diff --git a/.gitignore b/.gitignore
index 8e41ebb30..69cdadeb9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,6 +10,9 @@ lerna-debug.log*
 node_modules
 .emsdk
 native/libopus-fec-wasm/build
+electron/resources/private-transport/*/qortal-private-transport
+electron/resources/private-transport/*/qortal-private-transport.exe
+electron/tools/masque-relay/
 dist
 dist.zip
 dist-ssr
@@ -70,3 +73,6 @@ electron/resources/reticulum-runtime/*
 
 # PyInstaller / venv build scratch (build-rnsd-frozen.py)
 electron/.build/
+
+# Dependency notices generated by the wallet engine build
+/public/wallet-dependency-licenses.txt
diff --git a/docs/development.md b/docs/development.md
index c8f14df6e..caff76da1 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -2,7 +2,7 @@
 
 Requirements for the development of Qortal-Hub from sources:
 
-- installation of nodejs from the [official site](https://nodejs.org/en/download)
+- installation of Node.js 22.12 or newer from the [official site](https://nodejs.org/en/download)
 - Python 3.9+ and Git on PATH for Reticulum networking during Electron development
 - an IDE like vscode or Intellij, or similar tools
 - some knowledge of React and its ecosystem
diff --git a/docs/local-wallet-signing.md b/docs/local-wallet-signing.md
new file mode 100644
index 000000000..d4d41fc05
--- /dev/null
+++ b/docs/local-wallet-signing.md
@@ -0,0 +1,551 @@
+# Local signing for Bitcoin-derived wallets
+
+## Purpose
+
+Qortal Hub previously sent a wallet's extended private key to Qortal Core when
+it needed Core to create and sign a BTC-family transaction. This worked, but it
+gave Core everything needed to spend from that wallet.
+
+This change moves transaction construction, approval and signing into Hub for:
+
+- Bitcoin (BTC)
+- Litecoin (LTC)
+- Dogecoin (DOGE)
+- DigiByte (DGB)
+- Ravencoin (RVN)
+
+Core now receives an extended **public** key (`xpub`) to find wallet activity and
+an already-signed transaction to broadcast. Hub does not send the wallet's
+extended **private** key (`xprv`) to Core, and it does not fall back to the old
+private-key endpoints when the new endpoints are unavailable.
+
+The main security property is simple:
+
+> Core can help find coins and publish a payment, but it no longer receives the
+> wallet key that can create payments.
+
+## Plain-language explanation
+
+Before this change, sending LTC was similar to handing Core the wallet key and
+asking Core to prepare, sign and send the payment.
+
+After this change, Core supplies public information about the wallet's coins.
+Hub prepares the payment, shows the existing Hub permission prompt and signs the
+approved payment locally. Core receives only the finished signed transaction and
+broadcasts it to the Litecoin network.
+
+A transaction signature is tied to the exact transaction. Core cannot change a
+recipient, amount, fee or input without making the signature invalid. The signed
+transaction also cannot be reused to authorize an unrelated future payment.
+
+Core still learns the wallet's public key and transaction history because it
+performs discovery. This is a privacy consideration, but an xpub cannot sign or
+spend funds.
+
+## What changed
+
+| Feature                 | Previous behavior                                                                                 | New behavior                                                                                                     |
+| ----------------------- | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
+| Normal BTC-family sends | Hub sent the xprv to a Core send endpoint; Core constructed, signed and broadcast the transaction | Core supplies public spend data; Hub constructs, approves and signs locally; Core broadcasts signed bytes        |
+| Q-App `SEND_COIN`       | The request eventually used Core's private-key send API                                           | The Q-App contract stays the same; Hub routes it through local signing                                           |
+| Wallet Send UI          | Core performed signing                                                                            | The existing Hub permission prompt authorizes a locally signed transaction                                       |
+| Buy-order funding       | Core used the wallet key to fund the trade                                                        | Hub validates the returned HTLC plan and signs its funding transaction locally                                   |
+| Fees                    | A caller could provide a fee rate, with Hub defaults otherwise                                    | Custom fee rates remain supported; when omitted, Hub uses Core's configured rate and applies local safety limits |
+| Send maximum            | No common local-signing path                                                                      | `sendMax: true` spends available confirmed funds minus the calculated fee                                        |
+| Uncertain broadcasts    | A retry could risk constructing another payment                                                   | Hub journals the exact signed bytes and only offers to rebroadcast that transaction                              |
+| Concurrent sends        | Requests could overlap                                                                            | Overlapping sends for the same wallet and coin are rejected                                                      |
+
+## What did not change
+
+- Q-Apps continue to call `qortalRequest()` with `SEND_COIN` or
+  `CREATE_TRADE_BUY_ORDER`.
+- Q-Apps never receive wallet private keys or raw signing access.
+- The user still receives the normal Hub permission request. There is no second
+  Electron confirmation dialog.
+- QORT sending is unchanged.
+- Pirate Chain (ARRR) keeps its separate wallet and transaction implementation.
+- Public nodes can serve BTC-family sends and QORT trade buys through the local
+  signer; creating sell offers and all ARRR trading still require a local node.
+  Hub does not route public-node purchases through a trading proxy.
+- Core's existing trade state machine still watches, redeems and refunds swaps.
+- Legacy Core send endpoints remain available for older clients, but this Hub
+  does not use them for BTC, LTC, DOGE, DGB or RVN.
+- Existing wallet derivation remains unchanged, so existing addresses and funds
+  remain in the same wallets.
+
+## Ordinary send flow
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant Caller as Wallet UI / Q-App
+    participant Hub
+    participant Core
+    participant Network as BTC-family network
+
+    Caller->>Hub: Request payment
+    Hub->>Core: xpub + expected chain ID
+    Core->>Network: Discover address history and confirmed UTXOs
+    Core-->>Hub: Public spend context
+    Hub->>Hub: Validate data and build transaction plan
+    Hub->>User: Existing amount, recipient and fee approval
+    User-->>Hub: Approve
+    Hub->>Core: Refresh public spend context
+    Core-->>Hub: Current spend context
+    Hub->>Hub: Revalidate and sign locally
+    Hub->>Hub: Persist exact signed bytes
+    Hub->>Core: Signed transaction bytes
+    Core->>Network: Broadcast exact transaction
+    Network-->>Core: Transaction ID
+    Core-->>Hub: Transaction ID
+    Hub-->>Caller: Transaction ID
+```
+
+Hub refreshes the spend context after approval. If the wallet, selected node,
+inputs, outputs or trade intent changed during approval, Hub stops instead of
+signing stale information. A changed fee recommendation also stops a payment
+that relies on that recommendation, but it does not replace a fee explicitly
+supplied by the caller.
+
+## Q-App compatibility
+
+An ordinary Q-App send keeps the existing request shape:
+
+```js
+const txId = await qortalRequest({
+  action: 'SEND_COIN',
+  coin: 'LTC',
+  destinationAddress: 'ltc1...',
+  amount: '0.10000000',
+});
+```
+
+`recipient` is also accepted by the existing handler. A Q-App can continue to
+supply `fee` in coin-per-byte units:
+
+```js
+const txId = await qortalRequest({
+  action: 'SEND_COIN',
+  coin: 'LTC',
+  recipient: 'ltc1...',
+  amount: '0.10000000',
+  fee: '0.00000020',
+});
+```
+
+To spend the confirmed available balance minus the transaction fee:
+
+```js
+const txId = await qortalRequest({
+  action: 'SEND_COIN',
+  coin: 'LTC',
+  destinationAddress: 'ltc1...',
+  sendMax: true,
+});
+```
+
+`sendMax: true` must not be combined with `amount`. Q-Apps do not construct a
+PSBT, provide an xpub or call the new Core endpoints themselves. Hub owns those
+details and returns the resulting transaction ID through the existing Q-App
+response path.
+
+## Fee handling
+
+Private keys are unrelated to fee discovery. Core already has a configured fee
+rate for each supported network, expressed per 1,000 bytes. The public spend
+context exposes this as an integer atomic-unit rate per byte, rounded upward.
+
+Hub uses that rate when the request omits `fee`. If the request supplies a custom
+positive rate, Hub honors it as the previous Core send flow did. Independent
+per-coin ceilings still limit the rate and total fee. Hub calculates the fee
+from the actual transaction plan and displays the planned fee in its normal
+permission prompt.
+
+The value is a configured recommendation, not a live mempool estimate. A future
+fee-estimation change can improve that recommendation without changing where the
+private key lives.
+
+## Core API contract
+
+All endpoints are authenticated with the normal Core API key.
+
+### Public spend context
+
+```http
+POST /crosschain/{btc|ltc|doge|dgb|rvn}/wallet/public/spend-context
+Content-Type: application/json
+```
+
+```json
+{
+  "xpub58": "<root extended public key>",
+  "expectedChainId": "bip122:<mainnet genesis identifier>"
+}
+```
+
+The version 1 response contains:
+
+- the currency, mainnet identity and transaction-format constants;
+- the current chain height;
+- the minimum non-dust output and recommended fee rate as decimal strings;
+- confirmed UTXOs with their receive/change derivation paths;
+- the public scripts, values and full previous transactions needed to validate
+  and sign legacy inputs.
+
+Core rejects private extended keys and mismatched chain IDs. Discovery scans
+both receive and change branches with a 20-address gap limit. It is bounded to
+2,000 keys per branch, 1,000 outputs and 8 MB of distinct previous transaction
+data. Exceeding a bound fails the request instead of returning a partial wallet.
+
+For performance, Core checks address history, including mempool history, for the
+full gap. It only requests unspent outputs for addresses that have history. A
+normal wallet with one used address therefore needs roughly 42 address queries
+instead of the original implementation's 82. Hub intentionally performs a fresh
+scan after approval so it does not sign using stale inputs.
+
+### Broadcast
+
+```http
+POST /crosschain/{btc|ltc|doge|dgb|rvn}/send/broadcast
+Content-Type: application/json
+```
+
+```json
+{
+  "expectedChainId": "bip122:<mainnet genesis identifier>",
+  "rawTransactionHex": "<locally signed transaction>"
+}
+```
+
+Core parses and structurally verifies the transaction, broadcasts the exact
+bytes, and requires the Electrum server to return the transaction ID calculated
+from those bytes. It returns that transaction ID to Hub. A broadcast response is
+an acknowledgement, not a blockchain confirmation.
+
+### Exact transaction status
+
+```http
+POST /crosschain/{btc|ltc|doge|dgb|rvn}/wallet/public/transaction-status
+Content-Type: application/json
+```
+
+```json
+{
+  "expectedChainId": "bip122:<mainnet genesis identifier>",
+  "txId": "<transaction ID>"
+}
+```
+
+This lightweight endpoint looks up only the transaction Hub already signed. It
+does not receive the wallet xpub or private key. Core returns `UNKNOWN`,
+`MEMPOOL` or `CONFIRMED`, together with the exact coin, network, chain ID and
+transaction ID so Hub can reject a response for the wrong chain or transaction.
+
+### Local trade preparation
+
+```http
+POST /crosschain/tradebot/respond/local
+Content-Type: application/json
+```
+
+```json
+{
+  "addresses": ["<AT address>"],
+  "xpub58": "<root extended public key>",
+  "receivingAddress": "<Qortal address>",
+  "expectedChainId": "bip122:<mainnet genesis identifier>"
+}
+```
+
+The response contains the HTLC destinations, amounts, redeem scripts, refund
+public-key hashes, secret hashes and lock times that Hub must validate before it
+funds the trades.
+
+## Local transaction construction and signing
+
+Hub uses pinned `@scure/btc-signer` 2.4.1 for transaction parsing,
+address/script encoding, BIP 174 PSBT handling, signature hashes, signing and
+finalization. It uses the existing HD wallet roots and derivation scheme, so the
+change does not create new wallets.
+
+The local flow performs these checks:
+
+1. Parse the public spend context with strict type, size and network checks.
+2. Verify each previous transaction hash and the referenced output index.
+3. Verify each UTXO's value and locking script against its previous transaction.
+4. Derive the public child key at the supplied path and verify that it owns the
+   input address and script.
+5. Select confirmed inputs and calculate outputs, change and fee with integer
+   atomic units (`bigint`), avoiding floating-point money calculations.
+6. Validate recipient formats and per-coin policy bounds.
+7. Obtain permission through Hub's existing approval dialog.
+8. Fetch current spend data and require the planned transaction to remain the
+   same.
+9. Build a PSBT containing full previous transactions, derivation metadata,
+   final sequences and `SIGHASH_ALL`.
+10. Rebuild and compare the expected PSBT at the signer boundary before accessing
+    the key.
+11. Sign locally, finalize the transaction and compare its unsigned bytes with
+    the approved unsigned transaction.
+12. Verify the final fee, transaction ID and serialized size before persistence
+    and broadcast.
+
+The PSBT and private key are never included in a Core request.
+
+## Desktop, browser and Android behavior
+
+On Electron, Hub transfers the five BTC-family roots to an in-memory main-process
+signer session when the wallet unlocks. The signer provides public-key lookup and
+transaction signing operations; it does not expose key export or arbitrary
+message/digest signing. IPC is restricted to the main Hub window's main frame.
+
+The normal Hub permission prompt occurs before the signing request. The signer
+does not display a duplicate native confirmation. It still reconstructs and
+validates the expected transaction before signing. Logout, account replacement,
+navigation, renderer failure or window destruction clears the signer session.
+The signer does not persist its private keys.
+
+Browser and Android builds perform the same transaction construction, checking
+and signing locally in their application context. They also keep the private key
+out of Core requests.
+
+## Trade funding
+
+Local funding supports ACCTv3 buy orders for the five listed coins. Core first
+creates and durably stores a pending trade record in
+`ALICE_WAITING_FOR_FUNDING` (state 80), including the watch-only wallet xpub and
+the separate trade key and secret. It then returns the funding plan.
+
+Hub binds that plan to the selected offers and verifies:
+
+- AT identity and requested Qortal receiving address;
+- seller public-key hash;
+- HTLC redeem script and derived P2SH address;
+- foreign amount plus the bounded funding reserve;
+- lock time and expiration window.
+
+Hub signs one transaction containing the validated HTLC outputs. Core observes
+confirmed funding and continues the existing offer-message, AT-lock, redeem and
+refund state machine, including when Hub is closed.
+
+The trade-specific private key and secret remain in Core because Core needs them
+to complete or refund an active trade. They are newly generated for that trade
+and are not the wallet's root private key. This change is specifically about
+keeping the reusable BTC-family wallet xprv out of Core.
+
+Repeated preparation of the same pending trade is idempotent. Existing trades
+are not rewritten or deleted. An older Core must not replace an updated Core
+while state 80 trades exist because it does not understand that state.
+
+## Broadcast journal and duplicate-payment prevention
+
+A network timeout does not prove that a broadcast failed. Creating a new payment
+after a timeout can spend a second set of inputs and pay twice.
+
+Before broadcast, Hub saves:
+
+- the transaction ID;
+- the exact signed transaction bytes;
+- the input outpoints reserved by the transaction;
+- the broadcast deadline for time-sensitive trade funding.
+
+Electron stores this in a dedicated fsynced journal and uses exclusive creation
+to arbitrate concurrent application instances. Browser and Android use local
+storage and Web Locks where available. Overlapping sends for the same wallet and
+coin are rejected rather than queued.
+
+Hub keeps a reservation after a successful broadcast acknowledgement. It checks
+the exact transaction on login, when the selected Core changes, when the window
+regains focus, every minute while the wallet is unlocked, and before another
+send. A confirmed transaction clears the reservation automatically. If this
+happens during a new send, that send continues to its normal payment approval.
+An unconfirmed mempool transaction remains reserved and blocks a new payment.
+
+If a Core reports `UNKNOWN`, Hub keeps the reservation because a newly selected
+or out-of-sync Core might simply not have seen the transaction yet. The next
+send can offer to rebroadcast only the exact saved bytes with explicit
+permission. Recovery never builds a replacement transaction and never reports
+an older recovered payment as success for a new request. Changing Core aborts
+an in-flight automatic check, and the result is ignored unless the same wallet
+and Core are still selected.
+
+Corrupt journal entries, old entries without saved bytes, expired trade-funding
+transactions and abandoned desktop lock files fail closed and require manual
+investigation.
+
+## Security properties and trust boundaries
+
+This change provides the property it was designed for: **Core does not receive
+the reusable BTC, LTC, DOGE, DGB or RVN wallet private key from the updated
+Hub.**
+
+It also limits what Core can do with a valid signed transaction. The signature
+commits to its inputs and outputs, so changing payment details invalidates it.
+Hub independently enforces fee and response-size ceilings before signing.
+
+The remaining trust boundaries are:
+
+- Core supplies chain data. Hub validates internal consistency and ownership,
+  but does not independently synchronize block headers or verify inclusion
+  proofs.
+- Core sees the wallet xpub and can observe its derived address history.
+- Core retains separate per-trade keys and secrets for swap execution and
+  refunds.
+- Electron's main process holds the BTC-family roots in memory while the wallet
+  is unlocked.
+- The existing Qortal unlock and seed-derivation flow still runs in the renderer,
+  and Qortal's Ed25519 secret contains the account seed used to derive these
+  wallets. This is not a hardware-backed or fully isolated seed vault.
+- JavaScript strings cannot be reliably zeroized; clearing a session releases
+  references but cannot guarantee immediate memory erasure.
+
+These limits do not change the primary result: no updated Hub request sends the
+wallet xprv to Core.
+
+## Supported transaction scope
+
+The current implementation supports:
+
+- mainnet BTC, LTC, DOGE, DGB and RVN;
+- confirmed legacy P2PKH wallet inputs using existing receive/change derivation;
+- P2PKH and P2SH recipients for all five coins;
+- witness-v0 recipient outputs for BTC, LTC and DGB;
+- ordinary coin transfers and ACCTv3 trade funding.
+
+It does not add:
+
+- SegWit wallet-input derivation;
+- Taproot;
+- Litecoin MWEB;
+- Ravencoin asset transactions;
+- testnet wallets;
+- ACCTv1 local funding;
+- proxy-node trade buys;
+- fresh change-address allocation (change currently returns to a verified
+  selected input address).
+
+PSBT expansion is limited to 8 MB of repeated previous-transaction data and 256
+MiB of repeated validation work. Very fragmented wallets may need smaller
+payments.
+
+## Failure behavior and compatibility
+
+Hub fails rather than sending a private key when Core does not support the new
+endpoints. Users must run matching updated Hub and Core versions.
+
+Typical failures include:
+
+- `upgrade`: Core or the desktop bridge does not expose the required API;
+- `changed`: the wallet, node, spend data or trade intent changed during the
+  approval/signing flow;
+- `declined`: the user rejected Hub's normal permission request;
+- `pending`: another send is active or a previous transaction remains reserved;
+- `confirming`: the prior payment is in the mempool and remains reserved;
+- `unknown`: broadcast outcome is uncertain, so the exact transaction remains
+  journaled for safe recovery;
+- `invalid`: input, response, address, amount, fee or signed transaction
+  validation failed.
+
+## Implementation map
+
+The main Hub components are:
+
+- `src/qortal/get.ts`: routes normal sends and trade buys to local signing;
+- `src/qortal/foreign-coin-send.ts`: connects Q-App/UI requests to the signer,
+  Core endpoints, permission flow and journal;
+- `src/qortal/local-trade-funding.ts`: prepares and validates local ACCTv3
+  funding;
+- `src/lib/foreign-wallet/send.ts`: approval, refresh, signing, persistence,
+  recovery and broadcast orchestration;
+- `src/lib/foreign-wallet/foreign-wallet-spend-plan.ts`: public-only input and
+  output planning;
+- `src/lib/foreign-wallet/foreign-wallet-transaction.ts`: PSBT construction,
+  signing and signed-transaction inspection;
+- `src/lib/foreign-wallet/foreign-wallet-spend-context.ts`: strict Core response
+  parsing;
+- `src/lib/foreign-wallet/trade-plan.ts`: HTLC-plan verification;
+- `src/lib/foreign-wallet/desktop-engine.ts`: Electron signer state and signing
+  validation;
+- `electron/src/foreign-wallet-signer.ts`: restricted main-process signer
+  adapter;
+- `electron/src/foreign-wallet-journal.ts`: durable pending-transaction journal.
+
+The main Core components are:
+
+- `LocalWalletSupport`: public wallet discovery, exact transaction status and
+  signed-byte broadcast;
+- `ForeignWalletRequest`: discovery, status and broadcast request model;
+- the five `CrossChain*Resource` classes: coin-specific endpoint exposure;
+- `LocalTradeFunding`: durable local trade preparation and progression;
+- `CrossChainTradeBotResource`: local funding endpoint;
+- the five ACCTv3 trade bots and `TradeStates`: state 80 handling;
+- `LocalWalletResponseWriter`: exact JSON serialization for public wallet and
+  trade-plan responses.
+
+## Validation
+
+Hub's focused tests cover all five networks, PSBT construction and signing,
+public-only planning, forged previous transactions and amounts, wallet changes,
+fee limits, trade-plan validation, response-size limits, journal persistence,
+ambiguous broadcasts, exact-byte recovery, concurrent requests and permission
+declines.
+
+Core's tests use bitcoinj independently to verify the Hub-generated signatures
+for all five networks. They also test private-key rejection, chain mismatch,
+forged data, exact-byte broadcasting, query behavior, idempotent trade
+preparation and the actual Jersey HTTP serialization used by Hub. Test fixtures
+under `src/test/resources/crosschain/local-wallet/` use synthetic, publicly known
+keys and must never receive real funds.
+
+Run the focused checks with:
+
+```bash
+# Hub
+npx vitest run src/lib/foreign-wallet \
+  src/qortal/foreign-coin-send.test.ts \
+  src/qortal/local-trade-funding.test.ts \
+  src/qortal/wallet-response.test.ts \
+  src/qortal/__tests__/createBuyOrder.test.ts \
+  src/utils/chromeStorage.foreign-wallet.test.ts \
+  electron/src/foreign-wallet-journal.test.ts
+
+# Core (Core skips JUnit unless explicitly enabled)
+mvn -DskipJUnitTests=false \
+  -Dtest=LocalWalletTests,LocalWalletApiTests test
+```
+
+Automated tests do not send real funds. A controlled release test should still
+cover a funded send and complete trade/redeem/refund lifecycle.
+
+## Build and deployment
+
+Both Hub and Core must be deployed together.
+
+For Hub:
+
+```bash
+npm run build
+npx cap sync @capacitor-community/electron
+```
+
+The Hub build bundles the shared signing engine and its pinned dependencies into
+`electron/build/foreign-wallet-engine.cjs`. The Electron build invokes the same
+bundle step. Dependency license notices are generated from the bundled packages.
+
+For Core:
+
+```bash
+mvn -DskipJUnitTests=true package
+```
+
+Install the resulting Core JAR and restart Core. An existing running process
+continues using its old classes until it is restarted.
+
+## References
+
+- [BIP 174: Partially Signed Bitcoin Transaction Format](https://bips.dev/174/)
+- [Scure BTC Signer security documentation](https://github.com/paulmillr/scure-btc-signer#security)
+- [Electron context isolation](https://www.electronjs.org/docs/latest/tutorial/context-isolation)
+
+Using an audited library reduces custom cryptographic code, but a library audit
+does not audit Hub's integration or future dependency versions.
diff --git a/docs/masque-relay-access.md b/docs/masque-relay-access.md
new file mode 100644
index 000000000..61a5181b4
--- /dev/null
+++ b/docs/masque-relay-access.md
@@ -0,0 +1,110 @@
+# MASQUE relay admission
+
+Hub's relay admission is generic transport infrastructure. QApps and application
+backends never receive relay tickets and do not participate in authorization.
+
+## Flow
+
+1. Discover signed availability over Reticulum. Public relays remain v1/v2;
+   restricted relays must use v3. Do not fall back to the old account proof.
+2. Prefer reusable connections, then public/matching-group relays, then unknown
+   membership. Coalesce selection and hedge after 300 ms, at most two concurrent
+   candidates and six attempts within a 60-second cold-path budget.
+   Fresh membership information excludes nonmatching restricted relays, even
+   if none remain. That case returns `RELAY_NO_ELIGIBLE_RELAY` without requesting
+   tickets or opening QUIC. Unknown or stale membership still permits trying
+   a relay; public relays remain eligible.
+3. For restricted relays, fetch the current public ticket descriptor through an
+   encrypted Reticulum Link. Check its relay pin, group-policy hash and key
+   commitment against the signed advertisement. Native Go additionally validates
+   the RSA key, derived key ID and shared hourly expiry.
+4. Generate three independent random tickets and blind them with CIRCL v1.6.5
+   (RFC 9474 RSABSSA-SHA384-PSS-Deterministic). Sign a one-minute issuance challenge
+   in the trusted wallet context. The challenge binds the blinded batch.
+5. Send the account proof **only through Reticulum**. The relay checks account
+   ownership and group membership, then blind-signs the batch. Unblind and
+   verify inside native Go. Store resulting tickets only in Hub main memory.
+6. Prepare pinned QUIC and redeem one anonymous ticket. No account address,
+   public key or wallet signature goes over QUIC. Only then attach a backend.
+7. Use spare single-use tickets for reconnects; refresh batches when exhausted
+   or near expiry. Reuse the authorized outer connection across QApps. Renew
+   five minutes before expiry without replacing the connection.
+8. Logout/account switch clears credentials, pending results, timers and
+   connections. There is no direct-to-backend fallback.
+
+Expiry is issuance-hour start plus 12 hours (11–12 hours of actual validity).
+Redemption never extends it. The relay commits a spent marker durably before
+forwarding, including across crashes/restarts. Existing grants and spare tickets
+do not require Core availability. A member removed from a group can retain
+access for the remaining window, subject also to Core freshness.
+
+## Protocol and packaging
+
+Sidecar version: **0.7.0**; IPC framing remains version 2. Main-only operations:
+`prepareRelayTickets`, `finalizeRelayTickets`, `prepareRelay`, `authorizeRelay`,
+`closeRelay`, `clearRelays`. Native ticket blinding state is bounded and expires
+after a minute. Prepared connection handles remain process-local.
+
+The Reticulum service uses the persistent discovery identity and destination
+`qortal-hub-v3.community-masque-relay.v1`. Request paths are `/catalog`,
+`/challenge`, `/issue`; serialized JSON requests are transported as encrypted
+RNS Link requests/resources, not announcements. The Hub Python handler uses a
+dedicated four-worker bound and tears down each temporary link after response.
+
+A v3 advertisement has a three-byte header (version; IPv6 bit plus name length
+minus one; group count), IP, uint16 port, uint32 lease expiry, TLS pin, name,
+canonical LEB128 group IDs, full 64-byte Reticulum public identity, 32-byte
+ticket-key commitment, and 64-byte Ed25519 signature. Signature domain:
+`Qortal-MASQUE-Discovery-v3\\0`. Total is at most 316 bytes, including 16
+maximum-size IDs with IPv6 and the default relay name. The shared codec ships
+beside the bridge and in frozen/packaged builds.
+
+Policy digest: SHA-256 of compact JSON
+`{"Mode":"groups","Groups":[sorted IDs]}`.
+
+Ticket key ID: SHA-256 of
+`Qortal-MASQUE-Ticket-v1\\0 || policyHex || relayPinHex || decimalEpoch || PKCS1PublicDER`.
+Epoch is floor(Unix seconds / 3600). Ticket signed message:
+`Qortal-MASQUE-Ticket-v1\\0 || keyIdHex || random32`.
+Redemption JSON contains only epoch, keyId, base64 message and base64 signature.
+
+Issuance proof type: `masque-ticket-issue-v1`, with relayPin, policy, binding,
+nonce, expiresAt. Binding is SHA-256 of compact JSON
+`{"key":keyId,"blinded":[base64 blinded messages]}`.
+The wallet adds authorAddress/authorPublicKey and Ed25519-signs the sorted JSON,
+excluding signature. Public key and signature are Base58. This domain is only
+available to Hub's own wallet context, not an iframe.
+
+QUIC control still uses `Qortal-Relay-Control: authorize`. A restricted,
+unauthorized connection returns 401 and
+`Qortal-Relay-Challenge: {"type":"masque-ticket-required-v1"}`.
+Main passes a ticket to the sidecar, which transmits `Qortal-Relay-Ticket`.
+An authorized connection returns 204 and `Qortal-Relay-Expires`.
+Renewal sets `Qortal-Relay-Renew: 1`. Account-shaped proofs are rejected
+independently by native Go and the relay.
+
+## Boundaries
+
+This assumes the Reticulum authorization path hides the user's IP. Blind signing
+prevents direct transcript-to-ticket matching, not timing correlation, small-group
+inference, malicious issuer equivocation, or deliberate ticket sharing. A signed
+key commitment is not a global key transparency system. Do not claim full anonymity
+or non-transferable membership enforcement.
+
+The standalone relay's ACCESS.md describes operator configuration, persistence,
+capacity, Core failover and deployment. Public mode remains the default; enabling
+groups requires an explicit operator choice. Update/restart Hub and the relay,
+not the Call backend/QApp. Never restore old spent-ticket state alongside retained
+signing keys.
+
+## Verification
+
+- `npm run test:private-transport` with `QORTAL_GO_BINARY` when necessary.
+- `npx vitest run electron/src/relay-access-coordinator.test.ts electron/src/relay-ticket-wallet.test.ts src/background/reticulum-signing-policy.test.ts`.
+- `python3 -m unittest presence_bridge_test` from electron/resources.
+- `go test -race ./...` from electron/native/private-transport.
+- Relay's cross-project Python test exercises the actual Hub Python handler,
+  isolated Reticulum instances, real sidecar/relay binaries and a mock Core,
+  including denial, forwarding, spare tickets and replay after restart.
+
+These checks do not replace a real macOS wallet/cross-network smoke test.
diff --git a/docs/private-upload-investigation.md b/docs/private-upload-investigation.md
new file mode 100644
index 000000000..f3ca47c1c
--- /dev/null
+++ b/docs/private-upload-investigation.md
@@ -0,0 +1,135 @@
+# Private upload throughput investigation — 2026-09-12
+
+## Confirmed in the local transport fixture
+
+quic-go's HTTP/3 `stateTrackingStream.enqueueDatagram` silently drops received
+datagrams once its per-stream queue contains 32 packets. The outer QUIC layer
+can already have acknowledged these packets, so outer packet-loss statistics
+do not expose this discard. Inner QUIC must recover the missing tunnel packets.
+
+A test-only Go workspace and overlay instrumented that exact discard branch.
+The module cache, running Hub, and VPS binaries were not modified.
+
+The opt-in `QORTAL_BULK_BENCH=1` test in
+`electron/src/private-channel-step3.test.ts` sends 64 opaque 524,886-byte messages
+over one keyed reliable stream with two concurrent native submissions. The
+fixture returns small acknowledgements. A local UDP proxy adds 60 ms in each
+direction. It does not intentionally drop packets; its explicit drop counter
+does not measure OS socket drops or packet reordering.
+
+| HTTP/3 receive queue | Seconds for 33,592,704 bytes | MB/s (decimal) | Instrumented relay queue drops | Inner reported loss | Outer reported loss |
+| --- | ---: | ---: | ---: | ---: | ---: |
+| 32, run 1 | 6.297 | 5.33 | 25 | 25 | 0 |
+| 32, run 2 | 9.803 | 3.43 | 194 | 194 | 0 |
+| 1024, run 1 | 2.416 | 13.91 | 0 | 191 | 13 |
+| 1024, run 2 | 3.664 | 9.17 | 0 | 972 | 458 |
+
+The larger queue is an experiment, not a proposed production default. It removes
+this discard point but does not remove all loss or reproduce a real network
+perfectly. The exact match between the instrumented discard count and inner loss
+in both stock-queue runs establishes a concrete loss mechanism in this fixture.
+
+## Production applicability and limits
+
+The VPS relay checkout at inspection was `8cbdaf3`, declaring quic-go v0.60.0
+and masque-go v0.4.0. v0.60.0 has the same 32-packet discard branch as the Hub
+fixture's v0.62.0. This identifies a relevant production risk, not a direct
+measurement of the running VPS relay's discard count.
+
+Earlier real-upload diagnostics showed inner loss with no outer loss and little
+time spent in encryption or backend disk synchronization. Those observations are
+consistent with this mechanism, but do not prove it accounts for all slow upload
+time. The fixture uses a Go receiver, not the production Python backend, and
+does not include QApp encryption, browser work, or storage.
+
+## Follow-up
+
+- Add bounded, observable tunnel receive buffering, with per-tunnel and aggregate
+  memory limits; do not replace the cap with unbounded queues.
+- Check receive draining, burst handling and loss at the other queue boundaries.
+- Measure throughput and media latency together before choosing production bounds.
+- Validate on the actual relay/backend path before claiming a production speed fix.
+
+## Implemented validation
+
+The final implementation uses bounded rings at both DATAGRAM receive layers,
+not the experimental constant-only change. Large limits are enabled after
+admission, shared accounting is capped at 32 MiB, and packets older than 50 ms
+are discarded when processed. Upstream raw packet safety limits remain intact.
+
+With small datagrams every 20 ms on the same inner connection:
+
+| Transfer | Simulated RTT | Elapsed | MB/s | Small datagrams received | Small datagram p95 RTT |
+| --- | ---: | ---: | ---: | ---: | ---: |
+| 33,592,704 bytes | 120 ms | 2.174 s | 15.45 | 104 / 104 | 181 ms |
+| 134,370,816 bytes | 120 ms | 6.128 s | 21.93 | 294 / 294 | 170 ms |
+
+Both runs reported zero full/budget/expiry drops at the new receive queues.
+The longer run's new raw-packet counter reported 58 drops at QUIC's existing
+256-packet unprocessed-packet cap. Inner loss was 57 packets and outer loss 18;
+these numbers measure different points and must not be subtracted to infer
+another exact loss count. The raw cap remains unchanged for flood protection.
+This local fixture is not evidence that the VPS has those exact raw drops.
+
+Validation passed: queue bounds/order/ownership/expiry/close/global-budget tests
+under the race detector; upstream QUIC and HTTP/3 race tests; Hub native race
+tests; 42 Electron transport tests; relay race tests; TypeScript checking; the
+relay Docker build stage; real Hub-sidecar/relay membership, renewal, replay and
+logout integration using isolated loopback Reticulum and generated test accounts.
+
+The VPS services were not modified by this implementation. Real deployment and
+a live-path measurement are still required to establish the user-visible speed.
+
+## Production Python receiver reproduction
+
+After deploying the relay and restarting Hub 0.10.1, a real upload still delivered
+about 84 MB in 40 s. Encryption consumed only 0.227 s of measured cumulative time;
+file reads 3.334 s. Native sends averaged 458 ms and acknowledgements 593 ms per
+roughly 512 KiB batch. These are overlapping request times, not additive durations.
+No receive-pressure reports appeared from the updated relay. The backend socket
+had `rb212992` and 3869 cumulative kernel drops (not attributable to one upload).
+
+The Step 4 opt-in benchmark now exercises the real Python QUIC server, parser,
+signed session authentication, bootstrap and attachment through the patched relay
+and sidecar. It sends the same 64 x 524886-byte reliable messages with two native
+sends in flight and 120 ms simulated RTT. A benchmark-only binary handler returns
+a small acknowledgement; storage, file encryption and browser work are excluded.
+
+| Receiver variant | Effective Linux socket receive buffer | Seconds | MB/s | Kernel drops / inner loss |
+| --- | ---: | ---: | ---: | ---: |
+| Production asyncio, default socket | 212992 bytes | 12.591 | 2.67 | 772 / 772 |
+| Production asyncio, 4 MiB SO_RCVBUF request | 8388608 bytes | 5.993 | 5.61 | 0 / 0 |
+| Test-only uvloop, same buffer | 8388608 bytes | 4.162 | 8.07 | 0 / 0 |
+| Test-only uvloop + coalesced transmit scheduling | 8388608 bytes | 3.392 | 9.90 | 238 / 238 |
+
+Linux reports doubled SO_RCVBUF accounting. Changing this setting is not itself
+a complete fix: inner RTT rose to 336 ms in the larger-buffer asyncio run and
+235 ms with uvloop, versus roughly 120 ms at the unchanged outer connection.
+The coalescing experiment still overflowed. These are diagnostic experiments,
+not approved production settings or a claim that buffering alone resolves this.
+
+Without profiling, the larger-buffer asyncio receiver consumed 4.98 CPU seconds
+for its 5.99-second transfer. A separate cProfile run (not a throughput result)
+recorded about 28900 UDP callbacks and transmit checks. Major costs were QUIC
+packet receive/send preparation, repeated header parsing, event-loop dispatch,
+and framing. AEAD decryption was about 0.16 s self-time in that profiled run.
+
+This reproduces the low-throughput symptom with the actual Python transport
+without any storage involvement. The socket drop count exactly matching inner
+loss establishes a second loss point. It also establishes substantial per-packet
+processing cost even when socket drops are eliminated. The remaining work is
+the backend receive path, including a bounded buffer and efficient processing /
+scheduling, with mixed-traffic latency validation—not another relay-only tweak.
+
+Reproduce from Hub's root with Go and uv available:
+
+```
+QORTAL_PYTHON_BENCH=1 npx vitest run electron/src/private-channel-step4.test.ts -t 'benchmarks real Python'
+```
+
+Diagnostic-only environment switches: `QORTAL_STEP4_PROFILE=1`,
+`QORTAL_STEP4_UVLOOP=1` (uses `uv run --with uvloop`, no production dependency
+change), and `QORTAL_STEP4_COALESCE=1`. These affect only the isolated fixture.
+
+Upstream implementation:
+https://github.com/quic-go/quic-go/blob/v0.60.0/http3/state_tracking_stream.go
diff --git a/docs/qapp-moq-transport.md b/docs/qapp-moq-transport.md
new file mode 100644
index 000000000..643b70885
--- /dev/null
+++ b/docs/qapp-moq-transport.md
@@ -0,0 +1,296 @@
+# Generic multi-track Q-App transport
+
+## Complete reliable objects (sidecar 0.11.0)
+
+`MOQ_OBJECT_PUBLISH` accepts one opaque reliable object using:
+
+```js
+payload: {
+  trackName: 'live',
+  objects: [bytes],
+  delivery: { priority: 1, maxQueueAgeMillis: 1500, groupId: 7, objectId: 1 }
+}
+```
+
+Both IDs must be nonnegative safe integers. The batch contains exactly one object,
+at most 1 MiB. Omitting both IDs selects datagrams, still limited to 1 KiB per
+object and eight objects per batch. Mixed/missing IDs are rejected, not downgraded.
+The authenticated bootstrap must advertise `moqtReliableGroups: true`; otherwise
+session opening fails with `UNSUPPORTED_MOQ_TRANSPORT`.
+
+Each complete object has its own reliable subgroup, with subgroup ID equal to
+object ID. IDs strictly increase within a group. A newer group replaces older
+dependencies on that publication; late objects from old groups are rejected.
+Applications, not Hub, decide what groups mean and authenticate metadata.
+
+Native delivery sends real FIN and resets outstanding retransmissions on expiry
+or group replacement. Write completion acknowledges QUIC admission, not remote
+receipt. Bounds: 64 leases / 2 MiB per publication, 4 MiB leased per session;
+incoming bound-track queues share 2 MiB plus 64 KiB reserved for small objects,
+and unknown aliases share 2 MiB. Wire fields are capped before allocation.
+Cancelled data streams are isolated; they do not close unrelated tracks.
+
+`reliableLeasedBytes` measures unexpired leases, not actual unacknowledged QUIC
+bytes. `receiveQueuedBytes`, inner RTT/minimum RTT and packet sent/lost counters
+support diagnosis. Datagram pacing is not a bandwidth estimate for streams.
+Publisher-priority headers are not a guarantee of QUIC stream priority; bounded
+admission and separate datagram delivery limit interference but cannot reserve
+physical bandwidth. Capture, codecs and payload encryption remain Q-App-owned.
+
+Update the backend bootstrap and media service together with Hub and the QApp.
+The relay needs no change. No fallback to fragmented delivery is provided.
+
+## Bounded tunnel receive buffering (sidecar 0.10.1)
+
+Hub and the standalone relay use documented local quic-go v0.62.0 / masque-go
+v0.5.0 replacements for bounded receive burst absorption. Both the QUIC DATAGRAM
+queue and the HTTP/3 tunnel queue use owned-payload FIFO rings, packet/byte caps,
+lazy 50 ms expiry, and one shared 32 MiB live-allocation budget per process.
+Ring storage is included; this is not a process RSS limit. Queue growth cannot
+bypass the shared budget. Large empty rings and closed queues release storage.
+
+The larger profile (1024 packets / 1 MiB charged packet data plus bounded ring
+slots) is enabled only after successful tunnel admission. Defaults before
+admission retain the upstream 32/128 packet caps. No QApp chooses memory limits.
+The relay still validates access and targets before opening or enabling a tunnel.
+
+Native session metrics distinguish HTTP/3 `tunnelReceiveDroppedFull`,
+`tunnelReceiveDroppedBudget`, `tunnelReceiveDroppedExpired` from corresponding
+`outerReceiveDropped*` QUIC receive-queue counters. They also expose tunnel queued
+bytes and maximum observed residence time. Outer counters include shared relay
+connection traffic. Expired residence times can exceed 50 ms; stale entries are
+never delivered. Relay pressure logs are numeric aggregates, rate-limited to one
+report per 30 seconds, including raw QUIC receive-queue overflow.
+
+This does not alter congestion control, packet encryption, stream priorities,
+capture, codecs, jitter policy or call logic. Encrypted packets remain opaque.
+FIFO buffering cannot guarantee priority or bandwidth across connections.
+
+Build/restart Hub with its matching 0.10.1 sidecar and rebuild the relay to gain
+both directions' improvements. No QApp or backend wire-protocol change is needed.
+Docker and native builds must include `third_party/`; Go 1.26+ is required.
+See the vendored `QORTAL_PATCH.md` files for maintenance and bounds tests.
+
+The opt-in `QORTAL_BULK_BENCH=1` Step 3 test sends 32 MiB through real MASQUE with
+0/120 ms simulated RTT while sending small datagrams every 20 ms. It reports
+throughput, receive drops and datagram p95 RTT; it requires at least 95% of the
+small packets to arrive with p95 below 500 ms. This is a local transport regression
+test, not a WAN speed guarantee or a full media-quality test.
+
+Sidecar 0.5.0 extends the existing owner-bound `PRIVATE_DATA_CHANNEL` capability.
+No capture, codec, media encryption, jitter, call membership, or media-specific
+priority policy lives in Hub.
+
+`MOQ_SESSION_OPEN` accepts `publicationTrack` as either the existing single
+string or an array of 1–8 distinct names, all under `publicationNamespace`.
+One logical session uses one inner QUIC/MoQ connection through MASQUE. The
+authenticated backend must subscribe to every declared publication before
+opening completes. Undeclared publications are rejected; relay recovery
+restores the same declarations and subscriptions with a fresh attach token.
+
+`MOQ_OBJECT_PUBLISH` continues to accept one `Uint8Array`. For explicit track
+selection and batching, `payload` may instead be:
+
+```js
+{ trackName: 'bulk', objects: [encryptedObject1, encryptedObject2] }
+```
+
+Batches have 1–8 objects, each 1–1024 bytes. They cross renderer/main/native IPC
+in one request; each remains a separate QUIC datagram, not a larger datagram.
+The native binary envelope prefixes each object with its uint16 big-endian
+length and validates the whole envelope before sending anything. A batch may
+partially send if the transport fails; it is never retried as reliable data.
+
+Admission is bounded at 16 KiB pending per publication and 64 KiB per session,
+with at most 128 subscriptions. A bulk publication cannot consume another
+publication's entire per-track allowance. Limits and owner checks apply equally
+to legacy and batch calls. The app should keep at most one bulk batch in flight;
+small batches give other publications opportunities to send between them.
+No stream has independent physical bandwidth: QUIC/MASQUE congestion control
+still applies to the connection. Track separation alone does not promise QoS.
+
+Recovered connections report interrupted publications as failed instead of
+claiming dropped stale objects were delivered. Media apps can request a fresh
+reference object; Hub does not interpret that object or decide media recovery.
+
+Tests cover owner isolation, declaration/batch limits, independent queue
+admission, malformed binary framing, and three opaque publication tracks on a
+real QUIC-through-MASQUE connection with a verified relay egress address.
+
+Deployment requires updated native Hub code and sidecar together; strict sidecar
+version checking rejects stale binaries. Existing single-track apps remain
+supported. Backends must implement routing for their own declared track names.
+
+The separate private reliable channel bounds each send (including waiting for
+another send) to five seconds, below Hub's seven-second sidecar request timeout.
+QUIC write deadlines interrupt flow-control stalls. Failed partial frames cancel
+the stream and report a recoverable transport closure; replacement connections
+have independent writers. Backend authorization rejections remain rejections.
+The private-channel attach exchange also observes its connection deadline.
+These limits do not change MoQ datagram delivery or media buffering.
+
+Private bootstrap rejection `transport_already_attached` is surfaced as
+`TRANSPORT_ALREADY_ATTACHED`, not a generic transport error. It is not retried
+against another relay: the authenticated backend session already owns a private
+transport. Apps should share their existing channel between consumers and route
+responses by message ID, releasing it only when the last consumer is finished.
+
+## Independent private reliable streams (sidecar 0.8.0)
+
+`PRIVATE_CHANNEL_SEND` accepts optional `streamOptions` on reliable messages:
+
+```js
+{ streamKey: 'opaque-stream-label', endStream: false }
+```
+
+Keys are 1–96 ASCII letters, digits, dots, underscores or hyphens. They are
+scoped to the owner-bound private channel; Hub does not interpret their names
+or payloads. Each key opens a distinct bidirectional QUIC stream under the
+existing attached connection. Omitting the option preserves the legacy stream.
+Datagrams cannot specify stream options. `endStream: true` writes a final frame
+and FIN; the receive half remains open for final replies (at most 30 seconds).
+Applications should use unique keys for finite tasks and finish them in cleanup.
+
+At most 32 keyed streams are live per connection. Each has an independent
+five-second send deadline and a 192 KiB Hub pending-send budget, within existing
+channel/owner budgets. A failed keyed write reports `RELIABLE_STREAM_FAILED`
+and resets only that stream; connection failures still use relay recovery.
+Streams share connection congestion control and the MASQUE path, not independent
+bandwidth. A stream key does not imply a priority class or bypass authorization.
+
+The sidecar IPC reader dispatches reliable sends through per-session/per-key
+queues, not inline. Each key preserves FIFO order while unrelated keys run
+independently. Admission is capped at 64 active keys, 16 queued jobs per key and
+4 MiB overall. Jobs waiting over one second fail without sending, keeping the
+queue plus five-second native write inside Hub's seven-second request deadline.
+Idle key workers are removed. This avoids moving stream head-of-line blocking
+into the IPC layer.
+
+The backend advertises `reliableStreams: true` in its ATTACHED frame. Missing
+support reports `RELIABLE_STREAMS_UNSUPPORTED`; it never silently multiplexes
+keyed traffic onto the old stream. Deploy the backend first, then updated Hub
+and sidecar together, then the QApp. The relay needs no change.
+
+## Paced, deadline-aware MoQ delivery (sidecar 0.9.0)
+
+Applications can supply generic local delivery policy on an object batch:
+
+```js
+{
+  trackName: 'opaque-track',
+  objects: [encryptedObject],
+  delivery: { priority: 0, maxQueueAgeMillis: 120 }
+}
+```
+
+Priority is 0 (latency-sensitive), 1 (live), or 2 (background).
+Queue lifetime is an integer from 10 to 2000 milliseconds. Legacy publications
+default to priority 1 and 200 milliseconds. These values neither grant access
+nor require Hub to interpret the payload. Backend applications assign their
+own outbound policies; an untrusted publisher cannot choose recipient priority.
+
+Each MoQ connection has one scheduler, not one independent rate limiter per
+track. It provides:
+
+- Weighted 8:4:1 service between priority classes; round-robin within a class.
+  Idle classes lend their unused service. FIFO order is preserved per track.
+- A 64 KiB per-track and 256 KiB total queue cap, with 32 KiB reserved capacity
+  for each other class. There are at most 128 queued tracks. Limits include
+  encoded MoQ bytes. Changing class while a track has pending objects is rejected.
+- Expiry before QUIC admission. Overload refuses new objects rather than
+  silently replacing arbitrary fragments of an existing object sequence.
+- A byte-credit pacer, initially 1 MB/s, with at most four datagrams / 4 KiB
+  in one burst and no accumulated idle credit beyond that burst allowance.
+- Conservative rate reduction on sustained packet loss / RTT inflation or a
+  blocked QUIC datagram send, with gradual recovery under demand. A stable high
+  RTT alone does not trigger reduction. This complements, never bypasses,
+  QUIC congestion control; it is not an independent bandwidth guarantee.
+
+Hub uses bounded, per-session/per-track IPC workers. A batch completes after
+scheduled QUIC admission (not remote acknowledgement). Different publications
+remain independent while one waits for pacing. Native IPC queue time counts
+toward the delivery deadline. Both admission and worker queues are bounded.
+A batch may partly transmit; it must never be blindly replayed.
+
+`MOQ_QUEUE_LIMIT` and `MOQ_OBJECT_EXPIRED` are expected pressure outcomes, not
+reasons to reconnect or switch relay. Connection failures retain existing
+recovery. Session close cancels queued work and releases blocked QUIC sends.
+
+Metrics expose `deliveryQueuedBytes`, `deliveryQueueDelayMillis`,
+`deliveryPacingBytesPerSecond`, `deliverySent`, `deliveryExpired`,
+`deliveryRejected`, and `deliverySendErrors`. Sent means handed to QUIC,
+not received by the peer. Applications retain receiver feedback and use these
+additional measurements for producer adaptation.
+
+### Boundaries and rollout
+
+The scheduler can expire data while it owns it; quic-go's public SendDatagram
+API cannot retract an object already admitted to its internal queue. All tracks
+still share congestion control, the outer MASQUE tunnel and physical bandwidth.
+This is not global QoS across independent QUIC connections or applications.
+Capture/encoding CPU starvation and receiver playout remain application concerns.
+
+No media keys, codecs, screen detection, or call policy were added to Hub.
+No relay protocol change is needed. Deploy the backend media service, then Hub
+with its matching 0.9.0 sidecar, then the QApp. An old backend remains wire
+compatible but does not provide scheduled downlink forwarding.
+
+Tests cover priority/fairness, per-track order, reservations and memory caps,
+expiry, pacing, slow-recipient isolation, shutdown, pressure without reconnect,
+policy validation, and scheduled forwarding over real QUIC through MASQUE.
+
+### Sidecar 0.9.1 validation fix
+
+Queue dispatch and execution share complete parameter types for reliable sends
+and MoQ publications. Both retain strict unknown-field rejection. Routing-only
+parameter structs incorrectly rejected messageId/endStream and batched/delivery
+before requests reached their handlers. Regression tests exercise the actual
+line-plus-binary Serve path, including legacy requests and malformed fields.
+Rebuild/restart Hub with the matching sidecar; no backend or relay update is
+required for this validation correction.
+
+### Bounded binary reliable messages (sidecar 0.10.0)
+
+Authenticated private channels expose `features.maxBinaryMessageBytes` (1 MiB
+minus the encoding byte). ArrayBuffer/typed-array messages larger than 64 KiB
+require a keyed reliable stream. JSON, primary-stream messages, and datagrams
+retain their existing limits. Hub treats the binary payload as opaque; applications
+own framing, encryption, durable acknowledgements, and idempotent retries.
+
+Large-message send admission uses separate budgets: 2 MiB per stream, 4 MiB per
+channel, 8 MiB per owner, and 32 MiB globally. Capacity is released when native
+submission completes or fails, not when the application's durable reply arrives.
+Small-message admission is independent. These are bounded queues, not a guarantee
+of bandwidth isolation: streams still share connection congestion control.
+
+The backend must advertise `maxReliablePayloadBytes` in its authenticated attach
+response. Missing/invalid advertisements retain the old 64 KiB ceiling; larger
+sends fail locally with `BULK_TRANSPORT_UNSUPPORTED`. Applications must negotiate
+their own binary protocol before using it. Rebuild/restart Hub with sidecar
+0.10.0 to enable the larger limit. No relay change is required.
+
+### Private transport diagnostics
+
+Native `sessionMetrics` also reports `innerPacketsSent/Lost`,
+`innerWireBytesSent/Lost`, and their `outer` counterparts, plus `outerRttMillis`.
+These are QUIC loss-detection estimates, not proof of physical packet loss:
+reordering can cause packets to be declared lost. Wire-byte totals include
+retransmissions and are distinct from the existing application-byte totals.
+Outer counters cover the pooled relay connection and can include other tunnels;
+do not add the same outer totals across sessions. Compare snapshots of a single
+connection during an isolated test. Loss totals may decrease when loss detection
+is corrected, so do not assume every delta is nonnegative.
+
+`tunnelWrites`, `tunnelWriteMicros`, and `tunnelWriteErrors` measure submission
+to the outer datagram transport for this tunnel. Time is cumulative across
+completed writes, not end-to-end delivery time. Existing `datagramsDropped` is
+an application-datagram submission error count, not a network-loss counter.
+These measurements contain no account IDs, endpoints, payloads, or keys. They
+do not change queue limits, congestion algorithms, or retry behavior.
+
+Reliable native sends share a six-second queue-and-write budget under the
+seven-second IPC timeout; individual writes remain capped at five seconds.
+Queue expiry before any write returns `RELIABLE_SEND_NOT_STARTED`, which an
+application can safely back off and retry. Actual write failures still reset
+the affected stream and must not be treated as unsent work. MoQ retains its
+existing expiry policy; queue memory/admission limits are unchanged.
diff --git a/docs/qapp-reticulum.md b/docs/qapp-reticulum.md
new file mode 100644
index 000000000..adbc173e4
--- /dev/null
+++ b/docs/qapp-reticulum.md
@@ -0,0 +1,144 @@
+# Reticulum networking for Q-Apps
+
+This desktop-only API gives a Q-App fetch-like RPC path and a persistent,
+message-oriented Reticulum path. Q-Apps never receive an `RNS.Link`, Channel,
+Buffer, path-discovery state, or stream chunks.
+
+Backends use the dedicated Reticulum destination aspect
+`qortal-hub-v3.qapp-backend.v1`; Qortal presence destinations are not reused.
+
+## API
+
+- `RNS_REQUEST`: `destination`, `path`, `payload`, optional `timeoutMs`,
+  `maxResponseBytes`, and application `requestId`.
+- `RNS_CONNECT`: `destination`; returns `{ connectionId, state }`.
+- `RNS_SEND`: `connectionId`, `payload`; resolves once the complete logical
+  message is queued and written.
+- `RNS_CLOSE`: `connectionId`.
+
+The host posts `RNS_MESSAGE` and `RNS_CONNECTION_STATE` events to the owning
+Q-App view. Desktop Q-Apps use separate Electron web contents and storage
+partitions; browser and mobile builds retain the iframe bridge. States are
+`CONNECTING`, `CONNECTED`, `RECONNECTING`,
+`DISCONNECTED`, `CLOSING`, `CLOSED`, and `ERROR`.
+
+The first operation for a destination in a tab asks whether the app may connect
+to its backend and exchange data. This single approval also grants
+`PRIVATE_DATA_CHANNEL` for that app's tab, covering private channels and MoQ.
+The dialog does not expose transport names or destination hashes. Subsequent
+`SESSION_PERMISSIONS` requests for already-approved capabilities return without
+another dialog; unrelated capabilities still require approval. Account access
+and microphone permission remain separate.
+
+Permission and connections are isolated by trusted tab, service, application
+name, and destination. Closing or reloading the tab removes its logical
+connections. This initial version does not consume a destination declared in
+QDN metadata because no owner-signed metadata field exists yet.
+
+## Pooling and reconnects
+
+RPC and realtime operations for one isolation key share one physical Link.
+Concurrent establishment joins one pending Link operation. Logical connection
+IDs remain stable when that Link is replaced. Reconnect uses exponential
+backoff with jitter. Incomplete stream frames are discarded with the old
+Buffer; complete unacknowledged messages are resent from their beginning.
+
+RPC calls are not replayed automatically after submission. Backends should use
+the supplied application `requestId` to deduplicate non-idempotent operations.
+
+## Wire protocol version 1
+
+Version 1 is frozen. Incompatible changes require a new destination aspect such
+as `qortal-hub-v3.qapp-backend.v2`. The canonical machine-readable vectors are
+in [`protocol-v1-vectors.json`](../protocol-v1-vectors.json), with an identical
+copy in the Python backend.
+
+Every Buffer frame uses network byte order:
+
+| Field                                 |            Size |
+| ------------------------------------- | --------------: |
+| version                               |          1 byte |
+| type (`DATA=1`, `ACK=2`, `CONTROL=3`) |          1 byte |
+| transport message ID                  |         8 bytes |
+| payload length                        |         4 bytes |
+| payload                               | declared length |
+
+The parser supports partial and coalesced reads. Frames are limited to 256 KiB,
+the receive accumulator to twice that, the unacknowledged queue to 64 messages,
+and queued bytes to 2 MiB. Received IDs are retained in a bounded 512-entry
+deduplication cache. An ACK is returned even for a duplicate DATA frame.
+
+Realtime uses bidirectional RNS Buffer stream ID `7`. Writers loop over partial
+writes and flush only after the complete frame is accepted. Each sender starts
+at a random nonzero 63-bit message ID, increments modulo `2^64`, and retains
+complete pending frames. ACK carries one DATA ID in the header and has an empty
+payload. ACK timeout is 120 seconds; there is no timer-driven same-Link retry.
+
+DATA payload is compact UTF-8 JSON:
+
+```json
+{ "connectionId": "rns-<UUID>", "payloadBase64": "...", "encoding": "json" }
+```
+
+`encoding` is `json` for a Base64-wrapped UTF-8 JSON value and `base64` for
+arbitrary bytes. Standard padded Base64 is used. JSON key order and whitespace
+are not normative. Multiple stable logical `connectionId` values can share the
+Link. The complete envelope, not only the decoded Q-App body, must fit 256 KiB.
+
+CONTROL `3` supports `{"type":"PING"}`, `{"type":"PONG"}`, and
+`{"type":"CLOSE","connectionId":"rns-<UUID>"}`. PING receives PONG with the
+same header message ID. CLOSE removes only the named logical connection on the
+receiving physical Link and is idempotent; a delayed DATA frame for that ID is
+acknowledged but not delivered. CONTROL is not ACKed. Other control shapes are
+protocol errors. Application authentication/session resume is above transport;
+v1 has no WELCOME or RESUME transport control.
+
+RPC `link.request()` data is a native dictionary with `version: 1`, application
+`requestId`, `encoding`, and `payloadBase64`. The backend returns a native JSON
+value or bytes directly. Requests are limited to 256 KiB decoded; responses are
+limited to the requested bound, at most 1 MiB. Submitted RPCs are never replayed
+automatically after ambiguous failure.
+
+Reconnect begins at 0.5 seconds, doubles with 0.8–1.2 jitter, and caps at 30
+seconds. Partial Buffer bytes are discarded. Complete unacknowledged DATA frames
+are resent in message-ID order from byte zero. Closing removes local ownership
+immediately and queues the remote CLOSE on a bounded, per-backend worker. A
+failed or stalled CLOSE tears down that same physical Link, while a replacement
+Link created in the meantime is left untouched. Removing the last logical
+connection prevents a pending reconnect timer from reopening the Link.
+
+Transport IDs prevent duplicate delivery across reconnects. They do not prevent
+duplicate business operations: Q-Apps must include their own operation IDs for
+payments, game actions, or any other non-idempotent operation.
+
+## Backend example and limits
+
+[`examples/qapp-reticulum/backend.py`](../examples/qapp-reticulum/backend.py)
+creates a persistent identity, announces the backend destination, serves
+`/hello`, and echoes realtime frames. The accompanying `client.js` shows all
+four Q-App actions and both event types.
+
+Current limitations:
+
+- Electron only; browser and mobile builds return a native-transport error.
+- Backend identity authorization is explicit user approval, not QDN metadata.
+- `RNS.Resource` upload/download actions are intentionally deferred. Realtime
+  messages and RPC bodies are bounded and are not suitable for large files.
+- Request cancellation and a bulk-priority scheduler are not exposed yet.
+- Application session/subscription resumption remains the Q-App/backend's job.
+## Generic Q-App screen capture
+
+Q-Apps may call `navigator.mediaDevices.getDisplayMedia({video: true, audio: false})`
+from a user gesture. Hub requests one-time capture permission before exposing any
+screen/window previews. After approval, it sends `QAPP_SCREEN_CAPTURE_SOURCES`
+directly to the requesting frame, containing a random one-use `requestId` and
+`sources: [{id, name, thumbnail}]`. The Q-App renders its own source picker and
+calls `qortalRequest({action: 'SCREEN_CAPTURE_SELECT', requestId, sourceId})`.
+Omitting `sourceId` cancels. Completion also emits `QAPP_SCREEN_CAPTURE_CANCEL`
+to dismiss any remaining picker. The original browser capture promise resolves
+to a local MediaStream; streams are never passed through IPC.
+
+Requests expire after 60 seconds. Native code validates the requesting frame,
+unchanged URL, approved source list, main-shell IPC sender, and one-use capability.
+Only one pending capture request is allowed across the Hub window. Hub does not encode, encrypt, or
+interpret this app's screen frames; application media logic stays in the Q-App.
diff --git a/docs/qapp-streaming-save.md b/docs/qapp-streaming-save.md
new file mode 100644
index 000000000..365112457
--- /dev/null
+++ b/docs/qapp-streaming-save.md
@@ -0,0 +1,77 @@
+# Streaming file saves (desktop)
+
+This generic QApp API saves bytes progressively without a whole-file Blob.
+It does not download URLs, decrypt data, inspect file formats, or verify an app's
+claims. The app remains responsible for its protocol and integrity checks.
+Legacy `SAVE_FILE` remains unchanged. An updated desktop Hub is required.
+
+## Permission and API
+
+Call `FILE_SAVE_OPEN` from a deliberate Download/Save action. Hub presents a
+native permission prompt showing the trusted app identity, **suggested filename**
+and **declared size**. It explicitly says these details come from the app and
+are not a guarantee of content or safety. Approval opens the native save dialog.
+Approval is per save, never a session-wide permission. Hub never auto-opens files.
+
+```js
+const { saveId } = await qortalRequestWithTimeout({
+  action: 'FILE_SAVE_OPEN', filename: 'example.zip', size: expectedBytes
+}, 330000);
+try {
+  let offset = 0;
+  for await (const data of verifiedChunks) { // Uint8Array, max 256 KiB
+    await qortalRequestWithTimeout({
+      action: 'FILE_SAVE_WRITE', saveId, offset, data
+    }, 60000);
+    offset += data.byteLength;
+  }
+  await verifyCompleteFile();
+  await qortalRequestWithTimeout({ action: 'FILE_SAVE_FINISH', saveId }, 60000);
+} catch (error) {
+  await qortalRequest({ action: 'FILE_SAVE_ABORT', saveId });
+  throw error;
+}
+```
+
+WRITE returns cumulative `bytesWritten`; FINISH returns `{ saved: true }`.
+Do not pipeline writes: await each acknowledgment. FINISH requires the exact
+declared length. Hub cannot know whether a malicious app actually verified it.
+The native path is never returned to the QApp. The iframe cannot supply its owner,
+permission wording, or an output path. Main-process IPC is restricted to Hub's
+main frame; saves are additionally bound to the QApp identity and tab.
+
+## Limits and cleanup
+
+- One pending/active save per tab/app, eight across Hub; maximum 8 GiB per save.
+  Applications can impose a smaller limit (the file-sharing app uses 3 GiB).
+- One in-flight write per save; chunks up to 256 KiB; strictly increasing offsets.
+- Five-minute idle expiry and 24-hour absolute lifetime. Pending dialogs are
+  invalidated too. A stale approval cannot create an output after logout/cleanup.
+- Tab reload/closure, logout, shell navigation/crash, cancellation and expiry
+  abort unfinished saves. On ordinary shutdown cleanup is best effort.
+- A randomly named `.qortal-save-<uuid>.part` beside the chosen destination holds
+  plaintext with owner-only POSIX permissions. It is not the final filename.
+  FINISH fsyncs and atomically renames it, replacing a file only at the destination
+  selected through the native overwrite-confirming dialog. There is no automatic
+  launch or antivirus/content-safety guarantee. Windows relies on folder ACLs.
+- Private local journals record partial paths for cleanup on the next Hub launch
+  following a crash. Failed deletions retain the journal for a later attempt.
+  Journals contain local paths, not file contents, and never reach a backend.
+  Cleanup is deletion, not guaranteed secure erasure of disk sectors.
+
+Keep the original destination unchanged on abort or integrity failure. If an
+application loses the final acknowledgment at the commit boundary, the file
+may already have been saved; cancellation cannot roll back a completed save.
+
+Error codes include `SAVE_CANCELLED`, `SAVE_BUSY`, `SAVE_NOT_FOUND`,
+`SAVE_INVALID_REQUEST`, `SAVE_INVALID_CHUNK`, `SAVE_INCOMPLETE`, `SAVE_IO_ERROR`,
+`SAVE_PERMISSION_DENIED`, and `SAVE_UNAVAILABLE`. OS errors are redacted.
+
+## Manual smoke test
+
+After building/syncing and restarting desktop Hub, open a file-sharing link.
+Approve the prompt and choose a path. Check a small file's contents, then a large
+file; memory must not grow with the entire file size. Cancel midway, close the
+tab, and log out during separate downloads: no final file should be created.
+Repeat with an existing output file and cancel: its contents must stay unchanged.
+Test native save/overwrite dialogs separately on Linux, macOS and Windows.
diff --git a/docs/reticulum.md b/docs/reticulum.md
index a0b506989..8e82f9461 100644
--- a/docs/reticulum.md
+++ b/docs/reticulum.md
@@ -94,6 +94,47 @@ A Python subprocess (`presence_bridge.py`) launched after the daemon is ready.
 | `send_qchat_file_resource` | Send a file offer to a peer |
 | `authorize_qchat_file_resource` | Authorise file delivery |
 
+### Q-App Backend Scheduling
+
+Q-App backend traffic is isolated from Hub control traffic and from its own realtime data path:
+
+- `qapp-rpc-*` handles bounded request/response work.
+- `qapp-realtime-*` handles gameplay and other realtime sends.
+- `qapp-lifecycle-*` handles connection setup and teardown.
+
+Each class is deterministically sharded by Q-App owner and backend destination. Once an RPC link is established, waiting for its response is callback-driven; it does not occupy a scheduler worker. The Electron manager additionally caps pending RPCs and logical connections both per Q-App owner and globally so one Q-App—or many malfunctioning owners—cannot exhaust shared bridge capacity.
+
+Q-App stream sends use raw partial writes, not Python `BufferedWriter`: the
+Reticulum raw writer can return zero while its channel window is full, which
+can make buffered `flush()` spin indefinitely. Sends have a ten-second deadline
+and run in a bounded pool (eight workers, 64 pending jobs), isolated from the
+Q-App scheduler. A failed or stalled write detaches its physical Link and
+schedules the existing reconnect flow. Every new stream gets a new write lock;
+late writes and reader failures remain tied to the old Link. Queue pressure
+alone does not reset a healthy Link. Failed sends return an error and release
+their pending acknowledgement reservation instead of reporting success.
+
+### Q-App document lifecycle
+
+Desktop Q-Apps run in isolated guest web contents. The shell registers each
+guest with Electron main using a per-guest attach token bound to a trusted tab,
+service, and name. The guest page has no Node API. Its preload forwards the
+existing Q-App request messages to the owning shell view and retains reply
+ports. Each app's browser storage has a separate persistent partition. Main
+blocks navigation to another app or origin while keeping the guest's owner.
+Full navigation (including refresh) starts resource cleanup on
+`did-start-navigation` before the new document can create connections.
+Same-document navigation retains connections. Tab removal and shell
+shutdown/crash also clean registered resources. Browser and mobile builds keep
+the iframe bridge.
+
+Reticulum, private channels, MoQ, and file saves snapshot their old resources
+at the same time; slow shutdown in one manager must not delay another manager's
+snapshot until after the new page connects. Never trigger owner-wide cleanup
+from the guest's `load` event: new-page scripts can already have connected.
+Reticulum setup checks ownership again after native setup returns and rejects
+connections cancelled in flight instead of returning a dead connected handle.
+
 ### Mesh Coordinator — `reticulum-mesh.ts`
 
 Handles hub-to-hub mesh networking, separate from the TLS P2P layer (`p2p-network.ts`).
diff --git a/electron/electron-builder.config.arm.json b/electron/electron-builder.config.arm.json
index d166cdbfd..1e7a24db2 100644
--- a/electron/electron-builder.config.arm.json
+++ b/electron/electron-builder.config.arm.json
@@ -6,6 +6,11 @@
   "asar": true,
   "afterPack": "scripts/afterPack.js",
   "extraResources": [
+    {
+      "from": "resources/private-transport",
+      "to": "private-transport",
+      "filter": ["**/qortal-private-transport"]
+    },
     {
       "from": "resources/presence_bridge.py",
       "to": "reticulum/presence_bridge.py"
@@ -75,8 +80,10 @@
     "category": "Network",
     "packageCategory": "Network",
     "desktop": {
-      "Name": "Qortal Hub",
-      "StartupWMClass": "qortal-hub"
+      "entry": {
+        "Name": "Qortal Hub",
+        "StartupWMClass": "qortal-hub"
+      }
     },
     "executableName": "qortal-hub",
     "icon": "assets/png"
diff --git a/electron/electron-builder.config.json b/electron/electron-builder.config.json
index 2d2af7574..c89ae5bf2 100644
--- a/electron/electron-builder.config.json
+++ b/electron/electron-builder.config.json
@@ -6,10 +6,19 @@
   "afterPack": "scripts/afterPack.js",
 
   "extraResources": [
+    {
+      "from": "resources/private-transport",
+      "to": "private-transport",
+      "filter": ["**/qortal-private-transport", "**/qortal-private-transport.exe"]
+    },
     {
       "from": "resources/presence_bridge.py",
       "to": "reticulum/presence_bridge.py"
     },
+    {
+      "from": "resources/masque_discovery_codec.py",
+      "to": "reticulum/masque_discovery_codec.py"
+    },
     {
       "from": "resources/qortal_python_diagnostics.py",
       "to": "reticulum/qortal_python_diagnostics.py"
@@ -40,6 +49,7 @@
       "filter": [
         "**/*",
         "!presence_bridge.py",
+        "!masque_discovery_codec.py",
         "!qortal_python_diagnostics.py",
         "!sitecustomize.py",
         "!qortalland_games.py",
@@ -88,8 +98,10 @@
     "category": "Network",
     "packageCategory": "Network",
     "desktop": {
-      "StartupWMClass": "qortal-hub",
-      "Name": "Qortal Hub"
+      "entry": {
+        "StartupWMClass": "qortal-hub",
+        "Name": "Qortal Hub"
+      }
     },
     "executableName": "qortal-hub",
     "icon": "assets/png",
diff --git a/electron/electron-builder.config.lin.json b/electron/electron-builder.config.lin.json
index 3d82ac6dc..53919d5a0 100644
--- a/electron/electron-builder.config.lin.json
+++ b/electron/electron-builder.config.lin.json
@@ -6,6 +6,11 @@
   "asar": true,
   "afterPack": "scripts/afterPack.js",
   "extraResources": [
+    {
+      "from": "resources/private-transport",
+      "to": "private-transport",
+      "filter": ["**/qortal-private-transport"]
+    },
     {
       "from": "resources/presence_bridge.py",
       "to": "reticulum/presence_bridge.py"
@@ -75,8 +80,10 @@
     "category": "Network",
     "packageCategory": "Network",
     "desktop": {
-      "Name": "Qortal Hub",
-      "StartupWMClass": "qortal-hub"
+      "entry": {
+        "Name": "Qortal Hub",
+        "StartupWMClass": "qortal-hub"
+      }
     },
     "executableName": "qortal-hub",
     "icon": "assets/png"
diff --git a/electron/electron-builder.config.mac.json b/electron/electron-builder.config.mac.json
index 996eed233..af2eea7c8 100644
--- a/electron/electron-builder.config.mac.json
+++ b/electron/electron-builder.config.mac.json
@@ -11,6 +11,11 @@
   "afterPack": "scripts/afterPack.js",
 
   "extraResources": [
+    {
+      "from": "resources/private-transport",
+      "to": "private-transport",
+      "filter": ["**/qortal-private-transport"]
+    },
     {
       "from": "resources/presence_bridge.py",
       "to": "reticulum/presence_bridge.py"
diff --git a/electron/electron-builder.config.win.json b/electron/electron-builder.config.win.json
index 170ce0a86..f12aecac8 100644
--- a/electron/electron-builder.config.win.json
+++ b/electron/electron-builder.config.win.json
@@ -5,6 +5,11 @@
   "compression": "normal",
   "asar": true,
   "extraResources": [
+    {
+      "from": "resources/private-transport",
+      "to": "private-transport",
+      "filter": ["**/qortal-private-transport.exe"]
+    },
     {
       "from": "resources/presence_bridge.py",
       "to": "reticulum/presence_bridge.py"
diff --git a/electron/native/private-transport/README.md b/electron/native/private-transport/README.md
new file mode 100644
index 000000000..6cb52d541
--- /dev/null
+++ b/electron/native/private-transport/README.md
@@ -0,0 +1,129 @@
+# Qortal private transport sidecar
+
+The sidecar carries authenticated inner QUIC through RFC 9298 CONNECT-UDP:
+
+```
+Electron -> sidecar -> outer QUIC/HTTP3 -> MASQUE -> inner QUIC -> backend
+```
+
+It opens no listening socket. `masque-go v0.5.0` supplies the CONNECT-UDP
+`net.PacketConn`; `quic-go v0.62.0` dials inner QUIC directly over it. There is
+no direct backend dial or fallback.
+
+## Authentication and bootstrap
+
+Electron obtains bootstrap version 1 through the authenticated reserved RNS
+request `/qortal/private-transport/bootstrap/v1`. Electron binds that request
+to the already-owned logical RNS connection in the internal request envelope.
+Its descriptor contains the
+logical session, authenticated RNS destination, literal backend endpoint,
+backend certificate SHA-256 pin, short-lived single-use attach token, nonce,
+owner binding hash, expiry, transport identifier, and supported features. The
+backend derives the owner binding from its signed Q-App/application session;
+the descriptor is never exposed to the Q-App.
+
+Both relay and backend TLS use pinned leaf-certificate DER hashes, logical
+hostname verification, and validity-period checks. Public Web PKI is not
+required. Inner QUIC uses ALPN `qortal-private/1`.
+
+After TLS, the client sends ATTACH with protocol version, logical session ID,
+attach token, nonce, channel purpose, and owner binding. The backend must return
+ATTACHED for the same logical session and transport generation 1.
+
+## Framing and IPC
+
+The reliable lane uses one persistent bidirectional QUIC stream:
+
+```
+magic[4] | version[1] | type[1] | metadataLength[2] |
+payloadLength[4] | bounded JSON metadata | raw payload
+```
+
+Metadata is limited to 4 KiB and raw reliable payloads to 64 KiB. QUIC
+DATAGRAMs use a distinct `QP3D` binary frame with protocol version, bounded
+message ID, and at most 1024 application bytes. They are not emulated with
+streams.
+
+Sidecar IPC version 2 is hybrid: NDJSON controls retain request IDs and coded
+errors; a declared `binaryLength` is followed immediately by raw bytes.
+Unsolicited reliable/datagram/error events use the same bounded sideband. This
+removes base64 expansion from the Step 3 application data path.
+
+Inner QUIC uses a conservative 1200-byte initial packet size and disables PMTU
+probing because the generic MASQUE PacketConn cannot expose UDP DF/OOB support.
+CONNECT-UDP permits 1500-byte UDP payloads. Larger application datagrams fail
+locally rather than being fragmented or converted to streams.
+
+Two congestion controllers are active: inner QUIC to the backend and outer
+QUIC to the relay. No nested-congestion tuning is attempted. Metrics include
+inner smoothed RTT, application bytes, datagram drops, stream errors, and
+connection errors; endpoints are excluded.
+
+## MoQT compatibility
+
+The MOQT compatibility spike pins `github.com/mengelbart/moqtransport` at commit
+`9eaf40a4dedd` (MOQT draft 18). The compatibility test in
+`internal/moqproof` establishes two real MOQT sessions over MASQUE-provided
+`net.PacketConn` instances. It blindly relays an opaque application object
+between the clients and verifies that the backend observes relay egress
+addresses. Keep MOQT behind the
+private-transport boundary; its wire version is not part of the Q-App API.
+
+The pinned source is selected from `third_party/moqtransport` using a Go
+`replace` directive. Its previously empty SendDatagram method now encodes
+OBJECT_DATAGRAM and sends it using QUIC DATAGRAM. Transport errors propagate;
+there is no retry or stream fallback. Provenance and patch scope are recorded
+in `third_party/moqtransport/QORTAL-PATCHES.md`.
+
+The production sidecar also owns a generic trusted MOQT client. It:
+
+- consumes the backend's authenticated, one-time `realtime` bootstrap;
+- establishes inner `moqt-18` QUIC only through CONNECT-UDP;
+- verifies the backend name and exact certificate pin;
+- accepts a bounded publication namespace and track instead of embedding any
+  application-specific room, participant, or content meaning;
+- publishes and receives only opaque application objects;
+- caps objects at 1024 bytes, namespace components at eight, and subscriptions
+  at 64; and
+- emits received objects only to the Electron main process.
+
+The sidecar does not capture, encode, encrypt, decrypt, sign, inspect, or play
+application content. Those responsibilities belong to the application using
+the generic transport. A capability-scoped Q-App API exposes only logical
+session open, track subscribe, opaque object publish, metrics, and close
+operations. It requires the existing `PRIVATE_DATA_CHANNEL` session permission,
+binds each MOQT session to the requesting Q-App and its owned Reticulum
+connection, and never returns backend endpoints, relay endpoints, credentials,
+or raw sockets.
+
+The opaque-object two-client test runs both subgroup-stream and datagram delivery.
+The datagram case deliberately loses the first object and verifies the next
+object arrives as a datagram, with no resend of the lost object. Oversized
+sends must return an error. These are local integration tests, not a completed
+Q-App/backend integration or a full MoQT interoperability audit.
+
+Run `go test ./...` here and in `third_party/moqtransport`. The latter
+includes upstream regression tests and byte-level datagram sender tests.
+
+## Build and scope
+
+The module requires Go 1.26+. The normal build uses local Go when available and
+automatically falls back to `golang:1.26-bookworm` through Docker otherwise.
+
+```
+npm run build:private-transport --prefix electron
+QORTAL_GO_BINARY=/path/to/go npm run test:private-transport
+```
+
+The normal development MASQUE path uses the real RNS provider and the companion
+`qapp-backend` implementation. Isolated Step 3 tests retain provider injection;
+the Step 4 integration test invokes the real backend bootstrap/token service and
+Python QUIC listener. Large-file framing and resumability remain out of scope.
+
+## Standalone community MASQUE relay
+
+The operator-run relay is maintained as the separate `qortal-masque-relay`
+project. Hub contains only the client, Reticulum discovery, and private-channel
+coordination code. Discovered MASQUE relays are the default in development and
+packaged builds. `QORTAL_PRIVATE_TRANSPORT=masque-test` exists only for the
+explicit local test-relay override.
diff --git a/electron/native/private-transport/cmd/qortal-private-transport-step3-fixture/main.go b/electron/native/private-transport/cmd/qortal-private-transport-step3-fixture/main.go
new file mode 100644
index 000000000..02e6e9c82
--- /dev/null
+++ b/electron/native/private-transport/cmd/qortal-private-transport-step3-fixture/main.go
@@ -0,0 +1,324 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/pem"
+	"math/big"
+	"net"
+	"net/http"
+	"os"
+	"sync"
+	"time"
+
+	masque "github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+	"qortal.org/qortal-hub/private-transport/internal/innerquic"
+)
+
+const (
+	logicalSessionID = "logical-test-session"
+	attachToken      = "single-use-test-attach-token-00000001"
+	nonce            = "test-bootstrap-nonce-0000000000000001"
+	purpose          = "realtime"
+	ownerBindingHash = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+)
+
+type benchmarkConnectionKey struct{}
+
+type fixture struct {
+	mu               sync.Mutex
+	backendUDP       *net.UDPConn
+	backendListener  *quic.Listener
+	relayUDP         *net.UDPConn
+	relayServer      *http3.Server
+	proxy            masque.Proxy
+	backendAddress   string
+	backendSource    string
+	relayEgress      string
+	reliableCount    int
+	datagramCount    int
+	tokenUsed        bool
+	dropNextDatagram bool
+	connections      map[*quic.Conn]struct{}
+}
+
+func main() {
+	f, startup, err := startFixture()
+	if err != nil {
+		os.Exit(1)
+	}
+	defer f.close()
+	enc := json.NewEncoder(os.Stdout)
+	_ = enc.Encode(startup)
+	scanner := bufio.NewScanner(os.Stdin)
+	for scanner.Scan() {
+		var cmd struct {
+			Operation string `json:"operation"`
+		}
+		if json.Unmarshal(scanner.Bytes(), &cmd) != nil {
+			continue
+		}
+		switch cmd.Operation {
+		case "stats":
+			f.mu.Lock()
+			v := map[string]interface{}{"backendSource": f.backendSource, "relayEgress": f.relayEgress, "reliableCount": f.reliableCount, "datagramCount": f.datagramCount, "tokenUsed": f.tokenUsed}
+			f.mu.Unlock()
+			v["receiveBuffers"] = quic.GlobalDatagramReceiveBufferStats()
+			_ = enc.Encode(v)
+		case "stopRelay":
+			f.stopRelay()
+			_ = enc.Encode(map[string]bool{"relayStopped": true})
+		case "stopBackend":
+			f.stopBackend()
+			_ = enc.Encode(map[string]bool{"backendStopped": true})
+		case "dropNextDatagram":
+			f.mu.Lock()
+			f.dropNextDatagram = true
+			f.mu.Unlock()
+			_ = enc.Encode(map[string]bool{"willDrop": true})
+		case "shutdown":
+			_ = enc.Encode(map[string]bool{"shuttingDown": true})
+			return
+		}
+	}
+}
+
+func startFixture() (*fixture, map[string]interface{}, error) {
+	backendCert, backendDER, err := certificate("qortal-test-backend")
+	if err != nil {
+		return nil, nil, err
+	}
+	backendUDP, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		return nil, nil, err
+	}
+	backendALPN := innerquic.ALPN
+	if os.Getenv("QORTAL_STEP3_TEST_WRONG_ALPN") == "1" {
+		backendALPN = "qortal-private/unsupported"
+	}
+	listener, err := quic.Listen(backendUDP, &tls.Config{Certificates: []tls.Certificate{backendCert}, NextProtos: []string{backendALPN}}, &quic.Config{EnableDatagrams: true, InitialPacketSize: innerquic.InnerPacketSize, DisablePathMTUDiscovery: true})
+	if err != nil {
+		return nil, nil, err
+	}
+	f := &fixture{backendUDP: backendUDP, backendListener: listener, backendAddress: backendUDP.LocalAddr().String(), connections: make(map[*quic.Conn]struct{})}
+	go f.acceptBackend()
+	relayCert, relayDER, err := certificate("qortal-test-relay")
+	if err != nil {
+		f.close()
+		return nil, nil, err
+	}
+	relayUDP, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		f.close()
+		return nil, nil, err
+	}
+	f.relayUDP = relayUDP
+	relayAddress := relayUDP.LocalAddr().String()
+	template := uritemplate.MustNew("https://" + relayAddress + "/.well-known/masque/udp/{target_host}/{target_port}/")
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/masque/udp/", func(w http.ResponseWriter, r *http.Request) {
+		// The opt-in delay benchmark forwards through a local UDP proxy.
+		if os.Getenv("QORTAL_STEP3_TEST_ACK_ONLY") == "1" {
+			r.Host = relayAddress
+			r.URL.Host = relayAddress
+		}
+		req, e := masque.ParseProxyRequest(r, template)
+		if e != nil || req.Target != f.backendAddress {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		target, e := net.ResolveUDPAddr("udp", f.backendAddress)
+		if e != nil {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		egress, e := net.DialUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)}, target)
+		if e != nil {
+			w.WriteHeader(http.StatusBadGateway)
+			return
+		}
+		f.mu.Lock()
+		f.relayEgress = egress.LocalAddr().String()
+		f.mu.Unlock()
+		w.(http3.HTTPStreamer).HTTPStream().EnableDatagramReceiveBuffer()
+		if c, ok := r.Context().Value(benchmarkConnectionKey{}).(*quic.Conn); ok {
+			c.EnableDatagramReceiveBuffer()
+		}
+		_ = f.proxy.ProxyConnectedSocket(w, req, egress)
+	})
+	f.relayServer = &http3.Server{ConnContext: func(ctx context.Context, c *quic.Conn) context.Context {
+		return context.WithValue(ctx, benchmarkConnectionKey{}, c)
+	}, TLSConfig: &tls.Config{Certificates: []tls.Certificate{relayCert}, NextProtos: []string{http3.NextProtoH3}}, QUICConfig: &quic.Config{EnableDatagrams: true}, EnableDatagrams: true, Handler: mux}
+	go func() { _ = f.relayServer.Serve(relayUDP) }()
+	relayPin := sha256.Sum256(relayDER)
+	backendPin := sha256.Sum256(backendDER)
+	return f, map[string]interface{}{"relayAddress": relayAddress, "relayServerName": "qortal-test-relay", "relayCertSha256": hex.EncodeToString(relayPin[:]), "backendAddress": f.backendAddress, "backendServerName": "qortal-test-backend", "backendCertSha256": hex.EncodeToString(backendPin[:]), "logicalSessionId": logicalSessionID, "attachToken": attachToken, "nonce": nonce, "purpose": purpose, "ownerBindingHash": ownerBindingHash, "expiresAt": time.Now().Add(time.Minute).UnixMilli(), "backendRnsDestination": "0123456789abcdef0123456789abcdef", "transport": "quic-masque-inner-v1"}, nil
+}
+
+func (f *fixture) acceptBackend() {
+	for {
+		conn, err := f.backendListener.Accept(context.Background())
+		if err != nil {
+			return
+		}
+		f.mu.Lock()
+		f.backendSource = conn.RemoteAddr().String()
+		f.connections[conn] = struct{}{}
+		f.mu.Unlock()
+		go f.handleBackend(conn)
+	}
+}
+func (f *fixture) handleBackend(conn *quic.Conn) {
+	defer func() { f.mu.Lock(); delete(f.connections, conn); f.mu.Unlock(); _ = conn.CloseWithError(0, "done") }()
+	stream, err := conn.AcceptStream(context.Background())
+	if err != nil {
+		return
+	}
+	frame, err := innerquic.ReadFrame(stream)
+	if err != nil || frame.Type != innerquic.FrameAttach {
+		return
+	}
+	var attach struct {
+		ProtocolVersion  int    `json:"protocolVersion"`
+		LogicalSessionID string `json:"logicalSessionId"`
+		AttachToken      string `json:"attachToken"`
+		Nonce            string `json:"nonce"`
+		Purpose          string `json:"purpose"`
+		OwnerBindingHash string `json:"ownerBindingHash"`
+	}
+	_ = json.Unmarshal(frame.Metadata, &attach)
+	f.mu.Lock()
+	valid := attach.ProtocolVersion == innerquic.ProtocolVersion && attach.LogicalSessionID == logicalSessionID && attach.AttachToken == attachToken && attach.Nonce == nonce && attach.Purpose == purpose && attach.OwnerBindingHash == ownerBindingHash && !f.tokenUsed
+	if valid {
+		f.tokenUsed = true
+	}
+	f.mu.Unlock()
+	response := map[string]interface{}{"ok": valid, "logicalSessionId": logicalSessionID, "transportGeneration": 1, "reliable": true, "datagrams": true}
+	if os.Getenv("QORTAL_STEP3_TEST_BULK") == "1" {
+		response["reliableStreams"] = true
+		response["maxReliablePayloadBytes"] = innerquic.MaxReliablePayloadBytes
+	}
+	if !valid {
+		response["code"] = "ATTACH_TOKEN_REJECTED"
+	}
+	metadata, _ := innerquic.Metadata(response)
+	_ = innerquic.WriteFrame(stream, innerquic.Frame{Type: innerquic.FrameAttached, Metadata: metadata})
+	if !valid {
+		_ = stream.Close()
+		time.Sleep(20 * time.Millisecond)
+		return
+	}
+	go f.echoDatagrams(conn)
+	go func() {
+		for {
+			keyed, err := conn.AcceptStream(context.Background())
+			if err != nil {
+				return
+			}
+			go f.echoReliable(keyed)
+		}
+	}()
+	f.echoReliable(stream)
+}
+
+func (f *fixture) echoReliable(stream *quic.Stream) {
+	defer stream.Close()
+	for {
+		message, err := innerquic.ReadFrame(stream)
+		if err != nil {
+			return
+		}
+		if message.Type != innerquic.FrameReliable {
+			return
+		}
+		f.mu.Lock()
+		f.reliableCount++
+		f.mu.Unlock()
+		if os.Getenv("QORTAL_STEP3_TEST_ACK_ONLY") == "1" {
+			message.Payload = []byte("ack")
+		}
+		if innerquic.WriteFrame(stream, message) != nil {
+			return
+		}
+	}
+}
+func (f *fixture) echoDatagrams(conn *quic.Conn) {
+	for {
+		data, err := conn.ReceiveDatagram(context.Background())
+		if err != nil {
+			return
+		}
+		if _, _, err := innerquic.DecodeDatagram(data); err != nil {
+			continue
+		}
+		f.mu.Lock()
+		f.datagramCount++
+		drop := f.dropNextDatagram
+		f.dropNextDatagram = false
+		f.mu.Unlock()
+		if drop {
+			continue
+		}
+		_ = conn.SendDatagram(data)
+	}
+}
+func (f *fixture) stopRelay() {
+	if f.relayServer != nil {
+		_ = f.relayServer.Close()
+		f.relayServer = nil
+	}
+	if f.relayUDP != nil {
+		_ = f.relayUDP.Close()
+		f.relayUDP = nil
+	}
+}
+func (f *fixture) stopBackend() {
+	f.mu.Lock()
+	connections := make([]*quic.Conn, 0, len(f.connections))
+	for conn := range f.connections {
+		connections = append(connections, conn)
+	}
+	f.mu.Unlock()
+	for _, conn := range connections {
+		_ = conn.CloseWithError(2, "backend stopped")
+	}
+	if f.backendListener != nil {
+		_ = f.backendListener.Close()
+		f.backendListener = nil
+	}
+	if f.backendUDP != nil {
+		_ = f.backendUDP.Close()
+		f.backendUDP = nil
+	}
+}
+func (f *fixture) close() { f.stopRelay(); _ = f.proxy.Close(); f.stopBackend() }
+func certificate(name string) (tls.Certificate, []byte, error) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return tls.Certificate{}, nil, err
+	}
+	now := time.Now()
+	template := &x509.Certificate{SerialNumber: big.NewInt(now.UnixNano()), Subject: pkix.Name{CommonName: name}, DNSNames: []string{name}, NotBefore: now.Add(-time.Minute), NotAfter: now.Add(time.Hour), KeyUsage: x509.KeyUsageDigitalSignature, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		return tls.Certificate{}, nil, err
+	}
+	keyDER, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		return tls.Certificate{}, nil, err
+	}
+	cert, err := tls.X509KeyPair(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER}))
+	return cert, der, err
+}
diff --git a/electron/native/private-transport/cmd/qortal-private-transport-step4-relay/main.go b/electron/native/private-transport/cmd/qortal-private-transport-step4-relay/main.go
new file mode 100644
index 000000000..09aee86e3
--- /dev/null
+++ b/electron/native/private-transport/cmd/qortal-private-transport-step4-relay/main.go
@@ -0,0 +1,144 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/hex"
+	"encoding/json"
+	"math/big"
+	"net"
+	"net/http"
+	"os"
+	"sync"
+	"time"
+
+	masque "github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+type relay struct {
+	mu         sync.Mutex
+	server     *http3.Server
+	proxy      masque.Proxy
+	udp        *net.UDPConn
+	target     string
+	lastEgress string
+}
+
+type connectionKey struct{}
+
+func main() {
+	target := os.Getenv("QORTAL_STEP4_BACKEND_ADDRESS")
+	parsedTarget, err := net.ResolveUDPAddr("udp", target)
+	if err != nil || parsedTarget.Port == 0 || parsedTarget.IP == nil {
+		panic("QORTAL_STEP4_BACKEND_ADDRESS must be a literal UDP endpoint")
+	}
+	certificate, der, err := testCertificate("qortal-step4-relay")
+	if err != nil {
+		panic(err)
+	}
+	udp, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		panic(err)
+	}
+	r := &relay{udp: udp, target: parsedTarget.String()}
+	template := uritemplate.MustNew("https://" + udp.LocalAddr().String() + "/.well-known/masque/udp/{target_host}/{target_port}/")
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/masque/udp/", func(w http.ResponseWriter, request *http.Request) {
+		if os.Getenv("QORTAL_STEP4_BULK_BENCH") == "1" {
+			request.Host = udp.LocalAddr().String()
+			request.URL.Host = request.Host
+		}
+		proxyRequest, parseErr := masque.ParseProxyRequest(request, template)
+		if parseErr != nil || proxyRequest.Target != r.target {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		egress, dialErr := net.DialUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)}, parsedTarget)
+		if dialErr != nil {
+			w.WriteHeader(http.StatusBadGateway)
+			return
+		}
+		r.mu.Lock()
+		r.lastEgress = egress.LocalAddr().String()
+		r.mu.Unlock()
+		w.(http3.HTTPStreamer).HTTPStream().EnableDatagramReceiveBuffer()
+		request.Context().Value(connectionKey{}).(*quic.Conn).EnableDatagramReceiveBuffer()
+		_ = r.proxy.ProxyConnectedSocket(w, proxyRequest, egress)
+	})
+	r.server = &http3.Server{
+		ConnContext: func(ctx context.Context, c *quic.Conn) context.Context {
+			return context.WithValue(ctx, connectionKey{}, c)
+		},
+		TLSConfig:       &tls.Config{Certificates: []tls.Certificate{certificate}, NextProtos: []string{http3.NextProtoH3}},
+		QUICConfig:      &quic.Config{EnableDatagrams: true},
+		EnableDatagrams: true,
+		Handler:         mux,
+	}
+	go func() { _ = r.server.Serve(udp) }()
+	pin := sha256.Sum256(der)
+	write(map[string]interface{}{
+		"relayAddress":    udp.LocalAddr().String(),
+		"relayServerName": "qortal-step4-relay",
+		"relayCertSha256": hex.EncodeToString(pin[:]),
+	})
+	scanner := bufio.NewScanner(os.Stdin)
+	for scanner.Scan() {
+		var command struct {
+			Operation string `json:"operation"`
+		}
+		_ = json.Unmarshal(scanner.Bytes(), &command)
+		switch command.Operation {
+		case "stats":
+			r.mu.Lock()
+			write(map[string]string{"relayEgress": r.lastEgress})
+			r.mu.Unlock()
+		case "shutdown":
+			r.close()
+			write(map[string]bool{"closed": true})
+			return
+		default:
+			write(map[string]string{"error": "unknown operation"})
+		}
+	}
+	r.close()
+}
+
+func (r *relay) close() {
+	_ = r.server.Close()
+	_ = r.proxy.Close()
+	_ = r.udp.Close()
+}
+
+func write(value interface{}) { _ = json.NewEncoder(os.Stdout).Encode(value) }
+
+func testCertificate(name string) (tls.Certificate, []byte, error) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return tls.Certificate{}, nil, err
+	}
+	now := time.Now()
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(now.UnixNano()),
+		Subject:      pkix.Name{CommonName: name},
+		DNSNames:     []string{name},
+		NotBefore:    now.Add(-time.Minute),
+		NotAfter:     now.Add(time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		return tls.Certificate{}, nil, err
+	}
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}, der, nil
+}
diff --git a/electron/native/private-transport/cmd/qortal-private-transport-test-fixture/main.go b/electron/native/private-transport/cmd/qortal-private-transport-test-fixture/main.go
new file mode 100644
index 000000000..c4152a35c
--- /dev/null
+++ b/electron/native/private-transport/cmd/qortal-private-transport-test-fixture/main.go
@@ -0,0 +1,188 @@
+package main
+
+import (
+	"bufio"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/pem"
+	"math/big"
+	"net"
+	"net/http"
+	"os"
+	"sync"
+	"time"
+
+	masque "github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+type fixture struct {
+	mu            sync.Mutex
+	echoConn      *net.UDPConn
+	relayConn     *net.UDPConn
+	server        *http3.Server
+	proxy         masque.Proxy
+	targetAddress string
+	relayEgress   string
+	echoSource    string
+	echoCount     int
+}
+
+func main() {
+	f, startup, err := startFixture()
+	if err != nil {
+		os.Exit(1)
+	}
+	defer f.close()
+	encoder := json.NewEncoder(os.Stdout)
+	_ = encoder.Encode(startup)
+	scanner := bufio.NewScanner(os.Stdin)
+	for scanner.Scan() {
+		var command struct {
+			Operation string `json:"operation"`
+		}
+		if json.Unmarshal(scanner.Bytes(), &command) != nil {
+			continue
+		}
+		switch command.Operation {
+		case "stats":
+			f.mu.Lock()
+			response := map[string]interface{}{"echoCount": f.echoCount, "echoSource": f.echoSource, "relayEgress": f.relayEgress}
+			f.mu.Unlock()
+			_ = encoder.Encode(response)
+		case "stopRelay":
+			f.stopRelay()
+			_ = encoder.Encode(map[string]bool{"relayStopped": true})
+		case "shutdown":
+			_ = encoder.Encode(map[string]bool{"shuttingDown": true})
+			return
+		}
+	}
+}
+
+func startFixture() (*fixture, map[string]string, error) {
+	echoConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		return nil, nil, err
+	}
+	f := &fixture{echoConn: echoConn, targetAddress: echoConn.LocalAddr().String()}
+	go f.echoLoop()
+
+	cert, der, err := testCertificate()
+	if err != nil {
+		f.close()
+		return nil, nil, err
+	}
+	relayConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		f.close()
+		return nil, nil, err
+	}
+	f.relayConn = relayConn
+	relayAddress := relayConn.LocalAddr().String()
+	template := uritemplate.MustNew("https://" + relayAddress + "/.well-known/masque/udp/{target_host}/{target_port}/")
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/masque/udp/", func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Qortal-Relay-Control") == "authorize" {
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		req, parseErr := masque.ParseProxyRequest(r, template)
+		if parseErr != nil || req.Target != f.targetAddress {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		target, resolveErr := net.ResolveUDPAddr("udp", f.targetAddress)
+		if resolveErr != nil {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		egress, dialErr := net.DialUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)}, target)
+		if dialErr != nil {
+			w.WriteHeader(http.StatusBadGateway)
+			return
+		}
+		f.mu.Lock()
+		f.relayEgress = egress.LocalAddr().String()
+		f.mu.Unlock()
+		_ = f.proxy.ProxyConnectedSocket(w, req, egress)
+	})
+	f.server = &http3.Server{
+		TLSConfig:  &tls.Config{Certificates: []tls.Certificate{cert}, NextProtos: []string{http3.NextProtoH3}},
+		QUICConfig: &quic.Config{EnableDatagrams: true}, EnableDatagrams: true, Handler: mux,
+	}
+	go func() { _ = f.server.Serve(relayConn) }()
+	pin := sha256.Sum256(der)
+	return f, map[string]string{
+		"relayAddress": relayAddress, "relayServerName": "qortal-test-relay",
+		"relayCertSha256": hex.EncodeToString(pin[:]), "targetAddress": f.targetAddress,
+	}, nil
+}
+
+func (f *fixture) echoLoop() {
+	buf := make([]byte, 1500)
+	for {
+		n, addr, err := f.echoConn.ReadFromUDP(buf)
+		if err != nil {
+			return
+		}
+		f.mu.Lock()
+		f.echoCount++
+		f.echoSource = addr.String()
+		f.mu.Unlock()
+		_, _ = f.echoConn.WriteToUDP(buf[:n], addr)
+	}
+}
+
+func (f *fixture) stopRelay() {
+	if f.server != nil {
+		_ = f.server.Close()
+		f.server = nil
+	}
+	if f.relayConn != nil {
+		_ = f.relayConn.Close()
+		f.relayConn = nil
+	}
+}
+func (f *fixture) close() {
+	f.stopRelay()
+	_ = f.proxy.Close()
+	if f.echoConn != nil {
+		_ = f.echoConn.Close()
+	}
+}
+
+func testCertificate() (tls.Certificate, []byte, error) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return tls.Certificate{}, nil, err
+	}
+	now := time.Now()
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "qortal-test-relay"},
+		DNSNames: []string{"qortal-test-relay"}, NotBefore: now.Add(-time.Minute), NotAfter: now.Add(time.Hour),
+		KeyUsage: x509.KeyUsageDigitalSignature, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		return tls.Certificate{}, nil, err
+	}
+	keyDER, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		return tls.Certificate{}, nil, err
+	}
+	cert, err := tls.X509KeyPair(
+		pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}),
+		pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER}),
+	)
+	return cert, der, err
+}
diff --git a/electron/native/private-transport/cmd/qortal-private-transport/main.go b/electron/native/private-transport/cmd/qortal-private-transport/main.go
new file mode 100644
index 000000000..1cfdafdfa
--- /dev/null
+++ b/electron/native/private-transport/cmd/qortal-private-transport/main.go
@@ -0,0 +1,15 @@
+package main
+
+import (
+	"context"
+	"os"
+
+	"qortal.org/qortal-hub/private-transport/internal/protocol"
+)
+
+func main() {
+	server := protocol.NewServer()
+	if err := server.Serve(context.Background(), os.Stdin, os.Stdout); err != nil {
+		os.Exit(1)
+	}
+}
diff --git a/electron/native/private-transport/go.mod b/electron/native/private-transport/go.mod
new file mode 100644
index 000000000..87c752e3f
--- /dev/null
+++ b/electron/native/private-transport/go.mod
@@ -0,0 +1,26 @@
+module qortal.org/qortal-hub/private-transport
+
+go 1.26.0
+
+replace github.com/mengelbart/moqtransport => ./third_party/moqtransport
+
+replace github.com/quic-go/quic-go => ./third_party/quic-go
+
+replace github.com/quic-go/masque-go => ./third_party/masque-go
+
+require (
+	github.com/cloudflare/circl v1.6.5
+	github.com/mengelbart/moqtransport v0.5.1-0.20260831154657-9eaf40a4dedd
+	github.com/quic-go/masque-go v0.5.0
+	github.com/quic-go/quic-go v0.62.0
+	github.com/yosida95/uritemplate/v3 v3.0.2
+)
+
+require (
+	github.com/dunglas/httpsfv v1.1.0 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+)
diff --git a/electron/native/private-transport/go.sum b/electron/native/private-transport/go.sum
new file mode 100644
index 000000000..ae16ad01c
--- /dev/null
+++ b/electron/native/private-transport/go.sum
@@ -0,0 +1,30 @@
+github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA=
+github.com/cloudflare/circl v1.6.5/go.mod h1:h5LNyxAc5nTue9DS5jT+48en2PSDYt3zdGnz5OstK6c=
+github.com/dunglas/httpsfv v1.1.0 h1:Jw76nAyKWKZKFrpMMcL76y35tOpYHqQPzHQiwDvpe54=
+github.com/dunglas/httpsfv v1.1.0/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
+github.com/quic-go/masque-go v0.5.0 h1:Ii6HUr/oRIROG9+xnGCMTKo7N8fb/J3hZOh1AMPH36M=
+github.com/quic-go/masque-go v0.5.0/go.mod h1:1o0Hj5Myu9wysEqY7oTyEgPEQjl2rQ2CKYkO5WrtZ7E=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.62.0 h1:ZHDjCk5OacATwGvs8PWE97CTvX7AqZiVoW7++ZOXTf8=
+github.com/quic-go/quic-go v0.62.0/go.mod h1:RAro2j2yN9a9EiPACLHT9IB2NXCvGQmmo/alT0yYI0w=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
diff --git a/electron/native/private-transport/internal/innerquic/framing.go b/electron/native/private-transport/internal/innerquic/framing.go
new file mode 100644
index 000000000..a8f6106fe
--- /dev/null
+++ b/electron/native/private-transport/internal/innerquic/framing.go
@@ -0,0 +1,121 @@
+package innerquic
+
+import (
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"io"
+)
+
+const (
+	ALPN                    = "qortal-private/1"
+	ProtocolVersion         = 1
+	MaxReliablePayloadBytes = 1024 * 1024
+	MaxMetadataBytes        = 4 * 1024
+	MaxDatagramPayloadBytes = 1024
+	InnerPacketSize         = 1200
+
+	FrameAttach   byte = 1
+	FrameAttached byte = 2
+	FrameReliable byte = 3
+)
+
+var streamMagic = [4]byte{'Q', 'P', '3', 'F'}
+var datagramMagic = [4]byte{'Q', 'P', '3', 'D'}
+
+type Frame struct {
+	Type     byte
+	Metadata []byte
+	Payload  []byte
+}
+
+func WriteFrame(w io.Writer, frame Frame) error {
+	if len(frame.Metadata) > MaxMetadataBytes || len(frame.Payload) > MaxReliablePayloadBytes {
+		return errors.New("inner frame exceeds limit")
+	}
+	header := make([]byte, 12)
+	copy(header[:4], streamMagic[:])
+	header[4] = ProtocolVersion
+	header[5] = frame.Type
+	binary.BigEndian.PutUint16(header[6:8], uint16(len(frame.Metadata)))
+	binary.BigEndian.PutUint32(header[8:12], uint32(len(frame.Payload)))
+	if err := writeFull(w, header); err != nil {
+		return err
+	}
+	if err := writeFull(w, frame.Metadata); err != nil {
+		return err
+	}
+	return writeFull(w, frame.Payload)
+}
+
+func writeFull(w io.Writer, data []byte) error {
+	for len(data) > 0 {
+		n, err := w.Write(data)
+		if err != nil {
+			return err
+		}
+		if n <= 0 {
+			return io.ErrShortWrite
+		}
+		data = data[n:]
+	}
+	return nil
+}
+
+func ReadFrame(r io.Reader) (Frame, error) {
+	header := make([]byte, 12)
+	if _, err := io.ReadFull(r, header); err != nil {
+		return Frame{}, err
+	}
+	if string(header[:4]) != string(streamMagic[:]) {
+		return Frame{}, errors.New("invalid inner frame magic")
+	}
+	if header[4] != ProtocolVersion {
+		return Frame{}, errors.New("unsupported inner protocol version")
+	}
+	metadataLen := int(binary.BigEndian.Uint16(header[6:8]))
+	payloadLen := int(binary.BigEndian.Uint32(header[8:12]))
+	if metadataLen > MaxMetadataBytes || payloadLen > MaxReliablePayloadBytes {
+		return Frame{}, errors.New("inner frame exceeds limit")
+	}
+	frame := Frame{Type: header[5], Metadata: make([]byte, metadataLen), Payload: make([]byte, payloadLen)}
+	if _, err := io.ReadFull(r, frame.Metadata); err != nil {
+		return Frame{}, err
+	}
+	if _, err := io.ReadFull(r, frame.Payload); err != nil {
+		return Frame{}, err
+	}
+	return frame, nil
+}
+
+func Metadata(value interface{}) ([]byte, error) {
+	data, err := json.Marshal(value)
+	if err != nil || len(data) > MaxMetadataBytes {
+		return nil, errors.New("invalid frame metadata")
+	}
+	return data, nil
+}
+
+func EncodeDatagram(messageID string, payload []byte) ([]byte, error) {
+	if len(messageID) == 0 || len(messageID) > 128 || len(payload) > MaxDatagramPayloadBytes {
+		return nil, errors.New("invalid inner datagram")
+	}
+	result := make([]byte, 7+len(messageID)+len(payload))
+	copy(result[:4], datagramMagic[:])
+	result[4] = ProtocolVersion
+	binary.BigEndian.PutUint16(result[5:7], uint16(len(messageID)))
+	copy(result[7:], messageID)
+	copy(result[7+len(messageID):], payload)
+	return result, nil
+}
+
+func DecodeDatagram(data []byte) (string, []byte, error) {
+	if len(data) < 7 || string(data[:4]) != string(datagramMagic[:]) || data[4] != ProtocolVersion {
+		return "", nil, errors.New("invalid inner datagram")
+	}
+	idLen := int(binary.BigEndian.Uint16(data[5:7]))
+	if idLen < 1 || idLen > 128 || 7+idLen > len(data) || len(data)-(7+idLen) > MaxDatagramPayloadBytes {
+		return "", nil, errors.New("invalid inner datagram lengths")
+	}
+	return string(data[7 : 7+idLen]), append([]byte(nil), data[7+idLen:]...), nil
+}
diff --git a/electron/native/private-transport/internal/innerquic/framing_test.go b/electron/native/private-transport/internal/innerquic/framing_test.go
new file mode 100644
index 000000000..a41bd8bd6
--- /dev/null
+++ b/electron/native/private-transport/internal/innerquic/framing_test.go
@@ -0,0 +1,35 @@
+package innerquic
+
+import (
+	"bytes"
+	"testing"
+)
+
+func TestReliableFramePreservesMetadataAndBinaryPayload(t *testing.T) {
+	var wire bytes.Buffer
+	want := Frame{Type: FrameReliable, Metadata: []byte(`{"messageId":"m1"}`), Payload: []byte{0, 1, 2, 255}}
+	if err := WriteFrame(&wire, want); err != nil {
+		t.Fatal(err)
+	}
+	got, err := ReadFrame(&wire)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Type != want.Type || !bytes.Equal(got.Metadata, want.Metadata) || !bytes.Equal(got.Payload, want.Payload) {
+		t.Fatalf("frame changed: %#v", got)
+	}
+}
+
+func TestFramesRejectOversizeAndProtocolMismatch(t *testing.T) {
+	if err := WriteFrame(&bytes.Buffer{}, Frame{Payload: make([]byte, MaxReliablePayloadBytes+1)}); err == nil {
+		t.Fatal("oversized frame accepted")
+	}
+	wire, err := EncodeDatagram("m", []byte("ok"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	wire[4]++
+	if _, _, err := DecodeDatagram(wire); err == nil {
+		t.Fatal("unsupported datagram version accepted")
+	}
+}
diff --git a/electron/native/private-transport/internal/innerquic/session.go b/electron/native/private-transport/internal/innerquic/session.go
new file mode 100644
index 000000000..5ef879fb1
--- /dev/null
+++ b/electron/native/private-transport/internal/innerquic/session.go
@@ -0,0 +1,359 @@
+package innerquic
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"crypto/tls"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	masqueclient "qortal.org/qortal-hub/private-transport/internal/masque"
+)
+
+const (
+	privateKeepAlivePeriod = 15 * time.Second
+	privateMaxIdleTimeout  = 2 * time.Minute
+)
+
+func privateQUICConfig() *quic.Config {
+	return &quic.Config{
+		EnableDatagrams:         true,
+		InitialPacketSize:       InnerPacketSize,
+		DisablePathMTUDiscovery: true,
+		KeepAlivePeriod:         privateKeepAlivePeriod,
+		MaxIdleTimeout:          privateMaxIdleTimeout,
+	}
+}
+
+type Config struct {
+	Relay             masqueclient.Config
+	BackendServerName string
+	BackendCertSHA256 string
+	LogicalSessionID  string
+	AttachToken       string
+	Nonce             string
+	Purpose           string
+	OwnerBindingHash  string
+	Timeout           time.Duration
+}
+
+type Event struct {
+	Kind, MessageID, Code string
+	Data                  []byte
+}
+type Metrics struct {
+	TunnelReceiveQueuedBytes        int64  `json:"tunnelReceiveQueuedBytes"`
+	TunnelReceiveDroppedFull        uint64 `json:"tunnelReceiveDroppedFull"`
+	TunnelReceiveDroppedBudget      uint64 `json:"tunnelReceiveDroppedBudget"`
+	TunnelReceiveDroppedExpired     uint64 `json:"tunnelReceiveDroppedExpired"`
+	TunnelReceiveMaxResidenceMicros uint64 `json:"tunnelReceiveMaxResidenceMicros"`
+	OuterReceiveDroppedFull         uint64 `json:"outerReceiveDroppedFull"`
+	OuterReceiveDroppedBudget       uint64 `json:"outerReceiveDroppedBudget"`
+	OuterReceiveDroppedExpired      uint64 `json:"outerReceiveDroppedExpired"`
+	InnerPacketsSent                uint64 `json:"innerPacketsSent"`
+	InnerPacketsLost                uint64 `json:"innerPacketsLost"`
+	InnerWireBytesSent              uint64 `json:"innerWireBytesSent"`
+	InnerWireBytesLost              uint64 `json:"innerWireBytesLost"`
+	OuterRTTMillis                  int64  `json:"outerRttMillis"`
+	OuterPacketsSent                uint64 `json:"outerPacketsSent"`
+	OuterPacketsLost                uint64 `json:"outerPacketsLost"`
+	OuterWireBytesSent              uint64 `json:"outerWireBytesSent"`
+	OuterWireBytesLost              uint64 `json:"outerWireBytesLost"`
+	TunnelWrites                    uint64 `json:"tunnelWrites"`
+	TunnelWriteMicros               uint64 `json:"tunnelWriteMicros"`
+	TunnelWriteErrors               uint64 `json:"tunnelWriteErrors"`
+	InnerRTTMillis                  int64  `json:"innerRttMillis"`
+	BytesSent                       uint64 `json:"bytesSent"`
+	BytesReceived                   uint64 `json:"bytesReceived"`
+	DatagramsDropped                uint64 `json:"datagramsDropped"`
+	StreamErrors                    uint64 `json:"streamErrors"`
+	ConnectionErrors                uint64 `json:"connectionErrors"`
+}
+
+type Session struct {
+	tunnel           *masqueclient.Tunnel
+	conn             *quic.Conn
+	stream           *quic.Stream
+	onEvent          func(Event)
+	reliableWriter   *boundedFrameWriter
+	streamsMu        sync.Mutex
+	streams          map[string]*reliableLane
+	reliableStreams  bool
+	maxReliableBytes int
+	closed           atomic.Bool
+	appSent          atomic.Uint64
+	appReceived      atomic.Uint64
+	datagramsDropped atomic.Uint64
+	streamErrors     atomic.Uint64
+	connectionErrors atomic.Uint64
+}
+
+type attachMetadata struct {
+	ProtocolVersion  int    `json:"protocolVersion"`
+	LogicalSessionID string `json:"logicalSessionId"`
+	AttachToken      string `json:"attachToken"`
+	Nonce            string `json:"nonce"`
+	Purpose          string `json:"purpose"`
+	OwnerBindingHash string `json:"ownerBindingHash"`
+}
+type attachedMetadata struct {
+	MaxReliableBytes    int    `json:"maxReliablePayloadBytes"`
+	ReliableStreams     bool   `json:"reliableStreams"`
+	OK                  bool   `json:"ok"`
+	LogicalSessionID    string `json:"logicalSessionId"`
+	TransportGeneration int    `json:"transportGeneration"`
+	Reliable            bool   `json:"reliable"`
+	Datagrams           bool   `json:"datagrams"`
+	Code                string `json:"code,omitempty"`
+}
+type messageMetadata struct {
+	MessageID string `json:"messageId"`
+}
+
+func Open(ctx context.Context, cfg Config, onEvent func(Event)) (*Session, error) {
+	pin, err := hex.DecodeString(cfg.BackendCertSHA256)
+	if err != nil || len(pin) != sha256.Size {
+		return nil, errors.New("invalid backend certificate pin")
+	}
+	timeout := cfg.Timeout
+	if timeout <= 0 {
+		timeout = 8 * time.Second
+	}
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	tunnel, err := masqueclient.Open(ctx, cfg.Relay)
+	if err != nil {
+		return nil, fmt.Errorf("MASQUE_TUNNEL_FAILED: %w", err)
+	}
+	fail := func(err error) (*Session, error) { _ = tunnel.Close(); return nil, err }
+	tlsConf := &tls.Config{
+		MinVersion: tls.VersionTLS13, NextProtos: []string{ALPN}, ServerName: cfg.BackendServerName,
+		InsecureSkipVerify: true,
+		VerifyConnection: func(state tls.ConnectionState) error {
+			if len(state.PeerCertificates) == 0 {
+				return errors.New("backend certificate missing")
+			}
+			leaf := state.PeerCertificates[0]
+			if now := time.Now(); now.Before(leaf.NotBefore) || now.After(leaf.NotAfter) {
+				return errors.New("backend certificate expired")
+			}
+			if err := leaf.VerifyHostname(cfg.BackendServerName); err != nil {
+				return errors.New("backend certificate name mismatch")
+			}
+			observed := sha256.Sum256(leaf.Raw)
+			if subtle.ConstantTimeCompare(observed[:], pin) != 1 {
+				return errors.New("backend certificate pin mismatch")
+			}
+			return nil
+		},
+	}
+	if tunnel.RemoteAddr() == nil {
+		return fail(errors.New("INNER_QUIC_FAILED: missing proxied backend address"))
+	}
+	conn, err := quic.Dial(
+		ctx,
+		tunnel.PacketConn(),
+		tunnel.RemoteAddr(),
+		tlsConf,
+		privateQUICConfig(),
+	)
+	if err != nil {
+		return fail(fmt.Errorf("INNER_QUIC_FAILED: %w", err))
+	}
+	stream, err := conn.OpenStreamSync(ctx)
+	if err != nil {
+		_ = conn.CloseWithError(1, "attach failed")
+		_ = tunnel.Close()
+		return nil, fmt.Errorf("SESSION_ATTACH_FAILED: %w", err)
+	}
+	// Dial's context does not bound subsequent stream reads or writes.
+	deadline, _ := ctx.Deadline()
+	_ = stream.SetDeadline(deadline)
+	stopAttach := context.AfterFunc(ctx, func() {
+		stream.CancelRead(1)
+		stream.CancelWrite(1)
+	})
+	defer stopAttach()
+	metadata, err := Metadata(attachMetadata{ProtocolVersion: ProtocolVersion, LogicalSessionID: cfg.LogicalSessionID, AttachToken: cfg.AttachToken, Nonce: cfg.Nonce, Purpose: cfg.Purpose, OwnerBindingHash: cfg.OwnerBindingHash})
+	if err != nil {
+		_ = conn.CloseWithError(1, "attach failed")
+		_ = tunnel.Close()
+		return nil, fmt.Errorf("SESSION_ATTACH_FAILED: %w", err)
+	}
+	if err := WriteFrame(stream, Frame{Type: FrameAttach, Metadata: metadata}); err != nil {
+		_ = conn.CloseWithError(1, "attach failed")
+		_ = tunnel.Close()
+		return nil, fmt.Errorf("SESSION_ATTACH_FAILED: %w", err)
+	}
+	response, err := ReadFrame(stream)
+	if err != nil || response.Type != FrameAttached {
+		_ = conn.CloseWithError(1, "attach failed")
+		_ = tunnel.Close()
+		return nil, errors.New("SESSION_ATTACH_FAILED")
+	}
+	var attached attachedMetadata
+	if json.Unmarshal(response.Metadata, &attached) != nil || !attached.OK || attached.LogicalSessionID != cfg.LogicalSessionID || attached.TransportGeneration != 1 {
+		_ = conn.CloseWithError(1, "attach rejected")
+		_ = tunnel.Close()
+		if attached.Code == "ATTACH_TOKEN_REJECTED" {
+			return nil, errors.New("ATTACH_TOKEN_REJECTED")
+		}
+		return nil, errors.New("SESSION_ATTACH_FAILED")
+	}
+	if !conn.ConnectionState().SupportsDatagrams.Remote {
+		_ = conn.CloseWithError(1, "datagrams required")
+		_ = tunnel.Close()
+		return nil, errors.New("DATAGRAM_UNSUPPORTED")
+	}
+	if !stopAttach() || ctx.Err() != nil {
+		_ = conn.CloseWithError(1, "attach timed out")
+		return fail(errors.New("SESSION_ATTACH_FAILED"))
+	}
+	_ = stream.SetDeadline(time.Time{})
+	limit := attached.MaxReliableBytes
+	if limit < 64*1024 || limit > MaxReliablePayloadBytes {
+		limit = 64 * 1024
+	}
+	s := &Session{tunnel: tunnel, conn: conn, stream: stream, onEvent: onEvent,
+		reliableWriter: newBoundedFrameWriter(stream), reliableStreams: attached.ReliableStreams,
+		streams: make(map[string]*reliableLane), maxReliableBytes: limit}
+	go s.readReliable()
+	go s.readDatagrams()
+	go s.watchConnection()
+	return s, nil
+}
+
+func (s *Session) SendReliable(messageID string, data []byte) error {
+	return s.SendReliableWithTimeout(messageID, data, 5*time.Second)
+}
+
+func (s *Session) SendReliableWithTimeout(messageID string, data []byte, timeout time.Duration) error {
+	if s.closed.Load() {
+		return errors.New("TRANSPORT_CLOSED")
+	}
+	if len(messageID) == 0 || len(messageID) > 128 || len(data) > 64*1024 {
+		return errors.New("FRAME_TOO_LARGE")
+	}
+	metadata, _ := Metadata(messageMetadata{MessageID: messageID})
+	err := s.reliableWriter.write(Frame{Type: FrameReliable, Metadata: metadata, Payload: data}, timeout)
+	if err == nil {
+		s.appSent.Add(uint64(len(data)))
+	} else {
+		s.streamErrors.Add(1)
+	}
+	return err
+}
+
+func (s *Session) SendDatagram(messageID string, data []byte) error {
+	if s.closed.Load() {
+		return errors.New("TRANSPORT_CLOSED")
+	}
+	encoded, err := EncodeDatagram(messageID, data)
+	if err != nil {
+		return err
+	}
+	if err = s.conn.SendDatagram(encoded); err != nil {
+		s.datagramsDropped.Add(1)
+		return err
+	}
+	s.appSent.Add(uint64(len(data)))
+	return nil
+}
+
+func (s *Session) Metrics() Metrics {
+	stats := s.conn.ConnectionStats()
+	m := Metrics{InnerRTTMillis: stats.SmoothedRTT.Milliseconds(), BytesSent: s.appSent.Load(), BytesReceived: s.appReceived.Load(), DatagramsDropped: s.datagramsDropped.Load(), StreamErrors: s.streamErrors.Load(), ConnectionErrors: s.connectionErrors.Load(),
+		InnerPacketsSent: stats.PacketsSent, InnerPacketsLost: stats.PacketsLost,
+		InnerWireBytesSent: stats.BytesSent, InnerWireBytesLost: stats.BytesLost}
+	if s.tunnel != nil {
+		h, q := s.tunnel.ReceiveBufferMetrics()
+		m.TunnelReceiveQueuedBytes, m.TunnelReceiveDroppedFull, m.TunnelReceiveDroppedBudget, m.TunnelReceiveDroppedExpired = h.QueuedBytes, h.DroppedFull, h.DroppedBudget, h.DroppedExpired
+		m.TunnelReceiveMaxResidenceMicros = h.MaxResidenceMicros
+		m.OuterReceiveDroppedFull, m.OuterReceiveDroppedBudget, m.OuterReceiveDroppedExpired = q.DroppedFull, q.DroppedBudget, q.DroppedExpired
+		outer, writes, micros, errors := s.tunnel.TransportMetrics()
+		m.OuterRTTMillis = outer.SmoothedRTT.Milliseconds()
+		m.OuterPacketsSent, m.OuterPacketsLost = outer.PacketsSent, outer.PacketsLost
+		m.OuterWireBytesSent, m.OuterWireBytesLost = outer.BytesSent, outer.BytesLost
+		m.TunnelWrites, m.TunnelWriteMicros, m.TunnelWriteErrors = writes, micros, errors
+	}
+	return m
+}
+
+func (s *Session) Close() error {
+	if !s.closed.CompareAndSwap(false, true) {
+		return nil
+	}
+	connErr := s.conn.CloseWithError(0, "closed")
+	// The inner CONNECTION_CLOSE must traverse CONNECT-UDP before its packet
+	// transport is torn down. A short grace avoids racing the outer tunnel close.
+	time.Sleep(50 * time.Millisecond)
+	return errors.Join(connErr, s.tunnel.Close())
+}
+
+func (s *Session) readReliable() {
+	s.readReliableStream(s.stream, true)
+}
+
+func (s *Session) readReliableStream(stream *quic.Stream, primary bool) {
+	for {
+		frame, err := ReadFrame(stream)
+		if err != nil {
+			if primary && !s.closed.Load() {
+				s.streamErrors.Add(1)
+				s.emit(Event{Kind: "error", Code: "STREAM_ERROR"})
+			}
+			return
+		}
+		if frame.Type != FrameReliable {
+			s.streamErrors.Add(1)
+			if primary {
+				s.emit(Event{Kind: "error", Code: "PROTOCOL_MISMATCH"})
+			}
+			return
+		}
+		var metadata messageMetadata
+		if json.Unmarshal(frame.Metadata, &metadata) != nil || metadata.MessageID == "" {
+			s.streamErrors.Add(1)
+			if primary {
+				s.emit(Event{Kind: "error", Code: "PROTOCOL_MISMATCH"})
+			}
+			return
+		}
+		s.appReceived.Add(uint64(len(frame.Payload)))
+		s.emit(Event{Kind: "reliableMessage", MessageID: metadata.MessageID, Data: frame.Payload})
+	}
+}
+func (s *Session) readDatagrams() {
+	for {
+		data, err := s.conn.ReceiveDatagram(context.Background())
+		if err != nil {
+			return
+		}
+		id, payload, err := DecodeDatagram(data)
+		if err != nil {
+			s.datagramsDropped.Add(1)
+			continue
+		}
+		s.appReceived.Add(uint64(len(payload)))
+		s.emit(Event{Kind: "datagram", MessageID: id, Data: payload})
+	}
+}
+func (s *Session) watchConnection() {
+	<-s.conn.Context().Done()
+	if !s.closed.Load() {
+		s.connectionErrors.Add(1)
+		s.emit(Event{Kind: "error", Code: "INNER_QUIC_FAILED"})
+	}
+}
+func (s *Session) emit(event Event) {
+	if s.onEvent != nil {
+		s.onEvent(event)
+	}
+}
diff --git a/electron/native/private-transport/internal/innerquic/session_test.go b/electron/native/private-transport/internal/innerquic/session_test.go
new file mode 100644
index 000000000..c029feda5
--- /dev/null
+++ b/electron/native/private-transport/internal/innerquic/session_test.go
@@ -0,0 +1,11 @@
+package innerquic
+
+import "testing"
+
+func TestPrivateQUICConfigKeepsIdleChannelAlive(t *testing.T) {
+	config := privateQUICConfig()
+	if !config.EnableDatagrams || config.KeepAlivePeriod != privateKeepAlivePeriod ||
+		config.MaxIdleTimeout != privateMaxIdleTimeout {
+		t.Fatalf("unexpected idle private-channel config: %#v", config)
+	}
+}
diff --git a/electron/native/private-transport/internal/innerquic/streams.go b/electron/native/private-transport/internal/innerquic/streams.go
new file mode 100644
index 000000000..c39ee8030
--- /dev/null
+++ b/electron/native/private-transport/internal/innerquic/streams.go
@@ -0,0 +1,80 @@
+package innerquic
+
+import (
+	"errors"
+	"regexp"
+	"time"
+
+	"github.com/quic-go/quic-go"
+)
+
+var streamKeyPattern = regexp.MustCompile(`^[A-Za-z0-9._-]{1,96}$`)
+
+type reliableLane struct {
+	stream *quic.Stream
+	writer *boundedFrameWriter
+}
+
+// Keys are opaque application routing labels, scoped to this attached session.
+// End sends the final frame and FIN; the reply side remains alive until EOF.
+func (s *Session) SendReliableStream(key, messageID string, data []byte, end bool) error {
+	return s.SendReliableStreamWithTimeout(key, messageID, data, end, 5*time.Second)
+}
+
+func (s *Session) SendReliableStreamWithTimeout(key, messageID string, data []byte, end bool, timeout time.Duration) error {
+	if s.closed.Load() || s.conn.Context().Err() != nil {
+		return errors.New("TRANSPORT_CLOSED")
+	}
+	if !s.reliableStreams {
+		return errors.New("RELIABLE_STREAMS_UNSUPPORTED")
+	}
+	limit := s.maxReliableBytes
+	if limit == 0 {
+		limit = 64 * 1024
+	}
+	if len(data) > limit {
+		return errors.New("BULK_TRANSPORT_UNSUPPORTED")
+	}
+	if !streamKeyPattern.MatchString(key) || len(messageID) == 0 || len(messageID) > 128 || len(data) > MaxReliablePayloadBytes {
+		return errors.New("invalid reliable stream message")
+	}
+	s.streamsMu.Lock()
+	lane := s.streams[key]
+	if lane == nil {
+		if len(s.streams) >= 32 {
+			s.streamsMu.Unlock()
+			return errors.New("STREAM_LIMIT_REACHED")
+		}
+		stream, err := s.conn.OpenStream()
+		if err != nil {
+			s.streamsMu.Unlock()
+			return errors.New("STREAM_LIMIT_REACHED")
+		}
+		lane = &reliableLane{stream: stream, writer: newBoundedFrameWriter(stream)}
+		s.streams[key] = lane
+		go func() {
+			s.readReliableStream(stream, false)
+			stream.CancelRead(1)
+			stream.CancelWrite(1)
+			s.streamsMu.Lock()
+			if s.streams[key] == lane {
+				delete(s.streams, key)
+			}
+			s.streamsMu.Unlock()
+		}()
+	}
+	s.streamsMu.Unlock()
+	metadata, _ := Metadata(messageMetadata{MessageID: messageID})
+	if err := lane.writer.write(Frame{Type: FrameReliable, Metadata: metadata, Payload: data}, timeout); err != nil {
+		lane.stream.CancelRead(1)
+		lane.stream.CancelWrite(1)
+		return errors.New("RELIABLE_STREAM_FAILED")
+	}
+	s.appSent.Add(uint64(len(data)))
+	if end {
+		_ = lane.stream.Close()
+		// Bound half-closed lanes even if the backend never finishes its replies.
+		_ = lane.stream.SetReadDeadline(time.Now().Add(30 * time.Second))
+	}
+	return nil
+}
diff --git a/electron/native/private-transport/internal/innerquic/streams_test.go b/electron/native/private-transport/internal/innerquic/streams_test.go
new file mode 100644
index 000000000..720aba305
--- /dev/null
+++ b/electron/native/private-transport/internal/innerquic/streams_test.go
@@ -0,0 +1,111 @@
+package innerquic
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"github.com/quic-go/quic-go"
+	"math/big"
+	"testing"
+	"time"
+)
+
+func TestControlStreamProgressesWhileBulkIsFlowControlled(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	template := &x509.Certificate{SerialNumber: big.NewInt(1), NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(time.Hour), KeyUsage: x509.KeyUsageDigitalSignature}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	listener, err := quic.ListenAddr("127.0.0.1:0", &tls.Config{Certificates: []tls.Certificate{{Certificate: [][]byte{der}, PrivateKey: key}}, NextProtos: []string{ALPN}}, &quic.Config{InitialStreamReceiveWindow: 1024, MaxStreamReceiveWindow: 1024, InitialConnectionReceiveWindow: 1024 * 1024, MaxConnectionReceiveWindow: 1024 * 1024})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	client, err := quic.DialAddr(ctx, listener.Addr().String(), &tls.Config{InsecureSkipVerify: true, NextProtos: []string{ALPN}}, &quic.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer client.CloseWithError(0, "test complete")
+	server, err := listener.Accept(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer server.CloseWithError(0, "test complete")
+	events := make(chan Event, 4)
+	session := &Session{conn: client, reliableStreams: true, maxReliableBytes: MaxReliablePayloadBytes, streams: map[string]*reliableLane{}, onEvent: func(e Event) { events <- e }}
+	// An older attached peer does not opt into larger frames. Reject locally,
+	// without creating a stream or disturbing its connection.
+	session.maxReliableBytes = 0
+	if err := session.SendReliableStream("unsupported", "large", make([]byte, 65537), false); err == nil || err.Error() != "BULK_TRANSPORT_UNSUPPORTED" {
+		t.Fatalf("expected old-peer capability rejection, got %v", err)
+	}
+	if len(session.streams) != 0 {
+		t.Fatal("unsupported send created a stream")
+	}
+	session.maxReliableBytes = MaxReliablePayloadBytes
+	bulkResult := make(chan error, 1)
+	go func() {
+		bulkResult <- session.SendReliableStream("bulk", "bulk-message", make([]byte, MaxReliablePayloadBytes), false)
+	}()
+	bulk, err := server.AcceptStream(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Deliberately don't read bulk: its 1 KiB receive window cannot fit the frame.
+	if err := session.SendReliableStream("control", "control-message", []byte("ping"), true); err != nil {
+		t.Fatal(err)
+	}
+	control, err := server.AcceptStream(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if control.StreamID() == bulk.StreamID() {
+		t.Fatal("traffic shared a stream")
+	}
+	frame, err := ReadFrame(control)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(frame.Payload) != "ping" {
+		t.Fatal("wrong control payload")
+	}
+	if err := WriteFrame(control, frame); err != nil {
+		t.Fatal(err)
+	}
+	_ = control.Close()
+	select {
+	case event := <-events:
+		if event.MessageID != "control-message" {
+			t.Fatalf("wrong event: %+v", event)
+		}
+	case <-ctx.Done():
+		t.Fatal("control response blocked behind bulk")
+	}
+	select {
+	case <-bulkResult:
+		t.Fatal("bulk unexpectedly completed without being read")
+	default:
+	}
+	bulk.CancelRead(1)
+	select {
+	case err := <-bulkResult:
+		if err == nil {
+			t.Fatal("cancelled bulk write succeeded")
+		}
+	case <-ctx.Done():
+		t.Fatal("cancelled write did not terminate")
+	}
+	// Stream failure must not close the authenticated QUIC connection.
+	if err := session.SendReliableStream("diagnostic", "after-reset", []byte("ok"), false); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/electron/native/private-transport/internal/innerquic/writer.go b/electron/native/private-transport/internal/innerquic/writer.go
new file mode 100644
index 000000000..d6fd50ac7
--- /dev/null
+++ b/electron/native/private-transport/internal/innerquic/writer.go
@@ -0,0 +1,58 @@
+package innerquic
+
+import (
+	"context"
+	"errors"
+	"io"
+	"time"
+
+	"github.com/quic-go/quic-go"
+)
+
+// ErrReliableWriteFailed means this physical stream must not be reused. A
+// partial frame cannot safely be followed by another frame on the same stream.
+var ErrReliableWriteFailed = errors.New("reliable stream write failed")
+
+type deadlineWriteStream interface {
+	io.Writer
+	SetWriteDeadline(time.Time) error
+	CancelWrite(quic.StreamErrorCode)
+}
+
+type boundedFrameWriter struct {
+	stream deadlineWriteStream
+	gate   chan struct{}
+	failed bool // protected by gate
+}
+
+func newBoundedFrameWriter(stream deadlineWriteStream) *boundedFrameWriter {
+	return &boundedFrameWriter{stream: stream, gate: make(chan struct{}, 1)}
+}
+
+func (w *boundedFrameWriter) write(frame Frame, timeout time.Duration) error {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	select {
+	case w.gate <- struct{}{}:
+		defer func() { <-w.gate }()
+	case <-ctx.Done():
+		return errors.Join(ErrReliableWriteFailed, ctx.Err())
+	}
+	if w.failed {
+		return ErrReliableWriteFailed
+	}
+	if err := ctx.Err(); err != nil {
+		return errors.Join(ErrReliableWriteFailed, err)
+	}
+	deadline, _ := ctx.Deadline()
+	err := w.stream.SetWriteDeadline(deadline)
+	if err == nil {
+		err = WriteFrame(w.stream, frame)
+	}
+	if err != nil {
+		w.failed = true
+		w.stream.CancelWrite(1)
+		return errors.Join(ErrReliableWriteFailed, err)
+	}
+	return nil
+}
diff --git a/electron/native/private-transport/internal/innerquic/writer_test.go b/electron/native/private-transport/internal/innerquic/writer_test.go
new file mode 100644
index 000000000..c7fcb7493
--- /dev/null
+++ b/electron/native/private-transport/internal/innerquic/writer_test.go
@@ -0,0 +1,82 @@
+package innerquic
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+)
+
+type testWriteStream struct {
+	bytes.Buffer
+	deadline  time.Time
+	blocked   bool
+	cancelled bool
+}
+
+func (s *testWriteStream) SetWriteDeadline(d time.Time) error { s.deadline = d; return nil }
+func (s *testWriteStream) CancelWrite(quic.StreamErrorCode)   { s.cancelled = true }
+func (s *testWriteStream) Write(p []byte) (int, error) {
+	if s.blocked {
+		time.Sleep(time.Until(s.deadline))
+		return 0, os.ErrDeadlineExceeded
+	}
+	// Exercise framing across short writes, too.
+	if len(p) > 3 {
+		p = p[:3]
+	}
+	return s.Buffer.Write(p)
+}
+
+func TestReliableWriteDeadlineCancelsAndPoisonsStream(t *testing.T) {
+	s := &testWriteStream{blocked: true}
+	w := newBoundedFrameWriter(s)
+	start := time.Now()
+	err := w.write(Frame{Type: FrameReliable}, 30*time.Millisecond)
+	if !errors.Is(err, ErrReliableWriteFailed) || !s.cancelled || time.Since(start) > time.Second {
+		t.Fatalf("write not bounded/cancelled: %v", err)
+	}
+	s.blocked = false
+	if err := w.write(Frame{Type: FrameReliable}, time.Second); !errors.Is(err, ErrReliableWriteFailed) || s.Len() != 0 {
+		t.Fatal("reused a failed stream")
+	}
+	// A replacement owns its own gate and failure state.
+	replacement := newBoundedFrameWriter(&testWriteStream{})
+	if err := replacement.write(Frame{Type: FrameReliable}, time.Second); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReliableWriteGateHasDeadline(t *testing.T) {
+	s := &testWriteStream{}
+	w := newBoundedFrameWriter(s)
+	w.gate <- struct{}{}
+	start := time.Now()
+	err := w.write(Frame{Type: FrameReliable}, 30*time.Millisecond)
+	if !errors.Is(err, ErrReliableWriteFailed) || time.Since(start) > time.Second {
+		t.Fatalf("lock wait not bounded: %v", err)
+	}
+	if s.cancelled || !s.deadline.IsZero() {
+		t.Fatal("waiting writer touched active writer's stream")
+	}
+	<-w.gate
+}
+
+func TestReliableWriteKeepsFrameBoundaries(t *testing.T) {
+	s := &testWriteStream{}
+	w := newBoundedFrameWriter(s)
+	for i := 0; i < 2; i++ {
+		if err := w.write(Frame{Type: FrameReliable, Payload: []byte("hello")}, time.Second); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for i := 0; i < 2; i++ {
+		f, err := ReadFrame(&s.Buffer)
+		if err != nil || string(f.Payload) != "hello" {
+			t.Fatalf("invalid frame: %v", err)
+		}
+	}
+}
diff --git a/electron/native/private-transport/internal/masque/client.go b/electron/native/private-transport/internal/masque/client.go
new file mode 100644
index 000000000..1a8310d9d
--- /dev/null
+++ b/electron/native/private-transport/internal/masque/client.go
@@ -0,0 +1,286 @@
+package masqueclient
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"crypto/tls"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	masque "github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+const MaxDatagramBytes = 1200
+
+const (
+	tunnelKeepAlivePeriod = 15 * time.Second
+	tunnelMaxIdleTimeout  = 2 * time.Minute
+)
+
+func tunnelQUICConfig() *quic.Config {
+	return &quic.Config{
+		EnableDatagrams: true,
+		KeepAlivePeriod: tunnelKeepAlivePeriod,
+		MaxIdleTimeout:  tunnelMaxIdleTimeout,
+	}
+}
+
+type Config struct {
+	PreparedRelay   string
+	LegacyRelay     bool
+	RelayAddress    string
+	RelayServerName string
+	RelayCertSHA256 string
+	TargetAddress   string
+	Timeout         time.Duration
+}
+
+type Tunnel struct {
+	conn        net.PacketConn
+	outer       *quic.Conn
+	writes      atomic.Uint64
+	writeNanos  atomic.Uint64
+	writeErrors atomic.Uint64
+	onClose     func()
+	closeOnce   sync.Once
+}
+
+// PacketConn is the only packet path exposed to the inner QUIC transport.
+func (t *Tunnel) PacketConn() net.PacketConn {
+	return &measuredPacketConn{PacketConn: t.conn, tunnel: t}
+}
+
+type measuredPacketConn struct {
+	net.PacketConn
+	tunnel *Tunnel
+}
+
+func (c *measuredPacketConn) WriteTo(data []byte, addr net.Addr) (int, error) {
+	start := time.Now()
+	n, err := c.PacketConn.WriteTo(data, addr)
+	c.tunnel.writes.Add(1)
+	c.tunnel.writeNanos.Add(uint64(time.Since(start)))
+	if err != nil {
+		c.tunnel.writeErrors.Add(1)
+	}
+	return n, err
+}
+
+// Outer counters cover the pooled relay connection, potentially shared by
+// multiple tunnels. Write timing covers only this tunnel's packet submission.
+func (t *Tunnel) TransportMetrics() (quic.ConnectionStats, uint64, uint64, uint64) {
+	var stats quic.ConnectionStats
+	if t.outer != nil {
+		stats = t.outer.ConnectionStats()
+	}
+	return stats, t.writes.Load(), t.writeNanos.Load() / uint64(time.Microsecond), t.writeErrors.Load()
+}
+
+func (t *Tunnel) ReceiveBufferMetrics() (quic.DatagramReceiveBufferStats, quic.DatagramReceiveBufferStats) {
+	var httpStats, quicStats quic.DatagramReceiveBufferStats
+	if c, ok := t.conn.(interface {
+		DatagramReceiveBufferStats() quic.DatagramReceiveBufferStats
+	}); ok {
+		httpStats = c.DatagramReceiveBufferStats()
+	}
+	if t.outer != nil {
+		quicStats = t.outer.DatagramReceiveBufferStats()
+	}
+	return httpStats, quicStats
+}
+
+// RemoteAddr is the logical backend endpoint represented by CONNECT-UDP.
+func (t *Tunnel) RemoteAddr() net.Addr {
+	type remoteAddr interface{ RemoteAddr() net.Addr }
+	if conn, ok := t.conn.(remoteAddr); ok {
+		return conn.RemoteAddr()
+	}
+	return nil
+}
+
+func Open(ctx context.Context, cfg Config) (*Tunnel, error) {
+	if cfg.PreparedRelay != "" {
+		return openPrepared(ctx, cfg)
+	}
+	relay, err := parseLiteralAddrPort("relayAddress", cfg.RelayAddress)
+	if err != nil {
+		return nil, err
+	}
+	target, err := parseLiteralAddrPort("targetAddress", cfg.TargetAddress)
+	if err != nil {
+		return nil, err
+	}
+	if cfg.RelayServerName == "" {
+		return nil, errors.New("relayServerName is required")
+	}
+	pin, err := hex.DecodeString(cfg.RelayCertSHA256)
+	if err != nil || len(pin) != sha256.Size {
+		return nil, errors.New("relayCertSha256 must be a 64-character hexadecimal SHA-256 hash")
+	}
+
+	timeout := cfg.Timeout
+	if timeout <= 0 {
+		timeout = 5 * time.Second
+	}
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	relayAddress := relay.String()
+	tlsConfig := &tls.Config{
+		MinVersion:         tls.VersionTLS13,
+		NextProtos:         []string{http3.NextProtoH3},
+		ServerName:         cfg.RelayServerName,
+		InsecureSkipVerify: true, // Standard verification is replaced by the mandatory leaf pin below.
+		VerifyConnection: func(state tls.ConnectionState) error {
+			if len(state.PeerCertificates) == 0 {
+				return errors.New("relay did not present a certificate")
+			}
+			leaf := state.PeerCertificates[0]
+			if now := time.Now(); now.Before(leaf.NotBefore) || now.After(leaf.NotAfter) {
+				return errors.New("relay certificate is outside its validity period")
+			}
+			if err := leaf.VerifyHostname(cfg.RelayServerName); err != nil {
+				return errors.New("relay certificate identity mismatch")
+			}
+			observed := sha256.Sum256(leaf.Raw)
+			if subtle.ConstantTimeCompare(observed[:], pin) != 1 {
+				return errors.New("relay certificate pin mismatch")
+			}
+			return nil
+		},
+	}
+
+	proxyTemplate := uritemplate.MustNew(fmt.Sprintf(
+		"https://%s/.well-known/masque/udp/{target_host}/{target_port}/",
+		relayAddress,
+	))
+	req, err := masque.NewRequest(ctx, proxyTemplate, target.String())
+	if err != nil {
+		return nil, fmt.Errorf("create CONNECT-UDP request: %w", err)
+	}
+	var outer *quic.Conn
+	transport := masque.Transport{
+		TLSClientConfig: tlsConfig,
+		QUICConfig:      tunnelQUICConfig(),
+		// Pin the network destination as well as its certificate identity. This
+		// prevents a library change from resolving or substituting a hostname.
+		DialAddr: func(dialCtx context.Context, addr string, tlsConf *tls.Config, quicConf *quic.Config) (*quic.Conn, error) {
+			if addr != relayAddress {
+				return nil, fmt.Errorf("unexpected relay address %q", addr)
+			}
+			var err error
+			outer, err = quic.DialAddr(dialCtx, relayAddress, tlsConf, quicConf)
+			return outer, err
+		},
+	}
+	conn, response, err := transport.Dial(req)
+	if err != nil {
+		if response != nil {
+			return nil, responseError(response)
+		}
+		return nil, fmt.Errorf("open CONNECT-UDP tunnel: %w", err)
+	}
+	conn.EnableDatagramReceiveBuffer()
+	outer.EnableDatagramReceiveBuffer()
+	return &Tunnel{conn: conn, outer: outer}, nil
+}
+
+func parseLiteralAddrPort(name, value string) (netip.AddrPort, error) {
+	addr, err := netip.ParseAddrPort(value)
+	if err != nil || !addr.Addr().IsValid() || addr.Port() == 0 {
+		return netip.AddrPort{}, fmt.Errorf("%s must be a literal IP address and non-zero port", name)
+	}
+	return addr, nil
+}
+
+func (t *Tunnel) Send(data []byte) error {
+	if len(data) == 0 || len(data) > MaxDatagramBytes {
+		return fmt.Errorf("datagram must contain 1..%d bytes", MaxDatagramBytes)
+	}
+	_, err := t.conn.WriteTo(data, nil)
+	return err
+}
+
+func (t *Tunnel) Receive(timeout time.Duration) ([]byte, error) {
+	if timeout <= 0 {
+		timeout = 5 * time.Second
+	}
+	if err := t.conn.SetReadDeadline(time.Now().Add(timeout)); err != nil {
+		return nil, err
+	}
+	buf := make([]byte, 1500)
+	n, _, err := t.conn.ReadFrom(buf)
+	if err != nil {
+		return nil, err
+	}
+	return append([]byte(nil), buf[:n]...), nil
+}
+
+func (t *Tunnel) Close() error {
+	err := t.conn.Close()
+	t.closeOnce.Do(func() {
+		if t.onClose != nil {
+			t.onClose()
+		}
+	})
+	return err
+}
+
+func responseError(response *http.Response) error {
+	code := response.Header.Get("Qortal-Relay-Error")
+	switch code {
+	case "RELAY_ACCESS_DENIED", "RELAY_PROOF_INVALID", "RELAY_AUTH_REQUIRED", "RELAY_MEMBERSHIP_UNAVAILABLE", "RELAY_TARGET_DENIED", "RELAY_FULL", "RELAY_AUTH_RATE_LIMITED", "RELAY_AUTH_UNAVAILABLE":
+		return errors.New(code)
+	}
+	return errors.New("RELAY_PROTOCOL_UNSUPPORTED")
+}
+
+// Authenticated QUIC application close codes preserve rejection semantics
+// even when an immediate revocation closes before its HTTP response arrives.
+func relayConnectionError(err error) error {
+	var applicationError *quic.ApplicationError
+	if errors.As(err, &applicationError) {
+		switch applicationError.ErrorCode {
+		case 0x515201:
+			return errors.New("RELAY_ACCESS_DENIED")
+		case 0x515202:
+			return errors.New("RELAY_AUTH_REQUIRED")
+		case 0x515203:
+			return errors.New("RELAY_FULL")
+		}
+	}
+	return errors.New("RELAY_CONNECT_FAILED")
+}
+
+func pinnedRelayTLS(cfg Config) (*tls.Config, string, error) {
+	relay, err := parseLiteralAddrPort("relayAddress", cfg.RelayAddress)
+	if err != nil {
+		return nil, "", err
+	}
+	pin, err := hex.DecodeString(cfg.RelayCertSHA256)
+	if err != nil || len(pin) != 32 || cfg.RelayServerName == "" {
+		return nil, "", errors.New("INVALID_RELAY_CONFIG")
+	}
+	return &tls.Config{MinVersion: tls.VersionTLS13, NextProtos: []string{http3.NextProtoH3}, ServerName: cfg.RelayServerName, InsecureSkipVerify: true, VerifyConnection: func(s tls.ConnectionState) error {
+		if len(s.PeerCertificates) == 0 {
+			return errors.New("RELAY_CERTIFICATE_INVALID")
+		}
+		leaf := s.PeerCertificates[0]
+		hash := sha256.Sum256(leaf.Raw)
+		if time.Now().Before(leaf.NotBefore) || time.Now().After(leaf.NotAfter) || leaf.VerifyHostname(cfg.RelayServerName) != nil || subtle.ConstantTimeCompare(hash[:], pin) != 1 {
+			return errors.New("RELAY_CERTIFICATE_INVALID")
+		}
+		return nil
+	}}, relay.String(), nil
+}
diff --git a/electron/native/private-transport/internal/masque/client_test.go b/electron/native/private-transport/internal/masque/client_test.go
new file mode 100644
index 000000000..bf864847f
--- /dev/null
+++ b/electron/native/private-transport/internal/masque/client_test.go
@@ -0,0 +1,45 @@
+package masqueclient
+
+import (
+	"net"
+	"testing"
+	"time"
+)
+
+func TestPacketMeasurementPreservesDeliveryAndErrors(t *testing.T) {
+	conn, err := net.ListenPacket("udp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	tunnel := &Tunnel{conn: conn}
+	measured := tunnel.PacketConn()
+	if err := measured.SetDeadline(time.Now().Add(time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	if n, err := measured.WriteTo([]byte("opaque"), conn.LocalAddr()); n != 6 || err != nil {
+		t.Fatalf("write changed: %d %v", n, err)
+	}
+	buffer := make([]byte, 10)
+	if n, _, err := measured.ReadFrom(buffer); err != nil || string(buffer[:n]) != "opaque" {
+		t.Fatalf("read changed: %v", err)
+	}
+	if err := measured.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := measured.WriteTo([]byte("opaque"), conn.LocalAddr()); err == nil {
+		t.Fatal("closed socket write succeeded")
+	}
+	_, writes, _, failures := tunnel.TransportMetrics()
+	if writes != 2 || failures != 1 {
+		t.Fatalf("wrong counters: %d %d", writes, failures)
+	}
+}
+
+func TestTunnelQUICConfigKeepsIdleCallTunnelAlive(t *testing.T) {
+	config := tunnelQUICConfig()
+	if !config.EnableDatagrams || config.KeepAlivePeriod != tunnelKeepAlivePeriod ||
+		config.MaxIdleTimeout != tunnelMaxIdleTimeout {
+		t.Fatalf("unexpected idle tunnel config: %#v", config)
+	}
+}
diff --git a/electron/native/private-transport/internal/masque/pool.go b/electron/native/private-transport/internal/masque/pool.go
new file mode 100644
index 000000000..7165f7cc8
--- /dev/null
+++ b/electron/native/private-transport/internal/masque/pool.go
@@ -0,0 +1,246 @@
+package masqueclient
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	masque "github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+type PreparedRelay struct {
+	Handle    string          `json:"handle"`
+	Ready     bool            `json:"ready"`
+	Challenge json.RawMessage `json:"challenge,omitempty"`
+	ExpiresAt int64           `json:"expiresAt,omitempty"`
+}
+type pooledRelay struct {
+	mu        sync.Mutex
+	config    Config
+	conn      *quic.Conn
+	client    *masque.ClientConn
+	ready     bool
+	expiresAt int64
+	touched   time.Time
+	refs      int
+}
+
+var relayPool = struct {
+	sync.Mutex
+	entries map[string]*pooledRelay
+	epoch   uint64
+}{entries: map[string]*pooledRelay{}}
+
+// BeginRelay connects without forwarding any destination traffic. Its handle
+// is private IPC state; account authorization remains in the wallet process.
+func BeginRelay(ctx context.Context, cfg Config) (PreparedRelay, error) {
+	relayPool.Lock()
+	epoch := relayPool.epoch
+	relayPool.Unlock()
+	tlsConfig, relayAddress, err := pinnedRelayTLS(cfg)
+	if err != nil {
+		return PreparedRelay{}, err
+	}
+	ctx, cancel := context.WithTimeout(ctx, 4*time.Second)
+	defer cancel()
+	conn, err := quic.DialAddr(ctx, relayAddress, tlsConfig, tunnelQUICConfig())
+	if err != nil {
+		return PreparedRelay{}, fmt.Errorf("RELAY_CONNECT_FAILED: %w", err)
+	}
+	tr := &masque.Transport{}
+	client, err := tr.NewClientConn(conn)
+	if err != nil {
+		conn.CloseWithError(0, "")
+		return PreparedRelay{}, errors.New("RELAY_PROTOCOL_UNSUPPORTED")
+	}
+	id := make([]byte, 24)
+	if _, err = rand.Read(id); err != nil {
+		conn.CloseWithError(0, "")
+		return PreparedRelay{}, err
+	}
+	handle := hex.EncodeToString(id)
+	p := &pooledRelay{config: cfg, conn: conn, client: client, touched: time.Now()}
+	relayPool.Lock()
+	if epoch != relayPool.epoch {
+		relayPool.Unlock()
+		conn.CloseWithError(0, "account changed")
+		return PreparedRelay{}, errors.New("RELAY_CONNECTION_CLOSED")
+	}
+	if len(relayPool.entries) >= 32 {
+		relayPool.Unlock()
+		conn.CloseWithError(0, "")
+		return PreparedRelay{}, errors.New("RELAY_POOL_FULL")
+	}
+	relayPool.entries[handle] = p
+	relayPool.Unlock()
+	context.AfterFunc(conn.Context(), func() { relayPool.Lock(); delete(relayPool.entries, handle); relayPool.Unlock() })
+	go func() {
+		ticker := time.NewTicker(10 * time.Second)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-conn.Context().Done():
+				return
+			case <-ticker.C:
+				p.mu.Lock()
+				idle := p.refs == 0 && time.Since(p.touched) > 30*time.Second
+				p.mu.Unlock()
+				if idle {
+					CloseRelay(handle)
+					return
+				}
+			}
+		}
+	}()
+	if cfg.LegacyRelay {
+		p.mu.Lock()
+		p.ready = true
+		p.mu.Unlock()
+		return PreparedRelay{Handle: handle, Ready: true}, nil
+	}
+	result, err := AuthorizeRelay(ctx, handle, "", false)
+	if err != nil {
+		CloseRelay(handle)
+	}
+	return result, err
+}
+
+func AuthorizeRelay(ctx context.Context, handle, proof string, renew bool) (PreparedRelay, error) {
+	p := findRelay(handle)
+	if p == nil {
+		return PreparedRelay{}, errors.New("RELAY_CONNECTION_CLOSED")
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.touched = time.Now()
+	if p.config.LegacyRelay {
+		if p.conn.Context().Err() != nil {
+			return PreparedRelay{}, errors.New("RELAY_CONNECTION_CLOSED")
+		}
+		return PreparedRelay{Handle: handle, Ready: true}, nil
+	}
+	ctx, cancel := context.WithTimeout(ctx, 7*time.Second)
+	defer cancel()
+	template := uritemplate.MustNew("https://" + p.config.RelayAddress + "/.well-known/masque/udp/{target_host}/{target_port}/")
+	req, err := masque.NewRequest(ctx, template, "0.0.0.0:1")
+	if err != nil {
+		return PreparedRelay{}, err
+	}
+	req.Header().Set("Qortal-Relay-Control", "authorize")
+	if renew {
+		req.Header().Set("Qortal-Relay-Renew", "1")
+	}
+	if proof != "" {
+		if len(proof) > 2048 {
+			return PreparedRelay{}, errors.New("RELAY_PROOF_INVALID")
+		}
+		// Never send account proofs on the IP-visible relay connection.
+		var token map[string]json.RawMessage
+		if json.Unmarshal([]byte(proof), &token) != nil || len(token) != 4 || token["epoch"] == nil || token["keyId"] == nil || token["message"] == nil || token["signature"] == nil {
+			return PreparedRelay{}, errors.New("RELAY_PROOF_INVALID")
+		}
+		req.Header().Set("Qortal-Relay-Ticket", proof)
+	}
+	c, response, err := p.client.Dial(req)
+	if c != nil {
+		c.Close()
+	}
+	result := PreparedRelay{Handle: handle}
+	if response != nil {
+		if value := response.Header.Get("Qortal-Relay-Challenge"); response.StatusCode == 401 && len(value) > 0 && len(value) <= 1024 && json.Valid([]byte(value)) {
+			if value == `{"type":"masque-ticket-required-v1"}` {
+				result.Challenge = json.RawMessage(value)
+				return result, nil
+			}
+			// Old identity-bearing challenges are deliberately unsupported.
+			return result, errors.New("RELAY_PROTOCOL_UNSUPPORTED")
+		}
+		if err != nil {
+			return result, responseError(response)
+		}
+		if response.StatusCode != 204 {
+			return result, errors.New("RELAY_PROTOCOL_UNSUPPORTED")
+		}
+		if v := response.Header.Get("Qortal-Relay-Expires"); v != "" {
+			if _, e := fmt.Sscan(v, &p.expiresAt); e != nil {
+				return result, errors.New("RELAY_PROTOCOL_UNSUPPORTED")
+			}
+		}
+	}
+	if err != nil {
+		return result, relayConnectionError(err)
+	}
+	p.ready = true
+	result.Ready = true
+	result.ExpiresAt = p.expiresAt
+	return result, nil
+}
+
+func findRelay(handle string) *pooledRelay {
+	relayPool.Lock()
+	defer relayPool.Unlock()
+	return relayPool.entries[handle]
+}
+func CloseRelay(handle string) {
+	relayPool.Lock()
+	p := relayPool.entries[handle]
+	delete(relayPool.entries, handle)
+	relayPool.Unlock()
+	if p != nil {
+		p.conn.CloseWithError(0, "relay connection released")
+	}
+}
+func CloseAllRelays() {
+	clearTicketStates()
+	relayPool.Lock()
+	relayPool.epoch++
+	entries := relayPool.entries
+	relayPool.entries = map[string]*pooledRelay{}
+	relayPool.Unlock()
+	for _, p := range entries {
+		p.conn.CloseWithError(0, "account cleared")
+	}
+}
+
+func openPrepared(ctx context.Context, cfg Config) (*Tunnel, error) {
+	if _, err := parseLiteralAddrPort("targetAddress", cfg.TargetAddress); err != nil {
+		return nil, err
+	}
+	p := findRelay(cfg.PreparedRelay)
+	if p == nil {
+		return nil, errors.New("RELAY_CONNECTION_CLOSED")
+	}
+	p.mu.Lock()
+	if !p.ready || p.config.RelayAddress != cfg.RelayAddress || p.config.RelayCertSHA256 != cfg.RelayCertSHA256 || p.config.RelayServerName != cfg.RelayServerName {
+		p.mu.Unlock()
+		return nil, errors.New("RELAY_PROOF_INVALID")
+	}
+	p.refs++
+	p.touched = time.Now()
+	p.mu.Unlock()
+	release := func() { p.mu.Lock(); p.refs--; p.touched = time.Now(); p.mu.Unlock() }
+	template := uritemplate.MustNew("https://" + cfg.RelayAddress + "/.well-known/masque/udp/{target_host}/{target_port}/")
+	req, err := masque.NewRequest(ctx, template, cfg.TargetAddress)
+	if err != nil {
+		release()
+		return nil, err
+	}
+	conn, response, err := p.client.Dial(req)
+	if err != nil {
+		release()
+		if response != nil {
+			return nil, responseError(response)
+		}
+		return nil, relayConnectionError(err)
+	}
+	conn.EnableDatagramReceiveBuffer()
+	p.conn.EnableDatagramReceiveBuffer()
+	return &Tunnel{conn: conn, outer: p.conn, onClose: release}, nil
+}
diff --git a/electron/native/private-transport/internal/masque/tickets.go b/electron/native/private-transport/internal/masque/tickets.go
new file mode 100644
index 000000000..9bf16cfc1
--- /dev/null
+++ b/electron/native/private-transport/internal/masque/tickets.go
@@ -0,0 +1,124 @@
+package masqueclient
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"github.com/cloudflare/circl/blindsign/blindrsa"
+	"strconv"
+	"sync"
+	"time"
+)
+
+const ticketDomain = "Qortal-MASQUE-Ticket-v1\x00"
+
+type TicketDescriptor struct {
+	Epoch     int64  `json:"epoch"`
+	ExpiresAt int64  `json:"expiresAt"`
+	PublicKey string `json:"publicKey"`
+	KeyID     string `json:"keyId"`
+	Policy    string `json:"policy"`
+	RelayPin  string `json:"relayPin"`
+}
+type ticketState struct {
+	client     blindrsa.Client
+	states     []blindrsa.State
+	messages   [][]byte
+	descriptor TicketDescriptor
+	created    time.Time
+}
+
+var ticketPending = struct {
+	sync.Mutex
+	entries map[string]ticketState
+}{entries: map[string]ticketState{}}
+
+func PrepareTickets(d TicketDescriptor) (map[string]any, error) {
+	ticketPending.Lock()
+	defer ticketPending.Unlock()
+	for k, s := range ticketPending.entries {
+		if time.Since(s.created) > time.Minute {
+			delete(ticketPending.entries, k)
+		}
+	}
+	if len(ticketPending.entries) >= 16 {
+		return nil, errors.New("RELAY_BUSY")
+	}
+	der, err := base64.StdEncoding.DecodeString(d.PublicKey)
+	if err != nil || len(der) > 1024 {
+		return nil, errors.New("RELAY_PROOF_INVALID")
+	}
+	pk, err := x509.ParsePKCS1PublicKey(der)
+	if err != nil || pk.N.BitLen() != 2048 || pk.E != 65537 {
+		return nil, errors.New("RELAY_PROOF_INVALID")
+	}
+	h := sha256.New()
+	h.Write([]byte(ticketDomain + d.Policy + d.RelayPin + strconv.FormatInt(d.Epoch, 10)))
+	h.Write(der)
+	if d.KeyID != hex.EncodeToString(h.Sum(nil)) || d.Epoch != time.Now().Unix()/3600 || d.ExpiresAt != (d.Epoch*3600+43200)*1000 {
+		return nil, errors.New("RELAY_PROOF_INVALID")
+	}
+	client, err := blindrsa.NewClient(blindrsa.SHA384PSSDeterministic, pk)
+	if err != nil {
+		return nil, err
+	}
+	state := ticketState{client: client, descriptor: d, created: time.Now()}
+	var blinded []string
+	for i := 0; i < 3; i++ {
+		nonce := make([]byte, 32)
+		if _, err = rand.Read(nonce); err != nil {
+			return nil, err
+		}
+		msg := append([]byte(ticketDomain+d.KeyID), nonce...)
+		prepared, err := client.Prepare(rand.Reader, msg)
+		if err != nil {
+			return nil, err
+		}
+		b, s, err := client.Blind(rand.Reader, prepared)
+		if err != nil {
+			return nil, err
+		}
+		state.messages = append(state.messages, prepared)
+		state.states = append(state.states, s)
+		blinded = append(blinded, base64.StdEncoding.EncodeToString(b))
+	}
+	id := make([]byte, 24)
+	if _, err = rand.Read(id); err != nil {
+		return nil, err
+	}
+	handle := hex.EncodeToString(id)
+	ticketPending.entries[handle] = state
+	return map[string]any{"handle": handle, "blinded": blinded}, nil
+}
+func FinalizeTickets(handle string, signatures []string) (map[string]any, error) {
+	ticketPending.Lock()
+	s, ok := ticketPending.entries[handle]
+	delete(ticketPending.entries, handle)
+	ticketPending.Unlock()
+	if !ok || time.Since(s.created) > time.Minute || len(signatures) != len(s.states) {
+		return nil, errors.New("RELAY_PROOF_INVALID")
+	}
+	tickets := make([]string, 0, len(signatures))
+	for i, b := range signatures {
+		raw, err := base64.StdEncoding.DecodeString(b)
+		if err != nil || len(raw) != 256 {
+			return nil, errors.New("RELAY_PROOF_INVALID")
+		}
+		sig, err := s.client.Finalize(s.states[i], raw)
+		if err != nil {
+			return nil, errors.New("RELAY_PROOF_INVALID")
+		}
+		token, _ := json.Marshal(map[string]any{"epoch": s.descriptor.Epoch, "keyId": s.descriptor.KeyID, "message": base64.StdEncoding.EncodeToString(s.messages[i]), "signature": base64.StdEncoding.EncodeToString(sig)})
+		tickets = append(tickets, string(token))
+	}
+	return map[string]any{"tickets": tickets, "expiresAt": s.descriptor.ExpiresAt}, nil
+}
+func clearTicketStates() {
+	ticketPending.Lock()
+	ticketPending.entries = map[string]ticketState{}
+	ticketPending.Unlock()
+}
diff --git a/electron/native/private-transport/internal/moqclient/session.go b/electron/native/private-transport/internal/moqclient/session.go
new file mode 100644
index 000000000..74934cfc8
--- /dev/null
+++ b/electron/native/private-transport/internal/moqclient/session.go
@@ -0,0 +1,501 @@
+package moqclient
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"crypto/tls"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"regexp"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/mengelbart/moqtransport"
+	"github.com/mengelbart/moqtransport/quicmoq"
+	"github.com/quic-go/quic-go"
+	masqueclient "qortal.org/qortal-hub/private-transport/internal/masque"
+)
+
+const (
+	ALPN                   = "moqt-18"
+	MaxObjectBytes         = 1024
+	MaxSubscriptions       = 128
+	MaxNamespaceComponents = 8
+	defaultConnectTimeout  = 8 * time.Second
+	maxSafeJSONInteger     = uint64(1<<53 - 1)
+	mediaKeepAlivePeriod   = 15 * time.Second
+	mediaMaxIdleTimeout    = 2 * time.Minute
+)
+
+var safeName = regexp.MustCompile(`^[A-Za-z0-9._-]{1,128}$`)
+
+func mediaQUICConfig() *quic.Config {
+	return &quic.Config{
+		EnableDatagrams:         true,
+		InitialPacketSize:       1200,
+		DisablePathMTUDiscovery: true,
+		KeepAlivePeriod:         mediaKeepAlivePeriod,
+		MaxIdleTimeout:          mediaMaxIdleTimeout,
+	}
+}
+
+type Config struct {
+	Relay                masqueclient.Config
+	BackendServerName    string
+	BackendCertSHA256    string
+	LogicalSessionID     string
+	AttachToken          string
+	PublicationNamespace []string
+	PublicationTrack     string
+	PublicationTracks    []string
+	Timeout              time.Duration
+}
+
+type Event struct {
+	Kind           string
+	SubscriptionID string
+	Namespace      []string
+	TrackName      string
+	GroupID        uint64
+	ObjectID       uint64
+	Data           []byte
+	Code           string
+}
+
+type Metrics struct {
+	moqtransport.DeliveryMetrics
+	TunnelReceiveDroppedFull    uint64 `json:"tunnelReceiveDroppedFull"`
+	TunnelReceiveDroppedBudget  uint64 `json:"tunnelReceiveDroppedBudget"`
+	TunnelReceiveDroppedExpired uint64 `json:"tunnelReceiveDroppedExpired"`
+	OuterReceiveDroppedFull     uint64 `json:"outerReceiveDroppedFull"`
+	OuterReceiveDroppedBudget   uint64 `json:"outerReceiveDroppedBudget"`
+	OuterReceiveDroppedExpired  uint64 `json:"outerReceiveDroppedExpired"`
+	InnerRTTMillis              int64  `json:"innerRttMillis"`
+	InnerMinRTTMillis           int64  `json:"innerMinRttMillis"`
+	InnerPacketsSent            uint64 `json:"innerPacketsSent"`
+	InnerPacketsLost            uint64 `json:"innerPacketsLost"`
+	ObjectsSent                 uint64 `json:"objectsSent"`
+	ObjectsRead                 uint64 `json:"objectsReceived"`
+	BytesSent                   uint64 `json:"bytesSent"`
+	BytesRead                   uint64 `json:"bytesReceived"`
+	ObjectErrors                uint64 `json:"objectErrors"`
+}
+
+type publicationHandler struct {
+	namespace   [][]byte
+	track       string
+	tracks      []string
+	publication chan *moqtransport.IncomingSubscribeRequest
+}
+
+func (h *publicationHandler) HandleGoAway(string) {}
+
+func (h *publicationHandler) HandleSubscribe(request *moqtransport.IncomingSubscribeRequest) {
+	alias := uint64(0)
+	tracks := h.tracks
+	if len(tracks) == 0 {
+		tracks = []string{h.track}
+	}
+	for index, track := range tracks {
+		if string(request.Name()) == track {
+			alias = uint64(index + 1)
+		}
+	}
+	if !equalNamespace(request.Namespace(), h.namespace) || alias == 0 {
+		request.Reject(moqtransport.RequestErrorCodeUnauthorized, "publication is not authorized")
+		return
+	}
+	request.Accept(alias)
+	select {
+	case h.publication <- request:
+	default:
+		_ = request.Close()
+	}
+}
+
+type subscription struct {
+	namespace []string
+	track     string
+	request   *moqtransport.OutgoingSubscribeRequest
+}
+
+type Session struct {
+	tunnel       *masqueclient.Tunnel
+	conn         *quic.Conn
+	moq          *moqtransport.Session
+	publication  *moqtransport.IncomingSubscribeRequest
+	publications map[string]*moqtransport.IncomingSubscribeRequest
+	defaultTrack string
+	onEvent      func(Event)
+
+	mu            sync.Mutex
+	subscriptions map[string]subscription
+	closed        atomic.Bool
+	nextObjectID  atomic.Uint64
+	objectsSent   atomic.Uint64
+	objectsRead   atomic.Uint64
+	bytesSent     atomic.Uint64
+	bytesRead     atomic.Uint64
+	objectErrors  atomic.Uint64
+}
+
+func Open(ctx context.Context, cfg Config, onEvent func(Event)) (*Session, error) {
+	tracks := cfg.PublicationTracks
+	if len(tracks) == 0 {
+		tracks = []string{cfg.PublicationTrack}
+	}
+	if len(tracks) > 8 {
+		return nil, errors.New("INVALID_MOQ_CONFIG")
+	}
+	seen := map[string]bool{}
+	for _, track := range tracks {
+		if !safeName.MatchString(track) || seen[track] {
+			return nil, errors.New("INVALID_MOQ_CONFIG")
+		}
+		seen[track] = true
+	}
+	cfg.PublicationTrack = tracks[0]
+	if !validNamespace(cfg.PublicationNamespace) || !safeName.MatchString(cfg.PublicationTrack) ||
+		cfg.LogicalSessionID == "" || len(cfg.LogicalSessionID) > 512 ||
+		len(cfg.AttachToken) < 32 || len(cfg.AttachToken) > 128 {
+		return nil, errors.New("INVALID_MOQ_CONFIG")
+	}
+	pin, err := hex.DecodeString(cfg.BackendCertSHA256)
+	if err != nil || len(pin) != sha256.Size {
+		return nil, errors.New("INVALID_MOQ_CONFIG")
+	}
+	timeout := cfg.Timeout
+	if timeout <= 0 {
+		timeout = defaultConnectTimeout
+	}
+	openCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	tunnel, err := masqueclient.Open(openCtx, cfg.Relay)
+	if err != nil {
+		return nil, fmt.Errorf("MASQUE_TUNNEL_FAILED: %w", err)
+	}
+	fail := func(openErr error) (*Session, error) {
+		_ = tunnel.Close()
+		return nil, openErr
+	}
+	if tunnel.RemoteAddr() == nil {
+		return fail(errors.New("MOQ_QUIC_FAILED: missing proxied backend address"))
+	}
+	connection, err := quic.Dial(
+		openCtx,
+		tunnel.PacketConn(),
+		tunnel.RemoteAddr(),
+		backendTLSConfig(cfg.BackendServerName, pin),
+		mediaQUICConfig(),
+	)
+	if err != nil {
+		return fail(fmt.Errorf("MOQ_QUIC_FAILED: %w", err))
+	}
+	handler := &publicationHandler{
+		namespace: stringsToNamespace(cfg.PublicationNamespace),
+		track:     cfg.PublicationTrack, tracks: tracks, publication: make(chan *moqtransport.IncomingSubscribeRequest, len(tracks)),
+	}
+	moq, err := moqtransport.NewSession(
+		quicmoq.NewClient(connection), "attach/"+cfg.AttachToken,
+		moqtransport.WithHandler(handler),
+	)
+	if err != nil {
+		_ = connection.CloseWithError(1, "MOQT setup failed")
+		return fail(fmt.Errorf("MOQ_SESSION_FAILED: %w", err))
+	}
+	publications := make(map[string]*moqtransport.IncomingSubscribeRequest)
+	for len(publications) < len(tracks) {
+		select {
+		case publication := <-handler.publication:
+			if !connection.ConnectionState().SupportsDatagrams.Remote {
+				moq.CloseWithError(1, "datagrams required")
+				return fail(errors.New("DATAGRAM_UNSUPPORTED"))
+			}
+			name := string(publication.Name())
+			if publications[name] != nil {
+				_ = publication.Close()
+				continue
+			}
+			publications[name] = publication
+		case <-moq.Context().Done():
+			moq.CloseWithError(1, "MOQT attach failed")
+			return fail(errors.New("MOQ_ATTACH_FAILED"))
+		case <-openCtx.Done():
+			moq.CloseWithError(1, "MOQT attach timed out")
+			return fail(errors.New("MOQ_ATTACH_FAILED"))
+		}
+	}
+	return &Session{tunnel: tunnel, conn: connection, moq: moq, publication: publications[tracks[0]],
+		publications: publications, defaultTrack: tracks[0], onEvent: onEvent, subscriptions: make(map[string]subscription)}, nil
+}
+
+func backendTLSConfig(serverName string, pin []byte) *tls.Config {
+	return &tls.Config{
+		MinVersion: tls.VersionTLS13, NextProtos: []string{ALPN}, ServerName: serverName,
+		InsecureSkipVerify: true, // Replaced by the mandatory identity and leaf-pin checks below.
+		VerifyConnection: func(state tls.ConnectionState) error {
+			if len(state.PeerCertificates) == 0 {
+				return errors.New("backend certificate missing")
+			}
+			leaf := state.PeerCertificates[0]
+			if now := time.Now(); now.Before(leaf.NotBefore) || now.After(leaf.NotAfter) {
+				return errors.New("backend certificate expired")
+			}
+			if err := leaf.VerifyHostname(serverName); err != nil {
+				return errors.New("backend certificate name mismatch")
+			}
+			observed := sha256.Sum256(leaf.Raw)
+			if subtle.ConstantTimeCompare(observed[:], pin) != 1 {
+				return errors.New("backend certificate pin mismatch")
+			}
+			return nil
+		},
+	}
+}
+
+func validNamespace(namespace []string) bool {
+	if len(namespace) == 0 || len(namespace) > MaxNamespaceComponents {
+		return false
+	}
+	total := 0
+	for _, component := range namespace {
+		if !safeName.MatchString(component) {
+			return false
+		}
+		total += len(component)
+	}
+	return total <= 512
+}
+
+func stringsToNamespace(namespace []string) [][]byte {
+	result := make([][]byte, len(namespace))
+	for index, component := range namespace {
+		result[index] = []byte(component)
+	}
+	return result
+}
+
+func equalNamespace(left, right [][]byte) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if string(left[index]) != string(right[index]) {
+			return false
+		}
+	}
+	return true
+}
+
+func (s *Session) Subscribe(subscriptionID string, namespace []string, track string) error {
+	if s.closed.Load() {
+		return errors.New("MOQ_SESSION_CLOSED")
+	}
+	if !safeName.MatchString(subscriptionID) || !validNamespace(namespace) || !safeName.MatchString(track) {
+		return errors.New("INVALID_MOQ_SUBSCRIPTION")
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if existing, found := s.subscriptions[subscriptionID]; found {
+		if equalStringNamespace(existing.namespace, namespace) && existing.track == track {
+			return nil
+		}
+		return errors.New("MOQ_SUBSCRIPTION_ID_REUSED")
+	}
+	if len(s.subscriptions) >= MaxSubscriptions {
+		return errors.New("MOQ_SUBSCRIPTION_LIMIT")
+	}
+	request, err := s.moq.Subscribe(s.moq.Context(), stringsToNamespace(namespace), track)
+	if err != nil {
+		return fmt.Errorf("MOQ_SUBSCRIBE_FAILED: %w", err)
+	}
+	entry := subscription{namespace: append([]string(nil), namespace...), track: track, request: request}
+	s.subscriptions[subscriptionID] = entry
+	go s.readSubscription(subscriptionID, entry)
+	return nil
+}
+
+func equalStringNamespace(left, right []string) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
+	return true
+}
+
+func (s *Session) PublishObject(payload []byte) error {
+	return s.PublishTrackObject(s.defaultTrack, payload)
+}
+
+func (s *Session) PublishTrackObject(track string, payload []byte) error {
+	return s.PublishTrackObjectWithPolicy(track, payload, moqtransport.DeliveryPolicy{Priority: 1, MaxQueueAgeMillis: 200})
+}
+
+func (s *Session) PublishTrackObjectWithPolicy(track string, payload []byte, policy moqtransport.DeliveryPolicy) error {
+	return s.PublishTrackBatch(track, [][]byte{payload}, policy)
+}
+
+func (s *Session) PublishTrackBatch(track string, objects [][]byte, policy moqtransport.DeliveryPolicy) error {
+	if track == "" {
+		track = s.defaultTrack
+	}
+	if len(objects) < 1 || len(objects) > 8 || !policy.Valid() {
+		return errors.New("INVALID_MOQ_CONFIG")
+	}
+	for _, payload := range objects {
+		if len(payload) < 1 || len(payload) > MaxObjectBytes {
+			return errors.New("MOQ_OBJECT_TOO_LARGE")
+		}
+	}
+	var pending []<-chan error
+	for _, payload := range objects {
+		completion, err := s.queueTrackObject(track, payload, policy)
+		if err != nil {
+			return err
+		}
+		pending = append(pending, completion)
+	}
+	for index, completion := range pending {
+		select {
+		case err := <-completion:
+			if err != nil {
+				s.objectErrors.Add(1)
+				return err
+			}
+			s.objectsSent.Add(1)
+			s.bytesSent.Add(uint64(len(objects[index])))
+		case <-s.moq.Context().Done():
+			return errors.New("MOQ_SESSION_CLOSED")
+		}
+	}
+	return nil
+}
+
+func (s *Session) PublishGroupObject(track string, groupID, objectID uint64, payload []byte, policy moqtransport.DeliveryPolicy) error {
+	if s.closed.Load() {
+		return errors.New("MOQ_SESSION_CLOSED")
+	}
+	if groupID > maxSafeJSONInteger || objectID > maxSafeJSONInteger || !policy.Valid() {
+		return errors.New("INVALID_MOQ_CONFIG")
+	}
+	if len(payload) == 0 || len(payload) > moqtransport.MaxReliableObjectBytes {
+		return errors.New("MOQ_OBJECT_TOO_LARGE")
+	}
+	publication := s.publications[track]
+	if publication == nil {
+		return errors.New("INVALID_MOQ_CONFIG")
+	}
+	err := publication.SendGroupObject(moqtransport.Object{GroupID: groupID, ObjectID: objectID, Payload: payload}, policy)
+	if err != nil {
+		s.objectErrors.Add(1)
+		return fmt.Errorf("MOQ_SEND_FAILED: %w", err)
+	}
+	s.objectsSent.Add(1)
+	s.bytesSent.Add(uint64(len(payload)))
+	return nil
+}
+
+func (s *Session) queueTrackObject(track string, payload []byte, policy moqtransport.DeliveryPolicy) (<-chan error, error) {
+	if s.closed.Load() {
+		return nil, errors.New("MOQ_SESSION_CLOSED")
+	}
+	if len(payload) == 0 || len(payload) > MaxObjectBytes {
+		return nil, errors.New("MOQ_OBJECT_TOO_LARGE")
+	}
+	objectID := s.nextObjectID.Add(1) - 1
+	publication := s.publication
+	if s.publications != nil {
+		publication = s.publications[track]
+	}
+	if publication == nil {
+		return nil, errors.New("INVALID_MOQ_CONFIG")
+	}
+	completion, err := publication.ScheduleDatagramResult(moqtransport.Object{
+		GroupID: 0, ObjectID: objectID,
+		ForwardingPreference: moqtransport.ObjectForwardingPreferenceDatagram,
+		Payload:              append([]byte(nil), payload...),
+	}, policy)
+	if err != nil {
+		s.objectErrors.Add(1)
+		return nil, fmt.Errorf("MOQ_SEND_FAILED: %w", err)
+	}
+	return completion, nil
+}
+
+func (s *Session) readSubscription(subscriptionID string, entry subscription) {
+	for {
+		object, err := entry.request.ReadObject(s.moq.Context())
+		if err != nil {
+			if !s.closed.Load() {
+				s.objectErrors.Add(1)
+				s.emit(Event{Kind: "error", SubscriptionID: subscriptionID, Code: "MOQ_READ_FAILED"})
+			}
+			return
+		}
+		limit := MaxObjectBytes
+		if object.ForwardingPreference == moqtransport.ObjectForwardingPreferenceSubgroup {
+			limit = moqtransport.MaxReliableObjectBytes
+		}
+		if len(object.Payload) == 0 || len(object.Payload) > limit ||
+			object.GroupID > maxSafeJSONInteger || object.ObjectID > maxSafeJSONInteger {
+			s.objectErrors.Add(1)
+			continue
+		}
+		s.objectsRead.Add(1)
+		s.bytesRead.Add(uint64(len(object.Payload)))
+		s.emit(Event{
+			Kind: "object", SubscriptionID: subscriptionID,
+			Namespace: append([]string(nil), entry.namespace...), TrackName: entry.track,
+			GroupID: object.GroupID, ObjectID: object.ObjectID,
+			Data: append([]byte(nil), object.Payload...),
+		})
+	}
+}
+
+func (s *Session) Metrics() Metrics {
+	stats := s.conn.ConnectionStats()
+	m := Metrics{
+		DeliveryMetrics:   s.moq.DeliveryMetrics(),
+		InnerRTTMillis:    stats.SmoothedRTT.Milliseconds(),
+		InnerMinRTTMillis: stats.MinRTT.Milliseconds(),
+		InnerPacketsSent:  stats.PacketsSent,
+		InnerPacketsLost:  stats.PacketsLost,
+		ObjectsSent:       s.objectsSent.Load(), ObjectsRead: s.objectsRead.Load(),
+		BytesSent: s.bytesSent.Load(), BytesRead: s.bytesRead.Load(),
+		ObjectErrors: s.objectErrors.Load(),
+	}
+	if s.tunnel != nil {
+		h, q := s.tunnel.ReceiveBufferMetrics()
+		m.TunnelReceiveDroppedFull, m.TunnelReceiveDroppedBudget, m.TunnelReceiveDroppedExpired = h.DroppedFull, h.DroppedBudget, h.DroppedExpired
+		m.OuterReceiveDroppedFull, m.OuterReceiveDroppedBudget, m.OuterReceiveDroppedExpired = q.DroppedFull, q.DroppedBudget, q.DroppedExpired
+	}
+	return m
+}
+
+func (s *Session) Close() error {
+	if !s.closed.CompareAndSwap(false, true) {
+		return nil
+	}
+	s.mu.Lock()
+	for _, entry := range s.subscriptions {
+		_ = entry.request.Close()
+	}
+	s.subscriptions = make(map[string]subscription)
+	s.mu.Unlock()
+	s.moq.CloseWithError(0, "closed")
+	time.Sleep(50 * time.Millisecond)
+	return s.tunnel.Close()
+}
+
+func (s *Session) emit(event Event) {
+	if s.onEvent != nil {
+		s.onEvent(event)
+	}
+}
diff --git a/electron/native/private-transport/internal/moqclient/session_integration_test.go b/electron/native/private-transport/internal/moqclient/session_integration_test.go
new file mode 100644
index 000000000..3d1a2c977
--- /dev/null
+++ b/electron/native/private-transport/internal/moqclient/session_integration_test.go
@@ -0,0 +1,235 @@
+package moqclient
+
+import (
+	"bytes"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/hex"
+	"math/big"
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/mengelbart/moqtransport"
+	"github.com/mengelbart/moqtransport/quicmoq"
+	masque "github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+	masqueclient "qortal.org/qortal-hub/private-transport/internal/masque"
+)
+
+type integrationHandler struct {
+	subscriptions chan *moqtransport.IncomingSubscribeRequest
+}
+
+func (h *integrationHandler) HandleGoAway(string) {}
+
+func (h *integrationHandler) HandleSubscribe(request *moqtransport.IncomingSubscribeRequest) {
+	h.subscriptions <- request
+}
+
+func TestSessionTransportsOpaqueMOQTObjectOnlyThroughMasque(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	backendCertificate := integrationCertificate(t, "moq-backend")
+	backendSocket, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer backendSocket.Close()
+	backendListener, err := quic.Listen(
+		backendSocket,
+		&tls.Config{Certificates: []tls.Certificate{backendCertificate}, NextProtos: []string{ALPN}},
+		&quic.Config{EnableDatagrams: true, InitialPacketSize: 1200, DisablePathMTUDiscovery: true},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer backendListener.Close()
+
+	relayCertificate := integrationCertificate(t, "moq-relay")
+	relaySocket, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer relaySocket.Close()
+	relayAddress := relaySocket.LocalAddr().String()
+	backendAddress := backendSocket.LocalAddr().String()
+	template := uritemplate.MustNew("https://" + relayAddress + "/.well-known/masque/udp/{target_host}/{target_port}/")
+	proxy := masque.Proxy{}
+	defer proxy.Close()
+	relayEgress := make(chan string, 1)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/masque/udp/", func(w http.ResponseWriter, r *http.Request) {
+		request, parseErr := masque.ParseProxyRequest(r, template)
+		if parseErr != nil || request.Target != backendAddress {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		target, resolveErr := net.ResolveUDPAddr("udp", backendAddress)
+		if resolveErr != nil {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		egress, dialErr := net.DialUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)}, target)
+		if dialErr != nil {
+			w.WriteHeader(http.StatusBadGateway)
+			return
+		}
+		relayEgress <- egress.LocalAddr().String()
+		_ = proxy.ProxyConnectedSocket(w, request, egress)
+	})
+	relayServer := &http3.Server{
+		TLSConfig:  &tls.Config{Certificates: []tls.Certificate{relayCertificate}, NextProtos: []string{http3.NextProtoH3}},
+		QUICConfig: &quic.Config{EnableDatagrams: true}, EnableDatagrams: true, Handler: mux,
+	}
+	defer relayServer.Close()
+	go func() { _ = relayServer.Serve(relaySocket) }()
+
+	attachToken := "integration-one-time-token-000000000000"
+	publicationNamespace := []string{"qortal", "apps", "sample", "publisher-123"}
+	publicationTrack := "realtime-data"
+	tracks := []string{publicationTrack, "auxiliary", "status"}
+	backendSource := make(chan string, 1)
+	backendErrors := make(chan error, 1)
+	go func() {
+		connection, acceptErr := backendListener.Accept(ctx)
+		if acceptErr != nil {
+			backendErrors <- acceptErr
+			return
+		}
+		backendSource <- connection.RemoteAddr().String()
+		handler := &integrationHandler{subscriptions: make(chan *moqtransport.IncomingSubscribeRequest, 1)}
+		session, sessionErr := moqtransport.NewSession(quicmoq.NewServer(connection), "", moqtransport.WithHandler(handler))
+		if sessionErr != nil {
+			backendErrors <- sessionErr
+			return
+		}
+		defer session.CloseWithError(0, "test complete")
+		for session.Path() == "" && ctx.Err() == nil {
+			time.Sleep(time.Millisecond)
+		}
+		if session.Path() != "attach/"+attachToken {
+			backendErrors <- context.Canceled
+			return
+		}
+		sources := make([]*moqtransport.OutgoingSubscribeRequest, 0, len(tracks))
+		for _, track := range tracks {
+			source, subscribeErr := session.Subscribe(ctx, stringsToNamespace(publicationNamespace), track)
+			if subscribeErr != nil {
+				backendErrors <- subscribeErr
+				return
+			}
+			sources = append(sources, source)
+		}
+		for index, source := range sources {
+			object, readErr := source.ReadObject(ctx)
+			if readErr != nil {
+				backendErrors <- readErr
+				return
+			}
+			var downstream *moqtransport.IncomingSubscribeRequest
+			select {
+			case downstream = <-handler.subscriptions:
+			case <-ctx.Done():
+				backendErrors <- ctx.Err()
+				return
+			}
+			downstream.Accept(uint64(index + 10))
+			if sendErr := downstream.SendScheduledDatagram(*object, moqtransport.DeliveryPolicy{Priority: index % 3, MaxQueueAgeMillis: 200}); sendErr != nil {
+				backendErrors <- sendErr
+				return
+			}
+		}
+		time.Sleep(100 * time.Millisecond)
+	}()
+
+	events := make(chan Event, 1)
+	session, err := Open(ctx, Config{
+		Relay: masqueclient.Config{
+			RelayAddress: relayAddress, RelayServerName: "moq-relay",
+			RelayCertSHA256: integrationCertificatePin(t, relayCertificate),
+			TargetAddress:   backendAddress, Timeout: 5 * time.Second,
+		},
+		BackendServerName: "moq-backend", BackendCertSHA256: integrationCertificatePin(t, backendCertificate),
+		LogicalSessionID: "logical-session", AttachToken: attachToken,
+		PublicationNamespace: publicationNamespace, PublicationTrack: publicationTrack, PublicationTracks: tracks, Timeout: 5 * time.Second,
+	}, func(event Event) { events <- event })
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer session.Close()
+	for _, publicationTrack := range tracks {
+		if err = session.Subscribe("self-"+publicationTrack, publicationNamespace, publicationTrack); err != nil {
+			t.Fatal(err)
+		}
+		payload := []byte("opaque-application-object/" + publicationTrack)
+		if err = session.PublishTrackObject(publicationTrack, payload); err != nil {
+			t.Fatal(err)
+		}
+		select {
+		case event := <-events:
+			if event.Kind != "object" || event.SubscriptionID != "self-"+publicationTrack ||
+				event.TrackName != publicationTrack || !equalStringNamespace(event.Namespace, publicationNamespace) ||
+				!bytes.Equal(event.Data, payload) {
+				t.Fatalf("unexpected MOQT event: %#v", event)
+			}
+		case err = <-backendErrors:
+			t.Fatal(err)
+		case <-ctx.Done():
+			t.Fatal("timed out waiting for relayed object")
+		}
+	}
+	var observedBackendSource, observedRelayEgress string
+	select {
+	case observedBackendSource = <-backendSource:
+	case <-ctx.Done():
+		t.Fatal("backend did not observe a source")
+	}
+	select {
+	case observedRelayEgress = <-relayEgress:
+	case <-ctx.Done():
+		t.Fatal("relay did not report its egress")
+	}
+	if observedBackendSource != observedRelayEgress {
+		t.Fatalf("backend saw %q instead of relay %q", observedBackendSource, observedRelayEgress)
+	}
+}
+
+func integrationCertificate(t *testing.T, name string) tls.Certificate {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(now.UnixNano()), Subject: pkix.Name{CommonName: name}, DNSNames: []string{name},
+		NotBefore: now.Add(-time.Minute), NotAfter: now.Add(time.Hour), KeyUsage: x509.KeyUsageDigitalSignature,
+		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
+}
+
+func integrationCertificatePin(t *testing.T, certificate tls.Certificate) string {
+	t.Helper()
+	parsed, err := x509.ParseCertificate(certificate.Certificate[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest := sha256.Sum256(parsed.Raw)
+	return hex.EncodeToString(digest[:])
+}
diff --git a/electron/native/private-transport/internal/moqclient/session_test.go b/electron/native/private-transport/internal/moqclient/session_test.go
new file mode 100644
index 000000000..ad2f6fb11
--- /dev/null
+++ b/electron/native/private-transport/internal/moqclient/session_test.go
@@ -0,0 +1,11 @@
+package moqclient
+
+import "testing"
+
+func TestMediaQUICConfigKeepsSilentCallAlive(t *testing.T) {
+	config := mediaQUICConfig()
+	if !config.EnableDatagrams || config.KeepAlivePeriod != mediaKeepAlivePeriod ||
+		config.MaxIdleTimeout != mediaMaxIdleTimeout {
+		t.Fatalf("unexpected idle media config: %#v", config)
+	}
+}
diff --git a/electron/native/private-transport/internal/moqproof/compatibility_test.go b/electron/native/private-transport/internal/moqproof/compatibility_test.go
new file mode 100644
index 000000000..d1c99c3ec
--- /dev/null
+++ b/electron/native/private-transport/internal/moqproof/compatibility_test.go
@@ -0,0 +1,405 @@
+package moqproof
+
+import (
+	"bytes"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/hex"
+	"math/big"
+	"net"
+	"net/http"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/mengelbart/moqtransport"
+	"github.com/mengelbart/moqtransport/quicmoq"
+	masque "github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+	masqueclient "qortal.org/qortal-hub/private-transport/internal/masque"
+)
+
+const proofTimeout = 5 * time.Second
+
+type proofHandler struct {
+	subscriptions chan *moqtransport.IncomingSubscribeRequest
+}
+
+func (h *proofHandler) HandleGoAway(string) {}
+
+func (h *proofHandler) HandleSubscribe(request *moqtransport.IncomingSubscribeRequest) {
+	h.subscriptions <- request
+}
+
+func TestEncryptedMOQTObjectIsBlindlyRelayedBetweenTwoMasqueClients(t *testing.T) {
+	t.Run("streams", func(t *testing.T) { testEncryptedRelay(t, false) })
+	t.Run("datagrams_with_loss", func(t *testing.T) { testEncryptedRelay(t, true) })
+}
+
+// Drop one MoQ datagram before it reaches QUIC to model packet loss without
+// disrupting TLS or MoQ control messages. Subsequent packets use the real tunnel.
+type dropFirstDatagram struct {
+	moqtransport.Connection
+	sends atomic.Int32
+}
+
+func (c *dropFirstDatagram) SendDatagram(data []byte) error {
+	if c.sends.Add(1) == 1 {
+		return nil
+	}
+	return c.Connection.SendDatagram(data)
+}
+
+func sendProofObject(r *moqtransport.IncomingSubscribeRequest, o moqtransport.Object, datagrams bool) error {
+	if datagrams {
+		return r.SendDatagram(o)
+	}
+	sg, err := r.OpenSubgroup(o.GroupID, o.SubGroupID, 0)
+	if err != nil {
+		return err
+	}
+	if _, err = sg.WriteObject(o.ObjectID, o.Payload); err != nil {
+		return err
+	}
+	return sg.Close()
+}
+
+func testEncryptedRelay(t *testing.T, datagrams bool) {
+	ctx, cancel := context.WithTimeout(context.Background(), proofTimeout)
+	defer cancel()
+
+	backendCertificate := testCertificate(t, "moq-proof-backend")
+	backendSocket, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer backendSocket.Close()
+	backendListener, err := quic.Listen(
+		backendSocket,
+		&tls.Config{
+			Certificates: []tls.Certificate{backendCertificate},
+			NextProtos:   []string{moqtransport.MOQT18.String()},
+		},
+		&quic.Config{
+			EnableDatagrams:         true,
+			InitialPacketSize:       1200,
+			DisablePathMTUDiscovery: true,
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer backendListener.Close()
+
+	relayCertificate := testCertificate(t, "moq-proof-relay")
+	relaySocket, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer relaySocket.Close()
+	relayAddress := relaySocket.LocalAddr().String()
+	backendAddress := backendSocket.LocalAddr().String()
+	template := uritemplate.MustNew(
+		"https://" + relayAddress + "/.well-known/masque/udp/{target_host}/{target_port}/",
+	)
+	proxy := masque.Proxy{}
+	defer proxy.Close()
+	relayEgress := make(chan string, 2)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/masque/udp/", func(w http.ResponseWriter, r *http.Request) {
+		request, parseErr := masque.ParseProxyRequest(r, template)
+		if parseErr != nil || request.Target != backendAddress {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		target, resolveErr := net.ResolveUDPAddr("udp", backendAddress)
+		if resolveErr != nil {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		egress, dialErr := net.DialUDP(
+			"udp",
+			&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)},
+			target,
+		)
+		if dialErr != nil {
+			w.WriteHeader(http.StatusBadGateway)
+			return
+		}
+		select {
+		case relayEgress <- egress.LocalAddr().String():
+		default:
+		}
+		_ = proxy.ProxyConnectedSocket(w, request, egress)
+	})
+	relayServer := &http3.Server{
+		TLSConfig: &tls.Config{
+			Certificates: []tls.Certificate{relayCertificate},
+			NextProtos:   []string{http3.NextProtoH3},
+		},
+		QUICConfig:      &quic.Config{EnableDatagrams: true},
+		EnableDatagrams: true,
+		Handler:         mux,
+	}
+	defer relayServer.Close()
+	go func() { _ = relayServer.Serve(relaySocket) }()
+
+	serverObjects := make(chan *moqtransport.Object, 1)
+	serverRemoteAddress := make(chan string, 2)
+	backendSubscriptions := make(chan *moqtransport.IncomingSubscribeRequest, 1)
+	go func() {
+		connection, acceptErr := backendListener.Accept(ctx)
+		if acceptErr != nil {
+			return
+		}
+		serverRemoteAddress <- connection.RemoteAddr().String()
+		session, sessionErr := moqtransport.NewSession(
+			quicmoq.NewServer(connection),
+			"",
+			moqtransport.WithHandler(&proofHandler{subscriptions: backendSubscriptions}),
+		)
+		if sessionErr != nil {
+			return
+		}
+		subscription, subscribeErr := session.Subscribe(
+			ctx,
+			[][]byte{[]byte("qortal"), []byte("apps"), []byte("proof")},
+			"objects",
+		)
+		if subscribeErr != nil {
+			return
+		}
+		object, readErr := subscription.ReadObject(ctx)
+		if readErr != nil {
+			return
+		}
+		var downstream *moqtransport.IncomingSubscribeRequest
+		select {
+		case downstream = <-backendSubscriptions:
+		case <-ctx.Done():
+			return
+		}
+		downstream.Accept(2)
+		if writeErr := sendProofObject(downstream, *object, datagrams); writeErr != nil {
+			return
+		}
+		serverObjects <- object
+	}()
+
+	tunnel, err := masqueclient.Open(ctx, masqueclient.Config{
+		RelayAddress:    relayAddress,
+		RelayServerName: "moq-proof-relay",
+		RelayCertSHA256: certificatePin(t, relayCertificate),
+		TargetAddress:   backendAddress,
+		Timeout:         proofTimeout,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer tunnel.Close()
+	connection, err := quic.Dial(
+		ctx,
+		tunnel.PacketConn(),
+		tunnel.RemoteAddr(),
+		&tls.Config{
+			InsecureSkipVerify: true,
+			ServerName:         "moq-proof-backend",
+			NextProtos:         []string{moqtransport.MOQT18.String()},
+		},
+		&quic.Config{
+			EnableDatagrams:         true,
+			InitialPacketSize:       1200,
+			DisablePathMTUDiscovery: true,
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	clientHandler := &proofHandler{
+		subscriptions: make(chan *moqtransport.IncomingSubscribeRequest, 1),
+	}
+	publisherConnection := &dropFirstDatagram{Connection: quicmoq.NewClient(connection)}
+	publisherSession, err := moqtransport.NewSession(
+		publisherConnection,
+		"publisher",
+		moqtransport.WithHandler(clientHandler),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer publisherSession.CloseWithError(0, "proof complete")
+
+	var publication *moqtransport.IncomingSubscribeRequest
+	select {
+	case publication = <-clientHandler.subscriptions:
+	case <-ctx.Done():
+		t.Fatal("backend did not subscribe to the client track")
+	}
+	publication.Accept(1)
+
+	go func() {
+		connection, acceptErr := backendListener.Accept(ctx)
+		if acceptErr != nil {
+			return
+		}
+		serverRemoteAddress <- connection.RemoteAddr().String()
+		_, _ = moqtransport.NewSession(
+			quicmoq.NewServer(connection),
+			"",
+			moqtransport.WithHandler(&proofHandler{subscriptions: backendSubscriptions}),
+		)
+	}()
+	subscriberTunnel, err := masqueclient.Open(ctx, masqueclient.Config{
+		RelayAddress:    relayAddress,
+		RelayServerName: "moq-proof-relay",
+		RelayCertSHA256: certificatePin(t, relayCertificate),
+		TargetAddress:   backendAddress,
+		Timeout:         proofTimeout,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer subscriberTunnel.Close()
+	subscriberConnection, err := quic.Dial(
+		ctx,
+		subscriberTunnel.PacketConn(),
+		subscriberTunnel.RemoteAddr(),
+		&tls.Config{
+			InsecureSkipVerify: true,
+			ServerName:         "moq-proof-backend",
+			NextProtos:         []string{moqtransport.MOQT18.String()},
+		},
+		&quic.Config{
+			EnableDatagrams:         true,
+			InitialPacketSize:       1200,
+			DisablePathMTUDiscovery: true,
+		},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	subscriberSession, err := moqtransport.NewSession(
+		quicmoq.NewClient(subscriberConnection),
+		"subscriber",
+		moqtransport.WithHandler(&proofHandler{subscriptions: make(chan *moqtransport.IncomingSubscribeRequest, 1)}),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer subscriberSession.CloseWithError(0, "proof complete")
+	downstream, err := subscriberSession.Subscribe(
+		ctx,
+		[][]byte{[]byte("qortal"), []byte("apps"), []byte("proof")},
+		"objects",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	payload := make([]byte, 600)
+	if _, err = rand.Read(payload); err != nil {
+		t.Fatal(err)
+	}
+	if datagrams {
+		if err = sendProofObject(publication, moqtransport.Object{GroupID: 1, ObjectID: 0, Payload: payload}, true); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err = sendProofObject(publication, moqtransport.Object{GroupID: 1, ObjectID: 1, Payload: payload}, datagrams); err != nil {
+		t.Fatal(err)
+	}
+
+	var relayedObject *moqtransport.Object
+	select {
+	case object := <-serverObjects:
+		relayedObject = object
+		if !bytes.Equal(object.Payload, payload) {
+			t.Fatal("backend changed the opaque MOQT payload")
+		}
+	case <-ctx.Done():
+		t.Fatal("backend did not receive the MoQT object")
+	}
+	received, err := downstream.ReadObject(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if datagrams {
+		if received.ForwardingPreference != moqtransport.ObjectForwardingPreferenceDatagram || received.ObjectID != 1 || publisherConnection.sends.Load() != 2 {
+			t.Fatal("lost object was retried or delivery changed to a stream")
+		}
+		if err := publication.SendDatagram(moqtransport.Object{GroupID: 2, Payload: make([]byte, 65536)}); err == nil {
+			t.Fatal("oversized datagram falsely reported success")
+		}
+	}
+	if !bytes.Equal(received.Payload, relayedObject.Payload) {
+		t.Fatal("subscriber received a different opaque object")
+	}
+
+	for range 2 {
+		var observedBackendSource, observedRelayEgress string
+		select {
+		case observedBackendSource = <-serverRemoteAddress:
+		case <-ctx.Done():
+			t.Fatal("backend did not observe a source address")
+		}
+		select {
+		case observedRelayEgress = <-relayEgress:
+		case <-ctx.Done():
+			t.Fatal("relay did not report its egress address")
+		}
+		if observedBackendSource != observedRelayEgress {
+			t.Fatalf(
+				"backend source %q was not the relay egress %q",
+				observedBackendSource,
+				observedRelayEgress,
+			)
+		}
+	}
+}
+
+func testCertificate(t *testing.T, name string) tls.Certificate {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(now.UnixNano()),
+		Subject:      pkix.Name{CommonName: name},
+		DNSNames:     []string{name},
+		NotBefore:    now.Add(-time.Minute),
+		NotAfter:     now.Add(time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(
+		rand.Reader,
+		template,
+		template,
+		&key.PublicKey,
+		key,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
+}
+
+func certificatePin(t *testing.T, certificate tls.Certificate) string {
+	t.Helper()
+	parsed, err := x509.ParseCertificate(certificate.Certificate[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest := sha256.Sum256(parsed.Raw)
+	return hex.EncodeToString(digest[:])
+}
diff --git a/electron/native/private-transport/internal/protocol/relay.go b/electron/native/private-transport/internal/protocol/relay.go
new file mode 100644
index 000000000..72458e352
--- /dev/null
+++ b/electron/native/private-transport/internal/protocol/relay.go
@@ -0,0 +1,67 @@
+package protocol
+
+import (
+	"context"
+	"errors"
+	masqueclient "qortal.org/qortal-hub/private-transport/internal/masque"
+	"strings"
+)
+
+func relayErrorCode(err error) string {
+	for _, code := range []string{"RELAY_ACCESS_DENIED", "RELAY_PROOF_INVALID", "RELAY_AUTH_REQUIRED", "RELAY_MEMBERSHIP_UNAVAILABLE", "RELAY_TARGET_DENIED", "RELAY_FULL", "RELAY_AUTH_RATE_LIMITED", "RELAY_AUTH_UNAVAILABLE", "RELAY_CERTIFICATE_INVALID", "RELAY_PROTOCOL_UNSUPPORTED", "RELAY_CONNECTION_CLOSED", "RELAY_POOL_FULL", "RELAY_CONNECT_FAILED"} {
+		if strings.Contains(err.Error(), code) {
+			return code
+		}
+	}
+	return ""
+}
+func (s *Server) relayOperation(ctx context.Context, req Request) Response {
+	var p struct {
+		RelayAddress    string                        `json:"relayAddress"`
+		RelayServerName string                        `json:"relayServerName"`
+		RelayCertSHA256 string                        `json:"relayCertSha256"`
+		Handle          string                        `json:"handle"`
+		Proof           string                        `json:"proof"`
+		Renew           bool                          `json:"renew"`
+		LegacyRelay     bool                          `json:"legacyRelay"`
+		Descriptor      masqueclient.TicketDescriptor `json:"descriptor"`
+		Signatures      []string                      `json:"signatures"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid relay request")
+	}
+	var result masqueclient.PreparedRelay
+	var err error
+	if req.Operation == "prepareRelayTickets" || req.Operation == "finalizeRelayTickets" {
+		var value map[string]any
+		if req.Operation == "prepareRelayTickets" {
+			value, err = masqueclient.PrepareTickets(p.Descriptor)
+		} else {
+			value, err = masqueclient.FinalizeTickets(p.Handle, p.Signatures)
+		}
+		if err != nil {
+			return failure(req.RequestID, "RELAY_PROOF_INVALID", "invalid relay ticket")
+		}
+		return success(req.RequestID, value)
+	}
+	switch req.Operation {
+	case "prepareRelay":
+		result, err = masqueclient.BeginRelay(ctx, masqueclient.Config{RelayAddress: p.RelayAddress, RelayServerName: p.RelayServerName, RelayCertSHA256: p.RelayCertSHA256, LegacyRelay: p.LegacyRelay})
+	case "authorizeRelay":
+		result, err = masqueclient.AuthorizeRelay(ctx, p.Handle, p.Proof, p.Renew)
+	case "closeRelay":
+		masqueclient.CloseRelay(p.Handle)
+	case "clearRelays":
+		masqueclient.CloseAllRelays()
+	default:
+		err = errors.New("invalid relay operation")
+	}
+	if err != nil {
+		code := relayErrorCode(err)
+		if code == "" {
+			code = "RELAY_CONNECT_FAILED"
+		}
+		return failure(req.RequestID, code, code)
+	}
+	return success(req.RequestID, result)
+}
diff --git a/electron/native/private-transport/internal/protocol/reliable_dispatch.go b/electron/native/private-transport/internal/protocol/reliable_dispatch.go
new file mode 100644
index 000000000..2bf8b3823
--- /dev/null
+++ b/electron/native/private-transport/internal/protocol/reliable_dispatch.go
@@ -0,0 +1,64 @@
+package protocol
+
+import (
+	"sync"
+	"time"
+)
+
+type reliableJob struct {
+	bytes    int
+	enqueued time.Time
+	run      func(bool)
+}
+
+// One worker per active opaque stream key preserves ordering without serializing
+// unrelated streams in the IPC reader. Idle workers disappear immediately.
+type reliableDispatcher struct {
+	maxQueueAge time.Duration
+	mu          sync.Mutex
+	queues      map[string][]reliableJob
+	bytes       int
+	workers     sync.WaitGroup
+}
+
+func (d *reliableDispatcher) submit(key string, size int, run func(bool)) bool {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if d.queues == nil {
+		d.queues = make(map[string][]reliableJob)
+	}
+	queue, exists := d.queues[key]
+	if (!exists && len(d.queues) >= 64) || len(queue) >= 16 || d.bytes+size > 4*1024*1024 {
+		return false
+	}
+	d.bytes += size
+	d.queues[key] = append(queue, reliableJob{size, time.Now(), run})
+	if exists {
+		return true
+	}
+	d.workers.Add(1)
+	go func() {
+		defer d.workers.Done()
+		for {
+			d.mu.Lock()
+			queue := d.queues[key]
+			if len(queue) == 0 {
+				delete(d.queues, key)
+				d.mu.Unlock()
+				return
+			}
+			job := queue[0]
+			d.queues[key] = queue[1:]
+			d.mu.Unlock()
+			age := d.maxQueueAge
+			if age == 0 {
+				age = time.Second
+			}
+			job.run(time.Since(job.enqueued) <= age)
+			d.mu.Lock()
+			d.bytes -= job.bytes
+			d.mu.Unlock()
+		}
+	}()
+	return true
+}
diff --git a/electron/native/private-transport/internal/protocol/reliable_dispatch_test.go b/electron/native/private-transport/internal/protocol/reliable_dispatch_test.go
new file mode 100644
index 000000000..1c0091942
--- /dev/null
+++ b/electron/native/private-transport/internal/protocol/reliable_dispatch_test.go
@@ -0,0 +1,38 @@
+package protocol
+
+import (
+	"testing"
+	"time"
+)
+
+func TestReliableQueueSharesLongerBudgetWithoutSendingExpiredWork(t *testing.T) {
+	for _, tc := range []struct {
+		age   time.Duration
+		ready bool
+	}{
+		{2 * time.Second, true}, {7 * time.Second, false},
+	} {
+		d := reliableDispatcher{maxQueueAge: 6 * time.Second}
+		started, release := make(chan struct{}), make(chan struct{})
+		d.submit("bulk", 10, func(bool) { close(started); <-release })
+		<-started
+		result := make(chan bool, 1)
+		d.submit("bulk", 10, func(ready bool) { result <- ready })
+		d.mu.Lock()
+		d.queues["bulk"][0].enqueued = time.Now().Add(-tc.age)
+		d.mu.Unlock()
+		control := make(chan bool, 1)
+		d.submit("control", 1, func(ready bool) { control <- ready })
+		if !<-control {
+			t.Fatal("control blocked")
+		}
+		close(release)
+		if got := <-result; got != tc.ready {
+			t.Fatalf("age=%v ready=%v", tc.age, got)
+		}
+		d.workers.Wait()
+		if d.bytes != 0 || len(d.queues) != 0 {
+			t.Fatal("queue leaked reservations")
+		}
+	}
+}
diff --git a/electron/native/private-transport/internal/protocol/server.go b/electron/native/private-transport/internal/protocol/server.go
new file mode 100644
index 000000000..617c0318e
--- /dev/null
+++ b/electron/native/private-transport/internal/protocol/server.go
@@ -0,0 +1,815 @@
+package protocol
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/binary"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"github.com/mengelbart/moqtransport"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	"qortal.org/qortal-hub/private-transport/internal/innerquic"
+	masqueclient "qortal.org/qortal-hub/private-transport/internal/masque"
+	"qortal.org/qortal-hub/private-transport/internal/moqclient"
+)
+
+const (
+	Version                 = 2
+	SidecarVersion          = "0.11.0"
+	MaxControlMessageBytes  = 64 * 1024
+	MaxBinaryMessageBytes   = innerquic.MaxReliablePayloadBytes
+	maxRememberedRequestIDs = 4096
+)
+
+// Dispatch and execution must decode the same complete schema. The decoder
+// rejects unknown fields, so a routing-only subset rejects valid requests.
+type privateSendParams struct {
+	SessionID string `json:"sessionId"`
+	MessageID string `json:"messageId"`
+	StreamKey string `json:"streamKey"`
+	EndStream bool   `json:"endStream"`
+}
+
+type moqPublishParams struct {
+	MoqSessionID string                       `json:"moqSessionId"`
+	TrackName    string                       `json:"trackName"`
+	Batched      bool                         `json:"batched"`
+	Delivery     *moqtransport.DeliveryPolicy `json:"delivery"`
+	GroupID      *uint64                      `json:"groupId"`
+	ObjectID     *uint64                      `json:"objectId"`
+}
+
+type Request struct {
+	receivedAt   time.Time
+	Version      int             `json:"version"`
+	RequestID    string          `json:"requestId"`
+	Operation    string          `json:"operation"`
+	Params       json.RawMessage `json:"params,omitempty"`
+	BinaryLength int             `json:"binaryLength,omitempty"`
+}
+type Error struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+type Response struct {
+	Version   int         `json:"version"`
+	Type      string      `json:"type"`
+	RequestID string      `json:"requestId"`
+	OK        bool        `json:"ok"`
+	Result    interface{} `json:"result,omitempty"`
+	Error     *Error      `json:"error,omitempty"`
+}
+type Event struct {
+	Version        int      `json:"version"`
+	Type           string   `json:"type"`
+	Event          string   `json:"event"`
+	SessionID      string   `json:"sessionId"`
+	MessageID      string   `json:"messageId,omitempty"`
+	SubscriptionID string   `json:"subscriptionId,omitempty"`
+	Namespace      []string `json:"namespace,omitempty"`
+	TrackName      string   `json:"trackName,omitempty"`
+	GroupID        uint64   `json:"groupId"`
+	ObjectID       uint64   `json:"objectId"`
+	Code           string   `json:"code,omitempty"`
+	BinaryLength   int      `json:"binaryLength,omitempty"`
+}
+
+type Server struct {
+	mu          sync.Mutex
+	tunnels     map[string]*masqueclient.Tunnel
+	sessions    map[string]*innerquic.Session
+	moqSessions map[string]*moqclient.Session
+	seen        map[string]struct{}
+	seenIDs     []string
+	writeMu     sync.Mutex
+	emit        func(Event, []byte)
+}
+
+func NewServer() *Server {
+	return &Server{
+		tunnels: map[string]*masqueclient.Tunnel{}, sessions: map[string]*innerquic.Session{},
+		moqSessions: map[string]*moqclient.Session{}, seen: map[string]struct{}{},
+	}
+}
+
+func (s *Server) Serve(ctx context.Context, input io.Reader, output io.Writer) error {
+	ctx, cancel := context.WithCancel(ctx)
+	var preparations sync.WaitGroup
+	slots := make(chan struct{}, 4)
+	defer func() { cancel(); preparations.Wait(); masqueclient.CloseAllRelays() }()
+	reader := bufio.NewReaderSize(input, 4096)
+	s.emit = func(event Event, binary []byte) { s.write(output, event, binary) }
+	reliableSends := reliableDispatcher{maxQueueAge: 6 * time.Second}
+	var moqSends reliableDispatcher
+	defer moqSends.workers.Wait()
+	defer reliableSends.workers.Wait()
+	defer s.Close()
+	for {
+		line, err := readControlLine(reader)
+		if errors.Is(err, io.EOF) {
+			return nil
+		}
+		if err != nil {
+			s.write(output, failure("", "CONTROL_MESSAGE_TOO_LARGE", "control message exceeds limit"), nil)
+			return nil
+		}
+		if len(bytes.TrimSpace(line)) == 0 {
+			continue
+		}
+		var req Request
+		if json.Unmarshal(line, &req) != nil {
+			s.write(output, failure("", "MALFORMED_JSON", "invalid JSON request"), nil)
+			continue
+		}
+		if req.BinaryLength < 0 || req.BinaryLength > MaxBinaryMessageBytes {
+			s.write(output, failure(req.RequestID, "BINARY_FRAME_TOO_LARGE", "binary frame exceeds limit"), nil)
+			return nil
+		}
+		binary := make([]byte, req.BinaryLength)
+		if _, err := io.ReadFull(reader, binary); err != nil {
+			s.write(output, failure(req.RequestID, "MALFORMED_BINARY_FRAME", "truncated binary frame"), nil)
+			return nil
+		}
+		req.receivedAt = time.Now()
+		if req.Operation == "publishMoqObject" {
+			var p moqPublishParams
+			if decodeParams(req.Params, &p) != nil || len(p.MoqSessionID) > 128 || len(p.TrackName) > 128 {
+				s.write(output, failure(req.RequestID, "INVALID_PARAMS", "invalid publication params"), nil)
+				continue
+			}
+			if !moqSends.submit(p.MoqSessionID+"\x00"+p.TrackName, len(binary), func(ready bool) {
+				if !ready {
+					s.write(output, failure(req.RequestID, "MOQ_OBJECT_EXPIRED", "publication queue timed out"), nil)
+					return
+				}
+				response, _ := s.handleRequest(ctx, req, binary)
+				s.write(output, response, nil)
+			}) {
+				s.write(output, failure(req.RequestID, "MOQ_QUEUE_LIMIT", "publication capacity reached"), nil)
+			}
+			continue
+		}
+		if req.Operation == "sendPrivateReliable" {
+			var p privateSendParams
+			if decodeParams(req.Params, &p) != nil || len(p.SessionID) > 128 || len(p.StreamKey) > 96 {
+				s.write(output, failure(req.RequestID, "INVALID_PARAMS", "invalid stream params"), nil)
+				continue
+			}
+			if !reliableSends.submit(p.SessionID+"\x00"+p.StreamKey, len(binary), func(ready bool) {
+				if !ready {
+					s.write(output, failure(req.RequestID, "RELIABLE_SEND_NOT_STARTED", "send expired before writing"), nil)
+					return
+				}
+				response, _ := s.handleRequest(ctx, req, binary)
+				s.write(output, response, nil)
+			}) {
+				s.write(output, failure(req.RequestID, "STREAM_LIMIT_REACHED", "stream send capacity reached"), nil)
+			}
+			continue
+		}
+		if req.Operation == "prepareRelay" || req.Operation == "authorizeRelay" {
+			select {
+			case slots <- struct{}{}:
+				preparations.Add(1)
+				go func(req Request) {
+					defer preparations.Done()
+					defer func() { <-slots }()
+					response, _ := s.handleRequest(ctx, req, nil)
+					s.write(output, response, nil)
+				}(req)
+			default:
+				s.write(output, failure(req.RequestID, "RELAY_BUSY", "relay preparation capacity reached"), nil)
+			}
+			continue
+		}
+		response, shutdown := s.handleRequest(ctx, req, binary)
+		s.write(output, response, nil)
+		if shutdown {
+			return nil
+		}
+	}
+}
+
+func readControlLine(reader *bufio.Reader) ([]byte, error) {
+	var line []byte
+	for {
+		part, prefix, err := reader.ReadLine()
+		if err != nil {
+			return nil, err
+		}
+		if len(line)+len(part) > MaxControlMessageBytes {
+			return nil, errors.New("control too large")
+		}
+		line = append(line, part...)
+		if !prefix {
+			return line, nil
+		}
+	}
+}
+func (s *Server) write(output io.Writer, value interface{}, binary []byte) {
+	s.writeMu.Lock()
+	defer s.writeMu.Unlock()
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		return
+	}
+	if writeAll(output, append(encoded, '\n')) != nil {
+		return
+	}
+	if len(binary) > 0 {
+		_ = writeAll(output, binary)
+	}
+}
+
+func writeAll(output io.Writer, data []byte) error {
+	for len(data) > 0 {
+		n, err := output.Write(data)
+		if err != nil {
+			return err
+		}
+		if n == 0 {
+			return io.ErrShortWrite
+		}
+		data = data[n:]
+	}
+	return nil
+}
+
+func (s *Server) Handle(ctx context.Context, line []byte) (Response, bool) {
+	var req Request
+	if json.Unmarshal(line, &req) != nil {
+		return failure("", "MALFORMED_JSON", "invalid JSON request"), false
+	}
+	return s.handleRequest(ctx, req, nil)
+}
+
+func (s *Server) handleRequest(ctx context.Context, req Request, binary []byte) (Response, bool) {
+	if req.RequestID == "" {
+		return failure("", "MISSING_REQUEST_ID", "requestId is required"), false
+	}
+	if req.Version != Version {
+		return failure(req.RequestID, "UNSUPPORTED_VERSION", "unsupported protocol version"), false
+	}
+	if s.rememberRequestID(req.RequestID) {
+		return failure(req.RequestID, "DUPLICATE_REQUEST_ID", "requestId was already used"), false
+	}
+	switch req.Operation {
+	case "prepareRelay", "authorizeRelay", "closeRelay", "clearRelays", "prepareRelayTickets", "finalizeRelayTickets":
+		return s.relayOperation(ctx, req), false
+	case "health":
+		return success(req.RequestID, map[string]interface{}{"service": "qortal-private-transport", "sidecarVersion": SidecarVersion, "protocolVersion": Version, "innerAlpn": innerquic.ALPN, "moqAlpn": moqclient.ALPN}), false
+	case "openMasqueTunnel":
+		return s.openTunnel(ctx, req), false
+	case "sendDatagram":
+		return s.sendTunnel(req), false
+	case "receiveDatagram":
+		return s.receiveTunnel(req), false
+	case "closeTunnel":
+		return s.closeTunnel(req), false
+	case "openPrivateSession":
+		return s.openPrivateSession(ctx, req), false
+	case "sendPrivateReliable":
+		return s.sendPrivate(req, binary, true), false
+	case "sendPrivateDatagram":
+		return s.sendPrivate(req, binary, false), false
+	case "sessionMetrics":
+		return s.sessionMetrics(req), false
+	case "closePrivateSession":
+		return s.closePrivateSession(req), false
+	case "openMoqSession":
+		return s.openMoqSession(ctx, req), false
+	case "subscribeMoqTrack":
+		return s.subscribeMoqTrack(req), false
+	case "publishMoqObject":
+		return s.publishMoqObject(req, binary), false
+	case "moqSessionMetrics":
+		return s.moqSessionMetrics(req), false
+	case "closeMoqSession":
+		return s.closeMoqSession(req), false
+	case "shutdown":
+		return success(req.RequestID, map[string]bool{"shuttingDown": true}), true
+	default:
+		return failure(req.RequestID, "UNKNOWN_OPERATION", "unsupported operation"), false
+	}
+}
+
+type moqOpenParams struct {
+	PreparedRelay        string          `json:"preparedRelay"`
+	RelayAddress         string          `json:"relayAddress"`
+	RelayServerName      string          `json:"relayServerName"`
+	RelayCertSHA256      string          `json:"relayCertSha256"`
+	BackendAddress       string          `json:"backendAddress"`
+	BackendServerName    string          `json:"backendServerName"`
+	BackendCertSHA256    string          `json:"backendCertSha256"`
+	LogicalSessionID     string          `json:"logicalSessionId"`
+	AttachToken          string          `json:"attachToken"`
+	PublicationNamespace []string        `json:"publicationNamespace"`
+	PublicationTrack     json.RawMessage `json:"publicationTrack"`
+	TimeoutMS            int             `json:"timeoutMs"`
+}
+
+func (s *Server) openMoqSession(ctx context.Context, req Request) Response {
+	var p moqOpenParams
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	var track string
+	var tracks []string
+	if json.Unmarshal(p.PublicationTrack, &track) == nil {
+		tracks = []string{track}
+	} else if json.Unmarshal(p.PublicationTrack, &tracks) != nil || len(tracks) == 0 {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid publication tracks")
+	}
+	sessionID, err := randomID("moq-")
+	if err != nil {
+		return failure(req.RequestID, "INTERNAL_ERROR", "failed to allocate MOQT session ID")
+	}
+	session, err := moqclient.Open(ctx, moqclient.Config{
+		Relay: masqueclient.Config{
+			PreparedRelay: p.PreparedRelay,
+			RelayAddress:  p.RelayAddress, RelayServerName: p.RelayServerName,
+			RelayCertSHA256: p.RelayCertSHA256, TargetAddress: p.BackendAddress,
+			Timeout: duration(p.TimeoutMS),
+		},
+		BackendServerName: p.BackendServerName, BackendCertSHA256: p.BackendCertSHA256,
+		LogicalSessionID: p.LogicalSessionID, AttachToken: p.AttachToken,
+		PublicationNamespace: p.PublicationNamespace, PublicationTrack: tracks[0], PublicationTracks: tracks,
+		Timeout: duration(p.TimeoutMS),
+	}, func(event moqclient.Event) { s.emitMoq(sessionID, event) })
+	if err != nil {
+		return failure(req.RequestID, moqErrorCode(err), "MOQT session establishment failed")
+	}
+	s.mu.Lock()
+	s.moqSessions[sessionID] = session
+	s.mu.Unlock()
+	return success(req.RequestID, map[string]interface{}{
+		"moqSessionId": sessionID, "logicalSessionId": p.LogicalSessionID,
+		"publicationNamespace": p.PublicationNamespace, "publicationTrack": p.PublicationTrack,
+		"applicationProtocol": moqclient.ALPN,
+	})
+}
+
+func moqErrorCode(err error) string {
+	if code := relayErrorCode(err); code != "" {
+		return code
+	}
+	text := err.Error()
+	if strings.Contains(text, "MASQUE_TUNNEL_FAILED") {
+		return "MASQUE_TUNNEL_FAILED"
+	}
+	if strings.Contains(text, "certificate") {
+		return "BACKEND_IDENTITY_MISMATCH"
+	}
+	for _, code := range []string{
+		"MOQ_QUEUE_LIMIT", "MOQ_OBJECT_EXPIRED",
+		"INVALID_MOQ_CONFIG", "MOQ_QUIC_FAILED", "MOQ_SESSION_FAILED",
+		"MOQ_ATTACH_FAILED", "DATAGRAM_UNSUPPORTED", "INVALID_MOQ_SUBSCRIPTION",
+		"MOQ_SUBSCRIBE_FAILED", "MOQ_SESSION_CLOSED", "MOQ_SUBSCRIPTION_LIMIT",
+		"MOQ_SUBSCRIPTION_ID_REUSED", "MOQ_OBJECT_TOO_LARGE", "MOQ_SEND_FAILED",
+	} {
+		if strings.Contains(text, code) {
+			return code
+		}
+	}
+	return "MOQ_SESSION_FAILED"
+}
+
+func (s *Server) emitMoq(sessionID string, event moqclient.Event) {
+	if s.emit == nil {
+		return
+	}
+	s.emit(Event{
+		Version: Version, Type: "event", Event: event.Kind, SessionID: sessionID,
+		SubscriptionID: event.SubscriptionID, Namespace: event.Namespace, TrackName: event.TrackName,
+		GroupID: event.GroupID, ObjectID: event.ObjectID, Code: event.Code,
+		BinaryLength: len(event.Data),
+	}, event.Data)
+}
+
+func (s *Server) subscribeMoqTrack(req Request) Response {
+	var p struct {
+		MoqSessionID   string   `json:"moqSessionId"`
+		SubscriptionID string   `json:"subscriptionId"`
+		Namespace      []string `json:"namespace"`
+		TrackName      string   `json:"trackName"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	session := s.getMoqSession(p.MoqSessionID)
+	if session == nil {
+		return failure(req.RequestID, "MOQ_SESSION_CLOSED", "MOQT session does not exist")
+	}
+	if err := session.Subscribe(p.SubscriptionID, p.Namespace, p.TrackName); err != nil {
+		return failure(req.RequestID, moqErrorCode(err), "MOQT subscription failed")
+	}
+	return success(req.RequestID, map[string]interface{}{
+		"subscribed": true, "subscriptionId": p.SubscriptionID,
+		"namespace": p.Namespace, "trackName": p.TrackName,
+	})
+}
+
+func (s *Server) publishMoqObject(req Request, binary []byte) Response {
+	var p moqPublishParams
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	session := s.getMoqSession(p.MoqSessionID)
+	if session == nil {
+		return failure(req.RequestID, "MOQ_SESSION_CLOSED", "MOQT session does not exist")
+	}
+	objects := [][]byte{binary}
+	if p.Batched {
+		var err error
+		objects, err = parseMoqBatch(binary)
+		if err != nil {
+			return failure(req.RequestID, "INVALID_PARAMS", "invalid object batch")
+		}
+	}
+	policy := moqtransport.DeliveryPolicy{Priority: 1, MaxQueueAgeMillis: 200}
+	if p.Delivery != nil {
+		policy = *p.Delivery
+	}
+	if !policy.Valid() {
+		return failure(req.RequestID, "INVALID_MOQ_CONFIG", "invalid delivery policy")
+	}
+	if !req.receivedAt.IsZero() {
+		policy.MaxQueueAgeMillis -= int(time.Since(req.receivedAt).Milliseconds())
+	}
+	if policy.MaxQueueAgeMillis < 10 {
+		return failure(req.RequestID, "MOQ_OBJECT_EXPIRED", "publication deadline exceeded")
+	}
+	var err error
+	if p.GroupID != nil || p.ObjectID != nil {
+		if p.GroupID == nil || p.ObjectID == nil || p.Batched {
+			return failure(req.RequestID, "INVALID_MOQ_CONFIG", "invalid reliable object")
+		}
+		err = session.PublishGroupObject(p.TrackName, *p.GroupID, *p.ObjectID, binary, policy)
+	} else {
+		err = session.PublishTrackBatch(p.TrackName, objects, policy)
+	}
+	if err != nil {
+		return failure(req.RequestID, moqErrorCode(err), "MOQT object publish failed")
+	}
+	return success(req.RequestID, map[string]interface{}{
+		"accepted": true, "bytesSent": len(binary),
+	})
+}
+
+func parseMoqBatch(data []byte) ([][]byte, error) {
+	var objects [][]byte
+	for len(data) > 0 {
+		if len(data) < 2 || len(objects) >= 8 {
+			return nil, errors.New("invalid batch")
+		}
+		size := int(binary.BigEndian.Uint16(data[:2]))
+		data = data[2:]
+		if size == 0 || size > moqclient.MaxObjectBytes || size > len(data) {
+			return nil, errors.New("invalid batch")
+		}
+		objects = append(objects, data[:size])
+		data = data[size:]
+	}
+	if len(objects) == 0 {
+		return nil, errors.New("empty batch")
+	}
+	return objects, nil
+}
+
+func (s *Server) moqSessionMetrics(req Request) Response {
+	var p struct {
+		MoqSessionID string `json:"moqSessionId"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	session := s.getMoqSession(p.MoqSessionID)
+	if session == nil {
+		return failure(req.RequestID, "MOQ_SESSION_CLOSED", "MOQT session does not exist")
+	}
+	return success(req.RequestID, session.Metrics())
+}
+
+func (s *Server) closeMoqSession(req Request) Response {
+	var p struct {
+		MoqSessionID string `json:"moqSessionId"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	s.mu.Lock()
+	session := s.moqSessions[p.MoqSessionID]
+	delete(s.moqSessions, p.MoqSessionID)
+	s.mu.Unlock()
+	if session == nil {
+		return failure(req.RequestID, "MOQ_SESSION_CLOSED", "MOQT session does not exist")
+	}
+	_ = session.Close()
+	return success(req.RequestID, map[string]bool{"closed": true})
+}
+
+func (s *Server) getMoqSession(id string) *moqclient.Session {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.moqSessions[id]
+}
+
+type privateOpenParams struct {
+	PreparedRelay     string `json:"preparedRelay"`
+	RelayAddress      string `json:"relayAddress"`
+	RelayServerName   string `json:"relayServerName"`
+	RelayCertSHA256   string `json:"relayCertSha256"`
+	BackendAddress    string `json:"backendAddress"`
+	BackendServerName string `json:"backendServerName"`
+	BackendCertSHA256 string `json:"backendCertSha256"`
+	LogicalSessionID  string `json:"logicalSessionId"`
+	AttachToken       string `json:"attachToken"`
+	Nonce             string `json:"nonce"`
+	Purpose           string `json:"purpose"`
+	OwnerBindingHash  string `json:"ownerBindingHash"`
+	TimeoutMS         int    `json:"timeoutMs"`
+}
+
+func (s *Server) openPrivateSession(ctx context.Context, req Request) Response {
+	var p privateOpenParams
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	sessionID, err := randomID("session-")
+	if err != nil {
+		return failure(req.RequestID, "INTERNAL_ERROR", "failed to allocate session ID")
+	}
+	session, err := innerquic.Open(ctx, innerquic.Config{Relay: masqueclient.Config{PreparedRelay: p.PreparedRelay, RelayAddress: p.RelayAddress, RelayServerName: p.RelayServerName, RelayCertSHA256: p.RelayCertSHA256, TargetAddress: p.BackendAddress, Timeout: duration(p.TimeoutMS)}, BackendServerName: p.BackendServerName, BackendCertSHA256: p.BackendCertSHA256, LogicalSessionID: p.LogicalSessionID, AttachToken: p.AttachToken, Nonce: p.Nonce, Purpose: p.Purpose, OwnerBindingHash: p.OwnerBindingHash, Timeout: duration(p.TimeoutMS)}, func(e innerquic.Event) { s.emitInner(sessionID, e) })
+	if err != nil {
+		return failure(req.RequestID, innerErrorCode(err), "private session establishment failed")
+	}
+	s.mu.Lock()
+	s.sessions[sessionID] = session
+	s.mu.Unlock()
+	innerID, _ := randomID("inner-")
+	return success(req.RequestID, map[string]interface{}{"sessionId": sessionID, "innerQuicConnectionId": innerID, "logicalSessionId": p.LogicalSessionID, "transportGeneration": 1})
+}
+func innerErrorCode(err error) string {
+	if code := relayErrorCode(err); code != "" {
+		return code
+	}
+	text := err.Error()
+	for _, code := range []string{"ATTACH_TOKEN_REJECTED", "DATAGRAM_UNSUPPORTED", "SESSION_ATTACH_FAILED", "MASQUE_TUNNEL_FAILED"} {
+		if strings.Contains(text, code) {
+			return code
+		}
+	}
+	if strings.Contains(text, "certificate") {
+		return "BACKEND_IDENTITY_MISMATCH"
+	}
+	if strings.Contains(text, "INNER_QUIC_FAILED") {
+		return "INNER_QUIC_FAILED"
+	}
+	return "INNER_QUIC_FAILED"
+}
+func (s *Server) emitInner(sessionID string, e innerquic.Event) {
+	if s.emit == nil {
+		return
+	}
+	s.emit(Event{Version: Version, Type: "event", Event: e.Kind, SessionID: sessionID, MessageID: e.MessageID, Code: e.Code, BinaryLength: len(e.Data)}, e.Data)
+}
+func (s *Server) sendPrivate(req Request, binary []byte, reliable bool) Response {
+	var p privateSendParams
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	if len(binary) == 0 {
+		return failure(req.RequestID, "INVALID_BINARY_FRAME", "binary payload required")
+	}
+	session := s.getSession(p.SessionID)
+	if session == nil {
+		return failure(req.RequestID, "TRANSPORT_CLOSED", "session does not exist")
+	}
+	var err error
+	if reliable {
+		// Queueing and writing share one budget, below the seven-second IPC
+		// timeout. Never restart a full write timeout after a long queue wait.
+		budget := 5 * time.Second
+		if !req.receivedAt.IsZero() {
+			remaining := time.Until(req.receivedAt.Add(6 * time.Second))
+			if remaining <= 0 {
+				return failure(req.RequestID, "RELIABLE_SEND_NOT_STARTED", "send expired before writing")
+			}
+			budget = min(budget, remaining)
+		}
+		if p.StreamKey != "" {
+			err = session.SendReliableStreamWithTimeout(p.StreamKey, p.MessageID, binary, p.EndStream, budget)
+		} else {
+			err = session.SendReliableWithTimeout(p.MessageID, binary, budget)
+		}
+	} else {
+		err = session.SendDatagram(p.MessageID, binary)
+	}
+	if err != nil {
+		code := "TRANSPORT_SEND_FAILED"
+		for _, streamCode := range []string{"STREAM_LIMIT_REACHED", "RELIABLE_STREAM_FAILED", "RELIABLE_STREAMS_UNSUPPORTED", "TRANSPORT_CLOSED"} {
+			if err.Error() == streamCode {
+				code = streamCode
+			}
+		}
+		if errors.Is(err, innerquic.ErrReliableWriteFailed) {
+			code = "TRANSPORT_CLOSED"
+		}
+		if strings.Contains(err.Error(), "large") || strings.Contains(err.Error(), "invalid") {
+			code = "FRAME_TOO_LARGE"
+		}
+		return failure(req.RequestID, code, "transport send failed")
+	}
+	return success(req.RequestID, map[string]interface{}{"accepted": true, "bytesSent": len(binary)})
+}
+func (s *Server) sessionMetrics(req Request) Response {
+	var p struct {
+		SessionID string `json:"sessionId"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	session := s.getSession(p.SessionID)
+	if session == nil {
+		return failure(req.RequestID, "TRANSPORT_CLOSED", "session does not exist")
+	}
+	return success(req.RequestID, session.Metrics())
+}
+func (s *Server) closePrivateSession(req Request) Response {
+	var p struct {
+		SessionID string `json:"sessionId"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	s.mu.Lock()
+	session := s.sessions[p.SessionID]
+	delete(s.sessions, p.SessionID)
+	s.mu.Unlock()
+	if session == nil {
+		return failure(req.RequestID, "TRANSPORT_CLOSED", "session does not exist")
+	}
+	_ = session.Close()
+	return success(req.RequestID, map[string]bool{"closed": true})
+}
+func (s *Server) getSession(id string) *innerquic.Session {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.sessions[id]
+}
+
+// Step 2 tunnel operations remain for regression tests.
+func (s *Server) openTunnel(ctx context.Context, req Request) Response {
+	var p struct {
+		PreparedRelay   string `json:"preparedRelay"`
+		RelayAddress    string `json:"relayAddress"`
+		RelayServerName string `json:"relayServerName"`
+		RelayCertSHA256 string `json:"relayCertSha256"`
+		TargetAddress   string `json:"targetAddress"`
+		TimeoutMS       int    `json:"timeoutMs"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	t, err := masqueclient.Open(ctx, masqueclient.Config{PreparedRelay: p.PreparedRelay, RelayAddress: p.RelayAddress, RelayServerName: p.RelayServerName, RelayCertSHA256: p.RelayCertSHA256, TargetAddress: p.TargetAddress, Timeout: duration(p.TimeoutMS)})
+	if err != nil {
+		return failure(req.RequestID, "MASQUE_OPEN_FAILED", "failed to open authenticated MASQUE tunnel")
+	}
+	id, _ := randomID("tunnel-")
+	s.mu.Lock()
+	s.tunnels[id] = t
+	s.mu.Unlock()
+	return success(req.RequestID, map[string]string{"tunnelId": id})
+}
+func (s *Server) sendTunnel(req Request) Response {
+	var p struct {
+		TunnelID   string `json:"tunnelId"`
+		DataBase64 string `json:"dataBase64"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	data, err := base64.StdEncoding.DecodeString(p.DataBase64)
+	if err != nil || len(data) == 0 || len(data) > masqueclient.MaxDatagramBytes {
+		return failure(req.RequestID, "INVALID_DATAGRAM", "invalid or oversized datagram")
+	}
+	t := s.getTunnel(p.TunnelID)
+	if t == nil {
+		return failure(req.RequestID, "UNKNOWN_TUNNEL", "tunnel does not exist")
+	}
+	if t.Send(data) != nil {
+		return failure(req.RequestID, "DATAGRAM_SEND_FAILED", "failed to send datagram")
+	}
+	return success(req.RequestID, map[string]int{"bytesSent": len(data)})
+}
+func (s *Server) receiveTunnel(req Request) Response {
+	var p struct {
+		TunnelID  string `json:"tunnelId"`
+		TimeoutMS int    `json:"timeoutMs"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	t := s.getTunnel(p.TunnelID)
+	if t == nil {
+		return failure(req.RequestID, "UNKNOWN_TUNNEL", "tunnel does not exist")
+	}
+	data, err := t.Receive(duration(p.TimeoutMS))
+	if err != nil {
+		return failure(req.RequestID, "DATAGRAM_RECEIVE_FAILED", "failed to receive datagram")
+	}
+	return success(req.RequestID, map[string]string{"dataBase64": base64.StdEncoding.EncodeToString(data)})
+}
+func (s *Server) closeTunnel(req Request) Response {
+	var p struct {
+		TunnelID string `json:"tunnelId"`
+	}
+	if decodeParams(req.Params, &p) != nil {
+		return failure(req.RequestID, "INVALID_PARAMS", "invalid params")
+	}
+	s.mu.Lock()
+	t := s.tunnels[p.TunnelID]
+	delete(s.tunnels, p.TunnelID)
+	s.mu.Unlock()
+	if t == nil {
+		return failure(req.RequestID, "UNKNOWN_TUNNEL", "tunnel does not exist")
+	}
+	_ = t.Close()
+	return success(req.RequestID, map[string]bool{"closed": true})
+}
+func (s *Server) getTunnel(id string) *masqueclient.Tunnel {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.tunnels[id]
+}
+func (s *Server) Close() {
+	s.mu.Lock()
+	ts := s.tunnels
+	ss := s.sessions
+	ms := s.moqSessions
+	s.tunnels = map[string]*masqueclient.Tunnel{}
+	s.sessions = map[string]*innerquic.Session{}
+	s.moqSessions = map[string]*moqclient.Session{}
+	s.mu.Unlock()
+	for _, x := range ms {
+		_ = x.Close()
+	}
+	for _, x := range ss {
+		_ = x.Close()
+	}
+	for _, x := range ts {
+		_ = x.Close()
+	}
+}
+func (s *Server) rememberRequestID(id string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if _, ok := s.seen[id]; ok {
+		return true
+	}
+	if len(s.seenIDs) == maxRememberedRequestIDs {
+		delete(s.seen, s.seenIDs[0])
+		s.seenIDs = s.seenIDs[1:]
+	}
+	s.seen[id] = struct{}{}
+	s.seenIDs = append(s.seenIDs, id)
+	return false
+}
+func decodeParams(raw json.RawMessage, target interface{}) error {
+	if len(raw) == 0 {
+		return errors.New("params required")
+	}
+	d := json.NewDecoder(bytes.NewReader(raw))
+	d.DisallowUnknownFields()
+	if d.Decode(target) != nil {
+		return errors.New("invalid params")
+	}
+	return nil
+}
+func duration(ms int) time.Duration {
+	if ms < 1 || ms > 30_000 {
+		return 8 * time.Second
+	}
+	return time.Duration(ms) * time.Millisecond
+}
+func randomID(prefix string) (string, error) {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return prefix + hex.EncodeToString(b), nil
+}
+func success(id string, result interface{}) Response {
+	return Response{Version: Version, Type: "response", RequestID: id, OK: true, Result: result}
+}
+func failure(id, code, message string) Response {
+	return Response{Version: Version, Type: "response", RequestID: id, OK: false, Error: &Error{Code: code, Message: message}}
+}
diff --git a/electron/native/private-transport/internal/protocol/server_test.go b/electron/native/private-transport/internal/protocol/server_test.go
new file mode 100644
index 000000000..2676f0a5f
--- /dev/null
+++ b/electron/native/private-transport/internal/protocol/server_test.go
@@ -0,0 +1,174 @@
+package protocol
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestServeDispatchUsesCompleteSendSchemas(t *testing.T) {
+	tests := []struct{ name, operation, params, want string }{
+		{"legacy reliable", "sendPrivateReliable", `{"sessionId":"missing","messageId":"request-1"}`, "TRANSPORT_CLOSED"},
+		{"keyed reliable", "sendPrivateReliable", `{"sessionId":"missing","messageId":"request-1","streamKey":"file-control","endStream":false}`, "TRANSPORT_CLOSED"},
+		{"final reliable", "sendPrivateReliable", `{"sessionId":"missing","messageId":"request-1","streamKey":"upload-1","endStream":true}`, "TRANSPORT_CLOSED"},
+		{"legacy moq", "publishMoqObject", `{"moqSessionId":"missing"}`, "MOQ_SESSION_CLOSED"},
+		{"batch moq", "publishMoqObject", `{"moqSessionId":"missing","trackName":"opaque","batched":true}`, "MOQ_SESSION_CLOSED"},
+		{"scheduled moq", "publishMoqObject", `{"moqSessionId":"missing","trackName":"opaque","batched":true,"delivery":{"priority":0,"maxQueueAgeMillis":120}}`, "MOQ_SESSION_CLOSED"},
+		{"unknown reliable field", "sendPrivateReliable", `{"sessionId":"missing","messageId":"request-1","typo":true}`, "INVALID_PARAMS"},
+		{"unknown moq field", "publishMoqObject", `{"moqSessionId":"missing","trackName":"opaque","typo":true}`, "INVALID_PARAMS"},
+		{"unknown delivery field", "publishMoqObject", `{"moqSessionId":"missing","delivery":{"priority":0,"maxQueueAgeMillis":120,"typo":true}}`, "INVALID_PARAMS"},
+		{"wrong reliable type", "sendPrivateReliable", `{"sessionId":"missing","messageId":"request-1","endStream":"true"}`, "INVALID_PARAMS"},
+		{"wrong moq type", "publishMoqObject", `{"moqSessionId":"missing","batched":"true"}`, "INVALID_PARAMS"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Use the actual line+binary IPC reader, not Handle(), which bypasses the
+			// dispatcher. Missing sessions prove valid requests reached execution while
+			// keeping this test independent of network availability and credentials.
+			req := Request{Version: Version, RequestID: "test", Operation: tt.operation, Params: json.RawMessage(tt.params), BinaryLength: 3}
+			line, err := json.Marshal(req)
+			if err != nil {
+				t.Fatal(err)
+			}
+			input := append(append(line, '\n'), 0, 1, 42)
+			var output bytes.Buffer
+			if err := NewServer().Serve(context.Background(), bytes.NewReader(input), &output); err != nil {
+				t.Fatal(err)
+			}
+			var response Response
+			if err := json.Unmarshal(bytes.TrimSpace(output.Bytes()), &response); err != nil {
+				t.Fatal(err, string(output.Bytes()))
+			}
+			if response.Error == nil || response.Error.Code != tt.want {
+				t.Fatalf("got %#v; want %s", response, tt.want)
+			}
+		})
+	}
+}
+
+func TestMalformedAndUnsupportedRequestsFailSafely(t *testing.T) {
+	tests := []struct {
+		name string
+		line string
+		code string
+	}{
+		{"malformed JSON", "{", "MALFORMED_JSON"},
+		{"missing request ID", `{"version":2,"operation":"health"}`, "MISSING_REQUEST_ID"},
+		{"unsupported version", `{"version":1,"requestId":"v1","operation":"health"}`, "UNSUPPORTED_VERSION"},
+		{"unknown operation", `{"version":2,"requestId":"unknown","operation":"exec"}`, "UNKNOWN_OPERATION"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			response, shutdown := NewServer().Handle(context.Background(), []byte(tt.line))
+			if shutdown || response.OK || response.Error == nil || response.Error.Code != tt.code {
+				t.Fatalf("unexpected response: %#v", response)
+			}
+		})
+	}
+}
+
+func TestMoqBatchValidation(t *testing.T) {
+	objects, err := parseMoqBatch([]byte{0, 2, 1, 2, 0, 1, 3})
+	if err != nil || len(objects) != 2 || !bytes.Equal(objects[0], []byte{1, 2}) {
+		t.Fatal("valid batch rejected", err)
+	}
+	for _, invalid := range [][]byte{nil, {0}, {0, 0}, {0, 2, 1}, {4, 1}, bytes.Repeat([]byte{0, 1, 42}, 9)} {
+		if _, err = parseMoqBatch(invalid); err == nil {
+			t.Fatal("invalid batch accepted", invalid)
+		}
+	}
+}
+
+func TestInnerErrorCodeDistinguishesRelayAndBackendCertificates(t *testing.T) {
+	if got := innerErrorCode(errors.New("MASQUE_TUNNEL_FAILED: relay certificate pin mismatch")); got != "MASQUE_TUNNEL_FAILED" {
+		t.Fatalf("relay error mapped to %q", got)
+	}
+	if got := innerErrorCode(errors.New("INNER_QUIC_FAILED: backend certificate pin mismatch")); got != "BACKEND_IDENTITY_MISMATCH" {
+		t.Fatalf("backend error mapped to %q", got)
+	}
+}
+
+func TestMoqErrorCodeDistinguishesRelayAndBackendCertificates(t *testing.T) {
+	if got := moqErrorCode(errors.New("MASQUE_TUNNEL_FAILED: relay certificate pin mismatch")); got != "MASQUE_TUNNEL_FAILED" {
+		t.Fatalf("relay error mapped to %q", got)
+	}
+	if got := moqErrorCode(errors.New("MOQ_QUIC_FAILED: backend certificate pin mismatch")); got != "BACKEND_IDENTITY_MISMATCH" {
+		t.Fatalf("backend error mapped to %q", got)
+	}
+}
+
+func TestMoqOperationsRejectUnknownSessions(t *testing.T) {
+	server := NewServer()
+	for index, request := range []string{
+		`{"version":2,"requestId":"subscribe","operation":"subscribeMoqTrack","params":{"moqSessionId":"missing","subscriptionId":"subscription-1","namespace":["qortal","apps"],"trackName":"realtime"}}`,
+		`{"version":2,"requestId":"publish","operation":"publishMoqObject","params":{"moqSessionId":"missing"}}`,
+		`{"version":2,"requestId":"metrics","operation":"moqSessionMetrics","params":{"moqSessionId":"missing"}}`,
+		`{"version":2,"requestId":"close","operation":"closeMoqSession","params":{"moqSessionId":"missing"}}`,
+	} {
+		response, shutdown := server.Handle(context.Background(), []byte(request))
+		if shutdown || response.OK || response.Error == nil || response.Error.Code != "MOQ_SESSION_CLOSED" {
+			t.Fatalf("request %d did not fail closed: %#v", index, response)
+		}
+	}
+}
+
+func TestAudioSpecificMoqOperationsAreNotAvailable(t *testing.T) {
+	for _, operation := range []string{
+		"openCallMediaSession", "subscribeCallMediaTrack", "publishCallMediaDatagram",
+		"setCallMediaSendKey", "setCallMediaReceiveKey", "removeCallMediaReceiveKey",
+		"publishCallAudioFrame", "callMediaSessionMetrics", "closeCallMediaSession",
+	} {
+		request := `{"version":2,"requestId":"old-` + operation + `","operation":"` + operation + `","params":{}}`
+		response, shutdown := NewServer().Handle(context.Background(), []byte(request))
+		if shutdown || response.OK || response.Error == nil || response.Error.Code != "UNKNOWN_OPERATION" {
+			t.Fatalf("operation %q did not fail closed: %#v", operation, response)
+		}
+	}
+}
+
+func TestDuplicateRequestIDFails(t *testing.T) {
+	server := NewServer()
+	request := []byte(`{"version":2,"requestId":"same","operation":"health"}`)
+	first, _ := server.Handle(context.Background(), request)
+	second, _ := server.Handle(context.Background(), request)
+	if !first.OK || second.OK || second.Error == nil || second.Error.Code != "DUPLICATE_REQUEST_ID" {
+		t.Fatalf("unexpected responses: first=%#v second=%#v", first, second)
+	}
+}
+
+func TestOversizedControlMessageFailsWithoutPanic(t *testing.T) {
+	input := strings.NewReader(strings.Repeat("x", MaxControlMessageBytes+1) + "\n")
+	var output bytes.Buffer
+	if err := NewServer().Serve(context.Background(), input, &output); err != nil {
+		t.Fatal(err)
+	}
+	var response Response
+	if err := json.Unmarshal(bytes.TrimSpace(output.Bytes()), &response); err != nil {
+		t.Fatal(err)
+	}
+	if response.OK || response.Error == nil || response.Error.Code != "CONTROL_MESSAGE_TOO_LARGE" {
+		t.Fatalf("unexpected response: %#v", response)
+	}
+}
+
+func TestMalformedAndOversizedBinaryFramesFailClosed(t *testing.T) {
+	for _, input := range []string{
+		`{"version":2,"requestId":"truncated","operation":"sendPrivateReliable","params":{},"binaryLength":5}` + "\nxx",
+		`{"version":2,"requestId":"oversized","operation":"sendPrivateReliable","params":{},"binaryLength":1048577}` + "\n",
+	} {
+		var output bytes.Buffer
+		if err := NewServer().Serve(context.Background(), strings.NewReader(input), &output); err != nil {
+			t.Fatal(err)
+		}
+		var response Response
+		if err := json.Unmarshal(bytes.TrimSpace(output.Bytes()), &response); err != nil {
+			t.Fatal(err)
+		}
+		if response.OK || response.Error == nil {
+			t.Fatalf("unexpected response: %#v", response)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/masque-go/.github/FUNDING.yml b/electron/native/private-transport/third_party/masque-go/.github/FUNDING.yml
new file mode 100644
index 000000000..7de30a1d7
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/.github/FUNDING.yml
@@ -0,0 +1,13 @@
+# These are supported funding model platforms
+
+github: [marten-seemann] # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
diff --git a/electron/native/private-transport/third_party/masque-go/.github/dependabot.yml b/electron/native/private-transport/third_party/masque-go/.github/dependabot.yml
new file mode 100644
index 000000000..5ace4600a
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/electron/native/private-transport/third_party/masque-go/.github/workflows/go-generate.sh b/electron/native/private-transport/third_party/masque-go/.github/workflows/go-generate.sh
new file mode 100644
index 000000000..b51c8beff
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/.github/workflows/go-generate.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -e
+
+DIR=$(pwd)
+TMP=$(mktemp -d)
+cd "$TMP"
+cp -r "$DIR" orig
+cp -r "$DIR" generated
+
+cd generated
+# delete all go-generated files generated (that adhere to the comment convention)
+grep --include \*.go -lrIZ "^// Code generated .* DO NOT EDIT\.$" . | xargs -r --null rm
+
+# generate everything
+go generate ./...
+cd ..
+
+# don't compare fuzzing corpora
+diff --exclude=corpus --exclude=.git -ruN orig generated
diff --git a/electron/native/private-transport/third_party/masque-go/.github/workflows/lint.yml b/electron/native/private-transport/third_party/masque-go/.github/workflows/lint.yml
new file mode 100644
index 000000000..5f38f907a
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/.github/workflows/lint.yml
@@ -0,0 +1,46 @@
+on: [push, pull_request]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    name: Lint
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: "1.27.x"
+      - name: Check for //go:build ignore in .go files
+        run: |
+          IGNORED_FILES=$(grep -rl '//go:build ignore' . --include='*.go') || true
+          if [ -n "$IGNORED_FILES" ]; then
+            echo "::error::Found ignored Go files: $IGNORED_FILES"
+            exit 1
+          fi
+      - name: Check that go.mod is tidied
+        if: success() || failure() # run this step even if the previous one failed
+        run: go mod tidy -diff
+      - name: Run code generators
+        if: success() || failure() # run this step even if the previous one failed
+        run: .github/workflows/go-generate.sh
+      - name: gofmt
+        if: success() || failure() # run this step even if the previous one failed
+        run: |
+          out=$(gofmt -s -l .)
+          if [[ -n "$out" ]]; then
+            echo $out | awk '{print "::error file=" $0 ",line=0,col=0::File is not gofmt-ed."}'
+            exit 1
+          fi
+      - name: go vet
+        if: success() || failure() # run this step even if the previous one failed
+        run: go vet ./...
+      - name: Install staticcheck
+        if: success() || failure() # run this step even if the previous one failed
+        run: go install honnef.co/go/tools/cmd/staticcheck@v0.8.1
+      - name: Run go fix
+        if: success() || failure() # run this step even if the previous one failed
+        run: go fix -diff ./...
+      - name: staticcheck
+        if: success() || failure() # run this step even if the previous one failed
+        run: |
+          set -o pipefail
+          staticcheck ./... | sed -e 's@\(.*\)\.go@./\1.go@g'
diff --git a/electron/native/private-transport/third_party/masque-go/.github/workflows/unit.yml b/electron/native/private-transport/third_party/masque-go/.github/workflows/unit.yml
new file mode 100644
index 000000000..ff6baf445
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/.github/workflows/unit.yml
@@ -0,0 +1,49 @@
+on: [push, pull_request]
+
+jobs:
+  unit:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ "ubuntu", "windows", "macos" ]
+        go: [ "1.26.x", "1.27.x" ]
+    runs-on: ${{ fromJSON(vars[format('UNIT_RUNNER_{0}', matrix.os)] || format('"{0}-latest"', matrix.os)) }}
+    name: Unit tests (${{ matrix.os}}, Go ${{ matrix.go }})
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: ${{ matrix.go }}
+      - run: go version
+      - name: Install go-junit-report
+        run: go install github.com/jstemmer/go-junit-report/v2@v2.1.0
+      - name: Run tests
+        env:
+          TIMESCALE_FACTOR: 10
+        run: go test -v -shuffle on -cover -coverprofile coverage.txt ./... 2>&1 | go-junit-report -set-exit-code -iocopy -out report.xml
+      - name: Run tests with race detector
+        env:
+          TIMESCALE_FACTOR: 10
+        run: go test -race -v -shuffle on ./...
+      - name: Upload coverage to Codecov
+        if: ${{ !cancelled() }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        env:
+          OS: ${{ matrix.os }}
+          GO: ${{ matrix.go }}
+        with:
+          files: coverage.txt
+          env_vars: OS,GO
+          token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload test report to Codecov
+        if: ${{ !cancelled() }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        env:
+          OS: ${{ matrix.os }}
+          GO: ${{ matrix.go }}
+        with:
+          report_type: test_results
+          name: Unit tests
+          files: report.xml
+          env_vars: OS,GO
+          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/electron/native/private-transport/third_party/masque-go/.gitignore b/electron/native/private-transport/third_party/masque-go/.gitignore
new file mode 100644
index 000000000..48062770f
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/.gitignore
@@ -0,0 +1,3 @@
+coverage.txt
+*.qlog
+*.sqlog
diff --git a/electron/native/private-transport/third_party/masque-go/LICENSE b/electron/native/private-transport/third_party/masque-go/LICENSE
new file mode 100644
index 000000000..e5a7b51c6
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/LICENSE
@@ -0,0 +1,7 @@
+Copyright 2024 Marten Seemann
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/electron/native/private-transport/third_party/masque-go/QORTAL_PATCH.md b/electron/native/private-transport/third_party/masque-go/QORTAL_PATCH.md
new file mode 100644
index 000000000..416904773
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/QORTAL_PATCH.md
@@ -0,0 +1,10 @@
+# Datagram buffer accessors
+
+Base: upstream masque-go v0.5.0, with its MIT license and tests retained.
+Only `datagram_buffer.go` is added. It exposes the admitted tunnel's HTTP/3
+receive-buffer opt-in and numeric snapshot through `Conn`.
+
+It requires the paired quic-go module replacement. There are no changes to
+CONNECT-UDP framing, certificates, ticket authorization, forwarding or encryption.
+Keep this copy identical between Hub and the relay. On upgrade, rebase this one
+file and run the upstream tests and real tunnel integration tests.
diff --git a/electron/native/private-transport/third_party/masque-go/README.md b/electron/native/private-transport/third_party/masque-go/README.md
new file mode 100644
index 000000000..2e82d8db4
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/README.md
@@ -0,0 +1,17 @@
+# masque-go
+
+[![Documentation](https://img.shields.io/badge/docs-quic--go.net-red?style=flat)](https://quic-go.net/docs/connect-udp)
+[![PkgGoDev](https://pkg.go.dev/badge/github.com/quic-go/masque-go)](https://pkg.go.dev/github.com/quic-go/masque-go)
+[![Code Coverage](https://img.shields.io/codecov/c/github/quic-go/masque-go/master.svg?style=flat-square)](https://codecov.io/gh/quic-go/masque-go/)
+
+masque-go is an implementation of the CONNECT-UDP protocol [RFC 9298](https://datatracker.ietf.org/doc/html/rfc9298), based on [quic-go](https://github.com/quic-go/quic-go). It provides both a client and a proxy implementation.
+
+Detailed documentation can be found on [quic-go.net](https://quic-go.net/docs/connect-udp/).
+
+## Release Policy
+
+masque-go always aims to support the latest two Go releases.
+
+## Contributing
+
+We are always happy to welcome new contributors! If you have any questions, please feel free to reach out by opening an issue or leaving a comment.
diff --git a/electron/native/private-transport/third_party/masque-go/client.go b/electron/native/private-transport/third_party/masque-go/client.go
new file mode 100644
index 000000000..2560b18b4
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/client.go
@@ -0,0 +1,126 @@
+package masque
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+
+	"github.com/dunglas/httpsfv"
+)
+
+// A ClientConn represents a connection to a single proxy server.
+// Multiple proxied connections can be established over a single ClientConn.
+type ClientConn struct {
+	conn       *quic.Conn
+	clientConn *http3.ClientConn
+}
+
+// Dial dials a proxied connection to a target server over the proxy connection.
+func (c *ClientConn) Dial(req *Request) (*Conn, *http.Response, error) {
+	return c.dial(req, nil)
+}
+
+func (c *ClientConn) dial(req *Request, closeConn func() error) (*Conn, *http.Response, error) {
+	httpReq := req.req
+	if httpReq.URL == nil {
+		return nil, nil, errors.New("masque: request URL is nil")
+	}
+	if httpReq.Host == "" && httpReq.URL.Host == "" {
+		return nil, nil, errors.New("masque: request needs a host")
+	}
+
+	select {
+	case <-httpReq.Context().Done():
+		return nil, nil, context.Cause(httpReq.Context())
+	case <-c.clientConn.Context().Done():
+		return nil, nil, context.Cause(c.clientConn.Context())
+	case <-c.clientConn.ReceivedSettings():
+	}
+	settings := c.clientConn.Settings()
+	if !settings.EnableExtendedConnect {
+		return nil, nil, errors.New("masque: server didn't enable Extended CONNECT")
+	}
+	if !settings.EnableDatagrams {
+		return nil, nil, errors.New("masque: server didn't enable Datagrams")
+	}
+
+	rstr, err := c.clientConn.OpenRequestStream(httpReq.Context())
+	if err != nil {
+		return nil, nil, fmt.Errorf("masque: failed to open request stream: %w", err)
+	}
+
+	var keepStream bool
+	defer func() {
+		if !keepStream {
+			rstr.CancelRead(quic.StreamErrorCode(http3.ErrCodeNoError))
+			rstr.CancelWrite(quic.StreamErrorCode(http3.ErrCodeNoError))
+		}
+	}()
+	if err := rstr.SendRequestHeader(httpReq); err != nil {
+		return nil, nil, fmt.Errorf("masque: failed to send request: %w", err)
+	}
+	// TODO: optimistically return the connection
+	rsp, err := rstr.ReadResponse()
+	if err != nil {
+		return nil, nil, fmt.Errorf("masque: failed to read response: %w", err)
+	}
+	if rsp.StatusCode < 200 || rsp.StatusCode > 299 {
+		return nil, rsp, fmt.Errorf("masque: server responded with %d", rsp.StatusCode)
+	}
+
+	var raddr net.Addr
+	if udpAddr := nextHopAddr(rsp); udpAddr != nil {
+		raddr = udpAddr
+	} else {
+		raddr = net.Addr(masqueAddr{req.target})
+	}
+
+	keepStream = true
+	return newProxiedConn(rstr, masqueAddr{c.conn.LocalAddr().String()}, raddr, closeConn), rsp, nil
+}
+
+// Extract the Proxy-Status next-hop value as a UDPAddr.
+func nextHopAddr(rsp *http.Response) *net.UDPAddr {
+	proxyStatusVals := rsp.Header.Values("Proxy-Status")
+	if len(proxyStatusVals) == 0 {
+		return nil
+	}
+	proxyStatus, err := httpsfv.UnmarshalItem(proxyStatusVals)
+	if err != nil {
+		log.Printf("bad Proxy-Status: %v", err)
+		return nil
+	}
+	nextHop, ok := proxyStatus.Params.Get("next-hop")
+	if !ok {
+		return nil
+	}
+	nextHopStr, ok := nextHop.(string)
+	if !ok {
+		log.Printf("non-string nextHop value")
+		return nil
+	}
+	if nextHopStr == "" {
+		return nil
+	}
+	host, port, err := net.SplitHostPort(nextHopStr)
+	if err != nil {
+		log.Printf("bad next-hop value: %v", err)
+		return nil
+	}
+	ip := net.ParseIP(host)
+	if ip == nil {
+		return nil
+	}
+	portNum, err := net.LookupPort("udp", port)
+	if err != nil {
+		log.Printf("bad port: %v", err)
+		return nil
+	}
+	return &net.UDPAddr{IP: ip, Port: portNum}
+}
diff --git a/electron/native/private-transport/third_party/masque-go/cmd/client/main.go b/electron/native/private-transport/third_party/masque-go/cmd/client/main.go
new file mode 100644
index 000000000..3637ef5d5
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/cmd/client/main.go
@@ -0,0 +1,95 @@
+package main
+
+import (
+	"context"
+	"crypto/tls"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+
+	"github.com/quic-go/masque-go"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+func main() {
+	var proxyURITemplate string
+	flag.StringVar(&proxyURITemplate, "t", "", "URI template")
+	flag.Parse()
+	if proxyURITemplate == "" {
+		flag.Usage()
+		os.Exit(1)
+	}
+	urls := flag.Args()
+	if len(urls) != 1 {
+		log.Fatal("usage: client -t <template> <url>")
+	}
+
+	tr := masque.Transport{
+		QUICConfig: &quic.Config{
+			EnableDatagrams:   true,
+			InitialPacketSize: 1350,
+		},
+	}
+	host, port, err := extractHostAndPort(urls[0])
+	if err != nil {
+		log.Fatalf("failed to parse url: %v", err)
+	}
+
+	hcl := &http.Client{
+		Transport: &http3.Transport{
+			Dial: func(ctx context.Context, addr string, tlsConf *tls.Config, quicConf *quic.Config) (*quic.Conn, error) {
+				raddr, err := net.ResolveUDPAddr("udp", host+":"+strconv.Itoa(int(port)))
+				if err != nil {
+					return nil, err
+				}
+				req, err := masque.NewRequest(ctx, uritemplate.MustNew(proxyURITemplate), raddr.String())
+				if err != nil {
+					return nil, err
+				}
+				pconn, _, err := tr.Dial(req)
+				if err != nil {
+					log.Fatal("dialing MASQUE failed:", err)
+				}
+				log.Printf("dialed connection: %s <-> %s", pconn.LocalAddr(), raddr)
+				quicConf = quicConf.Clone()
+				quicConf.DisablePathMTUDiscovery = true
+				return quic.DialEarly(ctx, pconn, raddr, tlsConf, quicConf)
+			},
+		},
+	}
+	rsp, err := hcl.Get(urls[0])
+	if err != nil {
+		log.Fatalf("request failed: %v", err)
+	}
+	log.Printf("HTTP status: %d", rsp.StatusCode)
+	data, err := io.ReadAll(rsp.Body)
+	if err != nil {
+		log.Fatalf("reading response body failed: %v", err)
+	}
+	log.Println(string(data))
+}
+
+func extractHostAndPort(template string) (string, uint16, error) {
+	u, err := url.Parse(template)
+	if err != nil {
+		return "", 0, err
+	}
+	host, portStr, err := net.SplitHostPort(u.Host)
+	if err != nil || portStr == "" {
+		return u.Host, 443, nil
+	}
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		return "", 0, fmt.Errorf("failed to parse port: %w", err)
+	}
+	return host, uint16(port), nil
+}
diff --git a/electron/native/private-transport/third_party/masque-go/cmd/proxy/main.go b/electron/native/private-transport/third_party/masque-go/cmd/proxy/main.go
new file mode 100644
index 000000000..0e74e617e
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/cmd/proxy/main.go
@@ -0,0 +1,71 @@
+package main
+
+import (
+	"crypto/tls"
+	"errors"
+	"flag"
+	"log"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"os"
+
+	"github.com/quic-go/masque-go"
+
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+func main() {
+	var templateStr, bind, keyFile, certFile string
+	flag.StringVar(&templateStr, "t", "", "URI template")
+	flag.StringVar(&bind, "b", "", "bind to (ip:port)")
+	flag.StringVar(&keyFile, "k", "", "key file")
+	flag.StringVar(&certFile, "c", "", "cert file")
+	flag.Parse()
+
+	if templateStr == "" || bind == "" || keyFile == "" || certFile == "" {
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	template, err := uritemplate.New(templateStr)
+	if err != nil {
+		log.Fatalf("invalid template: %v", err)
+	}
+	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		log.Fatalf("failed to load certificate: %v", err)
+	}
+	tlsConf := http3.ConfigureTLSConfig(&tls.Config{
+		Certificates: []tls.Certificate{cert},
+	})
+	server := http3.Server{
+		Addr:            bind,
+		TLSConfig:       tlsConf,
+		EnableDatagrams: true,
+		Logger:          slog.Default(),
+	}
+	defer server.Close()
+	proxy := masque.Proxy{}
+	// parse the template to extract the path for the HTTP handler
+	u, err := url.Parse(templateStr)
+	if err != nil {
+		log.Fatalf("failed to parse URI template: %v", err)
+	}
+	http.HandleFunc(u.Path, func(w http.ResponseWriter, r *http.Request) {
+		req, err := masque.ParseProxyRequest(r, template)
+		if err != nil {
+			if perr, ok := errors.AsType[*masque.ProxyRequestParseError](err); ok {
+				w.WriteHeader(perr.HTTPStatus)
+				return
+			}
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		proxy.Proxy(w, req)
+	})
+	if err := server.ListenAndServe(); err != nil {
+		log.Fatalf("failed to run proxy: %v", err)
+	}
+}
diff --git a/electron/native/private-transport/third_party/masque-go/codecov.yml b/electron/native/private-transport/third_party/masque-go/codecov.yml
new file mode 100644
index 000000000..658d67dfb
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/codecov.yml
@@ -0,0 +1,10 @@
+coverage:
+  ignore:
+    - cmd/
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        informational: true
diff --git a/electron/native/private-transport/third_party/masque-go/conn.go b/electron/native/private-transport/third_party/masque-go/conn.go
new file mode 100644
index 000000000..e23663f5b
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/conn.go
@@ -0,0 +1,208 @@
+package masque
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"os"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+type masqueAddr struct{ string }
+
+func (m masqueAddr) Network() string { return "connect-udp" }
+func (m masqueAddr) String() string  { return m.string }
+
+var _ net.Addr = masqueAddr{}
+
+type http3Stream interface {
+	io.ReadWriteCloser
+	ReceiveDatagram(context.Context) ([]byte, error)
+	SendDatagram([]byte) error
+	CancelRead(quic.StreamErrorCode)
+}
+
+var (
+	_ http3Stream = &http3.Stream{}
+	_ http3Stream = &http3.RequestStream{}
+)
+
+type Conn struct {
+	str        http3Stream
+	localAddr  net.Addr
+	remoteAddr net.Addr
+	closeConn  func() error
+
+	closed   atomic.Bool // set when Close is called
+	readDone chan struct{}
+
+	deadlineMx        sync.Mutex
+	readCtx           context.Context
+	readCtxCancel     context.CancelFunc
+	deadline          time.Time
+	readDeadlineTimer *time.Timer
+}
+
+var _ net.PacketConn = &Conn{}
+
+// closeConn is only used for QUIC connections dialed by [Transport.Dial].
+// It is nil for connections created through [Transport.NewClientConn]; callers close those QUIC connections themselves.
+func newProxiedConn(str http3Stream, local, remote net.Addr, closeConn func() error) *Conn {
+	c := &Conn{
+		str:        str,
+		localAddr:  local,
+		remoteAddr: remote,
+		closeConn:  closeConn,
+		readDone:   make(chan struct{}),
+	}
+	c.readCtx, c.readCtxCancel = context.WithCancel(context.Background())
+	go func() {
+		defer close(c.readDone)
+		if err := skipCapsules(str); err != io.EOF && !c.closed.Load() {
+			log.Printf("reading from request stream failed: %v", err)
+		}
+		str.Close()
+	}()
+	return c
+}
+
+func (c *Conn) ReadFrom(b []byte) (n int, addr net.Addr, err error) {
+start:
+	c.deadlineMx.Lock()
+	ctx := c.readCtx
+	c.deadlineMx.Unlock()
+	data, err := c.str.ReceiveDatagram(ctx)
+	if err != nil {
+		if !errors.Is(err, context.Canceled) {
+			return 0, nil, err
+		}
+		// The context is cancelled asynchronously (in a Go routine spawned from time.AfterFunc).
+		// We need to check if a new deadline has already been set.
+		c.deadlineMx.Lock()
+		restart := time.Now().Before(c.deadline)
+		c.deadlineMx.Unlock()
+		if restart {
+			goto start
+		}
+		return 0, nil, os.ErrDeadlineExceeded
+	}
+	contextID, n, err := quicvarint.Parse(data)
+	if err != nil {
+		return 0, nil, fmt.Errorf("masque: malformed datagram: %w", err)
+	}
+	if contextID != 0 {
+		// Drop this datagram. We currently only support proxying of UDP payloads.
+		goto start
+	}
+	// If b is too small, additional bytes are discarded.
+	// This mirrors the behavior of large UDP datagrams received on a UDP socket (on Linux).
+	return copy(b, data[n:]), c.remoteAddr, nil
+}
+
+// WriteTo sends a UDP datagram to the target.
+// The net.Addr parameter is ignored.
+func (c *Conn) WriteTo(p []byte, _ net.Addr) (n int, err error) {
+	data := make([]byte, 0, len(contextIDZero)+len(p))
+	data = append(data, contextIDZero...)
+	data = append(data, p...)
+	return len(p), c.str.SendDatagram(data)
+}
+
+func (c *Conn) Close() error {
+	c.closed.Store(true)
+	c.str.CancelRead(quic.StreamErrorCode(http3.ErrCodeNoError))
+	err := c.str.Close()
+	<-c.readDone
+	c.readCtxCancel()
+	c.deadlineMx.Lock()
+	if c.readDeadlineTimer != nil {
+		c.readDeadlineTimer.Stop()
+	}
+	c.deadlineMx.Unlock()
+	if c.closeConn != nil {
+		return errors.Join(err, c.closeConn())
+	}
+	return err
+}
+
+func (c *Conn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+func (c *Conn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
+
+func (c *Conn) SetDeadline(t time.Time) error {
+	_ = c.SetWriteDeadline(t)
+	return c.SetReadDeadline(t)
+}
+
+func (c *Conn) SetReadDeadline(t time.Time) error {
+	c.deadlineMx.Lock()
+	defer c.deadlineMx.Unlock()
+
+	oldDeadline := c.deadline
+	c.deadline = t
+	now := time.Now()
+	// Stop the timer.
+	if t.IsZero() {
+		if c.readDeadlineTimer != nil && !c.readDeadlineTimer.Stop() {
+			<-c.readDeadlineTimer.C
+		}
+
+		return nil
+	}
+	// If the deadline already expired, cancel immediately.
+	if !t.After(now) {
+		c.readCtxCancel()
+		return nil
+	}
+	deadline := t.Sub(now)
+	// if we already have a timer, reset it
+	if c.readDeadlineTimer != nil {
+		// if that timer expired, create a new one
+		if now.Before(oldDeadline) {
+			c.readCtxCancel() // the old context might already have been cancelled, but that's not guaranteed
+			c.readCtx, c.readCtxCancel = context.WithCancel(context.Background())
+		}
+		c.readDeadlineTimer.Reset(deadline)
+	} else { // this is the first time the timer is set
+		c.readDeadlineTimer = time.AfterFunc(deadline, func() {
+			c.deadlineMx.Lock()
+			defer c.deadlineMx.Unlock()
+			if !c.deadline.IsZero() && c.deadline.Before(time.Now()) {
+				c.readCtxCancel()
+			}
+		})
+	}
+	return nil
+}
+
+func (c *Conn) SetWriteDeadline(time.Time) error {
+	// TODO(#22): This is currently blocked on a change in quic-go's API.
+	return nil
+}
+
+func skipCapsules(str io.Reader) error {
+	parser := http3.NewCapsuleParser(str)
+	for {
+		ct, r, err := parser.Next()
+		if err != nil {
+			return err
+		}
+		log.Printf("skipping capsule of type %d", ct)
+		if err := r.Discard(); err != nil {
+			return err
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/masque-go/conn_test.go b/electron/native/private-transport/third_party/masque-go/conn_test.go
new file mode 100644
index 000000000..99e6b9e47
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/conn_test.go
@@ -0,0 +1,191 @@
+package masque_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"log"
+	"math/rand/v2"
+	"net"
+	"net/http"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/quic-go/masque-go"
+
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+
+	"github.com/stretchr/testify/require"
+)
+
+func setupProxiedConn(t *testing.T) (*http3.Stream, net.PacketConn) {
+	t.Helper()
+
+	targetConn := newUDPConnLocalhost(t)
+
+	strChan := make(chan *http3.Stream, 1)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/masque", func(w http.ResponseWriter, r *http.Request) {
+		strChan <- w.(http3.HTTPStreamer).HTTPStream()
+	})
+	server := http3.Server{
+		TLSConfig:       tlsConf,
+		Handler:         mux,
+		EnableDatagrams: true,
+	}
+	t.Cleanup(func() { server.Close() })
+	serverConn := newUDPConnLocalhost(t)
+	go server.Serve(serverConn)
+
+	tr := masque.Transport{
+		TLSClientConfig: &tls.Config{
+			ClientCAs:          certPool,
+			NextProtos:         []string{http3.NextProtoH3},
+			InsecureSkipVerify: true,
+		},
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	target := targetConn.LocalAddr().String()
+	req, err := masque.NewRequest(ctx,
+		uritemplate.MustNew(fmt.Sprintf("https://localhost:%d/masque?h={target_host}&p={target_port}", serverConn.LocalAddr().(*net.UDPAddr).Port)),
+		target,
+	)
+	require.NoError(t, err)
+	conn, rsp, err := tr.Dial(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, rsp.StatusCode)
+	require.Equal(t, target, conn.RemoteAddr().String())
+	t.Cleanup(func() { conn.Close() })
+
+	var str *http3.Stream
+	select {
+	case str = <-strChan:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	return str, conn
+}
+
+func TestCapsuleSkipping(t *testing.T) {
+	log.SetOutput(io.Discard)
+	defer log.SetOutput(os.Stderr)
+
+	str, conn := setupProxiedConn(t)
+
+	var buf bytes.Buffer
+	require.NoError(t, http3.WriteCapsule(&buf, 1337, []byte("foo")))
+	require.NoError(t, http3.WriteCapsule(&buf, 42, []byte("bar")))
+	_, err := str.Write(buf.Bytes())
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+
+	_, _, err = conn.ReadFrom(make([]byte, 100))
+	require.ErrorIs(t, err, io.EOF)
+}
+
+func TestReadDeadline(t *testing.T) {
+	t.Run("read after deadline", func(t *testing.T) {
+		_, conn := setupProxiedConn(t)
+
+		require.NoError(t, conn.SetReadDeadline(time.Now().Add(-time.Second)))
+		_, _, err := conn.ReadFrom(make([]byte, 100))
+		require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+	})
+
+	t.Run("unblocking read", func(t *testing.T) {
+		_, conn := setupProxiedConn(t)
+
+		errChan := make(chan error, 1)
+		go func() {
+			_, _, err := conn.ReadFrom(make([]byte, 100))
+			errChan <- err
+		}()
+		select {
+		case err := <-errChan:
+			t.Fatalf("didn't expect ReadFrom to return early: %v", err)
+		case <-time.After(scaleDuration(50 * time.Millisecond)):
+		}
+		require.NoError(t, conn.SetReadDeadline(time.Now().Add(-time.Second)))
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+		case <-time.After(scaleDuration(100 * time.Millisecond)):
+			t.Fatal("timeout")
+		}
+		_, _, err := conn.ReadFrom(make([]byte, 100))
+		require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+	})
+
+	t.Run("extending the deadline", func(t *testing.T) {
+		_, conn := setupProxiedConn(t)
+
+		start := time.Now()
+		d := scaleDuration(75 * time.Millisecond)
+		require.NoError(t, conn.SetReadDeadline(start.Add(d)))
+		errChan := make(chan error, 1)
+		go func() {
+			_, _, err := conn.ReadFrom(make([]byte, 100))
+			errChan <- err
+		}()
+		require.NoError(t, conn.SetReadDeadline(start.Add(2*d)))
+		select {
+		case err := <-errChan:
+			if since := time.Since(start); since < 2*d {
+				require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+				t.Fatalf("ReadFrom returned early: %s, expected >= %s", since, 2*d)
+			}
+		case <-time.After(10 * d):
+			t.Fatal("timeout")
+		}
+	})
+
+	t.Run("cancelling the deadline", func(t *testing.T) {
+		_, conn := setupProxiedConn(t)
+
+		start := time.Now()
+		d := scaleDuration(75 * time.Millisecond)
+		require.NoError(t, conn.SetReadDeadline(start.Add(d)))
+		errChan := make(chan error, 1)
+		go func() {
+			_, _, err := conn.ReadFrom(make([]byte, 100))
+			errChan <- err
+		}()
+		require.NoError(t, conn.SetReadDeadline(time.Time{}))
+		select {
+		case <-errChan:
+			t.Fatal("deadline was cancelled")
+		case <-time.After(2 * d):
+		}
+
+		// test shutdown
+		require.NoError(t, conn.SetReadDeadline(time.Now()))
+		select {
+		case err := <-errChan:
+			require.Error(t, err)
+		case <-time.After(scaleDuration(100 * time.Millisecond)):
+			t.Fatal("timeout")
+		}
+	})
+
+	t.Run("multiple deadlines", func(t *testing.T) {
+		_, conn := setupProxiedConn(t)
+
+		const num = 10
+		const maxDeadline = 5 * time.Millisecond
+
+		for range num {
+			// random duration between -5ms and 5ms
+			d := scaleDuration(maxDeadline - time.Duration(rand.Int64N(2*maxDeadline.Nanoseconds())))
+			t.Logf("setting deadline to %v", d)
+			require.NoError(t, conn.SetReadDeadline(time.Now().Add(d)))
+			_, _, err := conn.ReadFrom(make([]byte, 100))
+			require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/masque-go/connect-udp_test.go b/electron/native/private-transport/third_party/masque-go/connect-udp_test.go
new file mode 100644
index 000000000..c4d9138e5
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/connect-udp_test.go
@@ -0,0 +1,335 @@
+package masque_test
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/quic-go/masque-go"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+
+	"github.com/stretchr/testify/require"
+	"github.com/yosida95/uritemplate/v3"
+	"go.uber.org/goleak"
+)
+
+func TestMain(m *testing.M) {
+	goleak.VerifyTestMain(m)
+}
+
+func runEchoServer(t *testing.T, addr *net.UDPAddr) *net.UDPConn {
+	t.Helper()
+	conn, err := net.ListenUDP("udp", addr)
+	require.NoError(t, err)
+	go func() {
+		for {
+			b := make([]byte, 1500)
+			n, addr, err := conn.ReadFrom(b)
+			if err != nil {
+				return
+			}
+			if _, err := conn.WriteTo(b[:n], addr); err != nil {
+				return
+			}
+		}
+	}()
+	return conn
+}
+
+func TestProxyToIP(t *testing.T) {
+	t.Run("IPv4", func(t *testing.T) { testProxyToIP(t, &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}) })
+	t.Run("IPv6", func(t *testing.T) { testProxyToIP(t, &net.UDPAddr{IP: net.IPv6loopback, Port: 0}) })
+}
+
+func testProxyToIP(t *testing.T, addr *net.UDPAddr) {
+	remoteServerConn := runEchoServer(t, addr)
+	defer remoteServerConn.Close()
+
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	defer conn.Close()
+	t.Logf("server listening on %s", conn.LocalAddr())
+	template := uritemplate.MustNew(fmt.Sprintf("https://localhost:%d/masque?h={target_host}&p={target_port}", conn.LocalAddr().(*net.UDPAddr).Port))
+
+	mux := http.NewServeMux()
+	server := http3.Server{
+		TLSConfig:       tlsConf,
+		QUICConfig:      &quic.Config{EnableDatagrams: true},
+		EnableDatagrams: true,
+		Handler:         mux,
+	}
+	defer server.Close()
+	proxy := masque.Proxy{}
+	defer proxy.Close()
+	rawQueryCh := make(chan string, 1)
+	mux.HandleFunc("/masque", func(w http.ResponseWriter, r *http.Request) {
+		rawQueryCh <- r.URL.RawQuery
+		req, err := masque.ParseProxyRequest(r, template)
+		if err != nil {
+			t.Log("Upgrade failed:", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		proxy.Proxy(w, req)
+	})
+	go func() {
+		if err := server.Serve(conn); err != nil {
+			return
+		}
+	}()
+
+	tr := masque.Transport{
+		TLSClientConfig: &tls.Config{ClientCAs: certPool, NextProtos: []string{http3.NextProtoH3}, InsecureSkipVerify: true},
+	}
+	req, err := masque.NewRequest(context.Background(), template, remoteServerConn.LocalAddr().String())
+	require.NoError(t, err)
+	proxiedConn, _, err := tr.Dial(req)
+	require.NoError(t, err)
+	defer proxiedConn.Close()
+
+	rawQuery := <-rawQueryCh
+	// Verify the client encoded target_host per RFC 9298 (single percent-encoding).
+	require.NotContains(t, rawQuery, "%25", "target_host must not be double percent-encoded")
+	if addr.IP.To4() == nil { // IPv6: colons MUST be percent-encoded, e.g. "::1" -> "%3A%3A1"
+		require.Contains(t, rawQuery, "h=%3A%3A1")
+	} else {
+		require.Contains(t, rawQuery, "h="+addr.IP.String())
+	}
+
+	_, err = proxiedConn.WriteTo([]byte("foobar"), remoteServerConn.LocalAddr())
+	require.NoError(t, err)
+	b := make([]byte, 1500)
+	n, raddr, err := proxiedConn.ReadFrom(b)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), b[:n])
+
+	// Check raddr
+	expected := remoteServerConn.LocalAddr().(*net.UDPAddr)
+	observed := raddr.(*net.UDPAddr)
+	require.True(t, observed.IP.Equal(expected.IP))
+	require.Equal(t, expected.Port, observed.Port)
+}
+
+func TestProxyToHostname(t *testing.T) {
+	remoteServerConn := runEchoServer(t, &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	defer remoteServerConn.Close()
+
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	defer conn.Close()
+	t.Logf("server listening on %s", conn.LocalAddr())
+	template := uritemplate.MustNew(fmt.Sprintf("https://localhost:%d/masque?h={target_host}&p={target_port}", conn.LocalAddr().(*net.UDPAddr).Port))
+
+	mux := http.NewServeMux()
+	server := http3.Server{
+		TLSConfig:       tlsConf,
+		QUICConfig:      &quic.Config{EnableDatagrams: true},
+		EnableDatagrams: true,
+		Handler:         mux,
+	}
+	defer server.Close()
+	proxy := masque.Proxy{}
+	defer proxy.Close()
+	mux.HandleFunc("/masque", func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer token" {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		req, err := masque.ParseProxyRequest(r, template)
+		if err != nil {
+			t.Log("Upgrade failed:", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		if req.Target != "quic-go.net:1234" {
+			t.Log("unexpected request target:", req.Target)
+			w.WriteHeader(http.StatusServiceUnavailable)
+		}
+		// In this test, we don't actually want to connect to quic-go.net
+		// Replace the target with the UDP echoer we spun up earlier.
+		req.Target = remoteServerConn.LocalAddr().String()
+		if err = proxy.Proxy(w, req); err != nil {
+			t.Error(err)
+		}
+	})
+	go func() {
+		if err := server.Serve(conn); err != nil {
+			return
+		}
+	}()
+
+	tr := masque.Transport{
+		TLSClientConfig: &tls.Config{ClientCAs: certPool, NextProtos: []string{http3.NextProtoH3}, InsecureSkipVerify: true},
+	}
+	req, err := masque.NewRequest(context.Background(), template, "quic-go.net:1234") // the proxy doesn't actually resolve this hostname
+	require.NoError(t, err)
+	req.Header().Set("Authorization", "Bearer token")
+	proxiedConn, rsp, err := tr.Dial(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, rsp.StatusCode)
+	defer proxiedConn.Close()
+
+	_, err = proxiedConn.WriteTo([]byte("foobar"), nil)
+	require.NoError(t, err)
+	b := make([]byte, 1500)
+	n, raddr, err := proxiedConn.ReadFrom(b)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), b[:n])
+
+	// Check raddr
+	expected := remoteServerConn.LocalAddr().(*net.UDPAddr)
+	observed := raddr.(*net.UDPAddr)
+	require.True(t, observed.IP.Equal(expected.IP))
+	require.Equal(t, expected.Port, observed.Port)
+}
+
+func TestProxyingRejected(t *testing.T) {
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	defer conn.Close()
+	template := uritemplate.MustNew(fmt.Sprintf("https://localhost:%d/masque?h={target_host}&p={target_port}", conn.LocalAddr().(*net.UDPAddr).Port))
+
+	mux := http.NewServeMux()
+	server := http3.Server{
+		TLSConfig:       tlsConf,
+		QUICConfig:      &quic.Config{EnableDatagrams: true},
+		EnableDatagrams: true,
+		Handler:         mux,
+	}
+	defer server.Close()
+	proxy := masque.Proxy{}
+	defer proxy.Close()
+	mux.HandleFunc("/masque", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusTeapot) })
+	go func() {
+		if err := server.Serve(conn); err != nil {
+			return
+		}
+	}()
+
+	tr := masque.Transport{
+		TLSClientConfig: &tls.Config{ClientCAs: certPool, NextProtos: []string{http3.NextProtoH3}, InsecureSkipVerify: true},
+	}
+	req, err := masque.NewRequest(context.Background(), template, "quic-go.net:1234") // the proxy doesn't actually resolve this hostname
+	require.NoError(t, err)
+	_, rsp, err := tr.Dial(req)
+	require.Error(t, err)
+	require.Equal(t, http.StatusTeapot, rsp.StatusCode)
+}
+
+func TestProxyToHostnameMissingPort(t *testing.T) {
+	req, err := masque.NewRequest(
+		context.Background(),
+		uritemplate.MustNew("https://localhost:1234/masque?h={target_host}&p={target_port}"),
+		"quic-go.net", // missing port
+	)
+	require.Nil(t, req)
+	require.ErrorContains(t, err, "address quic-go.net: missing port in address")
+}
+
+func TestDialUsesRequestTargetAsRemoteAddr(t *testing.T) {
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	defer conn.Close()
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/masque", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set(http3.CapsuleProtocolHeader, "?1")
+		w.WriteHeader(http.StatusOK)
+	})
+	server := http3.Server{
+		TLSConfig:       tlsConf,
+		QUICConfig:      &quic.Config{EnableDatagrams: true},
+		EnableDatagrams: true,
+		Handler:         mux,
+	}
+	defer server.Close()
+	go func() {
+		if err := server.Serve(conn); err != nil {
+			return
+		}
+	}()
+
+	template := uritemplate.MustNew(fmt.Sprintf("https://localhost:%d/masque?h={target_host}&p={target_port}", conn.LocalAddr().(*net.UDPAddr).Port))
+	req, err := masque.NewRequest(context.Background(), template, "quic-go.net:1234")
+	require.NoError(t, err)
+	tr := masque.Transport{
+		TLSClientConfig: &tls.Config{ClientCAs: certPool, NextProtos: []string{http3.NextProtoH3}, InsecureSkipVerify: true},
+	}
+	proxiedConn, rsp, err := tr.Dial(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, rsp.StatusCode)
+	defer proxiedConn.Close()
+	require.Equal(t, "quic-go.net:1234", proxiedConn.RemoteAddr().String())
+}
+
+func TestProxyShutdown(t *testing.T) {
+	remoteServerConn := runEchoServer(t, &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	defer remoteServerConn.Close()
+
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	defer conn.Close()
+	t.Logf("server listening on %s", conn.LocalAddr())
+	template := uritemplate.MustNew(fmt.Sprintf("https://localhost:%d/masque?h={target_host}&p={target_port}", conn.LocalAddr().(*net.UDPAddr).Port))
+
+	mux := http.NewServeMux()
+	server := http3.Server{
+		TLSConfig:       tlsConf,
+		QUICConfig:      &quic.Config{EnableDatagrams: true},
+		EnableDatagrams: true,
+		Handler:         mux,
+	}
+	defer server.Close()
+	proxy := masque.Proxy{}
+	mux.HandleFunc("/masque", func(w http.ResponseWriter, r *http.Request) {
+		req, err := masque.ParseProxyRequest(r, template)
+		if err != nil {
+			t.Log("Upgrade failed:", err)
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		proxy.Proxy(w, req)
+	})
+	go func() {
+		if err := server.Serve(conn); err != nil {
+			return
+		}
+	}()
+
+	tr := masque.Transport{
+		TLSClientConfig: &tls.Config{ClientCAs: certPool, NextProtos: []string{http3.NextProtoH3}, InsecureSkipVerify: true},
+	}
+	req, err := masque.NewRequest(context.Background(), template, remoteServerConn.LocalAddr().String())
+	require.NoError(t, err)
+	proxiedConn, rsp, err := tr.Dial(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, rsp.StatusCode)
+	defer proxiedConn.Close()
+
+	_, err = proxiedConn.WriteTo([]byte("foobar"), remoteServerConn.LocalAddr())
+	require.NoError(t, err)
+	b := make([]byte, 1500)
+	n, _, err := proxiedConn.ReadFrom(b)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), b[:n])
+
+	// Close the server and expect the proxied connection to unblock ReadFrom and WriteTo.
+	proxy.Close()
+	_, _, err = proxiedConn.ReadFrom(b)
+	require.Error(t, err)
+	var errored bool
+	for range 10 {
+		if _, err := proxiedConn.WriteTo(b, remoteServerConn.LocalAddr()); err != nil {
+			errored = true
+			break
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	require.True(t, errored, "expected datagram write side to error")
+}
diff --git a/electron/native/private-transport/third_party/masque-go/datagram_buffer.go b/electron/native/private-transport/third_party/masque-go/datagram_buffer.go
new file mode 100644
index 000000000..98b0d4cc8
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/datagram_buffer.go
@@ -0,0 +1,19 @@
+package masque
+
+import "github.com/quic-go/quic-go"
+
+// EnableDatagramReceiveBuffer enables receive burst absorption on a successfully
+// opened tunnel. Not called automatically for unaccepted CONNECT requests.
+func (c *Conn) EnableDatagramReceiveBuffer() {
+	if s, ok := c.str.(interface{ EnableDatagramReceiveBuffer() }); ok {
+		s.EnableDatagramReceiveBuffer()
+	}
+}
+func (c *Conn) DatagramReceiveBufferStats() quic.DatagramReceiveBufferStats {
+	if s, ok := c.str.(interface {
+		DatagramReceiveBufferStats() quic.DatagramReceiveBufferStats
+	}); ok {
+		return s.DatagramReceiveBufferStats()
+	}
+	return quic.DatagramReceiveBufferStats{}
+}
diff --git a/electron/native/private-transport/third_party/masque-go/go.mod b/electron/native/private-transport/third_party/masque-go/go.mod
new file mode 100644
index 000000000..5614ecb46
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/go.mod
@@ -0,0 +1,20 @@
+module github.com/quic-go/masque-go
+
+go 1.26.0
+
+require (
+	github.com/dunglas/httpsfv v1.1.0
+	github.com/quic-go/quic-go v0.62.0
+	github.com/stretchr/testify v1.12.1
+	github.com/yosida95/uritemplate/v3 v3.0.2
+	go.uber.org/goleak v1.3.0
+)
+
+require (
+	github.com/quic-go/qpack v0.6.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+)
diff --git a/electron/native/private-transport/third_party/masque-go/go.sum b/electron/native/private-transport/third_party/masque-go/go.sum
new file mode 100644
index 000000000..d4ad16ed9
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/go.sum
@@ -0,0 +1,26 @@
+github.com/dunglas/httpsfv v1.1.0 h1:Jw76nAyKWKZKFrpMMcL76y35tOpYHqQPzHQiwDvpe54=
+github.com/dunglas/httpsfv v1.1.0/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.62.0 h1:ZHDjCk5OacATwGvs8PWE97CTvX7AqZiVoW7++ZOXTf8=
+github.com/quic-go/quic-go v0.62.0/go.mod h1:RAro2j2yN9a9EiPACLHT9IB2NXCvGQmmo/alT0yYI0w=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
+go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
diff --git a/electron/native/private-transport/third_party/masque-go/proxy.go b/electron/native/private-transport/third_party/masque-go/proxy.go
new file mode 100644
index 000000000..5da07efba
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/proxy.go
@@ -0,0 +1,254 @@
+package masque
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"sync"
+
+	"github.com/dunglas/httpsfv"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+const maxUDPPayloadSize = 1500
+
+var contextIDZero = quicvarint.Append([]byte{}, 0)
+
+type proxyEntry struct {
+	str  *http3.Stream
+	conn *net.UDPConn
+}
+
+func (e proxyEntry) Close() error {
+	e.str.CancelRead(quic.StreamErrorCode(http3.ErrCodeConnectError))
+	return errors.Join(e.str.Close(), e.conn.Close())
+}
+
+// A Proxy is an RFC 9298 CONNECT-UDP proxy.
+type Proxy struct {
+	mx       sync.Mutex
+	closed   bool
+	refCount sync.WaitGroup // counter for the Go routines spawned in Upgrade
+	closers  map[io.Closer]struct{}
+}
+
+func errToStatus(err error) int {
+	var netErr net.Error
+	if errors.As(err, &netErr) && netErr.Timeout() {
+		// Consistent with RFC 9209 Section 2.3.1.
+		return http.StatusGatewayTimeout
+	}
+	if _, ok := errors.AsType[*net.DNSError](err); ok {
+		// Recommended by RFC 9209 Section 2.3.2.
+		return http.StatusBadGateway
+	}
+	var addrErr *net.AddrError
+	var parseError *net.ParseError
+	if errors.As(err, &addrErr) || errors.As(err, &parseError) {
+		return http.StatusBadRequest
+	}
+	return http.StatusInternalServerError
+}
+
+func dnsErrorToProxyStatus(proxyStatus *httpsfv.Item, dnsError *net.DNSError) {
+	if dnsError.Timeout() {
+		proxyStatus.Params.Add("error", "dns_timeout")
+	} else {
+		proxyStatus.Params.Add("error", "dns_error")
+		if dnsError.IsNotFound {
+			// "Negative response" isn't a real RCODE, but it is included
+			// in RFC 8499 Section 3 as a sort of meta/pseudo-RCODE like NODATA,
+			// and this section is referenced by the definition of the "rcode"
+			// parameter.
+			proxyStatus.Params.Add("rcode", "Negative response")
+		} else {
+			// DNS intermediaries normally convert miscellaneous errors to SERVFAIL.
+			proxyStatus.Params.Add("rcode", "SERVFAIL")
+		}
+	}
+}
+
+// Proxy proxies a request on a newly created connected UDP socket.
+// For more control over the UDP socket, use ProxyConnectedSocket.
+// Applications may add custom header fields to the response header,
+// but MUST NOT call WriteHeader on the http.ResponseWriter.
+func (s *Proxy) Proxy(w http.ResponseWriter, r *ProxyRequest) error {
+	s.mx.Lock()
+	if s.closed {
+		s.mx.Unlock()
+		w.WriteHeader(http.StatusServiceUnavailable)
+		return net.ErrClosed
+	}
+	s.mx.Unlock()
+
+	proxyStatus := httpsfv.NewItem(r.Host)
+	// Adds the proxy status to the header.  Returns
+	// the input error, or a new one if serialization fails.
+	writeProxyStatus := func(err error) error {
+		if err != nil {
+			proxyStatus.Params.Add("details", err.Error())
+		}
+		proxyStatusVal, marshalErr := httpsfv.Marshal(proxyStatus)
+		if marshalErr != nil {
+			return marshalErr
+		}
+		w.Header().Add("Proxy-Status", proxyStatusVal)
+		return err
+	}
+
+	addr, err := net.ResolveUDPAddr("udp", r.Target)
+	if err != nil {
+		if dnsError, ok := errors.AsType[*net.DNSError](err); ok {
+			dnsErrorToProxyStatus(&proxyStatus, dnsError)
+		}
+		err = writeProxyStatus(err)
+		w.WriteHeader(errToStatus(err))
+		return err
+	}
+	proxyStatus.Params.Add("next-hop", addr.String())
+
+	conn, err := net.DialUDP("udp", nil, addr)
+	if err != nil {
+		proxyStatus.Params.Add("error", "destination_ip_unroutable")
+		err = writeProxyStatus(err)
+		w.WriteHeader(errToStatus(err))
+		return err
+	}
+	defer conn.Close()
+
+	if err = writeProxyStatus(nil); err != nil {
+		w.WriteHeader(errToStatus(err))
+		return err
+	}
+	return s.ProxyConnectedSocket(w, r, conn)
+}
+
+// ProxyConnectedSocket proxies a request on a connected UDP socket.
+// Applications may add custom header fields such as Proxy-Status
+// to the response header, but MUST NOT call WriteHeader on the
+// http.ResponseWriter. It closes the connection before returning.
+func (s *Proxy) ProxyConnectedSocket(w http.ResponseWriter, _ *ProxyRequest, conn *net.UDPConn) error {
+	s.mx.Lock()
+	if s.closed {
+		s.mx.Unlock()
+		conn.Close()
+		w.WriteHeader(http.StatusServiceUnavailable)
+		return net.ErrClosed
+	}
+
+	str := w.(http3.HTTPStreamer).HTTPStream()
+	entry := proxyEntry{str: str, conn: conn}
+
+	if s.closers == nil {
+		s.closers = make(map[io.Closer]struct{})
+	}
+	s.closers[entry] = struct{}{}
+
+	s.refCount.Add(1)
+	defer s.refCount.Done()
+	s.mx.Unlock()
+
+	w.Header().Set(http3.CapsuleProtocolHeader, capsuleProtocolHeaderValue)
+	w.WriteHeader(http.StatusOK)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		if err := s.proxyConnSend(conn, str); err != nil {
+			log.Printf("proxying send side to %s failed: %v", conn.RemoteAddr(), err)
+		}
+		str.Close()
+	}()
+	go func() {
+		defer wg.Done()
+		if err := s.proxyConnReceive(conn, str); err != nil {
+			s.mx.Lock()
+			closed := s.closed
+			s.mx.Unlock()
+			if !closed {
+				log.Printf("proxying receive side to %s failed: %v", conn.RemoteAddr(), err)
+			}
+		}
+		str.Close()
+	}()
+	// discard all capsules sent on the request stream
+	if err := skipCapsules(str); err == io.EOF {
+		log.Printf("reading from request stream failed: %v", err)
+	}
+	str.Close()
+	conn.Close()
+	wg.Wait()
+	s.mx.Lock()
+	delete(s.closers, entry)
+	s.mx.Unlock()
+	return nil
+}
+
+func (s *Proxy) proxyConnSend(conn *net.UDPConn, str *http3.Stream) error {
+	for {
+		data, err := str.ReceiveDatagram(context.Background())
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return nil
+			}
+			return err
+		}
+		contextID, n, err := quicvarint.Parse(data)
+		if err != nil {
+			return err
+		}
+		if contextID != 0 {
+			// Drop this datagram. We currently only support proxying of UDP payloads.
+			continue
+		}
+		if len(data[n:]) > maxUDPPayloadSize {
+			log.Printf("dropping datagram larger than MTU (%d > %d)", len(data[n:]), maxUDPPayloadSize)
+			continue
+		}
+		if _, err := conn.Write(data[n:]); err != nil {
+			return err
+		}
+	}
+}
+
+func (s *Proxy) proxyConnReceive(conn *net.UDPConn, str *http3.Stream) error {
+	b := make([]byte, len(contextIDZero)+maxUDPPayloadSize+1)
+	copy(b, contextIDZero)
+	for {
+		n, err := conn.Read(b[len(contextIDZero):])
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return nil
+			}
+			return err
+		}
+		if n > maxUDPPayloadSize {
+			log.Printf("dropping UDP packet larger than MTU")
+			continue
+		}
+		if err := str.SendDatagram(b[:len(contextIDZero)+n]); err != nil {
+			return err
+		}
+	}
+}
+
+// Close closes the proxy, immediately terminating all proxied flows.
+func (s *Proxy) Close() error {
+	s.mx.Lock()
+	s.closed = true
+	var errs []error
+	for closer := range s.closers {
+		errs = append(errs, closer.Close())
+	}
+	s.mx.Unlock()
+
+	s.refCount.Wait()
+	s.closers = nil
+	return errors.Join(errs...)
+}
diff --git a/electron/native/private-transport/third_party/masque-go/proxy_request.go b/electron/native/private-transport/third_party/masque-go/proxy_request.go
new file mode 100644
index 000000000..c121b5e28
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/proxy_request.go
@@ -0,0 +1,111 @@
+package masque
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"github.com/dunglas/httpsfv"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+// ProxyRequest is the parsed CONNECT-UDP request returned from ParseProxyRequest.
+// Target is the target server that the client requests to connect to.
+// It can either be DNS name:port or an IP:port.
+type ProxyRequest struct {
+	Target string
+	Host   string
+}
+
+// ProxyRequestParseError is returned from ParseProxyRequest if parsing the CONNECT-UDP request fails.
+// It is recommended that the request is rejected with the corresponding HTTP status code.
+type ProxyRequestParseError struct {
+	HTTPStatus int
+	Err        error
+}
+
+func (e *ProxyRequestParseError) Error() string { return e.Err.Error() }
+func (e *ProxyRequestParseError) Unwrap() error { return e.Err }
+
+// ParseProxyRequest parses a CONNECT-UDP request.
+// The template is the URI template that clients will use to configure this UDP proxy.
+func ParseProxyRequest(r *http.Request, template *uritemplate.Template) (*ProxyRequest, error) {
+	u, err := url.Parse(template.Raw())
+	if err != nil {
+		return nil, &ProxyRequestParseError{
+			HTTPStatus: http.StatusInternalServerError,
+			Err:        fmt.Errorf("failed to parse template: %w", err),
+		}
+	}
+
+	if r.Method != http.MethodConnect {
+		return nil, &ProxyRequestParseError{
+			HTTPStatus: http.StatusMethodNotAllowed,
+			Err:        fmt.Errorf("expected CONNECT request, got %s", r.Method),
+		}
+	}
+	if r.Proto != requestProtocol {
+		return nil, &ProxyRequestParseError{
+			HTTPStatus: http.StatusNotImplemented,
+			Err:        fmt.Errorf("unexpected protocol: %s", r.Proto),
+		}
+	}
+	if r.Host != u.Host {
+		return nil, &ProxyRequestParseError{
+			HTTPStatus: http.StatusBadRequest,
+			Err:        fmt.Errorf("host in :authority (%s) does not match template host (%s)", r.Host, u.Host),
+		}
+	}
+	// The capsule protocol header is optional, but if it's present,
+	// we need to validate its value.
+	capsuleHeaderValues, ok := r.Header[http3.CapsuleProtocolHeader]
+	if ok {
+		item, err := httpsfv.UnmarshalItem(capsuleHeaderValues)
+		if err != nil {
+			return nil, &ProxyRequestParseError{
+				HTTPStatus: http.StatusBadRequest,
+				Err:        fmt.Errorf("invalid capsule header value: %s", capsuleHeaderValues),
+			}
+		}
+		if v, ok := item.Value.(bool); !ok {
+			return nil, &ProxyRequestParseError{
+				HTTPStatus: http.StatusBadRequest,
+				Err:        fmt.Errorf("incorrect capsule header value type: %s", reflect.TypeOf(item.Value)),
+			}
+		} else if !v {
+			return nil, &ProxyRequestParseError{
+				HTTPStatus: http.StatusBadRequest,
+				Err:        fmt.Errorf("incorrect capsule header value: %t", item.Value),
+			}
+		}
+	}
+
+	match := template.Match(r.URL.String())
+	targetHost := match.Get(uriTemplateTargetHost).String()
+	targetPortStr := match.Get(uriTemplateTargetPort).String()
+	if targetHost == "" || targetPortStr == "" {
+		return nil, &ProxyRequestParseError{
+			HTTPStatus: http.StatusBadRequest,
+			Err:        fmt.Errorf("expected target_host and target_port"),
+		}
+	}
+	// IPv6 addresses need to be enclosed in [], otherwise resolving the address will fail.
+	if strings.Contains(targetHost, ":") {
+		targetHost = "[" + targetHost + "]"
+	}
+	targetPort, err := strconv.Atoi(targetPortStr)
+	if err != nil {
+		return nil, &ProxyRequestParseError{
+			HTTPStatus: http.StatusBadRequest,
+			Err:        fmt.Errorf("failed to decode target_port: %w", err),
+		}
+	}
+	return &ProxyRequest{
+		Target: fmt.Sprintf("%s:%d", targetHost, targetPort),
+		Host:   r.Host,
+	}, nil
+}
diff --git a/electron/native/private-transport/third_party/masque-go/proxy_request_test.go b/electron/native/private-transport/third_party/masque-go/proxy_request_test.go
new file mode 100644
index 000000000..55840f745
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/proxy_request_test.go
@@ -0,0 +1,113 @@
+package masque_test
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/dunglas/httpsfv"
+	"github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestProxyRequestParsing(t *testing.T) {
+	template := uritemplate.MustNew("https://localhost:1234/masque?h={target_host}&p={target_port}")
+
+	t.Run("valid request for a hostname", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque?h=localhost&p=1337")
+		r, err := masque.ParseProxyRequest(req, template)
+		require.NoError(t, err)
+		require.Equal(t, r.Target, "localhost:1337")
+	})
+
+	t.Run("valid request for an IPv4 address", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque?h=1.2.3.4&p=9999")
+		r, err := masque.ParseProxyRequest(req, template)
+		require.NoError(t, err)
+		require.Equal(t, r.Target, "1.2.3.4:9999")
+	})
+
+	t.Run("valid request for an IPv6 address", func(t *testing.T) {
+		req := newRequest(fmt.Sprintf(
+			"https://localhost:1234/masque?h=%s&p=1234",
+			strings.ReplaceAll("::1", ":", "%3A"),
+		))
+		r, err := masque.ParseProxyRequest(req, template)
+		require.NoError(t, err)
+		require.Equal(t, r.Target, "[::1]:1234")
+	})
+
+	t.Run("valid request, without the Capsule-Protocol header", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque?h=localhost&p=1337")
+		req.Header.Del(http3.CapsuleProtocolHeader)
+		_, err := masque.ParseProxyRequest(req, template)
+		require.NoError(t, err)
+	})
+
+	t.Run("wrong request method", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque")
+		req.Method = http.MethodHead
+		_, err := masque.ParseProxyRequest(req, template)
+		require.EqualError(t, err, "expected CONNECT request, got HEAD")
+		require.Equal(t, http.StatusMethodNotAllowed, err.(*masque.ProxyRequestParseError).HTTPStatus)
+	})
+
+	t.Run("wrong protocol", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque")
+		req.Proto = "not-connect-udp"
+		_, err := masque.ParseProxyRequest(req, template)
+		require.EqualError(t, err, "unexpected protocol: not-connect-udp")
+		require.Equal(t, http.StatusNotImplemented, err.(*masque.ProxyRequestParseError).HTTPStatus)
+	})
+
+	t.Run("wrong :authority", func(t *testing.T) {
+		req := newRequest("https://quic-go.net:1234/masque")
+		_, err := masque.ParseProxyRequest(req, template)
+		require.EqualError(t, err, "host in :authority (quic-go.net:1234) does not match template host (localhost:1234)")
+		require.Equal(t, http.StatusBadRequest, err.(*masque.ProxyRequestParseError).HTTPStatus)
+	})
+
+	t.Run("invalid Capsule-Protocol header", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque")
+		req.Header.Set(http3.CapsuleProtocolHeader, "🤡")
+		_, err := masque.ParseProxyRequest(req, template)
+		require.EqualError(t, err, "invalid capsule header value: [🤡]")
+		require.Equal(t, http.StatusBadRequest, err.(*masque.ProxyRequestParseError).HTTPStatus)
+	})
+
+	t.Run("invalid Capsule-Protocol header value type", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque")
+		req.Header.Set(http3.CapsuleProtocolHeader, "1")
+		_, err := masque.ParseProxyRequest(req, template)
+		require.EqualError(t, err, "incorrect capsule header value type: int64")
+		require.Equal(t, http.StatusBadRequest, err.(*masque.ProxyRequestParseError).HTTPStatus)
+	})
+
+	t.Run("invalid Capsule-Protocol header value", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque")
+		v, err := httpsfv.Marshal(httpsfv.NewItem(false))
+		require.NoError(t, err)
+		req.Header.Set(http3.CapsuleProtocolHeader, v)
+		_, err = masque.ParseProxyRequest(req, template)
+		require.EqualError(t, err, "incorrect capsule header value: false")
+		require.Equal(t, http.StatusBadRequest, err.(*masque.ProxyRequestParseError).HTTPStatus)
+	})
+
+	t.Run("missing target host", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque?h=&p=1234")
+		_, err := masque.ParseProxyRequest(req, template)
+		require.EqualError(t, err, "expected target_host and target_port")
+		require.Equal(t, http.StatusBadRequest, err.(*masque.ProxyRequestParseError).HTTPStatus)
+	})
+
+	t.Run("invalid target port", func(t *testing.T) {
+		req := newRequest("https://localhost:1234/masque?h=localhost&p=foobar")
+		_, err := masque.ParseProxyRequest(req, template)
+		require.ErrorContains(t, err, "failed to decode target_port")
+		require.Equal(t, http.StatusBadRequest, err.(*masque.ProxyRequestParseError).HTTPStatus)
+	})
+}
diff --git a/electron/native/private-transport/third_party/masque-go/proxy_test.go b/electron/native/private-transport/third_party/masque-go/proxy_test.go
new file mode 100644
index 000000000..151cc8a19
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/proxy_test.go
@@ -0,0 +1,169 @@
+package masque_test
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/quicvarint"
+	"github.com/stretchr/testify/require"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+func scaleDuration(d time.Duration) time.Duration {
+	if os.Getenv("CI") != "" {
+		return 5 * d
+	}
+	return d
+}
+
+func newRequest(target string) *http.Request {
+	req := httptest.NewRequest(http.MethodGet, target, nil)
+	req.Method = http.MethodConnect
+	req.Proto = "connect-udp"
+	req.Header.Add("Capsule-Protocol", "?1")
+	return req
+}
+
+func TestProxyCloseProxiedConn(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+	serverPort := serverConn.LocalAddr().(*net.UDPAddr).Port
+	template := uritemplate.MustNew(fmt.Sprintf("https://localhost:%d/masque?h={target_host}&p={target_port}", serverPort))
+
+	p := masque.Proxy{}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/masque", func(w http.ResponseWriter, r *http.Request) {
+		req, err := masque.ParseProxyRequest(r, template)
+		if err != nil {
+			t.Logf("error parsing request: %v", err)
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+		if err = p.Proxy(w, req); err != nil {
+			t.Error(err)
+		}
+	})
+	server := &http3.Server{
+		Handler:         mux,
+		EnableDatagrams: true,
+	}
+	defer server.Close()
+	go server.ServeQUICConn(serverConn)
+
+	tr := &http3.Transport{
+		EnableDatagrams: true,
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	reqStr, err := tr.NewClientConn(clientConn).OpenRequestStream(ctx)
+	require.NoError(t, err)
+
+	targetConn := newUDPConnLocalhost(t)
+	req := newRequest(fmt.Sprintf("https://localhost:%d/masque?h=localhost&p=%d", serverPort, targetConn.LocalAddr().(*net.UDPAddr).Port))
+	require.NoError(t, reqStr.SendRequestHeader(req))
+	hdr, err := reqStr.ReadResponse()
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, hdr.StatusCode)
+
+	// Check proxy-status header
+	proxyStatus := hdr.Header.Get("Proxy-Status")
+	hostPart := fmt.Sprintf(`"localhost:%d";`, serverPort)
+	require.Equal(t, hostPart, proxyStatus[:len(hostPart)])
+	nextHop := fmt.Sprintf(`;next-hop="%s"`, targetConn.LocalAddr().String())
+	require.Contains(t, proxyStatus, nextHop)
+
+	// we don't use reqStr.SendDatagram(), because we want to be able to send datagrams for this stream after we've closed it
+	sendDatagram := func(t *testing.T, b []byte) {
+		t.Helper()
+		data := quicvarint.Append(nil, uint64(reqStr.StreamID()/4)) // quarter stream ID
+		data = append(data, byte(0))                                // context ID
+		require.NoError(t, clientConn.SendDatagram(append(data, b...)))
+	}
+
+	sendDatagram(t, []byte("foo"))
+
+	b := make([]byte, 100)
+	targetConn.SetReadDeadline(time.Now().Add(time.Second))
+	n, _, err := targetConn.ReadFrom(b)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foo"), b[:n])
+	require.NoError(t, reqStr.Close())
+
+	// make sure the stream is recognized as closed by the proxy
+	time.Sleep(scaleDuration(20 * time.Millisecond))
+
+	sendDatagram(t, []byte("bar"))
+
+	// make sure that the "bar" datagram didn't get proxied
+	targetConn.SetReadDeadline(time.Now().Add(scaleDuration(25 * time.Millisecond)))
+	_, _, err = targetConn.ReadFrom(b)
+	require.Error(t, err)
+}
+
+func TestProxyBadPort(t *testing.T) {
+	p := masque.Proxy{}
+	r := newRequest("https://localhost:1234/masque?h=localhost&p=70000") // invalid port number
+	req, err := masque.ParseProxyRequest(r, uritemplate.MustNew("https://localhost:1234/masque?h={target_host}&p={target_port}"))
+	require.NoError(t, err)
+	rec := httptest.NewRecorder()
+
+	require.ErrorContains(t, p.Proxy(rec, req), "invalid port")
+	require.Equal(t, http.StatusBadRequest, rec.Code)
+
+	proxyStatus := rec.Header().Get("Proxy-Status")
+	hostPart := `"localhost:1234";`
+	require.Equal(t, hostPart, proxyStatus[:len(hostPart)])
+	require.Contains(t, proxyStatus, ";details=")
+	require.Contains(t, proxyStatus, "invalid port")
+	require.NotContains(t, proxyStatus, ";error=")
+}
+
+func TestProxyNXDOMAIN(t *testing.T) {
+	p := masque.Proxy{}
+	r := newRequest("https://localhost:1234/masque?h=nxdomain.test&p=12345") // invalid port number
+	req, err := masque.ParseProxyRequest(r, uritemplate.MustNew("https://localhost:1234/masque?h={target_host}&p={target_port}"))
+	require.NoError(t, err)
+	rec := httptest.NewRecorder()
+
+	require.ErrorContains(t, p.Proxy(rec, req), "no such host")
+	require.Equal(t, http.StatusBadGateway, rec.Code)
+
+	proxyStatus := rec.Header().Get("Proxy-Status")
+	hostPart := `"localhost:1234";`
+	require.Equal(t, hostPart, proxyStatus[:len(hostPart)])
+	require.Contains(t, proxyStatus, `;error="dns_error"`)
+	require.Contains(t, proxyStatus, `;rcode="Negative response"`)
+	require.Contains(t, proxyStatus, "details=")
+	require.Contains(t, proxyStatus, "no such host")
+}
+
+func TestProxyingAfterClose(t *testing.T) {
+	p := masque.Proxy{}
+	require.NoError(t, p.Close())
+
+	r := newRequest("https://localhost:1234/masque?h=localhost&p=1234")
+	req, err := masque.ParseProxyRequest(r, uritemplate.MustNew("https://localhost:1234/masque?h={target_host}&p={target_port}"))
+	require.NoError(t, err)
+
+	t.Run("proxying", func(t *testing.T) {
+		rec := httptest.NewRecorder()
+		require.ErrorIs(t, p.Proxy(rec, req), net.ErrClosed)
+		require.Equal(t, http.StatusServiceUnavailable, rec.Code)
+	})
+
+	t.Run("proxying connected socket", func(t *testing.T) {
+		rec := httptest.NewRecorder()
+		conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+		require.NoError(t, err)
+		require.ErrorIs(t, p.ProxyConnectedSocket(rec, req, conn), net.ErrClosed)
+		require.Equal(t, http.StatusServiceUnavailable, rec.Code)
+	})
+}
diff --git a/electron/native/private-transport/third_party/masque-go/request.go b/electron/native/private-transport/third_party/masque-go/request.go
new file mode 100644
index 000000000..db3a34c49
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/request.go
@@ -0,0 +1,63 @@
+package masque
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+
+	"github.com/dunglas/httpsfv"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+const (
+	requestProtocol       = "connect-udp"
+	uriTemplateTargetHost = "target_host"
+	uriTemplateTargetPort = "target_port"
+)
+
+var capsuleProtocolHeaderValue string
+
+func init() {
+	v, err := httpsfv.Marshal(httpsfv.NewItem(true))
+	if err != nil {
+		panic(fmt.Sprintf("failed to marshal capsule protocol header value: %v", err))
+	}
+	capsuleProtocolHeaderValue = v
+}
+
+// Request is a CONNECT-UDP request created by NewRequest.
+// The zero value is not valid.
+type Request struct {
+	req    *http.Request
+	target string
+}
+
+// NewRequest creates a CONNECT-UDP request for the given target.
+// The target must be given as a host:port.
+func NewRequest(ctx context.Context, proxyTemplate *uritemplate.Template, target string) (*Request, error) {
+	host, port, err := net.SplitHostPort(target)
+	if err != nil {
+		return nil, fmt.Errorf("masque: failed to parse target: %w", err)
+	}
+	str, err := proxyTemplate.Expand(uritemplate.Values{
+		uriTemplateTargetHost: uritemplate.String(host),
+		uriTemplateTargetPort: uritemplate.String(port),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("masque: failed to expand Template: %w", err)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodConnect, str, nil)
+	if err != nil {
+		return nil, fmt.Errorf("masque: failed to create request: %w", err)
+	}
+	req.Proto = requestProtocol
+	req.Host = req.URL.Host
+	req.Header.Set(http3.CapsuleProtocolHeader, capsuleProtocolHeaderValue)
+	return &Request{req: req, target: target}, nil
+}
+
+// Header returns the HTTP header fields sent with the CONNECT-UDP request.
+// Callers may add custom headers before dialing.
+func (r *Request) Header() http.Header { return r.req.Header }
diff --git a/electron/native/private-transport/third_party/masque-go/test_helper_test.go b/electron/native/private-transport/third_party/masque-go/test_helper_test.go
new file mode 100644
index 000000000..4a2552742
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/test_helper_test.go
@@ -0,0 +1,154 @@
+package masque_test
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"log"
+	"math/big"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	tlsConf  *tls.Config
+	certPool *x509.CertPool
+)
+
+func generateCA() (*x509.Certificate, *rsa.PrivateKey, error) {
+	certTempl := &x509.Certificate{
+		SerialNumber:          big.NewInt(2019),
+		Subject:               pkix.Name{},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(24 * time.Hour),
+		IsCA:                  true,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+	}
+	caPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, nil, err
+	}
+	caBytes, err := x509.CreateCertificate(rand.Reader, certTempl, certTempl, &caPrivateKey.PublicKey, caPrivateKey)
+	if err != nil {
+		return nil, nil, err
+	}
+	ca, err := x509.ParseCertificate(caBytes)
+	if err != nil {
+		return nil, nil, err
+	}
+	return ca, caPrivateKey, nil
+}
+
+func generateLeafCert(ca *x509.Certificate, caPrivateKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
+	certTempl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		DNSNames:     []string{"localhost", "127.0.0.1"},
+		NotBefore:    time.Now(),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+	}
+	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, nil, err
+	}
+	certBytes, err := x509.CreateCertificate(rand.Reader, certTempl, ca, &privKey.PublicKey, caPrivateKey)
+	if err != nil {
+		return nil, nil, err
+	}
+	cert, err := x509.ParseCertificate(certBytes)
+	if err != nil {
+		return nil, nil, err
+	}
+	return cert, privKey, nil
+}
+
+func newUDPConnLocalhost(t testing.TB) *net.UDPConn {
+	t.Helper()
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.Close() })
+	return conn
+}
+
+func newConnPair(t *testing.T) (client, server *quic.Conn) {
+	return newConnPairWithDatagrams(t, true)
+}
+
+func newConnPairWithDatagrams(t *testing.T, enableDatagrams bool) (client, server *quic.Conn) {
+	t.Helper()
+
+	ln, err := quic.ListenEarly(
+		newUDPConnLocalhost(t),
+		tlsConf,
+		&quic.Config{
+			InitialStreamReceiveWindow:     1 << 60,
+			InitialConnectionReceiveWindow: 1 << 60,
+			EnableDatagrams:                enableDatagrams,
+		},
+	)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	cl, err := quic.DialEarly(
+		ctx,
+		newUDPConnLocalhost(t),
+		ln.Addr(),
+		&tls.Config{
+			ServerName: "localhost",
+			NextProtos: []string{http3.NextProtoH3},
+			RootCAs:    certPool,
+		},
+		&quic.Config{EnableDatagrams: enableDatagrams},
+	)
+	require.NoError(t, err)
+	if enableDatagrams {
+		require.True(t, cl.ConnectionState().SupportsDatagrams.Remote)
+	}
+	t.Cleanup(func() { cl.CloseWithError(0, "") })
+
+	conn, err := ln.Accept(ctx)
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.CloseWithError(0, "") })
+	select {
+	case <-conn.HandshakeComplete():
+		if enableDatagrams {
+			require.True(t, conn.ConnectionState().SupportsDatagrams.Remote)
+		}
+	case <-ctx.Done():
+		t.Fatal("timeout")
+	}
+	return cl, conn
+}
+
+func init() {
+	ca, caPrivateKey, err := generateCA()
+	if err != nil {
+		log.Fatal("failed to generate CA certificate:", err)
+	}
+	leafCert, leafPrivateKey, err := generateLeafCert(ca, caPrivateKey)
+	if err != nil {
+		log.Fatal("failed to generate leaf certificate:", err)
+	}
+	certPool = x509.NewCertPool()
+	certPool.AddCert(ca)
+	tlsConf = &tls.Config{
+		Certificates: []tls.Certificate{{
+			Certificate: [][]byte{leafCert.Raw},
+			PrivateKey:  leafPrivateKey,
+		}},
+		NextProtos: []string{http3.NextProtoH3},
+	}
+}
diff --git a/electron/native/private-transport/third_party/masque-go/transport.go b/electron/native/private-transport/third_party/masque-go/transport.go
new file mode 100644
index 000000000..e54173860
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/transport.go
@@ -0,0 +1,94 @@
+package masque
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+)
+
+// defaultInitialPacketSize is an increased packet size used for the connection to the proxy.
+// This allows tunneling QUIC connections, which themselves have a minimum MTU requirement of 1200 bytes.
+const defaultInitialPacketSize = 1350
+
+// A Transport establishes proxied connections to multiple remote hosts.
+type Transport struct {
+	// TLSClientConfig is the TLS client config used when dialing the QUIC connection to the proxy.
+	// It must set the "h3" ALPN.
+	TLSClientConfig *tls.Config
+
+	// QUICConfig is the QUIC config used when dialing the QUIC connection.
+	QUICConfig *quic.Config
+
+	// DialAddr dials the QUIC connection to the proxy.
+	// If unset, quic.DialAddr is used.
+	DialAddr func(ctx context.Context, addr string, tlsConf *tls.Config, quicConf *quic.Config) (*quic.Conn, error)
+}
+
+// Dial is a shortcut that opens a QUIC connection to the proxy and then dials a proxied connection.
+// Closing the returned Conn also closes the QUIC connection to the proxy.
+// More advanced use cases, including multiple proxied connections via one proxy connection,
+// should dial a new QUIC connection and use [Transport.NewClientConn].
+func (t *Transport) Dial(req *Request) (*Conn, *http.Response, error) {
+	httpReq := req.req
+	if httpReq.URL == nil || httpReq.URL.Host == "" {
+		return nil, nil, errors.New("masque: request URL needs a host")
+	}
+
+	quicConf := t.QUICConfig
+	if quicConf == nil {
+		quicConf = &quic.Config{
+			EnableDatagrams:   true,
+			InitialPacketSize: defaultInitialPacketSize,
+		}
+	}
+	if !quicConf.EnableDatagrams {
+		return nil, nil, errors.New("masque: QUICConfig needs to enable Datagrams")
+	}
+	tlsConf := t.TLSClientConfig
+	if tlsConf == nil {
+		tlsConf = &tls.Config{NextProtos: []string{http3.NextProtoH3}}
+	}
+	dial := t.DialAddr
+	if dial == nil {
+		dial = quic.DialAddr
+	}
+	addr := httpReq.URL.Host
+	if httpReq.URL.Port() == "" {
+		addr = net.JoinHostPort(httpReq.URL.Hostname(), "443")
+	}
+	conn, err := dial(httpReq.Context(), addr, tlsConf, quicConf)
+	if err != nil {
+		return nil, nil, fmt.Errorf("masque: dialing QUIC connection failed: %w", err)
+	}
+	c, err := t.NewClientConn(conn)
+	if err != nil {
+		conn.CloseWithError(0, "")
+		return nil, nil, err
+	}
+	pconn, rsp, err := c.dial(req, func() error { return conn.CloseWithError(0, "") })
+	if err != nil {
+		conn.CloseWithError(0, "")
+		return nil, rsp, err
+	}
+	return pconn, rsp, nil
+}
+
+// NewClientConn creates a client connection for an already established QUIC connection.
+// It returns an error if the QUIC connection didn't negotiate datagram support.
+// The caller owns the QUIC connection and closes it when done.
+func (t *Transport) NewClientConn(conn *quic.Conn) (*ClientConn, error) {
+	if datagrams := conn.ConnectionState().SupportsDatagrams; !datagrams.Local || !datagrams.Remote {
+		return nil, errors.New("masque: QUIC connection needs Datagram support")
+	}
+	tr := &http3.Transport{EnableDatagrams: true}
+	return &ClientConn{
+		conn:       conn,
+		clientConn: tr.NewClientConn(conn),
+	}, nil
+}
diff --git a/electron/native/private-transport/third_party/masque-go/transport_test.go b/electron/native/private-transport/third_party/masque-go/transport_test.go
new file mode 100644
index 000000000..8fbcdb8f8
--- /dev/null
+++ b/electron/native/private-transport/third_party/masque-go/transport_test.go
@@ -0,0 +1,35 @@
+package masque_test
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"testing"
+
+	"github.com/quic-go/masque-go"
+	"github.com/quic-go/quic-go"
+	"github.com/stretchr/testify/require"
+	"github.com/yosida95/uritemplate/v3"
+)
+
+func TestTransportAddsDefaultPort(t *testing.T) {
+	req, err := masque.NewRequest(t.Context(), uritemplate.MustNew("https://proxy.example/masque?h={target_host}&p={target_port}"), "target.example:443")
+	require.NoError(t, err)
+
+	dialErr := errors.New("dial stopped")
+	tr := masque.Transport{
+		DialAddr: func(_ context.Context, addr string, _ *tls.Config, _ *quic.Config) (*quic.Conn, error) {
+			require.Equal(t, "proxy.example:443", addr)
+			return nil, dialErr
+		},
+	}
+	_, _, err = tr.Dial(req)
+	require.ErrorIs(t, err, dialErr)
+}
+
+func TestNewClientConnRequiresQUICDatagrams(t *testing.T) {
+	conn, _ := newConnPairWithDatagrams(t, false)
+
+	_, err := new(masque.Transport).NewClientConn(conn)
+	require.ErrorContains(t, err, "Datagram support")
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/LICENSE b/electron/native/private-transport/third_party/moqtransport/LICENSE
new file mode 100644
index 000000000..30c77be00
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Mathis Engelbart
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/electron/native/private-transport/third_party/moqtransport/QORTAL-PATCHES.md b/electron/native/private-transport/third_party/moqtransport/QORTAL-PATCHES.md
new file mode 100644
index 000000000..ad195872d
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/QORTAL-PATCHES.md
@@ -0,0 +1,45 @@
+# Local MoQT dependency
+
+Complete-object delivery adds real subgroup FIN/reset, cancellable group leases,
+monotonic object IDs, per-track/session byte limits and session-wide receive
+budgets. Expiry or stream cancellation does not close the media connection.
+Wire fields are bounded before allocation, including unbound track aliases.
+The unidirectional reader cancels its local watcher before waiting for it, so
+finished subgroup streams do not retain goroutines until session shutdown.
+Run group_delivery_test.go, reader_test.go and the race detector as well as the
+parent integration tests. Group/object payloads remain application-opaque;
+this is a bounded single-object-subgroup API, not a complete MoQ implementation.
+
+Upstream: https://github.com/mengelbart/moqtransport
+Revision: 9eaf40a4dedd549b6838cba1a900f9b382d722e8
+Wire profile: moqt-18, the profile implemented by that revision.
+
+This directory contains the core, QUIC adapter, wire codec, varint package,
+upstream tests and license. Examples, WebTransport adapter and development
+generators are omitted. The parent module selects this copy using Go replace;
+there are no module-cache edits or install-time patches.
+
+Local change: complete IncomingSubscribeRequest.SendDatagram using the existing
+draft-18 OBJECT_DATAGRAM encoder and Connection.SendDatagram. Zero object IDs
+use the defined flag; explicit publisher priority is 0. Subgroup IDs are
+rejected because they have no datagram wire field. Transport errors, including
+oversized packets, propagate without retries or conversion to streams.
+
+Subscription response write failures are logged instead of panicking the
+native sidecar when a remote peer disconnects during authorization.
+
+Run the parent module tests and this module's tests when updating the pin.
+This patch does not complete the library's other unfinished APIs or establish
+interoperability with another implementation.
+
+Generic delivery scheduling: delivery.go adds local deadline/priority policy,
+bounded per-session/per-track queues, reserved class capacity, weighted fair
+service, pacing and pressure metrics. ScheduleDatagram is nonblocking;
+SendScheduledDatagram / ScheduleDatagramResult provide producer backpressure.
+The QUIC adapter supplies public connection stats, without modifying quic-go.
+Scheduled publisher priority uses the existing draft-18 wire field; payloads
+are opaque and no application track names appear in this library.
+
+Keep this patch byte-identical in Hub and the backend's vendored module.
+Run delivery_test.go (including the race detector) and the parent real-MASQUE
+integration tests. No claim of cross-implementation MoQ compatibility is added.
diff --git a/electron/native/private-transport/third_party/moqtransport/README.md b/electron/native/private-transport/third_party/moqtransport/README.md
new file mode 100644
index 000000000..500260a99
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/README.md
@@ -0,0 +1,55 @@
+# Media over QUIC Transport (MoQT)
+
+[![Go Reference](https://pkg.go.dev/badge/github.com/mengelbart/moqtransport.svg)](https://pkg.go.dev/github.com/mengelbart/moqtransport)
+
+`moqtransport` is a Go implementation of [Media over QUIC Transport](https://datatracker.ietf.org/doc/draft-ietf-moq-transport/) on top of [quic-go](https://github.com/quic-go/quic-go) and optionally [webtransport-go](https://github.com/quic-go/webtransport-go/).
+
+## Overview
+
+This library implements the Media over QUIC Transport (MoQT) protocol as defined in [draft-ietf-moq-transport-11](https://www.ietf.org/archive/id/draft-ietf-moq-transport-11.txt). MoQT is designed to operate over QUIC or WebTransport for efficient media delivery with a publish/subscribe model.
+
+### Implementation Status
+
+This code, as well as the specification, is work in progress.
+The implementation currently covers most aspects of the MoQT specification (draft-11), including:
+
+ Session establishment and initialization  
+ Control message encoding and handling  
+ Data stream management  
+ Track announcement and subscription  
+ Error handling  
+ Support for both QUIC and WebTransport  
+
+### Areas for Future Development
+
+ Implementation of FETCH
+ Exposure of more parameters
+ ...
+
+## Usage
+
+See the [date examples in the examples directory](examples/date/README.md) for a simple demonstration of how to use this library.
+
+Basic usage involves:
+
+1. Creating a connection using either QUIC or WebTransport
+2. Establishing a MoQT session
+3. Implementing handlers for various MoQT messages
+4. Publishing or subscribing to tracks
+
+## Project Structure
+
+- `quicmoq/`: QUIC-specific implementation
+- `webtransportmoq/`: WebTransport-specific implementation
+- `internal/`: Internal implementation details
+- `examples/`: Example applications demonstrating usage
+- `integrationtests/`: Integration tests
+
+## Requirements
+
+- Go 1.23.6 or later
+- Dependencies are managed via Go modules
+
+## License
+
+See the [LICENSE](LICENSE) file for details.
diff --git a/electron/native/private-transport/third_party/moqtransport/connection.go b/electron/native/private-transport/third_party/moqtransport/connection.go
new file mode 100644
index 000000000..f173cf27a
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/connection.go
@@ -0,0 +1,137 @@
+package moqtransport
+
+import (
+	"context"
+	"errors"
+	"io"
+)
+
+// Protocol is a transport protocol supported by MoQ.
+type Protocol int
+
+// The supported protocols
+const (
+	ProtocolQUIC Protocol = iota
+	ProtocolWebTransport
+)
+
+func (p Protocol) String() string {
+	switch p {
+	case ProtocolQUIC:
+		return "quic"
+	case ProtocolWebTransport:
+		return "webtransport"
+	default:
+		return "invalid protocol"
+	}
+}
+
+// Perspective indicates whether the connection is a client or a server
+type Perspective int
+
+// The perspectives
+const (
+	PerspectiveClient Perspective = iota
+	PerspectiveServer
+)
+
+func (p Perspective) String() string {
+	switch p {
+	case PerspectiveServer:
+		return "server"
+	case PerspectiveClient:
+		return "client"
+	default:
+		return "invalid perspective"
+	}
+}
+
+// A Stream is the interface implemented by bidirectional streams.
+type Stream interface {
+	ReceiveStream
+	SendStream
+}
+
+// ReceiveStream is the interface implemented by the receiving end of unidirectional
+// streams.
+type ReceiveStream interface {
+	// Read reads from the stream.
+	io.Reader
+
+	// Stop stops reading from the stream and sends a signal to the sender to
+	// stop sending on the stream.
+	Stop(uint32)
+
+	// StreamID returns the ID of the stream
+	StreamID() uint64
+}
+
+// SendStream is the interface implemented by the sending end of unidirectional
+// streams.
+type SendStream interface {
+	// Write writes to the stream.
+	// Close closes the stream and guarantees retransmissions until all data has
+	// been received by the receiver or the stream is reset.
+	io.WriteCloser
+
+	// Reset closes the stream and stops retransmitting outstanding data.
+	Reset(uint32)
+
+	// StreamID returns the ID of the stream
+	StreamID() uint64
+}
+
+var ErrDatagramSupportDisabled = errors.New("datagram support disabled")
+
+// Connection is the interface of a QUIC/WebTransport connection. New Transports
+// expect an implementation of this interface as the underlying connection.
+// Implementations based on quic-go and webtransport-go are provided in quicmoq
+// and webTransportmoq.
+type Connection interface {
+	// AcceptStream returns the next stream opened by the peer, blocking until
+	// one is available.
+	AcceptStream(context.Context) (Stream, error)
+
+	// AcceptUniStream returns the next unidirectional stream opened by the
+	// peer, blocking until one is available.
+	AcceptUniStream(context.Context) (ReceiveStream, error)
+
+	// OpenStream opens a new bidirectional stream.
+	OpenStream() (Stream, error)
+
+	// OpenStreamSync opens a new bidirectional stream, blocking until it can be
+	// opened.
+	OpenStreamSync(context.Context) (Stream, error)
+
+	// OpenUniStream opens a new unidirectional stream.
+	OpenUniStream() (SendStream, error)
+
+	// OpenUniStream opens a new unidirectional stream, blocking until it can be
+	// opened.
+	OpenUniStreamSync(context.Context) (SendStream, error)
+
+	// SendDatagram sends a datagram.
+	SendDatagram([]byte) error
+
+	// ReceiveDatagram receives the next datagram, blocking until one is
+	// available.
+	ReceiveDatagram(context.Context) ([]byte, error)
+
+	// CloseWithError closes the connection with an error code and a reason
+	// string.
+	CloseWithError(uint64, string) error
+
+	// Context returns a context that will be canceled when the connection is
+	// closed.
+	Context() context.Context
+
+	// Protocol returns the underlying transport protocol of the connection.
+	Protocol() Protocol
+
+	// ApplicationProtocol returns the application protocol negotiated for the
+	// connection.
+	ApplicationProtocol() ApplicationProtocol
+
+	// Perspective returns the perspective of the connection.
+	Perspective() Perspective
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/datagram_send_test.go b/electron/native/private-transport/third_party/moqtransport/datagram_send_test.go
new file mode 100644
index 000000000..19c469573
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/datagram_send_test.go
@@ -0,0 +1,57 @@
+package moqtransport
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"testing"
+)
+
+type datagramCapture struct {
+	Connection
+	data  []byte
+	calls int
+	err   error
+}
+
+func (c *datagramCapture) SendDatagram(data []byte) error {
+	c.calls++
+	c.data = append([]byte(nil), data...)
+	return c.err
+}
+
+func TestDatagramSendWireAndErrors(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		id   uint64
+		want []byte
+	}{
+		{"zero", 0, []byte{0x04, 0x01, 0x02, 0x00, 0xaa, 0xbb}},
+		{"nonzero", 3, []byte{0x00, 0x01, 0x02, 0x03, 0x00, 0xaa, 0xbb}},
+		{"multibyte", 128, []byte{0x00, 0x01, 0x02, 0x80, 0x80, 0x00, 0xaa, 0xbb}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			conn := &datagramCapture{}
+			r := &IncomingSubscribeRequest{session: &Session{ctx: context.Background(), conn: conn}, trackAlias: 1}
+			if err := r.SendDatagram(Object{GroupID: 2, ObjectID: tc.id, Payload: []byte{0xaa, 0xbb}}); err != nil {
+				t.Fatal(err)
+			}
+			if conn.calls != 1 || !bytes.Equal(conn.data, tc.want) {
+				t.Fatalf("got %x (%d sends), want %x", conn.data, conn.calls, tc.want)
+			}
+			conn.err = errors.New("datagram too large")
+			if err := r.SendDatagram(Object{}); !errors.Is(err, conn.err) || conn.calls != 2 {
+				t.Fatalf("transport error must propagate after exactly one attempt: %v", err)
+			}
+			if err := r.SendDatagram(Object{SubGroupID: 1}); err == nil || conn.calls != 2 {
+				t.Fatal("subgroup was silently discarded")
+			}
+			ctx, cancel := context.WithCancel(context.Background())
+			cancel()
+			r.session.ctx = ctx
+			if err := r.SendDatagram(Object{}); !errors.Is(err, context.Canceled) || conn.calls != 2 {
+				t.Fatal("closed session sent a datagram")
+			}
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/delivery.go b/electron/native/private-transport/third_party/moqtransport/delivery.go
new file mode 100644
index 000000000..66af889d1
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/delivery.go
@@ -0,0 +1,320 @@
+package moqtransport
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"time"
+)
+
+// DeliveryPolicy is local scheduling policy, not authorization or payload metadata.
+// Priority 0 is latency-sensitive, 1 is live, 2 is background. Lower classes
+// receive a reserved share even when a higher class is continuously busy.
+type DeliveryPolicy struct {
+	Priority          int `json:"priority"`
+	MaxQueueAgeMillis int `json:"maxQueueAgeMillis"`
+}
+
+func (p DeliveryPolicy) Valid() bool {
+	return p.Priority >= 0 && p.Priority <= 2 && p.MaxQueueAgeMillis >= 10 && p.MaxQueueAgeMillis <= 2000
+}
+
+var ErrDeliveryQueueFull = errors.New("MOQ_QUEUE_LIMIT")
+var ErrDeliveryPolicy = errors.New("INVALID_MOQ_CONFIG")
+var ErrDeliveryExpired = errors.New("MOQ_OBJECT_EXPIRED")
+
+type DeliveryMetrics struct {
+	ReliableLeasedBytes  int64  `json:"reliableLeasedBytes"`
+	ReceiveQueuedBytes   int64  `json:"receiveQueuedBytes"`
+	QueuedBytes          int    `json:"deliveryQueuedBytes"`
+	Sent                 uint64 `json:"deliverySent"`
+	Expired              uint64 `json:"deliveryExpired"`
+	Rejected             uint64 `json:"deliveryRejected"`
+	SendErrors           uint64 `json:"deliverySendErrors"`
+	QueueDelayMillis     int64  `json:"deliveryQueueDelayMillis"`
+	PacingBytesPerSecond int64  `json:"deliveryPacingBytesPerSecond"`
+}
+type DeliveryNetworkStats struct {
+	RTT, MinRTT              time.Duration
+	PacketsSent, PacketsLost uint64
+}
+type deliveryNetwork interface{ DeliveryNetworkStats() DeliveryNetworkStats }
+type deliveryItem struct {
+	result           chan error
+	data             []byte
+	queued, deadline time.Time
+}
+type deliveryLane struct {
+	key      uint64
+	priority int
+	items    []deliveryItem
+	bytes    int
+}
+type deliveryScheduler struct {
+	mu                   sync.Mutex
+	ctx                  context.Context
+	send                 func([]byte) error
+	network              func() DeliveryNetworkStats
+	lanes                []*deliveryLane
+	cursor               [3]int
+	slot                 int
+	metrics              DeliveryMetrics
+	wake                 chan struct{}
+	rate                 float64
+	tokens               float64
+	lastTick, lastSample time.Time
+	previous             DeliveryNetworkStats
+	bad                  int
+	lastQueueSample      time.Time
+}
+
+const deliveryMaxTrackBytes = 64 * 1024
+const deliveryMaxSessionBytes = 256 * 1024
+
+// Weighted fair service, with round-robin within each class.
+var deliverySlots = [...]int{0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 2}
+
+func newDeliveryScheduler(ctx context.Context, send func([]byte) error, network func() DeliveryNetworkStats) *deliveryScheduler {
+	return &deliveryScheduler{ctx: ctx, send: send, network: network, wake: make(chan struct{}, 1),
+		rate: 1_000_000, lastTick: time.Now(), lastSample: time.Now()}
+}
+func (d *deliveryScheduler) enqueue(key uint64, data []byte, policy DeliveryPolicy, result ...chan error) error {
+	if !policy.Valid() {
+		return ErrDeliveryPolicy
+	}
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if err := d.ctx.Err(); err != nil {
+		return err
+	}
+	now := time.Now()
+	d.expire(now)
+	var lane *deliveryLane
+	for _, l := range d.lanes {
+		if l.key == key {
+			lane = l
+			break
+		}
+	}
+	if lane == nil {
+		if len(d.lanes) >= 128 {
+			d.metrics.Rejected++
+			return ErrDeliveryQueueFull
+		}
+		lane = &deliveryLane{key: key, priority: policy.Priority}
+		d.lanes = append(d.lanes, lane)
+	}
+	// Do not silently discard dependency fragments to make room for later ones.
+	if len(lane.items) > 0 && lane.priority != policy.Priority {
+		return ErrDeliveryPolicy
+	}
+	// Refuse overload immediately so the producer can reduce its rate.
+	var classBytes [3]int
+	for _, l := range d.lanes {
+		classBytes[l.priority] += l.bytes
+	}
+	reserve := 0
+	for class, bytes := range classBytes {
+		if class != policy.Priority {
+			reserve += max(0, 32*1024-bytes)
+		}
+	}
+	if lane.bytes+len(data) > deliveryMaxTrackBytes || d.metrics.QueuedBytes+len(data) > deliveryMaxSessionBytes-reserve {
+		d.metrics.Rejected++
+		return ErrDeliveryQueueFull
+	}
+	lane.priority = policy.Priority
+	var completion chan error
+	if len(result) > 0 {
+		completion = result[0]
+	}
+	lane.items = append(lane.items, deliveryItem{completion, append([]byte(nil), data...), now, now.Add(time.Duration(policy.MaxQueueAgeMillis) * time.Millisecond)})
+	lane.bytes += len(data)
+	d.metrics.QueuedBytes += len(data)
+	select {
+	case d.wake <- struct{}{}:
+	default:
+	}
+	return nil
+}
+func (d *deliveryScheduler) expire(now time.Time) {
+	for i := 0; i < len(d.lanes); {
+		l := d.lanes[i]
+		kept := l.items[:0]
+		for _, item := range l.items {
+			if !now.Before(item.deadline) {
+				l.bytes -= len(item.data)
+				d.metrics.QueuedBytes -= len(item.data)
+				d.metrics.Expired++
+				if item.result != nil {
+					item.result <- ErrDeliveryExpired
+				}
+			} else {
+				kept = append(kept, item)
+			}
+		}
+		clear(l.items[len(kept):])
+		l.items = kept
+		if len(l.items) == 0 {
+			d.lanes = append(d.lanes[:i], d.lanes[i+1:]...)
+			continue
+		}
+		i++
+	}
+}
+
+// Caller holds mu. Each turn transmits at most one object from one track.
+func (d *deliveryScheduler) take(now time.Time) (deliveryItem, bool) {
+	d.expire(now)
+	if len(d.lanes) == 0 {
+		return deliveryItem{}, false
+	}
+	for n := 0; n < len(deliverySlots); n++ {
+		class := deliverySlots[d.slot]
+		d.slot = (d.slot + 1) % len(deliverySlots)
+		for i := 0; i < len(d.lanes); i++ {
+			index := (d.cursor[class] + i) % len(d.lanes)
+			l := d.lanes[index]
+			if l.priority != class || len(l.items) == 0 {
+				continue
+			}
+			item := l.items[0]
+			if float64(len(item.data)) > d.tokens {
+				continue
+			}
+			d.cursor[class] = (index + 1) % len(d.lanes)
+			l.items[0] = deliveryItem{}
+			l.items = l.items[1:]
+			l.bytes -= len(item.data)
+			d.metrics.QueuedBytes -= len(item.data)
+			d.tokens -= float64(len(item.data))
+			d.metrics.QueueDelayMillis = now.Sub(item.queued).Milliseconds()
+			d.lastQueueSample = now
+			return item, true
+		}
+	}
+	return deliveryItem{}, false
+}
+func (d *deliveryScheduler) sample(now time.Time) {
+	if now.Sub(d.lastSample) < time.Second {
+		return
+	}
+	if d.network != nil {
+		s := d.network()
+		sent := uint64(0)
+		lost := uint64(0)
+		if s.PacketsSent >= d.previous.PacketsSent {
+			sent = s.PacketsSent - d.previous.PacketsSent
+		}
+		if s.PacketsLost >= d.previous.PacketsLost {
+			lost = s.PacketsLost - d.previous.PacketsLost
+		}
+		congested := sent >= 20 && (float64(lost)/float64(sent) > 0.03 || (s.MinRTT > 0 && s.RTT-s.MinRTT > max(20*time.Millisecond, s.MinRTT/4)))
+		if congested {
+			d.bad++
+		} else {
+			d.bad = 0
+		}
+		if d.bad >= 2 {
+			d.rate = max(32_000, d.rate*0.85)
+		} else if !congested && d.metrics.QueuedBytes > 0 {
+			d.rate = min(20_000_000, d.rate*1.05)
+		}
+		d.previous = s
+	}
+	d.lastSample = now
+}
+func (d *deliveryScheduler) run() {
+	timer := time.NewTimer(time.Hour)
+	timer.Stop()
+	defer timer.Stop()
+	defer func() { d.mu.Lock(); d.lanes = nil; d.metrics.QueuedBytes = 0; d.mu.Unlock() }()
+	for {
+		d.mu.Lock()
+		pending := d.metrics.QueuedBytes > 0
+		d.mu.Unlock()
+		var tick <-chan time.Time
+		if pending {
+			timer.Reset(2 * time.Millisecond)
+			tick = timer.C
+		}
+		select {
+		case <-d.ctx.Done():
+			return
+		case <-d.wake:
+		case <-tick:
+		}
+		timer.Stop()
+		now := time.Now()
+		d.mu.Lock()
+		d.sample(now)
+		// No idle credit or unbounded catch-up bursts after an event-loop stall.
+		d.tokens = min(4096, d.tokens+now.Sub(d.lastTick).Seconds()*d.rate)
+		d.lastTick = now
+		d.mu.Unlock()
+		for burst := 0; burst < 4; burst++ {
+			d.mu.Lock()
+			item, ok := d.take(time.Now())
+			d.mu.Unlock()
+			if !ok {
+				break
+			}
+			if d.ctx.Err() != nil {
+				return
+			}
+			start := time.Now()
+			err := d.send(item.data)
+			if item.result != nil {
+				item.result <- err
+			}
+			elapsed := time.Since(start)
+			d.mu.Lock()
+			if err != nil {
+				d.metrics.SendErrors++
+			} else {
+				d.metrics.Sent++
+			}
+			// SendDatagram can block at the QUIC queue. Back off instead of filling it
+			// again at the original producer rate. QUIC remains the congestion authority.
+			if elapsed > 5*time.Millisecond {
+				d.rate = max(32_000, min(d.rate, float64(len(item.data))/elapsed.Seconds()*0.9))
+				d.tokens = 0
+			}
+			d.mu.Unlock()
+		}
+	}
+}
+func (d *deliveryScheduler) snapshot() DeliveryMetrics {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	m := d.metrics
+	m.PacingBytesPerSecond = int64(d.rate)
+	// Report current queue age too, including periods when sending is stalled.
+	for _, l := range d.lanes {
+		if len(l.items) > 0 {
+			m.QueueDelayMillis = max(m.QueueDelayMillis, time.Since(l.items[0].queued).Milliseconds())
+		}
+	}
+	if m.QueuedBytes == 0 && time.Since(d.lastQueueSample) > time.Second {
+		m.QueueDelayMillis = 0
+	}
+	return m
+}
+func (s *Session) scheduler() *deliveryScheduler {
+	s.deliveryOnce.Do(func() {
+		var network func() DeliveryNetworkStats
+		if c, ok := s.conn.(deliveryNetwork); ok {
+			network = c.DeliveryNetworkStats
+		}
+		s.delivery = newDeliveryScheduler(s.ctx, s.conn.SendDatagram, network)
+		// Context/connection closure terminates both the worker and a blocked send.
+		_ = s.goTracked(s.delivery.run)
+	})
+	return s.delivery
+}
+func (s *Session) DeliveryMetrics() DeliveryMetrics {
+	m := s.scheduler().snapshot()
+	m.ReliableLeasedBytes = s.reliableBytes.Load()
+	m.ReceiveQueuedBytes = s.receiveBytes.Load()
+	return m
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/delivery_test.go b/electron/native/private-transport/third_party/moqtransport/delivery_test.go
new file mode 100644
index 000000000..a96dc2186
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/delivery_test.go
@@ -0,0 +1,170 @@
+package moqtransport
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestDeliveryFairPriorityAndOrder(t *testing.T) {
+	d := newDeliveryScheduler(context.Background(), nil, nil)
+	// Multiple opaque tracks, not application-specific labels.
+	for i := 0; i < 40; i++ {
+		for key := uint64(1); key <= 4; key++ {
+			p := DeliveryPolicy{Priority: 0, MaxQueueAgeMillis: 1000}
+			if key == 3 {
+				p.Priority = 1
+			}
+			if key == 4 {
+				p.Priority = 2
+			}
+			if err := d.enqueue(key, []byte{byte(key), byte(i)}, p); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	d.tokens = 100000
+	count := map[byte]int{}
+	for i := 0; i < 26; i++ {
+		item, ok := d.take(time.Now())
+		if !ok {
+			t.Fatal("missing item")
+		}
+		if int(item.data[1]) != count[item.data[0]] {
+			t.Fatal("per-track order changed")
+		}
+		count[item.data[0]]++
+	}
+	if count[1] != 8 || count[2] != 8 || count[3] != 8 || count[4] != 2 {
+		t.Fatalf("unfair service: %v", count)
+	}
+}
+func TestDeliveryBoundsExpiryAndReuse(t *testing.T) {
+	d := newDeliveryScheduler(context.Background(), nil, nil)
+	p := DeliveryPolicy{Priority: 1, MaxQueueAgeMillis: 10}
+	done := make(chan error, 1)
+	if err := d.enqueue(1, make([]byte, deliveryMaxTrackBytes), p, done); err != nil {
+		t.Fatal(err)
+	}
+	if !errors.Is(d.enqueue(1, []byte{1}, p), ErrDeliveryQueueFull) {
+		t.Fatal("track limit bypassed")
+	}
+	// Another track retains independent capacity.
+	if err := d.enqueue(2, []byte{2}, p); err != nil {
+		t.Fatal(err)
+	}
+	d.expire(time.Now().Add(time.Second))
+	if !errors.Is(<-done, ErrDeliveryExpired) {
+		t.Fatal("expiry not reported")
+	}
+	if d.metrics.QueuedBytes != 0 || len(d.lanes) != 0 || d.metrics.Expired != 2 {
+		t.Fatal(d.metrics)
+	}
+	for i := 0; i < 300; i++ {
+		if err := d.enqueue(uint64(i), []byte{1}, p); err != nil {
+			t.Fatal(err)
+		}
+		d.expire(time.Now().Add(time.Second))
+	}
+	if err := d.enqueue(1, []byte{1}, DeliveryPolicy{Priority: -1, MaxQueueAgeMillis: 10}); !errors.Is(err, ErrDeliveryPolicy) {
+		t.Fatal(err)
+	}
+}
+func TestDeliverySessionCap(t *testing.T) {
+	d := newDeliveryScheduler(context.Background(), nil, nil)
+	p := DeliveryPolicy{Priority: 1, MaxQueueAgeMillis: 1000}
+	for i := 0; i < 3; i++ {
+		if err := d.enqueue(uint64(i), make([]byte, deliveryMaxTrackBytes), p); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if !errors.Is(d.enqueue(5, []byte{1}, p), ErrDeliveryQueueFull) {
+		t.Fatal("session limit bypassed")
+	}
+	if err := d.enqueue(6, make([]byte, 32*1024), DeliveryPolicy{Priority: 0, MaxQueueAgeMillis: 1000}); err != nil {
+		t.Fatal("urgent reserve consumed", err)
+	}
+	if err := d.enqueue(7, make([]byte, 32*1024), DeliveryPolicy{Priority: 2, MaxQueueAgeMillis: 1000}); err != nil {
+		t.Fatal("background reserve consumed", err)
+	}
+}
+func TestDeliveryPacingDoesNotAccumulateIdleBurst(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	sent := make(chan time.Time, 32)
+	d := newDeliveryScheduler(ctx, func([]byte) error { sent <- time.Now(); return nil }, nil)
+	d.rate = 10000
+	for i := 0; i < 8; i++ {
+		if err := d.enqueue(1, make([]byte, 1000), DeliveryPolicy{Priority: 1, MaxQueueAgeMillis: 2000}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	go d.run()
+	start := time.Now()
+	select {
+	case <-sent:
+		if time.Since(start) < 60*time.Millisecond {
+			t.Fatal("unpaced burst")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("no progress")
+	}
+	cancel()
+}
+func TestDeliveryCongestionAndRecovery(t *testing.T) {
+	var stats DeliveryNetworkStats
+	d := newDeliveryScheduler(context.Background(), nil, func() DeliveryNetworkStats { return stats })
+	now := time.Now()
+	for i := 1; i <= 3; i++ {
+		stats = DeliveryNetworkStats{RTT: 100 * time.Millisecond, MinRTT: 30 * time.Millisecond, PacketsSent: uint64(i * 100), PacketsLost: uint64(i * 10)}
+		d.sample(now.Add(time.Duration(i) * time.Second))
+	}
+	if d.rate >= 1_000_000 {
+		t.Fatal("no congestion response")
+	}
+	low := d.rate
+	d.metrics.QueuedBytes = 1000
+	stats = DeliveryNetworkStats{RTT: 30 * time.Millisecond, MinRTT: 30 * time.Millisecond, PacketsSent: 400, PacketsLost: 30}
+	d.sample(now.Add(4 * time.Second))
+	if d.rate <= low || d.rate > low*1.051 {
+		t.Fatal("unsafe recovery", d.rate)
+	}
+}
+func TestDeliverySlowRecipientIsolationAndClose(t *testing.T) {
+	slowCtx, stop := context.WithCancel(context.Background())
+	entered := make(chan struct{})
+	slow := newDeliveryScheduler(slowCtx, func([]byte) error { close(entered); <-slowCtx.Done(); return slowCtx.Err() }, nil)
+	fastCtx, closeFast := context.WithCancel(context.Background())
+	defer closeFast()
+	fast := newDeliveryScheduler(fastCtx, func([]byte) error { return nil }, nil)
+	slowDone := make(chan error, 1)
+	fastDone := make(chan error, 1)
+	p := DeliveryPolicy{Priority: 0, MaxQueueAgeMillis: 100}
+	_ = slow.enqueue(1, []byte{1}, p, slowDone)
+	_ = fast.enqueue(1, []byte{1}, p, fastDone)
+	go slow.run()
+	go fast.run()
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("slow not started")
+	}
+	select {
+	case err := <-fastDone:
+		if err != nil {
+			t.Fatal(err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("slow recipient blocked fast one")
+	}
+	stop()
+	select {
+	case <-slowDone:
+	case <-time.After(time.Second):
+		t.Fatal("close did not release send")
+	}
+	if !errors.Is(slow.enqueue(1, []byte{1}, p), context.Canceled) {
+		t.Fatal("accepted after close")
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/errors.go b/electron/native/private-transport/third_party/moqtransport/errors.go
new file mode 100644
index 000000000..7fa05f5ef
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/errors.go
@@ -0,0 +1,83 @@
+package moqtransport
+
+// ErrorCode is a session termination error code.
+type ErrorCode uint64
+
+const (
+	ErrorCodeNoError                  ErrorCode = 0x00
+	ErrorCodeInternal                 ErrorCode = 0x01
+	ErrorCodeUnauthorized             ErrorCode = 0x02
+	ErrorCodeProtocolViolation        ErrorCode = 0x03
+	ErrorCodeInvalidRequestID         ErrorCode = 0x04
+	ErrorCodeDuplicateTrackAlias      ErrorCode = 0x05
+	ErrorCodeKeyValueFormattingError  ErrorCode = 0x06
+	ErrorCodeInvalidPath              ErrorCode = 0x08
+	ErrorCodeMalformedPath            ErrorCode = 0x09
+	ErrorCodeGoAwayTimeout            ErrorCode = 0x10
+	ErrorCodeControlMessageTimeout    ErrorCode = 0x11
+	ErrorCodeDataStreamTimeout        ErrorCode = 0x12
+	ErrorCodeAuthTokenCacheOverflow   ErrorCode = 0x13
+	ErrorCodeDuplicateAuthTokenAlias  ErrorCode = 0x14
+	ErrorCodeVersionNegotiationFailed ErrorCode = 0x15
+	ErrorCodeMalformedAuthToken       ErrorCode = 0x16
+	ErrorCodeUnknownAuthTokenAlias    ErrorCode = 0x17
+	ErrorCodeExpiredAuthToken         ErrorCode = 0x18
+	ErrorCodeInvalidAuthority         ErrorCode = 0x19
+	ErrorCodeMalformedAuthority       ErrorCode = 0x1A
+)
+
+// RequestErrorCode is a REQUEST_ERROR error code.
+type RequestErrorCode uint64
+
+const (
+	RequestErrorCodeInternal                RequestErrorCode = 0x00
+	RequestErrorCodeUnauthorized            RequestErrorCode = 0x01
+	RequestErrorCodeTimeout                 RequestErrorCode = 0x02
+	RequestErrorCodeNotSupported            RequestErrorCode = 0x03
+	RequestErrorCodeMalformedAuthToken      RequestErrorCode = 0x04
+	RequestErrorCodeExpiredAuthToken        RequestErrorCode = 0x05
+	RequestErrorCodeGoingAway               RequestErrorCode = 0x06
+	RequestErrorCodeExcessiveLoad           RequestErrorCode = 0x09
+	RequestErrorCodeDoesNotExist            RequestErrorCode = 0x10
+	RequestErrorCodeInvalidRange            RequestErrorCode = 0x11
+	RequestErrorCodeMalformedTrack          RequestErrorCode = 0x12
+	RequestErrorCodeDuplicateSubscription   RequestErrorCode = 0x19
+	RequestErrorCodeUninterested            RequestErrorCode = 0x20
+	RequestErrorCodePrefixOverlap           RequestErrorCode = 0x30
+	RequestErrorCodeNamespaceTooLarge       RequestErrorCode = 0x31
+	RequestErrorCodeInvalidJoiningRequestID RequestErrorCode = 0x32
+	RequestErrorCodeUnsupportedExtension    RequestErrorCode = 0x33
+	RequestErrorCodeRedirect                RequestErrorCode = 0x34
+)
+
+// StreamResetErrorCode is used when resetting a stream or sending STOP_SENDING.
+type StreamResetErrorCode uint32
+
+const (
+	StreamResetErrorCodeInternal            StreamResetErrorCode = 0x00
+	StreamResetErrorCodeCancelled           StreamResetErrorCode = 0x01
+	StreamResetErrorCodeDeliveryTimeout     StreamResetErrorCode = 0x02
+	StreamResetErrorCodeSessionClosed       StreamResetErrorCode = 0x03
+	StreamResetErrorCodeGoingAway           StreamResetErrorCode = 0x04
+	StreamResetErrorCodeTooFarBehind        StreamResetErrorCode = 0x05
+	StreamResetErrorCodeUnknownObjectStatus StreamResetErrorCode = 0x06
+	StreamResetErrorCodeExpiredAuthToken    StreamResetErrorCode = 0x07
+	StreamResetErrorCodeExcessiveLoad       StreamResetErrorCode = 0x09
+	StreamResetErrorCodeMalformedTrack      StreamResetErrorCode = 0x12
+)
+
+// PublishDoneStatusCode says why a subscription ended.
+type PublishDoneStatusCode uint64
+
+const (
+	PublishDoneStatusCodeInternal          PublishDoneStatusCode = 0x00
+	PublishDoneStatusCodeUnauthorized      PublishDoneStatusCode = 0x01
+	PublishDoneStatusCodeTrackEnded        PublishDoneStatusCode = 0x02
+	PublishDoneStatusCodeSubscriptionEnded PublishDoneStatusCode = 0x03
+	PublishDoneStatusCodeGoingAway         PublishDoneStatusCode = 0x04
+	PublishDoneStatusCodeTooFarBehind      PublishDoneStatusCode = 0x05
+	PublishDoneStatusCodeExpired           PublishDoneStatusCode = 0x06
+	PublishDoneStatusCodeUpdateFailed      PublishDoneStatusCode = 0x08
+	PublishDoneStatusCodeExcessiveLoad     PublishDoneStatusCode = 0x09
+	PublishDoneStatusCodeMalformedTrack    PublishDoneStatusCode = 0x12
+)
diff --git a/electron/native/private-transport/third_party/moqtransport/go.mod b/electron/native/private-transport/third_party/moqtransport/go.mod
new file mode 100644
index 000000000..ec71c77fd
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/go.mod
@@ -0,0 +1,28 @@
+module github.com/mengelbart/moqtransport
+
+go 1.25.12
+
+require (
+	github.com/quic-go/quic-go v0.61.0
+	github.com/quic-go/webtransport-go v0.12.0
+	github.com/stretchr/testify v1.11.1
+	go.uber.org/goleak v1.3.0
+	go.uber.org/mock v0.6.0
+	golang.org/x/tools v0.47.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dunglas/httpsfv v1.1.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
+
+tool go.uber.org/mock/mockgen
diff --git a/electron/native/private-transport/third_party/moqtransport/go.sum b/electron/native/private-transport/third_party/moqtransport/go.sum
new file mode 100644
index 000000000..1d5807a6b
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/go.sum
@@ -0,0 +1,47 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dunglas/httpsfv v1.1.0 h1:Jw76nAyKWKZKFrpMMcL76y35tOpYHqQPzHQiwDvpe54=
+github.com/dunglas/httpsfv v1.1.0/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.61.0 h1:ui88A53s8MSVYLC56en0KQ17HARk+9986Dn0SBfKNvA=
+github.com/quic-go/quic-go v0.61.0/go.mod h1:9So2anK4Tp22URSQq00k+Vo2PNkle96ycDPDHL4s9vs=
+github.com/quic-go/webtransport-go v0.12.0 h1:CpnKNwZvdV0LD73xoHO8QaR0NI3llqpWRwnazdZS0sE=
+github.com/quic-go/webtransport-go v0.12.0/go.mod h1:GHne8aRFJ24h73pAMrcywXtuaz/ShBXCLXLvG/NPFdU=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/electron/native/private-transport/third_party/moqtransport/goleak_test.go b/electron/native/private-transport/third_party/moqtransport/goleak_test.go
new file mode 100644
index 000000000..37eea6daa
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/goleak_test.go
@@ -0,0 +1,11 @@
+package moqtransport
+
+import (
+	"testing"
+
+	"go.uber.org/goleak"
+)
+
+func TestMain(m *testing.M) {
+	goleak.VerifyTestMain(m)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/group_delivery.go b/electron/native/private-transport/third_party/moqtransport/group_delivery.go
new file mode 100644
index 000000000..751a6bace
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/group_delivery.go
@@ -0,0 +1,122 @@
+package moqtransport
+
+import (
+	"errors"
+	"time"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+)
+
+// MaxReliableObjectBytes bounds an opaque application object, not a datagram.
+const MaxReliableObjectBytes = 1024 * 1024
+const maxGroupBytes = 2 * MaxReliableObjectBytes
+const maxGroupStreams = 64
+
+var ErrObjectExpired = errors.New("MOQ_OBJECT_EXPIRED")
+
+type objectLease struct {
+	stream SendStream
+	timer  *time.Timer
+	size   int
+}
+
+// SendGroupObject sends one complete object on its own cancellable subgroup.
+// Group IDs must increase when dependencies are replaced. The application owns
+// dependency semantics; the transport never inspects the encrypted payload.
+// Success means QUIC accepted the write, not that the peer received the object.
+// FIN alone does not bound retransmission: the lease resets even FIN'd streams.
+func (r *IncomingSubscribeRequest) SendGroupObject(o Object, policy DeliveryPolicy) error {
+	if len(o.Payload) == 0 || len(o.Payload) > MaxReliableObjectBytes || !policy.Valid() ||
+		o.GroupID >= 1<<62 || o.ObjectID >= 1<<62 {
+		return ErrDeliveryPolicy
+	}
+	if err := r.session.ctx.Err(); err != nil {
+		return err
+	}
+	r.groupMu.Lock()
+	if r.groupStarted && o.GroupID < r.groupID {
+		r.groupMu.Unlock()
+		return ErrObjectExpired
+	}
+	if !r.groupStarted || o.GroupID > r.groupID {
+		for lease := range r.groupLeases {
+			r.releaseLeaseLocked(lease)
+		}
+		r.groupLeases = make(map[*objectLease]struct{})
+		r.groupBytes = 0
+		r.groupID, r.groupStarted = o.GroupID, true
+		r.groupObjectStarted = false
+	}
+	if r.groupObjectStarted && o.ObjectID <= r.groupObjectID {
+		r.groupMu.Unlock()
+		return ErrDeliveryPolicy
+	}
+	if len(r.groupLeases) >= maxGroupStreams || r.groupBytes+len(o.Payload) > maxGroupBytes {
+		r.groupMu.Unlock()
+		return ErrDeliveryQueueFull
+	}
+	size := int64(len(o.Payload))
+	for {
+		queued := r.session.reliableBytes.Load()
+		if queued+size > 4*MaxReliableObjectBytes {
+			r.groupMu.Unlock()
+			return ErrDeliveryQueueFull
+		}
+		if r.session.reliableBytes.CompareAndSwap(queued, queued+size) {
+			break
+		}
+	}
+	stream, err := r.session.conn.OpenUniStream()
+	if err != nil {
+		r.session.reliableBytes.Add(-size)
+		r.groupMu.Unlock()
+		if r.session.ctx.Err() == nil {
+			return ErrDeliveryQueueFull
+		}
+		return err
+	}
+	lease := &objectLease{stream: stream, size: len(o.Payload)}
+	r.groupObjectID, r.groupObjectStarted = o.ObjectID, true
+	r.groupLeases[lease] = struct{}{}
+	r.groupBytes += len(o.Payload)
+
+	release := func() {
+		r.groupMu.Lock()
+		r.releaseLeaseLocked(lease)
+		r.groupMu.Unlock()
+	}
+	// Reset also interrupts a Write blocked by QUIC flow/congestion control.
+	timer := time.AfterFunc(time.Duration(policy.MaxQueueAgeMillis)*time.Millisecond, release)
+	lease.timer = timer
+	r.groupMu.Unlock()
+	subgroup, err := newSubgroup(wire.NewAppender(stream, r.session.version), r.trackAlias, o.GroupID, o.ObjectID, uint8(policy.Priority*64))
+	if err == nil {
+		subgroup.sender = stream
+		_, err = subgroup.WriteObject(o.ObjectID, o.Payload)
+		if err == nil {
+			err = subgroup.Close()
+		}
+	}
+	if err != nil {
+		timer.Stop()
+		release()
+		// A cancelled/expired subgroup is not a failed media connection.
+		// The session's control reader handles genuine connection closure.
+		if r.session.ctx.Err() == nil {
+			return ErrObjectExpired
+		}
+	}
+	return err
+}
+
+// Caller holds groupMu; timer, group replacement and write failure race here.
+func (r *IncomingSubscribeRequest) releaseLeaseLocked(lease *objectLease) {
+	if _, ok := r.groupLeases[lease]; !ok {
+		return
+	}
+	lease.timer.Stop()
+	lease.stream.Reset(uint32(StreamResetErrorCodeInternal))
+	delete(r.groupLeases, lease)
+	r.groupBytes -= lease.size
+	r.session.reliableBytes.Add(-int64(lease.size))
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/group_delivery_test.go b/electron/native/private-transport/third_party/moqtransport/group_delivery_test.go
new file mode 100644
index 000000000..bfc3538a8
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/group_delivery_test.go
@@ -0,0 +1,123 @@
+package moqtransport
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+type leaseTestStream struct {
+	mu     sync.Mutex
+	data   bytes.Buffer
+	closed atomic.Int32
+	resets atomic.Int32
+	done   chan struct{}
+	once   sync.Once
+	block  bool
+}
+
+func (s *leaseTestStream) Write(p []byte) (int, error) {
+	if s.block {
+		<-s.done
+		return 0, errors.New("reset")
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.data.Write(p)
+}
+func (s *leaseTestStream) Close() error     { s.closed.Add(1); return nil }
+func (s *leaseTestStream) Reset(uint32)     { s.resets.Add(1); s.once.Do(func() { close(s.done) }) }
+func (s *leaseTestStream) StreamID() uint64 { return 7 }
+
+func groupTestRequest(t *testing.T, stream *leaseTestStream) *IncomingSubscribeRequest {
+	c := NewMockConnection(gomock.NewController(t))
+	c.EXPECT().OpenUniStream().Return(stream, nil).AnyTimes()
+	return &IncomingSubscribeRequest{session: &Session{ctx: context.Background(), conn: c, version: 18}}
+}
+func TestGroupObjectFinAndBoundedRetransmission(t *testing.T) {
+	stream := &leaseTestStream{done: make(chan struct{})}
+	r := groupTestRequest(t, stream)
+	require.NoError(t, r.SendGroupObject(Object{GroupID: 1, ObjectID: 1, Payload: bytes.Repeat([]byte{7}, 100_000)}, DeliveryPolicy{Priority: 1, MaxQueueAgeMillis: 30}))
+	require.EqualValues(t, 1, stream.closed.Load())
+	select {
+	case <-stream.done:
+	case <-time.After(time.Second):
+		t.Fatal("FIN did not expire")
+	}
+	require.Eventually(t, func() bool { r.groupMu.Lock(); defer r.groupMu.Unlock(); return r.groupBytes == 0 }, time.Second, time.Millisecond)
+}
+func TestGroupDeadlineInterruptsBlockedHeaderWrite(t *testing.T) {
+	stream := &leaseTestStream{done: make(chan struct{}), block: true}
+	r := groupTestRequest(t, stream)
+	done := make(chan error, 1)
+	go func() {
+		done <- r.SendGroupObject(Object{GroupID: 1, ObjectID: 1, Payload: []byte("test")}, DeliveryPolicy{Priority: 1, MaxQueueAgeMillis: 20})
+	}()
+	select {
+	case err := <-done:
+		require.ErrorIs(t, err, ErrObjectExpired)
+	case <-time.After(time.Second):
+		t.Fatal("write remained blocked")
+	}
+}
+func TestNewGroupCancelsOldAndRejectsStaleGroup(t *testing.T) {
+	stream := &leaseTestStream{done: make(chan struct{})}
+	r := groupTestRequest(t, stream)
+	policy := DeliveryPolicy{Priority: 1, MaxQueueAgeMillis: 30}
+	require.NoError(t, r.SendGroupObject(Object{GroupID: 1, ObjectID: 1, Payload: []byte("first")}, policy))
+	require.NoError(t, r.SendGroupObject(Object{GroupID: 2, ObjectID: 2, Payload: []byte("key")}, policy))
+	require.GreaterOrEqual(t, stream.resets.Load(), int32(1))
+	require.ErrorIs(t, r.SendGroupObject(Object{GroupID: 1, Payload: []byte("old")}, policy), ErrObjectExpired)
+	time.Sleep(40 * time.Millisecond)
+}
+func TestSubgroupCloseReallySendsFinOnce(t *testing.T) {
+	stream := &leaseTestStream{done: make(chan struct{})}
+	r := groupTestRequest(t, stream)
+	subgroup, err := r.OpenSubgroup(1, 1, 0)
+	require.NoError(t, err)
+	require.NoError(t, subgroup.Close())
+	require.NoError(t, subgroup.Close())
+	require.EqualValues(t, 1, stream.closed.Load())
+	subgroup.Reset(1)
+	require.EqualValues(t, 1, stream.resets.Load())
+}
+func TestCancelledDataStreamDoesNotCloseSession(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+	defer session.CloseWithError(0, "done")
+	reader := conn.acceptUniStream(encodeDataStream(t, 17, 3, 5, testObject{0, "hello"}))
+	<-reader.drained
+	reader.close(errors.New("peer expired subgroup"))
+	time.Sleep(20 * time.Millisecond)
+	require.NoError(t, session.Context().Err())
+}
+
+func TestGroupAdmissionBoundsAndDuplicateIDs(t *testing.T) {
+	stream := &leaseTestStream{done: make(chan struct{})}
+	r := groupTestRequest(t, stream)
+	t.Cleanup(func() {
+		r.groupMu.Lock()
+		defer r.groupMu.Unlock()
+		for lease := range r.groupLeases {
+			r.releaseLeaseLocked(lease)
+		}
+	})
+	policy := DeliveryPolicy{Priority: 1, MaxQueueAgeMillis: 2000}
+	large := bytes.Repeat([]byte{1}, MaxReliableObjectBytes)
+	require.NoError(t, r.SendGroupObject(Object{GroupID: 1, ObjectID: 1, Payload: large}, policy))
+	require.ErrorIs(t, r.SendGroupObject(Object{GroupID: 1, ObjectID: 1, Payload: []byte{1}}, policy), ErrDeliveryPolicy)
+	require.NoError(t, r.SendGroupObject(Object{GroupID: 1, ObjectID: 2, Payload: large}, policy))
+	require.ErrorIs(t, r.SendGroupObject(Object{GroupID: 1, ObjectID: 3, Payload: []byte{1}}, policy), ErrDeliveryQueueFull)
+	require.EqualValues(t, 2*MaxReliableObjectBytes, r.session.reliableBytes.Load())
+	// Replacing the group releases its byte reservation immediately.
+	require.NoError(t, r.SendGroupObject(Object{GroupID: 2, ObjectID: 1, Payload: []byte{1}}, policy))
+	require.EqualValues(t, 1, r.session.reliableBytes.Load())
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/handler.go b/electron/native/private-transport/third_party/moqtransport/handler.go
new file mode 100644
index 000000000..418d550b6
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/handler.go
@@ -0,0 +1,7 @@
+package moqtransport
+
+// Handler is the handler interface for non-specific  MoQ messages.
+type Handler interface {
+	HandleGoAway(string)
+	HandleSubscribe(*IncomingSubscribeRequest)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/incoming_subscribe_request.go b/electron/native/private-transport/third_party/moqtransport/incoming_subscribe_request.go
new file mode 100644
index 000000000..de71f825e
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/incoming_subscribe_request.go
@@ -0,0 +1,177 @@
+package moqtransport
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"sync"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+)
+
+type IncomingSubscribeRequest struct {
+	logger       *slog.Logger
+	session      *Session
+	streamWriter messageWriter
+	streamReader messageReader
+
+	namespace [][]byte
+	name      []byte
+
+	trackAlias         uint64
+	groupMu            sync.Mutex
+	groupID            uint64
+	groupStarted       bool
+	groupObjectStarted bool
+	groupObjectID      uint64
+	groupLeases        map[*objectLease]struct{}
+	groupBytes         int
+}
+
+func newIncomingSubscribeRequest(msg *wire.Subscribe, session *Session, streamWriter messageWriter, streamReader messageReader) *IncomingSubscribeRequest {
+	isr := &IncomingSubscribeRequest{
+		logger:       defaultLogger,
+		session:      session,
+		streamWriter: streamWriter,
+		streamReader: streamReader,
+		namespace:    msg.TrackNamespace,
+		name:         msg.TrackName,
+		trackAlias:   0,
+	}
+	isr.logger.Debug("incoming subscribe request created", "requestID", msg.RequestID, "namespace", msg.TrackNamespace, "trackName", msg.TrackName)
+	return isr
+}
+
+// readMessages reads from the request stream until it fails. It must be called
+// from a goroutine tracked by the session WaitGroup.
+func (r *IncomingSubscribeRequest) readMessages() {
+	for {
+		msg, err := r.streamReader.Read()
+		if err != nil {
+			if !errors.Is(err, io.EOF) {
+				r.session.handleReaderError(err)
+			}
+			return
+		}
+		switch msg := msg.(type) {
+		case *wire.RequestUpdate:
+			// TODO
+		default:
+			r.session.closeWithError(&SessionError{
+				Code:   uint64(ErrorCodeProtocolViolation),
+				Reason: fmt.Sprintf("unexpected message type: %T", msg),
+			})
+			return
+		}
+	}
+}
+
+func (r *IncomingSubscribeRequest) Accept(trackAlias uint64) {
+	r.logger.Debug("accepting subscribe request")
+	r.trackAlias = trackAlias
+	err := r.streamWriter.Write(&wire.SubscribeOk{
+		TrackAlias: trackAlias,
+	})
+	if err != nil {
+		r.logger.Debug("failed to accept subscribe request", "error", err)
+	}
+}
+
+func (r *IncomingSubscribeRequest) Reject(code RequestErrorCode, reason string) {
+	err := r.streamWriter.Write(&wire.RequestError{
+		ErrorCode:     uint64(code),
+		RetryInterval: 0, // TODO: Add retry interval if needed
+		ErrorReason:   reason,
+	})
+	if err != nil {
+		r.logger.Debug("failed to reject subscribe request", "error", err)
+	}
+}
+
+func (r *IncomingSubscribeRequest) SendDatagram(o Object) error {
+	return r.sendDatagram(o, nil)
+}
+
+// ScheduleDatagram admits an unreliable object; success is not a delivery ACK.
+func (r *IncomingSubscribeRequest) ScheduleDatagram(o Object, policy DeliveryPolicy) error {
+	return r.sendDatagram(o, &policy)
+}
+
+// SendScheduledDatagram adds producer backpressure without blocking other tracks.
+// The result acknowledges QUIC admission, not reception by the peer.
+func (r *IncomingSubscribeRequest) SendScheduledDatagram(o Object, policy DeliveryPolicy) error {
+	result, err := r.ScheduleDatagramResult(o, policy)
+	if err != nil {
+		return err
+	}
+	select {
+	case err := <-result:
+		return err
+	case <-r.session.ctx.Done():
+		return r.session.ctx.Err()
+	}
+}
+
+func (r *IncomingSubscribeRequest) ScheduleDatagramResult(o Object, policy DeliveryPolicy) (<-chan error, error) {
+	result := make(chan error, 1)
+	if err := r.sendDatagram(o, &policy, result); err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+func (r *IncomingSubscribeRequest) sendDatagram(o Object, policy *DeliveryPolicy, result ...chan error) error {
+	// A datagram carries one complete object. Do not emulate unreliable
+	// delivery with a stream or retry a rejected send.
+	if err := r.session.ctx.Err(); err != nil {
+		return err
+	}
+	if o.SubGroupID != 0 {
+		return errors.New("datagram objects have no subgroup ID")
+	}
+	message := &wire.DatagramObject{
+		TrackAlias:        r.trackAlias,
+		GroupID:           o.GroupID,
+		ObjectID:          o.ObjectID,
+		PublisherPriority: 0,
+		ObjectPayload:     o.Payload,
+	}
+	message.SetZeroObjectID(o.ObjectID == 0)
+	if policy != nil {
+		if !policy.Valid() {
+			return ErrDeliveryPolicy
+		}
+		message.PublisherPriority = uint8(policy.Priority * 64)
+		return r.session.scheduler().enqueue(r.trackAlias, message.AppendDatagram(nil), *policy, result...)
+	}
+	return r.session.conn.SendDatagram(message.AppendDatagram(nil))
+}
+
+func (r *IncomingSubscribeRequest) OpenSubgroup(groupID, subgroupID uint64, priority uint8) (*Subgroup, error) {
+	stream, err := r.session.conn.OpenUniStream()
+	if err != nil {
+		return nil, err
+	}
+	appender := wire.NewAppender(stream, r.session.version)
+	subgroup, err := newSubgroup(appender, r.trackAlias, groupID, subgroupID, priority)
+	if err != nil {
+		stream.Reset(uint32(StreamResetErrorCodeInternal))
+		return nil, err
+	}
+	subgroup.sender = stream
+	return subgroup, nil
+}
+
+func (r *IncomingSubscribeRequest) Close() error {
+	// TODO
+	return nil
+}
+
+func (r *IncomingSubscribeRequest) Namespace() [][]byte {
+	return r.namespace
+}
+
+func (r *IncomingSubscribeRequest) Name() []byte {
+	return r.name
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/appender.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/appender.go
new file mode 100644
index 000000000..109673284
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/appender.go
@@ -0,0 +1,83 @@
+package wire
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+	"math"
+
+	"github.com/mengelbart/moqtransport/varint"
+)
+
+type Appender struct {
+	writer  io.Writer
+	version uint64
+}
+
+func NewAppender(w io.Writer, version uint64) *Appender {
+	return &Appender{
+		writer:  w,
+		version: version,
+	}
+}
+
+func (a *Appender) Write(msg ControlMessage) error {
+	buf := make([]byte, 0, 4096)
+
+	switch msg.(type) {
+	case *SubgroupObject:
+		// Objects on a subgroup stream are written without type and length.
+	case *SubgroupHeader, *FetchHeader, *Padding, *FetchObject:
+		// Data stream headers are written with a type but without a length, and
+		// a fetch object with its serialization flags in place of a type.
+		buf = varint.Append(buf, uint64(msg.Type()))
+	default:
+		return a.writeControlMessage(buf, msg)
+	}
+
+	buf, err := a.serializeMessage(buf, msg)
+	if err != nil {
+		return err
+	}
+	return a.writeBuffer(buf)
+}
+
+func (a *Appender) writeControlMessage(buf []byte, msg ControlMessage) error {
+	buf = varint.Append(buf, uint64(msg.Type()))
+	tl := len(buf)
+	buf = append(buf, 0x00, 0x00) // length placeholder
+
+	buf, err := a.serializeMessage(buf, msg)
+	if err != nil {
+		return err
+	}
+
+	length := len(buf[tl+2:])
+	if length > math.MaxUint16 {
+		return fmt.Errorf("control message too large")
+	}
+	binary.BigEndian.PutUint16(buf[tl:tl+2], uint16(length))
+
+	return a.writeBuffer(buf)
+}
+
+func (a *Appender) serializeMessage(buf []byte, msg ControlMessage) ([]byte, error) {
+	switch a.version {
+	case 18:
+		buf = msg.append_v18(buf)
+	default:
+		return nil, fmt.Errorf("unsupported version: %d", a.version)
+	}
+	return buf, nil
+}
+
+func (a *Appender) writeBuffer(buf []byte) error {
+	n, err := a.writer.Write(buf)
+	if err != nil {
+		return err
+	}
+	if n != len(buf) {
+		return fmt.Errorf("failed to write complete message")
+	}
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/control_message.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/control_message.go
new file mode 100644
index 000000000..8642d6db1
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/control_message.go
@@ -0,0 +1,45 @@
+package wire
+
+const (
+	// Bidirectional stream messages
+	ControlMessageTypeSubscribe   ControlMessageType = 0x3
+	ControlMessageTypeSubscribeOk ControlMessageType = 0x4
+
+	ControlMessageTypePublish     ControlMessageType = 0x1d
+	ControlMessageTypePublishOk   ControlMessageType = 0x1e
+	ControlMessageTypePublishDone ControlMessageType = 0xb
+
+	ControlMessageTypeFetch   ControlMessageType = 0x16
+	ControlMessageTypeFetchOk ControlMessageType = 0x18
+
+	ControlMessageTypeTrackStatus ControlMessageType = 0xd
+
+	ControlMessageTypePublishNamespace   ControlMessageType = 0x6
+	ControlMessageTypeSubscribeNamespace ControlMessageType = 0x50
+	ControlMessageTypeSubscribeTracks    ControlMessageType = 0x51
+
+	ControlMessageTypeNamespace     ControlMessageType = 0x8
+	ControlMessageTypeNamespaceDone ControlMessageType = 0xe
+
+	ControlMessageTypePublishBlocked ControlMessageType = 0xf
+
+	ControlMessageTypeRequestUpdate ControlMessageType = 0x2
+	ControlMessageTypeRequestOk     ControlMessageType = 0x7
+	ControlMessageTypeRequestError  ControlMessageType = 0x5
+
+	// Unidirectional stream messages
+	ControlMessageTypeSetup ControlMessageType = 0x2f00
+
+	ControlMessageTypeGoAway ControlMessageType = 0x10
+
+	ControlMessageTypeFetchHeader ControlMessageType = 0x5
+	ControlMessageTypePadding     ControlMessageType = 0x132b3e28
+)
+
+type ControlMessageType uint64
+
+type ControlMessage interface {
+	Type() ControlMessageType
+	parse_v18(messageReader) error
+	append_v18([]byte) []byte
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/datagram_object.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/datagram_object.go
new file mode 100644
index 000000000..1d445adbd
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/datagram_object.go
@@ -0,0 +1,81 @@
+package wire
+
+import (
+	"bytes"
+
+	"github.com/mengelbart/moqtransport/varint"
+)
+
+type DatagramObject struct {
+	typ               uint64
+	TrackAlias        uint64         `proto:"varint"`
+	GroupID           uint64         `proto:"varint"`
+	ObjectID          uint64         `proto:"varint,if=!ZeroObjectID"`
+	PublisherPriority uint8          `proto:"byte,if=!DefaultPriority"`
+	Properties        []KeyValuePair `proto:"kvp_list_tlv,if=HasProperties"`
+	ObjectStatus      uint64         `proto:"varint,if=Status"`
+	ObjectPayload     []byte         `proto:"remaining_bytes,if=!Status"`
+}
+
+func (m *DatagramObject) Type() ControlMessageType {
+	return ControlMessageType(m.typ)
+}
+
+func (m *DatagramObject) HasProperties() bool {
+	return getBit(m.typ, 0)
+}
+
+func (m *DatagramObject) SetHasProperties(v bool) {
+	m.typ = setBit(m.typ, 0, v)
+}
+
+func (m *DatagramObject) EndOfGroup() bool {
+	return getBit(m.typ, 1)
+}
+
+func (m *DatagramObject) SetEndOfGroup(v bool) {
+	m.typ = setBit(m.typ, 1, v)
+}
+
+func (m *DatagramObject) ZeroObjectID() bool {
+	return getBit(m.typ, 2)
+}
+
+func (m *DatagramObject) SetZeroObjectID(v bool) {
+	m.typ = setBit(m.typ, 2, v)
+}
+
+func (m *DatagramObject) DefaultPriority() bool {
+	return getBit(m.typ, 3)
+}
+
+func (m *DatagramObject) SetDefaultPriority(v bool) {
+	m.typ = setBit(m.typ, 3, v)
+}
+
+func (m *DatagramObject) Status() bool {
+	return getBit(m.typ, 5)
+}
+
+func (m *DatagramObject) SetStatus(v bool) {
+	m.typ = setBit(m.typ, 5, v)
+}
+
+func (m *DatagramObject) AppendDatagram(buf []byte) []byte {
+	buf = varint.Append(buf, m.typ)
+	return m.append_v18(buf)
+}
+
+func (m *DatagramObject) Parse(data []byte) error {
+	br := bytes.NewReader(data)
+
+	typ, err := varint.Read(br)
+	if err != nil {
+		return err
+	}
+	m.typ = typ
+
+	r := &boundedReader{reader: br}
+	r.reset(int64(br.Len()))
+	return m.parse_v18(r)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/datagram_object_test.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/datagram_object_test.go
new file mode 100644
index 000000000..0044d7da3
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/datagram_object_test.go
@@ -0,0 +1,57 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/mengelbart/moqtransport/varint"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDatagramObjectParseLargePropertiesLength(t *testing.T) {
+	// typ bit 0 set: the datagram claims to carry properties.
+	data := []byte{0x01, 0x00, 0x00, 0x00, 0x00}
+	data = varint.Append(data, 1<<40) // properties length in bytes
+
+	m := DatagramObject{}
+	err := m.Parse(data)
+	assert.ErrorIs(t, err, io.ErrUnexpectedEOF)
+	assert.Empty(t, m.Properties)
+}
+
+func TestDatagramObjectParseTruncatedProperty(t *testing.T) {
+	data := []byte{0x01, 0x00, 0x00, 0x00, 0x00}
+	data = varint.Append(data, 3) // properties length in bytes
+	data = varint.Append(data, 1) // property type 1: length-prefixed bytes
+	data = varint.Append(data, 8) // claims 8 bytes
+	data = append(data, 'A')
+
+	m := DatagramObject{}
+	err := m.Parse(data)
+	assert.ErrorIs(t, err, io.ErrUnexpectedEOF)
+	assert.Empty(t, m.Properties)
+}
+
+func TestDatagramObjectParseProperties(t *testing.T) {
+	data := []byte{0x01, 0x04, 0x05, 0x06, 0x07}
+	data = varint.Append(data, 5) // properties length in bytes
+	data = varint.Append(data, 1) // delta 1, type 1: length-prefixed bytes
+	data = varint.Append(data, 1)
+	data = append(data, 'A')
+	data = varint.Append(data, 1) // delta 1, type 2: varint value
+	data = varint.Append(data, 42)
+	data = append(data, "payload"...)
+
+	m := DatagramObject{}
+	err := m.Parse(data)
+	assert.NoError(t, err)
+	assert.Equal(t, uint64(4), m.TrackAlias)
+	assert.Equal(t, uint64(5), m.GroupID)
+	assert.Equal(t, uint64(6), m.ObjectID)
+	assert.Equal(t, uint8(7), m.PublisherPriority)
+	assert.Equal(t, []KeyValuePair{
+		{Type: 1, Bytes: []byte("A")},
+		{Type: 2, Varint: 42},
+	}, m.Properties)
+	assert.Equal(t, []byte("payload"), m.ObjectPayload)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/datagram_object_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/datagram_object_v18.go
new file mode 100644
index 000000000..24102b55e
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/datagram_object_v18.go
@@ -0,0 +1,79 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *DatagramObject) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.TrackAlias))
+	buf = varint.Append(buf, uint64(m.GroupID))
+	if !m.ZeroObjectID() {
+		buf = varint.Append(buf, uint64(m.ObjectID))
+	}
+	if !m.DefaultPriority() {
+		buf = append(buf, m.PublisherPriority)
+	}
+	if m.HasProperties() {
+		PropertiesBuf := appendKeyValuePairs_v18(nil, m.Properties)
+		buf = varint.Append(buf, uint64(len(PropertiesBuf)))
+		buf = append(buf, PropertiesBuf...)
+	}
+	if m.Status() {
+		buf = varint.Append(buf, uint64(m.ObjectStatus))
+	}
+	if !m.Status() {
+		buf = append(buf, m.ObjectPayload...)
+	}
+	return buf
+}
+
+func (m *DatagramObject) parse_v18(r messageReader) error {
+	var err error
+
+	m.TrackAlias, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.GroupID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	if !m.ZeroObjectID() {
+		m.ObjectID, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	if !m.DefaultPriority() {
+		m.PublisherPriority, err = r.ReadByte()
+		if err != nil {
+			return err
+		}
+	}
+
+	if m.HasProperties() {
+		m.Properties, err = parseKeyValuePairsTLV_v18(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	if m.Status() {
+		m.ObjectStatus, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	if !m.Status() {
+		m.ObjectPayload, err = readRemaining(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_header_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_header_v18.go
new file mode 100644
index 000000000..3c0d43f93
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_header_v18.go
@@ -0,0 +1,21 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *FetchHeader) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.RequestID))
+	return buf
+}
+
+func (m *FetchHeader) parse_v18(r messageReader) error {
+	var err error
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_object.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_object.go
new file mode 100644
index 000000000..9ad78fb55
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_object.go
@@ -0,0 +1,142 @@
+package wire
+
+import "fmt"
+
+// Bit positions and masks of the fetch object serialization flags.
+const (
+	fetchBitObjectIDDelta uint = 2
+	fetchBitGroupIDDelta  uint = 3
+	fetchBitPriority      uint = 4
+	fetchBitProperties    uint = 5
+	fetchBitDatagram      uint = 6
+
+	fetchSubgroupIDModeMask uint64 = 0b0000_0011
+
+	// Serialization flags below 128 are a bit field.
+	fetchFlagsMax uint64 = 0x7f
+)
+
+// Encodings of the subgroup ID, the two least significant bits of the
+// serialization flags.
+const (
+	// FetchSubgroupIDModeZero omits the subgroup ID, it is 0.
+	FetchSubgroupIDModeZero uint8 = 0
+	// FetchSubgroupIDModePrior omits the subgroup ID, it is the prior object's.
+	FetchSubgroupIDModePrior uint8 = 1
+	// FetchSubgroupIDModePriorPlusOne omits the subgroup ID, it is the prior
+	// object's plus one.
+	FetchSubgroupIDModePriorPlusOne uint8 = 2
+	// FetchSubgroupIDModeExplicit carries the subgroup ID in the object.
+	FetchSubgroupIDModeExplicit uint8 = 3
+)
+
+// Serialization flag values at or above 128.
+const (
+	FetchEndOfNonExistentRange uint64 = 0x8c
+	FetchEndOfUnknownRange     uint64 = 0x10c
+)
+
+var errInvalidSerializationFlags = fmt.Errorf("invalid fetch object serialization flags")
+
+type FetchObject struct {
+	flags uint64
+
+	GroupIDDelta      uint64         `proto:"varint,if=HasGroupIDDelta"`
+	SubgroupID        uint64         `proto:"varint,if=explicitSubgroupID"`
+	ObjectIDDelta     uint64         `proto:"varint,if=HasObjectIDDelta"`
+	PublisherPriority uint8          `proto:"byte,if=HasPriority"`
+	Properties        []KeyValuePair `proto:"kvp_list_tlv,if=HasProperties"`
+	ObjectPayload     []byte         `proto:"tlv_bytes"`
+}
+
+func NewEndOfNonExistentRange(groupIDDelta, objectIDDelta uint64) *FetchObject {
+	return newEndOfRange(FetchEndOfNonExistentRange, groupIDDelta, objectIDDelta)
+}
+
+func NewEndOfUnknownRange(groupIDDelta, objectIDDelta uint64) *FetchObject {
+	return newEndOfRange(FetchEndOfUnknownRange, groupIDDelta, objectIDDelta)
+}
+
+func newEndOfRange(flags, groupIDDelta, objectIDDelta uint64) *FetchObject {
+	return &FetchObject{
+		flags:         flags,
+		GroupIDDelta:  groupIDDelta,
+		ObjectIDDelta: objectIDDelta,
+	}
+}
+
+func (m *FetchObject) Type() ControlMessageType {
+	return ControlMessageType(m.flags)
+}
+
+// validate rejects a serialization flags value that is neither a bit field nor
+// one of the two end of range markers.
+func (m *FetchObject) validate() error {
+	if m.flags <= fetchFlagsMax || m.IsEndOfRange() {
+		return nil
+	}
+	return fmt.Errorf("%w: %v", errInvalidSerializationFlags, m.flags)
+}
+
+func (m *FetchObject) IsEndOfRange() bool {
+	return m.flags == FetchEndOfNonExistentRange || m.flags == FetchEndOfUnknownRange
+}
+
+func (m *FetchObject) SubgroupIDMode() uint8 {
+	return uint8(m.flags & fetchSubgroupIDModeMask)
+}
+
+func (m *FetchObject) SetSubgroupIDMode(v uint8) {
+	switch v {
+	case FetchSubgroupIDModeZero, FetchSubgroupIDModePrior, FetchSubgroupIDModePriorPlusOne, FetchSubgroupIDModeExplicit:
+		m.flags = m.flags&^fetchSubgroupIDModeMask | uint64(v)
+	default:
+		panic(fmt.Sprintf("invalid fetch subgroup id mode: %d", v))
+	}
+}
+
+// explicitSubgroupID reports whether the subgroup ID field is present. A
+// datagram object has no subgroup ID and the mode bits are ignored.
+func (m *FetchObject) explicitSubgroupID() bool {
+	return !m.Datagram() && m.SubgroupIDMode() == FetchSubgroupIDModeExplicit
+}
+
+func (m *FetchObject) HasObjectIDDelta() bool {
+	return getBit(m.flags, fetchBitObjectIDDelta)
+}
+
+func (m *FetchObject) SetHasObjectIDDelta(v bool) {
+	m.flags = setBit(m.flags, fetchBitObjectIDDelta, v)
+}
+
+func (m *FetchObject) HasGroupIDDelta() bool {
+	return getBit(m.flags, fetchBitGroupIDDelta)
+}
+
+func (m *FetchObject) SetHasGroupIDDelta(v bool) {
+	m.flags = setBit(m.flags, fetchBitGroupIDDelta, v)
+}
+
+func (m *FetchObject) HasPriority() bool {
+	return getBit(m.flags, fetchBitPriority)
+}
+
+func (m *FetchObject) SetHasPriority(v bool) {
+	m.flags = setBit(m.flags, fetchBitPriority, v)
+}
+
+func (m *FetchObject) HasProperties() bool {
+	return getBit(m.flags, fetchBitProperties)
+}
+
+func (m *FetchObject) SetHasProperties(v bool) {
+	m.flags = setBit(m.flags, fetchBitProperties, v)
+}
+
+func (m *FetchObject) Datagram() bool {
+	return getBit(m.flags, fetchBitDatagram)
+}
+
+func (m *FetchObject) SetDatagram(v bool) {
+	m.flags = setBit(m.flags, fetchBitDatagram, v)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_object_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_object_v18.go
new file mode 100644
index 000000000..9e3c6329d
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_object_v18.go
@@ -0,0 +1,80 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *FetchObject) append_v18(buf []byte) []byte {
+	if m.HasGroupIDDelta() {
+		buf = varint.Append(buf, uint64(m.GroupIDDelta))
+	}
+	if m.explicitSubgroupID() {
+		buf = varint.Append(buf, uint64(m.SubgroupID))
+	}
+	if m.HasObjectIDDelta() {
+		buf = varint.Append(buf, uint64(m.ObjectIDDelta))
+	}
+	if m.HasPriority() {
+		buf = append(buf, m.PublisherPriority)
+	}
+	if m.HasProperties() {
+		PropertiesBuf := appendKeyValuePairs_v18(nil, m.Properties)
+		buf = varint.Append(buf, uint64(len(PropertiesBuf)))
+		buf = append(buf, PropertiesBuf...)
+	}
+	buf = varint.Append(buf, uint64(len(m.ObjectPayload)))
+	buf = append(buf, m.ObjectPayload...)
+	return buf
+}
+
+func (m *FetchObject) parse_v18(r messageReader) error {
+	var err error
+
+	if m.HasGroupIDDelta() {
+		m.GroupIDDelta, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	if m.explicitSubgroupID() {
+		m.SubgroupID, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	if m.HasObjectIDDelta() {
+		m.ObjectIDDelta, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	if m.HasPriority() {
+		m.PublisherPriority, err = r.ReadByte()
+		if err != nil {
+			return err
+		}
+	}
+
+	if m.HasProperties() {
+		m.Properties, err = parseKeyValuePairsTLV_v18(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	var ObjectPayloadLength uint64
+	ObjectPayloadLength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.ObjectPayload, err = readBytes(r, ObjectPayloadLength)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_ok_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_ok_v18.go
new file mode 100644
index 000000000..230867378
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_ok_v18.go
@@ -0,0 +1,52 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import (
+	"errors"
+
+	"github.com/mengelbart/moqtransport/varint"
+)
+
+func (m *FetchOk) append_v18(buf []byte) []byte {
+	if m.EndOfTrack {
+		buf = append(buf, byte(1))
+	} else {
+		buf = append(buf, byte(0))
+	}
+	buf = m.EndLocation.append_v18(buf)
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	buf = appendKeyValuePairs_v18(buf, m.Properties)
+	return buf
+}
+
+func (m *FetchOk) parse_v18(r messageReader) error {
+	var err error
+
+	var EndOfTrackByte byte
+	EndOfTrackByte, err = r.ReadByte()
+	if err != nil {
+		return err
+	}
+	if EndOfTrackByte > 1 {
+		return errors.New("invalid bool flag value")
+	}
+	m.EndOfTrack = EndOfTrackByte > 0
+
+	if err = m.EndLocation.parse_v18(r); err != nil {
+		return err
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	m.Properties, err = parseKeyValuePairsRemaining_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_stream_test.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_stream_test.go
new file mode 100644
index 000000000..741876d03
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_stream_test.go
@@ -0,0 +1,196 @@
+package wire
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"github.com/mengelbart/moqtransport/varint"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFetchStreamBytes(t *testing.T) {
+	var buf bytes.Buffer
+	appender := NewAppender(&buf, 18)
+
+	require.NoError(t, appender.Write(&FetchHeader{RequestID: 42}))
+
+	first := &FetchObject{
+		GroupIDDelta:      1,
+		SubgroupID:        9,
+		ObjectIDDelta:     0,
+		PublisherPriority: 200,
+		ObjectPayload:     []byte("ab"),
+	}
+	first.SetHasGroupIDDelta(true)
+	first.SetSubgroupIDMode(FetchSubgroupIDModeExplicit)
+	first.SetHasObjectIDDelta(true)
+	first.SetHasPriority(true)
+	require.NoError(t, appender.Write(first))
+
+	require.NoError(t, appender.Write(&FetchObject{ObjectPayload: []byte("c")}))
+	require.NoError(t, appender.Write(NewEndOfNonExistentRange(2, 5)))
+
+	assert.Equal(t, []byte{
+		0x05, // FETCH_HEADER
+		0x2a, // request ID
+
+		0x1f, // flags: group delta, subgroup ID mode 0b11, object delta, priority
+		0x01, // group ID delta
+		0x09, // subgroup ID
+		0x00, // object ID delta
+		200,  // publisher priority
+		0x02, 'a', 'b',
+
+		0x00, // flags: subgroup ID mode 0b00, nothing present
+		0x01, 'c',
+
+		0x80, 0x8c, // flags: end of non-existent range
+		0x02, // group ID delta
+		0x05, // object ID delta
+		0x00, // payload length
+	}, buf.Bytes())
+}
+
+// fetchObjects covers every serialization flag, one combination per object.
+func fetchObjects() []*FetchObject {
+	explicit := &FetchObject{
+		GroupIDDelta:      1,
+		SubgroupID:        9,
+		ObjectIDDelta:     0,
+		PublisherPriority: 200,
+		ObjectPayload:     []byte("hello"),
+	}
+	explicit.SetHasGroupIDDelta(true)
+	explicit.SetSubgroupIDMode(FetchSubgroupIDModeExplicit)
+	explicit.SetHasObjectIDDelta(true)
+	explicit.SetHasPriority(true)
+
+	prior := &FetchObject{ObjectIDDelta: 3, ObjectPayload: []byte("world")}
+	prior.SetSubgroupIDMode(FetchSubgroupIDModePrior)
+	prior.SetHasObjectIDDelta(true)
+
+	priorPlusOne := &FetchObject{ObjectPayload: []byte("!")}
+	priorPlusOne.SetSubgroupIDMode(FetchSubgroupIDModePriorPlusOne)
+
+	properties := &FetchObject{
+		Properties: []KeyValuePair{
+			{Type: 1, Bytes: []byte("A")},
+			{Type: 2, Varint: 42},
+		},
+		ObjectPayload: []byte("ab"),
+	}
+	properties.SetHasProperties(true)
+
+	// A datagram object has no subgroup ID, the mode bits are ignored.
+	datagram := &FetchObject{ObjectPayload: []byte("d")}
+	datagram.SetDatagram(true)
+	datagram.SetSubgroupIDMode(FetchSubgroupIDModeExplicit)
+
+	return []*FetchObject{
+		explicit,
+		prior,
+		priorPlusOne,
+		properties,
+		datagram,
+		{}, // an empty object, every field absent
+		NewEndOfNonExistentRange(2, 5),
+		NewEndOfUnknownRange(0, 1),
+	}
+}
+
+func TestFetchStreamRoundTrip(t *testing.T) {
+	var buf bytes.Buffer
+	appender := NewAppender(&buf, 18)
+
+	header := &FetchHeader{RequestID: 42}
+	require.NoError(t, appender.Write(header))
+
+	objects := fetchObjects()
+	for _, o := range objects {
+		require.NoError(t, appender.Write(o))
+	}
+
+	parser := mustParser(t, &buf, 18, StreamTypeData)
+
+	msg, err := parser.Read()
+	require.NoError(t, err)
+	assert.Equal(t, header, msg)
+
+	for i, want := range objects {
+		msg, err := parser.Read()
+		require.NoError(t, err, "object %v", i)
+		assert.Equal(t, want, msg, "object %v", i)
+	}
+
+	_, err = parser.Read()
+	assert.ErrorIs(t, err, io.EOF)
+}
+
+func TestParseInvalidSerializationFlags(t *testing.T) {
+	cases := map[string]struct {
+		flags  uint64
+		fields []byte
+	}{
+		// No field is present.
+		"128": {flags: 0x80, fields: []byte{0x00}},
+		// No field is present.
+		"256": {flags: 0x100, fields: []byte{0x00}},
+		// Group delta, object delta, priority, properties and a payload length.
+		// The datagram bit suppresses the subgroup ID.
+		"255": {flags: 0xff, fields: []byte{0x00, 0x00, 0x00, 0x00, 0x00}},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			buf := []byte{0x05, 0x2a} // FETCH_HEADER
+			buf = varint.Append(buf, tc.flags)
+			buf = append(buf, tc.fields...)
+
+			parser := mustParser(t, bytes.NewReader(buf), 18, StreamTypeData)
+
+			_, err := parser.Read()
+			require.NoError(t, err)
+
+			_, err = parser.Read()
+			assert.ErrorIs(t, err, errInvalidSerializationFlags)
+		})
+	}
+}
+
+func TestParseTruncatedFetchObject(t *testing.T) {
+	full := []byte{
+		0x05, 0x2a, // FETCH_HEADER
+		0x3f,            // flags: group delta, subgroup mode 0b11, object delta, priority, properties
+		0x01,            // group ID delta
+		0x09,            // subgroup ID
+		0x00,            // object ID delta
+		200,             // publisher priority
+		0x03,            // properties length in bytes
+		0x01, 0x01, 'A', // property type delta 1, type 1: one byte, 'A'
+		0x02, 'a', 'b', // payload
+	}
+	for i := 3; i < len(full); i++ {
+		parser := mustParser(t, bytes.NewReader(full[:i]), 18, StreamTypeData)
+
+		_, err := parser.Read()
+		require.NoError(t, err, "truncated after %v bytes", i)
+
+		_, err = parser.Read()
+		assert.ErrorIs(t, err, io.ErrUnexpectedEOF, "truncated after %v bytes", i)
+	}
+}
+
+func TestParseFetchObjectLargePropertiesLength(t *testing.T) {
+	buf := []byte{0x05, 0x2a} // FETCH_HEADER
+	buf = append(buf, 0x20)   // flags: properties present
+	buf = varint.Append(buf, 1<<40)
+
+	parser := mustParser(t, bytes.NewReader(buf), 18, StreamTypeData)
+
+	_, err := parser.Read()
+	require.NoError(t, err)
+
+	_, err = parser.Read()
+	assert.ErrorIs(t, err, io.ErrUnexpectedEOF)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_v18.go
new file mode 100644
index 000000000..4f5b94ac2
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/fetch_v18.go
@@ -0,0 +1,120 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *Fetch) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.RequestID))
+	buf = varint.Append(buf, uint64(m.FetchType))
+	if m.isStandalone() {
+		buf = varint.Append(buf, uint64(len(m.TrackNamespace)))
+		for _, v := range m.TrackNamespace {
+			buf = varint.Append(buf, uint64(len(v)))
+			buf = append(buf, v...)
+		}
+	}
+	if m.isStandalone() {
+		buf = varint.Append(buf, uint64(len(m.TrackName)))
+		buf = append(buf, m.TrackName...)
+	}
+	if m.isStandalone() {
+		buf = m.StartLocation.append_v18(buf)
+	}
+	if m.isStandalone() {
+		buf = m.EndLocation.append_v18(buf)
+	}
+	if m.isJoining() {
+		buf = varint.Append(buf, uint64(m.JoiningRequestID))
+	}
+	if m.isJoining() {
+		buf = varint.Append(buf, uint64(m.JoiningStart))
+	}
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	return buf
+}
+
+func (m *Fetch) parse_v18(r messageReader) error {
+	var err error
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.FetchType, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	if m.isStandalone() {
+		var numTrackNamespace uint64
+		numTrackNamespace, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		m.TrackNamespace = make([][]byte, 0)
+		for range numTrackNamespace {
+			var length uint64
+			length, err = varint.Read(r)
+			if err != nil {
+				return err
+			}
+
+			var value []byte
+			value, err = readBytes(r, length)
+			if err != nil {
+				return err
+			}
+			m.TrackNamespace = append(m.TrackNamespace, value)
+		}
+	}
+
+	if m.isStandalone() {
+		var TrackNameLength uint64
+		TrackNameLength, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		m.TrackName, err = readBytes(r, TrackNameLength)
+		if err != nil {
+			return err
+		}
+	}
+
+	if m.isStandalone() {
+		if err = m.StartLocation.parse_v18(r); err != nil {
+			return err
+		}
+	}
+
+	if m.isStandalone() {
+		if err = m.EndLocation.parse_v18(r); err != nil {
+			return err
+		}
+	}
+
+	if m.isJoining() {
+		m.JoiningRequestID, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	if m.isJoining() {
+		m.JoiningStart, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/go_away_ctrl_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/go_away_ctrl_v18.go
new file mode 100644
index 000000000..2b80896a3
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/go_away_ctrl_v18.go
@@ -0,0 +1,42 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *GoAwayCtrl) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(len(m.NewSessionURI)))
+	buf = append(buf, []byte(m.NewSessionURI)...)
+	buf = varint.Append(buf, uint64(m.Timeout))
+	buf = varint.Append(buf, uint64(m.RequestID))
+	return buf
+}
+
+func (m *GoAwayCtrl) parse_v18(r messageReader) error {
+	var err error
+
+	var NewSessionURILength uint64
+	NewSessionURILength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var NewSessionURIBytes []byte
+	NewSessionURIBytes, err = readBytes(r, NewSessionURILength)
+	if err != nil {
+		return err
+	}
+	m.NewSessionURI = string(NewSessionURIBytes)
+
+	m.Timeout, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/go_away_req_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/go_away_req_v18.go
new file mode 100644
index 000000000..955537583
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/go_away_req_v18.go
@@ -0,0 +1,36 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *GoAwayReq) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(len(m.NewSessionURI)))
+	buf = append(buf, []byte(m.NewSessionURI)...)
+	buf = varint.Append(buf, uint64(m.Timeout))
+	return buf
+}
+
+func (m *GoAwayReq) parse_v18(r messageReader) error {
+	var err error
+
+	var NewSessionURILength uint64
+	NewSessionURILength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var NewSessionURIBytes []byte
+	NewSessionURIBytes, err = readBytes(r, NewSessionURILength)
+	if err != nil {
+		return err
+	}
+	m.NewSessionURI = string(NewSessionURIBytes)
+
+	m.Timeout, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/key_value_pair.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/key_value_pair.go
new file mode 100644
index 000000000..408288688
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/key_value_pair.go
@@ -0,0 +1,123 @@
+package wire
+
+import (
+	"errors"
+	"math"
+	"slices"
+
+	"github.com/mengelbart/moqtransport/varint"
+)
+
+// maxKeyValuePairValueLength is the largest value a pair may carry.
+const maxKeyValuePairValueLength = 1<<16 - 1
+
+var (
+	errKeyValuePairTypeOverflow = errors.New("key value pair type exceeds 2^64-1")
+	errKeyValuePairValueTooLong = errors.New("key value pair value exceeds 2^16-1 bytes")
+)
+
+type KeyValuePair struct {
+	Type   uint64
+	Bytes  []byte `proto:"tlv_bytes,if=hasBytes"`
+	Varint uint64 `proto:"varint,if=!hasBytes"`
+}
+
+// hasBytes reports whether the pair carries a byte string rather than a varint.
+func (p *KeyValuePair) hasBytes() bool {
+	return p.Type%2 == 1
+}
+
+func (p *KeyValuePair) validate() error {
+	if len(p.Bytes) > maxKeyValuePairValueLength {
+		return errKeyValuePairValueTooLong
+	}
+	return nil
+}
+
+func compareKeyValuePairs(a, b KeyValuePair) int {
+	if a.Type < b.Type {
+		return -1
+	}
+	if a.Type > b.Type {
+		return 1
+	}
+	return 0
+}
+
+// appendKeyValuePairs_v18 writes pairs without any outer framing, encoding each
+// type as a delta from the previous one. The pairs are sorted by type first,
+// because a delta encoding cannot express a decreasing sequence.
+func appendKeyValuePairs_v18(buf []byte, pairs []KeyValuePair) []byte {
+	if !slices.IsSortedFunc(pairs, compareKeyValuePairs) {
+		pairs = slices.Clone(pairs)
+		slices.SortStableFunc(pairs, compareKeyValuePairs)
+	}
+	prev := uint64(0)
+	for i := range pairs {
+		buf = varint.Append(buf, pairs[i].Type-prev)
+		buf = pairs[i].append_v18(buf)
+		prev = pairs[i].Type
+	}
+	return buf
+}
+
+func parseKeyValuePair_v18(r messageReader, prev uint64) (KeyValuePair, error) {
+	delta, err := varint.Read(r)
+	if err != nil {
+		return KeyValuePair{}, err
+	}
+	if delta > math.MaxUint64-prev {
+		return KeyValuePair{}, errKeyValuePairTypeOverflow
+	}
+	p := KeyValuePair{Type: prev + delta}
+	if err := p.parse_v18(r); err != nil {
+		return KeyValuePair{}, err
+	}
+	return p, p.validate()
+}
+
+// parseKeyValuePairsCount_v18 reads a count prefixed list of pairs.
+func parseKeyValuePairsCount_v18(r messageReader) ([]KeyValuePair, error) {
+	count, err := varint.Read(r)
+	if err != nil {
+		return nil, err
+	}
+	pairs := make([]KeyValuePair, 0)
+	prev := uint64(0)
+	for range count {
+		p, err := parseKeyValuePair_v18(r, prev)
+		if err != nil {
+			return nil, err
+		}
+		prev = p.Type
+		pairs = append(pairs, p)
+	}
+	return pairs, nil
+}
+
+// parseKeyValuePairsTLV_v18 reads a byte length prefixed block of pairs.
+func parseKeyValuePairsTLV_v18(r messageReader) ([]KeyValuePair, error) {
+	br, err := tlvReader(r)
+	if err != nil {
+		return nil, err
+	}
+	return parseKeyValuePairsRemaining_v18(br)
+}
+
+// parseKeyValuePairsRemaining_v18 reads pairs until the reader is exhausted.
+func parseKeyValuePairsRemaining_v18(r messageReader) ([]KeyValuePair, error) {
+	if r.remaining() < 0 {
+		return nil, errNoMessageLength
+	}
+	pairs := make([]KeyValuePair, 0)
+	prev := uint64(0)
+	for r.remaining() > 0 {
+		p, err := parseKeyValuePair_v18(r, prev)
+		if err != nil {
+			return nil, err
+		}
+		prev = p.Type
+		pairs = append(pairs, p)
+	}
+	return pairs, nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/key_value_pair_test.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/key_value_pair_test.go
new file mode 100644
index 000000000..163463ebf
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/key_value_pair_test.go
@@ -0,0 +1,238 @@
+package wire
+
+import (
+	"fmt"
+	"io"
+	"testing"
+
+	"github.com/mengelbart/moqtransport/varint"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAppendKeyValuePairs(t *testing.T) {
+	cases := []struct {
+		pairs  []KeyValuePair
+		buf    []byte
+		expect []byte
+	}{
+		{
+			pairs: []KeyValuePair{{
+				Type:  1,
+				Bytes: []byte(""),
+			}},
+			buf:    nil,
+			expect: []byte{0x01, 0x00},
+		},
+		{
+			pairs: []KeyValuePair{{
+				Type:  1,
+				Bytes: []byte("A"),
+			}},
+			buf:    nil,
+			expect: []byte{0x01, 0x01, 'A'},
+		},
+		{
+			pairs: []KeyValuePair{{
+				Type:  1,
+				Bytes: []byte("A"),
+			}},
+			buf:    []byte{0x01, 0x02},
+			expect: []byte{0x01, 0x02, 0x01, 0x01, 'A'},
+		},
+		{
+			pairs: []KeyValuePair{{
+				Type:   2,
+				Varint: uint64(1),
+			}},
+			buf:    nil,
+			expect: []byte{0x02, 0x01},
+		},
+		{
+			pairs: []KeyValuePair{{
+				Type:   MaxRequestIDParameterKey,
+				Varint: uint64(2),
+			}},
+			buf:    []byte{},
+			expect: []byte{0x02, 0x02},
+		},
+		{
+			pairs: []KeyValuePair{{
+				Type:   MaxRequestIDParameterKey,
+				Varint: uint64(3),
+			}},
+			buf:    []byte{0x01, 0x02},
+			expect: []byte{0x01, 0x02, 0x02, 0x03},
+		},
+		{
+			pairs: []KeyValuePair{
+				{Type: 2, Varint: 42},
+				{Type: 77, Bytes: []byte("A")},
+			},
+			buf:    nil,
+			expect: []byte{0x02, 0x2a, 0x4b, 0x01, 'A'},
+		},
+		{
+			pairs: []KeyValuePair{
+				{Type: 3, Bytes: []byte("A")},
+				{Type: 3, Bytes: []byte("B")},
+			},
+			buf:    nil,
+			expect: []byte{0x03, 0x01, 'A', 0x00, 0x01, 'B'},
+		},
+		{
+			pairs: []KeyValuePair{
+				{Type: 2, Varint: 42},
+				{Type: 1, Bytes: []byte("A")},
+			},
+			buf:    nil,
+			expect: []byte{0x01, 0x01, 'A', 0x01, 0x2a},
+		},
+	}
+	for i, tc := range cases {
+		t.Run(fmt.Sprintf("%v", i), func(t *testing.T) {
+			in := append([]KeyValuePair{}, tc.pairs...)
+			res := appendKeyValuePairs_v18(tc.buf, tc.pairs)
+			assert.Equal(t, tc.expect, res)
+			assert.Equal(t, in, tc.pairs, "input must not be reordered in place")
+		})
+	}
+}
+
+func TestParseKeyValuePair(t *testing.T) {
+	cases := []struct {
+		data     []byte
+		prev     uint64
+		expect   KeyValuePair
+		err      error
+		consumed int64
+	}{
+		{
+			data: []byte{byte(MaxRequestIDParameterKey), 0x01},
+			expect: KeyValuePair{
+				Type:   MaxRequestIDParameterKey,
+				Varint: uint64(1),
+			},
+			err:      nil,
+			consumed: 2,
+		},
+		{
+			data: append([]byte{byte(PathParameterKey), 11}, "/path/param"...),
+			expect: KeyValuePair{
+				Type:  1,
+				Bytes: []byte("/path/param"),
+			},
+			err:      nil,
+			consumed: 13,
+		},
+		{
+			data:     []byte{},
+			expect:   KeyValuePair{},
+			err:      io.ErrUnexpectedEOF,
+			consumed: 0,
+		},
+		{
+			data: []byte{0x05, 0x01, 0x00},
+			expect: KeyValuePair{
+				Type:  5,
+				Bytes: []byte{0x00},
+			},
+			err:      nil,
+			consumed: 3,
+		},
+		{
+			data: []byte{0x01, 0x01, 'A'},
+			expect: KeyValuePair{
+				Type:  PathParameterKey,
+				Bytes: []byte("A"),
+			},
+			err:      nil,
+			consumed: 3,
+		},
+		{
+			data:     []byte{0x01, 0x08, 'A'},
+			expect:   KeyValuePair{},
+			err:      io.ErrUnexpectedEOF,
+			consumed: 2,
+		},
+		{
+			data: []byte{0x01, 0x2a},
+			prev: 1,
+			expect: KeyValuePair{
+				Type:   2,
+				Varint: 42,
+			},
+			err:      nil,
+			consumed: 2,
+		},
+		{
+			data: []byte{0x00, 0x01, 'A'},
+			prev: 3,
+			expect: KeyValuePair{
+				Type:  3,
+				Bytes: []byte("A"),
+			},
+			err:      nil,
+			consumed: 3,
+		},
+		{
+			data:     varint.Append(nil, 2),
+			prev:     1<<64 - 1,
+			expect:   KeyValuePair{},
+			err:      errKeyValuePairTypeOverflow,
+			consumed: 1,
+		},
+	}
+	for i, tc := range cases {
+		t.Run(fmt.Sprintf("%v", i), func(t *testing.T) {
+			r := newTestBoundedReader(t, tc.data, int64(len(tc.data)))
+
+			res, err := parseKeyValuePair_v18(r, tc.prev)
+			assert.Equal(t, tc.expect, res)
+			assert.Equal(t, tc.consumed, int64(len(tc.data))-r.remaining())
+			if tc.err != nil {
+				assert.ErrorIs(t, err, tc.err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestParseKeyValuePairValueTooLong(t *testing.T) {
+	value := make([]byte, maxKeyValuePairValueLength+1)
+	data := varint.Append(nil, 1)
+	data = varint.Append(data, uint64(len(value)))
+	data = append(data, value...)
+
+	r := newTestBoundedReader(t, data, int64(len(data)))
+	_, err := parseKeyValuePair_v18(r, 0)
+	assert.ErrorIs(t, err, errKeyValuePairValueTooLong)
+}
+
+func TestParseKeyValuePairsAccumulatesTypes(t *testing.T) {
+	pairs := []KeyValuePair{
+		{Type: 2, Varint: 42},
+		{Type: 77, Bytes: []byte("A")},
+		{Type: 77, Bytes: []byte("B")},
+	}
+	buf := varint.Append(nil, uint64(len(pairs)))
+	buf = appendKeyValuePairs_v18(buf, pairs)
+
+	assert.Equal(t, []byte{
+		0x03,       // number of pairs
+		0x02, 0x2a, // type 2, varint 42
+		0x4b, 0x01, 'A', // delta 75, type 77, one byte
+		0x00, 0x01, 'B', // delta 0, type 77, one byte
+	}, buf)
+
+	r := newTestBoundedReader(t, buf, int64(len(buf)))
+	got, err := parseKeyValuePairsCount_v18(r)
+	require.NoError(t, err)
+	assert.Equal(t, pairs, got)
+}
+
+func TestParseKeyValuePairsRemainingNeedsLength(t *testing.T) {
+	_, err := parseKeyValuePairsRemaining_v18(&unboundedReader{})
+	assert.ErrorIs(t, err, errNoMessageLength)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/key_value_pair_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/key_value_pair_v18.go
new file mode 100644
index 000000000..7e4cd45bc
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/key_value_pair_v18.go
@@ -0,0 +1,42 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *KeyValuePair) append_v18(buf []byte) []byte {
+	if m.hasBytes() {
+		buf = varint.Append(buf, uint64(len(m.Bytes)))
+		buf = append(buf, m.Bytes...)
+	}
+	if !m.hasBytes() {
+		buf = varint.Append(buf, uint64(m.Varint))
+	}
+	return buf
+}
+
+func (m *KeyValuePair) parse_v18(r messageReader) error {
+	var err error
+
+	if m.hasBytes() {
+		var BytesLength uint64
+		BytesLength, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		m.Bytes, err = readBytes(r, BytesLength)
+		if err != nil {
+			return err
+		}
+	}
+
+	if !m.hasBytes() {
+		m.Varint, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/location.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/location.go
new file mode 100644
index 000000000..ca4b9129f
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/location.go
@@ -0,0 +1,6 @@
+package wire
+
+type Location struct {
+	Group  uint64 `proto:"varint"`
+	Object uint64 `proto:"varint"`
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/location_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/location_v18.go
new file mode 100644
index 000000000..5a8afe3d7
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/location_v18.go
@@ -0,0 +1,27 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *Location) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.Group))
+	buf = varint.Append(buf, uint64(m.Object))
+	return buf
+}
+
+func (m *Location) parse_v18(r messageReader) error {
+	var err error
+
+	m.Group, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.Object, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/namespace_done_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/namespace_done_v18.go
new file mode 100644
index 000000000..c07669fd0
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/namespace_done_v18.go
@@ -0,0 +1,42 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *NamespaceDone) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(len(m.TrackNamespaceSuffix)))
+	for _, v := range m.TrackNamespaceSuffix {
+		buf = varint.Append(buf, uint64(len(v)))
+		buf = append(buf, v...)
+	}
+	return buf
+}
+
+func (m *NamespaceDone) parse_v18(r messageReader) error {
+	var err error
+
+	var numTrackNamespaceSuffix uint64
+	numTrackNamespaceSuffix, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackNamespaceSuffix = make([][]byte, 0)
+	for range numTrackNamespaceSuffix {
+		var length uint64
+		length, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		var value []byte
+		value, err = readBytes(r, length)
+		if err != nil {
+			return err
+		}
+		m.TrackNamespaceSuffix = append(m.TrackNamespaceSuffix, value)
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/namespace_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/namespace_v18.go
new file mode 100644
index 000000000..a62ed523a
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/namespace_v18.go
@@ -0,0 +1,42 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *Namespace) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(len(m.TrackNamespaceSuffix)))
+	for _, v := range m.TrackNamespaceSuffix {
+		buf = varint.Append(buf, uint64(len(v)))
+		buf = append(buf, v...)
+	}
+	return buf
+}
+
+func (m *Namespace) parse_v18(r messageReader) error {
+	var err error
+
+	var numTrackNamespaceSuffix uint64
+	numTrackNamespaceSuffix, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackNamespaceSuffix = make([][]byte, 0)
+	for range numTrackNamespaceSuffix {
+		var length uint64
+		length, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		var value []byte
+		value, err = readBytes(r, length)
+		if err != nil {
+			return err
+		}
+		m.TrackNamespaceSuffix = append(m.TrackNamespaceSuffix, value)
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/padding_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/padding_v18.go
new file mode 100644
index 000000000..74057ea6f
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/padding_v18.go
@@ -0,0 +1,11 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+func (m *Padding) append_v18(buf []byte) []byte {
+	return buf
+}
+
+func (m *Padding) parse_v18(r messageReader) error {
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/parameters.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/parameters.go
new file mode 100644
index 000000000..819943e75
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/parameters.go
@@ -0,0 +1,7 @@
+package wire
+
+const (
+	PathParameterKey               = 0x01
+	MaxRequestIDParameterKey       = 0x02
+	AuthorizationTokenParameterKey = 0x03
+)
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/parser.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/parser.go
new file mode 100644
index 000000000..76b490d19
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/parser.go
@@ -0,0 +1,262 @@
+package wire
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/mengelbart/moqtransport/varint"
+)
+
+var errLengthMismatch = errors.New("length mismatch")
+
+type streamReader interface {
+	io.Reader
+	io.ByteReader
+}
+
+type StreamType uint8
+
+const (
+	StreamTypeControl StreamType = iota
+	StreamTypeRequest
+	StreamTypeData
+)
+
+// validator is implemented by messages with well formedness rules the wire
+// format alone cannot express.
+type validator interface {
+	validate() error
+}
+
+func parseMessage(m ControlMessage, r messageReader, version uint64) error {
+	switch version {
+	case 18:
+		if err := m.parse_v18(r); err != nil {
+			return err
+		}
+	default:
+		return fmt.Errorf("unsupported version: %d", version)
+	}
+	if v, ok := m.(validator); ok {
+		return v.validate()
+	}
+	return nil
+}
+
+type Parser struct {
+	bounded    *boundedReader
+	unbounded  *unboundedReader
+	version    uint64
+	streamType StreamType
+	objects    objectParser
+	closed     error
+}
+
+func NewParser(r io.Reader, version uint64, streamType StreamType) (*Parser, error) {
+	switch streamType {
+	case StreamTypeControl, StreamTypeRequest, StreamTypeData:
+	default:
+		return nil, fmt.Errorf("unknown stream type: %d", streamType)
+	}
+	reader := bufio.NewReader(r)
+	return &Parser{
+		bounded:    &boundedReader{reader: reader},
+		unbounded:  &unboundedReader{reader: reader},
+		version:    version,
+		streamType: streamType,
+		objects:    nil,
+	}, nil
+}
+
+func (p *Parser) Read() (ControlMessage, error) {
+	if p.closed != nil {
+		return nil, p.closed
+	}
+	p.unbounded.reset()
+
+	if p.objects != nil {
+		return p.objects.parse()
+	}
+	mt, err := varint.Read(p.unbounded)
+	if err != nil {
+		return nil, err
+	}
+	if p.streamType == StreamTypeData {
+		return p.readDataHeader(mt)
+	}
+
+	length, err := p.readLength()
+	if err != nil {
+		return nil, err
+	}
+
+	m, err := p.controlMessage(mt)
+	if err != nil {
+		return nil, err
+	}
+
+	p.bounded.reset(int64(length))
+	if err := parseMessage(m, p.bounded, p.version); err != nil {
+		return nil, err
+	}
+	// A message that under-reads its body would leave the rest of it in the
+	// stream and desync every message after it.
+	if p.bounded.remaining() != 0 {
+		if err := p.bounded.discard(); err != nil {
+			return nil, err
+		}
+		return nil, errLengthMismatch
+	}
+	return m, nil
+}
+
+func (p *Parser) readLength() (uint16, error) {
+	hi, err := p.unbounded.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	lo, err := p.unbounded.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	return uint16(hi)<<8 | uint16(lo), nil
+}
+
+func (p *Parser) controlMessage(mt uint64) (ControlMessage, error) {
+	switch p.streamType {
+	case StreamTypeControl:
+		switch ControlMessageType(mt) {
+		case ControlMessageTypeSetup:
+			return &Setup{}, nil
+		case ControlMessageTypeGoAway:
+			return &GoAwayCtrl{}, nil
+		}
+	case StreamTypeRequest:
+		switch ControlMessageType(mt) {
+		case ControlMessageTypeGoAway:
+			return &GoAwayReq{}, nil
+
+		case ControlMessageTypeFetch:
+			return &Fetch{}, nil
+		case ControlMessageTypeFetchOk:
+			return &FetchOk{}, nil
+
+		case ControlMessageTypeNamespace:
+			return &Namespace{}, nil
+		case ControlMessageTypeNamespaceDone:
+			return &NamespaceDone{}, nil
+
+		case ControlMessageTypePublish:
+			return &Publish{}, nil
+		case ControlMessageTypePublishBlocked:
+			return &PublishBlocked{}, nil
+		case ControlMessageTypePublishDone:
+			return &PublishDone{}, nil
+		case ControlMessageTypePublishNamespace:
+			return &PublishNamespace{}, nil
+		case ControlMessageTypePublishOk:
+			return &PublishOk{}, nil
+
+		case ControlMessageTypeRequestError:
+			return &RequestError{}, nil
+		case ControlMessageTypeRequestOk:
+			return &RequestOk{}, nil
+		case ControlMessageTypeRequestUpdate:
+			return &RequestUpdate{}, nil
+
+		case ControlMessageTypeSubscribe:
+			return &Subscribe{}, nil
+		case ControlMessageTypeSubscribeNamespace:
+			return &SubscribeNamespace{}, nil
+		case ControlMessageTypeSubscribeOk:
+			return &SubscribeOk{}, nil
+		case ControlMessageTypeSubscribeTracks:
+			return &SubscribeTracks{}, nil
+
+		case ControlMessageTypeTrackStatus:
+			return &TrackStatus{}, nil
+		}
+	default:
+		return nil, fmt.Errorf("stream type carries no control messages: %d", p.streamType)
+	}
+	return nil, fmt.Errorf("unknown control message type: %d", mt)
+}
+
+func (p *Parser) readDataHeader(mt uint64) (ControlMessage, error) {
+	switch ControlMessageType(mt) {
+	case ControlMessageTypeFetchHeader:
+		m := &FetchHeader{}
+		if err := parseMessage(m, p.unbounded, p.version); err != nil {
+			return nil, err
+		}
+		p.objects = &fetchObjectParser{
+			reader:  p.unbounded,
+			version: p.version,
+		}
+		return m, nil
+
+	case ControlMessageTypePadding:
+		m := &Padding{}
+		p.closed = fmt.Errorf("Read called on parser after %T, which starts no object sequence", m)
+		return m, nil
+
+	default:
+		m := &SubgroupHeader{
+			typ: mt,
+		}
+		if !m.validType() {
+			return nil, fmt.Errorf("unknown data stream type: %d", mt)
+		}
+		if err := parseMessage(m, p.unbounded, p.version); err != nil {
+			return nil, err
+		}
+		p.objects = &subgroupObjectParser{
+			reader:        p.unbounded,
+			version:       p.version,
+			hasProperties: m.Properties(),
+		}
+		return m, nil
+	}
+}
+
+// objectParser reads the objects that follow a data stream header.
+type objectParser interface {
+	parse() (ControlMessage, error)
+}
+
+type subgroupObjectParser struct {
+	reader        messageReader
+	version       uint64
+	hasProperties bool
+}
+
+func (p *subgroupObjectParser) parse() (ControlMessage, error) {
+	o := &SubgroupObject{
+		hasProperties: p.hasProperties,
+	}
+	if err := parseMessage(o, p.reader, p.version); err != nil {
+		return nil, err
+	}
+	return o, nil
+}
+
+type fetchObjectParser struct {
+	reader  messageReader
+	version uint64
+}
+
+func (p *fetchObjectParser) parse() (ControlMessage, error) {
+	flags, err := varint.Read(p.reader)
+	if err != nil {
+		return nil, err
+	}
+	o := &FetchObject{
+		flags: flags,
+	}
+	if err := parseMessage(o, p.reader, p.version); err != nil {
+		return nil, err
+	}
+	return o, nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_blocked_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_blocked_v18.go
new file mode 100644
index 000000000..c172e47d0
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_blocked_v18.go
@@ -0,0 +1,55 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *PublishBlocked) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(len(m.TrackNamespaceSuffix)))
+	for _, v := range m.TrackNamespaceSuffix {
+		buf = varint.Append(buf, uint64(len(v)))
+		buf = append(buf, v...)
+	}
+	buf = varint.Append(buf, uint64(len(m.TrackName)))
+	buf = append(buf, m.TrackName...)
+	return buf
+}
+
+func (m *PublishBlocked) parse_v18(r messageReader) error {
+	var err error
+
+	var numTrackNamespaceSuffix uint64
+	numTrackNamespaceSuffix, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackNamespaceSuffix = make([][]byte, 0)
+	for range numTrackNamespaceSuffix {
+		var length uint64
+		length, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		var value []byte
+		value, err = readBytes(r, length)
+		if err != nil {
+			return err
+		}
+		m.TrackNamespaceSuffix = append(m.TrackNamespaceSuffix, value)
+	}
+
+	var TrackNameLength uint64
+	TrackNameLength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackName, err = readBytes(r, TrackNameLength)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_done_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_done_v18.go
new file mode 100644
index 000000000..ac35a0bc1
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_done_v18.go
@@ -0,0 +1,42 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *PublishDone) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.StatusCode))
+	buf = varint.Append(buf, uint64(m.StreamCount))
+	buf = varint.Append(buf, uint64(len(m.ErrorReason)))
+	buf = append(buf, []byte(m.ErrorReason)...)
+	return buf
+}
+
+func (m *PublishDone) parse_v18(r messageReader) error {
+	var err error
+
+	m.StatusCode, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.StreamCount, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var ErrorReasonLength uint64
+	ErrorReasonLength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var ErrorReasonBytes []byte
+	ErrorReasonBytes, err = readBytes(r, ErrorReasonLength)
+	if err != nil {
+		return err
+	}
+	m.ErrorReason = string(ErrorReasonBytes)
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_namespace_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_namespace_v18.go
new file mode 100644
index 000000000..90211c876
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_namespace_v18.go
@@ -0,0 +1,55 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *PublishNamespace) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.RequestID))
+	buf = varint.Append(buf, uint64(len(m.TrackNamespace)))
+	for _, v := range m.TrackNamespace {
+		buf = varint.Append(buf, uint64(len(v)))
+		buf = append(buf, v...)
+	}
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	return buf
+}
+
+func (m *PublishNamespace) parse_v18(r messageReader) error {
+	var err error
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var numTrackNamespace uint64
+	numTrackNamespace, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackNamespace = make([][]byte, 0)
+	for range numTrackNamespace {
+		var length uint64
+		length, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		var value []byte
+		value, err = readBytes(r, length)
+		if err != nil {
+			return err
+		}
+		m.TrackNamespace = append(m.TrackNamespace, value)
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_ok_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_ok_v18.go
new file mode 100644
index 000000000..3b163309a
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_ok_v18.go
@@ -0,0 +1,28 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *PublishOk) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	buf = appendKeyValuePairs_v18(buf, m.Properties)
+	return buf
+}
+
+func (m *PublishOk) parse_v18(r messageReader) error {
+	var err error
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	m.Properties, err = parseKeyValuePairsRemaining_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_v18.go
new file mode 100644
index 000000000..da28514c2
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/publish_v18.go
@@ -0,0 +1,80 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *Publish) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.RequestID))
+	buf = varint.Append(buf, uint64(len(m.TrackNamespace)))
+	for _, v := range m.TrackNamespace {
+		buf = varint.Append(buf, uint64(len(v)))
+		buf = append(buf, v...)
+	}
+	buf = varint.Append(buf, uint64(len(m.TrackName)))
+	buf = append(buf, m.TrackName...)
+	buf = varint.Append(buf, uint64(m.TrackAlias))
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	buf = appendKeyValuePairs_v18(buf, m.Properties)
+	return buf
+}
+
+func (m *Publish) parse_v18(r messageReader) error {
+	var err error
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var numTrackNamespace uint64
+	numTrackNamespace, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackNamespace = make([][]byte, 0)
+	for range numTrackNamespace {
+		var length uint64
+		length, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		var value []byte
+		value, err = readBytes(r, length)
+		if err != nil {
+			return err
+		}
+		m.TrackNamespace = append(m.TrackNamespace, value)
+	}
+
+	var TrackNameLength uint64
+	TrackNameLength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackName, err = readBytes(r, TrackNameLength)
+	if err != nil {
+		return err
+	}
+
+	m.TrackAlias, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	m.Properties, err = parseKeyValuePairsRemaining_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/reader.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/reader.go
new file mode 100644
index 000000000..3f3d2b74b
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/reader.go
@@ -0,0 +1,181 @@
+package wire
+
+import (
+	"errors"
+	"io"
+
+	"github.com/mengelbart/moqtransport/varint"
+)
+
+var errNoMessageLength = errors.New("message is not length delimited")
+
+// messageReader reads the body of a single message.
+type messageReader interface {
+	io.Reader
+	io.ByteReader
+	remaining() int64
+}
+
+// boundedReader reads at most n bytes of a length delimited message body.
+// Running out of budget, or reaching the end of the underlying stream mid
+// message, is io.ErrUnexpectedEOF, so that io.EOF keeps meaning that a stream
+// ended between messages.
+type boundedReader struct {
+	reader streamReader
+	n      int64
+}
+
+func (r *boundedReader) reset(n int64) {
+	r.n = n
+}
+
+func (r *boundedReader) remaining() int64 {
+	return r.n
+}
+
+func (r *boundedReader) Read(buf []byte) (int, error) {
+	if len(buf) == 0 {
+		return 0, nil
+	}
+	if r.n <= 0 {
+		return 0, io.ErrUnexpectedEOF
+	}
+	if int64(len(buf)) > r.n {
+		buf = buf[:r.n]
+	}
+	n, err := r.reader.Read(buf)
+	r.n -= int64(n)
+	if errors.Is(err, io.EOF) {
+		err = io.ErrUnexpectedEOF
+	}
+	return n, err
+}
+
+func (r *boundedReader) ReadByte() (byte, error) {
+	if r.n <= 0 {
+		return 0, io.ErrUnexpectedEOF
+	}
+	b, err := r.reader.ReadByte()
+	if err != nil {
+		if errors.Is(err, io.EOF) {
+			err = io.ErrUnexpectedEOF
+		}
+		return 0, err
+	}
+	r.n--
+	return b, nil
+}
+
+func (r *boundedReader) discard() error {
+	var scratch [512]byte
+	for r.n > 0 {
+		buf := scratch[:]
+		if int64(len(buf)) > r.n {
+			buf = buf[:r.n]
+		}
+		n, err := io.ReadFull(r.reader, buf)
+		r.n -= int64(n)
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return io.ErrUnexpectedEOF
+			}
+			return err
+		}
+	}
+	return nil
+}
+
+// unboundedReader reads a message that is not length delimited. The stream
+// ending before the message starts is io.EOF, once the message has begun it is
+// io.ErrUnexpectedEOF.
+type unboundedReader struct {
+	reader  streamReader
+	started bool
+}
+
+func (r *unboundedReader) reset() {
+	r.started = false
+}
+
+func (r *unboundedReader) remaining() int64 {
+	return -1
+}
+
+func (r *unboundedReader) Read(buf []byte) (int, error) {
+	n, err := r.reader.Read(buf)
+	if n > 0 {
+		r.started = true
+	}
+	if errors.Is(err, io.EOF) && r.started {
+		err = io.ErrUnexpectedEOF
+	}
+	return n, err
+}
+
+func (r *unboundedReader) ReadByte() (byte, error) {
+	b, err := r.reader.ReadByte()
+	if err != nil {
+		if errors.Is(err, io.EOF) && r.started {
+			err = io.ErrUnexpectedEOF
+		}
+		return 0, err
+	}
+	r.started = true
+	return b, nil
+}
+
+// readBytes reads n bytes. A length delimited message bounds the allocation by
+// its remaining budget, otherwise the buffer grows in capped chunks so that a
+// bogus length allocates only what actually arrives.
+func readBytes(r messageReader, n uint64) ([]byte, error) {
+	// Bound allocations even on non-length-delimited subgroup streams.
+	if n > 1024*1024 {
+		return nil, errors.New("wire field exceeds size limit")
+	}
+	if n == 0 {
+		return nil, nil
+	}
+	if rem := r.remaining(); rem >= 0 {
+		if n > uint64(rem) {
+			return nil, io.ErrUnexpectedEOF
+		}
+		buf := make([]byte, n)
+		if _, err := io.ReadFull(r, buf); err != nil {
+			return nil, err
+		}
+		return buf, nil
+	}
+
+	const chunk = 4096
+	buf := make([]byte, 0, min(n, chunk))
+	for uint64(len(buf)) < n {
+		want := min(n-uint64(len(buf)), chunk)
+		buf = append(buf, make([]byte, want)...)
+		if _, err := io.ReadFull(r, buf[uint64(len(buf))-want:]); err != nil {
+			return nil, err
+		}
+	}
+	return buf, nil
+}
+
+// tlvReader reads a byte length and returns a reader bounded to it, for a block
+// that is length delimited inside a message.
+func tlvReader(r messageReader) (*boundedReader, error) {
+	n, err := varint.Read(r)
+	if err != nil {
+		return nil, err
+	}
+	if rem := r.remaining(); rem >= 0 && n > uint64(rem) {
+		return nil, io.ErrUnexpectedEOF
+	}
+	return &boundedReader{reader: r, n: int64(n)}, nil
+}
+
+// readRemaining reads the rest of a length delimited message body.
+func readRemaining(r messageReader) ([]byte, error) {
+	n := r.remaining()
+	if n < 0 {
+		return nil, errNoMessageLength
+	}
+	return readBytes(r, uint64(n))
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/reader_test.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/reader_test.go
new file mode 100644
index 000000000..c93264474
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/reader_test.go
@@ -0,0 +1,149 @@
+package wire
+
+import (
+	"bufio"
+	"bytes"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newTestBoundedReader(t *testing.T, data []byte, n int64) *boundedReader {
+	t.Helper()
+	r := &boundedReader{reader: bufio.NewReader(bytes.NewReader(data))}
+	r.reset(n)
+	return r
+}
+
+func TestBoundedReaderBudget(t *testing.T) {
+	r := newTestBoundedReader(t, []byte("abcdef"), 3)
+
+	for _, want := range []byte("abc") {
+		b, err := r.ReadByte()
+		require.NoError(t, err)
+		assert.Equal(t, want, b)
+	}
+	assert.Equal(t, int64(0), r.remaining())
+
+	_, err := r.ReadByte()
+	assert.ErrorIs(t, err, io.ErrUnexpectedEOF)
+}
+
+func TestOversizedFieldRejectedBeforeReadingOrAllocating(t *testing.T) {
+	value, err := readBytes(nil, 1<<40)
+	require.Error(t, err)
+	require.Nil(t, value)
+}
+
+func TestBoundedReaderReadTruncatesToBudget(t *testing.T) {
+	r := newTestBoundedReader(t, []byte("abcdef"), 2)
+
+	buf := make([]byte, 6)
+	n, err := r.Read(buf)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("ab"), buf[:n])
+	assert.Equal(t, int64(0), r.remaining())
+}
+
+func TestBoundedReaderShortStreamIsUnexpectedEOF(t *testing.T) {
+	t.Run("ReadByte", func(t *testing.T) {
+		r := newTestBoundedReader(t, []byte("ab"), 5)
+		for range 2 {
+			_, err := r.ReadByte()
+			require.NoError(t, err)
+		}
+		_, err := r.ReadByte()
+		assert.ErrorIs(t, err, io.ErrUnexpectedEOF)
+	})
+
+	t.Run("Read", func(t *testing.T) {
+		r := newTestBoundedReader(t, []byte("ab"), 5)
+		_, err := io.ReadFull(r, make([]byte, 5))
+		assert.ErrorIs(t, err, io.ErrUnexpectedEOF)
+	})
+}
+
+func TestBoundedReaderDiscard(t *testing.T) {
+	underlying := bufio.NewReader(bytes.NewReader([]byte("abcdef")))
+	r := &boundedReader{reader: underlying}
+	r.reset(4)
+
+	_, err := r.ReadByte()
+	require.NoError(t, err)
+	require.NoError(t, r.discard())
+	assert.Equal(t, int64(0), r.remaining())
+
+	// The bytes after the message body are still there for the next read.
+	rest, err := io.ReadAll(underlying)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("ef"), rest)
+}
+
+func TestBoundedReaderDiscardShortStream(t *testing.T) {
+	r := newTestBoundedReader(t, []byte("ab"), 5)
+	assert.ErrorIs(t, r.discard(), io.ErrUnexpectedEOF)
+}
+
+func TestUnboundedReaderEOFOnlyBeforeTheMessage(t *testing.T) {
+	newReader := func(data []byte) *unboundedReader {
+		return &unboundedReader{reader: bufio.NewReader(bytes.NewReader(data))}
+	}
+
+	assert.Equal(t, int64(-1), newReader(nil).remaining())
+
+	t.Run("nothing read is a clean end", func(t *testing.T) {
+		_, err := newReader(nil).ReadByte()
+		assert.ErrorIs(t, err, io.EOF)
+	})
+
+	t.Run("ending after a byte is unexpected", func(t *testing.T) {
+		r := newReader([]byte("a"))
+		_, err := r.ReadByte()
+		require.NoError(t, err)
+
+		_, err = r.ReadByte()
+		assert.ErrorIs(t, err, io.ErrUnexpectedEOF)
+	})
+
+	t.Run("reset starts a new message", func(t *testing.T) {
+		r := newReader([]byte("a"))
+		_, err := r.ReadByte()
+		require.NoError(t, err)
+
+		r.reset()
+		_, err = r.ReadByte()
+		assert.ErrorIs(t, err, io.EOF)
+	})
+}
+
+func TestReadBytes(t *testing.T) {
+	t.Run("bounded", func(t *testing.T) {
+		r := newTestBoundedReader(t, []byte("abcdef"), 4)
+		buf, err := readBytes(r, 3)
+		require.NoError(t, err)
+		assert.Equal(t, []byte("abc"), buf)
+		assert.Equal(t, int64(1), r.remaining())
+	})
+
+	t.Run("longer than the budget", func(t *testing.T) {
+		r := newTestBoundedReader(t, []byte("abcdef"), 2)
+		_, err := readBytes(r, 3)
+		assert.ErrorIs(t, err, io.ErrUnexpectedEOF)
+	})
+
+	t.Run("unbounded", func(t *testing.T) {
+		r := &unboundedReader{reader: bufio.NewReader(bytes.NewReader([]byte("abcdef")))}
+		buf, err := readBytes(r, 3)
+		require.NoError(t, err)
+		assert.Equal(t, []byte("abc"), buf)
+	})
+
+	// A length no stream could deliver must not be allocated up front.
+	t.Run("unbounded bogus length", func(t *testing.T) {
+		r := &unboundedReader{reader: bufio.NewReader(bytes.NewReader([]byte("abcdef")))}
+		_, err := readBytes(r, 1<<60)
+		assert.Error(t, err)
+	})
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/request_error_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/request_error_v18.go
new file mode 100644
index 000000000..d0771e74d
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/request_error_v18.go
@@ -0,0 +1,42 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *RequestError) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.ErrorCode))
+	buf = varint.Append(buf, uint64(m.RetryInterval))
+	buf = varint.Append(buf, uint64(len(m.ErrorReason)))
+	buf = append(buf, []byte(m.ErrorReason)...)
+	return buf
+}
+
+func (m *RequestError) parse_v18(r messageReader) error {
+	var err error
+
+	m.ErrorCode, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.RetryInterval, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var ErrorReasonLength uint64
+	ErrorReasonLength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var ErrorReasonBytes []byte
+	ErrorReasonBytes, err = readBytes(r, ErrorReasonLength)
+	if err != nil {
+		return err
+	}
+	m.ErrorReason = string(ErrorReasonBytes)
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/request_ok_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/request_ok_v18.go
new file mode 100644
index 000000000..b4fe2137a
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/request_ok_v18.go
@@ -0,0 +1,28 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *RequestOk) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	buf = appendKeyValuePairs_v18(buf, m.Properties)
+	return buf
+}
+
+func (m *RequestOk) parse_v18(r messageReader) error {
+	var err error
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	m.Properties, err = parseKeyValuePairsRemaining_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/request_update_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/request_update_v18.go
new file mode 100644
index 000000000..53e2245b2
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/request_update_v18.go
@@ -0,0 +1,28 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *RequestUpdate) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.RequestID))
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	return buf
+}
+
+func (m *RequestUpdate) parse_v18(r messageReader) error {
+	var err error
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/roundtrip_test.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/roundtrip_test.go
new file mode 100644
index 000000000..ff9694935
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/roundtrip_test.go
@@ -0,0 +1,246 @@
+package wire
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"testing"
+
+	"github.com/mengelbart/moqtransport/varint"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func kvps() []KeyValuePair {
+	return []KeyValuePair{
+		{Type: 2, Varint: 4200},
+		{Type: 3, Bytes: []byte("value")},
+	}
+}
+
+func roundTripCases() []struct {
+	name       string
+	streamType StreamType
+	msg        ControlMessage
+} {
+	return []struct {
+		name       string
+		streamType StreamType
+		msg        ControlMessage
+	}{
+		{"Setup", StreamTypeControl, &Setup{Options: kvps()}},
+		{"GoAwayCtrl", StreamTypeControl, &GoAwayCtrl{NewSessionURI: "moqt://example", Timeout: 17, RequestID: 3}},
+
+		{"GoAwayReq", StreamTypeRequest, &GoAwayReq{NewSessionURI: "moqt://example", Timeout: 17}},
+		{"Subscribe", StreamTypeRequest, &Subscribe{
+			RequestID:      7,
+			TrackNamespace: [][]byte{[]byte("ns"), []byte("sub")},
+			TrackName:      []byte("track"),
+			Parameters:     kvps(),
+		}},
+		{"SubscribeOk", StreamTypeRequest, &SubscribeOk{TrackAlias: 9, Parameters: kvps(), Properties: kvps()}},
+		{"Publish", StreamTypeRequest, &Publish{
+			RequestID:      7,
+			TrackNamespace: [][]byte{[]byte("ns")},
+			TrackName:      []byte("track"),
+			TrackAlias:     9,
+			Parameters:     kvps(),
+			Properties:     kvps(),
+		}},
+		{"PublishOk", StreamTypeRequest, &PublishOk{Parameters: kvps(), Properties: kvps()}},
+		{"PublishDone", StreamTypeRequest, &PublishDone{StatusCode: 2, StreamCount: 11, ErrorReason: "done"}},
+		{"FetchStandalone", StreamTypeRequest, &Fetch{
+			RequestID:      7,
+			FetchType:      FetchTypeStandalone,
+			TrackNamespace: [][]byte{[]byte("ns"), []byte("sub")},
+			TrackName:      []byte("track"),
+			StartLocation:  Location{Group: 1, Object: 2},
+			EndLocation:    Location{Group: 3, Object: 4},
+			Parameters:     kvps(),
+		}},
+		{"FetchRelativeJoining", StreamTypeRequest, &Fetch{
+			RequestID:        7,
+			FetchType:        FetchTypeRelativeJoining,
+			JoiningRequestID: 3,
+			JoiningStart:     2,
+			Parameters:       kvps(),
+		}},
+		{"FetchAbsoluteJoining", StreamTypeRequest, &Fetch{
+			RequestID:        7,
+			FetchType:        FetchTypeAbsoluteJoining,
+			JoiningRequestID: 3,
+			JoiningStart:     9,
+			Parameters:       kvps(),
+		}},
+		{"FetchOk", StreamTypeRequest, &FetchOk{
+			EndOfTrack:  true,
+			EndLocation: Location{Group: 4, Object: 5},
+			Parameters:  kvps(),
+			Properties:  kvps(),
+		}},
+		{"TrackStatus", StreamTypeRequest, &TrackStatus{
+			RequestID:      7,
+			TrackNamespace: [][]byte{[]byte("ns")},
+			TrackName:      []byte("track"),
+			Parameters:     kvps(),
+		}},
+		{"PublishNamespace", StreamTypeRequest, &PublishNamespace{
+			RequestID:      7,
+			TrackNamespace: [][]byte{[]byte("ns")},
+			Parameters:     kvps(),
+		}},
+		{"SubscribeNamespace", StreamTypeRequest, &SubscribeNamespace{
+			RequestID:            7,
+			TrackNamespacePrefix: [][]byte{[]byte("ns")},
+			Parameters:           kvps(),
+		}},
+		{"SubscribeTracks", StreamTypeRequest, &SubscribeTracks{
+			RequestID:            7,
+			TrackNamespacePrefix: [][]byte{[]byte("ns")},
+			Parameters:           kvps(),
+		}},
+		{"Namespace", StreamTypeRequest, &Namespace{TrackNamespaceSuffix: [][]byte{[]byte("a"), []byte("b")}}},
+		{"NamespaceDone", StreamTypeRequest, &NamespaceDone{TrackNamespaceSuffix: [][]byte{[]byte("a")}}},
+		{"PublishBlocked", StreamTypeRequest, &PublishBlocked{
+			TrackNamespaceSuffix: [][]byte{[]byte("a")},
+			TrackName:            []byte("track"),
+		}},
+		{"RequestUpdate", StreamTypeRequest, &RequestUpdate{RequestID: 7, Parameters: kvps()}},
+		{"RequestOk", StreamTypeRequest, &RequestOk{Parameters: kvps(), Properties: kvps()}},
+		{"RequestError", StreamTypeRequest, &RequestError{ErrorCode: 3, RetryInterval: 8, ErrorReason: "nope"}},
+
+		{"FetchHeader", StreamTypeData, &FetchHeader{RequestID: 42}},
+		{"Padding", StreamTypeData, &Padding{}},
+		{"SubgroupHeader", StreamTypeData, NewSubgroupHeader(4, 7, 9, 200)},
+	}
+}
+
+func encode(t *testing.T, msg ControlMessage) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	require.NoError(t, NewAppender(&buf, 18).Write(msg))
+	return buf.Bytes()
+}
+
+func mustParser(t *testing.T, r io.Reader, version uint64, streamType StreamType) *Parser {
+	t.Helper()
+	p, err := NewParser(r, version, streamType)
+	require.NoError(t, err)
+	return p
+}
+
+func TestMessageRoundTrip(t *testing.T) {
+	for _, tc := range roundTripCases() {
+		t.Run(tc.name, func(t *testing.T) {
+			encoded := encode(t, tc.msg)
+
+			got, err := mustParser(t, bytes.NewReader(encoded), 18, tc.streamType).Read()
+			require.NoError(t, err)
+			assert.Equal(t, tc.msg, got)
+		})
+	}
+}
+
+func deltaPairs() []KeyValuePair {
+	return []KeyValuePair{
+		{Type: 2, Varint: 4200},
+		{Type: 77, Bytes: []byte("value")},
+		{Type: 77, Bytes: []byte("other")},
+	}
+}
+
+// deltaPairBytes is the delta encoding of deltaPairs, without any framing.
+var deltaPairBytes = []byte{
+	0x02, 0x90, 0x68, // delta 2, type 2: varint 4200
+	0x4b, 0x05, 'v', 'a', 'l', 'u', 'e', // delta 75, type 77: five bytes
+	0x00, 0x05, 'o', 't', 'h', 'e', 'r', // delta 0, type 77: five bytes
+}
+
+func TestSetupOptionsBytes(t *testing.T) {
+	msg := &Setup{Options: deltaPairs()}
+
+	assert.Equal(t, deltaPairBytes, msg.append_v18(nil))
+
+	got, err := mustParser(t, bytes.NewReader(encode(t, msg)), 18, StreamTypeControl).Read()
+	require.NoError(t, err)
+	assert.Equal(t, msg, got)
+}
+
+func TestParameterListBytes(t *testing.T) {
+	msg := &RequestUpdate{RequestID: 7, Parameters: deltaPairs()}
+
+	want := []byte{0x07, 0x03} // request ID, number of parameters
+	want = append(want, deltaPairBytes...)
+	assert.Equal(t, want, msg.append_v18(nil))
+
+	got, err := mustParser(t, bytes.NewReader(encode(t, msg)), 18, StreamTypeRequest).Read()
+	require.NoError(t, err)
+	assert.Equal(t, msg, got)
+}
+
+// TestMessageTruncated cuts every encoding at every prefix. io.EOF means only
+// that no byte of a message was read, so it is expected at offset 0 and nowhere
+// else: once a message has begun, ending early is io.ErrUnexpectedEOF.
+func TestMessageTruncated(t *testing.T) {
+	for _, tc := range roundTripCases() {
+		t.Run(tc.name, func(t *testing.T) {
+			encoded := encode(t, tc.msg)
+			for i := range encoded {
+				want := io.ErrUnexpectedEOF
+				if i == 0 {
+					want = io.EOF
+				}
+				_, err := mustParser(t, bytes.NewReader(encoded[:i]), 18, tc.streamType).Read()
+				assert.ErrorIs(t, err, want, fmt.Sprintf("truncated to %v of %v bytes", i, len(encoded)))
+			}
+		})
+	}
+}
+
+// TestParseBodyLongerThanMessage rejects a body the parser under-reads, whose
+// leftover bytes would otherwise stay in the stream and desync every message
+// after it.
+func TestParseBodyLongerThanMessage(t *testing.T) {
+	msg := &GoAwayReq{NewSessionURI: "moqt://example", Timeout: 17}
+	body := msg.append_v18(nil)
+
+	encoded := varint.Append(nil, uint64(msg.Type()))
+	encoded = append(encoded, byte((len(body)+1)>>8), byte(len(body)+1))
+	encoded = append(encoded, body...)
+	encoded = append(encoded, 0xff)
+
+	_, err := mustParser(t, bytes.NewReader(encoded), 18, StreamTypeRequest).Read()
+	assert.ErrorIs(t, err, errLengthMismatch)
+}
+
+// TestParseFetchUnknownType covers the one conditional whose discriminator is a
+// field of the message rather than a bit of the type varint: an unknown fetch
+// type carries neither structure, and must not be read as if it carried the
+// standalone one.
+func TestParseFetchUnknownType(t *testing.T) {
+	standalone := &Fetch{
+		RequestID:      7,
+		FetchType:      FetchTypeStandalone,
+		TrackNamespace: [][]byte{[]byte("ns")},
+		TrackName:      []byte("track"),
+		StartLocation:  Location{Group: 1, Object: 2},
+		EndLocation:    Location{Group: 3, Object: 4},
+		Parameters:     kvps(),
+	}
+	encoded := encode(t, standalone)
+
+	// Rewrite the fetch type in place. It is the second varint of the body,
+	// after the one byte request ID.
+	body := len(varint.Append(nil, uint64(standalone.Type()))) + 2
+	require.Equal(t, byte(FetchTypeStandalone), encoded[body+1])
+	encoded[body+1] = 0x04
+
+	_, err := mustParser(t, bytes.NewReader(encoded), 18, StreamTypeRequest).Read()
+	assert.Error(t, err)
+}
+
+func TestNewParserRejectsUnknownStreamType(t *testing.T) {
+	_, err := NewParser(bytes.NewReader(nil), 18, StreamType(7))
+	assert.Error(t, err)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/setup_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/setup_v18.go
new file mode 100644
index 000000000..e502b89c9
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/setup_v18.go
@@ -0,0 +1,19 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+func (m *Setup) append_v18(buf []byte) []byte {
+	buf = appendKeyValuePairs_v18(buf, m.Options)
+	return buf
+}
+
+func (m *Setup) parse_v18(r messageReader) error {
+	var err error
+
+	m.Options, err = parseKeyValuePairsRemaining_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_header.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_header.go
new file mode 100644
index 000000000..efd31333d
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_header.go
@@ -0,0 +1,126 @@
+package wire
+
+import "fmt"
+
+func setBit(x uint64, bit uint, v bool) uint64 {
+	if v {
+		return x | (1 << bit)
+	}
+	return x & ^(1 << bit)
+}
+
+func getBit(x uint64, bit uint) bool {
+	return (x & (1 << bit)) != 0
+}
+
+// Bit positions of the flags in the subgroup header type.
+const (
+	subgroupBitProperties      uint = 0
+	subgroupBitSubgroupIDMode  uint = 1 // two bits wide
+	subgroupBitEndOfGroup      uint = 3
+	subgroupBitDefaultPriority uint = 5
+	subgroupBitFirstObject     uint = 6
+
+	subgroupIDModeMask uint64 = 0b0000_0110
+
+	// Subgroup header types take the form 0b0XX1XXXX and fit in a single byte.
+	subgroupTypeFormMask uint64 = 0b1001_0000
+	subgroupTypeForm     uint64 = 0b0001_0000
+	subgroupTypeMax      uint64 = 0xff
+)
+
+// Modes of the two bit SUBGROUP_ID_MODE field of the subgroup header type.
+const (
+	// SubgroupIDModeZero omits the subgroup ID from the header, it is 0.
+	SubgroupIDModeZero uint8 = 0
+	// SubgroupIDModeFirstObject omits the subgroup ID from the header, it is the
+	// object ID of the first object on the stream.
+	SubgroupIDModeFirstObject uint8 = 1
+	// SubgroupIDModeExplicit carries the subgroup ID in the header.
+	SubgroupIDModeExplicit uint8 = 2
+	// SubgroupIDModeReserved is reserved for future use and invalid on the wire.
+	SubgroupIDModeReserved uint8 = 3
+)
+
+type SubgroupHeader struct {
+	typ               uint64
+	TrackAlias        uint64 `proto:"varint"`
+	GroupID           uint64 `proto:"varint"`
+	SubgroupID        uint64 `proto:"varint,if=explicitSubgroupID"`
+	PublisherPriority uint8  `proto:"byte,if=!DefaultPriority"`
+}
+
+func NewSubgroupHeader(trackAlias, groupID, subgroupID uint64, publisherPriority uint8) *SubgroupHeader {
+	m := &SubgroupHeader{
+		typ:               subgroupTypeForm,
+		TrackAlias:        trackAlias,
+		GroupID:           groupID,
+		SubgroupID:        subgroupID,
+		PublisherPriority: publisherPriority,
+	}
+	m.SetSubgroupIDMode(SubgroupIDModeExplicit)
+	return m
+}
+
+func (m *SubgroupHeader) Type() ControlMessageType {
+	return ControlMessageType(m.typ)
+}
+
+func (m *SubgroupHeader) validType() bool {
+	if m.typ > subgroupTypeMax {
+		return false
+	}
+	if m.typ&subgroupTypeFormMask != subgroupTypeForm {
+		return false
+	}
+	return m.SubgroupIDMode() != SubgroupIDModeReserved
+}
+
+func (m *SubgroupHeader) Properties() bool {
+	return getBit(m.typ, subgroupBitProperties)
+}
+
+func (m *SubgroupHeader) SetProperties(v bool) {
+	m.typ = setBit(m.typ, subgroupBitProperties, v)
+}
+
+func (m *SubgroupHeader) explicitSubgroupID() bool {
+	return m.SubgroupIDMode() == SubgroupIDModeExplicit
+}
+
+func (m *SubgroupHeader) SubgroupIDMode() uint8 {
+	return uint8((m.typ & subgroupIDModeMask) >> subgroupBitSubgroupIDMode)
+}
+
+func (m *SubgroupHeader) SetSubgroupIDMode(v uint8) {
+	switch v {
+	case SubgroupIDModeZero, SubgroupIDModeFirstObject, SubgroupIDModeExplicit:
+		m.typ = m.typ&^subgroupIDModeMask | uint64(v)<<subgroupBitSubgroupIDMode
+	default:
+		panic(fmt.Sprintf("invalid subgroup id mode: %d", v))
+	}
+}
+
+func (m *SubgroupHeader) EndOfGroup() bool {
+	return getBit(m.typ, subgroupBitEndOfGroup)
+}
+
+func (m *SubgroupHeader) SetEndOfGroup(v bool) {
+	m.typ = setBit(m.typ, subgroupBitEndOfGroup, v)
+}
+
+func (m *SubgroupHeader) DefaultPriority() bool {
+	return getBit(m.typ, subgroupBitDefaultPriority)
+}
+
+func (m *SubgroupHeader) SetDefaultPriority(v bool) {
+	m.typ = setBit(m.typ, subgroupBitDefaultPriority, v)
+}
+
+func (m *SubgroupHeader) FirstBit() bool {
+	return getBit(m.typ, subgroupBitFirstObject)
+}
+
+func (m *SubgroupHeader) SetFirstBit(v bool) {
+	m.typ = setBit(m.typ, subgroupBitFirstObject, v)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_header_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_header_v18.go
new file mode 100644
index 000000000..59a6a78c8
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_header_v18.go
@@ -0,0 +1,47 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *SubgroupHeader) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.TrackAlias))
+	buf = varint.Append(buf, uint64(m.GroupID))
+	if m.explicitSubgroupID() {
+		buf = varint.Append(buf, uint64(m.SubgroupID))
+	}
+	if !m.DefaultPriority() {
+		buf = append(buf, m.PublisherPriority)
+	}
+	return buf
+}
+
+func (m *SubgroupHeader) parse_v18(r messageReader) error {
+	var err error
+
+	m.TrackAlias, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.GroupID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	if m.explicitSubgroupID() {
+		m.SubgroupID, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	if !m.DefaultPriority() {
+		m.PublisherPriority, err = r.ReadByte()
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_object.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_object.go
new file mode 100644
index 000000000..f95683653
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_object.go
@@ -0,0 +1,26 @@
+package wire
+
+type SubgroupObject struct {
+	hasProperties bool
+
+	ObjectIDDelta uint64         `proto:"varint"`
+	Properties    []KeyValuePair `proto:"kvp_list_tlv,if=HasProperties"`
+	ObjectPayload []byte         `proto:"tlv_bytes"`
+	ObjectStatus  uint64         `proto:"varint,if=EmptyPayload"`
+}
+
+func (m *SubgroupObject) Type() ControlMessageType {
+	return 0
+}
+
+func (m *SubgroupObject) HasProperties() bool {
+	return m.hasProperties
+}
+
+func (m *SubgroupObject) SetHasProperties(v bool) {
+	m.hasProperties = v
+}
+
+func (m *SubgroupObject) EmptyPayload() bool {
+	return len(m.ObjectPayload) == 0
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_object_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_object_v18.go
new file mode 100644
index 000000000..75eecc6e0
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_object_v18.go
@@ -0,0 +1,56 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *SubgroupObject) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.ObjectIDDelta))
+	if m.HasProperties() {
+		PropertiesBuf := appendKeyValuePairs_v18(nil, m.Properties)
+		buf = varint.Append(buf, uint64(len(PropertiesBuf)))
+		buf = append(buf, PropertiesBuf...)
+	}
+	buf = varint.Append(buf, uint64(len(m.ObjectPayload)))
+	buf = append(buf, m.ObjectPayload...)
+	if m.EmptyPayload() {
+		buf = varint.Append(buf, uint64(m.ObjectStatus))
+	}
+	return buf
+}
+
+func (m *SubgroupObject) parse_v18(r messageReader) error {
+	var err error
+
+	m.ObjectIDDelta, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	if m.HasProperties() {
+		m.Properties, err = parseKeyValuePairsTLV_v18(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	var ObjectPayloadLength uint64
+	ObjectPayloadLength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.ObjectPayload, err = readBytes(r, ObjectPayloadLength)
+	if err != nil {
+		return err
+	}
+
+	if m.EmptyPayload() {
+		m.ObjectStatus, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_stream_test.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_stream_test.go
new file mode 100644
index 000000000..1f011422a
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/subgroup_stream_test.go
@@ -0,0 +1,207 @@
+package wire
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"github.com/mengelbart/moqtransport/varint"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSubgroupStreamBytes(t *testing.T) {
+	var buf bytes.Buffer
+	appender := NewAppender(&buf, 18)
+
+	require.NoError(t, appender.Write(NewSubgroupHeader(4, 7, 9, 200)))
+	require.NoError(t, appender.Write(&SubgroupObject{ObjectIDDelta: 0, ObjectPayload: []byte("ab")}))
+	require.NoError(t, appender.Write(&SubgroupObject{ObjectIDDelta: 3, ObjectPayload: []byte("c")}))
+
+	assert.Equal(t, []byte{
+		0x14, // type: bit 4 set, subgroup ID mode 0b10
+		0x04, // track alias
+		0x07, // group ID
+		0x09, // subgroup ID
+		200,  // publisher priority
+		0x00, 0x02, 'a', 'b',
+		0x03, 0x01, 'c',
+	}, buf.Bytes())
+}
+
+func TestSubgroupStreamRoundTrip(t *testing.T) {
+	var buf bytes.Buffer
+	appender := NewAppender(&buf, 18)
+
+	header := NewSubgroupHeader(4, 7, 9, 200)
+	require.NoError(t, appender.Write(header))
+
+	objects := []*SubgroupObject{
+		{ObjectIDDelta: 0, ObjectPayload: []byte("hello")},
+		{ObjectIDDelta: 3, ObjectPayload: []byte("world")},
+		{ObjectIDDelta: 0, ObjectStatus: 3},
+	}
+	for _, o := range objects {
+		require.NoError(t, appender.Write(o))
+	}
+
+	parser := mustParser(t, &buf, 18, StreamTypeData)
+
+	msg, err := parser.Read()
+	require.NoError(t, err)
+	assert.Equal(t, header, msg)
+
+	for _, want := range objects {
+		msg, err := parser.Read()
+		require.NoError(t, err)
+		assert.Equal(t, want, msg)
+	}
+}
+
+func TestSubgroupStreamDefaultPriority(t *testing.T) {
+	var buf bytes.Buffer
+
+	header := NewSubgroupHeader(4, 7, 9, 200)
+	header.SetDefaultPriority(true)
+	require.NoError(t, NewAppender(&buf, 18).Write(header))
+
+	assert.Equal(t, []byte{0x34, 0x04, 0x07, 0x09}, buf.Bytes())
+
+	msg, err := mustParser(t, &buf, 18, StreamTypeData).Read()
+	require.NoError(t, err)
+	assert.Equal(t, &SubgroupHeader{typ: 0x34, TrackAlias: 4, GroupID: 7, SubgroupID: 9}, msg)
+}
+
+func TestFetchHeaderRoundTrip(t *testing.T) {
+	var buf bytes.Buffer
+	require.NoError(t, NewAppender(&buf, 18).Write(&FetchHeader{RequestID: 42}))
+
+	assert.Equal(t, []byte{0x05, 0x2a}, buf.Bytes())
+
+	msg, err := mustParser(t, &buf, 18, StreamTypeData).Read()
+	require.NoError(t, err)
+	assert.Equal(t, &FetchHeader{RequestID: 42}, msg)
+}
+
+func TestParseInvalidDataStreamType(t *testing.T) {
+	cases := map[string]uint64{
+		"reserved subgroup id mode": 0x16,
+		"bit 4 not set":             0x00,
+		"bit 7 set":                 0x90,
+		// Truncating the type to its low byte would make this look like 0x10.
+		"multi byte type": 0x110,
+	}
+	for name, typ := range cases {
+		t.Run(name, func(t *testing.T) {
+			buf := varint.Append(nil, typ)
+			buf = append(buf, 0x04, 0x07, 0x09, 0x00)
+
+			_, err := mustParser(t, bytes.NewReader(buf), 18, StreamTypeData).Read()
+			assert.Error(t, err)
+		})
+	}
+}
+
+func TestParseTruncatedSubgroupHeader(t *testing.T) {
+	full := []byte{0x14, 0x04, 0x07, 0x09, 200}
+	for i := 1; i < len(full); i++ {
+		_, err := mustParser(t, bytes.NewReader(full[:i]), 18, StreamTypeData).Read()
+		assert.Error(t, err, "truncated after %v bytes", i)
+	}
+}
+
+func propertyObjects() []*SubgroupObject {
+	first := &SubgroupObject{
+		ObjectIDDelta: 0,
+		Properties: []KeyValuePair{
+			{Type: 1, Bytes: []byte("A")},
+			{Type: 2, Varint: 42},
+		},
+		ObjectPayload: []byte("ab"),
+	}
+	second := &SubgroupObject{
+		ObjectIDDelta: 3,
+		ObjectStatus:  3,
+	}
+	first.SetHasProperties(true)
+	second.SetHasProperties(true)
+	return []*SubgroupObject{first, second}
+}
+
+func TestSubgroupStreamPropertiesBytes(t *testing.T) {
+	var buf bytes.Buffer
+	appender := NewAppender(&buf, 18)
+
+	header := NewSubgroupHeader(4, 7, 9, 200)
+	header.SetProperties(true)
+	require.NoError(t, appender.Write(header))
+	for _, o := range propertyObjects() {
+		require.NoError(t, appender.Write(o))
+	}
+
+	assert.Equal(t, []byte{
+		0x15, // type: bit 4 set, properties, subgroup ID mode 0b10
+		0x04, // track alias
+		0x07, // group ID
+		0x09, // subgroup ID
+		200,  // publisher priority
+
+		0x00,            // object ID delta
+		0x05,            // properties length in bytes
+		0x01, 0x01, 'A', // property type delta 1, type 1: one byte, 'A'
+		0x01, 0x2a, // property type delta 1, type 2: varint 42
+		0x02, 'a', 'b', // payload
+
+		0x03, // object ID delta
+		0x00, // properties length in bytes
+		0x00, // payload length
+		0x03, // object status
+	}, buf.Bytes())
+}
+
+func TestSubgroupStreamPropertiesRoundTrip(t *testing.T) {
+	var buf bytes.Buffer
+	appender := NewAppender(&buf, 18)
+
+	header := NewSubgroupHeader(4, 7, 9, 200)
+	header.SetProperties(true)
+	require.NoError(t, appender.Write(header))
+	for _, o := range propertyObjects() {
+		require.NoError(t, appender.Write(o))
+	}
+
+	parser := mustParser(t, &buf, 18, StreamTypeData)
+
+	msg, err := parser.Read()
+	require.NoError(t, err)
+	assert.Equal(t, header, msg)
+
+	// An object with no properties parses to an empty list, not a nil one.
+	want := propertyObjects()
+	want[1].Properties = []KeyValuePair{}
+
+	for _, o := range want {
+		msg, err := parser.Read()
+		require.NoError(t, err)
+		assert.Equal(t, o, msg)
+	}
+}
+
+func TestParseTruncatedObjectProperties(t *testing.T) {
+	full := []byte{
+		0x15, 0x04, 0x07, 0x09, 200,
+		0x00,                        // object ID delta
+		0x05,                        // properties length in bytes
+		0x02, 0x2a, 0x01, 0x01, 'A', // properties
+		0x02, 'a', 'b', // payload
+	}
+	for i := 6; i < len(full); i++ {
+		parser := mustParser(t, bytes.NewReader(full[:i]), 18, StreamTypeData)
+
+		_, err := parser.Read()
+		require.NoError(t, err, "truncated after %v bytes", i)
+
+		_, err = parser.Read()
+		assert.ErrorIs(t, err, io.ErrUnexpectedEOF, "truncated after %v bytes", i)
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_namespace_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_namespace_v18.go
new file mode 100644
index 000000000..ed3fce6bd
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_namespace_v18.go
@@ -0,0 +1,55 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *SubscribeNamespace) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.RequestID))
+	buf = varint.Append(buf, uint64(len(m.TrackNamespacePrefix)))
+	for _, v := range m.TrackNamespacePrefix {
+		buf = varint.Append(buf, uint64(len(v)))
+		buf = append(buf, v...)
+	}
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	return buf
+}
+
+func (m *SubscribeNamespace) parse_v18(r messageReader) error {
+	var err error
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var numTrackNamespacePrefix uint64
+	numTrackNamespacePrefix, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackNamespacePrefix = make([][]byte, 0)
+	for range numTrackNamespacePrefix {
+		var length uint64
+		length, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		var value []byte
+		value, err = readBytes(r, length)
+		if err != nil {
+			return err
+		}
+		m.TrackNamespacePrefix = append(m.TrackNamespacePrefix, value)
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_ok_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_ok_v18.go
new file mode 100644
index 000000000..ada5465a2
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_ok_v18.go
@@ -0,0 +1,34 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *SubscribeOk) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.TrackAlias))
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	buf = appendKeyValuePairs_v18(buf, m.Properties)
+	return buf
+}
+
+func (m *SubscribeOk) parse_v18(r messageReader) error {
+	var err error
+
+	m.TrackAlias, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	m.Properties, err = parseKeyValuePairsRemaining_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_tracks_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_tracks_v18.go
new file mode 100644
index 000000000..84387db79
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_tracks_v18.go
@@ -0,0 +1,55 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *SubscribeTracks) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.RequestID))
+	buf = varint.Append(buf, uint64(len(m.TrackNamespacePrefix)))
+	for _, v := range m.TrackNamespacePrefix {
+		buf = varint.Append(buf, uint64(len(v)))
+		buf = append(buf, v...)
+	}
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	return buf
+}
+
+func (m *SubscribeTracks) parse_v18(r messageReader) error {
+	var err error
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var numTrackNamespacePrefix uint64
+	numTrackNamespacePrefix, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackNamespacePrefix = make([][]byte, 0)
+	for range numTrackNamespacePrefix {
+		var length uint64
+		length, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		var value []byte
+		value, err = readBytes(r, length)
+		if err != nil {
+			return err
+		}
+		m.TrackNamespacePrefix = append(m.TrackNamespacePrefix, value)
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_v18.go
new file mode 100644
index 000000000..5f5919b09
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/subscribe_v18.go
@@ -0,0 +1,68 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *Subscribe) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.RequestID))
+	buf = varint.Append(buf, uint64(len(m.TrackNamespace)))
+	for _, v := range m.TrackNamespace {
+		buf = varint.Append(buf, uint64(len(v)))
+		buf = append(buf, v...)
+	}
+	buf = varint.Append(buf, uint64(len(m.TrackName)))
+	buf = append(buf, m.TrackName...)
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	return buf
+}
+
+func (m *Subscribe) parse_v18(r messageReader) error {
+	var err error
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var numTrackNamespace uint64
+	numTrackNamespace, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackNamespace = make([][]byte, 0)
+	for range numTrackNamespace {
+		var length uint64
+		length, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		var value []byte
+		value, err = readBytes(r, length)
+		if err != nil {
+			return err
+		}
+		m.TrackNamespace = append(m.TrackNamespace, value)
+	}
+
+	var TrackNameLength uint64
+	TrackNameLength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackName, err = readBytes(r, TrackNameLength)
+	if err != nil {
+		return err
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/track_status_v18.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/track_status_v18.go
new file mode 100644
index 000000000..edb64d065
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/track_status_v18.go
@@ -0,0 +1,68 @@
+// Code generated by "wiregen -dir ./internal/wire/"; DO NOT EDIT.
+
+package wire
+
+import "github.com/mengelbart/moqtransport/varint"
+
+func (m *TrackStatus) append_v18(buf []byte) []byte {
+	buf = varint.Append(buf, uint64(m.RequestID))
+	buf = varint.Append(buf, uint64(len(m.TrackNamespace)))
+	for _, v := range m.TrackNamespace {
+		buf = varint.Append(buf, uint64(len(v)))
+		buf = append(buf, v...)
+	}
+	buf = varint.Append(buf, uint64(len(m.TrackName)))
+	buf = append(buf, m.TrackName...)
+	buf = varint.Append(buf, uint64(len(m.Parameters)))
+	buf = appendKeyValuePairs_v18(buf, m.Parameters)
+	return buf
+}
+
+func (m *TrackStatus) parse_v18(r messageReader) error {
+	var err error
+
+	m.RequestID, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	var numTrackNamespace uint64
+	numTrackNamespace, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackNamespace = make([][]byte, 0)
+	for range numTrackNamespace {
+		var length uint64
+		length, err = varint.Read(r)
+		if err != nil {
+			return err
+		}
+
+		var value []byte
+		value, err = readBytes(r, length)
+		if err != nil {
+			return err
+		}
+		m.TrackNamespace = append(m.TrackNamespace, value)
+	}
+
+	var TrackNameLength uint64
+	TrackNameLength, err = varint.Read(r)
+	if err != nil {
+		return err
+	}
+
+	m.TrackName, err = readBytes(r, TrackNameLength)
+	if err != nil {
+		return err
+	}
+
+	m.Parameters, err = parseKeyValuePairsCount_v18(r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/internal/wire/wire.go b/electron/native/private-transport/third_party/moqtransport/internal/wire/wire.go
new file mode 100644
index 000000000..447a16ec1
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/internal/wire/wire.go
@@ -0,0 +1,246 @@
+package wire
+
+import "fmt"
+
+type Setup struct {
+	Options []KeyValuePair `proto:"kvp_list_remaining"`
+}
+
+func (m *Setup) Type() ControlMessageType {
+	return ControlMessageTypeSetup
+}
+
+type GoAwayCtrl struct {
+	NewSessionURI string `proto:"tlv_string"`
+	Timeout       uint64 `proto:"varint"`
+	RequestID     uint64 `proto:"varint"`
+}
+
+func (m *GoAwayCtrl) Type() ControlMessageType {
+	return ControlMessageTypeGoAway
+}
+
+type GoAwayReq struct {
+	NewSessionURI string `proto:"tlv_string"`
+	Timeout       uint64 `proto:"varint"`
+}
+
+func (m *GoAwayReq) Type() ControlMessageType {
+	return ControlMessageTypeGoAway
+}
+
+type Subscribe struct {
+	RequestID      uint64         `proto:"varint"`
+	TrackNamespace [][]byte       `proto:"ntlv_bytes"`
+	TrackName      []byte         `proto:"tlv_bytes"`
+	Parameters     []KeyValuePair `proto:"kvp_list"`
+}
+
+func (m *Subscribe) Type() ControlMessageType {
+	return ControlMessageTypeSubscribe
+}
+
+type SubscribeOk struct {
+	TrackAlias uint64         `proto:"varint"`
+	Parameters []KeyValuePair `proto:"kvp_list"`
+	Properties []KeyValuePair `proto:"kvp_list_remaining"`
+}
+
+func (m *SubscribeOk) Type() ControlMessageType {
+	return ControlMessageTypeSubscribeOk
+}
+
+type Publish struct {
+	RequestID      uint64         `proto:"varint"`
+	TrackNamespace [][]byte       `proto:"ntlv_bytes"`
+	TrackName      []byte         `proto:"tlv_bytes"`
+	TrackAlias     uint64         `proto:"varint"`
+	Parameters     []KeyValuePair `proto:"kvp_list"`
+	Properties     []KeyValuePair `proto:"kvp_list_remaining"`
+}
+
+func (m *Publish) Type() ControlMessageType {
+	return ControlMessageTypePublish
+}
+
+type PublishOk struct {
+	Parameters []KeyValuePair `proto:"kvp_list"`
+	Properties []KeyValuePair `proto:"kvp_list_remaining"`
+}
+
+func (m *PublishOk) Type() ControlMessageType {
+	return ControlMessageTypePublishOk
+}
+
+type PublishDone struct {
+	StatusCode  uint64 `proto:"varint"`
+	StreamCount uint64 `proto:"varint"`
+	ErrorReason string `proto:"tlv_string"`
+}
+
+func (m *PublishDone) Type() ControlMessageType {
+	return ControlMessageTypePublishDone
+}
+
+const (
+	FetchTypeStandalone      uint64 = 0x1
+	FetchTypeRelativeJoining uint64 = 0x2
+	FetchTypeAbsoluteJoining uint64 = 0x3
+)
+
+type Fetch struct {
+	RequestID uint64 `proto:"varint"`
+	FetchType uint64 `proto:"varint"`
+
+	TrackNamespace [][]byte `proto:"ntlv_bytes,if=isStandalone"`
+	TrackName      []byte   `proto:"tlv_bytes,if=isStandalone"`
+	StartLocation  Location `proto:"message,if=isStandalone"`
+	EndLocation    Location `proto:"message,if=isStandalone"`
+
+	JoiningRequestID uint64 `proto:"varint,if=isJoining"`
+	JoiningStart     uint64 `proto:"varint,if=isJoining"`
+
+	Parameters []KeyValuePair `proto:"kvp_list"`
+}
+
+func (m *Fetch) Type() ControlMessageType {
+	return ControlMessageTypeFetch
+}
+
+func (m *Fetch) isStandalone() bool {
+	return m.FetchType == FetchTypeStandalone
+}
+
+func (m *Fetch) isJoining() bool {
+	return m.FetchType == FetchTypeRelativeJoining || m.FetchType == FetchTypeAbsoluteJoining
+}
+
+// validate rejects a fetch type that carries neither structure.
+func (m *Fetch) validate() error {
+	if !m.isStandalone() && !m.isJoining() {
+		return fmt.Errorf("invalid fetch type: %d", m.FetchType)
+	}
+	return nil
+}
+
+type FetchOk struct {
+	EndOfTrack  bool           `proto:"bool"`
+	EndLocation Location       `proto:"message"`
+	Parameters  []KeyValuePair `proto:"kvp_list"`
+	Properties  []KeyValuePair `proto:"kvp_list_remaining"`
+}
+
+func (m *FetchOk) Type() ControlMessageType {
+	return ControlMessageTypeFetchOk
+}
+
+type TrackStatus struct {
+	RequestID      uint64         `proto:"varint"`
+	TrackNamespace [][]byte       `proto:"ntlv_bytes"`
+	TrackName      []byte         `proto:"tlv_bytes"`
+	Parameters     []KeyValuePair `proto:"kvp_list"`
+}
+
+func (m *TrackStatus) Type() ControlMessageType {
+	return ControlMessageTypeTrackStatus
+}
+
+type PublishNamespace struct {
+	RequestID      uint64         `proto:"varint"`
+	TrackNamespace [][]byte       `proto:"ntlv_bytes"`
+	Parameters     []KeyValuePair `proto:"kvp_list"`
+}
+
+func (m *PublishNamespace) Type() ControlMessageType {
+	return ControlMessageTypePublishNamespace
+}
+
+type SubscribeNamespace struct {
+	RequestID            uint64         `proto:"varint"`
+	TrackNamespacePrefix [][]byte       `proto:"ntlv_bytes"`
+	Parameters           []KeyValuePair `proto:"kvp_list"`
+}
+
+func (m *SubscribeNamespace) Type() ControlMessageType {
+	return ControlMessageTypeSubscribeNamespace
+}
+
+type SubscribeTracks struct {
+	RequestID            uint64         `proto:"varint"`
+	TrackNamespacePrefix [][]byte       `proto:"ntlv_bytes"`
+	Parameters           []KeyValuePair `proto:"kvp_list"`
+}
+
+func (m *SubscribeTracks) Type() ControlMessageType {
+	return ControlMessageTypeSubscribeTracks
+}
+
+type Namespace struct {
+	TrackNamespaceSuffix [][]byte `proto:"ntlv_bytes"`
+}
+
+func (m *Namespace) Type() ControlMessageType {
+	return ControlMessageTypeNamespace
+}
+
+type NamespaceDone struct {
+	TrackNamespaceSuffix [][]byte `proto:"ntlv_bytes"`
+}
+
+func (m *NamespaceDone) Type() ControlMessageType {
+	return ControlMessageTypeNamespaceDone
+}
+
+type PublishBlocked struct {
+	TrackNamespaceSuffix [][]byte `proto:"ntlv_bytes"`
+	TrackName            []byte   `proto:"tlv_bytes"`
+}
+
+func (m *PublishBlocked) Type() ControlMessageType {
+	return ControlMessageTypePublishBlocked
+}
+
+type RequestUpdate struct {
+	RequestID  uint64         `proto:"varint"`
+	Parameters []KeyValuePair `proto:"kvp_list"`
+}
+
+func (m *RequestUpdate) Type() ControlMessageType {
+	return ControlMessageTypeRequestUpdate
+}
+
+type RequestOk struct {
+	Parameters []KeyValuePair `proto:"kvp_list"`
+	Properties []KeyValuePair `proto:"kvp_list_remaining"`
+}
+
+func (m *RequestOk) Type() ControlMessageType {
+	return ControlMessageTypeRequestOk
+}
+
+type RequestError struct {
+	ErrorCode     uint64 `proto:"varint"`
+	RetryInterval uint64 `proto:"varint"`
+	ErrorReason   string `proto:"tlv_string"`
+	// TODO: Implement Redirect
+}
+
+func (m *RequestError) Type() ControlMessageType {
+	return ControlMessageTypeRequestError
+}
+
+type FetchHeader struct {
+	RequestID uint64 `proto:"varint"`
+}
+
+func (m *FetchHeader) Type() ControlMessageType {
+	return ControlMessageTypeFetchHeader
+}
+
+// wiregen:message
+type Padding struct {
+}
+
+func (m *Padding) Type() ControlMessageType {
+	return ControlMessageTypePadding
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/local_control_stream.go b/electron/native/private-transport/third_party/moqtransport/local_control_stream.go
new file mode 100644
index 000000000..3c46331b8
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/local_control_stream.go
@@ -0,0 +1,15 @@
+package moqtransport
+
+import "github.com/mengelbart/moqtransport/internal/wire"
+
+type localControlStream struct {
+	w messageWriter
+}
+
+func newLocalControlStream(w messageWriter) *localControlStream {
+	return &localControlStream{w: w}
+}
+
+func (s *localControlStream) write(msg wire.ControlMessage) error {
+	return s.w.Write(msg)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/logging.go b/electron/native/private-transport/third_party/moqtransport/logging.go
new file mode 100644
index 000000000..207aefb79
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/logging.go
@@ -0,0 +1,44 @@
+package moqtransport
+
+import (
+	"log/slog"
+	"math"
+	"os"
+	"strings"
+)
+
+const logEnv = "MOQ_LOG_LEVEL"
+
+const (
+	LogLevelNone = math.MaxInt
+)
+
+var moqtransportLogLevel = new(slog.LevelVar)
+
+var defaultLogger *slog.Logger
+
+func init() {
+	h := slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{
+		AddSource: false,
+		Level:     moqtransportLogLevel,
+	})
+	moqtransportLogLevel.Set(readLoggingEnv())
+	defaultLogger = slog.New(h)
+}
+
+func readLoggingEnv() slog.Level {
+	switch strings.ToLower(os.Getenv(logEnv)) {
+	case "":
+		return LogLevelNone
+	case "debug":
+		return slog.LevelDebug
+	case "info":
+		return slog.LevelInfo
+	case "warn":
+		return slog.LevelWarn
+	case "error":
+		return slog.LevelError
+	default:
+		return LogLevelNone
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/mock_connection_test.go b/electron/native/private-transport/third_party/moqtransport/mock_connection_test.go
new file mode 100644
index 000000000..f8e979810
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/mock_connection_test.go
@@ -0,0 +1,541 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/mengelbart/moqtransport (interfaces: Connection)
+//
+// Generated by this command:
+//
+//	mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_connection_test.go github.com/mengelbart/moqtransport Connection
+//
+
+package moqtransport
+
+import (
+	context "context"
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockConnection is a mock of Connection interface.
+type MockConnection struct {
+	ctrl     *gomock.Controller
+	recorder *MockConnectionMockRecorder
+	isgomock struct{}
+}
+
+// MockConnectionMockRecorder is the mock recorder for MockConnection.
+type MockConnectionMockRecorder struct {
+	mock *MockConnection
+}
+
+// NewMockConnection creates a new mock instance.
+func NewMockConnection(ctrl *gomock.Controller) *MockConnection {
+	mock := &MockConnection{ctrl: ctrl}
+	mock.recorder = &MockConnectionMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockConnection) EXPECT() *MockConnectionMockRecorder {
+	return m.recorder
+}
+
+// AcceptStream mocks base method.
+func (m *MockConnection) AcceptStream(arg0 context.Context) (Stream, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AcceptStream", arg0)
+	ret0, _ := ret[0].(Stream)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AcceptStream indicates an expected call of AcceptStream.
+func (mr *MockConnectionMockRecorder) AcceptStream(arg0 any) *MockConnectionAcceptStreamCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcceptStream", reflect.TypeOf((*MockConnection)(nil).AcceptStream), arg0)
+	return &MockConnectionAcceptStreamCall{Call: call}
+}
+
+// MockConnectionAcceptStreamCall wrap *gomock.Call
+type MockConnectionAcceptStreamCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionAcceptStreamCall) Return(arg0 Stream, arg1 error) *MockConnectionAcceptStreamCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionAcceptStreamCall) Do(f func(context.Context) (Stream, error)) *MockConnectionAcceptStreamCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionAcceptStreamCall) DoAndReturn(f func(context.Context) (Stream, error)) *MockConnectionAcceptStreamCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// AcceptUniStream mocks base method.
+func (m *MockConnection) AcceptUniStream(arg0 context.Context) (ReceiveStream, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AcceptUniStream", arg0)
+	ret0, _ := ret[0].(ReceiveStream)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AcceptUniStream indicates an expected call of AcceptUniStream.
+func (mr *MockConnectionMockRecorder) AcceptUniStream(arg0 any) *MockConnectionAcceptUniStreamCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcceptUniStream", reflect.TypeOf((*MockConnection)(nil).AcceptUniStream), arg0)
+	return &MockConnectionAcceptUniStreamCall{Call: call}
+}
+
+// MockConnectionAcceptUniStreamCall wrap *gomock.Call
+type MockConnectionAcceptUniStreamCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionAcceptUniStreamCall) Return(arg0 ReceiveStream, arg1 error) *MockConnectionAcceptUniStreamCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionAcceptUniStreamCall) Do(f func(context.Context) (ReceiveStream, error)) *MockConnectionAcceptUniStreamCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionAcceptUniStreamCall) DoAndReturn(f func(context.Context) (ReceiveStream, error)) *MockConnectionAcceptUniStreamCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ApplicationProtocol mocks base method.
+func (m *MockConnection) ApplicationProtocol() ApplicationProtocol {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ApplicationProtocol")
+	ret0, _ := ret[0].(ApplicationProtocol)
+	return ret0
+}
+
+// ApplicationProtocol indicates an expected call of ApplicationProtocol.
+func (mr *MockConnectionMockRecorder) ApplicationProtocol() *MockConnectionApplicationProtocolCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ApplicationProtocol", reflect.TypeOf((*MockConnection)(nil).ApplicationProtocol))
+	return &MockConnectionApplicationProtocolCall{Call: call}
+}
+
+// MockConnectionApplicationProtocolCall wrap *gomock.Call
+type MockConnectionApplicationProtocolCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionApplicationProtocolCall) Return(arg0 ApplicationProtocol) *MockConnectionApplicationProtocolCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionApplicationProtocolCall) Do(f func() ApplicationProtocol) *MockConnectionApplicationProtocolCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionApplicationProtocolCall) DoAndReturn(f func() ApplicationProtocol) *MockConnectionApplicationProtocolCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// CloseWithError mocks base method.
+func (m *MockConnection) CloseWithError(arg0 uint64, arg1 string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CloseWithError", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CloseWithError indicates an expected call of CloseWithError.
+func (mr *MockConnectionMockRecorder) CloseWithError(arg0, arg1 any) *MockConnectionCloseWithErrorCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CloseWithError", reflect.TypeOf((*MockConnection)(nil).CloseWithError), arg0, arg1)
+	return &MockConnectionCloseWithErrorCall{Call: call}
+}
+
+// MockConnectionCloseWithErrorCall wrap *gomock.Call
+type MockConnectionCloseWithErrorCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionCloseWithErrorCall) Return(arg0 error) *MockConnectionCloseWithErrorCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionCloseWithErrorCall) Do(f func(uint64, string) error) *MockConnectionCloseWithErrorCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionCloseWithErrorCall) DoAndReturn(f func(uint64, string) error) *MockConnectionCloseWithErrorCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Context mocks base method.
+func (m *MockConnection) Context() context.Context {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Context")
+	ret0, _ := ret[0].(context.Context)
+	return ret0
+}
+
+// Context indicates an expected call of Context.
+func (mr *MockConnectionMockRecorder) Context() *MockConnectionContextCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Context", reflect.TypeOf((*MockConnection)(nil).Context))
+	return &MockConnectionContextCall{Call: call}
+}
+
+// MockConnectionContextCall wrap *gomock.Call
+type MockConnectionContextCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionContextCall) Return(arg0 context.Context) *MockConnectionContextCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionContextCall) Do(f func() context.Context) *MockConnectionContextCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionContextCall) DoAndReturn(f func() context.Context) *MockConnectionContextCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// OpenStream mocks base method.
+func (m *MockConnection) OpenStream() (Stream, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "OpenStream")
+	ret0, _ := ret[0].(Stream)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// OpenStream indicates an expected call of OpenStream.
+func (mr *MockConnectionMockRecorder) OpenStream() *MockConnectionOpenStreamCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OpenStream", reflect.TypeOf((*MockConnection)(nil).OpenStream))
+	return &MockConnectionOpenStreamCall{Call: call}
+}
+
+// MockConnectionOpenStreamCall wrap *gomock.Call
+type MockConnectionOpenStreamCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionOpenStreamCall) Return(arg0 Stream, arg1 error) *MockConnectionOpenStreamCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionOpenStreamCall) Do(f func() (Stream, error)) *MockConnectionOpenStreamCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionOpenStreamCall) DoAndReturn(f func() (Stream, error)) *MockConnectionOpenStreamCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// OpenStreamSync mocks base method.
+func (m *MockConnection) OpenStreamSync(arg0 context.Context) (Stream, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "OpenStreamSync", arg0)
+	ret0, _ := ret[0].(Stream)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// OpenStreamSync indicates an expected call of OpenStreamSync.
+func (mr *MockConnectionMockRecorder) OpenStreamSync(arg0 any) *MockConnectionOpenStreamSyncCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OpenStreamSync", reflect.TypeOf((*MockConnection)(nil).OpenStreamSync), arg0)
+	return &MockConnectionOpenStreamSyncCall{Call: call}
+}
+
+// MockConnectionOpenStreamSyncCall wrap *gomock.Call
+type MockConnectionOpenStreamSyncCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionOpenStreamSyncCall) Return(arg0 Stream, arg1 error) *MockConnectionOpenStreamSyncCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionOpenStreamSyncCall) Do(f func(context.Context) (Stream, error)) *MockConnectionOpenStreamSyncCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionOpenStreamSyncCall) DoAndReturn(f func(context.Context) (Stream, error)) *MockConnectionOpenStreamSyncCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// OpenUniStream mocks base method.
+func (m *MockConnection) OpenUniStream() (SendStream, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "OpenUniStream")
+	ret0, _ := ret[0].(SendStream)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// OpenUniStream indicates an expected call of OpenUniStream.
+func (mr *MockConnectionMockRecorder) OpenUniStream() *MockConnectionOpenUniStreamCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OpenUniStream", reflect.TypeOf((*MockConnection)(nil).OpenUniStream))
+	return &MockConnectionOpenUniStreamCall{Call: call}
+}
+
+// MockConnectionOpenUniStreamCall wrap *gomock.Call
+type MockConnectionOpenUniStreamCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionOpenUniStreamCall) Return(arg0 SendStream, arg1 error) *MockConnectionOpenUniStreamCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionOpenUniStreamCall) Do(f func() (SendStream, error)) *MockConnectionOpenUniStreamCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionOpenUniStreamCall) DoAndReturn(f func() (SendStream, error)) *MockConnectionOpenUniStreamCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// OpenUniStreamSync mocks base method.
+func (m *MockConnection) OpenUniStreamSync(arg0 context.Context) (SendStream, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "OpenUniStreamSync", arg0)
+	ret0, _ := ret[0].(SendStream)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// OpenUniStreamSync indicates an expected call of OpenUniStreamSync.
+func (mr *MockConnectionMockRecorder) OpenUniStreamSync(arg0 any) *MockConnectionOpenUniStreamSyncCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OpenUniStreamSync", reflect.TypeOf((*MockConnection)(nil).OpenUniStreamSync), arg0)
+	return &MockConnectionOpenUniStreamSyncCall{Call: call}
+}
+
+// MockConnectionOpenUniStreamSyncCall wrap *gomock.Call
+type MockConnectionOpenUniStreamSyncCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionOpenUniStreamSyncCall) Return(arg0 SendStream, arg1 error) *MockConnectionOpenUniStreamSyncCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionOpenUniStreamSyncCall) Do(f func(context.Context) (SendStream, error)) *MockConnectionOpenUniStreamSyncCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionOpenUniStreamSyncCall) DoAndReturn(f func(context.Context) (SendStream, error)) *MockConnectionOpenUniStreamSyncCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Perspective mocks base method.
+func (m *MockConnection) Perspective() Perspective {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Perspective")
+	ret0, _ := ret[0].(Perspective)
+	return ret0
+}
+
+// Perspective indicates an expected call of Perspective.
+func (mr *MockConnectionMockRecorder) Perspective() *MockConnectionPerspectiveCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Perspective", reflect.TypeOf((*MockConnection)(nil).Perspective))
+	return &MockConnectionPerspectiveCall{Call: call}
+}
+
+// MockConnectionPerspectiveCall wrap *gomock.Call
+type MockConnectionPerspectiveCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionPerspectiveCall) Return(arg0 Perspective) *MockConnectionPerspectiveCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionPerspectiveCall) Do(f func() Perspective) *MockConnectionPerspectiveCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionPerspectiveCall) DoAndReturn(f func() Perspective) *MockConnectionPerspectiveCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Protocol mocks base method.
+func (m *MockConnection) Protocol() Protocol {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Protocol")
+	ret0, _ := ret[0].(Protocol)
+	return ret0
+}
+
+// Protocol indicates an expected call of Protocol.
+func (mr *MockConnectionMockRecorder) Protocol() *MockConnectionProtocolCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Protocol", reflect.TypeOf((*MockConnection)(nil).Protocol))
+	return &MockConnectionProtocolCall{Call: call}
+}
+
+// MockConnectionProtocolCall wrap *gomock.Call
+type MockConnectionProtocolCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionProtocolCall) Return(arg0 Protocol) *MockConnectionProtocolCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionProtocolCall) Do(f func() Protocol) *MockConnectionProtocolCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionProtocolCall) DoAndReturn(f func() Protocol) *MockConnectionProtocolCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ReceiveDatagram mocks base method.
+func (m *MockConnection) ReceiveDatagram(arg0 context.Context) ([]byte, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ReceiveDatagram", arg0)
+	ret0, _ := ret[0].([]byte)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ReceiveDatagram indicates an expected call of ReceiveDatagram.
+func (mr *MockConnectionMockRecorder) ReceiveDatagram(arg0 any) *MockConnectionReceiveDatagramCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReceiveDatagram", reflect.TypeOf((*MockConnection)(nil).ReceiveDatagram), arg0)
+	return &MockConnectionReceiveDatagramCall{Call: call}
+}
+
+// MockConnectionReceiveDatagramCall wrap *gomock.Call
+type MockConnectionReceiveDatagramCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionReceiveDatagramCall) Return(arg0 []byte, arg1 error) *MockConnectionReceiveDatagramCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionReceiveDatagramCall) Do(f func(context.Context) ([]byte, error)) *MockConnectionReceiveDatagramCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionReceiveDatagramCall) DoAndReturn(f func(context.Context) ([]byte, error)) *MockConnectionReceiveDatagramCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SendDatagram mocks base method.
+func (m *MockConnection) SendDatagram(arg0 []byte) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SendDatagram", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SendDatagram indicates an expected call of SendDatagram.
+func (mr *MockConnectionMockRecorder) SendDatagram(arg0 any) *MockConnectionSendDatagramCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SendDatagram", reflect.TypeOf((*MockConnection)(nil).SendDatagram), arg0)
+	return &MockConnectionSendDatagramCall{Call: call}
+}
+
+// MockConnectionSendDatagramCall wrap *gomock.Call
+type MockConnectionSendDatagramCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnectionSendDatagramCall) Return(arg0 error) *MockConnectionSendDatagramCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnectionSendDatagramCall) Do(f func([]byte) error) *MockConnectionSendDatagramCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnectionSendDatagramCall) DoAndReturn(f func([]byte) error) *MockConnectionSendDatagramCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/mock_handler_test.go b/electron/native/private-transport/third_party/moqtransport/mock_handler_test.go
new file mode 100644
index 000000000..0fc35b428
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/mock_handler_test.go
@@ -0,0 +1,111 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/mengelbart/moqtransport (interfaces: Handler)
+//
+// Generated by this command:
+//
+//	mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_handler_test.go github.com/mengelbart/moqtransport Handler
+//
+
+package moqtransport
+
+import (
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockHandler is a mock of Handler interface.
+type MockHandler struct {
+	ctrl     *gomock.Controller
+	recorder *MockHandlerMockRecorder
+	isgomock struct{}
+}
+
+// MockHandlerMockRecorder is the mock recorder for MockHandler.
+type MockHandlerMockRecorder struct {
+	mock *MockHandler
+}
+
+// NewMockHandler creates a new mock instance.
+func NewMockHandler(ctrl *gomock.Controller) *MockHandler {
+	mock := &MockHandler{ctrl: ctrl}
+	mock.recorder = &MockHandlerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockHandler) EXPECT() *MockHandlerMockRecorder {
+	return m.recorder
+}
+
+// HandleGoAway mocks base method.
+func (m *MockHandler) HandleGoAway(arg0 string) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "HandleGoAway", arg0)
+}
+
+// HandleGoAway indicates an expected call of HandleGoAway.
+func (mr *MockHandlerMockRecorder) HandleGoAway(arg0 any) *MockHandlerHandleGoAwayCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HandleGoAway", reflect.TypeOf((*MockHandler)(nil).HandleGoAway), arg0)
+	return &MockHandlerHandleGoAwayCall{Call: call}
+}
+
+// MockHandlerHandleGoAwayCall wrap *gomock.Call
+type MockHandlerHandleGoAwayCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockHandlerHandleGoAwayCall) Return() *MockHandlerHandleGoAwayCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockHandlerHandleGoAwayCall) Do(f func(string)) *MockHandlerHandleGoAwayCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockHandlerHandleGoAwayCall) DoAndReturn(f func(string)) *MockHandlerHandleGoAwayCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// HandleSubscribe mocks base method.
+func (m *MockHandler) HandleSubscribe(arg0 *IncomingSubscribeRequest) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "HandleSubscribe", arg0)
+}
+
+// HandleSubscribe indicates an expected call of HandleSubscribe.
+func (mr *MockHandlerMockRecorder) HandleSubscribe(arg0 any) *MockHandlerHandleSubscribeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HandleSubscribe", reflect.TypeOf((*MockHandler)(nil).HandleSubscribe), arg0)
+	return &MockHandlerHandleSubscribeCall{Call: call}
+}
+
+// MockHandlerHandleSubscribeCall wrap *gomock.Call
+type MockHandlerHandleSubscribeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockHandlerHandleSubscribeCall) Return() *MockHandlerHandleSubscribeCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockHandlerHandleSubscribeCall) Do(f func(*IncomingSubscribeRequest)) *MockHandlerHandleSubscribeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockHandlerHandleSubscribeCall) DoAndReturn(f func(*IncomingSubscribeRequest)) *MockHandlerHandleSubscribeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/mock_receive_stream_test.go b/electron/native/private-transport/third_party/moqtransport/mock_receive_stream_test.go
new file mode 100644
index 000000000..50dadca5c
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/mock_receive_stream_test.go
@@ -0,0 +1,152 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/mengelbart/moqtransport (interfaces: ReceiveStream)
+//
+// Generated by this command:
+//
+//	mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_receive_stream_test.go github.com/mengelbart/moqtransport ReceiveStream
+//
+
+package moqtransport
+
+import (
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockReceiveStream is a mock of ReceiveStream interface.
+type MockReceiveStream struct {
+	ctrl     *gomock.Controller
+	recorder *MockReceiveStreamMockRecorder
+	isgomock struct{}
+}
+
+// MockReceiveStreamMockRecorder is the mock recorder for MockReceiveStream.
+type MockReceiveStreamMockRecorder struct {
+	mock *MockReceiveStream
+}
+
+// NewMockReceiveStream creates a new mock instance.
+func NewMockReceiveStream(ctrl *gomock.Controller) *MockReceiveStream {
+	mock := &MockReceiveStream{ctrl: ctrl}
+	mock.recorder = &MockReceiveStreamMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockReceiveStream) EXPECT() *MockReceiveStreamMockRecorder {
+	return m.recorder
+}
+
+// Read mocks base method.
+func (m *MockReceiveStream) Read(p []byte) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Read", p)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Read indicates an expected call of Read.
+func (mr *MockReceiveStreamMockRecorder) Read(p any) *MockReceiveStreamReadCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Read", reflect.TypeOf((*MockReceiveStream)(nil).Read), p)
+	return &MockReceiveStreamReadCall{Call: call}
+}
+
+// MockReceiveStreamReadCall wrap *gomock.Call
+type MockReceiveStreamReadCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockReceiveStreamReadCall) Return(n int, err error) *MockReceiveStreamReadCall {
+	c.Call = c.Call.Return(n, err)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockReceiveStreamReadCall) Do(f func([]byte) (int, error)) *MockReceiveStreamReadCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockReceiveStreamReadCall) DoAndReturn(f func([]byte) (int, error)) *MockReceiveStreamReadCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Stop mocks base method.
+func (m *MockReceiveStream) Stop(arg0 uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Stop", arg0)
+}
+
+// Stop indicates an expected call of Stop.
+func (mr *MockReceiveStreamMockRecorder) Stop(arg0 any) *MockReceiveStreamStopCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Stop", reflect.TypeOf((*MockReceiveStream)(nil).Stop), arg0)
+	return &MockReceiveStreamStopCall{Call: call}
+}
+
+// MockReceiveStreamStopCall wrap *gomock.Call
+type MockReceiveStreamStopCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockReceiveStreamStopCall) Return() *MockReceiveStreamStopCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockReceiveStreamStopCall) Do(f func(uint32)) *MockReceiveStreamStopCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockReceiveStreamStopCall) DoAndReturn(f func(uint32)) *MockReceiveStreamStopCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// StreamID mocks base method.
+func (m *MockReceiveStream) StreamID() uint64 {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "StreamID")
+	ret0, _ := ret[0].(uint64)
+	return ret0
+}
+
+// StreamID indicates an expected call of StreamID.
+func (mr *MockReceiveStreamMockRecorder) StreamID() *MockReceiveStreamStreamIDCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "StreamID", reflect.TypeOf((*MockReceiveStream)(nil).StreamID))
+	return &MockReceiveStreamStreamIDCall{Call: call}
+}
+
+// MockReceiveStreamStreamIDCall wrap *gomock.Call
+type MockReceiveStreamStreamIDCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockReceiveStreamStreamIDCall) Return(arg0 uint64) *MockReceiveStreamStreamIDCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockReceiveStreamStreamIDCall) Do(f func() uint64) *MockReceiveStreamStreamIDCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockReceiveStreamStreamIDCall) DoAndReturn(f func() uint64) *MockReceiveStreamStreamIDCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/mock_send_stream_test.go b/electron/native/private-transport/third_party/moqtransport/mock_send_stream_test.go
new file mode 100644
index 000000000..b5bfd811e
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/mock_send_stream_test.go
@@ -0,0 +1,190 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/mengelbart/moqtransport (interfaces: SendStream)
+//
+// Generated by this command:
+//
+//	mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_send_stream_test.go github.com/mengelbart/moqtransport SendStream
+//
+
+package moqtransport
+
+import (
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockSendStream is a mock of SendStream interface.
+type MockSendStream struct {
+	ctrl     *gomock.Controller
+	recorder *MockSendStreamMockRecorder
+	isgomock struct{}
+}
+
+// MockSendStreamMockRecorder is the mock recorder for MockSendStream.
+type MockSendStreamMockRecorder struct {
+	mock *MockSendStream
+}
+
+// NewMockSendStream creates a new mock instance.
+func NewMockSendStream(ctrl *gomock.Controller) *MockSendStream {
+	mock := &MockSendStream{ctrl: ctrl}
+	mock.recorder = &MockSendStreamMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSendStream) EXPECT() *MockSendStreamMockRecorder {
+	return m.recorder
+}
+
+// Close mocks base method.
+func (m *MockSendStream) Close() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Close")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Close indicates an expected call of Close.
+func (mr *MockSendStreamMockRecorder) Close() *MockSendStreamCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockSendStream)(nil).Close))
+	return &MockSendStreamCloseCall{Call: call}
+}
+
+// MockSendStreamCloseCall wrap *gomock.Call
+type MockSendStreamCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendStreamCloseCall) Return(arg0 error) *MockSendStreamCloseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendStreamCloseCall) Do(f func() error) *MockSendStreamCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendStreamCloseCall) DoAndReturn(f func() error) *MockSendStreamCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Reset mocks base method.
+func (m *MockSendStream) Reset(arg0 uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Reset", arg0)
+}
+
+// Reset indicates an expected call of Reset.
+func (mr *MockSendStreamMockRecorder) Reset(arg0 any) *MockSendStreamResetCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Reset", reflect.TypeOf((*MockSendStream)(nil).Reset), arg0)
+	return &MockSendStreamResetCall{Call: call}
+}
+
+// MockSendStreamResetCall wrap *gomock.Call
+type MockSendStreamResetCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendStreamResetCall) Return() *MockSendStreamResetCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendStreamResetCall) Do(f func(uint32)) *MockSendStreamResetCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendStreamResetCall) DoAndReturn(f func(uint32)) *MockSendStreamResetCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// StreamID mocks base method.
+func (m *MockSendStream) StreamID() uint64 {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "StreamID")
+	ret0, _ := ret[0].(uint64)
+	return ret0
+}
+
+// StreamID indicates an expected call of StreamID.
+func (mr *MockSendStreamMockRecorder) StreamID() *MockSendStreamStreamIDCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "StreamID", reflect.TypeOf((*MockSendStream)(nil).StreamID))
+	return &MockSendStreamStreamIDCall{Call: call}
+}
+
+// MockSendStreamStreamIDCall wrap *gomock.Call
+type MockSendStreamStreamIDCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendStreamStreamIDCall) Return(arg0 uint64) *MockSendStreamStreamIDCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendStreamStreamIDCall) Do(f func() uint64) *MockSendStreamStreamIDCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendStreamStreamIDCall) DoAndReturn(f func() uint64) *MockSendStreamStreamIDCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Write mocks base method.
+func (m *MockSendStream) Write(p []byte) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Write", p)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Write indicates an expected call of Write.
+func (mr *MockSendStreamMockRecorder) Write(p any) *MockSendStreamWriteCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Write", reflect.TypeOf((*MockSendStream)(nil).Write), p)
+	return &MockSendStreamWriteCall{Call: call}
+}
+
+// MockSendStreamWriteCall wrap *gomock.Call
+type MockSendStreamWriteCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendStreamWriteCall) Return(n int, err error) *MockSendStreamWriteCall {
+	c.Call = c.Call.Return(n, err)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendStreamWriteCall) Do(f func([]byte) (int, error)) *MockSendStreamWriteCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendStreamWriteCall) DoAndReturn(f func([]byte) (int, error)) *MockSendStreamWriteCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/mock_stream_test.go b/electron/native/private-transport/third_party/moqtransport/mock_stream_test.go
new file mode 100644
index 000000000..b31619fd3
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/mock_stream_test.go
@@ -0,0 +1,265 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/mengelbart/moqtransport (interfaces: Stream)
+//
+// Generated by this command:
+//
+//	mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_stream_test.go github.com/mengelbart/moqtransport Stream
+//
+
+package moqtransport
+
+import (
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockStream is a mock of Stream interface.
+type MockStream struct {
+	ctrl     *gomock.Controller
+	recorder *MockStreamMockRecorder
+	isgomock struct{}
+}
+
+// MockStreamMockRecorder is the mock recorder for MockStream.
+type MockStreamMockRecorder struct {
+	mock *MockStream
+}
+
+// NewMockStream creates a new mock instance.
+func NewMockStream(ctrl *gomock.Controller) *MockStream {
+	mock := &MockStream{ctrl: ctrl}
+	mock.recorder = &MockStreamMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockStream) EXPECT() *MockStreamMockRecorder {
+	return m.recorder
+}
+
+// Close mocks base method.
+func (m *MockStream) Close() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Close")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Close indicates an expected call of Close.
+func (mr *MockStreamMockRecorder) Close() *MockStreamCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockStream)(nil).Close))
+	return &MockStreamCloseCall{Call: call}
+}
+
+// MockStreamCloseCall wrap *gomock.Call
+type MockStreamCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamCloseCall) Return(arg0 error) *MockStreamCloseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamCloseCall) Do(f func() error) *MockStreamCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamCloseCall) DoAndReturn(f func() error) *MockStreamCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Read mocks base method.
+func (m *MockStream) Read(p []byte) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Read", p)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Read indicates an expected call of Read.
+func (mr *MockStreamMockRecorder) Read(p any) *MockStreamReadCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Read", reflect.TypeOf((*MockStream)(nil).Read), p)
+	return &MockStreamReadCall{Call: call}
+}
+
+// MockStreamReadCall wrap *gomock.Call
+type MockStreamReadCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamReadCall) Return(n int, err error) *MockStreamReadCall {
+	c.Call = c.Call.Return(n, err)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamReadCall) Do(f func([]byte) (int, error)) *MockStreamReadCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamReadCall) DoAndReturn(f func([]byte) (int, error)) *MockStreamReadCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Reset mocks base method.
+func (m *MockStream) Reset(arg0 uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Reset", arg0)
+}
+
+// Reset indicates an expected call of Reset.
+func (mr *MockStreamMockRecorder) Reset(arg0 any) *MockStreamResetCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Reset", reflect.TypeOf((*MockStream)(nil).Reset), arg0)
+	return &MockStreamResetCall{Call: call}
+}
+
+// MockStreamResetCall wrap *gomock.Call
+type MockStreamResetCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamResetCall) Return() *MockStreamResetCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamResetCall) Do(f func(uint32)) *MockStreamResetCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamResetCall) DoAndReturn(f func(uint32)) *MockStreamResetCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Stop mocks base method.
+func (m *MockStream) Stop(arg0 uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Stop", arg0)
+}
+
+// Stop indicates an expected call of Stop.
+func (mr *MockStreamMockRecorder) Stop(arg0 any) *MockStreamStopCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Stop", reflect.TypeOf((*MockStream)(nil).Stop), arg0)
+	return &MockStreamStopCall{Call: call}
+}
+
+// MockStreamStopCall wrap *gomock.Call
+type MockStreamStopCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamStopCall) Return() *MockStreamStopCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamStopCall) Do(f func(uint32)) *MockStreamStopCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamStopCall) DoAndReturn(f func(uint32)) *MockStreamStopCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// StreamID mocks base method.
+func (m *MockStream) StreamID() uint64 {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "StreamID")
+	ret0, _ := ret[0].(uint64)
+	return ret0
+}
+
+// StreamID indicates an expected call of StreamID.
+func (mr *MockStreamMockRecorder) StreamID() *MockStreamStreamIDCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "StreamID", reflect.TypeOf((*MockStream)(nil).StreamID))
+	return &MockStreamStreamIDCall{Call: call}
+}
+
+// MockStreamStreamIDCall wrap *gomock.Call
+type MockStreamStreamIDCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamStreamIDCall) Return(arg0 uint64) *MockStreamStreamIDCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamStreamIDCall) Do(f func() uint64) *MockStreamStreamIDCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamStreamIDCall) DoAndReturn(f func() uint64) *MockStreamStreamIDCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Write mocks base method.
+func (m *MockStream) Write(p []byte) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Write", p)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Write indicates an expected call of Write.
+func (mr *MockStreamMockRecorder) Write(p any) *MockStreamWriteCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Write", reflect.TypeOf((*MockStream)(nil).Write), p)
+	return &MockStreamWriteCall{Call: call}
+}
+
+// MockStreamWriteCall wrap *gomock.Call
+type MockStreamWriteCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamWriteCall) Return(n int, err error) *MockStreamWriteCall {
+	c.Call = c.Call.Return(n, err)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamWriteCall) Do(f func([]byte) (int, error)) *MockStreamWriteCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamWriteCall) DoAndReturn(f func([]byte) (int, error)) *MockStreamWriteCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/mockgen.go b/electron/native/private-transport/third_party/moqtransport/mockgen.go
new file mode 100644
index 000000000..ddbd3fb61
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/mockgen.go
@@ -0,0 +1,7 @@
+package moqtransport
+
+//go:generate go tool mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_connection_test.go github.com/mengelbart/moqtransport Connection
+//go:generate go tool mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_stream_test.go github.com/mengelbart/moqtransport Stream
+//go:generate go tool mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_receive_stream_test.go github.com/mengelbart/moqtransport ReceiveStream
+//go:generate go tool mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_send_stream_test.go github.com/mengelbart/moqtransport SendStream
+//go:generate go tool mockgen -typed -write_package_comment=false -package moqtransport -self_package github.com/mengelbart/moqtransport -destination mock_handler_test.go github.com/mengelbart/moqtransport Handler
diff --git a/electron/native/private-transport/third_party/moqtransport/moqtransport.go b/electron/native/private-transport/third_party/moqtransport/moqtransport.go
new file mode 100644
index 000000000..a57fc14a5
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/moqtransport.go
@@ -0,0 +1 @@
+package moqtransport
diff --git a/electron/native/private-transport/third_party/moqtransport/object.go b/electron/native/private-transport/third_party/moqtransport/object.go
new file mode 100644
index 000000000..b061a18ce
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/object.go
@@ -0,0 +1,17 @@
+package moqtransport
+
+type ObjectForwardingPreference int
+
+const (
+	ObjectForwardingPreferenceSubgroup ObjectForwardingPreference = iota
+	ObjectForwardingPreferenceDatagram
+)
+
+// An Object is a MoQ Object.
+type Object struct {
+	GroupID              uint64
+	ObjectID             uint64
+	ForwardingPreference ObjectForwardingPreference
+	SubGroupID           uint64
+	Payload              []byte
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/outgoing_subscribe_request.go b/electron/native/private-transport/third_party/moqtransport/outgoing_subscribe_request.go
new file mode 100644
index 000000000..f45ca9cc8
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/outgoing_subscribe_request.go
@@ -0,0 +1,153 @@
+package moqtransport
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"sync"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+)
+
+type OutgoingSubscribeRequestOption func(*OutgoingSubscribeRequest) error
+
+type OutgoingSubscribeRequest struct {
+	logger       *slog.Logger
+	requestID    uint64
+	session      *Session
+	streamWriter messageWriter
+	streamReader messageReader
+	buffer       chan *Object
+	bufferMu     sync.Mutex
+	bufferBytes  int
+}
+
+func newOutgoingSubscribeRequest(
+	requestID uint64,
+	session *Session,
+	streamWriter messageWriter,
+	streamReader messageReader,
+	namespace [][]byte,
+	trackName []byte,
+	parameters ...OutgoingSubscribeRequestOption,
+) (*OutgoingSubscribeRequest, error) {
+	r := &OutgoingSubscribeRequest{
+		logger:       defaultLogger,
+		requestID:    requestID,
+		session:      session,
+		streamWriter: streamWriter,
+		streamReader: streamReader,
+		buffer:       make(chan *Object, 100), // TODO: Make buffer size configurable
+	}
+	for _, opt := range parameters {
+		if err := opt(r); err != nil {
+			return nil, err
+		}
+	}
+	msg := &wire.Subscribe{
+		RequestID:      requestID,
+		TrackNamespace: namespace,
+		TrackName:      trackName,
+		Parameters:     nil, // TODO: Add parameters if needed
+	}
+	if err := r.streamWriter.Write(msg); err != nil {
+		return nil, err
+	}
+	r.logger.Debug("sent subscribe request", "requestID", requestID, "namespace", namespace, "trackName", trackName)
+	return r, nil
+}
+
+// readMessages reads from the request stream until it fails. It must be called
+// from a goroutine tracked by the session WaitGroup.
+func (r *OutgoingSubscribeRequest) readMessages() {
+	for {
+		msg, err := r.streamReader.Read()
+		if err != nil {
+			if !errors.Is(err, io.EOF) {
+				r.session.handleReaderError(err)
+			}
+			return
+		}
+		switch msg := msg.(type) {
+		case *wire.SubscribeOk:
+			if err := r.session.bindTrackAlias(msg.TrackAlias, r); err != nil {
+				r.session.closeWithError(&SessionError{
+					Code:   uint64(ErrorCodeProtocolViolation),
+					Reason: err.Error(),
+				})
+				return
+			}
+		case *wire.RequestOk:
+		case *wire.RequestError:
+		default:
+			r.session.closeWithError(&SessionError{
+				Code:   uint64(ErrorCodeProtocolViolation),
+				Reason: fmt.Sprintf("unexpected message type: %T", msg),
+			})
+			return
+		}
+	}
+}
+
+func (t *OutgoingSubscribeRequest) push(o *Object) {
+	t.bufferMu.Lock()
+	defer t.bufferMu.Unlock()
+	if t.bufferBytes+len(o.Payload) > maxGroupBytes {
+		return
+	}
+	// Session-wide byte accounting prevents many subscribed tracks from
+	// multiplying the large-object budget. Reserve room for small objects.
+	limit := int64(maxGroupBytes)
+	if len(o.Payload) <= 1024 {
+		limit += 64 * 1024
+	}
+	for {
+		queued := t.session.receiveBytes.Load()
+		if queued+int64(len(o.Payload)) > limit {
+			return
+		}
+		if t.session.receiveBytes.CompareAndSwap(queued, queued+int64(len(o.Payload))) {
+			break
+		}
+	}
+	select {
+	case t.buffer <- o:
+		t.bufferBytes += len(o.Payload)
+	default:
+		t.session.receiveBytes.Add(-int64(len(o.Payload)))
+		t.logger.Info("buffer overflow: dropping incoming object")
+	}
+}
+
+func (r *OutgoingSubscribeRequest) Close() error {
+	// TODO: Send a message to the peer to stop the subscription.
+	r.session.removeReceiver(r)
+	r.bufferMu.Lock()
+	defer r.bufferMu.Unlock()
+	for {
+		select {
+		case obj := <-r.buffer:
+			r.bufferBytes -= len(obj.Payload)
+			r.session.receiveBytes.Add(-int64(len(obj.Payload)))
+		default:
+			return nil
+		}
+	}
+}
+
+func (r *OutgoingSubscribeRequest) ReadObject(ctx context.Context) (*Object, error) {
+	r.logger.Debug("waiting for next object")
+	// TODO: Add case for shutdown when request is closed
+	select {
+	case <-ctx.Done():
+		return nil, context.Cause(ctx)
+	case obj := <-r.buffer:
+		r.bufferMu.Lock()
+		r.bufferBytes -= len(obj.Payload)
+		r.session.receiveBytes.Add(-int64(len(obj.Payload)))
+		r.bufferMu.Unlock()
+		return obj, nil
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/quicmoq/connection.go b/electron/native/private-transport/third_party/moqtransport/quicmoq/connection.go
new file mode 100644
index 000000000..63e125465
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/quicmoq/connection.go
@@ -0,0 +1,118 @@
+package quicmoq
+
+import (
+	"context"
+
+	"github.com/mengelbart/moqtransport"
+	"github.com/quic-go/quic-go"
+)
+
+type connection struct {
+	connection  *quic.Conn
+	perspective moqtransport.Perspective
+}
+
+func NewServer(conn *quic.Conn) moqtransport.Connection {
+	return New(conn, moqtransport.PerspectiveServer)
+}
+
+func NewClient(conn *quic.Conn) moqtransport.Connection {
+	return New(conn, moqtransport.PerspectiveClient)
+}
+
+func New(conn *quic.Conn, perspective moqtransport.Perspective) moqtransport.Connection {
+	return &connection{conn, perspective}
+}
+
+func (c *connection) AcceptStream(ctx context.Context) (moqtransport.Stream, error) {
+	s, err := c.connection.AcceptStream(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &Stream{
+		stream: s,
+	}, nil
+}
+
+func (c *connection) AcceptUniStream(ctx context.Context) (moqtransport.ReceiveStream, error) {
+	s, err := c.connection.AcceptUniStream(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &ReceiveStream{
+		stream: s,
+	}, nil
+}
+
+func (c *connection) OpenStream() (moqtransport.Stream, error) {
+	s, err := c.connection.OpenStream()
+	if err != nil {
+		return nil, err
+	}
+	return &Stream{
+		stream: s,
+	}, nil
+}
+
+func (c *connection) OpenStreamSync(ctx context.Context) (moqtransport.Stream, error) {
+	s, err := c.connection.OpenStreamSync(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &Stream{
+		stream: s,
+	}, nil
+}
+
+func (c *connection) OpenUniStream() (moqtransport.SendStream, error) {
+	s, err := c.connection.OpenUniStream()
+	if err != nil {
+		return nil, err
+	}
+	return &SendStream{
+		stream: s,
+	}, nil
+}
+
+func (c *connection) OpenUniStreamSync(ctx context.Context) (moqtransport.SendStream, error) {
+	s, err := c.connection.OpenUniStreamSync(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &SendStream{
+		stream: s,
+	}, nil
+}
+
+func (c *connection) SendDatagram(b []byte) error {
+	return c.connection.SendDatagram(b)
+}
+
+func (c *connection) DeliveryNetworkStats() moqtransport.DeliveryNetworkStats {
+	s := c.connection.ConnectionStats()
+	return moqtransport.DeliveryNetworkStats{RTT: s.SmoothedRTT, MinRTT: s.MinRTT, PacketsSent: s.PacketsSent, PacketsLost: s.PacketsLost}
+}
+
+func (c *connection) ReceiveDatagram(ctx context.Context) ([]byte, error) {
+	return c.connection.ReceiveDatagram(ctx)
+}
+
+func (c *connection) CloseWithError(e uint64, msg string) error {
+	return c.connection.CloseWithError(quic.ApplicationErrorCode(e), msg)
+}
+
+func (c *connection) Context() context.Context {
+	return c.connection.Context()
+}
+
+func (c *connection) Protocol() moqtransport.Protocol {
+	return moqtransport.ProtocolQUIC
+}
+
+func (c *connection) ApplicationProtocol() moqtransport.ApplicationProtocol {
+	return moqtransport.ApplicationProtocol(c.connection.ConnectionState().TLS.NegotiatedProtocol)
+}
+
+func (c *connection) Perspective() moqtransport.Perspective {
+	return c.perspective
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/quicmoq/receive_stream.go b/electron/native/private-transport/third_party/moqtransport/quicmoq/receive_stream.go
new file mode 100644
index 000000000..a2bfb6365
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/quicmoq/receive_stream.go
@@ -0,0 +1,27 @@
+package quicmoq
+
+import (
+	"github.com/mengelbart/moqtransport"
+	"github.com/quic-go/quic-go"
+)
+
+var _ moqtransport.ReceiveStream = (*ReceiveStream)(nil)
+
+type ReceiveStream struct {
+	stream *quic.ReceiveStream
+}
+
+// Read implements moqtransport.ReceiveStream.
+func (r *ReceiveStream) Read(p []byte) (n int, err error) {
+	return r.stream.Read(p)
+}
+
+// Stop implements moqtransport.ReceiveStream.
+func (r *ReceiveStream) Stop(code uint32) {
+	r.stream.CancelRead(quic.StreamErrorCode(code))
+}
+
+// StreamID implements moqtransport.ReceiveStream
+func (r *ReceiveStream) StreamID() uint64 {
+	return uint64(r.stream.StreamID())
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/quicmoq/send_stream.go b/electron/native/private-transport/third_party/moqtransport/quicmoq/send_stream.go
new file mode 100644
index 000000000..86d1fd663
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/quicmoq/send_stream.go
@@ -0,0 +1,32 @@
+package quicmoq
+
+import (
+	"github.com/mengelbart/moqtransport"
+	"github.com/quic-go/quic-go"
+)
+
+var _ moqtransport.SendStream = (*SendStream)(nil)
+
+type SendStream struct {
+	stream *quic.SendStream
+}
+
+// Write implements moqtransport.SendStream.
+func (s *SendStream) Write(p []byte) (n int, err error) {
+	return s.stream.Write(p)
+}
+
+// Reset implements moqtransport.SendStream
+func (s *SendStream) Reset(code uint32) {
+	s.stream.CancelWrite(quic.StreamErrorCode(code))
+}
+
+// Close implements moqtransport.SendStream.
+func (s *SendStream) Close() error {
+	return s.stream.Close()
+}
+
+// StreamID implements moqtransport.SendStream
+func (s *SendStream) StreamID() uint64 {
+	return uint64(s.stream.StreamID())
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/quicmoq/stream.go b/electron/native/private-transport/third_party/moqtransport/quicmoq/stream.go
new file mode 100644
index 000000000..783ca0043
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/quicmoq/stream.go
@@ -0,0 +1,42 @@
+package quicmoq
+
+import (
+	"github.com/mengelbart/moqtransport"
+	"github.com/quic-go/quic-go"
+)
+
+var _ moqtransport.Stream = (*Stream)(nil)
+
+type Stream struct {
+	stream *quic.Stream
+}
+
+// Read implements moqtransport.Stream.
+func (s *Stream) Read(p []byte) (n int, err error) {
+	return s.stream.Read(p)
+}
+
+// Write implements moqtransport.Stream.
+func (s *Stream) Write(p []byte) (n int, err error) {
+	return s.stream.Write(p)
+}
+
+// Close implements moqtransport.Stream.
+func (s *Stream) Close() error {
+	return s.stream.Close()
+}
+
+// Reset implements moqtransport.Stream.
+func (s *Stream) Reset(code uint32) {
+	s.stream.CancelWrite(quic.StreamErrorCode(code))
+}
+
+// Stop implements moqtransport.Stream.
+func (s *Stream) Stop(code uint32) {
+	s.stream.CancelRead(quic.StreamErrorCode(code))
+}
+
+// StreamID implements moqtransport.Stream.
+func (s *Stream) StreamID() uint64 {
+	return uint64(s.stream.StreamID())
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/remote_control_stream.go b/electron/native/private-transport/third_party/moqtransport/remote_control_stream.go
new file mode 100644
index 000000000..f6f022b42
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/remote_control_stream.go
@@ -0,0 +1,46 @@
+package moqtransport
+
+import (
+	"fmt"
+	"log/slog"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+)
+
+type remoteControlStream struct {
+	logger *slog.Logger
+	r      messageReader
+	s      *Session
+}
+
+func newRemoteControlStream(msg *wire.Setup, r messageReader, s *Session) *remoteControlStream {
+	rcs := &remoteControlStream{
+		logger: defaultLogger.With("stream", "remote_control"),
+		r:      r,
+		s:      s,
+	}
+	rcs.logger.Debug("remote control stream created", "setup", msg)
+	return rcs
+}
+
+// readMessages reads from the remote control stream until it fails. It must be
+// called from a goroutine tracked by the session WaitGroup.
+func (s *remoteControlStream) readMessages() {
+	for {
+		msg, err := s.r.Read()
+		if err != nil {
+			s.s.handleReaderError(err)
+			return
+		}
+		switch msg := msg.(type) {
+		case *wire.GoAwayCtrl:
+			s.s.onGoAway(msg)
+		default:
+			s.s.closeWithError(&SessionError{
+				Code:   uint64(ErrorCodeProtocolViolation),
+				Reason: fmt.Sprintf("unexpected control message type: %T", msg),
+			})
+			return
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/request_id.go b/electron/native/private-transport/third_party/moqtransport/request_id.go
new file mode 100644
index 000000000..4e1136c3b
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/request_id.go
@@ -0,0 +1,26 @@
+package moqtransport
+
+import (
+	"sync"
+)
+
+type requestIDGenerator struct {
+	lock     sync.Mutex
+	id       uint64
+	interval uint64
+}
+
+func newRequestIDGenerator(initialID uint64) *requestIDGenerator {
+	return &requestIDGenerator{
+		id:       initialID,
+		interval: 2,
+	}
+}
+
+func (g *requestIDGenerator) next() uint64 {
+	g.lock.Lock()
+	defer g.lock.Unlock()
+	next := g.id
+	g.id += g.interval
+	return next
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/session.go b/electron/native/private-transport/third_party/moqtransport/session.go
new file mode 100644
index 000000000..54083f13d
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/session.go
@@ -0,0 +1,534 @@
+package moqtransport
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"math"
+	"sync"
+	"sync/atomic"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+	"github.com/mengelbart/moqtransport/varint"
+)
+
+var (
+	errMissingPathParameter    = errors.New("missing path parameter")
+	errUnexpectedPathParameter = errors.New("unexpected path parameter on WebTransport connection")
+)
+
+type messageReader interface {
+	Read() (wire.ControlMessage, error)
+}
+
+type messageWriter interface {
+	Write(wire.ControlMessage) error
+}
+
+type Option func(*Session) error
+
+func WithHandler(handler Handler) Option {
+	return func(s *Session) error {
+		s.handler = handler
+		return nil
+	}
+}
+
+// A Session is an endpoint of a MoQ Session session.
+type Session struct {
+	deliveryOnce sync.Once
+	delivery     *deliveryScheduler
+	logger       *slog.Logger
+
+	ctx       context.Context
+	cancelCtx context.CancelCauseFunc
+	wg        sync.WaitGroup
+
+	closeLock sync.Mutex
+	closeErr  error
+
+	conn       Connection
+	requestIDs *requestIDGenerator
+
+	controlStreamLock   sync.Mutex
+	remoteControlStream *remoteControlStream
+	localControlStream  *localControlStream
+	remotePath          string
+
+	handler Handler
+
+	version uint64
+	path    string
+
+	tracksLock    sync.Mutex
+	tracks        map[uint64]*trackEntry
+	pendingTracks int
+	pendingBytes  int
+	receiveBytes  atomic.Int64
+	reliableBytes atomic.Int64
+}
+
+// NewSession creates a session on conn. It never closes conn: if NewSession
+// returns an error, nothing has been written and the caller keeps ownership of
+// conn. Once a session exists, only the session closes conn. Errors that occur
+// after NewSession returned, including a failed SETUP write, are reported
+// through Context.
+func NewSession(conn Connection, path string, options ...Option) (*Session, error) {
+	version := conn.ApplicationProtocol().versionNumber()
+	if version == 0 {
+		return nil, fmt.Errorf("unsupported application protocol: %q", conn.ApplicationProtocol())
+	}
+	logger := defaultLogger.With("perspective", conn.Perspective())
+	logger.Debug("creating new session", "version", version, "path", path)
+
+	s := &Session{
+		logger:              logger,
+		wg:                  sync.WaitGroup{},
+		conn:                conn,
+		requestIDs:          newRequestIDGenerator(uint64(conn.Perspective())),
+		remoteControlStream: nil,
+		localControlStream:  nil,
+		handler:             nil,
+		version:             version,
+		path:                path,
+		tracks:              make(map[uint64]*trackEntry),
+	}
+
+	for _, opt := range options {
+		if err := opt(s); err != nil {
+			return nil, err
+		}
+	}
+
+	ctrlStream, err := conn.OpenUniStream()
+	if err != nil {
+		return nil, err
+	}
+	s.localControlStream = newLocalControlStream(wire.NewAppender(ctrlStream, uint64(version)))
+
+	s.ctx, s.cancelCtx = context.WithCancelCause(context.Background())
+
+	s.wg.Go(func() { s.sendSetup() })
+	s.wg.Go(func() { s.readUniStreams() })
+	s.wg.Go(func() { s.readBidiStreams() })
+	s.wg.Go(func() { s.readDatagrams() })
+
+	return s, nil
+}
+
+type SessionError struct {
+	Code   uint64
+	Reason string
+	Remote bool
+}
+
+func (e *SessionError) Error() string {
+	return e.Reason
+}
+
+func (e *SessionError) Is(target error) bool {
+	other, ok := target.(*SessionError)
+	return ok && e.Code == other.Code && e.Remote == other.Remote
+}
+
+func (s *Session) CloseWithError(code uint64, reason string) {
+	s.closeWithError(&SessionError{Code: code, Reason: reason, Remote: false})
+	s.wg.Wait()
+}
+
+// Context returns a context that is canceled when the session closes.
+// context.Cause reports the error that closed it.
+func (s *Session) Context() context.Context {
+	return s.ctx
+}
+
+func (s *Session) sendSetup() {
+	setup := &wire.Setup{}
+	if s.conn.Protocol() == ProtocolQUIC {
+		setup.Options = []wire.KeyValuePair{
+			{Type: wire.PathParameterKey, Bytes: []byte(s.path)},
+		}
+	}
+	if err := s.localControlStream.write(setup); err != nil {
+		s.handleReaderError(err)
+		return
+	}
+	s.logger.Debug("setup message sent", "version", s.version, "path", s.path)
+}
+
+func (s *Session) closeWithError(closeErr error) bool {
+	s.closeLock.Lock()
+	defer s.closeLock.Unlock()
+	if s.closeErr != nil {
+		return false
+	}
+	s.closeErr = closeErr
+	s.cancelCtx(closeErr)
+
+	code := uint64(ErrorCodeInternal)
+	reason := ""
+	if se, ok := closeErr.(*SessionError); ok {
+		code = se.Code
+		reason = se.Reason
+	}
+	_ = s.conn.CloseWithError(code, reason)
+
+	return true
+}
+
+// goTracked runs f in a goroutine tracked by the session WaitGroup. It reports
+// an error and does not start f if the session is already closed.
+func (s *Session) goTracked(f func()) error {
+	s.closeLock.Lock()
+	defer s.closeLock.Unlock()
+	if s.closeErr != nil {
+		return s.closeErr
+	}
+	s.wg.Go(f)
+	return nil
+}
+
+// handleReaderError closes the session unless it is already shutting down, in
+// which case the error is expected and ignored.
+func (s *Session) handleReaderError(err error) {
+	if s.ctx.Err() != nil {
+		s.logger.Debug("ignoring reader error during session shutdown", "error", err)
+		return
+	}
+	s.closeWithError(err)
+}
+
+func (s *Session) readUniStreams() {
+	s.logger.Debug("starting to read uni streams")
+	for {
+		stream, err := s.conn.AcceptUniStream(s.ctx)
+		if err != nil {
+			if s.ctx.Err() != nil {
+				s.logger.Debug("context canceled, stopping readUniStreams")
+				return
+			}
+			s.closeWithError(err)
+			return
+		}
+		s.wg.Go(func() { s.handleUniStream(stream) })
+	}
+}
+
+func (s *Session) readBidiStreams() {
+	s.logger.Debug("starting to read bidi streams")
+	for {
+		stream, err := s.conn.AcceptStream(s.ctx)
+		if err != nil {
+			if s.ctx.Err() != nil {
+				s.logger.Debug("context canceled, stopping readBidiStreams")
+				return
+			}
+			s.closeWithError(err)
+			return
+		}
+		s.wg.Go(func() { s.handleBidiStream(stream) })
+	}
+}
+
+func (s *Session) readDatagrams() {
+	s.logger.Debug("starting to read datagrams")
+	for {
+		dgram, err := s.conn.ReceiveDatagram(s.ctx)
+		if err != nil {
+			if s.ctx.Err() != nil {
+				s.logger.Debug("context canceled, stopping readDatagrams")
+				return
+			}
+			s.closeWithError(err)
+			return
+		}
+		msg := new(wire.DatagramObject)
+		if err = msg.Parse(dgram); err != nil {
+			s.closeWithError(&SessionError{Code: uint64(ErrorCodeProtocolViolation), Reason: fmt.Sprintf("failed to parse datagram: %v", err), Remote: false})
+			return
+		}
+		s.receiveDatagram(msg)
+	}
+}
+
+func (s *Session) handleUniStream(stream ReceiveStream) {
+	s.logger.Debug("accepted new uni stream", "streamID", stream.StreamID())
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	var wg sync.WaitGroup
+	defer func() { cancel(); wg.Wait() }()
+	wg.Go(func() {
+		select {
+		case <-ctx.Done():
+		case <-s.ctx.Done():
+			stream.Stop(0) // TODO: Set correct error code?
+		}
+	})
+
+	// TODO: This is a hacky way to figure out the stream type before
+	// creating the parser. Ideally, we wouldn't need to know the stream
+	// type, because we could parse all messages based on the message type
+	// given in the first varint. However, the code points currently overlap
+	// so it is impossible to distinguish between some messages that can
+	// only be sent on different stream types.
+	br := bufio.NewReader(stream)
+	firstVarint, err := peekFirstVarint(br)
+	if err != nil {
+		s.logger.Error("failed to peek first varint of stream", "streamID", stream.StreamID(), "error", err)
+		stream.Stop(uint32(StreamResetErrorCodeInternal))
+		return
+	}
+	typ, _, err := varint.Parse(firstVarint)
+	if err != nil {
+		s.closeWithError(&SessionError{Code: uint64(ErrorCodeProtocolViolation), Reason: fmt.Sprintf("failed to parse first varint of stream: %v", err), Remote: false})
+		return
+	}
+	var streamType wire.StreamType
+	if typ == 0x2f00 {
+		streamType = wire.StreamTypeControl
+	} else {
+		streamType = wire.StreamTypeData
+	}
+	s.logger.Debug("got stream type", "streamID", stream.StreamID(), "streamType", streamType)
+
+	parser, err := wire.NewParser(br, uint64(s.version), streamType)
+	if err != nil {
+		s.logger.Error("failed to create parser", "streamID", stream.StreamID(), "error", err)
+		stream.Stop(uint32(StreamResetErrorCodeInternal))
+		return
+	}
+	msg, err := parser.Read()
+	if err != nil {
+		s.logger.Error("error while reading message", "streamID", stream.StreamID(), "error", err, "typ", typ)
+		if streamType == wire.StreamTypeData {
+			stream.Stop(uint32(StreamResetErrorCodeInternal))
+			return
+		}
+		s.closeWithError(&SessionError{Code: uint64(ErrorCodeProtocolViolation), Reason: fmt.Sprintf("failed to parse message: %v", err), Remote: false})
+		return
+	}
+	switch m := msg.(type) {
+	case *wire.Setup:
+		path, err := validatePathParameter(m.Options, s.conn.Protocol() == ProtocolQUIC)
+		if err != nil {
+			s.closeWithError(&SessionError{Code: uint64(ErrorCodeInvalidPath), Reason: err.Error(), Remote: false})
+			return
+		}
+		rcs := newRemoteControlStream(m, parser, s)
+		if !s.setRemoteControlStream(rcs, path) {
+			s.closeWithError(&SessionError{Code: uint64(ErrorCodeProtocolViolation), Reason: "duplicate control stream", Remote: false})
+			return
+		}
+		rcs.readMessages()
+	case *wire.SubgroupHeader:
+		defer stream.Stop(uint32(StreamResetErrorCodeInternal))
+		s.readDataStream(m, parser)
+	case *wire.Padding:
+		if _, err := io.Copy(io.Discard, br); err != nil {
+			s.logger.Debug("error while discarding padding stream", "streamID", stream.StreamID(), "error", err)
+		}
+	default:
+		// TODO
+		s.closeWithError(&SessionError{Code: uint64(ErrorCodeProtocolViolation), Reason: fmt.Sprintf("unexpected message type: %T", m), Remote: false})
+		return
+	}
+}
+
+func (s *Session) setRemoteControlStream(rcs *remoteControlStream, path string) bool {
+	s.controlStreamLock.Lock()
+	defer s.controlStreamLock.Unlock()
+	if s.remoteControlStream != nil {
+		return false
+	}
+	s.remoteControlStream = rcs
+	s.remotePath = path
+	return true
+}
+
+// Path returns the path the peer sent in its SETUP message. It is only
+// populated for QUIC connections, since WebTransport conveys the path in the
+// HTTP request instead. It is empty until the peer's SETUP has been received.
+func (s *Session) Path() string {
+	s.controlStreamLock.Lock()
+	defer s.controlStreamLock.Unlock()
+	return s.remotePath
+}
+
+func peekFirstVarint(br *bufio.Reader) ([]byte, error) {
+	firstByte, err := br.Peek(1)
+	if err != nil {
+		return nil, err
+	}
+
+	needed := 1
+	for i := 7; i >= 0; i-- {
+		if (firstByte[0] & (1 << uint(i))) == 0 {
+			break
+		}
+		needed++
+	}
+
+	return br.Peek(needed)
+}
+
+func (s *Session) handleBidiStream(stream Stream) {
+	s.logger.Debug("accepted new bidi stream", "streamID", stream.StreamID())
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	var wg sync.WaitGroup
+	defer wg.Wait()
+	wg.Go(func() {
+		select {
+		case <-ctx.Done():
+		case <-s.ctx.Done():
+			stream.Stop(0)  // TODO: Set correct error code?
+			stream.Reset(0) // TODO: Set correct error code?
+		}
+	})
+
+	parser, err := wire.NewParser(stream, uint64(s.version), wire.StreamTypeRequest)
+	if err != nil {
+		stream.Stop(uint32(StreamResetErrorCodeInternal))
+		stream.Reset(uint32(StreamResetErrorCodeInternal))
+		return
+	}
+	msg, err := parser.Read()
+	if err != nil {
+		stream.Stop(uint32(StreamResetErrorCodeInternal))
+		stream.Reset(uint32(StreamResetErrorCodeInternal))
+		return
+	}
+	switch m := msg.(type) {
+	case *wire.TrackStatus:
+	case *wire.Subscribe:
+		// TODO: Handle incoming request
+		if s.handler == nil {
+			return
+		}
+		request := newIncomingSubscribeRequest(m, s, wire.NewAppender(stream, uint64(s.version)), parser)
+		s.handler.HandleSubscribe(request)
+		request.readMessages()
+	case *wire.Publish:
+	case *wire.Fetch:
+	case *wire.PublishNamespace:
+	case *wire.SubscribeNamespace:
+	case *wire.SubscribeTracks:
+	default:
+		s.closeWithError(&SessionError{Code: uint64(ErrorCodeProtocolViolation), Reason: fmt.Sprintf("unexpected message type: %T", m), Remote: false})
+		return
+	}
+}
+
+// readDataStream reads objects from a subgroup stream until it ends and routes
+// them by track alias. It must be called from a goroutine tracked by the
+// session WaitGroup.
+func (s *Session) readDataStream(header *wire.SubgroupHeader, parser messageReader) {
+	var (
+		firstObject  = true
+		lastObjectID uint64
+		subgroupID   = header.SubgroupID
+	)
+	for {
+		m, err := parser.Read()
+		if err != nil {
+			// Expiry/reset of a data subgroup is local to that subgroup, not
+			// a control-plane failure. Keep other tracks and the session alive.
+			return
+		}
+		o, ok := m.(*wire.SubgroupObject)
+		if !ok {
+			s.closeWithError(&SessionError{
+				Code:   uint64(ErrorCodeProtocolViolation),
+				Reason: fmt.Sprintf("unexpected message type: %T", m),
+			})
+			return
+		}
+		objectID := o.ObjectIDDelta
+		if firstObject {
+			if header.SubgroupIDMode() == wire.SubgroupIDModeFirstObject {
+				subgroupID = objectID
+			}
+		} else {
+			if o.ObjectIDDelta >= math.MaxUint64-lastObjectID {
+				s.closeWithError(&SessionError{
+					Code:   uint64(ErrorCodeProtocolViolation),
+					Reason: "object ID out of range",
+				})
+				return
+			}
+			objectID = lastObjectID + o.ObjectIDDelta + 1
+		}
+		firstObject = false
+		lastObjectID = objectID
+
+		payload := make([]byte, len(o.ObjectPayload))
+		copy(payload, o.ObjectPayload)
+		s.logger.Debug("received object", "groupID", header.GroupID, "subgroupID", subgroupID, "objectID", objectID, "payloadLength", len(payload))
+		s.pushObject(header.TrackAlias, &Object{
+			GroupID:              header.GroupID,
+			ObjectID:             objectID,
+			ForwardingPreference: ObjectForwardingPreferenceSubgroup,
+			SubGroupID:           subgroupID,
+			Payload:              payload,
+		})
+	}
+}
+
+func (s *Session) receiveDatagram(msg *wire.DatagramObject) {
+	payload := make([]byte, len(msg.ObjectPayload))
+	copy(payload, msg.ObjectPayload)
+	s.pushObject(msg.TrackAlias, &Object{
+		GroupID:              msg.GroupID,
+		ObjectID:             msg.ObjectID,
+		ForwardingPreference: ObjectForwardingPreferenceDatagram,
+		Payload:              payload,
+	})
+}
+
+func (s *Session) Subscribe(
+	ctx context.Context,
+	namespace [][]byte,
+	name string,
+) (*OutgoingSubscribeRequest, error) {
+	s.closeLock.Lock()
+	if s.closeErr != nil {
+		s.closeLock.Unlock()
+		return nil, s.closeErr
+	}
+	s.closeLock.Unlock()
+
+	requestID := s.requestIDs.next()
+	stream, err := s.conn.OpenStreamSync(ctx)
+	if err != nil {
+		return nil, err
+	}
+	s.logger.Debug("opened new stream for subscribe request", "requestID", requestID, "namespace", namespace, "name", name)
+	parser, err := wire.NewParser(stream, uint64(s.version), wire.StreamTypeRequest)
+	if err != nil {
+		return nil, err
+	}
+	appender := wire.NewAppender(stream, uint64(s.version))
+
+	request, err := newOutgoingSubscribeRequest(requestID, s, appender, parser, namespace, []byte(name))
+	if err != nil {
+		return nil, err
+	}
+
+	if err := s.goTracked(request.readMessages); err != nil {
+		return nil, err
+	}
+	return request, nil
+}
+
+func (s *Session) onGoAway(msg *wire.GoAwayCtrl) {
+	if s.handler == nil {
+		return
+	}
+	s.handler.HandleGoAway(msg.NewSessionURI)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/session_control_stream_test.go b/electron/native/private-transport/third_party/moqtransport/session_control_stream_test.go
new file mode 100644
index 000000000..11f479a36
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/session_control_stream_test.go
@@ -0,0 +1,46 @@
+package moqtransport
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/goleak"
+)
+
+func sessionCloseError(s *Session) error {
+	s.closeLock.Lock()
+	defer s.closeLock.Unlock()
+	return s.closeErr
+}
+
+func acceptedControlStream(s *Session) *remoteControlStream {
+	s.controlStreamLock.Lock()
+	defer s.controlStreamLock.Unlock()
+	return s.remoteControlStream
+}
+
+// A session has exactly one remote control stream. A second one from the peer
+// is a protocol violation and must not replace the first.
+func TestDuplicateControlStreamClosesSession(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	first := conn.acceptUniStream(encodeControlMessage(t, setupWithPath("/path")))
+	<-first.drained
+	accepted := acceptedControlStream(session)
+	require.NotNil(t, accepted)
+
+	conn.acceptUniStream(encodeControlMessage(t, setupWithPath("/path")))
+	require.Eventually(t, func() bool {
+		return sessionCloseError(session) != nil
+	}, time.Second, time.Millisecond)
+
+	assert.ErrorIs(t, sessionCloseError(session), &SessionError{Code: uint64(ErrorCodeProtocolViolation)})
+	assert.Same(t, accepted, acceptedControlStream(session))
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/session_helpers.go b/electron/native/private-transport/third_party/moqtransport/session_helpers.go
new file mode 100644
index 000000000..bdcc0f26d
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/session_helpers.go
@@ -0,0 +1,34 @@
+package moqtransport
+
+import (
+	"slices"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+)
+
+func validatePathParameter(setupParameters []wire.KeyValuePair, protocolIsQUIC bool) (string, error) {
+	index := slices.IndexFunc(setupParameters, func(p wire.KeyValuePair) bool {
+		return p.Type == wire.PathParameterKey
+	})
+	if index < 0 {
+		if protocolIsQUIC {
+			return "", errMissingPathParameter
+		}
+		return "", nil
+	}
+	if !protocolIsQUIC {
+		return "", errUnexpectedPathParameter
+	}
+	return string(setupParameters[index].Bytes), nil
+}
+
+//nolint:unused
+func validateAuthParameter(subscribeParameters []wire.KeyValuePair) (string, error) {
+	index := slices.IndexFunc(subscribeParameters, func(p wire.KeyValuePair) bool {
+		return p.Type == wire.AuthorizationTokenParameterKey
+	})
+	if index < 0 {
+		return "", nil
+	}
+	return string(subscribeParameters[index].Bytes), nil
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/session_helpers_test.go b/electron/native/private-transport/third_party/moqtransport/session_helpers_test.go
new file mode 100644
index 000000000..16b73a678
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/session_helpers_test.go
@@ -0,0 +1,62 @@
+package moqtransport
+
+import (
+	"testing"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidatePathParameter(t *testing.T) {
+	path := wire.KeyValuePair{Type: wire.PathParameterKey, Bytes: []byte("/path")}
+	other := wire.KeyValuePair{Type: wire.MaxRequestIDParameterKey, Varint: 1}
+
+	cases := []struct {
+		name           string
+		parameters     []wire.KeyValuePair
+		protocolIsQUIC bool
+		expect         string
+		err            error
+	}{
+		{
+			name:           "missing on QUIC",
+			protocolIsQUIC: true,
+			err:            errMissingPathParameter,
+		},
+		{
+			name:           "missing on WebTransport",
+			protocolIsQUIC: false,
+		},
+		{
+			name:           "first parameter on QUIC",
+			parameters:     []wire.KeyValuePair{path, other},
+			protocolIsQUIC: true,
+			expect:         "/path",
+		},
+		{
+			name:           "later parameter on QUIC",
+			parameters:     []wire.KeyValuePair{other, path},
+			protocolIsQUIC: true,
+			expect:         "/path",
+		},
+		{
+			name:           "first parameter on WebTransport",
+			parameters:     []wire.KeyValuePair{path, other},
+			protocolIsQUIC: false,
+			err:            errUnexpectedPathParameter,
+		},
+		{
+			name:           "later parameter on WebTransport",
+			parameters:     []wire.KeyValuePair{other, path},
+			protocolIsQUIC: false,
+			err:            errUnexpectedPathParameter,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			res, err := validatePathParameter(tc.parameters, tc.protocolIsQUIC)
+			assert.Equal(t, tc.expect, res)
+			assert.Equal(t, tc.err, err)
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/session_objects_test.go b/electron/native/private-transport/third_party/moqtransport/session_objects_test.go
new file mode 100644
index 000000000..4bf734eea
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/session_objects_test.go
@@ -0,0 +1,272 @@
+package moqtransport
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/goleak"
+)
+
+type testReceiver struct {
+	objects []*Object
+}
+
+func (r *testReceiver) push(o *Object) {
+	r.objects = append(r.objects, o)
+}
+
+// testObject is an object on a subgroup stream, identified by its wire object
+// ID delta rather than its object ID.
+type testObject struct {
+	delta   uint64
+	payload string
+}
+
+func encodeDataStream(t *testing.T, trackAlias, groupID, subgroupID uint64, objects ...testObject) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	appender := wire.NewAppender(&buf, 18)
+	require.NoError(t, appender.Write(wire.NewSubgroupHeader(trackAlias, groupID, subgroupID, 0)))
+	for _, o := range objects {
+		require.NoError(t, appender.Write(&wire.SubgroupObject{
+			ObjectIDDelta: o.delta,
+			ObjectPayload: []byte(o.payload),
+		}))
+	}
+	return buf.Bytes()
+}
+
+func encodeDatagram(trackAlias, groupID, objectID uint64, payload string) []byte {
+	msg := &wire.DatagramObject{
+		TrackAlias:    trackAlias,
+		GroupID:       groupID,
+		ObjectID:      objectID,
+		ObjectPayload: []byte(payload),
+	}
+	return msg.AppendDatagram(nil)
+}
+
+func readObject(t *testing.T, request *OutgoingSubscribeRequest) *Object {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	o, err := request.ReadObject(ctx)
+	require.NoError(t, err)
+	return o
+}
+
+func trackCount(s *Session) int {
+	s.tracksLock.Lock()
+	defer s.tracksLock.Unlock()
+	return len(s.tracks)
+}
+
+func hasTrackAlias(s *Session, trackAlias uint64) bool {
+	s.tracksLock.Lock()
+	defer s.tracksLock.Unlock()
+	entry, ok := s.tracks[trackAlias]
+	return ok && entry.receiver != nil
+}
+
+// subscribe starts a subscription and returns it together with the reader of
+// the stream the session opened for it.
+func subscribe(t *testing.T, session *Session, conn *testConnection) (*OutgoingSubscribeRequest, *blockingReader) {
+	t.Helper()
+	request, err := session.Subscribe(context.Background(), [][]byte{[]byte("namespace")}, "track")
+	require.NoError(t, err)
+	return request, <-conn.openedStreams
+}
+
+// The track alias is assigned by the peer in SUBSCRIBE_OK, so a subgroup stream
+// can arrive first. Its objects must be delivered once the alias is known.
+func TestSubgroupBeforeSubscribeOk(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	request, requestStream := subscribe(t, session, conn)
+
+	reader := conn.acceptUniStream(encodeDataStream(t, 17, 3, 5, testObject{0, "hello"}))
+	<-reader.drained
+
+	requestStream.feed(encodeControlMessage(t, &wire.SubscribeOk{TrackAlias: 17}))
+
+	o := readObject(t, request)
+	assert.Equal(t, []byte("hello"), o.Payload)
+	assert.Equal(t, uint64(3), o.GroupID)
+	assert.Equal(t, uint64(5), o.SubGroupID)
+	assert.Equal(t, uint64(0), o.ObjectID)
+	assert.Equal(t, ObjectForwardingPreferenceSubgroup, o.ForwardingPreference)
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+func TestSubgroupAfterSubscribeOk(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	request, requestStream := subscribe(t, session, conn)
+	requestStream.feed(encodeControlMessage(t, &wire.SubscribeOk{TrackAlias: 17}))
+	require.Eventually(t, func() bool {
+		return hasTrackAlias(session, 17)
+	}, time.Second, time.Millisecond)
+
+	conn.acceptUniStream(encodeDataStream(t, 17, 3, 5, testObject{0, "hello"}))
+
+	assert.Equal(t, []byte("hello"), readObject(t, request).Payload)
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+// The object ID of the first object on a subgroup stream is its delta, and each
+// following object is the previous object ID plus its delta plus one.
+func TestSubgroupObjectIDDeltas(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	request, requestStream := subscribe(t, session, conn)
+	requestStream.feed(encodeControlMessage(t, &wire.SubscribeOk{TrackAlias: 17}))
+	require.Eventually(t, func() bool {
+		return hasTrackAlias(session, 17)
+	}, time.Second, time.Millisecond)
+
+	conn.acceptUniStream(encodeDataStream(t, 17, 3, 5,
+		testObject{2, "first"},
+		testObject{0, "second"},
+		testObject{3, "third"},
+	))
+
+	for _, want := range []uint64{2, 3, 7} {
+		assert.Equal(t, want, readObject(t, request).ObjectID)
+	}
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+// Datagrams carry a track alias too and can arrive before SUBSCRIBE_OK.
+func TestDatagramBeforeSubscribeOk(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	request, requestStream := subscribe(t, session, conn)
+
+	conn.sendDatagram(encodeDatagram(17, 3, 4, "hello"))
+	require.Eventually(t, func() bool {
+		return trackCount(session) == 1
+	}, time.Second, time.Millisecond)
+
+	requestStream.feed(encodeControlMessage(t, &wire.SubscribeOk{TrackAlias: 17}))
+
+	o := readObject(t, request)
+	assert.Equal(t, []byte("hello"), o.Payload)
+	assert.Equal(t, uint64(3), o.GroupID)
+	assert.Equal(t, uint64(4), o.ObjectID)
+	assert.Equal(t, ObjectForwardingPreferenceDatagram, o.ForwardingPreference)
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+func TestDatagramAfterSubscribeOk(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	request, requestStream := subscribe(t, session, conn)
+	requestStream.feed(encodeControlMessage(t, &wire.SubscribeOk{TrackAlias: 17}))
+	require.Eventually(t, func() bool {
+		return hasTrackAlias(session, 17)
+	}, time.Second, time.Millisecond)
+
+	conn.sendDatagram(encodeDatagram(17, 3, 4, "hello"))
+
+	assert.Equal(t, []byte("hello"), readObject(t, request).Payload)
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+// Objects buffered for an unbound track alias are capped, and the ones that fit
+// are delivered in order.
+func TestPendingObjectLimit(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	for i := range maxPendingObjects + 5 {
+		session.pushObject(17, &Object{Payload: []byte(fmt.Sprintf("object-%d", i))})
+	}
+
+	receiver := &testReceiver{}
+	require.NoError(t, session.bindTrackAlias(17, receiver))
+
+	require.Len(t, receiver.objects, maxPendingObjects)
+	assert.Equal(t, []byte("object-0"), receiver.objects[0].Payload)
+	assert.Equal(t, []byte(fmt.Sprintf("object-%d", maxPendingObjects-1)), receiver.objects[maxPendingObjects-1].Payload)
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+// The number of unbound track aliases buffering objects is capped.
+func TestPendingTrackLimit(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	for i := range uint64(maxPendingTracks) + 1 {
+		session.pushObject(i, &Object{Payload: []byte("payload")})
+	}
+	assert.Equal(t, maxPendingTracks, trackCount(session))
+
+	receiver := &testReceiver{}
+	require.NoError(t, session.bindTrackAlias(maxPendingTracks, receiver))
+	assert.Empty(t, receiver.objects)
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+// A track alias may only be bound once.
+func TestBindDuplicateTrackAlias(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	require.NoError(t, session.bindTrackAlias(17, &testReceiver{}))
+	assert.ErrorIs(t, session.bindTrackAlias(17, &testReceiver{}), errDuplicateTrackAlias)
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+// Closing a request removes its track alias entry.
+func TestCloseRequestRemovesTrackAlias(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	request, requestStream := subscribe(t, session, conn)
+	requestStream.feed(encodeControlMessage(t, &wire.SubscribeOk{TrackAlias: 17}))
+	require.Eventually(t, func() bool {
+		return hasTrackAlias(session, 17)
+	}, time.Second, time.Millisecond)
+
+	require.NoError(t, request.Close())
+	assert.Equal(t, 0, trackCount(session))
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/session_shutdown_test.go b/electron/native/private-transport/third_party/moqtransport/session_shutdown_test.go
new file mode 100644
index 000000000..ce3e16ec2
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/session_shutdown_test.go
@@ -0,0 +1,365 @@
+package moqtransport
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"sync"
+	"testing"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/goleak"
+	"go.uber.org/mock/gomock"
+)
+
+var (
+	errTestConnectionClosed = errors.New("test connection closed")
+	errTestStreamStopped    = errors.New("test stream stopped")
+	errTestOptionFailed     = errors.New("test option failed")
+	errTestSetupWriteFailed = errors.New("test setup write failed")
+)
+
+// blockingReader serves data and then blocks until more is fed or it is closed,
+// like a stream that has delivered a message and is waiting for the next one.
+type blockingReader struct {
+	mu     sync.Mutex
+	data   []byte
+	notify chan struct{}
+
+	drainedOnce sync.Once
+	drained     chan struct{}
+
+	closeOnce sync.Once
+	closed    chan struct{}
+	closeErr  error
+}
+
+func newBlockingReader(data []byte) *blockingReader {
+	return &blockingReader{
+		data:    append([]byte(nil), data...),
+		notify:  make(chan struct{}, 1),
+		drained: make(chan struct{}),
+		closed:  make(chan struct{}),
+	}
+}
+
+func (r *blockingReader) Read(p []byte) (int, error) {
+	for {
+		r.mu.Lock()
+		if len(r.data) > 0 {
+			n := copy(p, r.data)
+			r.data = r.data[n:]
+			r.mu.Unlock()
+			return n, nil
+		}
+		r.mu.Unlock()
+
+		r.drainedOnce.Do(func() { close(r.drained) })
+		select {
+		case <-r.closed:
+			return 0, r.closeErr
+		case <-r.notify:
+		}
+	}
+}
+
+// feed appends data to the reader and wakes a blocked Read.
+func (r *blockingReader) feed(data []byte) {
+	r.mu.Lock()
+	r.data = append(r.data, data...)
+	r.mu.Unlock()
+	select {
+	case r.notify <- struct{}{}:
+	default:
+	}
+}
+
+func (r *blockingReader) close(err error) {
+	r.closeOnce.Do(func() {
+		r.closeErr = err
+		close(r.closed)
+	})
+}
+
+// testConnection drives a MockConnection: it hands out the streams queued on it
+// and blocks everywhere else until the connection is closed.
+type testConnection struct {
+	*MockConnection
+
+	ctrl        *gomock.Controller
+	uniStreams  chan ReceiveStream
+	bidiStreams chan Stream
+	datagrams   chan []byte
+
+	// openedStreams carries the readers of the bidirectional streams the
+	// session opened, so a test can feed responses to its own requests.
+	openedStreams chan *blockingReader
+
+	// sendStreamWriteErr, when set, is returned by every write on a stream
+	// opened by the session, e.g. to fail the SETUP message. It must be set
+	// before the session is created and is read-only afterwards.
+	sendStreamWriteErr error
+
+	mu             sync.Mutex
+	readers        []*blockingReader
+	lastID         uint64
+	openedUniCount int
+	closeCount     int
+}
+
+func newTestConnection(t *testing.T) *testConnection {
+	t.Helper()
+	ctrl := gomock.NewController(t)
+	c := &testConnection{
+		MockConnection: NewMockConnection(ctrl),
+		ctrl:           ctrl,
+		uniStreams:     make(chan ReceiveStream, 1),
+		bidiStreams:    make(chan Stream, 1),
+		datagrams:      make(chan []byte, 1),
+		openedStreams:  make(chan *blockingReader, 8),
+	}
+	c.EXPECT().ApplicationProtocol().Return(MOQT18).AnyTimes()
+	c.EXPECT().Perspective().Return(PerspectiveServer).AnyTimes()
+	c.EXPECT().Protocol().Return(ProtocolQUIC).AnyTimes()
+	c.EXPECT().OpenUniStream().DoAndReturn(func() (SendStream, error) {
+		return c.newSendStream(), nil
+	}).AnyTimes()
+	c.EXPECT().OpenStreamSync(gomock.Any()).DoAndReturn(func(context.Context) (Stream, error) {
+		stream, reader := c.newStream(nil)
+		c.openedStreams <- reader
+		return stream, nil
+	}).AnyTimes()
+	c.EXPECT().AcceptUniStream(gomock.Any()).DoAndReturn(func(ctx context.Context) (ReceiveStream, error) {
+		select {
+		case <-ctx.Done():
+			return nil, context.Cause(ctx)
+		case stream := <-c.uniStreams:
+			return stream, nil
+		}
+	}).AnyTimes()
+	c.EXPECT().AcceptStream(gomock.Any()).DoAndReturn(func(ctx context.Context) (Stream, error) {
+		select {
+		case <-ctx.Done():
+			return nil, context.Cause(ctx)
+		case stream := <-c.bidiStreams:
+			return stream, nil
+		}
+	}).AnyTimes()
+	c.EXPECT().ReceiveDatagram(gomock.Any()).DoAndReturn(func(ctx context.Context) ([]byte, error) {
+		select {
+		case <-ctx.Done():
+			return nil, context.Cause(ctx)
+		case dgram := <-c.datagrams:
+			return dgram, nil
+		}
+	}).AnyTimes()
+	c.EXPECT().CloseWithError(gomock.Any(), gomock.Any()).DoAndReturn(func(uint64, string) error {
+		c.mu.Lock()
+		c.closeCount++
+		readers := c.readers
+		c.mu.Unlock()
+		for _, r := range readers {
+			r.close(errTestConnectionClosed)
+		}
+		return nil
+	}).AnyTimes()
+	return c
+}
+
+func (c *testConnection) openedUniStreams() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.openedUniCount
+}
+
+func (c *testConnection) closes() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.closeCount
+}
+
+func (c *testConnection) newReader(data []byte) (*blockingReader, uint64) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	r := newBlockingReader(data)
+	c.readers = append(c.readers, r)
+	c.lastID += 4
+	return r, c.lastID
+}
+
+func (c *testConnection) newSendStream() *MockSendStream {
+	c.mu.Lock()
+	c.lastID += 4
+	id := c.lastID
+	c.openedUniCount++
+	c.mu.Unlock()
+
+	stream := NewMockSendStream(c.ctrl)
+	stream.EXPECT().Write(gomock.Any()).DoAndReturn(func(p []byte) (int, error) {
+		if c.sendStreamWriteErr != nil {
+			return 0, c.sendStreamWriteErr
+		}
+		return len(p), nil
+	}).AnyTimes()
+	stream.EXPECT().Close().Return(nil).AnyTimes()
+	stream.EXPECT().Reset(gomock.Any()).AnyTimes()
+	stream.EXPECT().StreamID().Return(id).AnyTimes()
+	return stream
+}
+
+func (c *testConnection) newReceiveStream(data []byte) (*MockReceiveStream, *blockingReader) {
+	r, id := c.newReader(data)
+	stream := NewMockReceiveStream(c.ctrl)
+	stream.EXPECT().Read(gomock.Any()).DoAndReturn(r.Read).AnyTimes()
+	stream.EXPECT().Stop(gomock.Any()).Do(func(uint32) { r.close(errTestStreamStopped) }).AnyTimes()
+	stream.EXPECT().StreamID().Return(id).AnyTimes()
+	return stream, r
+}
+
+func (c *testConnection) newStream(data []byte) (*MockStream, *blockingReader) {
+	r, id := c.newReader(data)
+	stream := NewMockStream(c.ctrl)
+	stream.EXPECT().Read(gomock.Any()).DoAndReturn(r.Read).AnyTimes()
+	stream.EXPECT().Write(gomock.Any()).DoAndReturn(func(p []byte) (int, error) { return len(p), nil }).AnyTimes()
+	stream.EXPECT().Close().Return(nil).AnyTimes()
+	stream.EXPECT().Stop(gomock.Any()).Do(func(uint32) { r.close(errTestStreamStopped) }).AnyTimes()
+	stream.EXPECT().Reset(gomock.Any()).AnyTimes()
+	stream.EXPECT().StreamID().Return(id).AnyTimes()
+	return stream, r
+}
+
+// acceptUniStream queues a unidirectional stream carrying data as if the peer
+// had opened it.
+func (c *testConnection) acceptUniStream(data []byte) *blockingReader {
+	stream, r := c.newReceiveStream(data)
+	c.uniStreams <- stream
+	return r
+}
+
+// acceptStream queues a bidirectional stream carrying data as if the peer had
+// opened it.
+func (c *testConnection) acceptStream(data []byte) *blockingReader {
+	stream, r := c.newStream(data)
+	c.bidiStreams <- stream
+	return r
+}
+
+// sendDatagram delivers a datagram as if the peer had sent it.
+func (c *testConnection) sendDatagram(data []byte) {
+	c.datagrams <- data
+}
+
+func encodeControlMessage(t *testing.T, msg wire.ControlMessage) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	require.NoError(t, wire.NewAppender(&buf, 18).Write(msg))
+	return buf.Bytes()
+}
+
+func setupWithPath(path string) *wire.Setup {
+	return &wire.Setup{
+		Options: []wire.KeyValuePair{
+			{Type: wire.PathParameterKey, Bytes: []byte(path)},
+		},
+	}
+}
+
+// The remote control stream reader must not panic when the session is closed,
+// and CloseWithError must not return before it is done.
+func TestCloseSessionWithRemoteControlStreamReader(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	reader := conn.acceptUniStream(encodeControlMessage(t, setupWithPath("/path")))
+	<-reader.drained
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+// The outgoing subscribe request reader must not panic when the session is
+// closed, and CloseWithError must not return before it is done.
+func TestCloseSessionWithOutgoingSubscribeRequestReader(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	request, err := session.Subscribe(context.Background(), [][]byte{[]byte("namespace")}, "track")
+	require.NoError(t, err)
+	require.NotNil(t, request)
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+// The incoming subscribe request reader must not panic when the session is
+// closed, and CloseWithError must not return before it is done.
+func TestCloseSessionWithIncomingSubscribeRequestReader(t *testing.T) {
+	conn := newTestConnection(t)
+	handler := NewMockHandler(conn.ctrl)
+	requests := make(chan *IncomingSubscribeRequest, 1)
+	handler.EXPECT().HandleSubscribe(gomock.Any()).Do(func(r *IncomingSubscribeRequest) {
+		requests <- r
+	})
+
+	session, err := NewSession(conn, "", WithHandler(handler))
+	require.NoError(t, err)
+
+	reader := conn.acceptStream(encodeControlMessage(t, &wire.Subscribe{
+		TrackNamespace: [][]byte{[]byte("namespace")},
+		TrackName:      []byte("track"),
+	}))
+	assert.Equal(t, []byte("track"), (<-requests).Name())
+	<-reader.drained
+
+	session.CloseWithError(0, "closing")
+	goleak.VerifyNone(t)
+}
+
+// Subscribing on a closed session must not start an untracked reader.
+func TestSubscribeAfterCloseFails(t *testing.T) {
+	conn := newTestConnection(t)
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+
+	session.CloseWithError(0, "closing")
+
+	_, err = session.Subscribe(context.Background(), [][]byte{[]byte("namespace")}, "track")
+	assert.Error(t, err)
+	goleak.VerifyNone(t)
+}
+
+// A failing option must be reported before any stream is opened, so there is
+// nothing to clean up and the caller's connection is left alone.
+func TestNewSessionOptionErrorOpensNoStream(t *testing.T) {
+	conn := newTestConnection(t)
+
+	session, err := NewSession(conn, "", func(*Session) error { return errTestOptionFailed })
+	assert.ErrorIs(t, err, errTestOptionFailed)
+	assert.Nil(t, session)
+	assert.Equal(t, 0, conn.openedUniStreams())
+	assert.Equal(t, 0, conn.closes())
+	goleak.VerifyNone(t)
+}
+
+// The SETUP write happens after NewSession returned, so a failing write must
+// reach the caller through the session context and close the session.
+func TestNewSessionSetupWriteErrorClosesSession(t *testing.T) {
+	conn := newTestConnection(t)
+	conn.sendStreamWriteErr = errTestSetupWriteFailed
+
+	session, err := NewSession(conn, "")
+	require.NoError(t, err)
+	require.NotNil(t, session)
+
+	<-session.Context().Done()
+	assert.ErrorIs(t, context.Cause(session.Context()), errTestSetupWriteFailed)
+
+	session.CloseWithError(0, "closing")
+	assert.Equal(t, 1, conn.openedUniStreams())
+	assert.Equal(t, 1, conn.closes())
+	goleak.VerifyNone(t)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/session_test.go b/electron/native/private-transport/third_party/moqtransport/session_test.go
new file mode 100644
index 000000000..4e558032d
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/session_test.go
@@ -0,0 +1,55 @@
+package moqtransport
+
+import (
+	"bufio"
+	"bytes"
+	"testing"
+
+	"github.com/mengelbart/moqtransport/varint"
+)
+
+func TestPeekFirstVarint(t *testing.T) {
+	testCases := []struct {
+		name   string
+		value  uint64
+		expect int
+	}{
+		{name: "one byte", value: 42, expect: 1},
+		{name: "two bytes", value: 0x2f00, expect: 2},
+		{name: "nine bytes", value: 1 << 56, expect: 9},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			encoded := varint.Append(nil, testCase.value)
+			reader := bufio.NewReader(bytes.NewReader(encoded))
+
+			peeked, err := peekFirstVarint(reader)
+			if err != nil {
+				t.Fatalf("peekFirstVarint() error = %v", err)
+			}
+			if len(peeked) != testCase.expect {
+				t.Fatalf("peekFirstVarint() length = %d, want %d", len(peeked), testCase.expect)
+			}
+			parsed, n, err := varint.Parse(peeked)
+			if err != nil {
+				t.Fatalf("varint.Parse() error = %v", err)
+			}
+			if parsed != testCase.value {
+				t.Fatalf("varint.Parse() value = %d, want %d", parsed, testCase.value)
+			}
+			if n != testCase.expect {
+				t.Fatalf("varint.Parse() len = %d, want %d", n, testCase.expect)
+			}
+		})
+	}
+}
+
+func TestPeekFirstVarintTooShort(t *testing.T) {
+	reader := bufio.NewReader(bytes.NewReader([]byte{0x80}))
+
+	_, err := peekFirstVarint(reader)
+	if err == nil {
+		t.Fatal("peekFirstVarint() error = nil, want error")
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/subgroup.go b/electron/native/private-transport/third_party/moqtransport/subgroup.go
new file mode 100644
index 000000000..0e85ea267
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/subgroup.go
@@ -0,0 +1,71 @@
+package moqtransport
+
+import (
+	"fmt"
+	"io"
+	"sync"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+)
+
+type Subgroup struct {
+	stream    messageWriter
+	sender    SendStream
+	closeOnce sync.Once
+	closeErr  error
+
+	firstObject  bool
+	lastObjectID uint64
+}
+
+func newSubgroup(stream messageWriter, trackAlias, groupID, subgroupID uint64, publisherPriority uint8) (*Subgroup, error) {
+	if err := stream.Write(wire.NewSubgroupHeader(trackAlias, groupID, subgroupID, publisherPriority)); err != nil {
+		return nil, err
+	}
+	return &Subgroup{
+		stream:      stream,
+		firstObject: true,
+	}, nil
+}
+
+// WriteObject writes an object to the subgroup. Object IDs must increase
+// strictly monotonically along the subgroup.
+func (s *Subgroup) WriteObject(objectID uint64, payload []byte) (int, error) {
+	delta := objectID
+	if !s.firstObject {
+		if objectID <= s.lastObjectID {
+			return 0, fmt.Errorf("object ID %v not greater than previous object ID %v", objectID, s.lastObjectID)
+		}
+		delta = objectID - s.lastObjectID - 1
+	}
+	o := &wire.SubgroupObject{
+		ObjectIDDelta: delta,
+		ObjectPayload: payload,
+	}
+	if err := s.stream.Write(o); err != nil {
+		return 0, err
+	}
+	s.firstObject = false
+	s.lastObjectID = objectID
+	return len(payload), nil
+}
+
+// Close closes the subgroup.
+func (s *Subgroup) Close() error {
+	s.closeOnce.Do(func() {
+		if s.sender != nil {
+			s.closeErr = s.sender.Close()
+		}
+	})
+	return s.closeErr
+}
+
+// Reset abandons outstanding retransmissions, including after Close sent FIN.
+// It may be called concurrently with a blocked WriteObject.
+func (s *Subgroup) Reset(code uint32) {
+	if s.sender != nil {
+		s.sender.Reset(code)
+	}
+}
+
+var _ io.Closer = (*Subgroup)(nil)
diff --git a/electron/native/private-transport/third_party/moqtransport/subgroup_test.go b/electron/native/private-transport/third_party/moqtransport/subgroup_test.go
new file mode 100644
index 000000000..3fba17b3e
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/subgroup_test.go
@@ -0,0 +1,57 @@
+package moqtransport
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/mengelbart/moqtransport/internal/wire"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSubgroupWriteObject(t *testing.T) {
+	var buf bytes.Buffer
+	subgroup, err := newSubgroup(wire.NewAppender(&buf, 18), 4, 7, 9, 200)
+	require.NoError(t, err)
+
+	for _, objectID := range []uint64{0, 1, 5} {
+		n, err := subgroup.WriteObject(objectID, []byte("payload"))
+		require.NoError(t, err)
+		assert.Equal(t, len("payload"), n)
+	}
+
+	parser, err := wire.NewParser(&buf, 18, wire.StreamTypeData)
+	require.NoError(t, err)
+
+	msg, err := parser.Read()
+	require.NoError(t, err)
+	header, ok := msg.(*wire.SubgroupHeader)
+	require.True(t, ok)
+	assert.Equal(t, uint64(4), header.TrackAlias)
+	assert.Equal(t, uint64(7), header.GroupID)
+	assert.Equal(t, uint64(9), header.SubgroupID)
+	assert.Equal(t, uint8(200), header.PublisherPriority)
+
+	for _, want := range []uint64{0, 0, 3} {
+		msg, err := parser.Read()
+		require.NoError(t, err)
+		o, ok := msg.(*wire.SubgroupObject)
+		require.True(t, ok)
+		assert.Equal(t, want, o.ObjectIDDelta)
+	}
+}
+
+func TestSubgroupWriteObjectOutOfOrder(t *testing.T) {
+	var buf bytes.Buffer
+	subgroup, err := newSubgroup(wire.NewAppender(&buf, 18), 4, 7, 9, 0)
+	require.NoError(t, err)
+
+	_, err = subgroup.WriteObject(3, []byte("payload"))
+	require.NoError(t, err)
+
+	_, err = subgroup.WriteObject(3, []byte("payload"))
+	assert.Error(t, err)
+
+	_, err = subgroup.WriteObject(2, []byte("payload"))
+	assert.Error(t, err)
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/tracks.go b/electron/native/private-transport/third_party/moqtransport/tracks.go
new file mode 100644
index 000000000..88372321d
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/tracks.go
@@ -0,0 +1,99 @@
+package moqtransport
+
+import (
+	"errors"
+)
+
+// maxPendingObjects is the number of objects buffered per track alias that is
+// not bound to a receiver yet.
+// TODO: Make configurable.
+const maxPendingObjects = 100
+
+// maxPendingTracks is the number of unbound track aliases that may buffer
+// objects at the same time.
+// TODO: Make configurable.
+const maxPendingTracks = 16
+
+var errDuplicateTrackAlias = errors.New("track alias already in use")
+
+type objectReceiver interface {
+	push(*Object)
+}
+
+// trackEntry routes the objects of one track alias. Objects that arrive before
+// the alias is bound to a receiver are buffered in pending.
+type trackEntry struct {
+	receiver objectReceiver
+	pending  []*Object
+}
+
+// pushObject delivers o to the receiver of trackAlias. The track alias is
+// assigned by the peer in SUBSCRIBE_OK, so objects can arrive before it is
+// known. They are buffered until the alias is bound to a receiver.
+func (s *Session) pushObject(trackAlias uint64, o *Object) {
+	s.tracksLock.Lock()
+	defer s.tracksLock.Unlock()
+
+	entry, ok := s.tracks[trackAlias]
+	if ok && entry.receiver != nil {
+		entry.receiver.push(o)
+		return
+	}
+	// TODO: Decide whether exceeding a limit should close the session with a
+	// protocol violation instead of dropping the object.
+	if !ok && s.pendingTracks >= maxPendingTracks {
+		s.logger.Info("too many unbound track aliases: dropping incoming object", "trackAlias", trackAlias)
+		return
+	}
+	if ok && len(entry.pending) >= maxPendingObjects {
+		s.logger.Info("pending object buffer overflow: dropping incoming object", "trackAlias", trackAlias)
+		return
+	}
+	if s.pendingBytes+len(o.Payload) > maxGroupBytes {
+		return
+	}
+	if !ok {
+		entry = &trackEntry{}
+		s.tracks[trackAlias] = entry
+		s.pendingTracks++
+	}
+	entry.pending = append(entry.pending, o)
+	s.pendingBytes += len(o.Payload)
+}
+
+// bindTrackAlias attaches r to trackAlias and hands it the objects that
+// arrived before the alias was known.
+func (s *Session) bindTrackAlias(trackAlias uint64, r objectReceiver) error {
+	s.tracksLock.Lock()
+	defer s.tracksLock.Unlock()
+
+	entry, ok := s.tracks[trackAlias]
+	if !ok {
+		s.tracks[trackAlias] = &trackEntry{receiver: r}
+		return nil
+	}
+	if entry.receiver != nil {
+		return errDuplicateTrackAlias
+	}
+	entry.receiver = r
+	s.pendingTracks--
+	for _, o := range entry.pending {
+		s.pendingBytes -= len(o.Payload)
+		r.push(o)
+	}
+	entry.pending = nil
+	return nil
+}
+
+// removeReceiver drops the track alias entry of r, if it has one.
+func (s *Session) removeReceiver(r objectReceiver) {
+	s.tracksLock.Lock()
+	defer s.tracksLock.Unlock()
+
+	for trackAlias, entry := range s.tracks {
+		if entry.receiver == r {
+			delete(s.tracks, trackAlias)
+			return
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/varint/varint.go b/electron/native/private-transport/third_party/moqtransport/varint/varint.go
new file mode 100644
index 000000000..1542f0680
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/varint/varint.go
@@ -0,0 +1,104 @@
+// Package varint implements variable length integers as defined in
+// https://datatracker.ietf.org/doc/html/draft-ietf-moq-transport-19#name-variable-length-integers
+package varint
+
+import (
+	"io"
+)
+
+const (
+	maxVarint1 = 127
+	maxVarint2 = 16383
+	maxVarint3 = 2097151
+	maxVarint4 = 268435455
+	maxVarint5 = 34359738367
+	maxVarint6 = 4398046511103
+	maxVarint7 = 562949953421311
+	maxVarint8 = 72057594037927935
+	maxVarint9 = 18446744073709551615
+)
+
+func Read(r io.ByteReader) (uint64, error) {
+	b0, err := r.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+
+	leadingOnes := 0
+	for i := 7; i >= 0; i-- {
+		if (b0 & (1 << uint(i))) == 0 {
+			break
+		}
+		leadingOnes++
+	}
+
+	if leadingOnes == 0 {
+		return uint64(b0), nil
+	}
+
+	result := uint64(b0 & ((1 << uint(7-leadingOnes)) - 1))
+	for i := 0; i < leadingOnes; i++ {
+		b, err := r.ReadByte()
+		if err != nil {
+			return 0, err
+		}
+		result = (result << 8) | uint64(b)
+	}
+	return result, nil
+}
+
+func Parse(b []byte) (uint64, int, error) {
+	if len(b) == 0 {
+		return 0, 0, io.EOF
+	}
+	// Count leading ones in the first byte
+	leadingOnes := 0
+	for i := 7; i >= 0; i-- {
+		if (b[0] & (1 << uint(i))) == 0 {
+			break
+		}
+		leadingOnes++
+	}
+
+	if len(b) < 1+leadingOnes {
+		return 0, 0, io.EOF
+	}
+
+	if leadingOnes == 0 {
+		return uint64(b[0]), 1, nil
+	}
+
+	result := uint64(b[0] & ((1 << uint(7-leadingOnes)) - 1))
+	for i := 1; i <= leadingOnes; i++ {
+		result = (result << 8) | uint64(b[i])
+	}
+	return result, 1 + leadingOnes, nil
+}
+
+func Append(b []byte, value uint64) []byte {
+	if value <= maxVarint1 {
+		return append(b, byte(value))
+	}
+	if value <= maxVarint2 {
+		return append(b, byte(0x80|(value>>8)), byte(value))
+	}
+	if value <= maxVarint3 {
+		return append(b, byte(0xC0|(value>>16)), byte(value>>8), byte(value))
+	}
+	if value <= maxVarint4 {
+		return append(b, byte(0xE0|(value>>24)), byte(value>>16), byte(value>>8), byte(value))
+	}
+	if value <= maxVarint5 {
+		return append(b, byte(0xF0|(value>>32)), byte(value>>24), byte(value>>16), byte(value>>8), byte(value))
+	}
+	if value <= maxVarint6 {
+		return append(b, byte(0xF8|(value>>40)), byte(value>>32), byte(value>>24), byte(value>>16), byte(value>>8), byte(value))
+	}
+	if value <= maxVarint7 {
+		return append(b, byte(0xFC|(value>>48)), byte(value>>40), byte(value>>32), byte(value>>24), byte(value>>16), byte(value>>8), byte(value))
+	}
+	if value <= maxVarint8 {
+		return append(b, byte(0xFE|(value>>56)), byte(value>>48), byte(value>>40), byte(value>>32), byte(value>>24), byte(value>>16), byte(value>>8), byte(value))
+	}
+	return append(b, byte(0xFF), byte(value>>56), byte(value>>48), byte(value>>40), byte(value>>32), byte(value>>24), byte(value>>16), byte(value>>8), byte(value))
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/varint/varint_test.go b/electron/native/private-transport/third_party/moqtransport/varint/varint_test.go
new file mode 100644
index 000000000..f2e9a362a
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/varint/varint_test.go
@@ -0,0 +1,125 @@
+package varint
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseVarint(t *testing.T) {
+	cases := []struct {
+		bytes []byte
+		value uint64
+		count int
+		err   error
+	}{
+		{[]byte{}, 0, 0, io.EOF},
+		{[]byte{0x00}, 0, 1, nil},
+		{[]byte{0x01}, 1, 1, nil},
+		{[]byte{0x7F}, 127, 1, nil},
+		{[]byte{0x25}, 37, 1, nil},
+		{[]byte{0x80, 0x25}, 37, 2, nil},
+		{[]byte{0x80, 0x00}, 0, 2, nil},
+		{[]byte{0xED, 0x7F, 0x3E, 0x7D}, 226_442_877, 4, nil},
+		{[]byte{0xFA, 0xA1, 0xA0, 0xE4, 0x03, 0xD8}, 2_893_212_287_960, 6, nil},
+		{[]byte{0xFC, 0x89, 0x98, 0xAB, 0xC6, 0x6B, 0xC0}, 151_288_809_941_952, 7, nil},
+		{[]byte{0xFE, 0xFA, 0x31, 0x8F, 0xA8, 0xE3, 0xCA, 0x11}, 70_423_237_261_249_041, 8, nil},
+		{[]byte{0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}, 18_446_744_073_709_551_615, 9, nil},
+		{[]byte{0x80}, 0, 0, io.EOF},
+		{[]byte{0xC0, 0x01}, 0, 0, io.EOF},
+		{[]byte{0xFF, 0xFF, 0xFF}, 0, 0, io.EOF},
+		{[]byte{0xFE, 0xFA, 0x31, 0x8F, 0xA8, 0xE3, 0xCA}, 0, 0, io.EOF},
+	}
+	for _, c := range cases {
+		t.Run(fmt.Sprintf("%v", c.bytes), func(t *testing.T) {
+			value, bytes, err := Parse(c.bytes)
+			assert.Equal(t, c.value, value, "Parse(%v) = %d, want %d", c.bytes, value, c.value)
+			assert.Equal(t, c.count, bytes, "Parse(%v) = %d bytes, want %d", c.bytes, bytes, c.count)
+			assert.Equal(t, c.err, err, "Parse(%v) = %v, want %v", c.bytes, err, c.err)
+		})
+	}
+}
+
+func TestReadVarint(t *testing.T) {
+	cases := []struct {
+		bytes []byte
+		value uint64
+		err   error
+	}{
+		{[]byte{}, 0, io.EOF},
+		{[]byte{0x00}, 0, nil},
+		{[]byte{0x01}, 1, nil},
+		{[]byte{0x7F}, 127, nil},
+		{[]byte{0x25}, 37, nil},
+		{[]byte{0x80, 0x25}, 37, nil},
+		{[]byte{0x80, 0x00}, 0, nil},
+		{[]byte{0xED, 0x7F, 0x3E, 0x7D}, 226_442_877, nil},
+		{[]byte{0xFA, 0xA1, 0xA0, 0xE4, 0x03, 0xD8}, 2_893_212_287_960, nil},
+		{[]byte{0xFC, 0x89, 0x98, 0xAB, 0xC6, 0x6B, 0xC0}, 151_288_809_941_952, nil},
+		{[]byte{0xFE, 0xFA, 0x31, 0x8F, 0xA8, 0xE3, 0xCA, 0x11}, 70_423_237_261_249_041, nil},
+		{[]byte{0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}, 18_446_744_073_709_551_615, nil},
+		{[]byte{0x80}, 0, io.EOF},
+		{[]byte{0xFF, 0xFF, 0xFF}, 0, io.EOF},
+	}
+	for _, c := range cases {
+		t.Run(fmt.Sprintf("%v", c.bytes), func(t *testing.T) {
+			value, err := Read(bytes.NewReader(c.bytes))
+			assert.Equal(t, c.value, value, "Read(%v) = %d, want %d", c.bytes, value, c.value)
+			assert.Equal(t, c.err, err, "Read(%v) = %v, want %v", c.bytes, err, c.err)
+		})
+	}
+}
+
+// FuzzParse checks that Parse never panics on arbitrary input and stays
+// consistent with Read, which sees the same bytes through an io.ByteReader.
+func FuzzParse(f *testing.F) {
+	for _, seed := range [][]byte{
+		{},
+		{0x25},
+		{0x80, 0x25},
+		{0xC0},
+		{0xFF, 0xFF, 0xFF},
+		{0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF},
+	} {
+		f.Add(seed)
+	}
+	f.Fuzz(func(t *testing.T, b []byte) {
+		value, n, err := Parse(b)
+		readValue, readErr := Read(bytes.NewReader(b))
+		if err != nil {
+			assert.Equal(t, 0, n, "Parse(%v) consumed %d bytes despite failing", b, n)
+			assert.Error(t, readErr, "Parse(%v) failed but Read succeeded", b)
+			return
+		}
+		assert.GreaterOrEqual(t, n, 1, "Parse(%v) succeeded without consuming a byte", b)
+		assert.LessOrEqual(t, n, len(b), "Parse(%v) consumed more bytes than it was given", b)
+		assert.NoError(t, readErr, "Parse(%v) succeeded but Read failed", b)
+		assert.Equal(t, value, readValue, "Parse(%v) = %d, but Read = %d", b, value, readValue)
+	})
+}
+
+func TestAppendVarint(t *testing.T) {
+	cases := []struct {
+		value uint64
+		bytes []byte
+	}{
+		{0, []byte{0x00}},
+		{1, []byte{0x01}},
+		{37, []byte{0x25}},
+		{127, []byte{0x7F}},
+		{226_442_877, []byte{0xED, 0x7F, 0x3E, 0x7D}},
+		{2_893_212_287_960, []byte{0xFA, 0xA1, 0xA0, 0xE4, 0x03, 0xD8}},
+		{151_288_809_941_952, []byte{0xFC, 0x89, 0x98, 0xAB, 0xC6, 0x6B, 0xC0}},
+		{70_423_237_261_249_041, []byte{0xFE, 0xFA, 0x31, 0x8F, 0xA8, 0xE3, 0xCA, 0x11}},
+		{18_446_744_073_709_551_615, []byte{0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}},
+	}
+	for _, c := range cases {
+		t.Run(fmt.Sprintf("%d", c.value), func(t *testing.T) {
+			bytes := Append([]byte{}, c.value)
+			assert.Equal(t, c.bytes, bytes, "Append(%d) = %v, want %v", c.value, bytes, c.bytes)
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/moqtransport/version.go b/electron/native/private-transport/third_party/moqtransport/version.go
new file mode 100644
index 000000000..cec7fb4a1
--- /dev/null
+++ b/electron/native/private-transport/third_party/moqtransport/version.go
@@ -0,0 +1,20 @@
+package moqtransport
+
+const (
+	MOQT18 ApplicationProtocol = "moqt-18"
+)
+
+type ApplicationProtocol string
+
+func (ap ApplicationProtocol) String() string {
+	return string(ap)
+}
+
+func (ap ApplicationProtocol) versionNumber() uint64 {
+	switch ap {
+	case MOQT18:
+		return 18
+	default:
+		return 0
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/.clusterfuzzlite/Dockerfile b/electron/native/private-transport/third_party/quic-go/.clusterfuzzlite/Dockerfile
new file mode 100644
index 000000000..9c00ced5c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.clusterfuzzlite/Dockerfile
@@ -0,0 +1,5 @@
+FROM gcr.io/oss-fuzz-base/base-builder-go:v1
+
+COPY . $SRC/quic-go
+WORKDIR $SRC/quic-go
+COPY .clusterfuzzlite/build.sh $SRC/
diff --git a/electron/native/private-transport/third_party/quic-go/.clusterfuzzlite/build.sh b/electron/native/private-transport/third_party/quic-go/.clusterfuzzlite/build.sh
new file mode 100644
index 000000000..d11d10bd0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.clusterfuzzlite/build.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+set -euo pipefail
+
+go version
+go env
+
+build_native_go_fuzzer() {
+	local pkg=$1
+	local fuzz=$2
+	local name=$3
+	local corpus_dir="${WORK:-/tmp}/quic-go-seed-corpus/$name"
+	local corpus_zip="$OUT/${name}_seed_corpus.zip"
+
+	# FUZZ_CORPUS_DIR makes go-ossfuzz-seeds write each f.Add seed as a raw
+	# libFuzzer corpus file. OSS-Fuzz picks up <fuzzer>_seed_corpus.zip from
+	# $OUT and unpacks it next to the fuzzer binary.
+	rm -rf "$corpus_dir"
+	mkdir -p "$corpus_dir"
+	FUZZ_CORPUS_DIR="$corpus_dir" go test "$pkg" -run "^${fuzz}$" -count=1 -v
+
+	rm -f "$corpus_zip"
+	corpus_files=$(find "$corpus_dir" -type f | wc -l)
+	echo "$name: generated $corpus_files corpus files"
+	if [[ "$corpus_files" -gt 0 ]]; then
+		(cd "$corpus_dir" && zip -q -r "$corpus_zip" .)
+	fi
+
+	compile_native_go_fuzzer_v2 "$pkg" "$fuzz" "$name"
+}
+
+build_native_go_fuzzer github.com/quic-go/quic-go/internal/wire FuzzFrames frame_fuzzer_v2
+build_native_go_fuzzer github.com/quic-go/quic-go/internal/wire FuzzTransportParameters transportparameter_fuzzer_v2
+build_native_go_fuzzer github.com/quic-go/quic-go/http3 FuzzFrameParser http3_frame_fuzzer
+build_native_go_fuzzer github.com/quic-go/quic-go/internal/wire FuzzHeaderParser header_fuzzer_v2
+build_native_go_fuzzer github.com/quic-go/quic-go/internal/handshake FuzzHandshake handshake_fuzzer_v2
+build_native_go_fuzzer github.com/quic-go/quic-go FuzzFrameSorter frame_sorter_fuzzer
+build_native_go_fuzzer github.com/quic-go/quic-go/http3 FuzzHeaderParsing http3_header_parsing_fuzzer
diff --git a/electron/native/private-transport/third_party/quic-go/.clusterfuzzlite/project.yaml b/electron/native/private-transport/third_party/quic-go/.clusterfuzzlite/project.yaml
new file mode 100644
index 000000000..4f2ee4d97
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.clusterfuzzlite/project.yaml
@@ -0,0 +1 @@
+language: go
diff --git a/electron/native/private-transport/third_party/quic-go/.githooks/README.md b/electron/native/private-transport/third_party/quic-go/.githooks/README.md
new file mode 100644
index 000000000..e38700cf6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.githooks/README.md
@@ -0,0 +1,8 @@
+# Git Hooks
+
+This directory contains useful Git hooks for working with quic-go.
+
+Install them by running
+```bash
+git config core.hooksPath .githooks
+```
diff --git a/electron/native/private-transport/third_party/quic-go/.githooks/pre-commit b/electron/native/private-transport/third_party/quic-go/.githooks/pre-commit
new file mode 100644
index 000000000..0e3c57248
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.githooks/pre-commit
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+# Check that test files don't contain focussed test cases.
+errored=false
+for f in $(git diff --diff-filter=d --cached --name-only); do
+	if [[ $f != *_test.go ]]; then continue; fi
+	output=$(git show :"$f" | grep -n -e "FIt(" -e "FContext(" -e "FDescribe(")
+	if [ $? -eq 0 ]; then
+		echo "$f contains a focussed test:"
+		echo "$output"
+		echo ""
+		errored=true
+	fi
+done
+
+pushd ./integrationtests/gomodvendor > /dev/null
+go mod tidy
+if [[ -n $(git diff --diff-filter=d --name-only -- "go.mod" "go.sum") ]]; then
+  echo "go.mod / go.sum in integrationtests/gomodvendor not tidied"
+  errored=true
+fi
+popd > /dev/null
+
+# Check that all Go files are properly gofumpt-ed.
+output=$(gofumpt -d $(git diff --diff-filter=d --cached --name-only -- '*.go'))
+if [ -n "$output" ]; then
+	echo "Found files that are not properly gofumpt-ed."
+	echo "$output"
+	errored=true
+fi
+
+if [ "$errored" = true ]; then
+	exit 1
+fi
diff --git a/electron/native/private-transport/third_party/quic-go/.github/FUNDING.yml b/electron/native/private-transport/third_party/quic-go/.github/FUNDING.yml
new file mode 100644
index 000000000..7de30a1d7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/FUNDING.yml
@@ -0,0 +1,13 @@
+# These are supported funding model platforms
+
+github: [marten-seemann] # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
diff --git a/electron/native/private-transport/third_party/quic-go/.github/dependabot.yml b/electron/native/private-transport/third_party/quic-go/.github/dependabot.yml
new file mode 100644
index 000000000..5ace4600a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/build-interop-docker.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/build-interop-docker.yml
new file mode 100644
index 000000000..bf0a7f609
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/build-interop-docker.yml
@@ -0,0 +1,51 @@
+name: Build interop Docker image
+
+permissions: read-all
+
+on: 
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'push' && github.ref != 'refs/heads/master' }}
+
+jobs:
+  interop:
+    runs-on: ${{ fromJSON(vars['DOCKER_RUNNER_UBUNTU'] || '"ubuntu-latest"') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        with:
+          platforms: linux/amd64,linux/arm64
+      - name: Login to Docker Hub
+        if: github.event_name == 'push'
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: set tag name
+        id: tag
+        # Tagged releases won't be picked up by the interop runner automatically,
+        # but they can be useful when debugging regressions.
+        run: |
+          if [[ $GITHUB_REF == refs/tags/* ]]; then
+            echo "tag=${GITHUB_REF#refs/tags/}" | tee -a $GITHUB_OUTPUT;
+          else
+            echo 'tag=latest' | tee -a $GITHUB_OUTPUT;
+          fi
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: "."
+          file: "interop/Dockerfile"
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name == 'push' }}
+          tags: martenseemann/quic-go-interop:${{ steps.tag.outputs.tag }}
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-coverage.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-coverage.yml
new file mode 100644
index 000000000..94047bda6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-coverage.yml
@@ -0,0 +1,108 @@
+name: ClusterFuzz coverage
+on:
+  # Disabled because OSS-Fuzz still uses Go 1.25, while quic-go requires Go 1.27.
+  # Re-enable once OSS-Fuzz supports Go 1.27; tracked in https://github.com/google/oss-fuzz/issues/15307.
+  # schedule:
+  #   - cron: '12 3,11,19 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_DEFAULT_PLATFORM: linux/amd64
+      CLUSTERFUZZ_CORPUS_BUCKET: quic-go-corpus.clusterfuzz-external.appspot.com
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7
+        with:
+          repository: google/oss-fuzz
+          path: oss-fuzz
+      - uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+      - name: Configure Google Cloud credentials
+        run: |
+          cat > "$RUNNER_TEMP/gcp-ossfuzz-user-credentials.json" <<'EOF'
+          ${{ secrets.GCP_OSSFUZZ_USER_CREDENTIALS }}
+          EOF
+          echo "CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=$RUNNER_TEMP/gcp-ossfuzz-user-credentials.json" >> "$GITHUB_ENV"
+      - name: Download ClusterFuzz corpus
+        run: |
+          set -euo pipefail
+
+          targets=(
+            frame_fuzzer_v2
+            transportparameter_fuzzer_v2
+            http3_frame_fuzzer
+            header_fuzzer_v2
+            handshake_fuzzer_v2
+            frame_sorter_fuzzer
+            http3_header_parsing_fuzzer
+          )
+
+          mkdir -p oss-fuzz/build/corpus/quic-go
+          for target in "${targets[@]}"; do
+            source_dir="gs://${CLUSTERFUZZ_CORPUS_BUCKET}/libFuzzer/quic-go_${target}"
+            corpus_dir="oss-fuzz/build/corpus/quic-go/${target}"
+
+            echo "$target: downloading live corpus"
+            rm -rf "$corpus_dir"
+            mkdir -p "$corpus_dir"
+
+            gcloud storage cp --recursive "$source_dir/*" "$corpus_dir" || echo "$target: no live corpus found"
+          done
+
+          corpus_files=$(find oss-fuzz/build/corpus/quic-go -type f | wc -l | tr -d ' ')
+          if [ "$corpus_files" = 0 ]; then
+            echo "no ClusterFuzz corpus files downloaded"
+            exit 1
+          fi
+      - name: Summarize ClusterFuzz corpus
+        run: |
+          set -euo pipefail
+
+          corpus_root=oss-fuzz/build/corpus/quic-go
+          {
+            echo "## ClusterFuzz corpus"
+            echo
+            echo "| Fuzzer | Corpus files downloaded |"
+            echo "| --- | ---: |"
+
+            for corpus_dir in "$corpus_root"/*; do
+              [ -d "$corpus_dir" ] || continue
+
+              target=$(basename "$corpus_dir")
+              corpus_files=$(find "$corpus_dir" -type f | wc -l | tr -d ' ')
+              if [ "$corpus_files" = 0 ]; then
+                corpus_files="---"
+              fi
+              echo "| \`$target\` | $corpus_files |"
+            done
+          } >> "$GITHUB_STEP_SUMMARY"
+      - name: Build coverage fuzzers
+        working-directory: oss-fuzz
+        run: |
+          python3 infra/helper.py build_image --no-pull quic-go
+          python3 infra/helper.py build_fuzzers --sanitizer coverage --mount_path /src/quic-go quic-go "$GITHUB_WORKSPACE"
+      - name: Generate coverage
+        working-directory: oss-fuzz
+        run: |
+          rm -f build/out/quic-go/qpack_decode_fuzzer
+          python3 infra/helper.py coverage --no-corpus-download --no-serve quic-go
+      - name: Prepare Codecov coverage
+        working-directory: oss-fuzz
+        run: |
+          sed "s#^/out/src/quic-go/#${GITHUB_WORKSPACE}/#" \
+            build/out/quic-go/fuzz.cov > "$GITHUB_WORKSPACE/clusterfuzz.coverprofile"
+          test -s "$GITHUB_WORKSPACE/clusterfuzz.coverprofile"
+      - name: Upload coverage to Codecov
+        if: ${{ !cancelled() }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          disable_search: true
+          files: clusterfuzz.coverprofile
+          flags: clusterfuzz
+          name: ClusterFuzz fuzzing
+          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-lite-batch.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-lite-batch.yml
new file mode 100644
index 000000000..bf8154cb6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-lite-batch.yml
@@ -0,0 +1,90 @@
+name: ClusterFuzzLite batch fuzzing
+on:
+  # Disabled because OSS-Fuzz still uses Go 1.25, while quic-go requires Go 1.27.
+  # Re-enable once OSS-Fuzz supports Go 1.27; tracked in https://github.com/google/oss-fuzz/issues/15307.
+  # schedule:
+  #   - cron: '0 0/6 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  batch-fuzzing:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer:
+        - address
+    steps:
+      - name: Build Fuzzers (${{ matrix.sanitizer }})
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: go
+          sanitizer: ${{ matrix.sanitizer }}
+      - name: Run Fuzzers (${{ matrix.sanitizer }})
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 3600
+          mode: 'batch'
+          sanitizer: ${{ matrix.sanitizer }}
+          output-sarif: true
+          storage-repo: https://${{ secrets.CLUSTERFUZZ_LITE_STORAGE }}@github.com/quic-go/clusterfuzzlite-storage.git
+          storage-repo-branch: master
+          storage-repo-branch-coverage: gh-pages
+
+  coverage:
+    needs: batch-fuzzing
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_DEFAULT_PLATFORM: linux/amd64
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7
+        with:
+          repository: google/oss-fuzz
+          path: oss-fuzz
+      - uses: actions/checkout@v7
+        with:
+          repository: quic-go/clusterfuzzlite-storage
+          ref: master
+          path: clusterfuzzlite-storage
+          token: ${{ secrets.CLUSTERFUZZ_LITE_STORAGE }}
+      - name: List fuzz targets
+        run: find clusterfuzzlite-storage/corpus -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | sort
+      - name: Prepare corpus
+        run: |
+          mkdir -p oss-fuzz/build/corpus
+          mv clusterfuzzlite-storage/corpus oss-fuzz/build/corpus/quic-go
+      - name: Use ClusterFuzzLite build script
+        run: |
+          cp .clusterfuzzlite/build.sh oss-fuzz/projects/quic-go/build.sh
+          sed -i '4i cd "$SRC/quic-go"' oss-fuzz/projects/quic-go/build.sh
+      - name: Build coverage fuzzers
+        working-directory: oss-fuzz
+        run: |
+          python3 infra/helper.py build_image --no-pull quic-go
+          python3 infra/helper.py build_fuzzers --sanitizer coverage --mount_path /src/quic-go quic-go "$GITHUB_WORKSPACE"
+      - name: Generate coverage
+        working-directory: oss-fuzz
+        run: python3 infra/helper.py coverage --no-corpus-download --no-serve quic-go
+      - name: Prepare Codecov coverage
+        working-directory: oss-fuzz
+        run: |
+          sed "s#^/out/src/quic-go/#${GITHUB_WORKSPACE}/#" \
+            build/out/quic-go/fuzz.cov > "$GITHUB_WORKSPACE/clusterfuzz-lite-batch.coverprofile"
+          test -s "$GITHUB_WORKSPACE/clusterfuzz-lite-batch.coverprofile"
+      - name: Upload coverage to Codecov
+        if: ${{ !cancelled() }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          disable_search: true
+          files: clusterfuzz-lite-batch.coverprofile
+          flags: clusterfuzz-lite-batch
+          name: ClusterFuzzLite batch fuzzing
+          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-lite-pr.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-lite-pr.yml
new file mode 100644
index 000000000..08642108d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-lite-pr.yml
@@ -0,0 +1,54 @@
+name: ClusterFuzzLite PR fuzzing
+on:
+  # Disabled because OSS-Fuzz still uses Go 1.25, while quic-go requires Go 1.27.
+  # Re-enable once OSS-Fuzz supports Go 1.27; tracked in https://github.com/google/oss-fuzz/issues/15307.
+  # pull_request:
+  #   paths:
+  #     - '**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  PR:
+    if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' }}
+    env:
+      # Forked PRs don't receive repository secrets, so they run without corpus storage.
+      CLUSTERFUZZ_LITE_STORAGE_REPO: >-
+        ${{
+          github.event.pull_request.head.repo.id == github.event.pull_request.base.repo.id &&
+          format('https://{0}@github.com/quic-go/clusterfuzzlite-storage.git', secrets.CLUSTERFUZZ_LITE_STORAGE) || ''
+        }}
+    runs-on: ${{ fromJSON(vars['CLUSTERFUZZ_LITE_RUNNER_UBUNTU'] || '"ubuntu-latest"') }}
+    concurrency:
+      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
+      cancel-in-progress: true
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer:
+        - address
+    steps:
+    - name: Build Fuzzers (${{ matrix.sanitizer }})
+      uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+      with:
+        language: go
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        sanitizer: ${{ matrix.sanitizer }}
+        storage-repo: ${{ env.CLUSTERFUZZ_LITE_STORAGE_REPO }}
+        storage-repo-branch: master
+        storage-repo-branch-coverage: gh-pages
+    - name: Run Fuzzers (${{ matrix.sanitizer }})
+      uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        fuzz-seconds: 480
+        mode: 'code-change'
+        sanitizer: ${{ matrix.sanitizer }}
+        output-sarif: true
+        parallel-fuzzing: true
+        storage-repo: ${{ env.CLUSTERFUZZ_LITE_STORAGE_REPO }}
+        storage-repo-branch: master
+        storage-repo-branch-coverage: gh-pages
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-lite-prune.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-lite-prune.yml
new file mode 100644
index 000000000..fc228a797
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/clusterfuzz-lite-prune.yml
@@ -0,0 +1,32 @@
+name: ClusterFuzzLite pruning
+on:
+  # Disabled because OSS-Fuzz still uses Go 1.25, while quic-go requires Go 1.27.
+  # Re-enable once OSS-Fuzz supports Go 1.27; tracked in https://github.com/google/oss-fuzz/issues/15307.
+  # schedule:
+  #   - cron: '0 2 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  Pruning:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Build Fuzzers
+      id: build
+      uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+      with:
+        language: go
+    - name: Run Fuzzers
+      id: run
+      uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        fuzz-seconds: 600
+        mode: 'prune'
+        output-sarif: true
+        storage-repo: https://${{ secrets.CLUSTERFUZZ_LITE_STORAGE }}@github.com/quic-go/clusterfuzzlite-storage.git
+        storage-repo-branch: master
+        storage-repo-branch-coverage: gh-pages
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/codspeed.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/codspeed.yml
new file mode 100644
index 000000000..9d9d399ea
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/codspeed.yml
@@ -0,0 +1,30 @@
+name: Benchmarks
+
+permissions:
+  contents: read
+  id-token: write
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+jobs:
+  benchmarks:
+    name: Benchmarks
+    runs-on: codspeed-macro
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: "1.27.x"
+          check-latest: true
+      - name: Run the benchmarks
+        uses: CodSpeedHQ/action@4296e51e7041e24dadb86d1d6e8b9320d223dbe8 # v5.0.3
+        with:
+          mode: walltime
+          run: go test -run=^$ -bench=. ./integrationtests/self
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/cross-compile.sh b/electron/native/private-transport/third_party/quic-go/.github/workflows/cross-compile.sh
new file mode 100644
index 000000000..cd526223f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/cross-compile.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+set -e
+
+dist="$1"
+goos=$(echo "$dist" | cut -d "/" -f1)
+goarch=$(echo "$dist" | cut -d "/" -f2)
+
+# cross-compiling for android is a pain...
+if [[ "$goos" == "android" ]]; then exit; fi
+# iOS builds require Cgo, see https://github.com/golang/go/issues/43343
+# Cgo would then need a C cross compilation setup. Not worth the hassle.
+if [[ "$goos" == "ios" ]]; then exit; fi
+
+# Write all log output to a temporary file instead of to stdout.
+# That allows running this script in parallel, while preserving the correct order of the output.
+log_file=$(mktemp)
+
+error_handler() {
+  cat "$log_file" >&2
+  rm "$log_file"
+  exit 1
+}
+
+trap 'error_handler' ERR
+
+echo "$dist" >> "$log_file"
+out="main-$goos-$goarch"
+GOOS=$goos GOARCH=$goarch go build -o $out example/main.go >> "$log_file" 2>&1
+rm $out
+
+cat "$log_file"
+rm "$log_file"
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/cross-compile.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/cross-compile.yml
new file mode 100644
index 000000000..abc075005
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/cross-compile.yml
@@ -0,0 +1,50 @@
+on: [push, pull_request]
+
+permissions: read-all
+
+jobs:
+  crosscompile:
+    permissions:
+      actions: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        go: [ "1.26.x", "1.27.x" ]
+    runs-on: ${{ fromJSON(vars['CROSS_COMPILE_RUNNER_UBUNTU'] || '"ubuntu-latest"') }}
+    name: "Cross Compilation (Go ${{matrix.go}})"
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: ${{ matrix.go }}
+          check-latest: true
+      - name: Get Date
+        id: get-date
+        run: echo "date=$(/bin/date -u "+%Y%m%d")" >> $GITHUB_OUTPUT
+      - name: Load Go build cache
+        id: load-go-cache
+        uses: actions/cache/restore@v6
+        with:
+          path: ~/.cache/go-build
+          key: go-${{ matrix.go }}-crosscompile-${{ steps.get-date.outputs.date }}
+          restore-keys: go-${{ matrix.go }}-crosscompile-
+      - name: Install build utils
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-multilib
+      - name: Install dependencies
+        run: go build example/main.go
+      - name: Run cross compilation
+        # run in parallel on as many cores as are available on the machine
+        run: go tool dist list | xargs -I % -P "$(nproc)" .github/workflows/cross-compile.sh %
+      - name: Save Go build cache
+        # only store cache when on master
+        if: github.event_name == 'push' && github.ref_name == 'master'
+        uses: actions/cache/save@v6
+        with:
+          path: ~/.cache/go-build
+          # Caches are immutable, so we only update it once per day (at most).
+          # See https://github.com/actions/cache/blob/main/tips-and-workarounds.md#update-a-cache
+          key: go-${{ matrix.go }}-crosscompile-${{ steps.get-date.outputs.date }}
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/go-generate.sh b/electron/native/private-transport/third_party/quic-go/.github/workflows/go-generate.sh
new file mode 100644
index 000000000..fab97c73d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/go-generate.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -e
+
+# delete all go-generated files (that adhere to the comment convention)
+git ls-files -z | grep --include \*.go -lrIZ "^// Code generated .* DO NOT EDIT\.$" | tr '\0' '\n' | xargs rm -f
+
+# First regenerate sys_conn_buffers_write.go.
+# If it doesn't exist, the following mockgen calls will fail.
+go generate -run "sys_conn_buffers_write.go"
+# now generate everything
+go generate ./...
+
+# Check if any files were changed
+git diff --exit-code || (
+    echo "Generated files are not up to date. Please run 'go generate ./...' and commit the changes."
+    exit 1
+)
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/govulncheck.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/govulncheck.yml
new file mode 100644
index 000000000..904fffa42
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/govulncheck.yml
@@ -0,0 +1,19 @@
+on:
+  schedule:
+    - cron: "17 4 * * *"
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: "1.27.x"
+          check-latest: true
+      - name: Run govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/integration.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/integration.yml
new file mode 100644
index 000000000..f1e198a36
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/integration.yml
@@ -0,0 +1,89 @@
+on: [push, pull_request]
+
+permissions: read-all
+
+jobs:
+  integration:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ "ubuntu" ]
+        go: [ "1.26.x", "1.27.x" ]
+        race: [ false ]
+        include:
+          - os: "ubuntu"
+            go: "1.27.x"
+            race: true
+          - os: "windows"
+            go: "1.27.x"
+            race: false
+          - os: "macos"
+            go: "1.27.x"
+            race: false
+    runs-on: ${{ fromJSON(vars[format('INTEGRATION_RUNNER_{0}', matrix.os)] || format('"{0}-latest"', matrix.os)) }}
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash # by default Windows uses PowerShell, which uses a different syntax for setting environment variables
+    env:
+      DEBUG: false # set this to true to export qlogs and save them as artifacts
+      TIMESCALE_FACTOR: 3
+    name: "Integration (${{ matrix.os }}, Go ${{ matrix.go }}${{ matrix.race && ', race' || '' }})"
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: ${{ matrix.go }}
+          check-latest: true
+      - name: Install go-junit-report
+        run: go install github.com/jstemmer/go-junit-report/v2@v2.1.0
+      - name: Set qlogger
+        if: env.DEBUG == 'true'
+        run: echo "QLOGFLAG= -qlog" >> $GITHUB_ENV
+      - name: Enable race detector
+        if: ${{ matrix.race }}
+        run: echo "RACEFLAG= -race" >> $GITHUB_ENV
+      - run: go version
+      - name: Run tools tests
+        run: go test ${{ env.RACEFLAG }} -v -timeout 30s -shuffle=on ./integrationtests/tools/... 2>&1 | go-junit-report -set-exit-code -iocopy -out report_tools.xml
+      - name: Run version negotiation tests
+        run: go test ${{ env.RACEFLAG }} -v -timeout 30s -shuffle=on ./integrationtests/versionnegotiation ${{ env.QLOGFLAG }} 2>&1 | go-junit-report -set-exit-code -iocopy -out report_versionnegotiation.xml
+      - name: Run FIPS 140 tests
+        if: success() || failure()
+        working-directory: integrationtests/fips
+        run: go test -v -timeout 1m -shuffle=on . 2>&1 | go-junit-report -set-exit-code -iocopy -out ../../report_fips.xml
+      - name: Run self tests, using QUIC v1
+        if: success() || failure() # run this step even if the previous one failed
+        run: go test ${{ env.RACEFLAG }} -v -timeout 5m -shuffle=on ./integrationtests/self -version=1 ${{ env.QLOGFLAG }} 2>&1 | go-junit-report -set-exit-code -iocopy -out report_self.xml
+      - name: Run self tests, using QUIC v2
+        if: ${{ !matrix.race && (success() || failure()) }} # run this step even if the previous one failed
+        run: go test ${{ env.RACEFLAG }} -v -timeout 5m -shuffle=on ./integrationtests/self -version=2 ${{ env.QLOGFLAG }} 2>&1 | go-junit-report -set-exit-code -iocopy -out report_self_v2.xml
+      - name: Run self tests, with GSO disabled
+        if: ${{ matrix.os == 'ubuntu' && (success() || failure()) }} # run this step even if the previous one failed
+        env:
+          QUIC_GO_DISABLE_GSO: true
+        run: go test ${{ env.RACEFLAG }} -v -timeout 5m -shuffle=on ./integrationtests/self -version=1 ${{ env.QLOGFLAG }} 2>&1 | go-junit-report -set-exit-code -iocopy -out report_self_nogso.xml
+      - name: Run self tests, with ECN disabled
+        if: ${{ !matrix.race && matrix.os == 'ubuntu' && (success() || failure()) }} # run this step even if the previous one failed
+        env:
+          QUIC_GO_DISABLE_ECN: true
+        run: go test ${{ env.RACEFLAG }} -v -timeout 5m -shuffle=on ./integrationtests/self -version=1 ${{ env.QLOGFLAG }} 2>&1 | go-junit-report -set-exit-code -iocopy -out report_self_noecn.xml
+      - name: Run benchmarks
+        if: ${{ !matrix.race }}
+        run: go test -v -run=^$ -timeout 5m -shuffle=on -bench=. ./integrationtests/self
+      - name: save qlogs
+        if: ${{ always() && env.DEBUG == 'true' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: qlogs-${{ matrix.os }}-go${{ matrix.go }}-race${{ matrix.race }}
+          path: integrationtests/self/*.qlog
+          retention-days: 7
+      - name: Upload report to Codecov
+        if: ${{ !cancelled() && !matrix.race }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          report_type: test_results
+          name: Unit tests
+          files: report_tools.xml,report_versionnegotiation.xml,report_self.xml,report_self_v2.xml,report_self_nogso.xml,report_self_noecn.xml,report_fips.xml
+          env_vars: OS,GO
+          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/lint.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/lint.yml
new file mode 100644
index 000000000..180dc17c9
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/lint.yml
@@ -0,0 +1,113 @@
+on: [push, pull_request]
+
+permissions: read-all
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: "1.27.x"
+          check-latest: true
+      - name: Check for //go:build ignore in .go files
+        run: |
+          IGNORED_FILES=$(grep -rl '//go:build ignore' . --include='*.go') || true
+          if [ -n "$IGNORED_FILES" ]; then
+            echo "::error::Found ignored Go files: $IGNORED_FILES"
+            exit 1
+          fi
+      - name: Check that go.mod is tidied
+        if: success() || failure() # run this step even if the previous one failed
+        run: go mod tidy -diff
+      - name: Check that FIPS go.mod is tidied
+        if: success() || failure() # run this step even if the previous one failed
+        working-directory: integrationtests/fips
+        run: go mod tidy -diff
+      - name: Run go fix
+        if: success() || failure() # run this step even if the previous one failed
+        run: |
+          set -o pipefail
+          # slices.Backward is measurably slower in receivedPacketHistory.
+          go list ./... | grep -v '/internal/ackhandler$' | xargs go fix -diff
+          go fix -diff -slicesbackward=false ./internal/ackhandler
+      - name: Run code generators
+        if: success() || failure() # run this step even if the previous one failed
+        run: .github/workflows/go-generate.sh
+      - name: Check that go mod vendor works
+        if: success() || failure() # run this step even if the previous one failed
+        run: |
+          cd integrationtests/gomodvendor
+          go mod vendor
+      - name: Run gcassert
+        if: success() || failure() # run this step even if the previous one failed
+        run: go tool gcassert ./...
+        # Only run govulncheck on pull requests, not on pushes (including merge commits to master).
+        # govulncheck queries the vulnerability database at runtime, so a newly disclosed vulnerability
+        # could otherwise cause the post-merge run to fail even though nothing in the repository changed,
+        # breaking master through no fault of the merged PR.
+      - name: Run govulncheck
+        if: ${{ (success() || failure()) && github.event_name == 'pull_request' }}
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+  golangci-lint:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        go: [ "1.26.x", "1.27.x" ]
+    env:
+      GOLANGCI_LINT_VERSION: v2.13.0
+    name: golangci-lint (Go ${{ matrix.go }})
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: ${{ matrix.go }}
+          check-latest: true
+      - name: golangci-lint (Linux)
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        with:
+          args: --timeout=3m
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+      - name: golangci-lint (Windows)
+        if: success() || failure() # run this step even if the previous one failed
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        env:
+          GOOS: "windows"
+        with:
+          args: --timeout=3m
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+      - name: golangci-lint (OSX)
+        if: success() || failure() # run this step even if the previous one failed
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        env:
+          GOOS: "darwin"
+        with:
+          args: --timeout=3m
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+      - name: golangci-lint (FreeBSD)
+        if: success() || failure() # run this step even if the previous one failed
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        env:
+          GOOS: "freebsd"
+        with:
+          args: --timeout=3m
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+      - name: golangci-lint (OpenBSD)
+        if: success() || failure() # run this step even if the previous one failed
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        env:
+          GOOS: "openbsd"
+        with:
+          args: --timeout=3m
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+      - name: golangci-lint (others)
+        if: success() || failure() # run this step even if the previous one failed
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        env:
+          GOOS: "solaris" # some OS that we don't have any build tags for
+        with:
+          args: --timeout=3m
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
diff --git a/electron/native/private-transport/third_party/quic-go/.github/workflows/unit.yml b/electron/native/private-transport/third_party/quic-go/.github/workflows/unit.yml
new file mode 100644
index 000000000..16d7fcab8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.github/workflows/unit.yml
@@ -0,0 +1,74 @@
+on: [push, pull_request]
+
+permissions: read-all
+
+jobs:
+  unit:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ "ubuntu", "windows", "macos" ]
+        go: [ "1.26.x", "1.27.x" ]
+    runs-on: ${{ fromJSON(vars[format('UNIT_RUNNER_{0}', matrix.os)] || format('"{0}-latest"', matrix.os)) }}
+    name: Unit tests (${{ matrix.os}}, Go ${{ matrix.go }})
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: ${{ matrix.go }}
+          check-latest: true
+      - run: go version
+      - name: Install go-junit-report
+        run: go install github.com/jstemmer/go-junit-report/v2@v2.1.0
+      - name: Remove integrationtests
+        shell: bash
+        run: git rm -r --cached integrationtests && rm -rf integrationtests
+      - name: Run tests
+        env:
+          TIMESCALE_FACTOR: 10
+        run: go test -v -shuffle on -cover -coverprofile coverage.txt ./... 2>&1 | go-junit-report -set-exit-code -iocopy -out report.xml
+      - name: Run tests as root
+        if: ${{ matrix.os == 'ubuntu' }}
+        env:
+          TIMESCALE_FACTOR: 10
+          FILE: sys_conn_helper_linux_test.go
+        run: |
+          test -f $FILE # make sure the file actually exists
+          TEST_NAMES=$(grep '^func Test' "$FILE" | sed 's/^func \([A-Za-z0-9_]*\)(.*/\1/' | tr '\n' '|')
+          go test -c -cover -tags root -o quic-go.test .
+          sudo ./quic-go.test -test.v -test.run "${TEST_NAMES%|}" -test.coverprofile coverage-root.txt 2>&1 | go-junit-report -set-exit-code -iocopy -package-name github.com/quic-go/quic-go -out report_root.xml
+          rm quic-go.test
+      - name: Run tests with race detector
+        if: ${{ matrix.os == 'ubuntu' }} # speed things up. Windows and OSX VMs are slow
+        env:
+          TIMESCALE_FACTOR: 20
+        run: go test -v -shuffle on ./...
+      - name: Run handshake tests in FIPS140 mode
+        env:
+          GODEBUG: fips140=only
+        run: go test -v ./internal/handshake -run 'TestToken|TestRetry|TestInitial|TestDecode|TestEncrypt'
+      - name: Run benchmark tests
+        run: go test -v -run=^$ -benchtime 0.5s -bench=. ./...
+      - name: Upload coverage to Codecov
+        if: ${{ !cancelled() }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        env:
+          OS: ${{ matrix.os }}
+          GO: ${{ matrix.go }}
+        with:
+          files: coverage.txt,coverage-root.txt
+          env_vars: OS,GO
+          token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload test report to Codecov
+        if: ${{ !cancelled() }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        env:
+          OS: ${{ matrix.os }}
+          GO: ${{ matrix.go }}
+        with:
+          report_type: test_results
+          name: Unit tests
+          files: report.xml,report_root.xml
+          env_vars: OS,GO
+          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/electron/native/private-transport/third_party/quic-go/.gitignore b/electron/native/private-transport/third_party/quic-go/.gitignore
new file mode 100644
index 000000000..60571ed0c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.gitignore
@@ -0,0 +1,20 @@
+debug
+debug.test
+main
+mockgen_tmp.go
+*.qtr
+*.qlog
+*.sqlog
+*.txt
+race.[0-9]*
+
+fuzzing/*/*.zip
+fuzzing/*/coverprofile
+fuzzing/*/crashers
+fuzzing/*/sonarprofile
+fuzzing/*/suppressions
+fuzzing/*/corpus/
+
+**/testdata/fuzz/
+
+gomock_reflect_*/
diff --git a/electron/native/private-transport/third_party/quic-go/.golangci.yml b/electron/native/private-transport/third_party/quic-go/.golangci.yml
new file mode 100644
index 000000000..82bf4fc90
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/.golangci.yml
@@ -0,0 +1,99 @@
+version: "2"
+linters:
+  default: none
+  enable:
+    - asciicheck
+    - copyloopvar
+    - depguard
+    - exhaustive
+    - govet
+    - ineffassign
+    - misspell
+    - nolintlint
+    - prealloc
+    - staticcheck
+    - unconvert
+    - unparam
+    - unused
+    - usetesting
+  settings:
+    depguard:
+      rules:
+        random:
+          deny:
+            - pkg: "math/rand$"
+              desc: use math/rand/v2
+            - pkg: "golang.org/x/exp/rand"
+              desc: use math/rand/v2
+        quicvarint:
+          list-mode: strict
+          files:
+            - '**/github.com/quic-go/quic-go/quicvarint/*'
+            - '!$test'
+          allow:
+            - $gostd
+        rsa:
+          list-mode: original
+          deny:
+            - pkg: crypto/rsa
+              desc: "use crypto/ed25519 instead"
+        ginkgo:
+          list-mode: original
+          deny:
+            - pkg: github.com/onsi/ginkgo
+              desc: "use standard Go tests"
+            - pkg: github.com/onsi/ginkgo/v2
+              desc: "use standard Go tests"
+            - pkg: github.com/onsi/gomega
+              desc: "use standard Go tests"
+        http3-internal:
+          list-mode: lax
+          files:
+            - '**/http3/**'
+          deny:
+            - pkg: 'github.com/quic-go/quic-go/internal'
+              desc: 'no dependency on quic-go/internal'
+    misspell:
+      ignore-rules:
+        - ect
+    # see https://github.com/ldez/usetesting/issues/10
+    usetesting:
+      context-background: false
+      context-todo: false
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - depguard
+        path: internal/qtls
+      - linters:
+          - exhaustive
+          - prealloc
+          - unparam
+        path: _test\.go
+      - linters:
+          - staticcheck
+        path: _test\.go
+        text: 'SA1029:' # inappropriate key in call to context.WithValue
+    paths:
+      - internal/handshake/cipher_suite.go
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - gofumpt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - internal/handshake/cipher_suite.go
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/electron/native/private-transport/third_party/quic-go/FIPS140.md b/electron/native/private-transport/third_party/quic-go/FIPS140.md
new file mode 100644
index 000000000..7d7d92e87
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/FIPS140.md
@@ -0,0 +1,37 @@
+# FIPS 140-3
+
+quic-go relies on the Go standard library for cryptography, including the Go Cryptographic Module described in [The FIPS 140-3 Go Cryptographic Module](https://go.dev/blog/fips140). quic-go does not seek separate FIPS 140-3 validation as a cryptographic module. This document explains how quic-go uses Go standard library cryptography for QUIC operations relevant to FIPS 140-3.
+
+Starting with quic-go v0.60, the behavior described here applies when built with Go 1.26 or newer. With older Go versions, quic-go still builds and runs as usual, without any attempt to meet FIPS 140 requirements.
+
+## QUIC operations relevant to FIPS 140-3
+
+quic-go delegates the TLS 1.3 handshake, certificate handling, cipher suite selection, session tickets, and the TLS key schedule to `crypto/tls`. When Go's FIPS 140-3 mode is active, `crypto/tls` restricts the algorithms it negotiates.
+
+### Packet protection AEADs
+
+The main quic-go-specific FIPS-relevant operations are the AEADs protecting Handshake, 0-RTT, and 1-RTT packets.
+
+AES-GCM packet protection AEADs are constructed through the Go standard library's TLS 1.3 AES-GCM implementation. Today this uses `go:linkname` to call the unexported `crypto/tls.aeadAESGCMTLS13`, because the standard library does not yet expose a QUIC-specific constructor; see [golang/go#79219](https://github.com/golang/go/issues/79219).
+
+ChaCha20-Poly1305 is not used in Go's FIPS 140-3 mode. `crypto/tls` avoids that cipher suite during negotiation, and quic-go additionally guards its internal ChaCha20-Poly1305 path when FIPS 140-3 mode is enabled.
+
+### Header protection
+
+For Handshake, 0-RTT, and 1-RTT packets protected with AES cipher suites, header protection keys are derived with `crypto/hkdf` and the AES block operation uses `crypto/aes`. ChaCha20 header protection is tied to the ChaCha20-Poly1305 cipher suite and is not reachable in FIPS 140-3 mode.
+
+### Address validation tokens
+
+quic-go encrypts the address validation tokens it sends in Retry packets and NEW_TOKEN frames. These are not TLS session tickets (those are handled by `crypto/tls`); they carry server-defined state such as the client address, timestamp, RTT information, and Retry connection IDs.
+
+Token-protection keys are derived with `crypto/hkdf`, AES is used via `crypto/aes`, and the token AEAD is constructed with `cipher.NewGCMWithRandomNonce`, keeping token encryption on standard library primitives.
+
+## QUIC operations not relevant to FIPS 140-3
+
+### Initial packet protection
+
+Initial packet protection (including Initial header protection) is not treated as FIPS 140-relevant confidentiality protection: the Initial secrets are derived from constants in RFC 9001 and the packet's destination connection ID, so any observer can derive the same keys. quic-go therefore disables strict FIPS 140 enforcement around Initial packet construction in Go 1.26 FIPS 140-3 mode. See the IETF QUIC mailing list discussion at <https://mailarchive.ietf.org/arch/msg/quic/k2kl2W_n5WDEZBbt3O31Ef2XBbM/>.
+
+### Retry packet integrity tag
+
+RFC 9001 defines the Retry packet integrity tag using fixed keys and nonces. It guards against accidental corruption and casual injection but does not encrypt packet contents. quic-go treats it as outside the FIPS 140 scope and disables strict FIPS 140 enforcement for that AEAD construction in Go 1.26 FIPS 140-3 mode.
diff --git a/electron/native/private-transport/third_party/quic-go/FUZZING.md b/electron/native/private-transport/third_party/quic-go/FUZZING.md
new file mode 100644
index 000000000..2662a1931
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/FUZZING.md
@@ -0,0 +1,59 @@
+# Fuzzing
+
+[![Documentation](https://img.shields.io/badge/OSS--Fuzz-Introspector-red?style=flat)](https://introspector.oss-fuzz.com/project-profile?project=quic-go)
+[![ClusterFuzz coverage](https://img.shields.io/codecov/c/github/quic-go/quic-go/master.svg?flag=clusterfuzz&label=ClusterFuzz%20coverage&logo=codecov&logoColor=white&style=flat)](https://app.codecov.io/gh/quic-go/quic-go?flags%5B0%5D=clusterfuzz)
+[![ClusterFuzz Lite Batch coverage](https://img.shields.io/codecov/c/github/quic-go/quic-go/master.svg?flag=clusterfuzz-lite-batch&label=ClusterFuzz%20Lite%20Batch%20coverage&logo=codecov&logoColor=white&style=flat)](https://app.codecov.io/gh/quic-go/quic-go?flags%5B0%5D=clusterfuzz-lite-batch)
+
+Run the commands below from a local [`google/oss-fuzz`](https://github.com/google/oss-fuzz) checkout.
+Fuzz target names match the binary names listed in `oss-fuzz.sh` (for example, `frame_fuzzer_v2`).
+
+Update the base images:
+```sh
+python3 infra/helper.py pull_images
+```
+
+## Running fuzzers locally
+
+The following steps run a single fuzz target and then open its line-by-line coverage in `go tool cover`.
+
+```sh
+export DOCKER_DEFAULT_PLATFORM=linux/amd64
+export FUZZ_TARGET=<fuzz_target>
+export CORPUS_DIR=corpus/$FUZZ_TARGET
+
+mkdir -p "$CORPUS_DIR"
+
+python3 infra/helper.py build_image --no-pull quic-go
+python3 infra/helper.py build_fuzzers --sanitizer address quic-go
+python3 infra/helper.py run_fuzzer --corpus-dir="$CORPUS_DIR" quic-go "$FUZZ_TARGET"
+```
+
+Leave `run_fuzzer` running for a while to build up a corpus. It unpacks the seed corpus zip into the corpus directory and appends new entries as it discovers them.
+
+```sh
+python3 infra/helper.py build_fuzzers --sanitizer coverage quic-go
+python3 infra/helper.py coverage --no-serve --fuzz-target "$FUZZ_TARGET" --corpus-dir="$CORPUS_DIR" quic-go
+sed "s#^/out/#$(pwd)/build/out/quic-go/#" build/out/quic-go/fuzz.cov > "/tmp/quic-go-$FUZZ_TARGET.coverprofile"
+go tool cover -html="/tmp/quic-go-$FUZZ_TARGET.coverprofile"
+```
+
+The `sed` command rewrites the container paths in `fuzz.cov` so that `go tool cover` can locate the source files in the local checkout.
+
+To produce a coverage report against a modified local source tree, mount the local checkout when building the coverage fuzzers, the same way you would for reproducers:
+
+```sh
+python3 infra/helper.py build_fuzzers --sanitizer coverage --mount_path /root/go/src/github.com/quic-go/quic-go quic-go <local_quic_go_dir>
+```
+
+## Reproducing an OSS-Fuzz testcase
+
+Download the reproducer file from the OSS-Fuzz report. To test a local fix, rebuild the fuzzers with the modified quic-go checkout mounted at the path expected by `oss-fuzz.sh`:
+
+```sh
+export DOCKER_DEFAULT_PLATFORM=linux/amd64
+export FUZZ_TARGET=<fuzz_target>
+
+python3 infra/helper.py build_image --no-pull quic-go
+python3 infra/helper.py build_fuzzers --sanitizer address --mount_path /root/go/src/github.com/quic-go/quic-go quic-go <local_quic_go_dir>
+python3 infra/helper.py reproduce quic-go "$FUZZ_TARGET" <reproducer_file>
+```
diff --git a/electron/native/private-transport/third_party/quic-go/LICENSE b/electron/native/private-transport/third_party/quic-go/LICENSE
new file mode 100644
index 000000000..51378befb
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2016 the quic-go authors & Google, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/electron/native/private-transport/third_party/quic-go/QORTAL_PATCH.md b/electron/native/private-transport/third_party/quic-go/QORTAL_PATCH.md
new file mode 100644
index 000000000..c7c59912f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/QORTAL_PATCH.md
@@ -0,0 +1,52 @@
+# Bounded datagram receive queues
+
+Base: upstream quic-go v0.62.0, retaining its MIT license and tests.
+This local module replacement is used by both Hub and the standalone relay.
+Keep both copies identical. There is no cryptographic or wire-protocol change.
+
+The upstream 32-packet HTTP/3 receive queue can discard packets already
+acknowledged by outer QUIC. An inner reliable QUIC connection then retransmits
+and reduces its sending rate. Increasing only the HTTP/3 limit can move overflow
+to the connection-level DATAGRAM queue instead.
+
+Local changes:
+
+- `internal/datagrambuffer`: lazily grown FIFO ring, compact owned payloads,
+  monotonic residence time, byte/packet limits, counters, and atomic global budget.
+- `datagram_queue.go`: use that queue; promptly release on close.
+- `http3/state_tracking_stream.go`: same queue at HTTP/3 layer; close cleanup.
+- `datagram_buffer.go` and `http3/datagram_buffer.go`: opt-in receive profile and
+  numeric stats. No peer-controlled queue-size or allocation parameter.
+- `connection.go`: count existing raw receive-queue overflow; its cap is unchanged.
+
+Defaults remain 32 packets per HTTP/3 stream and 128 per QUIC DATAGRAM queue.
+The application calls `EnableDatagramReceiveBuffer` only for an admitted tunnel
+and its connection. The profile allows at most 1024 packets and 1 MiB including
+per-packet accounting, plus at most 64 KiB of ring slots per queue. It drops
+packets older than 50 ms on enqueue/dequeue; no stale packet is handed onward.
+Expiry is lazy, not a timer promising physical reclamation after 50 ms.
+
+All queues, including default/pre-admission ones, share a **32 MiB process-wide
+live-allocation budget**. Payloads, packet overhead and ring slots are charged;
+ring growth reserves both old and new storage temporarily. This is not an RSS
+limit: Go GC, QUIC socket buffers, cryptographic packets and other application
+allocations are separate. Empty large rings and consumed payload references are
+released immediately; small empty rings stay charged until close.
+
+Overflow drops incoming datagrams, preserving accepted FIFO order. Expiry drops
+stale head entries. DATAGRAM remains unreliable; congestion control is unchanged.
+The profile absorbs bursts, not sustained overload, and does not promise bandwidth
+or priority between opaque encrypted packets. MaxResidenceMicros also counts
+expired entries and can therefore exceed 50 ms.
+
+Tests (from this directory):
+
+```
+go test -race ./internal/datagrambuffer
+go test -race . ./http3
+```
+
+On upgrade, rebase these listed changes onto the new pinned upstream release,
+retain its license, run upstream tests plus the local bounds/cleanup/race tests,
+then run Hub's real MASQUE mixed bulk/datagram fixture and relay access tests.
+Never edit the Go module cache or depend on a developer-only build overlay.
diff --git a/electron/native/private-transport/third_party/quic-go/README.md b/electron/native/private-transport/third_party/quic-go/README.md
new file mode 100644
index 000000000..76b907040
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/README.md
@@ -0,0 +1,80 @@
+<div align="center" style="margin-bottom: 15px;">
+  <img src="./assets/quic-go-logo.png" width="700" height="auto">
+</div>
+
+# A QUIC implementation in pure Go
+
+
+[![Documentation](https://img.shields.io/badge/docs-quic--go.net-red?style=flat)](https://quic-go.net/docs/)
+[![PkgGoDev](https://pkg.go.dev/badge/github.com/quic-go/quic-go)](https://pkg.go.dev/github.com/quic-go/quic-go)
+[![Code Coverage](https://img.shields.io/codecov/c/github/quic-go/quic-go/master.svg?style=flat-square)](https://codecov.io/gh/quic-go/quic-go/)
+<!-- Disabled because OSS-Fuzz still uses Go 1.25, while quic-go requires Go 1.27.
+Re-enable once OSS-Fuzz supports Go 1.27; tracked in https://github.com/google/oss-fuzz/issues/15307.
+[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/quic-go.svg)](https://issues.oss-fuzz.com/issues?q=quic-go)
+-->
+
+quic-go is an implementation of the QUIC protocol ([RFC 9000](https://datatracker.ietf.org/doc/html/rfc9000), [RFC 9001](https://datatracker.ietf.org/doc/html/rfc9001), [RFC 9002](https://datatracker.ietf.org/doc/html/rfc9002)) in Go.
+
+Other QUIC specifications:
+
+* Unreliable Datagram Extension ([RFC 9221](https://datatracker.ietf.org/doc/html/rfc9221))
+* Datagram Packetization Layer Path MTU Discovery (DPLPMTUD, [RFC 8899](https://datatracker.ietf.org/doc/html/rfc8899))
+* QUIC Version 2 ([RFC 9369](https://datatracker.ietf.org/doc/html/rfc9369))
+* QUIC Event Logging using qlog ([draft-ietf-quic-qlog-main-schema](https://datatracker.ietf.org/doc/draft-ietf-quic-qlog-main-schema/) and [draft-ietf-quic-qlog-quic-events](https://datatracker.ietf.org/doc/draft-ietf-quic-qlog-quic-events/))
+* QUIC Stream Resets with Partial Delivery ([draft-ietf-quic-reliable-stream-reset-07](https://datatracker.ietf.org/doc/html/draft-ietf-quic-reliable-stream-reset-07) and [draft-ietf-quic-reliable-stream-reset-09](https://datatracker.ietf.org/doc/html/draft-ietf-quic-reliable-stream-reset-09))
+
+quic-go also supports HTTP/3 ([RFC 9114](https://datatracker.ietf.org/doc/html/rfc9114)).
+
+Other HTTP/3 specifications:
+
+* QPACK: Field Compression for HTTP/3 ([RFC 9204](https://datatracker.ietf.org/doc/html/rfc9204))
+* Extensible Prioritization Scheme for HTTP ([RFC 9218](https://datatracker.ietf.org/doc/html/rfc9218))
+* HTTP Datagrams and the Capsule Protocol ([RFC 9297](https://datatracker.ietf.org/doc/html/rfc9297))
+
+Related projects:
+
+* [webtransport-go](https://github.com/quic-go/webtransport-go) implements WebTransport over HTTP/3 ([draft-ietf-webtrans-http3](https://datatracker.ietf.org/doc/draft-ietf-webtrans-http3/)).
+* [masque-go](https://github.com/quic-go/masque-go) implements CONNECT-UDP ([RFC 9298](https://datatracker.ietf.org/doc/html/rfc9298)).
+* [connect-ip-go](https://github.com/quic-go/connect-ip-go) implements CONNECT-IP ([RFC 9484](https://datatracker.ietf.org/doc/html/rfc9484)).
+
+Detailed documentation can be found on [quic-go.net](https://quic-go.net/docs/).
+
+## FIPS 140-3
+
+Starting with v0.60, quic-go supports use in FIPS 140-3 environments when built with Go 1.26 or newer, using Go standard library cryptography for the QUIC code paths relevant in FIPS mode; see [FIPS140.md](FIPS140.md) for details.
+
+## Projects using quic-go
+
+| Project                                                   | Description                                                                                                                                                       | Stars                                                                                               |
+| ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
+| [AdGuardHome](https://github.com/AdguardTeam/AdGuardHome) | Free and open source, powerful network-wide ads & trackers blocking DNS server.                                                                                   | ![GitHub Repo stars](https://img.shields.io/github/stars/AdguardTeam/AdGuardHome?style=flat-square) |
+| [algernon](https://github.com/xyproto/algernon)           | Small self-contained pure-Go web server with Lua, Markdown, HTTP/2, QUIC, Redis and PostgreSQL support                                                            | ![GitHub Repo stars](https://img.shields.io/github/stars/xyproto/algernon?style=flat-square)        |
+| [caddy](https://github.com/caddyserver/caddy/)            | Fast, multi-platform web server with automatic HTTPS                                                                                                              | ![GitHub Repo stars](https://img.shields.io/github/stars/caddyserver/caddy?style=flat-square)       |
+| [cloudflared](https://github.com/cloudflare/cloudflared)  | A tunneling daemon that proxies traffic from the Cloudflare network to your origins                                                                               | ![GitHub Repo stars](https://img.shields.io/github/stars/cloudflare/cloudflared?style=flat-square)  |
+| [frp](https://github.com/fatedier/frp)                    | A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet                                                                   | ![GitHub Repo stars](https://img.shields.io/github/stars/fatedier/frp?style=flat-square)            |
+| [go-libp2p](https://github.com/libp2p/go-libp2p)          | libp2p implementation in Go, powering [Kubo](https://github.com/ipfs/kubo) (IPFS) and [Lotus](https://github.com/filecoin-project/lotus) (Filecoin), among others | ![GitHub Repo stars](https://img.shields.io/github/stars/libp2p/go-libp2p?style=flat-square)     |
+| [gost](https://github.com/go-gost/gost)                   | A simple security tunnel written in Go                                                                                                                        | ![GitHub Repo stars](https://img.shields.io/github/stars/go-gost/gost?style=flat-square)            |
+| [Hysteria](https://github.com/apernet/hysteria)           | A powerful, lightning fast and censorship resistant proxy                                                                                                         | ![GitHub Repo stars](https://img.shields.io/github/stars/apernet/hysteria?style=flat-square)        |
+| [Mercure](https://github.com/dunglas/mercure)             | An open, easy, fast, reliable and battery-efficient solution for real-time communications                                                                         | ![GitHub Repo stars](https://img.shields.io/github/stars/dunglas/mercure?style=flat-square)         |
+| [nodepass](https://github.com/NodePassProject/nodepass) | A secure, efficient TCP/UDP tunneling solution that delivers fast, reliable access across network restrictions using pre-established TCP/QUIC/WebSocket or HTTP/2 connections. | ![GitHub Repo stars](https://img.shields.io/github/stars/NodePassProject/nodepass?style=flat-square)  |
+| [OONI Probe](https://github.com/ooni/probe-cli)           | Next generation OONI Probe. Library and CLI tool.                                                                                                                 | ![GitHub Repo stars](https://img.shields.io/github/stars/ooni/probe-cli?style=flat-square)          |
+| [reverst](https://github.com/flipt-io/reverst)            | Reverse Tunnels in Go over HTTP/3 and QUIC                                                                                                                        | ![GitHub Repo stars](https://img.shields.io/github/stars/flipt-io/reverst?style=flat-square) |
+| [RoadRunner](https://github.com/roadrunner-server/roadrunner) | High-performance PHP application server, process manager written in Go and powered with plugins | ![GitHub Repo stars](https://img.shields.io/github/stars/roadrunner-server/roadrunner?style=flat-square) |
+| [syncthing](https://github.com/syncthing/syncthing/)      | Open Source Continuous File Synchronization                                                                                                                       | ![GitHub Repo stars](https://img.shields.io/github/stars/syncthing/syncthing?style=flat-square)     |
+| [traefik](https://github.com/traefik/traefik)             | The Cloud Native Application Proxy                                                                                                                                | ![GitHub Repo stars](https://img.shields.io/github/stars/traefik/traefik?style=flat-square)         |
+| [v2ray-core](https://github.com/v2fly/v2ray-core)         | A platform for building proxies to bypass network restrictions                                                                                                    | ![GitHub Repo stars](https://img.shields.io/github/stars/v2fly/v2ray-core?style=flat-square)        |
+| [YoMo](https://github.com/yomorun/yomo)                   | Streaming Serverless Framework for Geo-distributed System                                                                                                         | ![GitHub Repo stars](https://img.shields.io/github/stars/yomorun/yomo?style=flat-square)            |
+
+If you'd like to see your project added to this list, please send us a PR.
+
+## Release Policy
+
+quic-go always aims to support the latest two Go releases.
+
+## Contributing
+
+We are always happy to welcome new contributors! We have a number of self-contained issues that are suitable for first-time contributors, they are tagged with [help wanted](https://github.com/quic-go/quic-go/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22). If you have any questions, please feel free to reach out by opening an issue or leaving a comment.
+
+## License
+
+The code is licensed under the MIT license. The logo and brand assets are excluded from the MIT license. See [assets/LICENSE.md](https://github.com/quic-go/quic-go/tree/master/assets/LICENSE.md) for the full usage policy and details.
diff --git a/electron/native/private-transport/third_party/quic-go/SECURITY.md b/electron/native/private-transport/third_party/quic-go/SECURITY.md
new file mode 100644
index 000000000..79fe1f568
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/SECURITY.md
@@ -0,0 +1,14 @@
+# Security Policy
+
+quic-go is an implementation of the QUIC protocol and related standards. No software is perfect, and we take reports of potential security issues very seriously.
+
+## Reporting a Vulnerability
+
+If you discover a vulnerability that could affect production deployments (e.g., a remotely exploitable issue), please report it [**privately**](https://github.com/quic-go/quic-go/security/advisories/new).
+Please **DO NOT file a public issue** for exploitable vulnerabilities.
+
+If the issue is theoretical, non-exploitable, or related to an experimental feature, you may discuss it openly by filing a regular issue.
+
+## Reporting a non-security bug
+
+For bugs, feature requests, or other non-security concerns, please open a GitHub [issue](https://github.com/quic-go/quic-go/issues/new).
diff --git a/electron/native/private-transport/third_party/quic-go/assets/LICENSE.md b/electron/native/private-transport/third_party/quic-go/assets/LICENSE.md
new file mode 100644
index 000000000..672a20f5b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/assets/LICENSE.md
@@ -0,0 +1,27 @@
+# quic-go Logo and Trademark Usage Policy
+
+## Exception to Main License
+
+The files in this directory (collectively, "Brand Assets") are **excluded** from the quic-go project's main MIT License. These assets are protected by copyright and trademark laws.
+
+## Permitted Use
+
+You are granted a limited, non-exclusive license to use these Brand Assets solely for the following purposes:
+
+- **Editorial and Press:** You may use the Brand Assets in blog posts, news articles, video reviews, and public presentations that discuss, review, or reference the quic-go project.
+
+- **Reference:** You may use the Brand Assets to indicate your project's compatibility with or dependence on quic-go (e.g., "Powered by quic-go").
+
+## Restricted Use
+
+You may NOT:
+
+- **Modification:** Modify the Brand Assets in any way (including changing colors, aspect ratio, or obscuring the image). Resizing the image while maintaining the original aspect ratio is permitted.
+
+- **No Branding:** Use the Brand Assets as the logo, icon, or mascot for your own project, product, or service.
+
+- **No Endorsement:** Use the Brand Assets in a way that suggests your project is officially sponsored by, endorsed by, or affiliated with the quic-go maintainers.
+
+## Termination
+
+The quic-go project reserves the right to revoke this authorization at any time if usage is found to be confusing, misleading, or detrimental to the project's reputation.
diff --git a/electron/native/private-transport/third_party/quic-go/assets/logo.svg b/electron/native/private-transport/third_party/quic-go/assets/logo.svg
new file mode 100644
index 000000000..ecf2bc06b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/assets/logo.svg
@@ -0,0 +1,330 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   version="1.1"
+   id="svg1"
+   width="1055.6"
+   height="245.85333"
+   viewBox="0 0 1055.6 245.85333"
+   sodipodi:docname="logo.svg"
+   inkscape:version="1.4.2 (ebf0e940, 2025-05-08)"
+   inkscape:export-filename="logo.png"
+   inkscape:export-xdpi="181.88708"
+   inkscape:export-ydpi="181.88708"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <defs
+     id="defs1" />
+  <sodipodi:namedview
+     id="namedview1"
+     pagecolor="#ffffff"
+     bordercolor="#000000"
+     borderopacity="0.25"
+     inkscape:showpageshadow="2"
+     inkscape:pageopacity="0.0"
+     inkscape:pagecheckerboard="0"
+     inkscape:deskcolor="#d1d1d1"
+     showgrid="false"
+     inkscape:zoom="0.86294901"
+     inkscape:cx="489.02078"
+     inkscape:cy="166.29024"
+     inkscape:window-width="1728"
+     inkscape:window-height="1004"
+     inkscape:window-x="0"
+     inkscape:window-y="38"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="group-R5">
+    <inkscape:page
+       x="0"
+       y="0"
+       inkscape:label="1"
+       id="page1"
+       width="1055.6"
+       height="245.85333"
+       margin="0"
+       bleed="0" />
+  </sodipodi:namedview>
+  <g
+     id="g1"
+     inkscape:groupmode="layer"
+     inkscape:label="1">
+    <g
+       id="group-R5"
+       transform="translate(-0.66617046,-0.15373164)">
+      <path
+         id="path2"
+         d="m 1625.98,893.551 c 0.21,0.586 0.27,1.195 0.6,1.75 2.78,4.781 8.9,6.398 13.66,3.629 l 9.57,-5.555 c 4.44,21.66 0.74,46.387 -10.99,69.895 -14.24,28.574 -38.06,52.1 -57.23,69.41 -53.1,47.93 -115.13,82.42 -162.13,104.46 0.08,-2.4 0.18,-4.79 0.14,-7.24 -0.32,-21.94 -5.22,-43.24 -10.2,-63.17 -23.39,-93.578 -56.29,-185.273 -97.77,-272.55 -8.73,-18.348 -18.13,-36.629 -27.29,-54.399 53.09,-15.351 107.96,-22.722 163.27,-21.84 34.14,0.571 61.23,4.289 85.26,11.688 26.74,8.23 49.61,21.461 66.68,38.351 -9.45,6.551 -18.33,13.668 -25.94,22.301 -15.78,17.91 -23.26,39.539 -20.51,59.344 2.39,17.195 13.09,31.953 27.07,39.438 -2.28,3.847 -1.77,8.898 1.55,12.195 3.91,3.902 10.25,3.887 14.14,-0.039 1.52,-1.524 3.2,-2.895 4.87,-4.281 2.17,-1.797 4.32,-3.602 6.29,-5.575 0.07,-0.074 0.11,-0.172 0.18,-0.25 5.34,1.684 10.9,2.641 16.44,2.657 0.8,0 1.56,-0.161 2.34,-0.219"
+         style="fill:#71c2e2;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path3"
+         d="m 1767.21,734.289 c 13.24,3.582 29.34,12.859 31.17,27.27 0.99,7.781 -2.67,16.961 -9.77,24.543 -7.26,7.769 -17.24,13.558 -26.88,19.168 l -131.52,76.367 c -4.22,2.449 -5.79,7.476 -4.23,11.914 -0.78,0.058 -1.54,0.219 -2.34,0.219 -5.54,-0.016 -11.1,-0.973 -16.44,-2.657 2.65,-2.836 3.46,-6.937 1.99,-10.558 -1.5,-3.711 -5.07,-6.164 -9.08,-6.242 -14.03,-0.266 -25.39,-14.403 -27.2,-27.438 -1.95,-14.023 3.77,-29.836 15.7,-43.375 11.18,-12.68 25.75,-21.918 42.24,-31.828 20.72,-12.481 42.92,-25.313 66.58,-33.141 25.13,-8.312 49.27,-9.793 69.78,-4.242"
+         style="fill:#dbb28f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path4"
+         d="m 2553.1,1409.43 c -29.69,-0.45 -53.64,23.5 -51.46,52.8 2.27,30.7 20.69,47.74 51.17,49.01 28.23,1.17 52.88,-25.43 51.78,-55.99 -4.17,-27.35 -20.02,-45.35 -51.49,-45.82 z m -82.31,212.05 c -2.92,-1.73 -5.98,-3.25 -9.15,-4.55 -7.78,-3.18 -15.73,-4.89 -23.41,-6.54 -4.57,-0.98 -9.13,-1.96 -13.6,-3.27 -6.33,-1.86 -12.45,-4.68 -18.37,-8.03 -7.87,-5.73 -16.05,-11.13 -23.02,-17.93 -3.2,-3.13 -6.18,-6.45 -8.95,-9.91 -2.76,-3.51 -5.4,-7.16 -7.81,-11.03 -0.57,-0.92 -1.05,-1.92 -1.6,-2.85 -1.7,-2.89 -3.38,-5.78 -4.85,-8.8 -1.91,-3.92 -3.66,-7.95 -5.18,-12.11 -10.76,-29.38 -12.77,-64.99 -5.99,-105.83 7.58,-45.7 23.36,-82.16 46.9,-108.36 27.53,-30.66 67.93,-46.37 102.76,-39.98 18.65,3.4 37.24,12.77 55.27,27.85 51.75,43.34 75.23,119.01 57.13,184.03 -17.77,63.74 -75.04,115.56 -140.13,127.31"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path5"
+         d="m 1435.36,1151.73 c 1.9,-0.91 3.92,-1.96 5.86,-2.9 -1.17,1.23 -2.41,2.38 -3.56,3.64 -0.74,-0.3 -1.51,-0.53 -2.3,-0.74"
+         style="fill:#71c2e2;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path6"
+         d="m 1416.49,1160.92 c 0.03,-0.15 0.07,-0.29 0.1,-0.44 0.59,-0.26 1.26,-0.59 1.85,-0.85 -0.12,0.21 -0.3,0.38 -0.41,0.6 -0.54,0.17 -1.03,0.45 -1.54,0.69"
+         style="fill:#71c2e2;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path7"
+         d="m 1358.31,636.379 c 20.38,-3.129 41.06,-5.109 61.61,-5.82 4.47,-0.149 8.84,-0.161 13.23,-0.2 -24.21,2.731 -48.37,6.129 -72.67,7.629 -0.49,-0.738 -1.25,-1.269 -2.17,-1.609"
+         style="fill:#71c2e2;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path8"
+         d="m 2026.1,1292.35 c -114.54,0.7 -197.24,86.26 -196.66,203.43 0.61,119.08 87.54,205.24 206.88,205.24 h 1.03 c 57.7,-0.24 109.81,-21.02 146.74,-58.5 37.37,-37.93 57.6,-91.25 56.97,-150.14 -1.18,-110.58 -96.84,-200.04 -213.55,-200.03 z m -396.73,422.22 c -5.52,0.16 -9.87,4.75 -9.72,10.28 0.14,4.78 -1.71,9.76 -4.92,13.3 -3.22,3.55 -7.99,5.87 -12.76,6.21 -4.76,0.3 -9.4,-1.62 -11.04,-4.66 -1.81,-3.34 -0.98,-8.99 -0.21,-12.95 0.78,-4 1.88,-8.57 4.07,-12.24 1.7,-2.87 4.1,-4.96 6.4,-5.58 5.33,-1.43 8.49,-6.92 7.06,-12.25 -1.2,-4.46 -5.24,-7.41 -9.66,-7.41 -0.86,0 -1.73,0.11 -2.6,0.35 -7.41,2 -13.94,7.2 -18.39,14.65 -3.78,6.34 -5.46,13.29 -6.51,18.64 -1.48,7.57 -2.57,17.41 2.25,26.32 5.46,10.07 17.23,15.95 30.05,15.07 9.93,-0.7 19.47,-5.34 26.16,-12.72 6.69,-7.38 10.37,-17.33 10.09,-27.29 -0.15,-5.51 -4.73,-9.96 -10.27,-9.72 z m 852.92,-453.73 c -21.38,0 -43.07,6.15 -62.95,17.31 10.09,-16.29 18.84,-34.79 17.44,-52.72 -1.41,-17.97 -11.2,-35.23 -26.18,-46.18 -11.7,-8.55 -26.29,-13.14 -41.16,-13.14 -2.71,0 -5.44,0.25 -8.17,0.57 1.58,-11.39 2.87,-23.09 1.36,-35.18 -2.11,-16.78 -9.52,-30.72 -20.88,-39.23 -12.31,-9.23 -27.43,-11.04 -41.87,-12.11 -6.55,-0.49 -13.27,-0.9 -20.06,-0.9 -10.05,0 -20.25,0.91 -30.24,3.85 -20.05,5.91 -35.23,19.54 -40.63,36.45 -2.79,8.71 -2.8,17.57 -2.81,25.38 l -0.04,32.88 c -10.33,0.43 -20.91,2.59 -30.53,8.19 -17.44,10.15 -28.68,29.88 -29.32,51.48 -0.56,18.71 6.92,38.41 20.52,54.04 11.43,13.15 26.97,23.69 46.16,31.35 1.76,6.53 5.66,13.24 11.7,19.76 16.24,17.54 38.12,29.65 61.62,34.08 17.32,3.28 38.87,1.34 57.3,-4.28 -6.25,16.72 -11.12,35 -14.42,54.92 -7.35,44.29 -5.02,83.32 6.93,115.98 15.06,41.1 46.06,72.11 82.92,82.97 1.5,0.44 3.05,0.72 4.57,1.1 l -0.31,-0.03 c -2.01,18.73 -12.79,34.04 -21.47,43.59 -11.84,12.99 -26.96,23.51 -41.53,32.95 -80.07,51.86 -175.64,105.87 -277.31,113.24 -66.02,4.79 -134.3,9.73 -201.08,4.57 -72.46,-5.59 -134.79,-23.01 -185.53,-51.6 5.07,-9.69 9.02,-19.98 11.43,-30.69 1.21,-5.39 -2.16,-10.74 -7.55,-11.96 -5.39,-1.21 -10.75,2.17 -11.96,7.56 -6.01,26.7 -22.56,50.66 -45.4,65.73 -18.43,12.16 -41.73,18.92 -65.58,19.02 -12.94,-0.06 -36.95,-2.2 -51.45,-17.97 -5.22,-5.68 -9.41,-13.29 -12.8,-23.28 -9,-26.47 -7.9,-56.41 3.02,-82.16 10.91,-25.74 31.68,-47.34 56.96,-59.28 5,-2.36 7.14,-8.31 4.78,-13.31 -1.71,-3.62 -5.3,-5.74 -9.05,-5.74 -1.43,0 -2.89,0.31 -4.26,0.96 -11.38,5.38 -21.96,12.45 -31.43,20.79 -20.59,-23 -38.08,-61.4 -47.98,-91.49 -3.87,-11.77 -9.43,-28.33 -14.99,-44.89 -5.54,-16.48 -11.07,-32.95 -14.94,-44.74 2.09,-31.72 -3.9,-63.85 -11.43,-98.21 -7.93,-36.23 -16.83,-72.63 -26.12,-108.85 237.2851,-66.0547 350.3756,-253.39019 336.26,-416.561 l -4.22,0.371 22.16,-12.871 c 10.39,-6.028 22.17,-12.868 31.45,-22.789 11.28,-12.059 16.74,-26.899 15,-40.719 -3.06,-24.199 -25.66,-38.629 -45.8,-44.071 -9.84,-2.66 -20.3,-3.98 -31.18,-3.98 -13.76,0 -28.2,2.238 -42.88,6.449 -30.26,-38.949 -73.93,-69.019 -126.46,-86.988 -39.27,-13.422 -84.16,-20.211 -133.65,-20.211 -6.26,0 -12.6,0.109 -19.01,0.332 -57.49,1.957 -116.03,13.449 -166.93,32.418 -35.8,-73.289 -45.83,-160.219 -27.31,-239.609 18.41,-78.961 65.44,-152.09 129.43,-201.969 3.3,1.859 6.73,3.508 10.12,5.219 0.4,0.238 0.78,0.5 1.18,0.738 0.02,-0.027 0.05,-0.059 0.07,-0.09 1.92,0.949 3.75,2.031 5.69,2.93 5.03,2.32 10.95,0.133 13.27,-4.887 1.03,-2.242 1.05,-4.633 0.44,-6.832 2.68,-0.711 5.35,-1.5 7.97,-2.32 30.89,-9.641 63.52,-21.231 83.15,-48.508 l 8.89,11.098 c -0.17,-7.27 -1.35,-14.54 -3.26,-21.731 118.61,-59.7773 263.4,-78.0781 408.16,-51.4609 130.44,24.0239 255.9,106.4809 344.2,226.2499 44.19,59.942 72.07,130.961 99.03,199.641 3.49,8.902 6.98,17.793 10.51,26.679 92.95,233.961 152.76,479.522 177.9,729.952 -6.5,-2.41 -13.05,-4.29 -19.64,-5.49 -6.52,-1.18 -13.15,-1.77 -19.82,-1.77"
+         style="fill:#71c2e2;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)"
+         sodipodi:nodetypes="ccscccsccccccccccscccccsccccccsccccsccccccccccccccccccccccccsccccccsccccccccccsccsccsccccccccccccccccccccc" />
+      <path
+         id="path9"
+         d="m 1273.46,710.031 c 1.01,2.367 1.61,4.821 1.79,7.328 -0.63,-2.429 -1.23,-4.859 -1.79,-7.328"
+         style="fill:#71c2e2;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path10"
+         d="m 1293.02,653.379 c -0.16,0.043 -0.33,0.07 -0.49,0.101 -6.91,1.372 -14.16,2.258 -20.84,4.54 -5.55,1.902 -9.39,5.39 -11.57,9.742 -0.76,-2.172 -1.42,-4.133 -1.88,-5.602 22.34,-8.41 46.3,-15.211 70.98,-20.422 -0.23,0.571 -0.39,1.172 -0.44,1.782 -11.92,3.289 -23.84,6.582 -35.76,9.859"
+         style="fill:#71c2e2;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path11"
+         d="m 2406.26,1599.09 c -11.95,-6.75 -22.84,-16.28 -31.97,-27.84 2.77,3.46 5.75,6.78 8.95,9.91 6.97,6.8 15.15,12.2 23.02,17.93"
+         style="fill:#71c2e2;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path12"
+         d="m 2112.02,1435.3 c -35.79,-0.54 -64.65,28.33 -62.03,63.65 2.74,37 24.95,57.55 61.69,59.08 34.02,1.41 63.74,-30.65 62.41,-67.5 -5.02,-32.96 -24.13,-54.66 -62.07,-55.23 z m 56.1,192.46 c -34.19,34.63 -79.9,53.82 -128.72,54.03 -0.28,0 -0.55,0 -0.85,0 -102.57,0 -187.32,-80.97 -189.07,-180.87 -0.93,-52.69 17.64,-101.08 52.27,-136.29 32.97,-33.5 77.79,-51.95 126.24,-51.95 0.08,0 0.16,0 0.24,0 107.5,0.14 192.41,80.06 193.3,181.95 0.44,50.51 -18.53,97.79 -53.41,133.13"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path13"
+         d="m 2423.19,699.898 c 18.69,-4.097 37.82,-7.878 56.58,-6.839 21.79,1.16 40.62,9.339 51.68,22.41 4.41,5.23 7.79,11.461 9.78,18 4.42,14.543 0.78,30.16 -8.85,37.992 -7.35,5.98 -18.4,8.121 -28.14,10.008 l -53.16,10.312 c -8.75,-30.781 -18.05,-61.41 -27.89,-91.883"
+         style="fill:#dcb390;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path14"
+         d="m 1158.62,1367.05 c -9.26,6.84 -6.03,21.44 -1,31.87 20.84,43.21 56.36,78.97 98.93,100.94 8.09,4.17 57.94,27.2 57.68,10.37 10.85,6.02 20.8,13.11 27.41,23.45 6.25,9.76 9.35,22.01 17.87,29.62 -5.53,1.39 -11.15,2.21 -16.79,2.25 h -0.51 c -23.42,0 -46.35,-11.57 -63.73,-21.68 -52.41,-30.48 -98.81,-73.07 -134.19,-123.17 -11.39,-16.12 -21.51,-33.02 -30.72,-50.44 10.49,-7.37 21.19,-14.41 32.08,-21.13 3.1,6.17 8.48,12.05 12.97,17.92"
+         style="fill:#6cbcde;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path15"
+         d="m 1314.23,1510.23 c -0.01,-1.01 -0.15,-2.12 -0.54,-3.43 -2.78,-9.17 -23.9,-18.75 -31.26,-24.4 -10.51,-8.06 -20.59,-16.67 -30.19,-25.77 -22.31,-21.16 -42.07,-45.02 -58.62,-70.93 -4.01,-6.28 -7.99,-12.84 -14.02,-17.21 -6.04,-4.35 -14.81,-5.92 -20.85,-1.57 -0.05,0.04 -0.08,0.09 -0.13,0.13 -4.49,-5.87 -9.87,-11.75 -12.97,-17.92 12.45,-7.69 25.16,-14.91 38.08,-21.74 17.48,-8.27 34.96,-16.54 52.44,-24.82 38.2,-16.06 77.91,-28.51 118.52,-37.11 8.32,1.9 16.67,1.59 24.6,-2.33 1.81,-0.89 3.34,-2.06 4.89,-3.2 4.76,-0.78 9.52,-1.56 14.3,-2.24 9.13,35.63 17.87,71.43 25.68,107.06 10.57,48.23 18.04,91.6 2.38,133.98 -12.1,32.78 -38.31,57.32 -67.03,64.57 -8.52,-7.61 -11.62,-19.86 -17.87,-29.62 -6.61,-10.34 -16.56,-17.43 -27.41,-23.45"
+         style="fill:#4ca7d5;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path16"
+         d="m 942.551,838.941 c -1.422,2.188 -1.93,4.797 -1.348,7.461 l -2.73,-9.031 c -0.02,-0.062 -0.035,-0.109 -0.051,-0.172 0.867,0.41 1.586,1 2.519,1.332 0.532,0.188 1.075,0.258 1.61,0.41"
+         style="fill:#6cbedf;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path17"
+         d="m 954.379,853.625 35.184,-13.555 c 11.567,3.262 21.587,11.508 28.847,21.258 8.52,11.438 13.87,24.863 19.48,37.973 22.06,51.48 50.26,102.539 83.04,149.989 8.44,18.89 18.19,37.42 25.62,56.6 2.62,6.74 18.42,48.36 30.77,23.76 1.06,-2.1 1.28,-4.4 1.1,-6.75 5.03,5.69 10.01,11.46 15.18,16.95 21.64,22.99 45.81,43.03 70.4,62.74 16.76,13.43 33.51,26.86 50.26,40.29 3.69,2.96 7.61,5.94 11.68,8.75 -79.02,19.84 -154.29,53.88 -221.29,100.45 -10.32,-22.12 -19.75,-44.61 -28.52,-67.38 -13.32,-36.25 -24.59,-73.4 -35.67,-110.03 L 941.828,848.469 c 2.207,4.719 7.633,7.043 12.551,5.156"
+         style="fill:#6cbedf;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path18"
+         d="m 1236.17,1302.57 c -17.48,8.28 -34.96,16.55 -52.44,24.82 17.11,-9.04 34.61,-17.32 52.44,-24.82"
+         style="fill:#6cbedf;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path19"
+         d="m 1354.69,1265.46 c 9.78,-2.07 19.61,-3.91 29.49,-5.53 -1.55,1.14 -3.08,2.31 -4.89,3.2 -7.93,3.92 -16.28,4.23 -24.6,2.33"
+         style="fill:#4ca3d4;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path20"
+         d="m 1237.47,668 1.75,0.359 c 1.61,5.102 4.44,13.2 9.18,24.621 1.68,4.051 3.14,10.661 4.69,17.649 2.3,10.449 4.68,21.242 8.91,29.453 l 3.04,5.898 c 9.56,18.551 19.45,37.719 28.52,56.801 40.92,86.067 73.36,176.504 96.44,268.799 4.7,18.8 9.31,38.81 9.6,58.61 0.18,11.57 -1.19,22.37 -4.05,32.09 -0.84,2.85 -2.22,5.83 -3.67,8.99 -2.77,6.02 -5.91,12.84 -6.21,20.84 0,8.76 0.19,17.01 2.51,25.57 1.84,6.8 3.49,13.71 5.29,20.55 -22.75,3.28 -45.28,7.81 -67.53,13.4 -4.07,-2.81 -7.99,-5.79 -11.68,-8.75 -16.75,-13.43 -33.5,-26.86 -50.26,-40.29 -24.59,-19.71 -48.76,-39.75 -70.4,-62.74 -5.17,-5.49 -10.15,-11.26 -15.18,-16.95 -0.18,-2.58 -0.85,-5.21 -1.56,-7.69 -22.61,-78.85 -45.21,-157.687 -67.81,-236.53 -2.86,-9.973 -5.92,-20.321 -12.86,-28.035 -6.94,-7.715 -18.97,-11.907 -27.97,-6.735 -13.11,7.543 -10.79,26.871 -6.5,41.371 15.69,53.012 34.3,105.16 55.7,156.129 1.11,2.64 2.34,5.25 3.51,7.88 -32.78,-47.45 -60.98,-98.509 -83.04,-149.989 -5.61,-13.11 -10.96,-26.535 -19.48,-37.973 -7.26,-9.75 -17.28,-17.996 -28.847,-21.258 l 84.187,-32.441 c 5.16,-1.988 7.72,-7.77 5.74,-12.93 -1.53,-3.969 -5.32,-6.398 -9.33,-6.398 -1.2,0 -2.42,0.211 -3.6,0.66 l -119.369,46 c -2.046,0.789 -3.535,2.269 -4.64,3.98 -0.535,-0.152 -1.078,-0.222 -1.61,-0.41 -0.933,-0.332 -1.652,-0.922 -2.519,-1.332 -7.156,-23.699 -13.211,-48.347 -2.488,-66.769 6.711,-11.532 19.371,-19.2 31.757,-26.078 41.539,-23.071 85.979,-41.442 132.099,-54.633 23.96,-6.848 48.59,-12.328 73.2,-16.289 4.09,-0.649 8.5,-1.489 13.11,-2.36 17.57,-3.32 37.47,-7.07 51.37,-3.07"
+         style="fill:#4ca3d4;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path21"
+         d="m 942.551,838.941 c 1.105,-1.711 2.594,-3.191 4.64,-3.98 l 119.369,-46 c 1.18,-0.449 2.4,-0.66 3.6,-0.66 4.01,0 7.8,2.429 9.33,6.398 1.98,5.16 -0.58,10.942 -5.74,12.93 l -84.187,32.441 -35.184,13.555 c -4.918,1.887 -10.344,-0.437 -12.551,-5.156 l -0.625,-2.067 c -0.582,-2.664 -0.074,-5.273 1.348,-7.461"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path22"
+         d="m 1179.6,1368.49 c 6.03,4.37 10.01,10.93 14.02,17.21 16.55,25.91 36.31,49.77 58.62,70.93 9.6,9.1 19.68,17.71 30.19,25.77 7.36,5.65 28.48,15.23 31.26,24.4 0.39,1.31 0.53,2.42 0.54,3.43 0.26,16.83 -49.59,-6.2 -57.68,-10.37 -42.57,-21.97 -78.09,-57.73 -98.93,-100.94 -5.03,-10.43 -8.26,-25.03 1,-31.87 0.05,-0.04 0.08,-0.09 0.13,-0.13 6.04,-4.35 14.81,-2.78 20.85,1.57"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path23"
+         d="m 1616.7,756.891 c -19.68,-20.672 -46.52,-36.711 -77.95,-46.379 -25.87,-7.973 -54.73,-11.961 -90.81,-12.571 -3.18,-0.043 -6.37,-0.07 -9.56,-0.07 -54.94,0 -109.38,7.91 -162.11,23.41 -0.36,-1.261 -0.68,-2.609 -1.02,-3.922 -0.18,-2.507 -0.78,-4.961 -1.79,-7.328 -0.28,-1.242 -0.58,-2.492 -0.85,-3.711 -1.74,-7.89 -3.38,-15.332 -5.74,-21.011 -3.1,-7.457 -10.7594,-28.67844 -12.2894,-33.05744 2.18,-4.352 11.5594,7.67044 17.1094,5.76844 24.3717,-12.9812 54.7149,-25.3127 54.9449,-25.8837 9.61,-2.019 53.2971,-24.43 41.231,-4.1193 24.3,-1.5 31.4724,-2.68222 55.6824,-5.41322 49.29,-0.449 103.3717,13.62622 141.8717,26.78722 46.42,15.871 85.15,41.808 112.8,75.109 -20.57,8.309 -39.73,19.219 -57.68,30.031 -1.3,0.778 -2.55,1.578 -3.84,2.36"
+         style="fill:#5490bd;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)"
+         sodipodi:nodetypes="cccscccccccccccccc" />
+      <path
+         id="path24"
+         d="m 2416.55,1684.43 c 1.6,-1.76 3.26,-3.73 4.93,-5.81 0.53,0.62 0.98,1.3 1.67,1.79 4.51,3.23 10.75,2.19 13.96,-2.3 7.61,-10.61 9.04,-25.02 3.78,-36.96 0.78,-2.98 1.4,-6.05 1.84,-9.22 3.94,0.97 7.76,2.05 11.34,3.52 21.32,8.7 35.63,32.54 33.29,55.45 -2.32,22.91 -21.15,43.38 -43.78,47.61 -22.4,4.19 -46.97,-7.78 -57.63,-27.87 10.81,-7.66 21.43,-16.13 30.6,-26.21"
+         style="fill:#71c2e2;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path25"
+         d="m 1146.55,1105.89 c -7.43,-19.18 -17.18,-37.71 -25.62,-56.6 -1.17,-2.63 -2.4,-5.24 -3.51,-7.88 -21.4,-50.969 -40.01,-103.117 -55.7,-156.129 -4.29,-14.5 -6.61,-33.828 6.5,-41.371 9,-5.172 21.03,-0.98 27.97,6.735 6.94,7.714 10,18.062 12.86,28.035 22.6,78.843 45.2,157.68 67.81,236.53 0.71,2.48 1.38,5.11 1.56,7.69 0.18,2.35 -0.04,4.65 -1.1,6.75 -12.35,24.6 -28.15,-17.02 -30.77,-23.76"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path26"
+         d="m 2304.85,1186 1.13,-85.2 c 9.09,0.98 17.49,2.76 23.78,7.47 6.87,5.16 11.62,14.53 13.02,25.73 1.36,10.77 -1.37,26.66 -3.07,38.21 -5.4,1.95 -10.69,4.08 -15.82,6.31 -6.5,2.83 -12.77,5.48 -19.04,7.48"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path27"
+         d="m 2239.62,1181.35 c -4.1,-0.9 -8.68,-1.78 -13.52,-2.47 l 0.04,-33.91 c 0.01,-6.67 0.02,-13.58 1.86,-19.33 3.97,-12.46 16.68,-20.23 27.23,-23.34 9.66,-2.84 20.23,-3.25 30.76,-2.88 l -1.19,89.79 c -11.34,-0.01 -23.03,-2.65 -35.25,-5.56 -3.32,-0.78 -6.63,-1.56 -9.93,-2.3"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path29"
+         d="m 1412.56,1232.15 c -1.73,-6.55 -3.31,-13.18 -5.07,-19.7 -1.68,-6.2 -1.82,-12.72 -1.82,-19.99 0.14,-3.63 2.1,-7.89 4.37,-12.82 1.7,-3.67 3.45,-7.47 4.7,-11.71 0.67,-2.29 0.6463,-6.8631 1.1763,-9.2331 0.9013,-0.092 3.4905,-0.9577 4.1014,-1.3618 54.491,-24.7868 121.397,-61.4452 174.9723,-109.8151 20.48,-18.49 46,-43.75 61.73,-75.325 14.87,-29.812 18.73,-61.757 11.2,-89.336 l 66.42,-38.566 c 5.28,86.789 -27.17,176.817 -89.9,248.167 -57.34,65.22 -137.48,113.34 -231.88,139.69"
+         style="fill:#5490bd;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)"
+         sodipodi:nodetypes="cccccccsccccc" />
+      <path
+         id="path30"
+         d="m 2398.8,1195.4 c 10.33,7.55 17.08,19.36 18.04,31.6 1.4,17.9 -13.78,40.41 -25.69,57.48 -24.48,-6.3 -50.62,-9.63 -76.14,-9.63 -26.75,0 -52.7,3.49 -75,10.55 -8.78,2.78 -19.16,7.2 -24.63,16.65 -13.83,-6.2 -25.19,-14.07 -33.51,-23.65 -10.35,-11.88 -16.04,-26.58 -15.62,-40.32 0.42,-14.53 8.03,-28.18 19.38,-34.78 14.93,-8.7 35.5,-5.55 49.67,-2.42 3.21,0.71 6.42,1.47 9.63,2.23 16.53,3.92 33.61,7.96 51.45,5.45 12.83,-1.82 24.35,-6.85 35.5,-11.71 10.41,-4.54 20.26,-8.83 30.44,-10.25 13.06,-1.8 26.34,1.4 36.48,8.8"
+         style="fill:#dcb390;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path31"
+         d="m 2355.41,1345.72 c -16.02,10.05 -45.36,15.11 -65.45,11.35 -19.32,-3.65 -37.3,-13.59 -50.65,-28.01 -4.54,-4.92 -8.79,-11.74 -7.08,-16.14 1.62,-4.16 8.66,-6.82 13.81,-8.45 40.21,-12.73 93.39,-12.75 139.97,-0.75 -1.71,1.73 -3.49,3.35 -5.13,5.17 -9.7,10.81 -18.19,23.11 -25.47,36.83"
+         style="fill:#1e3058;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path32"
+         d="m 1393.17,196.18 c -2.62,0.82 -5.29,1.609 -7.97,2.32 -0.76,-2.738 -2.55,-5.16 -5.33,-6.441 -1.93,-0.887 -3.76,-1.95 -5.65,-2.918 -14.92,-9.332 -28.85,-20.141 -41.38,-32.672 -17.24,-17.25 -27.32,-33.481 -30.82,-49.617 -4.11,-18.9731 2.26,-38.5434 15.49,-47.5825 8.05,-5.5 19.09,-7.8086 31.13,-6.4101 12.46,1.3906 24.47,6.3125 34.56,10.9219 24.34,11.1289 42.7,23.4804 56.14,37.7777 l 36.98,46.113 c -19.63,27.277 -52.26,38.867 -83.15,48.508"
+         style="fill:#dbb28f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path33"
+         d="m 2030.81,112.672 c 8.22,-26.3712 22.24,-50.8907 40.96,-71.2111 11.68,-12.6914 21.91,-19.3711 32.19,-21.0703 16.7,-2.6601 35.8,9.8594 42.69,28.0782 6.37,16.8398 4.15,38.2695 -6.08,58.8012 -9.02,18.101 -22.86,33.91 -36.64,49.152 -23.55,-16.531 -48,-31.141 -73.12,-43.75"
+         style="fill:#dcb390;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path34"
+         d="M 843.043,1147.21 0,1110.42 832.531,1073.63 Z"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path35"
+         d="m 952.363,1346.94 -639.113,-36.8 631.145,-36.78 z"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path36"
+         d="m 342.684,910.699 479.586,-36.793 6.054,73.582 z"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path37"
+         d="m 1603.39,1764.3 c -12.82,0.88 -24.59,-5 -30.05,-15.07 -4.82,-8.91 -3.73,-18.75 -2.25,-26.32 1.05,-5.35 2.73,-12.3 6.51,-18.64 4.45,-7.45 10.98,-12.65 18.39,-14.65 0.87,-0.24 1.74,-0.35 2.6,-0.35 4.42,0 8.46,2.95 9.66,7.41 1.43,5.33 -1.73,10.82 -7.06,12.25 -2.3,0.62 -4.7,2.71 -6.4,5.58 -2.19,3.67 -3.29,8.24 -4.07,12.24 -0.77,3.96 -1.6,9.61 0.21,12.95 1.64,3.04 6.28,4.96 11.04,4.66 4.77,-0.34 9.54,-2.66 12.76,-6.21 3.21,-3.54 5.06,-8.52 4.92,-13.3 -0.15,-5.53 4.2,-10.12 9.72,-10.28 5.54,-0.24 10.12,4.21 10.27,9.72 0.28,9.96 -3.4,19.91 -10.09,27.29 -6.69,7.38 -16.23,12.02 -26.16,12.72"
+         style="fill:#100f0d;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path38"
+         d="m 2553.79,1310.14 c -18.03,-15.08 -36.62,-24.45 -55.27,-27.85 -34.83,-6.39 -75.23,9.32 -102.76,39.98 -23.54,26.2 -39.32,62.66 -46.9,108.36 -6.78,40.84 -4.77,76.45 5.99,105.83 1.52,4.16 3.27,8.19 5.18,12.11 1.47,3.02 3.15,5.91 4.85,8.8 0.55,0.93 1.03,1.93 1.6,2.85 2.41,3.87 5.05,7.52 7.81,11.03 9.13,11.56 20.02,21.09 31.97,27.84 5.92,3.35 12.04,6.17 18.37,8.03 4.47,1.31 9.03,2.29 13.6,3.27 7.68,1.65 15.63,3.36 23.41,6.54 3.17,1.3 6.23,2.82 9.15,4.55 65.09,-11.75 122.36,-63.57 140.13,-127.31 18.1,-65.02 -5.38,-140.69 -57.13,-184.03 z m -307.75,-5.67 c -5.15,1.63 -12.19,4.29 -13.81,8.45 -1.71,4.4 2.54,11.22 7.08,16.14 13.35,14.42 31.33,24.36 50.65,28.01 20.09,3.76 49.43,-1.3 65.45,-11.35 7.28,-13.72 15.77,-26.02 25.47,-36.83 1.64,-1.82 3.42,-3.44 5.13,-5.17 -46.58,-12 -99.76,-11.98 -139.97,0.75 z m 39.95,-205.05 c -10.53,-0.37 -21.1,0.04 -30.76,2.88 -10.55,3.11 -23.26,10.88 -27.23,23.34 -1.84,5.75 -1.85,12.66 -1.86,19.33 l -0.04,33.91 c 4.84,0.69 9.42,1.57 13.52,2.47 3.3,0.74 6.61,1.52 9.93,2.3 12.22,2.91 23.91,5.55 35.25,5.56 z m 56.79,34.58 c -1.4,-11.2 -6.15,-20.57 -13.02,-25.73 -6.29,-4.71 -14.69,-6.49 -23.78,-7.47 l -1.13,85.2 c 6.27,-2 12.54,-4.65 19.04,-7.48 5.13,-2.23 10.42,-4.36 15.82,-6.31 1.7,-11.55 4.43,-27.44 3.07,-38.21 z m -10.9,62.85 c -11.15,4.86 -22.67,9.89 -35.5,11.71 -17.84,2.51 -34.92,-1.53 -51.45,-5.45 -3.21,-0.76 -6.42,-1.52 -9.63,-2.23 -14.17,-3.13 -34.74,-6.28 -49.67,2.42 -11.35,6.6 -18.96,20.25 -19.38,34.78 -0.42,13.74 5.27,28.44 15.62,40.32 8.32,9.58 19.68,17.45 33.51,23.65 5.47,-9.45 15.85,-13.87 24.63,-16.65 22.3,-7.06 48.25,-10.55 75,-10.55 25.52,0 51.66,3.33 76.14,9.63 11.91,-17.07 27.09,-39.58 25.69,-57.48 -0.96,-12.24 -7.71,-24.05 -18.04,-31.6 -10.14,-7.4 -23.42,-10.6 -36.48,-8.8 -10.18,1.42 -20.03,5.71 -30.44,10.25 z m 11.97,-658.702 c -3.53,-8.886 -7.02,-17.777 -10.51,-26.679 -26.96,-68.68 -54.84,-139.699 -99.03,-199.641 -88.3,-119.769 -213.76,-202.226 -344.2,-226.2499 -144.76,-26.6172 -289.55,-8.3164 -408.16,51.4609 1.91,7.191 3.09,14.461 3.26,21.731 l -8.89,-11.098 -36.98,-46.113 c -13.44,-14.2973 -31.8,-26.6488 -56.14,-37.7777 -10.09,-4.6094 -22.1,-9.5313 -34.56,-10.9219 -12.04,-1.3985 -23.08,0.9101 -31.13,6.4101 -13.23,9.0391 -19.6,28.6094 -15.49,47.5825 3.5,16.136 13.58,32.367 30.82,49.617 12.53,12.531 26.46,23.34 41.38,32.672 1.89,0.968 3.72,2.031 5.65,2.918 2.78,1.281 4.57,3.703 5.33,6.441 0.61,2.199 0.59,4.59 -0.44,6.832 -2.32,5.02 -8.24,7.207 -13.27,4.887 -1.94,-0.899 -3.77,-1.981 -5.69,-2.93 -0.02,0.031 -0.05,0.063 -0.07,0.09 -0.4,-0.238 -0.78,-0.5 -1.18,-0.738 -3.39,-1.711 -6.82,-3.36 -10.12,-5.219 -63.99,49.879 -111.02,123.008 -129.43,201.969 -18.52,79.39 -8.49,166.32 27.31,239.609 50.9,-18.969 109.44,-30.461 166.93,-32.418 6.41,-0.223 12.75,-0.332 19.01,-0.332 49.49,0 94.38,6.789 133.65,20.211 52.53,17.969 96.2,48.039 126.46,86.988 14.68,-4.211 29.12,-6.449 42.88,-6.449 10.88,0 21.34,1.32 31.18,3.98 20.14,5.442 42.74,19.872 45.8,44.071 1.74,13.82 -3.72,28.66 -15,40.719 -9.28,9.921 -21.06,16.761 -31.45,22.789 l -22.16,12.871 3.7558,-2.53741 c 0.52,6.011 1.3142,14.19341 1.4942,20.22041 0.2353,13.74623 -0.12,26.61 -1.36,39.922 -7,75.77 -39.77,150.915 -94.04,212.625 -59.99,68.24 -143.57,118.59 -241.89,145.96 9.29,36.22 18.19,72.62 26.12,108.85 7.53,34.36 13.52,66.49 11.43,98.21 3.87,11.79 9.4,28.26 14.94,44.74 5.56,16.56 11.12,33.12 14.99,44.89 9.9,30.09 27.39,68.49 47.98,91.49 9.47,-8.34 20.05,-15.41 31.43,-20.79 1.37,-0.65 2.83,-0.96 4.26,-0.96 3.75,0 7.34,2.12 9.05,5.74 2.36,5 0.22,10.95 -4.78,13.31 -25.28,11.94 -46.05,33.54 -56.96,59.28 -10.92,25.75 -12.02,55.69 -3.02,82.16 3.39,9.99 7.58,17.6 12.8,23.28 14.5,15.77 38.51,17.91 51.45,17.97 23.85,-0.1 47.15,-6.86 65.58,-19.02 22.84,-15.07 39.39,-39.03 45.4,-65.73 1.21,-5.39 6.57,-8.77 11.96,-7.56 5.39,1.22 8.76,6.57 7.55,11.96 -2.41,10.71 -6.36,21 -11.43,30.69 50.74,28.59 113.07,46.01 185.53,51.6 66.78,5.16 135.06,0.22 201.08,-4.57 101.67,-7.37 197.24,-61.38 277.31,-113.24 14.57,-9.44 29.69,-19.96 41.53,-32.95 8.68,-9.55 19.46,-24.86 21.47,-43.59 l 0.31,0.03 c -1.52,-0.38 -3.07,-0.66 -4.57,-1.1 -36.86,-10.86 -67.86,-41.87 -82.92,-82.97 -11.95,-32.66 -14.28,-71.69 -6.93,-115.98 3.3,-19.92 8.17,-38.2 14.42,-54.92 -18.43,5.62 -39.98,7.56 -57.3,4.28 -23.5,-4.43 -45.38,-16.54 -61.62,-34.08 -6.04,-6.52 -9.94,-13.23 -11.7,-19.76 -19.19,-7.66 -34.73,-18.2 -46.16,-31.35 -13.6,-15.63 -21.08,-35.33 -20.52,-54.04 0.64,-21.6 11.88,-41.33 29.32,-51.48 9.62,-5.6 20.2,-7.76 30.53,-8.19 l 0.04,-32.88 c 0.01,-7.81 0.02,-16.67 2.81,-25.38 5.4,-16.91 20.58,-30.54 40.63,-36.45 9.99,-2.94 20.19,-3.85 30.24,-3.85 6.79,0 13.51,0.41 20.06,0.9 14.44,1.07 29.56,2.88 41.87,12.11 11.36,8.51 18.77,22.45 20.88,39.23 1.51,12.09 0.22,23.79 -1.36,35.18 2.73,-0.32 5.46,-0.57 8.17,-0.57 14.87,0 29.46,4.59 41.16,13.14 14.98,10.95 24.77,28.21 26.18,46.18 1.4,17.93 -7.35,36.43 -17.44,52.72 19.88,-11.16 41.57,-17.31 62.95,-17.31 6.67,0 13.3,0.59 19.82,1.77 6.59,1.2 13.14,3.08 19.64,5.49 -25.14,-250.43 -84.95,-495.991 -177.9,-729.952 z m 160.39,243.321 c 9.74,-1.887 20.79,-4.028 28.14,-10.008 9.63,-7.832 13.27,-23.449 8.85,-37.992 -1.99,-6.539 -5.37,-12.77 -9.78,-18 -11.06,-13.071 -29.89,-21.25 -51.68,-22.41 -18.76,-1.039 -37.89,2.742 -56.58,6.839 9.84,30.473 19.14,61.102 27.89,91.883 z M 2140.57,107.27 c 10.23,-20.5317 12.45,-41.9614 6.08,-58.8012 -6.89,-18.2188 -25.99,-30.7383 -42.69,-28.0782 -10.28,1.6992 -20.51,8.3789 -32.19,21.0703 -18.72,20.3204 -32.74,44.8399 -40.96,71.2111 25.12,12.609 49.57,27.219 73.12,43.75 13.78,-15.242 27.62,-31.051 36.64,-49.152 z m -954.47,563.8 c -4.61,0.871 -9.02,1.711 -13.11,2.36 -24.61,3.961 -49.24,9.441 -73.2,16.289 -46.12,13.191 -90.56,31.562 -132.099,54.633 -12.386,6.878 -25.046,14.546 -31.757,26.078 -10.723,18.422 -4.668,43.07 2.488,66.769 0.016,0.063 0.031,0.11 0.051,0.172 l 2.73,9.031 0.625,2.067 98.632,326.201 c 11.08,36.63 22.35,73.78 35.67,110.03 8.45,22.99 17.7,45.63 28.29,67.53 0.08,-0.05 0.15,-0.1 0.23,-0.15 67,-46.57 142.27,-80.61 221.29,-100.45 22.25,-5.59 44.78,-10.12 67.53,-13.4 -1.8,-6.84 -3.45,-13.75 -5.29,-20.55 -2.32,-8.56 -2.51,-16.81 -2.51,-25.57 0.3,-8 3.44,-14.82 6.21,-20.84 1.45,-3.16 2.83,-6.14 3.67,-8.99 2.86,-9.72 4.23,-20.52 4.05,-32.09 -0.29,-19.8 -4.9,-39.81 -9.6,-58.61 -23.08,-92.295 -55.52,-182.732 -96.44,-268.799 -9.07,-19.082 -18.96,-38.25 -28.52,-56.801 l -3.04,-5.898 c -4.23,-8.211 -6.61,-19.004 -8.91,-29.453 -1.55,-6.988 -3.01,-13.598 -4.69,-17.649 -4.74,-11.421 -7.57,-19.519 -9.18,-24.621 L 1237.47,668 c -13.9,-4 -33.8,-0.25 -51.37,3.07 z m 548.24,173.223 -66.42,38.566 c 7.53,27.579 3.67,59.524 -11.2,89.336 -15.73,31.575 -41.25,56.835 -61.73,75.325 -50.02,45.16 -107.41,78.58 -153.77,101.31 -1.94,0.94 -3.96,1.99 -5.86,2.9 -5.87,2.82 -11.49,5.43 -16.92,7.9 -0.59,0.26 -1.26,0.59 -1.85,0.85 -0.03,0.15 -0.07,0.29 -0.1,0.44 -0.53,2.37 -1.08,4.72 -1.75,7.01 -1.25,4.24 -3,8.04 -4.7,11.71 -2.27,4.93 -4.23,9.19 -4.37,12.82 0,7.27 0.14,13.79 1.82,19.99 1.76,6.52 3.34,13.15 5.07,19.7 94.4,-26.35 174.54,-74.47 231.88,-139.69 62.73,-71.35 95.18,-161.378 89.9,-248.167 z M 1678.22,724.5 c -27.65,-33.301 -66.38,-59.238 -112.8,-75.109 -38.5,-13.161 -82.98,-19.481 -132.27,-19.032 -4.39,0.039 -8.76,0.051 -13.23,0.2 -20.55,0.711 -41.23,2.691 -61.61,5.82 -9.79,1.5 -19.48,3.34 -29.09,5.359 -24.68,5.211 -48.64,12.012 -70.98,20.422 0.46,1.469 1.12,3.43 1.88,5.602 1.53,4.379 3.65,10.09 6.75,17.547 2.36,5.679 4,13.121 5.74,21.011 0.27,1.219 0.57,2.469 0.85,3.711 0.56,2.469 1.16,4.899 1.79,7.328 0.34,1.313 0.66,2.661 1.02,3.922 52.73,-15.5 107.17,-23.41 162.11,-23.41 3.19,0 6.38,0.027 9.56,0.07 36.08,0.61 64.94,4.598 90.81,12.571 31.43,9.668 58.27,25.707 77.95,46.379 1.29,-0.782 2.54,-1.582 3.84,-2.36 17.95,-10.812 37.11,-21.722 57.68,-30.031 z m -47.37,47.172 c -16.49,9.91 -31.06,19.148 -42.24,31.828 -11.93,13.539 -17.65,29.352 -15.7,43.375 1.81,13.035 13.17,27.172 27.2,27.438 4.01,0.078 7.58,2.531 9.08,6.242 1.47,3.621 0.66,7.722 -1.99,10.558 -0.07,0.078 -0.11,0.176 -0.18,0.25 -1.97,1.973 -4.12,3.778 -6.29,5.575 -1.67,1.386 -3.35,2.757 -4.87,4.281 -3.89,3.926 -10.23,3.941 -14.14,0.039 -3.32,-3.297 -3.83,-8.348 -1.55,-12.195 -13.98,-7.485 -24.68,-22.243 -27.07,-39.438 -2.75,-19.805 4.73,-41.434 20.51,-59.344 7.61,-8.633 16.49,-15.75 25.94,-22.301 -17.07,-16.89 -39.94,-30.121 -66.68,-38.351 -24.03,-7.399 -51.12,-11.117 -85.26,-11.688 -55.31,-0.882 -110.18,6.489 -163.27,21.84 9.16,17.77 18.56,36.051 27.29,54.399 41.48,87.277 74.38,178.972 97.77,272.55 4.98,19.93 9.88,41.23 10.2,63.17 0.04,2.45 -0.06,4.84 -0.14,7.24 47,-22.04 109.03,-56.53 162.13,-104.46 19.17,-17.31 42.99,-40.836 57.23,-69.41 11.73,-23.508 15.43,-48.235 10.99,-69.895 l -9.57,5.555 c -4.76,2.769 -10.88,1.152 -13.66,-3.629 -0.33,-0.555 -0.39,-1.164 -0.6,-1.75 -1.56,-4.438 0.01,-9.465 4.23,-11.914 l 131.52,-76.367 c 9.64,-5.61 19.62,-11.399 26.88,-19.168 7.1,-7.582 10.76,-16.762 9.77,-24.543 -1.83,-14.411 -17.93,-23.688 -31.17,-27.27 -20.51,-5.551 -44.65,-4.07 -69.78,4.242 -23.66,7.828 -45.86,20.66 -66.58,33.141 z M 1144.29,1420.7 c 35.38,50.1 81.78,92.69 134.19,123.17 17.38,10.11 40.31,21.68 63.73,21.68 h 0.51 c 5.64,-0.04 11.26,-0.86 16.79,-2.25 28.72,-7.25 54.93,-31.79 67.03,-64.57 15.66,-42.38 8.19,-85.75 -2.38,-133.98 -7.81,-35.63 -16.55,-71.43 -25.68,-107.06 -4.78,0.68 -9.54,1.46 -14.3,2.24 -9.88,1.62 -19.71,3.46 -29.49,5.53 -40.61,8.6 -80.32,21.05 -118.52,37.11 -17.83,7.5 -35.33,15.78 -52.44,24.82 -12.92,6.83 -25.63,14.05 -38.08,21.74 -10.89,6.72 -21.59,13.76 -32.08,21.13 9.21,17.42 19.33,34.32 30.72,50.44 z m 1299.29,317.81 c 22.63,-4.23 41.46,-24.7 43.78,-47.61 2.34,-22.91 -11.97,-46.75 -33.29,-55.45 -3.58,-1.47 -7.4,-2.55 -11.34,-3.52 -0.44,3.17 -1.06,6.24 -1.84,9.22 -0.1,-0.24 -0.16,-0.49 -0.27,-0.72 -1.7,-3.64 -5.31,-5.78 -9.08,-5.78 -1.41,0 -2.85,0.3 -4.22,0.94 -5.01,2.34 -7.16,8.29 -4.83,13.29 2.59,5.55 1.93,12.61 -1.63,17.58 -2.73,3.8 -2.25,8.75 0.62,12.16 -1.67,2.08 -3.33,4.05 -4.93,5.81 -9.17,10.08 -19.79,18.55 -30.6,26.21 10.66,20.09 35.23,32.06 57.63,27.87 z m 46.21,-100.84 c 12.7,15.15 19.52,35.22 17.48,55.26 -3.26,31.9 -28.49,59.34 -60.01,65.24 -30.47,5.7 -62.56,-9.58 -77.84,-36.37 -81.88,52.9 -179.59,107.66 -285.04,115.31 -66.74,4.83 -135.74,9.84 -204.08,4.57 -75.78,-5.86 -141.19,-24.27 -194.64,-54.59 -8.77,11.82 -19.46,22.23 -31.8,30.37 -21.64,14.28 -48.82,22.22 -76.52,22.33 -28.13,0.18 -51.65,-8.56 -66.26,-24.43 -7.13,-7.77 -12.7,-17.7 -17.01,-30.38 -10.55,-31.06 -9.26,-66.19 3.55,-96.41 5.27,-12.42 12.58,-23.95 21.33,-34.29 -29,-31.71 -47.65,-83.76 -52.9,-99.72 -3.86,-11.74 -9.4,-28.25 -14.95,-44.77 -1.2,-3.58 -2.4,-7.15 -3.59,-10.68 -0.7,2.19 -1.4,4.37 -2.21,6.56 -17.26,46.72 -59.38,79.56 -102.43,79.88 -28.76,-0.12 -54.73,-12.93 -74.45,-24.4 -54.87,-31.9 -103.44,-76.48 -140.47,-128.9 -53.34,-75.53 -80.43,-165.13 -106.63,-251.79 L 919.332,843.16 c -8.086,-26.738 -15.469,-57.398 -0.684,-82.781 2.582,-4.438 5.715,-8.359 9.149,-11.918 l -11.434,-21.91 c -6.093,-11.68 -13,-24.922 -15.519,-39.582 -4.399,-25.528 5.148,-53.93 25.527,-75.981 19.973,-21.597 46.844,-34.238 65.309,-41.847 47.9,-19.801 100.21,-29.93 152.33,-29.93 18.95,0 37.86,1.379 56.53,4.07 -7.42,-48.019 -5.97,-97.48 4.98,-144.441 19.1,-81.899 67.34,-157.891 133.1,-210.469 -6.9,-5.59 -13.6,-11.441 -19.92,-17.762 -20.04,-20.039 -31.89,-39.507 -36.22,-59.519 -5.89,-27.1486 3.65,-54.6095 23.75,-68.3283 9.86,-6.7422 22.32,-10.2812 35.78,-10.2812 2.91,0 5.88,0.1601 8.87,0.4883 15.26,1.7226 29.11,7.3515 40.64,12.6328 26.73,12.2187 47.14,26.039 62.39,42.2578 8.83,9.3789 15.83,19.6796 21.03,30.4216 85.37,-42.6208 183.57,-64.6326 285.63,-64.6326 43.92,0 88.56,4.0508 133.15,12.2618 40.41,7.4414 80.31,20.3711 118.87,37.9808 9.2,-28.1097 24.41,-54.2191 44.47,-75.9808 9.35,-10.1485 24.04,-24.03129 43.66,-27.250044 C 2103.43,0.210938 2106.13,0 2108.85,0 c 23.8,0 47.15,16.6484 56.51,41.3984 8.32,22.0313 5.81,49.3008 -6.88,74.8006 -9.88,19.813 -24.07,36.281 -38.3,52.039 48.4,36.403 92.63,80.731 130.22,131.723 45.75,62.059 74.12,134.32 101.55,204.211 3.49,8.859 6.97,17.738 10.49,26.598 19.67,49.5 37.77,99.539 54.48,150.011 18.26,-4.019 37.02,-7.89 56.39,-7.89 2.5,0 5.01,0.058 7.53,0.191 27.28,1.477 51.29,12.219 65.88,29.477 6.16,7.293 10.88,15.972 13.65,25.101 6.82,22.449 0.65,46.289 -15.37,59.309 -11.23,9.152 -25.5,11.91 -36.95,14.133 l -51.53,10 c 41.36,149.554 71.78,312.528 87.22,467.508 7.74,4.55 15.38,9.92 22.88,16.2 57.58,48.2 83.71,132.39 63.56,204.73 -18.33,65.8 -74.54,120.19 -140.39,138.13"
+         style="fill:#100f0d;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)"
+         sodipodi:nodetypes="ccccccccccccccccsccccccscccccccccccccccccccccccccscccccscccccccccsccccscccccccccsccsccscccccccccccccsccccccsccccccccccccccccccccccccsccccscccsccscccccccccccccccscccccccccccccccccccccccccccscccscccccccccccccccccccccccccscccccccccccccccccccccccccccccccccccccccccsccccccccccccccccccssccccccccccccccccccccccccccccccccccsccccccsccccsscccscccccccscccccccccc" />
+      <path
+         id="path39"
+         d="m 1099.48,407.262 c -4.02,-9.313 -8.99,-19.563 -18.53,-23.012 -8.49,-3.059 -18.22,0.512 -24.87,6.602 -6.65,6.097 -10.84,14.347 -14.88,22.41 -21.56,-21.813 -43.118,-43.621 -64.673,-65.43 -10.699,-10.82 -23.097,-22.391 -38.312,-22.434 l -3.777,127.661 c -10.403,-2.59 -21.196,-5.18 -31.727,-3.2 -10.531,1.981 -20.754,9.891 -21.785,20.563 24.133,20.937 40.5,49.5 48.941,80.308 C 890.57,537.91 852.309,514.219 834.484,476.922 816.926,440.191 821.93,397.16 827.316,356.801 l 46.289,18.57 c 8.032,-71.84 10.555,-140.473 0.719,-212.101 -0.047,-0.36 0.43,-0.571 0.711,-0.34 58.453,46.929 112.93,98.808 162.645,154.902 -0.43,-15.773 5.82,-31.621 16.89,-42.863 34.76,31.703 71.23,66.23 82.24,111.961 6.67,27.679 2.93,57.73 -10.31,82.929 -9.01,-20.871 -18.01,-41.73 -27.02,-62.597"
+         style="fill:#ff6600;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path40"
+         d="m 2028.23,1312.68 c -0.08,0 -0.16,0 -0.24,0 -48.45,0 -93.27,18.45 -126.24,51.95 -34.63,35.21 -53.2,83.6 -52.27,136.29 1.75,99.9 86.5,180.87 189.07,180.87 0.3,0 0.57,0 0.85,0 48.82,-0.21 94.53,-19.4 128.72,-54.03 34.88,-35.34 53.85,-82.62 53.41,-133.13 -0.89,-101.89 -85.8,-181.81 -193.3,-181.95 z m 212.83,179.7 c 0.63,58.89 -19.6,112.21 -56.97,150.14 -36.93,37.48 -89.04,58.26 -146.74,58.5 -0.34,0 -0.69,0 -1.03,0 -119.34,0 -206.27,-86.16 -206.88,-205.24 -0.58,-117.17 82.12,-202.73 196.66,-203.43 0.46,0 0.94,0 1.41,0 116.71,-0.01 212.37,89.45 213.55,200.03"
+         style="fill:#231f20;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path41"
+         d="m 2596.49,1465.75 c 2.1,-3.74 2.2,-8.23 0.27,-11.73 -1.8,-3.22 -5.26,-5.43 -9.25,-5.94 -0.62,-0.08 -1.23,-0.12 -1.86,-0.12 -2.52,0 -5.16,0.64 -7.85,1.9 -1.07,0.51 -1.84,1.49 -2.08,2.65 -1.07,5.25 2.88,9.38 4.78,11.37 2.05,2.16 2.86,3.6 3,5.34 0.08,1.1 0.64,2.1 1.53,2.75 0.9,0.64 2.01,0.87 3.09,0.6 3.88,-0.93 6.94,-4.26 8.37,-6.82 z m -13.56,-32.43 c -0.11,0 -0.22,0 -0.33,0 -6.38,0.43 -12.36,3.81 -16,9.06 -1.58,2.27 -1.01,5.38 1.25,6.96 2.27,1.57 5.38,1.02 6.95,-1.25 1.91,-2.73 5.14,-4.57 8.46,-4.79 2.76,-0.18 4.85,-2.56 4.66,-5.32 -0.18,-2.64 -2.37,-4.66 -4.99,-4.66 z m -30.12,77.92 c -30.48,-1.27 -48.9,-18.31 -51.17,-49.01 -2.18,-29.3 21.77,-53.25 51.46,-52.8 31.47,0.47 47.32,18.47 51.49,45.82 1.1,30.56 -23.55,57.16 -51.78,55.99"
+         style="fill:#231f20;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path42"
+         d="m 2146.27,1482.02 c -0.59,-0.07 -1.19,-0.11 -1.8,-0.11 -2.56,0 -5.25,0.64 -7.92,1.9 -1.06,0.51 -1.83,1.48 -2.07,2.65 -1.07,5.24 2.88,9.38 4.78,11.36 2.05,2.16 2.86,3.61 3,5.35 0.08,1.09 0.64,2.1 1.54,2.74 0.9,0.64 2.03,0.87 3.08,0.61 3.88,-0.95 6.94,-4.27 8.37,-6.83 2.1,-3.76 2.2,-8.25 0.27,-11.73 -1.82,-3.23 -5.28,-5.44 -9.25,-5.94 z m -4.57,-14.76 c -0.12,0 -0.23,0 -0.34,0.01 -6.38,0.42 -12.36,3.81 -16.01,9.06 -1.57,2.26 -1,5.38 1.26,6.96 2.27,1.57 5.38,1.01 6.96,-1.26 1.9,-2.73 5.13,-4.57 8.45,-4.78 2.76,-0.19 4.85,-2.57 4.66,-5.32 -0.18,-2.65 -2.37,-4.67 -4.98,-4.67 z m -30.02,90.77 c -36.74,-1.53 -58.95,-22.08 -61.69,-59.08 -2.62,-35.32 26.24,-64.19 62.03,-63.65 37.94,0.57 57.05,22.27 62.07,55.23 1.33,36.85 -28.39,68.91 -62.41,67.5"
+         style="fill:#231f20;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path43"
+         d="m 2155.25,1499.69 c -1.43,2.56 -4.49,5.88 -8.37,6.83 -1.05,0.26 -2.18,0.03 -3.08,-0.61 -0.9,-0.64 -1.46,-1.65 -1.54,-2.74 -0.14,-1.74 -0.95,-3.19 -3,-5.35 -1.9,-1.98 -5.85,-6.12 -4.78,-11.36 0.24,-1.17 1.01,-2.14 2.07,-2.65 2.67,-1.26 5.36,-1.9 7.92,-1.9 0.61,0 1.21,0.04 1.8,0.11 3.97,0.5 7.43,2.71 9.25,5.94 1.93,3.48 1.83,7.97 -0.27,11.73"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path44"
+         d="m 2142.02,1477.25 c -3.32,0.21 -6.55,2.05 -8.45,4.78 -1.58,2.27 -4.69,2.83 -6.96,1.26 -2.26,-1.58 -2.83,-4.7 -1.26,-6.96 3.65,-5.25 9.63,-8.64 16.01,-9.06 0.11,-0.01 0.22,-0.01 0.34,-0.01 2.61,0 4.8,2.02 4.98,4.67 0.19,2.75 -1.9,5.13 -4.66,5.32"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path45"
+         d="m 2585.03,1471.97 c -0.89,-0.65 -1.45,-1.65 -1.53,-2.75 -0.14,-1.74 -0.95,-3.18 -3,-5.34 -1.9,-1.99 -5.85,-6.12 -4.78,-11.37 0.24,-1.16 1.01,-2.14 2.08,-2.65 2.69,-1.26 5.33,-1.9 7.85,-1.9 0.63,0 1.24,0.04 1.86,0.12 3.99,0.51 7.45,2.72 9.25,5.94 1.93,3.5 1.83,7.99 -0.27,11.73 -1.43,2.56 -4.49,5.89 -8.37,6.82 -1.08,0.27 -2.19,0.04 -3.09,-0.6"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path46"
+         d="m 2583.26,1443.3 c -3.32,0.22 -6.55,2.06 -8.46,4.79 -1.57,2.27 -4.68,2.82 -6.95,1.25 -2.26,-1.58 -2.83,-4.69 -1.25,-6.96 3.64,-5.25 9.62,-8.63 16,-9.06 0.11,0 0.22,0 0.33,0 2.62,0 4.81,2.02 4.99,4.66 0.19,2.76 -1.9,5.14 -4.66,5.32"
+         style="fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path47"
+         d="m 2437.11,1678.11 c -3.21,4.49 -9.45,5.53 -13.96,2.3 -0.69,-0.49 -1.14,-1.17 -1.67,-1.79 -2.87,-3.41 -3.35,-8.36 -0.62,-12.16 3.56,-4.97 4.22,-12.03 1.63,-17.58 -2.33,-5 -0.18,-10.95 4.83,-13.29 1.37,-0.64 2.81,-0.94 4.22,-0.94 3.77,0 7.38,2.14 9.08,5.78 0.11,0.23 0.17,0.48 0.27,0.72 5.26,11.94 3.83,26.35 -3.78,36.96"
+         style="fill:#100f0d;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path48"
+         d="m 3413.01,1057.13 c 4.17,0 7.72,-1.48 10.66,-4.4 2.92,-2.94 4.4,-6.49 4.4,-10.66 V 673.102 c 0,-4.192 -1.48,-7.743 -4.4,-10.661 -2.94,-2.941 -6.49,-4.402 -10.66,-4.402 h -380.26 c -4.2,0 -7.74,1.461 -10.66,4.402 -2.94,2.918 -4.39,6.469 -4.39,10.661 v 368.968 c 0,4.17 1.45,7.72 4.39,10.66 2.92,2.92 6.46,4.4 10.66,4.4 z m -475.63,140.55 c -25.94,-15.9 -46.65,-36.82 -62.12,-62.75 -15.49,-25.94 -23.22,-54.8 -23.22,-86.59 V 666.832 c 0,-31.812 7.73,-60.672 23.22,-86.594 15.47,-25.949 36.18,-46.867 62.12,-62.738 25.92,-15.91 55.22,-23.852 87.84,-23.852 h 402.85 V 205.012 h 164.39 V 1221.52 h -567.24 c -32.62,0 -61.92,-7.96 -87.84,-23.84"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)"
+         sodipodi:nodetypes="scsscsscsssssccssccsccccsc" />
+      <path
+         id="path49"
+         d="m 4277.65,673.102 c 0,-4.192 -1.48,-7.743 -4.4,-10.661 -2.94,-2.941 -6.49,-4.402 -10.66,-4.402 h -380.26 c -4.19,0 -7.74,1.461 -10.66,4.402 -2.94,2.918 -4.39,6.469 -4.39,10.661 v 548.418 h -164.4 V 666.832 c 0,-31.812 7.73,-60.672 23.21,-86.594 15.47,-25.949 36.4,-46.867 62.76,-62.738 26.35,-15.91 55.41,-23.852 87.21,-23.852 h 392.8 c 32.63,0 61.9,7.942 87.85,23.852 25.92,15.871 46.63,36.789 62.12,62.738 15.47,25.922 23.21,54.782 23.21,86.594 V 1221.52 H 4277.65 V 673.102"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)"
+         sodipodi:nodetypes="ccsscsccsccssccsccc" />
+      <path
+         id="path50"
+         d="m 4573.8,493.648 h 164.4 V 1221.52 H 4573.8 V 493.648"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path51"
+         d="m 4573.8,1294.3 h 164.4 v 165.66 H 4573.8 V 1294.3"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path52"
+         d="m 5022.43,662.441 c -2.94,2.918 -4.39,6.469 -4.39,10.661 v 368.968 c 0,4.17 1.45,7.72 4.39,10.66 2.92,2.92 6.48,4.4 10.67,4.4 h 558.45 v 164.39 h -564.72 c -31.81,0 -60.68,-7.96 -86.6,-23.84 -25.94,-15.9 -46.86,-36.82 -62.75,-62.75 -15.9,-25.94 -23.84,-54.8 -23.84,-86.59 V 666.832 c 0,-31.812 7.94,-60.672 23.84,-86.594 15.89,-25.949 36.81,-46.867 62.75,-62.738 25.92,-15.91 54.79,-23.852 86.6,-23.852 h 565.97 v 164.391 h -559.7 c -4.19,0 -7.75,1.461 -10.67,4.402"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path53"
+         d="m 5692.49,782.289 h 513.27 V 946.688 H 5692.49 V 782.289"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path54"
+         d="m 6910.57,673.102 c 0,-4.192 -1.48,-7.743 -4.4,-10.661 -2.94,-2.941 -6.49,-4.402 -10.66,-4.402 h -380.26 c -4.19,0 -7.74,1.461 -10.66,4.402 -2.94,2.918 -4.39,6.469 -4.39,10.661 v 368.968 c 0,4.17 1.45,7.72 4.39,10.66 2.92,2.92 6.47,4.4 10.66,4.4 h 380.26 c 4.17,0 7.72,-1.48 10.66,-4.4 2.92,-2.94 4.4,-6.49 4.4,-10.66 z m 79.06,524.578 c -25.95,15.88 -54.81,23.84 -86.59,23.84 h -394.06 c -30.96,0 -59.6,-7.96 -85.96,-23.84 -26.36,-15.9 -47.49,-36.82 -63.38,-62.75 -15.9,-25.94 -23.84,-54.8 -23.84,-86.59 V 666.832 c 0,-31.812 7.94,-60.672 23.84,-86.594 15.89,-25.949 37.02,-46.867 63.38,-62.738 26.36,-15.91 55,-23.852 85.96,-23.852 h 401.59 V 386.98 c 0,-4.179 -1.48,-7.73 -4.4,-10.671 -2.94,-2.93 -6.49,-4.387 -10.66,-4.387 H 6457.53 V 206.27 h 445.51 c 31.78,0 60.86,7.742 87.21,23.21 26.36,15.5 47.06,36.2 62.12,62.122 15.06,25.937 22.59,55.218 22.59,87.847 v 668.891 c 0,31.79 -7.74,60.65 -23.21,86.59 -15.49,25.93 -36.2,46.85 -62.12,62.75"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+      <path
+         id="path55"
+         d="m 7752.65,673.102 c 0,-4.192 -1.48,-7.743 -4.4,-10.661 -2.94,-2.941 -6.49,-4.402 -10.66,-4.402 h -380.26 c -4.19,0 -7.74,1.461 -10.66,4.402 -2.94,2.918 -4.39,6.469 -4.39,10.661 v 368.968 c 0,4.17 1.45,7.72 4.39,10.66 2.92,2.92 6.47,4.4 10.66,4.4 h 380.26 c 4.17,0 7.72,-1.48 10.66,-4.4 2.92,-2.94 4.4,-6.49 4.4,-10.66 z m 141.18,461.828 c -15.49,25.93 -36.4,46.85 -62.75,62.75 -26.35,15.88 -55.44,23.84 -87.22,23.84 h -392.8 c -31.8,0 -60.67,-7.96 -86.59,-23.84 -25.94,-15.9 -46.86,-36.82 -62.75,-62.75 -15.9,-25.94 -23.84,-54.8 -23.84,-86.59 V 666.832 c 0,-31.812 7.94,-60.672 23.84,-86.594 15.89,-25.949 36.81,-46.867 62.75,-62.738 25.92,-15.91 54.79,-23.852 86.59,-23.852 h 392.8 c 32.63,0 61.9,7.942 87.85,23.852 25.92,15.871 46.63,36.789 62.12,62.738 15.47,25.922 23.21,54.782 23.21,86.594 v 381.508 c 0,31.79 -7.74,60.65 -23.21,86.59"
+         style="fill:#202b4f;fill-opacity:1;fill-rule:nonzero;stroke:none"
+         transform="matrix(0.13333333,0,0,-0.13333333,0,245.85333)" />
+    </g>
+  </g>
+</svg>
diff --git a/electron/native/private-transport/third_party/quic-go/assets/quic-go-logo.png b/electron/native/private-transport/third_party/quic-go/assets/quic-go-logo.png
new file mode 100644
index 000000000..6be4ed431
Binary files /dev/null and b/electron/native/private-transport/third_party/quic-go/assets/quic-go-logo.png differ
diff --git a/electron/native/private-transport/third_party/quic-go/buffer_pool.go b/electron/native/private-transport/third_party/quic-go/buffer_pool.go
new file mode 100644
index 000000000..48589e123
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/buffer_pool.go
@@ -0,0 +1,92 @@
+package quic
+
+import (
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+type packetBuffer struct {
+	Data []byte
+
+	// refCount counts how many packets Data is used in.
+	// It doesn't support concurrent use.
+	// It is > 1 when used for coalesced packet.
+	refCount int
+}
+
+// Split increases the refCount.
+// It must be called when a packet buffer is used for more than one packet,
+// e.g. when splitting coalesced packets.
+func (b *packetBuffer) Split() {
+	b.refCount++
+}
+
+// Decrement decrements the reference counter.
+// It doesn't put the buffer back into the pool.
+func (b *packetBuffer) Decrement() {
+	b.refCount--
+	if b.refCount < 0 {
+		panic("negative packetBuffer refCount")
+	}
+}
+
+// MaybeRelease puts the packet buffer back into the pool,
+// if the reference counter already reached 0.
+func (b *packetBuffer) MaybeRelease() {
+	// only put the packetBuffer back if it's not used any more
+	if b.refCount == 0 {
+		b.putBack()
+	}
+}
+
+// Release puts back the packet buffer into the pool.
+// It should be called when processing is definitely finished.
+func (b *packetBuffer) Release() {
+	b.Decrement()
+	if b.refCount != 0 {
+		panic("packetBuffer refCount not zero")
+	}
+	b.putBack()
+}
+
+// Len returns the length of Data
+func (b *packetBuffer) Len() protocol.ByteCount { return protocol.ByteCount(len(b.Data)) }
+func (b *packetBuffer) Cap() protocol.ByteCount { return protocol.ByteCount(cap(b.Data)) }
+
+func (b *packetBuffer) putBack() {
+	if cap(b.Data) == protocol.MaxPacketBufferSize {
+		bufferPool.Put(b)
+		return
+	}
+	if cap(b.Data) == protocol.MaxLargePacketBufferSize {
+		largeBufferPool.Put(b)
+		return
+	}
+	panic("putPacketBuffer called with packet of wrong size!")
+}
+
+var bufferPool, largeBufferPool sync.Pool
+
+func getPacketBuffer() *packetBuffer {
+	buf := bufferPool.Get().(*packetBuffer)
+	buf.refCount = 1
+	buf.Data = buf.Data[:0]
+	return buf
+}
+
+func getLargePacketBuffer() *packetBuffer {
+	buf := largeBufferPool.Get().(*packetBuffer)
+	buf.refCount = 1
+	buf.Data = buf.Data[:0]
+	return buf
+}
+
+func init() {
+	bufferPool.New = func() any {
+		return &packetBuffer{Data: make([]byte, 0, protocol.MaxPacketBufferSize)}
+	}
+	largeBufferPool.New = func() any {
+		return &packetBuffer{Data: make([]byte, 0, protocol.MaxLargePacketBufferSize)}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/buffer_pool_test.go b/electron/native/private-transport/third_party/quic-go/buffer_pool_test.go
new file mode 100644
index 000000000..6b8bae8aa
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/buffer_pool_test.go
@@ -0,0 +1,44 @@
+package quic
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestBufferPoolSizes(t *testing.T) {
+	buf1 := getPacketBuffer()
+	require.Equal(t, protocol.MaxPacketBufferSize, cap(buf1.Data))
+	require.Zero(t, buf1.Len())
+	buf1.Data = append(buf1.Data, []byte("foobar")...)
+	require.Equal(t, protocol.ByteCount(6), buf1.Len())
+
+	buf2 := getLargePacketBuffer()
+	require.Equal(t, protocol.MaxLargePacketBufferSize, cap(buf2.Data))
+	require.Zero(t, buf2.Len())
+}
+
+func TestBufferPoolRelease(t *testing.T) {
+	buf1 := getPacketBuffer()
+	buf1.Release()
+	// panics if released twice
+	require.Panics(t, func() { buf1.Release() })
+
+	// panics if wrong-sized buffers are passed
+	buf2 := getLargePacketBuffer()
+	buf2.Data = make([]byte, 10) // replace the underlying slice
+	require.Panics(t, func() { buf2.Release() })
+}
+
+func TestBufferPoolSplitting(t *testing.T) {
+	buf := getPacketBuffer()
+	buf.Split()
+	buf.Split()
+	// now we have 3 parts
+	buf.Decrement()
+	buf.Decrement()
+	buf.Decrement()
+	require.Panics(t, func() { buf.Decrement() })
+}
diff --git a/electron/native/private-transport/third_party/quic-go/client.go b/electron/native/private-transport/third_party/quic-go/client.go
new file mode 100644
index 000000000..3221dc880
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/client.go
@@ -0,0 +1,109 @@
+package quic
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"net"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// make it possible to mock connection ID for initial generation in the tests
+var generateConnectionIDForInitial = protocol.GenerateConnectionIDForInitial
+
+// DialAddr establishes a new QUIC connection to a server.
+// It resolves the address, and then creates a new UDP connection to dial the QUIC server.
+// When the QUIC connection is closed, this UDP connection is closed.
+// See [Dial] for more details.
+func DialAddr(ctx context.Context, addr string, tlsConf *tls.Config, conf *Config) (*Conn, error) {
+	udpConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
+	if err != nil {
+		return nil, err
+	}
+	udpAddr, err := net.ResolveUDPAddr("udp", addr)
+	if err != nil {
+		return nil, err
+	}
+	tr, err := setupTransport(udpConn, tlsConf, true)
+	if err != nil {
+		return nil, err
+	}
+	conn, err := tr.dial(ctx, udpAddr, addr, tlsConf, conf, false)
+	if err != nil {
+		tr.Close()
+		return nil, err
+	}
+	return conn, nil
+}
+
+// DialAddrEarly establishes a new 0-RTT QUIC connection to a server.
+// See [DialAddr] for more details.
+func DialAddrEarly(ctx context.Context, addr string, tlsConf *tls.Config, conf *Config) (*Conn, error) {
+	udpConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
+	if err != nil {
+		return nil, err
+	}
+	udpAddr, err := net.ResolveUDPAddr("udp", addr)
+	if err != nil {
+		return nil, err
+	}
+	tr, err := setupTransport(udpConn, tlsConf, true)
+	if err != nil {
+		return nil, err
+	}
+	conn, err := tr.dial(ctx, udpAddr, addr, tlsConf, conf, true)
+	if err != nil {
+		tr.Close()
+		return nil, err
+	}
+	return conn, nil
+}
+
+// DialEarly establishes a new 0-RTT QUIC connection to a server using a [net.PacketConn].
+// See [Dial] for more details.
+func DialEarly(ctx context.Context, c net.PacketConn, addr net.Addr, tlsConf *tls.Config, conf *Config) (*Conn, error) {
+	dl, err := setupTransport(c, tlsConf, false)
+	if err != nil {
+		return nil, err
+	}
+	conn, err := dl.DialEarly(ctx, addr, tlsConf, conf)
+	if err != nil {
+		dl.Close()
+		return nil, err
+	}
+	return conn, nil
+}
+
+// Dial establishes a new QUIC connection to a server using a [net.PacketConn].
+// If the PacketConn satisfies the [OOBCapablePacketConn] interface (as a [net.UDPConn] does),
+// ECN and packet info support will be enabled. In this case, packets will be read in batches,
+// and [OOBCapablePacketConn.WriteMsgUDP] will be used instead of [net.PacketConn.WriteTo].
+// The [tls.Config] must define an application protocol using [tls.Config.NextProtos].
+//
+// This is a convenience function. More advanced use cases should instantiate a [Transport],
+// which offers configuration options for a more fine-grained control of the connection establishment,
+// including reusing the underlying UDP socket for multiple QUIC connections.
+func Dial(ctx context.Context, c net.PacketConn, addr net.Addr, tlsConf *tls.Config, conf *Config) (*Conn, error) {
+	dl, err := setupTransport(c, tlsConf, false)
+	if err != nil {
+		return nil, err
+	}
+	conn, err := dl.Dial(ctx, addr, tlsConf, conf)
+	if err != nil {
+		dl.Close()
+		return nil, err
+	}
+	return conn, nil
+}
+
+func setupTransport(c net.PacketConn, tlsConf *tls.Config, createdPacketConn bool) (*Transport, error) {
+	if tlsConf == nil {
+		return nil, errors.New("quic: tls.Config not set")
+	}
+	return &Transport{
+		Conn:        c,
+		createdConn: createdPacketConn,
+		isSingleUse: true,
+	}, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/client_test.go b/electron/native/private-transport/third_party/quic-go/client_test.go
new file mode 100644
index 000000000..8a33afc6f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/client_test.go
@@ -0,0 +1,105 @@
+package quic
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDial(t *testing.T) {
+	t.Run("Dial", func(t *testing.T) {
+		testDial(t,
+			func(ctx context.Context, addr net.Addr) error {
+				conn := newUDPConnLocalhost(t)
+				_, err := Dial(ctx, conn, addr, &tls.Config{}, nil)
+				return err
+			},
+			false,
+		)
+	})
+
+	t.Run("DialEarly", func(t *testing.T) {
+		testDial(t,
+			func(ctx context.Context, addr net.Addr) error {
+				conn := newUDPConnLocalhost(t)
+				_, err := DialEarly(ctx, conn, addr, &tls.Config{}, nil)
+				return err
+			},
+			false,
+		)
+	})
+
+	t.Run("DialAddr", func(t *testing.T) {
+		testDial(t,
+			func(ctx context.Context, addr net.Addr) error {
+				_, err := DialAddr(ctx, addr.String(), &tls.Config{}, nil)
+				return err
+			},
+			true,
+		)
+	})
+
+	t.Run("DialAddrEarly", func(t *testing.T) {
+		testDial(t,
+			func(ctx context.Context, addr net.Addr) error {
+				_, err := DialAddrEarly(ctx, addr.String(), &tls.Config{}, nil)
+				return err
+			},
+			true,
+		)
+	})
+}
+
+func testDial(t *testing.T,
+	dialFn func(context.Context, net.Addr) error,
+	shouldCloseConn bool,
+) {
+	server := newUDPConnLocalhost(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	errChan := make(chan error, 1)
+	go func() { errChan <- dialFn(ctx, server.LocalAddr()) }()
+
+	server.SetReadDeadline(time.Now().Add(time.Second))
+	_, addr, err := server.ReadFrom(make([]byte, 1500))
+	require.NoError(t, err)
+	cancel()
+	select {
+	case err := <-errChan:
+		require.ErrorIs(t, err, context.Canceled)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	if shouldCloseConn {
+		// The socket that the client used for dialing should be closed now.
+		// Binding to the same address would error if the address was still in use.
+		require.Eventually(t, func() bool {
+			conn, err := net.ListenUDP("udp", addr.(*net.UDPAddr))
+			if err != nil {
+				return false
+			}
+			conn.Close()
+			return true
+		}, scaleDuration(200*time.Millisecond), scaleDuration(10*time.Millisecond))
+		require.False(t, areTransportsRunning())
+		return
+	}
+
+	// The socket that the client used for dialing should not be closed now.
+	// Binding to the same address will error if the address was still in use.
+	_, err = net.ListenUDP("udp", addr.(*net.UDPAddr))
+	require.Error(t, err)
+	if runtime.GOOS == "windows" {
+		require.ErrorContains(t, err, "bind: Only one usage of each socket address")
+	} else {
+		require.ErrorContains(t, err, "address already in use")
+	}
+
+	require.False(t, areTransportsRunning())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/closed_conn.go b/electron/native/private-transport/third_party/quic-go/closed_conn.go
new file mode 100644
index 000000000..6486ea65e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/closed_conn.go
@@ -0,0 +1,58 @@
+package quic
+
+import (
+	"math/bits"
+	"net"
+	"sync/atomic"
+
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+// A closedLocalConn is a connection that we closed locally.
+// When receiving packets for such a connection, we need to retransmit the packet containing the CONNECTION_CLOSE frame,
+// with an exponential backoff.
+type closedLocalConn struct {
+	counter atomic.Uint32
+	logger  utils.Logger
+
+	sendPacket func(net.Addr, packetInfo)
+}
+
+var _ packetHandler = &closedLocalConn{}
+
+// newClosedLocalConn creates a new closedLocalConn and runs it.
+func newClosedLocalConn(sendPacket func(net.Addr, packetInfo), logger utils.Logger) packetHandler {
+	return &closedLocalConn{
+		sendPacket: sendPacket,
+		logger:     logger,
+	}
+}
+
+func (c *closedLocalConn) handlePacket(p receivedPacket) {
+	n := c.counter.Add(1)
+	// exponential backoff
+	// only send a CONNECTION_CLOSE for the 1st, 2nd, 4th, 8th, 16th, ... packet arriving
+	if bits.OnesCount32(n) != 1 {
+		return
+	}
+	c.logger.Debugf("Received %d packets after sending CONNECTION_CLOSE. Retransmitting.", n)
+	c.sendPacket(p.remoteAddr, p.info)
+}
+
+func (c *closedLocalConn) destroy(error)                              {}
+func (c *closedLocalConn) closeWithTransportError(TransportErrorCode) {}
+
+// A closedRemoteConn is a connection that was closed remotely.
+// For such a connection, we might receive reordered packets that were sent before the CONNECTION_CLOSE.
+// We can just ignore those packets.
+type closedRemoteConn struct{}
+
+var _ packetHandler = &closedRemoteConn{}
+
+func newClosedRemoteConn() packetHandler {
+	return &closedRemoteConn{}
+}
+
+func (c *closedRemoteConn) handlePacket(receivedPacket)                {}
+func (c *closedRemoteConn) destroy(error)                              {}
+func (c *closedRemoteConn) closeWithTransportError(TransportErrorCode) {}
diff --git a/electron/native/private-transport/third_party/quic-go/closed_conn_test.go b/electron/native/private-transport/third_party/quic-go/closed_conn_test.go
new file mode 100644
index 000000000..20a61fce8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/closed_conn_test.go
@@ -0,0 +1,34 @@
+package quic
+
+import (
+	"net"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/utils"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestClosedLocalConnection(t *testing.T) {
+	written := make(chan net.Addr, 1)
+	conn := newClosedLocalConn(func(addr net.Addr, _ packetInfo) { written <- addr }, utils.DefaultLogger)
+	addr := &net.UDPAddr{IP: net.IPv4(127, 1, 2, 3), Port: 1337}
+	for i := 1; i <= 20; i++ {
+		conn.handlePacket(receivedPacket{remoteAddr: addr})
+		if i == 1 || i == 2 || i == 4 || i == 8 || i == 16 {
+			select {
+			case gotAddr := <-written:
+				require.Equal(t, addr, gotAddr) // receive the CONNECTION_CLOSE
+			default:
+				t.Fatal("expected to receive address")
+			}
+		} else {
+			select {
+			case gotAddr := <-written:
+				t.Fatalf("unexpected address received: %v", gotAddr)
+			default:
+				// Nothing received, which is expected
+			}
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/codecov.yml b/electron/native/private-transport/third_party/quic-go/codecov.yml
new file mode 100644
index 000000000..55d8a35e4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/codecov.yml
@@ -0,0 +1,23 @@
+coverage:
+  round: nearest
+  ignore:
+    - http3/gzip_reader.go
+    - example/
+    - interop/
+    - internal/handshake/cipher_suite.go
+    - internal/mocks/
+    - internal/utils/linkedlist/linkedlist.go
+    - internal/testdata
+    - testutils/
+    - fuzzing/
+    - metrics/
+  status:
+    project:
+      default:
+        threshold: 0.5
+    patch: false
+flags:
+  clusterfuzz-lite-batch:
+    joined: false
+  clusterfuzz:
+    joined: false
diff --git a/electron/native/private-transport/third_party/quic-go/config.go b/electron/native/private-transport/third_party/quic-go/config.go
new file mode 100644
index 000000000..74c2054e4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/config.go
@@ -0,0 +1,129 @@
+package quic
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// Clone clones a Config.
+func (c *Config) Clone() *Config {
+	copy := *c
+	return &copy
+}
+
+func (c *Config) handshakeTimeout() time.Duration {
+	return 2 * c.HandshakeIdleTimeout
+}
+
+func (c *Config) maxRetryTokenAge() time.Duration {
+	return c.handshakeTimeout()
+}
+
+func validateConfig(config *Config) error {
+	if config == nil {
+		return nil
+	}
+	const maxStreams = 1 << 60
+	if config.MaxIncomingStreams > maxStreams {
+		config.MaxIncomingStreams = maxStreams
+	}
+	if config.MaxIncomingUniStreams > maxStreams {
+		config.MaxIncomingUniStreams = maxStreams
+	}
+	if config.MaxStreamReceiveWindow > quicvarint.Max {
+		config.MaxStreamReceiveWindow = quicvarint.Max
+	}
+	if config.MaxConnectionReceiveWindow > quicvarint.Max {
+		config.MaxConnectionReceiveWindow = quicvarint.Max
+	}
+	if config.InitialPacketSize > 0 && config.InitialPacketSize < protocol.MinInitialPacketSize {
+		config.InitialPacketSize = protocol.MinInitialPacketSize
+	}
+	if config.InitialPacketSize > protocol.MaxPacketBufferSize {
+		config.InitialPacketSize = protocol.MaxPacketBufferSize
+	}
+	// check that all QUIC versions are actually supported
+	for _, v := range config.Versions {
+		if !protocol.IsValidVersion(v) {
+			return fmt.Errorf("invalid QUIC version: %s", v)
+		}
+	}
+	return nil
+}
+
+// populateConfig populates fields in the quic.Config with their default values, if none are set
+// it may be called with nil
+func populateConfig(config *Config) *Config {
+	if config == nil {
+		config = &Config{}
+	}
+	versions := config.Versions
+	if len(versions) == 0 {
+		versions = protocol.SupportedVersions
+	}
+	handshakeIdleTimeout := protocol.DefaultHandshakeIdleTimeout
+	if config.HandshakeIdleTimeout != 0 {
+		handshakeIdleTimeout = config.HandshakeIdleTimeout
+	}
+	idleTimeout := protocol.DefaultIdleTimeout
+	if config.MaxIdleTimeout != 0 {
+		idleTimeout = config.MaxIdleTimeout
+	}
+	initialStreamReceiveWindow := config.InitialStreamReceiveWindow
+	if initialStreamReceiveWindow == 0 {
+		initialStreamReceiveWindow = protocol.DefaultInitialMaxStreamData
+	}
+	maxStreamReceiveWindow := config.MaxStreamReceiveWindow
+	if maxStreamReceiveWindow == 0 {
+		maxStreamReceiveWindow = protocol.DefaultMaxReceiveStreamFlowControlWindow
+	}
+	initialConnectionReceiveWindow := config.InitialConnectionReceiveWindow
+	if initialConnectionReceiveWindow == 0 {
+		initialConnectionReceiveWindow = protocol.DefaultInitialMaxData
+	}
+	maxConnectionReceiveWindow := config.MaxConnectionReceiveWindow
+	if maxConnectionReceiveWindow == 0 {
+		maxConnectionReceiveWindow = protocol.DefaultMaxReceiveConnectionFlowControlWindow
+	}
+	maxIncomingStreams := config.MaxIncomingStreams
+	if maxIncomingStreams == 0 {
+		maxIncomingStreams = protocol.DefaultMaxIncomingStreams
+	} else if maxIncomingStreams < 0 {
+		maxIncomingStreams = 0
+	}
+	maxIncomingUniStreams := config.MaxIncomingUniStreams
+	if maxIncomingUniStreams == 0 {
+		maxIncomingUniStreams = protocol.DefaultMaxIncomingUniStreams
+	} else if maxIncomingUniStreams < 0 {
+		maxIncomingUniStreams = 0
+	}
+	initialPacketSize := config.InitialPacketSize
+	if initialPacketSize == 0 {
+		initialPacketSize = protocol.InitialPacketSize
+	}
+
+	return &Config{
+		GetConfigForClient:               config.GetConfigForClient,
+		Versions:                         versions,
+		HandshakeIdleTimeout:             handshakeIdleTimeout,
+		MaxIdleTimeout:                   idleTimeout,
+		KeepAlivePeriod:                  config.KeepAlivePeriod,
+		InitialStreamReceiveWindow:       initialStreamReceiveWindow,
+		MaxStreamReceiveWindow:           maxStreamReceiveWindow,
+		InitialConnectionReceiveWindow:   initialConnectionReceiveWindow,
+		MaxConnectionReceiveWindow:       maxConnectionReceiveWindow,
+		AllowConnectionWindowIncrease:    config.AllowConnectionWindowIncrease,
+		MaxIncomingStreams:               maxIncomingStreams,
+		MaxIncomingUniStreams:            maxIncomingUniStreams,
+		TokenStore:                       config.TokenStore,
+		EnableDatagrams:                  config.EnableDatagrams,
+		InitialPacketSize:                initialPacketSize,
+		DisablePathMTUDiscovery:          config.DisablePathMTUDiscovery,
+		EnableStreamResetPartialDelivery: config.EnableStreamResetPartialDelivery,
+		Allow0RTT:                        config.Allow0RTT,
+		Tracer:                           config.Tracer,
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/config_test.go b/electron/native/private-transport/third_party/quic-go/config_test.go
new file mode 100644
index 000000000..23735421f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/config_test.go
@@ -0,0 +1,199 @@
+package quic
+
+import (
+	"context"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigValidation(t *testing.T) {
+	t.Run("nil config", func(t *testing.T) {
+		require.NoError(t, validateConfig(nil))
+	})
+
+	t.Run("config with a few values set", func(t *testing.T) {
+		conf := populateConfig(&Config{
+			MaxIncomingStreams:     5,
+			MaxStreamReceiveWindow: 10,
+		})
+		require.NoError(t, validateConfig(conf))
+		require.Equal(t, int64(5), conf.MaxIncomingStreams)
+		require.Equal(t, uint64(10), conf.MaxStreamReceiveWindow)
+	})
+
+	t.Run("stream limits", func(t *testing.T) {
+		conf := &Config{
+			MaxIncomingStreams:    1<<60 + 1,
+			MaxIncomingUniStreams: 1<<60 + 2,
+		}
+		require.NoError(t, validateConfig(conf))
+		require.Equal(t, int64(1<<60), conf.MaxIncomingStreams)
+		require.Equal(t, int64(1<<60), conf.MaxIncomingUniStreams)
+	})
+
+	t.Run("flow control windows", func(t *testing.T) {
+		conf := &Config{
+			MaxStreamReceiveWindow:     quicvarint.Max + 1,
+			MaxConnectionReceiveWindow: quicvarint.Max + 2,
+		}
+		require.NoError(t, validateConfig(conf))
+		require.Equal(t, uint64(quicvarint.Max), conf.MaxStreamReceiveWindow)
+		require.Equal(t, uint64(quicvarint.Max), conf.MaxConnectionReceiveWindow)
+	})
+
+	t.Run("initial packet size", func(t *testing.T) {
+		// not set
+		conf := &Config{InitialPacketSize: 0}
+		require.NoError(t, validateConfig(conf))
+		require.Zero(t, conf.InitialPacketSize)
+
+		// too small
+		conf = &Config{InitialPacketSize: 10}
+		require.NoError(t, validateConfig(conf))
+		require.Equal(t, uint16(1200), conf.InitialPacketSize)
+
+		// too large
+		conf = &Config{InitialPacketSize: protocol.MaxPacketBufferSize + 1}
+		require.NoError(t, validateConfig(conf))
+		require.Equal(t, uint16(protocol.MaxPacketBufferSize), conf.InitialPacketSize)
+	})
+}
+
+func TestConfigHandshakeIdleTimeout(t *testing.T) {
+	c := &Config{HandshakeIdleTimeout: time.Second * 11 / 2}
+	require.Equal(t, 11*time.Second, c.handshakeTimeout())
+}
+
+func configWithNonZeroNonFunctionFields(t *testing.T) *Config {
+	t.Helper()
+	c := &Config{}
+	v := reflect.ValueOf(c).Elem()
+
+	typ := v.Type()
+	for i := 0; i < typ.NumField(); i++ {
+		f := v.Field(i)
+		if !f.CanSet() {
+			// unexported field; not cloned.
+			continue
+		}
+
+		switch fn := typ.Field(i).Name; fn {
+		case "GetConfigForClient", "RequireAddressValidation", "GetLogWriter", "AllowConnectionWindowIncrease", "Tracer":
+			// Can't compare functions.
+		case "Versions":
+			f.Set(reflect.ValueOf([]Version{1, 2, 3}))
+		case "ConnectionIDLength":
+			f.Set(reflect.ValueOf(8))
+		case "ConnectionIDGenerator":
+			f.Set(reflect.ValueOf(&protocol.DefaultConnectionIDGenerator{ConnLen: protocol.DefaultConnectionIDLength}))
+		case "HandshakeIdleTimeout":
+			f.Set(reflect.ValueOf(time.Second))
+		case "MaxIdleTimeout":
+			f.Set(reflect.ValueOf(time.Hour))
+		case "TokenStore":
+			f.Set(reflect.ValueOf(NewLRUTokenStore(2, 3)))
+		case "InitialStreamReceiveWindow":
+			f.Set(reflect.ValueOf(uint64(1234)))
+		case "MaxStreamReceiveWindow":
+			f.Set(reflect.ValueOf(uint64(9)))
+		case "InitialConnectionReceiveWindow":
+			f.Set(reflect.ValueOf(uint64(4321)))
+		case "MaxConnectionReceiveWindow":
+			f.Set(reflect.ValueOf(uint64(10)))
+		case "MaxIncomingStreams":
+			f.Set(reflect.ValueOf(int64(11)))
+		case "MaxIncomingUniStreams":
+			f.Set(reflect.ValueOf(int64(12)))
+		case "StatelessResetKey":
+			f.Set(reflect.ValueOf(&StatelessResetKey{1, 2, 3, 4}))
+		case "KeepAlivePeriod":
+			f.Set(reflect.ValueOf(time.Second))
+		case "EnableDatagrams":
+			f.Set(reflect.ValueOf(true))
+		case "DisableVersionNegotiationPackets":
+			f.Set(reflect.ValueOf(true))
+		case "InitialPacketSize":
+			f.Set(reflect.ValueOf(uint16(1350)))
+		case "DisablePathMTUDiscovery":
+			f.Set(reflect.ValueOf(true))
+		case "Allow0RTT":
+			f.Set(reflect.ValueOf(true))
+		case "EnableStreamResetPartialDelivery":
+			f.Set(reflect.ValueOf(true))
+		default:
+			t.Fatalf("all fields must be accounted for, but saw unknown field %q", fn)
+		}
+	}
+	return c
+}
+
+func TestConfigClone(t *testing.T) {
+	t.Run("function fields", func(t *testing.T) {
+		var calledAllowConnectionWindowIncrease, calledTracer bool
+		c1 := &Config{
+			GetConfigForClient:            func(info *ClientInfo) (*Config, error) { return nil, assert.AnError },
+			AllowConnectionWindowIncrease: func(*Conn, uint64) bool { calledAllowConnectionWindowIncrease = true; return true },
+			Tracer: func(context.Context, bool, ConnectionID) qlogwriter.Trace {
+				calledTracer = true
+				return nil
+			},
+		}
+		c2 := c1.Clone()
+		c2.AllowConnectionWindowIncrease(nil, 1234)
+		require.True(t, calledAllowConnectionWindowIncrease)
+		_, err := c2.GetConfigForClient(&ClientInfo{})
+		require.ErrorIs(t, err, assert.AnError)
+		c2.Tracer(context.Background(), true, protocol.ConnectionID{})
+		require.True(t, calledTracer)
+	})
+
+	t.Run("non-function fields", func(t *testing.T) {
+		c := configWithNonZeroNonFunctionFields(t)
+		require.Equal(t, c, c.Clone())
+	})
+
+	t.Run("returns a copy", func(t *testing.T) {
+		c1 := &Config{MaxIncomingStreams: 100}
+		c2 := c1.Clone()
+		c2.MaxIncomingStreams = 200
+		require.EqualValues(t, 100, c1.MaxIncomingStreams)
+	})
+}
+
+func TestConfigDefaultValues(t *testing.T) {
+	// if set, the values should be copied
+	c := configWithNonZeroNonFunctionFields(t)
+	require.Equal(t, c, populateConfig(c))
+
+	// if not set, some fields use default values
+	c = populateConfig(&Config{})
+	require.Equal(t, protocol.SupportedVersions, c.Versions)
+	require.Equal(t, protocol.DefaultHandshakeIdleTimeout, c.HandshakeIdleTimeout)
+	require.Equal(t, protocol.DefaultIdleTimeout, c.MaxIdleTimeout)
+	require.EqualValues(t, protocol.DefaultInitialMaxStreamData, c.InitialStreamReceiveWindow)
+	require.EqualValues(t, protocol.DefaultMaxReceiveStreamFlowControlWindow, c.MaxStreamReceiveWindow)
+	require.EqualValues(t, protocol.DefaultInitialMaxData, c.InitialConnectionReceiveWindow)
+	require.EqualValues(t, protocol.DefaultMaxReceiveConnectionFlowControlWindow, c.MaxConnectionReceiveWindow)
+	require.EqualValues(t, protocol.DefaultMaxIncomingStreams, c.MaxIncomingStreams)
+	require.EqualValues(t, protocol.DefaultMaxIncomingUniStreams, c.MaxIncomingUniStreams)
+	require.False(t, c.DisablePathMTUDiscovery)
+	require.Nil(t, c.GetConfigForClient)
+}
+
+func TestConfigZeroLimits(t *testing.T) {
+	config := &Config{
+		MaxIncomingStreams:    -1,
+		MaxIncomingUniStreams: -1,
+	}
+	c := populateConfig(config)
+	require.Zero(t, c.MaxIncomingStreams)
+	require.Zero(t, c.MaxIncomingUniStreams)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/conn_id_generator.go b/electron/native/private-transport/third_party/quic-go/conn_id_generator.go
new file mode 100644
index 000000000..133932a6a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/conn_id_generator.go
@@ -0,0 +1,212 @@
+package quic
+
+import (
+	"fmt"
+	"slices"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type connRunnerCallbacks struct {
+	AddConnectionID    func(protocol.ConnectionID)
+	RemoveConnectionID func(protocol.ConnectionID)
+	ReplaceWithClosed  func([]protocol.ConnectionID, []byte, time.Duration)
+}
+
+// The memory address of the Transport is used as the key.
+type connRunners map[connRunner]connRunnerCallbacks
+
+func (cr connRunners) AddConnectionID(id protocol.ConnectionID) {
+	for _, c := range cr {
+		c.AddConnectionID(id)
+	}
+}
+
+func (cr connRunners) RemoveConnectionID(id protocol.ConnectionID) {
+	for _, c := range cr {
+		c.RemoveConnectionID(id)
+	}
+}
+
+func (cr connRunners) ReplaceWithClosed(ids []protocol.ConnectionID, b []byte, expiry time.Duration) {
+	for _, c := range cr {
+		c.ReplaceWithClosed(ids, b, expiry)
+	}
+}
+
+type connIDToRetire struct {
+	t      monotime.Time
+	connID protocol.ConnectionID
+}
+
+type connIDGenerator struct {
+	generator   ConnectionIDGenerator
+	highestSeq  uint64
+	connRunners connRunners
+
+	activeSrcConnIDs        map[uint64]protocol.ConnectionID
+	connIDsToRetire         []connIDToRetire       // sorted by t
+	initialClientDestConnID *protocol.ConnectionID // nil for the client
+
+	statelessResetter *statelessResetter
+
+	queueControlFrame func(wire.Frame)
+}
+
+func newConnIDGenerator(
+	runner connRunner,
+	initialConnectionID protocol.ConnectionID,
+	initialClientDestConnID *protocol.ConnectionID, // nil for the client
+	statelessResetter *statelessResetter,
+	callbacks connRunnerCallbacks,
+	queueControlFrame func(wire.Frame),
+	generator ConnectionIDGenerator,
+) *connIDGenerator {
+	m := &connIDGenerator{
+		generator:         generator,
+		activeSrcConnIDs:  make(map[uint64]protocol.ConnectionID),
+		statelessResetter: statelessResetter,
+		connRunners:       map[connRunner]connRunnerCallbacks{runner: callbacks},
+		queueControlFrame: queueControlFrame,
+	}
+	m.activeSrcConnIDs[0] = initialConnectionID
+	m.initialClientDestConnID = initialClientDestConnID
+	return m
+}
+
+func (m *connIDGenerator) SetMaxActiveConnIDs(limit uint64) error {
+	if m.generator.ConnectionIDLen() == 0 {
+		return nil
+	}
+	// The active_connection_id_limit transport parameter is the number of
+	// connection IDs the peer will store. This limit includes the connection ID
+	// used during the handshake, and the one sent in the preferred_address
+	// transport parameter.
+	// We currently don't send the preferred_address transport parameter,
+	// so we can issue (limit - 1) connection IDs.
+	for i := uint64(len(m.activeSrcConnIDs)); i < min(limit, protocol.MaxIssuedConnectionIDs); i++ {
+		if err := m.issueNewConnID(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (m *connIDGenerator) Retire(seq uint64, sentWithDestConnID protocol.ConnectionID, expiry monotime.Time) error {
+	if seq > m.highestSeq {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: fmt.Sprintf("retired connection ID %d (highest issued: %d)", seq, m.highestSeq),
+		}
+	}
+	connID, ok := m.activeSrcConnIDs[seq]
+	// We might already have deleted this connection ID, if this is a duplicate frame.
+	if !ok {
+		return nil
+	}
+	if connID == sentWithDestConnID {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: fmt.Sprintf("retired connection ID %d (%s), which was used as the Destination Connection ID on this packet", seq, connID),
+		}
+	}
+	m.queueConnIDForRetiring(connID, expiry)
+
+	delete(m.activeSrcConnIDs, seq)
+	// Don't issue a replacement for the initial connection ID.
+	if seq == 0 {
+		return nil
+	}
+	return m.issueNewConnID()
+}
+
+func (m *connIDGenerator) queueConnIDForRetiring(connID protocol.ConnectionID, expiry monotime.Time) {
+	idx := slices.IndexFunc(m.connIDsToRetire, func(c connIDToRetire) bool {
+		return c.t.After(expiry)
+	})
+	if idx == -1 {
+		idx = len(m.connIDsToRetire)
+	}
+	m.connIDsToRetire = slices.Insert(m.connIDsToRetire, idx, connIDToRetire{t: expiry, connID: connID})
+}
+
+func (m *connIDGenerator) issueNewConnID() error {
+	connID, err := m.generator.GenerateConnectionID()
+	if err != nil {
+		return err
+	}
+	m.activeSrcConnIDs[m.highestSeq+1] = connID
+	m.connRunners.AddConnectionID(connID)
+	m.queueControlFrame(&wire.NewConnectionIDFrame{
+		SequenceNumber:      m.highestSeq + 1,
+		ConnectionID:        connID,
+		StatelessResetToken: m.statelessResetter.GetStatelessResetToken(connID),
+	})
+	m.highestSeq++
+	return nil
+}
+
+func (m *connIDGenerator) SetHandshakeComplete(connIDExpiry monotime.Time) {
+	if m.initialClientDestConnID != nil {
+		m.queueConnIDForRetiring(*m.initialClientDestConnID, connIDExpiry)
+		m.initialClientDestConnID = nil
+	}
+}
+
+func (m *connIDGenerator) RemoveRetiredConnIDs(now monotime.Time) {
+	if len(m.connIDsToRetire) == 0 {
+		return
+	}
+	for _, c := range m.connIDsToRetire {
+		if c.t.After(now) {
+			break
+		}
+		m.connRunners.RemoveConnectionID(c.connID)
+		m.connIDsToRetire = m.connIDsToRetire[1:]
+	}
+}
+
+func (m *connIDGenerator) RemoveAll() {
+	if m.initialClientDestConnID != nil {
+		m.connRunners.RemoveConnectionID(*m.initialClientDestConnID)
+	}
+	for _, connID := range m.activeSrcConnIDs {
+		m.connRunners.RemoveConnectionID(connID)
+	}
+	for _, c := range m.connIDsToRetire {
+		m.connRunners.RemoveConnectionID(c.connID)
+	}
+}
+
+func (m *connIDGenerator) ReplaceWithClosed(connClose []byte, expiry time.Duration) {
+	connIDs := make([]protocol.ConnectionID, 0, len(m.activeSrcConnIDs)+len(m.connIDsToRetire)+1)
+	if m.initialClientDestConnID != nil {
+		connIDs = append(connIDs, *m.initialClientDestConnID)
+	}
+	for _, connID := range m.activeSrcConnIDs {
+		connIDs = append(connIDs, connID)
+	}
+	for _, c := range m.connIDsToRetire {
+		connIDs = append(connIDs, c.connID)
+	}
+	m.connRunners.ReplaceWithClosed(connIDs, connClose, expiry)
+}
+
+func (m *connIDGenerator) AddConnRunner(runner connRunner, r connRunnerCallbacks) {
+	// The transport might have already been added earlier.
+	// This happens if the application migrates back to and old path.
+	if _, ok := m.connRunners[runner]; ok {
+		return
+	}
+	m.connRunners[runner] = r
+	if m.initialClientDestConnID != nil {
+		r.AddConnectionID(*m.initialClientDestConnID)
+	}
+	for _, connID := range m.activeSrcConnIDs {
+		r.AddConnectionID(connID)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/conn_id_generator_test.go b/electron/native/private-transport/third_party/quic-go/conn_id_generator_test.go
new file mode 100644
index 000000000..9eade628d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/conn_id_generator_test.go
@@ -0,0 +1,350 @@
+package quic
+
+import (
+	"math/rand/v2"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestConnIDGeneratorIssueAndRetire(t *testing.T) {
+	t.Run("with initial client destination connection ID", func(t *testing.T) {
+		testConnIDGeneratorIssueAndRetire(t, true)
+	})
+	t.Run("without initial client destination connection ID", func(t *testing.T) {
+		testConnIDGeneratorIssueAndRetire(t, false)
+	})
+}
+
+func testConnIDGeneratorIssueAndRetire(t *testing.T, hasInitialClientDestConnID bool) {
+	var (
+		added   []protocol.ConnectionID
+		removed []protocol.ConnectionID
+	)
+	var queuedFrames []wire.Frame
+	sr := newStatelessResetter(&StatelessResetKey{1, 2, 3, 4})
+	var initialClientDestConnID *protocol.ConnectionID
+	if hasInitialClientDestConnID {
+		connID := protocol.ParseConnectionID([]byte{2, 2, 2, 2})
+		initialClientDestConnID = &connID
+	}
+	g := newConnIDGenerator(
+		&packetHandlerMap{},
+		protocol.ParseConnectionID([]byte{1, 1, 1, 1}),
+		initialClientDestConnID,
+		sr,
+		connRunnerCallbacks{
+			AddConnectionID:    func(c protocol.ConnectionID) { added = append(added, c) },
+			RemoveConnectionID: func(c protocol.ConnectionID) { removed = append(removed, c) },
+			ReplaceWithClosed:  func([]protocol.ConnectionID, []byte, time.Duration) {},
+		},
+		func(f wire.Frame) { queuedFrames = append(queuedFrames, f) },
+		&protocol.DefaultConnectionIDGenerator{ConnLen: 5},
+	)
+
+	require.Empty(t, added)
+	require.NoError(t, g.SetMaxActiveConnIDs(4))
+	require.Len(t, added, 3)
+	require.Len(t, queuedFrames, 3)
+	require.Empty(t, removed)
+	connIDs := make(map[uint64]protocol.ConnectionID)
+	// connection IDs 1, 2 and 3 were issued
+	for i, f := range queuedFrames {
+		ncid := f.(*wire.NewConnectionIDFrame)
+		require.EqualValues(t, i+1, ncid.SequenceNumber)
+		require.Equal(t, ncid.ConnectionID, added[i])
+		require.Equal(t, ncid.StatelessResetToken, sr.GetStatelessResetToken(ncid.ConnectionID))
+		connIDs[ncid.SequenceNumber] = ncid.ConnectionID
+	}
+
+	// completing the handshake retires the initial client destination connection ID
+	added = added[:0]
+	queuedFrames = queuedFrames[:0]
+	now := monotime.Now()
+	g.SetHandshakeComplete(now)
+	require.Empty(t, added)
+	require.Empty(t, queuedFrames)
+	require.Empty(t, removed)
+	g.RemoveRetiredConnIDs(now)
+	if hasInitialClientDestConnID {
+		require.Equal(t, []protocol.ConnectionID{*initialClientDestConnID}, removed)
+		removed = removed[:0]
+	} else {
+		require.Empty(t, removed)
+	}
+
+	// it's invalid to retire a connection ID that hasn't been issued yet
+	err := g.Retire(4, protocol.ParseConnectionID([]byte{3, 3, 3, 3}), monotime.Now())
+	require.ErrorIs(t, &qerr.TransportError{ErrorCode: qerr.ProtocolViolation}, err)
+	require.ErrorContains(t, err, "retired connection ID 4 (highest issued: 3)")
+	// it's invalid to retire a connection ID in a packet that uses that connection ID
+	err = g.Retire(3, connIDs[3], monotime.Now())
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+	require.ErrorContains(t, err, "was used as the Destination Connection ID on this packet")
+
+	// retiring a connection ID makes us issue a new one
+	require.NoError(t, g.Retire(2, protocol.ParseConnectionID([]byte{3, 3, 3, 3}), monotime.Now()))
+	g.RemoveRetiredConnIDs(monotime.Now())
+	require.Equal(t, []protocol.ConnectionID{connIDs[2]}, removed)
+	require.Len(t, queuedFrames, 1)
+	require.EqualValues(t, 4, queuedFrames[0].(*wire.NewConnectionIDFrame).SequenceNumber)
+	queuedFrames = queuedFrames[:0]
+	removed = removed[:0]
+
+	// duplicate retirements don't do anything
+	require.NoError(t, g.Retire(2, protocol.ParseConnectionID([]byte{3, 3, 3, 3}), monotime.Now()))
+	g.RemoveRetiredConnIDs(monotime.Now())
+	require.Empty(t, queuedFrames)
+	require.Empty(t, removed)
+}
+
+func TestConnIDGeneratorRetiring(t *testing.T) {
+	initialConnID := protocol.ParseConnectionID([]byte{2, 2, 2, 2})
+	var added, removed []protocol.ConnectionID
+	g := newConnIDGenerator(
+		&packetHandlerMap{},
+		protocol.ParseConnectionID([]byte{1, 1, 1, 1}),
+		&initialConnID,
+		newStatelessResetter(&StatelessResetKey{1, 2, 3, 4}),
+		connRunnerCallbacks{
+			AddConnectionID:    func(c protocol.ConnectionID) { added = append(added, c) },
+			RemoveConnectionID: func(c protocol.ConnectionID) { removed = append(removed, c) },
+			ReplaceWithClosed:  func([]protocol.ConnectionID, []byte, time.Duration) {},
+		},
+		func(f wire.Frame) {},
+		&protocol.DefaultConnectionIDGenerator{ConnLen: 5},
+	)
+	require.NoError(t, g.SetMaxActiveConnIDs(6))
+	require.Empty(t, removed)
+	require.Len(t, added, 5)
+
+	now := monotime.Now()
+
+	retirements := map[protocol.ConnectionID]monotime.Time{}
+	t1 := now.Add(time.Duration(rand.IntN(1000)) * time.Millisecond)
+	retirements[initialConnID] = t1
+	g.SetHandshakeComplete(t1)
+	for i := range 5 {
+		t2 := now.Add(time.Duration(rand.IntN(1000)) * time.Millisecond)
+		require.NoError(t, g.Retire(uint64(i+1), protocol.ParseConnectionID([]byte{9, 9, 9, 9}), t2))
+		retirements[added[i]] = t2
+
+		if rand.IntN(2) == 0 {
+			now = now.Add(time.Duration(rand.IntN(500)) * time.Millisecond)
+			g.RemoveRetiredConnIDs(now)
+			for _, r := range removed {
+				require.Contains(t, retirements, r)
+				require.LessOrEqual(t, retirements[r], now)
+				delete(retirements, r)
+			}
+			removed = removed[:0]
+			for _, r := range retirements {
+				require.Greater(t, r, now)
+			}
+		}
+	}
+}
+
+func TestConnIDGeneratorRemoveAll(t *testing.T) {
+	t.Run("with initial client destination connection ID", func(t *testing.T) {
+		testConnIDGeneratorRemoveAll(t, true)
+	})
+	t.Run("without initial client destination connection ID", func(t *testing.T) {
+		testConnIDGeneratorRemoveAll(t, false)
+	})
+}
+
+func testConnIDGeneratorRemoveAll(t *testing.T, hasInitialClientDestConnID bool) {
+	var initialClientDestConnID *protocol.ConnectionID
+	if hasInitialClientDestConnID {
+		connID := protocol.ParseConnectionID([]byte{2, 2, 2, 2})
+		initialClientDestConnID = &connID
+	}
+	var (
+		added   []protocol.ConnectionID
+		removed []protocol.ConnectionID
+	)
+	g := newConnIDGenerator(
+		&packetHandlerMap{},
+		protocol.ParseConnectionID([]byte{1, 1, 1, 1}),
+		initialClientDestConnID,
+		newStatelessResetter(&StatelessResetKey{1, 2, 3, 4}),
+		connRunnerCallbacks{
+			AddConnectionID:    func(c protocol.ConnectionID) { added = append(added, c) },
+			RemoveConnectionID: func(c protocol.ConnectionID) { removed = append(removed, c) },
+			ReplaceWithClosed:  func([]protocol.ConnectionID, []byte, time.Duration) {},
+		},
+		func(f wire.Frame) {},
+		&protocol.DefaultConnectionIDGenerator{ConnLen: 5},
+	)
+
+	require.NoError(t, g.SetMaxActiveConnIDs(1000))
+	require.Len(t, added, protocol.MaxIssuedConnectionIDs-1)
+
+	g.RemoveAll()
+	if hasInitialClientDestConnID {
+		require.Len(t, removed, protocol.MaxIssuedConnectionIDs+1)
+		require.Contains(t, removed, *initialClientDestConnID)
+	} else {
+		require.Len(t, removed, protocol.MaxIssuedConnectionIDs)
+	}
+	for _, id := range added {
+		require.Contains(t, removed, id)
+	}
+	require.Contains(t, removed, protocol.ParseConnectionID([]byte{1, 1, 1, 1}))
+}
+
+func TestConnIDGeneratorReplaceWithClosed(t *testing.T) {
+	t.Run("with initial client destination connection ID", func(t *testing.T) {
+		testConnIDGeneratorReplaceWithClosed(t, true)
+	})
+	t.Run("without initial client destination connection ID", func(t *testing.T) {
+		testConnIDGeneratorReplaceWithClosed(t, false)
+	})
+}
+
+func testConnIDGeneratorReplaceWithClosed(t *testing.T, hasInitialClientDestConnID bool) {
+	var initialClientDestConnID *protocol.ConnectionID
+	if hasInitialClientDestConnID {
+		connID := protocol.ParseConnectionID([]byte{2, 2, 2, 2})
+		initialClientDestConnID = &connID
+	}
+	var (
+		added        []protocol.ConnectionID
+		replaced     []protocol.ConnectionID
+		replacedWith []byte
+	)
+	g := newConnIDGenerator(
+		&packetHandlerMap{},
+		protocol.ParseConnectionID([]byte{1, 1, 1, 1}),
+		initialClientDestConnID,
+		newStatelessResetter(&StatelessResetKey{1, 2, 3, 4}),
+		connRunnerCallbacks{
+			AddConnectionID:    func(c protocol.ConnectionID) { added = append(added, c) },
+			RemoveConnectionID: func(c protocol.ConnectionID) { t.Fatal("didn't expect conn ID removals") },
+			ReplaceWithClosed: func(connIDs []protocol.ConnectionID, b []byte, _ time.Duration) {
+				replaced = connIDs
+				replacedWith = b
+			},
+		},
+		func(f wire.Frame) {},
+		&protocol.DefaultConnectionIDGenerator{ConnLen: 5},
+	)
+
+	require.NoError(t, g.SetMaxActiveConnIDs(1000))
+	require.Len(t, added, protocol.MaxIssuedConnectionIDs-1)
+	// Retire two of these connection ID.
+	// This makes us issue two more connection IDs.
+	require.NoError(t, g.Retire(3, protocol.ParseConnectionID([]byte{1, 1, 1, 1}), monotime.Now()))
+	require.NoError(t, g.Retire(4, protocol.ParseConnectionID([]byte{1, 1, 1, 1}), monotime.Now()))
+	require.Len(t, added, protocol.MaxIssuedConnectionIDs+1)
+
+	g.ReplaceWithClosed([]byte("foobar"), time.Second)
+	if hasInitialClientDestConnID {
+		require.Len(t, replaced, protocol.MaxIssuedConnectionIDs+3)
+		require.Contains(t, replaced, *initialClientDestConnID)
+	} else {
+		require.Len(t, replaced, protocol.MaxIssuedConnectionIDs+2)
+	}
+	for _, id := range added {
+		require.Contains(t, replaced, id)
+	}
+	require.Contains(t, replaced, protocol.ParseConnectionID([]byte{1, 1, 1, 1}))
+	require.Equal(t, []byte("foobar"), replacedWith)
+}
+
+func TestConnIDGeneratorAddConnRunner(t *testing.T) {
+	initialConnID := protocol.ParseConnectionID([]byte{1, 1, 1, 1})
+	clientDestConnID := protocol.ParseConnectionID([]byte{2, 2, 2, 2})
+
+	type connIDTracker struct {
+		added, removed, replaced []protocol.ConnectionID
+	}
+
+	var tracker1, tracker2, tracker3 connIDTracker
+	runner1 := connRunnerCallbacks{
+		AddConnectionID:    func(c protocol.ConnectionID) { tracker1.added = append(tracker1.added, c) },
+		RemoveConnectionID: func(c protocol.ConnectionID) { tracker1.removed = append(tracker1.removed, c) },
+		ReplaceWithClosed: func(connIDs []protocol.ConnectionID, _ []byte, _ time.Duration) {
+			tracker1.replaced = append(tracker1.replaced, connIDs...)
+		},
+	}
+	runner2 := connRunnerCallbacks{
+		AddConnectionID:    func(c protocol.ConnectionID) { tracker2.added = append(tracker2.added, c) },
+		RemoveConnectionID: func(c protocol.ConnectionID) { tracker2.removed = append(tracker2.removed, c) },
+		ReplaceWithClosed: func(connIDs []protocol.ConnectionID, _ []byte, _ time.Duration) {
+			tracker2.replaced = append(tracker2.replaced, connIDs...)
+		},
+	}
+	runner3 := connRunnerCallbacks{
+		AddConnectionID:    func(c protocol.ConnectionID) { tracker3.added = append(tracker3.added, c) },
+		RemoveConnectionID: func(c protocol.ConnectionID) { tracker3.removed = append(tracker3.removed, c) },
+		ReplaceWithClosed: func(connIDs []protocol.ConnectionID, _ []byte, _ time.Duration) {
+			tracker3.replaced = append(tracker3.replaced, connIDs...)
+		},
+	}
+
+	sr := newStatelessResetter(&StatelessResetKey{1, 2, 3, 4})
+	var queuedFrames []wire.Frame
+
+	tr := &packetHandlerMap{}
+	g := newConnIDGenerator(
+		tr,
+		initialConnID,
+		&clientDestConnID,
+		sr,
+		runner1,
+		func(f wire.Frame) { queuedFrames = append(queuedFrames, f) },
+		&protocol.DefaultConnectionIDGenerator{ConnLen: 5},
+	)
+	require.NoError(t, g.SetMaxActiveConnIDs(3))
+	require.Len(t, tracker1.added, 2)
+
+	// add the second runner - it should get all existing connection IDs
+	g.AddConnRunner(&packetHandlerMap{}, runner2)
+	require.Len(t, tracker1.added, 2) // unchanged
+	require.Len(t, tracker2.added, 4)
+	require.Contains(t, tracker2.added, initialConnID)
+	require.Contains(t, tracker2.added, clientDestConnID)
+	require.Contains(t, tracker2.added, tracker1.added[0])
+	require.Contains(t, tracker2.added, tracker1.added[1])
+
+	// adding the same transport again doesn't do anything
+	trCopy := tr
+	g.AddConnRunner(trCopy, runner3)
+	require.Empty(t, tracker3.added)
+
+	var connIDToRetire protocol.ConnectionID
+	var seqToRetire uint64
+	ncid := queuedFrames[0].(*wire.NewConnectionIDFrame)
+	connIDToRetire = ncid.ConnectionID
+	seqToRetire = ncid.SequenceNumber
+
+	require.NoError(t, g.Retire(seqToRetire, protocol.ParseConnectionID([]byte{3, 3, 3, 3}), monotime.Now()))
+	g.RemoveRetiredConnIDs(monotime.Now())
+	require.Equal(t, []protocol.ConnectionID{connIDToRetire}, tracker1.removed)
+	require.Equal(t, []protocol.ConnectionID{connIDToRetire}, tracker2.removed)
+
+	tracker1.removed = nil
+	tracker2.removed = nil
+	g.SetHandshakeComplete(monotime.Now())
+	g.RemoveRetiredConnIDs(monotime.Now())
+	require.Equal(t, []protocol.ConnectionID{clientDestConnID}, tracker1.removed)
+	require.Equal(t, []protocol.ConnectionID{clientDestConnID}, tracker2.removed)
+
+	g.ReplaceWithClosed([]byte("connection closed"), time.Second)
+	require.True(t, len(tracker1.replaced) > 0)
+	require.Equal(t, tracker1.replaced, tracker2.replaced)
+
+	tracker1.removed = nil
+	tracker2.removed = nil
+	g.RemoveAll()
+	require.NotEmpty(t, tracker1.removed)
+	require.Equal(t, tracker1.removed, tracker2.removed)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/conn_id_manager.go b/electron/native/private-transport/third_party/quic-go/conn_id_manager.go
new file mode 100644
index 000000000..8d08e07c6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/conn_id_manager.go
@@ -0,0 +1,331 @@
+package quic
+
+import (
+	"fmt"
+	"slices"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type newConnID struct {
+	SequenceNumber      uint64
+	ConnectionID        protocol.ConnectionID
+	StatelessResetToken protocol.StatelessResetToken
+}
+
+type connIDManager struct {
+	queue []newConnID
+
+	highestProbingID uint64
+	pathMx           sync.Mutex
+	pathProbing      map[pathID]newConnID // initialized lazily
+
+	handshakeComplete         bool
+	activeSequenceNumber      uint64
+	highestRetired            uint64
+	activeConnectionID        protocol.ConnectionID
+	activeStatelessResetToken *protocol.StatelessResetToken
+
+	// We change the connection ID after sending on average
+	// protocol.PacketsPerConnectionID packets. The actual value is randomized
+	// hide the packet loss rate from on-path observers.
+	rand                   utils.Rand
+	packetsSinceLastChange uint32
+	packetsPerConnectionID uint32
+
+	addStatelessResetToken    func(protocol.StatelessResetToken)
+	removeStatelessResetToken func(protocol.StatelessResetToken)
+	queueControlFrame         func(wire.Frame)
+
+	closed bool
+}
+
+func newConnIDManager(
+	initialDestConnID protocol.ConnectionID,
+	addStatelessResetToken func(protocol.StatelessResetToken),
+	removeStatelessResetToken func(protocol.StatelessResetToken),
+	queueControlFrame func(wire.Frame),
+) *connIDManager {
+	return &connIDManager{
+		activeConnectionID:        initialDestConnID,
+		addStatelessResetToken:    addStatelessResetToken,
+		removeStatelessResetToken: removeStatelessResetToken,
+		queueControlFrame:         queueControlFrame,
+		queue:                     make([]newConnID, 0, protocol.MaxActiveConnectionIDs),
+	}
+}
+
+func (h *connIDManager) AddFromPreferredAddress(connID protocol.ConnectionID, resetToken protocol.StatelessResetToken) error {
+	return h.addConnectionID(1, connID, resetToken)
+}
+
+func (h *connIDManager) Add(f *wire.NewConnectionIDFrame) error {
+	h.pathMx.Lock()
+	defer h.pathMx.Unlock()
+
+	if err := h.add(f); err != nil {
+		return err
+	}
+	if len(h.queue) >= protocol.MaxActiveConnectionIDs {
+		return &qerr.TransportError{ErrorCode: qerr.ConnectionIDLimitError}
+	}
+	return nil
+}
+
+func (h *connIDManager) add(f *wire.NewConnectionIDFrame) error {
+	if h.activeConnectionID.Len() == 0 {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "received NEW_CONNECTION_ID frame but zero-length connection IDs are in use",
+		}
+	}
+	// If the NEW_CONNECTION_ID frame is reordered, such that its sequence number is smaller than the currently active
+	// connection ID or if it was already retired, send the RETIRE_CONNECTION_ID frame immediately.
+	if f.SequenceNumber < max(h.activeSequenceNumber, h.highestProbingID) || f.SequenceNumber < h.highestRetired {
+		h.queueControlFrame(&wire.RetireConnectionIDFrame{
+			SequenceNumber: f.SequenceNumber,
+		})
+		return nil
+	}
+
+	if f.RetirePriorTo != 0 && h.pathProbing != nil {
+		for id, entry := range h.pathProbing {
+			if entry.SequenceNumber < f.RetirePriorTo {
+				h.queueControlFrame(&wire.RetireConnectionIDFrame{
+					SequenceNumber: entry.SequenceNumber,
+				})
+				h.removeStatelessResetToken(entry.StatelessResetToken)
+				delete(h.pathProbing, id)
+			}
+		}
+	}
+	// Retire elements in the queue.
+	// Doesn't retire the active connection ID.
+	if f.RetirePriorTo > h.highestRetired {
+		var newQueue []newConnID
+		for _, entry := range h.queue {
+			if entry.SequenceNumber >= f.RetirePriorTo {
+				newQueue = append(newQueue, entry)
+			} else {
+				h.queueControlFrame(&wire.RetireConnectionIDFrame{SequenceNumber: entry.SequenceNumber})
+			}
+		}
+		h.queue = newQueue
+		h.highestRetired = f.RetirePriorTo
+	}
+
+	if f.SequenceNumber == h.activeSequenceNumber {
+		return nil
+	}
+
+	if err := h.addConnectionID(f.SequenceNumber, f.ConnectionID, f.StatelessResetToken); err != nil {
+		return err
+	}
+
+	// Retire the active connection ID, if necessary.
+	if h.activeSequenceNumber < f.RetirePriorTo {
+		// The queue is guaranteed to have at least one element at this point.
+		h.updateConnectionID()
+	}
+	return nil
+}
+
+func (h *connIDManager) addConnectionID(seq uint64, connID protocol.ConnectionID, resetToken protocol.StatelessResetToken) error {
+	// fast path: add to the end of the queue
+	if len(h.queue) == 0 || h.queue[len(h.queue)-1].SequenceNumber < seq {
+		h.queue = append(h.queue, newConnID{
+			SequenceNumber:      seq,
+			ConnectionID:        connID,
+			StatelessResetToken: resetToken,
+		})
+		return nil
+	}
+
+	// slow path: insert in the middle
+	for i, entry := range h.queue {
+		if entry.SequenceNumber == seq {
+			if entry.ConnectionID != connID {
+				return fmt.Errorf("received conflicting connection IDs for sequence number %d", seq)
+			}
+			if entry.StatelessResetToken != resetToken {
+				return fmt.Errorf("received conflicting stateless reset tokens for sequence number %d", seq)
+			}
+			return nil
+		}
+
+		// insert at the correct position to maintain sorted order
+		if entry.SequenceNumber > seq {
+			h.queue = slices.Insert(h.queue, i, newConnID{
+				SequenceNumber:      seq,
+				ConnectionID:        connID,
+				StatelessResetToken: resetToken,
+			})
+			return nil
+		}
+	}
+	return nil // unreachable
+}
+
+func (h *connIDManager) updateConnectionID() {
+	h.assertNotClosed()
+	h.queueControlFrame(&wire.RetireConnectionIDFrame{
+		SequenceNumber: h.activeSequenceNumber,
+	})
+	h.highestRetired = max(h.highestRetired, h.activeSequenceNumber)
+	if h.activeStatelessResetToken != nil {
+		h.removeStatelessResetToken(*h.activeStatelessResetToken)
+	}
+
+	front := h.queue[0]
+	h.queue = h.queue[1:]
+	h.activeSequenceNumber = front.SequenceNumber
+	h.activeConnectionID = front.ConnectionID
+	h.activeStatelessResetToken = &front.StatelessResetToken
+	h.packetsSinceLastChange = 0
+	h.packetsPerConnectionID = protocol.PacketsPerConnectionID/2 + uint32(h.rand.Int31n(protocol.PacketsPerConnectionID))
+	h.addStatelessResetToken(*h.activeStatelessResetToken)
+}
+
+func (h *connIDManager) Close() {
+	h.pathMx.Lock()
+	defer h.pathMx.Unlock()
+
+	h.closed = true
+	if h.activeStatelessResetToken != nil {
+		h.removeStatelessResetToken(*h.activeStatelessResetToken)
+	}
+	for _, entry := range h.pathProbing {
+		h.removeStatelessResetToken(entry.StatelessResetToken)
+	}
+	clear(h.pathProbing)
+}
+
+// is called when the server performs a Retry
+// and when the server changes the connection ID in the first Initial sent
+func (h *connIDManager) ChangeInitialConnID(newConnID protocol.ConnectionID) {
+	if h.activeSequenceNumber != 0 {
+		panic("expected first connection ID to have sequence number 0")
+	}
+	h.activeConnectionID = newConnID
+}
+
+// is called when the server provides a stateless reset token in the transport parameters
+func (h *connIDManager) SetStatelessResetToken(token protocol.StatelessResetToken) {
+	h.assertNotClosed()
+	if h.activeSequenceNumber != 0 {
+		panic("expected first connection ID to have sequence number 0")
+	}
+	h.activeStatelessResetToken = &token
+	h.addStatelessResetToken(token)
+}
+
+func (h *connIDManager) SentPacket() {
+	h.packetsSinceLastChange++
+}
+
+func (h *connIDManager) shouldUpdateConnID() bool {
+	if !h.handshakeComplete {
+		return false
+	}
+	// initiate the first change as early as possible (after handshake completion)
+	if len(h.queue) > 0 && h.activeSequenceNumber == 0 {
+		return true
+	}
+	// For later changes, only change if
+	// 1. The queue of connection IDs is filled more than 50%.
+	// 2. We sent at least PacketsPerConnectionID packets
+	return 2*len(h.queue) >= protocol.MaxActiveConnectionIDs &&
+		h.packetsSinceLastChange >= h.packetsPerConnectionID
+}
+
+func (h *connIDManager) Get() protocol.ConnectionID {
+	h.assertNotClosed()
+	if h.shouldUpdateConnID() {
+		h.updateConnectionID()
+	}
+	return h.activeConnectionID
+}
+
+func (h *connIDManager) SetHandshakeComplete() {
+	h.handshakeComplete = true
+}
+
+// GetConnIDForPath retrieves a connection ID for a new path (i.e. not the active one).
+// Once a connection ID is allocated for a path, it cannot be used for a different path.
+// When called with the same pathID, it will return the same connection ID,
+// unless the peer requested that this connection ID be retired.
+func (h *connIDManager) GetConnIDForPath(id pathID) (protocol.ConnectionID, bool) {
+	h.pathMx.Lock()
+	defer h.pathMx.Unlock()
+
+	h.assertNotClosed()
+	// if we're using zero-length connection IDs, we don't need to change the connection ID
+	if h.activeConnectionID.Len() == 0 {
+		return protocol.ConnectionID{}, true
+	}
+
+	if h.pathProbing == nil {
+		h.pathProbing = make(map[pathID]newConnID)
+	}
+	entry, ok := h.pathProbing[id]
+	if ok {
+		return entry.ConnectionID, true
+	}
+	if len(h.queue) == 0 {
+		return protocol.ConnectionID{}, false
+	}
+	front := h.queue[0]
+	h.queue = h.queue[1:]
+	h.pathProbing[id] = front
+	h.highestProbingID = front.SequenceNumber
+	h.addStatelessResetToken(front.StatelessResetToken)
+	return front.ConnectionID, true
+}
+
+func (h *connIDManager) RetireConnIDForPath(pathID pathID) {
+	h.pathMx.Lock()
+	defer h.pathMx.Unlock()
+
+	entry, ok := h.pathProbing[pathID]
+	if !ok {
+		return
+	}
+	h.queueControlFrame(&wire.RetireConnectionIDFrame{
+		SequenceNumber: entry.SequenceNumber,
+	})
+	h.removeStatelessResetToken(entry.StatelessResetToken)
+	delete(h.pathProbing, pathID)
+}
+
+func (h *connIDManager) IsActiveStatelessResetToken(token protocol.StatelessResetToken) bool {
+	h.pathMx.Lock()
+	defer h.pathMx.Unlock()
+
+	if h.activeStatelessResetToken != nil {
+		if *h.activeStatelessResetToken == token {
+			return true
+		}
+	}
+	if h.pathProbing != nil {
+		for _, entry := range h.pathProbing {
+			if entry.StatelessResetToken == token {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// Using the connIDManager after it has been closed can have disastrous effects:
+// If the connection ID is rotated, a new entry would be inserted into the packet handler map,
+// leading to a memory leak of the connection struct.
+// See https://github.com/quic-go/quic-go/pull/4852 for more details.
+func (h *connIDManager) assertNotClosed() {
+	if h.closed {
+		panic("connection ID manager is closed")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/conn_id_manager_test.go b/electron/native/private-transport/third_party/quic-go/conn_id_manager_test.go
new file mode 100644
index 000000000..183927457
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/conn_id_manager_test.go
@@ -0,0 +1,435 @@
+package quic
+
+import (
+	"crypto/rand"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestConnIDManagerInitialConnID(t *testing.T) {
+	m := newConnIDManager(protocol.ParseConnectionID([]byte{1, 2, 3, 4}), nil, nil, nil)
+	require.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4}), m.Get())
+	require.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4}), m.Get())
+	m.ChangeInitialConnID(protocol.ParseConnectionID([]byte{5, 6, 7, 8}))
+	require.Equal(t, protocol.ParseConnectionID([]byte{5, 6, 7, 8}), m.Get())
+}
+
+func TestConnIDManagerAddConnIDs(t *testing.T) {
+	m := newConnIDManager(
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		func(protocol.StatelessResetToken) {},
+		func(protocol.StatelessResetToken) {},
+		func(wire.Frame) {},
+	)
+	f1 := &wire.NewConnectionIDFrame{
+		SequenceNumber:      1,
+		ConnectionID:        protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		StatelessResetToken: protocol.StatelessResetToken{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb, 0xc, 0xd, 0xe},
+	}
+	f2 := &wire.NewConnectionIDFrame{
+		SequenceNumber:      2,
+		ConnectionID:        protocol.ParseConnectionID([]byte{0xba, 0xad, 0xf0, 0x0d}),
+		StatelessResetToken: protocol.StatelessResetToken{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb, 0xc, 0xd, 0xe},
+	}
+	require.NoError(t, m.Add(f2))
+	require.NoError(t, m.Add(f1)) // receiving reordered frames is fine
+	require.NoError(t, m.Add(f2)) // receiving a duplicate is fine
+
+	require.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4}), m.Get())
+	m.updateConnectionID()
+	require.Equal(t, protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}), m.Get())
+	m.updateConnectionID()
+	require.Equal(t, protocol.ParseConnectionID([]byte{0xba, 0xad, 0xf0, 0x0d}), m.Get())
+
+	require.NoError(t, m.Add(f2)) // receiving a duplicate for the current connection ID is fine as well
+	require.Equal(t, protocol.ParseConnectionID([]byte{0xba, 0xad, 0xf0, 0x0d}), m.Get())
+
+	// receiving mismatching connection IDs is not fine
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      3,
+		ConnectionID:        protocol.ParseConnectionID([]byte{1, 2, 3, 4}), // mismatching connection ID
+		StatelessResetToken: protocol.StatelessResetToken{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb, 0xc, 0xd, 0xe},
+	}))
+	require.EqualError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      3,
+		ConnectionID:        protocol.ParseConnectionID([]byte{2, 3, 4, 5}), // mismatching connection ID
+		StatelessResetToken: protocol.StatelessResetToken{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb, 0xc, 0xd, 0xe},
+	}), "received conflicting connection IDs for sequence number 3")
+	// receiving mismatching stateless reset tokens is not fine either
+	require.EqualError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      3,
+		ConnectionID:        protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		StatelessResetToken: protocol.StatelessResetToken{1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb, 0xc, 0xd, 0xe, 0},
+	}), "received conflicting stateless reset tokens for sequence number 3")
+}
+
+func TestConnIDManagerLimit(t *testing.T) {
+	m := newConnIDManager(
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		func(protocol.StatelessResetToken) {},
+		func(protocol.StatelessResetToken) {},
+		func(f wire.Frame) {},
+	)
+	for i := uint8(1); i < protocol.MaxActiveConnectionIDs; i++ {
+		require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+			SequenceNumber:      uint64(i),
+			ConnectionID:        protocol.ParseConnectionID([]byte{i, i, i, i}),
+			StatelessResetToken: protocol.StatelessResetToken{i, i, i, i, i, i, i, i, i, i, i, i, i, i, i, i},
+		}))
+	}
+	require.Equal(t, &qerr.TransportError{ErrorCode: qerr.ConnectionIDLimitError}, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      uint64(9999),
+		ConnectionID:        protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		StatelessResetToken: protocol.StatelessResetToken{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
+	}))
+}
+
+func TestConnIDManagerRetiringConnectionIDs(t *testing.T) {
+	var frameQueue []wire.Frame
+	m := newConnIDManager(
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		func(protocol.StatelessResetToken) {},
+		func(protocol.StatelessResetToken) {},
+		func(f wire.Frame) { frameQueue = append(frameQueue, f) },
+	)
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber: 10,
+		ConnectionID:   protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+	}))
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber: 13,
+		ConnectionID:   protocol.ParseConnectionID([]byte{2, 3, 4, 5}),
+	}))
+	require.Empty(t, frameQueue)
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		RetirePriorTo:  14,
+		SequenceNumber: 17,
+		ConnectionID:   protocol.ParseConnectionID([]byte{3, 4, 5, 6}),
+	}))
+	require.Equal(t, []wire.Frame{
+		&wire.RetireConnectionIDFrame{SequenceNumber: 10},
+		&wire.RetireConnectionIDFrame{SequenceNumber: 13},
+		&wire.RetireConnectionIDFrame{SequenceNumber: 0},
+	}, frameQueue)
+	require.Equal(t, protocol.ParseConnectionID([]byte{3, 4, 5, 6}), m.Get())
+	frameQueue = nil
+
+	// a reordered connection ID is immediately retired
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber: 12,
+		ConnectionID:   protocol.ParseConnectionID([]byte{5, 6, 7, 8}),
+	}))
+	require.Equal(t, []wire.Frame{&wire.RetireConnectionIDFrame{SequenceNumber: 12}}, frameQueue)
+	require.Equal(t, protocol.ParseConnectionID([]byte{3, 4, 5, 6}), m.Get())
+}
+
+func TestConnIDManagerHandshakeCompletion(t *testing.T) {
+	var frameQueue []wire.Frame
+	var addedTokens, removedTokens []protocol.StatelessResetToken
+	m := newConnIDManager(
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		func(token protocol.StatelessResetToken) { addedTokens = append(addedTokens, token) },
+		func(token protocol.StatelessResetToken) { removedTokens = append(removedTokens, token) },
+		func(f wire.Frame) { frameQueue = append(frameQueue, f) },
+	)
+	m.SetStatelessResetToken(protocol.StatelessResetToken{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1})
+	require.Equal(t, []protocol.StatelessResetToken{{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1}}, addedTokens)
+	require.Empty(t, removedTokens)
+
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      1,
+		ConnectionID:        protocol.ParseConnectionID([]byte{4, 3, 2, 1}),
+		StatelessResetToken: protocol.StatelessResetToken{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1},
+	}))
+	require.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4}), m.Get())
+	m.SetHandshakeComplete()
+	require.Equal(t, protocol.ParseConnectionID([]byte{4, 3, 2, 1}), m.Get())
+	require.Equal(t, []wire.Frame{&wire.RetireConnectionIDFrame{SequenceNumber: 0}}, frameQueue)
+	require.Equal(t, []protocol.StatelessResetToken{{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1}}, removedTokens)
+}
+
+func TestConnIDManagerConnIDRotation(t *testing.T) {
+	toToken := func(connID protocol.ConnectionID) protocol.StatelessResetToken {
+		var token protocol.StatelessResetToken
+		copy(token[:], connID.Bytes())
+		copy(token[connID.Len():], connID.Bytes())
+		return token
+	}
+
+	var frameQueue []wire.Frame
+	var addedTokens, removedTokens []protocol.StatelessResetToken
+	m := newConnIDManager(
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		func(token protocol.StatelessResetToken) { addedTokens = append(addedTokens, token) },
+		func(token protocol.StatelessResetToken) { removedTokens = append(removedTokens, token) },
+		func(f wire.Frame) { frameQueue = append(frameQueue, f) },
+	)
+	// the first connection ID is used as soon as the handshake is complete
+	m.SetHandshakeComplete()
+	firstConnID := protocol.ParseConnectionID([]byte{4, 3, 2, 1})
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      1,
+		ConnectionID:        firstConnID,
+		StatelessResetToken: toToken(protocol.ParseConnectionID([]byte{4, 3, 2, 1})),
+	}))
+	require.Equal(t, firstConnID, m.Get())
+	frameQueue = nil
+	require.True(t, m.IsActiveStatelessResetToken(toToken(firstConnID)))
+	require.Equal(t, addedTokens, []protocol.StatelessResetToken{toToken(firstConnID)})
+	addedTokens = addedTokens[:0]
+
+	// Note that we're missing the connection ID with sequence number 2.
+	// It will be received later.
+	var queuedConnIDs []protocol.ConnectionID
+	for i := range protocol.MaxActiveConnectionIDs - 1 {
+		b := make([]byte, 4)
+		rand.Read(b)
+		connID := protocol.ParseConnectionID(b)
+		queuedConnIDs = append(queuedConnIDs, connID)
+		require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+			SequenceNumber:      uint64(3 + i),
+			ConnectionID:        connID,
+			StatelessResetToken: toToken(connID),
+		}))
+		require.False(t, m.IsActiveStatelessResetToken(toToken(connID)))
+	}
+
+	var counter int
+	for {
+		require.Empty(t, frameQueue)
+		m.SentPacket()
+		counter++
+		if connID := m.Get(); connID != firstConnID {
+			require.Equal(t, queuedConnIDs[0], m.Get())
+			require.Equal(t, []wire.Frame{&wire.RetireConnectionIDFrame{SequenceNumber: 1}}, frameQueue)
+			require.Equal(t, removedTokens, []protocol.StatelessResetToken{toToken(firstConnID)})
+			require.Equal(t, addedTokens, []protocol.StatelessResetToken{toToken(connID)})
+			addedTokens = addedTokens[:0]
+			removedTokens = removedTokens[:0]
+			require.True(t, m.IsActiveStatelessResetToken(toToken(connID)))
+			require.False(t, m.IsActiveStatelessResetToken(toToken(firstConnID)))
+			break
+		}
+		require.True(t, m.IsActiveStatelessResetToken(toToken(firstConnID)))
+		require.Empty(t, addedTokens)
+	}
+	require.GreaterOrEqual(t, counter, protocol.PacketsPerConnectionID/2)
+	require.LessOrEqual(t, counter, protocol.PacketsPerConnectionID*3/2)
+	frameQueue = nil
+
+	// now receive connection ID 2
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber: 2,
+		ConnectionID:   protocol.ParseConnectionID([]byte{2, 3, 4, 5}),
+	}))
+	require.Equal(t, []wire.Frame{&wire.RetireConnectionIDFrame{SequenceNumber: 2}}, frameQueue)
+}
+
+func TestConnIDManagerPathMigration(t *testing.T) {
+	var frameQueue []wire.Frame
+	var addedTokens, removedTokens []protocol.StatelessResetToken
+	m := newConnIDManager(
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		func(token protocol.StatelessResetToken) { addedTokens = append(addedTokens, token) },
+		func(token protocol.StatelessResetToken) { removedTokens = append(removedTokens, token) },
+		func(f wire.Frame) { frameQueue = append(frameQueue, f) },
+	)
+
+	// no connection ID available yet
+	_, ok := m.GetConnIDForPath(1)
+	require.False(t, ok)
+
+	// add two connection IDs
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      1,
+		ConnectionID:        protocol.ParseConnectionID([]byte{4, 3, 2, 1}),
+		StatelessResetToken: protocol.StatelessResetToken{4, 3, 2, 1, 4, 3, 2, 1},
+	}))
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      2,
+		ConnectionID:        protocol.ParseConnectionID([]byte{5, 4, 3, 2}),
+		StatelessResetToken: protocol.StatelessResetToken{5, 4, 3, 2, 5, 4, 3, 2},
+	}))
+	connID, ok := m.GetConnIDForPath(1)
+	require.True(t, ok)
+	require.Equal(t, protocol.ParseConnectionID([]byte{4, 3, 2, 1}), connID)
+	require.Equal(t, []protocol.StatelessResetToken{{4, 3, 2, 1, 4, 3, 2, 1}}, addedTokens)
+	require.Empty(t, removedTokens)
+
+	addedTokens = addedTokens[:0]
+	require.False(t, m.IsActiveStatelessResetToken(protocol.StatelessResetToken{5, 4, 3, 2, 5, 4, 3, 2}))
+	connID, ok = m.GetConnIDForPath(2)
+	require.True(t, ok)
+	require.Equal(t, protocol.ParseConnectionID([]byte{5, 4, 3, 2}), connID)
+	require.Equal(t, []protocol.StatelessResetToken{{5, 4, 3, 2, 5, 4, 3, 2}}, addedTokens)
+	require.Empty(t, removedTokens)
+	require.True(t, m.IsActiveStatelessResetToken(protocol.StatelessResetToken{5, 4, 3, 2, 5, 4, 3, 2}))
+
+	addedTokens = addedTokens[:0]
+	// asking for the connection for path 1 again returns the same connection ID
+	connID, ok = m.GetConnIDForPath(1)
+	require.True(t, ok)
+	require.Equal(t, protocol.ParseConnectionID([]byte{4, 3, 2, 1}), connID)
+	require.Empty(t, addedTokens)
+
+	// if the connection ID is retired, the path will use another connection ID
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      3,
+		RetirePriorTo:       2,
+		ConnectionID:        protocol.ParseConnectionID([]byte{6, 5, 4, 3}),
+		StatelessResetToken: protocol.StatelessResetToken{6, 5, 4, 3, 6, 5, 4, 3},
+	}))
+	require.Len(t, frameQueue, 2)
+	require.Equal(t, []protocol.StatelessResetToken{{4, 3, 2, 1, 4, 3, 2, 1}}, removedTokens)
+	frameQueue = nil
+	removedTokens = removedTokens[:0]
+
+	require.Equal(t, protocol.ParseConnectionID([]byte{6, 5, 4, 3}), m.Get())
+	require.Equal(t, []protocol.StatelessResetToken{{6, 5, 4, 3, 6, 5, 4, 3}}, addedTokens)
+	require.Empty(t, removedTokens)
+	addedTokens = addedTokens[:0]
+
+	// the connection ID is not used for new paths
+	_, ok = m.GetConnIDForPath(3)
+	require.False(t, ok)
+
+	// Manually retiring the connection ID does nothing.
+	// Path 1 doesn't have a connection ID anymore.
+	m.RetireConnIDForPath(1)
+	require.Empty(t, frameQueue)
+	_, ok = m.GetConnIDForPath(1)
+	require.False(t, ok)
+	require.Empty(t, removedTokens)
+
+	// only after a new connection ID is added, it will be used for path 1
+	require.NoError(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      4,
+		ConnectionID:        protocol.ParseConnectionID([]byte{7, 6, 5, 4}),
+		StatelessResetToken: protocol.StatelessResetToken{16, 15, 14, 13},
+	}))
+	connID, ok = m.GetConnIDForPath(1)
+	require.True(t, ok)
+	require.Equal(t, protocol.ParseConnectionID([]byte{7, 6, 5, 4}), connID)
+	require.Equal(t, []protocol.StatelessResetToken{{16, 15, 14, 13}}, addedTokens)
+	require.Empty(t, removedTokens)
+	require.True(t, m.IsActiveStatelessResetToken(protocol.StatelessResetToken{16, 15, 14, 13}))
+
+	// a RETIRE_CONNECTION_ID frame for path 1 is queued when retiring the connection ID
+	m.RetireConnIDForPath(1)
+	require.Equal(t, []wire.Frame{&wire.RetireConnectionIDFrame{SequenceNumber: 4}}, frameQueue)
+	require.Equal(t, []protocol.StatelessResetToken{{16, 15, 14, 13}}, removedTokens)
+	removedTokens = removedTokens[:0]
+	require.False(t, m.IsActiveStatelessResetToken(protocol.StatelessResetToken{16, 15, 14, 13}))
+
+	frameQueue = nil
+	m.Close()
+	require.Equal(t, []protocol.StatelessResetToken{
+		{6, 5, 4, 3, 6, 5, 4, 3}, // currently active connection ID
+		{5, 4, 3, 2, 5, 4, 3, 2}, // path 2
+	}, removedTokens)
+	m.RetireConnIDForPath(2)
+	require.Empty(t, frameQueue)
+}
+
+func TestConnIDManagerZeroLengthConnectionID(t *testing.T) {
+	m := newConnIDManager(
+		protocol.ConnectionID{},
+		func(protocol.StatelessResetToken) {},
+		func(protocol.StatelessResetToken) {},
+		func(f wire.Frame) {},
+	)
+	require.Equal(t, protocol.ConnectionID{}, m.Get())
+	for range 5 * protocol.PacketsPerConnectionID {
+		m.SentPacket()
+		require.Equal(t, protocol.ConnectionID{}, m.Get())
+	}
+
+	// for path probing, we don't need to change the connection ID
+	for id := pathID(1); id < 10; id++ {
+		connID, ok := m.GetConnIDForPath(id)
+		require.True(t, ok)
+		require.Equal(t, protocol.ConnectionID{}, connID)
+	}
+	// retiring a connection ID for a path is also a no-op
+	for id := pathID(1); id < 20; id++ {
+		m.RetireConnIDForPath(id)
+	}
+
+	require.ErrorIs(t, m.Add(&wire.NewConnectionIDFrame{
+		SequenceNumber:      1,
+		ConnectionID:        protocol.ConnectionID{},
+		StatelessResetToken: protocol.StatelessResetToken{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1},
+	}), &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+}
+
+func TestConnIDManagerClose(t *testing.T) {
+	var addedTokens, removedTokens []protocol.StatelessResetToken
+	m := newConnIDManager(
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		func(token protocol.StatelessResetToken) { addedTokens = append(addedTokens, token) },
+		func(token protocol.StatelessResetToken) { removedTokens = append(removedTokens, token) },
+		func(f wire.Frame) {},
+	)
+	m.SetStatelessResetToken(protocol.StatelessResetToken{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1})
+	require.Equal(t, []protocol.StatelessResetToken{{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1}}, addedTokens)
+	require.Empty(t, removedTokens)
+	m.Close()
+	require.Equal(t, []protocol.StatelessResetToken{{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1}}, removedTokens)
+
+	require.Panics(t, func() { m.Get() })
+	require.Panics(t, func() { m.SetStatelessResetToken(protocol.StatelessResetToken{}) })
+}
+
+func BenchmarkConnIDManagerReordered(b *testing.B) {
+	benchmarkConnIDManager(b, true)
+}
+
+func BenchmarkConnIDManagerInOrder(b *testing.B) {
+	benchmarkConnIDManager(b, false)
+}
+
+func benchmarkConnIDManager(b *testing.B, reordered bool) {
+	m := newConnIDManager(
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		func(protocol.StatelessResetToken) {},
+		func(protocol.StatelessResetToken) {},
+		func(f wire.Frame) {},
+	)
+	connIDs := make([]protocol.ConnectionID, 0, protocol.MaxActiveConnectionIDs)
+	statelessResetTokens := make([]protocol.StatelessResetToken, 0, protocol.MaxActiveConnectionIDs)
+	for range protocol.MaxActiveConnectionIDs {
+		b := make([]byte, 8)
+		rand.Read(b)
+		connIDs = append(connIDs, protocol.ParseConnectionID(b))
+		var statelessResetToken protocol.StatelessResetToken
+		rand.Read(statelessResetToken[:])
+		statelessResetTokens = append(statelessResetTokens, statelessResetToken)
+	}
+
+	// 1 -> 3
+	// 2 -> 1
+	// 3 -> 2
+	// 4 -> 4
+	offsets := []int{2, -1, -1, 0}
+
+	b.ResetTimer()
+	for i := range b.N {
+		seq := i
+		if reordered {
+			seq += offsets[i%len(offsets)]
+		}
+		m.Add(&wire.NewConnectionIDFrame{
+			SequenceNumber:      uint64(seq),
+			ConnectionID:        connIDs[i%len(connIDs)],
+			StatelessResetToken: statelessResetTokens[i%len(statelessResetTokens)],
+		})
+		if i > protocol.MaxActiveConnectionIDs-2 {
+			m.updateConnectionID()
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/conn_wrapped_test.go b/electron/native/private-transport/third_party/quic-go/conn_wrapped_test.go
new file mode 100644
index 000000000..6dd8d81fc
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/conn_wrapped_test.go
@@ -0,0 +1,73 @@
+package quic
+
+import "context"
+
+func (c *wrappedConn) run() error {
+	if c.testHooks == nil {
+		return c.Conn.run()
+	}
+	if c.testHooks.run != nil {
+		return c.testHooks.run()
+	}
+	return nil
+}
+
+func (c *wrappedConn) earlyConnReady() <-chan struct{} {
+	if c.testHooks == nil {
+		return c.Conn.earlyConnReady()
+	}
+	if c.testHooks.earlyConnReady != nil {
+		return c.testHooks.earlyConnReady()
+	}
+	return nil
+}
+
+func (c *wrappedConn) Context() context.Context {
+	if c.testHooks == nil {
+		return c.Conn.Context()
+	}
+	if c.testHooks.context != nil {
+		return c.testHooks.context()
+	}
+	return context.Background()
+}
+
+func (c *wrappedConn) HandshakeComplete() <-chan struct{} {
+	if c.testHooks == nil {
+		return c.Conn.HandshakeComplete()
+	}
+	if c.testHooks.handshakeComplete != nil {
+		return c.testHooks.handshakeComplete()
+	}
+	return nil
+}
+
+func (c *wrappedConn) closeWithTransportError(code TransportErrorCode) {
+	if c.testHooks == nil {
+		c.Conn.closeWithTransportError(code)
+		return
+	}
+	if c.testHooks.closeWithTransportError != nil {
+		c.testHooks.closeWithTransportError(code)
+	}
+}
+
+func (c *wrappedConn) destroy(e error) {
+	if c.testHooks == nil {
+		c.Conn.destroy(e)
+		return
+	}
+	if c.testHooks.destroy != nil {
+		c.testHooks.destroy(e)
+	}
+}
+
+func (c *wrappedConn) handlePacket(p receivedPacket) {
+	if c.testHooks == nil {
+		c.Conn.handlePacket(p)
+		return
+	}
+	if c.testHooks.handlePacket != nil {
+		c.testHooks.handlePacket(p)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/connection.go b/electron/native/private-transport/third_party/quic-go/connection.go
new file mode 100644
index 000000000..3d3da7028
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/connection.go
@@ -0,0 +1,3169 @@
+package quic
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"reflect"
+	"slices"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/utils/ringbuffer"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+type unpacker interface {
+	UnpackLongHeader(hdr *wire.Header, data []byte) (*unpackedPacket, error)
+	UnpackShortHeader(rcvTime monotime.Time, data []byte) (protocol.PacketNumber, protocol.PacketNumberLen, protocol.KeyPhaseBit, []byte, error)
+}
+
+type cryptoStreamHandler interface {
+	StartHandshake(context.Context) error
+	ChangeConnectionID(protocol.ConnectionID)
+	SetLargest1RTTAcked(protocol.PacketNumber) error
+	SetHandshakeConfirmed()
+	GetSessionTicket() ([]byte, error)
+	NextEvent() handshake.Event
+	DiscardInitialKeys()
+	HandleMessage([]byte, protocol.EncryptionLevel) error
+	io.Closer
+	ConnectionState() handshake.ConnectionState
+}
+
+type receivedPacket struct {
+	buffer *packetBuffer
+
+	remoteAddr net.Addr
+	rcvTime    monotime.Time
+	data       []byte
+
+	ecn protocol.ECN
+
+	info packetInfo // only valid if the contained IP address is valid
+}
+
+type receivedPacketWithChecksum struct {
+	receivedPacket
+	checksum qlog.DatagramPayloadChecksum
+}
+
+func (p *receivedPacket) Size() protocol.ByteCount { return protocol.ByteCount(len(p.data)) }
+
+func (p *receivedPacket) Clone() *receivedPacket {
+	return &receivedPacket{
+		remoteAddr: p.remoteAddr,
+		rcvTime:    p.rcvTime,
+		data:       p.data,
+		buffer:     p.buffer,
+		ecn:        p.ecn,
+		info:       p.info,
+	}
+}
+
+type connRunner interface {
+	Add(protocol.ConnectionID, packetHandler) bool
+	Remove(protocol.ConnectionID)
+	ReplaceWithClosed([]protocol.ConnectionID, []byte, time.Duration)
+	AddResetToken(protocol.StatelessResetToken, packetHandler)
+	RemoveResetToken(protocol.StatelessResetToken)
+}
+
+type closeError struct {
+	err       error
+	immediate bool
+}
+
+type errCloseForRecreating struct {
+	nextPacketNumber protocol.PacketNumber
+	nextVersion      protocol.Version
+}
+
+func (e *errCloseForRecreating) Error() string {
+	return "closing connection in order to recreate it"
+}
+
+var deadlineSendImmediately = monotime.Time(42 * time.Millisecond) // any value > time.Time{} and before time.Now() is fine
+
+type blockMode uint8
+
+const (
+	// blockModeNone means that the connection is not blocked.
+	blockModeNone blockMode = iota
+	// blockModeCongestionLimited means that the connection is congestion limited.
+	// In that case, we can still send acknowledgments and PTO probe packets.
+	blockModeCongestionLimited
+	// blockModeHardBlocked means that no packet can be sent, under no circumstances. This can happen when:
+	// * the send queue is full
+	// * the SentPacketHandler returns SendNone, e.g. when we are tracking the maximum number of packets
+	// In that case, the timer will be set to the idle timeout.
+	blockModeHardBlocked
+)
+
+// A Conn is a QUIC connection between two peers.
+// Calls to the connection (and to streams) can return the following types of errors:
+//   - [ApplicationError]: for errors triggered by the application running on top of QUIC
+//   - [TransportError]: for errors triggered by the QUIC transport (in many cases a misbehaving peer)
+//   - [IdleTimeoutError]: when the peer goes away unexpectedly (this is a [net.Error] timeout error)
+//   - [HandshakeTimeoutError]: when the cryptographic handshake takes too long (this is a [net.Error] timeout error)
+//   - [StatelessResetError]: when we receive a stateless reset
+//   - [VersionNegotiationError]: returned by the client, when there's no version overlap between the peers
+type Conn struct {
+	// Destination connection ID used during the handshake.
+	// Used to check source connection ID on incoming packets.
+	handshakeDestConnID protocol.ConnectionID
+	// Set for the client. Destination connection ID used on the first Initial sent.
+	origDestConnID protocol.ConnectionID
+	retrySrcConnID *protocol.ConnectionID // only set for the client (and if a Retry was performed)
+
+	srcConnIDLen int
+
+	perspective protocol.Perspective
+	version     protocol.Version
+	config      *Config
+
+	conn      sendConn
+	sendQueue sender
+
+	// lazily initialzed: most connections never migrate
+	pathManager         *pathManager
+	largestRcvdAppData  protocol.PacketNumber
+	pathManagerOutgoing atomic.Pointer[pathManagerOutgoing]
+
+	streamsMap      *streamsMap
+	connIDManager   *connIDManager
+	connIDGenerator *connIDGenerator
+
+	rttStats  *utils.RTTStats
+	connStats utils.ConnectionStats
+
+	cryptoStreamManager   *cryptoStreamManager
+	sentPacketHandler     ackhandler.SentPacketHandler
+	receivedPacketHandler ackhandler.ReceivedPacketHandler
+	retransmissionQueue   *retransmissionQueue
+	framer                *framer
+	connFlowController    *connectionFlowController
+	tokenStoreKey         string                    // only set for the client
+	tokenGenerator        *handshake.TokenGenerator // only set for the server
+
+	unpacker      unpacker
+	frameParser   wire.FrameParser
+	packer        packer
+	mtuDiscoverer *mtuFinder // initialized when the transport parameters are received
+
+	maxPayloadSizeEstimate atomic.Uint32
+
+	initialStream       *initialCryptoStream
+	handshakeStream     *cryptoStream
+	oneRTTStream        *cryptoStream // only set for the server
+	cryptoStreamHandler cryptoStreamHandler
+
+	notifyReceivedPacket chan struct{}
+	sendingScheduled     chan struct{}
+	receivedPacketMx     sync.Mutex
+	receivedPackets      ringbuffer.RingBuffer[receivedPacket]
+
+	// closeChan is used to notify the run loop that it should terminate
+	closeChan chan struct{}
+	closeErr  atomic.Pointer[closeError]
+
+	ctx                   context.Context
+	ctxCancel             context.CancelCauseFunc
+	handshakeCompleteChan chan struct{}
+
+	undecryptablePackets          []receivedPacketWithChecksum // undecryptable packets, waiting for a change in encryption level
+	undecryptablePacketsToProcess []receivedPacketWithChecksum
+
+	earlyConnReadyChan chan struct{}
+	sentFirstPacket    bool
+	droppedInitialKeys bool
+	handshakeComplete  bool
+	handshakeConfirmed bool
+
+	receivedRetry       bool
+	versionNegotiated   bool
+	receivedFirstPacket bool
+
+	blocked blockMode
+
+	// the minimum of the max_idle_timeout values advertised by both endpoints
+	idleTimeout  time.Duration
+	creationTime monotime.Time
+	// The idle timeout is set based on the max of the time we received the last packet...
+	lastPacketReceivedTime monotime.Time
+	// ... and the time we sent a new ack-eliciting packet after receiving a packet.
+	firstAckElicitingPacketAfterIdleSentTime monotime.Time
+	// pacingDeadline is the time when the next packet should be sent
+	pacingDeadline monotime.Time
+
+	peerParams *wire.TransportParameters
+
+	timer *time.Timer
+	// keepAlivePingSent stores whether a keep alive PING is in flight.
+	// It is reset as soon as we receive a packet from the peer.
+	keepAlivePingSent bool
+	keepAliveInterval time.Duration
+
+	datagramQueue *datagramQueue
+
+	connStateMutex sync.Mutex
+	connState      ConnectionState
+
+	logID     string
+	qlogTrace qlogwriter.Trace
+	qlogger   qlogwriter.Recorder
+	logger    utils.Logger
+}
+
+var _ streamSender = &Conn{}
+
+type connTestHooks struct {
+	run                     func() error
+	earlyConnReady          func() <-chan struct{}
+	context                 func() context.Context
+	handshakeComplete       func() <-chan struct{}
+	closeWithTransportError func(TransportErrorCode)
+	destroy                 func(error)
+	handlePacket            func(receivedPacket)
+}
+
+type wrappedConn struct {
+	testHooks *connTestHooks
+	*Conn
+}
+
+var newConnection = func(
+	ctx context.Context,
+	ctxCancel context.CancelCauseFunc,
+	conn sendConn,
+	runner connRunner,
+	origDestConnID protocol.ConnectionID,
+	retrySrcConnID *protocol.ConnectionID,
+	clientDestConnID protocol.ConnectionID,
+	destConnID protocol.ConnectionID,
+	srcConnID protocol.ConnectionID,
+	connIDGenerator ConnectionIDGenerator,
+	statelessResetter *statelessResetter,
+	conf *Config,
+	tlsConf *tls.Config,
+	tokenGenerator *handshake.TokenGenerator,
+	clientAddressValidated bool,
+	rtt time.Duration,
+	qlogTrace qlogwriter.Trace,
+	logger utils.Logger,
+	v protocol.Version,
+) *wrappedConn {
+	s := &Conn{
+		ctx:                 ctx,
+		ctxCancel:           ctxCancel,
+		conn:                conn,
+		config:              conf,
+		handshakeDestConnID: destConnID,
+		srcConnIDLen:        srcConnID.Len(),
+		tokenGenerator:      tokenGenerator,
+		oneRTTStream:        newCryptoStream(),
+		perspective:         protocol.PerspectiveServer,
+		qlogTrace:           qlogTrace,
+		logger:              logger,
+		version:             v,
+	}
+	if qlogTrace != nil {
+		s.qlogger = qlogTrace.AddProducer()
+	}
+	if origDestConnID.Len() > 0 {
+		s.logID = origDestConnID.String()
+	} else {
+		s.logID = destConnID.String()
+	}
+	s.connIDManager = newConnIDManager(
+		destConnID,
+		func(token protocol.StatelessResetToken) { runner.AddResetToken(token, s) },
+		runner.RemoveResetToken,
+		s.queueControlFrame,
+	)
+	s.connIDGenerator = newConnIDGenerator(
+		runner,
+		srcConnID,
+		&clientDestConnID,
+		statelessResetter,
+		connRunnerCallbacks{
+			AddConnectionID:    func(connID protocol.ConnectionID) { runner.Add(connID, s) },
+			RemoveConnectionID: runner.Remove,
+			ReplaceWithClosed:  runner.ReplaceWithClosed,
+		},
+		s.queueControlFrame,
+		connIDGenerator,
+	)
+	s.preSetup()
+	s.rttStats.SetInitialRTT(rtt)
+	s.sentPacketHandler = ackhandler.NewSentPacketHandler(
+		0,
+		protocol.ByteCount(s.config.InitialPacketSize),
+		s.rttStats,
+		&s.connStats,
+		clientAddressValidated,
+		s.conn.capabilities().ECN,
+		s.receivedPacketHandler.IgnorePacketsBelow,
+		s.perspective,
+		s.qlogger,
+		s.logger,
+	)
+	s.maxPayloadSizeEstimate.Store(uint32(estimateMaxPayloadSize(protocol.ByteCount(s.config.InitialPacketSize))))
+	statelessResetToken := statelessResetter.GetStatelessResetToken(srcConnID)
+	params := &wire.TransportParameters{
+		InitialMaxStreamDataBidiLocal:   protocol.ByteCount(s.config.InitialStreamReceiveWindow),
+		InitialMaxStreamDataBidiRemote:  protocol.ByteCount(s.config.InitialStreamReceiveWindow),
+		InitialMaxStreamDataUni:         protocol.ByteCount(s.config.InitialStreamReceiveWindow),
+		InitialMaxData:                  protocol.ByteCount(s.config.InitialConnectionReceiveWindow),
+		MaxIdleTimeout:                  s.config.MaxIdleTimeout,
+		MaxBidiStreamNum:                protocol.StreamNum(s.config.MaxIncomingStreams),
+		MaxUniStreamNum:                 protocol.StreamNum(s.config.MaxIncomingUniStreams),
+		MaxAckDelay:                     protocol.MaxAckDelayInclGranularity,
+		AckDelayExponent:                protocol.AckDelayExponent,
+		MaxUDPPayloadSize:               protocol.MaxPacketBufferSize,
+		StatelessResetToken:             &statelessResetToken,
+		OriginalDestinationConnectionID: origDestConnID,
+		// For interoperability with quic-go versions before May 2023, this value must be set to a value
+		// different from protocol.DefaultActiveConnectionIDLimit.
+		// If set to the default value, it will be omitted from the transport parameters, which will make
+		// old quic-go versions interpret it as 0, instead of the default value of 2.
+		// See https://github.com/quic-go/quic-go/pull/3806.
+		ActiveConnectionIDLimit:   protocol.MaxActiveConnectionIDs,
+		InitialSourceConnectionID: srcConnID,
+		RetrySourceConnectionID:   retrySrcConnID,
+		EnableResetStreamAt:       conf.EnableStreamResetPartialDelivery,
+	}
+	if s.config.EnableDatagrams {
+		params.MaxDatagramFrameSize = wire.MaxDatagramSize
+	} else {
+		params.MaxDatagramFrameSize = protocol.InvalidByteCount
+	}
+	if s.qlogger != nil {
+		s.qlogTransportParameters(params, protocol.PerspectiveServer, false)
+	}
+	cs := handshake.NewCryptoSetupServer(
+		clientDestConnID,
+		conn.LocalAddr(),
+		conn.RemoteAddr(),
+		params,
+		tlsConf,
+		conf.Allow0RTT,
+		s.rttStats,
+		s.qlogger,
+		logger,
+		s.version,
+	)
+	s.cryptoStreamHandler = cs
+	s.packer = newPacketPacker(srcConnID, s.connIDManager.Get, s.initialStream, s.handshakeStream, s.sentPacketHandler, s.retransmissionQueue, cs, s.framer, &s.receivedPacketHandler, s.datagramQueue, s.perspective)
+	s.unpacker = newPacketUnpacker(cs, s.srcConnIDLen)
+	s.cryptoStreamManager = newCryptoStreamManager(s.initialStream, s.handshakeStream, s.oneRTTStream)
+	return &wrappedConn{Conn: s}
+}
+
+// declare this as a variable, such that we can it mock it in the tests
+var newClientConnection = func(
+	ctx context.Context,
+	conn sendConn,
+	runner connRunner,
+	destConnID protocol.ConnectionID,
+	srcConnID protocol.ConnectionID,
+	connIDGenerator ConnectionIDGenerator,
+	statelessResetter *statelessResetter,
+	conf *Config,
+	tlsConf *tls.Config,
+	initialPacketNumber protocol.PacketNumber,
+	enable0RTT bool,
+	hasNegotiatedVersion bool,
+	qlogTrace qlogwriter.Trace,
+	logger utils.Logger,
+	v protocol.Version,
+) *wrappedConn {
+	s := &Conn{
+		conn:                conn,
+		config:              conf,
+		origDestConnID:      destConnID,
+		handshakeDestConnID: destConnID,
+		srcConnIDLen:        srcConnID.Len(),
+		perspective:         protocol.PerspectiveClient,
+		logID:               destConnID.String(),
+		logger:              logger,
+		qlogTrace:           qlogTrace,
+		versionNegotiated:   hasNegotiatedVersion,
+		version:             v,
+	}
+	if qlogTrace != nil {
+		s.qlogger = qlogTrace.AddProducer()
+	}
+	if s.qlogger != nil {
+		var srcAddr, destAddr *net.UDPAddr
+		if addr, ok := conn.LocalAddr().(*net.UDPAddr); ok {
+			srcAddr = addr
+		}
+		if addr, ok := conn.RemoteAddr().(*net.UDPAddr); ok {
+			destAddr = addr
+		}
+		s.qlogger.RecordEvent(startedConnectionEvent(srcAddr, destAddr))
+	}
+	s.connIDManager = newConnIDManager(
+		destConnID,
+		func(token protocol.StatelessResetToken) { runner.AddResetToken(token, s) },
+		runner.RemoveResetToken,
+		s.queueControlFrame,
+	)
+	s.connIDGenerator = newConnIDGenerator(
+		runner,
+		srcConnID,
+		nil,
+		statelessResetter,
+		connRunnerCallbacks{
+			AddConnectionID:    func(connID protocol.ConnectionID) { runner.Add(connID, s) },
+			RemoveConnectionID: runner.Remove,
+			ReplaceWithClosed:  runner.ReplaceWithClosed,
+		},
+		s.queueControlFrame,
+		connIDGenerator,
+	)
+	s.ctx, s.ctxCancel = context.WithCancelCause(ctx)
+	s.preSetup()
+	s.sentPacketHandler = ackhandler.NewSentPacketHandler(
+		initialPacketNumber,
+		protocol.ByteCount(s.config.InitialPacketSize),
+		s.rttStats,
+		&s.connStats,
+		false, // has no effect
+		s.conn.capabilities().ECN,
+		s.receivedPacketHandler.IgnorePacketsBelow,
+		s.perspective,
+		s.qlogger,
+		s.logger,
+	)
+	s.maxPayloadSizeEstimate.Store(uint32(estimateMaxPayloadSize(protocol.ByteCount(s.config.InitialPacketSize))))
+	oneRTTStream := newCryptoStream()
+	params := &wire.TransportParameters{
+		InitialMaxStreamDataBidiRemote: protocol.ByteCount(s.config.InitialStreamReceiveWindow),
+		InitialMaxStreamDataBidiLocal:  protocol.ByteCount(s.config.InitialStreamReceiveWindow),
+		InitialMaxStreamDataUni:        protocol.ByteCount(s.config.InitialStreamReceiveWindow),
+		InitialMaxData:                 protocol.ByteCount(s.config.InitialConnectionReceiveWindow),
+		MaxIdleTimeout:                 s.config.MaxIdleTimeout,
+		MaxBidiStreamNum:               protocol.StreamNum(s.config.MaxIncomingStreams),
+		MaxUniStreamNum:                protocol.StreamNum(s.config.MaxIncomingUniStreams),
+		MaxAckDelay:                    protocol.MaxAckDelayInclGranularity,
+		MaxUDPPayloadSize:              protocol.MaxPacketBufferSize,
+		AckDelayExponent:               protocol.AckDelayExponent,
+		// For interoperability with quic-go versions before May 2023, this value must be set to a value
+		// different from protocol.DefaultActiveConnectionIDLimit.
+		// If set to the default value, it will be omitted from the transport parameters, which will make
+		// old quic-go versions interpret it as 0, instead of the default value of 2.
+		// See https://github.com/quic-go/quic-go/pull/3806.
+		ActiveConnectionIDLimit:   protocol.MaxActiveConnectionIDs,
+		InitialSourceConnectionID: srcConnID,
+		EnableResetStreamAt:       conf.EnableStreamResetPartialDelivery,
+	}
+	if s.config.EnableDatagrams {
+		params.MaxDatagramFrameSize = wire.MaxDatagramSize
+	} else {
+		params.MaxDatagramFrameSize = protocol.InvalidByteCount
+	}
+	if s.qlogger != nil {
+		s.qlogTransportParameters(params, protocol.PerspectiveClient, false)
+	}
+	cs := handshake.NewCryptoSetupClient(
+		destConnID,
+		params,
+		tlsConf,
+		enable0RTT,
+		s.rttStats,
+		s.qlogger,
+		logger,
+		s.version,
+	)
+	s.cryptoStreamHandler = cs
+	s.cryptoStreamManager = newCryptoStreamManager(s.initialStream, s.handshakeStream, oneRTTStream)
+	s.unpacker = newPacketUnpacker(cs, s.srcConnIDLen)
+	s.packer = newPacketPacker(srcConnID, s.connIDManager.Get, s.initialStream, s.handshakeStream, s.sentPacketHandler, s.retransmissionQueue, cs, s.framer, &s.receivedPacketHandler, s.datagramQueue, s.perspective)
+	if len(tlsConf.ServerName) > 0 {
+		s.tokenStoreKey = tlsConf.ServerName
+	} else {
+		s.tokenStoreKey = conn.RemoteAddr().String()
+	}
+	if s.config.TokenStore != nil {
+		if token := s.config.TokenStore.Pop(s.tokenStoreKey); token != nil {
+			s.packer.SetToken(token.data)
+			s.rttStats.SetInitialRTT(token.rtt)
+		}
+	}
+	return &wrappedConn{Conn: s}
+}
+
+func (c *Conn) preSetup() {
+	c.largestRcvdAppData = protocol.InvalidPacketNumber
+	c.initialStream = newInitialCryptoStream(c.perspective == protocol.PerspectiveClient)
+	c.handshakeStream = newCryptoStream()
+	c.sendQueue = newSendQueue(c.conn)
+	c.retransmissionQueue = newRetransmissionQueue()
+	c.frameParser = *wire.NewFrameParser(
+		c.config.EnableDatagrams,
+		c.config.EnableStreamResetPartialDelivery,
+		false, // ACK_FREQUENCY is not supported yet
+	)
+	c.rttStats = utils.NewRTTStats()
+	c.connFlowController = newConnectionFlowController(
+		protocol.ByteCount(c.config.InitialConnectionReceiveWindow),
+		protocol.ByteCount(c.config.MaxConnectionReceiveWindow),
+		func(size protocol.ByteCount) bool {
+			if c.config.AllowConnectionWindowIncrease == nil {
+				return true
+			}
+			return c.config.AllowConnectionWindowIncrease(c, uint64(size))
+		},
+		c.rttStats,
+		c.logger,
+	)
+	c.earlyConnReadyChan = make(chan struct{})
+	c.streamsMap = newStreamsMap(
+		c.ctx,
+		c,
+		c.queueControlFrame,
+		c.newFlowController,
+		uint64(c.config.MaxIncomingStreams),
+		uint64(c.config.MaxIncomingUniStreams),
+		c.perspective,
+	)
+	c.framer = newFramer(c.connFlowController)
+	c.receivedPackets.Init(8)
+	c.notifyReceivedPacket = make(chan struct{}, 1)
+	c.closeChan = make(chan struct{}, 1)
+	c.sendingScheduled = make(chan struct{}, 1)
+	c.handshakeCompleteChan = make(chan struct{})
+
+	now := monotime.Now()
+	c.lastPacketReceivedTime = now
+	c.creationTime = now
+
+	c.receivedPacketHandler = *ackhandler.NewReceivedPacketHandler(c.logger)
+
+	c.datagramQueue = newDatagramQueue(c.scheduleSending, c.logger)
+	c.connState.Version = c.version
+}
+
+// run the connection main loop
+func (c *Conn) run() (err error) {
+	defer func() { c.ctxCancel(err) }()
+
+	defer func() {
+		// drain queued packets that will never be processed
+		c.receivedPacketMx.Lock()
+		defer c.receivedPacketMx.Unlock()
+
+		for !c.receivedPackets.Empty() {
+			p := c.receivedPackets.PopFront()
+			p.buffer.Decrement()
+			p.buffer.MaybeRelease()
+		}
+	}()
+
+	c.timer = time.NewTimer(monotime.Until(c.idleTimeoutStartTime().Add(c.config.HandshakeIdleTimeout)))
+
+	if err := c.cryptoStreamHandler.StartHandshake(c.ctx); err != nil {
+		return err
+	}
+	if err := c.handleHandshakeEvents(monotime.Now()); err != nil {
+		return err
+	}
+	go func() {
+		if err := c.sendQueue.Run(); err != nil {
+			c.destroyImpl(err)
+		}
+	}()
+
+	if c.perspective == protocol.PerspectiveClient {
+		c.scheduleSending() // so the ClientHello actually gets sent
+	}
+
+	var sendQueueAvailable <-chan struct{}
+
+runLoop:
+	for {
+		if c.framer.QueuedTooManyControlFrames() {
+			c.setCloseError(&closeError{err: &qerr.TransportError{ErrorCode: InternalError}})
+			break runLoop
+		}
+		// Close immediately if requested
+		select {
+		case <-c.closeChan:
+			break runLoop
+		default:
+		}
+
+		// no need to set a timer if we can send packets immediately
+		if c.pacingDeadline != deadlineSendImmediately {
+			c.maybeResetTimer()
+		}
+
+		// 1st: handle undecryptable packets, if any.
+		// This can only occur before completion of the handshake.
+		if len(c.undecryptablePacketsToProcess) > 0 {
+			var processedUndecryptablePacket bool
+			queue := c.undecryptablePacketsToProcess
+			c.undecryptablePacketsToProcess = nil
+			for _, p := range queue {
+				processed, err := c.handleOnePacket(p.receivedPacket, p.checksum)
+				if err != nil {
+					c.setCloseError(&closeError{err: err})
+					break runLoop
+				}
+				if processed {
+					processedUndecryptablePacket = true
+				}
+			}
+			if processedUndecryptablePacket {
+				// if we processed any undecryptable packets, jump to the resetting of the timers directly
+				continue
+			}
+		}
+
+		// 2nd: receive packets.
+		processed, err := c.handlePackets() // don't check receivedPackets.Len() in the run loop to avoid locking the mutex
+		if err != nil {
+			c.setCloseError(&closeError{err: err})
+			break runLoop
+		}
+
+		// We don't need to wait for new events if:
+		// * we processed packets: we probably need to send an ACK, and potentially more data
+		// * the pacer allows us to send more packets immediately
+		shouldProceedImmediately := sendQueueAvailable == nil && (processed || c.pacingDeadline.Equal(deadlineSendImmediately))
+		if !shouldProceedImmediately {
+			// 3rd: wait for something to happen:
+			// * closing of the connection
+			// * timer firing
+			// * sending scheduled
+			// * send queue available
+			// * received packets
+			select {
+			case <-c.closeChan:
+				break runLoop
+			case <-c.timer.C:
+			case <-c.sendingScheduled:
+			case <-sendQueueAvailable:
+			case <-c.notifyReceivedPacket:
+				wasProcessed, err := c.handlePackets()
+				if err != nil {
+					c.setCloseError(&closeError{err: err})
+					break runLoop
+				}
+				// if we processed any undecryptable packets, jump to the resetting of the timers directly
+				if !wasProcessed {
+					continue
+				}
+			}
+		}
+
+		// Check for loss detection timeout.
+		// This could cause packets to be declared lost, and retransmissions to be enqueued.
+		now := monotime.Now()
+		if timeout := c.sentPacketHandler.GetLossDetectionTimeout(); !timeout.IsZero() && !timeout.After(now) {
+			if err := c.sentPacketHandler.OnLossDetectionTimeout(now); err != nil {
+				c.setCloseError(&closeError{err: err})
+				break runLoop
+			}
+		}
+
+		if keepAliveTime := c.nextKeepAliveTime(); !keepAliveTime.IsZero() && !now.Before(keepAliveTime) {
+			// send a PING frame since there is no activity in the connection
+			c.logger.Debugf("Sending a keep-alive PING to keep the connection alive.")
+			c.framer.QueueControlFrame(&wire.PingFrame{})
+			c.keepAlivePingSent = true
+		} else if !c.handshakeComplete && now.Sub(c.creationTime) >= c.config.handshakeTimeout() {
+			c.destroyImpl(qerr.ErrHandshakeTimeout)
+			break runLoop
+		} else {
+			idleTimeoutStartTime := c.idleTimeoutStartTime()
+			if (!c.handshakeComplete && now.Sub(idleTimeoutStartTime) >= c.config.HandshakeIdleTimeout) ||
+				(c.handshakeComplete && !now.Before(c.nextIdleTimeoutTime())) {
+				c.destroyImpl(qerr.ErrIdleTimeout)
+				break runLoop
+			}
+		}
+
+		c.connIDGenerator.RemoveRetiredConnIDs(now)
+
+		if c.perspective == protocol.PerspectiveClient {
+			pm := c.pathManagerOutgoing.Load()
+			if pm != nil {
+				tr, ok := pm.ShouldSwitchPath()
+				if ok {
+					c.switchToNewPath(tr, now)
+				}
+			}
+		}
+
+		if c.sendQueue.WouldBlock() {
+			// The send queue is still busy sending out packets. Wait until there's space to enqueue new packets.
+			sendQueueAvailable = c.sendQueue.Available()
+			// Cancel the pacing timer, as we can't send any more packets until the send queue is available again.
+			c.pacingDeadline = 0
+			c.blocked = blockModeHardBlocked
+			continue
+		}
+
+		if c.closeErr.Load() != nil {
+			break runLoop
+		}
+
+		c.blocked = blockModeNone // sending might set it back to true if we're congestion limited
+		if err := c.triggerSending(now); err != nil {
+			c.setCloseError(&closeError{err: err})
+			break runLoop
+		}
+		if c.sendQueue.WouldBlock() {
+			// The send queue is still busy sending out packets. Wait until there's space to enqueue new packets.
+			sendQueueAvailable = c.sendQueue.Available()
+			// Cancel the pacing timer, as we can't send any more packets until the send queue is available again.
+			c.pacingDeadline = 0
+			c.blocked = blockModeHardBlocked
+		} else {
+			sendQueueAvailable = nil
+		}
+	}
+
+	closeErr := c.closeErr.Load()
+	c.cryptoStreamHandler.Close()
+	c.sendQueue.Close() // close the send queue before sending the CONNECTION_CLOSE
+	c.handleCloseError(closeErr)
+	if c.qlogger != nil {
+		if _, ok := errors.AsType[*errCloseForRecreating](closeErr.err); !ok {
+			c.qlogger.Close()
+		}
+	}
+	c.logger.Infof("Connection %s closed.", c.logID)
+	c.timer.Stop()
+	return closeErr.err
+}
+
+// blocks until the early connection can be used
+func (c *Conn) earlyConnReady() <-chan struct{} {
+	return c.earlyConnReadyChan
+}
+
+// Context returns a context that is cancelled when the connection is closed.
+// The cancellation cause is set to the error that caused the connection to close.
+func (c *Conn) Context() context.Context {
+	return c.ctx
+}
+
+func (c *Conn) supportsDatagrams() bool {
+	return c.peerParams.MaxDatagramFrameSize > 0
+}
+
+// ConnectionState returns basic details about the QUIC connection.
+func (c *Conn) ConnectionState() ConnectionState {
+	c.connStateMutex.Lock()
+	defer c.connStateMutex.Unlock()
+
+	cs := c.cryptoStreamHandler.ConnectionState()
+	c.connState.TLS = cs.ConnectionState
+	c.connState.Used0RTT = cs.Used0RTT
+	if c.peerParams != nil {
+		c.connState.SupportsDatagrams.Remote = c.supportsDatagrams()
+		c.connState.SupportsStreamResetPartialDelivery.Remote = c.peerParams.EnableResetStreamAt
+	}
+	c.connState.SupportsDatagrams.Local = c.config.EnableDatagrams
+	c.connState.SupportsStreamResetPartialDelivery.Local = c.config.EnableStreamResetPartialDelivery
+	c.connState.GSO = c.conn.capabilities().GSO
+	return c.connState
+}
+
+// ConnectionStats contains statistics about the QUIC connection
+type ConnectionStats struct {
+	// MinRTT is the estimate of the minimum RTT observed on the active network
+	// path.
+	MinRTT time.Duration
+	// LatestRTT is the last RTT sample observed on the active network path.
+	LatestRTT time.Duration
+	// SmoothedRTT is an exponentially weighted moving average of an endpoint's
+	// RTT samples. See https://www.rfc-editor.org/rfc/rfc9002#section-5.3
+	SmoothedRTT time.Duration
+	// MeanDeviation estimates the variation in the RTT samples using a mean
+	// variation. See https://www.rfc-editor.org/rfc/rfc9002#section-5.3
+	MeanDeviation time.Duration
+
+	// BytesSent is the number of bytes sent on the underlying connection,
+	// including retransmissions. Does not include UDP or any other outer
+	// framing.
+	BytesSent uint64
+	// PacketsSent is the number of packets sent on the underlying connection,
+	// including those that are determined to have been lost.
+	PacketsSent uint64
+	// BytesReceived is the number of total bytes received on the underlying
+	// connection, including duplicate data for streams. Does not include UDP or
+	// any other outer framing.
+	BytesReceived uint64
+	// PacketsReceived is the number of total packets received on the underlying
+	// connection, including packets that were not processable.
+	PacketsReceived uint64
+	// BytesLost is the number of bytes lost on the underlying connection (does
+	// not monotonically increase, because packets that are declared lost can
+	// subsequently be received). Does not include UDP or any other outer
+	// framing.
+	BytesLost uint64
+	// PacketsLost is the number of packets lost on the underlying connection
+	// (does not monotonically increase, because packets that are declared lost
+	// can subsequently be received).
+	PacketsLost uint64
+}
+
+func (c *Conn) ConnectionStats() ConnectionStats {
+	return ConnectionStats{
+		MinRTT:        c.rttStats.MinRTT(),
+		LatestRTT:     c.rttStats.LatestRTT(),
+		SmoothedRTT:   c.rttStats.SmoothedRTT(),
+		MeanDeviation: c.rttStats.MeanDeviation(),
+
+		BytesSent:       c.connStats.BytesSent.Load(),
+		PacketsSent:     c.connStats.PacketsSent.Load(),
+		BytesReceived:   c.connStats.BytesReceived.Load(),
+		PacketsReceived: c.connStats.PacketsReceived.Load(),
+		BytesLost:       c.connStats.BytesLost.Load(),
+		PacketsLost:     c.connStats.PacketsLost.Load(),
+	}
+}
+
+// Time when the connection should time out
+func (c *Conn) nextIdleTimeoutTime() monotime.Time {
+	idleTimeout := max(c.idleTimeout, c.rttStats.PTO(true)*3)
+	return c.idleTimeoutStartTime().Add(idleTimeout)
+}
+
+// Time when the next keep-alive packet should be sent.
+// It returns a zero time if no keep-alive should be sent.
+func (c *Conn) nextKeepAliveTime() monotime.Time {
+	if c.config.KeepAlivePeriod == 0 || c.keepAlivePingSent {
+		return 0
+	}
+	keepAliveInterval := max(c.keepAliveInterval, c.rttStats.PTO(true)*3/2)
+	return c.lastPacketReceivedTime.Add(keepAliveInterval)
+}
+
+func (c *Conn) maybeResetTimer() {
+	var deadline monotime.Time
+	if !c.handshakeComplete {
+		deadline = c.creationTime.Add(c.config.handshakeTimeout())
+		if t := c.idleTimeoutStartTime().Add(c.config.HandshakeIdleTimeout); t.Before(deadline) {
+			deadline = t
+		}
+	} else {
+		// A keep-alive packet is ack-eliciting, so it can only be sent if the connection is
+		// neither congestion limited nor hard-blocked.
+		if c.blocked != blockModeNone {
+			deadline = c.nextIdleTimeoutTime()
+		} else {
+			if keepAliveTime := c.nextKeepAliveTime(); !keepAliveTime.IsZero() {
+				deadline = keepAliveTime
+			} else {
+				deadline = c.nextIdleTimeoutTime()
+			}
+		}
+	}
+	// If the connection is hard-blocked, we can't even send acknowledgments,
+	// nor can we send PTO probe packets.
+	if c.blocked == blockModeHardBlocked {
+		c.timer.Reset(monotime.Until(deadline))
+		return
+	}
+
+	if t := c.receivedPacketHandler.GetAlarmTimeout(); !t.IsZero() && t.Before(deadline) {
+		deadline = t
+	}
+	if t := c.sentPacketHandler.GetLossDetectionTimeout(); !t.IsZero() && t.Before(deadline) {
+		deadline = t
+	}
+	if c.blocked == blockModeCongestionLimited {
+		c.timer.Reset(monotime.Until(deadline))
+		return
+	}
+
+	if !c.pacingDeadline.IsZero() && c.pacingDeadline.Before(deadline) {
+		deadline = c.pacingDeadline
+	}
+	c.timer.Reset(monotime.Until(deadline))
+}
+
+func (c *Conn) idleTimeoutStartTime() monotime.Time {
+	startTime := c.lastPacketReceivedTime
+	if t := c.firstAckElicitingPacketAfterIdleSentTime; !t.IsZero() && t.After(startTime) {
+		startTime = t
+	}
+	return startTime
+}
+
+func (c *Conn) switchToNewPath(tr *Transport, now monotime.Time) {
+	initialPacketSize := protocol.ByteCount(c.config.InitialPacketSize)
+	c.sentPacketHandler.MigratedPath(now, initialPacketSize)
+	maxPacketSize := protocol.ByteCount(protocol.MaxPacketBufferSize)
+	if c.peerParams.MaxUDPPayloadSize > 0 && c.peerParams.MaxUDPPayloadSize < maxPacketSize {
+		maxPacketSize = c.peerParams.MaxUDPPayloadSize
+	}
+	c.mtuDiscoverer.Reset(now, initialPacketSize, maxPacketSize)
+	c.conn = newSendConn(tr.conn, c.conn.RemoteAddr(), packetInfo{}, utils.DefaultLogger) // TODO: find a better way
+	c.sendQueue.Close()
+	c.sendQueue = newSendQueue(c.conn)
+	go func() {
+		if err := c.sendQueue.Run(); err != nil {
+			c.destroyImpl(err)
+		}
+	}()
+}
+
+func (c *Conn) handleHandshakeComplete(now monotime.Time) error {
+	defer close(c.handshakeCompleteChan)
+	// Once the handshake completes, we have derived 1-RTT keys.
+	// There's no point in queueing undecryptable packets for later decryption anymore.
+	c.undecryptablePackets = nil
+
+	c.connIDManager.SetHandshakeComplete()
+	c.connIDGenerator.SetHandshakeComplete(now.Add(3 * c.rttStats.PTO(false)))
+
+	if c.qlogger != nil {
+		c.qlogger.RecordEvent(qlog.ALPNInformation{
+			ChosenALPN: c.cryptoStreamHandler.ConnectionState().NegotiatedProtocol,
+		})
+	}
+
+	// The server applies transport parameters right away, but the client side has to wait for handshake completion.
+	// During a 0-RTT connection, the client is only allowed to use the new transport parameters for 1-RTT packets.
+	if c.perspective == protocol.PerspectiveClient {
+		c.applyTransportParameters()
+		return nil
+	}
+
+	// All these only apply to the server side.
+	if err := c.handleHandshakeConfirmed(now); err != nil {
+		return err
+	}
+
+	ticket, err := c.cryptoStreamHandler.GetSessionTicket()
+	if err != nil {
+		return err
+	}
+	if ticket != nil { // may be nil if session tickets are disabled via tls.Config.SessionTicketsDisabled
+		c.oneRTTStream.Write(ticket)
+		for c.oneRTTStream.HasData() {
+			if cf := c.oneRTTStream.PopCryptoFrame(protocol.MaxPostHandshakeCryptoFrameSize); cf != nil {
+				c.queueControlFrame(cf)
+			}
+		}
+	}
+	token, err := c.tokenGenerator.NewToken(c.conn.RemoteAddr(), c.rttStats.SmoothedRTT())
+	if err != nil {
+		return err
+	}
+	c.queueControlFrame(&wire.NewTokenFrame{Token: token})
+	c.queueControlFrame(&wire.HandshakeDoneFrame{})
+	return nil
+}
+
+func (c *Conn) handleHandshakeConfirmed(now monotime.Time) error {
+	// Drop initial keys.
+	// On the client side, this should have happened when sending the first Handshake packet,
+	// but this is not guaranteed if the server misbehaves.
+	// See CVE-2025-59530 for more details.
+	c.dropEncryptionLevel(protocol.EncryptionInitial, now)
+	c.dropEncryptionLevel(protocol.EncryptionHandshake, now)
+
+	c.handshakeConfirmed = true
+	c.cryptoStreamHandler.SetHandshakeConfirmed()
+
+	if !c.config.DisablePathMTUDiscovery && c.conn.capabilities().DF {
+		c.mtuDiscoverer.Start(now)
+	}
+	return nil
+}
+
+const maxPacketsToProcess = 32
+
+func (c *Conn) handlePackets() (wasProcessed bool, _ error) {
+	// Process packets from the receivedPackets queue.
+	// Limit the number of packets to process to maxPacketsToProcess,
+	// so we eventually get a chance to send out an ACK when receiving a lot of packets.
+	c.receivedPacketMx.Lock()
+
+	if c.receivedPackets.Empty() {
+		c.receivedPacketMx.Unlock()
+		return false, nil
+	}
+
+	var hasMorePackets bool
+	for range maxPacketsToProcess {
+		p := c.receivedPackets.PopFront()
+		c.receivedPacketMx.Unlock()
+
+		var datagramPayloadChecksum qlog.DatagramPayloadChecksum
+		if c.qlogger != nil && wire.IsLongHeaderPacket(p.data[0]) {
+			datagramPayloadChecksum = qlog.CalculateDatagramPayloadChecksum(p.data)
+		}
+		processed, err := c.handleOnePacket(p, datagramPayloadChecksum)
+		if err != nil {
+			return false, err
+		}
+		if processed {
+			wasProcessed = true
+		}
+		c.receivedPacketMx.Lock()
+		hasMorePackets = !c.receivedPackets.Empty()
+		if !hasMorePackets {
+			break
+		}
+		// Prioritize sending of new CRYPTO data.
+		// This is especially relevant when processing 0-RTT packets.
+		if !c.handshakeComplete && (c.initialStream.HasData() || c.handshakeStream.HasData()) {
+			break
+		}
+	}
+	c.receivedPacketMx.Unlock()
+
+	if hasMorePackets {
+		select {
+		case c.notifyReceivedPacket <- struct{}{}:
+		default:
+		}
+	}
+	return wasProcessed, nil
+}
+
+func (c *Conn) handleOnePacket(rp receivedPacket, datagramPayloadChecksum qlog.DatagramPayloadChecksum) (wasProcessed bool, _ error) {
+	c.sentPacketHandler.ReceivedBytes(rp.Size(), rp.rcvTime)
+
+	if wire.IsVersionNegotiationPacket(rp.data) {
+		return false, c.handleVersionNegotiationPacket(rp)
+	}
+
+	var counter uint8
+	var lastConnID protocol.ConnectionID
+	data := rp.data
+	p := rp
+	for len(data) > 0 {
+		if counter > 0 {
+			p = *p.Clone()
+			p.data = data
+
+			destConnID, err := wire.ParseConnectionID(p.data, c.srcConnIDLen)
+			if err != nil {
+				if c.qlogger != nil {
+					c.qlogger.RecordEvent(qlog.PacketDropped{
+						Raw:                     qlog.RawInfo{Length: len(data)},
+						DatagramPayloadChecksum: datagramPayloadChecksum,
+						Trigger:                 qlog.PacketDropHeaderParseError,
+					})
+				}
+				c.logger.Debugf("error parsing packet, couldn't parse connection ID: %s", err)
+				break
+			}
+			if destConnID != lastConnID {
+				if c.qlogger != nil {
+					c.qlogger.RecordEvent(qlog.PacketDropped{
+						Header:                  qlog.PacketHeader{DestConnectionID: destConnID},
+						Raw:                     qlog.RawInfo{Length: len(data)},
+						DatagramPayloadChecksum: datagramPayloadChecksum,
+						Trigger:                 qlog.PacketDropUnknownConnectionID,
+					})
+				}
+				c.logger.Debugf("coalesced packet has different destination connection ID: %s, expected %s", destConnID, lastConnID)
+				break
+			}
+		}
+
+		if wire.IsLongHeaderPacket(p.data[0]) {
+			hdr, packetData, rest, err := wire.ParsePacket(p.data)
+			if err != nil {
+				if c.qlogger != nil {
+					if err == wire.ErrUnsupportedVersion {
+						c.qlogger.RecordEvent(qlog.PacketDropped{
+							Header:                  qlog.PacketHeader{Version: hdr.Version},
+							Raw:                     qlog.RawInfo{Length: len(data)},
+							DatagramPayloadChecksum: datagramPayloadChecksum,
+							Trigger:                 qlog.PacketDropUnsupportedVersion,
+						})
+					} else {
+						c.qlogger.RecordEvent(qlog.PacketDropped{
+							Raw:                     qlog.RawInfo{Length: len(data)},
+							DatagramPayloadChecksum: datagramPayloadChecksum,
+							Trigger:                 qlog.PacketDropHeaderParseError,
+						})
+					}
+				}
+				c.logger.Debugf("error parsing packet: %s", err)
+				break
+			}
+			lastConnID = hdr.DestConnectionID
+
+			if hdr.Version != c.version {
+				if c.qlogger != nil {
+					c.qlogger.RecordEvent(qlog.PacketDropped{
+						Raw:                     qlog.RawInfo{Length: len(data)},
+						DatagramPayloadChecksum: datagramPayloadChecksum,
+						Trigger:                 qlog.PacketDropUnexpectedVersion,
+					})
+				}
+				c.logger.Debugf("Dropping packet with version %x. Expected %x.", hdr.Version, c.version)
+				break
+			}
+
+			if counter > 0 {
+				p.buffer.Split()
+			}
+			counter++
+
+			// only log if this actually a coalesced packet
+			if c.logger.Debug() && (counter > 1 || len(rest) > 0) {
+				c.logger.Debugf("Parsed a coalesced packet. Part %d: %d bytes. Remaining: %d bytes.", counter, len(packetData), len(rest))
+			}
+
+			p.data = packetData
+
+			processed, err := c.handleLongHeaderPacket(p, hdr, datagramPayloadChecksum)
+			if err != nil {
+				return false, err
+			}
+			if processed {
+				wasProcessed = true
+			}
+			data = rest
+		} else {
+			if counter > 0 {
+				p.buffer.Split()
+			}
+			processed, err := c.handleShortHeaderPacket(p, counter > 0, datagramPayloadChecksum)
+			if err != nil {
+				return false, err
+			}
+			if processed {
+				wasProcessed = true
+			}
+			break
+		}
+	}
+
+	p.buffer.MaybeRelease()
+	c.blocked = blockModeNone
+	return wasProcessed, nil
+}
+
+func (c *Conn) handleShortHeaderPacket(
+	p receivedPacket,
+	isCoalesced bool,
+	datagramPayloadChecksum qlog.DatagramPayloadChecksum, // only for logging
+) (wasProcessed bool, _ error) {
+	var wasQueued bool
+
+	defer func() {
+		// Put back the packet buffer if the packet wasn't queued for later decryption.
+		if !wasQueued {
+			p.buffer.Decrement()
+		}
+	}()
+
+	destConnID, err := wire.ParseConnectionID(p.data, c.srcConnIDLen)
+	if err != nil {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketType1RTT,
+					PacketNumber: protocol.InvalidPacketNumber,
+				},
+				Raw:                     qlog.RawInfo{Length: len(p.data)},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Trigger:                 qlog.PacketDropHeaderParseError,
+			})
+		}
+		return false, nil
+	}
+	pn, pnLen, keyPhase, data, err := c.unpacker.UnpackShortHeader(p.rcvTime, p.data)
+	if err != nil {
+		// Stateless reset packets (see RFC 9000, section 10.3):
+		// * fill the entire UDP datagram (i.e. they cannot be part of a coalesced packet)
+		// * are short header packets (first bit is 0)
+		// * have the QUIC bit set (second bit is 1)
+		// * are at least 21 bytes long
+		if !isCoalesced && len(p.data) >= protocol.MinReceivedStatelessResetSize && p.data[0]&0b11000000 == 0b01000000 {
+			token := protocol.StatelessResetToken(p.data[len(p.data)-16:])
+			if c.connIDManager.IsActiveStatelessResetToken(token) {
+				return false, &StatelessResetError{}
+			}
+		}
+		wasQueued, err = c.handleUnpackError(err, p, qlog.PacketType1RTT, datagramPayloadChecksum)
+		return false, err
+	}
+	c.largestRcvdAppData = max(c.largestRcvdAppData, pn)
+
+	if c.logger.Debug() {
+		c.logger.Debugf("<- Reading packet %d (%d bytes) for connection %s, 1-RTT", pn, p.Size(), destConnID)
+		wire.LogShortHeader(c.logger, destConnID, pn, pnLen, keyPhase)
+	}
+
+	if c.receivedPacketHandler.IsPotentiallyDuplicate(pn, protocol.Encryption1RTT) {
+		c.logger.Debugf("Dropping (potentially) duplicate packet.")
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketType1RTT,
+					PacketNumber: pn,
+				},
+				Raw:                     qlog.RawInfo{Length: int(p.Size())},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Trigger:                 qlog.PacketDropDuplicate,
+			})
+		}
+		return false, nil
+	}
+
+	var log func([]qlog.Frame)
+	if c.qlogger != nil {
+		log = func(frames []qlog.Frame) {
+			c.qlogger.RecordEvent(qlog.PacketReceived{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketType1RTT,
+					DestConnectionID: destConnID,
+					PacketNumber:     pn,
+					KeyPhaseBit:      keyPhase,
+				},
+				Raw: qlog.RawInfo{
+					Length:        int(p.Size()),
+					PayloadLength: int(p.Size() - wire.ShortHeaderLen(destConnID, pnLen)),
+				},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Frames:                  frames,
+				ECN:                     toQlogECN(p.ecn),
+			})
+		}
+	}
+	isNonProbing, pathChallenge, err := c.handleUnpackedShortHeaderPacket(destConnID, pn, data, p.ecn, p.rcvTime, log)
+	if err != nil {
+		return false, err
+	}
+
+	// In RFC 9000, only the client can migrate between paths.
+	if c.perspective == protocol.PerspectiveClient {
+		return true, nil
+	}
+	if addrsEqual(p.remoteAddr, c.RemoteAddr()) {
+		return true, nil
+	}
+
+	var shouldSwitchPath bool
+	if c.pathManager == nil {
+		c.pathManager = newPathManager(
+			c.connIDManager.GetConnIDForPath,
+			c.connIDManager.RetireConnIDForPath,
+			c.logger,
+		)
+	}
+	destConnID, frames, shouldSwitchPath := c.pathManager.HandlePacket(p.remoteAddr, p.rcvTime, pathChallenge, isNonProbing)
+	if len(frames) > 0 {
+		probe, buf, err := c.packer.PackPathProbePacket(destConnID, frames, c.version)
+		if err != nil {
+			return true, err
+		}
+		c.logger.Debugf("sending path probe packet to %s", p.remoteAddr)
+		c.logShortHeaderPacketWithDatagramPayloadChecksum(probe, protocol.ECNNon, buf.Len(), false, datagramPayloadChecksum)
+		c.registerPackedShortHeaderPacket(probe, protocol.ECNNon, p.rcvTime)
+		c.sendQueue.SendProbe(buf, p.remoteAddr, p.info)
+	}
+	// We only switch paths in response to the highest-numbered non-probing packet,
+	// see section 9.3 of RFC 9000.
+	if !shouldSwitchPath || pn != c.largestRcvdAppData {
+		return true, nil
+	}
+	c.pathManager.SwitchToPath(p.remoteAddr)
+	c.sentPacketHandler.MigratedPath(p.rcvTime, protocol.ByteCount(c.config.InitialPacketSize))
+	maxPacketSize := protocol.ByteCount(protocol.MaxPacketBufferSize)
+	if c.peerParams.MaxUDPPayloadSize > 0 && c.peerParams.MaxUDPPayloadSize < maxPacketSize {
+		maxPacketSize = c.peerParams.MaxUDPPayloadSize
+	}
+	c.mtuDiscoverer.Reset(
+		p.rcvTime,
+		protocol.ByteCount(c.config.InitialPacketSize),
+		maxPacketSize,
+	)
+	c.conn.ChangeRemoteAddr(p.remoteAddr, p.info)
+	return true, nil
+}
+
+func (c *Conn) handleLongHeaderPacket(p receivedPacket, hdr *wire.Header, datagramPayloadChecksum qlog.DatagramPayloadChecksum) (wasProcessed bool, _ error) {
+	var wasQueued bool
+
+	defer func() {
+		// Put back the packet buffer if the packet wasn't queued for later decryption.
+		if !wasQueued {
+			p.buffer.Decrement()
+		}
+	}()
+
+	if hdr.Type == protocol.PacketTypeRetry {
+		return c.handleRetryPacket(hdr, p.data, p.rcvTime), nil
+	}
+
+	// The server can change the source connection ID with the first Handshake packet.
+	// After this, all packets with a different source connection have to be ignored.
+	if c.receivedFirstPacket && hdr.Type == protocol.PacketTypeInitial && hdr.SrcConnectionID != c.handshakeDestConnID {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketTypeInitial,
+					PacketNumber: protocol.InvalidPacketNumber,
+				},
+				Raw:                     qlog.RawInfo{Length: int(p.Size())},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Trigger:                 qlog.PacketDropUnknownConnectionID,
+			})
+		}
+		c.logger.Debugf("Dropping Initial packet (%d bytes) with unexpected source connection ID: %s (expected %s)", p.Size(), hdr.SrcConnectionID, c.handshakeDestConnID)
+		return false, nil
+	}
+	// drop 0-RTT packets, if we are a client
+	if c.perspective == protocol.PerspectiveClient && hdr.Type == protocol.PacketType0RTT {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketType0RTT,
+					PacketNumber: protocol.InvalidPacketNumber,
+				},
+				Raw:                     qlog.RawInfo{Length: int(p.Size())},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Trigger:                 qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		return false, nil
+	}
+
+	packet, err := c.unpacker.UnpackLongHeader(hdr, p.data)
+	if err != nil {
+		wasQueued, err = c.handleUnpackError(err, p, toQlogPacketType(hdr.Type), datagramPayloadChecksum)
+		return false, err
+	}
+
+	if c.logger.Debug() {
+		c.logger.Debugf("<- Reading packet %d (%d bytes) for connection %s, %s", packet.hdr.PacketNumber, p.Size(), hdr.DestConnectionID, packet.encryptionLevel)
+		packet.hdr.Log(c.logger)
+	}
+
+	if pn := packet.hdr.PacketNumber; c.receivedPacketHandler.IsPotentiallyDuplicate(pn, packet.encryptionLevel) {
+		c.logger.Debugf("Dropping (potentially) duplicate packet.")
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       toQlogPacketType(packet.hdr.Type),
+					DestConnectionID: hdr.DestConnectionID,
+					SrcConnectionID:  hdr.SrcConnectionID,
+					PacketNumber:     pn,
+					Version:          packet.hdr.Version,
+				},
+				Raw:                     qlog.RawInfo{Length: int(p.Size()), PayloadLength: int(packet.hdr.Length)},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Trigger:                 qlog.PacketDropDuplicate,
+			})
+		}
+		return false, nil
+	}
+
+	if err := c.handleUnpackedLongHeaderPacket(packet, p.ecn, p.rcvTime, datagramPayloadChecksum, p.Size()); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func (c *Conn) handleUnpackError(err error, p receivedPacket, pt qlog.PacketType, datagramPayloadChecksum qlog.DatagramPayloadChecksum) (wasQueued bool, _ error) {
+	switch err {
+	case handshake.ErrKeysDropped:
+		if c.qlogger != nil {
+			connID, _ := wire.ParseConnectionID(p.data, c.srcConnIDLen)
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       pt,
+					DestConnectionID: connID,
+					PacketNumber:     protocol.InvalidPacketNumber,
+				},
+				Raw:                     qlog.RawInfo{Length: int(p.Size())},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Trigger:                 qlog.PacketDropKeyUnavailable,
+			})
+		}
+		c.logger.Debugf("Dropping %s packet (%d bytes) because we already dropped the keys.", pt, p.Size())
+		return false, nil
+	case handshake.ErrKeysNotYetAvailable:
+		// Sealer for this encryption level not yet available.
+		// Try again later.
+		c.tryQueueingUndecryptablePacket(p, pt, datagramPayloadChecksum)
+		return true, nil
+	case wire.ErrInvalidReservedBits:
+		return false, &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: err.Error(),
+		}
+	case handshake.ErrDecryptionFailed:
+		// This might be a packet injected by an attacker. Drop it.
+		if c.qlogger != nil {
+			connID, _ := wire.ParseConnectionID(p.data, c.srcConnIDLen)
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       pt,
+					DestConnectionID: connID,
+					PacketNumber:     protocol.InvalidPacketNumber,
+				},
+				Raw:                     qlog.RawInfo{Length: int(p.Size())},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Trigger:                 qlog.PacketDropPayloadDecryptError,
+			})
+		}
+		c.logger.Debugf("Dropping %s packet (%d bytes) that could not be unpacked. Error: %s", pt, p.Size(), err)
+		return false, nil
+	default:
+		if _, ok := errors.AsType[*headerParseError](err); ok {
+			// This might be a packet injected by an attacker. Drop it.
+			if c.qlogger != nil {
+				connID, _ := wire.ParseConnectionID(p.data, c.srcConnIDLen)
+				c.qlogger.RecordEvent(qlog.PacketDropped{
+					Header: qlog.PacketHeader{
+						PacketType:       pt,
+						DestConnectionID: connID,
+						PacketNumber:     protocol.InvalidPacketNumber,
+					},
+					Raw:                     qlog.RawInfo{Length: int(p.Size())},
+					DatagramPayloadChecksum: datagramPayloadChecksum,
+					Trigger:                 qlog.PacketDropHeaderParseError,
+				})
+			}
+			c.logger.Debugf("Dropping %s packet (%d bytes) for which we couldn't unpack the header. Error: %s", pt, p.Size(), err)
+			return false, nil
+		}
+		// This is an error returned by the AEAD (other than ErrDecryptionFailed).
+		// For example, a PROTOCOL_VIOLATION due to key updates.
+		return false, err
+	}
+}
+
+func (c *Conn) handleRetryPacket(hdr *wire.Header, data []byte, rcvTime monotime.Time) bool /* was this a valid Retry */ {
+	if c.perspective == protocol.PerspectiveServer {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeRetry,
+					SrcConnectionID:  hdr.SrcConnectionID,
+					DestConnectionID: hdr.DestConnectionID,
+					Version:          hdr.Version,
+				},
+				Raw:     qlog.RawInfo{Length: len(data)},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		c.logger.Debugf("Ignoring Retry.")
+		return false
+	}
+	if c.receivedFirstPacket {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeRetry,
+					SrcConnectionID:  hdr.SrcConnectionID,
+					DestConnectionID: hdr.DestConnectionID,
+					Version:          hdr.Version,
+				},
+				Raw:     qlog.RawInfo{Length: len(data)},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		c.logger.Debugf("Ignoring Retry, since we already received a packet.")
+		return false
+	}
+	destConnID := c.connIDManager.Get()
+	if hdr.SrcConnectionID == destConnID {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeRetry,
+					SrcConnectionID:  hdr.SrcConnectionID,
+					DestConnectionID: hdr.DestConnectionID,
+					Version:          hdr.Version,
+				},
+				Raw:     qlog.RawInfo{Length: len(data)},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		c.logger.Debugf("Ignoring Retry, since the server didn't change the Source Connection ID.")
+		return false
+	}
+	// If a token is already set, this means that we already received a Retry from the server.
+	// Ignore this Retry packet.
+	if c.receivedRetry {
+		c.logger.Debugf("Ignoring Retry, since a Retry was already received.")
+		return false
+	}
+
+	tag := handshake.GetRetryIntegrityTag(data[:len(data)-16], destConnID, hdr.Version)
+	if !bytes.Equal(data[len(data)-16:], tag[:]) {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeRetry,
+					SrcConnectionID:  hdr.SrcConnectionID,
+					DestConnectionID: hdr.DestConnectionID,
+					Version:          hdr.Version,
+				},
+				Raw:     qlog.RawInfo{Length: len(data)},
+				Trigger: qlog.PacketDropPayloadDecryptError,
+			})
+		}
+		c.logger.Debugf("Ignoring spoofed Retry. Integrity Tag doesn't match.")
+		return false
+	}
+
+	newDestConnID := hdr.SrcConnectionID
+	c.receivedRetry = true
+	c.sentPacketHandler.ResetForRetry(rcvTime)
+	c.handshakeDestConnID = newDestConnID
+	c.retrySrcConnID = &newDestConnID
+	c.cryptoStreamHandler.ChangeConnectionID(newDestConnID)
+	c.packer.SetToken(hdr.Token)
+	c.connIDManager.ChangeInitialConnID(newDestConnID)
+
+	if c.logger.Debug() {
+		c.logger.Debugf("<- Received Retry:")
+		(&wire.ExtendedHeader{Header: *hdr}).Log(c.logger)
+		c.logger.Debugf("Switching destination connection ID to: %s", hdr.SrcConnectionID)
+	}
+	if c.qlogger != nil {
+		c.qlogger.RecordEvent(qlog.PacketReceived{
+			Header: qlog.PacketHeader{
+				PacketType:       qlog.PacketTypeRetry,
+				DestConnectionID: destConnID,
+				SrcConnectionID:  newDestConnID,
+				Version:          hdr.Version,
+				Token:            &qlog.Token{Raw: hdr.Token},
+			},
+			Raw: qlog.RawInfo{Length: len(data)},
+		})
+	}
+
+	c.scheduleSending()
+	return true
+}
+
+func (c *Conn) handleVersionNegotiationPacket(p receivedPacket) error {
+	if c.perspective == protocol.PerspectiveServer || // servers never receive version negotiation packets
+		c.receivedFirstPacket || c.versionNegotiated { // ignore delayed / duplicated version negotiation packets
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header:  qlog.PacketHeader{PacketType: qlog.PacketTypeVersionNegotiation},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		return nil
+	}
+
+	src, dest, supportedVersions, err := wire.ParseVersionNegotiationPacket(p.data)
+	if err != nil {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header:  qlog.PacketHeader{PacketType: qlog.PacketTypeVersionNegotiation},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropHeaderParseError,
+			})
+		}
+		c.logger.Debugf("Error parsing Version Negotiation packet: %s", err)
+		return nil
+	}
+
+	if slices.Contains(supportedVersions, c.version) {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header:  qlog.PacketHeader{PacketType: qlog.PacketTypeVersionNegotiation},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropUnexpectedVersion,
+			})
+		}
+		// The Version Negotiation packet contains the version that we offered.
+		// This might be a packet sent by an attacker, or it was corrupted.
+		return nil
+	}
+
+	c.logger.Infof("Received a Version Negotiation packet. Supported Versions: %s", supportedVersions)
+	if c.qlogger != nil {
+		c.qlogger.RecordEvent(qlog.VersionNegotiationReceived{
+			Header: qlog.PacketHeaderVersionNegotiation{
+				DestConnectionID: dest,
+				SrcConnectionID:  src,
+			},
+			SupportedVersions: supportedVersions,
+		})
+	}
+	newVersion, ok := protocol.ChooseSupportedVersion(c.config.Versions, supportedVersions)
+	if !ok {
+		c.destroyImpl(&VersionNegotiationError{
+			Ours:   c.config.Versions,
+			Theirs: supportedVersions,
+		})
+		c.logger.Infof("No compatible QUIC version found.")
+		return nil
+	}
+	if c.qlogger != nil {
+		c.qlogger.RecordEvent(qlog.VersionInformation{
+			ChosenVersion:  newVersion,
+			ClientVersions: c.config.Versions,
+			ServerVersions: supportedVersions,
+		})
+	}
+
+	c.logger.Infof("Switching to QUIC version %s.", newVersion)
+	nextPN, _ := c.sentPacketHandler.PeekPacketNumber(protocol.EncryptionInitial)
+	return &errCloseForRecreating{
+		nextPacketNumber: nextPN,
+		nextVersion:      newVersion,
+	}
+}
+
+func (c *Conn) handleUnpackedLongHeaderPacket(
+	packet *unpackedPacket,
+	ecn protocol.ECN,
+	rcvTime monotime.Time,
+	datagramPayloadChecksum qlog.DatagramPayloadChecksum, // only for logging
+	packetSize protocol.ByteCount, // only for logging
+) error {
+	if !c.receivedFirstPacket {
+		c.receivedFirstPacket = true
+		if !c.versionNegotiated && c.qlogger != nil {
+			var clientVersions, serverVersions []Version
+			switch c.perspective {
+			case protocol.PerspectiveClient:
+				clientVersions = c.config.Versions
+			case protocol.PerspectiveServer:
+				serverVersions = c.config.Versions
+			}
+			c.qlogger.RecordEvent(qlog.VersionInformation{
+				ChosenVersion:  c.version,
+				ClientVersions: clientVersions,
+				ServerVersions: serverVersions,
+			})
+		}
+		// The server can change the source connection ID with the first Handshake packet.
+		if c.perspective == protocol.PerspectiveClient && packet.hdr.SrcConnectionID != c.handshakeDestConnID {
+			cid := packet.hdr.SrcConnectionID
+			c.logger.Debugf("Received first packet. Switching destination connection ID to: %s", cid)
+			c.handshakeDestConnID = cid
+			c.connIDManager.ChangeInitialConnID(cid)
+		}
+		// We create the connection as soon as we receive the first packet from the client.
+		// We do that before authenticating the packet.
+		// That means that if the source connection ID was corrupted,
+		// we might have created a connection with an incorrect source connection ID.
+		// Once we authenticate the first packet, we need to update it.
+		if c.perspective == protocol.PerspectiveServer {
+			if packet.hdr.SrcConnectionID != c.handshakeDestConnID {
+				c.handshakeDestConnID = packet.hdr.SrcConnectionID
+				c.connIDManager.ChangeInitialConnID(packet.hdr.SrcConnectionID)
+			}
+			if c.qlogger != nil {
+				var srcAddr, destAddr *net.UDPAddr
+				if addr, ok := c.conn.LocalAddr().(*net.UDPAddr); ok {
+					srcAddr = addr
+				}
+				if addr, ok := c.conn.RemoteAddr().(*net.UDPAddr); ok {
+					destAddr = addr
+				}
+				c.qlogger.RecordEvent(startedConnectionEvent(srcAddr, destAddr))
+			}
+		}
+	}
+
+	if c.perspective == protocol.PerspectiveServer && packet.encryptionLevel == protocol.EncryptionHandshake &&
+		!c.droppedInitialKeys {
+		// On the server side, Initial keys are dropped as soon as the first Handshake packet is received.
+		// See Section 4.9.1 of RFC 9001.
+		c.dropEncryptionLevel(protocol.EncryptionInitial, rcvTime)
+	}
+
+	c.lastPacketReceivedTime = rcvTime
+	c.firstAckElicitingPacketAfterIdleSentTime = 0
+	c.keepAlivePingSent = false
+
+	if packet.hdr.Type == protocol.PacketType0RTT {
+		c.largestRcvdAppData = max(c.largestRcvdAppData, packet.hdr.PacketNumber)
+	}
+
+	var log func([]qlog.Frame)
+	if c.qlogger != nil {
+		log = func(frames []qlog.Frame) {
+			var token *qlog.Token
+			if len(packet.hdr.Token) > 0 {
+				token = &qlog.Token{Raw: packet.hdr.Token}
+			}
+			c.qlogger.RecordEvent(qlog.PacketReceived{
+				Header: qlog.PacketHeader{
+					PacketType:       toQlogPacketType(packet.hdr.Type),
+					DestConnectionID: packet.hdr.DestConnectionID,
+					SrcConnectionID:  packet.hdr.SrcConnectionID,
+					PacketNumber:     packet.hdr.PacketNumber,
+					Version:          packet.hdr.Version,
+					Token:            token,
+				},
+				Raw: qlog.RawInfo{
+					Length:        int(packetSize),
+					PayloadLength: int(packet.hdr.Length),
+				},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Frames:                  frames,
+				ECN:                     toQlogECN(ecn),
+			})
+		}
+	}
+	isAckEliciting, _, _, err := c.handleFrames(packet.data, packet.hdr.DestConnectionID, packet.encryptionLevel, log, rcvTime)
+	if err != nil {
+		return err
+	}
+	c.sentPacketHandler.ReceivedPacket(packet.encryptionLevel, rcvTime)
+	return c.receivedPacketHandler.ReceivedPacket(packet.hdr.PacketNumber, ecn, packet.encryptionLevel, rcvTime, isAckEliciting)
+}
+
+func (c *Conn) handleUnpackedShortHeaderPacket(
+	destConnID protocol.ConnectionID,
+	pn protocol.PacketNumber,
+	data []byte,
+	ecn protocol.ECN,
+	rcvTime monotime.Time,
+	log func([]qlog.Frame),
+) (isNonProbing bool, pathChallenge *wire.PathChallengeFrame, _ error) {
+	c.lastPacketReceivedTime = rcvTime
+	c.firstAckElicitingPacketAfterIdleSentTime = 0
+	c.keepAlivePingSent = false
+
+	isAckEliciting, isNonProbing, pathChallenge, err := c.handleFrames(data, destConnID, protocol.Encryption1RTT, log, rcvTime)
+	if err != nil {
+		return false, nil, err
+	}
+	c.sentPacketHandler.ReceivedPacket(protocol.Encryption1RTT, rcvTime)
+	if err := c.receivedPacketHandler.ReceivedPacket(pn, ecn, protocol.Encryption1RTT, rcvTime, isAckEliciting); err != nil {
+		return false, nil, err
+	}
+	return isNonProbing, pathChallenge, nil
+}
+
+// handleFrames parses the frames, one after the other, and handles them.
+// It returns the last PATH_CHALLENGE frame contained in the packet, if any.
+func (c *Conn) handleFrames(
+	data []byte,
+	destConnID protocol.ConnectionID,
+	encLevel protocol.EncryptionLevel,
+	log func([]qlog.Frame),
+	rcvTime monotime.Time,
+) (isAckEliciting, isNonProbing bool, pathChallenge *wire.PathChallengeFrame, _ error) {
+	// Only used for tracing.
+	// If we're not tracing, this slice will always remain empty.
+	var frames []qlog.Frame
+	if log != nil {
+		frames = make([]qlog.Frame, 0, 4)
+	}
+	handshakeWasComplete := c.handshakeComplete
+	var handleErr error
+	var skipHandling bool
+
+	for len(data) > 0 {
+		frameType, l, err := c.frameParser.ParseType(data, encLevel)
+		if err != nil {
+			// The frame parser skips over PADDING frames, and returns an io.EOF if the PADDING
+			// frames were the last frames in this packet.
+			if err == io.EOF {
+				break
+			}
+			return false, false, nil, err
+		}
+		data = data[l:]
+
+		if ackhandler.IsFrameTypeAckEliciting(frameType) {
+			isAckEliciting = true
+		}
+		if !wire.IsProbingFrameType(frameType) {
+			isNonProbing = true
+		}
+
+		// We're inlining common cases, to avoid using interfaces
+		// Fast path: STREAM, DATAGRAM and ACK
+		if frameType.IsStreamFrameType() {
+			streamFrame, l, err := c.frameParser.ParseStreamFrame(frameType, data, c.version)
+			if err != nil {
+				return false, false, nil, err
+			}
+			data = data[l:]
+
+			if log != nil {
+				frames = append(frames, toQlogFrame(streamFrame))
+			}
+			// an error occurred handling a previous frame, don't handle the current frame
+			if skipHandling {
+				continue
+			}
+			wire.LogFrame(c.logger, streamFrame, false)
+			handleErr = c.streamsMap.HandleStreamFrame(streamFrame, rcvTime)
+		} else if frameType.IsAckFrameType() {
+			ackFrame, l, err := c.frameParser.ParseAckFrame(frameType, data, encLevel, c.version)
+			if err != nil {
+				return false, false, nil, err
+			}
+			data = data[l:]
+			if log != nil {
+				frames = append(frames, toQlogFrame(ackFrame))
+			}
+			// an error occurred handling a previous frame, don't handle the current frame
+			if skipHandling {
+				continue
+			}
+			wire.LogFrame(c.logger, ackFrame, false)
+			handleErr = c.handleAckFrame(ackFrame, encLevel, rcvTime)
+		} else if frameType.IsDatagramFrameType() {
+			datagramFrame, l, err := c.frameParser.ParseDatagramFrame(frameType, data, c.version)
+			if err != nil {
+				return false, false, nil, err
+			}
+			data = data[l:]
+
+			if log != nil {
+				frames = append(frames, toQlogFrame(datagramFrame))
+			}
+			// an error occurred handling a previous frame, don't handle the current frame
+			if skipHandling {
+				continue
+			}
+			wire.LogFrame(c.logger, datagramFrame, false)
+			handleErr = c.handleDatagramFrame(datagramFrame)
+		} else {
+			frame, l, err := c.frameParser.ParseLessCommonFrame(frameType, data, c.version)
+			if err != nil {
+				return false, false, nil, err
+			}
+			data = data[l:]
+
+			if log != nil {
+				frames = append(frames, toQlogFrame(frame))
+			}
+			// an error occurred handling a previous frame, don't handle the current frame
+			if skipHandling {
+				continue
+			}
+			pc, err := c.handleFrame(frame, encLevel, destConnID, rcvTime)
+			if pc != nil {
+				pathChallenge = pc
+			}
+			handleErr = err
+		}
+
+		if handleErr != nil {
+			// if we're logging, we need to keep parsing (but not handling) all frames
+			skipHandling = true
+			if log == nil {
+				return false, false, nil, handleErr
+			}
+		}
+	}
+
+	if log != nil {
+		log(frames)
+		if handleErr != nil {
+			return false, false, nil, handleErr
+		}
+	}
+
+	// Handle completion of the handshake after processing all the frames.
+	// This ensures that we correctly handle the following case on the server side:
+	// We receive a Handshake packet that contains the CRYPTO frame that allows us to complete the handshake,
+	// and an ACK serialized after that CRYPTO frame. In this case, we still want to process the ACK frame.
+	if !handshakeWasComplete && c.handshakeComplete {
+		if err := c.handleHandshakeComplete(rcvTime); err != nil {
+			return false, false, nil, err
+		}
+	}
+	return
+}
+
+func (c *Conn) handleFrame(
+	f wire.Frame,
+	encLevel protocol.EncryptionLevel,
+	destConnID protocol.ConnectionID,
+	rcvTime monotime.Time,
+) (pathChallenge *wire.PathChallengeFrame, _ error) {
+	var err error
+	wire.LogFrame(c.logger, f, false)
+	switch frame := f.(type) {
+	case *wire.CryptoFrame:
+		err = c.handleCryptoFrame(frame, encLevel, rcvTime)
+	case *wire.ConnectionCloseFrame:
+		err = c.handleConnectionCloseFrame(frame)
+	case *wire.ResetStreamFrame:
+		err = c.streamsMap.HandleResetStreamFrame(frame, rcvTime)
+	case *wire.MaxDataFrame:
+		c.connFlowController.UpdateSendWindow(frame.MaximumData)
+	case *wire.MaxStreamDataFrame:
+		err = c.streamsMap.HandleMaxStreamDataFrame(frame)
+	case *wire.MaxStreamsFrame:
+		c.streamsMap.HandleMaxStreamsFrame(frame)
+	case *wire.DataBlockedFrame:
+	case *wire.StreamDataBlockedFrame:
+		err = c.streamsMap.HandleStreamDataBlockedFrame(frame)
+	case *wire.StreamsBlockedFrame:
+	case *wire.StopSendingFrame:
+		err = c.streamsMap.HandleStopSendingFrame(frame)
+	case *wire.PingFrame:
+	case *wire.PathChallengeFrame:
+		c.handlePathChallengeFrame(frame)
+		pathChallenge = frame
+	case *wire.PathResponseFrame:
+		err = c.handlePathResponseFrame(frame)
+	case *wire.NewTokenFrame:
+		err = c.handleNewTokenFrame(frame)
+	case *wire.NewConnectionIDFrame:
+		err = c.connIDManager.Add(frame)
+	case *wire.RetireConnectionIDFrame:
+		err = c.connIDGenerator.Retire(frame.SequenceNumber, destConnID, rcvTime.Add(3*c.rttStats.PTO(false)))
+	case *wire.HandshakeDoneFrame:
+		err = c.handleHandshakeDoneFrame(rcvTime)
+	default:
+		err = fmt.Errorf("unexpected frame type: %s", reflect.ValueOf(&frame).Elem().Type().Name())
+	}
+	return pathChallenge, err
+}
+
+// handlePacket is called by the server with a new packet
+func (c *Conn) handlePacket(p receivedPacket) {
+	c.receivedPacketMx.Lock()
+	// Discard packets once the amount of queued packets is larger than
+	// the channel size, protocol.MaxConnUnprocessedPackets
+	if c.receivedPackets.Len() >= protocol.MaxConnUnprocessedPackets {
+		recordRawDatagramPacketDrop()
+		if c.qlogger != nil {
+			var datagramPayloadChecksum qlog.DatagramPayloadChecksum
+			if wire.IsLongHeaderPacket(p.data[0]) {
+				datagramPayloadChecksum = qlog.CalculateDatagramPayloadChecksum(p.data)
+			}
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Raw:                     qlog.RawInfo{Length: int(p.Size())},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Trigger:                 qlog.PacketDropDOSPrevention,
+			})
+		}
+		c.receivedPacketMx.Unlock()
+		return
+	}
+	c.receivedPackets.PushBack(p)
+	c.receivedPacketMx.Unlock()
+
+	select {
+	case c.notifyReceivedPacket <- struct{}{}:
+	default:
+	}
+}
+
+func (c *Conn) handleConnectionCloseFrame(frame *wire.ConnectionCloseFrame) error {
+	if frame.IsApplicationError {
+		return &qerr.ApplicationError{
+			Remote:       true,
+			ErrorCode:    qerr.ApplicationErrorCode(frame.ErrorCode),
+			ErrorMessage: frame.ReasonPhrase,
+		}
+	}
+	return &qerr.TransportError{
+		Remote:       true,
+		ErrorCode:    qerr.TransportErrorCode(frame.ErrorCode),
+		FrameType:    frame.FrameType,
+		ErrorMessage: frame.ReasonPhrase,
+	}
+}
+
+func (c *Conn) handleCryptoFrame(frame *wire.CryptoFrame, encLevel protocol.EncryptionLevel, rcvTime monotime.Time) error {
+	if err := c.cryptoStreamManager.HandleCryptoFrame(frame, encLevel); err != nil {
+		return err
+	}
+	for {
+		data := c.cryptoStreamManager.GetCryptoData(encLevel)
+		if data == nil {
+			break
+		}
+		if err := c.cryptoStreamHandler.HandleMessage(data, encLevel); err != nil {
+			return err
+		}
+	}
+	return c.handleHandshakeEvents(rcvTime)
+}
+
+func (c *Conn) handleHandshakeEvents(now monotime.Time) error {
+	for {
+		ev := c.cryptoStreamHandler.NextEvent()
+		var err error
+		switch ev.Kind {
+		case handshake.EventNoEvent:
+			return nil
+		case handshake.EventHandshakeComplete:
+			// Don't call handleHandshakeComplete yet.
+			// It's advantageous to process ACK frames that might be serialized after the CRYPTO frame first.
+			c.handshakeComplete = true
+		case handshake.EventReceivedTransportParameters:
+			err = c.handleTransportParameters(ev.TransportParameters)
+		case handshake.EventRestoredTransportParameters:
+			c.restoreTransportParameters(ev.TransportParameters)
+			close(c.earlyConnReadyChan)
+		case handshake.EventReceived0RTTReadKeys,
+			handshake.EventReceivedHandshakeReadKeys,
+			handshake.EventReceived1RTTReadKeys:
+			//nolint:exhaustive // only Handshake and 1-RTT require finishing the previous CRYPTO stream
+			switch ev.Kind {
+			case handshake.EventReceivedHandshakeReadKeys:
+				err = c.cryptoStreamManager.Finish(protocol.EncryptionInitial)
+			case handshake.EventReceived1RTTReadKeys:
+				err = c.cryptoStreamManager.Finish(protocol.EncryptionHandshake)
+			}
+			// queue all previously undecryptable packets
+			c.undecryptablePacketsToProcess = append(c.undecryptablePacketsToProcess, c.undecryptablePackets...)
+			c.undecryptablePackets = nil
+		case handshake.EventDiscard0RTTKeys:
+			c.dropEncryptionLevel(protocol.Encryption0RTT, now)
+		case handshake.EventWriteInitialData:
+			_, err = c.initialStream.Write(ev.Data)
+		case handshake.EventWriteHandshakeData:
+			_, err = c.handshakeStream.Write(ev.Data)
+		}
+		if err != nil {
+			return err
+		}
+	}
+}
+
+func (c *Conn) handlePathChallengeFrame(f *wire.PathChallengeFrame) {
+	if c.perspective == protocol.PerspectiveClient {
+		c.queueControlFrame(&wire.PathResponseFrame{Data: f.Data})
+	}
+}
+
+func (c *Conn) handlePathResponseFrame(f *wire.PathResponseFrame) error {
+	switch c.perspective {
+	case protocol.PerspectiveClient:
+		return c.handlePathResponseFrameClient(f)
+	case protocol.PerspectiveServer:
+		return c.handlePathResponseFrameServer(f)
+	default:
+		panic("unreachable")
+	}
+}
+
+func (c *Conn) handlePathResponseFrameClient(f *wire.PathResponseFrame) error {
+	pm := c.pathManagerOutgoing.Load()
+	if pm == nil {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "unexpected PATH_RESPONSE frame",
+		}
+	}
+	pm.HandlePathResponseFrame(f)
+	return nil
+}
+
+func (c *Conn) handlePathResponseFrameServer(f *wire.PathResponseFrame) error {
+	if c.pathManager == nil {
+		// since we didn't send PATH_CHALLENGEs yet, we don't expect PATH_RESPONSEs
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "unexpected PATH_RESPONSE frame",
+		}
+	}
+	c.pathManager.HandlePathResponseFrame(f)
+	return nil
+}
+
+func (c *Conn) handleNewTokenFrame(frame *wire.NewTokenFrame) error {
+	if c.perspective == protocol.PerspectiveServer {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "received NEW_TOKEN frame from the client",
+		}
+	}
+	if c.config.TokenStore != nil {
+		c.config.TokenStore.Put(c.tokenStoreKey, &ClientToken{data: frame.Token, rtt: c.rttStats.SmoothedRTT()})
+	}
+	return nil
+}
+
+func (c *Conn) handleHandshakeDoneFrame(rcvTime monotime.Time) error {
+	if c.perspective == protocol.PerspectiveServer {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "received a HANDSHAKE_DONE frame",
+		}
+	}
+	if !c.handshakeConfirmed {
+		return c.handleHandshakeConfirmed(rcvTime)
+	}
+	return nil
+}
+
+func (c *Conn) handleAckFrame(frame *wire.AckFrame, encLevel protocol.EncryptionLevel, rcvTime monotime.Time) error {
+	acked1RTTPacket, err := c.sentPacketHandler.ReceivedAck(frame, encLevel, c.lastPacketReceivedTime)
+	if err != nil {
+		return err
+	}
+	if !acked1RTTPacket {
+		return nil
+	}
+	// On the client side: If the packet acknowledged a 1-RTT packet, this confirms the handshake.
+	// This is only possible if the ACK was sent in a 1-RTT packet.
+	// This is an optimization over simply waiting for a HANDSHAKE_DONE frame, see section 4.1.2 of RFC 9001.
+	if c.perspective == protocol.PerspectiveClient && !c.handshakeConfirmed {
+		if err := c.handleHandshakeConfirmed(rcvTime); err != nil {
+			return err
+		}
+	}
+	// If one of the acknowledged packets was a Path MTU probe packet, this might have increased the Path MTU estimate.
+	if c.mtuDiscoverer != nil {
+		mtu := c.mtuDiscoverer.CurrentSize()
+		maxPayloadSize := estimateMaxPayloadSize(mtu)
+		if maxPayloadSize > protocol.ByteCount(c.maxPayloadSizeEstimate.Load()) {
+			c.maxPayloadSizeEstimate.Store(uint32(maxPayloadSize))
+			c.sentPacketHandler.SetMaxDatagramSize(mtu)
+		}
+	}
+	return c.cryptoStreamHandler.SetLargest1RTTAcked(frame.LargestAcked())
+}
+
+func (c *Conn) handleDatagramFrame(f *wire.DatagramFrame) error {
+	if f.Length(c.version) > wire.MaxDatagramSize {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "DATAGRAM frame too large",
+		}
+	}
+	c.datagramQueue.HandleDatagramFrame(f)
+	return nil
+}
+
+func (c *Conn) setCloseError(e *closeError) {
+	c.closeErr.CompareAndSwap(nil, e)
+	select {
+	case c.closeChan <- struct{}{}:
+	default:
+	}
+}
+
+// closeLocal closes the connection and send a CONNECTION_CLOSE containing the error
+func (c *Conn) closeLocal(e error) {
+	c.setCloseError(&closeError{err: e, immediate: false})
+}
+
+// destroy closes the connection without sending the error on the wire
+func (c *Conn) destroy(e error) {
+	c.destroyImpl(e)
+	<-c.ctx.Done()
+}
+
+func (c *Conn) destroyImpl(e error) {
+	c.setCloseError(&closeError{err: e, immediate: true})
+}
+
+// CloseWithError closes the connection with an error.
+// The error string will be sent to the peer.
+func (c *Conn) CloseWithError(code ApplicationErrorCode, desc string) error {
+	c.closeLocal(&qerr.ApplicationError{
+		ErrorCode:    code,
+		ErrorMessage: desc,
+	})
+	<-c.ctx.Done()
+	return nil
+}
+
+func (c *Conn) closeWithTransportError(code TransportErrorCode) {
+	c.closeLocal(&qerr.TransportError{ErrorCode: code})
+	<-c.ctx.Done()
+}
+
+func (c *Conn) handleCloseError(closeErr *closeError) {
+	if closeErr.immediate {
+		if nerr, ok := closeErr.err.(net.Error); ok && nerr.Timeout() {
+			c.logger.Errorf("Destroying connection: %s", closeErr.err)
+		} else {
+			c.logger.Errorf("Destroying connection with error: %s", closeErr.err)
+		}
+	} else {
+		if closeErr.err == nil {
+			c.logger.Infof("Closing connection.")
+		} else {
+			c.logger.Errorf("Closing connection with error: %s", closeErr.err)
+		}
+	}
+
+	e := closeErr.err
+	if e == nil {
+		e = &qerr.ApplicationError{}
+	} else {
+		defer func() { closeErr.err = e }()
+	}
+
+	var (
+		statelessResetErr     *StatelessResetError
+		versionNegotiationErr *VersionNegotiationError
+		recreateErr           *errCloseForRecreating
+		applicationErr        *ApplicationError
+		transportErr          *TransportError
+	)
+	var isRemoteClose bool
+	var trigger qlog.ConnectionCloseTrigger
+	var reason string
+	var transportErrorCode *qlog.TransportErrorCode
+	var applicationErrorCode *qlog.ApplicationErrorCode
+	switch {
+	case errors.Is(e, qerr.ErrIdleTimeout),
+		errors.Is(e, qerr.ErrHandshakeTimeout):
+		trigger = qlog.ConnectionCloseTriggerIdleTimeout
+	case errors.As(e, &statelessResetErr):
+		trigger = qlog.ConnectionCloseTriggerStatelessReset
+	case errors.As(e, &versionNegotiationErr):
+		trigger = qlog.ConnectionCloseTriggerVersionMismatch
+	case errors.As(e, &recreateErr):
+	case errors.As(e, &applicationErr):
+		isRemoteClose = applicationErr.Remote
+		reason = applicationErr.ErrorMessage
+		applicationErrorCode = &applicationErr.ErrorCode
+	case errors.As(e, &transportErr):
+		isRemoteClose = transportErr.Remote
+		reason = transportErr.ErrorMessage
+		transportErrorCode = &transportErr.ErrorCode
+	case closeErr.immediate:
+		e = closeErr.err
+	default:
+		te := &qerr.TransportError{
+			ErrorCode:    qerr.InternalError,
+			ErrorMessage: e.Error(),
+		}
+		e = te
+		reason = te.ErrorMessage
+		code := te.ErrorCode
+		transportErrorCode = &code
+	}
+
+	c.streamsMap.CloseWithError(e)
+	if c.datagramQueue != nil {
+		c.datagramQueue.CloseWithError(e)
+	}
+
+	// In rare instances, the connection ID manager might switch to a new connection ID
+	// when sending the CONNECTION_CLOSE frame.
+	// The connection ID manager removes the active stateless reset token from the packet
+	// handler map when it is closed, so we need to make sure that this happens last.
+	defer c.connIDManager.Close()
+
+	if c.qlogger != nil && !errors.As(e, &recreateErr) {
+		initiator := qlog.InitiatorLocal
+		if isRemoteClose {
+			initiator = qlog.InitiatorRemote
+		}
+		c.qlogger.RecordEvent(qlog.ConnectionClosed{
+			Initiator:        initiator,
+			ConnectionError:  transportErrorCode,
+			ApplicationError: applicationErrorCode,
+			Trigger:          trigger,
+			Reason:           reason,
+		})
+	}
+
+	// If this is a remote close we're done here
+	if isRemoteClose {
+		c.connIDGenerator.ReplaceWithClosed(nil, 3*c.rttStats.PTO(false))
+		return
+	}
+	if closeErr.immediate {
+		c.connIDGenerator.RemoveAll()
+		return
+	}
+	// Don't send out any CONNECTION_CLOSE if this is an error that occurred
+	// before we even sent out the first packet.
+	if c.perspective == protocol.PerspectiveClient && !c.sentFirstPacket {
+		c.connIDGenerator.RemoveAll()
+		return
+	}
+	connClosePacket, err := c.sendConnectionClose(e)
+	if err != nil {
+		c.logger.Debugf("Error sending CONNECTION_CLOSE: %s", err)
+	}
+	c.connIDGenerator.ReplaceWithClosed(connClosePacket, 3*c.rttStats.PTO(false))
+}
+
+func (c *Conn) dropEncryptionLevel(encLevel protocol.EncryptionLevel, now monotime.Time) {
+	c.sentPacketHandler.DropPackets(encLevel, now)
+	c.receivedPacketHandler.DropPackets(encLevel)
+	//nolint:exhaustive // only Initial and 0-RTT need special treatment
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		c.droppedInitialKeys = true
+		c.cryptoStreamHandler.DiscardInitialKeys()
+	case protocol.Encryption0RTT:
+		c.streamsMap.ResetFor0RTT()
+		c.framer.Handle0RTTRejection()
+		c.connFlowController.Reset()
+	}
+}
+
+// is called for the client, when restoring transport parameters saved for 0-RTT
+func (c *Conn) restoreTransportParameters(params *wire.TransportParameters) {
+	if c.logger.Debug() {
+		c.logger.Debugf("Restoring Transport Parameters: %s", params)
+	}
+	if c.qlogger != nil {
+		c.qlogger.RecordEvent(qlog.ParametersSet{
+			Restore:                         true,
+			Initiator:                       qlog.InitiatorRemote,
+			SentBy:                          c.perspective,
+			OriginalDestinationConnectionID: params.OriginalDestinationConnectionID,
+			InitialSourceConnectionID:       params.InitialSourceConnectionID,
+			RetrySourceConnectionID:         params.RetrySourceConnectionID,
+			StatelessResetToken:             params.StatelessResetToken,
+			DisableActiveMigration:          params.DisableActiveMigration,
+			MaxIdleTimeout:                  params.MaxIdleTimeout,
+			MaxUDPPayloadSize:               params.MaxUDPPayloadSize,
+			AckDelayExponent:                params.AckDelayExponent,
+			MaxAckDelay:                     params.MaxAckDelay,
+			ActiveConnectionIDLimit:         params.ActiveConnectionIDLimit,
+			InitialMaxData:                  params.InitialMaxData,
+			InitialMaxStreamDataBidiLocal:   params.InitialMaxStreamDataBidiLocal,
+			InitialMaxStreamDataBidiRemote:  params.InitialMaxStreamDataBidiRemote,
+			InitialMaxStreamDataUni:         params.InitialMaxStreamDataUni,
+			InitialMaxStreamsBidi:           int64(params.MaxBidiStreamNum),
+			InitialMaxStreamsUni:            int64(params.MaxUniStreamNum),
+			MaxDatagramFrameSize:            params.MaxDatagramFrameSize,
+			EnableResetStreamAt:             params.EnableResetStreamAt,
+		})
+	}
+
+	c.peerParams = params
+	c.connIDGenerator.SetMaxActiveConnIDs(params.ActiveConnectionIDLimit)
+	c.connFlowController.UpdateSendWindow(params.InitialMaxData)
+	c.streamsMap.HandleTransportParameters(params)
+}
+
+func (c *Conn) handleTransportParameters(params *wire.TransportParameters) error {
+	if c.qlogger != nil {
+		c.qlogTransportParameters(params, c.perspective.Opposite(), false)
+	}
+	if err := c.checkTransportParameters(params); err != nil {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.TransportParameterError,
+			ErrorMessage: err.Error(),
+		}
+	}
+
+	if c.perspective == protocol.PerspectiveClient && c.peerParams != nil && c.ConnectionState().Used0RTT && !params.ValidForUpdate(c.peerParams) {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "server sent reduced limits after accepting 0-RTT data",
+		}
+	}
+
+	c.peerParams = params
+	// On the client side we have to wait for handshake completion.
+	// During a 0-RTT connection, we are only allowed to use the new transport parameters for 1-RTT packets.
+	if c.perspective == protocol.PerspectiveServer {
+		c.applyTransportParameters()
+		// On the server side, the early connection is ready as soon as we processed
+		// the client's transport parameters.
+		close(c.earlyConnReadyChan)
+	}
+	return nil
+}
+
+func (c *Conn) checkTransportParameters(params *wire.TransportParameters) error {
+	if c.logger.Debug() {
+		c.logger.Debugf("Processed Transport Parameters: %s", params)
+	}
+
+	// check the initial_source_connection_id
+	if params.InitialSourceConnectionID != c.handshakeDestConnID {
+		return fmt.Errorf("expected initial_source_connection_id to equal %s, is %s", c.handshakeDestConnID, params.InitialSourceConnectionID)
+	}
+
+	if c.perspective == protocol.PerspectiveServer {
+		return nil
+	}
+	// check the original_destination_connection_id
+	if params.OriginalDestinationConnectionID != c.origDestConnID {
+		return fmt.Errorf("expected original_destination_connection_id to equal %s, is %s", c.origDestConnID, params.OriginalDestinationConnectionID)
+	}
+	if c.retrySrcConnID != nil { // a Retry was performed
+		if params.RetrySourceConnectionID == nil {
+			return errors.New("missing retry_source_connection_id")
+		}
+		if *params.RetrySourceConnectionID != *c.retrySrcConnID {
+			return fmt.Errorf("expected retry_source_connection_id to equal %s, is %s", c.retrySrcConnID, *params.RetrySourceConnectionID)
+		}
+	} else if params.RetrySourceConnectionID != nil {
+		return errors.New("received retry_source_connection_id, although no Retry was performed")
+	}
+	return nil
+}
+
+func (c *Conn) applyTransportParameters() {
+	params := c.peerParams
+	// Our local idle timeout will always be > 0.
+	c.idleTimeout = c.config.MaxIdleTimeout
+	// If the peer advertised an idle timeout, take the minimum of the values.
+	if params.MaxIdleTimeout > 0 {
+		c.idleTimeout = min(c.idleTimeout, params.MaxIdleTimeout)
+	}
+	c.keepAliveInterval = min(c.config.KeepAlivePeriod, c.idleTimeout/2)
+	c.streamsMap.HandleTransportParameters(params)
+	c.frameParser.SetAckDelayExponent(params.AckDelayExponent)
+	c.connFlowController.UpdateSendWindow(params.InitialMaxData)
+	c.rttStats.SetMaxAckDelay(params.MaxAckDelay)
+	c.connIDGenerator.SetMaxActiveConnIDs(params.ActiveConnectionIDLimit)
+	if params.StatelessResetToken != nil {
+		c.connIDManager.SetStatelessResetToken(*params.StatelessResetToken)
+	}
+	// We don't support connection migration yet, so we don't have any use for the preferred_address.
+	if params.PreferredAddress != nil {
+		// Retire the connection ID.
+		c.connIDManager.AddFromPreferredAddress(params.PreferredAddress.ConnectionID, params.PreferredAddress.StatelessResetToken)
+	}
+	maxPacketSize := protocol.ByteCount(protocol.MaxPacketBufferSize)
+	if params.MaxUDPPayloadSize > 0 && params.MaxUDPPayloadSize < maxPacketSize {
+		maxPacketSize = params.MaxUDPPayloadSize
+	}
+	c.mtuDiscoverer = newMTUDiscoverer(
+		c.rttStats,
+		protocol.ByteCount(c.config.InitialPacketSize),
+		maxPacketSize,
+		c.qlogger,
+	)
+}
+
+func (c *Conn) triggerSending(now monotime.Time) error {
+	c.pacingDeadline = 0
+
+	sendMode := c.sentPacketHandler.SendMode(now)
+	switch sendMode {
+	case ackhandler.SendAny:
+		return c.sendPackets(now)
+	case ackhandler.SendNone:
+		c.blocked = blockModeHardBlocked
+		return nil
+	case ackhandler.SendPacingLimited:
+		deadline := c.sentPacketHandler.TimeUntilSend()
+		if deadline.IsZero() {
+			deadline = deadlineSendImmediately
+		}
+		c.pacingDeadline = deadline
+		// Allow sending of an ACK if we're pacing limit.
+		// This makes sure that a peer that is mostly receiving data (and thus has an inaccurate cwnd estimate)
+		// sends enough ACKs to allow its peer to utilize the bandwidth.
+		return c.maybeSendAckOnlyPacket(now)
+	case ackhandler.SendAck:
+		// We can at most send a single ACK only packet.
+		// There will only be a new ACK after receiving new packets.
+		// SendAck is only returned when we're congestion limited, so we don't need to set the pacing timer.
+		c.blocked = blockModeCongestionLimited
+		return c.maybeSendAckOnlyPacket(now)
+	case ackhandler.SendPTOInitial, ackhandler.SendPTOHandshake, ackhandler.SendPTOAppData:
+		if err := c.sendProbePacket(sendMode, now); err != nil {
+			return err
+		}
+		if c.sendQueue.WouldBlock() {
+			c.scheduleSending()
+			return nil
+		}
+		return c.triggerSending(now)
+	default:
+		return fmt.Errorf("BUG: invalid send mode %d", sendMode)
+	}
+}
+
+func (c *Conn) sendPackets(now monotime.Time) error {
+	if c.perspective == protocol.PerspectiveClient && c.handshakeConfirmed {
+		if pm := c.pathManagerOutgoing.Load(); pm != nil {
+			connID, frame, tr, ok := pm.NextPathToProbe()
+			if ok {
+				probe, buf, err := c.packer.PackPathProbePacket(connID, []ackhandler.Frame{frame}, c.version)
+				if err != nil {
+					return err
+				}
+				c.logger.Debugf("sending path probe packet from %s", c.LocalAddr())
+				c.logShortHeaderPacket(probe, protocol.ECNNon, buf.Len())
+				c.registerPackedShortHeaderPacket(probe, protocol.ECNNon, now)
+				tr.WriteTo(buf.Data, c.conn.RemoteAddr())
+				// There's (likely) more data to send. Loop around again.
+				c.scheduleSending()
+				return nil
+			}
+		}
+	}
+
+	// Path MTU Discovery
+	// Can't use GSO, since we need to send a single packet that's larger than our current maximum size.
+	// Performance-wise, this doesn't matter, since we only send a very small (<10) number of
+	// MTU probe packets per connection.
+	if c.handshakeConfirmed && c.mtuDiscoverer != nil && c.mtuDiscoverer.ShouldSendProbe(now) {
+		ping, size := c.mtuDiscoverer.GetPing(now)
+		p, buf, err := c.packer.PackMTUProbePacket(ping, size, c.version)
+		if err != nil {
+			return err
+		}
+		ecn := c.sentPacketHandler.ECNMode(true)
+		c.logShortHeaderPacket(p, ecn, buf.Len())
+		c.registerPackedShortHeaderPacket(p, ecn, now)
+		c.sendQueue.Send(buf, 0, ecn)
+		// There's (likely) more data to send. Loop around again.
+		c.scheduleSending()
+		return nil
+	}
+
+	if offset := c.connFlowController.GetWindowUpdate(now); offset > 0 {
+		c.framer.QueueControlFrame(&wire.MaxDataFrame{MaximumData: offset})
+	}
+	if cf := c.cryptoStreamManager.GetPostHandshakeData(protocol.MaxPostHandshakeCryptoFrameSize); cf != nil {
+		c.queueControlFrame(cf)
+	}
+
+	if !c.handshakeConfirmed {
+		packet, err := c.packer.PackCoalescedPacket(false, c.maxPacketSize(), now, c.version)
+		if err != nil || packet == nil {
+			return err
+		}
+		c.sentFirstPacket = true
+		if err := c.sendPackedCoalescedPacket(packet, c.sentPacketHandler.ECNMode(packet.IsOnlyShortHeaderPacket()), now); err != nil {
+			return err
+		}
+		//nolint:exhaustive // only need to handle pacing-related events here
+		switch c.sentPacketHandler.SendMode(now) {
+		case ackhandler.SendPacingLimited:
+			c.resetPacingDeadline()
+		case ackhandler.SendAny:
+			c.pacingDeadline = deadlineSendImmediately
+		}
+		return nil
+	}
+
+	if c.conn.capabilities().GSO {
+		return c.sendPacketsWithGSO(now)
+	}
+	return c.sendPacketsWithoutGSO(now)
+}
+
+func (c *Conn) sendPacketsWithoutGSO(now monotime.Time) error {
+	for {
+		buf := getPacketBuffer()
+		ecn := c.sentPacketHandler.ECNMode(true)
+		if _, err := c.appendOneShortHeaderPacket(buf, c.maxPacketSize(), ecn, now); err != nil {
+			if err == errNothingToPack {
+				buf.Release()
+				return nil
+			}
+			return err
+		}
+
+		c.sendQueue.Send(buf, 0, ecn)
+
+		if c.sendQueue.WouldBlock() {
+			return nil
+		}
+		sendMode := c.sentPacketHandler.SendMode(now)
+		if sendMode == ackhandler.SendPacingLimited {
+			c.resetPacingDeadline()
+			return nil
+		}
+		if sendMode != ackhandler.SendAny {
+			return nil
+		}
+		// Prioritize receiving of packets over sending out more packets.
+		c.receivedPacketMx.Lock()
+		hasPackets := !c.receivedPackets.Empty()
+		c.receivedPacketMx.Unlock()
+		if hasPackets {
+			c.pacingDeadline = deadlineSendImmediately
+			return nil
+		}
+	}
+}
+
+func (c *Conn) sendPacketsWithGSO(now monotime.Time) error {
+	buf := getLargePacketBuffer()
+	maxSize := c.maxPacketSize()
+
+	ecn := c.sentPacketHandler.ECNMode(true)
+	for {
+		var dontSendMore bool
+		size, err := c.appendOneShortHeaderPacket(buf, maxSize, ecn, now)
+		if err != nil {
+			if err != errNothingToPack {
+				return err
+			}
+			if buf.Len() == 0 {
+				buf.Release()
+				return nil
+			}
+			dontSendMore = true
+		}
+
+		if !dontSendMore {
+			sendMode := c.sentPacketHandler.SendMode(now)
+			if sendMode == ackhandler.SendPacingLimited {
+				c.resetPacingDeadline()
+			}
+			if sendMode != ackhandler.SendAny {
+				dontSendMore = true
+			}
+		}
+
+		// Don't send more packets in this batch if they require a different ECN marking than the previous ones.
+		nextECN := c.sentPacketHandler.ECNMode(true)
+
+		// Append another packet if
+		// 1. The congestion controller and pacer allow sending more
+		// 2. The last packet appended was a full-size packet
+		// 3. The next packet will have the same ECN marking
+		// 4. We still have enough space for another full-size packet in the buffer
+		if !dontSendMore && size == maxSize && nextECN == ecn && buf.Len()+maxSize <= buf.Cap() {
+			continue
+		}
+
+		c.sendQueue.Send(buf, uint16(maxSize), ecn)
+
+		if dontSendMore {
+			return nil
+		}
+		if c.sendQueue.WouldBlock() {
+			return nil
+		}
+
+		// Prioritize receiving of packets over sending out more packets.
+		c.receivedPacketMx.Lock()
+		hasPackets := !c.receivedPackets.Empty()
+		c.receivedPacketMx.Unlock()
+		if hasPackets {
+			c.pacingDeadline = deadlineSendImmediately
+			return nil
+		}
+
+		ecn = nextECN
+		buf = getLargePacketBuffer()
+	}
+}
+
+func (c *Conn) resetPacingDeadline() {
+	deadline := c.sentPacketHandler.TimeUntilSend()
+	if deadline.IsZero() {
+		deadline = deadlineSendImmediately
+	}
+	c.pacingDeadline = deadline
+}
+
+func (c *Conn) maybeSendAckOnlyPacket(now monotime.Time) error {
+	if !c.handshakeConfirmed {
+		ecn := c.sentPacketHandler.ECNMode(false)
+		packet, err := c.packer.PackCoalescedPacket(true, c.maxPacketSize(), now, c.version)
+		if err != nil {
+			return err
+		}
+		if packet == nil {
+			return nil
+		}
+		return c.sendPackedCoalescedPacket(packet, ecn, now)
+	}
+
+	ecn := c.sentPacketHandler.ECNMode(true)
+	p, buf, err := c.packer.PackAckOnlyPacket(c.maxPacketSize(), now, c.version)
+	if err != nil {
+		if err == errNothingToPack {
+			return nil
+		}
+		return err
+	}
+	c.logShortHeaderPacket(p, ecn, buf.Len())
+	c.registerPackedShortHeaderPacket(p, ecn, now)
+	c.sendQueue.Send(buf, 0, ecn)
+	return nil
+}
+
+func (c *Conn) sendProbePacket(sendMode ackhandler.SendMode, now monotime.Time) error {
+	var encLevel protocol.EncryptionLevel
+	//nolint:exhaustive // We only need to handle the PTO send modes here.
+	switch sendMode {
+	case ackhandler.SendPTOInitial:
+		encLevel = protocol.EncryptionInitial
+	case ackhandler.SendPTOHandshake:
+		encLevel = protocol.EncryptionHandshake
+	case ackhandler.SendPTOAppData:
+		encLevel = protocol.Encryption1RTT
+	default:
+		return fmt.Errorf("connection BUG: unexpected send mode: %d", sendMode)
+	}
+	// Queue probe packets until we actually send out a packet,
+	// or until there are no more packets to queue.
+	var packet *coalescedPacket
+	for packet == nil {
+		if wasQueued := c.sentPacketHandler.QueueProbePacket(encLevel); !wasQueued {
+			break
+		}
+		var err error
+		packet, err = c.packer.PackPTOProbePacket(encLevel, c.maxPacketSize(), false, now, c.version)
+		if err != nil {
+			return err
+		}
+	}
+	if packet == nil {
+		var err error
+		packet, err = c.packer.PackPTOProbePacket(encLevel, c.maxPacketSize(), true, now, c.version)
+		if err != nil {
+			return err
+		}
+	}
+	if packet == nil || (len(packet.longHdrPackets) == 0 && packet.shortHdrPacket == nil) {
+		return fmt.Errorf("connection BUG: couldn't pack %s probe packet: %v", encLevel, packet)
+	}
+	return c.sendPackedCoalescedPacket(packet, c.sentPacketHandler.ECNMode(packet.IsOnlyShortHeaderPacket()), now)
+}
+
+// appendOneShortHeaderPacket appends a new packet to the given packetBuffer.
+// If there was nothing to pack, the returned size is 0.
+func (c *Conn) appendOneShortHeaderPacket(buf *packetBuffer, maxSize protocol.ByteCount, ecn protocol.ECN, now monotime.Time) (protocol.ByteCount, error) {
+	startLen := buf.Len()
+	p, err := c.packer.AppendPacket(buf, maxSize, now, c.version)
+	if err != nil {
+		return 0, err
+	}
+	size := buf.Len() - startLen
+	c.logShortHeaderPacket(p, ecn, size)
+	c.registerPackedShortHeaderPacket(p, ecn, now)
+	return size, nil
+}
+
+func (c *Conn) registerPackedShortHeaderPacket(p shortHeaderPacket, ecn protocol.ECN, now monotime.Time) {
+	if p.IsPathProbePacket {
+		c.sentPacketHandler.SentPacket(
+			now,
+			p.PacketNumber,
+			protocol.InvalidPacketNumber,
+			p.StreamFrames,
+			p.Frames,
+			protocol.Encryption1RTT,
+			ecn,
+			p.Length,
+			p.IsPathMTUProbePacket,
+			true,
+		)
+		return
+	}
+	if c.firstAckElicitingPacketAfterIdleSentTime.IsZero() && (len(p.StreamFrames) > 0 || ackhandler.HasAckElicitingFrames(p.Frames)) {
+		c.firstAckElicitingPacketAfterIdleSentTime = now
+	}
+
+	largestAcked := protocol.InvalidPacketNumber
+	if p.Ack != nil {
+		largestAcked = p.Ack.LargestAcked()
+	}
+	c.sentPacketHandler.SentPacket(
+		now,
+		p.PacketNumber,
+		largestAcked,
+		p.StreamFrames,
+		p.Frames,
+		protocol.Encryption1RTT,
+		ecn,
+		p.Length,
+		p.IsPathMTUProbePacket,
+		false,
+	)
+	c.connIDManager.SentPacket()
+}
+
+func (c *Conn) sendPackedCoalescedPacket(packet *coalescedPacket, ecn protocol.ECN, now monotime.Time) error {
+	c.logCoalescedPacket(packet, ecn)
+	for _, p := range packet.longHdrPackets {
+		if c.firstAckElicitingPacketAfterIdleSentTime.IsZero() && p.IsAckEliciting() {
+			c.firstAckElicitingPacketAfterIdleSentTime = now
+		}
+		largestAcked := protocol.InvalidPacketNumber
+		if p.ack != nil {
+			largestAcked = p.ack.LargestAcked()
+		}
+		c.sentPacketHandler.SentPacket(
+			now,
+			p.header.PacketNumber,
+			largestAcked,
+			p.streamFrames,
+			p.frames,
+			p.EncryptionLevel(),
+			ecn,
+			p.length,
+			false,
+			false,
+		)
+		if c.perspective == protocol.PerspectiveClient && p.EncryptionLevel() == protocol.EncryptionHandshake &&
+			!c.droppedInitialKeys {
+			// On the client side, Initial keys are dropped as soon as the first Handshake packet is sent.
+			// See Section 4.9.1 of RFC 9001.
+			c.dropEncryptionLevel(protocol.EncryptionInitial, now)
+		}
+	}
+	if p := packet.shortHdrPacket; p != nil {
+		if c.firstAckElicitingPacketAfterIdleSentTime.IsZero() && p.IsAckEliciting() {
+			c.firstAckElicitingPacketAfterIdleSentTime = now
+		}
+		largestAcked := protocol.InvalidPacketNumber
+		if p.Ack != nil {
+			largestAcked = p.Ack.LargestAcked()
+		}
+		c.sentPacketHandler.SentPacket(
+			now,
+			p.PacketNumber,
+			largestAcked,
+			p.StreamFrames,
+			p.Frames,
+			protocol.Encryption1RTT,
+			ecn,
+			p.Length,
+			p.IsPathMTUProbePacket,
+			false,
+		)
+	}
+	c.connIDManager.SentPacket()
+	c.sendQueue.Send(packet.buffer, 0, ecn)
+	return nil
+}
+
+func (c *Conn) sendConnectionClose(e error) ([]byte, error) {
+	var packet *coalescedPacket
+	var err error
+	if transportErr, ok := errors.AsType[*qerr.TransportError](e); ok {
+		packet, err = c.packer.PackConnectionClose(transportErr, c.maxPacketSize(), c.version)
+	} else if applicationErr, ok := errors.AsType[*qerr.ApplicationError](e); ok {
+		packet, err = c.packer.PackApplicationClose(applicationErr, c.maxPacketSize(), c.version)
+	} else {
+		packet, err = c.packer.PackConnectionClose(&qerr.TransportError{
+			ErrorCode:    qerr.InternalError,
+			ErrorMessage: fmt.Sprintf("connection BUG: unspecified error type (msg: %s)", e.Error()),
+		}, c.maxPacketSize(), c.version)
+	}
+	if err != nil {
+		return nil, err
+	}
+	ecn := c.sentPacketHandler.ECNMode(packet.IsOnlyShortHeaderPacket())
+	c.logCoalescedPacket(packet, ecn)
+	return packet.buffer.Data, c.conn.Write(packet.buffer.Data, 0, ecn)
+}
+
+func (c *Conn) maxPacketSize() protocol.ByteCount {
+	if c.mtuDiscoverer == nil {
+		// Use the configured packet size on the client side.
+		// If the server sends a max_udp_payload_size that's smaller than this size, we can ignore this:
+		// Apparently the server still processed the (fully padded) Initial packet anyway.
+		if c.perspective == protocol.PerspectiveClient {
+			return protocol.ByteCount(c.config.InitialPacketSize)
+		}
+		// On the server side, there's no downside to using 1200 bytes until we received the client's transport
+		// parameters:
+		// * If the first packet didn't contain the entire ClientHello, all we can do is ACK that packet. We don't
+		//   need a lot of bytes for that.
+		// * If it did, we will have processed the transport parameters and initialized the MTU discoverer.
+		return protocol.MinInitialPacketSize
+	}
+	return c.mtuDiscoverer.CurrentSize()
+}
+
+// AcceptStream returns the next stream opened by the peer, blocking until one is available.
+func (c *Conn) AcceptStream(ctx context.Context) (*Stream, error) {
+	return c.streamsMap.AcceptStream(ctx)
+}
+
+// AcceptUniStream returns the next unidirectional stream opened by the peer, blocking until one is available.
+func (c *Conn) AcceptUniStream(ctx context.Context) (*ReceiveStream, error) {
+	return c.streamsMap.AcceptUniStream(ctx)
+}
+
+// OpenStream opens a new bidirectional QUIC stream.
+// There is no signaling to the peer about new streams:
+// The peer can only accept the stream after data has been sent on the stream,
+// or the stream has been reset or closed.
+// When reaching the peer's stream limit, it is not possible to open a new stream until the
+// peer raises the stream limit. In that case, a [StreamLimitReachedError] is returned.
+func (c *Conn) OpenStream() (*Stream, error) {
+	return c.streamsMap.OpenStream()
+}
+
+// OpenStreamSync opens a new bidirectional QUIC stream.
+// It blocks until a new stream can be opened.
+// There is no signaling to the peer about new streams:
+// The peer can only accept the stream after data has been sent on the stream,
+// or the stream has been reset or closed.
+func (c *Conn) OpenStreamSync(ctx context.Context) (*Stream, error) {
+	return c.streamsMap.OpenStreamSync(ctx)
+}
+
+// OpenUniStream opens a new outgoing unidirectional QUIC stream.
+// There is no signaling to the peer about new streams:
+// The peer can only accept the stream after data has been sent on the stream,
+// or the stream has been reset or closed.
+// When reaching the peer's stream limit, it is not possible to open a new stream until the
+// peer raises the stream limit. In that case, a [StreamLimitReachedError] is returned.
+func (c *Conn) OpenUniStream() (*SendStream, error) {
+	return c.streamsMap.OpenUniStream()
+}
+
+// OpenUniStreamSync opens a new outgoing unidirectional QUIC stream.
+// It blocks until a new stream can be opened.
+// There is no signaling to the peer about new streams:
+// The peer can only accept the stream after data has been sent on the stream,
+// or the stream has been reset or closed.
+func (c *Conn) OpenUniStreamSync(ctx context.Context) (*SendStream, error) {
+	return c.streamsMap.OpenUniStreamSync(ctx)
+}
+
+func (c *Conn) newFlowController(id protocol.StreamID) *streamFlowController {
+	initialSendWindow := c.peerParams.InitialMaxStreamDataUni
+	if protocol.StreamTypeOf(id) == protocol.StreamTypeBidi {
+		if protocol.StreamInitiator(id) == c.perspective {
+			initialSendWindow = c.peerParams.InitialMaxStreamDataBidiRemote
+		} else {
+			initialSendWindow = c.peerParams.InitialMaxStreamDataBidiLocal
+		}
+	}
+	return newStreamFlowController(
+		id,
+		c.connFlowController,
+		protocol.ByteCount(c.config.InitialStreamReceiveWindow),
+		protocol.ByteCount(c.config.MaxStreamReceiveWindow),
+		initialSendWindow,
+		c.rttStats,
+		c.logger,
+	)
+}
+
+// scheduleSending signals that we have data for sending
+func (c *Conn) scheduleSending() {
+	select {
+	case c.sendingScheduled <- struct{}{}:
+	default:
+	}
+}
+
+// tryQueueingUndecryptablePacket queues a packet for which we're missing the decryption keys.
+// The qlogevents.PacketType is only used for logging purposes.
+func (c *Conn) tryQueueingUndecryptablePacket(p receivedPacket, pt qlog.PacketType, datagramPayloadChecksum qlog.DatagramPayloadChecksum) {
+	if c.handshakeComplete {
+		panic("shouldn't queue undecryptable packets after handshake completion")
+	}
+	if len(c.undecryptablePackets)+1 > protocol.MaxUndecryptablePackets {
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   pt,
+					PacketNumber: protocol.InvalidPacketNumber,
+				},
+				Raw:                     qlog.RawInfo{Length: int(p.Size())},
+				DatagramPayloadChecksum: datagramPayloadChecksum,
+				Trigger:                 qlog.PacketDropDOSPrevention,
+			})
+		}
+		c.logger.Infof("Dropping undecryptable packet (%d bytes). Undecryptable packet queue full.", p.Size())
+		return
+	}
+	c.logger.Infof("Queueing packet (%d bytes) for later decryption", p.Size())
+	if c.qlogger != nil {
+		c.qlogger.RecordEvent(qlog.PacketBuffered{
+			Header: qlog.PacketHeader{
+				PacketType:   pt,
+				PacketNumber: protocol.InvalidPacketNumber,
+			},
+			Raw:                     qlog.RawInfo{Length: int(p.Size())},
+			DatagramPayloadChecksum: datagramPayloadChecksum,
+		})
+	}
+	c.undecryptablePackets = append(c.undecryptablePackets, receivedPacketWithChecksum{receivedPacket: p, checksum: datagramPayloadChecksum})
+}
+
+func (c *Conn) queueControlFrame(f wire.Frame) {
+	c.framer.QueueControlFrame(f)
+	c.scheduleSending()
+}
+
+func (c *Conn) onHasConnectionData() { c.scheduleSending() }
+
+func (c *Conn) onHasStreamData(id protocol.StreamID, str *SendStream) {
+	c.framer.AddActiveStream(id, str)
+	c.scheduleSending()
+}
+
+func (c *Conn) onHasStreamRetransmission(id protocol.StreamID, str *SendStream) {
+	c.framer.AddStreamWithRetransmission(id, str)
+	c.scheduleSending()
+}
+
+func (c *Conn) onHasStreamControlFrame(id protocol.StreamID, str streamControlFrameGetter) {
+	c.framer.AddStreamWithControlFrames(id, str)
+	c.scheduleSending()
+}
+
+func (c *Conn) onStreamCompleted(id protocol.StreamID) {
+	if err := c.streamsMap.DeleteStream(id); err != nil {
+		c.closeLocal(err)
+	}
+	c.framer.RemoveActiveStream(id)
+}
+
+func (c *Conn) updateStreamPriority(id protocol.StreamID) {
+	c.framer.UpdateStreamPriority(id)
+	c.scheduleSending()
+}
+
+func (c *Conn) recordStreamPriorityUpdated(id protocol.StreamID, urgency int8, incremental bool) {
+	if c.qlogger != nil {
+		c.qlogger.RecordEvent(qlog.StreamPriorityUpdated{
+			StreamID:    id,
+			Urgency:     urgency,
+			Incremental: incremental,
+		})
+	}
+}
+
+// SendDatagram sends a message using a QUIC datagram, as specified in RFC 9221,
+// if the peer enabled datagram support.
+// There is no delivery guarantee for DATAGRAM frames, they are not retransmitted if lost.
+// The payload of the datagram needs to fit into a single QUIC packet.
+// In addition, a datagram may be dropped before being sent out if the available packet size suddenly decreases.
+// If the payload is too large to be sent at the current time, a [DatagramTooLargeError] is returned.
+func (c *Conn) SendDatagram(p []byte) error {
+	if !c.supportsDatagrams() {
+		return errors.New("datagram support disabled")
+	}
+
+	f := &wire.DatagramFrame{DataLenPresent: true}
+	// The payload size estimate is conservative.
+	// Under many circumstances we could send a few more bytes.
+	maxDataLen := min(
+		f.MaxDataLen(c.peerParams.MaxDatagramFrameSize, c.version),
+		protocol.ByteCount(c.maxPayloadSizeEstimate.Load()),
+	)
+	if protocol.ByteCount(len(p)) > maxDataLen {
+		return &DatagramTooLargeError{MaxDatagramPayloadSize: int64(maxDataLen)}
+	}
+	f.Data = make([]byte, len(p))
+	copy(f.Data, p)
+	return c.datagramQueue.Add(f)
+}
+
+// ReceiveDatagram gets a message received in a QUIC datagram, as specified in RFC 9221.
+func (c *Conn) ReceiveDatagram(ctx context.Context) ([]byte, error) {
+	if !c.config.EnableDatagrams {
+		return nil, errors.New("datagram support disabled")
+	}
+	return c.datagramQueue.Receive(ctx)
+}
+
+// LocalAddr returns the local address of the QUIC connection.
+func (c *Conn) LocalAddr() net.Addr { return c.conn.LocalAddr() }
+
+// RemoteAddr returns the remote address of the QUIC connection.
+func (c *Conn) RemoteAddr() net.Addr { return c.conn.RemoteAddr() }
+
+// getPathManager lazily initializes the Conn's pathManagerOutgoing.
+// May create multiple pathManagerOutgoing objects if called concurrently.
+func (c *Conn) getPathManager() *pathManagerOutgoing {
+	old := c.pathManagerOutgoing.Load()
+	if old != nil {
+		// Path manager is already initialized
+		return old
+	}
+
+	// Initialize the path manager
+	new := newPathManagerOutgoing(
+		c.connIDManager.GetConnIDForPath,
+		c.connIDManager.RetireConnIDForPath,
+		c.scheduleSending,
+	)
+	if c.pathManagerOutgoing.CompareAndSwap(old, new) {
+		return new
+	}
+
+	// Swap failed. A concurrent writer wrote first, use their value.
+	return c.pathManagerOutgoing.Load()
+}
+
+func (c *Conn) AddPath(t *Transport) (*Path, error) {
+	if c.perspective == protocol.PerspectiveServer {
+		return nil, errors.New("server cannot initiate connection migration")
+	}
+	if c.peerParams.DisableActiveMigration {
+		return nil, errors.New("server disabled connection migration")
+	}
+	if err := t.init(false); err != nil {
+		return nil, err
+	}
+	return c.getPathManager().NewPath(
+		t,
+		200*time.Millisecond, // initial RTT estimate
+		func() {
+			runner := (*packetHandlerMap)(t)
+			c.connIDGenerator.AddConnRunner(
+				runner,
+				connRunnerCallbacks{
+					AddConnectionID:    func(connID protocol.ConnectionID) { runner.Add(connID, c) },
+					RemoveConnectionID: runner.Remove,
+					ReplaceWithClosed:  runner.ReplaceWithClosed,
+				},
+			)
+		},
+	), nil
+}
+
+// HandshakeComplete blocks until the handshake completes (or fails).
+// For the client, data sent before completion of the handshake is encrypted with 0-RTT keys.
+// For the server, data sent before completion of the handshake is encrypted with 1-RTT keys,
+// however the client's identity is only verified once the handshake completes.
+func (c *Conn) HandshakeComplete() <-chan struct{} {
+	return c.handshakeCompleteChan
+}
+
+// QlogTrace returns the qlog trace of the QUIC connection.
+// It is nil if qlog is not enabled.
+func (c *Conn) QlogTrace() qlogwriter.Trace {
+	return c.qlogTrace
+}
+
+// NextConnection transitions a connection to be usable after a 0-RTT rejection.
+// It waits for the handshake to complete and then enables the connection for normal use.
+// This should be called when the server rejects 0-RTT and the application receives
+// [Err0RTTRejected] errors.
+//
+// Note that 0-RTT rejection invalidates all data sent in 0-RTT packets. It is the
+// application's responsibility to handle this (for example by resending the data).
+func (c *Conn) NextConnection(ctx context.Context) (*Conn, error) {
+	// The handshake might fail after the server rejected 0-RTT.
+	// This could happen if the Finished message is malformed or never received.
+	select {
+	case <-ctx.Done():
+		return nil, context.Cause(ctx)
+	case <-c.Context().Done():
+		return nil, context.Cause(c.Context())
+	case <-c.HandshakeComplete():
+		c.streamsMap.UseResetMaps()
+		return c, nil
+	}
+}
+
+// estimateMaxPayloadSize estimates the maximum payload size for short header packets.
+// It is not very sophisticated: it just subtracts the size of header (assuming the maximum
+// connection ID length), and the size of the encryption tag.
+func estimateMaxPayloadSize(mtu protocol.ByteCount) protocol.ByteCount {
+	return mtu - 1 /* type byte */ - 20 /* maximum connection ID length */ - 16 /* tag size */
+}
diff --git a/electron/native/private-transport/third_party/quic-go/connection_logging.go b/electron/native/private-transport/third_party/quic-go/connection_logging.go
new file mode 100644
index 000000000..56df46005
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/connection_logging.go
@@ -0,0 +1,315 @@
+package quic
+
+import (
+	"net"
+	"net/netip"
+	"slices"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+)
+
+// ConvertFrame converts a wire.Frame into a logging.Frame.
+// This makes it possible for external packages to access the frames.
+// Furthermore, it removes the data slices from CRYPTO and STREAM frames.
+func toQlogFrame(frame wire.Frame) qlog.Frame {
+	switch f := frame.(type) {
+	case *wire.AckFrame:
+		// We use a pool for ACK frames.
+		// Implementations of the tracer interface may hold on to frames, so we need to make a copy here.
+		return qlog.Frame{Frame: toQlogAckFrame(f)}
+	case *wire.CryptoFrame:
+		return qlog.Frame{
+			Frame: &qlog.CryptoFrame{
+				Offset: int64(f.Offset),
+				Length: int64(len(f.Data)),
+			},
+		}
+	case *wire.StreamFrame:
+		return qlog.Frame{
+			Frame: &qlog.StreamFrame{
+				StreamID: f.StreamID,
+				Offset:   int64(f.Offset),
+				Length:   int64(f.DataLen()),
+				Fin:      f.Fin,
+			},
+		}
+	case *wire.DatagramFrame:
+		return qlog.Frame{
+			Frame: &qlog.DatagramFrame{
+				Length: int64(len(f.Data)),
+			},
+		}
+	default:
+		return qlog.Frame{Frame: frame}
+	}
+}
+
+func toQlogAckFrame(f *wire.AckFrame) *qlog.AckFrame {
+	ack := &qlog.AckFrame{
+		AckRanges: slices.Clone(f.AckRanges),
+		DelayTime: f.DelayTime,
+		ECNCE:     f.ECNCE,
+		ECT0:      f.ECT0,
+		ECT1:      f.ECT1,
+	}
+	return ack
+}
+
+func (c *Conn) logLongHeaderPacket(p *longHeaderPacket, ecn protocol.ECN, datagramPayloadChecksum qlog.DatagramPayloadChecksum) {
+	// quic-go logging
+	if c.logger.Debug() {
+		p.header.Log(c.logger)
+		if p.ack != nil {
+			wire.LogFrame(c.logger, p.ack, true)
+		}
+		for _, frame := range p.frames {
+			wire.LogFrame(c.logger, frame.Frame, true)
+		}
+		for _, frame := range p.streamFrames {
+			wire.LogFrame(c.logger, frame.Frame, true)
+		}
+	}
+
+	// tracing
+	if c.qlogger != nil {
+		numFrames := len(p.frames) + len(p.streamFrames)
+		if p.ack != nil {
+			numFrames++
+		}
+		frames := make([]qlog.Frame, 0, numFrames)
+		if p.ack != nil {
+			frames = append(frames, toQlogFrame(p.ack))
+		}
+		for _, f := range p.frames {
+			frames = append(frames, toQlogFrame(f.Frame))
+		}
+		for _, f := range p.streamFrames {
+			frames = append(frames, toQlogFrame(f.Frame))
+		}
+		c.qlogger.RecordEvent(qlog.PacketSent{
+			Header: qlog.PacketHeader{
+				PacketType:       toQlogPacketType(p.header.Type),
+				KeyPhaseBit:      p.header.KeyPhase,
+				PacketNumber:     p.header.PacketNumber,
+				Version:          p.header.Version,
+				SrcConnectionID:  p.header.SrcConnectionID,
+				DestConnectionID: p.header.DestConnectionID,
+			},
+			Raw: qlog.RawInfo{
+				Length:        int(p.length),
+				PayloadLength: int(p.header.Length),
+			},
+			DatagramPayloadChecksum: datagramPayloadChecksum,
+			Frames:                  frames,
+			ECN:                     toQlogECN(ecn),
+		})
+	}
+}
+
+func (c *Conn) logShortHeaderPacket(p shortHeaderPacket, ecn protocol.ECN, size protocol.ByteCount) {
+	c.logShortHeaderPacketWithDatagramPayloadChecksum(p, ecn, size, false, 0)
+}
+
+func (c *Conn) logShortHeaderPacketWithDatagramPayloadChecksum(p shortHeaderPacket, ecn protocol.ECN, size protocol.ByteCount, isCoalesced bool, datagramPayloadChecksum qlog.DatagramPayloadChecksum) {
+	if c.logger.Debug() && !isCoalesced {
+		c.logger.Debugf("-> Sending packet %d (%d bytes) for connection %s, 1-RTT (ECN: %s)", p.PacketNumber, size, c.logID, ecn)
+	}
+	// quic-go logging
+	if c.logger.Debug() {
+		wire.LogShortHeader(c.logger, p.DestConnID, p.PacketNumber, p.PacketNumberLen, p.KeyPhase)
+		if p.Ack != nil {
+			wire.LogFrame(c.logger, p.Ack, true)
+		}
+		for _, f := range p.Frames {
+			wire.LogFrame(c.logger, f.Frame, true)
+		}
+		for _, f := range p.StreamFrames {
+			wire.LogFrame(c.logger, f.Frame, true)
+		}
+	}
+
+	// tracing
+	if c.qlogger != nil {
+		numFrames := len(p.Frames) + len(p.StreamFrames)
+		if p.Ack != nil {
+			numFrames++
+		}
+		fs := make([]qlog.Frame, 0, numFrames)
+		if p.Ack != nil {
+			fs = append(fs, toQlogFrame(p.Ack))
+		}
+		for _, f := range p.Frames {
+			fs = append(fs, toQlogFrame(f.Frame))
+		}
+		for _, f := range p.StreamFrames {
+			fs = append(fs, toQlogFrame(f.Frame))
+		}
+		c.qlogger.RecordEvent(qlog.PacketSent{
+			Header: qlog.PacketHeader{
+				PacketType:       qlog.PacketType1RTT,
+				KeyPhaseBit:      p.KeyPhase,
+				PacketNumber:     p.PacketNumber,
+				Version:          c.version,
+				DestConnectionID: p.DestConnID,
+			},
+			Raw: qlog.RawInfo{
+				Length:        int(size),
+				PayloadLength: int(size - wire.ShortHeaderLen(p.DestConnID, p.PacketNumberLen)),
+			},
+			DatagramPayloadChecksum: datagramPayloadChecksum,
+			Frames:                  fs,
+			ECN:                     toQlogECN(ecn),
+		})
+	}
+}
+
+func (c *Conn) logCoalescedPacket(packet *coalescedPacket, ecn protocol.ECN) {
+	var datagramPayloadChecksum qlog.DatagramPayloadChecksum
+	if c.qlogger != nil {
+		datagramPayloadChecksum = qlog.CalculateDatagramPayloadChecksum(packet.buffer.Data)
+	}
+	if c.logger.Debug() {
+		// There's a short period between dropping both Initial and Handshake keys and completion of the handshake,
+		// during which we might call PackCoalescedPacket but just pack a short header packet.
+		if len(packet.longHdrPackets) == 0 && packet.shortHdrPacket != nil {
+			c.logShortHeaderPacketWithDatagramPayloadChecksum(
+				*packet.shortHdrPacket,
+				ecn,
+				packet.shortHdrPacket.Length,
+				false,
+				datagramPayloadChecksum,
+			)
+			return
+		}
+		if len(packet.longHdrPackets) > 1 {
+			c.logger.Debugf("-> Sending coalesced packet (%d parts, %d bytes) for connection %s", len(packet.longHdrPackets), packet.buffer.Len(), c.logID)
+		} else {
+			c.logger.Debugf("-> Sending packet %d (%d bytes) for connection %s, %s", packet.longHdrPackets[0].header.PacketNumber, packet.buffer.Len(), c.logID, packet.longHdrPackets[0].EncryptionLevel())
+		}
+	}
+	for _, p := range packet.longHdrPackets {
+		c.logLongHeaderPacket(p, ecn, datagramPayloadChecksum)
+	}
+	if p := packet.shortHdrPacket; p != nil {
+		c.logShortHeaderPacketWithDatagramPayloadChecksum(*p, ecn, p.Length, true, datagramPayloadChecksum)
+	}
+}
+
+func (c *Conn) qlogTransportParameters(tp *wire.TransportParameters, sentBy protocol.Perspective, restore bool) {
+	ev := qlog.ParametersSet{
+		Restore:                         restore,
+		OriginalDestinationConnectionID: tp.OriginalDestinationConnectionID,
+		InitialSourceConnectionID:       tp.InitialSourceConnectionID,
+		RetrySourceConnectionID:         tp.RetrySourceConnectionID,
+		StatelessResetToken:             tp.StatelessResetToken,
+		DisableActiveMigration:          tp.DisableActiveMigration,
+		MaxIdleTimeout:                  tp.MaxIdleTimeout,
+		MaxUDPPayloadSize:               tp.MaxUDPPayloadSize,
+		AckDelayExponent:                tp.AckDelayExponent,
+		MaxAckDelay:                     tp.MaxAckDelay,
+		ActiveConnectionIDLimit:         tp.ActiveConnectionIDLimit,
+		InitialMaxData:                  tp.InitialMaxData,
+		InitialMaxStreamDataBidiLocal:   tp.InitialMaxStreamDataBidiLocal,
+		InitialMaxStreamDataBidiRemote:  tp.InitialMaxStreamDataBidiRemote,
+		InitialMaxStreamDataUni:         tp.InitialMaxStreamDataUni,
+		InitialMaxStreamsBidi:           int64(tp.MaxBidiStreamNum),
+		InitialMaxStreamsUni:            int64(tp.MaxUniStreamNum),
+		MaxDatagramFrameSize:            tp.MaxDatagramFrameSize,
+		EnableResetStreamAt:             tp.EnableResetStreamAt,
+	}
+	if sentBy == c.perspective {
+		ev.Initiator = qlog.InitiatorLocal
+	} else {
+		ev.Initiator = qlog.InitiatorRemote
+	}
+	if tp.PreferredAddress != nil {
+		ev.PreferredAddress = &qlog.PreferredAddress{
+			IPv4:                tp.PreferredAddress.IPv4,
+			IPv6:                tp.PreferredAddress.IPv6,
+			ConnectionID:        tp.PreferredAddress.ConnectionID,
+			StatelessResetToken: tp.PreferredAddress.StatelessResetToken,
+		}
+	}
+	c.qlogger.RecordEvent(ev)
+}
+
+func toQlogECN(ecn protocol.ECN) qlog.ECN {
+	//nolint:exhaustive // only need to handle the 3 valid values
+	switch ecn {
+	case protocol.ECT0:
+		return qlog.ECT0
+	case protocol.ECT1:
+		return qlog.ECT1
+	case protocol.ECNCE:
+		return qlog.ECNCE
+	default:
+		return qlog.ECNUnsupported
+	}
+}
+
+func toQlogPacketType(pt protocol.PacketType) qlog.PacketType {
+	var qpt qlog.PacketType
+	switch pt {
+	case protocol.PacketTypeInitial:
+		qpt = qlog.PacketTypeInitial
+	case protocol.PacketTypeHandshake:
+		qpt = qlog.PacketTypeHandshake
+	case protocol.PacketType0RTT:
+		qpt = qlog.PacketType0RTT
+	case protocol.PacketTypeRetry:
+		qpt = qlog.PacketTypeRetry
+	}
+	return qpt
+}
+
+func toPathEndpointInfo(addr *net.UDPAddr) qlog.PathEndpointInfo {
+	if addr == nil {
+		return qlog.PathEndpointInfo{}
+	}
+
+	var info qlog.PathEndpointInfo
+	if addr.IP == nil || addr.IP.To4() != nil {
+		addrPort := netip.AddrPortFrom(netip.AddrFrom4([4]byte(addr.IP.To4())), uint16(addr.Port))
+		if addrPort.IsValid() {
+			info.IPv4 = addrPort
+		}
+	} else {
+		addrPort := netip.AddrPortFrom(netip.AddrFrom16([16]byte(addr.IP.To16())), uint16(addr.Port))
+		if addrPort.IsValid() {
+			info.IPv6 = addrPort
+		}
+	}
+	return info
+}
+
+// startedConnectionEvent builds a StartedConnection event using consistent logic
+// for both endpoints. If the local address is unspecified (e.g., dual-stack
+// listener), it selects the family based on the remote address and uses the
+// unspecified address of that family with the local port.
+func startedConnectionEvent(local, remote *net.UDPAddr) qlog.StartedConnection {
+	var localInfo, remoteInfo qlog.PathEndpointInfo
+	if remote != nil {
+		remoteInfo = toPathEndpointInfo(remote)
+	}
+	if local != nil {
+		if local.IP == nil || local.IP.IsUnspecified() {
+			// Choose local family based on the remote address family.
+			if remote != nil && remote.IP.To4() != nil {
+				ap := netip.AddrPortFrom(netip.AddrFrom4([4]byte{}), uint16(local.Port))
+				if ap.IsValid() {
+					localInfo.IPv4 = ap
+				}
+			} else if remote != nil && remote.IP.To16() != nil && remote.IP.To4() == nil {
+				ap := netip.AddrPortFrom(netip.AddrFrom16([16]byte{}), uint16(local.Port))
+				if ap.IsValid() {
+					localInfo.IPv6 = ap
+				}
+			}
+		} else {
+			localInfo = toPathEndpointInfo(local)
+		}
+	}
+	return qlog.StartedConnection{Local: localInfo, Remote: remoteInfo}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/connection_logging_test.go b/electron/native/private-transport/third_party/quic-go/connection_logging_test.go
new file mode 100644
index 000000000..d93d309e7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/connection_logging_test.go
@@ -0,0 +1,143 @@
+package quic
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestConnectionLoggingCryptoFrame(t *testing.T) {
+	f := toQlogFrame(&wire.CryptoFrame{
+		Offset: 1234,
+		Data:   []byte("foobar"),
+	})
+	require.Equal(t, &qlog.CryptoFrame{
+		Offset: 1234,
+		Length: 6,
+	}, f.Frame)
+}
+
+func TestConnectionLoggingStreamFrame(t *testing.T) {
+	f := toQlogFrame(&wire.StreamFrame{
+		StreamID: 42,
+		Offset:   1234,
+		Data:     []byte("foo"),
+		Fin:      true,
+	})
+	require.Equal(t, &qlog.StreamFrame{
+		StreamID: 42,
+		Offset:   1234,
+		Length:   3,
+		Fin:      true,
+	}, f.Frame)
+}
+
+func TestConnectionLoggingAckFrame(t *testing.T) {
+	ack := &wire.AckFrame{
+		AckRanges: []wire.AckRange{
+			{Smallest: 1, Largest: 3},
+			{Smallest: 6, Largest: 7},
+		},
+		DelayTime: 42,
+		ECNCE:     123,
+		ECT0:      456,
+		ECT1:      789,
+	}
+	f := toQlogFrame(ack)
+	// now modify the ACK range in the original frame
+	ack.AckRanges[0].Smallest = 2
+	require.Equal(t, &qlog.AckFrame{
+		AckRanges: []wire.AckRange{
+			{Smallest: 1, Largest: 3}, // unchanged, since the ACK ranges were cloned
+			{Smallest: 6, Largest: 7},
+		},
+		DelayTime: 42,
+		ECNCE:     123,
+		ECT0:      456,
+		ECT1:      789,
+	}, f.Frame)
+}
+
+func TestConnectionLoggingDatagramFrame(t *testing.T) {
+	f := toQlogFrame(&wire.DatagramFrame{Data: []byte("foobar")})
+	require.Equal(t, &qlog.DatagramFrame{Length: 6}, f.Frame)
+}
+
+func TestConnectionLoggingOtherFrames(t *testing.T) {
+	f := toQlogFrame(&wire.MaxDataFrame{MaximumData: 1234})
+	require.Equal(t, &qlog.MaxDataFrame{MaximumData: 1234}, f.Frame)
+}
+
+func TestConnectionLoggingStartedConnectionEvent(t *testing.T) {
+	tests := []struct {
+		name          string
+		local         *net.UDPAddr
+		remote        *net.UDPAddr
+		wantLocalIP   string
+		wantLocalPort uint16
+		wantRemote    netip.AddrPort
+	}{
+		{
+			name:          "unspecified local, remote IPv4 -> 0.0.0.0",
+			local:         &net.UDPAddr{Port: 58451},
+			remote:        &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 6121},
+			wantLocalIP:   "0.0.0.0",
+			wantLocalPort: 58451,
+			wantRemote:    netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), 6121),
+		},
+		{
+			name:          "unspecified local, remote IPv6 -> ::",
+			local:         &net.UDPAddr{Port: 4242},
+			remote:        &net.UDPAddr{IP: net.ParseIP("2001:db8::1"), Port: 6121},
+			wantLocalIP:   "::",
+			wantLocalPort: 4242,
+			wantRemote:    func() netip.AddrPort { a, _ := netip.ParseAddr("2001:db8::1"); return netip.AddrPortFrom(a, 6121) }(),
+		},
+		{
+			name:          "specified local IPv4",
+			local:         &net.UDPAddr{IP: net.IPv4(192, 168, 1, 10), Port: 9999},
+			remote:        &net.UDPAddr{IP: net.IPv4(10, 0, 0, 1), Port: 1234},
+			wantLocalIP:   "192.168.1.10",
+			wantLocalPort: 9999,
+			wantRemote:    netip.AddrPortFrom(netip.AddrFrom4([4]byte{10, 0, 0, 1}), 1234),
+		},
+		{
+			name:          "specified local IPv6",
+			local:         &net.UDPAddr{IP: net.ParseIP("fe80::1"), Port: 999},
+			remote:        &net.UDPAddr{IP: net.ParseIP("2001:db8::1"), Port: 6121},
+			wantLocalIP:   "fe80::1",
+			wantLocalPort: 999,
+			wantRemote:    func() netip.AddrPort { a, _ := netip.ParseAddr("2001:db8::1"); return netip.AddrPortFrom(a, 6121) }(),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ev := startedConnectionEvent(tc.local, tc.remote)
+			var gotIP string
+			var gotPort uint16
+			if ev.Local.IPv4.IsValid() {
+				gotIP = ev.Local.IPv4.Addr().String()
+				gotPort = ev.Local.IPv4.Port()
+			} else if ev.Local.IPv6.IsValid() {
+				gotIP = ev.Local.IPv6.Addr().String()
+				gotPort = ev.Local.IPv6.Port()
+			}
+			require.Equal(t, tc.wantLocalIP, gotIP)
+			require.Equal(t, tc.wantLocalPort, gotPort)
+
+			var gotRemote netip.AddrPort
+			if ev.Remote.IPv4.IsValid() {
+				gotRemote = ev.Remote.IPv4
+			} else if ev.Remote.IPv6.IsValid() {
+				gotRemote = ev.Remote.IPv6
+			}
+			require.Equal(t, tc.wantRemote, gotRemote)
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/connection_test.go b/electron/native/private-transport/third_party/quic-go/connection_test.go
new file mode 100644
index 000000000..68dadf516
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/connection_test.go
@@ -0,0 +1,3509 @@
+package quic
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"strconv"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/mocks"
+	mockackhandler "github.com/quic-go/quic-go/internal/mocks/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+type testConnectionOpt func(*Conn)
+
+func connectionOptCryptoSetup(cs *mocks.MockCryptoSetup) testConnectionOpt {
+	return func(conn *Conn) { conn.cryptoStreamHandler = cs }
+}
+
+func connectionOptConnFlowController(cfc *connectionFlowController) testConnectionOpt {
+	return func(conn *Conn) { conn.connFlowController = cfc }
+}
+
+func connectionOptTracer(r qlogwriter.Recorder) testConnectionOpt {
+	return func(conn *Conn) { conn.qlogger = r }
+}
+
+func connectionOptSentPacketHandler(sph ackhandler.SentPacketHandler) testConnectionOpt {
+	return func(conn *Conn) { conn.sentPacketHandler = sph }
+}
+
+func connectionOptUnpacker(u unpacker) testConnectionOpt {
+	return func(conn *Conn) { conn.unpacker = u }
+}
+
+func connectionOptSender(s sender) testConnectionOpt {
+	return func(conn *Conn) { conn.sendQueue = s }
+}
+
+func connectionOptHandshakeConfirmed() testConnectionOpt {
+	return func(conn *Conn) {
+		conn.handshakeComplete = true
+		conn.handshakeConfirmed = true
+	}
+}
+
+func connectionOptRTT(rtt time.Duration) testConnectionOpt {
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(rtt, 0)
+	return func(conn *Conn) { conn.rttStats = rttStats }
+}
+
+func connectionOptRetrySrcConnID(rcid protocol.ConnectionID) testConnectionOpt {
+	return func(conn *Conn) { conn.retrySrcConnID = &rcid }
+}
+
+type testConnection struct {
+	conn       *Conn
+	connRunner *MockConnRunner
+	sendConn   *MockSendConn
+	packer     *MockPacker
+	destConnID protocol.ConnectionID
+	srcConnID  protocol.ConnectionID
+	remoteAddr *net.UDPAddr
+}
+
+func (tc *testConnection) receivedPacketHandler() *ackhandler.ReceivedPacketHandler {
+	return &tc.conn.receivedPacketHandler
+}
+
+func newServerTestConnection(
+	t *testing.T,
+	mockCtrl *gomock.Controller,
+	config *Config,
+	gso bool,
+	opts ...testConnectionOpt,
+) *testConnection {
+	if mockCtrl == nil {
+		mockCtrl = gomock.NewController(t)
+	}
+	remoteAddr := &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 4321}
+	localAddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1234}
+	connRunner := NewMockConnRunner(mockCtrl)
+	sendConn := NewMockSendConn(mockCtrl)
+	sendConn.EXPECT().capabilities().Return(connCapabilities{GSO: gso}).AnyTimes()
+	sendConn.EXPECT().RemoteAddr().Return(remoteAddr).AnyTimes()
+	sendConn.EXPECT().LocalAddr().Return(localAddr).AnyTimes()
+	packer := NewMockPacker(mockCtrl)
+	b := make([]byte, 12)
+	rand.Read(b)
+	origDestConnID := protocol.ParseConnectionID(b[:6])
+	srcConnID := protocol.ParseConnectionID(b[6:12])
+	ctx, cancel := context.WithCancelCause(context.Background())
+	if config == nil {
+		config = &Config{DisablePathMTUDiscovery: true}
+	}
+	wc := newConnection(
+		ctx,
+		cancel,
+		sendConn,
+		connRunner,
+		origDestConnID,
+		nil,
+		protocol.ConnectionID{},
+		protocol.ConnectionID{},
+		srcConnID,
+		&protocol.DefaultConnectionIDGenerator{},
+		newStatelessResetter(nil),
+		populateConfig(config),
+		&tls.Config{},
+		handshake.NewTokenGenerator(handshake.TokenProtectorKey{}),
+		false,
+		1337*time.Millisecond,
+		nil,
+		utils.DefaultLogger,
+		protocol.Version1,
+	)
+	require.Nil(t, wc.testHooks)
+	conn := wc.Conn
+	conn.packer = packer
+	for _, opt := range opts {
+		opt(conn)
+	}
+	return &testConnection{
+		conn:       conn,
+		connRunner: connRunner,
+		sendConn:   sendConn,
+		packer:     packer,
+		destConnID: origDestConnID,
+		srcConnID:  srcConnID,
+		remoteAddr: remoteAddr,
+	}
+}
+
+func newClientTestConnection(
+	t *testing.T,
+	mockCtrl *gomock.Controller,
+	config *Config,
+	enable0RTT bool,
+	opts ...testConnectionOpt,
+) *testConnection {
+	if mockCtrl == nil {
+		mockCtrl = gomock.NewController(t)
+	}
+	remoteAddr := &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 4321}
+	localAddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1234}
+	connRunner := NewMockConnRunner(mockCtrl)
+	sendConn := NewMockSendConn(mockCtrl)
+	sendConn.EXPECT().capabilities().Return(connCapabilities{}).AnyTimes()
+	sendConn.EXPECT().RemoteAddr().Return(remoteAddr).AnyTimes()
+	sendConn.EXPECT().LocalAddr().Return(localAddr).AnyTimes()
+	packer := NewMockPacker(mockCtrl)
+	b := make([]byte, 12)
+	rand.Read(b)
+	destConnID := protocol.ParseConnectionID(b[:6])
+	srcConnID := protocol.ParseConnectionID(b[6:12])
+	if config == nil {
+		config = &Config{DisablePathMTUDiscovery: true}
+	}
+	conn := newClientConnection(
+		context.Background(),
+		sendConn,
+		connRunner,
+		destConnID,
+		srcConnID,
+		&protocol.DefaultConnectionIDGenerator{},
+		newStatelessResetter(nil),
+		populateConfig(config),
+		&tls.Config{ServerName: "quic-go.net"},
+		0,
+		enable0RTT,
+		false,
+		nil,
+		utils.DefaultLogger,
+		protocol.Version1,
+	)
+	require.Nil(t, conn.testHooks)
+	conn.packer = packer
+	for _, opt := range opts {
+		opt(conn.Conn)
+	}
+	return &testConnection{
+		conn:       conn.Conn,
+		connRunner: connRunner,
+		sendConn:   sendConn,
+		packer:     packer,
+		destConnID: destConnID,
+		srcConnID:  srcConnID,
+	}
+}
+
+func TestConnectionHandleStreamRelatedFrames(t *testing.T) {
+	const id protocol.StreamID = 5
+	connID := protocol.ConnectionID{}
+
+	tests := []struct {
+		name  string
+		frame wire.Frame
+	}{
+		{name: "RESET_STREAM", frame: &wire.ResetStreamFrame{StreamID: id, ErrorCode: 42, FinalSize: 1337}},
+		{name: "STOP_SENDING", frame: &wire.StopSendingFrame{StreamID: id, ErrorCode: 42}},
+		{name: "MAX_STREAM_DATA", frame: &wire.MaxStreamDataFrame{StreamID: id, MaximumStreamData: 1337}},
+		{name: "STREAM_DATA_BLOCKED", frame: &wire.StreamDataBlockedFrame{StreamID: id, MaximumStreamData: 42}},
+		{name: "STREAM_FRAME", frame: &wire.StreamFrame{StreamID: id, Data: []byte{1, 2, 3, 4, 5, 6, 7, 8}, Offset: 1337}},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			tc := newServerTestConnection(t, gomock.NewController(t), nil, false)
+			data, err := test.frame.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			_, _, _, err = tc.conn.handleFrames(data, connID, protocol.Encryption1RTT, nil, monotime.Now())
+			require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+		})
+	}
+}
+
+func TestConnectionHandleConnectionFlowControlFrames(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	connFC := newConnectionFlowController(0, 0, nil, utils.NewRTTStats(), utils.DefaultLogger)
+	require.Zero(t, connFC.SendWindowSize())
+	tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptConnFlowController(connFC))
+	now := monotime.Now()
+	connID := protocol.ConnectionID{}
+	// MAX_DATA frame
+	_, err := tc.conn.handleFrame(&wire.MaxDataFrame{MaximumData: 1337}, protocol.Encryption1RTT, connID, now)
+	require.NoError(t, err)
+	require.Equal(t, protocol.ByteCount(1337), connFC.SendWindowSize())
+	// DATA_BLOCKED frame
+	_, err = tc.conn.handleFrame(&wire.DataBlockedFrame{MaximumData: 1337}, protocol.Encryption1RTT, connID, now)
+	require.NoError(t, err)
+}
+
+func TestConnectionServerInvalidFrames(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tc := newServerTestConnection(t, mockCtrl, nil, false)
+
+	for _, test := range []struct {
+		Name  string
+		Frame wire.Frame
+	}{
+		{Name: "NEW_TOKEN", Frame: &wire.NewTokenFrame{Token: []byte("foobar")}},
+		{Name: "HANDSHAKE_DONE", Frame: &wire.HandshakeDoneFrame{}},
+		{Name: "PATH_RESPONSE", Frame: &wire.PathResponseFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}}},
+	} {
+		t.Run(test.Name, func(t *testing.T) {
+			_, err := tc.conn.handleFrame(test.Frame, protocol.Encryption1RTT, protocol.ConnectionID{}, monotime.Now())
+			require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+		})
+	}
+}
+
+func TestConnectionClose(t *testing.T) {
+	t.Run("transport error", func(t *testing.T) {
+		expectedErr := &qerr.TransportError{
+			ErrorCode:    1337,
+			FrameType:    42,
+			ErrorMessage: "foobar",
+		}
+		testConnectionClose(t, false, expectedErr)
+	})
+	t.Run("application error", func(t *testing.T) {
+		expectedErr := &qerr.ApplicationError{
+			ErrorCode:    1337,
+			ErrorMessage: "foobar",
+		}
+		testConnectionClose(t, true, expectedErr)
+	})
+}
+
+func testConnectionClose(t *testing.T, useApplicationClose bool, expectedErr error) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptTracer(&eventRecorder))
+		errChan := make(chan error, 1)
+
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		b := getPacketBuffer()
+		b.Data = append(b.Data, []byte("connection close")...)
+		if useApplicationClose {
+			tc.packer.EXPECT().PackApplicationClose(expectedErr, gomock.Any(), protocol.Version1).Return(&coalescedPacket{buffer: b}, nil)
+		} else {
+			tc.packer.EXPECT().PackConnectionClose(expectedErr, gomock.Any(), protocol.Version1).Return(&coalescedPacket{buffer: b}, nil)
+		}
+		tc.sendConn.EXPECT().Write([]byte("connection close"), gomock.Any(), gomock.Any())
+		tc.connRunner.EXPECT().ReplaceWithClosed(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.closeLocal(expectedErr)
+
+		synctest.Wait()
+
+		var want qlog.ConnectionClosed
+		if useApplicationClose {
+			code := expectedErr.(*qerr.ApplicationError).ErrorCode
+			want = qlog.ConnectionClosed{
+				Initiator:        qlog.InitiatorLocal,
+				ApplicationError: &code,
+				Reason:           expectedErr.(*qerr.ApplicationError).ErrorMessage,
+			}
+		} else {
+			code := expectedErr.(*qerr.TransportError).ErrorCode
+			want = qlog.ConnectionClosed{
+				Initiator:       qlog.InitiatorLocal,
+				ConnectionError: &code,
+				Reason:          expectedErr.(*qerr.TransportError).ErrorMessage,
+			}
+		}
+		require.Equal(t,
+			[]qlogwriter.Event{want},
+			eventRecorder.Events(qlog.ConnectionClosed{}),
+		)
+		eventRecorder.Clear()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, expectedErr)
+		default:
+			t.Fatal("connection was not closed")
+		}
+
+		// further calls to CloseWithError don't do anything
+		tc.conn.CloseWithError(42, "another error")
+		require.Empty(t, eventRecorder.Events(qlog.ConnectionClosed{}))
+	})
+}
+
+func TestConnectionStatelessReset(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptTracer(&eventRecorder))
+		errChan := make(chan error, 1)
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.destroy(&StatelessResetError{})
+
+		synctest.Wait()
+
+		require.Equal(t,
+			[]qlogwriter.Event{qlog.ConnectionClosed{Initiator: qlog.InitiatorLocal, Trigger: qlog.ConnectionCloseTriggerStatelessReset}},
+			eventRecorder.Events(qlog.ConnectionClosed{}),
+		)
+	})
+}
+
+func getLongHeaderPacket(t *testing.T, remoteAddr net.Addr, extHdr *wire.ExtendedHeader, data []byte) receivedPacket {
+	t.Helper()
+	b, err := extHdr.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	return receivedPacket{
+		remoteAddr: remoteAddr,
+		data:       append(b, data...),
+		buffer:     getPacketBuffer(),
+		rcvTime:    monotime.Now(),
+	}
+}
+
+func getShortHeaderPacket(t *testing.T, remoteAddr net.Addr, connID protocol.ConnectionID, pn protocol.PacketNumber, data []byte) receivedPacket {
+	t.Helper()
+	b, err := wire.AppendShortHeader(nil, connID, pn, protocol.PacketNumberLen2, protocol.KeyPhaseOne)
+	require.NoError(t, err)
+	return receivedPacket{
+		remoteAddr: remoteAddr,
+		data:       append(b, data...),
+		buffer:     getPacketBuffer(),
+		rcvTime:    monotime.Now(),
+	}
+}
+
+func TestConnectionServerInvalidPackets(t *testing.T) {
+	t.Run("Retry", func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptTracer(&eventRecorder))
+
+		p := getLongHeaderPacket(t,
+			tc.remoteAddr,
+			&wire.ExtendedHeader{Header: wire.Header{
+				Type:             protocol.PacketTypeRetry,
+				DestConnectionID: tc.conn.origDestConnID,
+				SrcConnectionID:  tc.srcConnID,
+				Version:          tc.conn.version,
+				Token:            []byte("foobar"),
+			}},
+			make([]byte, 16), /* Retry integrity tag */
+		)
+		wasProcessed, err := tc.conn.handleOnePacket(p, 0)
+		require.NoError(t, err)
+		require.False(t, wasProcessed)
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Header: qlog.PacketHeader{
+						PacketType:       qlog.PacketTypeRetry,
+						SrcConnectionID:  tc.srcConnID,
+						DestConnectionID: tc.conn.origDestConnID,
+						Version:          tc.conn.version,
+					},
+					Raw:     qlog.RawInfo{Length: int(p.Size())},
+					Trigger: qlog.PacketDropUnexpectedPacket,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+	})
+
+	t.Run("version negotiation", func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptTracer(&eventRecorder))
+
+		b := wire.ComposeVersionNegotiation(
+			protocol.ArbitraryLenConnectionID(tc.srcConnID.Bytes()),
+			protocol.ArbitraryLenConnectionID(tc.conn.origDestConnID.Bytes()),
+			[]Version{Version1},
+		)
+		wasProcessed, err := tc.conn.handleOnePacket(receivedPacket{data: b, buffer: getPacketBuffer()}, 0)
+		require.NoError(t, err)
+		require.False(t, wasProcessed)
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Header:  qlog.PacketHeader{PacketType: qlog.PacketTypeVersionNegotiation},
+					Raw:     qlog.RawInfo{Length: len(b)},
+					Trigger: qlog.PacketDropUnexpectedPacket,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+	})
+
+	t.Run("unsupported version", func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptTracer(&eventRecorder))
+
+		p := getLongHeaderPacket(t,
+			tc.remoteAddr,
+			&wire.ExtendedHeader{
+				Header:          wire.Header{Type: protocol.PacketTypeHandshake, Version: 1234},
+				PacketNumberLen: protocol.PacketNumberLen2,
+			},
+			nil,
+		)
+		wasProcessed, err := tc.conn.handleOnePacket(p, 42)
+		require.NoError(t, err)
+		require.False(t, wasProcessed)
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Header:                  qlog.PacketHeader{Version: 1234},
+					Raw:                     qlog.RawInfo{Length: int(p.Size())},
+					DatagramPayloadChecksum: 42,
+					Trigger:                 qlog.PacketDropUnsupportedVersion,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+	})
+
+	t.Run("invalid header", func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptTracer(&eventRecorder))
+
+		p := getLongHeaderPacket(t,
+			tc.remoteAddr,
+			&wire.ExtendedHeader{
+				Header:          wire.Header{Type: protocol.PacketTypeHandshake, Version: Version1},
+				PacketNumberLen: protocol.PacketNumberLen2,
+			},
+			nil,
+		)
+		p.data[0] ^= 0x40 // unset the QUIC bit
+		wasProcessed, err := tc.conn.handleOnePacket(p, 42)
+		require.NoError(t, err)
+		require.False(t, wasProcessed)
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Header:                  qlog.PacketHeader{},
+					Raw:                     qlog.RawInfo{Length: int(p.Size())},
+					DatagramPayloadChecksum: 42,
+					Trigger:                 qlog.PacketDropHeaderParseError,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+	})
+}
+
+func TestConnectionClientDrop0RTT(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	var eventRecorder events.Recorder
+	tc := newClientTestConnection(t, mockCtrl, nil, false, connectionOptTracer(&eventRecorder))
+
+	p := getLongHeaderPacket(t,
+		tc.remoteAddr,
+		&wire.ExtendedHeader{
+			Header:          wire.Header{Type: protocol.PacketType0RTT, Length: 2, Version: protocol.Version1},
+			PacketNumberLen: protocol.PacketNumberLen2,
+		},
+		nil,
+	)
+	wasProcessed, err := tc.conn.handleOnePacket(p, 1234)
+	require.NoError(t, err)
+	require.False(t, wasProcessed)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketType0RTT,
+					PacketNumber: protocol.InvalidPacketNumber,
+				},
+				Raw:                     qlog.RawInfo{Length: int(p.Size())},
+				DatagramPayloadChecksum: 1234,
+				Trigger:                 qlog.PacketDropUnexpectedPacket,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+}
+
+func TestConnectionUnpacking(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	unpacker := NewMockUnpacker(mockCtrl)
+	var eventRecorder events.Recorder
+	tc := newServerTestConnection(t,
+		mockCtrl,
+		nil,
+		false,
+		connectionOptUnpacker(unpacker),
+		connectionOptTracer(&eventRecorder),
+	)
+
+	// receive a long header packet
+	hdr := &wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             protocol.PacketTypeInitial,
+			DestConnectionID: tc.srcConnID,
+			Version:          protocol.Version1,
+			Length:           1,
+		},
+		PacketNumber:    0x37,
+		PacketNumberLen: protocol.PacketNumberLen1,
+	}
+	unpackedHdr := *hdr
+	unpackedHdr.PacketNumber = 0x1337
+	packet := getLongHeaderPacket(t, tc.remoteAddr, hdr, nil)
+	packet.ecn = protocol.ECNCE
+	rcvTime := monotime.Now().Add(-10 * time.Second)
+	packet.rcvTime = rcvTime
+	unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(&unpackedPacket{
+		encryptionLevel: protocol.EncryptionInitial,
+		hdr:             &unpackedHdr,
+		data:            []byte{0}, // one PADDING frame
+	}, nil)
+
+	wasProcessed, err := tc.conn.handleOnePacket(packet, 42)
+	require.NoError(t, err)
+	require.True(t, wasProcessed)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketReceived{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeInitial,
+					DestConnectionID: tc.srcConnID,
+					PacketNumber:     protocol.PacketNumber(0x1337),
+					Version:          protocol.Version1,
+				},
+				Frames:                  []qlog.Frame{},
+				ECN:                     qlog.ECNCE,
+				Raw:                     qlog.RawInfo{Length: int(packet.Size()), PayloadLength: 1},
+				DatagramPayloadChecksum: 42,
+			},
+		},
+		eventRecorder.Events(qlog.PacketReceived{}, qlog.PacketDropped{}),
+	)
+	eventRecorder.Clear()
+
+	// receive a duplicate of this packet
+	packet = getLongHeaderPacket(t, tc.remoteAddr, hdr, nil)
+	unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(&unpackedPacket{
+		encryptionLevel: protocol.EncryptionInitial,
+		hdr:             &unpackedHdr,
+		data:            []byte{0}, // one PADDING frame
+	}, nil)
+	wasProcessed, err = tc.conn.handleOnePacket(packet, 43)
+	require.NoError(t, err)
+	require.False(t, wasProcessed)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeInitial,
+					DestConnectionID: tc.srcConnID,
+					PacketNumber:     protocol.PacketNumber(0x1337),
+					Version:          protocol.Version1,
+				},
+				Raw:                     qlog.RawInfo{Length: int(packet.Size()), PayloadLength: 1},
+				DatagramPayloadChecksum: 43,
+				Trigger:                 qlog.PacketDropDuplicate,
+			},
+		},
+		eventRecorder.Events(qlog.PacketReceived{}, qlog.PacketDropped{}),
+	)
+	eventRecorder.Clear()
+
+	// receive a short header packet
+	packet = getShortHeaderPacket(t, tc.remoteAddr, tc.srcConnID, 0x37, nil)
+	packet.ecn = protocol.ECT1
+	packet.rcvTime = rcvTime
+	unpacker.EXPECT().UnpackShortHeader(gomock.Any(), gomock.Any()).Return(
+		protocol.PacketNumber(0x1337), protocol.PacketNumberLen2, protocol.KeyPhaseZero, []byte{0} /* PADDING */, nil,
+	)
+	wasProcessed, err = tc.conn.handleOnePacket(packet, 0)
+	require.NoError(t, err)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketReceived{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketType1RTT,
+					DestConnectionID: tc.srcConnID,
+					PacketNumber:     protocol.PacketNumber(0x1337),
+					KeyPhaseBit:      protocol.KeyPhaseZero,
+				},
+				Raw:    qlog.RawInfo{Length: int(packet.Size())},
+				Frames: []qlog.Frame{},
+				ECN:    qlog.ECT1,
+			},
+		},
+		eventRecorder.Events(qlog.PacketReceived{}, qlog.PacketDropped{}),
+	)
+	require.True(t, wasProcessed)
+}
+
+func TestConnectionUnpackCoalescedPacket(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	unpacker := NewMockUnpacker(mockCtrl)
+	var eventRecorder events.Recorder
+	tc := newServerTestConnection(t,
+		mockCtrl,
+		nil,
+		false,
+		connectionOptUnpacker(unpacker),
+		connectionOptTracer(&eventRecorder),
+	)
+	hdr1 := &wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             protocol.PacketTypeInitial,
+			DestConnectionID: tc.srcConnID,
+			Version:          protocol.Version1,
+			Length:           1,
+		},
+		PacketNumber:    37,
+		PacketNumberLen: protocol.PacketNumberLen1,
+	}
+	hdr2 := &wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             protocol.PacketTypeHandshake,
+			DestConnectionID: tc.srcConnID,
+			Version:          protocol.Version1,
+			Length:           1,
+		},
+		PacketNumber:    38,
+		PacketNumberLen: protocol.PacketNumberLen1,
+	}
+	// add a packet with a different source connection ID
+	incorrectSrcConnID := protocol.ParseConnectionID([]byte{0xa, 0xb, 0xc})
+	hdr3 := &wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             protocol.PacketTypeHandshake,
+			DestConnectionID: incorrectSrcConnID,
+			Version:          protocol.Version1,
+			Length:           1,
+		},
+		PacketNumber:    0x42,
+		PacketNumberLen: protocol.PacketNumberLen1,
+	}
+	unpackedHdr1 := *hdr1
+	unpackedHdr1.PacketNumber = 1337
+	unpackedHdr2 := *hdr2
+	unpackedHdr2.PacketNumber = 1338
+
+	packet := getLongHeaderPacket(t, tc.remoteAddr, hdr1, nil)
+	firstPacketLen := packet.Size()
+	packet2 := getLongHeaderPacket(t, tc.remoteAddr, hdr2, nil)
+	packet3 := getLongHeaderPacket(t, tc.remoteAddr, hdr3, nil)
+	packet.data = append(packet.data, packet2.data...)
+	packet.data = append(packet.data, packet3.data...)
+	packet.ecn = protocol.ECT1
+	rcvTime := monotime.Now()
+	packet.rcvTime = rcvTime
+
+	unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(&unpackedPacket{
+		encryptionLevel: protocol.EncryptionInitial,
+		hdr:             &unpackedHdr1,
+		data:            []byte{0}, // one PADDING frame
+	}, nil)
+	unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(&unpackedPacket{
+		encryptionLevel: protocol.EncryptionHandshake,
+		hdr:             &unpackedHdr2,
+		data:            []byte{1}, // one PING frame
+	}, nil)
+	wasProcessed, err := tc.conn.handleOnePacket(packet, 42)
+	require.NoError(t, err)
+	require.True(t, wasProcessed)
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketReceived{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeInitial,
+					DestConnectionID: tc.srcConnID,
+					PacketNumber:     protocol.PacketNumber(1337),
+					Version:          protocol.Version1,
+				},
+				Raw:                     qlog.RawInfo{Length: int(firstPacketLen), PayloadLength: 1},
+				DatagramPayloadChecksum: 42,
+				Frames:                  []qlog.Frame{},
+				ECN:                     qlog.ECT1,
+			},
+			qlog.PacketReceived{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeHandshake,
+					DestConnectionID: tc.srcConnID,
+					PacketNumber:     protocol.PacketNumber(1338),
+					Version:          protocol.Version1,
+				},
+				Raw:                     qlog.RawInfo{Length: int(packet2.Size()), PayloadLength: 1},
+				DatagramPayloadChecksum: 42,
+				Frames:                  []qlog.Frame{{Frame: &wire.PingFrame{}}},
+				ECN:                     qlog.ECT1,
+			},
+			qlog.PacketDropped{
+				Header:                  qlog.PacketHeader{DestConnectionID: incorrectSrcConnID},
+				Raw:                     qlog.RawInfo{Length: int(packet3.Size())},
+				DatagramPayloadChecksum: 42,
+				Trigger:                 qlog.PacketDropUnknownConnectionID,
+			},
+		},
+		eventRecorder.Events(qlog.PacketReceived{}, qlog.PacketDropped{}),
+	)
+}
+
+func TestConnectionUnpackFailuresFatal(t *testing.T) {
+	t.Run("other errors", func(t *testing.T) {
+		require.ErrorIs(t,
+			testConnectionUnpackFailureFatal(t, &qerr.TransportError{ErrorCode: qerr.ConnectionIDLimitError}),
+			&qerr.TransportError{ErrorCode: qerr.ConnectionIDLimitError},
+		)
+	})
+
+	t.Run("invalid reserved bits", func(t *testing.T) {
+		require.ErrorIs(t,
+			testConnectionUnpackFailureFatal(t, wire.ErrInvalidReservedBits),
+			&qerr.TransportError{ErrorCode: qerr.ProtocolViolation},
+		)
+	})
+}
+
+func testConnectionUnpackFailureFatal(t *testing.T, unpackErr error) error {
+	mockCtrl := gomock.NewController(t)
+	unpacker := NewMockUnpacker(mockCtrl)
+	tc := newServerTestConnection(t,
+		mockCtrl,
+		nil,
+		false,
+		connectionOptUnpacker(unpacker),
+	)
+
+	tc.connRunner.EXPECT().ReplaceWithClosed(gomock.Any(), gomock.Any(), gomock.Any())
+	unpacker.EXPECT().UnpackShortHeader(gomock.Any(), gomock.Any()).Return(protocol.PacketNumber(0), protocol.PacketNumberLen(0), protocol.KeyPhaseBit(0), nil, unpackErr)
+	tc.packer.EXPECT().PackConnectionClose(gomock.Any(), gomock.Any(), protocol.Version1).Return(&coalescedPacket{buffer: getPacketBuffer()}, nil)
+	errChan := make(chan error, 1)
+	go func() { errChan <- tc.conn.run() }()
+
+	tc.sendConn.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any())
+	tc.conn.handlePacket(getShortHeaderPacket(t, tc.remoteAddr, tc.srcConnID, 0x42, nil))
+
+	select {
+	case err := <-errChan:
+		require.Error(t, err)
+		return err
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	return nil
+}
+
+func TestConnectionUnpackFailureDropped(t *testing.T) {
+	t.Run("keys dropped", func(t *testing.T) {
+		testConnectionUnpackFailureDropped(t, handshake.ErrKeysDropped, qlog.PacketDropKeyUnavailable)
+	})
+
+	t.Run("decryption failed", func(t *testing.T) {
+		testConnectionUnpackFailureDropped(t, handshake.ErrDecryptionFailed, qlog.PacketDropPayloadDecryptError)
+	})
+
+	t.Run("header parse error", func(t *testing.T) {
+		testConnectionUnpackFailureDropped(t, &headerParseError{err: assert.AnError}, qlog.PacketDropHeaderParseError)
+	})
+}
+
+func testConnectionUnpackFailureDropped(t *testing.T, unpackErr error, packetDropReason qlog.PacketDropReason) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		unpacker := NewMockUnpacker(mockCtrl)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptUnpacker(unpacker),
+			connectionOptTracer(&eventRecorder),
+		)
+
+		unpacker.EXPECT().UnpackShortHeader(gomock.Any(), gomock.Any()).Return(protocol.PacketNumber(0), protocol.PacketNumberLen(0), protocol.KeyPhaseBit(0), nil, unpackErr)
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		packet := getShortHeaderPacket(t, tc.remoteAddr, tc.srcConnID, 0x42, nil)
+		tc.conn.handlePacket(packet)
+		synctest.Wait()
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Header: qlog.PacketHeader{
+						PacketType:       qlog.PacketType1RTT,
+						DestConnectionID: tc.srcConnID,
+						PacketNumber:     protocol.InvalidPacketNumber,
+					},
+					Raw:     qlog.RawInfo{Length: int(packet.Size())},
+					Trigger: packetDropReason,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case <-errChan:
+		default:
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestConnectionMaxUnprocessedPackets(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptTracer(&eventRecorder))
+
+		for range protocol.MaxConnUnprocessedPackets {
+			// nothing here should block
+			tc.conn.handlePacket(receivedPacket{data: []byte("foobar")})
+		}
+		tc.conn.handlePacket(receivedPacket{data: []byte("foobar")})
+
+		synctest.Wait()
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Raw:     qlog.RawInfo{Length: 6},
+					Trigger: qlog.PacketDropDOSPrevention,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+	})
+}
+
+func TestConnectionRemoteClose(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		unpacker := NewMockUnpacker(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptTracer(&eventRecorder),
+			connectionOptUnpacker(unpacker),
+		)
+		ccf, err := (&wire.ConnectionCloseFrame{
+			ErrorCode:    uint64(qerr.StreamLimitError),
+			ReasonPhrase: "foobar",
+		}).Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		unpacker.EXPECT().UnpackShortHeader(gomock.Any(), gomock.Any()).Return(protocol.PacketNumber(1), protocol.PacketNumberLen2, protocol.KeyPhaseBit(0), ccf, nil)
+
+		tc.connRunner.EXPECT().ReplaceWithClosed(gomock.Any(), gomock.Any(), gomock.Any())
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		p := getShortHeaderPacket(t, tc.remoteAddr, tc.srcConnID, 1, []byte("encrypted"))
+		tc.conn.handlePacket(receivedPacket{data: p.data, buffer: p.buffer, rcvTime: monotime.Now()})
+
+		synctest.Wait()
+
+		expectedErr := &qerr.TransportError{ErrorCode: qerr.StreamLimitError, ErrorMessage: "foobar", Remote: true}
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, expectedErr)
+		default:
+			t.Fatal("timeout")
+		}
+
+		code := expectedErr.ErrorCode
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.ConnectionClosed{
+					Initiator:       qlog.InitiatorRemote,
+					ConnectionError: &code,
+					Reason:          expectedErr.ErrorMessage,
+				},
+			},
+			eventRecorder.Events(qlog.ConnectionClosed{}),
+		)
+	})
+}
+
+func TestConnectionIdleTimeoutDuringHandshake(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const timeout = 7 * time.Second
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			&Config{HandshakeIdleTimeout: timeout},
+			false,
+			connectionOptTracer(&eventRecorder),
+		)
+		tc.packer.EXPECT().PackCoalescedPacket(false, gomock.Any(), gomock.Any(), protocol.Version1).AnyTimes()
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		start := monotime.Now()
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, &IdleTimeoutError{})
+			require.Equal(t, timeout, monotime.Since(start))
+		case <-time.After(timeout + time.Nanosecond):
+			t.Fatal("timeout")
+		}
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.ConnectionClosed{
+					Initiator: qlog.InitiatorLocal,
+					Trigger:   qlog.ConnectionCloseTriggerIdleTimeout,
+				},
+			},
+			eventRecorder.Events(qlog.ConnectionClosed{}),
+		)
+	})
+}
+
+func TestConnectionHandshakeIdleTimeout(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			&Config{HandshakeIdleTimeout: 7 * time.Second},
+			false,
+			connectionOptTracer(&eventRecorder),
+			func(c *Conn) { c.creationTime = monotime.Now().Add(-20 * time.Second) },
+		)
+		tc.packer.EXPECT().PackCoalescedPacket(false, gomock.Any(), gomock.Any(), protocol.Version1).AnyTimes()
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, &HandshakeTimeoutError{})
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.ConnectionClosed{
+					Initiator: qlog.InitiatorLocal,
+					Trigger:   qlog.ConnectionCloseTriggerIdleTimeout,
+				},
+			},
+			eventRecorder.Events(qlog.ConnectionClosed{}),
+		)
+	})
+}
+
+func TestConnectionTransportParameters(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	var eventRecorder events.Recorder
+	connFC := newConnectionFlowController(0, 0, nil, utils.NewRTTStats(), utils.DefaultLogger)
+	require.Zero(t, connFC.SendWindowSize())
+	tc := newServerTestConnection(t,
+		mockCtrl,
+		nil,
+		false,
+		connectionOptTracer(&eventRecorder),
+		connectionOptConnFlowController(connFC),
+	)
+	_, err := tc.conn.OpenStream()
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+	_, err = tc.conn.OpenUniStream()
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+	params := &wire.TransportParameters{
+		MaxIdleTimeout:                90 * time.Second,
+		InitialMaxStreamDataBidiLocal: 0x5000,
+		InitialMaxData:                1337,
+		ActiveConnectionIDLimit:       3,
+		// marshaling always sets it to this value
+		MaxUDPPayloadSize:               protocol.MaxPacketBufferSize,
+		OriginalDestinationConnectionID: tc.destConnID,
+		MaxBidiStreamNum:                1,
+		MaxUniStreamNum:                 1,
+	}
+	require.NoError(t, tc.conn.handleTransportParameters(params))
+	require.Equal(t, protocol.ByteCount(1337), connFC.SendWindowSize())
+	_, err = tc.conn.OpenStream()
+	require.NoError(t, err)
+	_, err = tc.conn.OpenUniStream()
+	require.NoError(t, err)
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.ParametersSet{
+				Initiator:                     qlog.InitiatorRemote,
+				MaxIdleTimeout:                90 * time.Second,
+				InitialMaxStreamDataBidiLocal: 0x5000,
+				InitialMaxData:                1337,
+				ActiveConnectionIDLimit:       3,
+				// marshaling always sets it to this value
+				MaxUDPPayloadSize:               protocol.MaxPacketBufferSize,
+				OriginalDestinationConnectionID: tc.destConnID,
+				InitialMaxStreamsBidi:           1,
+				InitialMaxStreamsUni:            1,
+			},
+		},
+		eventRecorder.Events(qlog.ParametersSet{}),
+	)
+}
+
+func TestConnectionHandleMaxStreamsFrame(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		connFC := newConnectionFlowController(0, 0, nil, utils.NewRTTStats(), utils.DefaultLogger)
+		tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptConnFlowController(connFC))
+		tc.conn.handleTransportParameters(&wire.TransportParameters{})
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		uniStreamChan := make(chan error)
+		go func() {
+			_, err := tc.conn.OpenUniStreamSync(ctx)
+			uniStreamChan <- err
+		}()
+		bidiStreamChan := make(chan error)
+		go func() {
+			_, err := tc.conn.OpenStreamSync(ctx)
+			bidiStreamChan <- err
+		}()
+
+		synctest.Wait()
+		select {
+		case <-uniStreamChan:
+			t.Fatal("uni stream should be blocked")
+		case <-bidiStreamChan:
+			t.Fatal("bidi stream should be blocked")
+		default:
+		}
+
+		// MAX_STREAMS frame for bidirectional stream
+		_, err := tc.conn.handleFrame(
+			&wire.MaxStreamsFrame{Type: protocol.StreamTypeBidi, MaxStreamNum: 10},
+			protocol.Encryption1RTT,
+			protocol.ConnectionID{},
+			monotime.Now(),
+		)
+		require.NoError(t, err)
+
+		synctest.Wait()
+
+		select {
+		case <-uniStreamChan:
+			t.Fatal("uni stream should be blocked")
+		default:
+		}
+		select {
+		case err := <-bidiStreamChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("bidi stream should be unblocked")
+		}
+
+		// MAX_STREAMS frame for bidirectional stream
+		_, err = tc.conn.handleFrame(
+			&wire.MaxStreamsFrame{Type: protocol.StreamTypeUni, MaxStreamNum: 10},
+			protocol.Encryption1RTT,
+			protocol.ConnectionID{},
+			monotime.Now(),
+		)
+		require.NoError(t, err)
+
+		synctest.Wait()
+		select {
+		case err := <-uniStreamChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestConnectionTransportParameterValidationFailureServer(t *testing.T) {
+	tc := newServerTestConnection(t, nil, nil, false)
+	err := tc.conn.handleTransportParameters(&wire.TransportParameters{
+		InitialSourceConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+	})
+	assert.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.TransportParameterError})
+	assert.ErrorContains(t, err, "expected initial_source_connection_id to equal")
+}
+
+func TestConnectionTransportParameterValidationFailureClient(t *testing.T) {
+	t.Run("initial_source_connection_id", func(t *testing.T) {
+		tc := newClientTestConnection(t, nil, nil, false)
+		err := tc.conn.handleTransportParameters(&wire.TransportParameters{
+			InitialSourceConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		})
+		assert.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.TransportParameterError})
+		assert.ErrorContains(t, err, "expected initial_source_connection_id to equal")
+	})
+
+	t.Run("original_destination_connection_id", func(t *testing.T) {
+		tc := newClientTestConnection(t, nil, nil, false)
+		err := tc.conn.handleTransportParameters(&wire.TransportParameters{
+			InitialSourceConnectionID:       tc.destConnID,
+			OriginalDestinationConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		})
+		assert.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.TransportParameterError})
+		assert.ErrorContains(t, err, "expected original_destination_connection_id to equal")
+	})
+
+	t.Run("retry_source_connection_id if no retry", func(t *testing.T) {
+		tc := newClientTestConnection(t, nil, nil, false)
+		rcid := protocol.ParseConnectionID([]byte{1, 2, 3, 4})
+		params := &wire.TransportParameters{
+			InitialSourceConnectionID:       tc.destConnID,
+			OriginalDestinationConnectionID: tc.destConnID,
+			RetrySourceConnectionID:         &rcid,
+		}
+		err := tc.conn.handleTransportParameters(params)
+		assert.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.TransportParameterError})
+		assert.ErrorContains(t, err, "received retry_source_connection_id, although no Retry was performed")
+	})
+
+	t.Run("retry_source_connection_id missing", func(t *testing.T) {
+		tc := newClientTestConnection(t,
+			nil,
+			nil,
+			false,
+			connectionOptRetrySrcConnID(protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef})),
+		)
+		params := &wire.TransportParameters{
+			InitialSourceConnectionID:       tc.destConnID,
+			OriginalDestinationConnectionID: tc.destConnID,
+		}
+		err := tc.conn.handleTransportParameters(params)
+		assert.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.TransportParameterError})
+		assert.ErrorContains(t, err, "missing retry_source_connection_id")
+	})
+
+	t.Run("retry_source_connection_id incorrect", func(t *testing.T) {
+		tc := newClientTestConnection(t,
+			nil,
+			nil,
+			false,
+			connectionOptRetrySrcConnID(protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef})),
+		)
+		wrongCID := protocol.ParseConnectionID([]byte{1, 2, 3, 4})
+		params := &wire.TransportParameters{
+			InitialSourceConnectionID:       tc.destConnID,
+			OriginalDestinationConnectionID: tc.destConnID,
+			RetrySourceConnectionID:         &wrongCID,
+		}
+		err := tc.conn.handleTransportParameters(params)
+		assert.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.TransportParameterError})
+		assert.ErrorContains(t, err, "expected retry_source_connection_id to equal")
+	})
+}
+
+func TestConnectionHandshakeServer(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cs := mocks.NewMockCryptoSetup(mockCtrl)
+	unpacker := NewMockUnpacker(mockCtrl)
+	tc := newServerTestConnection(
+		t,
+		mockCtrl,
+		nil,
+		false,
+		connectionOptCryptoSetup(cs),
+		connectionOptUnpacker(unpacker),
+	)
+
+	// the state transition is driven by processing of a CRYPTO frame
+	hdr := &wire.ExtendedHeader{
+		Header:          wire.Header{Type: protocol.PacketTypeHandshake, Version: protocol.Version1},
+		PacketNumberLen: protocol.PacketNumberLen2,
+	}
+	data, err := (&wire.CryptoFrame{Data: []byte("foobar")}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+
+	cs.EXPECT().DiscardInitialKeys().Times(2)
+	gomock.InOrder(
+		cs.EXPECT().StartHandshake(gomock.Any()),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent}),
+		unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(
+			&unpackedPacket{hdr: hdr, encryptionLevel: protocol.EncryptionHandshake, data: data}, nil,
+		),
+		cs.EXPECT().HandleMessage([]byte("foobar"), protocol.EncryptionHandshake),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventHandshakeComplete}),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent}),
+		cs.EXPECT().SetHandshakeConfirmed(),
+		cs.EXPECT().GetSessionTicket().Return([]byte("session ticket"), nil),
+	)
+	tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(shortHeaderPacket{}, errNothingToPack).AnyTimes()
+
+	errChan := make(chan error, 1)
+	go func() { errChan <- tc.conn.run() }()
+	p := getLongHeaderPacket(t, tc.remoteAddr, hdr, nil)
+	tc.conn.handlePacket(receivedPacket{data: p.data, buffer: p.buffer, rcvTime: monotime.Now()})
+
+	select {
+	case <-tc.conn.HandshakeComplete():
+	case <-tc.conn.Context().Done():
+		t.Fatal("connection context done")
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	var foundSessionTicket, foundHandshakeDone, foundNewToken bool
+	frames, _, _ := tc.conn.framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	for _, frame := range frames {
+		switch f := frame.Frame.(type) {
+		case *wire.CryptoFrame:
+			assert.Equal(t, []byte("session ticket"), f.Data)
+			foundSessionTicket = true
+		case *wire.HandshakeDoneFrame:
+			foundHandshakeDone = true
+		case *wire.NewTokenFrame:
+			assert.NotEmpty(t, f.Token)
+			foundNewToken = true
+		}
+	}
+	assert.True(t, foundSessionTicket)
+	assert.True(t, foundHandshakeDone)
+	assert.True(t, foundNewToken)
+
+	// test teardown
+	cs.EXPECT().Close()
+	tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+	tc.conn.destroy(nil)
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestConnectionFinishesCryptoStreamWhenReadKeysBecomeAvailable(t *testing.T) {
+	for _, test := range []struct {
+		event    handshake.EventKind
+		previous protocol.EncryptionLevel
+	}{
+		{handshake.EventReceivedHandshakeReadKeys, protocol.EncryptionInitial},
+		{handshake.EventReceived1RTTReadKeys, protocol.EncryptionHandshake},
+	} {
+		t.Run(test.event.String(), func(t *testing.T) {
+			mockCtrl := gomock.NewController(t)
+			cs := mocks.NewMockCryptoSetup(mockCtrl)
+			tc := newServerTestConnection(t, mockCtrl, nil, false, connectionOptCryptoSetup(cs))
+			require.NoError(t, tc.conn.cryptoStreamManager.HandleCryptoFrame(
+				&wire.CryptoFrame{Offset: 1, Data: []byte("foo")},
+				test.previous,
+			))
+
+			cs.EXPECT().NextEvent().Return(handshake.Event{Kind: test.event})
+			err := tc.conn.handleHandshakeEvents(monotime.Now())
+			require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+			require.ErrorContains(t, err, "encryption level changed, but crypto stream has more data to read")
+		})
+	}
+}
+
+func TestConnectionHandshakeClient(t *testing.T) {
+	t.Run("without preferred address", func(t *testing.T) {
+		testConnectionHandshakeClient(t, false)
+	})
+	t.Run("with preferred address", func(t *testing.T) {
+		testConnectionHandshakeClient(t, true)
+	})
+}
+
+func testConnectionHandshakeClient(t *testing.T, usePreferredAddress bool) {
+	mockCtrl := gomock.NewController(t)
+	cs := mocks.NewMockCryptoSetup(mockCtrl)
+	unpacker := NewMockUnpacker(mockCtrl)
+	tc := newClientTestConnection(t, mockCtrl, nil, false, connectionOptCryptoSetup(cs), connectionOptUnpacker(unpacker))
+	tc.sendConn.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+
+	// the state transition is driven by processing of a CRYPTO frame
+	hdr := &wire.ExtendedHeader{
+		Header:          wire.Header{Type: protocol.PacketTypeHandshake, Version: protocol.Version1},
+		PacketNumberLen: protocol.PacketNumberLen2,
+	}
+	data, err := (&wire.CryptoFrame{Data: []byte("foobar")}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+
+	tp := &wire.TransportParameters{
+		OriginalDestinationConnectionID: tc.destConnID,
+		MaxIdleTimeout:                  time.Hour,
+	}
+	preferredAddressConnID := protocol.ParseConnectionID([]byte{10, 8, 6, 4})
+	preferredAddressResetToken := protocol.StatelessResetToken{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1}
+	if usePreferredAddress {
+		tp.PreferredAddress = &wire.PreferredAddress{
+			IPv4:                netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), 42),
+			IPv6:                netip.AddrPortFrom(netip.AddrFrom16([16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}), 13),
+			ConnectionID:        preferredAddressConnID,
+			StatelessResetToken: preferredAddressResetToken,
+		}
+	}
+
+	packedFirstPacket := make(chan struct{})
+	gomock.InOrder(
+		cs.EXPECT().StartHandshake(gomock.Any()),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent}),
+		tc.packer.EXPECT().PackCoalescedPacket(false, gomock.Any(), gomock.Any(), protocol.Version1).DoAndReturn(
+			func(b bool, bc protocol.ByteCount, t monotime.Time, v protocol.Version) (*coalescedPacket, error) {
+				close(packedFirstPacket)
+				return &coalescedPacket{buffer: getPacketBuffer(), longHdrPackets: []*longHeaderPacket{{header: hdr}}}, nil
+			},
+		),
+		// initial keys are dropped when the first handshake packet is sent
+		cs.EXPECT().DiscardInitialKeys(),
+		// no more data to send
+		unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(
+			&unpackedPacket{hdr: hdr, encryptionLevel: protocol.EncryptionHandshake, data: data}, nil,
+		),
+		cs.EXPECT().HandleMessage([]byte("foobar"), protocol.EncryptionHandshake),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventReceivedTransportParameters, TransportParameters: tp}),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventHandshakeComplete}),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent}),
+	)
+	tc.packer.EXPECT().PackCoalescedPacket(false, gomock.Any(), gomock.Any(), protocol.Version1).Return(nil, nil).AnyTimes()
+
+	errChan := make(chan error, 1)
+	go func() { errChan <- tc.conn.run() }()
+
+	select {
+	case <-packedFirstPacket:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	p := getLongHeaderPacket(t, tc.remoteAddr, hdr, nil)
+	tc.conn.handlePacket(receivedPacket{data: p.data, buffer: p.buffer, rcvTime: monotime.Now()})
+
+	select {
+	case <-tc.conn.HandshakeComplete():
+	case <-tc.conn.Context().Done():
+		t.Fatal("connection context done")
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	require.True(t, mockCtrl.Satisfied())
+	// the handshake isn't confirmed until we receive a HANDSHAKE_DONE frame from the server
+
+	data, err = (&wire.HandshakeDoneFrame{}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	done := make(chan struct{})
+	tc.packer.EXPECT().PackCoalescedPacket(false, gomock.Any(), gomock.Any(), protocol.Version1).Return(nil, nil).AnyTimes()
+	gomock.InOrder(
+		unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(
+			&unpackedPacket{hdr: hdr, encryptionLevel: protocol.Encryption1RTT, data: data}, nil,
+		),
+		cs.EXPECT().DiscardInitialKeys(),
+		cs.EXPECT().SetHandshakeConfirmed(),
+		tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+			func(buf *packetBuffer, _ protocol.ByteCount, _ monotime.Time, _ protocol.Version) (shortHeaderPacket, error) {
+				close(done)
+				return shortHeaderPacket{}, errNothingToPack
+			},
+		),
+	)
+	tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(shortHeaderPacket{}, errNothingToPack).AnyTimes()
+	p = getLongHeaderPacket(t, tc.remoteAddr, hdr, nil)
+	tc.conn.handlePacket(receivedPacket{data: p.data, buffer: p.buffer, rcvTime: monotime.Now()})
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	if usePreferredAddress {
+		tc.connRunner.EXPECT().AddResetToken(preferredAddressResetToken, gomock.Any())
+	}
+	nextConnID := tc.conn.connIDManager.Get()
+	if usePreferredAddress {
+		require.Equal(t, preferredAddressConnID, nextConnID)
+	}
+
+	// test teardown
+	cs.EXPECT().Close()
+	tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+	if usePreferredAddress {
+		tc.connRunner.EXPECT().RemoveResetToken(preferredAddressResetToken)
+	}
+	tc.conn.destroy(nil)
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestConnection0RTTTransportParameters(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cs := mocks.NewMockCryptoSetup(mockCtrl)
+	unpacker := NewMockUnpacker(mockCtrl)
+	tc := newClientTestConnection(t, mockCtrl, nil, false, connectionOptCryptoSetup(cs), connectionOptUnpacker(unpacker))
+	tc.sendConn.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+
+	// the state transition is driven by processing of a CRYPTO frame
+	hdr := &wire.ExtendedHeader{
+		Header:          wire.Header{Type: protocol.PacketTypeHandshake, Version: protocol.Version1},
+		PacketNumberLen: protocol.PacketNumberLen2,
+	}
+	data, err := (&wire.CryptoFrame{Data: []byte("foobar")}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+
+	restored := &wire.TransportParameters{
+		ActiveConnectionIDLimit:        3,
+		InitialMaxData:                 0x5000,
+		InitialMaxStreamDataBidiLocal:  0x5000,
+		InitialMaxStreamDataBidiRemote: 1000,
+		InitialMaxStreamDataUni:        1000,
+		MaxBidiStreamNum:               500,
+		MaxUniStreamNum:                500,
+	}
+	new := *restored
+	new.MaxBidiStreamNum-- // the server is not allowed to reduce the limit
+	new.OriginalDestinationConnectionID = tc.destConnID
+
+	packedFirstPacket := make(chan struct{})
+	gomock.InOrder(
+		cs.EXPECT().StartHandshake(gomock.Any()),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventRestoredTransportParameters, TransportParameters: restored}),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent}),
+		tc.packer.EXPECT().PackCoalescedPacket(false, gomock.Any(), gomock.Any(), protocol.Version1).DoAndReturn(
+			func(b bool, bc protocol.ByteCount, t monotime.Time, v protocol.Version) (*coalescedPacket, error) {
+				close(packedFirstPacket)
+				return &coalescedPacket{buffer: getPacketBuffer(), longHdrPackets: []*longHeaderPacket{{header: hdr}}}, nil
+			},
+		),
+		// initial keys are dropped when the first handshake packet is sent
+		cs.EXPECT().DiscardInitialKeys(),
+		// no more data to send
+		unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(
+			&unpackedPacket{hdr: hdr, encryptionLevel: protocol.EncryptionHandshake, data: data}, nil,
+		),
+		cs.EXPECT().HandleMessage([]byte("foobar"), protocol.EncryptionHandshake),
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventReceivedTransportParameters, TransportParameters: &new}),
+		cs.EXPECT().ConnectionState().Return(handshake.ConnectionState{Used0RTT: true}),
+		// cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent}),
+		cs.EXPECT().Close(),
+	)
+	tc.packer.EXPECT().PackCoalescedPacket(false, gomock.Any(), gomock.Any(), protocol.Version1).Return(nil, nil).AnyTimes()
+	tc.packer.EXPECT().PackConnectionClose(gomock.Any(), gomock.Any(), protocol.Version1).Return(&coalescedPacket{buffer: getPacketBuffer()}, nil)
+	tc.connRunner.EXPECT().ReplaceWithClosed(gomock.Any(), gomock.Any(), gomock.Any())
+
+	errChan := make(chan error, 1)
+	go func() { errChan <- tc.conn.run() }()
+
+	select {
+	case <-packedFirstPacket:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	p := getLongHeaderPacket(t, tc.remoteAddr, hdr, nil)
+	tc.conn.handlePacket(receivedPacket{data: p.data, buffer: p.buffer, rcvTime: monotime.Now()})
+
+	select {
+	case err := <-errChan:
+		require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+		require.ErrorContains(t, err, "server sent reduced limits after accepting 0-RTT data")
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestConnectionReceivePrioritization(t *testing.T) {
+	for _, handshakeComplete := range []bool{true, false} {
+		t.Run(fmt.Sprintf("handshake complete: %t", handshakeComplete), func(t *testing.T) {
+			events := testConnectionReceivePrioritization(t, handshakeComplete, 5)
+			require.Equal(t, []string{"unpack", "unpack", "unpack", "unpack", "unpack", "pack"}, events)
+		})
+	}
+}
+
+func testConnectionReceivePrioritization(t *testing.T, handshakeComplete bool, numPackets int) []string {
+	mockCtrl := gomock.NewController(t)
+	unpacker := NewMockUnpacker(mockCtrl)
+	opts := []testConnectionOpt{connectionOptUnpacker(unpacker)}
+	if handshakeComplete {
+		opts = append(opts, connectionOptHandshakeConfirmed())
+	}
+	tc := newServerTestConnection(t, mockCtrl, nil, false, opts...)
+
+	var events []string
+	var counter int
+	var testDone bool
+	done := make(chan struct{})
+	unpacker.EXPECT().UnpackShortHeader(gomock.Any(), gomock.Any()).DoAndReturn(
+		func(rcvTime monotime.Time, data []byte) (protocol.PacketNumber, protocol.PacketNumberLen, protocol.KeyPhaseBit, []byte, error) {
+			counter++
+			if counter == numPackets {
+				testDone = true
+			}
+			events = append(events, "unpack")
+			return protocol.PacketNumber(counter), protocol.PacketNumberLen2, protocol.KeyPhaseZero, []byte{0, 1} /* PADDING, PING */, nil
+		},
+	).Times(numPackets)
+	switch handshakeComplete {
+	case false:
+		tc.packer.EXPECT().PackCoalescedPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+			func(b bool, bc protocol.ByteCount, t monotime.Time, v protocol.Version) (*coalescedPacket, error) {
+				events = append(events, "pack")
+				if testDone {
+					close(done)
+				}
+				return nil, nil
+			},
+		).AnyTimes()
+	case true:
+		tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+			func(b *packetBuffer, bc protocol.ByteCount, t monotime.Time, v protocol.Version) (shortHeaderPacket, error) {
+				events = append(events, "pack")
+				if testDone {
+					close(done)
+				}
+				return shortHeaderPacket{}, errNothingToPack
+			},
+		).AnyTimes()
+	}
+
+	for i := range numPackets {
+		tc.conn.handlePacket(getShortHeaderPacket(t, tc.remoteAddr, tc.srcConnID, protocol.PacketNumber(i), []byte("foobar")))
+	}
+
+	tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+	errChan := make(chan error, 1)
+	go func() { errChan <- tc.conn.run() }()
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	// test teardown
+	tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+	tc.conn.destroy(nil)
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	return events
+}
+
+func TestConnectionPacketBuffering(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		unpacker := NewMockUnpacker(mockCtrl)
+		cs := mocks.NewMockCryptoSetup(mockCtrl)
+		var eventRecorder events.Recorder
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptUnpacker(unpacker),
+			connectionOptCryptoSetup(cs),
+			connectionOptTracer(&eventRecorder),
+		)
+
+		cs.EXPECT().DiscardInitialKeys()
+
+		hdr1 := wire.ExtendedHeader{
+			Header: wire.Header{
+				Type:             protocol.PacketTypeHandshake,
+				DestConnectionID: tc.srcConnID,
+				SrcConnectionID:  tc.destConnID,
+				Length:           8,
+				Version:          protocol.Version1,
+			},
+			PacketNumberLen: protocol.PacketNumberLen1,
+			PacketNumber:    1,
+		}
+		hdr2 := hdr1
+		hdr2.PacketNumber = 2
+		cs.EXPECT().StartHandshake(gomock.Any())
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent})
+		unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(nil, handshake.ErrKeysNotYetAvailable).Times(2)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		hdrs := make(map[string]*wire.ExtendedHeader)
+
+		packet1 := getLongHeaderPacket(t, tc.remoteAddr, &hdr1, []byte("packet1"))
+		datagramPayloadChecksum1 := qlog.CalculateDatagramPayloadChecksum(packet1.data)
+		hdrs["packet1"] = &hdr1
+		tc.conn.handlePacket(packet1)
+		packet2 := getLongHeaderPacket(t, tc.remoteAddr, &hdr2, []byte("packet2"))
+		datagramPayloadChecksum2 := qlog.CalculateDatagramPayloadChecksum(packet2.data)
+		hdrs["packet2"] = &hdr2
+		tc.conn.handlePacket(packet2)
+		synctest.Wait()
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketBuffered{
+					Header: qlog.PacketHeader{
+						PacketType:   qlog.PacketTypeHandshake,
+						PacketNumber: protocol.InvalidPacketNumber,
+					},
+					Raw:                     qlog.RawInfo{Length: int(packet1.Size())},
+					DatagramPayloadChecksum: datagramPayloadChecksum1,
+				},
+				qlog.PacketBuffered{
+					Header: qlog.PacketHeader{
+						PacketType:   qlog.PacketTypeHandshake,
+						PacketNumber: protocol.InvalidPacketNumber,
+					},
+					Raw:                     qlog.RawInfo{Length: int(packet2.Size())},
+					DatagramPayloadChecksum: datagramPayloadChecksum2,
+				},
+			},
+			eventRecorder.Events(qlog.PacketBuffered{}),
+		)
+
+		eventRecorder.Clear()
+
+		// Now send another packet.
+		// In reality, this packet would contain a CRYPTO frame that advances the TLS handshake
+		// such that new keys become available.
+		var packets []string
+		hdr3 := hdr1
+		hdr3.PacketNumber = 3
+		hdrs["packet3"] = &hdr3
+		tc.packer.EXPECT().PackCoalescedPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(nil, nil).AnyTimes()
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventReceived1RTTReadKeys})
+		cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent})
+
+		gomock.InOrder(
+			// packet 3 contains a CRYPTO frame and triggers the keys to become available
+			unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).DoAndReturn(
+				func(hdr *wire.Header, data []byte) (*unpackedPacket, error) {
+					id := string(data[len(data)-7:])
+					packets = append(packets, id)
+					cf := &wire.CryptoFrame{Data: []byte("foobar")}
+					b, _ := cf.Append(nil, protocol.Version1)
+					extHdr, ok := hdrs[id]
+					if !ok {
+						panic(fmt.Sprintf("unknown header: %v", id))
+					}
+					return &unpackedPacket{hdr: extHdr, encryptionLevel: protocol.EncryptionHandshake, data: b}, nil
+				},
+			),
+			cs.EXPECT().HandleMessage(gomock.Any(), gomock.Any()),
+			unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).DoAndReturn(
+				func(hdr *wire.Header, data []byte) (*unpackedPacket, error) {
+					id := string(data[len(data)-7:])
+					extHdr, ok := hdrs[id]
+					if !ok {
+						panic(fmt.Sprintf("unknown header: %v", id))
+					}
+					packets = append(packets, id)
+					return &unpackedPacket{hdr: extHdr, encryptionLevel: protocol.EncryptionHandshake, data: []byte{0} /* PADDING */}, nil
+				},
+			).Times(2),
+		)
+
+		packet3 := getLongHeaderPacket(t, tc.remoteAddr, &hdr3, []byte("packet3"))
+		datagramPayloadChecksum3 := qlog.CalculateDatagramPayloadChecksum(packet3.data)
+		tc.conn.handlePacket(packet3)
+
+		synctest.Wait()
+
+		// packet3 triggered the keys to become available
+		// packet1 and packet2 are processed from the buffer in order
+		require.Equal(t, []string{"packet3", "packet1", "packet2"}, packets)
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketReceived{
+					Header: qlog.PacketHeader{
+						PacketType:       qlog.PacketTypeHandshake,
+						DestConnectionID: tc.srcConnID,
+						SrcConnectionID:  tc.destConnID,
+						PacketNumber:     3,
+						Version:          protocol.Version1,
+					},
+					Raw:                     qlog.RawInfo{Length: int(packet3.Size()), PayloadLength: 8},
+					DatagramPayloadChecksum: datagramPayloadChecksum3,
+					Frames:                  []qlog.Frame{{Frame: &qlog.CryptoFrame{Length: 6}}},
+				},
+				qlog.PacketReceived{
+					Header: qlog.PacketHeader{
+						PacketType:       qlog.PacketTypeHandshake,
+						DestConnectionID: tc.srcConnID,
+						SrcConnectionID:  tc.destConnID,
+						PacketNumber:     1,
+						Version:          protocol.Version1,
+					},
+					Raw:                     qlog.RawInfo{Length: int(packet1.Size()), PayloadLength: 8},
+					DatagramPayloadChecksum: datagramPayloadChecksum1,
+					Frames:                  []qlog.Frame{},
+				},
+				qlog.PacketReceived{
+					Header: qlog.PacketHeader{
+						PacketType:       qlog.PacketTypeHandshake,
+						DestConnectionID: tc.srcConnID,
+						SrcConnectionID:  tc.destConnID,
+						PacketNumber:     2,
+						Version:          protocol.Version1,
+					},
+					Raw:                     qlog.RawInfo{Length: int(packet1.Size()), PayloadLength: 8},
+					DatagramPayloadChecksum: datagramPayloadChecksum2,
+					Frames:                  []qlog.Frame{},
+				},
+			},
+			eventRecorder.Events(qlog.PacketReceived{}, qlog.PacketBuffered{}),
+		)
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		cs.EXPECT().Close()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestConnectionPacketPacing(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		sender := NewMockSender(mockCtrl)
+
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptSentPacketHandler(sph),
+			connectionOptSender(sender),
+			connectionOptHandshakeConfirmed(),
+		)
+		sender.EXPECT().Run()
+
+		const step = 50 * time.Millisecond
+
+		sph.EXPECT().GetLossDetectionTimeout().Return(monotime.Now().Add(time.Hour)).AnyTimes()
+		gomock.InOrder(
+			// 1. allow 2 packets to be sent
+			sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny),
+			sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()),
+			sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny),
+			sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()),
+			sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendPacingLimited),
+			// 2. become pacing limited for 25ms
+			sph.EXPECT().TimeUntilSend().DoAndReturn(func() monotime.Time { return monotime.Now().Add(step) }),
+			// 3. send another packet
+			sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny),
+			sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()),
+			sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendPacingLimited),
+			// 4. become pacing limited for 25ms...
+			sph.EXPECT().TimeUntilSend().DoAndReturn(func() monotime.Time { return monotime.Now().Add(step) }),
+			// ... but this time we're still pacing limited when waking up.
+			// In this case, we can only send an ACK.
+			sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendPacingLimited),
+			// 5. stop the test by becoming pacing limited forever
+			sph.EXPECT().TimeUntilSend().Return(monotime.Now().Add(time.Hour)),
+			sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()),
+		)
+		sph.EXPECT().ECNMode(gomock.Any()).AnyTimes()
+		for i := range 3 {
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), Version1).DoAndReturn(
+				func(buf *packetBuffer, _ protocol.ByteCount, _ monotime.Time, _ protocol.Version) (shortHeaderPacket, error) {
+					buf.Data = append(buf.Data, []byte("packet"+strconv.Itoa(i+1))...)
+					return shortHeaderPacket{PacketNumber: protocol.PacketNumber(i + 1)}, nil
+				},
+			)
+		}
+		tc.packer.EXPECT().PackAckOnlyPacket(gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+			func(_ protocol.ByteCount, _ monotime.Time, _ protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+				buf := getPacketBuffer()
+				buf.Data = []byte("ack")
+				return shortHeaderPacket{PacketNumber: 1}, buf, nil
+			},
+		)
+		sender.EXPECT().WouldBlock().AnyTimes()
+
+		type sentPacket struct {
+			time monotime.Time
+			data []byte
+		}
+		sendChan := make(chan sentPacket, 10)
+		sender.EXPECT().Send(gomock.Any(), gomock.Any(), gomock.Any()).Do(func(b *packetBuffer, _ uint16, _ protocol.ECN) {
+			sendChan <- sentPacket{time: monotime.Now(), data: b.Data}
+		}).Times(4)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		synctest.Wait()
+
+		var times []monotime.Time
+		for i := range 3 {
+			select {
+			case b := <-sendChan:
+				require.Equal(t, []byte("packet"+strconv.Itoa(i+1)), b.data)
+				times = append(times, b.time)
+			case <-time.After(time.Hour):
+				t.Fatal("should have sent a packet")
+			}
+		}
+		select {
+		case b := <-sendChan:
+			require.Equal(t, []byte("ack"), b.data)
+			times = append(times, b.time)
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+
+		require.Equal(t, times[0], times[1])
+		require.Equal(t, times[2], times[1].Add(step))
+		require.Equal(t, times[3], times[2].Add(step))
+
+		synctest.Wait() // make sure that no more packets are sent
+		require.True(t, mockCtrl.Satisfied())
+
+		// test teardown
+		sender.EXPECT().Close()
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case <-sendChan:
+			t.Fatal("should not have sent any more packets")
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have timed out")
+		}
+	})
+}
+
+// When the send queue blocks, we need to reset the pacing timer, otherwise the run loop might busy-loop.
+// See https://github.com/quic-go/quic-go/pull/4943 for more details.
+func TestConnectionPacingAndSendQueue(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		sender := NewMockSender(mockCtrl)
+
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptSentPacketHandler(sph),
+			connectionOptSender(sender),
+			connectionOptHandshakeConfirmed(),
+		)
+		sender.EXPECT().Run()
+
+		sendQueueAvailable := make(chan struct{})
+		pacingDeadline := monotime.Now().Add(-time.Millisecond)
+		var counter int
+		// allow exactly one packet to be sent, then become blocked
+		sender.EXPECT().WouldBlock().Return(false)
+		sender.EXPECT().WouldBlock().DoAndReturn(func() bool { counter++; return true }).AnyTimes()
+		sender.EXPECT().Available().Return(sendQueueAvailable).AnyTimes()
+		sph.EXPECT().GetLossDetectionTimeout().Return(monotime.Now().Add(time.Hour)).AnyTimes()
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendPacingLimited).AnyTimes()
+		sph.EXPECT().TimeUntilSend().Return(pacingDeadline).AnyTimes()
+		sph.EXPECT().ECNMode(gomock.Any()).Return(protocol.ECNNon).AnyTimes()
+		tc.packer.EXPECT().PackAckOnlyPacket(gomock.Any(), gomock.Any(), gomock.Any()).Return(
+			shortHeaderPacket{}, nil, errNothingToPack,
+		)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		synctest.Wait()
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		sender.EXPECT().Close()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have timed out")
+		}
+
+		// make sure the run loop didn't do too many iterations
+		require.Less(t, counter, 3)
+	})
+}
+
+func TestConnectionIdleTimeout(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			&Config{MaxIdleTimeout: time.Minute},
+			false,
+			connectionOptHandshakeConfirmed(),
+			connectionOptSentPacketHandler(sph),
+			connectionOptRTT(time.Millisecond),
+		)
+		// the idle timeout is set when the transport parameters are received
+		const idleTimeout = 500 * time.Millisecond
+		require.NoError(t, tc.conn.handleTransportParameters(&wire.TransportParameters{
+			MaxIdleTimeout: idleTimeout,
+		}))
+
+		sph.EXPECT().GetLossDetectionTimeout().AnyTimes()
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny).AnyTimes()
+		sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any())
+		sph.EXPECT().ECNMode(gomock.Any()).AnyTimes()
+		var lastSendTime monotime.Time
+		tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+			func(buf *packetBuffer, _ protocol.ByteCount, _ monotime.Time, _ protocol.Version) (shortHeaderPacket, error) {
+				buf.Data = append(buf.Data, []byte("foobar")...)
+				lastSendTime = monotime.Now()
+				return shortHeaderPacket{Frames: []ackhandler.Frame{{Frame: &wire.PingFrame{}}}, Length: 6}, nil
+			},
+		)
+		tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(shortHeaderPacket{}, errNothingToPack)
+		tc.sendConn.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any())
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, &IdleTimeoutError{})
+			require.NotZero(t, lastSendTime)
+			require.Equal(t, idleTimeout, monotime.Since(lastSendTime))
+		case <-time.After(time.Hour):
+			t.Fatal("should have timed out")
+		}
+	})
+}
+
+func TestConnectionKeepAlive(t *testing.T) {
+	t.Run("enabled", func(t *testing.T) {
+		testConnectionKeepAlive(t, true, true)
+	})
+
+	t.Run("disabled", func(t *testing.T) {
+		testConnectionKeepAlive(t, false, false)
+	})
+}
+
+func testConnectionKeepAlive(t *testing.T, enable, expectKeepAlive bool) {
+	synctest.Test(t, func(t *testing.T) {
+		var keepAlivePeriod time.Duration
+		if enable {
+			keepAlivePeriod = time.Second
+		}
+
+		mockCtrl := gomock.NewController(t)
+		unpacker := NewMockUnpacker(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			&Config{MaxIdleTimeout: time.Second, KeepAlivePeriod: keepAlivePeriod},
+			false,
+			connectionOptUnpacker(unpacker),
+			connectionOptHandshakeConfirmed(),
+			connectionOptRTT(time.Millisecond),
+		)
+		// the idle timeout is set when the transport parameters are received
+		const idleTimeout = 50 * time.Millisecond
+		require.NoError(t, tc.conn.handleTransportParameters(&wire.TransportParameters{
+			MaxIdleTimeout: idleTimeout,
+		}))
+
+		// Receive a packet. This starts the keep-alive timer.
+		buf := getPacketBuffer()
+		var err error
+		buf.Data, err = wire.AppendShortHeader(buf.Data, tc.srcConnID, 1, protocol.PacketNumberLen1, protocol.KeyPhaseZero)
+		require.NoError(t, err)
+		buf.Data = append(buf.Data, []byte("packet")...)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		var unpackTime, packTime monotime.Time
+		done := make(chan struct{})
+		unpacker.EXPECT().UnpackShortHeader(gomock.Any(), gomock.Any()).DoAndReturn(
+			func(t monotime.Time, bytes []byte) (protocol.PacketNumber, protocol.PacketNumberLen, protocol.KeyPhaseBit, []byte, error) {
+				unpackTime = monotime.Now()
+				return protocol.PacketNumber(1), protocol.PacketNumberLen1, protocol.KeyPhaseZero, []byte{0} /* PADDING */, nil
+			},
+		)
+		tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(shortHeaderPacket{}, errNothingToPack)
+
+		switch expectKeepAlive {
+		case true:
+			// record the time of the keep-alive is sent
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(buffer *packetBuffer, count protocol.ByteCount, t monotime.Time, version protocol.Version) (shortHeaderPacket, error) {
+					packTime = monotime.Now()
+					close(done)
+					return shortHeaderPacket{}, errNothingToPack
+				},
+			)
+			tc.conn.handlePacket(receivedPacket{data: buf.Data, buffer: buf, rcvTime: monotime.Now(), remoteAddr: tc.remoteAddr})
+			select {
+			case <-done:
+				// the keep-alive packet should be sent after half the idle timeout
+				require.Equal(t, unpackTime.Add(idleTimeout/2), packTime)
+			case <-time.After(idleTimeout):
+				t.Fatal("timeout")
+			}
+		case false: // if keep-alives are disabled, the connection will run into an idle timeout
+			tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+			tc.conn.handlePacket(receivedPacket{data: buf.Data, buffer: buf, rcvTime: monotime.Now(), remoteAddr: tc.remoteAddr})
+		}
+
+		// test teardown
+		if expectKeepAlive {
+			tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+			tc.conn.destroy(nil)
+		}
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			if expectKeepAlive {
+				require.NoError(t, err)
+			} else {
+				require.ErrorIs(t, err, &IdleTimeoutError{})
+			}
+		case <-time.After(time.Hour):
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestConnectionACKTimer(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			&Config{MaxIdleTimeout: time.Second},
+			false,
+			connectionOptHandshakeConfirmed(),
+			connectionOptSentPacketHandler(sph),
+		)
+		const alarmTimeout = 500 * time.Millisecond
+
+		sph.EXPECT().GetLossDetectionTimeout().AnyTimes()
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny).AnyTimes()
+		sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+		sph.EXPECT().ECNMode(gomock.Any()).AnyTimes()
+		tc.sendConn.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+
+		// Set initial alarm timeout far in the future
+		_ = tc.receivedPacketHandler().ReceivedPacket(1, protocol.ECNNon, protocol.Encryption1RTT, monotime.Now().Add(time.Hour), true)
+
+		var times []monotime.Time
+		done := make(chan struct{}, 5)
+		var calls []any
+
+		for range 2 {
+			calls = append(calls, tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(buf *packetBuffer, _ protocol.ByteCount, _ monotime.Time, _ protocol.Version) (shortHeaderPacket, error) {
+					buf.Data = append(buf.Data, []byte("foobar")...)
+					times = append(times, monotime.Now())
+					rph := tc.receivedPacketHandler()
+					if len(times) == 1 {
+						// After first packet is sent, set alarm timeout for the next iteration
+						// Get the ACK frame to reset state, then receive a new packet to set alarm
+						_ = rph.GetAckFrame(protocol.Encryption1RTT, monotime.Now(), false)
+						alarmRcvTime := monotime.Now().Add(alarmTimeout - protocol.MaxAckDelay)
+						_ = rph.ReceivedPacket(2, protocol.ECNNon, protocol.Encryption1RTT, alarmRcvTime, true)
+					} else {
+						// After second packet is sent, set alarm timeout far in the future
+						_ = rph.GetAckFrame(protocol.Encryption1RTT, monotime.Now(), false)
+						_ = rph.ReceivedPacket(3, protocol.ECNNon, protocol.Encryption1RTT, monotime.Now().Add(time.Hour), true)
+					}
+					return shortHeaderPacket{Frames: []ackhandler.Frame{{Frame: &wire.PingFrame{}}}, Length: 6}, nil
+				},
+			))
+			calls = append(calls, tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(*packetBuffer, protocol.ByteCount, monotime.Time, protocol.Version) (shortHeaderPacket, error) {
+					done <- struct{}{}
+					return shortHeaderPacket{}, errNothingToPack
+				},
+			))
+		}
+		gomock.InOrder(calls...)
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		for range 2 {
+			synctest.Wait()
+
+			select {
+			case <-done:
+			case <-time.After(time.Hour):
+				t.Fatal("timeout")
+			}
+		}
+
+		assert.Len(t, times, 2)
+		require.Equal(t, times[0].Add(alarmTimeout), times[1])
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have timed out")
+		}
+	})
+}
+
+// Send a GSO batch, until we have no more data to send.
+func TestConnectionGSOBatch(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			true,
+			connectionOptHandshakeConfirmed(),
+			connectionOptSentPacketHandler(sph),
+		)
+
+		// allow packets to be sent
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny).AnyTimes()
+		sph.EXPECT().TimeUntilSend().AnyTimes()
+		sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+		sph.EXPECT().GetLossDetectionTimeout().AnyTimes()
+		sph.EXPECT().ECNMode(gomock.Any()).Return(protocol.ECT1).AnyTimes()
+
+		maxPacketSize := tc.conn.maxPacketSize()
+		var expectedData []byte
+		for i := range 4 {
+			data := bytes.Repeat([]byte{byte(i)}, int(maxPacketSize))
+			expectedData = append(expectedData, data...)
+
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(buffer *packetBuffer, count protocol.ByteCount, t monotime.Time, version protocol.Version) (shortHeaderPacket, error) {
+					buffer.Data = append(buffer.Data, data...)
+					return shortHeaderPacket{PacketNumber: protocol.PacketNumber(i)}, nil
+				},
+			)
+		}
+		done := make(chan struct{})
+		tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(shortHeaderPacket{}, errNothingToPack)
+		tc.sendConn.EXPECT().Write(expectedData, uint16(maxPacketSize), protocol.ECT1).DoAndReturn(
+			func([]byte, uint16, protocol.ECN) error { close(done); return nil },
+		)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		synctest.Wait()
+
+		select {
+		case <-done:
+		default:
+			t.Fatal("should have sent a packet")
+		}
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have timed out")
+		}
+	})
+}
+
+// Send a GSO batch, until a packet smaller than the maximum size is packed
+func TestConnectionGSOBatchPacketSize(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			true,
+			connectionOptHandshakeConfirmed(),
+			connectionOptSentPacketHandler(sph),
+		)
+
+		// allow packets to be sent
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny).AnyTimes()
+		sph.EXPECT().TimeUntilSend().AnyTimes()
+		sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+		sph.EXPECT().GetLossDetectionTimeout().AnyTimes()
+		sph.EXPECT().ECNMode(gomock.Any()).Return(protocol.ECT1).AnyTimes()
+
+		maxPacketSize := tc.conn.maxPacketSize()
+		var expectedData []byte
+		var calls []any
+		for i := range 4 {
+			var data []byte
+			if i == 3 {
+				data = bytes.Repeat([]byte{byte(i)}, int(maxPacketSize-1))
+			} else {
+				data = bytes.Repeat([]byte{byte(i)}, int(maxPacketSize))
+			}
+			expectedData = append(expectedData, data...)
+
+			calls = append(calls, tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(buffer *packetBuffer, count protocol.ByteCount, t monotime.Time, version protocol.Version) (shortHeaderPacket, error) {
+					buffer.Data = append(buffer.Data, data...)
+					return shortHeaderPacket{PacketNumber: protocol.PacketNumber(10 + i)}, nil
+				},
+			))
+		}
+		// The smaller (fourth) packet concluded this GSO batch, but the send loop will immediately start composing the next batch.
+		// We therefore send a "foobar", so we can check that we're actually generating two GSO batches.
+		calls = append(calls,
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(buffer *packetBuffer, count protocol.ByteCount, t monotime.Time, version protocol.Version) (shortHeaderPacket, error) {
+					buffer.Data = append(buffer.Data, []byte("foobar")...)
+					return shortHeaderPacket{PacketNumber: protocol.PacketNumber(14)}, nil
+				},
+			),
+		)
+		calls = append(calls,
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(shortHeaderPacket{}, errNothingToPack),
+		)
+		gomock.InOrder(calls...)
+
+		done := make(chan struct{})
+		gomock.InOrder(
+			tc.sendConn.EXPECT().Write(expectedData, uint16(maxPacketSize), protocol.ECT1),
+			tc.sendConn.EXPECT().Write([]byte("foobar"), uint16(maxPacketSize), protocol.ECT1).DoAndReturn(
+				func([]byte, uint16, protocol.ECN) error { close(done); return nil },
+			),
+		)
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		synctest.Wait()
+
+		select {
+		case <-done:
+		default:
+			t.Fatal("should have sent a packet")
+		}
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have timed out")
+		}
+	})
+}
+
+func TestConnectionGSOBatchECN(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			true,
+			connectionOptHandshakeConfirmed(),
+			connectionOptSentPacketHandler(sph),
+		)
+
+		// allow packets to be sent
+		ecnMode := protocol.ECT1
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny).AnyTimes()
+		sph.EXPECT().TimeUntilSend().AnyTimes()
+		sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+		sph.EXPECT().GetLossDetectionTimeout().AnyTimes()
+		sph.EXPECT().ECNMode(gomock.Any()).DoAndReturn(func(bool) protocol.ECN { return ecnMode }).AnyTimes()
+
+		// 3. Send a GSO batch, until the ECN marking changes.
+		var expectedData []byte
+		var calls []any
+		maxPacketSize := tc.conn.maxPacketSize()
+		for i := range 3 {
+			data := bytes.Repeat([]byte{byte(i)}, int(maxPacketSize))
+			expectedData = append(expectedData, data...)
+
+			calls = append(calls, tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(buffer *packetBuffer, count protocol.ByteCount, t monotime.Time, version protocol.Version) (shortHeaderPacket, error) {
+					buffer.Data = append(buffer.Data, data...)
+					if i == 2 {
+						ecnMode = protocol.ECNCE
+					}
+					return shortHeaderPacket{PacketNumber: protocol.PacketNumber(20 + i)}, nil
+				},
+			))
+		}
+		// The smaller (fourth) packet concluded this GSO batch, but the send loop will immediately start composing the next batch.
+		// We therefore send a "foobar", so we can check that we're actually generating two GSO batches.
+		calls = append(calls,
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(buffer *packetBuffer, count protocol.ByteCount, t monotime.Time, version protocol.Version) (shortHeaderPacket, error) {
+					buffer.Data = append(buffer.Data, []byte("foobar")...)
+					return shortHeaderPacket{PacketNumber: protocol.PacketNumber(24)}, nil
+				},
+			),
+		)
+		calls = append(calls,
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(shortHeaderPacket{}, errNothingToPack),
+		)
+		gomock.InOrder(calls...)
+
+		done3 := make(chan struct{})
+		tc.sendConn.EXPECT().Write(expectedData, uint16(maxPacketSize), protocol.ECT1)
+		tc.sendConn.EXPECT().Write([]byte("foobar"), uint16(maxPacketSize), protocol.ECNCE).DoAndReturn(
+			func([]byte, uint16, protocol.ECN) error { close(done3); return nil },
+		)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		synctest.Wait()
+
+		select {
+		case <-done3:
+		default:
+			t.Fatal("should have sent a packet")
+		}
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have timed out")
+		}
+	})
+}
+
+func TestConnectionPTOProbePackets(t *testing.T) {
+	t.Run("Initial", func(t *testing.T) {
+		testConnectionPTOProbePackets(t, protocol.EncryptionInitial)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testConnectionPTOProbePackets(t, protocol.EncryptionHandshake)
+	})
+	t.Run("1-RTT", func(t *testing.T) {
+		testConnectionPTOProbePackets(t, protocol.Encryption1RTT)
+	})
+}
+
+func testConnectionPTOProbePackets(t *testing.T, encLevel protocol.EncryptionLevel) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptSentPacketHandler(sph),
+		)
+
+		var sendMode ackhandler.SendMode
+		switch encLevel {
+		case protocol.EncryptionInitial:
+			sendMode = ackhandler.SendPTOInitial
+		case protocol.EncryptionHandshake:
+			sendMode = ackhandler.SendPTOHandshake
+		case protocol.Encryption1RTT:
+			sendMode = ackhandler.SendPTOAppData
+		}
+
+		sph.EXPECT().GetLossDetectionTimeout().AnyTimes()
+		sph.EXPECT().TimeUntilSend().AnyTimes()
+		sph.EXPECT().SendMode(gomock.Any()).Return(sendMode)
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendNone)
+		sph.EXPECT().ECNMode(gomock.Any())
+		sph.EXPECT().QueueProbePacket(encLevel).Return(false)
+		sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any())
+
+		tc.packer.EXPECT().PackPTOProbePacket(encLevel, gomock.Any(), true, gomock.Any(), protocol.Version1).DoAndReturn(
+			func(protocol.EncryptionLevel, protocol.ByteCount, bool, monotime.Time, protocol.Version) (*coalescedPacket, error) {
+				return &coalescedPacket{
+					buffer:         getPacketBuffer(),
+					shortHdrPacket: &shortHeaderPacket{PacketNumber: 1},
+				}, nil
+			},
+		)
+		done := make(chan struct{})
+		tc.sendConn.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any()).Do(
+			func([]byte, uint16, protocol.ECN) error { close(done); return nil },
+		)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have timed out")
+		}
+	})
+}
+
+func TestConnectionCongestionControl(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptHandshakeConfirmed(),
+			connectionOptSentPacketHandler(sph),
+		)
+
+		sph.EXPECT().TimeUntilSend().AnyTimes()
+		sph.EXPECT().GetLossDetectionTimeout().AnyTimes()
+		sph.EXPECT().ECNMode(true).AnyTimes()
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny).Times(2)
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAck).MaxTimes(1)
+		sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Times(2)
+		// Since we're already sending out packets, we don't expect any calls to PackAckOnlyPacket
+		for i := range 2 {
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(buffer *packetBuffer, count protocol.ByteCount, t monotime.Time, version protocol.Version) (shortHeaderPacket, error) {
+					buffer.Data = append(buffer.Data, []byte("foobar")...)
+					return shortHeaderPacket{PacketNumber: protocol.PacketNumber(i)}, nil
+				},
+			)
+		}
+		tc.sendConn.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any())
+		done1 := make(chan struct{})
+		tc.sendConn.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any()).Do(
+			func([]byte, uint16, protocol.ECN) error { close(done1); return nil },
+		)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		synctest.Wait()
+
+		select {
+		case <-done1:
+		default:
+			t.Fatal("should have sent a packet")
+		}
+		require.True(t, mockCtrl.Satisfied())
+
+		// Now that we're congestion limited, we can only send an ack-only packet
+		done2 := make(chan struct{})
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAck)
+		tc.packer.EXPECT().PackAckOnlyPacket(gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+			func(protocol.ByteCount, monotime.Time, protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+				close(done2)
+				return shortHeaderPacket{}, nil, errNothingToPack
+			},
+		)
+		tc.conn.scheduleSending()
+
+		synctest.Wait()
+
+		select {
+		case <-done2:
+		default:
+			t.Fatal("should have sent an ack-only packet")
+		}
+		require.True(t, mockCtrl.Satisfied())
+
+		// If the send mode is "none", we can't even send an ack-only packet
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendNone)
+		tc.conn.scheduleSending()
+		synctest.Wait() // make sure there are no calls to the packer
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestConnectionSendQueue(t *testing.T) {
+	t.Run("with GSO", func(t *testing.T) {
+		testConnectionSendQueue(t, true)
+	})
+	t.Run("without GSO", func(t *testing.T) {
+		testConnectionSendQueue(t, false)
+	})
+}
+
+func testConnectionSendQueue(t *testing.T, enableGSO bool) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		sph := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+		sender := NewMockSender(mockCtrl)
+		tc := newServerTestConnection(t,
+			mockCtrl,
+			nil,
+			enableGSO,
+			connectionOptSender(sender),
+			connectionOptHandshakeConfirmed(),
+			connectionOptSentPacketHandler(sph),
+		)
+
+		sender.EXPECT().Run().MaxTimes(1)
+		sender.EXPECT().WouldBlock()
+		sender.EXPECT().WouldBlock().Return(true).Times(2)
+		available := make(chan struct{})
+		blocked := make(chan struct{})
+		sender.EXPECT().Available().DoAndReturn(
+			func() <-chan struct{} {
+				close(blocked)
+				return available
+			},
+		)
+		sph.EXPECT().GetLossDetectionTimeout().AnyTimes()
+		sph.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any())
+		sph.EXPECT().SendMode(gomock.Any()).Return(ackhandler.SendAny).AnyTimes()
+		sph.EXPECT().ECNMode(gomock.Any()).AnyTimes()
+		tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(
+			shortHeaderPacket{PacketNumber: protocol.PacketNumber(1)}, nil,
+		)
+		sender.EXPECT().Send(gomock.Any(), gomock.Any(), gomock.Any())
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		tc.conn.scheduleSending()
+
+		synctest.Wait()
+
+		select {
+		case <-blocked:
+		default:
+			t.Fatal("should have blocked")
+		}
+		require.True(t, mockCtrl.Satisfied())
+
+		// now make room in the send queue
+		sender.EXPECT().WouldBlock().AnyTimes()
+		unblocked := make(chan struct{})
+		tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+			func(*packetBuffer, protocol.ByteCount, monotime.Time, protocol.Version) (shortHeaderPacket, error) {
+				close(unblocked)
+				return shortHeaderPacket{}, errNothingToPack
+			},
+		)
+		available <- struct{}{}
+
+		synctest.Wait()
+
+		select {
+		case <-unblocked:
+		default:
+			t.Fatal("should have unblocked")
+		}
+
+		// test teardown
+		sender.EXPECT().Close()
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func getVersionNegotiationPacket(src, dest protocol.ConnectionID, versions []protocol.Version) receivedPacket {
+	b := wire.ComposeVersionNegotiation(
+		protocol.ArbitraryLenConnectionID(src.Bytes()),
+		protocol.ArbitraryLenConnectionID(dest.Bytes()),
+		versions,
+	)
+	return receivedPacket{
+		rcvTime: monotime.Now(),
+		data:    b,
+		buffer:  getPacketBuffer(),
+	}
+}
+
+func TestConnectionVersionNegotiation(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newClientTestConnection(t, mockCtrl, nil, false, connectionOptTracer(&eventRecorder))
+
+		tc.packer.EXPECT().PackCoalescedPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(nil, nil).AnyTimes()
+		tc.connRunner.EXPECT().Remove(gomock.Any())
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+		vnp := getVersionNegotiationPacket(
+			tc.destConnID,
+			tc.srcConnID,
+			[]protocol.Version{1234, protocol.Version2},
+		)
+		// the version negotiation packet might contained greased versions
+		_, _, vnpVersions, err := wire.ParseVersionNegotiationPacket(vnp.data)
+		require.NoError(t, err)
+		tc.conn.handlePacket(vnp)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			var rerr *errCloseForRecreating
+			require.ErrorAs(t, err, &rerr)
+			require.Equal(t, rerr.nextVersion, protocol.Version2)
+		default:
+			t.Fatal("should have received a Version Negotiation packet")
+		}
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.VersionNegotiationReceived{
+					Header: qlog.PacketHeaderVersionNegotiation{
+						SrcConnectionID:  protocol.ArbitraryLenConnectionID(tc.destConnID.Bytes()),
+						DestConnectionID: protocol.ArbitraryLenConnectionID(tc.srcConnID.Bytes()),
+					},
+					SupportedVersions: vnpVersions,
+				},
+				qlog.VersionInformation{
+					ServerVersions: vnpVersions,
+					ClientVersions: []qlog.Version{protocol.Version1, protocol.Version2},
+					ChosenVersion:  protocol.Version2,
+				},
+			},
+			eventRecorder.Events(qlog.VersionNegotiationReceived{}, qlog.VersionInformation{}),
+		)
+	})
+}
+
+func TestConnectionVersionNegotiationNoMatch(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		tc := newClientTestConnection(t,
+			mockCtrl,
+			&Config{Versions: []protocol.Version{protocol.Version1}},
+			false,
+			connectionOptTracer(&eventRecorder),
+		)
+
+		tc.packer.EXPECT().PackCoalescedPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(nil, nil).AnyTimes()
+		tc.connRunner.EXPECT().Remove(gomock.Any())
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		vnp := getVersionNegotiationPacket(
+			tc.destConnID,
+			tc.srcConnID,
+			[]protocol.Version{protocol.Version2},
+		)
+		_, _, vnpVersions, err := wire.ParseVersionNegotiationPacket(vnp.data)
+		require.NoError(t, err)
+		tc.conn.handlePacket(vnp)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			var verr *VersionNegotiationError
+			require.ErrorAs(t, err, &verr)
+			require.Contains(t, verr.Theirs, protocol.Version2)
+			require.Equal(t,
+				[]qlogwriter.Event{
+					qlog.VersionNegotiationReceived{
+						Header: qlog.PacketHeaderVersionNegotiation{
+							SrcConnectionID:  protocol.ArbitraryLenConnectionID(tc.destConnID.Bytes()),
+							DestConnectionID: protocol.ArbitraryLenConnectionID(tc.srcConnID.Bytes()),
+						},
+						SupportedVersions: vnpVersions,
+					},
+					qlog.ConnectionClosed{
+						Initiator: qlog.InitiatorLocal,
+						Trigger:   qlog.ConnectionCloseTriggerVersionMismatch,
+					},
+				},
+				eventRecorder.Events(qlog.VersionNegotiationReceived{}, qlog.ConnectionClosed{}),
+			)
+		default:
+			t.Fatal("should have received a Version Negotiation packet")
+		}
+	})
+}
+
+func TestConnectionVersionNegotiationInvalidPackets(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	var eventRecorder events.Recorder
+	tc := newClientTestConnection(t,
+		mockCtrl,
+		nil,
+		false,
+		connectionOptTracer(&eventRecorder),
+	)
+
+	// offers the current version
+	vnp := getVersionNegotiationPacket(
+		tc.destConnID,
+		tc.srcConnID,
+		[]protocol.Version{1234, protocol.Version1},
+	)
+	wasProcessed, err := tc.conn.handleOnePacket(vnp, 0)
+	require.NoError(t, err)
+	require.False(t, wasProcessed)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header:  qlog.PacketHeader{PacketType: qlog.PacketTypeVersionNegotiation},
+				Raw:     qlog.RawInfo{Length: int(vnp.Size())},
+				Trigger: qlog.PacketDropUnexpectedVersion,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+	require.True(t, mockCtrl.Satisfied())
+	eventRecorder.Clear()
+
+	// unparseable, since it's missing 2 bytes
+	vnp.data = vnp.data[:len(vnp.data)-2]
+	wasProcessed, err = tc.conn.handleOnePacket(vnp, 0)
+	require.NoError(t, err)
+	require.False(t, wasProcessed)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header:  qlog.PacketHeader{PacketType: qlog.PacketTypeVersionNegotiation},
+				Raw:     qlog.RawInfo{Length: int(vnp.Size())},
+				Trigger: qlog.PacketDropHeaderParseError,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+}
+
+func getRetryPacket(t *testing.T, src, dest, origDest protocol.ConnectionID, token []byte) receivedPacket {
+	hdr := wire.Header{
+		Type:             protocol.PacketTypeRetry,
+		SrcConnectionID:  src,
+		DestConnectionID: dest,
+		Token:            token,
+		Version:          protocol.Version1,
+	}
+	b, err := (&wire.ExtendedHeader{Header: hdr}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	tag := handshake.GetRetryIntegrityTag(b, origDest, protocol.Version1)
+	b = append(b, tag[:]...)
+	return receivedPacket{
+		rcvTime: monotime.Now(),
+		data:    b,
+		buffer:  getPacketBuffer(),
+	}
+}
+
+func TestConnectionRetryDrops(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	var eventRecorder events.Recorder
+	unpacker := NewMockUnpacker(mockCtrl)
+	tc := newClientTestConnection(t,
+		mockCtrl,
+		nil,
+		false,
+		connectionOptTracer(&eventRecorder),
+		connectionOptUnpacker(unpacker),
+	)
+
+	newConnID := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef})
+
+	// invalid integrity tag
+	retry := getRetryPacket(t, newConnID, tc.srcConnID, tc.destConnID, []byte("foobar"))
+	retry.data[len(retry.data)-1]++
+	wasProcessed, err := tc.conn.handleOnePacket(retry, 0)
+	require.NoError(t, err)
+	require.False(t, wasProcessed)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeRetry,
+					SrcConnectionID:  newConnID,
+					DestConnectionID: tc.srcConnID,
+					Version:          protocol.Version1,
+				},
+				Raw:     qlog.RawInfo{Length: int(retry.Size())},
+				Trigger: qlog.PacketDropPayloadDecryptError,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+	eventRecorder.Clear()
+
+	// receive a retry that doesn't change the connection ID
+	retry = getRetryPacket(t, tc.destConnID, tc.srcConnID, tc.destConnID, []byte("foobar"))
+	wasProcessed, err = tc.conn.handleOnePacket(retry, 0)
+	require.NoError(t, err)
+	require.False(t, wasProcessed)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeRetry,
+					SrcConnectionID:  tc.destConnID,
+					DestConnectionID: tc.srcConnID,
+					Version:          protocol.Version1,
+				},
+				Raw:     qlog.RawInfo{Length: int(retry.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+}
+
+func TestConnectionRetryAfterReceivedPacket(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	var eventRecorder events.Recorder
+	unpacker := NewMockUnpacker(mockCtrl)
+	tc := newClientTestConnection(t,
+		mockCtrl,
+		nil,
+		false,
+		connectionOptTracer(&eventRecorder),
+		connectionOptUnpacker(unpacker),
+	)
+
+	// receive a regular packet
+	regular := getPacketWithPacketType(t, tc.srcConnID, protocol.PacketTypeInitial, 200)
+	unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(
+		&unpackedPacket{
+			hdr:             &wire.ExtendedHeader{Header: wire.Header{Type: protocol.PacketTypeInitial}},
+			encryptionLevel: protocol.EncryptionInitial,
+		}, nil,
+	)
+	wasProcessed, err := tc.conn.handleOnePacket(receivedPacket{
+		data:       regular,
+		buffer:     getPacketBuffer(),
+		rcvTime:    monotime.Now(),
+		remoteAddr: tc.remoteAddr,
+	}, 0)
+	require.NoError(t, err)
+	require.True(t, wasProcessed)
+
+	require.Len(t, eventRecorder.Events(qlog.PacketReceived{}), 1)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.VersionInformation{
+				ChosenVersion:  protocol.Version1,
+				ClientVersions: tc.conn.config.Versions,
+			},
+		},
+		eventRecorder.Events(qlog.VersionInformation{}),
+	)
+	eventRecorder.Clear()
+
+	// receive a retry
+	retry := getRetryPacket(t, tc.destConnID, tc.srcConnID, tc.destConnID, []byte("foobar"))
+	wasProcessed, err = tc.conn.handleOnePacket(retry, 0)
+	require.NoError(t, err)
+	require.False(t, wasProcessed)
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeRetry,
+					SrcConnectionID:  tc.conn.origDestConnID,
+					DestConnectionID: tc.srcConnID,
+					Version:          tc.conn.version,
+				},
+				Raw:     qlog.RawInfo{Length: int(retry.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+	eventRecorder.Clear()
+}
+
+func TestConnectionConnectionIDChanges(t *testing.T) {
+	t.Run("with retry", func(t *testing.T) {
+		testConnectionConnectionIDChanges(t, true)
+	})
+	t.Run("without retry", func(t *testing.T) {
+		testConnectionConnectionIDChanges(t, false)
+	})
+}
+
+func testConnectionConnectionIDChanges(t *testing.T, sendRetry bool) {
+	synctest.Test(t, func(t *testing.T) {
+		makeInitialPacket := func(t *testing.T, hdr *wire.ExtendedHeader) []byte {
+			t.Helper()
+			data, err := hdr.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			data = append(data, make([]byte, hdr.Length-protocol.ByteCount(hdr.PacketNumberLen))...)
+			return data
+		}
+
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		unpacker := NewMockUnpacker(mockCtrl)
+		tc := newClientTestConnection(t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptTracer(&eventRecorder),
+			connectionOptUnpacker(unpacker),
+		)
+
+		dstConnID := tc.destConnID
+		b := make([]byte, 3*10)
+		rand.Read(b)
+		newConnID := protocol.ParseConnectionID(b[:11])
+		newConnID2 := protocol.ParseConnectionID(b[11:20])
+
+		tc.packer.EXPECT().PackCoalescedPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(nil, nil).AnyTimes()
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		require.Equal(t, dstConnID, tc.conn.connIDManager.Get())
+
+		var retryConnID protocol.ConnectionID
+		if sendRetry {
+			retryConnID = protocol.ParseConnectionID(b[20:30])
+			tc.packer.EXPECT().SetToken([]byte("foobar"))
+
+			retry := getRetryPacket(t, retryConnID, tc.srcConnID, tc.destConnID, []byte("foobar"))
+			tc.conn.handlePacket(retry)
+
+			synctest.Wait()
+
+			require.Equal(t,
+				[]qlogwriter.Event{
+					qlog.PacketReceived{
+						Header: qlog.PacketHeader{
+							PacketType:       qlog.PacketTypeRetry,
+							SrcConnectionID:  retryConnID,
+							DestConnectionID: dstConnID,
+							Version:          protocol.Version1,
+							Token:            &qlog.Token{Raw: []byte("foobar")},
+						},
+						Raw: qlog.RawInfo{Length: int(retry.Size())},
+					},
+				},
+				eventRecorder.Events(qlog.PacketReceived{}, qlog.PacketDropped{}),
+			)
+		}
+		eventRecorder.Clear()
+
+		// Send the first packet. The server changes the connection ID to newConnID.
+		hdr1 := wire.ExtendedHeader{
+			Header: wire.Header{
+				SrcConnectionID:  newConnID,
+				DestConnectionID: tc.srcConnID,
+				Type:             protocol.PacketTypeInitial,
+				Length:           200,
+				Version:          protocol.Version1,
+			},
+			PacketNumber:    1,
+			PacketNumberLen: protocol.PacketNumberLen2,
+		}
+		hdr2 := hdr1
+		hdr2.SrcConnectionID = newConnID2
+
+		unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(
+			&unpackedPacket{hdr: &hdr1, encryptionLevel: protocol.EncryptionInitial}, nil,
+		)
+		eventRecorder.Clear()
+		packet1 := getLongHeaderPacket(t, tc.remoteAddr, &hdr1, make([]byte, 198))
+		tc.conn.handlePacket(packet1)
+
+		synctest.Wait()
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketReceived{
+					Header: qlog.PacketHeader{
+						PacketType:       qlog.PacketTypeInitial,
+						SrcConnectionID:  newConnID,
+						DestConnectionID: tc.srcConnID,
+						PacketNumber:     1,
+						Version:          protocol.Version1,
+					},
+					Raw:                     qlog.RawInfo{Length: int(packet1.Size()), PayloadLength: int(hdr1.Length)},
+					DatagramPayloadChecksum: qlog.CalculateDatagramPayloadChecksum(packet1.data),
+					Frames:                  []qlog.Frame{},
+				},
+			},
+			eventRecorder.Events(qlog.PacketReceived{}, qlog.PacketDropped{}),
+		)
+		eventRecorder.Clear()
+
+		// Send the second packet. We refuse to accept it, because the connection ID is changed again.
+		packet2 := receivedPacket{data: makeInitialPacket(t, &hdr2), buffer: getPacketBuffer(), rcvTime: monotime.Now(), remoteAddr: tc.remoteAddr}
+		tc.conn.handlePacket(packet2)
+
+		synctest.Wait()
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Header: qlog.PacketHeader{
+						PacketType:   qlog.PacketTypeInitial,
+						PacketNumber: protocol.InvalidPacketNumber,
+					},
+					Raw:                     qlog.RawInfo{Length: int(packet2.Size())},
+					DatagramPayloadChecksum: qlog.CalculateDatagramPayloadChecksum(packet2.data),
+					Trigger:                 qlog.PacketDropUnknownConnectionID,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}, qlog.PacketReceived{}),
+		)
+		// the connection ID should not have changed
+		require.Equal(t, newConnID, tc.conn.connIDManager.Get())
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any())
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have shut down")
+		}
+	})
+}
+
+// When the connection is closed before sending the first packet,
+// we don't send a CONNECTION_CLOSE.
+// This can happen if there's something wrong the tls.Config, and
+// crypto/tls refuses to start the handshake.
+func TestConnectionEarlyClose(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		var eventRecorder events.Recorder
+		cryptoSetup := mocks.NewMockCryptoSetup(mockCtrl)
+		tc := newClientTestConnection(t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptTracer(&eventRecorder),
+			connectionOptCryptoSetup(cryptoSetup),
+		)
+
+		tc.conn.sentFirstPacket = false
+		cryptoSetup.EXPECT().StartHandshake(gomock.Any()).Do(func(context.Context) error {
+			tc.conn.closeLocal(errors.New("early error"))
+			return nil
+		})
+		cryptoSetup.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent})
+		cryptoSetup.EXPECT().Close()
+		tc.connRunner.EXPECT().Remove(gomock.Any())
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.Error(t, err)
+			require.ErrorContains(t, err, "early error")
+			code := qerr.InternalError
+			require.Equal(t,
+				[]qlogwriter.Event{
+					qlog.ConnectionClosed{
+						Initiator:       qlog.InitiatorLocal,
+						ConnectionError: &code,
+						Reason:          "early error",
+					},
+				},
+				eventRecorder.Events(qlog.ConnectionClosed{}),
+			)
+		default:
+			t.Fatal("should have shut down")
+		}
+	})
+}
+
+func TestConnectionPathValidation(t *testing.T) {
+	t.Run("NAT rebinding", func(t *testing.T) {
+		testConnectionPathValidation(t, true)
+	})
+
+	t.Run("intentional migration", func(t *testing.T) {
+		testConnectionPathValidation(t, false)
+	})
+}
+
+func testConnectionPathValidation(t *testing.T, isNATRebinding bool) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		unpacker := NewMockUnpacker(mockCtrl)
+		tc := newServerTestConnection(
+			t,
+			mockCtrl,
+			nil,
+			false,
+			connectionOptUnpacker(unpacker),
+			connectionOptHandshakeConfirmed(),
+			connectionOptRTT(time.Second),
+		)
+		require.NoError(t, tc.conn.handleTransportParameters(&wire.TransportParameters{MaxUDPPayloadSize: 1456}))
+
+		newRemoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 1, 1), Port: 1234}
+		require.NotEqual(t, tc.remoteAddr, newRemoteAddr)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- tc.conn.run() }()
+
+		probeSent := make(chan struct{})
+		var pathChallenge *wire.PathChallengeFrame
+		payload := []byte{0} // PADDING frame
+		if isNATRebinding {
+			payload = []byte{1} // PING frame
+		}
+		gomock.InOrder(
+			unpacker.EXPECT().UnpackShortHeader(gomock.Any(), gomock.Any()).Return(
+				protocol.PacketNumber(10), protocol.PacketNumberLen2, protocol.KeyPhaseZero, payload, nil,
+			),
+			tc.packer.EXPECT().PackPathProbePacket(gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+				func(_ protocol.ConnectionID, frames []ackhandler.Frame, _ protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+					pathChallenge = frames[0].Frame.(*wire.PathChallengeFrame)
+					return shortHeaderPacket{IsPathProbePacket: true}, getPacketBuffer(), nil
+				},
+			),
+			tc.sendConn.EXPECT().WriteTo(gomock.Any(), newRemoteAddr, packetInfo{}).DoAndReturn(
+				func([]byte, net.Addr, packetInfo) error { close(probeSent); return nil },
+			),
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(
+				shortHeaderPacket{}, errNothingToPack,
+			),
+		)
+
+		tc.conn.handlePacket(receivedPacket{
+			data:       make([]byte, 10),
+			buffer:     getPacketBuffer(),
+			remoteAddr: newRemoteAddr,
+			rcvTime:    monotime.Now(),
+		})
+
+		synctest.Wait()
+
+		select {
+		case <-probeSent:
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+
+		// Receive a packed containing a PATH_RESPONSE frame.
+		// Only if the first packet received on the path was a probing packet
+		// (i.e. we're dealing with a NAT rebinding), this makes us switch to the new path.
+		migrated := make(chan struct{})
+		data, err := (&wire.PathResponseFrame{Data: pathChallenge.Data}).Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		calls := []any{
+			unpacker.EXPECT().UnpackShortHeader(gomock.Any(), gomock.Any()).Return(
+				protocol.PacketNumber(11), protocol.PacketNumberLen2, protocol.KeyPhaseZero, data, nil,
+			),
+		}
+		if isNATRebinding {
+			calls = append(calls,
+				tc.sendConn.EXPECT().ChangeRemoteAddr(newRemoteAddr, gomock.Any()).Do(
+					func(net.Addr, packetInfo) { close(migrated) },
+				),
+			)
+		}
+		calls = append(calls,
+			tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(
+				shortHeaderPacket{}, errNothingToPack,
+			).MaxTimes(1),
+		)
+		gomock.InOrder(calls...)
+		require.Equal(t, tc.remoteAddr, tc.conn.RemoteAddr())
+		// the PATH_RESPONSE can be sent on the old path, if the client is just probing the new path
+		addr := tc.remoteAddr
+		if isNATRebinding {
+			addr = newRemoteAddr
+		}
+		tc.conn.handlePacket(receivedPacket{
+			data:       make([]byte, 100),
+			buffer:     getPacketBuffer(),
+			remoteAddr: addr,
+			rcvTime:    monotime.Now(),
+		})
+
+		synctest.Wait()
+
+		if !isNATRebinding {
+			// If the first packet was a probing packet, we only switch to the new path when we
+			// receive a non-probing packet on that path.
+			select {
+			case <-migrated:
+				t.Fatal("didn't expect a migration yet")
+			default:
+			}
+
+			payload := []byte{1} // PING frame
+			payload, err = (&wire.PathResponseFrame{Data: pathChallenge.Data}).Append(payload, protocol.Version1)
+			require.NoError(t, err)
+			gomock.InOrder(
+				unpacker.EXPECT().UnpackShortHeader(gomock.Any(), gomock.Any()).Return(
+					protocol.PacketNumber(12), protocol.PacketNumberLen2, protocol.KeyPhaseZero, payload, nil,
+				),
+				tc.sendConn.EXPECT().ChangeRemoteAddr(newRemoteAddr, gomock.Any()).Do(
+					func(net.Addr, packetInfo) { close(migrated) },
+				),
+				tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(
+					shortHeaderPacket{}, errNothingToPack,
+				).MaxTimes(1),
+			)
+			tc.conn.handlePacket(receivedPacket{
+				data:       make([]byte, 100),
+				buffer:     getPacketBuffer(),
+				remoteAddr: newRemoteAddr,
+				rcvTime:    monotime.Now(),
+			})
+		}
+
+		synctest.Wait()
+
+		select {
+		case <-migrated:
+		default:
+			t.Fatal("should have migrated")
+		}
+
+		// test teardown
+		tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+		tc.conn.destroy(nil)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have shut down")
+		}
+	})
+}
+
+func TestConnectionMigrationServer(t *testing.T) {
+	tc := newServerTestConnection(t, nil, nil, false)
+	_, err := tc.conn.AddPath(&Transport{})
+	require.Error(t, err)
+	require.ErrorContains(t, err, "server cannot initiate connection migration")
+}
+
+func TestConnectionMigration(t *testing.T) {
+	t.Run("disabled", func(t *testing.T) {
+		testConnectionMigration(t, false)
+	})
+
+	t.Run("enabled", func(t *testing.T) {
+		testConnectionMigration(t, true)
+	})
+}
+
+func testConnectionMigration(t *testing.T, enabled bool) {
+	tc := newClientTestConnection(t, nil, nil, false, connectionOptHandshakeConfirmed())
+	require.NoError(t, tc.conn.handleTransportParameters(&wire.TransportParameters{
+		InitialSourceConnectionID:       tc.destConnID,
+		OriginalDestinationConnectionID: tc.destConnID,
+		DisableActiveMigration:          !enabled,
+	}))
+
+	tr := &Transport{
+		Conn:              newUDPConnLocalhost(t),
+		StatelessResetKey: &StatelessResetKey{},
+	}
+	defer tr.Close()
+	path, err := tc.conn.AddPath(tr)
+	if !enabled {
+		require.Error(t, err)
+		require.ErrorContains(t, err, "server disabled connection migration")
+		return
+	}
+	require.NoError(t, err)
+	require.NotNil(t, path)
+
+	tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(
+		shortHeaderPacket{}, errNothingToPack,
+	).AnyTimes()
+	packedProbe := make(chan struct{})
+	tc.packer.EXPECT().PackPathProbePacket(gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+		func(protocol.ConnectionID, []ackhandler.Frame, protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+			defer close(packedProbe)
+			return shortHeaderPacket{IsPathProbePacket: true}, getPacketBuffer(), nil
+		},
+	).AnyTimes()
+	tc.connRunner.EXPECT().AddResetToken(gomock.Any(), gomock.Any())
+	// add a new connection ID, so the path can be probed
+	_, err = tc.conn.handleFrame(&wire.NewConnectionIDFrame{
+		SequenceNumber: 1,
+		ConnectionID:   protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+	}, protocol.EncryptionInitial, tc.destConnID, monotime.Now())
+	require.NoError(t, err)
+	errChan := make(chan error, 1)
+	go func() { errChan <- tc.conn.run() }()
+
+	// Adding the path initialized the transport.
+	// We can test this by triggering a stateless reset.
+	conn := newUDPConnLocalhost(t)
+	_, err = conn.WriteTo(append([]byte{0x40}, make([]byte, 100)...), tr.Conn.LocalAddr())
+	require.NoError(t, err)
+	conn.SetReadDeadline(time.Now().Add(time.Second))
+	_, _, err = conn.ReadFrom(make([]byte, 100))
+	require.NoError(t, err)
+
+	go func() { path.Probe(context.Background()) }()
+	select {
+	case <-packedProbe:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	// teardown
+	tc.connRunner.EXPECT().Remove(gomock.Any()).AnyTimes()
+	tc.connRunner.EXPECT().RemoveResetToken(gomock.Any()).MaxTimes(1)
+	tc.conn.destroy(nil)
+	select {
+	case <-errChan:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestConnectionDatagrams(t *testing.T) {
+	t.Run("disabled", func(t *testing.T) {
+		testConnectionDatagrams(t, false)
+	})
+	t.Run("enabled", func(t *testing.T) {
+		testConnectionDatagrams(t, true)
+	})
+}
+
+func testConnectionDatagrams(t *testing.T, enabled bool) {
+	tc := newServerTestConnection(t, nil, &Config{EnableDatagrams: enabled}, false)
+
+	data, err := (&wire.DatagramFrame{Data: []byte("foo"), DataLenPresent: true}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	data, err = (&wire.DatagramFrame{Data: []byte("bar")}).Append(data, protocol.Version1)
+	require.NoError(t, err)
+	_, _, _, err = tc.conn.handleFrames(data, protocol.ConnectionID{}, protocol.Encryption1RTT, nil, monotime.Now())
+
+	if !enabled {
+		require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.FrameEncodingError, FrameType: uint64(wire.FrameTypeDatagramWithLength)})
+		return
+	}
+
+	require.NoError(t, err)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	d, err := tc.conn.ReceiveDatagram(ctx)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foo"), d)
+	d, err = tc.conn.ReceiveDatagram(ctx)
+	require.NoError(t, err)
+	require.Equal(t, []byte("bar"), d)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/crypto_stream.go b/electron/native/private-transport/third_party/quic-go/crypto_stream.go
new file mode 100644
index 000000000..6d39aa09e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/crypto_stream.go
@@ -0,0 +1,249 @@
+package quic
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"strconv"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+const disableClientHelloScramblingEnv = "QUIC_GO_DISABLE_CLIENTHELLO_SCRAMBLING"
+
+// The baseCryptoStream is used by the cryptoStream and the initialCryptoStream.
+// This allows us to implement different logic for PopCryptoFrame for the two streams.
+type baseCryptoStream struct {
+	queue frameSorter
+
+	highestOffset protocol.ByteCount
+	finished      bool
+
+	writeOffset protocol.ByteCount
+	writeBuf    []byte
+}
+
+func newCryptoStream() *cryptoStream {
+	return &cryptoStream{baseCryptoStream{queue: *newFrameSorter()}}
+}
+
+func (s *baseCryptoStream) HandleCryptoFrame(f *wire.CryptoFrame) error {
+	highestOffset := f.Offset + protocol.ByteCount(len(f.Data))
+	if maxOffset := highestOffset; maxOffset > protocol.MaxCryptoStreamOffset {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.CryptoBufferExceeded,
+			ErrorMessage: fmt.Sprintf("received invalid offset %d on crypto stream, maximum allowed %d", maxOffset, protocol.MaxCryptoStreamOffset),
+		}
+	}
+	if s.finished {
+		if highestOffset > s.highestOffset {
+			// reject crypto data received after this stream was already finished
+			return &qerr.TransportError{
+				ErrorCode:    qerr.ProtocolViolation,
+				ErrorMessage: "received crypto data after change of encryption level",
+			}
+		}
+		// ignore data with a smaller offset than the highest received
+		// could e.g. be a retransmission
+		return nil
+	}
+	s.highestOffset = max(s.highestOffset, highestOffset)
+	return s.queue.Push(f.Data, f.Offset, nil)
+}
+
+// GetCryptoData retrieves data that was received in CRYPTO frames
+func (s *baseCryptoStream) GetCryptoData() []byte {
+	_, data, _ := s.queue.Pop()
+	return data
+}
+
+func (s *baseCryptoStream) Finish() error {
+	if s.queue.HasMoreData() {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "encryption level changed, but crypto stream has more data to read",
+		}
+	}
+	s.finished = true
+	return nil
+}
+
+// Writes writes data that should be sent out in CRYPTO frames
+func (s *baseCryptoStream) Write(p []byte) (int, error) {
+	s.writeBuf = append(s.writeBuf, p...)
+	return len(p), nil
+}
+
+func (s *baseCryptoStream) HasData() bool {
+	return len(s.writeBuf) > 0
+}
+
+func (s *baseCryptoStream) PopCryptoFrame(maxLen protocol.ByteCount) *wire.CryptoFrame {
+	f := &wire.CryptoFrame{Offset: s.writeOffset}
+	n := min(f.MaxDataLen(maxLen), protocol.ByteCount(len(s.writeBuf)))
+	if n <= 0 {
+		return nil
+	}
+	f.Data = s.writeBuf[:n]
+	s.writeBuf = s.writeBuf[n:]
+	s.writeOffset += n
+	return f
+}
+
+type cryptoStream struct {
+	baseCryptoStream
+}
+
+type clientHelloCut struct {
+	start protocol.ByteCount
+	end   protocol.ByteCount
+}
+
+type initialCryptoStream struct {
+	baseCryptoStream
+
+	scramble bool
+	end      protocol.ByteCount
+	cuts     [2]clientHelloCut
+}
+
+func newInitialCryptoStream(isClient bool) *initialCryptoStream {
+	var scramble bool
+	if isClient {
+		disabled, err := strconv.ParseBool(os.Getenv(disableClientHelloScramblingEnv))
+		scramble = err != nil || !disabled
+	}
+	s := &initialCryptoStream{
+		baseCryptoStream: baseCryptoStream{queue: *newFrameSorter()},
+		scramble:         scramble,
+	}
+	for i := range len(s.cuts) {
+		s.cuts[i].start = protocol.InvalidByteCount
+		s.cuts[i].end = protocol.InvalidByteCount
+	}
+	return s
+}
+
+func (s *initialCryptoStream) HasData() bool {
+	// The ClientHello might be written in multiple parts.
+	// In order to correctly split the ClientHello, we need the entire ClientHello has been queued.
+	if s.scramble && s.writeOffset == 0 && s.cuts[0].start == protocol.InvalidByteCount {
+		return false
+	}
+	return s.baseCryptoStream.HasData()
+}
+
+func (s *initialCryptoStream) Write(p []byte) (int, error) {
+	s.writeBuf = append(s.writeBuf, p...)
+	if !s.scramble {
+		return len(p), nil
+	}
+	if s.cuts[0].start == protocol.InvalidByteCount {
+		sniPos, sniLen, echPos, err := findSNIAndECH(s.writeBuf)
+		if errors.Is(err, io.ErrUnexpectedEOF) {
+			return len(p), nil
+		}
+		if err != nil {
+			return len(p), err
+		}
+		if sniPos == -1 && echPos == -1 {
+			// Neither SNI nor ECH found.
+			// There's nothing to scramble.
+			s.scramble = false
+			return len(p), nil
+		}
+		s.end = protocol.ByteCount(len(s.writeBuf))
+		s.cuts[0].start = protocol.ByteCount(sniPos + sniLen/2) // right in the middle
+		s.cuts[0].end = protocol.ByteCount(sniPos + sniLen)
+		if echPos > 0 {
+			// ECH extension found, cut the ECH extension type value (a uint16) in half
+			start := protocol.ByteCount(echPos + 1)
+			s.cuts[1].start = start
+			// cut somewhere (16 bytes), most likely in the ECH extension value
+			s.cuts[1].end = min(start+16, s.end)
+		}
+		slices.SortFunc(s.cuts[:], func(a, b clientHelloCut) int {
+			if a.start == protocol.InvalidByteCount {
+				return 1
+			}
+			if a.start > b.start {
+				return 1
+			}
+			return -1
+		})
+	}
+	return len(p), nil
+}
+
+func (s *initialCryptoStream) PopCryptoFrame(maxLen protocol.ByteCount) *wire.CryptoFrame {
+	if !s.scramble {
+		return s.baseCryptoStream.PopCryptoFrame(maxLen)
+	}
+
+	// send out the skipped parts
+	if s.writeOffset == s.end {
+		var foundCuts bool
+		var f *wire.CryptoFrame
+		for i, c := range s.cuts {
+			if c.start == protocol.InvalidByteCount {
+				continue
+			}
+			foundCuts = true
+			if f != nil {
+				break
+			}
+			f = &wire.CryptoFrame{Offset: c.start}
+			n := min(f.MaxDataLen(maxLen), c.end-c.start)
+			if n <= 0 {
+				return nil
+			}
+			f.Data = s.writeBuf[c.start : c.start+n]
+			s.cuts[i].start += n
+			if s.cuts[i].start == c.end {
+				s.cuts[i].start = protocol.InvalidByteCount
+				s.cuts[i].end = protocol.InvalidByteCount
+				foundCuts = false
+			}
+		}
+		if !foundCuts {
+			// no more cuts found, we're done sending out everything up until s.end
+			s.writeBuf = s.writeBuf[s.end:]
+			s.end = protocol.InvalidByteCount
+			s.scramble = false
+		}
+		return f
+	}
+
+	nextCut := clientHelloCut{start: protocol.InvalidByteCount, end: protocol.InvalidByteCount}
+	for _, c := range s.cuts {
+		if c.start == protocol.InvalidByteCount {
+			continue
+		}
+		if c.start > s.writeOffset {
+			nextCut = c
+			break
+		}
+	}
+	f := &wire.CryptoFrame{Offset: s.writeOffset}
+	maxOffset := nextCut.start
+	if maxOffset == protocol.InvalidByteCount {
+		maxOffset = s.end
+	}
+	n := min(f.MaxDataLen(maxLen), maxOffset-s.writeOffset)
+	if n <= 0 {
+		return nil
+	}
+	f.Data = s.writeBuf[s.writeOffset : s.writeOffset+n]
+	// Don't reslice the writeBuf yet.
+	// This is done once all parts have been sent out.
+	s.writeOffset += n
+	if s.writeOffset == nextCut.start {
+		s.writeOffset = nextCut.end
+	}
+
+	return f
+}
diff --git a/electron/native/private-transport/third_party/quic-go/crypto_stream_manager.go b/electron/native/private-transport/third_party/quic-go/crypto_stream_manager.go
new file mode 100644
index 000000000..7f586b84a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/crypto_stream_manager.go
@@ -0,0 +1,73 @@
+package quic
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type cryptoStreamManager struct {
+	initialStream   *initialCryptoStream
+	handshakeStream *cryptoStream
+	oneRTTStream    *cryptoStream
+}
+
+func newCryptoStreamManager(
+	initialStream *initialCryptoStream,
+	handshakeStream *cryptoStream,
+	oneRTTStream *cryptoStream,
+) *cryptoStreamManager {
+	return &cryptoStreamManager{
+		initialStream:   initialStream,
+		handshakeStream: handshakeStream,
+		oneRTTStream:    oneRTTStream,
+	}
+}
+
+func (m *cryptoStreamManager) HandleCryptoFrame(frame *wire.CryptoFrame, encLevel protocol.EncryptionLevel) error {
+	//nolint:exhaustive // CRYPTO frames cannot be sent in 0-RTT packets.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return m.initialStream.HandleCryptoFrame(frame)
+	case protocol.EncryptionHandshake:
+		return m.handshakeStream.HandleCryptoFrame(frame)
+	case protocol.Encryption1RTT:
+		return m.oneRTTStream.HandleCryptoFrame(frame)
+	default:
+		return fmt.Errorf("received CRYPTO frame with unexpected encryption level: %s", encLevel)
+	}
+}
+
+func (m *cryptoStreamManager) GetCryptoData(encLevel protocol.EncryptionLevel) []byte {
+	//nolint:exhaustive // CRYPTO frames cannot be sent in 0-RTT packets.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return m.initialStream.GetCryptoData()
+	case protocol.EncryptionHandshake:
+		return m.handshakeStream.GetCryptoData()
+	case protocol.Encryption1RTT:
+		return m.oneRTTStream.GetCryptoData()
+	default:
+		panic(fmt.Sprintf("received CRYPTO frame with unexpected encryption level: %s", encLevel))
+	}
+}
+
+func (m *cryptoStreamManager) GetPostHandshakeData(maxSize protocol.ByteCount) *wire.CryptoFrame {
+	if !m.oneRTTStream.HasData() {
+		return nil
+	}
+	return m.oneRTTStream.PopCryptoFrame(maxSize)
+}
+
+func (m *cryptoStreamManager) Finish(encLevel protocol.EncryptionLevel) error {
+	//nolint:exhaustive // The 1-RTT CRYPTO stream is never finished.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return m.initialStream.Finish()
+	case protocol.EncryptionHandshake:
+		return m.handshakeStream.Finish()
+	default:
+		panic(fmt.Sprintf("finished unexpected encryption level: %s", encLevel))
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/crypto_stream_manager_test.go b/electron/native/private-transport/third_party/quic-go/crypto_stream_manager_test.go
new file mode 100644
index 000000000..ba926d1e0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/crypto_stream_manager_test.go
@@ -0,0 +1,87 @@
+package quic
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCryptoStreamManager(t *testing.T) {
+	t.Run("Initial", func(t *testing.T) {
+		testCryptoStreamManager(t, protocol.EncryptionInitial)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testCryptoStreamManager(t, protocol.EncryptionHandshake)
+	})
+	t.Run("1-RTT", func(t *testing.T) {
+		testCryptoStreamManager(t, protocol.Encryption1RTT)
+	})
+}
+
+func testCryptoStreamManager(t *testing.T, encLevel protocol.EncryptionLevel) {
+	initialStream := newInitialCryptoStream(true)
+	handshakeStream := newCryptoStream()
+	oneRTTStream := newCryptoStream()
+	csm := newCryptoStreamManager(initialStream, handshakeStream, oneRTTStream)
+
+	require.NoError(t, csm.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("foo")}, encLevel))
+	require.NoError(t, csm.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("bar"), Offset: 3}, encLevel))
+	var data []byte
+	for {
+		b := csm.GetCryptoData(encLevel)
+		if len(b) == 0 {
+			break
+		}
+		data = append(data, b...)
+	}
+	require.Equal(t, []byte("foobar"), data)
+}
+
+func TestCryptoStreamManagerInvalidEncryptionLevel(t *testing.T) {
+	csm := newCryptoStreamManager(nil, nil, nil)
+	require.ErrorContains(t,
+		csm.HandleCryptoFrame(&wire.CryptoFrame{}, protocol.Encryption0RTT),
+		"received CRYPTO frame with unexpected encryption level",
+	)
+}
+
+func TestCryptoStreamManagerFinishEncryptionLevel(t *testing.T) {
+	t.Run("Initial", func(t *testing.T) {
+		testCryptoStreamManagerFinishEncryptionLevel(t, protocol.EncryptionInitial)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testCryptoStreamManagerFinishEncryptionLevel(t, protocol.EncryptionHandshake)
+	})
+}
+
+func testCryptoStreamManagerFinishEncryptionLevel(t *testing.T, encLevel protocol.EncryptionLevel) {
+	initialStream := newInitialCryptoStream(true)
+	handshakeStream := newCryptoStream()
+	oneRTTStream := newCryptoStream()
+	csm := newCryptoStreamManager(initialStream, handshakeStream, oneRTTStream)
+
+	require.NoError(t, csm.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("foo")}, encLevel))
+	require.ErrorContains(t, csm.Finish(encLevel), "encryption level changed, but crypto stream has more data to read")
+
+	require.Equal(t, []byte("foo"), csm.GetCryptoData(encLevel))
+	require.NoError(t, csm.Finish(encLevel))
+}
+
+func TestCryptoStreamManagerPostHandshake(t *testing.T) {
+	initialStream := newInitialCryptoStream(true)
+	handshakeStream := newCryptoStream()
+	oneRTTStream := newCryptoStream()
+	csm := newCryptoStreamManager(initialStream, handshakeStream, oneRTTStream)
+
+	_, err := oneRTTStream.Write([]byte("foo"))
+	require.NoError(t, err)
+	_, err = oneRTTStream.Write([]byte("bar"))
+	require.NoError(t, err)
+	require.Equal(t,
+		&wire.CryptoFrame{Data: []byte("foobar")},
+		csm.GetPostHandshakeData(protocol.ByteCount(10)),
+	)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/crypto_stream_test.go b/electron/native/private-transport/third_party/quic-go/crypto_stream_test.go
new file mode 100644
index 000000000..6665e0b19
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/crypto_stream_test.go
@@ -0,0 +1,288 @@
+package quic
+
+import (
+	"fmt"
+	mrand "math/rand/v2"
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCryptoStreamDataAssembly(t *testing.T) {
+	str := newCryptoStream()
+	require.NoError(t, str.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("bar"), Offset: 3}))
+	require.NoError(t, str.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("foo")}))
+	// receive a retransmission
+	require.NoError(t, str.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("bar"), Offset: 3}))
+
+	var data []byte
+	for {
+		b := str.GetCryptoData()
+		if b == nil {
+			break
+		}
+		data = append(data, b...)
+	}
+	require.Equal(t, []byte("foobar"), data)
+}
+
+func TestCryptoStreamMaxOffset(t *testing.T) {
+	str := newCryptoStream()
+	require.NoError(t, str.HandleCryptoFrame(&wire.CryptoFrame{
+		Offset: protocol.MaxCryptoStreamOffset - 5,
+		Data:   []byte("foo"),
+	}))
+	require.ErrorIs(t,
+		str.HandleCryptoFrame(&wire.CryptoFrame{
+			Offset: protocol.MaxCryptoStreamOffset - 2,
+			Data:   []byte("bar"),
+		}),
+		&qerr.TransportError{ErrorCode: qerr.CryptoBufferExceeded},
+	)
+}
+
+func TestCryptoStreamFinishWithQueuedData(t *testing.T) {
+	t.Run("with data at current offset", func(t *testing.T) {
+		str := newCryptoStream()
+		require.NoError(t, str.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("foo")}))
+		require.Equal(t, []byte("foo"), str.GetCryptoData())
+		require.NoError(t, str.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("bar"), Offset: 3}))
+		require.ErrorIs(t, str.Finish(), &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+	})
+
+	t.Run("with data at a higher offset", func(t *testing.T) {
+		str := newCryptoStream()
+		require.NoError(t, str.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("foobar"), Offset: 20}))
+		require.ErrorIs(t, str.Finish(), &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+	})
+}
+
+func TestCryptoStreamReceiveDataAfterFinish(t *testing.T) {
+	str := newCryptoStream()
+	require.NoError(t, str.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("foobar")}))
+	require.Equal(t, []byte("foobar"), str.GetCryptoData())
+	require.NoError(t, str.Finish())
+	// receiving a retransmission is ok
+	require.NoError(t, str.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("bar"), Offset: 3}))
+	// but receiving new data is not
+	require.ErrorIs(t,
+		str.HandleCryptoFrame(&wire.CryptoFrame{Data: []byte("baz"), Offset: 4}),
+		&qerr.TransportError{ErrorCode: qerr.ProtocolViolation},
+	)
+}
+
+func expectedCryptoFrameLen(offset protocol.ByteCount) protocol.ByteCount {
+	f := &wire.CryptoFrame{Offset: offset}
+	return f.Length(protocol.Version1)
+}
+
+func TestCryptoStreamWrite(t *testing.T) {
+	str := newCryptoStream()
+
+	require.False(t, str.HasData())
+	_, err := str.Write([]byte("foo"))
+	require.NoError(t, err)
+	require.True(t, str.HasData())
+	_, err = str.Write([]byte("bar"))
+	require.NoError(t, err)
+	_, err = str.Write([]byte("baz"))
+	require.NoError(t, err)
+	require.True(t, str.HasData())
+
+	for i := range expectedCryptoFrameLen(0) {
+		require.Nil(t, str.PopCryptoFrame(i))
+	}
+
+	f := str.PopCryptoFrame(expectedCryptoFrameLen(0) + 1)
+	require.Equal(t, &wire.CryptoFrame{Data: []byte("f")}, f)
+	require.True(t, str.HasData())
+	f = str.PopCryptoFrame(expectedCryptoFrameLen(1) + 3)
+	// the three write calls were coalesced into a single frame
+	require.Equal(t, &wire.CryptoFrame{Offset: 1, Data: []byte("oob")}, f)
+	f = str.PopCryptoFrame(protocol.MaxByteCount)
+	require.Equal(t, &wire.CryptoFrame{Offset: 4, Data: []byte("arbaz")}, f)
+	require.False(t, str.HasData())
+}
+
+func TestInitialCryptoStreamServer(t *testing.T) {
+	str := newInitialCryptoStream(false)
+	_, err := str.Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	f := str.PopCryptoFrame(expectedCryptoFrameLen(0) + 3)
+	require.Equal(t, &wire.CryptoFrame{Offset: 0, Data: []byte("foo")}, f)
+	require.True(t, str.HasData())
+
+	// append another CRYPTO frame to the existing slice
+	f = str.PopCryptoFrame(expectedCryptoFrameLen(3) + 3)
+	require.Equal(t, &wire.CryptoFrame{Offset: 3, Data: []byte("bar")}, f)
+	require.False(t, str.HasData())
+}
+
+func reassembleCryptoData(t *testing.T, segments map[protocol.ByteCount][]byte) []byte {
+	t.Helper()
+
+	var reassembled []byte
+	var offset protocol.ByteCount
+	for len(segments) > 0 {
+		b, ok := segments[offset]
+		if !ok {
+			break
+		}
+		reassembled = append(reassembled, b...)
+		delete(segments, offset)
+		offset = protocol.ByteCount(len(reassembled))
+	}
+	require.Empty(t, segments)
+	return reassembled
+}
+
+func skipIfDisableScramblingEnvSet(t *testing.T) {
+	t.Helper()
+	disabled, err := strconv.ParseBool(os.Getenv(disableClientHelloScramblingEnv))
+	if err == nil && disabled {
+		t.Skip("ClientHello scrambling disabled via " + disableClientHelloScramblingEnv)
+	}
+}
+
+func TestInitialCryptoStreamClientStatic(t *testing.T) {
+	skipIfDisableScramblingEnvSet(t)
+
+	str := newInitialCryptoStream(true)
+	clientHello, err := getClientHello("quic-go.net")
+	require.NoError(t, err)
+	_, err = str.Write(clientHello)
+	require.NoError(t, err)
+	require.True(t, str.HasData())
+	_, err = str.Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	segments := make(map[protocol.ByteCount][]byte)
+
+	f1 := str.PopCryptoFrame(protocol.MaxByteCount)
+	require.NotNil(t, f1)
+	segments[f1.Offset] = f1.Data
+	require.True(t, str.HasData())
+
+	f2 := str.PopCryptoFrame(protocol.MaxByteCount)
+	require.NotNil(t, f2)
+	require.NotContains(t, segments, f2.Offset)
+	segments[f2.Offset] = f2.Data
+	require.True(t, str.HasData())
+	require.NotEqual(t, f2.Offset, protocol.ByteCount(len(f1.Data)))
+
+	f3 := str.PopCryptoFrame(protocol.MaxByteCount)
+	require.NotNil(t, f2)
+	require.NotContains(t, segments, f3.Offset)
+	segments[f3.Offset] = f3.Data
+	require.True(t, str.HasData())
+	require.NotEqual(t, f3.Offset, protocol.ByteCount(len(f2.Data)))
+
+	f4 := str.PopCryptoFrame(protocol.MaxByteCount)
+	require.NotNil(t, f4)
+	require.NotContains(t, segments, f4.Offset)
+	segments[f4.Offset] = f4.Data
+	require.Equal(t, []byte("foobar"), f4.Data)
+	require.False(t, str.HasData())
+	require.NotEqual(t, f4.Offset, protocol.ByteCount(len(f3.Data)))
+
+	reassembled := reassembleCryptoData(t, segments)
+	require.Equal(t, append(clientHello, []byte("foobar")...), reassembled)
+}
+
+func randomDomainName(length int) string {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz"
+	b := make([]byte, length)
+	for i := range b {
+		if i > 0 && i < length-1 && mrand.IntN(5) == 0 && b[i-1] != '.' {
+			b[i] = '.'
+		} else {
+			b[i] = alphabet[mrand.IntN(len(alphabet))]
+		}
+	}
+	return string(b)
+}
+
+func TestInitialCryptoStreamClientRandomizedSizes(t *testing.T) {
+	skipIfDisableScramblingEnvSet(t)
+
+	for i := range 100 {
+		t.Run(fmt.Sprintf("run %d", i), func(t *testing.T) {
+			var serverName string
+			if mrand.Int()%4 > 0 {
+				serverName = randomDomainName(6 + mrand.IntN(20))
+			}
+			var clientHello []byte
+			if serverName == "" || !strings.Contains(serverName, ".") || mrand.Int()%2 == 0 {
+				t.Logf("using a ClientHello without ECH, hostname: %q", serverName)
+				var err error
+				clientHello, err = getClientHello(serverName)
+				require.NoError(t, err)
+			} else {
+				t.Logf("using a ClientHello with ECH, hostname: %q", serverName)
+				var err error
+				clientHello, err = getClientHelloWithECH(serverName)
+				require.NoError(t, err)
+			}
+			testInitialCryptoStreamClientRandomizedSizes(t, clientHello, serverName)
+		})
+	}
+}
+
+func testInitialCryptoStreamClientRandomizedSizes(t *testing.T, clientHello []byte, expectedServerName string) {
+	str := newInitialCryptoStream(true)
+
+	b := slices.Clone(clientHello)
+	for len(b) > 0 {
+		n := min(len(b), mrand.IntN(2*len(b)))
+		_, err := str.Write(b[:n])
+		require.NoError(t, err)
+		b = b[n:]
+	}
+
+	require.True(t, str.HasData())
+	_, err := str.Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	segments := make(map[protocol.ByteCount][]byte)
+
+	var frames []*wire.CryptoFrame
+	for str.HasData() {
+		// fmt.Println("popping a frame")
+		var maxSize protocol.ByteCount
+		if mrand.Int()%4 == 0 {
+			maxSize = protocol.ByteCount(mrand.IntN(512) + 1)
+		} else {
+			maxSize = protocol.ByteCount(mrand.IntN(32) + 1)
+		}
+		f := str.PopCryptoFrame(maxSize)
+		if f == nil {
+			continue
+		}
+		frames = append(frames, f)
+		require.LessOrEqual(t, f.Length(protocol.Version1), maxSize)
+	}
+	t.Logf("received %d frames", len(frames))
+
+	for _, f := range frames {
+		t.Logf("offset %d: %d bytes", f.Offset, len(f.Data))
+		if expectedServerName != "" {
+			require.NotContainsf(t, string(f.Data), expectedServerName, "frame at offset %d contains the server name", f.Offset)
+		}
+		segments[f.Offset] = f.Data
+	}
+
+	reassembled := reassembleCryptoData(t, segments)
+	require.Equal(t, append(clientHello, []byte("foobar")...), reassembled)
+	if expectedServerName != "" {
+		require.Contains(t, string(reassembled), expectedServerName)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/datagram_buffer.go b/electron/native/private-transport/third_party/quic-go/datagram_buffer.go
new file mode 100644
index 000000000..7b34bbca6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/datagram_buffer.go
@@ -0,0 +1,31 @@
+package quic
+
+import "github.com/quic-go/quic-go/internal/datagrambuffer"
+
+func recordRawDatagramPacketDrop() { datagrambuffer.RecordRawPacketDrop() }
+
+type DatagramReceiveBufferStats = datagrambuffer.Stats
+
+// GlobalDatagramReceiveBufferStats includes all QUIC and HTTP/3 receive queues
+// in this process. It contains no connection, address, or payload information.
+func GlobalDatagramReceiveBufferStats() DatagramReceiveBufferStats {
+	return datagrambuffer.GlobalStats()
+}
+
+// EnableDatagramReceiveBuffer enables bounded burst absorption after admission.
+// Existing congestion control and unreliable DATAGRAM semantics are unchanged.
+func (c *Conn) EnableDatagramReceiveBuffer() {
+	if q := c.datagramQueue; q != nil {
+		q.rcvMx.Lock()
+		q.rcvQueue.EnableBurst()
+		q.rcvMx.Unlock()
+	}
+}
+func (c *Conn) DatagramReceiveBufferStats() DatagramReceiveBufferStats {
+	if q := c.datagramQueue; q != nil {
+		q.rcvMx.Lock()
+		defer q.rcvMx.Unlock()
+		return q.rcvQueue.Stats()
+	}
+	return DatagramReceiveBufferStats{}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/datagram_queue.go b/electron/native/private-transport/third_party/quic-go/datagram_queue.go
new file mode 100644
index 000000000..dcaeb7691
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/datagram_queue.go
@@ -0,0 +1,138 @@
+package quic
+
+import (
+	"context"
+	"github.com/quic-go/quic-go/internal/datagrambuffer"
+	"sync"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/utils/ringbuffer"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+const (
+	maxDatagramSendQueueLen = 32
+	maxDatagramRcvQueueLen  = 128
+)
+
+type datagramQueue struct {
+	sendMx    sync.Mutex
+	sendQueue ringbuffer.RingBuffer[*wire.DatagramFrame]
+	sent      chan struct{} // used to notify Add that a datagram was dequeued
+
+	rcvMx    sync.Mutex
+	rcvQueue *datagrambuffer.Queue
+	rcvd     chan struct{} // used to notify Receive that a new datagram was received
+
+	closeErr error
+	closed   chan struct{}
+
+	hasData func()
+
+	logger utils.Logger
+}
+
+func newDatagramQueue(hasData func(), logger utils.Logger) *datagramQueue {
+	return &datagramQueue{
+		hasData:  hasData,
+		rcvd:     make(chan struct{}, 1),
+		sent:     make(chan struct{}, 1),
+		closed:   make(chan struct{}),
+		logger:   logger,
+		rcvQueue: datagrambuffer.New(maxDatagramRcvQueueLen),
+	}
+}
+
+// Add queues a new DATAGRAM frame for sending.
+// Up to 32 DATAGRAM frames will be queued.
+// Once that limit is reached, Add blocks until the queue size has reduced.
+func (h *datagramQueue) Add(f *wire.DatagramFrame) error {
+	h.sendMx.Lock()
+
+	for {
+		if h.sendQueue.Len() < maxDatagramSendQueueLen {
+			h.sendQueue.PushBack(f)
+			h.sendMx.Unlock()
+			h.hasData()
+			return nil
+		}
+		select {
+		case <-h.sent: // drain the queue so we don't loop immediately
+		default:
+		}
+		h.sendMx.Unlock()
+		select {
+		case <-h.closed:
+			return h.closeErr
+		case <-h.sent:
+		}
+		h.sendMx.Lock()
+	}
+}
+
+// Peek gets the next DATAGRAM frame for sending.
+// If actually sent out, Pop needs to be called before the next call to Peek.
+func (h *datagramQueue) Peek() *wire.DatagramFrame {
+	h.sendMx.Lock()
+	defer h.sendMx.Unlock()
+	if h.sendQueue.Empty() {
+		return nil
+	}
+	return h.sendQueue.PeekFront()
+}
+
+func (h *datagramQueue) Pop() {
+	h.sendMx.Lock()
+	defer h.sendMx.Unlock()
+	_ = h.sendQueue.PopFront()
+	select {
+	case h.sent <- struct{}{}:
+	default:
+	}
+}
+
+// HandleDatagramFrame handles a received DATAGRAM frame.
+func (h *datagramQueue) HandleDatagramFrame(f *wire.DatagramFrame) {
+	var queued bool
+	h.rcvMx.Lock()
+	if h.rcvQueue.Push(f.Data, time.Now()) {
+		queued = true
+		select {
+		case h.rcvd <- struct{}{}:
+		default:
+		}
+	}
+	h.rcvMx.Unlock()
+	if !queued && h.logger.Debug() {
+		h.logger.Debugf("Discarding received DATAGRAM frame (%d bytes payload)", len(f.Data))
+	}
+}
+
+// Receive gets a received DATAGRAM frame.
+func (h *datagramQueue) Receive(ctx context.Context) ([]byte, error) {
+	for {
+		h.rcvMx.Lock()
+		if data, ok := h.rcvQueue.Pop(time.Now()); ok {
+			h.rcvMx.Unlock()
+			return data, nil
+		}
+		h.rcvMx.Unlock()
+		select {
+		case <-h.rcvd:
+			continue
+		case <-h.closed:
+			return nil, h.closeErr
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+}
+
+func (h *datagramQueue) CloseWithError(e error) {
+	h.rcvMx.Lock()
+	h.rcvQueue.Close()
+	h.rcvMx.Unlock()
+	h.closeErr = e
+	close(h.closed)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/datagram_queue_test.go b/electron/native/private-transport/third_party/quic-go/datagram_queue_test.go
new file mode 100644
index 000000000..2b140ed1e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/datagram_queue_test.go
@@ -0,0 +1,180 @@
+package quic
+
+import (
+	"context"
+	"testing"
+	"testing/synctest"
+
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDatagramQueuePeekAndPop(t *testing.T) {
+	var queued []struct{}
+	queue := newDatagramQueue(func() { queued = append(queued, struct{}{}) }, utils.DefaultLogger)
+	require.Nil(t, queue.Peek())
+	require.Empty(t, queued)
+	require.NoError(t, queue.Add(&wire.DatagramFrame{Data: []byte("foo")}))
+	require.Len(t, queued, 1)
+	require.Equal(t, &wire.DatagramFrame{Data: []byte("foo")}, queue.Peek())
+	// calling peek again returns the same datagram
+	require.Equal(t, &wire.DatagramFrame{Data: []byte("foo")}, queue.Peek())
+	queue.Pop()
+	require.Nil(t, queue.Peek())
+}
+
+func TestDatagramQueueSendQueueLength(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		queue := newDatagramQueue(func() {}, utils.DefaultLogger)
+
+		for range maxDatagramSendQueueLen {
+			require.NoError(t, queue.Add(&wire.DatagramFrame{Data: []byte{0}}))
+		}
+		errChan := make(chan error, 1)
+		go func() { errChan <- queue.Add(&wire.DatagramFrame{Data: []byte("foobar")}) }()
+
+		synctest.Wait()
+
+		select {
+		case <-errChan:
+			t.Fatal("expected to not receive error")
+		default:
+		}
+
+		// peeking doesn't remove the datagram from the queue...
+		require.NotNil(t, queue.Peek())
+		synctest.Wait()
+		select {
+		case <-errChan:
+			t.Fatal("expected to not receive error")
+		default:
+		}
+
+		// ...but popping does
+		queue.Pop()
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("timeout")
+		}
+		// pop all the remaining datagrams
+		for range maxDatagramSendQueueLen - 1 {
+			queue.Pop()
+		}
+		f := queue.Peek()
+		require.NotNil(t, f)
+		require.Equal(t, &wire.DatagramFrame{Data: []byte("foobar")}, f)
+	})
+}
+
+func TestDatagramQueueReceive(t *testing.T) {
+	queue := newDatagramQueue(func() {}, utils.DefaultLogger)
+
+	// receive frames that were received earlier
+	queue.HandleDatagramFrame(&wire.DatagramFrame{Data: []byte("foo")})
+	queue.HandleDatagramFrame(&wire.DatagramFrame{Data: []byte("bar")})
+	data, err := queue.Receive(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, []byte("foo"), data)
+	data, err = queue.Receive(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, []byte("bar"), data)
+}
+
+func TestDatagramQueueReceiveBlocking(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		queue := newDatagramQueue(func() {}, utils.DefaultLogger)
+
+		// block until a new frame is received
+		type result struct {
+			data []byte
+			err  error
+		}
+		resultChan := make(chan result, 1)
+		go func() {
+			data, err := queue.Receive(context.Background())
+			resultChan <- result{data, err}
+		}()
+
+		synctest.Wait()
+
+		select {
+		case <-resultChan:
+			t.Fatal("expected to not receive result")
+		default:
+		}
+		queue.HandleDatagramFrame(&wire.DatagramFrame{Data: []byte("foobar")})
+		synctest.Wait()
+		select {
+		case result := <-resultChan:
+			require.NoError(t, result.err)
+			require.Equal(t, []byte("foobar"), result.data)
+		default:
+			t.Fatal("should have received a datagram frame")
+		}
+
+		// unblock when the context is canceled
+		ctx, cancel := context.WithCancel(context.Background())
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := queue.Receive(ctx)
+			errChan <- err
+		}()
+
+		synctest.Wait()
+		select {
+		case <-errChan:
+			t.Fatal("expected to not receive error")
+		default:
+		}
+
+		cancel()
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, context.Canceled)
+		default:
+			t.Fatal("should have received a context canceled error")
+		}
+	})
+}
+
+func TestDatagramQueueClose(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		queue := newDatagramQueue(func() {}, utils.DefaultLogger)
+
+		for range maxDatagramSendQueueLen {
+			require.NoError(t, queue.Add(&wire.DatagramFrame{Data: []byte{0}}))
+		}
+		errChan1 := make(chan error, 1)
+		go func() { errChan1 <- queue.Add(&wire.DatagramFrame{Data: []byte("foobar")}) }()
+		errChan2 := make(chan error, 1)
+		go func() {
+			_, err := queue.Receive(context.Background())
+			errChan2 <- err
+		}()
+
+		queue.CloseWithError(assert.AnError)
+		synctest.Wait()
+
+		select {
+		case err := <-errChan1:
+			require.ErrorIs(t, err, assert.AnError)
+		default:
+			t.Fatal("should have received an error")
+		}
+
+		select {
+		case err := <-errChan2:
+			require.ErrorIs(t, err, assert.AnError)
+		default:
+			t.Fatal("should have received an error")
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/errors.go b/electron/native/private-transport/third_party/quic-go/errors.go
new file mode 100644
index 000000000..a66caf1b5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/errors.go
@@ -0,0 +1,106 @@
+package quic
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/qerr"
+)
+
+type (
+	// TransportError indicates an error that occurred on the QUIC transport layer.
+	// Every transport error other than CONNECTION_REFUSED and APPLICATION_ERROR is
+	// likely a bug in the implementation.
+	TransportError = qerr.TransportError
+	// ApplicationError is an application-defined error.
+	ApplicationError = qerr.ApplicationError
+	// VersionNegotiationError indicates a failure to negotiate a QUIC version.
+	VersionNegotiationError = qerr.VersionNegotiationError
+	// StatelessResetError indicates a stateless reset was received.
+	// This can happen when the peer reboots, or when packets are misrouted.
+	// See section 10.3 of RFC 9000 for details.
+	StatelessResetError = qerr.StatelessResetError
+	// IdleTimeoutError indicates that the connection timed out because it was inactive for too long.
+	IdleTimeoutError = qerr.IdleTimeoutError
+	// HandshakeTimeoutError indicates that the connection timed out before completing the handshake.
+	HandshakeTimeoutError = qerr.HandshakeTimeoutError
+)
+
+type (
+	// TransportErrorCode is a QUIC transport error code, see section 20 of RFC 9000.
+	TransportErrorCode = qerr.TransportErrorCode
+	// ApplicationErrorCode is an QUIC application error code.
+	ApplicationErrorCode = qerr.ApplicationErrorCode
+	// StreamErrorCode is a QUIC stream error code. The meaning of the value is defined by the application.
+	StreamErrorCode = qerr.StreamErrorCode
+)
+
+const (
+	// NoError is the NO_ERROR transport error code.
+	NoError = qerr.NoError
+	// InternalError is the INTERNAL_ERROR transport error code.
+	InternalError = qerr.InternalError
+	// ConnectionRefused is the CONNECTION_REFUSED transport error code.
+	ConnectionRefused = qerr.ConnectionRefused
+	// FlowControlError is the FLOW_CONTROL_ERROR transport error code.
+	FlowControlError = qerr.FlowControlError
+	// StreamLimitError is the STREAM_LIMIT_ERROR transport error code.
+	StreamLimitError = qerr.StreamLimitError
+	// StreamStateError is the STREAM_STATE_ERROR transport error code.
+	StreamStateError = qerr.StreamStateError
+	// FinalSizeError is the FINAL_SIZE_ERROR transport error code.
+	FinalSizeError = qerr.FinalSizeError
+	// FrameEncodingError is the FRAME_ENCODING_ERROR transport error code.
+	FrameEncodingError = qerr.FrameEncodingError
+	// TransportParameterError is the TRANSPORT_PARAMETER_ERROR transport error code.
+	TransportParameterError = qerr.TransportParameterError
+	// ConnectionIDLimitError is the CONNECTION_ID_LIMIT_ERROR transport error code.
+	ConnectionIDLimitError = qerr.ConnectionIDLimitError
+	// ProtocolViolation is the PROTOCOL_VIOLATION transport error code.
+	ProtocolViolation = qerr.ProtocolViolation
+	// InvalidToken is the INVALID_TOKEN transport error code.
+	InvalidToken = qerr.InvalidToken
+	// ApplicationErrorErrorCode is the APPLICATION_ERROR transport error code.
+	ApplicationErrorErrorCode = qerr.ApplicationErrorErrorCode
+	// CryptoBufferExceeded is the CRYPTO_BUFFER_EXCEEDED transport error code.
+	CryptoBufferExceeded = qerr.CryptoBufferExceeded
+	// KeyUpdateError is the KEY_UPDATE_ERROR transport error code.
+	KeyUpdateError = qerr.KeyUpdateError
+	// AEADLimitReached is the AEAD_LIMIT_REACHED transport error code.
+	AEADLimitReached = qerr.AEADLimitReached
+	// NoViablePathError is the NO_VIABLE_PATH_ERROR transport error code.
+	NoViablePathError = qerr.NoViablePathError
+)
+
+// A StreamError is used to signal stream cancellations.
+// It can be returned by stream methods such as [ReceiveStream.Read], [SendStream.Write],
+// [Stream.Read], and [Stream.Write].
+type StreamError struct {
+	StreamID  StreamID
+	ErrorCode StreamErrorCode
+	Remote    bool
+}
+
+func (e *StreamError) Is(target error) bool {
+	t, ok := target.(*StreamError)
+	return ok && e.StreamID == t.StreamID && e.ErrorCode == t.ErrorCode && e.Remote == t.Remote
+}
+
+func (e *StreamError) Error() string {
+	pers := "local"
+	if e.Remote {
+		pers = "remote"
+	}
+	return fmt.Sprintf("stream %d canceled by %s with error code %d", e.StreamID, pers, e.ErrorCode)
+}
+
+// DatagramTooLargeError is returned from [Conn.SendDatagram] if the payload is too large to be sent.
+type DatagramTooLargeError struct {
+	MaxDatagramPayloadSize int64
+}
+
+func (e *DatagramTooLargeError) Is(target error) bool {
+	t, ok := target.(*DatagramTooLargeError)
+	return ok && e.MaxDatagramPayloadSize == t.MaxDatagramPayloadSize
+}
+
+func (e *DatagramTooLargeError) Error() string { return "DATAGRAM frame too large" }
diff --git a/electron/native/private-transport/third_party/quic-go/errors_test.go b/electron/native/private-transport/third_party/quic-go/errors_test.go
new file mode 100644
index 000000000..58fea6445
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/errors_test.go
@@ -0,0 +1,37 @@
+package quic
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestStreamError(t *testing.T) {
+	require.True(t, errors.Is(
+		&StreamError{StreamID: 1, ErrorCode: 2, Remote: true},
+		&StreamError{StreamID: 1, ErrorCode: 2, Remote: true},
+	))
+	require.False(t, errors.Is(&StreamError{StreamID: 1}, &StreamError{StreamID: 2}))
+	require.False(t, errors.Is(&StreamError{StreamID: 1}, &StreamError{StreamID: 2}))
+	require.Equal(t,
+		"stream 1 canceled by remote with error code 2",
+		(&StreamError{StreamID: 1, ErrorCode: 2, Remote: true}).Error(),
+	)
+	require.Equal(t,
+		"stream 42 canceled by local with error code 1337",
+		(&StreamError{StreamID: 42, ErrorCode: 1337, Remote: false}).Error(),
+	)
+}
+
+func TestDatagramTooLargeError(t *testing.T) {
+	require.True(t, errors.Is(
+		&DatagramTooLargeError{MaxDatagramPayloadSize: 1024},
+		&DatagramTooLargeError{MaxDatagramPayloadSize: 1024},
+	))
+	require.False(t, errors.Is(
+		&DatagramTooLargeError{MaxDatagramPayloadSize: 1024},
+		&DatagramTooLargeError{MaxDatagramPayloadSize: 1025},
+	))
+	require.Equal(t, "DATAGRAM frame too large", (&DatagramTooLargeError{MaxDatagramPayloadSize: 1024}).Error())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/example/client/main.go b/electron/native/private-transport/third_party/quic-go/example/client/main.go
new file mode 100644
index 000000000..ece768077
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/example/client/main.go
@@ -0,0 +1,81 @@
+package main
+
+import (
+	"bytes"
+	"crypto/tls"
+	"crypto/x509"
+	"flag"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"sync"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/internal/testdata"
+)
+
+func main() {
+	quiet := flag.Bool("q", false, "don't print the data")
+	keyLogFile := flag.String("keylog", "", "key log file")
+	insecure := flag.Bool("insecure", false, "skip certificate verification")
+	flag.Parse()
+	urls := flag.Args()
+
+	var keyLog io.Writer
+	if len(*keyLogFile) > 0 {
+		f, err := os.Create(*keyLogFile)
+		if err != nil {
+			log.Fatal(err)
+		}
+		defer f.Close()
+		keyLog = f
+	}
+
+	pool, err := x509.SystemCertPool()
+	if err != nil {
+		log.Fatal(err)
+	}
+	testdata.AddRootCA(pool)
+
+	roundTripper := &http3.Transport{
+		TLSClientConfig: &tls.Config{
+			RootCAs:            pool,
+			InsecureSkipVerify: *insecure,
+			KeyLogWriter:       keyLog,
+		},
+		QUICConfig: &quic.Config{
+			Tracer: qlog.DefaultConnectionTracer,
+		},
+	}
+	defer roundTripper.Close()
+	hclient := &http.Client{
+		Transport: roundTripper,
+	}
+
+	var wg sync.WaitGroup
+	for _, addr := range urls {
+		log.Printf("GET %s", addr)
+		wg.Go(func() {
+			rsp, err := hclient.Get(addr)
+			if err != nil {
+				log.Fatal(err)
+			}
+			log.Printf("Got response for %s: %#v", addr, rsp)
+
+			body := &bytes.Buffer{}
+			_, err = io.Copy(body, rsp.Body)
+			if err != nil {
+				log.Fatal(err)
+			}
+			if *quiet {
+				log.Printf("Response Body: %d bytes", body.Len())
+			} else {
+				log.Printf("Response Body (%d bytes):\n%s", body.Len(), body.Bytes())
+			}
+		})
+	}
+	wg.Wait()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/example/echo/echo.go b/electron/native/private-transport/third_party/quic-go/example/echo/echo.go
new file mode 100644
index 000000000..1bb8e4044
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/example/echo/echo.go
@@ -0,0 +1,113 @@
+package main
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"io"
+	"log"
+	"math/big"
+
+	"github.com/quic-go/quic-go"
+)
+
+const addr = "localhost:4242"
+
+const message = "foobar"
+
+// We start a server echoing data on the first stream the client opens,
+// then connect with a client, send the message, and wait for its receipt.
+func main() {
+	go func() { log.Fatal(echoServer()) }()
+
+	if err := clientMain(); err != nil {
+		panic(err)
+	}
+}
+
+// Start a server that echos all data on the first stream opened by the client
+func echoServer() error {
+	listener, err := quic.ListenAddr(addr, generateTLSConfig(), nil)
+	if err != nil {
+		return err
+	}
+	defer listener.Close()
+
+	conn, err := listener.Accept(context.Background())
+	if err != nil {
+		return err
+	}
+
+	stream, err := conn.AcceptStream(context.Background())
+	if err != nil {
+		panic(err)
+	}
+	defer stream.Close()
+
+	// Echo through the loggingWriter
+	_, err = io.Copy(loggingWriter{stream}, stream)
+	return err
+}
+
+func clientMain() error {
+	tlsConf := &tls.Config{
+		InsecureSkipVerify: true,
+		NextProtos:         []string{"quic-echo-example"},
+	}
+	conn, err := quic.DialAddr(context.Background(), addr, tlsConf, nil)
+	if err != nil {
+		return err
+	}
+	defer conn.CloseWithError(0, "")
+
+	stream, err := conn.OpenStreamSync(context.Background())
+	if err != nil {
+		return err
+	}
+	defer stream.Close()
+
+	fmt.Printf("Client: Sending '%s'\n", message)
+	if _, err := stream.Write([]byte(message)); err != nil {
+		return err
+	}
+
+	buf := make([]byte, len(message))
+	if _, err := io.ReadFull(stream, buf); err != nil {
+		return err
+	}
+	fmt.Printf("Client: Got '%s'\n", buf)
+
+	return nil
+}
+
+// A wrapper for io.Writer that also logs the message.
+type loggingWriter struct{ io.Writer }
+
+func (w loggingWriter) Write(b []byte) (int, error) {
+	fmt.Printf("Server: Got '%s'\n", string(b))
+	return w.Writer.Write(b)
+}
+
+// Setup a bare-bones TLS config for the server
+func generateTLSConfig() *tls.Config {
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		panic(err)
+	}
+	template := x509.Certificate{SerialNumber: big.NewInt(1)}
+	certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, priv.Public(), priv)
+	if err != nil {
+		panic(err)
+	}
+
+	return &tls.Config{
+		Certificates: []tls.Certificate{{
+			Certificate: [][]byte{certDER},
+			PrivateKey:  priv,
+		}},
+		NextProtos: []string{"quic-echo-example"},
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/example/main.go b/electron/native/private-transport/third_party/quic-go/example/main.go
new file mode 100644
index 000000000..8731b99d5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/example/main.go
@@ -0,0 +1,182 @@
+package main
+
+import (
+	"crypto/md5"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"mime/multipart"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+
+	_ "net/http/pprof"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/internal/testdata"
+)
+
+type binds []string
+
+func (b binds) String() string {
+	return strings.Join(b, ",")
+}
+
+func (b *binds) Set(v string) error {
+	*b = strings.Split(v, ",")
+	return nil
+}
+
+// Size is needed by the /demo/upload handler to determine the size of the uploaded file
+type Size interface {
+	Size() int64
+}
+
+// See https://en.wikipedia.org/wiki/Lehmer_random_number_generator
+func generatePRData(l int) []byte {
+	res := make([]byte, l)
+	seed := uint64(1)
+	for i := range l {
+		seed = seed * 48271 % 2147483647
+		res[i] = byte(seed)
+	}
+	return res
+}
+
+func setupHandler(www string) http.Handler {
+	mux := http.NewServeMux()
+
+	if len(www) > 0 {
+		mux.Handle("/", http.FileServer(http.Dir(www)))
+	} else {
+		mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+			fmt.Printf("%#v\n", r)
+			const maxSize = 1 << 30 // 1 GB
+			num, err := strconv.ParseInt(strings.ReplaceAll(r.RequestURI, "/", ""), 10, 64)
+			if err != nil || num <= 0 || num > maxSize {
+				w.WriteHeader(400)
+				return
+			}
+			w.Write(generatePRData(int(num)))
+		})
+	}
+
+	mux.HandleFunc("/demo/tile", func(w http.ResponseWriter, r *http.Request) {
+		// Small 40x40 png
+		w.Write([]byte{
+			0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d,
+			0x49, 0x48, 0x44, 0x52, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x28,
+			0x01, 0x03, 0x00, 0x00, 0x00, 0xb6, 0x30, 0x2a, 0x2e, 0x00, 0x00, 0x00,
+			0x03, 0x50, 0x4c, 0x54, 0x45, 0x5a, 0xc3, 0x5a, 0xad, 0x38, 0xaa, 0xdb,
+			0x00, 0x00, 0x00, 0x0b, 0x49, 0x44, 0x41, 0x54, 0x78, 0x01, 0x63, 0x18,
+			0x61, 0x00, 0x00, 0x00, 0xf0, 0x00, 0x01, 0xe2, 0xb8, 0x75, 0x22, 0x00,
+			0x00, 0x00, 0x00, 0x49, 0x45, 0x4e, 0x44, 0xae, 0x42, 0x60, 0x82,
+		})
+	})
+
+	mux.HandleFunc("/demo/tiles", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "<html><head><style>img{width:40px;height:40px;}</style></head><body>")
+		for i := range 200 {
+			fmt.Fprintf(w, `<img src="/demo/tile?cachebust=%d">`, i)
+		}
+		io.WriteString(w, "</body></html>")
+	})
+
+	mux.HandleFunc("/demo/echo", func(w http.ResponseWriter, r *http.Request) {
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			fmt.Printf("error reading body while handling /echo: %s\n", err.Error())
+		}
+		w.Write(body)
+	})
+
+	// accept file uploads and return the MD5 of the uploaded file
+	// maximum accepted file size is 1 GB
+	mux.HandleFunc("/demo/upload", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost {
+			err := r.ParseMultipartForm(1 << 30) // 1 GB
+			if err == nil {
+				var file multipart.File
+				file, _, err = r.FormFile("uploadfile")
+				if err == nil {
+					var size int64
+					if sizeInterface, ok := file.(Size); ok {
+						size = sizeInterface.Size()
+						b := make([]byte, size)
+						file.Read(b)
+						md5 := md5.Sum(b)
+						fmt.Fprintf(w, "%x", md5)
+						return
+					}
+					err = errors.New("couldn't get uploaded file size")
+				}
+			}
+			log.Printf("Error receiving upload: %#v", err)
+		}
+		io.WriteString(w, `<html><body><form action="/demo/upload" method="post" enctype="multipart/form-data">
+				<input type="file" name="uploadfile"><br>
+				<input type="submit">
+			</form></body></html>`)
+	})
+
+	return mux
+}
+
+func main() {
+	// defer profile.Start().Stop()
+	go func() {
+		log.Println(http.ListenAndServe("localhost:6060", nil))
+	}()
+	// runtime.SetBlockProfileRate(1)
+
+	bs := binds{}
+	flag.Var(&bs, "bind", "bind to")
+	www := flag.String("www", "", "www data")
+	tcp := flag.Bool("tcp", false, "also listen on TCP")
+	key := flag.String("key", "", "TLS key (requires -cert option)")
+	cert := flag.String("cert", "", "TLS certificate (requires -key option)")
+	flag.Parse()
+
+	if len(bs) == 0 {
+		bs = binds{"localhost:6121"}
+	}
+
+	handler := setupHandler(*www)
+
+	var wg sync.WaitGroup
+	var certFile, keyFile string
+	if *key != "" && *cert != "" {
+		keyFile = *key
+		certFile = *cert
+	} else {
+		certFile, keyFile = testdata.GetCertificatePaths()
+	}
+	for _, b := range bs {
+		fmt.Println("listening on", b)
+		bCap := b
+		wg.Go(func() {
+			var err error
+			if *tcp {
+				err = http3.ListenAndServeTLS(bCap, certFile, keyFile, handler)
+			} else {
+				server := http3.Server{
+					Handler: handler,
+					Addr:    bCap,
+					QUICConfig: &quic.Config{
+						Tracer: qlog.DefaultConnectionTracer,
+					},
+				}
+				err = server.ListenAndServeTLS(certFile, keyFile)
+			}
+			if err != nil {
+				fmt.Println(err)
+			}
+		})
+	}
+	wg.Wait()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/flow_controller_base.go b/electron/native/private-transport/third_party/quic-go/flow_controller_base.go
new file mode 100644
index 000000000..769336cdb
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/flow_controller_base.go
@@ -0,0 +1,84 @@
+package quic
+
+import (
+	"sync"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+type receiveFlowController struct {
+	//nolint:structcheck // The mutex is used both by the stream and the connection flow controller
+	mutex                sync.Mutex
+	bytesRead            protocol.ByteCount
+	highestReceived      protocol.ByteCount
+	receiveWindow        protocol.ByteCount
+	receiveWindowSize    protocol.ByteCount
+	maxReceiveWindowSize protocol.ByteCount
+
+	allowWindowIncrease func(size protocol.ByteCount) bool
+
+	epochStartTime   monotime.Time
+	epochStartOffset protocol.ByteCount
+	rttStats         *utils.RTTStats
+
+	logger utils.Logger
+}
+
+// needs to be called with locked mutex
+func (c *receiveFlowController) addBytesRead(n protocol.ByteCount) {
+	c.bytesRead += n
+}
+
+func (c *receiveFlowController) hasWindowUpdate() bool {
+	bytesRemaining := c.receiveWindow - c.bytesRead
+	// update the window when more than the threshold was consumed
+	return bytesRemaining <= protocol.ByteCount(float64(c.receiveWindowSize)*(1-protocol.WindowUpdateThreshold))
+}
+
+// getWindowUpdate updates the receive window, if necessary
+// it returns the new offset
+func (c *receiveFlowController) getWindowUpdate(now monotime.Time) protocol.ByteCount {
+	if !c.hasWindowUpdate() {
+		return 0
+	}
+
+	c.maybeAdjustWindowSize(now)
+	c.receiveWindow = c.bytesRead + c.receiveWindowSize
+	return c.receiveWindow
+}
+
+// maybeAdjustWindowSize increases the receiveWindowSize if we're sending updates too often.
+// For details about auto-tuning, see https://docs.google.com/document/d/1SExkMmGiz8VYzV3s9E35JQlJ73vhzCekKkDi85F1qCE/edit?usp=sharing.
+func (c *receiveFlowController) maybeAdjustWindowSize(now monotime.Time) {
+	bytesReadInEpoch := c.bytesRead - c.epochStartOffset
+	// don't do anything if less than half the window has been consumed
+	if bytesReadInEpoch <= c.receiveWindowSize/2 {
+		return
+	}
+	rtt := c.rttStats.SmoothedRTT()
+	if rtt == 0 {
+		return
+	}
+
+	fraction := float64(bytesReadInEpoch) / float64(c.receiveWindowSize)
+	if now.Sub(c.epochStartTime) < time.Duration(4*fraction*float64(rtt)) {
+		// window is consumed too fast, try to increase the window size
+		newSize := min(2*c.receiveWindowSize, c.maxReceiveWindowSize)
+		if newSize > c.receiveWindowSize && (c.allowWindowIncrease == nil || c.allowWindowIncrease(newSize-c.receiveWindowSize)) {
+			c.receiveWindowSize = newSize
+		}
+	}
+	c.startNewAutoTuningEpoch(now)
+}
+
+func (c *receiveFlowController) startNewAutoTuningEpoch(now monotime.Time) {
+	c.epochStartTime = now
+	c.epochStartOffset = c.bytesRead
+}
+
+func (c *receiveFlowController) checkFlowControlViolation() bool {
+	return c.highestReceived > c.receiveWindow
+}
diff --git a/electron/native/private-transport/third_party/quic-go/flow_controller_connection.go b/electron/native/private-transport/third_party/quic-go/flow_controller_connection.go
new file mode 100644
index 000000000..5c7e58e82
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/flow_controller_connection.go
@@ -0,0 +1,178 @@
+package quic
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+type connectionFlowController struct {
+	receiveFlowController
+
+	// Protects send-side state, which TryWriteAll can access from application goroutines.
+	sendMutex     sync.Mutex
+	bytesSent     protocol.ByteCount
+	sendWindow    protocol.ByteCount
+	lastBlockedAt protocol.ByteCount
+}
+
+// newConnectionFlowController gets a new flow controller for the connection.
+// It is created before we receive the peer's transport parameters, thus it starts with a sendWindow of 0.
+func newConnectionFlowController(
+	receiveWindow protocol.ByteCount,
+	maxReceiveWindow protocol.ByteCount,
+	allowWindowIncrease func(size protocol.ByteCount) bool,
+	rttStats *utils.RTTStats,
+	logger utils.Logger,
+) *connectionFlowController {
+	return &connectionFlowController{
+		receiveFlowController: receiveFlowController{
+			rttStats:             rttStats,
+			receiveWindow:        receiveWindow,
+			receiveWindowSize:    receiveWindow,
+			maxReceiveWindowSize: maxReceiveWindow,
+			allowWindowIncrease:  allowWindowIncrease,
+			logger:               logger,
+		},
+	}
+}
+
+// IncrementHighestReceived adds an increment to the highestReceived value
+func (c *connectionFlowController) IncrementHighestReceived(increment protocol.ByteCount, now monotime.Time) error {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	// If this is the first frame received on this connection, start flow-control auto-tuning.
+	if c.highestReceived == 0 {
+		c.startNewAutoTuningEpoch(now)
+	}
+	c.highestReceived += increment
+
+	if c.checkFlowControlViolation() {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.FlowControlError,
+			ErrorMessage: fmt.Sprintf("received %d bytes for the connection, allowed %d bytes", c.highestReceived, c.receiveWindow),
+		}
+	}
+	return nil
+}
+
+func (c *connectionFlowController) AddBytesRead(n protocol.ByteCount) (hasWindowUpdate bool) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	c.addBytesRead(n)
+	return c.hasWindowUpdate()
+}
+
+// TryAddBytesSent adds n bytes if sufficient connection-level send credit is available.
+func (c *connectionFlowController) TryAddBytesSent(n protocol.ByteCount) bool {
+	c.sendMutex.Lock()
+	defer c.sendMutex.Unlock()
+
+	if c.bytesSent > c.sendWindow || n > c.sendWindow-c.bytesSent {
+		return false
+	}
+	c.bytesSent += n
+	return true
+}
+
+// AddBytesSentWithLimiter adds the limiter-approved portion of the available connection-level send credit.
+func (c *connectionFlowController) AddBytesSentWithLimiter(
+	n protocol.ByteCount,
+	limiter func(int) int,
+) (protocol.ByteCount, bool) {
+	c.sendMutex.Lock()
+	defer c.sendMutex.Unlock()
+
+	if c.bytesSent >= c.sendWindow {
+		return 0, false
+	}
+	n = min(n, c.sendWindow-c.bytesSent)
+	added := min(
+		max(protocol.ByteCount(limiter(int(n))), 0),
+		n,
+	)
+	c.bytesSent += added
+	return added, added < n
+}
+
+// UpdateSendWindow is called after receiving a MAX_DATA frame.
+func (c *connectionFlowController) UpdateSendWindow(offset protocol.ByteCount) (updated bool) {
+	c.sendMutex.Lock()
+	defer c.sendMutex.Unlock()
+
+	if offset > c.sendWindow {
+		c.sendWindow = offset
+		return true
+	}
+	return false
+}
+
+func (c *connectionFlowController) SendWindowSize() protocol.ByteCount {
+	c.sendMutex.Lock()
+	defer c.sendMutex.Unlock()
+
+	return c.sendWindow - c.bytesSent
+}
+
+// IsNewlyBlocked says if it is newly blocked by connection flow control.
+// For every offset, it only returns true once.
+// If it is blocked, the offset is returned.
+func (c *connectionFlowController) IsNewlyBlocked() (bool, protocol.ByteCount) {
+	c.sendMutex.Lock()
+	defer c.sendMutex.Unlock()
+
+	if c.bytesSent < c.sendWindow || c.sendWindow == c.lastBlockedAt {
+		return false, 0
+	}
+	c.lastBlockedAt = c.sendWindow
+	return true, c.sendWindow
+}
+
+func (c *connectionFlowController) GetWindowUpdate(now monotime.Time) protocol.ByteCount {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	oldWindowSize := c.receiveWindowSize
+	offset := c.getWindowUpdate(now)
+	if c.logger.Debug() && oldWindowSize < c.receiveWindowSize {
+		c.logger.Debugf("Increasing receive flow control window for the connection to %d kB", c.receiveWindowSize/(1<<10))
+	}
+	return offset
+}
+
+// EnsureMinimumWindowSize sets a minimum window size
+// it should make sure that the connection-level window is increased when a stream-level window grows
+func (c *connectionFlowController) EnsureMinimumWindowSize(inc protocol.ByteCount, now monotime.Time) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	if inc <= c.receiveWindowSize {
+		return
+	}
+	newSize := min(inc, c.maxReceiveWindowSize)
+	if delta := newSize - c.receiveWindowSize; delta > 0 && c.allowWindowIncrease(delta) {
+		c.receiveWindowSize = newSize
+		if c.logger.Debug() {
+			c.logger.Debugf("Increasing receive flow control window for the connection to %d, in response to stream flow control window increase", newSize)
+		}
+	}
+	c.startNewAutoTuningEpoch(now)
+}
+
+// Reset rests the flow controller. This happens when 0-RTT is rejected.
+// All stream data is invalidated, it's as if we had never opened a stream and never sent any data.
+// At that point, we only have sent stream data, but we didn't have the keys to open 1-RTT keys yet.
+func (c *connectionFlowController) Reset() {
+	c.sendMutex.Lock()
+	defer c.sendMutex.Unlock()
+
+	c.bytesSent = 0
+	c.lastBlockedAt = 0
+	c.sendWindow = 0
+}
diff --git a/electron/native/private-transport/third_party/quic-go/flow_controller_connection_test.go b/electron/native/private-transport/third_party/quic-go/flow_controller_connection_test.go
new file mode 100644
index 000000000..418d71f62
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/flow_controller_connection_test.go
@@ -0,0 +1,71 @@
+package quic
+
+import (
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestConnectionFlowControlWindowUpdate(t *testing.T) {
+	fc := newConnectionFlowController(
+		100, // initial receive window
+		100, // max receive window
+		nil,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	require.False(t, fc.AddBytesRead(1))
+	require.Zero(t, fc.GetWindowUpdate(monotime.Now()))
+	require.True(t, fc.AddBytesRead(99))
+	require.Equal(t, protocol.ByteCount(200), fc.GetWindowUpdate(monotime.Now()))
+}
+
+func TestConnectionWindowAutoTuningNotAllowed(t *testing.T) {
+	// the RTT is 1 second
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(time.Second, 0)
+	require.Equal(t, time.Second, rttStats.SmoothedRTT())
+
+	callbackCalledWith := protocol.InvalidByteCount
+	fc := newConnectionFlowController(
+		100, // initial receive window
+		150, // max receive window
+		func(size protocol.ByteCount) bool {
+			callbackCalledWith = size
+			return false
+		},
+		rttStats,
+		utils.DefaultLogger,
+	)
+	now := monotime.Now()
+	require.NoError(t, fc.IncrementHighestReceived(100, now))
+	fc.AddBytesRead(90)
+	require.Equal(t, protocol.InvalidByteCount, callbackCalledWith)
+	require.Equal(t, protocol.ByteCount(90+100), fc.GetWindowUpdate(now.Add(time.Millisecond)))
+	require.Equal(t, protocol.ByteCount(150-100), callbackCalledWith)
+}
+
+func TestConnectionFlowControlViolation(t *testing.T) {
+	fc := newConnectionFlowController(100, 100, nil, utils.NewRTTStats(), utils.DefaultLogger)
+	require.NoError(t, fc.IncrementHighestReceived(40, monotime.Now()))
+	require.NoError(t, fc.IncrementHighestReceived(60, monotime.Now()))
+	err := fc.IncrementHighestReceived(1, monotime.Now())
+	var terr *qerr.TransportError
+	require.ErrorAs(t, err, &terr)
+	require.Equal(t, qerr.FlowControlError, terr.ErrorCode)
+}
+
+func TestConnectionFlowControllerReset(t *testing.T) {
+	fc := newConnectionFlowController(0, 0, nil, utils.NewRTTStats(), utils.DefaultLogger)
+	fc.UpdateSendWindow(100)
+	require.True(t, fc.TryAddBytesSent(10))
+	require.Equal(t, protocol.ByteCount(90), fc.SendWindowSize())
+	fc.Reset()
+	require.Zero(t, fc.SendWindowSize())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/flow_controller_stream.go b/electron/native/private-transport/third_party/quic-go/flow_controller_stream.go
new file mode 100644
index 000000000..4375b5f10
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/flow_controller_stream.go
@@ -0,0 +1,196 @@
+package quic
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+type streamFlowController struct {
+	receiveFlowController
+
+	bytesSent     protocol.ByteCount
+	sendWindow    protocol.ByteCount
+	lastBlockedAt protocol.ByteCount
+
+	streamID protocol.StreamID
+
+	connection *connectionFlowController
+
+	receivedFinalOffset bool
+}
+
+// newStreamFlowController gets a new flow controller for a stream.
+func newStreamFlowController(
+	streamID protocol.StreamID,
+	cfc *connectionFlowController,
+	receiveWindow protocol.ByteCount,
+	maxReceiveWindow protocol.ByteCount,
+	initialSendWindow protocol.ByteCount,
+	rttStats *utils.RTTStats,
+	logger utils.Logger,
+) *streamFlowController {
+	return &streamFlowController{
+		streamID:   streamID,
+		connection: cfc,
+		sendWindow: initialSendWindow,
+		receiveFlowController: receiveFlowController{
+			rttStats:             rttStats,
+			receiveWindow:        receiveWindow,
+			receiveWindowSize:    receiveWindow,
+			maxReceiveWindowSize: maxReceiveWindow,
+			logger:               logger,
+		},
+	}
+}
+
+// UpdateHighestReceived updates the highestReceived value, if the offset is higher.
+func (c *streamFlowController) UpdateHighestReceived(offset protocol.ByteCount, final bool, now monotime.Time) error {
+	// If the final offset for this stream is already known, check for consistency.
+	if c.receivedFinalOffset {
+		// If we receive another final offset, check that it's the same.
+		if final && offset != c.highestReceived {
+			return &qerr.TransportError{
+				ErrorCode:    qerr.FinalSizeError,
+				ErrorMessage: fmt.Sprintf("received inconsistent final offset for stream %d (old: %d, new: %d bytes)", c.streamID, c.highestReceived, offset),
+			}
+		}
+		// Check that the offset is below the final offset.
+		if offset > c.highestReceived {
+			return &qerr.TransportError{
+				ErrorCode:    qerr.FinalSizeError,
+				ErrorMessage: fmt.Sprintf("received offset %d for stream %d, but final offset was already received at %d", offset, c.streamID, c.highestReceived),
+			}
+		}
+	}
+
+	if final {
+		c.receivedFinalOffset = true
+	}
+	if offset == c.highestReceived {
+		return nil
+	}
+	// A higher offset was received before. This can happen due to reordering.
+	if offset < c.highestReceived {
+		if final {
+			return &qerr.TransportError{
+				ErrorCode:    qerr.FinalSizeError,
+				ErrorMessage: fmt.Sprintf("received final offset %d for stream %d, but already received offset %d before", offset, c.streamID, c.highestReceived),
+			}
+		}
+		return nil
+	}
+
+	// If this is the first frame received for this stream, start flow-control auto-tuning.
+	if c.highestReceived == 0 {
+		c.startNewAutoTuningEpoch(now)
+	}
+	increment := offset - c.highestReceived
+	c.highestReceived = offset
+
+	if c.checkFlowControlViolation() {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.FlowControlError,
+			ErrorMessage: fmt.Sprintf("received %d bytes on stream %d, allowed %d bytes", offset, c.streamID, c.receiveWindow),
+		}
+	}
+	return c.connection.IncrementHighestReceived(increment, now)
+}
+
+func (c *streamFlowController) AddBytesRead(n protocol.ByteCount) (hasStreamWindowUpdate, hasConnWindowUpdate bool) {
+	c.mutex.Lock()
+	c.addBytesRead(n)
+	hasStreamWindowUpdate = c.shouldQueueWindowUpdate()
+	c.mutex.Unlock()
+	hasConnWindowUpdate = c.connection.AddBytesRead(n)
+	return
+}
+
+func (c *streamFlowController) Abandon() {
+	c.mutex.Lock()
+	unread := c.highestReceived - c.bytesRead
+	c.bytesRead = c.highestReceived
+	c.mutex.Unlock()
+	if unread > 0 {
+		c.connection.AddBytesRead(unread)
+	}
+}
+
+func (c *streamFlowController) UpdateSendWindow(offset protocol.ByteCount) (updated bool) {
+	if offset > c.sendWindow {
+		c.sendWindow = offset
+		return true
+	}
+	return false
+}
+
+// TryAddBytesSent adds n bytes if sufficient stream- and connection-level send credit is available.
+func (c *streamFlowController) TryAddBytesSent(n protocol.ByteCount) bool {
+	if c.bytesSent > c.sendWindow || n > c.sendWindow-c.bytesSent {
+		return false
+	}
+	if !c.connection.TryAddBytesSent(n) {
+		return false
+	}
+	c.bytesSent += n
+	return true
+}
+
+// AddBytesSentWithLimiter adds the limiter-approved portion of the available stream- and connection-level send credit.
+func (c *streamFlowController) AddBytesSentWithLimiter(
+	n protocol.ByteCount,
+	limiter func(int) int,
+) (protocol.ByteCount, bool) {
+	if c.bytesSent >= c.sendWindow {
+		return 0, false
+	}
+	n = min(n, c.sendWindow-c.bytesSent)
+	added, limited := c.connection.AddBytesSentWithLimiter(n, limiter)
+	c.bytesSent += added
+	return added, limited
+}
+
+func (c *streamFlowController) SendWindowSize() protocol.ByteCount {
+	return min(c.sendWindow-c.bytesSent, c.connection.SendWindowSize())
+}
+
+func (c *streamFlowController) IsNewlyBlocked() bool {
+	blocked, _ := c.isNewlyBlocked()
+	return blocked
+}
+
+func (c *streamFlowController) isNewlyBlocked() (bool, protocol.ByteCount) {
+	if c.bytesSent < c.sendWindow || c.sendWindow == c.lastBlockedAt {
+		return false, 0
+	}
+	c.lastBlockedAt = c.sendWindow
+	return true, c.sendWindow
+}
+
+func (c *streamFlowController) shouldQueueWindowUpdate() bool {
+	return !c.receivedFinalOffset && c.hasWindowUpdate()
+}
+
+func (c *streamFlowController) GetWindowUpdate(now monotime.Time) protocol.ByteCount {
+	// If we already received the final offset for this stream, the peer won't need any additional flow control credit.
+	if c.receivedFinalOffset {
+		return 0
+	}
+
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	oldWindowSize := c.receiveWindowSize
+	offset := c.getWindowUpdate(now)
+	if c.receiveWindowSize > oldWindowSize { // auto-tuning enlarged the window size
+		c.logger.Debugf("Increasing receive flow control window for stream %d to %d", c.streamID, c.receiveWindowSize)
+		c.connection.EnsureMinimumWindowSize(
+			protocol.ByteCount(float64(c.receiveWindowSize)*protocol.ConnectionFlowControlMultiplier),
+			now,
+		)
+	}
+	return offset
+}
diff --git a/electron/native/private-transport/third_party/quic-go/flow_controller_stream_test.go b/electron/native/private-transport/third_party/quic-go/flow_controller_stream_test.go
new file mode 100644
index 000000000..9b32d7bfd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/flow_controller_stream_test.go
@@ -0,0 +1,319 @@
+package quic
+
+import (
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestStreamFlowControlReceiving(t *testing.T) {
+	fc := newStreamFlowController(
+		42,
+		newConnectionFlowController(
+			protocol.MaxByteCount,
+			protocol.MaxByteCount,
+			nil,
+			utils.NewRTTStats(),
+			utils.DefaultLogger,
+		),
+		100,
+		protocol.MaxByteCount,
+		protocol.MaxByteCount,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+
+	require.NoError(t, fc.UpdateHighestReceived(50, false, monotime.Now()))
+	// duplicates are fine
+	require.NoError(t, fc.UpdateHighestReceived(50, false, monotime.Now()))
+	// reordering is fine
+	require.NoError(t, fc.UpdateHighestReceived(40, false, monotime.Now()))
+	require.NoError(t, fc.UpdateHighestReceived(60, false, monotime.Now()))
+
+	// exceeding the limit is not fine
+	err := fc.UpdateHighestReceived(101, false, monotime.Now())
+	var terr *qerr.TransportError
+	require.ErrorAs(t, err, &terr)
+	require.Equal(t, qerr.FlowControlError, terr.ErrorCode)
+	require.Equal(t, "received 101 bytes on stream 42, allowed 100 bytes", terr.ErrorMessage)
+}
+
+func TestStreamFlowControllerFinalOffset(t *testing.T) {
+	newFC := func() *streamFlowController {
+		return newStreamFlowController(
+			42,
+			newConnectionFlowController(
+				protocol.MaxByteCount,
+				protocol.MaxByteCount,
+				nil,
+				utils.NewRTTStats(),
+				utils.DefaultLogger,
+			),
+			protocol.MaxByteCount,
+			protocol.MaxByteCount,
+			protocol.MaxByteCount,
+			utils.NewRTTStats(),
+			utils.DefaultLogger,
+		)
+	}
+
+	t.Run("duplicate final offset", func(t *testing.T) {
+		fc := newFC()
+		require.NoError(t, fc.UpdateHighestReceived(50, true, monotime.Now()))
+		// it is valid to receive the same final offset multiple times
+		require.NoError(t, fc.UpdateHighestReceived(50, true, monotime.Now()))
+	})
+
+	t.Run("inconsistent final offset", func(t *testing.T) {
+		fc := newFC()
+		require.NoError(t, fc.UpdateHighestReceived(50, true, monotime.Now()))
+		err := fc.UpdateHighestReceived(51, true, monotime.Now())
+		require.Error(t, err)
+		var terr *qerr.TransportError
+		require.ErrorAs(t, err, &terr)
+		require.Equal(t, qerr.FinalSizeError, terr.ErrorCode)
+		require.Equal(t, "received inconsistent final offset for stream 42 (old: 50, new: 51 bytes)", terr.ErrorMessage)
+	})
+
+	t.Run("non-final offset past final offset", func(t *testing.T) {
+		fc := newFC()
+		require.NoError(t, fc.UpdateHighestReceived(50, true, monotime.Now()))
+		// No matter the ordering, it's never ok to receive an offset past the final offset.
+		err := fc.UpdateHighestReceived(60, false, monotime.Now())
+		var terr *qerr.TransportError
+		require.ErrorAs(t, err, &terr)
+		require.Equal(t, qerr.FinalSizeError, terr.ErrorCode)
+		require.Equal(t, "received offset 60 for stream 42, but final offset was already received at 50", terr.ErrorMessage)
+	})
+
+	t.Run("final offset smaller than previous offset", func(t *testing.T) {
+		fc := newFC()
+		require.NoError(t, fc.UpdateHighestReceived(50, false, monotime.Now()))
+		// If we received offset already, it's invalid to receive a smaller final offset.
+		err := fc.UpdateHighestReceived(40, true, monotime.Now())
+		var terr *qerr.TransportError
+		require.ErrorAs(t, err, &terr)
+		require.Equal(t, qerr.FinalSizeError, terr.ErrorCode)
+		require.Equal(t, "received final offset 40 for stream 42, but already received offset 50 before", terr.ErrorMessage)
+	})
+}
+
+func TestStreamAbandoning(t *testing.T) {
+	connFC := newConnectionFlowController(
+		100,
+		protocol.MaxByteCount,
+		nil,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	require.True(t, connFC.UpdateSendWindow(300))
+	fc := newStreamFlowController(
+		42,
+		connFC,
+		60,
+		protocol.MaxByteCount,
+		100,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+
+	require.NoError(t, fc.UpdateHighestReceived(50, true, monotime.Now()))
+	require.Zero(t, fc.GetWindowUpdate(monotime.Now()))
+	require.Zero(t, connFC.GetWindowUpdate(monotime.Now()))
+
+	// Abandon the stream.
+	// This marks all bytes as having been consumed.
+	fc.Abandon()
+	require.Equal(t, protocol.ByteCount(150), connFC.GetWindowUpdate(monotime.Now()))
+}
+
+func TestStreamSendWindow(t *testing.T) {
+	// We set up the connection flow controller with a limit of 300 bytes,
+	// and the stream flow controller with a limit of 100 bytes.
+	connFC := newConnectionFlowController(
+		protocol.MaxByteCount,
+		protocol.MaxByteCount,
+		nil,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	require.True(t, connFC.UpdateSendWindow(300))
+	fc := newStreamFlowController(
+		42,
+		connFC,
+		protocol.MaxByteCount,
+		protocol.MaxByteCount,
+		100,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	// first, we're limited by the stream flow controller
+	require.Equal(t, protocol.ByteCount(100), fc.SendWindowSize())
+	require.True(t, fc.TryAddBytesSent(50))
+	require.False(t, fc.IsNewlyBlocked())
+	require.Equal(t, protocol.ByteCount(50), fc.SendWindowSize())
+	require.True(t, fc.TryAddBytesSent(50))
+	require.True(t, fc.IsNewlyBlocked())
+	require.Zero(t, fc.SendWindowSize())
+	require.False(t, fc.IsNewlyBlocked()) // we're still blocked, but it's not new
+
+	// Update the stream flow control limit, but don't update the connection flow control limit.
+	// We're now limited by the connection flow controller.
+	require.True(t, fc.UpdateSendWindow(1000))
+	// reordered updates are ignored
+	require.False(t, fc.UpdateSendWindow(999))
+
+	require.False(t, fc.IsNewlyBlocked()) // we're not blocked anymore
+	require.Equal(t, protocol.ByteCount(200), fc.SendWindowSize())
+	require.True(t, fc.TryAddBytesSent(200))
+	require.Zero(t, fc.SendWindowSize())
+	require.False(t, fc.IsNewlyBlocked()) // we're blocked, but not on stream flow control
+}
+
+func TestStreamFlowControllerTryAddBytesSent(t *testing.T) {
+	connFC := newConnectionFlowController(
+		protocol.MaxByteCount,
+		protocol.MaxByteCount,
+		nil,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	require.True(t, connFC.UpdateSendWindow(10))
+	fc := newStreamFlowController(
+		42,
+		connFC,
+		protocol.MaxByteCount,
+		protocol.MaxByteCount,
+		100,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+
+	require.True(t, fc.TryAddBytesSent(6))
+	require.False(t, fc.TryAddBytesSent(5))
+	require.Equal(t, protocol.ByteCount(4), connFC.SendWindowSize())
+}
+
+func TestStreamWindowUpdate(t *testing.T) {
+	fc := newStreamFlowController(
+		42,
+		newConnectionFlowController(
+			protocol.MaxByteCount,
+			protocol.MaxByteCount,
+			nil,
+			utils.NewRTTStats(),
+			utils.DefaultLogger,
+		),
+		100,
+		100,
+		protocol.MaxByteCount,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	require.Zero(t, fc.GetWindowUpdate(monotime.Now()))
+	hasStreamWindowUpdate, _ := fc.AddBytesRead(24)
+	require.False(t, hasStreamWindowUpdate)
+	require.Zero(t, fc.GetWindowUpdate(monotime.Now()))
+	// the window is updated when it's 25% filled
+	hasStreamWindowUpdate, _ = fc.AddBytesRead(1)
+	require.True(t, hasStreamWindowUpdate)
+	require.Equal(t, protocol.ByteCount(125), fc.GetWindowUpdate(monotime.Now()))
+
+	hasStreamWindowUpdate, _ = fc.AddBytesRead(24)
+	require.False(t, hasStreamWindowUpdate)
+	require.Zero(t, fc.GetWindowUpdate(monotime.Now()))
+	// the window is updated when it's 25% filled
+	hasStreamWindowUpdate, _ = fc.AddBytesRead(1)
+	require.True(t, hasStreamWindowUpdate)
+	require.Equal(t, protocol.ByteCount(150), fc.GetWindowUpdate(monotime.Now()))
+
+	// Receive the final offset.
+	// We don't need to send any more flow control updates.
+	require.NoError(t, fc.UpdateHighestReceived(100, true, monotime.Now()))
+	fc.AddBytesRead(50)
+	require.Zero(t, fc.GetWindowUpdate(monotime.Now()))
+}
+
+func TestStreamConnectionWindowUpdate(t *testing.T) {
+	connFC := newConnectionFlowController(
+		100,
+		protocol.MaxByteCount,
+		nil,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	fc := newStreamFlowController(
+		42,
+		connFC,
+		1000,
+		protocol.MaxByteCount,
+		protocol.MaxByteCount,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+
+	hasStreamWindowUpdate, hasConnWindowUpdate := fc.AddBytesRead(50)
+	require.False(t, hasStreamWindowUpdate)
+	require.Zero(t, fc.GetWindowUpdate(monotime.Now()))
+	require.True(t, hasConnWindowUpdate)
+	require.NotZero(t, connFC.GetWindowUpdate(monotime.Now()))
+}
+
+func TestStreamWindowAutoTuning(t *testing.T) {
+	// the RTT is 1 second
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(time.Second, 0)
+	require.Equal(t, time.Second, rttStats.SmoothedRTT())
+
+	connFC := newConnectionFlowController(
+		150, // initial receive window
+		350, // max receive window
+		func(size protocol.ByteCount) bool { return true },
+		rttStats,
+		utils.DefaultLogger,
+	)
+	fc := newStreamFlowController(
+		42,
+		connFC,
+		100, // initial send window
+		399, // max send window
+		protocol.MaxByteCount,
+		rttStats,
+		utils.DefaultLogger,
+	)
+
+	now := monotime.Now()
+	require.NoError(t, fc.UpdateHighestReceived(100, false, now))
+
+	// data consumption is too slow, window size is not increased
+	now = now.Add(2500 * time.Millisecond)
+	fc.AddBytesRead(51)
+	// one initial stream window size added
+	require.Equal(t, protocol.ByteCount(51+100), fc.GetWindowUpdate(now))
+	// one initial connection window size added
+	require.Equal(t, protocol.ByteCount(51+150), connFC.getWindowUpdate(now))
+
+	// data consumption is fast enough, window size is increased
+	now = now.Add(2 * time.Second)
+	fc.AddBytesRead(51)
+	// stream window size doubled to 200 bytes
+	require.Equal(t, protocol.ByteCount(102+2*100), fc.GetWindowUpdate(now))
+	// The connection window is now increased as well,
+	// so that we don't get blocked on connection level flow control:
+	// The increase is by 200 bytes * a connection factor of 1.5: 300 bytes.
+	require.Equal(t, protocol.ByteCount(102+300), connFC.GetWindowUpdate(now))
+
+	// data consumption is fast enough, window size is increased
+	now = now.Add(2 * time.Second)
+	fc.AddBytesRead(101)
+	// stream window size increased again, but bumps into its maximum value
+	require.Equal(t, protocol.ByteCount(203+399), fc.GetWindowUpdate(now))
+	// the connection window is also increased, but it bumps into its maximum value
+	require.Equal(t, protocol.ByteCount(203+350), connFC.GetWindowUpdate(now))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/flow_controller_test_helpers_test.go b/electron/native/private-transport/third_party/quic-go/flow_controller_test_helpers_test.go
new file mode 100644
index 000000000..815252b86
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/flow_controller_test_helpers_test.go
@@ -0,0 +1,39 @@
+package quic
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+func newTestStreamFlowController(id protocol.StreamID) *streamFlowController {
+	return newTestStreamFlowControllerWithSendWindow(id, 0)
+}
+
+func newTestStreamFlowControllerWithSendWindow(id protocol.StreamID, sendWindow protocol.ByteCount) *streamFlowController {
+	return newTestStreamFlowControllerWithWindows(id, sendWindow, protocol.MaxByteCount, protocol.MaxByteCount)
+}
+
+func newTestStreamFlowControllerWithWindows(
+	id protocol.StreamID,
+	sendWindow protocol.ByteCount,
+	streamReceiveWindow protocol.ByteCount,
+	connReceiveWindow protocol.ByteCount,
+) *streamFlowController {
+	connFC := newConnectionFlowController(
+		connReceiveWindow,
+		protocol.MaxByteCount,
+		nil,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	connFC.UpdateSendWindow(protocol.MaxByteCount)
+	return newStreamFlowController(
+		id,
+		connFC,
+		streamReceiveWindow,
+		protocol.MaxByteCount,
+		sendWindow,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/frame_sorter.go b/electron/native/private-transport/third_party/quic-go/frame_sorter.go
new file mode 100644
index 000000000..20c6d9cc0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/frame_sorter.go
@@ -0,0 +1,274 @@
+package quic
+
+import (
+	"errors"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	list "github.com/quic-go/quic-go/internal/utils/linkedlist"
+)
+
+// byteInterval is an interval from one ByteCount to the other
+type byteInterval struct {
+	Start protocol.ByteCount
+	End   protocol.ByteCount
+}
+
+var byteIntervalElementPool sync.Pool
+
+func init() {
+	byteIntervalElementPool = *list.NewPool[byteInterval]()
+}
+
+type frameSorterEntry struct {
+	Data   []byte
+	DoneCb func()
+}
+
+type frameSorter struct {
+	queue   map[protocol.ByteCount]frameSorterEntry
+	readPos protocol.ByteCount
+	gaps    *list.List[byteInterval]
+}
+
+var errDuplicateStreamData = errors.New("duplicate stream data")
+
+func newFrameSorter() *frameSorter {
+	s := frameSorter{
+		gaps:  list.NewWithPool[byteInterval](&byteIntervalElementPool),
+		queue: make(map[protocol.ByteCount]frameSorterEntry),
+	}
+	s.gaps.PushFront(byteInterval{Start: 0, End: protocol.MaxByteCount})
+	return &s
+}
+
+func (s *frameSorter) Push(data []byte, offset protocol.ByteCount, doneCb func()) error {
+	err := s.push(data, offset, doneCb)
+	if err == errDuplicateStreamData {
+		if doneCb != nil {
+			doneCb()
+		}
+		return nil
+	}
+	return err
+}
+
+func (s *frameSorter) push(data []byte, offset protocol.ByteCount, doneCb func()) error {
+	if len(data) == 0 {
+		return errDuplicateStreamData
+	}
+
+	start := offset
+	end := offset + protocol.ByteCount(len(data))
+
+	if end <= s.gaps.Front().Value.Start {
+		return errDuplicateStreamData
+	}
+
+	startGap, startsInGap := s.findStartGap(start)
+	endGap, endsInGap := s.findEndGap(startGap, end)
+
+	startGapEqualsEndGap := startGap == endGap
+
+	if (startGapEqualsEndGap && end <= startGap.Value.Start) ||
+		(!startGapEqualsEndGap && startGap.Value.End >= endGap.Value.Start && end <= startGap.Value.Start) {
+		return errDuplicateStreamData
+	}
+
+	startGapNext := startGap.Next()
+	startGapEnd := startGap.Value.End // save it, in case startGap is modified
+	endGapStart := endGap.Value.Start // save it, in case endGap is modified
+	endGapEnd := endGap.Value.End     // save it, in case endGap is modified
+	var adjustedStartGapEnd bool
+	var wasCut bool
+
+	pos := start
+	var hasReplacedAtLeastOne bool
+	for {
+		oldEntry, ok := s.queue[pos]
+		if !ok {
+			break
+		}
+		oldEntryLen := protocol.ByteCount(len(oldEntry.Data))
+		if end-pos > oldEntryLen || (hasReplacedAtLeastOne && end-pos == oldEntryLen) {
+			// The existing frame is shorter than the new frame. Replace it.
+			delete(s.queue, pos)
+			pos += oldEntryLen
+			hasReplacedAtLeastOne = true
+			if oldEntry.DoneCb != nil {
+				oldEntry.DoneCb()
+			}
+		} else {
+			if !hasReplacedAtLeastOne {
+				return errDuplicateStreamData
+			}
+			// The existing frame is longer than the new frame.
+			// Cut the new frame such that the end aligns with the start of the existing frame.
+			data = data[:pos-start]
+			end = pos
+			wasCut = true
+			break
+		}
+	}
+
+	if !startsInGap && !hasReplacedAtLeastOne {
+		// cut the frame, such that it starts at the start of the gap
+		data = data[startGap.Value.Start-start:]
+		start = startGap.Value.Start
+		wasCut = true
+	}
+	if start <= startGap.Value.Start {
+		if end >= startGap.Value.End {
+			// The frame covers the whole startGap. Delete the gap.
+			s.gaps.Remove(startGap)
+		} else {
+			startGap.Value.Start = end
+		}
+	} else if !hasReplacedAtLeastOne {
+		startGap.Value.End = start
+		adjustedStartGapEnd = true
+	}
+
+	if !startGapEqualsEndGap {
+		s.deleteConsecutive(startGapEnd)
+		var nextGap *list.Element[byteInterval]
+		for gap := startGapNext; gap.Value.End < endGapStart; gap = nextGap {
+			nextGap = gap.Next()
+			s.deleteConsecutive(gap.Value.End)
+			s.gaps.Remove(gap)
+		}
+	}
+
+	if !endsInGap && start != endGapEnd && end > endGapEnd {
+		// cut the frame, such that it ends at the end of the gap
+		data = data[:endGapEnd-start]
+		end = endGapEnd
+		wasCut = true
+	}
+	if end == endGapEnd {
+		if !startGapEqualsEndGap {
+			// The frame covers the whole endGap. Delete the gap.
+			s.gaps.Remove(endGap)
+		}
+	} else {
+		if startGapEqualsEndGap && adjustedStartGapEnd {
+			// The frame split the existing gap into two.
+			s.gaps.InsertAfter(byteInterval{Start: end, End: startGapEnd}, startGap)
+		} else if !startGapEqualsEndGap {
+			endGap.Value.Start = end
+		}
+	}
+
+	if wasCut && len(data) < protocol.MinStreamFrameBufferSize {
+		newData := make([]byte, len(data))
+		copy(newData, data)
+		data = newData
+		if doneCb != nil {
+			doneCb()
+			doneCb = nil
+		}
+	}
+
+	if s.gaps.Len() > protocol.MaxStreamFrameSorterGaps {
+		return errors.New("too many gaps in received data")
+	}
+
+	s.queue[start] = frameSorterEntry{Data: data, DoneCb: doneCb}
+	return nil
+}
+
+func (s *frameSorter) findStartGap(offset protocol.ByteCount) (*list.Element[byteInterval], bool) {
+	for gap := s.gaps.Front(); gap != nil; gap = gap.Next() {
+		if offset >= gap.Value.Start && offset <= gap.Value.End {
+			return gap, true
+		}
+		if offset < gap.Value.Start {
+			return gap, false
+		}
+	}
+	panic("no gap found")
+}
+
+func (s *frameSorter) findEndGap(startGap *list.Element[byteInterval], offset protocol.ByteCount) (*list.Element[byteInterval], bool) {
+	for gap := startGap; gap != nil; gap = gap.Next() {
+		if offset >= gap.Value.Start && offset < gap.Value.End {
+			return gap, true
+		}
+		if offset < gap.Value.Start {
+			return gap.Prev(), false
+		}
+	}
+	panic("no gap found")
+}
+
+// deleteConsecutive deletes consecutive frames from the queue, starting at pos
+func (s *frameSorter) deleteConsecutive(pos protocol.ByteCount) {
+	for {
+		oldEntry, ok := s.queue[pos]
+		if !ok {
+			break
+		}
+		oldEntryLen := protocol.ByteCount(len(oldEntry.Data))
+		delete(s.queue, pos)
+		if oldEntry.DoneCb != nil {
+			oldEntry.DoneCb()
+		}
+		pos += oldEntryLen
+	}
+}
+
+func (s *frameSorter) Pop() (protocol.ByteCount, []byte, func()) {
+	entry, ok := s.queue[s.readPos]
+	if !ok {
+		return s.readPos, nil, nil
+	}
+	delete(s.queue, s.readPos)
+	offset := s.readPos
+	s.readPos += protocol.ByteCount(len(entry.Data))
+	if s.gaps.Front().Value.End <= s.readPos {
+		panic("frame sorter BUG: read position higher than a gap")
+	}
+	return offset, entry.Data, entry.DoneCb
+}
+
+// HasMoreData says if there is any more data queued at *any* offset.
+func (s *frameSorter) HasMoreData() bool {
+	return len(s.queue) > 0
+}
+
+var errTooLittleData = errors.New("too little data")
+
+// Peek copies len(p) consecutive bytes starting at offset into p, without removing them.
+// It is only possible to peek from an offset where a frame starts.
+//
+// If there isn't enough consecutive data available, errTooLittleData is returned.
+func (s *frameSorter) Peek(offset protocol.ByteCount, p []byte) error {
+	if len(p) == 0 {
+		return nil
+	}
+
+	// first, check if we have enough consecutive data available
+	pos := offset
+	remaining := len(p)
+	for remaining > 0 {
+		entry, ok := s.queue[pos]
+		if !ok {
+			return errTooLittleData
+		}
+		entryLen := len(entry.Data)
+		if remaining <= entryLen {
+			break // enough data available
+		}
+		remaining -= entryLen
+		pos += protocol.ByteCount(entryLen)
+	}
+
+	pos = offset
+	var copied int
+	for copied < len(p) {
+		entry := s.queue[pos] // the entry is guaranteed to exist from the check above
+		copied += copy(p[copied:], entry.Data)
+		pos += protocol.ByteCount(len(entry.Data))
+	}
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/frame_sorter_test.go b/electron/native/private-transport/third_party/quic-go/frame_sorter_test.go
new file mode 100644
index 000000000..1ec1cf0a2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/frame_sorter_test.go
@@ -0,0 +1,1657 @@
+package quic
+
+import (
+	rand "crypto/rand"
+	"fmt"
+	"math"
+	mrand "math/rand/v2"
+	"slices"
+	"testing"
+
+	ossfuzzseeds "github.com/quic-go/go-ossfuzz-seeds"
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+type callbackTracker struct {
+	called *bool
+	cb     func()
+}
+
+func (t *callbackTracker) WasCalled() bool { return *t.called }
+
+func getFrameSorterTestCallback(t *testing.T) (func(), callbackTracker) {
+	var called bool
+	cb := func() {
+		if called {
+			t.Fatal("double free")
+		}
+		called = true
+	}
+	return cb, callbackTracker{
+		cb:     cb,
+		called: &called,
+	}
+}
+
+func TestFrameSorterSimpleCases(t *testing.T) {
+	s := newFrameSorter()
+	_, data, doneCb := s.Pop()
+	require.Nil(t, data)
+	require.Nil(t, doneCb)
+
+	// empty frames are ignored
+	require.NoError(t, s.Push(nil, 0, nil))
+	_, data, doneCb = s.Pop()
+	require.Nil(t, data)
+	require.Nil(t, doneCb)
+
+	cb1, t1 := getFrameSorterTestCallback(t)
+	cb2, t2 := getFrameSorterTestCallback(t)
+	require.NoError(t, s.Push([]byte("bar"), 3, cb2))
+	require.True(t, s.HasMoreData())
+	require.NoError(t, s.Push([]byte("foo"), 0, cb1))
+
+	offset, data, doneCb := s.Pop()
+	require.Equal(t, []byte("foo"), data)
+	require.Zero(t, offset)
+	require.NotNil(t, doneCb)
+	doneCb()
+	require.True(t, t1.WasCalled())
+	require.False(t, t2.WasCalled())
+	require.True(t, s.HasMoreData())
+
+	offset, data, doneCb = s.Pop()
+	require.Equal(t, []byte("bar"), data)
+	require.Equal(t, protocol.ByteCount(3), offset)
+	require.NotNil(t, doneCb)
+	doneCb()
+	require.True(t, t2.WasCalled())
+	require.False(t, s.HasMoreData())
+
+	// now receive a duplicate
+	cb3, t3 := getFrameSorterTestCallback(t)
+	require.NoError(t, s.Push([]byte("foo"), 0, cb3))
+	require.False(t, s.HasMoreData())
+	require.True(t, t3.WasCalled())
+
+	// now receive a later frame that overlaps with the ones we already consumed
+	cb4, _ := getFrameSorterTestCallback(t)
+	require.NoError(t, s.Push([]byte("barbaz"), 3, cb4))
+	require.True(t, s.HasMoreData())
+
+	offset, data, _ = s.Pop()
+	require.Equal(t, protocol.ByteCount(6), offset)
+	require.Equal(t, []byte("baz"), data)
+	require.False(t, s.HasMoreData())
+}
+
+// Usually, it's not a good idea to test the implementation details.
+// However, we need to make sure that the frame sorter handles gaps correctly,
+// in particular when overlapping stream data is received.
+// This also includes returning buffers that are no longer needed.
+func TestFrameSorterGapHandling(t *testing.T) {
+	random := mrand.NewChaCha8([32]byte{'f', 'o', 'o', 'b', 'a', 'r'})
+
+	getData := func(l protocol.ByteCount) []byte {
+		b := make([]byte, l)
+		random.Read(b)
+		return b
+	}
+
+	checkQueue := func(t *testing.T, s *frameSorter, m map[protocol.ByteCount][]byte) {
+		require.Equal(t, len(m), len(s.queue))
+		for offset, data := range m {
+			require.Contains(t, s.queue, offset)
+			require.Equal(t, data, s.queue[offset].Data)
+		}
+	}
+
+	checkGaps := func(t *testing.T, s *frameSorter, expectedGaps []byteInterval) {
+		if s.gaps.Len() != len(expectedGaps) {
+			fmt.Println("Gaps:")
+			for gap := s.gaps.Front(); gap != nil; gap = gap.Next() {
+				fmt.Printf("\t%d - %d\n", gap.Value.Start, gap.Value.End)
+			}
+			require.Equal(t, len(expectedGaps), s.gaps.Len())
+		}
+		var i int
+		for gap := s.gaps.Front(); gap != nil; gap = gap.Next() {
+			require.Equal(t, expectedGaps[i], gap.Value)
+			i++
+		}
+	}
+
+	// ---xxx--------------
+	//       ++++++
+	// =>
+	// ---xxx++++++--------
+	t.Run("case 1", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(5)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 11
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f1,
+			6: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 11, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+	})
+
+	// ---xxx-----------------
+	//          +++++++
+	// =>
+	// ---xxx---+++++++--------
+	t.Run("case 2", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(5)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1))  // 3 - 6
+		require.NoError(t, s.Push(f2, 10, cb2)) // 10 -15
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3:  f1,
+			10: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 6, End: 10},
+			{Start: 15, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+	})
+
+	// ---xxx----xxxxxx-------
+	//       ++++
+	// =>
+	// ---xxx++++xxxxx--------
+	t.Run("case 3", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(5)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1))  // 3 - 6
+		require.NoError(t, s.Push(f3, 10, cb2)) // 10 - 15
+		require.NoError(t, s.Push(f2, 6, cb3))  // 6 - 10
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3:  f1,
+			6:  f2,
+			10: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 15, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ----xxxx-------
+	//       ++++
+	// =>
+	// ----xxxx++-----
+	t.Run("case 4", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(4)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 7
+		require.NoError(t, s.Push(f2, 5, cb2)) // 5 - 9
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f1,
+			7: f2[2:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 9, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+	})
+
+	t.Run("case 4, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 2))
+		f1 := getData(4 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1)) // 3 - 7
+		require.NoError(t, s.Push(f2, 5*mult, cb2)) // 5 - 9
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3 * mult: f1,
+			7 * mult: f2[2*mult:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3 * mult},
+			{Start: 9 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+	})
+
+	// xxxx-------
+	//    ++++
+	// =>
+	// xxxx+++-----
+	t.Run("case 5", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(4)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 0, cb1)) // 0 - 4
+		require.NoError(t, s.Push(f2, 3, cb2)) // 3 - 7
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			0: f1,
+			4: f2[1:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 7, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+	})
+
+	t.Run("case 5, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 2))
+		f1 := getData(4 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 0, cb1))      // 0 - 4
+		require.NoError(t, s.Push(f2, 3*mult, cb2)) // 3 - 7
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			0:        f1,
+			4 * mult: f2[mult:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 7 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+	})
+
+	// ----xxxx-------
+	//   ++++
+	// =>
+	// --++xxxx-------
+	t.Run("case 6", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(4)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5, cb1)) // 5 - 9
+		require.NoError(t, s.Push(f2, 3, cb2)) // 3 - 7
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f2[:2],
+			5: f1,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 9, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+	})
+
+	t.Run("case 6, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 2))
+		f1 := getData(4 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5*mult, cb1)) // 5 - 9
+		require.NoError(t, s.Push(f2, 3*mult, cb2)) // 3 - 7
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3 * mult: f2[:2*mult],
+			5 * mult: f1,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3 * mult},
+			{Start: 9 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+	})
+
+	// ---xxx----xxxxxx-------
+	//       ++
+	// =>
+	// ---xxx++--xxxxx--------
+	t.Run("case 7", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(2)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(5)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1))  // 3 - 6
+		require.NoError(t, s.Push(f3, 10, cb2)) // 10 - 15
+		require.NoError(t, s.Push(f2, 6, cb3))  // 6 - 8
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3:  f1,
+			6:  f2,
+			10: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 8, End: 10},
+			{Start: 15, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxx---------xxxxxx--
+	//          ++
+	// =>
+	// ---xxx---++----xxxxx--
+	t.Run("case 8", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(2)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(5)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1))  // 3 - 6
+		require.NoError(t, s.Push(f3, 15, cb2)) // 15 - 20
+		require.NoError(t, s.Push(f2, 10, cb3)) // 10 - 12
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3:  f1,
+			10: f2,
+			15: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 6, End: 10},
+			{Start: 12, End: 15},
+			{Start: 20, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxx----xxxxxx-------
+	//         ++
+	// =>
+	// ---xxx--++xxxxx--------
+	t.Run("case 9", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(2)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(5)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1))  // 3 - 6
+		require.NoError(t, s.Push(f3, 10, cb2)) // 10 - 15
+		require.NoError(t, s.Push(f2, 8, cb3))  // 8 - 10
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3:  f1,
+			8:  f2,
+			10: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 6, End: 8},
+			{Start: 15, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxx----=====-------
+	//      +++++++
+	// =>
+	// ---xxx++++=====--------
+	t.Run("case 10", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(5)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(6)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1))  // 3 - 6
+		require.NoError(t, s.Push(f2, 10, cb2)) // 10 - 15
+		require.NoError(t, s.Push(f3, 5, cb3))  // 5 - 11
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3:  f1,
+			6:  f3[1:5],
+			10: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 15, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+	})
+
+	t.Run("case 10, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 4))
+		f1 := getData(3 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(5 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(6 * mult)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1))  // 3 - 6
+		require.NoError(t, s.Push(f2, 10*mult, cb2)) // 10 - 15
+		require.NoError(t, s.Push(f3, 5*mult, cb3))  // 5 - 11
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3 * mult:  f1,
+			6 * mult:  f3[mult : 5*mult],
+			10 * mult: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3 * mult},
+			{Start: 15 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxxx----=====-------
+	//      ++++++
+	// =>
+	// ---xxx++++=====--------
+	t.Run("case 11", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(4)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(5)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(5)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1))  // 3 - 7
+		require.NoError(t, s.Push(f2, 10, cb2)) // 10 - 15
+		require.NoError(t, s.Push(f3, 5, cb3))  // 5 - 10
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3:  f1,
+			7:  f3[2:],
+			10: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 15, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+	})
+
+	// ---xxxx----=====-------
+	//      ++++++
+	// =>
+	// ---xxx++++=====--------
+	t.Run("case 11, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 3))
+		f1 := getData(4 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(5 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(5 * mult)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1))  // 3 - 7
+		require.NoError(t, s.Push(f2, 10*mult, cb2)) // 10 - 15
+		require.NoError(t, s.Push(f3, 5*mult, cb3))  // 5 - 10
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3 * mult:  f1,
+			7 * mult:  f3[2*mult:],
+			10 * mult: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3 * mult},
+			{Start: 15 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ----xxxx-------
+	//     +++++++
+	// =>
+	// ----+++++++-----
+	t.Run("case 12", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(4)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(7)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 7
+		require.NoError(t, s.Push(f2, 3, cb2)) // 3 - 10
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 10, End: protocol.MaxByteCount},
+		})
+		require.True(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+	})
+
+	// ----xxx===-------
+	//     +++++++
+	// =>
+	// ----+++++++-----
+	t.Run("case 13", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(7)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 9
+		require.NoError(t, s.Push(f3, 3, cb3)) // 3 - 10
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 10, End: protocol.MaxByteCount},
+		})
+		require.True(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ----xxx====-------
+	//     +++++
+	// =>
+	// ----+++====-----
+	t.Run("case 14", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(5)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 10
+		require.NoError(t, s.Push(f3, 3, cb3)) // 3 - 8
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f3[:3],
+			6: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 10, End: protocol.MaxByteCount},
+		})
+		require.True(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+	})
+
+	t.Run("case 14, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 3))
+		f1 := getData(3 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(5 * mult)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6*mult, cb2)) // 6 - 10
+		require.NoError(t, s.Push(f3, 3*mult, cb3)) // 3 - 8
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3 * mult: f3[:3*mult],
+			6 * mult: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3 * mult},
+			{Start: 10 * mult, End: protocol.MaxByteCount},
+		})
+		require.True(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ----xxx===-------
+	//     ++++++
+	// =>
+	// ----++++++-----
+	t.Run("case 15", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(6)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 9
+		require.NoError(t, s.Push(f3, 3, cb3)) // 3 - 9
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 9, End: protocol.MaxByteCount},
+		})
+		require.True(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxxx-------
+	//    ++++
+	// =>
+	// ---xxxx-----
+	t.Run("case 16", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(4)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5, cb1)) // 5 - 9
+		require.NoError(t, s.Push(f2, 5, cb2)) // 5 - 9
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			5: f1,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 5},
+			{Start: 9, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+	})
+
+	// ----xxx===-------
+	//     +++
+	// =>
+	// ----xxx===-----
+	t.Run("case 17", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(3)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 9
+		require.NoError(t, s.Push(f3, 3, cb3)) // 3 - 6
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f1,
+			6: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 9, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+	})
+
+	// ---xxxx-------
+	//    ++
+	// =>
+	// ---xxxx-----
+	t.Run("case 18", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(4)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(2)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5, cb1)) // 5 - 9
+		require.NoError(t, s.Push(f2, 5, cb2)) // 5 - 7
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			5: f1,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 5},
+			{Start: 9, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+	})
+
+	// ---xxxxx------
+	//     ++
+	// =>
+	// ---xxxxx----
+	t.Run("case 19", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(5)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(2)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5, cb1)) // 5 - 10
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			5: f1,
+		})
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 8
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			5: f1,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 5},
+			{Start: 10, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+	})
+
+	// xxxxx------
+	//  ++
+	// =>
+	// xxxxx------
+	t.Run("case 20", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(10)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 0, cb1)) // 0 - 10
+		require.NoError(t, s.Push(f2, 5, cb2)) // 5 - 9
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			0: f1,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 10, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+	})
+	// ---xxxxx---
+	//      +++
+	// =>
+	// ---xxxxx---
+	t.Run("case 21", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(5)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5, cb1)) // 5 - 10
+		require.NoError(t, s.Push(f2, 7, cb2)) // 7 - 10
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 5},
+			{Start: 10, End: protocol.MaxByteCount},
+		})
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			5: f1,
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+	})
+
+	// ----xxx------
+	//   +++++
+	// =>
+	// --+++++----
+	t.Run("case 22", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(5)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5, cb1)) // 5 - 8
+		require.NoError(t, s.Push(f2, 3, cb2)) // 3 - 8
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 8, End: protocol.MaxByteCount},
+		})
+		require.True(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+	})
+
+	// ----xxx===------
+	//   ++++++++
+	// =>
+	// --++++++++----
+	t.Run("case 23", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(8)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5, cb1)) // 5 - 8
+		require.NoError(t, s.Push(f2, 8, cb2)) // 8 - 11
+		require.NoError(t, s.Push(f3, 3, cb3)) // 3 - 11
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 11, End: protocol.MaxByteCount},
+		})
+		require.True(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// --xxx---===---
+	//      ++++++
+	// =>
+	// --xxx++++++----
+	t.Run("case 24", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(6)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 9, cb2)) // 9 - 12
+		require.NoError(t, s.Push(f3, 6, cb3)) // 6 - 12
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f1,
+			6: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 12, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// --xxx---===---###
+	//      +++++++++
+	// =>
+	// --xxx+++++++++###
+	t.Run("case 25", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(3)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		f4 := getData(9)
+		cb4, t4 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1))  // 3 - 6
+		require.NoError(t, s.Push(f2, 9, cb2))  // 9 - 12
+		require.NoError(t, s.Push(f3, 15, cb3)) // 15 - 18
+		require.NoError(t, s.Push(f4, 6, cb4))  // 6 - 15
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3:  f1,
+			6:  f4,
+			15: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 18, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+		require.False(t, t4.WasCalled())
+	})
+
+	// ----xxx------
+	//   +++++++
+	// =>
+	// --+++++++---
+	t.Run("case 26", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(10)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5, cb1)) // 5 - 8
+		require.NoError(t, s.Push(f2, 3, cb2)) // 3 - 13
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 13, End: protocol.MaxByteCount},
+		})
+		require.True(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+	})
+
+	// ---xxx====---
+	//   ++++
+	// =>
+	// --+xxx====---
+	t.Run("case 27", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(4)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 10
+		require.NoError(t, s.Push(f3, 2, cb3)) // 2 - 6
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			2: f3[:1],
+			3: f1,
+			6: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 2},
+			{Start: 10, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+	})
+
+	t.Run("case 27, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		const mult = protocol.MinStreamFrameSize
+		f1 := getData(3 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(4 * mult)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6*mult, cb2)) // 6 - 10
+		require.NoError(t, s.Push(f3, 2*mult, cb3)) // 2 - 6
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			2 * mult: f3[:mult],
+			3 * mult: f1,
+			6 * mult: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 2 * mult},
+			{Start: 10 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxx====---
+	//   ++++++
+	// =>
+	// --+xxx====---
+	t.Run("case 28", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(6)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 10
+		require.NoError(t, s.Push(f3, 2, cb3)) // 2 - 8
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			2: f3[:1],
+			3: f1,
+			6: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 2},
+			{Start: 10, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+	})
+
+	t.Run("case 28, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		const mult = protocol.MinStreamFrameSize
+		f1 := getData(3 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(6 * mult)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6*mult, cb2)) // 6 - 10
+		require.NoError(t, s.Push(f3, 2*mult, cb3)) // 2 - 8
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			2 * mult: f3[:mult],
+			3 * mult: f1,
+			6 * mult: f2,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 2 * mult},
+			{Start: 10 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxx===-----
+	//       +++++
+	// =>
+	// ---xxx+++++---
+	t.Run("case 29", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(5)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 9
+		require.NoError(t, s.Push(f3, 6, cb3)) // 6 - 11
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f1,
+			6: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 11, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxx===----
+	//      ++++++
+	// =>
+	// ---xxx===++--
+	t.Run("case 30", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(6)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6, cb2)) // 6 - 9
+		require.NoError(t, s.Push(f3, 5, cb3)) // 5 - 11
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f1,
+			6: f2,
+			9: f3[4:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 11, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+	})
+
+	t.Run("case 30, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 2))
+		f1 := getData(3 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(6 * mult)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 6*mult, cb2)) // 6 - 9
+		require.NoError(t, s.Push(f3, 5*mult, cb3)) // 5 - 11
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3 * mult: f1,
+			6 * mult: f2,
+			9 * mult: f3[4*mult:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3 * mult},
+			{Start: 11 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxx---===-----
+	//     ++++++++++
+	// =>
+	// ---xxx++++++++---
+	t.Run("case 31", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(10)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 9, cb2)) // 9 - 12
+		require.NoError(t, s.Push(f3, 5, cb3)) // 5 - 15
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f1,
+			6: f3[1:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 15, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+	})
+
+	t.Run("case 31, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 9))
+		f1 := getData(3 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(10 * mult)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 9*mult, cb2)) // 9 - 12
+		require.NoError(t, s.Push(f3, 5*mult, cb3)) // 5 - 15
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3 * mult: f1,
+			6 * mult: f3[mult:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3 * mult},
+			{Start: 15 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxx---===-----
+	//    +++++++++
+	// =>
+	// ---+++++++++---
+	t.Run("case 32", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(9)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 9, cb2)) // 9 - 12
+		require.NoError(t, s.Push(f3, 3, cb3)) // 3 - 12
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f3,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 12, End: protocol.MaxByteCount},
+		})
+		require.True(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+
+	// ---xxx---===###-----
+	//     ++++++++++++
+	// =>
+	// ---xxx++++++++++---
+	t.Run("case 33", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(3)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		f4 := getData(12)
+		cb4, t4 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 9, cb2)) // 9 - 12
+		require.NoError(t, s.Push(f3, 9, cb3)) // 12 - 15
+		require.NoError(t, s.Push(f4, 5, cb4)) // 5 - 17
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f1,
+			6: f4[1:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 17, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+		require.True(t, t4.WasCalled())
+	})
+
+	t.Run("case 33, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 11))
+		f1 := getData(3 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(3 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(3 * mult)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		f4 := getData(12 * mult)
+		cb4, t4 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 9*mult, cb2)) // 9 - 12
+		require.NoError(t, s.Push(f3, 9*mult, cb3)) // 12 - 15
+		require.NoError(t, s.Push(f4, 5*mult, cb4)) // 5 - 17
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3 * mult: f1,
+			6 * mult: f4[mult:],
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3 * mult},
+			{Start: 17 * mult, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+		require.False(t, t4.WasCalled())
+	})
+
+	// ---xxx===---###
+	//       ++++++
+	// =>
+	// ---xxx++++++###
+	t.Run("case 34", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(5)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(5)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(10)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		f4 := getData(5)
+		cb4, t4 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 5, cb1))  // 5 - 10
+		require.NoError(t, s.Push(f2, 10, cb2)) // 10 - 15
+		require.NoError(t, s.Push(f4, 20, cb3)) // 20 - 25
+		require.NoError(t, s.Push(f3, 10, cb4)) // 10 - 20
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			5:  f1,
+			10: f3,
+			20: f4,
+		})
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 5},
+			{Start: 25, End: protocol.MaxByteCount},
+		})
+		require.False(t, t1.WasCalled())
+		require.True(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+		require.False(t, t4.WasCalled())
+	})
+
+	// ---xxx---####---
+	//    ++++++++
+	// =>
+	// ---++++++####---
+	t.Run("case 35", func(t *testing.T) {
+		s := newFrameSorter()
+		f1 := getData(3)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(8)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 9, cb2)) // 9 - 13
+		require.NoError(t, s.Push(f3, 3, cb3)) // 3 - 11
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3},
+			{Start: 13, End: protocol.MaxByteCount},
+		})
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3: f3[:6],
+			9: f2,
+		})
+		require.True(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.True(t, t3.WasCalled())
+	})
+
+	t.Run("case 35, for long frames", func(t *testing.T) {
+		s := newFrameSorter()
+		mult := protocol.ByteCount(math.Ceil(float64(protocol.MinStreamFrameSize) / 6))
+		f1 := getData(3 * mult)
+		cb1, t1 := getFrameSorterTestCallback(t)
+		f2 := getData(4 * mult)
+		cb2, t2 := getFrameSorterTestCallback(t)
+		f3 := getData(8 * mult)
+		cb3, t3 := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f1, 3*mult, cb1)) // 3 - 6
+		require.NoError(t, s.Push(f2, 9*mult, cb2)) // 9 - 13
+		require.NoError(t, s.Push(f3, 3*mult, cb3)) // 3 - 11
+		checkGaps(t, s, []byteInterval{
+			{Start: 0, End: 3 * mult},
+			{Start: 13 * mult, End: protocol.MaxByteCount},
+		})
+		checkQueue(t, s, map[protocol.ByteCount][]byte{
+			3 * mult: f3[:6*mult],
+			9 * mult: f2,
+		})
+		require.True(t, t1.WasCalled())
+		require.False(t, t2.WasCalled())
+		require.False(t, t3.WasCalled())
+	})
+}
+
+func TestFrameSorterTooManyGaps(t *testing.T) {
+	s := newFrameSorter()
+	for i := range protocol.MaxStreamFrameSorterGaps {
+		require.NoError(t, s.Push([]byte("foobar"), protocol.ByteCount(i*7), nil))
+	}
+	require.Equal(t, protocol.MaxStreamFrameSorterGaps, s.gaps.Len())
+	err := s.Push([]byte("foobar"), protocol.ByteCount(protocol.MaxStreamFrameSorterGaps*7)+100, nil)
+	require.EqualError(t, err, "too many gaps in received data")
+}
+
+func TestFrameSorterRandomized(t *testing.T) {
+	t.Run("short", func(t *testing.T) {
+		testFrameSorterRandomized(t, 25, false, false)
+	})
+	t.Run("long", func(t *testing.T) {
+		testFrameSorterRandomized(t, 2*protocol.MinStreamFrameSize, false, false)
+	})
+	t.Run("short, with duplicates", func(t *testing.T) {
+		testFrameSorterRandomized(t, 25, true, false)
+	})
+	t.Run("long, with duplicates", func(t *testing.T) {
+		testFrameSorterRandomized(t, 2*protocol.MinStreamFrameSize, true, false)
+	})
+	t.Run("short, with overlaps", func(t *testing.T) {
+		testFrameSorterRandomized(t, 25, false, true)
+	})
+	t.Run("long, with overlaps", func(t *testing.T) {
+		testFrameSorterRandomized(t, 2*protocol.MinStreamFrameSize, false, true)
+	})
+}
+
+func testFrameSorterRandomized(t *testing.T, dataLen protocol.ByteCount, injectDuplicates, injectOverlaps bool) {
+	type frame struct {
+		offset protocol.ByteCount
+		data   []byte
+	}
+
+	const num = 1000
+
+	data := make([]byte, num*int(dataLen))
+	var seed [32]byte
+	rand.Read(seed[:])
+	random := mrand.NewChaCha8(seed)
+	random.Read(data)
+
+	frames := make([]frame, num)
+	for i := range num {
+		b := make([]byte, dataLen)
+		offset := i * int(dataLen)
+		copy(b, data[offset:offset+int(dataLen)])
+		frames[i] = frame{
+			offset: protocol.ByteCount(i) * dataLen,
+			data:   b,
+		}
+	}
+	mrand.Shuffle(len(frames), func(i, j int) { frames[i], frames[j] = frames[j], frames[i] })
+
+	s := newFrameSorter()
+
+	var callbacks []callbackTracker
+	for _, f := range frames {
+		cb, tr := getFrameSorterTestCallback(t)
+		require.NoError(t, s.Push(f.data, f.offset, cb))
+		callbacks = append(callbacks, tr)
+	}
+	if injectDuplicates {
+		for range num / 10 {
+			cb, tr := getFrameSorterTestCallback(t)
+			df := frames[mrand.IntN(len(frames))]
+			require.NoError(t, s.Push(df.data, df.offset, cb))
+			callbacks = append(callbacks, tr)
+		}
+	}
+	if injectOverlaps {
+		finalOffset := num * dataLen
+		for range num / 3 {
+			cb, tr := getFrameSorterTestCallback(t)
+			startOffset := protocol.ByteCount(mrand.IntN(int(finalOffset)))
+			endOffset := startOffset + protocol.ByteCount(mrand.IntN(int(finalOffset-startOffset)))
+			require.NoError(t, s.Push(data[startOffset:endOffset], startOffset, cb))
+			callbacks = append(callbacks, tr)
+		}
+	}
+	require.Equal(t, 1, s.gaps.Len())
+	require.Equal(t, byteInterval{Start: num * dataLen, End: protocol.MaxByteCount}, s.gaps.Front().Value)
+
+	// read all data
+	var read []byte
+	for {
+		offset, b, cb := s.Pop()
+		if b == nil {
+			break
+		}
+		require.Equal(t, offset, protocol.ByteCount(len(read)))
+		read = append(read, b...)
+		if cb != nil {
+			cb()
+		}
+	}
+
+	require.Equal(t, data, read)
+	require.False(t, s.HasMoreData())
+	for _, cb := range callbacks {
+		require.True(t, cb.WasCalled())
+	}
+}
+
+func TestFrameSorterPeek(t *testing.T) {
+	s := newFrameSorter()
+	require.NoError(t, s.Peek(1337, []byte{})) // empty peek is a no-op
+	require.ErrorIs(t, s.Peek(0, []byte{0, 1, 2, 3, 4}), errTooLittleData)
+
+	require.NoError(t, s.Push([]byte("foobar"), 0, nil))
+
+	// peek partial frame
+	p := make([]byte, 3)
+	require.NoError(t, s.Peek(0, p))
+	require.Equal(t, []byte("foo"), p)
+	// peek entire frame
+	p = make([]byte, 6)
+	require.NoError(t, s.Peek(0, p))
+	require.Equal(t, []byte("foobar"), p)
+	// peek more than available
+	p = make([]byte, 10)
+	require.ErrorIs(t, s.Peek(0, p), errTooLittleData)
+	// peek at offset where no entry exists
+	p = make([]byte, 3)
+	require.ErrorIs(t, s.Peek(3, p), errTooLittleData)
+
+	// peek across multiple frames
+	s.Push([]byte("baz"), 6, nil)
+	p = make([]byte, 9)
+	require.NoError(t, s.Peek(0, p))
+	require.Equal(t, []byte("foobarbaz"), p)
+	// peek starting from second frame
+	p = make([]byte, 3)
+	require.NoError(t, s.Peek(6, p))
+	require.Equal(t, []byte("baz"), p)
+
+	// peeking across gaps doesn't work
+	s.Push([]byte("qux"), 10, nil)
+	p = make([]byte, 10)
+	require.ErrorIs(t, s.Peek(0, p), errTooLittleData)
+}
+
+func FuzzFrameSorter(f *testing.F) {
+	const (
+		opPush uint8 = iota
+		opPop
+		opPeek
+	)
+
+	// Each operation is encoded as 3 bytes: 1 byte op type, 1 byte offset, 1 byte length.
+	// maxStreamLen is chosen larger than protocol.MinStreamFrameBufferSize so that overlapping
+	// frames can be cut down to less than that threshold. This ensures the small-cut code path
+	// in frameSorter.push (which copies the cut frame and fires the doneCb early) is exercised,
+	// while still allowing un-cut frames to be at or above the minimum size.
+	const (
+		opSize       = 3
+		maxStreamLen = 256
+		maxOps       = 128
+	)
+	// If MinStreamFrameBufferSize is ever changed to grow beyond maxStreamLen,
+	// the small-cut path becomes unreachable. Keep them in sync.
+	require.Less(f, protocol.MinStreamFrameBufferSize, maxStreamLen)
+
+	corpus := ossfuzzseeds.New(f)
+	for _, seed := range [][]uint8{
+		{opPush, 0, 3, opPush, 3, 3, opPop, 0, 0},
+		{opPush, 6, 3, opPush, 0, 3, opPush, 3, 3, opPop, 0, 0},
+		{opPush, 0, 6, opPush, 0, 6, opPop, 0, 0, opPush, 0, 6},
+		{opPush, 3, 4, opPush, 5, 4, opPush, 0, 3, opPop, 0, 0},
+		{opPush, 3, 3, opPush, 9, 3, opPush, 5, 10, opPush, 0, 3, opPop, 0, 0},
+		{opPush, 0, 6, opPeek, 0, 3, opPush, 6, 3, opPeek, 0, 9, opPush, 10, 3, opPeek, 0, 12},
+	} {
+		corpus.Add(seed)
+	}
+
+	// use deterministic non-uniform data
+	streamData := make([]byte, maxStreamLen)
+	for i := range streamData {
+		streamData[i] = byte(31*i + 7)
+	}
+
+	f.Fuzz(func(t *testing.T, data []byte) {
+		if len(data)%opSize != 0 || len(data) > opSize*maxOps {
+			return
+		}
+
+		s := newFrameSorter()
+		received := make([]bool, len(streamData))
+		var readPos protocol.ByteCount
+		var callbacks []callbackTracker
+
+		push := func(offset, length int) {
+			cb, tr := getFrameSorterTestCallback(t)
+			callbacks = append(callbacks, tr)
+			require.NoError(t, s.Push(streamData[offset:offset+length], protocol.ByteCount(offset), cb))
+			for i := max(offset, int(readPos)); i < offset+length; i++ {
+				received[i] = true
+			}
+		}
+
+		for ; len(data) >= opSize; data = data[opSize:] {
+			op, offset, length := data[0], int(data[1]), int(data[2])
+			if offset+length > len(streamData) {
+				return
+			}
+
+			switch op {
+			case opPush:
+				push(offset, length)
+			case opPop:
+				readPos = frameSorterFuzzPop(t, s, streamData, received, readPos)
+			case opPeek:
+				frameSorterFuzzPeek(t, s, streamData, received, readPos, offset, length)
+			}
+		}
+
+		// Complete the stream so that all queued data is eventually popped or replaced.
+		// This lets us assert that every callback is called exactly once.
+		push(0, len(streamData))
+
+		for readPos < protocol.ByteCount(len(streamData)) {
+			readPos = frameSorterFuzzPop(t, s, streamData, received, readPos)
+		}
+		require.False(t, s.HasMoreData())
+		for _, cb := range callbacks {
+			require.True(t, cb.WasCalled())
+		}
+	})
+}
+
+func frameSorterFuzzPop(t *testing.T, s *frameSorter, streamData []byte, received []bool, readPos protocol.ByteCount) protocol.ByteCount {
+	t.Helper()
+
+	hasMoreData := func(received []bool) bool {
+		return slices.Contains(received, true)
+	}
+
+	offset, data, cb := s.Pop()
+	require.Equal(t, readPos, offset)
+
+	require.LessOrEqual(t, readPos, protocol.ByteCount(len(streamData)))
+	if readPos == protocol.ByteCount(len(streamData)) || !received[readPos] {
+		require.Nil(t, data)
+		require.Nil(t, cb)
+		require.Equal(t, hasMoreData(received[int(readPos):]), s.HasMoreData())
+		return readPos
+	}
+
+	require.NotEmpty(t, data)
+	nextGap := slices.Index(received[int(readPos):], false)
+	if nextGap == -1 {
+		nextGap = len(received) - int(readPos)
+	}
+	require.LessOrEqual(t, len(data), nextGap)
+	end := readPos + protocol.ByteCount(len(data))
+	require.LessOrEqual(t, end, protocol.ByteCount(len(streamData)))
+	require.Equal(t, streamData[readPos:end], data)
+	if cb != nil {
+		cb()
+	}
+	require.Equal(t, hasMoreData(received[int(end):]), s.HasMoreData())
+	return end
+}
+
+func frameSorterFuzzPeek(t *testing.T, s *frameSorter, streamData []byte, received []bool, readPos protocol.ByteCount, offset, length int) {
+	t.Helper()
+
+	p := make([]byte, length)
+	err := s.Peek(protocol.ByteCount(offset), p)
+
+	// Peek only supports peeking from offsets where a frame starts. The model only
+	// knows that frame boundaries are guaranteed at readPos, so when peeking from
+	// there with enough consecutive received data, Peek must succeed.
+	if length > 0 && protocol.ByteCount(offset) == readPos {
+		nextGap := slices.Index(received[offset:], false)
+		if nextGap == -1 || nextGap >= length {
+			require.NoError(t, err)
+		}
+	}
+	if err != nil {
+		return
+	}
+	require.Equal(t, streamData[offset:offset+length], p)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/framer.go b/electron/native/private-transport/third_party/quic-go/framer.go
new file mode 100644
index 000000000..0ce60c8f6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/framer.go
@@ -0,0 +1,484 @@
+package quic
+
+import (
+	"slices"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils/minheap"
+	"github.com/quic-go/quic-go/internal/utils/ringbuffer"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+const (
+	maxPathResponses = 256
+	maxControlFrames = 16 << 10
+)
+
+// This is the largest possible size of a stream-related control frame
+// (which is the RESET_STREAM frame).
+const maxStreamControlFrameSize = 25
+
+type streamFrameGetter interface {
+	priority() (urgency int8, incremental bool, generation uint32)
+	popStreamFrame(protocol.ByteCount, protocol.Version) (_ ackhandler.StreamFrame, _ *wire.StreamDataBlockedFrame, hasMoreData bool)
+	popRetransmissionFrame(protocol.ByteCount, protocol.Version) (ackhandler.StreamFrame, bool)
+}
+
+type streamControlFrameGetter interface {
+	getControlFrame(monotime.Time) (_ ackhandler.Frame, ok, hasMore bool)
+}
+
+// streamQueueEntry captures the stream's generation when it is queued.
+// A mismatch with the current generation identifies an entry left behind by a priority change.
+type streamQueueEntry struct {
+	id         protocol.StreamID
+	generation uint32
+}
+
+// queuedStream tracks the latest generation added to a scheduling queue,
+// preventing duplicate and out-of-order notifications from queueing it again.
+type queuedStream struct {
+	streamFrameGetter
+	generation uint32
+}
+
+type framer struct {
+	mutex sync.Mutex
+
+	activeStreams         map[protocol.StreamID]queuedStream
+	retransmissionStreams map[protocol.StreamID]streamFrameGetter
+
+	incrementalStreams    [8]ringbuffer.RingBuffer[streamQueueEntry]
+	nonIncrementalStreams [8]minheap.Heap[protocol.StreamID, uint32 /* generation */]
+	// If an urgency level contains both incremental and non-incremental streams,
+	// we round-robin between incremental and non-incremental streams.
+	lastSendWasIncremental [8]bool
+
+	streamsWithControlFrames map[protocol.StreamID]streamControlFrameGetter
+	// Retransmissions are not incremental: repair all lost data for the first queued stream.
+	// New losses extend its batch, so A, B, A is repaired as A, A, B, delaying B.
+	// The ring buffer provides FIFO scheduling while reusing its storage.
+	retransmissionQueue [8]ringbuffer.RingBuffer[protocol.StreamID]
+
+	controlFrameMutex          sync.Mutex
+	controlFrames              []wire.Frame
+	pathResponses              []*wire.PathResponseFrame
+	connFlowController         *connectionFlowController
+	queuedTooManyControlFrames bool
+}
+
+func newFramer(connFlowController *connectionFlowController) *framer {
+	return &framer{
+		activeStreams:            make(map[protocol.StreamID]queuedStream),
+		retransmissionStreams:    make(map[protocol.StreamID]streamFrameGetter),
+		streamsWithControlFrames: make(map[protocol.StreamID]streamControlFrameGetter),
+		connFlowController:       connFlowController,
+	}
+}
+
+func (f *framer) HasData() bool {
+	f.controlFrameMutex.Lock()
+	hasControlFrames := len(f.streamsWithControlFrames) > 0 || len(f.controlFrames) > 0 || len(f.pathResponses) > 0
+	f.controlFrameMutex.Unlock()
+
+	if hasControlFrames {
+		return true
+	}
+
+	f.mutex.Lock()
+	defer f.mutex.Unlock()
+
+	for urgency := range f.incrementalStreams {
+		if !f.incrementalStreams[urgency].Empty() || !f.nonIncrementalStreams[urgency].Empty() ||
+			!f.retransmissionQueue[urgency].Empty() {
+			return true
+		}
+	}
+	return false
+}
+
+func (f *framer) QueueControlFrame(frame wire.Frame) {
+	f.controlFrameMutex.Lock()
+	defer f.controlFrameMutex.Unlock()
+
+	if pr, ok := frame.(*wire.PathResponseFrame); ok {
+		// Only queue up to maxPathResponses PATH_RESPONSE frames.
+		// This limit should be high enough to never be hit in practice,
+		// unless the peer is doing something malicious.
+		if len(f.pathResponses) >= maxPathResponses {
+			return
+		}
+		f.pathResponses = append(f.pathResponses, pr)
+		return
+	}
+	// This is a hack.
+	if len(f.controlFrames) >= maxControlFrames {
+		f.queuedTooManyControlFrames = true
+		return
+	}
+	f.controlFrames = append(f.controlFrames, frame)
+}
+
+func (f *framer) Append(
+	frames []ackhandler.Frame,
+	streamFrames []ackhandler.StreamFrame,
+	maxLen protocol.ByteCount,
+	now monotime.Time,
+	v protocol.Version,
+) ([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount) {
+	f.controlFrameMutex.Lock()
+	frames, controlFrameLen := f.appendControlFrames(frames, maxLen, now, v)
+	maxLen -= controlFrameLen
+
+	var lastFrame ackhandler.StreamFrame
+	var streamFrameLen protocol.ByteCount
+	f.mutex.Lock()
+	// retransmit all lost STREAM data before sending new STREAM data
+retransmissions:
+	for urgency := range f.retransmissionQueue {
+		bucket := &f.retransmissionQueue[urgency]
+		for !bucket.Empty() && protocol.MinStreamFrameSize <= maxLen {
+			id := bucket.PeekFront()
+			str, ok := f.retransmissionStreams[id]
+			if !ok {
+				bucket.PopFront()
+				continue
+			}
+			currentUrgency, _, _ := str.priority()
+			if currentUrgency != int8(urgency) {
+				bucket.PopFront()
+				f.retransmissionQueue[currentUrgency].PushBack(id)
+				continue
+			}
+			// For the last STREAM frame, we'll remove the DataLen field later.
+			frameMaxLen := maxLen + protocol.ByteCount(quicvarint.Len(uint64(maxLen)))
+			sf, hasMoreRetransmissions := str.popRetransmissionFrame(frameMaxLen, v)
+			if !hasMoreRetransmissions {
+				bucket.PopFront()
+				delete(f.retransmissionStreams, id)
+			}
+			if sf.Frame == nil {
+				// If the retransmission didn't fit, retry it in the next packet.
+				if hasMoreRetransmissions {
+					break retransmissions
+				}
+				continue
+			}
+			streamFrames = append(streamFrames, sf)
+			maxLen -= sf.Frame.Length(v)
+			lastFrame = sf
+			streamFrameLen += sf.Frame.Length(v)
+		}
+	}
+	// pop STREAM frames, until less than 128 bytes are left in the packet
+	for urgency := range f.incrementalStreams {
+		numActiveStreams := f.incrementalStreams[urgency].Len() + f.nonIncrementalStreams[urgency].Len()
+
+		for range numActiveStreams {
+			if protocol.MinStreamFrameSize > maxLen {
+				break
+			}
+			sf, blocked := f.getNextStreamFrame(maxLen, int8(urgency), v)
+			if sf.Frame != nil {
+				streamFrames = append(streamFrames, sf)
+				maxLen -= sf.Frame.Length(v)
+				lastFrame = sf
+				streamFrameLen += sf.Frame.Length(v)
+			}
+			// If the stream just became blocked on stream flow control, attempt to pack the
+			// STREAM_DATA_BLOCKED into the same packet.
+			if blocked != nil {
+				l := blocked.Length(v)
+				// In case it doesn't fit, queue it for the next packet.
+				if maxLen < l {
+					f.controlFrames = append(f.controlFrames, blocked)
+					break
+				}
+				frames = append(frames, ackhandler.Frame{Frame: blocked})
+				maxLen -= l
+				controlFrameLen += l
+			}
+		}
+	}
+
+	// The only way to become blocked on connection-level flow control is by sending STREAM frames.
+	if isBlocked, offset := f.connFlowController.IsNewlyBlocked(); isBlocked {
+		blocked := &wire.DataBlockedFrame{MaximumData: offset}
+		l := blocked.Length(v)
+		// In case it doesn't fit, queue it for the next packet.
+		if maxLen >= l {
+			frames = append(frames, ackhandler.Frame{Frame: blocked})
+			controlFrameLen += l
+		} else {
+			f.controlFrames = append(f.controlFrames, blocked)
+		}
+	}
+
+	f.mutex.Unlock()
+	f.controlFrameMutex.Unlock()
+
+	if lastFrame.Frame != nil {
+		// account for the smaller size of the last STREAM frame
+		streamFrameLen -= lastFrame.Frame.Length(v)
+		lastFrame.Frame.DataLenPresent = false
+		streamFrameLen += lastFrame.Frame.Length(v)
+	}
+
+	return frames, streamFrames, controlFrameLen + streamFrameLen
+}
+
+func (f *framer) appendControlFrames(
+	frames []ackhandler.Frame,
+	maxLen protocol.ByteCount,
+	now monotime.Time,
+	v protocol.Version,
+) ([]ackhandler.Frame, protocol.ByteCount) {
+	var length protocol.ByteCount
+	// add a PATH_RESPONSE first, but only pack a single PATH_RESPONSE per packet
+	if len(f.pathResponses) > 0 {
+		frame := f.pathResponses[0]
+		frameLen := frame.Length(v)
+		if frameLen <= maxLen {
+			frames = append(frames, ackhandler.Frame{Frame: frame})
+			length += frameLen
+			f.pathResponses = f.pathResponses[1:]
+		}
+	}
+
+	// add stream-related control frames
+	for id, str := range f.streamsWithControlFrames {
+	start:
+		remainingLen := maxLen - length
+		if remainingLen <= maxStreamControlFrameSize {
+			break
+		}
+		fr, ok, hasMore := str.getControlFrame(now)
+		if !hasMore {
+			delete(f.streamsWithControlFrames, id)
+		}
+		if !ok {
+			continue
+		}
+		frames = append(frames, fr)
+		length += fr.Frame.Length(v)
+		if hasMore {
+			// It is rare that a stream has more than one control frame to queue.
+			// We don't want to spawn another loop for just to cover that case.
+			goto start
+		}
+	}
+
+	for len(f.controlFrames) > 0 {
+		frame := f.controlFrames[len(f.controlFrames)-1]
+		frameLen := frame.Length(v)
+		if length+frameLen > maxLen {
+			break
+		}
+		frames = append(frames, ackhandler.Frame{Frame: frame})
+		length += frameLen
+		f.controlFrames = f.controlFrames[:len(f.controlFrames)-1]
+	}
+
+	return frames, length
+}
+
+// QueuedTooManyControlFrames says if the control frame queue exceeded its maximum queue length.
+// This is a hack.
+// It is easier to implement than propagating an error return value in QueueControlFrame.
+// The correct solution would be to queue frames with their respective structs.
+// See https://github.com/quic-go/quic-go/issues/4271 for the queueing of stream-related control frames.
+func (f *framer) QueuedTooManyControlFrames() bool {
+	return f.queuedTooManyControlFrames
+}
+
+func (f *framer) AddActiveStream(id protocol.StreamID, str streamFrameGetter) {
+	f.mutex.Lock()
+	defer f.mutex.Unlock()
+
+	urgency, incremental, generation := str.priority()
+	if activeStr, ok := f.activeStreams[id]; ok && activeStr.generation == generation {
+		return
+	}
+	if incremental {
+		f.incrementalStreams[urgency].PushBack(streamQueueEntry{id: id, generation: generation})
+	} else {
+		f.nonIncrementalStreams[urgency].Push(id, generation)
+	}
+	f.activeStreams[id] = queuedStream{streamFrameGetter: str, generation: generation}
+}
+
+func (f *framer) AddStreamWithRetransmission(id protocol.StreamID, str streamFrameGetter) {
+	f.mutex.Lock()
+	defer f.mutex.Unlock()
+
+	urgency, _, _ := str.priority()
+	if _, ok := f.retransmissionStreams[id]; ok {
+		return
+	}
+	f.retransmissionQueue[urgency].PushBack(id)
+	f.retransmissionStreams[id] = str
+}
+
+func (f *framer) AddStreamWithControlFrames(id protocol.StreamID, str streamControlFrameGetter) {
+	f.controlFrameMutex.Lock()
+	defer f.controlFrameMutex.Unlock()
+
+	if _, ok := f.streamsWithControlFrames[id]; !ok {
+		f.streamsWithControlFrames[id] = str
+	}
+}
+
+// RemoveActiveStream is called when a stream completes.
+func (f *framer) RemoveActiveStream(id protocol.StreamID) {
+	f.mutex.Lock()
+	defer f.mutex.Unlock()
+
+	// We don't delete the stream from the ring buffers and heaps,
+	// since we'd have to find it there first.
+	// Instead, we check if the stream is still in active when appending STREAM frames.
+	delete(f.activeStreams, id)
+	delete(f.retransmissionStreams, id)
+}
+
+func (f *framer) UpdateStreamPriority(id protocol.StreamID) {
+	f.mutex.Lock()
+	defer f.mutex.Unlock()
+
+	str, ok := f.activeStreams[id]
+	if !ok {
+		return
+	}
+	urgency, incremental, generation := str.priority()
+	if str.generation != generation {
+		// Leave the old queue entry in place. It will be discarded when it reaches
+		// the front of that queue and no longer matches the stream's generation.
+		if incremental {
+			f.incrementalStreams[urgency].PushBack(streamQueueEntry{id: id, generation: generation})
+		} else {
+			f.nonIncrementalStreams[urgency].Push(id, generation)
+		}
+		str.generation = generation
+		f.activeStreams[id] = str
+	}
+}
+
+func (f *framer) getNextStreamFrame(
+	maxLen protocol.ByteCount,
+	urgency int8,
+	v protocol.Version,
+) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame) {
+	if f.nonIncrementalStreams[urgency].Empty() || (!f.lastSendWasIncremental[urgency] && !f.incrementalStreams[urgency].Empty()) {
+		return f.getNextIncrementalStreamFrame(maxLen, urgency, v)
+	}
+	return f.getNextNonIncrementalStreamFrame(maxLen, urgency, v)
+}
+
+func (f *framer) getNextIncrementalStreamFrame(
+	maxLen protocol.ByteCount,
+	urgency int8,
+	v protocol.Version,
+) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame) {
+	queue := &f.incrementalStreams[urgency]
+	if queue.Empty() {
+		return ackhandler.StreamFrame{}, nil
+	}
+	entry := queue.PopFront()
+	str, ok := f.activeStreams[entry.id]
+	if !ok {
+		return ackhandler.StreamFrame{}, nil
+	}
+	_, _, generation := str.priority()
+	if generation != entry.generation {
+		return ackhandler.StreamFrame{}, nil
+	}
+
+	frame, blocked, hasMoreData := f.popStreamFrame(entry.id, str, maxLen, v)
+	if hasMoreData {
+		queue.PushBack(entry)
+	}
+	f.lastSendWasIncremental[urgency] = true
+	return frame, blocked
+}
+
+func (f *framer) getNextNonIncrementalStreamFrame(
+	maxLen protocol.ByteCount,
+	urgency int8,
+	v protocol.Version,
+) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame) {
+	queue := &f.nonIncrementalStreams[urgency]
+	if queue.Empty() {
+		return ackhandler.StreamFrame{}, nil
+	}
+	id, queuedGeneration := queue.Peek()
+	str, ok := f.activeStreams[id]
+	if !ok {
+		queue.Pop()
+		return ackhandler.StreamFrame{}, nil
+	}
+	_, _, generation := str.priority()
+	if generation != queuedGeneration {
+		queue.Pop()
+		return ackhandler.StreamFrame{}, nil
+	}
+
+	frame, blocked, hasMoreData := f.popStreamFrame(id, str, maxLen, v)
+	if !hasMoreData {
+		queue.Pop()
+	}
+	f.lastSendWasIncremental[urgency] = false
+	return frame, blocked
+}
+
+func (f *framer) popStreamFrame(
+	id protocol.StreamID,
+	str queuedStream,
+	maxLen protocol.ByteCount,
+	v protocol.Version,
+) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+	// For the last STREAM frame, we'll remove the DataLen field later.
+	// Therefore, we can pretend to have more bytes available when popping
+	// the STREAM frame (which will always have the DataLen set).
+	maxLen += protocol.ByteCount(quicvarint.Len(uint64(maxLen)))
+	frame, blocked, hasMoreData := str.popStreamFrame(maxLen, v)
+	if !hasMoreData {
+		delete(f.activeStreams, id)
+	}
+	// Note that the frame.Frame can be nil:
+	// * if the stream was canceled after it said it had data
+	// * the remaining size doesn't allow us to add another STREAM frame
+	return frame, blocked, hasMoreData
+}
+
+func (f *framer) Handle0RTTRejection() {
+	f.mutex.Lock()
+	defer f.mutex.Unlock()
+	f.controlFrameMutex.Lock()
+	defer f.controlFrameMutex.Unlock()
+
+	for urgency := range f.incrementalStreams {
+		f.incrementalStreams[urgency].Clear()
+		f.nonIncrementalStreams[urgency].Clear()
+		f.lastSendWasIncremental[urgency] = false
+		f.retransmissionQueue[urgency].Clear()
+	}
+	clear(f.activeStreams)
+	clear(f.retransmissionStreams)
+	clear(f.streamsWithControlFrames)
+
+	var j int
+	for i, frame := range f.controlFrames {
+		switch frame.(type) {
+		case *wire.MaxDataFrame, *wire.MaxStreamDataFrame, *wire.MaxStreamsFrame,
+			*wire.DataBlockedFrame, *wire.StreamDataBlockedFrame, *wire.StreamsBlockedFrame:
+			continue
+		default:
+			f.controlFrames[j] = f.controlFrames[i]
+			j++
+		}
+	}
+	f.controlFrames = slices.Delete(f.controlFrames, j, len(f.controlFrames))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/framer_test.go b/electron/native/private-transport/third_party/quic-go/framer_test.go
new file mode 100644
index 000000000..1425203b3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/framer_test.go
@@ -0,0 +1,745 @@
+package quic
+
+import (
+	"bytes"
+	"encoding/binary"
+	"math/rand/v2"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func TestFramerControlFrames(t *testing.T) {
+	pc := &wire.PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 6, 7, 8}}
+	msf := &wire.MaxStreamsFrame{MaxStreamNum: 0x1337}
+
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	require.False(t, framer.HasData())
+	framer.QueueControlFrame(pc)
+	require.True(t, framer.HasData())
+	framer.QueueControlFrame(msf)
+	frames, streamFrames, length := framer.Append(
+		[]ackhandler.Frame{{Frame: &wire.PingFrame{}}},
+		nil,
+		protocol.MaxByteCount,
+		monotime.Now(),
+		protocol.Version1,
+	)
+	require.Len(t, frames, 3)
+	require.Empty(t, streamFrames)
+	require.Contains(t, frames, ackhandler.Frame{Frame: &wire.PingFrame{}})
+	require.Contains(t, frames, ackhandler.Frame{Frame: pc})
+	require.Contains(t, frames, ackhandler.Frame{Frame: msf})
+	require.Equal(t, length, pc.Length(protocol.Version1)+msf.Length(protocol.Version1))
+	require.False(t, framer.HasData())
+}
+
+func TestFramerControlFrameSizing(t *testing.T) {
+	const maxSize = protocol.ByteCount(1000)
+	bf := &wire.DataBlockedFrame{MaximumData: 0x1337}
+	bfLen := bf.Length(protocol.Version1)
+
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	numFrames := int(maxSize / bfLen) // max number of frames that fit into maxSize
+	for i := 0; i < numFrames+1; i++ {
+		framer.QueueControlFrame(bf)
+	}
+	frames, _, length := framer.Append(nil, nil, maxSize, monotime.Now(), protocol.Version1)
+	require.Len(t, frames, numFrames)
+	require.Greater(t, length, maxSize-bfLen)
+	// now make sure that the last frame is also added
+	frames, _, length = framer.Append(nil, nil, maxSize, monotime.Now(), protocol.Version1)
+	require.Len(t, frames, 1)
+	require.Equal(t, length, bfLen)
+}
+
+func TestFramerStreamControlFrames(t *testing.T) {
+	const streamID = protocol.StreamID(10)
+	ping := &wire.PingFrame{}
+	mdf1 := &wire.MaxStreamDataFrame{StreamID: streamID, MaximumStreamData: 1337}
+	mdf2 := &wire.MaxStreamDataFrame{StreamID: streamID, MaximumStreamData: 1338}
+
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.QueueControlFrame(ping)
+	str := NewMockStreamControlFrameGetter(gomock.NewController(t))
+	framer.AddStreamWithControlFrames(streamID, str)
+	now := monotime.Now()
+	str.EXPECT().getControlFrame(now).Return(ackhandler.Frame{Frame: mdf1}, true, true)
+	str.EXPECT().getControlFrame(now).Return(ackhandler.Frame{Frame: mdf2}, true, false)
+	frames, streamFrames, l := framer.Append(nil, nil, protocol.MaxByteCount, now, protocol.Version1)
+	require.Len(t, frames, 3)
+	require.Empty(t, streamFrames)
+	require.Equal(t, mdf1, frames[0].Frame)
+	require.Equal(t, mdf2, frames[1].Frame)
+	require.Equal(t, ping, frames[2].Frame)
+	require.Equal(t, ping.Length(protocol.Version1)+mdf1.Length(protocol.Version1)+mdf2.Length(protocol.Version1), l)
+}
+
+// If there are less than 25 bytes left, no more stream-related control frames are enqueued.
+// This avoids dequeueing a frame from the stream that would be too large to fit into the packet.
+func TestFramerStreamControlFramesSizing(t *testing.T) {
+	mdf1 := &wire.MaxStreamDataFrame{MaximumStreamData: 1337}
+
+	str := NewMockStreamControlFrameGetter(gomock.NewController(t))
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.AddStreamWithControlFrames(10, str)
+	str.EXPECT().getControlFrame(gomock.Any()).Return(ackhandler.Frame{Frame: mdf1}, true, true).AnyTimes()
+	frames, _, l := framer.Append(nil, nil, 100, monotime.Now(), protocol.Version1)
+	require.Equal(t, protocol.ByteCount(len(frames))*mdf1.Length(protocol.Version1), l)
+	require.Greater(t, l, protocol.ByteCount(100-maxStreamControlFrameSize))
+	require.LessOrEqual(t, l, protocol.ByteCount(100))
+}
+
+func TestFramerStreamDataBlocked(t *testing.T) {
+	t.Run("small STREAM frame", func(t *testing.T) {
+		testFramerStreamDataBlocked(t, true)
+	})
+
+	t.Run("large STREAM frame", func(t *testing.T) {
+		testFramerStreamDataBlocked(t, false)
+	})
+}
+
+// If the stream becomes blocked on stream flow control, we attempt to pack the STREAM_DATA_BLOCKED
+// into the same packet.
+// However, there's the pathological case, where the STREAM frame and the STREAM_DATA_BLOCKED frame
+// don't fit into the same packet. In that case, the STREAM_DATA_BLOCKED frame is queued and sent
+// in the next packet.
+func testFramerStreamDataBlocked(t *testing.T, fits bool) {
+	const streamID = 5
+	str := NewMockStreamFrameGetter(gomock.NewController(t))
+	str.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.AddActiveStream(streamID, str)
+	str.EXPECT().popStreamFrame(gomock.Any(), gomock.Any()).DoAndReturn(
+		func(size protocol.ByteCount, v protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+			data := []byte("foobar")
+			if !fits {
+				// Leave 3 bytes in the packet.
+				// This is not enough to fit in the STREAM_DATA_BLOCKED frame.
+				data = make([]byte, size-3)
+			}
+			f := &wire.StreamFrame{StreamID: streamID, DataLenPresent: true, Data: data}
+			blocked := &wire.StreamDataBlockedFrame{StreamID: streamID, MaximumStreamData: f.DataLen()}
+			if !fits {
+				require.Greater(t, blocked.Length(protocol.Version1), protocol.ByteCount(3))
+			}
+			return ackhandler.StreamFrame{Frame: f}, blocked, false
+		},
+	)
+
+	const maxSize protocol.ByteCount = 1000
+	frames, streamFrames, l := framer.Append(nil, nil, maxSize, monotime.Now(), protocol.Version1)
+	require.Len(t, streamFrames, 1)
+	dataLen := streamFrames[0].Frame.DataLen()
+	if fits {
+		require.Len(t, frames, 1)
+		require.Equal(t, &wire.StreamDataBlockedFrame{StreamID: streamID, MaximumStreamData: dataLen}, frames[0].Frame)
+	} else {
+		require.Equal(t, streamFrames[0].Frame.Length(protocol.Version1), l)
+		require.Empty(t, frames)
+		frames, streamFrames, l2 := framer.Append(nil, nil, maxSize, monotime.Now(), protocol.Version1)
+		require.Greater(t, l+l2, maxSize)
+		require.Empty(t, streamFrames)
+		require.Len(t, frames, 1)
+		require.Equal(t, &wire.StreamDataBlockedFrame{StreamID: streamID, MaximumStreamData: dataLen}, frames[0].Frame)
+	}
+}
+
+func TestFramerDataBlocked(t *testing.T) {
+	t.Run("small STREAM frame", func(t *testing.T) {
+		testFramerDataBlocked(t, true)
+	})
+
+	t.Run("large STREAM frame", func(t *testing.T) {
+		testFramerDataBlocked(t, false)
+	})
+}
+
+// If the stream becomes blocked on connection flow control, we attempt to pack the
+// DATA_BLOCKED frame into the same packet.
+// However, there's the pathological case, where the STREAM frame and the DATA_BLOCKED frame
+// don't fit into the same packet. In that case, the DATA_BLOCKED frame is queued and sent
+// in the next packet.
+func testFramerDataBlocked(t *testing.T, fits bool) {
+	const streamID = 5
+	const offset = 100
+
+	fc := newConnectionFlowController(0, 0, nil, nil, nil)
+	fc.UpdateSendWindow(offset)
+	require.True(t, fc.TryAddBytesSent(offset))
+
+	str := NewMockStreamFrameGetter(gomock.NewController(t))
+	str.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	framer := newFramer(fc)
+	framer.AddActiveStream(streamID, str)
+
+	str.EXPECT().popStreamFrame(gomock.Any(), gomock.Any()).DoAndReturn(
+		func(size protocol.ByteCount, v protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+			data := []byte("foobar")
+			if !fits {
+				// Leave 2 bytes in the packet.
+				// This is not enough to fit in the DATA_BLOCKED frame.
+				data = make([]byte, size-2)
+			}
+			f := &wire.StreamFrame{StreamID: streamID, DataLenPresent: true, Data: data}
+			return ackhandler.StreamFrame{Frame: f}, nil, false
+		},
+	)
+
+	const maxSize protocol.ByteCount = 1000
+	frames, streamFrames, l := framer.Append(nil, nil, maxSize, monotime.Now(), protocol.Version1)
+	require.Len(t, streamFrames, 1)
+	if fits {
+		require.Len(t, frames, 1)
+		require.Equal(t, &wire.DataBlockedFrame{MaximumData: offset}, frames[0].Frame)
+	} else {
+		require.Equal(t, streamFrames[0].Frame.Length(protocol.Version1), l)
+		require.Empty(t, frames)
+		frames, streamFrames, l2 := framer.Append(nil, nil, maxSize, monotime.Now(), protocol.Version1)
+		require.Greater(t, l+l2, maxSize)
+		require.Empty(t, streamFrames)
+		require.Len(t, frames, 1)
+		require.Equal(t, &wire.DataBlockedFrame{MaximumData: offset}, frames[0].Frame)
+	}
+}
+
+func TestFramerDetectsFrameDoS(t *testing.T) {
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	for i := range maxControlFrames - 1 {
+		framer.QueueControlFrame(&wire.PingFrame{})
+		framer.QueueControlFrame(&wire.PingFrame{})
+		require.False(t, framer.QueuedTooManyControlFrames())
+		frames, _, _ := framer.Append([]ackhandler.Frame{}, nil, 1, monotime.Now(), protocol.Version1)
+		require.Len(t, frames, 1)
+		require.Len(t, framer.controlFrames, i+1)
+	}
+	framer.QueueControlFrame(&wire.PingFrame{})
+	require.False(t, framer.QueuedTooManyControlFrames())
+	require.Len(t, framer.controlFrames, maxControlFrames)
+	framer.QueueControlFrame(&wire.PingFrame{})
+	require.True(t, framer.QueuedTooManyControlFrames())
+	require.Len(t, framer.controlFrames, maxControlFrames)
+}
+
+func TestFramerDetectsFramePathResponseDoS(t *testing.T) {
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	var pathResponses []*wire.PathResponseFrame
+	for range 2 * maxPathResponses {
+		var f wire.PathResponseFrame
+		binary.BigEndian.PutUint64(f.Data[:], rand.Uint64())
+		pathResponses = append(pathResponses, &f)
+		framer.QueueControlFrame(&f)
+	}
+	for i := range maxPathResponses {
+		require.True(t, framer.HasData())
+		frames, _, length := framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+		require.Len(t, frames, 1)
+		require.Equal(t, pathResponses[i], frames[0].Frame)
+		require.Equal(t, pathResponses[i].Length(protocol.Version1), length)
+	}
+	require.False(t, framer.HasData())
+	frames, _, length := framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Empty(t, frames)
+	require.Zero(t, length)
+}
+
+func TestFramerPacksSinglePathResponsePerPacket(t *testing.T) {
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	f1 := &wire.PathResponseFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}}
+	f2 := &wire.PathResponseFrame{Data: [8]byte{2, 3, 4, 5, 6, 7, 8, 9}}
+	cf1 := &wire.DataBlockedFrame{MaximumData: 1337}
+	cf2 := &wire.HandshakeDoneFrame{}
+	framer.QueueControlFrame(f1)
+	framer.QueueControlFrame(f2)
+	framer.QueueControlFrame(cf1)
+	framer.QueueControlFrame(cf2)
+	// the first packet should contain a single PATH_RESPONSE frame, but all the other control frames
+	frames, _, _ := framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Len(t, frames, 3)
+	require.Equal(t, f1, frames[0].Frame)
+	require.Contains(t, []wire.Frame{frames[1].Frame, frames[2].Frame}, cf1)
+	require.Contains(t, []wire.Frame{frames[1].Frame, frames[2].Frame}, cf2)
+	// the second packet should contain the other PATH_RESPONSE frame
+	require.True(t, framer.HasData())
+	frames, _, _ = framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Len(t, frames, 1)
+	require.Equal(t, f2, frames[0].Frame)
+	require.False(t, framer.HasData())
+}
+
+func TestFramerAppendStreamFrames(t *testing.T) {
+	const (
+		str1ID = protocol.StreamID(42)
+		str2ID = protocol.StreamID(43)
+	)
+	f1 := &wire.StreamFrame{StreamID: str1ID, Data: []byte("foo"), DataLenPresent: true}
+	f2 := &wire.StreamFrame{StreamID: str2ID, Data: []byte("bar"), DataLenPresent: true}
+	totalLen := f1.Length(protocol.Version1) + f2.Length(protocol.Version1)
+
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	require.False(t, framer.HasData())
+	// no frames added yet
+	controlFrames, fs, length := framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Empty(t, controlFrames)
+	require.Empty(t, fs)
+	require.Zero(t, length)
+
+	// add two streams
+	mockCtrl := gomock.NewController(t)
+	str1 := NewMockStreamFrameGetter(mockCtrl)
+	str1.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	str1.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{Frame: f1}, nil, true)
+	str2 := NewMockStreamFrameGetter(mockCtrl)
+	str2.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	str2.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{Frame: f2}, nil, false)
+	framer.AddActiveStream(str1ID, str1)
+	framer.AddActiveStream(str1ID, str1) // duplicate calls are ok (they're no-ops)
+	framer.AddActiveStream(str2ID, str2)
+	require.True(t, framer.HasData())
+
+	// Even though the first stream claimed to have more data,
+	// we only dequeue a single STREAM frame per call of AppendStreamFrames.
+	f0 := ackhandler.StreamFrame{Frame: &wire.StreamFrame{StreamID: 9999}}
+	controlFrames, fs, length = framer.Append([]ackhandler.Frame{}, []ackhandler.StreamFrame{f0}, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Empty(t, controlFrames)
+	require.Len(t, fs, 3)
+	require.Equal(t, f0, fs[0])
+	require.Equal(t, str1ID, fs[1].Frame.StreamID)
+	require.Equal(t, []byte("foo"), fs[1].Frame.Data)
+	// since two STREAM frames are sent, the DataLenPresent flag is set on the first frame
+	require.True(t, fs[1].Frame.DataLenPresent)
+	require.Equal(t, str2ID, fs[2].Frame.StreamID)
+	require.Equal(t, []byte("bar"), fs[2].Frame.Data)
+	// the last frame doesn't have the DataLenPresent flag set
+	require.False(t, fs[2].Frame.DataLenPresent)
+	require.Equal(t, fs[1].Frame.Length(protocol.Version1)+fs[2].Frame.Length(protocol.Version1), length)
+	require.Less(t, length, totalLen) // unsetting DataLenPresent on the last frame reduces the length
+	require.True(t, framer.HasData()) // the stream claimed to have more data...
+
+	// ... but it actually doesn't
+	str1.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{}, nil, false)
+	_, fs, length = framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Empty(t, fs)
+	require.Zero(t, length)
+	require.False(t, framer.HasData())
+}
+
+func TestFramerPrioritizesStreamRetransmissions(t *testing.T) {
+	const (
+		newDataStreamID       = protocol.StreamID(1)
+		firstRetransStreamID  = protocol.StreamID(4)
+		secondRetransStreamID = protocol.StreamID(8)
+	)
+	newDataStr := NewMockStreamFrameGetter(gomock.NewController(t))
+	newDataStr.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	str1 := NewMockStreamFrameGetter(gomock.NewController(t))
+	str1.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	str2 := NewMockStreamFrameGetter(gomock.NewController(t))
+	str2.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	firstRetransmission := &wire.StreamFrame{StreamID: firstRetransStreamID, Data: []byte("first"), DataLenPresent: true}
+	secondRetransmission := &wire.StreamFrame{StreamID: secondRetransStreamID, Data: []byte("second"), DataLenPresent: true}
+	thirdRetransmission := &wire.StreamFrame{StreamID: secondRetransStreamID, Offset: 6, Data: []byte("third"), DataLenPresent: true}
+	newData := &wire.StreamFrame{StreamID: newDataStreamID, Data: []byte("new"), DataLenPresent: true}
+
+	str1.EXPECT().popRetransmissionFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{Frame: firstRetransmission}, false)
+	str2.EXPECT().popRetransmissionFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{Frame: secondRetransmission}, true)
+	str2.EXPECT().popRetransmissionFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{Frame: thirdRetransmission}, false)
+	newDataStr.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{Frame: newData}, nil, false)
+
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	require.False(t, framer.HasData())
+	framer.AddStreamWithRetransmission(secondRetransStreamID, str2)
+	require.True(t, framer.HasData())
+	framer.AddStreamWithRetransmission(secondRetransStreamID, str2) // duplicate calls are no-ops
+	framer.AddActiveStream(newDataStreamID, newDataStr)
+	framer.AddStreamWithRetransmission(firstRetransStreamID, str1)
+
+	_, fs, _ := framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Len(t, fs, 4)
+	require.Equal(t,
+		[]protocol.StreamID{secondRetransStreamID, secondRetransStreamID, firstRetransStreamID, newDataStreamID},
+		[]protocol.StreamID{fs[0].Frame.StreamID, fs[1].Frame.StreamID, fs[2].Frame.StreamID, fs[3].Frame.StreamID},
+	)
+	require.False(t, framer.HasData())
+}
+
+func TestFramerSplitsStreamRetransmissions(t *testing.T) {
+	const (
+		firstStreamID  = protocol.StreamID(4)
+		secondStreamID = protocol.StreamID(8)
+		maxLen         = protocol.ByteCount(1000)
+	)
+	str1 := NewMockStreamFrameGetter(gomock.NewController(t))
+	str1.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	str2 := NewMockStreamFrameGetter(gomock.NewController(t))
+	str2.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	data1 := bytes.Repeat([]byte{1}, 500)
+	data2 := bytes.Repeat([]byte{2}, 1000)
+	retransmit1 := &wire.StreamFrame{StreamID: firstStreamID, Data: data1, DataLenPresent: true}
+	retransmit2 := &wire.StreamFrame{StreamID: secondStreamID, Data: data2, DataLenPresent: true}
+
+	str1.EXPECT().popRetransmissionFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{Frame: retransmit1}, false)
+	str2.EXPECT().popRetransmissionFrame(gomock.Any(), protocol.Version1).DoAndReturn(func(maxSize protocol.ByteCount, v protocol.Version) (ackhandler.StreamFrame, bool) {
+		f, split := retransmit2.MaybeSplitOffFrame(maxSize, v)
+		require.True(t, split)
+		return ackhandler.StreamFrame{Frame: f}, true
+	})
+	str2.EXPECT().popRetransmissionFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{Frame: retransmit2}, false)
+
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.AddStreamWithRetransmission(firstStreamID, str1)
+	framer.AddStreamWithRetransmission(secondStreamID, str2)
+
+	_, fs, length := framer.Append(nil, nil, maxLen, monotime.Now(), protocol.Version1)
+	require.Equal(t, maxLen, length)
+	require.Len(t, fs, 2)
+	require.Equal(t, firstStreamID, fs[0].Frame.StreamID)
+	require.Len(t, fs[0].Frame.Data, len(data1))
+	require.Equal(t, secondStreamID, fs[1].Frame.StreamID)
+	require.Equal(t, protocol.ByteCount(0), fs[1].Frame.Offset)
+	firstPartLen := len(fs[1].Frame.Data)
+	require.Less(t, firstPartLen, len(data2))
+	require.True(t, framer.HasData())
+
+	_, fs, _ = framer.Append(nil, nil, maxLen, monotime.Now(), protocol.Version1)
+	require.Len(t, fs, 1)
+	require.Equal(t, secondStreamID, fs[0].Frame.StreamID)
+	require.Equal(t, protocol.ByteCount(firstPartLen), fs[0].Frame.Offset)
+	require.Len(t, fs[0].Frame.Data, len(data2)-firstPartLen)
+	require.False(t, framer.HasData())
+}
+
+// newMockPriorityStream creates a mock stream that produces packet-sized frames at the given priority
+func newMockPriorityStream(t *testing.T, id protocol.StreamID, urgency int8, incremental bool, numFrames int) *MockStreamFrameGetter {
+	t.Helper()
+
+	str := NewMockStreamFrameGetter(gomock.NewController(t))
+	str.EXPECT().priority().Return(urgency, incremental, uint32(0)).AnyTimes()
+	remaining := numFrames
+	str.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).DoAndReturn(
+		func(_ protocol.ByteCount, v protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+			frame := &wire.StreamFrame{StreamID: id, DataLenPresent: true}
+			frame.Data = make([]byte, frame.MaxDataLen(protocol.MinStreamFrameSize, v))
+			remaining--
+			return ackhandler.StreamFrame{Frame: frame}, nil, remaining > 0
+		},
+	).Times(numFrames)
+	return str
+}
+
+// appendPriorityPackets appends one STREAM frame per packet and returns their stream IDs.
+func appendPriorityPackets(t *testing.T, framer *framer, numPackets int) []protocol.StreamID {
+	t.Helper()
+
+	ids := make([]protocol.StreamID, 0, numPackets)
+	for range numPackets {
+		_, frames, _ := framer.Append(nil, nil, protocol.MinStreamFrameSize, monotime.Now(), protocol.Version1)
+		require.Len(t, frames, 1)
+		ids = append(ids, frames[0].Frame.StreamID)
+	}
+	return ids
+}
+
+func TestFramerSchedulesIncrementalStreams(t *testing.T) {
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.AddActiveStream(8, newMockPriorityStream(t, 8, 0, true, 3))
+	framer.AddActiveStream(0, newMockPriorityStream(t, 0, 1, true, 1))
+	framer.AddActiveStream(4, newMockPriorityStream(t, 4, 0, true, 2))
+
+	require.Equal(t,
+		[]protocol.StreamID{8, 4, 8, 4, 8, 0},
+		appendPriorityPackets(t, framer, 6),
+	)
+	require.False(t, framer.HasData())
+}
+
+func TestFramerSchedulesNonIncrementalStreams(t *testing.T) {
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.AddActiveStream(8, newMockPriorityStream(t, 8, 0, false, 2))
+	framer.AddActiveStream(0, newMockPriorityStream(t, 0, 1, false, 1))
+	framer.AddActiveStream(4, newMockPriorityStream(t, 4, 0, false, 3))
+
+	require.Equal(t,
+		[]protocol.StreamID{4, 4, 4, 8, 8, 0},
+		appendPriorityPackets(t, framer, 6),
+	)
+	require.False(t, framer.HasData())
+}
+
+func TestFramerSchedulesReprioritizedStream(t *testing.T) {
+	const updatedStreamID = protocol.StreamID(8)
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.AddActiveStream(4, newMockPriorityStream(t, 4, 1, true, 1))
+	framer.AddActiveStream(12, newMockPriorityStream(t, 12, 2, true, 1))
+
+	// stream 8 starts at urgency 0 with enough data for two packets
+	updatedStr := NewMockStreamFrameGetter(gomock.NewController(t))
+	gomock.InOrder(
+		updatedStr.EXPECT().priority().Return(0, true, 0).Times(2),
+		updatedStr.EXPECT().priority().Return(2, false, 1).Times(3),
+	)
+	remaining := 2
+	updatedStr.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).DoAndReturn(
+		func(_ protocol.ByteCount, v protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+			frame := &wire.StreamFrame{StreamID: updatedStreamID, DataLenPresent: true}
+			frame.Data = make([]byte, frame.MaxDataLen(protocol.MinStreamFrameSize, v))
+			remaining--
+			return ackhandler.StreamFrame{Frame: frame}, nil, remaining > 0
+		},
+	).Times(2)
+	framer.AddActiveStream(updatedStreamID, updatedStr)
+
+	// the first packet contains stream 8 and leaves it queued at urgency 0
+	ids := appendPriorityPackets(t, framer, 1)
+	// lower stream 8 to urgency 2 and make it non-incremental, leaving its old queue entry stale
+	framer.UpdateStreamPriority(updatedStreamID)
+	ids = append(ids, appendPriorityPackets(t, framer, 3)...)
+
+	// the stale entry is skipped, so stream 4 runs next; without the update, stream 8 would run next
+	// at urgency 2, incremental stream 12 is scheduled before non-incremental stream 8
+	require.Equal(t, []protocol.StreamID{8, 4, 12, 8}, ids)
+	require.False(t, framer.HasData())
+}
+
+func TestFramerAlternatesIncrementalAndNonIncrementalStreams(t *testing.T) {
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.AddActiveStream(8, newMockPriorityStream(t, 8, 0, true, 2))
+	framer.AddActiveStream(4, newMockPriorityStream(t, 4, 0, false, 3))
+	framer.AddActiveStream(12, newMockPriorityStream(t, 12, 0, true, 1))
+
+	// incremental streams 8 and 12 round-robin while stream 4 gets every non-incremental turn
+	require.Equal(t,
+		[]protocol.StreamID{8, 4, 12, 4, 8, 4},
+		appendPriorityPackets(t, framer, 6),
+	)
+	require.False(t, framer.HasData())
+}
+
+func TestFramerRequeuesRetransmissionAfterPriorityChange(t *testing.T) {
+	const streamID = protocol.StreamID(4)
+	urgency := int8(3)
+	str := NewMockStreamFrameGetter(gomock.NewController(t))
+	str.EXPECT().priority().DoAndReturn(func() (int8, bool, uint32) {
+		return urgency, true, 0
+	}).AnyTimes()
+	str.EXPECT().popRetransmissionFrame(gomock.Any(), protocol.Version1).Return(
+		ackhandler.StreamFrame{Frame: &wire.StreamFrame{StreamID: streamID}}, false,
+	)
+
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.AddStreamWithRetransmission(streamID, str)
+	urgency = 2
+	_, frames, _ := framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Empty(t, frames)
+	require.True(t, framer.HasData())
+
+	_, frames, _ = framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Len(t, frames, 1)
+	require.Equal(t, streamID, frames[0].Frame.StreamID)
+	require.False(t, framer.HasData())
+}
+
+func TestFramerUpdatesStreamRetransmissionPriority(t *testing.T) {
+	const (
+		updatedStreamID = protocol.StreamID(4)
+		otherStreamID   = protocol.StreamID(8)
+	)
+	urgency := int8(0)
+	updatedStr := NewMockStreamFrameGetter(gomock.NewController(t))
+	updatedStr.EXPECT().priority().DoAndReturn(func() (int8, bool, uint32) {
+		return urgency, true, 0
+	}).AnyTimes()
+	otherStr := NewMockStreamFrameGetter(gomock.NewController(t))
+	otherStr.EXPECT().priority().Return(int8(1), true, uint32(0)).AnyTimes()
+	updatedStr.EXPECT().popRetransmissionFrame(gomock.Any(), protocol.Version1).Return(
+		ackhandler.StreamFrame{Frame: &wire.StreamFrame{StreamID: updatedStreamID}}, false,
+	)
+	otherStr.EXPECT().popRetransmissionFrame(gomock.Any(), protocol.Version1).Return(
+		ackhandler.StreamFrame{Frame: &wire.StreamFrame{StreamID: otherStreamID}}, false,
+	)
+
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.AddStreamWithRetransmission(updatedStreamID, updatedStr)
+	framer.AddStreamWithRetransmission(otherStreamID, otherStr)
+	urgency = 2
+	_, frames, _ := framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Len(t, frames, 2)
+	require.Equal(t, otherStreamID, frames[0].Frame.StreamID)
+	require.Equal(t, updatedStreamID, frames[1].Frame.StreamID)
+}
+
+func TestFramerRemoveActiveStream(t *testing.T) {
+	t.Run("incremental", func(t *testing.T) {
+		testFramerRemoveActiveStream(t, true)
+	})
+	t.Run("non-incremental", func(t *testing.T) {
+		testFramerRemoveActiveStream(t, false)
+	})
+}
+
+// testFramerRemoveActiveStream verifies that queued data is discarded when a stream is removed.
+func testFramerRemoveActiveStream(t *testing.T, incremental bool) {
+	const id = protocol.StreamID(42)
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	require.False(t, framer.HasData())
+	str := NewMockStreamFrameGetter(gomock.NewController(t))
+	str.EXPECT().priority().Return(defaultUrgency, incremental, uint32(0)).AnyTimes()
+	framer.AddActiveStream(id, str)
+	framer.AddStreamWithRetransmission(id, str)
+	require.True(t, framer.HasData())
+	framer.RemoveActiveStream(id) // no calls will be issued to the mock stream
+	// we can't assert on framer.HasData here, since it's not removed from the scheduling queue
+	_, frames, _ := framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Empty(t, frames)
+	require.False(t, framer.HasData())
+}
+
+func TestFramerMinStreamFrameSize(t *testing.T) {
+	const id = protocol.StreamID(42)
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	str := NewMockStreamFrameGetter(gomock.NewController(t))
+	str.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	framer.AddActiveStream(id, str)
+
+	require.True(t, framer.HasData())
+	// don't pop frames smaller than the minimum STREAM frame size
+	_, frames, _ := framer.Append(nil, nil, protocol.MinStreamFrameSize-1, monotime.Now(), protocol.Version1)
+	require.Empty(t, frames)
+
+	// pop frames of the minimum size
+	str.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).DoAndReturn(
+		func(size protocol.ByteCount, v protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+			f := &wire.StreamFrame{StreamID: id, DataLenPresent: true}
+			f.Data = make([]byte, f.MaxDataLen(protocol.MinStreamFrameSize, v))
+			return ackhandler.StreamFrame{Frame: f}, nil, false
+		},
+	)
+	_, frames, _ = framer.Append(nil, nil, protocol.MinStreamFrameSize, monotime.Now(), protocol.Version1)
+	require.Len(t, frames, 1)
+	// unsetting DataLenPresent on the last frame reduced the size slightly beyond the minimum size
+	require.Equal(t, protocol.MinStreamFrameSize-2, frames[0].Frame.Length(protocol.Version1))
+}
+
+func TestFramerMinStreamFrameSizeMultipleStreamFrames(t *testing.T) {
+	const id = protocol.StreamID(42)
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	str := NewMockStreamFrameGetter(gomock.NewController(t))
+	str.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	framer.AddActiveStream(id, str)
+
+	// pop a frame such that the remaining size is one byte less than the minimum STREAM frame size
+	f := &wire.StreamFrame{
+		StreamID:       id,
+		Data:           bytes.Repeat([]byte("f"), int(500-protocol.MinStreamFrameSize)),
+		DataLenPresent: true,
+	}
+	str.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).Return(ackhandler.StreamFrame{Frame: f}, nil, false)
+	framer.AddActiveStream(id, str)
+	_, fs, length := framer.Append(nil, nil, 500, monotime.Now(), protocol.Version1)
+	require.Len(t, fs, 1)
+	require.Equal(t, f, fs[0].Frame)
+	require.Equal(t, f.Length(protocol.Version1), length)
+}
+
+func TestFramerFillPacketOneStream(t *testing.T) {
+	const id = protocol.StreamID(42)
+	str := NewMockStreamFrameGetter(gomock.NewController(t))
+	str.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+
+	for i := protocol.MinStreamFrameSize; i < 2000; i++ {
+		str.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).DoAndReturn(
+			func(size protocol.ByteCount, v protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+				f := &wire.StreamFrame{
+					StreamID:       id,
+					DataLenPresent: true,
+				}
+				f.Data = make([]byte, f.MaxDataLen(size, v))
+				require.Equal(t, size, f.Length(protocol.Version1))
+				return ackhandler.StreamFrame{Frame: f}, nil, false
+			},
+		)
+		framer.AddActiveStream(id, str)
+		_, frames, _ := framer.Append(nil, nil, i, monotime.Now(), protocol.Version1)
+		require.Len(t, frames, 1)
+		require.False(t, frames[0].Frame.DataLenPresent)
+		// make sure the entire space was filled up
+		require.Equal(t, i, frames[0].Frame.Length(protocol.Version1))
+	}
+}
+
+func TestFramerFillPacketMultipleStreams(t *testing.T) {
+	const (
+		id1 = protocol.StreamID(1000)
+		id2 = protocol.StreamID(11)
+	)
+	mockCtrl := gomock.NewController(t)
+	str1 := NewMockStreamFrameGetter(mockCtrl)
+	str1.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	str2 := NewMockStreamFrameGetter(mockCtrl)
+	str2.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+
+	for i := 2 * protocol.MinStreamFrameSize; i < 2000; i++ {
+		str1.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).DoAndReturn(
+			func(size protocol.ByteCount, v protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+				f := &wire.StreamFrame{StreamID: id1, DataLenPresent: true}
+				f.Data = make([]byte, f.MaxDataLen(protocol.MinStreamFrameSize, v))
+				return ackhandler.StreamFrame{Frame: f}, nil, false
+			},
+		)
+		str2.EXPECT().popStreamFrame(gomock.Any(), protocol.Version1).DoAndReturn(
+			func(size protocol.ByteCount, v protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+				f := &wire.StreamFrame{StreamID: id2, DataLenPresent: true}
+				f.Data = make([]byte, f.MaxDataLen(size, v))
+				require.Equal(t, size, f.Length(protocol.Version1))
+				return ackhandler.StreamFrame{Frame: f}, nil, false
+			},
+		)
+		framer.AddActiveStream(id1, str1)
+		framer.AddActiveStream(id2, str2)
+		_, frames, _ := framer.Append(nil, nil, i, monotime.Now(), protocol.Version1)
+		require.Len(t, frames, 2)
+		require.True(t, frames[0].Frame.DataLenPresent)
+		require.False(t, frames[1].Frame.DataLenPresent)
+		require.Equal(t, i, frames[0].Frame.Length(protocol.Version1)+frames[1].Frame.Length(protocol.Version1))
+	}
+}
+
+func TestFramer0RTTRejection(t *testing.T) {
+	ncid := &wire.NewConnectionIDFrame{
+		SequenceNumber: 10,
+		ConnectionID:   protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+	}
+	ping := &wire.PingFrame{}
+	pc := &wire.PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 6, 7, 8}}
+
+	framer := newFramer(newConnectionFlowController(0, 0, nil, nil, nil))
+	framer.QueueControlFrame(ncid)
+	framer.QueueControlFrame(&wire.DataBlockedFrame{MaximumData: 1337})
+	framer.QueueControlFrame(&wire.StreamDataBlockedFrame{StreamID: 42, MaximumStreamData: 1337})
+	framer.QueueControlFrame(ping)
+	framer.QueueControlFrame(&wire.StreamsBlockedFrame{StreamLimit: 13})
+	framer.QueueControlFrame(pc)
+
+	str := NewMockStreamFrameGetter(gomock.NewController(t))
+	str.EXPECT().priority().Return(defaultUrgency, true, uint32(0)).AnyTimes()
+	framer.AddActiveStream(10, str)
+	framer.AddStreamWithRetransmission(10, str)
+	framer.AddStreamWithControlFrames(10, NewMockStreamControlFrameGetter(gomock.NewController(t)))
+
+	framer.Handle0RTTRejection()
+	controlFrames, streamFrames, _ := framer.Append(nil, nil, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.Empty(t, streamFrames)
+	require.Len(t, controlFrames, 3)
+	require.Contains(t, controlFrames, ackhandler.Frame{Frame: pc})
+	require.Contains(t, controlFrames, ackhandler.Frame{Frame: ping})
+	require.Contains(t, controlFrames, ackhandler.Frame{Frame: ncid})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/go.mod b/electron/native/private-transport/third_party/quic-go/go.mod
new file mode 100644
index 000000000..36fecc7a5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/go.mod
@@ -0,0 +1,27 @@
+module github.com/quic-go/quic-go
+
+go 1.26.0
+
+require (
+	github.com/quic-go/go-ossfuzz-seeds v0.1.0
+	github.com/quic-go/qpack v0.6.0
+	github.com/stretchr/testify v1.12.1
+	go.uber.org/mock v0.5.2
+	golang.org/x/crypto v0.54.0
+	golang.org/x/net v0.56.0
+	golang.org/x/sync v0.22.0
+	golang.org/x/sys v0.47.0
+)
+
+require (
+	github.com/jordanlewis/gcassert v0.0.0-20250430164644-389ef753e22e // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
+)
+
+tool (
+	github.com/jordanlewis/gcassert/cmd/gcassert
+	go.uber.org/mock/mockgen
+)
diff --git a/electron/native/private-transport/third_party/quic-go/go.sum b/electron/native/private-transport/third_party/quic-go/go.sum
new file mode 100644
index 000000000..731060113
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/go.sum
@@ -0,0 +1,84 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/jordanlewis/gcassert v0.0.0-20250430164644-389ef753e22e h1:a+PGEeXb+exwBS3NboqXHyxarD9kaboBbrSp+7GuBuc=
+github.com/jordanlewis/gcassert v0.0.0-20250430164644-389ef753e22e/go.mod h1:ZybsQk6DWyN5t7An1MuPm1gtSZ1xDaTXS9ZjIOxvQrk=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
+go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/electron/native/private-transport/third_party/quic-go/http3/README.md b/electron/native/private-transport/third_party/quic-go/http3/README.md
new file mode 100644
index 000000000..0e2ed4c5f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/README.md
@@ -0,0 +1,9 @@
+# HTTP/3
+
+[![Documentation](https://img.shields.io/badge/docs-quic--go.net-red?style=flat)](https://quic-go.net/docs/)
+[![PkgGoDev](https://pkg.go.dev/badge/github.com/quic-go/quic-go/http3)](https://pkg.go.dev/github.com/quic-go/quic-go/http3)
+
+This package implements HTTP/3 ([RFC 9114](https://datatracker.ietf.org/doc/html/rfc9114)), including QPACK ([RFC 9204](https://datatracker.ietf.org/doc/html/rfc9204)) and HTTP Datagrams ([RFC 9297](https://datatracker.ietf.org/doc/html/rfc9297)).
+It aims to provide feature parity with the standard library's HTTP/1.1 and HTTP/2 implementation.
+
+Detailed documentation can be found on [quic-go.net](https://quic-go.net/docs/).
diff --git a/electron/native/private-transport/third_party/quic-go/http3/body.go b/electron/native/private-transport/third_party/quic-go/http3/body.go
new file mode 100644
index 000000000..faf863e96
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/body.go
@@ -0,0 +1,137 @@
+package http3
+
+import (
+	"context"
+	"errors"
+	"io"
+	"sync"
+
+	"github.com/quic-go/quic-go"
+)
+
+// Settingser allows waiting for and retrieving the peer's HTTP/3 settings.
+type Settingser interface {
+	// ReceivedSettings returns a channel that is closed once the peer's SETTINGS frame was received.
+	// The settings can be obtained from [Settingser.Settings] after the channel is closed.
+	ReceivedSettings() <-chan struct{}
+	// Settings returns the settings received on this connection.
+	// It is only valid to call this method after the channel returned by [Settingser.ReceivedSettings] is closed.
+	Settings() *Settings
+}
+
+var errTooMuchData = errors.New("peer sent too much data")
+
+// The body is used in the requestBody (for a http.Request) and the responseBody (for a http.Response).
+type body struct {
+	str *Stream
+
+	remainingContentLength int64
+	violatedContentLength  bool
+	hasContentLength       bool
+}
+
+func newBody(str *Stream, contentLength int64) *body {
+	b := &body{str: str}
+	if contentLength >= 0 {
+		b.hasContentLength = true
+		b.remainingContentLength = contentLength
+	}
+	return b
+}
+
+func (r *body) StreamID() quic.StreamID { return r.str.StreamID() }
+
+func (r *body) checkContentLengthViolation() error {
+	if !r.hasContentLength {
+		return nil
+	}
+	if r.remainingContentLength < 0 || r.remainingContentLength == 0 && r.str.hasMoreData() {
+		if !r.violatedContentLength {
+			r.str.CancelRead(quic.StreamErrorCode(ErrCodeMessageError))
+			r.str.CancelWrite(quic.StreamErrorCode(ErrCodeMessageError))
+			r.violatedContentLength = true
+		}
+		return errTooMuchData
+	}
+	return nil
+}
+
+func (r *body) Read(b []byte) (int, error) {
+	if err := r.checkContentLengthViolation(); err != nil {
+		return 0, err
+	}
+	if r.hasContentLength {
+		b = b[:min(int64(len(b)), r.remainingContentLength)]
+	}
+	n, err := r.str.Read(b)
+	r.remainingContentLength -= int64(n)
+	if err := r.checkContentLengthViolation(); err != nil {
+		return n, err
+	}
+	return n, maybeReplaceError(err)
+}
+
+func (r *body) Close() error {
+	r.str.CancelRead(quic.StreamErrorCode(ErrCodeRequestCanceled))
+	return nil
+}
+
+type requestBody struct {
+	body
+	connCtx      context.Context
+	rcvdSettings <-chan struct{}
+	getSettings  func() *Settings
+}
+
+var _ io.ReadCloser = &requestBody{}
+
+func newRequestBody(str *Stream, contentLength int64, connCtx context.Context, rcvdSettings <-chan struct{}, getSettings func() *Settings) *requestBody {
+	return &requestBody{
+		body:         *newBody(str, contentLength),
+		connCtx:      connCtx,
+		rcvdSettings: rcvdSettings,
+		getSettings:  getSettings,
+	}
+}
+
+type hijackableBody struct {
+	body body
+
+	// only set for the http.Response
+	// The channel is closed when the user is done with this response:
+	// either when Read() errors, or when Close() is called.
+	reqDone     chan<- struct{}
+	reqDoneOnce sync.Once
+}
+
+var _ io.ReadCloser = &hijackableBody{}
+
+func newResponseBody(str *Stream, contentLength int64, done chan<- struct{}) *hijackableBody {
+	return &hijackableBody{
+		body:    *newBody(str, contentLength),
+		reqDone: done,
+	}
+}
+
+func (r *hijackableBody) Read(b []byte) (int, error) {
+	n, err := r.body.Read(b)
+	if err != nil {
+		r.requestDone()
+	}
+	return n, maybeReplaceError(err)
+}
+
+func (r *hijackableBody) requestDone() {
+	if r.reqDone != nil {
+		r.reqDoneOnce.Do(func() {
+			close(r.reqDone)
+		})
+	}
+}
+
+func (r *hijackableBody) Close() error {
+	r.requestDone()
+	// If the EOF was read, CancelRead() is a no-op.
+	r.body.str.CancelRead(quic.StreamErrorCode(ErrCodeRequestCanceled))
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/body_test.go b/electron/native/private-transport/third_party/quic-go/http3/body_test.go
new file mode 100644
index 000000000..252a28839
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/body_test.go
@@ -0,0 +1,140 @@
+package http3
+
+import (
+	"bytes"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func TestResponseBodyReading(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	var buf bytes.Buffer
+	buf.Write(getDataFrame([]byte("foobar")))
+	str := NewMockDatagramStream(mockCtrl)
+	str.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	str.EXPECT().Read(gomock.Any()).DoAndReturn(buf.Read).AnyTimes()
+	reqDone := make(chan struct{})
+	rb := newResponseBody(
+		newStream(str, nil, nil, func(io.Reader, *headersFrame) error { return nil }, nil),
+		-1,
+		reqDone,
+	)
+
+	data, err := io.ReadAll(rb)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), data)
+}
+
+func TestResponseBodyReadError(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	str := NewMockDatagramStream(mockCtrl)
+	str.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	str.EXPECT().Read(gomock.Any()).Return(0, assert.AnError).Times(2)
+	reqDone := make(chan struct{})
+	rb := newResponseBody(
+		newStream(str, nil, nil, func(io.Reader, *headersFrame) error { return nil }, nil),
+		-1,
+		reqDone,
+	)
+
+	_, err := rb.Read([]byte{0})
+	require.ErrorIs(t, err, assert.AnError)
+	// repeated calls to Read should return the same error
+	_, err = rb.Read([]byte{0})
+	require.ErrorIs(t, err, assert.AnError)
+	select {
+	case <-reqDone:
+	default:
+		t.Fatal("reqDone should be closed")
+	}
+}
+
+func TestResponseBodyClose(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	str := NewMockDatagramStream(mockCtrl)
+	str.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	str.EXPECT().CancelRead(quic.StreamErrorCode(ErrCodeRequestCanceled)).Times(2)
+	reqDone := make(chan struct{})
+	rb := newResponseBody(
+		newStream(str, nil, nil, func(io.Reader, *headersFrame) error { return nil }, nil),
+		-1,
+		reqDone,
+	)
+	require.NoError(t, rb.Close())
+	select {
+	case <-reqDone:
+	default:
+		t.Fatal("reqDone should be closed")
+	}
+
+	// multiple calls to Close should be a no-op
+	require.NoError(t, rb.Close())
+}
+
+func TestResponseBodyConcurrentClose(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	str := NewMockDatagramStream(mockCtrl)
+	str.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	str.EXPECT().CancelRead(quic.StreamErrorCode(ErrCodeRequestCanceled)).MaxTimes(3)
+	reqDone := make(chan struct{})
+	rb := newResponseBody(
+		newStream(str, nil, nil, func(io.Reader, *headersFrame) error { return nil }, nil),
+		-1,
+		reqDone,
+	)
+
+	for range 3 {
+		go rb.Close()
+	}
+	select {
+	case <-reqDone:
+	case <-time.After(time.Second):
+		t.Fatal("reqDone should be closed")
+	}
+}
+
+func TestResponseBodyLengthLimiting(t *testing.T) {
+	t.Run("along frame boundary", func(t *testing.T) {
+		testResponseBodyLengthLimiting(t, true)
+	})
+
+	t.Run("in the middle of a frame", func(t *testing.T) {
+		testResponseBodyLengthLimiting(t, false)
+	})
+}
+
+func testResponseBodyLengthLimiting(t *testing.T, alongFrameBoundary bool) {
+	var buf bytes.Buffer
+	buf.Write(getDataFrame([]byte("foo")))
+	buf.Write(getDataFrame([]byte("bar")))
+
+	l := int64(4)
+	if alongFrameBoundary {
+		l = 3
+	}
+	mockCtrl := gomock.NewController(t)
+	str := NewMockDatagramStream(mockCtrl)
+	str.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	str.EXPECT().CancelRead(quic.StreamErrorCode(ErrCodeMessageError))
+	str.EXPECT().CancelWrite(quic.StreamErrorCode(ErrCodeMessageError))
+	str.EXPECT().Read(gomock.Any()).DoAndReturn(buf.Read).AnyTimes()
+	rb := newResponseBody(
+		newStream(str, nil, nil, func(io.Reader, *headersFrame) error { return nil }, nil),
+		l,
+		make(chan struct{}),
+	)
+	data, err := io.ReadAll(rb)
+	require.Equal(t, []byte("foobar")[:l], data)
+	require.ErrorIs(t, err, errTooMuchData)
+	// check that repeated calls to Read also return the right error
+	n, err := rb.Read([]byte{0})
+	require.Zero(t, n)
+	require.ErrorIs(t, err, errTooMuchData)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/capsule.go b/electron/native/private-transport/third_party/quic-go/http3/capsule.go
new file mode 100644
index 000000000..4c5643631
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/capsule.go
@@ -0,0 +1,148 @@
+package http3
+
+import (
+	"errors"
+	"io"
+
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// CapsuleType is the type of the capsule
+type CapsuleType uint64
+
+// CapsuleProtocolHeader is the header value used to advertise support for the capsule protocol
+const CapsuleProtocolHeader = "Capsule-Protocol"
+
+type noCopy struct{}
+
+func (*noCopy) Lock()   {}
+func (*noCopy) Unlock() {}
+
+// CapsuleParser parses a sequence of capsules.
+// A capsule's contents must be fully consumed or discarded before calling [CapsuleParser.Next] again.
+type CapsuleParser struct {
+	noCopy noCopy
+
+	r quicvarint.Reader
+
+	generation uint64
+	remaining  uint64
+}
+
+// NewCapsuleParser creates a parser that reads capsules from r.
+func NewCapsuleParser(r io.Reader) *CapsuleParser {
+	return &CapsuleParser{r: quicvarint.NewReader(r)}
+}
+
+var (
+	errReaderInvalid      = errors.New("http3: capsule reader is no longer valid")
+	errCapsuleNotConsumed = errors.New("http3: previous capsule was not fully consumed")
+)
+
+// Next returns the type and contents of the next capsule.
+// The previous capsule's contents must be fully consumed or discarded before calling this method again.
+func (p *CapsuleParser) Next() (CapsuleType, CapsuleReader, error) {
+	if p.remaining > 0 {
+		return 0, CapsuleReader{}, errCapsuleNotConsumed
+	}
+
+	r := &countingByteReader{Reader: p.r}
+	ct, err := quicvarint.Read(r)
+	if err != nil {
+		// If an io.EOF is returned without consuming any bytes, return it unmodified.
+		// Otherwise, return an io.ErrUnexpectedEOF.
+		if err == io.EOF && r.NumRead > 0 {
+			return 0, CapsuleReader{}, io.ErrUnexpectedEOF
+		}
+		return 0, CapsuleReader{}, err
+	}
+	r.Reset()
+	l, err := quicvarint.Read(r)
+	if err != nil {
+		if err == io.EOF {
+			return 0, CapsuleReader{}, io.ErrUnexpectedEOF
+		}
+		return 0, CapsuleReader{}, err
+	}
+
+	p.generation++
+	p.remaining = l
+	return CapsuleType(ct), CapsuleReader{parser: p, generation: p.generation}, nil
+}
+
+// CapsuleReader reads the contents of a capsule.
+// It becomes invalid after [CapsuleParser.Next] successfully advances to the next capsule.
+type CapsuleReader struct {
+	parser     *CapsuleParser
+	generation uint64
+}
+
+var _ quicvarint.Reader = CapsuleReader{}
+
+// valid reports whether the reader still refers to the parser's current capsule.
+func (r CapsuleReader) valid() bool {
+	return r.parser != nil && r.generation == r.parser.generation
+}
+
+// Read reads from the capsule contents.
+func (r CapsuleReader) Read(b []byte) (int, error) {
+	if !r.valid() {
+		return 0, errReaderInvalid
+	}
+	if r.parser.remaining == 0 {
+		return 0, io.EOF
+	}
+	if uint64(len(b)) > r.parser.remaining {
+		b = b[:r.parser.remaining]
+	}
+	n, err := r.parser.r.Read(b)
+	r.parser.remaining -= uint64(n)
+	if err == io.EOF && r.parser.remaining > 0 {
+		return n, io.ErrUnexpectedEOF
+	}
+	return n, err
+}
+
+// ReadByte reads one byte from the capsule contents.
+func (r CapsuleReader) ReadByte() (byte, error) {
+	if !r.valid() {
+		return 0, errReaderInvalid
+	}
+	if r.parser.remaining == 0 {
+		return 0, io.EOF
+	}
+	b, err := r.parser.r.ReadByte()
+	if err == io.EOF {
+		return 0, io.ErrUnexpectedEOF
+	}
+	if err == nil {
+		r.parser.remaining--
+	}
+	return b, err
+}
+
+// Remaining returns the number of bytes remaining in the capsule.
+func (r CapsuleReader) Remaining() int64 {
+	if !r.valid() {
+		return 0
+	}
+	return int64(r.parser.remaining)
+}
+
+// Discard consumes the remaining capsule contents.
+func (r CapsuleReader) Discard() error {
+	_, err := io.Copy(io.Discard, r)
+	return err
+}
+
+// WriteCapsule writes a capsule
+func WriteCapsule(w quicvarint.Writer, ct CapsuleType, value []byte) error {
+	b := make([]byte, 0, 16)
+	b = quicvarint.Append(b, uint64(ct))
+	b = quicvarint.Append(b, uint64(len(value)))
+	if _, err := w.Write(b); err != nil {
+		return err
+	}
+	_, err := w.Write(value)
+	return err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/capsule_test.go b/electron/native/private-transport/third_party/quic-go/http3/capsule_test.go
new file mode 100644
index 000000000..1b2a34f42
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/capsule_test.go
@@ -0,0 +1,163 @@
+package http3
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCapsuleParsing(t *testing.T) {
+	b := quicvarint.Append(nil, 1337)
+	b = quicvarint.Append(b, 6)
+	b = append(b, []byte("foobar")...)
+
+	p := NewCapsuleParser(bytes.NewReader(b))
+	ct, r, err := p.Next()
+	require.NoError(t, err)
+	require.Equal(t, CapsuleType(1337), ct)
+	require.Equal(t, int64(6), r.Remaining())
+	buf := make([]byte, 3)
+	n, err := r.Read(buf)
+	require.NoError(t, err)
+	require.Equal(t, 3, n)
+	require.Equal(t, []byte("foo"), buf)
+	require.Equal(t, int64(3), r.Remaining())
+	data, err := io.ReadAll(r) // reads until EOF
+	require.NoError(t, err)
+	require.Equal(t, []byte("bar"), data)
+	require.Zero(t, r.Remaining())
+	_, _, err = p.Next()
+	require.ErrorIs(t, err, io.EOF)
+}
+
+func TestEmptyCapsuleParsing(t *testing.T) {
+	b := quicvarint.Append(nil, 1337)
+	b = quicvarint.Append(b, 0)
+	// Capsule content is empty.
+
+	p := NewCapsuleParser(bytes.NewReader(b))
+	ct, r, err := p.Next()
+	require.NoError(t, err)
+	require.Equal(t, CapsuleType(1337), ct)
+	data, err := io.ReadAll(r) // reads until EOF
+	require.NoError(t, err)
+	require.Equal(t, []byte{}, data)
+}
+
+// test EOF vs ErrUnexpectedEOF
+func TestCapsuleTruncation(t *testing.T) {
+	t.Run("with content", func(t *testing.T) {
+		b := quicvarint.Append(nil, 1337)
+		b = quicvarint.Append(b, 6)
+		b = append(b, []byte("foobar")...)
+		testCapsuleTruncation(t, b)
+	})
+
+	t.Run("empty content", func(t *testing.T) {
+		b := quicvarint.Append(nil, 1337)
+		b = quicvarint.Append(b, 0)
+		testCapsuleTruncation(t, b)
+	})
+}
+
+func testCapsuleTruncation(t *testing.T, b []byte) {
+	for i := range b {
+		p := NewCapsuleParser(bytes.NewReader(b[:i]))
+		ct, r, err := p.Next()
+		if err != nil {
+			if i == 0 {
+				require.ErrorIs(t, err, io.EOF)
+			} else {
+				require.ErrorIs(t, err, io.ErrUnexpectedEOF)
+			}
+			continue
+		}
+		require.Equal(t, CapsuleType(1337), ct)
+		_, err = io.ReadAll(r)
+		require.ErrorIs(t, err, io.ErrUnexpectedEOF)
+	}
+}
+
+func TestCapsuleParserRequiresConsumption(t *testing.T) {
+	var buf bytes.Buffer
+	require.NoError(t, WriteCapsule(&buf, 1, []byte("first")))
+	require.NoError(t, WriteCapsule(&buf, 2, []byte("second")))
+
+	p := NewCapsuleParser(&buf)
+	_, r, err := p.Next()
+	require.NoError(t, err)
+	_, err = r.ReadByte()
+	require.NoError(t, err)
+	_, _, err = p.Next()
+	require.ErrorIs(t, err, errCapsuleNotConsumed)
+
+	require.NoError(t, r.Discard())
+	ct, next, err := p.Next()
+	require.NoError(t, err)
+	require.Equal(t, CapsuleType(2), ct)
+	data, err := io.ReadAll(next)
+	require.NoError(t, err)
+	require.Equal(t, []byte("second"), data)
+
+	_, err = r.ReadByte()
+	require.ErrorIs(t, err, errReaderInvalid)
+	_, err = r.Read(make([]byte, 1))
+	require.ErrorIs(t, err, errReaderInvalid)
+}
+
+func TestCopiedCapsuleReadersShareProgress(t *testing.T) {
+	var buf bytes.Buffer
+	require.NoError(t, WriteCapsule(&buf, 1, []byte("foobar")))
+
+	p := NewCapsuleParser(&buf)
+	_, r, err := p.Next()
+	require.NoError(t, err)
+	r2 := r
+
+	b, err := r.ReadByte()
+	require.NoError(t, err)
+	require.Equal(t, byte('f'), b)
+	require.Equal(t, int64(5), r2.Remaining())
+	data, err := io.ReadAll(r2)
+	require.NoError(t, err)
+	require.Equal(t, []byte("oobar"), data)
+	require.Zero(t, r.Remaining())
+}
+
+func TestCapsuleWriting(t *testing.T) {
+	var buf bytes.Buffer
+	require.NoError(t, WriteCapsule(&buf, 1337, []byte("foobar")))
+
+	p := NewCapsuleParser(&buf)
+	ct, r, err := p.Next()
+	require.NoError(t, err)
+	require.Equal(t, CapsuleType(1337), ct)
+	val, err := io.ReadAll(r)
+	require.NoError(t, err)
+	require.Equal(t, "foobar", string(val))
+}
+
+func TestCapsuleWriteEmpty(t *testing.T) {
+	var buf bytes.Buffer
+	require.NoError(t, WriteCapsule(&buf, 1337, []byte{}))
+	require.NoError(t, WriteCapsule(&buf, 1337, []byte{}))
+
+	p := NewCapsuleParser(&buf)
+	ct, r, err := p.Next()
+	require.NoError(t, err)
+	require.Equal(t, CapsuleType(1337), ct)
+	val, err := io.ReadAll(r)
+	require.NoError(t, err)
+	require.Empty(t, val)
+
+	ct, r, err = p.Next()
+	require.NoError(t, err)
+	require.Equal(t, CapsuleType(1337), ct)
+	val, err = io.ReadAll(r)
+	require.NoError(t, err)
+	require.Empty(t, val)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/client.go b/electron/native/private-transport/third_party/quic-go/http3/client.go
new file mode 100644
index 000000000..6820440c9
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/client.go
@@ -0,0 +1,500 @@
+package http3
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptrace"
+	"net/textproto"
+	"sync"
+	"time"
+
+	"github.com/quic-go/qpack"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+const (
+	// MethodGet0RTT allows a GET request to be sent using 0-RTT.
+	// Note that 0-RTT doesn't provide replay protection and should only be used for idempotent requests.
+	MethodGet0RTT = "GET_0RTT"
+	// MethodHead0RTT allows a HEAD request to be sent using 0-RTT.
+	// Note that 0-RTT doesn't provide replay protection and should only be used for idempotent requests.
+	MethodHead0RTT = "HEAD_0RTT"
+)
+
+const (
+	defaultUserAgent              = "quic-go HTTP/3"
+	defaultMaxResponseHeaderBytes = 10 * 1 << 20 // 10 MB
+)
+
+var errGoAway = errors.New("connection in graceful shutdown")
+
+type errConnUnusable struct{ e error }
+
+func (e *errConnUnusable) Unwrap() error { return e.e }
+func (e *errConnUnusable) Error() string { return fmt.Sprintf("http3: conn unusable: %s", e.e.Error()) }
+
+const max1xxResponses = 5 // arbitrary bound on number of informational responses
+
+var defaultQuicConfig = &quic.Config{
+	MaxIncomingStreams: -1, // don't allow the server to create bidirectional streams
+	KeepAlivePeriod:    10 * time.Second,
+}
+
+// ClientConn is an HTTP/3 client doing requests to a single remote server.
+type ClientConn struct {
+	conn    *quic.Conn
+	rawConn *rawConn
+
+	decoder *qpack.Decoder
+
+	// Additional HTTP/3 settings.
+	// It is invalid to specify any settings defined by RFC 9114 (HTTP/3) and RFC 9297 (HTTP Datagrams).
+	additionalSettings map[uint64]uint64
+
+	// maxResponseHeaderBytes specifies a limit on how many response bytes are
+	// allowed in the server's response header.
+	maxResponseHeaderBytes int
+
+	// disableCompression, if true, prevents the Transport from requesting compression with an
+	// "Accept-Encoding: gzip" request header when the Request contains no existing Accept-Encoding value.
+	// If the Transport requests gzip on its own and gets a gzipped response, it's transparently
+	// decoded in the Response.Body.
+	// However, if the user explicitly requested gzip it is not automatically uncompressed.
+	disableCompression bool
+
+	streamMx     sync.Mutex
+	maxStreamID  quic.StreamID // set once a GOAWAY frame is received
+	goAwayCtx    context.Context
+	goAwayCancel context.CancelFunc
+
+	qlogger qlogwriter.Recorder
+	logger  *slog.Logger
+
+	requestWriter *requestWriter
+}
+
+var _ http.RoundTripper = &ClientConn{}
+
+func newClientConn(
+	conn *quic.Conn,
+	enableDatagrams bool,
+	additionalSettings map[uint64]uint64,
+	maxResponseHeaderBytes int,
+	disableCompression bool,
+	logger *slog.Logger,
+) *ClientConn {
+	var qlogger qlogwriter.Recorder
+	if qlogTrace := conn.QlogTrace(); qlogTrace != nil && qlogTrace.SupportsSchemas(qlog.EventSchema) {
+		qlogger = qlogTrace.AddProducer()
+	}
+	c := &ClientConn{
+		conn:               conn,
+		additionalSettings: additionalSettings,
+		disableCompression: disableCompression,
+		maxStreamID:        invalidStreamID,
+		logger:             logger,
+		qlogger:            qlogger,
+		decoder:            qpack.NewDecoder(),
+	}
+	c.goAwayCtx, c.goAwayCancel = context.WithCancel(context.Background())
+	if maxResponseHeaderBytes <= 0 {
+		c.maxResponseHeaderBytes = defaultMaxResponseHeaderBytes
+	} else {
+		c.maxResponseHeaderBytes = maxResponseHeaderBytes
+	}
+	c.requestWriter = newRequestWriter()
+	c.rawConn = newRawConn(
+		conn,
+		enableDatagrams,
+		c.onStreamsEmpty,
+		c.handleControlStream,
+		qlogger,
+		c.logger,
+	)
+	// send the SETTINGs frame, using 0-RTT data, if possible
+	go func() {
+		_, err := c.rawConn.openControlStream(&settingsFrame{
+			Datagram:            enableDatagrams,
+			Other:               additionalSettings,
+			MaxFieldSectionSize: int64(c.maxResponseHeaderBytes),
+		})
+		if err != nil {
+			if c.logger != nil {
+				c.logger.Debug("setting up connection failed", "error", err)
+			}
+			c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeInternalError), "")
+			return
+		}
+	}()
+	return c
+}
+
+// OpenRequestStream opens a new request stream on the HTTP/3 connection.
+func (c *ClientConn) OpenRequestStream(ctx context.Context) (*RequestStream, error) {
+	return c.openRequestStream(ctx, c.requestWriter, nil, c.disableCompression, c.maxResponseHeaderBytes)
+}
+
+func (c *ClientConn) openRequestStream(
+	ctx context.Context,
+	requestWriter *requestWriter,
+	reqDone chan<- struct{},
+	disableCompression bool,
+	maxHeaderBytes int,
+) (*RequestStream, error) {
+	// RFC 9114 Section 5.2 prohibits opening any new request streams after GOAWAY.
+	// The stream ID only identifies requests that were already in flight and might still be processed.
+	if c.goAwayCtx.Err() != nil {
+		return nil, errGoAway
+	}
+
+	openCtx, cancel := context.WithCancelCause(ctx)
+	// A request blocked in OpenStreamSync has no request stream yet, so it is not in flight.
+	stop := context.AfterFunc(c.goAwayCtx, func() { cancel(errGoAway) })
+	str, err := c.conn.OpenStreamSync(openCtx)
+	stop()
+	cancel(nil)
+	if err != nil {
+		if context.Cause(openCtx) == errGoAway {
+			return nil, errGoAway
+		}
+		return nil, err
+	}
+
+	// Check again in case GOAWAY raced with OpenStreamSync.
+	if c.goAwayCtx.Err() != nil {
+		str.CancelRead(quic.StreamErrorCode(ErrCodeRequestCanceled))
+		str.CancelWrite(quic.StreamErrorCode(ErrCodeRequestCanceled))
+		return nil, errGoAway
+	}
+
+	hstr := c.rawConn.TrackStream(str)
+	rsp := &http.Response{}
+	trace := httptrace.ContextClientTrace(ctx)
+	return newRequestStream(
+		newStream(hstr, c.rawConn, trace, func(r io.Reader, hf *headersFrame) error {
+			hdr, err := decodeTrailers(r, hf, maxHeaderBytes, c.decoder, c.qlogger, str.StreamID())
+			if err != nil {
+				return err
+			}
+			rsp.Trailer = hdr
+			return nil
+		}, c.qlogger),
+		requestWriter,
+		reqDone,
+		c.decoder,
+		disableCompression,
+		maxHeaderBytes,
+		rsp,
+	), nil
+}
+
+func (c *ClientConn) handleUnidirectionalStream(str *quic.ReceiveStream) {
+	c.rawConn.handleUnidirectionalStream(str, false)
+}
+
+func (c *ClientConn) handleControlStream(str *quic.ReceiveStream, fp *frameParser) {
+	for {
+		f, err := fp.ParseNext(c.qlogger)
+		if err != nil {
+			if errors.Is(err, errPriorityUpdateForPush) {
+				c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "")
+				return
+			}
+			_, isStreamError := errors.AsType[*quic.StreamError](err)
+			if err == io.EOF || isStreamError {
+				c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeClosedCriticalStream), "")
+				return
+			}
+			c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameError), "")
+			return
+		}
+		// GOAWAY is the only frame allowed at this point:
+		// * unexpected frames are ignored by the frame parser
+		// * we don't support any extension that might add support for more frames
+		goaway, ok := f.(*goAwayFrame)
+		if !ok {
+			c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "")
+			return
+		}
+		if goaway.StreamID%4 != 0 { // client-initiated, bidirectional streams
+			c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeIDError), "")
+			return
+		}
+		c.streamMx.Lock()
+		// the server is not allowed to increase the Stream ID in subsequent GOAWAY frames
+		if c.maxStreamID != invalidStreamID && goaway.StreamID > c.maxStreamID {
+			c.streamMx.Unlock()
+			c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeIDError), "")
+			return
+		}
+		c.maxStreamID = goaway.StreamID
+		c.goAwayCancel()
+		c.streamMx.Unlock()
+
+		hasActiveStreams := c.rawConn.hasActiveStreams()
+		// immediately close the connection if there are currently no active requests
+		if !hasActiveStreams {
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeNoError), "")
+			return
+		}
+	}
+}
+
+func (c *ClientConn) onStreamsEmpty() {
+	c.streamMx.Lock()
+	defer c.streamMx.Unlock()
+
+	// The server is performing a graceful shutdown.
+	if c.maxStreamID != invalidStreamID {
+		c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeNoError), "")
+	}
+}
+
+// RoundTrip executes a request and returns a response
+func (c *ClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
+	rsp, err := c.roundTrip(req)
+	if err != nil && req.Context().Err() != nil {
+		// if the context was canceled, return the context cancellation error
+		err = req.Context().Err()
+	}
+	return rsp, err
+}
+
+func (c *ClientConn) roundTrip(req *http.Request) (*http.Response, error) {
+	// Immediately send out this request, if this is a 0-RTT request.
+	switch req.Method {
+	case MethodGet0RTT:
+		// don't modify the original request
+		reqCopy := *req
+		req = &reqCopy
+		req.Method = http.MethodGet
+	case MethodHead0RTT:
+		// don't modify the original request
+		reqCopy := *req
+		req = &reqCopy
+		req.Method = http.MethodHead
+	default:
+		// wait for the handshake to complete
+		select {
+		case <-c.conn.HandshakeComplete():
+		case <-req.Context().Done():
+			return nil, req.Context().Err()
+		}
+	}
+
+	// It is only possible to send an Extended CONNECT request once the SETTINGS were received.
+	// See section 3 of RFC 8441.
+	if isExtendedConnectRequest(req) {
+		connCtx := c.conn.Context()
+		// wait for the server's SETTINGS frame to arrive
+		select {
+		case <-c.rawConn.ReceivedSettings():
+		case <-connCtx.Done():
+			return nil, context.Cause(connCtx)
+		}
+		if !c.rawConn.Settings().EnableExtendedConnect {
+			return nil, errors.New("http3: server didn't enable Extended CONNECT")
+		}
+	}
+
+	reqDone := make(chan struct{})
+	str, err := c.openRequestStream(
+		req.Context(),
+		c.requestWriter,
+		reqDone,
+		c.disableCompression,
+		c.maxResponseHeaderBytes,
+	)
+	if err != nil {
+		return nil, &errConnUnusable{e: err}
+	}
+
+	// Request Cancellation:
+	// This go routine keeps running even after RoundTripOpt() returns.
+	// It is shut down when the application is done processing the body.
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		select {
+		case <-req.Context().Done():
+			str.CancelWrite(quic.StreamErrorCode(ErrCodeRequestCanceled))
+			str.CancelRead(quic.StreamErrorCode(ErrCodeRequestCanceled))
+		case <-reqDone:
+		}
+	}()
+
+	rsp, err := c.doRequest(req, str)
+	if err != nil { // if any error occurred
+		close(reqDone)
+		<-done
+		return nil, maybeReplaceError(err)
+	}
+	return rsp, maybeReplaceError(err)
+}
+
+// ReceivedSettings returns a channel that is closed once the server's HTTP/3 settings were received.
+// The settings can be obtained from [ClientConn.Settings] after the channel is closed.
+func (c *ClientConn) ReceivedSettings() <-chan struct{} {
+	return c.rawConn.ReceivedSettings()
+}
+
+// Settings returns the HTTP/3 settings for this connection.
+// It is only valid to call this method after the channel returned by [ClientConn.ReceivedSettings] is closed.
+func (c *ClientConn) Settings() *Settings {
+	return c.rawConn.Settings()
+}
+
+// CloseWithError closes the connection with the given error code and message.
+// It is invalid to call this function after the connection was closed.
+func (c *ClientConn) CloseWithError(code quic.ApplicationErrorCode, msg string) error {
+	return c.conn.CloseWithError(code, msg)
+}
+
+// Context returns a context that is cancelled when the connection is closed.
+func (c *ClientConn) Context() context.Context {
+	return c.conn.Context()
+}
+
+// cancelingReader reads from the io.Reader.
+// It cancels writing on the stream if any error other than io.EOF occurs.
+type cancelingReader struct {
+	r   io.Reader
+	str *RequestStream
+}
+
+func (r *cancelingReader) Read(b []byte) (int, error) {
+	n, err := r.r.Read(b)
+	if err != nil && err != io.EOF {
+		r.str.CancelWrite(quic.StreamErrorCode(ErrCodeRequestCanceled))
+	}
+	return n, err
+}
+
+func (c *ClientConn) sendRequestBody(str *RequestStream, body io.ReadCloser, contentLength int64) error {
+	defer body.Close()
+	buf := make([]byte, bodyCopyBufferSize)
+	sr := &cancelingReader{str: str, r: body}
+	if contentLength == -1 {
+		_, err := io.CopyBuffer(str, sr, buf)
+		return err
+	}
+
+	// make sure we don't send more bytes than the content length
+	n, err := io.CopyBuffer(str, io.LimitReader(sr, contentLength), buf)
+	if err != nil {
+		return err
+	}
+	var extra int64
+	extra, err = io.CopyBuffer(io.Discard, sr, buf)
+	n += extra
+	if n > contentLength {
+		str.CancelWrite(quic.StreamErrorCode(ErrCodeRequestCanceled))
+		return fmt.Errorf("http: ContentLength=%d with Body length %d", contentLength, n)
+	}
+	return err
+}
+
+func (c *ClientConn) doRequest(req *http.Request, str *RequestStream) (*http.Response, error) {
+	trace := httptrace.ContextClientTrace(req.Context())
+	var sendingReqFailed bool
+	if err := str.sendRequestHeader(req); err != nil {
+		traceWroteRequest(trace, err)
+		if c.logger != nil {
+			c.logger.Debug("error writing request", "error", err)
+		}
+		sendingReqFailed = true
+	}
+	if !sendingReqFailed {
+		if req.Body == nil {
+			traceWroteRequest(trace, nil)
+			str.Close()
+		} else {
+			// send the request body asynchronously
+			go func() {
+				defer str.Close()
+				contentLength := int64(-1)
+				// According to the documentation for http.Request.ContentLength,
+				// a value of 0 with a non-nil Body is also treated as unknown content length.
+				if req.ContentLength > 0 {
+					contentLength = req.ContentLength
+				}
+				err := c.sendRequestBody(str, req.Body, contentLength)
+				traceWroteRequest(trace, err)
+				if err != nil {
+					if c.logger != nil {
+						c.logger.Debug("error writing request", "error", err)
+					}
+					return
+				}
+
+				if len(req.Trailer) > 0 {
+					if err := str.sendRequestTrailer(req); err != nil {
+						if c.logger != nil {
+							c.logger.Debug("error writing trailers", "error", err)
+						}
+					}
+				}
+			}()
+		}
+	}
+
+	// copy from net/http: support 1xx responses
+	var num1xx int // number of informational 1xx headers received
+	var res *http.Response
+	for {
+		var err error
+		res, err = str.ReadResponse()
+		if err != nil {
+			return nil, err
+		}
+		resCode := res.StatusCode
+		is1xx := 100 <= resCode && resCode <= 199
+		// treat 101 as a terminal status, see https://github.com/golang/go/issues/26161
+		is1xxNonTerminal := is1xx && resCode != http.StatusSwitchingProtocols
+		if is1xxNonTerminal {
+			num1xx++
+			if num1xx > max1xxResponses {
+				str.CancelRead(quic.StreamErrorCode(ErrCodeExcessiveLoad))
+				str.CancelWrite(quic.StreamErrorCode(ErrCodeExcessiveLoad))
+				return nil, errors.New("http3: too many 1xx informational responses")
+			}
+			traceGot1xxResponse(trace, resCode, textproto.MIMEHeader(res.Header))
+			if resCode == http.StatusContinue {
+				traceGot100Continue(trace)
+			}
+			continue
+		}
+		break
+	}
+	connState := c.conn.ConnectionState().TLS
+	res.TLS = &connState
+	res.Request = req
+	return res, nil
+}
+
+// RawClientConn is a low-level HTTP/3 client connection.
+// It allows the application to take control of the stream accept loops,
+// giving the application the ability to handle streams originating from the server.
+type RawClientConn struct {
+	*ClientConn
+}
+
+// HandleUnidirectionalStream handles an incoming unidirectional stream.
+func (c *RawClientConn) HandleUnidirectionalStream(str *quic.ReceiveStream) {
+	c.rawConn.handleUnidirectionalStream(str, false)
+}
+
+// HandleBidirectionalStream handles an incoming bidirectional stream.
+func (c *ClientConn) HandleBidirectionalStream(str *quic.Stream) {
+	// According to RFC 9114, the server is not allowed to open bidirectional streams.
+	c.rawConn.CloseWithError(
+		quic.ApplicationErrorCode(ErrCodeStreamCreationError),
+		fmt.Sprintf("server opened bidirectional stream %d", str.StreamID()),
+	)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/client_test.go b/electron/native/private-transport/third_party/quic-go/http3/client_test.go
new file mode 100644
index 000000000..f400c65ff
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/client_test.go
@@ -0,0 +1,897 @@
+package http3
+
+import (
+	"bytes"
+	"compress/gzip"
+	"context"
+	"io"
+	mrand "math/rand/v2"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/quic-go/qpack"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func TestClientSettings(t *testing.T) {
+	t.Run("enable datagrams", func(t *testing.T) {
+		testClientSettings(t, true, nil)
+	})
+	t.Run("additional settings", func(t *testing.T) {
+		testClientSettings(t, false, map[uint64]uint64{13: 37})
+	})
+}
+
+func testClientSettings(t *testing.T, enableDatagrams bool, other map[uint64]uint64) {
+	tr := &Transport{
+		EnableDatagrams:    enableDatagrams,
+		AdditionalSettings: other,
+	}
+
+	var eventRecorder events.Recorder
+	clientConn, serverConn := newConnPair(t, withClientRecorder(&eventRecorder))
+	tr.NewClientConn(clientConn)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err := serverConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	str.SetReadDeadline(time.Now().Add(time.Second))
+	typ, err := quicvarint.Read(quicvarint.NewReader(str))
+	require.NoError(t, err)
+	require.EqualValues(t, streamTypeControlStream, typ)
+	fp := (&frameParser{r: str})
+	f, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &settingsFrame{}, f)
+	settingsFrame := f.(*settingsFrame)
+	require.Equal(t, settingsFrame.Datagram, enableDatagrams)
+	require.Equal(t, settingsFrame.Other, other)
+
+	var datagramValue *bool
+	if enableDatagrams {
+		datagramValue = new(true)
+	}
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.FrameCreated{
+				StreamID: str.StreamID(),
+				Raw:      qlog.RawInfo{Length: 10},
+				Frame: qlog.Frame{
+					Frame: qlog.SettingsFrame{
+						MaxFieldSectionSize: defaultMaxResponseHeaderBytes,
+						Datagram:            datagramValue,
+						Other:               other,
+					},
+				},
+			},
+		},
+		filterQlogEventsForFrame(eventRecorder.Events(qlog.FrameCreated{}), qlog.SettingsFrame{}),
+	)
+}
+
+func encodeResponse(t *testing.T, status int) []byte {
+	t.Helper()
+
+	mockCtrl := gomock.NewController(t)
+	buf := &bytes.Buffer{}
+	rstr := NewMockDatagramStream(mockCtrl)
+	rstr.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	rstr.EXPECT().Write(gomock.Any()).Do(buf.Write).AnyTimes()
+	rw := newResponseWriter(newStream(rstr, nil, nil, func(io.Reader, *headersFrame) error { return nil }, nil), nil, false, nil)
+	rw.WriteHeader(status)
+	rw.Flush()
+	return buf.Bytes()
+}
+
+func TestClientRequest(t *testing.T) {
+	t.Run("GET", func(t *testing.T) {
+		rsp := testClientRequest(t, false, http.MethodGet, encodeResponse(t, http.StatusTeapot))
+		require.Equal(t, http.StatusTeapot, rsp.StatusCode)
+		require.Equal(t, "HTTP/3.0", rsp.Proto)
+		require.Equal(t, 3, rsp.ProtoMajor)
+		require.NotNil(t, rsp.Request)
+	})
+
+	t.Run("GET 0-RTT", func(t *testing.T) {
+		rsp := testClientRequest(t, true, http.MethodGet, encodeResponse(t, http.StatusOK))
+		require.Equal(t, http.StatusOK, rsp.StatusCode)
+	})
+
+	t.Run("HEAD", func(t *testing.T) {
+		rsp := testClientRequest(t, false, http.MethodHead, encodeResponse(t, http.StatusTeapot))
+		require.Equal(t, http.StatusTeapot, rsp.StatusCode)
+	})
+
+	t.Run("HEAD 0-RTT", func(t *testing.T) {
+		rsp := testClientRequest(t, true, http.MethodHead, encodeResponse(t, http.StatusOK))
+		require.Equal(t, http.StatusOK, rsp.StatusCode)
+	})
+}
+
+func testClientRequest(t *testing.T, use0RTT bool, method string, rspBytes []byte) *http.Response {
+	clientConn, serverConn := newConnPair(t)
+
+	reqMethod := method
+	if use0RTT {
+		switch method {
+		case http.MethodGet:
+			reqMethod = MethodGet0RTT
+		case http.MethodHead:
+			reqMethod = MethodHead0RTT
+		}
+	}
+	req, err := http.NewRequest(reqMethod, "http://quic-go.net", nil)
+	require.NoError(t, err)
+
+	type result struct {
+		rsp *http.Response
+		err error
+	}
+	resultChan := make(chan result, 1)
+	go func() {
+		cc := (&Transport{}).NewClientConn(clientConn)
+		rsp, err := cc.RoundTrip(req)
+		resultChan <- result{rsp: rsp, err: err}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+	str.SetReadDeadline(time.Now().Add(time.Second))
+
+	hfs := decodeHeader(t, str)
+	require.Equal(t, []string{method}, hfs[":method"])
+
+	_, err = str.Write(rspBytes)
+	require.NoError(t, err)
+
+	var res result
+	select {
+	case res = <-resultChan:
+		require.NoError(t, res.err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	// make sure the http.Request.Method value was not modified
+	if use0RTT {
+		switch reqMethod {
+		case MethodGet0RTT:
+			require.Equal(t, req.Method, MethodGet0RTT)
+		case MethodHead0RTT:
+			require.Equal(t, req.Method, MethodHead0RTT)
+		}
+	}
+	return res.rsp
+}
+
+func randomString(length int) string {
+	const alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	b := make([]byte, length)
+	for i := range b {
+		n := mrand.IntN(len(alphabet))
+		b[i] = alphabet[n]
+	}
+	return string(b)
+}
+
+func TestClientRequestError(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+
+	req, err := http.NewRequest(http.MethodGet, "http://quic-go.net", nil)
+	require.NoError(t, err)
+	for range 1000 {
+		req.Header.Add(randomString(50), randomString(50))
+	}
+
+	type result struct {
+		rsp *http.Response
+		err error
+	}
+	resultChan := make(chan result, 1)
+	go func() {
+		cc := (&Transport{}).NewClientConn(clientConn)
+		rsp, err := cc.RoundTrip(req)
+		resultChan <- result{rsp: rsp, err: err}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+	str.CancelRead(quic.StreamErrorCode(ErrCodeExcessiveLoad))
+
+	_, err = str.Write(encodeResponse(t, http.StatusTeapot))
+	require.NoError(t, err)
+
+	var res result
+	select {
+	case res = <-resultChan:
+		require.NoError(t, res.err)
+		require.Equal(t, http.StatusTeapot, res.rsp.StatusCode)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestClientResponseValidation(t *testing.T) {
+	t.Run("HEADERS frame too large", func(t *testing.T) {
+		require.ErrorContains(t,
+			testClientResponseValidation(t,
+				&Transport{MaxResponseHeaderBytes: 1337},
+				(&headersFrame{Length: 1338}).Append(nil),
+				quic.StreamErrorCode(ErrCodeFrameError),
+			),
+			"http3: HEADERS frame too large",
+		)
+	})
+
+	t.Run("invalid headers", func(t *testing.T) {
+		headerBuf := &bytes.Buffer{}
+		enc := qpack.NewEncoder(headerBuf)
+		// not a valid response pseudo header
+		require.NoError(t, enc.WriteField(qpack.HeaderField{Name: ":method", Value: "GET"}))
+		require.NoError(t, enc.Close())
+		b := (&headersFrame{Length: uint64(headerBuf.Len())}).Append(nil)
+		b = append(b, headerBuf.Bytes()...)
+
+		require.ErrorContains(t,
+			testClientResponseValidation(t, &Transport{}, b, quic.StreamErrorCode(ErrCodeMessageError)),
+			"invalid response pseudo header",
+		)
+	})
+}
+
+func testClientResponseValidation(t *testing.T, tr *Transport, rsp []byte, expectedReset quic.StreamErrorCode) error {
+	clientConn, serverConn := newConnPair(t)
+
+	cc := tr.NewClientConn(clientConn)
+	errChan := make(chan error)
+	go func() {
+		_, err := cc.RoundTrip(httptest.NewRequest(http.MethodGet, "http://quic-go.net", nil))
+		errChan <- err
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+	_, err = str.Write(rsp)
+	require.NoError(t, err)
+
+	select {
+	case err := <-errChan:
+		expectStreamWriteReset(t, str, expectedReset)
+		// The client closes the stream after sending the request,
+		// so we need to wait for the RESET_STREAM frame to be received.
+		time.Sleep(scaleDuration(10 * time.Millisecond))
+		expectStreamReadReset(t, str, expectedReset)
+		return err
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	panic("unreachable")
+}
+
+func TestClientRequestLengthLimit(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+
+	cc := (&Transport{}).NewClientConn(clientConn)
+	errChan := make(chan error)
+	body := bytes.NewBufferString("request body")
+	go func() {
+		req := httptest.NewRequest(http.MethodPost, "http://quic-go.net", body)
+		req.ContentLength = 8
+		_, err := cc.RoundTrip(req)
+		errChan <- err
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+
+	_, err = io.ReadAll(str)
+	var strErr *quic.StreamError
+	require.ErrorAs(t, err, &strErr)
+	require.Equal(t, quic.StreamErrorCode(ErrCodeRequestCanceled), strErr.ErrorCode)
+
+	_, err = str.Write(encodeResponse(t, http.StatusTeapot))
+	require.NoError(t, err)
+
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestClientExtendedConnect(t *testing.T) {
+	t.Run("enabled", func(t *testing.T) {
+		testClientExtendedConnect(t, true)
+	})
+
+	t.Run("disabled", func(t *testing.T) {
+		testClientExtendedConnect(t, false)
+	})
+}
+
+func testClientExtendedConnect(t *testing.T, enabled bool) {
+	clientConn, serverConn := newConnPair(t)
+
+	cc := (&Transport{}).NewClientConn(clientConn)
+	req, err := http.NewRequest(http.MethodConnect, "http://quic-go.net", nil)
+	require.NoError(t, err)
+	req.Proto = "connect"
+
+	errChan := make(chan error)
+	go func() {
+		_, err := cc.RoundTrip(req)
+		errChan <- err
+	}()
+
+	select {
+	case <-errChan:
+		t.Fatal("RoundTrip should have blocked until SETTINGS were received")
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	}
+
+	// now send the SETTINGS
+	settingsStr, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	settingsStr.SetWriteDeadline(time.Now().Add(time.Second))
+	settingsFrame := &settingsFrame{ExtendedConnect: enabled}
+	_, err = settingsStr.Write(settingsFrame.Append(quicvarint.Append(nil, streamTypeControlStream)))
+	require.NoError(t, err)
+
+	select {
+	case <-cc.ReceivedSettings():
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for settings")
+	}
+	settings := cc.Settings()
+	require.Equal(t, enabled, settings.EnableExtendedConnect)
+
+	if enabled {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		str, err := serverConn.AcceptStream(ctx)
+		require.NoError(t, err)
+		str.CancelRead(1337)
+		str.CancelWrite(1337)
+	}
+
+	select {
+	case err := <-errChan:
+		if enabled {
+			require.ErrorIs(t, err, &Error{Remote: true, ErrorCode: 1337})
+		} else {
+			require.EqualError(t, err, "http3: server didn't enable Extended CONNECT")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestClient1xxHandling(t *testing.T) {
+	t.Run("a few early hints", func(t *testing.T) {
+		testClient1xxHandling(t, max1xxResponses, http.StatusOK, false)
+	})
+	t.Run("too many early hints", func(t *testing.T) {
+		testClient1xxHandling(t, max1xxResponses+1, http.StatusOK, true)
+	})
+	t.Run("EarlyHints followed by StatusSwitchingProtocols", func(t *testing.T) {
+		testClient1xxHandling(t, 1, http.StatusSwitchingProtocols, false)
+	})
+}
+
+func testClient1xxHandling(t *testing.T, numEarlyHints int, terminalStatus int, tooMany bool) {
+	var rspBuf bytes.Buffer
+	rstr := NewMockDatagramStream(gomock.NewController(t))
+	rstr.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	rstr.EXPECT().Write(gomock.Any()).Do(rspBuf.Write).AnyTimes()
+	rw := newResponseWriter(newStream(rstr, nil, nil, func(io.Reader, *headersFrame) error { return nil }, nil), nil, false, nil)
+	rw.header.Add("Link", "foo")
+	rw.header.Add("Link", "bar")
+	for range numEarlyHints {
+		rw.WriteHeader(http.StatusEarlyHints)
+	}
+	rw.WriteHeader(terminalStatus)
+	rw.Flush()
+	rspBytes := rspBuf.Bytes()
+
+	clientConn, serverConn := newConnPair(t)
+
+	type result struct {
+		rsp *http.Response
+		err error
+	}
+	resultChan := make(chan result, 1)
+	go func() {
+		cc := (&Transport{}).NewClientConn(clientConn)
+		rsp, err := cc.RoundTrip(httptest.NewRequest(http.MethodGet, "http://quic-go.net", nil))
+		resultChan <- result{rsp: rsp, err: err}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+
+	// request headers
+	hfs := decodeHeader(t, str)
+	require.Equal(t, hfs[":method"], []string{http.MethodGet})
+
+	_, err = str.Write(rspBytes)
+	require.NoError(t, err)
+
+	var rsp *http.Response
+	select {
+	case res := <-resultChan:
+		if tooMany {
+			require.EqualError(t, res.err, "http3: too many 1xx informational responses")
+			return
+		}
+		require.NoError(t, res.err)
+		rsp = res.rsp
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	require.Equal(t, []string{"foo", "bar"}, rsp.Header["Link"])
+	require.Equal(t, terminalStatus, rsp.StatusCode)
+}
+
+func TestClientGzip(t *testing.T) {
+	var buf bytes.Buffer
+	w := gzip.NewWriter(&buf)
+	w.Write([]byte("foobar"))
+	w.Close()
+	gzippedFoobar := buf.Bytes()
+
+	t.Run("gzipped", func(t *testing.T) {
+		testClientGzip(t, gzippedFoobar, []byte("foobar"), false, true, http.MethodGet, http.StatusOK)
+	})
+	t.Run("not gzipped", func(t *testing.T) {
+		testClientGzip(t, []byte("foobar"), []byte("foobar"), false, false, http.MethodGet, http.StatusOK)
+	})
+	t.Run("disable compression", func(t *testing.T) {
+		testClientGzip(t, gzippedFoobar, gzippedFoobar, true, true, http.MethodGet, http.StatusOK)
+	})
+	t.Run("successful CONNECT", func(t *testing.T) {
+		rsp := testClientGzip(t, gzippedFoobar, gzippedFoobar, false, true, http.MethodConnect, http.StatusOK)
+		require.Equal(t, "gzip", rsp.Header.Get("Content-Encoding"))
+	})
+	t.Run("failed CONNECT", func(t *testing.T) {
+		testClientGzip(t, gzippedFoobar, []byte("foobar"), false, true, http.MethodConnect, http.StatusBadRequest)
+	})
+}
+
+func testClientGzip(t *testing.T,
+	data []byte,
+	expectedRsp []byte,
+	transportDisableCompression bool,
+	responseAddContentEncoding bool,
+	method string,
+	status int,
+) *http.Response {
+	var rspBuf bytes.Buffer
+	rstr := NewMockDatagramStream(gomock.NewController(t))
+	rstr.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	rstr.EXPECT().Write(gomock.Any()).Do(rspBuf.Write).AnyTimes()
+	rw := newResponseWriter(newStream(rstr, nil, nil, func(io.Reader, *headersFrame) error { return nil }, nil), nil, false, nil)
+	rw.WriteHeader(status)
+	if responseAddContentEncoding {
+		rw.header.Add("Content-Encoding", "gzip")
+	}
+	rw.Write(data)
+	rw.Flush()
+
+	clientConn, serverConn := newConnPair(t)
+
+	type result struct {
+		rsp *http.Response
+		err error
+	}
+	resultChan := make(chan result)
+	go func() {
+		cc := (&Transport{DisableCompression: transportDisableCompression}).NewClientConn(clientConn)
+		rsp, err := cc.RoundTrip(httptest.NewRequest(method, "http://quic-go.net", nil))
+		resultChan <- result{rsp: rsp, err: err}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+
+	// request headers
+	str.SetReadDeadline(time.Now().Add(time.Second))
+	hfs := decodeHeader(t, str)
+	if transportDisableCompression {
+		require.NotContains(t, hfs, "accept-encoding")
+	} else {
+		require.Equal(t, hfs["accept-encoding"], []string{"gzip"})
+	}
+
+	_, err = str.Write(rspBuf.Bytes())
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+
+	var rsp *http.Response
+	select {
+	case res := <-resultChan:
+		require.NoError(t, res.err)
+		rsp = res.rsp
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	require.Equal(t, status, rsp.StatusCode)
+	body, err := io.ReadAll(rsp.Body)
+	require.NoError(t, err)
+	require.Equal(t, expectedRsp, body)
+	return rsp
+}
+
+func TestClientRequestCancellation(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+
+	requestCtx, requestCancel := context.WithCancel(context.Background())
+	req, err := http.NewRequestWithContext(requestCtx, http.MethodGet, "http://quic-go.net", nil)
+	require.NoError(t, err)
+
+	type result struct {
+		rsp *http.Response
+		err error
+	}
+	resultChan := make(chan result)
+	go func() {
+		cc := (&Transport{}).NewClientConn(clientConn)
+		rsp, err := cc.RoundTrip(req)
+		resultChan <- result{rsp: rsp, err: err}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+
+	_, err = str.Write(encodeResponse(t, http.StatusTeapot))
+	require.NoError(t, err)
+
+	select {
+	case res := <-resultChan:
+		require.NoError(t, res.err)
+		require.Equal(t, http.StatusTeapot, res.rsp.StatusCode)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	requestCancel()
+
+	expectStreamWriteReset(t, str, quic.StreamErrorCode(ErrCodeRequestCanceled))
+}
+
+func TestClientConnGoAway(t *testing.T) {
+	t.Run("no active streams", func(t *testing.T) {
+		testClientConnGoAway(t, false)
+	})
+
+	t.Run("active stream", func(t *testing.T) {
+		testClientConnGoAway(t, true)
+	})
+}
+
+func testClientConnGoAway(t *testing.T, withStream bool) {
+	var clientEventRecorder events.Recorder
+	clientConn, serverConn := newConnPair(t, withClientRecorder(&clientEventRecorder))
+
+	cc := (&Transport{}).NewClientConn(clientConn)
+
+	var str *RequestStream
+	if withStream {
+		s, err := cc.OpenRequestStream(context.Background())
+		require.NoError(t, err)
+		str = s
+	}
+
+	// server sends control stream with SETTINGS and GOAWAY
+	b := quicvarint.Append(nil, streamTypeControlStream)
+	b = (&settingsFrame{}).Append(b)
+	b = (&goAwayFrame{StreamID: 8}).Append(b)
+	controlStr, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr.Write(b)
+	require.NoError(t, err)
+
+	// the connection should be closed after the stream is closed
+	if withStream {
+		select {
+		case <-serverConn.Context().Done():
+			t.Fatal("connection closed")
+		case <-time.After(scaleDuration(10 * time.Millisecond)):
+		}
+
+		// GOAWAY allows the request that was already open to finish.
+		str.Close()
+		str.CancelRead(1337)
+	}
+
+	select {
+	case <-serverConn.Context().Done():
+		require.ErrorIs(t,
+			context.Cause(serverConn.Context()),
+			&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(ErrCodeNoError)},
+		)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for close")
+	}
+
+	expectedLen, expectedPayloadLen := expectedFrameLength(t, &goAwayFrame{StreamID: 8})
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.FrameParsed{
+				StreamID: controlStr.StreamID(),
+				Raw:      qlog.RawInfo{PayloadLength: expectedPayloadLen, Length: expectedLen},
+				Frame:    qlog.Frame{Frame: qlog.GoAwayFrame{StreamID: 8}},
+			},
+		},
+		filterQlogEventsForFrame(clientEventRecorder.Events(qlog.FrameParsed{}), qlog.GoAwayFrame{StreamID: 8}),
+	)
+}
+
+func TestClientConnGoAwayConcurrent(t *testing.T) {
+	clientConn, serverConn := newConnPair(t, withServerBidiStreamLimit(2)) // allows streams 0 and 4
+
+	cc := (&Transport{}).NewClientConn(clientConn)
+
+	// peer sends control stream with SETTINGS, but not GOAWAY yet
+	b := quicvarint.Append(nil, streamTypeControlStream)
+	b = (&settingsFrame{}).Append(b)
+	controlStr, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr.Write(b)
+	require.NoError(t, err)
+
+	select {
+	case <-serverConn.Context().Done():
+		t.Fatal("connection closed")
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	}
+
+	// Consume both streams the server allows, but keep their receive sides open.
+	for range 2 {
+		str, err := cc.OpenRequestStream(context.Background())
+		require.NoError(t, err)
+		require.NoError(t, str.Close())
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	sstr0, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+	require.Equal(t, quic.StreamID(0), sstr0.StreamID())
+	sstr4, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+	require.Equal(t, quic.StreamID(4), sstr4.StreamID())
+
+	// Both of these calls will block in OpenStreamSync.
+	errChan := make(chan error, 2)
+	for range 2 {
+		go func() {
+			str, err := cc.OpenRequestStream(context.Background())
+			if err == nil {
+				str.Close()
+			}
+			errChan <- err
+		}()
+	}
+
+	select {
+	case <-errChan:
+		t.Fatal("OpenStreamSync calls should have blocked")
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	}
+
+	// Send a GOAWAY with a stream ID higher than the next stream ID.
+	b = (&goAwayFrame{StreamID: 12}).Append(nil)
+	_, err = controlStr.Write(b)
+	require.NoError(t, err)
+
+	// The GOAWAY stream ID only applies to requests already in flight. Even though
+	// stream 8 would be below the limit, no new request stream may be opened.
+	for range 2 {
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, errGoAway)
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	}
+
+	// The streams opened before GOAWAY are not canceled.
+	buf := make([]byte, 1)
+	_, err = sstr0.Read(buf)
+	require.ErrorIs(t, err, io.EOF)
+	_, err = sstr4.Read(buf)
+	require.ErrorIs(t, err, io.EOF)
+
+	// Complete stream 0 to free stream credit, while stream 4 keeps the connection alive.
+	require.NoError(t, sstr0.Close())
+
+	// Calls made after receiving GOAWAY fail even when stream credit is available.
+	openCtx, openCancel := context.WithTimeout(context.Background(), time.Second)
+	defer openCancel()
+	_, err = cc.OpenRequestStream(openCtx)
+	require.ErrorIs(t, err, errGoAway)
+
+	// In particular, the client didn't open and cancel stream 8 behind the caller's back.
+	noStreamCtx, noStreamCancel := context.WithTimeout(context.Background(), scaleDuration(10*time.Millisecond))
+	defer noStreamCancel()
+	_, err = serverConn.AcceptStream(noStreamCtx)
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+
+	require.NoError(t, sstr4.Close())
+}
+
+func TestClientConnGoAwayFailures(t *testing.T) {
+	t.Run("invalid frame", func(t *testing.T) {
+		b := (&settingsFrame{}).Append(nil)
+		// 1337 is invalid value for the Extended CONNECT setting
+		b = (&settingsFrame{Other: map[uint64]uint64{settingExtendedConnect: 1337}}).Append(b)
+		testClientConnGoAwayFailures(t, b, nil, ErrCodeFrameError)
+	})
+
+	t.Run("not a GOAWAY", func(t *testing.T) {
+		b := (&settingsFrame{}).Append(nil)
+		// GOAWAY is the only allowed frame type after SETTINGS
+		b = (&headersFrame{}).Append(b)
+		testClientConnGoAwayFailures(t, b, nil, ErrCodeFrameUnexpected)
+	})
+
+	t.Run("stream closed before GOAWAY", func(t *testing.T) {
+		testClientConnGoAwayFailures(t, (&settingsFrame{}).Append(nil), io.EOF, ErrCodeClosedCriticalStream)
+	})
+
+	t.Run("stream reset before GOAWAY", func(t *testing.T) {
+		testClientConnGoAwayFailures(t,
+			(&settingsFrame{}).Append(nil),
+			&quic.StreamError{Remote: true, ErrorCode: 42},
+			ErrCodeClosedCriticalStream,
+		)
+	})
+
+	t.Run("invalid stream ID", func(t *testing.T) {
+		data := (&settingsFrame{}).Append(nil)
+		data = (&goAwayFrame{StreamID: 1}).Append(data)
+		testClientConnGoAwayFailures(t, data, nil, ErrCodeIDError)
+	})
+
+	t.Run("increased stream ID", func(t *testing.T) {
+		localConn, peerConn := newConnPair(t)
+
+		cc := (&Transport{}).NewClientConn(localConn)
+
+		// need an active stream so the connection doesn't close after the first GOAWAY
+		_, err := cc.OpenRequestStream(context.Background())
+		require.NoError(t, err)
+
+		controlStr, err := peerConn.OpenUniStream()
+		require.NoError(t, err)
+		b := quicvarint.Append(nil, streamTypeControlStream)
+		b = (&settingsFrame{}).Append(b)
+		b = (&goAwayFrame{StreamID: 4}).Append(b)
+		b = (&goAwayFrame{StreamID: 8}).Append(b)
+		_, err = controlStr.Write(b)
+		require.NoError(t, err)
+
+		select {
+		case <-peerConn.Context().Done():
+			require.ErrorIs(t,
+				context.Cause(peerConn.Context()),
+				&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(ErrCodeIDError)},
+			)
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for close")
+		}
+	})
+}
+
+func testClientConnGoAwayFailures(t *testing.T, data []byte, readErr error, expectedErr ErrCode) {
+	localConn, peerConn := newConnPair(t)
+
+	(&Transport{}).NewClientConn(localConn)
+
+	controlStr, err := peerConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr.Write(quicvarint.Append(nil, streamTypeControlStream))
+	require.NoError(t, err)
+
+	switch readErr {
+	case nil:
+		_, err = controlStr.Write(data)
+		require.NoError(t, err)
+	case io.EOF:
+		_, err = controlStr.Write(data)
+		require.NoError(t, err)
+		require.NoError(t, controlStr.Close())
+	default:
+		// make sure the stream type is received
+		time.Sleep(scaleDuration(10 * time.Millisecond))
+		controlStr.CancelWrite(1337)
+	}
+
+	select {
+	case <-peerConn.Context().Done():
+		require.ErrorIs(t,
+			context.Cause(peerConn.Context()),
+			&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(expectedErr)},
+		)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for close")
+	}
+}
+
+func TestClientConnHandleBidirectionalStream(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+
+	cc := (&Transport{}).NewClientConn(clientConn)
+
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	cc.HandleBidirectionalStream(str)
+
+	select {
+	case <-serverConn.Context().Done():
+		require.ErrorIs(t,
+			context.Cause(serverConn.Context()),
+			&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(ErrCodeStreamCreationError)},
+		)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for connection close")
+	}
+}
+
+func TestRawClientConnHandleUnidirectionalStream(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+
+	cc := (&Transport{}).NewRawClientConn(clientConn)
+
+	b := quicvarint.Append(nil, streamTypeControlStream)
+	b = (&settingsFrame{}).Append(b)
+	str, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = str.Write(b)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	uniStr, err := clientConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		cc.HandleUnidirectionalStream(uniStr)
+	}()
+
+	select {
+	case <-cc.ReceivedSettings():
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for settings")
+	}
+	require.NotNil(t, cc.Settings())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/conn.go b/electron/native/private-transport/third_party/quic-go/http3/conn.go
new file mode 100644
index 000000000..039bebf6c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/conn.go
@@ -0,0 +1,330 @@
+package http3
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"maps"
+	"net"
+	"sync"
+	"sync/atomic"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+const maxQuarterStreamID = 1<<60 - 1
+
+// invalidStreamID is a stream ID that is invalid. The first valid stream ID in QUIC is 0.
+const invalidStreamID = quic.StreamID(-1)
+
+// rawConn is an HTTP/3 connection.
+// It provides HTTP/3 specific functionality by wrapping a quic.Conn,
+// in particular handling of unidirectional HTTP/3 streams, SETTINGS and datagrams.
+type rawConn struct {
+	conn *quic.Conn
+
+	logger *slog.Logger
+
+	enableDatagrams bool
+
+	streamMx sync.Mutex
+	streams  map[quic.StreamID]*stateTrackingStream
+
+	rcvdControlStr      atomic.Bool
+	rcvdQPACKEncoderStr atomic.Bool
+	rcvdQPACKDecoderStr atomic.Bool
+	controlStrHandler   func(*quic.ReceiveStream, *frameParser) // is called *after* the SETTINGS frame was parsed
+
+	onStreamsEmpty func()
+
+	settings         *Settings
+	receivedSettings chan struct{}
+
+	qlogger   qlogwriter.Recorder
+	qloggerWG sync.WaitGroup // tracks goroutines that may produce qlog events
+}
+
+func newRawConn(
+	quicConn *quic.Conn,
+	enableDatagrams bool,
+	onStreamsEmpty func(),
+	controlStrHandler func(*quic.ReceiveStream, *frameParser),
+	qlogger qlogwriter.Recorder,
+	logger *slog.Logger,
+) *rawConn {
+	c := &rawConn{
+		conn:              quicConn,
+		logger:            logger,
+		enableDatagrams:   enableDatagrams,
+		receivedSettings:  make(chan struct{}),
+		streams:           make(map[quic.StreamID]*stateTrackingStream),
+		qlogger:           qlogger,
+		onStreamsEmpty:    onStreamsEmpty,
+		controlStrHandler: controlStrHandler,
+	}
+	if qlogger != nil {
+		context.AfterFunc(quicConn.Context(), c.closeQlogger)
+	}
+	return c
+}
+
+func (c *rawConn) OpenUniStream() (*quic.SendStream, error) {
+	return c.conn.OpenUniStream()
+}
+
+// openControlStream opens the control stream and sends the SETTINGS frame.
+// It returns the control stream (needed by the server for sending GOAWAY later).
+func (c *rawConn) openControlStream(settings *settingsFrame) (*quic.SendStream, error) {
+	c.qloggerWG.Add(1)
+	defer c.qloggerWG.Done()
+
+	str, err := c.conn.OpenUniStream()
+	if err != nil {
+		return nil, err
+	}
+	b := make([]byte, 0, 64)
+	b = quicvarint.Append(b, streamTypeControlStream)
+	b = settings.Append(b)
+	if c.qlogger != nil {
+		sf := qlog.SettingsFrame{
+			MaxFieldSectionSize: settings.MaxFieldSectionSize,
+			Other:               maps.Clone(settings.Other),
+		}
+		if settings.Datagram {
+			sf.Datagram = new(true)
+		}
+		if settings.ExtendedConnect {
+			sf.ExtendedConnect = new(true)
+		}
+		c.qlogger.RecordEvent(qlog.FrameCreated{
+			StreamID: str.StreamID(),
+			Raw:      qlog.RawInfo{Length: len(b)},
+			Frame:    qlog.Frame{Frame: sf},
+		})
+	}
+	if _, err := str.Write(b); err != nil {
+		return nil, err
+	}
+	return str, nil
+}
+
+func (c *rawConn) TrackStream(str *quic.Stream) *stateTrackingStream {
+	hstr := newStateTrackingStream(str, c, func(b []byte) error { return c.sendDatagram(str.StreamID(), b) })
+
+	c.streamMx.Lock()
+	c.streams[str.StreamID()] = hstr
+	c.qloggerWG.Add(1)
+	c.streamMx.Unlock()
+	return hstr
+}
+
+func (c *rawConn) UpdateStreamPriority(id quic.StreamID, urgency int8, incremental bool) {
+	c.streamMx.Lock()
+	str := c.streams[id]
+	c.streamMx.Unlock()
+	// A PRIORITY_UPDATE can arrive before its request stream. We deliberately ignore such reordered frames.
+	if str != nil {
+		str.SetPriority(urgency, incremental)
+	}
+}
+
+func (c *rawConn) RemoteAddr() net.Addr {
+	return c.conn.RemoteAddr()
+}
+
+func (c *rawConn) ConnectionState() quic.ConnectionState {
+	return c.conn.ConnectionState()
+}
+
+func (c *rawConn) clearStream(id quic.StreamID) {
+	c.streamMx.Lock()
+	defer c.streamMx.Unlock()
+
+	if _, ok := c.streams[id]; ok {
+		delete(c.streams, id)
+		c.qloggerWG.Done()
+	}
+	if len(c.streams) == 0 {
+		c.onStreamsEmpty()
+	}
+}
+
+func (c *rawConn) hasActiveStreams() bool {
+	c.streamMx.Lock()
+	defer c.streamMx.Unlock()
+
+	return len(c.streams) > 0
+}
+
+func (c *rawConn) CloseWithError(code quic.ApplicationErrorCode, msg string) error {
+	return c.conn.CloseWithError(code, msg)
+}
+
+func (c *rawConn) handleUnidirectionalStream(str *quic.ReceiveStream, isServer bool) {
+	c.qloggerWG.Add(1)
+	defer c.qloggerWG.Done()
+
+	streamType, err := quicvarint.Read(quicvarint.NewReader(str))
+	if err != nil {
+		if c.logger != nil {
+			c.logger.Debug("reading stream type on stream failed", "stream ID", str.StreamID(), "error", err)
+		}
+		return
+	}
+	// We're only interested in the control stream here.
+	switch streamType {
+	case streamTypeControlStream:
+	case streamTypeQPACKEncoderStream:
+		if isFirst := c.rcvdQPACKEncoderStr.CompareAndSwap(false, true); !isFirst {
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeStreamCreationError), "duplicate QPACK encoder stream")
+		}
+		// Our QPACK implementation doesn't use the dynamic table yet.
+		return
+	case streamTypeQPACKDecoderStream:
+		if isFirst := c.rcvdQPACKDecoderStr.CompareAndSwap(false, true); !isFirst {
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeStreamCreationError), "duplicate QPACK decoder stream")
+		}
+		// Our QPACK implementation doesn't use the dynamic table yet.
+		return
+	case streamTypePushStream:
+		if isServer {
+			// only the server can push
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeStreamCreationError), "")
+		} else {
+			// we never increased the Push ID, so we don't expect any push streams
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeIDError), "")
+		}
+		return
+	default:
+		str.CancelRead(quic.StreamErrorCode(ErrCodeStreamCreationError))
+		return
+	}
+	// Only a single control stream is allowed.
+	if isFirstControlStr := c.rcvdControlStr.CompareAndSwap(false, true); !isFirstControlStr {
+		c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeStreamCreationError), "duplicate control stream")
+		return
+	}
+	c.handleControlStream(str)
+}
+
+func (c *rawConn) handleControlStream(str *quic.ReceiveStream) {
+	fp := &frameParser{closeConn: c.conn.CloseWithError, r: str, streamID: str.StreamID()}
+	f, err := fp.ParseNext(c.qlogger)
+	if err != nil {
+		if errors.Is(err, errPriorityUpdateForPush) {
+			c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeMissingSettings), "")
+			return
+		}
+		_, isStreamError := errors.AsType[*quic.StreamError](err)
+		if err == io.EOF || isStreamError {
+			c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeClosedCriticalStream), "")
+			return
+		}
+		c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameError), "")
+		return
+	}
+	sf, ok := f.(*settingsFrame)
+	if !ok {
+		c.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeMissingSettings), "")
+		return
+	}
+	c.settings = &Settings{
+		EnableDatagrams:       sf.Datagram,
+		EnableExtendedConnect: sf.ExtendedConnect,
+		Other:                 sf.Other,
+	}
+	close(c.receivedSettings)
+	if sf.Datagram {
+		// If datagram support was enabled on our side as well as on the server side,
+		// we can expect it to have been negotiated both on the transport and on the HTTP/3 layer.
+		// Note: ConnectionState() will block until the handshake is complete (relevant when using 0-RTT).
+		if c.enableDatagrams && !c.ConnectionState().SupportsDatagrams.Remote {
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeSettingsError), "missing QUIC Datagram support")
+			return
+		}
+		c.qloggerWG.Go(func() {
+			err := c.receiveDatagrams()
+			if c.logger != nil {
+				c.logger.Debug("receiving datagrams failed", "error", err)
+			}
+		})
+	}
+
+	c.controlStrHandler(str, fp)
+}
+
+func (c *rawConn) sendDatagram(streamID quic.StreamID, b []byte) error {
+	// TODO: this creates a lot of garbage and an additional copy
+	data := make([]byte, 0, len(b)+8)
+	quarterStreamID := uint64(streamID / 4)
+	data = quicvarint.Append(data, uint64(streamID/4))
+	data = append(data, b...)
+	if c.qlogger != nil {
+		c.qlogger.RecordEvent(qlog.DatagramCreated{
+			QuarterStreamID: quarterStreamID,
+			Raw: qlog.RawInfo{
+				Length:        len(data),
+				PayloadLength: len(b),
+			},
+		})
+	}
+	return c.conn.SendDatagram(data)
+}
+
+func (c *rawConn) receiveDatagrams() error {
+	for {
+		b, err := c.conn.ReceiveDatagram(context.Background())
+		if err != nil {
+			return err
+		}
+		quarterStreamID, n, err := quicvarint.Parse(b)
+		if err != nil {
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeDatagramError), "")
+			return fmt.Errorf("could not read quarter stream id: %w", err)
+		}
+		if c.qlogger != nil {
+			c.qlogger.RecordEvent(qlog.DatagramParsed{
+				QuarterStreamID: quarterStreamID,
+				Raw: qlog.RawInfo{
+					Length:        len(b),
+					PayloadLength: len(b) - n,
+				},
+			})
+		}
+		if quarterStreamID > maxQuarterStreamID {
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeDatagramError), "")
+			return fmt.Errorf("invalid quarter stream id: %w", err)
+		}
+		streamID := quic.StreamID(4 * quarterStreamID)
+		c.streamMx.Lock()
+		dg, ok := c.streams[streamID]
+		c.streamMx.Unlock()
+		if !ok {
+			continue
+		}
+		dg.enqueueDatagram(b[n:])
+	}
+}
+
+// ReceivedSettings returns a channel that is closed once the peer's SETTINGS frame was received.
+// Settings can be optained from the Settings method after the channel was closed.
+func (c *rawConn) ReceivedSettings() <-chan struct{} { return c.receivedSettings }
+
+// Settings returns the settings received on this connection.
+// It is only valid to call this function after the channel returned by ReceivedSettings was closed.
+func (c *rawConn) Settings() *Settings { return c.settings }
+
+// closeQlogger waits for all goroutines that may produce qlog events to finish,
+// then closes the qlogger.
+func (c *rawConn) closeQlogger() {
+	if c.qlogger == nil {
+		return
+	}
+	c.qloggerWG.Wait()
+	c.qlogger.Close()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/conn_test.go b/electron/native/private-transport/third_party/quic-go/http3/conn_test.go
new file mode 100644
index 000000000..b93c08abe
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/conn_test.go
@@ -0,0 +1,483 @@
+package http3
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+)
+
+func nopControlStrHandler(*quic.ReceiveStream, *frameParser) {}
+
+func TestConnReceiveSettings(t *testing.T) {
+	var eventRecorder events.Recorder
+	clientConn, serverConn := newConnPair(t, withServerRecorder(&eventRecorder))
+
+	conn := newRawConn(serverConn, false, nil, nopControlStrHandler, &eventRecorder, nil)
+	b := quicvarint.Append(nil, streamTypeControlStream)
+	sf := &settingsFrame{
+		MaxFieldSectionSize: 1234,
+		Datagram:            true,
+		ExtendedConnect:     true,
+		Other:               map[uint64]uint64{1337: 42},
+	}
+	b = sf.Append(b)
+	controlStr, err := clientConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr.Write(b)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	serverStr, err := serverConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		conn.handleUnidirectionalStream(serverStr, true)
+	}()
+	select {
+	case <-conn.ReceivedSettings():
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for settings")
+	}
+	settings := conn.Settings()
+	require.True(t, settings.EnableDatagrams)
+	require.True(t, settings.EnableExtendedConnect)
+	require.Equal(t, map[uint64]uint64{1337: 42}, settings.Other)
+
+	expectedLen, expectedPayloadLen := expectedFrameLength(t, sf)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.FrameParsed{
+				StreamID: controlStr.StreamID(),
+				Raw:      qlog.RawInfo{Length: expectedLen, PayloadLength: expectedPayloadLen},
+				Frame: qlog.Frame{
+					Frame: qlog.SettingsFrame{
+						MaxFieldSectionSize: 1234,
+						Datagram:            new(true),
+						ExtendedConnect:     new(true),
+						Other:               map[uint64]uint64{1337: 42},
+					},
+				},
+			},
+		},
+		filterQlogEventsForFrame(eventRecorder.Events(qlog.FrameParsed{}), qlog.SettingsFrame{}),
+	)
+}
+
+func TestConnRejectDuplicateStreams(t *testing.T) {
+	t.Run("control stream", func(t *testing.T) {
+		testConnRejectDuplicateStreams(t, streamTypeControlStream)
+	})
+	t.Run("encoder stream", func(t *testing.T) {
+		testConnRejectDuplicateStreams(t, streamTypeQPACKEncoderStream)
+	})
+	t.Run("decoder stream", func(t *testing.T) {
+		testConnRejectDuplicateStreams(t, streamTypeQPACKDecoderStream)
+	})
+}
+
+func testConnRejectDuplicateStreams(t *testing.T, typ uint64) {
+	clientConn, serverConn := newConnPair(t)
+
+	conn := newRawConn(serverConn, false, nil, nopControlStrHandler, nil, nil)
+	b := quicvarint.Append(nil, typ)
+	if typ == streamTypeControlStream {
+		b = (&settingsFrame{}).Append(b)
+	}
+	controlStr1, err := clientConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr1.Write(b)
+	require.NoError(t, err)
+	controlStr2, err := clientConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr2.Write(b)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	serverStr1, err := serverConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	serverStr2, err := serverConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	done := make(chan struct{}, 2)
+	go func() {
+		defer func() { done <- struct{}{} }()
+		conn.handleUnidirectionalStream(serverStr1, true)
+	}()
+	go func() {
+		defer func() { done <- struct{}{} }()
+		conn.handleUnidirectionalStream(serverStr2, true)
+	}()
+	select {
+	case <-clientConn.Context().Done():
+		require.ErrorIs(t,
+			context.Cause(clientConn.Context()),
+			&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(ErrCodeStreamCreationError)},
+		)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for duplicate stream")
+	}
+	for range 2 {
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	}
+}
+
+func TestConnResetUnknownUniStream(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+
+	conn := newRawConn(serverConn, false, nil, nopControlStrHandler, nil, nil)
+	buf := bytes.NewBuffer(quicvarint.Append(nil, 0x1337))
+	str, err := clientConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = str.Write(buf.Bytes())
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	serverStr, err := serverConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		conn.handleUnidirectionalStream(serverStr, true)
+	}()
+	expectStreamWriteReset(t, str, quic.StreamErrorCode(ErrCodeStreamCreationError))
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestConnControlStreamFailures(t *testing.T) {
+	t.Run("missing SETTINGS", func(t *testing.T) {
+		testConnControlStreamFailures(t, (&dataFrame{}).Append(nil), nil, ErrCodeMissingSettings)
+	})
+	t.Run("frame error", func(t *testing.T) {
+		testConnControlStreamFailures(t,
+			// 1337 is invalid value for the Extended CONNECT setting
+			(&settingsFrame{Other: map[uint64]uint64{settingExtendedConnect: 1337}}).Append(nil),
+			nil,
+			ErrCodeFrameError,
+		)
+	})
+	t.Run("control stream closed before SETTINGS", func(t *testing.T) {
+		testConnControlStreamFailures(t, nil, io.EOF, ErrCodeClosedCriticalStream)
+	})
+	t.Run("control stream reset before SETTINGS", func(t *testing.T) {
+		testConnControlStreamFailures(t,
+			nil,
+			&quic.StreamError{Remote: true, ErrorCode: 42},
+			ErrCodeClosedCriticalStream,
+		)
+	})
+}
+
+func testConnControlStreamFailures(t *testing.T, data []byte, readErr error, expectedErr ErrCode) {
+	clientConn, serverConn := newConnPair(t)
+
+	conn := newRawConn(clientConn, false, nil, nopControlStrHandler, nil, nil)
+	controlStr, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr.Write(quicvarint.Append(nil, streamTypeControlStream))
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	clientStr, err := clientConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		conn.handleUnidirectionalStream(clientStr, false)
+	}()
+
+	switch readErr {
+	case nil:
+		_, err = controlStr.Write(data)
+		require.NoError(t, err)
+	case io.EOF:
+		_, err = controlStr.Write(data)
+		require.NoError(t, err)
+		require.NoError(t, controlStr.Close())
+	default:
+		// make sure the stream type is received
+		time.Sleep(scaleDuration(10 * time.Millisecond))
+		controlStr.CancelWrite(1337)
+	}
+
+	select {
+	case <-serverConn.Context().Done():
+		require.ErrorIs(t,
+			context.Cause(serverConn.Context()),
+			&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(expectedErr)},
+		)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for close")
+	}
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestConnControlStreamHandler(t *testing.T) {
+	localConn, peerConn := newConnPair(t)
+
+	handlerCalled := make(chan struct{})
+	conn := newRawConn(localConn, false, nil, func(*quic.ReceiveStream, *frameParser) { close(handlerCalled) }, nil, nil)
+
+	b := quicvarint.Append(nil, streamTypeControlStream)
+	b = (&settingsFrame{}).Append(b)
+	str, err := peerConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = str.Write(b)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	localStr, err := localConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	go conn.handleUnidirectionalStream(localStr, false)
+
+	select {
+	case <-conn.ReceivedSettings():
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for settings")
+	}
+	select {
+	case <-handlerCalled:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for handler to be called")
+	}
+}
+
+func TestConnRejectPushStream(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testConnRejectPushStream(t, false, ErrCodeIDError)
+	})
+	t.Run("server", func(t *testing.T) {
+		testConnRejectPushStream(t, true, ErrCodeStreamCreationError)
+	})
+}
+
+func testConnRejectPushStream(t *testing.T, isServer bool, expectedErr ErrCode) {
+	localConn, peerConn := newConnPair(t)
+
+	conn := newRawConn(localConn, false, nil, nopControlStrHandler, nil, nil)
+	buf := bytes.NewBuffer(quicvarint.Append(nil, streamTypePushStream))
+	str, err := peerConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = str.Write(buf.Bytes())
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	localStr, err := localConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		conn.handleUnidirectionalStream(localStr, isServer)
+	}()
+	select {
+	case <-peerConn.Context().Done():
+		require.ErrorIs(t,
+			context.Cause(peerConn.Context()),
+			&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(expectedErr)},
+		)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for close")
+	}
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestConnInconsistentDatagramSupport(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+
+	conn := newRawConn(clientConn, true, nil, nopControlStrHandler, nil, nil)
+	b := quicvarint.Append(nil, streamTypeControlStream)
+	b = (&settingsFrame{Datagram: true}).Append(b)
+	controlStr, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr.Write(b)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	clientStr, err := clientConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		conn.handleUnidirectionalStream(clientStr, false)
+	}()
+
+	select {
+	case <-serverConn.Context().Done():
+		err := context.Cause(serverConn.Context())
+		require.ErrorIs(t, err, &quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(ErrCodeSettingsError)})
+		require.ErrorContains(t, err, "missing QUIC Datagram support")
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for close")
+	}
+}
+
+func TestConnSendAndReceiveDatagram(t *testing.T) {
+	var eventRecorder events.Recorder
+	clientConn, serverConn := newConnPair(t, withDatagrams(), withClientRecorder(&eventRecorder))
+
+	conn := newRawConn(clientConn, true, nil, nopControlStrHandler, &eventRecorder, nil)
+	b := quicvarint.Append(nil, streamTypeControlStream)
+	b = (&settingsFrame{Datagram: true}).Append(b)
+	controlStr, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr.Write(b)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	clientStr, err := clientConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		conn.handleUnidirectionalStream(clientStr, false)
+	}()
+
+	const strID = 4
+
+	// first deliver a datagram...
+	// since the stream is not open yet, it will be dropped
+	quarterStreamID := quicvarint.Append([]byte{}, strID/4)
+
+	datagram := append(quarterStreamID, []byte("foo")...)
+	require.NoError(t, serverConn.SendDatagram(datagram))
+	time.Sleep(scaleDuration(10 * time.Millisecond)) // give the datagram a chance to be delivered
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.DatagramParsed{
+				QuarterStreamID: strID / 4,
+				Raw:             qlog.RawInfo{Length: len(datagram), PayloadLength: 3},
+			},
+		},
+		eventRecorder.Events(qlog.DatagramParsed{}),
+	)
+	eventRecorder.Clear()
+
+	// don't use stream 0, since that makes it hard to test that the quarter stream ID is used
+	str0, err := clientConn.OpenStreamSync(context.Background())
+	require.NoError(t, err)
+	str0.Close()
+
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	require.Equal(t, quic.StreamID(strID), str.StreamID())
+	datagramStr := conn.TrackStream(str)
+
+	// now open the stream...
+	require.NoError(t, serverConn.SendDatagram(append(quarterStreamID, []byte("bar")...)))
+
+	data, err := datagramStr.ReceiveDatagram(ctx)
+	require.NoError(t, err)
+	require.Equal(t, []byte("bar"), data)
+
+	// now send a datagram
+	require.NoError(t, datagramStr.SendDatagram([]byte("foobaz")))
+
+	expected := quicvarint.Append([]byte{}, strID/4)
+	expected = append(expected, []byte("foobaz")...)
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.DatagramCreated{
+				QuarterStreamID: strID / 4,
+				Raw:             qlog.RawInfo{PayloadLength: 6, Length: len(expected)},
+			},
+		},
+		eventRecorder.Events(qlog.DatagramCreated{}),
+	)
+	eventRecorder.Clear()
+
+	data, err = serverConn.ReceiveDatagram(ctx)
+	require.NoError(t, err)
+	require.Equal(t, expected, data)
+}
+
+func TestConnDatagramFailures(t *testing.T) {
+	t.Run("invalid varint", func(t *testing.T) {
+		testConnDatagramFailures(t, []byte{128})
+	})
+
+	t.Run("invalid quarter stream ID", func(t *testing.T) {
+		testConnDatagramFailures(t, quicvarint.Append([]byte{}, maxQuarterStreamID+1))
+	})
+}
+
+func testConnDatagramFailures(t *testing.T, datagram []byte) {
+	localConn, peerConn := newConnPair(t, withDatagrams())
+
+	conn := newRawConn(localConn, true, nil, nopControlStrHandler, nil, nil)
+
+	b := quicvarint.Append(nil, streamTypeControlStream)
+	b = (&settingsFrame{Datagram: true}).Append(b)
+	controlStr, err := peerConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = controlStr.Write(b)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	localStr, err := localConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	go conn.handleUnidirectionalStream(localStr, false)
+
+	// Wait for SETTINGS to be received and datagram handling to start
+	select {
+	case <-conn.ReceivedSettings():
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for settings")
+	}
+
+	require.NoError(t, peerConn.SendDatagram(datagram))
+
+	select {
+	case <-peerConn.Context().Done():
+		require.ErrorIs(t,
+			context.Cause(peerConn.Context()),
+			&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(ErrCodeDatagramError)},
+		)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for close")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/datagram_buffer.go b/electron/native/private-transport/third_party/quic-go/http3/datagram_buffer.go
new file mode 100644
index 000000000..558bff06c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/datagram_buffer.go
@@ -0,0 +1,23 @@
+package http3
+
+import "github.com/quic-go/quic-go"
+
+// EnableDatagramReceiveBuffer enables bounded burst absorption on an admitted
+// datagram stream. Call only after authorization. It does not change wire data.
+func (s *Stream) EnableDatagramReceiveBuffer() {
+	if b, ok := s.datagramStream.(interface{ enableDatagramReceiveBuffer() }); ok {
+		b.enableDatagramReceiveBuffer()
+	}
+}
+func (s *Stream) DatagramReceiveBufferStats() quic.DatagramReceiveBufferStats {
+	if b, ok := s.datagramStream.(interface {
+		datagramReceiveBufferStats() quic.DatagramReceiveBufferStats
+	}); ok {
+		return b.datagramReceiveBufferStats()
+	}
+	return quic.DatagramReceiveBufferStats{}
+}
+func (s *RequestStream) EnableDatagramReceiveBuffer() { s.str.EnableDatagramReceiveBuffer() }
+func (s *RequestStream) DatagramReceiveBufferStats() quic.DatagramReceiveBufferStats {
+	return s.str.DatagramReceiveBufferStats()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/error.go b/electron/native/private-transport/third_party/quic-go/http3/error.go
new file mode 100644
index 000000000..7090a19d4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/error.go
@@ -0,0 +1,64 @@
+package http3
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/quic-go/quic-go"
+)
+
+// Error is returned by [Transport.RoundTrip], [Transport.RoundTripOpt], and
+// [ClientConn.RoundTrip] for HTTP clients, and from request-body reads and response
+// writes inside HTTP handlers for HTTP servers, when an HTTP/3 error occurs.
+// See section 8 of RFC 9114.
+type Error struct {
+	Remote       bool
+	ErrorCode    ErrCode
+	ErrorMessage string
+}
+
+var _ error = &Error{}
+
+func (e *Error) Error() string {
+	s := e.ErrorCode.string()
+	if s == "" {
+		s = fmt.Sprintf("H3 error (%#x)", uint64(e.ErrorCode))
+	}
+	// Usually errors are remote. Only make it explicit for local errors.
+	if !e.Remote {
+		s += " (local)"
+	}
+	if e.ErrorMessage != "" {
+		s += ": " + e.ErrorMessage
+	}
+	return s
+}
+
+func (e *Error) Is(target error) bool {
+	t, ok := target.(*Error)
+	return ok && e.ErrorCode == t.ErrorCode && e.Remote == t.Remote
+}
+
+func maybeReplaceError(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	var (
+		e      Error
+		strErr *quic.StreamError
+		appErr *quic.ApplicationError
+	)
+	switch {
+	default:
+		return err
+	case errors.As(err, &strErr):
+		e.Remote = strErr.Remote
+		e.ErrorCode = ErrCode(strErr.ErrorCode)
+	case errors.As(err, &appErr):
+		e.Remote = appErr.Remote
+		e.ErrorCode = ErrCode(appErr.ErrorCode)
+		e.ErrorMessage = appErr.ErrorMessage
+	}
+	return &e
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/error_codes.go b/electron/native/private-transport/third_party/quic-go/http3/error_codes.go
new file mode 100644
index 000000000..d0b10a1f1
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/error_codes.go
@@ -0,0 +1,84 @@
+package http3
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go"
+)
+
+type ErrCode quic.ApplicationErrorCode
+
+const (
+	ErrCodeNoError                  ErrCode = 0x100
+	ErrCodeGeneralProtocolError     ErrCode = 0x101
+	ErrCodeInternalError            ErrCode = 0x102
+	ErrCodeStreamCreationError      ErrCode = 0x103
+	ErrCodeClosedCriticalStream     ErrCode = 0x104
+	ErrCodeFrameUnexpected          ErrCode = 0x105
+	ErrCodeFrameError               ErrCode = 0x106
+	ErrCodeExcessiveLoad            ErrCode = 0x107
+	ErrCodeIDError                  ErrCode = 0x108
+	ErrCodeSettingsError            ErrCode = 0x109
+	ErrCodeMissingSettings          ErrCode = 0x10a
+	ErrCodeRequestRejected          ErrCode = 0x10b
+	ErrCodeRequestCanceled          ErrCode = 0x10c
+	ErrCodeRequestIncomplete        ErrCode = 0x10d
+	ErrCodeMessageError             ErrCode = 0x10e
+	ErrCodeConnectError             ErrCode = 0x10f
+	ErrCodeVersionFallback          ErrCode = 0x110
+	ErrCodeDatagramError            ErrCode = 0x33
+	ErrCodeQPACKDecompressionFailed ErrCode = 0x200
+)
+
+func (e ErrCode) String() string {
+	s := e.string()
+	if s != "" {
+		return s
+	}
+	return fmt.Sprintf("unknown error code: %#x", uint16(e))
+}
+
+func (e ErrCode) string() string {
+	switch e {
+	case ErrCodeNoError:
+		return "H3_NO_ERROR"
+	case ErrCodeGeneralProtocolError:
+		return "H3_GENERAL_PROTOCOL_ERROR"
+	case ErrCodeInternalError:
+		return "H3_INTERNAL_ERROR"
+	case ErrCodeStreamCreationError:
+		return "H3_STREAM_CREATION_ERROR"
+	case ErrCodeClosedCriticalStream:
+		return "H3_CLOSED_CRITICAL_STREAM"
+	case ErrCodeFrameUnexpected:
+		return "H3_FRAME_UNEXPECTED"
+	case ErrCodeFrameError:
+		return "H3_FRAME_ERROR"
+	case ErrCodeExcessiveLoad:
+		return "H3_EXCESSIVE_LOAD"
+	case ErrCodeIDError:
+		return "H3_ID_ERROR"
+	case ErrCodeSettingsError:
+		return "H3_SETTINGS_ERROR"
+	case ErrCodeMissingSettings:
+		return "H3_MISSING_SETTINGS"
+	case ErrCodeRequestRejected:
+		return "H3_REQUEST_REJECTED"
+	case ErrCodeRequestCanceled:
+		return "H3_REQUEST_CANCELLED"
+	case ErrCodeRequestIncomplete:
+		return "H3_INCOMPLETE_REQUEST"
+	case ErrCodeMessageError:
+		return "H3_MESSAGE_ERROR"
+	case ErrCodeConnectError:
+		return "H3_CONNECT_ERROR"
+	case ErrCodeVersionFallback:
+		return "H3_VERSION_FALLBACK"
+	case ErrCodeDatagramError:
+		return "H3_DATAGRAM_ERROR"
+	case ErrCodeQPACKDecompressionFailed:
+		return "QPACK_DECOMPRESSION_FAILED"
+	default:
+		return ""
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/error_codes_test.go b/electron/native/private-transport/third_party/quic-go/http3/error_codes_test.go
new file mode 100644
index 000000000..af7642b1d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/error_codes_test.go
@@ -0,0 +1,37 @@
+package http3
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"path"
+	"runtime"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestErrorCodes(t *testing.T) {
+	// We parse the error code file, extract all constants, and verify that
+	// each of them has a string version. Go FTW!
+	_, thisfile, _, ok := runtime.Caller(0)
+	require.True(t, ok, "Failed to get current frame")
+
+	filename := path.Join(path.Dir(thisfile), "error_codes.go")
+	fileAst, err := parser.ParseFile(token.NewFileSet(), filename, nil, 0)
+	require.NoError(t, err)
+
+	constSpecs := fileAst.Decls[2].(*ast.GenDecl).Specs
+	require.Greater(t, len(constSpecs), 4) // at time of writing
+
+	for _, c := range constSpecs {
+		valString := c.(*ast.ValueSpec).Values[0].(*ast.BasicLit).Value
+		val, err := strconv.ParseInt(valString, 0, 64)
+		require.NoError(t, err)
+		require.NotEqual(t, "unknown error code", ErrCode(val).String())
+	}
+
+	// Test unknown error code
+	require.Equal(t, "unknown error code: 0x1337", ErrCode(0x1337).String())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/error_test.go b/electron/native/private-transport/third_party/quic-go/http3/error_test.go
new file mode 100644
index 000000000..de7a85fd9
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/error_test.go
@@ -0,0 +1,87 @@
+package http3
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestErrorConversion(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    error
+		expected error
+	}{
+		{name: "nil error", input: nil, expected: nil},
+		{name: "regular error", input: assert.AnError, expected: assert.AnError},
+		{
+			name:     "stream error",
+			input:    &quic.StreamError{ErrorCode: 1337, Remote: true},
+			expected: &Error{Remote: true, ErrorCode: 1337},
+		},
+		{
+			name:     "application error",
+			input:    &quic.ApplicationError{ErrorCode: 42, Remote: true, ErrorMessage: "foobar"},
+			expected: &Error{Remote: true, ErrorCode: 42, ErrorMessage: "foobar"},
+		},
+		{
+			name:     "transport error",
+			input:    &quic.TransportError{ErrorCode: 42, Remote: true, ErrorMessage: "foobar"},
+			expected: &quic.TransportError{ErrorCode: 42, Remote: true, ErrorMessage: "foobar"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := maybeReplaceError(tt.input)
+			if tt.expected == nil {
+				require.Nil(t, result)
+			} else {
+				require.ErrorIs(t, tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestErrorString(t *testing.T) {
+	tests := []struct {
+		name     string
+		err      *Error
+		expected string
+	}{
+		{
+			name:     "remote error",
+			err:      &Error{ErrorCode: 0x10c, Remote: true},
+			expected: "H3_REQUEST_CANCELLED",
+		},
+		{
+			name:     "remote error with message",
+			err:      &Error{ErrorCode: 0x10c, Remote: true, ErrorMessage: "foobar"},
+			expected: "H3_REQUEST_CANCELLED: foobar",
+		},
+		{
+			name:     "local error",
+			err:      &Error{ErrorCode: 0x10c, Remote: false},
+			expected: "H3_REQUEST_CANCELLED (local)",
+		},
+		{
+			name:     "local error with message",
+			err:      &Error{ErrorCode: 0x10c, Remote: false, ErrorMessage: "foobar"},
+			expected: "H3_REQUEST_CANCELLED (local): foobar",
+		},
+		{
+			name:     "unknown error code",
+			err:      &Error{ErrorCode: 0x1337, Remote: true},
+			expected: "H3 error (0x1337)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.expected, tt.err.Error())
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/frames.go b/electron/native/private-transport/third_party/quic-go/http3/frames.go
new file mode 100644
index 000000000..6bc953251
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/frames.go
@@ -0,0 +1,371 @@
+package http3
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// FrameType is the frame type of a HTTP/3 frame
+type FrameType uint64
+
+type frame any
+
+var errPriorityUpdateForPush = errors.New("http3: PRIORITY_UPDATE frame for push")
+
+// The maximum length of an encoded HTTP/3 frame header is 16:
+// The frame has a type and length field, both QUIC varints (maximum 8 bytes in length)
+const frameHeaderLen = 16
+
+type countingByteReader struct {
+	quicvarint.Reader
+	NumRead int
+}
+
+func (r *countingByteReader) ReadByte() (byte, error) {
+	b, err := r.Reader.ReadByte()
+	if err == nil {
+		r.NumRead++
+	}
+	return b, err
+}
+
+func (r *countingByteReader) Read(b []byte) (int, error) {
+	n, err := r.Reader.Read(b)
+	r.NumRead += n
+	return n, err
+}
+
+func (r *countingByteReader) Reset() {
+	r.NumRead = 0
+}
+
+type frameParser struct {
+	r         io.Reader
+	streamID  quic.StreamID
+	closeConn func(quic.ApplicationErrorCode, string) error
+}
+
+func (p *frameParser) ParseNext(qlogger qlogwriter.Recorder) (frame, error) {
+	r := &countingByteReader{Reader: quicvarint.NewReader(p.r)}
+	for {
+		t, err := quicvarint.Read(r)
+		if err != nil {
+			return nil, err
+		}
+		l, err := quicvarint.Read(r)
+		if err != nil {
+			return nil, err
+		}
+
+		switch t {
+		case 0x0: // DATA
+			if qlogger != nil {
+				qlogger.RecordEvent(qlog.FrameParsed{
+					StreamID: p.streamID,
+					Raw: qlog.RawInfo{
+						Length:        int(l) + r.NumRead,
+						PayloadLength: int(l),
+					},
+					Frame: qlog.Frame{Frame: qlog.DataFrame{}},
+				})
+			}
+			return &dataFrame{Length: l}, nil
+		case 0x1: // HEADERS
+			return &headersFrame{
+				Length:    l,
+				headerLen: r.NumRead,
+			}, nil
+		case 0x4: // SETTINGS
+			return parseSettingsFrame(r, l, p.streamID, qlogger)
+		case 0x3: // unsupported: CANCEL_PUSH
+			if qlogger != nil {
+				qlogger.RecordEvent(qlog.FrameParsed{
+					StreamID: p.streamID,
+					Raw:      qlog.RawInfo{Length: r.NumRead, PayloadLength: int(l)},
+					Frame:    qlog.Frame{Frame: qlog.CancelPushFrame{}},
+				})
+			}
+		case 0x5: // unsupported: PUSH_PROMISE
+			if qlogger != nil {
+				qlogger.RecordEvent(qlog.FrameParsed{
+					StreamID: p.streamID,
+					Raw:      qlog.RawInfo{Length: r.NumRead, PayloadLength: int(l)},
+					Frame:    qlog.Frame{Frame: qlog.PushPromiseFrame{}},
+				})
+			}
+		case 0x7: // GOAWAY
+			return parseGoAwayFrame(r, l, p.streamID, qlogger)
+		case 0xf0700: // PRIORITY_UPDATE for a request stream
+			return parsePriorityUpdateFrame(r, l, p.streamID, qlogger)
+		case 0xf0701: // PRIORITY_UPDATE for a push stream
+			return nil, errPriorityUpdateForPush
+		case 0xd: // unsupported: MAX_PUSH_ID
+			if qlogger != nil {
+				qlogger.RecordEvent(qlog.FrameParsed{
+					StreamID: p.streamID,
+					Raw:      qlog.RawInfo{Length: r.NumRead, PayloadLength: int(l)},
+					Frame:    qlog.Frame{Frame: qlog.MaxPushIDFrame{}},
+				})
+			}
+		case 0x2, 0x6, 0x8, 0x9: // reserved frame types
+			if qlogger != nil {
+				qlogger.RecordEvent(qlog.FrameParsed{
+					StreamID: p.streamID,
+					Raw:      qlog.RawInfo{Length: r.NumRead + int(l), PayloadLength: int(l)},
+					Frame:    qlog.Frame{Frame: qlog.ReservedFrame{Type: t}},
+				})
+			}
+			p.closeConn(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "")
+			return nil, fmt.Errorf("http3: reserved frame type: %d", t)
+		default:
+			// unknown frame types
+			if qlogger != nil {
+				qlogger.RecordEvent(qlog.FrameParsed{
+					StreamID: p.streamID,
+					Raw:      qlog.RawInfo{Length: r.NumRead, PayloadLength: int(l)},
+					Frame:    qlog.Frame{Frame: qlog.UnknownFrame{Type: t}},
+				})
+			}
+		}
+
+		// skip over the payload
+		if _, err := io.CopyN(io.Discard, r, int64(l)); err != nil {
+			return nil, err
+		}
+		r.Reset()
+	}
+}
+
+type dataFrame struct {
+	Length uint64
+}
+
+func (f *dataFrame) Append(b []byte) []byte {
+	b = quicvarint.Append(b, 0x0)
+	return quicvarint.Append(b, f.Length)
+}
+
+type headersFrame struct {
+	Length    uint64
+	headerLen int // number of bytes read for type and length field
+}
+
+func (f *headersFrame) Append(b []byte) []byte {
+	b = quicvarint.Append(b, 0x1)
+	return quicvarint.Append(b, f.Length)
+}
+
+const (
+	// SETTINGS_MAX_FIELD_SECTION_SIZE
+	settingMaxFieldSectionSize = 0x6
+	// Extended CONNECT, RFC 9220
+	settingExtendedConnect = 0x8
+	// HTTP Datagrams, RFC 9297
+	settingDatagram = 0x33
+)
+
+type settingsFrame struct {
+	MaxFieldSectionSize int64 // SETTINGS_MAX_FIELD_SECTION_SIZE, -1 if not set
+
+	Datagram        bool              // HTTP Datagrams, RFC 9297
+	ExtendedConnect bool              // Extended CONNECT, RFC 9220
+	Other           map[uint64]uint64 // all settings that we don't explicitly recognize
+}
+
+const maxSettingsFrameSize = 8 << 10
+
+func parseSettingsFrame(r *countingByteReader, l uint64, streamID quic.StreamID, qlogger qlogwriter.Recorder) (*settingsFrame, error) {
+	if l > maxSettingsFrameSize {
+		return nil, fmt.Errorf("unexpected size for SETTINGS frame: %d", l)
+	}
+	buf := make([]byte, l)
+	if _, err := io.ReadFull(r, buf); err != nil {
+		if err == io.ErrUnexpectedEOF {
+			return nil, io.EOF
+		}
+		return nil, err
+	}
+	frame := &settingsFrame{MaxFieldSectionSize: -1}
+	b := bytes.NewReader(buf)
+	settingsFrame := qlog.SettingsFrame{MaxFieldSectionSize: -1}
+	var readMaxFieldSectionSize, readDatagram, readExtendedConnect bool
+	for b.Len() > 0 {
+		id, err := quicvarint.Read(b)
+		if err != nil { // should not happen. We allocated the whole frame already.
+			return nil, err
+		}
+		val, err := quicvarint.Read(b)
+		if err != nil { // should not happen. We allocated the whole frame already.
+			return nil, err
+		}
+
+		switch id {
+		case settingMaxFieldSectionSize:
+			if readMaxFieldSectionSize {
+				return nil, fmt.Errorf("duplicate setting: %d", id)
+			}
+			readMaxFieldSectionSize = true
+			frame.MaxFieldSectionSize = int64(val)
+			settingsFrame.MaxFieldSectionSize = int64(val)
+		case settingExtendedConnect:
+			if readExtendedConnect {
+				return nil, fmt.Errorf("duplicate setting: %d", id)
+			}
+			readExtendedConnect = true
+			if val != 0 && val != 1 {
+				return nil, fmt.Errorf("invalid value for SETTINGS_ENABLE_CONNECT_PROTOCOL: %d", val)
+			}
+			frame.ExtendedConnect = val == 1
+			if qlogger != nil {
+				settingsFrame.ExtendedConnect = new(frame.ExtendedConnect)
+			}
+		case settingDatagram:
+			if readDatagram {
+				return nil, fmt.Errorf("duplicate setting: %d", id)
+			}
+			readDatagram = true
+			if val != 0 && val != 1 {
+				return nil, fmt.Errorf("invalid value for SETTINGS_H3_DATAGRAM: %d", val)
+			}
+			frame.Datagram = val == 1
+			if qlogger != nil {
+				settingsFrame.Datagram = new(frame.Datagram)
+			}
+		default:
+			if _, ok := frame.Other[id]; ok {
+				return nil, fmt.Errorf("duplicate setting: %d", id)
+			}
+			if frame.Other == nil {
+				frame.Other = make(map[uint64]uint64)
+			}
+			frame.Other[id] = val
+		}
+	}
+	if qlogger != nil {
+		settingsFrame.Other = maps.Clone(frame.Other)
+
+		qlogger.RecordEvent(qlog.FrameParsed{
+			StreamID: streamID,
+			Raw: qlog.RawInfo{
+				Length:        r.NumRead,
+				PayloadLength: int(l),
+			},
+			Frame: qlog.Frame{Frame: settingsFrame},
+		})
+	}
+	return frame, nil
+}
+
+func (f *settingsFrame) Append(b []byte) []byte {
+	b = quicvarint.Append(b, 0x4)
+	var l int
+	if f.MaxFieldSectionSize >= 0 {
+		l += quicvarint.Len(settingMaxFieldSectionSize) + quicvarint.Len(uint64(f.MaxFieldSectionSize))
+	}
+	for id, val := range f.Other {
+		l += quicvarint.Len(id) + quicvarint.Len(val)
+	}
+	if f.Datagram {
+		l += quicvarint.Len(settingDatagram) + quicvarint.Len(1)
+	}
+	if f.ExtendedConnect {
+		l += quicvarint.Len(settingExtendedConnect) + quicvarint.Len(1)
+	}
+	b = quicvarint.Append(b, uint64(l))
+	if f.MaxFieldSectionSize >= 0 {
+		b = quicvarint.Append(b, settingMaxFieldSectionSize)
+		b = quicvarint.Append(b, uint64(f.MaxFieldSectionSize))
+	}
+	if f.Datagram {
+		b = quicvarint.Append(b, settingDatagram)
+		b = quicvarint.Append(b, 1)
+	}
+	if f.ExtendedConnect {
+		b = quicvarint.Append(b, settingExtendedConnect)
+		b = quicvarint.Append(b, 1)
+	}
+	for id, val := range f.Other {
+		b = quicvarint.Append(b, id)
+		b = quicvarint.Append(b, val)
+	}
+	return b
+}
+
+type goAwayFrame struct {
+	StreamID quic.StreamID
+}
+
+func parseGoAwayFrame(r *countingByteReader, l uint64, streamID quic.StreamID, qlogger qlogwriter.Recorder) (*goAwayFrame, error) {
+	frame := &goAwayFrame{}
+	startLen := r.NumRead
+	id, err := quicvarint.Read(r)
+	if err != nil {
+		return nil, err
+	}
+	if r.NumRead-startLen != int(l) {
+		return nil, errors.New("GOAWAY frame: inconsistent length")
+	}
+	frame.StreamID = quic.StreamID(id)
+	if qlogger != nil {
+		qlogger.RecordEvent(qlog.FrameParsed{
+			StreamID: streamID,
+			Raw:      qlog.RawInfo{Length: r.NumRead, PayloadLength: int(l)},
+			Frame:    qlog.Frame{Frame: qlog.GoAwayFrame{StreamID: frame.StreamID}},
+		})
+	}
+	return frame, nil
+}
+
+func (f *goAwayFrame) Append(b []byte) []byte {
+	b = quicvarint.Append(b, 0x7)
+	b = quicvarint.Append(b, uint64(quicvarint.Len(uint64(f.StreamID))))
+	return quicvarint.Append(b, uint64(f.StreamID))
+}
+
+// PRIORITY_UPDATE, RFC 9218
+type priorityUpdateFrame struct {
+	ElementID          uint64
+	PriorityFieldValue string
+}
+
+const maxPriorityUpdateFrameSize = 4 << 10
+
+func parsePriorityUpdateFrame(r *countingByteReader, l uint64, streamID quic.StreamID, qlogger qlogwriter.Recorder) (*priorityUpdateFrame, error) {
+	if l > maxPriorityUpdateFrameSize {
+		return nil, fmt.Errorf("unexpected size for PRIORITY_UPDATE frame: %d", l)
+	}
+	buf := make([]byte, l)
+	if _, err := io.ReadFull(r, buf); err != nil {
+		if err == io.ErrUnexpectedEOF {
+			return nil, io.EOF
+		}
+		return nil, err
+	}
+	id, n, err := quicvarint.Parse(buf)
+	if err != nil {
+		return nil, err
+	}
+	frame := &priorityUpdateFrame{
+		ElementID:          id,
+		PriorityFieldValue: string(buf[n:]),
+	}
+	if qlogger != nil {
+		qlogger.RecordEvent(qlog.FrameParsed{
+			StreamID: streamID,
+			Raw:      qlog.RawInfo{Length: r.NumRead, PayloadLength: int(l)},
+			Frame: qlog.Frame{Frame: qlog.PriorityUpdateFrame{
+				StreamID:           quic.StreamID(frame.ElementID),
+				PriorityFieldValue: frame.PriorityFieldValue,
+			}},
+		})
+	}
+	return frame, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/frames_test.go b/electron/native/private-transport/third_party/quic-go/http3/frames_test.go
new file mode 100644
index 000000000..1e640d93b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/frames_test.go
@@ -0,0 +1,518 @@
+package http3
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	ossfuzzseeds "github.com/quic-go/go-ossfuzz-seeds"
+
+	"github.com/stretchr/testify/require"
+)
+
+func testFrameParserEOF(t *testing.T, data []byte) {
+	t.Helper()
+	for i := range data {
+		b := make([]byte, i)
+		copy(b, data[:i])
+		fp := frameParser{r: bytes.NewReader(b)}
+		_, err := fp.ParseNext(nil)
+		require.Error(t, err)
+		require.ErrorIs(t, err, io.EOF)
+	}
+}
+
+func TestParserReservedFrameType(t *testing.T) {
+	for _, ft := range []uint64{0x2, 0x6, 0x8, 0x9} {
+		t.Run(fmt.Sprintf("type %#x", ft), func(t *testing.T) {
+			var eventRecorder events.Recorder
+			client, server := newConnPair(t, withDatagrams(), withServerRecorder(&eventRecorder))
+
+			data := quicvarint.Append(nil, ft)
+			data = quicvarint.Append(data, 6)
+			data = append(data, []byte("foobar")...)
+
+			fp := frameParser{
+				streamID:  42,
+				r:         bytes.NewReader(data),
+				closeConn: client.CloseWithError,
+			}
+			_, err := fp.ParseNext(&eventRecorder)
+			require.Error(t, err)
+			require.ErrorContains(t, err, "http3: reserved frame type")
+
+			select {
+			case <-server.Context().Done():
+				require.ErrorIs(t,
+					context.Cause(server.Context()),
+					&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(ErrCodeFrameUnexpected)},
+				)
+			case <-time.After(time.Second):
+				t.Fatal("timeout")
+			}
+
+			require.Equal(t,
+				[]qlogwriter.Event{
+					qlog.FrameParsed{
+						StreamID: 42,
+						Raw:      qlog.RawInfo{Length: len(data), PayloadLength: 6},
+						Frame:    qlog.Frame{Frame: qlog.ReservedFrame{Type: ft}},
+					},
+				},
+				eventRecorder.Events(qlog.FrameParsed{}),
+			)
+		})
+	}
+}
+
+func TestParserUnknownFrameType(t *testing.T) {
+	data := quicvarint.Append(nil, 0xdead)
+	data = quicvarint.Append(data, 6)
+	data = append(data, []byte("foobar")...)
+	data = quicvarint.Append(data, 0xbeef)
+	data = quicvarint.Append(data, 3)
+	data = append(data, []byte("baz")...)
+	hf := &headersFrame{Length: 3}
+	data = hf.Append(data)
+	data = append(data, []byte("foo")...)
+
+	r := bytes.NewReader(data)
+	fp := frameParser{r: r}
+	f, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &headersFrame{}, f)
+	hf = f.(*headersFrame)
+	require.Equal(t, uint64(3), hf.Length)
+	payload := make([]byte, 3)
+	_, err = io.ReadFull(r, payload)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foo"), payload)
+}
+
+func TestParserUnsupportedFrameTypes(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		ft   uint64
+		qf   any
+	}{
+		{name: "CANCEL_PUSH", ft: 0x3, qf: qlog.CancelPushFrame{}},
+		{name: "PUSH_PROMISE", ft: 0x5, qf: qlog.PushPromiseFrame{}},
+		{name: "MAX_PUSH_ID", ft: 0xd, qf: qlog.MaxPushIDFrame{}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var eventRecorder events.Recorder
+
+			data := quicvarint.Append(nil, tc.ft)
+			data = quicvarint.Append(data, 6)
+			data = append(data, []byte("foobar")...)
+			df := &dataFrame{Length: 3}
+			data = df.Append(data)
+			data = append(data, []byte("foo")...)
+
+			r := bytes.NewReader(data)
+			fp := frameParser{streamID: 42, r: r}
+
+			f, err := fp.ParseNext(&eventRecorder)
+			require.NoError(t, err)
+			require.IsType(t, &dataFrame{}, f)
+			df = f.(*dataFrame)
+			require.Equal(t, uint64(3), df.Length)
+			payload := make([]byte, 3)
+			_, err = io.ReadFull(r, payload)
+			require.NoError(t, err)
+			require.Equal(t, []byte("foo"), payload)
+
+			headerLen := quicvarint.Len(tc.ft) + quicvarint.Len(6)
+			dfLen, _ := expectedFrameLength(t, df)
+			require.Equal(t,
+				[]qlogwriter.Event{
+					qlog.FrameParsed{
+						StreamID: 42,
+						Raw:      qlog.RawInfo{Length: headerLen, PayloadLength: 6},
+						Frame:    qlog.Frame{Frame: tc.qf},
+					},
+					qlog.FrameParsed{
+						StreamID: 42,
+						Raw:      qlog.RawInfo{Length: dfLen, PayloadLength: 3},
+						Frame:    qlog.Frame{Frame: qlog.DataFrame{}},
+					},
+				},
+				eventRecorder.Events(qlog.FrameParsed{}),
+			)
+		})
+	}
+}
+
+func TestParserHeadersFrame(t *testing.T) {
+	data := quicvarint.Append(nil, 1) // type byte
+	data = quicvarint.Append(data, 0x1337)
+	fp := frameParser{r: bytes.NewReader(data)}
+
+	// incomplete data results in an io.EOF
+	testFrameParserEOF(t, data)
+
+	// parse
+	f1, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &headersFrame{}, f1)
+	require.Equal(t, uint64(0x1337), f1.(*headersFrame).Length)
+
+	// write and parse
+	fp = frameParser{r: bytes.NewReader(f1.(*headersFrame).Append(nil))}
+	f2, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.Equal(t, f1, f2)
+}
+
+func TestDataFrame(t *testing.T) {
+	data := quicvarint.Append(nil, 0) // type byte
+	data = quicvarint.Append(data, 0x1337)
+	fp := frameParser{r: bytes.NewReader(data)}
+
+	// incomplete data results in an io.EOF
+	testFrameParserEOF(t, data)
+
+	// parse
+	f1, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &dataFrame{}, f1)
+	require.Equal(t, uint64(0x1337), f1.(*dataFrame).Length)
+
+	// write and parse
+	fp = frameParser{r: bytes.NewReader(f1.(*dataFrame).Append(nil))}
+	f2, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.Equal(t, f1, f2)
+}
+
+func appendSetting(b []byte, key, value uint64) []byte {
+	b = quicvarint.Append(b, key)
+	b = quicvarint.Append(b, value)
+	return b
+}
+
+func TestParserSettingsFrame(t *testing.T) {
+	settings := appendSetting(nil, 13, 37)
+	settings = appendSetting(settings, 0xdead, 0xbeef)
+	data := quicvarint.Append(nil, 4) // type byte
+	data = quicvarint.Append(data, uint64(len(settings)))
+	data = append(data, settings...)
+
+	// incomplete data results in an io.EOF
+	testFrameParserEOF(t, data)
+
+	fp := frameParser{r: bytes.NewReader(data)}
+	frame, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &settingsFrame{}, frame)
+	sf := frame.(*settingsFrame)
+	require.Len(t, sf.Other, 2)
+	require.Equal(t, uint64(37), sf.Other[uint64(13)])
+	require.Equal(t, uint64(0xbeef), sf.Other[uint64(0xdead)])
+
+	// write and parse
+	fp = frameParser{r: bytes.NewReader(sf.Append(nil))}
+	f2, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &settingsFrame{}, f2)
+	sf2 := f2.(*settingsFrame)
+	require.Len(t, sf2.Other, len(sf.Other))
+	require.Equal(t, sf.Other, sf2.Other)
+}
+
+func TestParserSettingsFrameDuplicateSettings(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		num  uint64
+		val  uint64
+	}{
+		{
+			name: "other setting",
+			num:  13,
+			val:  37,
+		},
+		{
+			name: "extended connect",
+			num:  settingExtendedConnect,
+			val:  1,
+		},
+		{
+			name: "max field section size",
+			num:  settingMaxFieldSectionSize,
+			val:  1337,
+		},
+		{
+			name: "datagram",
+			num:  settingDatagram,
+			val:  1,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			settings := appendSetting(nil, tc.num, tc.val)
+			settings = appendSetting(settings, tc.num, tc.val)
+			data := quicvarint.Append(nil, 4) // type byte
+			data = quicvarint.Append(data, uint64(len(settings)))
+			data = append(data, settings...)
+			fp := frameParser{r: bytes.NewReader(data)}
+			_, err := fp.ParseNext(nil)
+			require.Error(t, err)
+			require.EqualError(t, err, fmt.Sprintf("duplicate setting: %d", tc.num))
+		})
+	}
+}
+
+func TestParserSettingsFrameMaxFieldSectionSize(t *testing.T) {
+	t.Run("absent", func(t *testing.T) {
+		testParserSettingsFrameMaxFieldSectionSize(t, false)
+	})
+
+	t.Run("with value", func(t *testing.T) {
+		testParserSettingsFrameMaxFieldSectionSize(t, true)
+	})
+}
+
+func testParserSettingsFrameMaxFieldSectionSize(t *testing.T, present bool) {
+	var settings []byte
+	if present {
+		settings = appendSetting(nil, settingMaxFieldSectionSize, 1337)
+	}
+	data := quicvarint.Append(nil, 4) // type byte
+	data = quicvarint.Append(data, uint64(len(settings)))
+	data = append(data, settings...)
+
+	fp := frameParser{r: bytes.NewReader(data)}
+	f, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &settingsFrame{}, f)
+	sf := f.(*settingsFrame)
+	if present {
+		require.EqualValues(t, 1337, sf.MaxFieldSectionSize)
+	} else {
+		require.EqualValues(t, -1, sf.MaxFieldSectionSize)
+	}
+
+	fp = frameParser{r: bytes.NewReader(sf.Append(nil))}
+	f2, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.Equal(t, sf, f2)
+}
+
+func TestParserSettingsFrameDatagram(t *testing.T) {
+	t.Run("enabled", func(t *testing.T) {
+		testParserSettingsFrameDatagram(t, true)
+	})
+	t.Run("disabled", func(t *testing.T) {
+		testParserSettingsFrameDatagram(t, false)
+	})
+}
+
+func testParserSettingsFrameDatagram(t *testing.T, enabled bool) {
+	var settings []byte
+	switch enabled {
+	case true:
+		settings = appendSetting(nil, settingDatagram, 1)
+	case false:
+		settings = appendSetting(nil, settingDatagram, 0)
+	}
+	data := quicvarint.Append(nil, 4) // type byte
+	data = quicvarint.Append(data, uint64(len(settings)))
+	data = append(data, settings...)
+
+	fp := frameParser{r: bytes.NewReader(data)}
+	f, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &settingsFrame{}, f)
+	sf := f.(*settingsFrame)
+	require.Equal(t, enabled, sf.Datagram)
+
+	fp = frameParser{r: bytes.NewReader(sf.Append(nil))}
+	f2, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.Equal(t, sf, f2)
+}
+
+func TestParserSettingsFrameDatagramInvalidValue(t *testing.T) {
+	settings := quicvarint.Append(nil, settingDatagram)
+	settings = quicvarint.Append(settings, 1337)
+	data := quicvarint.Append(nil, 4) // type byte
+	data = quicvarint.Append(data, uint64(len(settings)))
+	data = append(data, settings...)
+	fp := frameParser{r: bytes.NewReader(data)}
+	_, err := fp.ParseNext(nil)
+	require.EqualError(t, err, "invalid value for SETTINGS_H3_DATAGRAM: 1337")
+}
+
+func TestParserSettingsFrameExtendedConnect(t *testing.T) {
+	t.Run("enabled", func(t *testing.T) {
+		testParserSettingsFrameExtendedConnect(t, true)
+	})
+	t.Run("disabled", func(t *testing.T) {
+		testParserSettingsFrameExtendedConnect(t, false)
+	})
+}
+
+func testParserSettingsFrameExtendedConnect(t *testing.T, enabled bool) {
+	var settings []byte
+	switch enabled {
+	case true:
+		settings = appendSetting(nil, settingExtendedConnect, 1)
+	case false:
+		settings = appendSetting(nil, settingExtendedConnect, 0)
+	}
+	data := quicvarint.Append(nil, 4) // type byte
+	data = quicvarint.Append(data, uint64(len(settings)))
+	data = append(data, settings...)
+
+	fp := frameParser{r: bytes.NewReader(data)}
+	f, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &settingsFrame{}, f)
+	sf := f.(*settingsFrame)
+	require.Equal(t, enabled, sf.ExtendedConnect)
+
+	fp = frameParser{r: bytes.NewReader(sf.Append(nil))}
+	f2, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.Equal(t, sf, f2)
+}
+
+func TestParserSettingsFrameExtendedConnectInvalidValue(t *testing.T) {
+	settings := quicvarint.Append(nil, settingExtendedConnect)
+	settings = quicvarint.Append(settings, 1337)
+	data := quicvarint.Append(nil, 4) // type byte
+	data = quicvarint.Append(data, uint64(len(settings)))
+	data = append(data, settings...)
+	fp := frameParser{r: bytes.NewReader(data)}
+	_, err := fp.ParseNext(nil)
+	require.EqualError(t, err, "invalid value for SETTINGS_ENABLE_CONNECT_PROTOCOL: 1337")
+}
+
+func TestParserGoAwayFrame(t *testing.T) {
+	data := quicvarint.Append(nil, 7) // type byte
+	data = quicvarint.Append(data, uint64(quicvarint.Len(100)))
+	data = quicvarint.Append(data, 100)
+
+	// incomplete data results in an io.EOF
+	testFrameParserEOF(t, data)
+
+	fp := frameParser{r: bytes.NewReader(data)}
+	f, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &goAwayFrame{}, f)
+	require.Equal(t, quic.StreamID(100), f.(*goAwayFrame).StreamID)
+
+	// write and parse
+	fp = frameParser{r: bytes.NewReader(f.(*goAwayFrame).Append(nil))}
+	f2, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.Equal(t, f, f2)
+}
+
+func TestParserPriorityUpdateFrame(t *testing.T) {
+	var eventRecorder events.Recorder
+	frame := &priorityUpdateFrame{ElementID: 12, PriorityFieldValue: "u=1, i"}
+	payload := quicvarint.Append(nil, frame.ElementID)
+	payload = append(payload, frame.PriorityFieldValue...)
+	data := quicvarint.Append(nil, 0xf0700)
+	data = quicvarint.Append(data, uint64(len(payload)))
+	data = append(data, payload...)
+	testFrameParserEOF(t, data)
+
+	parsed, err := (&frameParser{streamID: 42, r: bytes.NewReader(data)}).ParseNext(&eventRecorder)
+	require.NoError(t, err)
+	require.Equal(t, frame, parsed)
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.FrameParsed{
+			StreamID: 42,
+			Raw:      qlog.RawInfo{Length: len(data), PayloadLength: len(payload)},
+			Frame: qlog.Frame{Frame: qlog.PriorityUpdateFrame{
+				StreamID:           12,
+				PriorityFieldValue: "u=1, i",
+			}},
+		}},
+		eventRecorder.Events(qlog.FrameParsed{}),
+	)
+
+	data = quicvarint.Append(nil, 0xf0701)
+	data = quicvarint.Append(data, 42) // the payload is intentionally omitted
+	_, err = (&frameParser{r: bytes.NewReader(data)}).ParseNext(nil)
+	require.ErrorIs(t, err, errPriorityUpdateForPush)
+}
+
+func FuzzFrameParser(f *testing.F) {
+	corpus := ossfuzzseeds.New(f)
+
+	frames := []interface{ Append([]byte) []byte }{
+		&dataFrame{Length: 5},
+		&headersFrame{Length: 3},
+		&settingsFrame{
+			MaxFieldSectionSize: 1337,
+			Datagram:            true,
+			ExtendedConnect:     true,
+			Other:               map[uint64]uint64{0xdead: 0xbeef},
+		},
+		&goAwayFrame{StreamID: 42},
+	}
+	for _, fr := range frames {
+		corpus.Add(fr.Append(nil))
+	}
+
+	unknown := quicvarint.Append(nil, 0xdead)
+	unknown = quicvarint.Append(unknown, 6)
+	unknown = append(unknown, []byte("foobar")...)
+	corpus.Add(unknown)
+
+	f.Fuzz(func(t *testing.T, data []byte) {
+		fp := frameParser{
+			r:         bytes.NewReader(data),
+			closeConn: func(quic.ApplicationErrorCode, string) error { return nil },
+		}
+		for {
+			fr, err := fp.ParseNext(nil)
+			if err != nil {
+				return
+			}
+
+			switch f := fr.(type) {
+			case *dataFrame:
+				if _, err := io.CopyN(io.Discard, fp.r, int64(f.Length)); err != nil {
+					return
+				}
+			case *headersFrame:
+				// Type and length are each at least one varint byte; HTTP/3 caps the pair at frameHeaderLen.
+				if f.headerLen < 2 || f.headerLen > frameHeaderLen {
+					t.Fatalf("HEADERS: headerLen %d outside [2, %d]", f.headerLen, frameHeaderLen)
+				}
+				if _, err := io.CopyN(io.Discard, fp.r, int64(f.Length)); err != nil {
+					return
+				}
+			case *settingsFrame:
+				// Unset uses -1; a present SETTINGS_MAX_FIELD_SECTION_SIZE is non-negative (see parseSettingsFrame).
+				if f.MaxFieldSectionSize != -1 && f.MaxFieldSectionSize < 0 {
+					t.Fatalf("SETTINGS: invalid MaxFieldSectionSize %d", f.MaxFieldSectionSize)
+				}
+				// Known settings are never stored in Other on a successful parse.
+				for id := range f.Other {
+					switch id {
+					case settingMaxFieldSectionSize, settingExtendedConnect, settingDatagram:
+						t.Fatalf("SETTINGS: known setting id %#x leaked into Other", id)
+					}
+				}
+			case *goAwayFrame:
+				// QUIC stream IDs fit in 62 bits; a negative value means uint64→int64 overflow in the parser.
+				if f.StreamID < 0 {
+					t.Fatalf("GOAWAY: negative StreamID %d", f.StreamID)
+				}
+			}
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/gzip_reader.go b/electron/native/private-transport/third_party/quic-go/http3/gzip_reader.go
new file mode 100644
index 000000000..01983ac77
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/gzip_reader.go
@@ -0,0 +1,39 @@
+package http3
+
+// copied from net/transport.go
+
+// gzipReader wraps a response body so it can lazily
+// call gzip.NewReader on the first call to Read
+import (
+	"compress/gzip"
+	"io"
+)
+
+// call gzip.NewReader on the first call to Read
+type gzipReader struct {
+	body io.ReadCloser // underlying Response.Body
+	zr   *gzip.Reader  // lazily-initialized gzip reader
+	zerr error         // sticky error
+}
+
+func newGzipReader(body io.ReadCloser) io.ReadCloser {
+	return &gzipReader{body: body}
+}
+
+func (gz *gzipReader) Read(p []byte) (n int, err error) {
+	if gz.zerr != nil {
+		return 0, gz.zerr
+	}
+	if gz.zr == nil {
+		gz.zr, err = gzip.NewReader(gz.body)
+		if err != nil {
+			gz.zerr = err
+			return 0, err
+		}
+	}
+	return gz.zr.Read(p)
+}
+
+func (gz *gzipReader) Close() error {
+	return gz.body.Close()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/headers.go b/electron/native/private-transport/third_party/quic-go/http3/headers.go
new file mode 100644
index 000000000..5819ee9e3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/headers.go
@@ -0,0 +1,472 @@
+package http3
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"slices"
+	"strconv"
+	"strings"
+
+	"golang.org/x/net/http/httpguts"
+
+	"github.com/quic-go/qpack"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+type qpackError struct{ err error }
+
+func (e *qpackError) Error() string { return fmt.Sprintf("qpack: %v", e.err) }
+func (e *qpackError) Unwrap() error { return e.err }
+
+var errHeaderTooLarge = errors.New("http3: headers too large")
+
+type header struct {
+	// Pseudo header fields defined in RFC 9114
+	Path      string
+	Method    string
+	Authority string
+	Scheme    string
+	Status    string
+	// for Extended connect
+	Protocol string
+	// parsed and deduplicated. -1 if no Content-Length header is sent
+	ContentLength int64
+	// all non-pseudo headers.
+	// Some pseudo-header keys with nil values are temporarily added to track presence.
+	Headers http.Header
+}
+
+// connection-specific header fields must not be sent on HTTP/3
+var invalidHeaderFields = [...]string{
+	"connection",
+	"keep-alive",
+	"proxy-connection",
+	"transfer-encoding",
+	"upgrade",
+}
+
+func parseHeaders(decodeFn qpack.DecodeFunc, isRequest bool, sizeLimit int, headerFields *[]qpack.HeaderField) (header, error) {
+	hdr := header{Headers: make(http.Header)}
+	var readFirstRegularHeader, readContentLength, hasMethod, hasStatus bool
+	var contentLengthStr string
+	for {
+		h, err := decodeFn()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return header{}, &qpackError{err}
+		}
+		if headerFields != nil {
+			*headerFields = append(*headerFields, h)
+		}
+		// RFC 9114, section 4.2.2:
+		// The size of a field list is calculated based on the uncompressed size of fields,
+		// including the length of the name and value in bytes plus an overhead of 32 bytes for each field.
+		sizeLimit -= len(h.Name) + len(h.Value) + 32
+		if sizeLimit < 0 {
+			return header{}, errHeaderTooLarge
+		}
+		if err := validateHeaderFieldNameAndValue(h); err != nil {
+			return header{}, err
+		}
+		if h.IsPseudo() {
+			if readFirstRegularHeader {
+				// all pseudo headers must appear before regular header fields, see section 4.3 of RFC 9114
+				return header{}, fmt.Errorf("received pseudo header %s after a regular header field", h.Name)
+			}
+			var isResponsePseudoHeader bool  // pseudo headers are either valid for requests or for responses
+			var isDuplicatePseudoHeader bool // pseudo headers are allowed to appear exactly once
+			switch h.Name {
+			case ":path":
+				_, isDuplicatePseudoHeader = hdr.Headers[h.Name]
+				hdr.Headers[h.Name] = nil
+				hdr.Path = h.Value
+			case ":method":
+				isDuplicatePseudoHeader = hasMethod
+				hasMethod = true
+				hdr.Method = h.Value
+			case ":authority":
+				_, isDuplicatePseudoHeader = hdr.Headers[h.Name]
+				hdr.Headers[h.Name] = nil
+				hdr.Authority = h.Value
+			case ":protocol": // RFC 9220
+				_, isDuplicatePseudoHeader = hdr.Headers[h.Name]
+				hdr.Headers[h.Name] = nil
+				hdr.Protocol = h.Value
+			case ":scheme":
+				_, isDuplicatePseudoHeader = hdr.Headers[h.Name]
+				hdr.Headers[h.Name] = nil
+				// URI schemes are case-insensitive and canonically lowercase, see section 3.1 of RFC 3986
+				hdr.Scheme = strings.ToLower(h.Value)
+			case ":status":
+				isDuplicatePseudoHeader = hasStatus
+				hasStatus = true
+				hdr.Status = h.Value
+				isResponsePseudoHeader = true
+			default:
+				return header{}, fmt.Errorf("unknown pseudo header: %s", h.Name)
+			}
+			if isDuplicatePseudoHeader {
+				return header{}, fmt.Errorf("duplicate pseudo header: %s", h.Name)
+			}
+			if isRequest && isResponsePseudoHeader {
+				return header{}, fmt.Errorf("invalid request pseudo header: %s", h.Name)
+			}
+			if !isRequest && !isResponsePseudoHeader {
+				return header{}, fmt.Errorf("invalid response pseudo header: %s", h.Name)
+			}
+		} else {
+			if err := validateRegularHeaderField(h); err != nil {
+				return header{}, err
+			}
+			readFirstRegularHeader = true
+			switch h.Name {
+			case "content-length":
+				// Ignore duplicate Content-Length headers.
+				// Fail if the duplicates differ.
+				if !readContentLength {
+					readContentLength = true
+					contentLengthStr = h.Value
+				} else if contentLengthStr != h.Value {
+					return header{}, fmt.Errorf("contradicting content lengths (%s and %s)", contentLengthStr, h.Value)
+				}
+			default:
+				hdr.Headers.Add(h.Name, h.Value)
+			}
+		}
+	}
+	hdr.ContentLength = -1
+	if len(contentLengthStr) > 0 {
+		// use ParseUint instead of ParseInt, so that parsing fails on negative values
+		cl, err := strconv.ParseUint(contentLengthStr, 10, 63)
+		if err != nil {
+			return header{}, fmt.Errorf("invalid content length: %w", err)
+		}
+		hdr.Headers.Set("Content-Length", contentLengthStr)
+		hdr.ContentLength = int64(cl)
+	}
+	return hdr, nil
+}
+
+func validateHeaderFieldNameAndValue(h qpack.HeaderField) error {
+	// field names need to be lowercase, see section 4.2 of RFC 9114
+	if strings.ToLower(h.Name) != h.Name {
+		return fmt.Errorf("header field is not lower-case: %s", h.Name)
+	}
+	if !httpguts.ValidHeaderFieldValue(h.Value) {
+		return fmt.Errorf("invalid header field value for %s: %q", h.Name, h.Value)
+	}
+	return nil
+}
+
+func validateRegularHeaderField(h qpack.HeaderField) error {
+	if !httpguts.ValidHeaderFieldName(h.Name) {
+		return fmt.Errorf("invalid header field name: %q", h.Name)
+	}
+	if slices.Contains(invalidHeaderFields[:], h.Name) {
+		return fmt.Errorf("invalid header field name: %q", h.Name)
+	}
+	if h.Name == "te" && h.Value != "trailers" {
+		return fmt.Errorf("invalid TE header field value: %q", h.Value)
+	}
+	return nil
+}
+
+func validateTrailerHeaderField(h qpack.HeaderField) error {
+	if err := validateRegularHeaderField(h); err != nil {
+		return err
+	}
+	if !httpguts.ValidTrailerHeader(h.Name) {
+		return fmt.Errorf("invalid trailer field name: %q", h.Name)
+	}
+	return nil
+}
+
+func parseTrailers(decodeFn qpack.DecodeFunc, sizeLimit int, headerFields *[]qpack.HeaderField) (http.Header, error) {
+	h := make(http.Header)
+	for {
+		hf, err := decodeFn()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return nil, &qpackError{err}
+		}
+		if headerFields != nil {
+			*headerFields = append(*headerFields, hf)
+		}
+		// RFC 9114, section 4.2.2:
+		// The size of a field list is calculated based on the uncompressed size of fields,
+		// including the length of the name and value in bytes plus an overhead of 32 bytes for each field.
+		sizeLimit -= len(hf.Name) + len(hf.Value) + 32
+		if sizeLimit < 0 {
+			return nil, errHeaderTooLarge
+		}
+		if err := validateHeaderFieldNameAndValue(hf); err != nil {
+			return nil, err
+		}
+		if hf.IsPseudo() {
+			return nil, fmt.Errorf("http3: received pseudo header in trailer: %s", hf.Name)
+		}
+		if err := validateTrailerHeaderField(hf); err != nil {
+			return nil, err
+		}
+		h.Add(hf.Name, hf.Value)
+	}
+	return h, nil
+}
+
+func requestFromHeaders(decodeFn qpack.DecodeFunc, sizeLimit int, headerFields *[]qpack.HeaderField) (*http.Request, error) {
+	hdr, err := parseHeaders(decodeFn, true, sizeLimit, headerFields)
+	if err != nil {
+		return nil, err
+	}
+	_, hasPath := hdr.Headers[":path"]
+	_, hasAuthority := hdr.Headers[":authority"]
+	_, hasScheme := hdr.Headers[":scheme"]
+	_, hasProtocol := hdr.Headers[":protocol"]
+	delete(hdr.Headers, ":path")
+	delete(hdr.Headers, ":authority")
+	delete(hdr.Headers, ":scheme")
+	delete(hdr.Headers, ":protocol")
+
+	if hdr.Method == "" {
+		return nil, errors.New(":method must not be empty")
+	}
+	if !validMethod(hdr.Method) {
+		return nil, fmt.Errorf("invalid :method: %q", hdr.Method)
+	}
+
+	// RFC 9114, Section 4.3.1 allows Host as an alternative to :authority.
+	hosts := hdr.Headers["Host"]
+	if len(hosts) > 1 {
+		return nil, errors.New("too many Host headers")
+	}
+	host := hdr.Headers.Get("Host")
+	// If both are present, they must contain the same value.
+	if hasAuthority && len(hosts) > 0 && hdr.Authority != host {
+		return nil, errors.New(":authority and Host header field values do not match")
+	}
+	isConnect := hdr.Method == http.MethodConnect
+	// If :authority is missing, use Host as a fallback for HTTP(S) requests.
+	// CONNECT requests are excluded since they must provide :authority (RFC 9114, Section 4.4).
+	if !isConnect && !hasAuthority && (hdr.Scheme == "http" || hdr.Scheme == "https") {
+		hdr.Authority = host
+	}
+	if strings.Contains(hdr.Authority, "@") && (hdr.Scheme == "http" || hdr.Scheme == "https") {
+		return nil, errors.New("userinfo is not allowed in :authority")
+	}
+
+	// concatenate cookie headers, see https://tools.ietf.org/html/rfc6265#section-5.4
+	if len(hdr.Headers["Cookie"]) > 0 {
+		hdr.Headers.Set("Cookie", strings.Join(hdr.Headers["Cookie"], "; "))
+	}
+
+	// Extended CONNECT, see https://datatracker.ietf.org/doc/html/rfc8441#section-4
+	isExtendedConnected := isConnect && hdr.Protocol != ""
+	if isExtendedConnected {
+		if !validExtendedConnectProtocol(hdr.Protocol) {
+			return nil, fmt.Errorf("invalid :protocol: %q", hdr.Protocol)
+		}
+		if hdr.Scheme == "" || hdr.Path == "" || hdr.Authority == "" {
+			return nil, errors.New("extended CONNECT: :scheme, :path and :authority must not be empty")
+		}
+	} else if isConnect {
+		if hasScheme || hasPath || hdr.Authority == "" { // normal CONNECT
+			return nil, errors.New(":scheme and :path must be omitted and :authority must not be empty")
+		}
+	} else if len(hdr.Path) == 0 || len(hdr.Authority) == 0 {
+		return nil, errors.New(":path and :authority must not be empty")
+	}
+
+	if !isExtendedConnected && hasProtocol {
+		return nil, errors.New(":protocol must be omitted")
+	}
+
+	var u *url.URL
+	var requestURI string
+
+	protocol := "HTTP/3.0"
+
+	if isConnect {
+		u = &url.URL{}
+		if isExtendedConnected {
+			u, err = url.ParseRequestURI(hdr.Path)
+			if err != nil {
+				return nil, err
+			}
+			protocol = hdr.Protocol
+		} else {
+			u.Path = hdr.Path
+		}
+		requestURI = hdr.Authority
+	} else {
+		u, err = url.ParseRequestURI(hdr.Path)
+		if err != nil {
+			return nil, fmt.Errorf("invalid request URI: %w", err)
+		}
+		requestURI = hdr.Path
+	}
+	u.Scheme = hdr.Scheme
+	u.Host = hdr.Authority
+
+	req := &http.Request{
+		Method:        hdr.Method,
+		URL:           u,
+		Proto:         protocol,
+		ProtoMajor:    3,
+		ProtoMinor:    0,
+		Header:        hdr.Headers,
+		Body:          nil,
+		ContentLength: hdr.ContentLength,
+		Host:          hdr.Authority,
+		RequestURI:    requestURI,
+	}
+	req.Trailer = extractAnnouncedTrailers(req.Header)
+	return req, nil
+}
+
+func validExtendedConnectProtocol(protocol string) bool {
+	// RFC 9220 specifies that the semantics of the :protocol pseudo are the same as defined in RFC 8441.
+	// RFC 8441, Section 4 specifies that :protocol is a single value from the HTTP Upgrade Token Registry.
+	// RFC 9110, Section 16.7 specifies that HTTP Upgrade Token Registry uses token grammar.
+	// Therefore, ValidHeaderFieldName is the right syntax check here, despite the misleading name.
+	return httpguts.ValidHeaderFieldName(protocol)
+}
+
+// updateResponseFromHeaders sets up http.Response as an HTTP/3 response,
+// using the decoded qpack header filed.
+// It is only called for the HTTP header (and not the HTTP trailer).
+// It takes an http.Response as an argument to allow the caller to set the trailer later on.
+func updateResponseFromHeaders(rsp *http.Response, decodeFn qpack.DecodeFunc, sizeLimit int, headerFields *[]qpack.HeaderField) error {
+	hdr, err := parseHeaders(decodeFn, false, sizeLimit, headerFields)
+	if err != nil {
+		return err
+	}
+	if hdr.Status == "" {
+		return errors.New("missing :status field")
+	}
+	rsp.Proto = "HTTP/3.0"
+	rsp.ProtoMajor = 3
+	rsp.Header = hdr.Headers
+	rsp.Trailer = extractAnnouncedTrailers(rsp.Header)
+	rsp.ContentLength = hdr.ContentLength
+
+	status, err := strconv.Atoi(hdr.Status)
+	if err != nil {
+		return fmt.Errorf("invalid status code: %w", err)
+	}
+	rsp.StatusCode = status
+	rsp.Status = hdr.Status + " " + http.StatusText(status)
+	return nil
+}
+
+// extractAnnouncedTrailers extracts trailer keys from the "Trailer" header.
+// It returns a map with the announced keys set to nil values, and removes the "Trailer" header.
+// It handles both duplicate as well as comma-separated values for the Trailer header.
+// For example:
+//
+//	Trailer: Trailer1, Trailer2
+//	Trailer: Trailer3
+//
+// Will result in a map containing the keys "Trailer1", "Trailer2", "Trailer3" with nil values.
+func extractAnnouncedTrailers(header http.Header) http.Header {
+	rawTrailers, ok := header["Trailer"]
+	if !ok {
+		return nil
+	}
+
+	trailers := make(http.Header)
+	for _, rawVal := range rawTrailers {
+		for val := range strings.SplitSeq(rawVal, ",") {
+			trailers[http.CanonicalHeaderKey(textproto.TrimString(val))] = nil
+		}
+	}
+	delete(header, "Trailer")
+	return trailers
+}
+
+// writeTrailers encodes and writes HTTP trailers as a HEADERS frame.
+// It returns true if trailers were written, false if there were no trailers to write.
+func writeTrailers(wr io.Writer, trailers http.Header, streamID quic.StreamID, qlogger qlogwriter.Recorder) (bool, error) {
+	var hasValues bool
+	for k, vals := range trailers {
+		if httpguts.ValidTrailerHeader(k) && len(vals) > 0 {
+			hasValues = true
+			break
+		}
+	}
+	if !hasValues {
+		return false, nil
+	}
+
+	var buf bytes.Buffer
+	enc := qpack.NewEncoder(&buf)
+	var headerFields []qlog.HeaderField
+	if qlogger != nil {
+		headerFields = make([]qlog.HeaderField, 0, len(trailers))
+	}
+
+	for k, vals := range trailers {
+		if len(vals) == 0 {
+			continue
+		}
+		if !httpguts.ValidTrailerHeader(k) {
+			continue
+		}
+		lowercaseKey := strings.ToLower(k)
+		for _, v := range vals {
+			if err := enc.WriteField(qpack.HeaderField{Name: lowercaseKey, Value: v}); err != nil {
+				return false, err
+			}
+			if qlogger != nil {
+				headerFields = append(headerFields, qlog.HeaderField{Name: lowercaseKey, Value: v})
+			}
+		}
+	}
+
+	b := make([]byte, 0, frameHeaderLen+buf.Len())
+	b = (&headersFrame{Length: uint64(buf.Len())}).Append(b)
+	b = append(b, buf.Bytes()...)
+	if qlogger != nil {
+		qlogCreatedHeadersFrame(qlogger, streamID, len(b), buf.Len(), headerFields)
+	}
+	_, err := wr.Write(b)
+	return true, err
+}
+
+func decodeTrailers(r io.Reader, hf *headersFrame, maxHeaderBytes int, decoder *qpack.Decoder, qlogger qlogwriter.Recorder, streamID quic.StreamID) (http.Header, error) {
+	if hf.Length > uint64(maxHeaderBytes) {
+		maybeQlogInvalidHeadersFrame(qlogger, streamID, hf.Length)
+		return nil, fmt.Errorf("http3: HEADERS frame too large: %d bytes (max: %d)", hf.Length, maxHeaderBytes)
+	}
+
+	b := make([]byte, hf.Length)
+	if _, err := io.ReadFull(r, b); err != nil {
+		return nil, err
+	}
+	decodeFn := decoder.Decode(b)
+	var fields []qpack.HeaderField
+	var headerFields *[]qpack.HeaderField
+	if qlogger != nil {
+		fields = make([]qpack.HeaderField, 0, 16)
+		headerFields = &fields
+	}
+	trailers, err := parseTrailers(decodeFn, maxHeaderBytes, headerFields)
+	if err != nil {
+		maybeQlogInvalidHeadersFrame(qlogger, streamID, hf.Length)
+		return nil, err
+	}
+	if qlogger != nil {
+		qlogParsedHeadersFrame(qlogger, streamID, hf, fields)
+	}
+	return trailers, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/headers_test.go b/electron/native/private-transport/third_party/quic-go/http3/headers_test.go
new file mode 100644
index 000000000..137b23141
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/headers_test.go
@@ -0,0 +1,909 @@
+package http3
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"math"
+	"net/http"
+	"testing"
+
+	ossfuzzseeds "github.com/quic-go/go-ossfuzz-seeds"
+	"github.com/quic-go/qpack"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/http/httpguts"
+)
+
+func decodeFromSlice(headers []qpack.HeaderField) qpack.DecodeFunc {
+	var i int
+	return func() (qpack.HeaderField, error) {
+		if i >= len(headers) {
+			return qpack.HeaderField{}, io.EOF
+		}
+		h := headers[i]
+		i++
+		return h, nil
+	}
+}
+
+func TestRequestHeaderParsing(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		path   string
+		scheme string
+	}{
+		{name: "regular path", path: "/foo", scheme: "https"},
+		// see https://github.com/quic-go/quic-go/pull/1898
+		{name: "path starting with //", path: "//foo", scheme: "https"},
+		{name: "upper-case scheme", path: "/foo", scheme: "HTTPS"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			headers := []qpack.HeaderField{
+				{Name: ":scheme", Value: tc.scheme},
+				{Name: ":path", Value: tc.path},
+				{Name: ":authority", Value: "quic-go.net:443"},
+				{Name: ":method", Value: http.MethodGet},
+				{Name: "content-length", Value: "42"},
+			}
+			req, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+			require.NoError(t, err)
+			require.Equal(t, http.MethodGet, req.Method)
+			require.Equal(t, tc.path, req.URL.Path)
+			require.Equal(t, "quic-go.net:443", req.URL.Host)
+			require.Equal(t, "HTTP/3.0", req.Proto)
+			require.Equal(t, 3, req.ProtoMajor)
+			require.Zero(t, req.ProtoMinor)
+			require.Equal(t, int64(42), req.ContentLength)
+			require.Equal(t, 1, len(req.Header))
+			require.Equal(t, "42", req.Header.Get("Content-Length"))
+			require.Nil(t, req.Body)
+			require.Equal(t, "quic-go.net:443", req.Host)
+			require.Equal(t, tc.path, req.RequestURI)
+			require.Equal(t, "quic-go.net", req.URL.Hostname())
+			require.Equal(t, "https", req.URL.Scheme)
+			require.Equal(t, "443", req.URL.Port())
+		})
+	}
+}
+
+// TestRequestHeaderParsingWithHostHeader verifies that Host is used when :authority is omitted.
+func TestRequestHeaderParsingWithHostHeader(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":scheme", Value: "https"},
+		{Name: ":path", Value: "/"},
+		{Name: ":method", Value: http.MethodGet},
+		{Name: "host", Value: "quic-go.net"},
+	}
+	req, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+	require.NoError(t, err)
+	require.Equal(t, "quic-go.net", req.Host)
+	require.Equal(t, "quic-go.net", req.URL.Host)
+}
+
+func TestRequestHeadersContentLength(t *testing.T) {
+	t.Run("no content length", func(t *testing.T) {
+		headers := []qpack.HeaderField{
+			{Name: ":path", Value: "/"},
+			{Name: ":authority", Value: "quic-go.net"},
+			{Name: ":method", Value: http.MethodGet},
+		}
+		req, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+		require.NoError(t, err)
+		require.Equal(t, int64(-1), req.ContentLength)
+	})
+
+	t.Run("multiple content lengths", func(t *testing.T) {
+		headers := []qpack.HeaderField{
+			{Name: ":path", Value: "/"},
+			{Name: ":authority", Value: "quic-go.net"},
+			{Name: ":method", Value: http.MethodGet},
+			{Name: "content-length", Value: "42"},
+			{Name: "content-length", Value: "42"},
+		}
+		req, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+		require.NoError(t, err)
+		require.Equal(t, "42", req.Header.Get("Content-Length"))
+	})
+}
+
+func TestRequestHeadersContentLengthValidation(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		headers     []qpack.HeaderField
+		err         string
+		errContains string
+	}{
+		{
+			name: "negative content length",
+			headers: []qpack.HeaderField{
+				{Name: "content-length", Value: "-42"},
+			},
+			errContains: "invalid content length",
+		},
+		{
+			name: "multiple differing content lengths",
+			headers: []qpack.HeaderField{
+				{Name: "content-length", Value: "42"},
+				{Name: "content-length", Value: "1337"},
+			},
+			err: "contradicting content lengths (42 and 1337)",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := requestFromHeaders(decodeFromSlice(tc.headers), math.MaxInt, nil)
+			if tc.errContains != "" {
+				require.ErrorContains(t, err, tc.errContains)
+			}
+			if tc.err != "" {
+				require.EqualError(t, err, tc.err)
+			}
+		})
+	}
+}
+
+func TestRequestHeadersValidation(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		headers     []qpack.HeaderField
+		err         string
+		errContains string
+	}{
+		{
+			name: "upper-case field name",
+			headers: []qpack.HeaderField{
+				{Name: "Content-Length", Value: "42"},
+			},
+			err: "header field is not lower-case: Content-Length",
+		},
+		{
+			name: "unknown pseudo header",
+			headers: []qpack.HeaderField{
+				{Name: ":foo", Value: "bar"},
+			},
+			err: "unknown pseudo header: :foo",
+		},
+		{
+			name: "pseudo header after regular header",
+			headers: []qpack.HeaderField{
+				{Name: ":path", Value: "/foo"},
+				{Name: "content-length", Value: "42"},
+				{Name: ":authority", Value: "quic-go.net"},
+			},
+			err: "received pseudo header :authority after a regular header field",
+		},
+		{
+			name: "invalid field name",
+			headers: []qpack.HeaderField{
+				{Name: "@", Value: "42"},
+			},
+			err: `invalid header field name: "@"`,
+		},
+		{
+			name: "invalid field value",
+			headers: []qpack.HeaderField{
+				{Name: "content", Value: "\n"},
+			},
+			err: `invalid header field value for content: "\n"`,
+		},
+		{
+			name: ":status header field", // :status is a response pseudo header
+			headers: []qpack.HeaderField{
+				{Name: ":status", Value: "404"},
+			},
+			err: "invalid request pseudo header: :status",
+		},
+		{
+			name: "missing :path",
+			headers: []qpack.HeaderField{
+				{Name: ":authority", Value: "quic-go.net"},
+				{Name: ":method", Value: http.MethodGet},
+			},
+			err: ":path and :authority must not be empty",
+		},
+		{
+			name: "missing :authority",
+			headers: []qpack.HeaderField{
+				{Name: ":path", Value: "/foo"},
+				{Name: ":method", Value: http.MethodGet},
+			},
+			err: ":path and :authority must not be empty",
+		},
+		{
+			name: "missing :method",
+			headers: []qpack.HeaderField{
+				{Name: ":path", Value: "/foo"},
+				{Name: ":authority", Value: "quic-go.net"},
+			},
+			err: ":method must not be empty",
+		},
+		{
+			name: "mismatching :authority and Host header field",
+			headers: []qpack.HeaderField{
+				{Name: ":scheme", Value: "https"},
+				{Name: ":path", Value: "/foo"},
+				{Name: ":authority", Value: "quic-go.net"},
+				{Name: ":method", Value: http.MethodGet},
+				{Name: "host", Value: "example.com"},
+			},
+			err: ":authority and Host header field values do not match",
+		},
+		{
+			name: "empty :authority and non-empty Host header field",
+			headers: []qpack.HeaderField{
+				{Name: ":scheme", Value: "https"},
+				{Name: ":path", Value: "/foo"},
+				{Name: ":authority", Value: ""},
+				{Name: ":method", Value: http.MethodGet},
+				{Name: "host", Value: "example.com"},
+			},
+			err: ":authority and Host header field values do not match",
+		},
+		{
+			name: "duplicate Host header field",
+			headers: []qpack.HeaderField{
+				{Name: ":scheme", Value: "https"},
+				{Name: ":path", Value: "/foo"},
+				{Name: ":method", Value: http.MethodGet},
+				{Name: "host", Value: "quic-go.net"},
+				{Name: "host", Value: "quic-go.net"},
+			},
+			err: "too many Host headers",
+		},
+		{
+			name: "Host header field with authority-less scheme",
+			headers: []qpack.HeaderField{
+				{Name: ":scheme", Value: "urn"},
+				{Name: ":path", Value: "/"},
+				{Name: ":method", Value: http.MethodGet},
+				{Name: "host", Value: "example.com"},
+			},
+			err: ":path and :authority must not be empty",
+		},
+		{
+			name: "invalid :method",
+			headers: []qpack.HeaderField{
+				{Name: ":scheme", Value: "https"},
+				{Name: ":path", Value: "/foo"},
+				{Name: ":authority", Value: "quic-go.net"},
+				// a method must be a token, and tokens cannot contain spaces
+				{Name: ":method", Value: "GET POST"},
+			},
+			err: `invalid :method: "GET POST"`,
+		},
+		{
+			name: "duplicate :path",
+			headers: []qpack.HeaderField{
+				{Name: ":path", Value: ""},
+				{Name: ":path", Value: "/foo"},
+			},
+			err: "duplicate pseudo header: :path",
+		},
+		{
+			name: "duplicate :authority",
+			headers: []qpack.HeaderField{
+				{Name: ":authority", Value: ""},
+				{Name: ":authority", Value: "quic-go.net"},
+			},
+			err: "duplicate pseudo header: :authority",
+		},
+		{
+			name: "duplicate :method",
+			headers: []qpack.HeaderField{
+				{Name: ":method", Value: ""},
+				{Name: ":method", Value: http.MethodGet},
+			},
+			err: "duplicate pseudo header: :method",
+		},
+		// :protocol is only valid for Extended CONNECT
+		{
+			name: "invalid :protocol",
+			headers: []qpack.HeaderField{
+				{Name: ":path", Value: "/foo"},
+				{Name: ":authority", Value: "quic-go.net"},
+				{Name: ":method", Value: http.MethodGet},
+				{Name: ":protocol", Value: "connect-udp"},
+			},
+			err: ":protocol must be omitted",
+		},
+		{
+			name: "empty :protocol",
+			headers: []qpack.HeaderField{
+				{Name: ":path", Value: "/foo"},
+				{Name: ":authority", Value: "quic-go.net"},
+				{Name: ":method", Value: http.MethodGet},
+				{Name: ":protocol", Value: ""},
+			},
+			err: ":protocol must be omitted",
+		},
+		{
+			name: "invalid :path",
+			headers: []qpack.HeaderField{
+				{Name: ":path", Value: "invalid path"},
+				{Name: ":authority", Value: "quic-go.net"},
+				{Name: ":method", Value: http.MethodGet},
+			},
+			errContains: "invalid request URI",
+		},
+		{
+			name: "userinfo in :authority",
+			headers: []qpack.HeaderField{
+				{Name: ":scheme", Value: "https"},
+				{Name: ":path", Value: "/foo"},
+				{Name: ":authority", Value: "user@quic-go.net"},
+				{Name: ":method", Value: http.MethodGet},
+			},
+			err: "userinfo is not allowed in :authority",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := requestFromHeaders(decodeFromSlice(tc.headers), math.MaxInt, nil)
+			if tc.errContains != "" {
+				require.ErrorContains(t, err, tc.errContains)
+			}
+			if tc.err != "" {
+				require.EqualError(t, err, tc.err)
+			}
+			require.NotErrorAs(t, err, new(*qpackError))
+		})
+	}
+}
+
+func TestCookieHeader(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":path", Value: "/foo"},
+		{Name: ":authority", Value: "quic-go.net"},
+		{Name: ":method", Value: http.MethodGet},
+		{Name: "cookie", Value: "cookie1=foobar1"},
+		{Name: "cookie", Value: "cookie2=foobar2"},
+	}
+	req, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.Header{
+		"Cookie": []string{"cookie1=foobar1; cookie2=foobar2"},
+	}, req.Header)
+}
+
+func TestHeadersConcatenation(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":path", Value: "/foo"},
+		{Name: ":authority", Value: "quic-go.net"},
+		{Name: ":method", Value: http.MethodGet},
+		{Name: "cache-control", Value: "max-age=0"},
+		{Name: "duplicate-header", Value: "1"},
+		{Name: "duplicate-header", Value: "2"},
+	}
+	req, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.Header{
+		"Cache-Control":    []string{"max-age=0"},
+		"Duplicate-Header": []string{"1", "2"},
+	}, req.Header)
+}
+
+func TestRequestHeadersConnect(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":authority", Value: "quic-go.net:443"},
+		{Name: ":method", Value: http.MethodConnect},
+	}
+	req, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.MethodConnect, req.Method)
+	require.Equal(t, "HTTP/3.0", req.Proto)
+	require.Equal(t, "quic-go.net:443", req.RequestURI)
+}
+
+func TestRequestHeadersConnectValidation(t *testing.T) {
+	// RFC 9114, Section 4.4: a CONNECT request must contain the :authority pseudo-header field,
+	// and must not contain the :scheme and :path pseudo-header fields.
+	for _, tc := range []struct {
+		name    string
+		headers []qpack.HeaderField
+		err     string
+	}{
+		{
+			name: "missing :authority",
+			headers: []qpack.HeaderField{
+				{Name: ":method", Value: http.MethodConnect},
+			},
+			err: ":scheme and :path must be omitted and :authority must not be empty",
+		},
+		{
+			name: ":scheme set",
+			headers: []qpack.HeaderField{
+				{Name: ":scheme", Value: "https"},
+				{Name: ":authority", Value: "quic-go.net:443"},
+				{Name: ":method", Value: http.MethodConnect},
+			},
+			err: ":scheme and :path must be omitted and :authority must not be empty",
+		},
+		{
+			name: ":path set",
+			headers: []qpack.HeaderField{
+				{Name: ":path", Value: "/foo"},
+				{Name: ":authority", Value: "quic-go.net:443"},
+				{Name: ":method", Value: http.MethodConnect},
+			},
+			err: ":scheme and :path must be omitted and :authority must not be empty",
+		},
+		{
+			name: "empty :path",
+			headers: []qpack.HeaderField{
+				{Name: ":path", Value: ""},
+				{Name: ":authority", Value: "quic-go.net"},
+				{Name: ":method", Value: http.MethodConnect},
+			},
+			err: ":scheme and :path must be omitted and :authority must not be empty",
+		},
+		{
+			name: "empty :scheme",
+			headers: []qpack.HeaderField{
+				{Name: ":scheme", Value: ""},
+				{Name: ":authority", Value: "quic-go.net"},
+				{Name: ":method", Value: http.MethodConnect},
+			},
+			err: ":scheme and :path must be omitted and :authority must not be empty",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := requestFromHeaders(decodeFromSlice(tc.headers), math.MaxInt, nil)
+			require.EqualError(t, err, tc.err)
+		})
+	}
+}
+
+func TestRequestHeadersExtendedConnect(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":protocol", Value: "webtransport"},
+		{Name: ":scheme", Value: "ftp"},
+		{Name: ":method", Value: http.MethodConnect},
+		{Name: ":authority", Value: "quic-go.net"},
+		{Name: ":path", Value: "/foo?val=1337"},
+	}
+	req, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.MethodConnect, req.Method)
+	require.Equal(t, "webtransport", req.Proto)
+	require.Equal(t, "ftp://quic-go.net/foo?val=1337", req.URL.String())
+	require.Equal(t, "1337", req.URL.Query().Get("val"))
+	require.Empty(t, req.Header)
+}
+
+func TestRequestHeadersExtendedConnectRequestValidation(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":protocol", Value: "webtransport"},
+		{Name: ":method", Value: http.MethodConnect},
+		{Name: ":authority", Value: "quic.clemente.io"},
+		{Name: ":path", Value: "/foo"},
+	}
+	_, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+	require.EqualError(t, err, "extended CONNECT: :scheme, :path and :authority must not be empty")
+}
+
+func TestRequestHeadersExtendedConnectInvalidProtocol(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":protocol", Value: "HTTP/3.0"},
+		{Name: ":scheme", Value: "https"},
+		{Name: ":method", Value: http.MethodConnect},
+		{Name: ":authority", Value: "quic-go.net"},
+		{Name: ":path", Value: "/foo"},
+	}
+	_, err := requestFromHeaders(decodeFromSlice(headers), math.MaxInt, nil)
+	require.EqualError(t, err, `invalid :protocol: "HTTP/3.0"`)
+}
+
+func TestResponseHeaderParsing(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":status", Value: "200"},
+		{Name: "content-length", Value: "42"},
+	}
+	rsp := &http.Response{}
+	require.NoError(t, updateResponseFromHeaders(rsp, decodeFromSlice(headers), math.MaxInt, nil))
+	require.Equal(t, "HTTP/3.0", rsp.Proto)
+	require.Equal(t, 3, rsp.ProtoMajor)
+	require.Zero(t, rsp.ProtoMinor)
+	require.Equal(t, int64(42), rsp.ContentLength)
+	require.Equal(t, 1, len(rsp.Header))
+	require.Equal(t, "42", rsp.Header.Get("Content-Length"))
+	require.Nil(t, rsp.Body)
+	require.Equal(t, 200, rsp.StatusCode)
+	require.Equal(t, "200 OK", rsp.Status)
+}
+
+func TestResponseHeaderParsingValidation(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		headers     []qpack.HeaderField
+		err         string
+		errContains string
+	}{
+		{
+			name: "missing :status",
+			headers: []qpack.HeaderField{
+				{Name: "content-length", Value: "42"},
+			},
+			err: "missing :status field",
+		},
+		{
+			name: "invalid status code",
+			headers: []qpack.HeaderField{
+				{Name: ":status", Value: "foobar"},
+			},
+			errContains: "invalid status code",
+		},
+		{
+			name: ":method header field", // :method is a request pseudo header
+			headers: []qpack.HeaderField{
+				{Name: ":method", Value: http.MethodGet},
+			},
+			err: "invalid response pseudo header: :method",
+		},
+		{
+			name: "duplicate :status",
+			headers: []qpack.HeaderField{
+				{Name: ":status", Value: ""},
+				{Name: ":status", Value: "404"},
+			},
+			err: "duplicate pseudo header: :status",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := updateResponseFromHeaders(&http.Response{}, decodeFromSlice(tc.headers), math.MaxInt, nil)
+			if tc.errContains != "" {
+				require.ErrorContains(t, err, tc.errContains)
+			}
+			if tc.err != "" {
+				require.EqualError(t, err, tc.err)
+			}
+		})
+	}
+
+	for _, tc := range []struct {
+		name         string
+		invalidField string
+	}{
+		{name: "connection", invalidField: "connection"},
+		{name: "keep-alive", invalidField: "keep-alive"},
+		{name: "proxy-connection", invalidField: "proxy-connection"},
+		{name: "transfer-encoding", invalidField: "transfer-encoding"},
+		{name: "upgrade", invalidField: "upgrade"},
+	} {
+		t.Run("invalid field: "+tc.name, func(t *testing.T) {
+			headers := []qpack.HeaderField{
+				{Name: ":status", Value: "404"},
+				{Name: tc.invalidField, Value: "some-value"},
+			}
+			err := updateResponseFromHeaders(&http.Response{}, decodeFromSlice(headers), math.MaxInt, nil)
+			require.EqualError(t, err, fmt.Sprintf("invalid header field name: %q", tc.invalidField))
+		})
+	}
+}
+
+func TestResponseTrailerFields(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":status", Value: "200"},
+		{Name: "trailer", Value: "Trailer1, Trailer2"},
+		{Name: "trailer", Value: "TRAILER3"},
+	}
+	var rsp http.Response
+	require.NoError(t, updateResponseFromHeaders(&rsp, decodeFromSlice(headers), math.MaxInt, nil))
+	require.Equal(t, 0, len(rsp.Header))
+	require.Equal(t, http.Header(map[string][]string{
+		"Trailer1": nil,
+		"Trailer2": nil,
+		"Trailer3": nil,
+	}), rsp.Trailer)
+}
+
+func TestResponseTrailerParsingTE(t *testing.T) {
+	headers := []qpack.HeaderField{
+		{Name: ":status", Value: "404"},
+		{Name: "te", Value: "trailers"},
+	}
+	require.NoError(t, updateResponseFromHeaders(&http.Response{}, decodeFromSlice(headers), math.MaxInt, nil))
+	headers = []qpack.HeaderField{
+		{Name: ":status", Value: "404"},
+		{Name: "te", Value: "not-trailers"},
+	}
+	require.EqualError(t,
+		updateResponseFromHeaders(&http.Response{}, decodeFromSlice(headers), math.MaxInt, nil),
+		`invalid TE header field value: "not-trailers"`)
+}
+
+func TestResponseTrailerParsing(t *testing.T) {
+	trailerHdr, err := parseTrailers(decodeFromSlice([]qpack.HeaderField{
+		{Name: "foo", Value: "42"},
+	}), math.MaxInt, nil)
+	require.NoError(t, err)
+	require.Equal(t, "42", trailerHdr.Get("Foo"))
+}
+
+func TestResponseTrailerParsingValidation(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		headers     []qpack.HeaderField
+		sizeLimit   int
+		err         string
+		errContains string
+		errIs       error
+	}{
+		{
+			name: "field list too large",
+			headers: []qpack.HeaderField{
+				{Name: "foo", Value: "bar"},
+			},
+			sizeLimit: 5,
+			errIs:     errHeaderTooLarge,
+		},
+		{
+			name: "upper-case field name",
+			headers: []qpack.HeaderField{
+				{Name: "Foo", Value: "bar"},
+			},
+			err: "header field is not lower-case: Foo",
+		},
+		{
+			name: "pseudo header",
+			headers: []qpack.HeaderField{
+				{Name: ":status", Value: "200"},
+			},
+			err: "http3: received pseudo header in trailer: :status",
+		},
+		{
+			name: "invalid field name",
+			headers: []qpack.HeaderField{
+				{Name: "@", Value: "bar"},
+			},
+			err: `invalid header field name: "@"`,
+		},
+		{
+			name: "invalid field value",
+			headers: []qpack.HeaderField{
+				{Name: "foo", Value: "\n"},
+			},
+			err: `invalid header field value for foo: "\n"`,
+		},
+		{
+			name: "connection-specific field",
+			headers: []qpack.HeaderField{
+				{Name: "connection", Value: "close"},
+			},
+			err: `invalid header field name: "connection"`,
+		},
+		{
+			name: "invalid te field value",
+			headers: []qpack.HeaderField{
+				{Name: "te", Value: "gzip"},
+			},
+			err: `invalid TE header field value: "gzip"`,
+		},
+		{
+			name: "invalid trailer field",
+			headers: []qpack.HeaderField{
+				{Name: "content-length", Value: "42"},
+			},
+			err: `invalid trailer field name: "content-length"`,
+		},
+		{
+			name: "valid header field name disallowed in trailers",
+			headers: []qpack.HeaderField{
+				{Name: "if-match", Value: "etag"},
+			},
+			err: `invalid trailer field name: "if-match"`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			sizeLimit := tc.sizeLimit
+			if sizeLimit == 0 {
+				sizeLimit = math.MaxInt
+			}
+			_, err := parseTrailers(decodeFromSlice(tc.headers), sizeLimit, nil)
+			if tc.errIs != nil {
+				require.ErrorIs(t, err, tc.errIs)
+			}
+			if tc.errContains != "" {
+				require.ErrorContains(t, err, tc.errContains)
+			}
+			if tc.err != "" {
+				require.EqualError(t, err, tc.err)
+			}
+			require.NotErrorAs(t, err, new(*qpackError))
+		})
+	}
+}
+
+func TestQpackError(t *testing.T) {
+	buf := &bytes.Buffer{}
+	enc := qpack.NewEncoder(buf)
+	enc.WriteField(qpack.HeaderField{Name: ":status", Value: "200"})
+	enc.Close()
+
+	t.Run("header parsing", func(t *testing.T) {
+		dec := qpack.NewDecoder()
+		decodeFn := dec.Decode(buf.Bytes()[:len(buf.Bytes())/2])
+		_, err := requestFromHeaders(decodeFn, math.MaxInt, nil)
+		require.ErrorAs(t, err, new(*qpackError))
+	})
+
+	t.Run("trailer parsing", func(t *testing.T) {
+		dec := qpack.NewDecoder()
+		decodeFn := dec.Decode(buf.Bytes()[:len(buf.Bytes())/2])
+		err := updateResponseFromHeaders(&http.Response{}, decodeFn, math.MaxInt, nil)
+		require.ErrorAs(t, err, new(*qpackError))
+	})
+}
+
+var benchmarkRequestHeaders = []qpack.HeaderField{
+	{Name: ":path", Value: "/api/v1/users/12345"},
+	{Name: ":authority", Value: "quic-go.net"},
+	{Name: ":method", Value: http.MethodPost},
+	{Name: "content-type", Value: "application/json"},
+	{Name: "content-length", Value: "1024"},
+	{Name: "user-agent", Value: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"},
+	{Name: "accept", Value: "application/json, text/plain, */*"},
+	{Name: "accept-encoding", Value: "gzip, deflate, br"},
+	{Name: "accept-language", Value: "en-US,en;q=0.9"},
+	{Name: "cache-control", Value: "no-cache"},
+	{Name: "cookie", Value: "session_id=abc123"},
+	{Name: "cookie", Value: "user_pref=dark_mode"},
+	{Name: "referer", Value: "https://quic-go.net/docs/http3/"},
+}
+
+func BenchmarkRequestFromHeaders(b *testing.B) {
+	b.ReportAllocs()
+
+	var buf bytes.Buffer
+	enc := qpack.NewEncoder(&buf)
+	for _, hf := range benchmarkRequestHeaders {
+		require.NoError(b, enc.WriteField(hf))
+	}
+
+	dec := qpack.NewDecoder()
+	for b.Loop() {
+		decodeFn := dec.Decode(buf.Bytes())
+		if _, err := requestFromHeaders(decodeFn, math.MaxInt, nil); err != nil {
+			b.Fatalf("failed to parse request: %v", err)
+		}
+	}
+}
+
+func BenchmarkRequestFromHeaderFields(b *testing.B) {
+	b.ReportAllocs()
+
+	for b.Loop() {
+		if _, err := requestFromHeaders(decodeFromSlice(benchmarkRequestHeaders), math.MaxInt, nil); err != nil {
+			b.Fatalf("failed to parse request: %v", err)
+		}
+	}
+}
+
+func FuzzHeaderParsing(f *testing.F) {
+	corpus := ossfuzzseeds.New(f)
+
+	for _, s := range [][]qpack.HeaderField{
+		{ // GET request
+			{Name: ":method", Value: "GET"},
+			{Name: ":scheme", Value: "https"},
+			{Name: ":path", Value: "/"},
+			{Name: ":authority", Value: "example.com"},
+		},
+		{ // POST with Content-Length
+			{Name: ":method", Value: "POST"},
+			{Name: ":scheme", Value: "https"},
+			{Name: ":path", Value: "/submit"},
+			{Name: ":authority", Value: "example.com"},
+			{Name: "content-length", Value: "42"},
+			{Name: "content-type", Value: "application/json"},
+		},
+		{ // CONNECT request
+			{Name: ":method", Value: "CONNECT"},
+			{Name: ":authority", Value: "proxy.example.com:443"},
+		},
+		{ // extended CONNECT
+			{Name: ":method", Value: "CONNECT"},
+			{Name: ":scheme", Value: "https"},
+			{Name: ":path", Value: "/webtransport"},
+			{Name: ":authority", Value: "example.com"},
+			{Name: ":protocol", Value: "webtransport"},
+		},
+		{ // 200 response
+			{Name: ":status", Value: "200"},
+			{Name: "content-type", Value: "text/html"},
+			{Name: "content-length", Value: "1024"},
+		},
+		{ // response with trailer announcement
+			{Name: ":status", Value: "200"},
+			{Name: "trailer", Value: "Checksum"},
+		},
+	} {
+		seedsStrings := make([][2]string, len(s))
+		for i, h := range s {
+			seedsStrings[i] = [2]string{h.Name, h.Value}
+		}
+		data, err := json.Marshal(seedsStrings)
+		require.NoError(f, err)
+		corpus.Add(data)
+	}
+
+	f.Fuzz(func(t *testing.T, data []byte) {
+		// Header fields are encoded as JSON (a [][2]string of [name, value] pairs) rather than as
+		// QPACK-encoded bytes. This bypasses the QPACK decoder intentionally: QPACK is fuzzed
+		// separately (in the qpack package).
+		const maxPairs = 1000
+		const maxHeaderBytes = 50_000
+		var pairs [][2]string
+		if err := json.Unmarshal(data, &pairs); err != nil {
+			return
+		}
+		if len(pairs) > maxPairs {
+			// don't fuzz too many header fields all at once
+			return
+		}
+		headers := make([]qpack.HeaderField, len(pairs))
+		for i, p := range pairs {
+			headers[i] = qpack.HeaderField{Name: p[0], Value: p[1]}
+		}
+
+		if req, err := requestFromHeaders(decodeFromSlice(headers), maxHeaderBytes, nil); err == nil {
+			require.NotEmpty(t, req.Method, "request has empty Method")
+			require.NotNil(t, req.URL, "request has nil URL")
+			require.NotEmpty(t, req.Proto, "request has empty Proto")
+			require.Truef(t, req.ProtoMajor == 3 && req.ProtoMinor == 0, "expected HTTP/3.0, got %d.%d", req.ProtoMajor, req.ProtoMinor)
+			require.GreaterOrEqualf(t, req.ContentLength, int64(-1), "invalid ContentLength: %d", req.ContentLength)
+			require.NotNil(t, req.Header, "request has nil Header map")
+			if req.Method == http.MethodConnect && req.Proto == "HTTP/3.0" {
+				// regular CONNECT: :path must be empty, :authority must be set
+				require.Empty(t, req.URL.Path, "CONNECT request has non-empty URL.Path")
+			}
+			if req.Method != http.MethodConnect {
+				require.NotEmpty(t, req.Host, "non-CONNECT request has empty Host")
+				require.NotEmpty(t, req.RequestURI, "non-CONNECT request has empty RequestURI")
+			}
+			requireValidFuzzHeader(t, req.Header, "request")
+		}
+
+		rsp := &http.Response{}
+		if err := updateResponseFromHeaders(rsp, decodeFromSlice(headers), maxHeaderBytes, nil); err == nil {
+			require.Equalf(t, "HTTP/3.0", rsp.Proto, "expected Proto HTTP/3.0, got %q", rsp.Proto)
+			require.Equalf(t, 3, rsp.ProtoMajor, "expected ProtoMajor 3, got %d", rsp.ProtoMajor)
+			require.GreaterOrEqualf(t, rsp.ContentLength, int64(-1), "invalid ContentLength: %d", rsp.ContentLength)
+			require.NotNil(t, rsp.Header, "response has nil Header map")
+			require.NotEmpty(t, rsp.Status, "response has empty Status")
+			requireValidFuzzHeader(t, rsp.Header, "response")
+		}
+
+		if trailers, err := parseTrailers(decodeFromSlice(headers), maxHeaderBytes, nil); err == nil {
+			for name := range trailers {
+				require.Falsef(t, len(name) > 0 && name[0] == ':', "trailer contains pseudo header %q", name)
+			}
+			requireValidFuzzTrailer(t, trailers)
+		}
+	})
+}
+
+func requireValidFuzzHeader(t *testing.T, h http.Header, context string) {
+	t.Helper()
+	for name, values := range h {
+		require.Truef(t, httpguts.ValidHeaderFieldName(name), "%s contains invalid header field name %q", context, name)
+		for _, value := range values {
+			require.Truef(t, httpguts.ValidHeaderFieldValue(value), "%s contains invalid header field value for %q: %q", context, name, value)
+		}
+	}
+	for _, name := range invalidHeaderFields {
+		require.Emptyf(t, h.Get(name), "%s contains connection-specific header %q", context, name)
+	}
+	if te := h.Values("Te"); len(te) > 0 {
+		for _, value := range te {
+			require.Equalf(t, "trailers", value, "%s contains invalid TE header field value: %q", context, value)
+		}
+	}
+}
+
+func requireValidFuzzTrailer(t *testing.T, h http.Header) {
+	t.Helper()
+	requireValidFuzzHeader(t, h, "trailer")
+	for name := range h {
+		require.Truef(t, httpguts.ValidTrailerHeader(name), "trailer contains invalid trailer field name %q", name)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/http3_helper_test.go b/electron/native/private-transport/third_party/quic-go/http3/http3_helper_test.go
new file mode 100644
index 000000000..28e01d619
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/http3_helper_test.go
@@ -0,0 +1,353 @@
+package http3
+
+import (
+	"bytes"
+	"context"
+	"crypto"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"errors"
+	"io"
+	"math/big"
+	"net"
+	"net/http"
+	"os"
+	"reflect"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/quic-go/qpack"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/require"
+)
+
+// maxByteCount is the maximum value of a ByteCount
+const maxByteCount = uint64(1<<62 - 1)
+
+func newUDPConnLocalhost(t testing.TB) *net.UDPConn {
+	t.Helper()
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.Close() })
+	return conn
+}
+
+func scaleDuration(t time.Duration) time.Duration {
+	scaleFactor := 1
+	if f, err := strconv.Atoi(os.Getenv("TIMESCALE_FACTOR")); err == nil { // parsing "" errors, so this works fine if the env is not set
+		scaleFactor = f
+	}
+	if scaleFactor == 0 {
+		panic("TIMESCALE_FACTOR is 0")
+	}
+	return time.Duration(scaleFactor) * t
+}
+
+var tlsConfig, tlsClientConfig *tls.Config
+
+func init() {
+	ca, caPrivateKey, err := generateCA()
+	if err != nil {
+		panic(err)
+	}
+	leafCert, leafPrivateKey, err := generateLeafCert(ca, caPrivateKey)
+	if err != nil {
+		panic(err)
+	}
+	tlsConfig = &tls.Config{
+		Certificates: []tls.Certificate{{
+			Certificate: [][]byte{leafCert.Raw},
+			PrivateKey:  leafPrivateKey,
+		}},
+		NextProtos: []string{NextProtoH3},
+	}
+
+	root := x509.NewCertPool()
+	root.AddCert(ca)
+	tlsClientConfig = &tls.Config{
+		ServerName: "localhost",
+		RootCAs:    root,
+		NextProtos: []string{NextProtoH3},
+	}
+}
+
+func generateCA() (*x509.Certificate, crypto.PrivateKey, error) {
+	certTempl := &x509.Certificate{
+		SerialNumber:          big.NewInt(2019),
+		Subject:               pkix.Name{},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(24 * time.Hour),
+		IsCA:                  true,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+	caBytes, err := x509.CreateCertificate(rand.Reader, certTempl, certTempl, pub, priv)
+	if err != nil {
+		return nil, nil, err
+	}
+	ca, err := x509.ParseCertificate(caBytes)
+	if err != nil {
+		return nil, nil, err
+	}
+	return ca, priv, nil
+}
+
+func generateLeafCert(ca *x509.Certificate, caPriv crypto.PrivateKey) (*x509.Certificate, crypto.PrivateKey, error) {
+	certTempl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		DNSNames:     []string{"localhost"},
+		IPAddresses:  []net.IP{net.IPv4(127, 0, 0, 1)},
+		NotBefore:    time.Now(),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+	certBytes, err := x509.CreateCertificate(rand.Reader, certTempl, ca, pub, caPriv)
+	if err != nil {
+		return nil, nil, err
+	}
+	cert, err := x509.ParseCertificate(certBytes)
+	if err != nil {
+		return nil, nil, err
+	}
+	return cert, priv, nil
+}
+
+func getTLSConfig() *tls.Config       { return tlsConfig.Clone() }
+func getTLSClientConfig() *tls.Config { return tlsClientConfig.Clone() }
+
+type qlogTrace struct {
+	recorder qlogwriter.Recorder
+}
+
+func (t *qlogTrace) SupportsSchemas(schema string) bool { return true }
+
+func (t *qlogTrace) AddProducer() qlogwriter.Recorder {
+	return t.recorder
+}
+
+type connPairOpts struct {
+	clientRecorder        qlogwriter.Recorder
+	serverRecorder        qlogwriter.Recorder
+	serverBidiStreamLimit int64
+	enableDatagrams       bool
+}
+
+type connPairOpt func(*connPairOpts)
+
+func withClientRecorder(r qlogwriter.Recorder) connPairOpt {
+	return func(o *connPairOpts) { o.clientRecorder = r }
+}
+
+func withServerRecorder(r qlogwriter.Recorder) connPairOpt {
+	return func(o *connPairOpts) { o.serverRecorder = r }
+}
+
+func withDatagrams() connPairOpt {
+	return func(o *connPairOpts) { o.enableDatagrams = true }
+}
+
+func withServerBidiStreamLimit(limit int64) connPairOpt {
+	return func(o *connPairOpts) { o.serverBidiStreamLimit = limit }
+}
+
+func newConnPair(t *testing.T, opts ...connPairOpt) (client, server *quic.Conn) {
+	t.Helper()
+
+	var o connPairOpts
+	for _, opt := range opts {
+		opt(&o)
+	}
+
+	ln, err := quic.ListenEarly(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		&quic.Config{
+			InitialStreamReceiveWindow:     maxByteCount,
+			InitialConnectionReceiveWindow: maxByteCount,
+			MaxIncomingStreams:             o.serverBidiStreamLimit,
+			EnableDatagrams:                o.enableDatagrams,
+			Tracer: func(ctx context.Context, isClient bool, connID quic.ConnectionID) qlogwriter.Trace {
+				return &qlogTrace{recorder: o.serverRecorder}
+			},
+		},
+	)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	cl, err := quic.DialEarly(
+		ctx,
+		newUDPConnLocalhost(t),
+		ln.Addr(),
+		getTLSClientConfig(),
+		&quic.Config{
+			EnableDatagrams: o.enableDatagrams,
+			Tracer: func(ctx context.Context, isClient bool, connID quic.ConnectionID) qlogwriter.Trace {
+				return &qlogTrace{recorder: o.clientRecorder}
+			},
+		},
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { cl.CloseWithError(0, "") })
+
+	conn, err := ln.Accept(ctx)
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.CloseWithError(0, "") })
+	select {
+	case <-conn.HandshakeComplete():
+	case <-ctx.Done():
+		t.Fatal("timeout")
+	}
+	return cl, conn
+}
+
+type quicReceiveStream interface {
+	io.Reader
+	SetReadDeadline(time.Time) error
+}
+
+func expectStreamReadReset(t *testing.T, str quicReceiveStream, errCode quic.StreamErrorCode) {
+	t.Helper()
+
+	str.SetReadDeadline(time.Now().Add(time.Second))
+	_, err := str.Read([]byte{0})
+	require.Error(t, err)
+	if errors.Is(err, os.ErrDeadlineExceeded) {
+		t.Fatal("didn't receive a stream reset")
+	}
+	var strErr *quic.StreamError
+	require.ErrorAs(t, err, &strErr)
+	require.Equal(t, errCode, strErr.ErrorCode)
+}
+
+type quicSendStream interface {
+	io.Writer
+	Context() context.Context
+}
+
+func expectStreamWriteReset(t *testing.T, str quicSendStream, errCode quic.StreamErrorCode) {
+	t.Helper()
+
+	select {
+	case <-str.Context().Done():
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	_, err := str.Write([]byte{0})
+	require.Error(t, err)
+	var strErr *quic.StreamError
+	require.ErrorAs(t, err, &strErr)
+	require.Equal(t, errCode, strErr.ErrorCode)
+}
+
+func encodeRequest(t *testing.T, req *http.Request) []byte {
+	t.Helper()
+
+	var buf bytes.Buffer
+	rw := newRequestWriter()
+	require.NoError(t, rw.WriteRequestHeader(&buf, req, false, 0, nil))
+	if req.Body != nil {
+		body, err := io.ReadAll(req.Body)
+		require.NoError(t, err)
+		buf.Write((&dataFrame{Length: uint64(len(body))}).Append(nil))
+		buf.Write(body)
+	}
+	return buf.Bytes()
+}
+
+func decodeHeader(t *testing.T, r io.Reader) map[string][]string {
+	t.Helper()
+
+	fields := make(map[string][]string)
+	frame, err := (&frameParser{r: r}).ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &headersFrame{}, frame)
+	headersFrame := frame.(*headersFrame)
+	data := make([]byte, headersFrame.Length)
+	_, err = io.ReadFull(r, data)
+	require.NoError(t, err)
+	hfs := decodeQpackHeaderFields(t, data)
+	for _, p := range hfs {
+		fields[p.Name] = append(fields[p.Name], p.Value)
+	}
+	return fields
+}
+
+func decodeQpackHeaderFields(t *testing.T, data []byte) []qpack.HeaderField {
+	t.Helper()
+
+	decoder := qpack.NewDecoder()
+	decodeFn := decoder.Decode(data)
+	var hfs []qpack.HeaderField
+	for {
+		hf, err := decodeFn()
+		if err == io.EOF {
+			break
+		}
+		require.NoError(t, err)
+		hfs = append(hfs, hf)
+	}
+	return hfs
+}
+
+// filterQlogEventsForFrame filters the events for the given frame type,
+// for both FrameCreated and FrameParsed events.
+// It returns the events that match the given frame type.
+func filterQlogEventsForFrame(events []qlogwriter.Event, frame any) []qlogwriter.Event {
+	var filtered []qlogwriter.Event
+	for _, ev := range events {
+		switch e := ev.(type) {
+		case qlog.FrameCreated:
+			if reflect.TypeOf(e.Frame.Frame) == reflect.TypeOf(frame) {
+				filtered = append(filtered, ev)
+			}
+		case qlog.FrameParsed:
+			if reflect.TypeOf(e.Frame.Frame) == reflect.TypeOf(frame) {
+				filtered = append(filtered, ev)
+			}
+		}
+	}
+	return filtered
+}
+
+func expectedFrameLength(t *testing.T, frame any) (length, payloadLength int) {
+	t.Helper()
+
+	switch f := frame.(type) {
+	case *dataFrame:
+		return len(f.Append(nil)) + int(f.Length), int(f.Length)
+	case *headersFrame:
+		return len(f.Append(nil)) + int(f.Length), int(f.Length)
+	case *goAwayFrame:
+		return len(f.Append(nil)), quicvarint.Len(uint64(f.StreamID))
+	case *settingsFrame:
+		data := f.Append(nil)
+		r := bytes.NewReader(data)
+		_, err := quicvarint.Read(r) // type
+		require.NoError(t, err)
+		_, err = quicvarint.Read(r) // length
+		require.NoError(t, err)
+		return len(data), r.Len()
+	default:
+		t.Fatalf("unexpected frame type: %T", frame)
+	}
+	panic("unreachable")
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/ca.pem b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/ca.pem
new file mode 100644
index 000000000..67a5545e8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/ca.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICzDCCAbQCCQDA+rLymNnfJzANBgkqhkiG9w0BAQsFADAoMSYwJAYDVQQKDB1x
+dWljLWdvIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMDA4MTgwOTIxMzVaFw0z
+MDA4MTYwOTIxMzVaMCgxJjAkBgNVBAoMHXF1aWMtZ28gQ2VydGlmaWNhdGUgQXV0
+aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1OcsYrVaSDfh
+iDppl6oteVspOY3yFb96T9Y/biaGPJAkBO9VGKcqwOUPmUeiWpedRAUB9LE7Srs6
+qBX4mnl90Icjp8jbIs5cPgIWLkIu8Qm549RghFzB3bn+EmCQSe4cxvyDMN3ndClp
+3YMXpZgXWgJGiPOylVi/OwHDdWDBorw4hvry+6yDtpQo2TuI2A/xtxXPT7BgsEJD
+WGffdgZOYXChcFA0c1XVLIYlu2w2JhxS8c2TUF6uSDlmcoONNKVoiNCuu1Z9MorS
+Qmg7a2G7dSPu123KcTcSQFcmJrt+1G81gOBtHB69kacD8xDmgksj09h/ODPL/gIU
+1ZcU2ci1/QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQB0Tb1JbLXp/BvWovSAhO/j
+wG7UEaUA1rCtkDB+fV2HS9bxCbV5eErdg8AMHKgB51ygUrq95vm/baZmUILr84XK
+uTEoxxrw5S9Z7SrhtbOpKCumoSeTsCPjDvCcwFExHv4XHFk+CPqZwbMHueVIMT0+
+nGWss/KecCPdJLdnUgMRz0tIuXzkoRuOiUiZfUeyBNVNbDFSrLigYshTeAPGaYjX
+CypoHxkeS93nWfOMUu8FTYLYkvGMU5i076zDoFGKJiEtbjSiNW+Hei7u2aSEuCzp
+qyTKzYPWYffAq3MM2MKJgZdL04e9GEGeuce/qhM1o3q77aI/XJImwEDdut2LDec1
+-----END CERTIFICATE-----
diff --git a/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/cert.go b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/cert.go
new file mode 100644
index 000000000..f77a7b2dd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/cert.go
@@ -0,0 +1,56 @@
+package testdata
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"os"
+	"path"
+	"runtime"
+)
+
+var certPath string
+
+func init() {
+	_, filename, _, ok := runtime.Caller(0)
+	if !ok {
+		panic("Failed to get current frame")
+	}
+
+	certPath = path.Dir(filename)
+}
+
+// GetCertificatePaths returns the paths to certificate and key
+func GetCertificatePaths() (string, string) {
+	return path.Join(certPath, "cert.pem"), path.Join(certPath, "priv.key")
+}
+
+// GetTLSConfig returns a tls config for quic.clemente.io
+func GetTLSConfig() *tls.Config {
+	cert, err := tls.LoadX509KeyPair(GetCertificatePaths())
+	if err != nil {
+		panic(err)
+	}
+	return &tls.Config{
+		MinVersion:   tls.VersionTLS13,
+		Certificates: []tls.Certificate{cert},
+	}
+}
+
+// AddRootCA adds the root CA certificate to a cert pool
+func AddRootCA(certPool *x509.CertPool) {
+	caCertPath := path.Join(certPath, "ca.pem")
+	caCertRaw, err := os.ReadFile(caCertPath)
+	if err != nil {
+		panic(err)
+	}
+	if ok := certPool.AppendCertsFromPEM(caCertRaw); !ok {
+		panic("Could not add root ceritificate to pool.")
+	}
+}
+
+// GetRootCA returns an x509.CertPool containing (only) the CA certificate
+func GetRootCA() *x509.CertPool {
+	pool := x509.NewCertPool()
+	AddRootCA(pool)
+	return pool
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/cert.pem b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/cert.pem
new file mode 100644
index 000000000..91d1aa9e7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/cert.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC1TCCAb2gAwIBAgIJAK2fcqC0BVA7MA0GCSqGSIb3DQEBCwUAMCgxJjAkBgNV
+BAoMHXF1aWMtZ28gQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIwMDgxODA5MjEz
+NVoXDTMwMDgxNjA5MjEzNVowEjEQMA4GA1UECgwHcXVpYy1nbzCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAN/YwrigSXdJCL/bdBGhb0UpqtU8H+krV870
++w1yCSykLImH8x3qHZEXt9sr/vgjcJoV6Z15RZmnbEqnAx84sIClIBoIgnk0VPxu
+WF+/U/dElbftCfYcfJAddhRckdmGB+yb3Wogb32UJ+q3my++h6NjHsYb+OwpJPnQ
+meXjOE7Kkf+bXfFywHF3R8kzVdh5JUFYeKbxYmYgxRps1YTsbCrZCrSy1CbQ9FJw
+Wg5C8t+7yvVFmOeWPECypBCz2xS2mu+kycMNIjIWMl0SL7oVM5cBkRKPeVIG/KcM
+i5+/4lRSLoPh0Txh2TKBWfpzLbIOdPU8/O7cAukIGWx0XsfHUQMCAwEAAaMYMBYw
+FAYDVR0RBA0wC4IJbG9jYWxob3N0MA0GCSqGSIb3DQEBCwUAA4IBAQAyxxvebdMz
+shp5pt1SxMOSXbo8sTa1cpaf2rTmb4nxjXs6KPBEn53hSBz9bhe5wXE4f94SHadf
+636rLh3d75KgrLUwO9Yq0HfCxMo1jUV/Ug++XwcHCI9vk58Tk/H4hqEM6C8RrdTj
+fYeuegQ0/oNLJ4uTw2P2A8TJbL6FC2dcICEAvUGZUcVyZ8m8tHXNRYYh6MZ7ubCh
+hinvL+AA5fY6EVlc5G/P4DN6fYxGn1cFNbiL4uZP4+W3dOmP+NV0YV9ihTyMzz0R
+vSoOZ9FeVkyw8EhMb3LoyXYKazvJy2VQST1ltzAGit9RiM1Gv4vuna74WsFzrn1U
+A/TbaR0ih/qG
+-----END CERTIFICATE-----
diff --git a/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/cert_test.go b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/cert_test.go
new file mode 100644
index 000000000..2eff1fef2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/cert_test.go
@@ -0,0 +1,28 @@
+package testdata
+
+import (
+	"crypto/tls"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCertificates(t *testing.T) {
+	ln, err := tls.Listen("tcp", "localhost:4433", GetTLSConfig())
+	require.NoError(t, err)
+
+	go func() {
+		conn, err := ln.Accept()
+		require.NoError(t, err)
+		defer conn.Close()
+		_, err = conn.Write([]byte("foobar"))
+		require.NoError(t, err)
+	}()
+
+	conn, err := tls.Dial("tcp", "localhost:4433", &tls.Config{RootCAs: GetRootCA()})
+	require.NoError(t, err)
+	data, err := io.ReadAll(conn)
+	require.NoError(t, err)
+	require.Equal(t, "foobar", string(data))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/generate_key.sh b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/generate_key.sh
new file mode 100644
index 000000000..7ecaa966d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/generate_key.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -e
+
+echo "Generating CA key and certificate:"
+openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:2048 \
+  -keyout ca.key -out ca.pem \
+  -subj "/O=quic-go Certificate Authority/"
+
+echo "Generating CSR"
+openssl req -out cert.csr -new -newkey rsa:2048 -nodes -keyout priv.key \
+  -subj "/O=quic-go/"
+
+echo "Sign certificate:"
+openssl x509 -req -sha256 -days 3650 -in cert.csr  -out cert.pem \
+  -CA ca.pem -CAkey ca.key -CAcreateserial \
+  -extfile <(printf "subjectAltName=DNS:localhost")
+
+# debug output the certificate
+openssl x509 -noout -text -in cert.pem
+
+# we don't need the CA key, the serial number and the CSR any more
+rm ca.key cert.csr ca.srl
+
diff --git a/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/priv.key b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/priv.key
new file mode 100644
index 000000000..56b8d894d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/internal/testdata/priv.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDf2MK4oEl3SQi/
+23QRoW9FKarVPB/pK1fO9PsNcgkspCyJh/Md6h2RF7fbK/74I3CaFemdeUWZp2xK
+pwMfOLCApSAaCIJ5NFT8blhfv1P3RJW37Qn2HHyQHXYUXJHZhgfsm91qIG99lCfq
+t5svvoejYx7GG/jsKST50Jnl4zhOypH/m13xcsBxd0fJM1XYeSVBWHim8WJmIMUa
+bNWE7Gwq2Qq0stQm0PRScFoOQvLfu8r1RZjnljxAsqQQs9sUtprvpMnDDSIyFjJd
+Ei+6FTOXAZESj3lSBvynDIufv+JUUi6D4dE8YdkygVn6cy2yDnT1PPzu3ALpCBls
+dF7Hx1EDAgMBAAECggEBAMm+mLDBdbUWk9YmuZNyRdC13wvT5obF05vo26OglXgw
+dxt09b6OVBuCnuff3SpS9pdJDIYq2HnFlSorH/sxopIvQKF17fHDIp1n7ipNTCXd
+IHrmHkY8Il/YzaVIUQMVc2rih0mw9greTqOS20DKnYC6QvAWIeDmrDaitTGl+ge3
+hm7e2lsgZi13R6fTNwQs9geEQSGzP2k7bFceHQFDChOYiQraR5+VZZ8S8AMGjk47
+AUa5EsKeUe6O9t2xuDSFxzYz5eadOAiErKGDos5KXXr3VQgFcC8uPEFFjcJ/yl+8
+tOe4iLeVwGSDJhTAThdR2deJOjaDcarWM7ixmxA3DAECgYEA/WVwmY4gWKwv49IJ
+Jnh1Gu93P772GqliMNpukdjTI+joQxfl4jRSt2hk4b1KRwyT9aaKfvdz0HFlXo/r
+9NVSAYT3/3vbcw61bfvPhhtz44qRAAKua6b5cUM6XqxVt1hqdP8lrf/blvA5ln+u
+O51S8+wpxZMuqKz/29zdWSG6tAMCgYEA4iWXMXX9dZajI6abVkWwuosvOakXdLk4
+tUy7zd+JPF7hmUzzj2gtg4hXoiQPAOi+GY3TX+1Nza3s1LD7iWaXSKeOWvvligw9
+Q/wVTNW2P1+tdhScJf9QudzW69xOm5HNBgx9uWV2cHfjC12vg5aTH0k5axvaq15H
+9WBXlH5q3wECgYBYoYGYBDFmMpvxmMagkSOMz1OrlVSpkLOKmOxx0SBRACc1SIec
+7mY8RqR6nOX9IfYixyTMMittLiyhvb9vfKnZZDQGRcFFZlCpbplws+t+HDqJgWaW
+uumm5zfkY2z7204pLBF24fZhvha2gGRl76pTLTiTJd79Gr3HnmJByd1vFwKBgHL7
+vfYuEeM55lT4Hz8sTAFtR2O/7+cvTgAQteSlZbfGXlp939DonUulhTkxsFc7/3wq
+unCpzcdoSWSTYDGqcf1FBIKKVVltg7EPeR0KBJIQabgCHqrLOBZojPZ7m5RJ+765
+lysuxZvFuTFMPzNe2gssRf+JuBMt6tR+WclsxZYBAoGAEEFs1ppDil1xlP5rdH7T
+d3TSw/u4eU/X8Ei1zi25hdRUiV76fP9fBELYFmSrPBhugYv91vtSv/LmD4zLfLv/
+yzwAD9j1lGbgM8Of8klCkk+XSJ88ryUwnMTJ5loQJW8t4L+zLv5Le7Ca9SAT0kJ1
+jT0GzDymgLMGp8RPdBkpk+w=
+-----END PRIVATE KEY-----
diff --git a/electron/native/private-transport/third_party/quic-go/http3/ip_addr.go b/electron/native/private-transport/third_party/quic-go/http3/ip_addr.go
new file mode 100644
index 000000000..876a1e35a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/ip_addr.go
@@ -0,0 +1,48 @@
+package http3
+
+import (
+	"net"
+	"strings"
+)
+
+// An addrList represents a list of network endpoint addresses.
+// Copy from [net.addrList] and change type from [net.Addr] to [net.IPAddr]
+type addrList []net.IPAddr
+
+// isIPv4 reports whether addr contains an IPv4 address.
+func isIPv4(addr net.IPAddr) bool {
+	return addr.IP.To4() != nil
+}
+
+// isNotIPv4 reports whether addr does not contain an IPv4 address.
+func isNotIPv4(addr net.IPAddr) bool { return !isIPv4(addr) }
+
+// forResolve returns the most appropriate address in address for
+// a call to ResolveTCPAddr, ResolveUDPAddr, or ResolveIPAddr.
+// IPv4 is preferred, unless addr contains an IPv6 literal.
+func (addrs addrList) forResolve(network, addr string) net.IPAddr {
+	var want6 bool
+	switch network {
+	case "ip":
+		// IPv6 literal (addr does NOT contain a port)
+		want6 = strings.ContainsRune(addr, ':')
+	case "tcp", "udp":
+		// IPv6 literal. (addr contains a port, so look for '[')
+		want6 = strings.ContainsRune(addr, '[')
+	}
+	if want6 {
+		return addrs.first(isNotIPv4)
+	}
+	return addrs.first(isIPv4)
+}
+
+// first returns the first address which satisfies strategy, or if
+// none do, then the first address of any kind.
+func (addrs addrList) first(strategy func(net.IPAddr) bool) net.IPAddr {
+	for _, addr := range addrs {
+		if strategy(addr) {
+			return addr
+		}
+	}
+	return addrs[0]
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/mock_clientconn_test.go b/electron/native/private-transport/third_party/quic-go/http3/mock_clientconn_test.go
new file mode 100644
index 000000000..c85954474
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/mock_clientconn_test.go
@@ -0,0 +1,157 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/http3 (interfaces: TestClientConnInterface)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -mock_names=TestClientConnInterface=MockClientConn -package http3 -destination mock_clientconn_test.go github.com/quic-go/quic-go/http3 TestClientConnInterface
+//
+
+// Package http3 is a generated GoMock package.
+package http3
+
+import (
+	context "context"
+	http "net/http"
+	reflect "reflect"
+
+	quic "github.com/quic-go/quic-go"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockClientConn is a mock of TestClientConnInterface interface.
+type MockClientConn struct {
+	ctrl     *gomock.Controller
+	recorder *MockClientConnMockRecorder
+	isgomock struct{}
+}
+
+// MockClientConnMockRecorder is the mock recorder for MockClientConn.
+type MockClientConnMockRecorder struct {
+	mock *MockClientConn
+}
+
+// NewMockClientConn creates a new mock instance.
+func NewMockClientConn(ctrl *gomock.Controller) *MockClientConn {
+	mock := &MockClientConn{ctrl: ctrl}
+	mock.recorder = &MockClientConnMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockClientConn) EXPECT() *MockClientConnMockRecorder {
+	return m.recorder
+}
+
+// OpenRequestStream mocks base method.
+func (m *MockClientConn) OpenRequestStream(arg0 context.Context) (*RequestStream, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "OpenRequestStream", arg0)
+	ret0, _ := ret[0].(*RequestStream)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// OpenRequestStream indicates an expected call of OpenRequestStream.
+func (mr *MockClientConnMockRecorder) OpenRequestStream(arg0 any) *MockClientConnOpenRequestStreamCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OpenRequestStream", reflect.TypeOf((*MockClientConn)(nil).OpenRequestStream), arg0)
+	return &MockClientConnOpenRequestStreamCall{Call: call}
+}
+
+// MockClientConnOpenRequestStreamCall wrap *gomock.Call
+type MockClientConnOpenRequestStreamCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockClientConnOpenRequestStreamCall) Return(arg0 *RequestStream, arg1 error) *MockClientConnOpenRequestStreamCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockClientConnOpenRequestStreamCall) Do(f func(context.Context) (*RequestStream, error)) *MockClientConnOpenRequestStreamCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockClientConnOpenRequestStreamCall) DoAndReturn(f func(context.Context) (*RequestStream, error)) *MockClientConnOpenRequestStreamCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// RoundTrip mocks base method.
+func (m *MockClientConn) RoundTrip(arg0 *http.Request) (*http.Response, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RoundTrip", arg0)
+	ret0, _ := ret[0].(*http.Response)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RoundTrip indicates an expected call of RoundTrip.
+func (mr *MockClientConnMockRecorder) RoundTrip(arg0 any) *MockClientConnRoundTripCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RoundTrip", reflect.TypeOf((*MockClientConn)(nil).RoundTrip), arg0)
+	return &MockClientConnRoundTripCall{Call: call}
+}
+
+// MockClientConnRoundTripCall wrap *gomock.Call
+type MockClientConnRoundTripCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockClientConnRoundTripCall) Return(arg0 *http.Response, arg1 error) *MockClientConnRoundTripCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockClientConnRoundTripCall) Do(f func(*http.Request) (*http.Response, error)) *MockClientConnRoundTripCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockClientConnRoundTripCall) DoAndReturn(f func(*http.Request) (*http.Response, error)) *MockClientConnRoundTripCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// handleUnidirectionalStream mocks base method.
+func (m *MockClientConn) handleUnidirectionalStream(arg0 *quic.ReceiveStream) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "handleUnidirectionalStream", arg0)
+}
+
+// handleUnidirectionalStream indicates an expected call of handleUnidirectionalStream.
+func (mr *MockClientConnMockRecorder) handleUnidirectionalStream(arg0 any) *MockClientConnhandleUnidirectionalStreamCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "handleUnidirectionalStream", reflect.TypeOf((*MockClientConn)(nil).handleUnidirectionalStream), arg0)
+	return &MockClientConnhandleUnidirectionalStreamCall{Call: call}
+}
+
+// MockClientConnhandleUnidirectionalStreamCall wrap *gomock.Call
+type MockClientConnhandleUnidirectionalStreamCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockClientConnhandleUnidirectionalStreamCall) Return() *MockClientConnhandleUnidirectionalStreamCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockClientConnhandleUnidirectionalStreamCall) Do(f func(*quic.ReceiveStream)) *MockClientConnhandleUnidirectionalStreamCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockClientConnhandleUnidirectionalStreamCall) DoAndReturn(f func(*quic.ReceiveStream)) *MockClientConnhandleUnidirectionalStreamCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/mock_datagram_stream_test.go b/electron/native/private-transport/third_party/quic-go/http3/mock_datagram_stream_test.go
new file mode 100644
index 000000000..76ae8a5b8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/mock_datagram_stream_test.go
@@ -0,0 +1,610 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/http3 (interfaces: DatagramStream)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -mock_names=DatagramStream=MockDatagramStream -package http3 -destination mock_datagram_stream_test.go github.com/quic-go/quic-go/http3 DatagramStream
+//
+
+// Package http3 is a generated GoMock package.
+package http3
+
+import (
+	context "context"
+	reflect "reflect"
+	time "time"
+
+	quic "github.com/quic-go/quic-go"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockDatagramStream is a mock of DatagramStream interface.
+type MockDatagramStream struct {
+	ctrl     *gomock.Controller
+	recorder *MockDatagramStreamMockRecorder
+	isgomock struct{}
+}
+
+// MockDatagramStreamMockRecorder is the mock recorder for MockDatagramStream.
+type MockDatagramStreamMockRecorder struct {
+	mock *MockDatagramStream
+}
+
+// NewMockDatagramStream creates a new mock instance.
+func NewMockDatagramStream(ctrl *gomock.Controller) *MockDatagramStream {
+	mock := &MockDatagramStream{ctrl: ctrl}
+	mock.recorder = &MockDatagramStreamMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockDatagramStream) EXPECT() *MockDatagramStreamMockRecorder {
+	return m.recorder
+}
+
+// CancelRead mocks base method.
+func (m *MockDatagramStream) CancelRead(arg0 quic.StreamErrorCode) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "CancelRead", arg0)
+}
+
+// CancelRead indicates an expected call of CancelRead.
+func (mr *MockDatagramStreamMockRecorder) CancelRead(arg0 any) *MockDatagramStreamCancelReadCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CancelRead", reflect.TypeOf((*MockDatagramStream)(nil).CancelRead), arg0)
+	return &MockDatagramStreamCancelReadCall{Call: call}
+}
+
+// MockDatagramStreamCancelReadCall wrap *gomock.Call
+type MockDatagramStreamCancelReadCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamCancelReadCall) Return() *MockDatagramStreamCancelReadCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamCancelReadCall) Do(f func(quic.StreamErrorCode)) *MockDatagramStreamCancelReadCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamCancelReadCall) DoAndReturn(f func(quic.StreamErrorCode)) *MockDatagramStreamCancelReadCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// CancelWrite mocks base method.
+func (m *MockDatagramStream) CancelWrite(arg0 quic.StreamErrorCode) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "CancelWrite", arg0)
+}
+
+// CancelWrite indicates an expected call of CancelWrite.
+func (mr *MockDatagramStreamMockRecorder) CancelWrite(arg0 any) *MockDatagramStreamCancelWriteCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CancelWrite", reflect.TypeOf((*MockDatagramStream)(nil).CancelWrite), arg0)
+	return &MockDatagramStreamCancelWriteCall{Call: call}
+}
+
+// MockDatagramStreamCancelWriteCall wrap *gomock.Call
+type MockDatagramStreamCancelWriteCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamCancelWriteCall) Return() *MockDatagramStreamCancelWriteCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamCancelWriteCall) Do(f func(quic.StreamErrorCode)) *MockDatagramStreamCancelWriteCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamCancelWriteCall) DoAndReturn(f func(quic.StreamErrorCode)) *MockDatagramStreamCancelWriteCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Close mocks base method.
+func (m *MockDatagramStream) Close() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Close")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Close indicates an expected call of Close.
+func (mr *MockDatagramStreamMockRecorder) Close() *MockDatagramStreamCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockDatagramStream)(nil).Close))
+	return &MockDatagramStreamCloseCall{Call: call}
+}
+
+// MockDatagramStreamCloseCall wrap *gomock.Call
+type MockDatagramStreamCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamCloseCall) Return(arg0 error) *MockDatagramStreamCloseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamCloseCall) Do(f func() error) *MockDatagramStreamCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamCloseCall) DoAndReturn(f func() error) *MockDatagramStreamCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Context mocks base method.
+func (m *MockDatagramStream) Context() context.Context {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Context")
+	ret0, _ := ret[0].(context.Context)
+	return ret0
+}
+
+// Context indicates an expected call of Context.
+func (mr *MockDatagramStreamMockRecorder) Context() *MockDatagramStreamContextCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Context", reflect.TypeOf((*MockDatagramStream)(nil).Context))
+	return &MockDatagramStreamContextCall{Call: call}
+}
+
+// MockDatagramStreamContextCall wrap *gomock.Call
+type MockDatagramStreamContextCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamContextCall) Return(arg0 context.Context) *MockDatagramStreamContextCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamContextCall) Do(f func() context.Context) *MockDatagramStreamContextCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamContextCall) DoAndReturn(f func() context.Context) *MockDatagramStreamContextCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// QUICStream mocks base method.
+func (m *MockDatagramStream) QUICStream() *quic.Stream {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "QUICStream")
+	ret0, _ := ret[0].(*quic.Stream)
+	return ret0
+}
+
+// QUICStream indicates an expected call of QUICStream.
+func (mr *MockDatagramStreamMockRecorder) QUICStream() *MockDatagramStreamQUICStreamCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "QUICStream", reflect.TypeOf((*MockDatagramStream)(nil).QUICStream))
+	return &MockDatagramStreamQUICStreamCall{Call: call}
+}
+
+// MockDatagramStreamQUICStreamCall wrap *gomock.Call
+type MockDatagramStreamQUICStreamCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamQUICStreamCall) Return(arg0 *quic.Stream) *MockDatagramStreamQUICStreamCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamQUICStreamCall) Do(f func() *quic.Stream) *MockDatagramStreamQUICStreamCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamQUICStreamCall) DoAndReturn(f func() *quic.Stream) *MockDatagramStreamQUICStreamCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Read mocks base method.
+func (m *MockDatagramStream) Read(p []byte) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Read", p)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Read indicates an expected call of Read.
+func (mr *MockDatagramStreamMockRecorder) Read(p any) *MockDatagramStreamReadCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Read", reflect.TypeOf((*MockDatagramStream)(nil).Read), p)
+	return &MockDatagramStreamReadCall{Call: call}
+}
+
+// MockDatagramStreamReadCall wrap *gomock.Call
+type MockDatagramStreamReadCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamReadCall) Return(n int, err error) *MockDatagramStreamReadCall {
+	c.Call = c.Call.Return(n, err)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamReadCall) Do(f func([]byte) (int, error)) *MockDatagramStreamReadCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamReadCall) DoAndReturn(f func([]byte) (int, error)) *MockDatagramStreamReadCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ReceiveDatagram mocks base method.
+func (m *MockDatagramStream) ReceiveDatagram(ctx context.Context) ([]byte, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ReceiveDatagram", ctx)
+	ret0, _ := ret[0].([]byte)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ReceiveDatagram indicates an expected call of ReceiveDatagram.
+func (mr *MockDatagramStreamMockRecorder) ReceiveDatagram(ctx any) *MockDatagramStreamReceiveDatagramCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReceiveDatagram", reflect.TypeOf((*MockDatagramStream)(nil).ReceiveDatagram), ctx)
+	return &MockDatagramStreamReceiveDatagramCall{Call: call}
+}
+
+// MockDatagramStreamReceiveDatagramCall wrap *gomock.Call
+type MockDatagramStreamReceiveDatagramCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamReceiveDatagramCall) Return(arg0 []byte, arg1 error) *MockDatagramStreamReceiveDatagramCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamReceiveDatagramCall) Do(f func(context.Context) ([]byte, error)) *MockDatagramStreamReceiveDatagramCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamReceiveDatagramCall) DoAndReturn(f func(context.Context) ([]byte, error)) *MockDatagramStreamReceiveDatagramCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SendDatagram mocks base method.
+func (m *MockDatagramStream) SendDatagram(b []byte) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SendDatagram", b)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SendDatagram indicates an expected call of SendDatagram.
+func (mr *MockDatagramStreamMockRecorder) SendDatagram(b any) *MockDatagramStreamSendDatagramCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SendDatagram", reflect.TypeOf((*MockDatagramStream)(nil).SendDatagram), b)
+	return &MockDatagramStreamSendDatagramCall{Call: call}
+}
+
+// MockDatagramStreamSendDatagramCall wrap *gomock.Call
+type MockDatagramStreamSendDatagramCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamSendDatagramCall) Return(arg0 error) *MockDatagramStreamSendDatagramCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamSendDatagramCall) Do(f func([]byte) error) *MockDatagramStreamSendDatagramCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamSendDatagramCall) DoAndReturn(f func([]byte) error) *MockDatagramStreamSendDatagramCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetDeadline mocks base method.
+func (m *MockDatagramStream) SetDeadline(arg0 time.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetDeadline", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetDeadline indicates an expected call of SetDeadline.
+func (mr *MockDatagramStreamMockRecorder) SetDeadline(arg0 any) *MockDatagramStreamSetDeadlineCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetDeadline", reflect.TypeOf((*MockDatagramStream)(nil).SetDeadline), arg0)
+	return &MockDatagramStreamSetDeadlineCall{Call: call}
+}
+
+// MockDatagramStreamSetDeadlineCall wrap *gomock.Call
+type MockDatagramStreamSetDeadlineCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamSetDeadlineCall) Return(arg0 error) *MockDatagramStreamSetDeadlineCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamSetDeadlineCall) Do(f func(time.Time) error) *MockDatagramStreamSetDeadlineCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamSetDeadlineCall) DoAndReturn(f func(time.Time) error) *MockDatagramStreamSetDeadlineCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetPriority mocks base method.
+func (m *MockDatagramStream) SetPriority(urgency int8, incremental bool) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetPriority", urgency, incremental)
+}
+
+// SetPriority indicates an expected call of SetPriority.
+func (mr *MockDatagramStreamMockRecorder) SetPriority(urgency, incremental any) *MockDatagramStreamSetPriorityCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetPriority", reflect.TypeOf((*MockDatagramStream)(nil).SetPriority), urgency, incremental)
+	return &MockDatagramStreamSetPriorityCall{Call: call}
+}
+
+// MockDatagramStreamSetPriorityCall wrap *gomock.Call
+type MockDatagramStreamSetPriorityCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamSetPriorityCall) Return() *MockDatagramStreamSetPriorityCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamSetPriorityCall) Do(f func(int8, bool)) *MockDatagramStreamSetPriorityCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamSetPriorityCall) DoAndReturn(f func(int8, bool)) *MockDatagramStreamSetPriorityCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetReadDeadline mocks base method.
+func (m *MockDatagramStream) SetReadDeadline(arg0 time.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetReadDeadline", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetReadDeadline indicates an expected call of SetReadDeadline.
+func (mr *MockDatagramStreamMockRecorder) SetReadDeadline(arg0 any) *MockDatagramStreamSetReadDeadlineCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetReadDeadline", reflect.TypeOf((*MockDatagramStream)(nil).SetReadDeadline), arg0)
+	return &MockDatagramStreamSetReadDeadlineCall{Call: call}
+}
+
+// MockDatagramStreamSetReadDeadlineCall wrap *gomock.Call
+type MockDatagramStreamSetReadDeadlineCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamSetReadDeadlineCall) Return(arg0 error) *MockDatagramStreamSetReadDeadlineCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamSetReadDeadlineCall) Do(f func(time.Time) error) *MockDatagramStreamSetReadDeadlineCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamSetReadDeadlineCall) DoAndReturn(f func(time.Time) error) *MockDatagramStreamSetReadDeadlineCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetWriteDeadline mocks base method.
+func (m *MockDatagramStream) SetWriteDeadline(arg0 time.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetWriteDeadline", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetWriteDeadline indicates an expected call of SetWriteDeadline.
+func (mr *MockDatagramStreamMockRecorder) SetWriteDeadline(arg0 any) *MockDatagramStreamSetWriteDeadlineCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetWriteDeadline", reflect.TypeOf((*MockDatagramStream)(nil).SetWriteDeadline), arg0)
+	return &MockDatagramStreamSetWriteDeadlineCall{Call: call}
+}
+
+// MockDatagramStreamSetWriteDeadlineCall wrap *gomock.Call
+type MockDatagramStreamSetWriteDeadlineCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamSetWriteDeadlineCall) Return(arg0 error) *MockDatagramStreamSetWriteDeadlineCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamSetWriteDeadlineCall) Do(f func(time.Time) error) *MockDatagramStreamSetWriteDeadlineCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamSetWriteDeadlineCall) DoAndReturn(f func(time.Time) error) *MockDatagramStreamSetWriteDeadlineCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// StreamID mocks base method.
+func (m *MockDatagramStream) StreamID() quic.StreamID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "StreamID")
+	ret0, _ := ret[0].(quic.StreamID)
+	return ret0
+}
+
+// StreamID indicates an expected call of StreamID.
+func (mr *MockDatagramStreamMockRecorder) StreamID() *MockDatagramStreamStreamIDCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "StreamID", reflect.TypeOf((*MockDatagramStream)(nil).StreamID))
+	return &MockDatagramStreamStreamIDCall{Call: call}
+}
+
+// MockDatagramStreamStreamIDCall wrap *gomock.Call
+type MockDatagramStreamStreamIDCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamStreamIDCall) Return(arg0 quic.StreamID) *MockDatagramStreamStreamIDCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamStreamIDCall) Do(f func() quic.StreamID) *MockDatagramStreamStreamIDCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamStreamIDCall) DoAndReturn(f func() quic.StreamID) *MockDatagramStreamStreamIDCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// TryWriteAll mocks base method.
+func (m *MockDatagramStream) TryWriteAll(arg0 []byte) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "TryWriteAll", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// TryWriteAll indicates an expected call of TryWriteAll.
+func (mr *MockDatagramStreamMockRecorder) TryWriteAll(arg0 any) *MockDatagramStreamTryWriteAllCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TryWriteAll", reflect.TypeOf((*MockDatagramStream)(nil).TryWriteAll), arg0)
+	return &MockDatagramStreamTryWriteAllCall{Call: call}
+}
+
+// MockDatagramStreamTryWriteAllCall wrap *gomock.Call
+type MockDatagramStreamTryWriteAllCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamTryWriteAllCall) Return(arg0 error) *MockDatagramStreamTryWriteAllCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamTryWriteAllCall) Do(f func([]byte) error) *MockDatagramStreamTryWriteAllCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamTryWriteAllCall) DoAndReturn(f func([]byte) error) *MockDatagramStreamTryWriteAllCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Write mocks base method.
+func (m *MockDatagramStream) Write(p []byte) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Write", p)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Write indicates an expected call of Write.
+func (mr *MockDatagramStreamMockRecorder) Write(p any) *MockDatagramStreamWriteCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Write", reflect.TypeOf((*MockDatagramStream)(nil).Write), p)
+	return &MockDatagramStreamWriteCall{Call: call}
+}
+
+// MockDatagramStreamWriteCall wrap *gomock.Call
+type MockDatagramStreamWriteCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockDatagramStreamWriteCall) Return(n int, err error) *MockDatagramStreamWriteCall {
+	c.Call = c.Call.Return(n, err)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockDatagramStreamWriteCall) Do(f func([]byte) (int, error)) *MockDatagramStreamWriteCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockDatagramStreamWriteCall) DoAndReturn(f func([]byte) (int, error)) *MockDatagramStreamWriteCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/mock_quic_listener_test.go b/electron/native/private-transport/third_party/quic-go/http3/mock_quic_listener_test.go
new file mode 100644
index 000000000..84acc3728
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/mock_quic_listener_test.go
@@ -0,0 +1,158 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/http3 (interfaces: QUICListener)
+//
+// Generated by this command:
+//
+//	mockgen -typed -package http3 -destination mock_quic_listener_test.go github.com/quic-go/quic-go/http3 QUICListener
+//
+
+// Package http3 is a generated GoMock package.
+package http3
+
+import (
+	context "context"
+	net "net"
+	reflect "reflect"
+
+	quic "github.com/quic-go/quic-go"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockQUICListener is a mock of QUICListener interface.
+type MockQUICListener struct {
+	ctrl     *gomock.Controller
+	recorder *MockQUICListenerMockRecorder
+	isgomock struct{}
+}
+
+// MockQUICListenerMockRecorder is the mock recorder for MockQUICListener.
+type MockQUICListenerMockRecorder struct {
+	mock *MockQUICListener
+}
+
+// NewMockQUICListener creates a new mock instance.
+func NewMockQUICListener(ctrl *gomock.Controller) *MockQUICListener {
+	mock := &MockQUICListener{ctrl: ctrl}
+	mock.recorder = &MockQUICListenerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockQUICListener) EXPECT() *MockQUICListenerMockRecorder {
+	return m.recorder
+}
+
+// Accept mocks base method.
+func (m *MockQUICListener) Accept(arg0 context.Context) (*quic.Conn, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Accept", arg0)
+	ret0, _ := ret[0].(*quic.Conn)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Accept indicates an expected call of Accept.
+func (mr *MockQUICListenerMockRecorder) Accept(arg0 any) *MockQUICListenerAcceptCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Accept", reflect.TypeOf((*MockQUICListener)(nil).Accept), arg0)
+	return &MockQUICListenerAcceptCall{Call: call}
+}
+
+// MockQUICListenerAcceptCall wrap *gomock.Call
+type MockQUICListenerAcceptCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockQUICListenerAcceptCall) Return(arg0 *quic.Conn, arg1 error) *MockQUICListenerAcceptCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockQUICListenerAcceptCall) Do(f func(context.Context) (*quic.Conn, error)) *MockQUICListenerAcceptCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockQUICListenerAcceptCall) DoAndReturn(f func(context.Context) (*quic.Conn, error)) *MockQUICListenerAcceptCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Addr mocks base method.
+func (m *MockQUICListener) Addr() net.Addr {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Addr")
+	ret0, _ := ret[0].(net.Addr)
+	return ret0
+}
+
+// Addr indicates an expected call of Addr.
+func (mr *MockQUICListenerMockRecorder) Addr() *MockQUICListenerAddrCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Addr", reflect.TypeOf((*MockQUICListener)(nil).Addr))
+	return &MockQUICListenerAddrCall{Call: call}
+}
+
+// MockQUICListenerAddrCall wrap *gomock.Call
+type MockQUICListenerAddrCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockQUICListenerAddrCall) Return(arg0 net.Addr) *MockQUICListenerAddrCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockQUICListenerAddrCall) Do(f func() net.Addr) *MockQUICListenerAddrCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockQUICListenerAddrCall) DoAndReturn(f func() net.Addr) *MockQUICListenerAddrCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Close mocks base method.
+func (m *MockQUICListener) Close() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Close")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Close indicates an expected call of Close.
+func (mr *MockQUICListenerMockRecorder) Close() *MockQUICListenerCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockQUICListener)(nil).Close))
+	return &MockQUICListenerCloseCall{Call: call}
+}
+
+// MockQUICListenerCloseCall wrap *gomock.Call
+type MockQUICListenerCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockQUICListenerCloseCall) Return(arg0 error) *MockQUICListenerCloseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockQUICListenerCloseCall) Do(f func() error) *MockQUICListenerCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockQUICListenerCloseCall) DoAndReturn(f func() error) *MockQUICListenerCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/mockgen.go b/electron/native/private-transport/third_party/quic-go/http3/mockgen.go
new file mode 100644
index 000000000..38a6f0214
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/mockgen.go
@@ -0,0 +1,11 @@
+//go:build gomock || generate
+
+package http3
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -mock_names=TestClientConnInterface=MockClientConn  -package http3 -destination mock_clientconn_test.go github.com/quic-go/quic-go/http3 TestClientConnInterface"
+type TestClientConnInterface = clientConn
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -mock_names=DatagramStream=MockDatagramStream  -package http3 -destination mock_datagram_stream_test.go github.com/quic-go/quic-go/http3 DatagramStream"
+type DatagramStream = datagramStream
+
+//go:generate sh -c "go tool mockgen -typed -package http3 -destination mock_quic_listener_test.go github.com/quic-go/quic-go/http3 QUICListener"
diff --git a/electron/native/private-transport/third_party/quic-go/http3/priority.go b/electron/native/private-transport/third_party/quic-go/http3/priority.go
new file mode 100644
index 000000000..f5d245c33
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/priority.go
@@ -0,0 +1,45 @@
+package http3
+
+import "strings"
+
+const defaultPriorityUrgency int8 = 3
+
+// parsePriority parses the RFC 9218 Priority header field value. It only
+// recognizes the u and i parameters; malformed members return both defaults.
+func parsePriority(value string) (urgency int8, incremental bool) {
+	urgency = defaultPriorityUrgency
+
+	var inString, escapes bool
+	for i, start := 0, 0; i <= len(value); i++ {
+		switch {
+		case i == len(value) || !inString && value[i] == ',':
+			member, _, _ := strings.Cut(strings.TrimSpace(value[start:i]), ";")
+			start = i + 1
+			key, item, hasValue := strings.Cut(member, "=")
+			if key == "" || hasValue && item == "" {
+				return defaultPriorityUrgency, false
+			}
+			switch key {
+			case "u":
+				if hasValue && len(item) == 1 && item[0] >= '0' && item[0] <= '7' {
+					urgency = int8(item[0] - '0')
+				}
+			case "i":
+				if !hasValue || item == "?1" {
+					incremental = true
+				} else if item == "?0" {
+					incremental = false
+				}
+			}
+		case escapes && value[i] == '\\':
+			i++
+		case value[i] == '"':
+			inString = !inString
+			escapes = inString && (i == 0 || value[i-1] != '%')
+		}
+	}
+	if inString {
+		return defaultPriorityUrgency, false
+	}
+	return urgency, incremental
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/priority_test.go b/electron/native/private-transport/third_party/quic-go/http3/priority_test.go
new file mode 100644
index 000000000..66dd3c663
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/priority_test.go
@@ -0,0 +1,93 @@
+package http3
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParsePriority(t *testing.T) {
+	tests := []struct {
+		name            string
+		value           string
+		wantUrgency     int8
+		wantIncremental bool
+	}{
+		{name: "empty", wantUrgency: defaultPriorityUrgency},
+		{name: "urgency", value: "u=0", wantUrgency: 0},
+		{name: "implicit incremental", value: "i", wantUrgency: defaultPriorityUrgency, wantIncremental: true},
+		{name: "explicit incremental", value: "i=?1", wantUrgency: defaultPriorityUrgency, wantIncremental: true},
+		{name: "urgency and non-incremental", value: "i=?0, u=4", wantUrgency: 4},
+		{name: "unknown fields", value: "some=data;someparam;u=fake, u=1;foo, i;bar", wantUrgency: 1, wantIncremental: true},
+		{name: "repeated fields", value: "u=1,i,u=5,i=?0", wantUrgency: 5},
+		{name: "wrong types", value: `u="ignored", i=1`, wantUrgency: defaultPriorityUrgency},
+		{name: "out of range urgency", value: "u=8", wantUrgency: defaultPriorityUrgency},
+		{name: "valid unknown SFV types", value: `a=(1 "two" ?1);x, b=:YWJj:, c=%"hello%20world", u=2`, wantUrgency: 2},
+		{name: "semicolon inside an extension value", value: `a="x;y";q=1, u=2`, wantUrgency: 2},
+		{name: "known fields inside extension values", value: `future="x\",u=0,i", u=5`, wantUrgency: 5},
+		{name: "backslash inside a display string", value: `future=%"x\", u=5`, wantUrgency: 5},
+		{name: "invalid member", value: "u=0, bad=", wantUrgency: defaultPriorityUrgency},
+		{name: "unterminated string", value: `u=1,i, invalid="`, wantUrgency: defaultPriorityUrgency},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			urgency, incremental := parsePriority(test.value)
+			require.Equal(t, test.wantUrgency, urgency)
+			require.Equal(t, test.wantIncremental, incremental)
+		})
+	}
+}
+
+func FuzzParsePriority(f *testing.F) {
+	for _, value := range []string{"", "u=0", "i=?0, u=7", `future="x,u=0", u=5`, `u=1, invalid="`} {
+		f.Add(value)
+	}
+	f.Fuzz(func(t *testing.T, value string) {
+		urgency, _ := parsePriority(value)
+		if urgency < 0 || urgency > 7 {
+			t.Fatalf("invalid urgency: %d", urgency)
+		}
+	})
+}
+
+func TestServerRequestPriority(t *testing.T) {
+	conn := &RawServerConn{}
+
+	requestPriority := func(header http.Header) (int8, bool) {
+		values, ok := header["Priority"]
+		if !ok {
+			return defaultPriorityUrgency, !conn.priorityAware.Load()
+		}
+		conn.priorityAware.Store(true)
+		return parsePriority(strings.Join(values, ","))
+	}
+
+	urgency, incremental := requestPriority(http.Header{})
+	require.Equal(t, defaultPriorityUrgency, urgency)
+	require.True(t, incremental)
+
+	header := http.Header{}
+	header.Set("Priority", "u=0")
+	urgency, incremental = requestPriority(header)
+	require.Equal(t, int8(0), urgency)
+	require.False(t, incremental)
+	require.True(t, conn.priorityAware.Load())
+
+	urgency, incremental = requestPriority(http.Header{})
+	require.Equal(t, defaultPriorityUrgency, urgency)
+	require.False(t, incremental)
+
+	header.Set("Priority", "i")
+	urgency, incremental = requestPriority(header)
+	require.Equal(t, defaultPriorityUrgency, urgency)
+	require.True(t, incremental)
+
+	conn = &RawServerConn{}
+	header.Set("Priority", `u=0, invalid="`)
+	urgency, incremental = requestPriority(header)
+	require.Equal(t, defaultPriorityUrgency, urgency)
+	require.False(t, incremental)
+	require.True(t, conn.priorityAware.Load())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/qlog.go b/electron/native/private-transport/third_party/quic-go/http3/qlog.go
new file mode 100644
index 000000000..54a2d2eb2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/qlog.go
@@ -0,0 +1,56 @@
+package http3
+
+import (
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+
+	"github.com/quic-go/qpack"
+)
+
+func maybeQlogInvalidHeadersFrame(qlogger qlogwriter.Recorder, streamID quic.StreamID, l uint64) {
+	if qlogger != nil {
+		qlogger.RecordEvent(qlog.FrameParsed{
+			StreamID: streamID,
+			Raw:      qlog.RawInfo{PayloadLength: int(l)},
+			Frame:    qlog.Frame{Frame: qlog.HeadersFrame{}},
+		})
+	}
+}
+
+func qlogParsedHeadersFrame(qlogger qlogwriter.Recorder, streamID quic.StreamID, hf *headersFrame, hfs []qpack.HeaderField) {
+	headerFields := make([]qlog.HeaderField, len(hfs))
+	for i, hf := range hfs {
+		headerFields[i] = qlog.HeaderField{
+			Name:  hf.Name,
+			Value: hf.Value,
+		}
+	}
+	qlogger.RecordEvent(qlog.FrameParsed{
+		StreamID: streamID,
+		Raw: qlog.RawInfo{
+			Length:        int(hf.Length) + hf.headerLen,
+			PayloadLength: int(hf.Length),
+		},
+		Frame: qlog.Frame{Frame: qlog.HeadersFrame{
+			HeaderFields: headerFields,
+		}},
+	})
+}
+
+func qlogCreatedHeadersFrame(qlogger qlogwriter.Recorder, streamID quic.StreamID, length, payloadLength int, hfs []qlog.HeaderField) {
+	headerFields := make([]qlog.HeaderField, len(hfs))
+	for i, hf := range hfs {
+		headerFields[i] = qlog.HeaderField{
+			Name:  hf.Name,
+			Value: hf.Value,
+		}
+	}
+	qlogger.RecordEvent(qlog.FrameCreated{
+		StreamID: streamID,
+		Raw:      qlog.RawInfo{Length: length, PayloadLength: payloadLength},
+		Frame: qlog.Frame{Frame: qlog.HeadersFrame{
+			HeaderFields: headerFields,
+		}},
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/qlog/event.go b/electron/native/private-transport/third_party/quic-go/http3/qlog/event.go
new file mode 100644
index 000000000..b5bbe1122
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/qlog/event.go
@@ -0,0 +1,138 @@
+package qlog
+
+import (
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+)
+
+type encoderHelper struct {
+	enc *jsontext.Encoder
+	err error
+}
+
+func (h *encoderHelper) WriteToken(t jsontext.Token) {
+	if h.err != nil {
+		return
+	}
+	h.err = h.enc.WriteToken(t)
+}
+
+type RawInfo struct {
+	Length        int // full packet length, including header and AEAD authentication tag
+	PayloadLength int // length of the packet payload, excluding AEAD tag
+}
+
+func (i RawInfo) HasValues() bool {
+	return i.Length != 0 || i.PayloadLength != 0
+}
+
+func (i RawInfo) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	if i.Length != 0 {
+		h.WriteToken(jsontext.String("length"))
+		h.WriteToken(jsontext.Uint(uint64(i.Length)))
+	}
+	if i.PayloadLength != 0 {
+		h.WriteToken(jsontext.String("payload_length"))
+		h.WriteToken(jsontext.Uint(uint64(i.PayloadLength)))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type FrameParsed struct {
+	StreamID quic.StreamID
+	Raw      RawInfo
+	Frame    Frame
+}
+
+func (e FrameParsed) Name() string { return "http3:frame_parsed" }
+
+func (e FrameParsed) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("stream_id"))
+	h.WriteToken(jsontext.Uint(uint64(e.StreamID)))
+	if e.Raw.HasValues() {
+		h.WriteToken(jsontext.String("raw"))
+		if err := e.Raw.encode(enc); err != nil {
+			return err
+		}
+	}
+	h.WriteToken(jsontext.String("frame"))
+	if err := e.Frame.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type FrameCreated struct {
+	StreamID quic.StreamID
+	Raw      RawInfo
+	Frame    Frame
+}
+
+func (e FrameCreated) Name() string { return "http3:frame_created" }
+
+func (e FrameCreated) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("stream_id"))
+	h.WriteToken(jsontext.Uint(uint64(e.StreamID)))
+	if e.Raw.HasValues() {
+		h.WriteToken(jsontext.String("raw"))
+		if err := e.Raw.encode(enc); err != nil {
+			return err
+		}
+	}
+	h.WriteToken(jsontext.String("frame"))
+	if err := e.Frame.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type DatagramCreated struct {
+	QuarterStreamID uint64
+	Raw             RawInfo
+}
+
+func (e DatagramCreated) Name() string { return "http3:datagram_created" }
+
+func (e DatagramCreated) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("quarter_stream_id"))
+	h.WriteToken(jsontext.Uint(e.QuarterStreamID))
+	h.WriteToken(jsontext.String("raw"))
+	if err := e.Raw.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type DatagramParsed struct {
+	QuarterStreamID uint64
+	Raw             RawInfo
+}
+
+func (e DatagramParsed) Name() string { return "http3:datagram_parsed" }
+
+func (e DatagramParsed) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("quarter_stream_id"))
+	h.WriteToken(jsontext.Uint(e.QuarterStreamID))
+	h.WriteToken(jsontext.String("raw"))
+	if err := e.Raw.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/qlog/event_test.go b/electron/native/private-transport/third_party/quic-go/http3/qlog/event_test.go
new file mode 100644
index 000000000..464436d27
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/qlog/event_test.go
@@ -0,0 +1,98 @@
+package qlog
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlogwriter"
+
+	"github.com/stretchr/testify/require"
+)
+
+type nopWriteCloserImpl struct{ io.Writer }
+
+func (nopWriteCloserImpl) Close() error { return nil }
+
+func nopWriteCloser(w io.Writer) io.WriteCloser {
+	return &nopWriteCloserImpl{Writer: w}
+}
+
+func testEventEncoding(t *testing.T, ev qlogwriter.Event) (string, map[string]any) {
+	t.Helper()
+	var buf bytes.Buffer
+
+	synctest.Test(t, func(t *testing.T) {
+		tr := qlogwriter.NewConnectionFileSeq(
+			nopWriteCloser(&buf),
+			true,
+			quic.ConnectionIDFromBytes([]byte{1, 2, 3, 4}),
+			[]string{"http3"},
+		)
+		go tr.Run()
+		producer := tr.AddProducer()
+
+		synctest.Wait()
+		time.Sleep(42 * time.Second)
+
+		producer.RecordEvent(ev)
+		producer.Close()
+	})
+
+	return decode(t, buf.String())
+}
+
+func decode(t *testing.T, data string) (string, map[string]any) {
+	t.Helper()
+
+	var result map[string]any
+
+	lines := bytes.Split([]byte(data), []byte{'\n'})
+	require.Len(t, lines, 3) // the first line is the trace header, the second line is the event, the third line is empty
+	require.Empty(t, lines[2])
+	require.Equal(t, qlogwriter.RecordSeparator, lines[1][0], "expected record separator at start of line")
+	require.NoError(t, json.Unmarshal(lines[1][1:], &result))
+	require.Equal(t, 42*time.Second, time.Duration(result["time"].(float64)*1e6)*time.Nanosecond)
+
+	return result["name"].(string), result["data"].(map[string]any)
+}
+
+func TestFrameParsedEvent(t *testing.T) {
+	name, ev := testEventEncoding(t, FrameParsed{
+		StreamID: quic.StreamID(4),
+		Raw: RawInfo{
+			Length:        1500,
+			PayloadLength: 100,
+		},
+		Frame: Frame{Frame: &DataFrame{}},
+	})
+
+	require.Equal(t, "http3:frame_parsed", name)
+	require.Equal(t, float64(4), ev["stream_id"])
+	require.NotContains(t, ev, "name")
+	require.Contains(t, ev, "frame")
+}
+
+func TestFrameCreatedEvent(t *testing.T) {
+	name, ev := testEventEncoding(t, FrameCreated{
+		StreamID: quic.StreamID(8),
+		Raw: RawInfo{
+			PayloadLength: 200,
+		},
+		Frame: Frame{Frame: &HeadersFrame{
+			HeaderFields: []HeaderField{
+				{Name: ":status", Value: "200"},
+				{Name: "content-type", Value: "text/html"},
+			},
+		}},
+	})
+
+	require.Equal(t, "http3:frame_created", name)
+	require.Equal(t, float64(8), ev["stream_id"])
+	require.NotContains(t, ev, "name")
+	require.Contains(t, ev, "frame")
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/qlog/frame.go b/electron/native/private-transport/third_party/quic-go/http3/qlog/frame.go
new file mode 100644
index 000000000..6795678c0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/qlog/frame.go
@@ -0,0 +1,241 @@
+package qlog
+
+import (
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+)
+
+// Frame represents an HTTP/3 frame.
+type Frame struct {
+	Frame any
+}
+
+func (f Frame) encode(enc *jsontext.Encoder) error {
+	switch frame := f.Frame.(type) {
+	case DataFrame:
+		return frame.encode(enc)
+	case HeadersFrame:
+		return frame.encode(enc)
+	case GoAwayFrame:
+		return frame.encode(enc)
+	case SettingsFrame:
+		return frame.encode(enc)
+	case PushPromiseFrame:
+		return frame.encode(enc)
+	case CancelPushFrame:
+		return frame.encode(enc)
+	case MaxPushIDFrame:
+		return frame.encode(enc)
+	case PriorityUpdateFrame:
+		return frame.encode(enc)
+	case ReservedFrame:
+		return frame.encode(enc)
+	case UnknownFrame:
+		return frame.encode(enc)
+	}
+	// This shouldn't happen if the code is correctly logging frames.
+	// Write a null token to produce valid JSON.
+	return enc.WriteToken(jsontext.Null)
+}
+
+// A DataFrame is a DATA frame
+type DataFrame struct{}
+
+func (f *DataFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("data"))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type HeaderField struct {
+	Name  string
+	Value string
+}
+
+// A HeadersFrame is a HEADERS frame
+type HeadersFrame struct {
+	HeaderFields []HeaderField
+}
+
+func (f *HeadersFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("headers"))
+	if len(f.HeaderFields) > 0 {
+		h.WriteToken(jsontext.String("header_fields"))
+		h.WriteToken(jsontext.BeginArray)
+		for _, f := range f.HeaderFields {
+			h.WriteToken(jsontext.BeginObject)
+			h.WriteToken(jsontext.String("name"))
+			h.WriteToken(jsontext.String(f.Name))
+			h.WriteToken(jsontext.String("value"))
+			h.WriteToken(jsontext.String(f.Value))
+			h.WriteToken(jsontext.EndObject)
+		}
+		h.WriteToken(jsontext.EndArray)
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// A GoAwayFrame is a GOAWAY frame
+type GoAwayFrame struct {
+	StreamID quic.StreamID
+}
+
+func (f *GoAwayFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("goaway"))
+	h.WriteToken(jsontext.String("id"))
+	h.WriteToken(jsontext.Uint(uint64(f.StreamID)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type SettingsFrame struct {
+	MaxFieldSectionSize int64
+	Datagram            *bool
+	ExtendedConnect     *bool
+	Other               map[uint64]uint64
+}
+
+func (f *SettingsFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("settings"))
+	h.WriteToken(jsontext.String("settings"))
+	h.WriteToken(jsontext.BeginArray)
+	if f.MaxFieldSectionSize >= 0 {
+		h.WriteToken(jsontext.BeginObject)
+		h.WriteToken(jsontext.String("name"))
+		h.WriteToken(jsontext.String("settings_max_field_section_size"))
+		h.WriteToken(jsontext.String("value"))
+		h.WriteToken(jsontext.Uint(uint64(f.MaxFieldSectionSize)))
+		h.WriteToken(jsontext.EndObject)
+	}
+	if f.Datagram != nil {
+		h.WriteToken(jsontext.BeginObject)
+		h.WriteToken(jsontext.String("name"))
+		h.WriteToken(jsontext.String("settings_h3_datagram"))
+		h.WriteToken(jsontext.String("value"))
+		h.WriteToken(jsontext.Bool(*f.Datagram))
+		h.WriteToken(jsontext.EndObject)
+	}
+	if f.ExtendedConnect != nil {
+		h.WriteToken(jsontext.BeginObject)
+		h.WriteToken(jsontext.String("name"))
+		h.WriteToken(jsontext.String("settings_enable_connect_protocol"))
+		h.WriteToken(jsontext.String("value"))
+		h.WriteToken(jsontext.Bool(*f.ExtendedConnect))
+		h.WriteToken(jsontext.EndObject)
+	}
+	if len(f.Other) > 0 {
+		for k, v := range f.Other {
+			h.WriteToken(jsontext.BeginObject)
+			h.WriteToken(jsontext.String("name"))
+			h.WriteToken(jsontext.String("unknown"))
+			h.WriteToken(jsontext.String("name_bytes"))
+			h.WriteToken(jsontext.Uint(k))
+			h.WriteToken(jsontext.String("value"))
+			h.WriteToken(jsontext.Uint(v))
+			h.WriteToken(jsontext.EndObject)
+		}
+	}
+	h.WriteToken(jsontext.EndArray)
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// A PushPromiseFrame is a PUSH_PROMISE frame
+type PushPromiseFrame struct{}
+
+func (f *PushPromiseFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("push_promise"))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// A CancelPushFrame is a CANCEL_PUSH frame
+type CancelPushFrame struct{}
+
+func (f *CancelPushFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("cancel_push"))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// A MaxPushIDFrame is a MAX_PUSH_ID frame
+type MaxPushIDFrame struct{}
+
+func (f *MaxPushIDFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("max_push_id"))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// A PriorityUpdateFrame is a PRIORITY_UPDATE frame for a request stream.
+type PriorityUpdateFrame struct {
+	StreamID           quic.StreamID
+	PriorityFieldValue string
+}
+
+func (f *PriorityUpdateFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("priority_update"))
+	h.WriteToken(jsontext.String("stream_id"))
+	h.WriteToken(jsontext.Uint(uint64(f.StreamID)))
+	h.WriteToken(jsontext.String("priority_field_value"))
+	h.WriteToken(jsontext.String(f.PriorityFieldValue))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// A ReservedFrame is one of the reserved frame types
+type ReservedFrame struct {
+	Type uint64
+}
+
+func (f *ReservedFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("reserved"))
+	h.WriteToken(jsontext.String("frame_type_bytes"))
+	h.WriteToken(jsontext.Uint(f.Type))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// An UnknownFrame is an unknown frame type
+type UnknownFrame struct {
+	Type uint64
+}
+
+func (f *UnknownFrame) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("unknown"))
+	h.WriteToken(jsontext.String("frame_type_bytes"))
+	h.WriteToken(jsontext.Uint(f.Type))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/qlog/frame_test.go b/electron/native/private-transport/third_party/quic-go/http3/qlog/frame_test.go
new file mode 100644
index 000000000..6b087fea4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/qlog/frame_test.go
@@ -0,0 +1,208 @@
+package qlog
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+
+	"github.com/stretchr/testify/require"
+)
+
+func check(t *testing.T, f any, expected map[string]any) {
+	t.Helper()
+
+	var buf bytes.Buffer
+	enc := jsontext.NewEncoder(&buf)
+	require.NoError(t, (Frame{Frame: f}).encode(enc))
+	data := buf.Bytes()
+	require.True(t, json.Valid(data), "invalid JSON: %s", string(data))
+	checkEncoding(t, data, expected)
+}
+
+func checkEncoding(t *testing.T, data []byte, expected map[string]any) {
+	t.Helper()
+
+	m := make(map[string]any)
+	require.NoError(t, json.Unmarshal(data, &m))
+	require.Len(t, m, len(expected))
+
+	for key, value := range expected {
+		switch v := value.(type) {
+		case bool, string, map[string]any:
+			require.Equal(t, v, m[key])
+		case int:
+			require.Equal(t, float64(v), m[key])
+		case float64:
+			require.Equal(t, v, m[key])
+		case []map[string]any: // used for header fields
+			require.Contains(t, m, key)
+			slice, ok := m[key].([]any)
+			require.True(t, ok)
+			require.Len(t, slice, len(v))
+			for i, expectedField := range v {
+				field, ok := slice[i].(map[string]any)
+				require.True(t, ok)
+				require.Equal(t, expectedField, field)
+			}
+		default:
+			t.Fatalf("unexpected type: %T", v)
+		}
+	}
+}
+
+func TestDataFrame(t *testing.T) {
+	check(t, DataFrame{}, map[string]any{
+		"frame_type": "data",
+	})
+}
+
+func TestHeadersFrame(t *testing.T) {
+	check(t, HeadersFrame{
+		HeaderFields: []HeaderField{
+			{Name: ":status", Value: "200"},
+			{Name: "content-type", Value: "application/json"},
+		},
+	}, map[string]any{
+		"frame_type": "headers",
+		"header_fields": []map[string]any{
+			{"name": ":status", "value": "200"},
+			{"name": "content-type", "value": "application/json"},
+		},
+	})
+}
+
+func TestGoAwayFrame(t *testing.T) {
+	check(t, GoAwayFrame{StreamID: 1337}, map[string]any{
+		"frame_type": "goaway",
+		"id":         1337,
+	})
+}
+
+func TestSettingsFrame(t *testing.T) {
+	tests := []struct {
+		name     string
+		frame    SettingsFrame
+		expected map[string]any
+	}{
+		{
+			name: "datagram: true",
+			frame: SettingsFrame{
+				MaxFieldSectionSize: -1,
+				Datagram:            new(true),
+			},
+			expected: map[string]any{
+				"frame_type": "settings",
+				"settings": []map[string]any{{
+					"name":  "settings_h3_datagram",
+					"value": true,
+				}},
+			},
+		},
+		{
+			name: "extended_connect: false",
+			frame: SettingsFrame{
+				MaxFieldSectionSize: -1,
+				ExtendedConnect:     new(false),
+			},
+			expected: map[string]any{
+				"frame_type": "settings",
+				"settings": []map[string]any{{
+					"name":  "settings_enable_connect_protocol",
+					"value": false,
+				}},
+			},
+		},
+		{
+			name:  "max_field_section_size",
+			frame: SettingsFrame{MaxFieldSectionSize: 1337},
+			expected: map[string]any{
+				"frame_type": "settings",
+				"settings": []map[string]any{{
+					"name":  "settings_max_field_section_size",
+					"value": float64(1337),
+				}},
+			},
+		},
+		{
+			name: "datagram: false, extended_connect: false",
+			frame: SettingsFrame{
+				MaxFieldSectionSize: -1,
+				Datagram:            new(false),
+				ExtendedConnect:     new(false),
+			},
+			expected: map[string]any{
+				"frame_type": "settings",
+				"settings": []map[string]any{
+					{"name": "settings_h3_datagram", "value": false},
+					{"name": "settings_enable_connect_protocol", "value": false},
+				},
+			},
+		},
+		{
+			name: "unknowns",
+			// Only test a single unknown setting.
+			// Testing multiple unknown settings doesn't add a lot of value,
+			// and would require us to deal with non-deterministic map iteration order.
+			frame: SettingsFrame{
+				MaxFieldSectionSize: -1,
+				Other:               map[uint64]uint64{0xdead: 0xbeef},
+			},
+			expected: map[string]any{
+				"frame_type": "settings",
+				"settings": []map[string]any{{
+					"name":       "unknown",
+					"name_bytes": float64(0xdead),
+					"value":      float64(0xbeef),
+				}},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			check(t, tc.frame, tc.expected)
+		})
+	}
+}
+
+func TestPushPromiseFrame(t *testing.T) {
+	check(t, PushPromiseFrame{}, map[string]any{
+		"frame_type": "push_promise",
+	})
+}
+
+func TestCancelPushFrame(t *testing.T) {
+	check(t, CancelPushFrame{}, map[string]any{
+		"frame_type": "cancel_push",
+	})
+}
+
+func TestMaxPushIDFrame(t *testing.T) {
+	check(t, MaxPushIDFrame{}, map[string]any{
+		"frame_type": "max_push_id",
+	})
+}
+
+func TestPriorityUpdateFrame(t *testing.T) {
+	check(t, PriorityUpdateFrame{StreamID: 12, PriorityFieldValue: "u=1, i"}, map[string]any{
+		"frame_type":           "priority_update",
+		"stream_id":            12,
+		"priority_field_value": "u=1, i",
+	})
+}
+
+func TestReservedFrame(t *testing.T) {
+	check(t, ReservedFrame{Type: 0x1f}, map[string]any{
+		"frame_type":       "reserved",
+		"frame_type_bytes": 0x1f,
+	})
+}
+
+func TestUnknownFrame(t *testing.T) {
+	check(t, UnknownFrame{Type: 0x2a}, map[string]any{
+		"frame_type":       "unknown",
+		"frame_type_bytes": 0x2a,
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/qlog/qlog_dir.go b/electron/native/private-transport/third_party/quic-go/http3/qlog/qlog_dir.go
new file mode 100644
index 000000000..898d17c6b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/qlog/qlog_dir.go
@@ -0,0 +1,15 @@
+package qlog
+
+import (
+	"context"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+const EventSchema = "urn:ietf:params:qlog:events:http3-12"
+
+func DefaultConnectionTracer(ctx context.Context, isClient bool, connID quic.ConnectionID) qlogwriter.Trace {
+	return qlog.DefaultConnectionTracerWithSchemas(ctx, isClient, connID, []string{qlog.EventSchema, EventSchema})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/qlog/qlog_dir_test.go b/electron/native/private-transport/third_party/quic-go/http3/qlog/qlog_dir_test.go
new file mode 100644
index 000000000..ea7d8469f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/qlog/qlog_dir_test.go
@@ -0,0 +1,41 @@
+package qlog
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/stretchr/testify/require"
+)
+
+func TestQLOGDIRSet(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	connID := quic.ConnectionIDFromBytes([]byte{1, 2, 3, 4})
+	qlogDir := filepath.Join(tmpDir, "qlogs")
+	t.Setenv("QLOGDIR", qlogDir)
+
+	tracer := DefaultConnectionTracer(context.Background(), true, connID)
+	require.NotNil(t, tracer)
+
+	// adding and closing a producer makes the tracer close the file
+	recorder := tracer.AddProducer()
+	recorder.Close()
+
+	_, err := os.Stat(qlogDir)
+	qlogDirCreated := !os.IsNotExist(err)
+	require.True(t, qlogDirCreated)
+
+	entries, err := os.ReadDir(qlogDir)
+	require.NoError(t, err)
+	require.Len(t, entries, 1)
+
+	data, err := os.ReadFile(filepath.Join(qlogDir, entries[0].Name()))
+	require.NoError(t, err)
+
+	require.Contains(t, string(data), EventSchema)
+	require.Contains(t, string(data), qlog.EventSchema)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/request_writer.go b/electron/native/private-transport/third_party/quic-go/http3/request_writer.go
new file mode 100644
index 000000000..ec362c22c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/request_writer.go
@@ -0,0 +1,324 @@
+package http3
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptrace"
+	"strconv"
+	"strings"
+	"sync"
+
+	"golang.org/x/net/http/httpguts"
+	"golang.org/x/net/http2/hpack"
+	"golang.org/x/net/idna"
+
+	"github.com/quic-go/qpack"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+const bodyCopyBufferSize = 8 * 1024
+
+type requestWriter struct {
+	mutex     sync.Mutex
+	encoder   *qpack.Encoder
+	headerBuf *bytes.Buffer
+}
+
+func newRequestWriter() *requestWriter {
+	headerBuf := &bytes.Buffer{}
+	encoder := qpack.NewEncoder(headerBuf)
+	return &requestWriter{
+		encoder:   encoder,
+		headerBuf: headerBuf,
+	}
+}
+
+func (w *requestWriter) WriteRequestHeader(wr io.Writer, req *http.Request, gzip bool, streamID quic.StreamID, qlogger qlogwriter.Recorder) error {
+	buf := &bytes.Buffer{}
+	if err := w.writeHeaders(buf, req, gzip, streamID, qlogger); err != nil {
+		return err
+	}
+	if _, err := wr.Write(buf.Bytes()); err != nil {
+		return err
+	}
+	trace := httptrace.ContextClientTrace(req.Context())
+	traceWroteHeaders(trace)
+	return nil
+}
+
+func (w *requestWriter) writeHeaders(wr io.Writer, req *http.Request, gzip bool, streamID quic.StreamID, qlogger qlogwriter.Recorder) error {
+	w.mutex.Lock()
+	defer w.mutex.Unlock()
+	defer w.encoder.Close()
+	defer w.headerBuf.Reset()
+
+	var trailers string
+	if len(req.Trailer) > 0 {
+		keys := make([]string, 0, len(req.Trailer))
+		for k := range req.Trailer {
+			if httpguts.ValidTrailerHeader(k) {
+				keys = append(keys, k)
+			}
+		}
+		trailers = strings.Join(keys, ", ")
+	}
+
+	headerFields, err := w.encodeHeaders(req, gzip, trailers, actualContentLength(req), qlogger != nil)
+	if err != nil {
+		return err
+	}
+
+	b := make([]byte, 0, 128)
+	b = (&headersFrame{Length: uint64(w.headerBuf.Len())}).Append(b)
+	if qlogger != nil {
+		qlogCreatedHeadersFrame(qlogger, streamID, len(b)+w.headerBuf.Len(), w.headerBuf.Len(), headerFields)
+	}
+	if _, err := wr.Write(b); err != nil {
+		return err
+	}
+	_, err = wr.Write(w.headerBuf.Bytes())
+	return err
+}
+
+func isExtendedConnectRequest(req *http.Request) bool {
+	return req.Method == http.MethodConnect && req.Proto != "" && req.Proto != "HTTP/1.1"
+}
+
+// copied from net/transport.go
+// Modified to support Extended CONNECT:
+// Contrary to what the godoc for the http.Request says,
+// we do respect the Proto field if the method is CONNECT.
+//
+// The returned header fields are only set if doQlog is true.
+func (w *requestWriter) encodeHeaders(req *http.Request, addGzipHeader bool, trailers string, contentLength int64, doQlog bool) ([]qlog.HeaderField, error) {
+	host := req.Host
+	if host == "" {
+		host = req.URL.Host
+	}
+	host, err := httpguts.PunycodeHostPort(host)
+	if err != nil {
+		return nil, err
+	}
+	if !httpguts.ValidHostHeader(host) {
+		return nil, errors.New("http3: invalid Host header")
+	}
+
+	// http.NewRequest sets this field to HTTP/1.1
+	isExtendedConnect := isExtendedConnectRequest(req)
+	if isExtendedConnect && !validExtendedConnectProtocol(req.Proto) {
+		return nil, fmt.Errorf("invalid request :protocol %q", req.Proto)
+	}
+
+	var path string
+	if req.Method != http.MethodConnect || isExtendedConnect {
+		path = req.URL.RequestURI()
+		if !validPseudoPath(path) {
+			orig := path
+			path = strings.TrimPrefix(path, req.URL.Scheme+"://"+host)
+			if !validPseudoPath(path) {
+				if req.URL.Opaque != "" {
+					return nil, fmt.Errorf("invalid request :path %q from URL.Opaque = %q", orig, req.URL.Opaque)
+				} else {
+					return nil, fmt.Errorf("invalid request :path %q", orig)
+				}
+			}
+		}
+	}
+
+	// Check for any invalid headers and return an error before we
+	// potentially pollute our hpack state. (We want to be able to
+	// continue to reuse the hpack encoder for future requests)
+	for k, vv := range req.Header {
+		if !httpguts.ValidHeaderFieldName(k) {
+			return nil, fmt.Errorf("invalid HTTP header name %q", k)
+		}
+		for _, v := range vv {
+			if !httpguts.ValidHeaderFieldValue(v) {
+				return nil, fmt.Errorf("invalid HTTP header value for header %q", k)
+			}
+		}
+	}
+
+	enumerateHeaders := func(f func(name, value string)) {
+		// 8.1.2.3 Request Pseudo-Header Fields
+		// The :path pseudo-header field includes the path and query parts of the
+		// target URI (the path-absolute production and optionally a '?' character
+		// followed by the query production (see Sections 3.3 and 3.4 of
+		// [RFC3986]).
+		f(":authority", host)
+		f(":method", req.Method)
+		if req.Method != http.MethodConnect || isExtendedConnect {
+			f(":path", path)
+			f(":scheme", req.URL.Scheme)
+		}
+		if isExtendedConnect {
+			f(":protocol", req.Proto)
+		}
+		if trailers != "" {
+			f("trailer", trailers)
+		}
+
+		var didUA bool
+		for k, vv := range req.Header {
+			if strings.EqualFold(k, "host") || strings.EqualFold(k, "content-length") {
+				// Host is :authority, already sent.
+				// Content-Length is automatic, set below.
+				continue
+			} else if strings.EqualFold(k, "connection") || strings.EqualFold(k, "proxy-connection") ||
+				strings.EqualFold(k, "transfer-encoding") || strings.EqualFold(k, "upgrade") ||
+				strings.EqualFold(k, "keep-alive") {
+				// Per 8.1.2.2 Connection-Specific Header
+				// Fields, don't send connection-specific
+				// fields. We have already checked if any
+				// are error-worthy so just ignore the rest.
+				continue
+			} else if strings.EqualFold(k, "user-agent") {
+				// Match Go's http1 behavior: at most one
+				// User-Agent. If set to nil or empty string,
+				// then omit it. Otherwise if not mentioned,
+				// include the default (below).
+				didUA = true
+				if len(vv) < 1 {
+					continue
+				}
+				vv = vv[:1]
+				if vv[0] == "" {
+					continue
+				}
+
+			}
+
+			for _, v := range vv {
+				f(k, v)
+			}
+		}
+		if shouldSendReqContentLength(req.Method, contentLength) {
+			f("content-length", strconv.FormatInt(contentLength, 10))
+		}
+		if addGzipHeader {
+			f("accept-encoding", "gzip")
+		}
+		if !didUA {
+			f("user-agent", defaultUserAgent)
+		}
+	}
+
+	// Do a first pass over the headers counting bytes to ensure
+	// we don't exceed cc.peerMaxHeaderListSize. This is done as a
+	// separate pass before encoding the headers to prevent
+	// modifying the hpack state.
+	hlSize := uint64(0)
+	enumerateHeaders(func(name, value string) {
+		hf := hpack.HeaderField{Name: name, Value: value}
+		hlSize += uint64(hf.Size())
+	})
+
+	// TODO: check maximum header list size
+	// if hlSize > cc.peerMaxHeaderListSize {
+	// 	return errRequestHeaderListSize
+	// }
+
+	trace := httptrace.ContextClientTrace(req.Context())
+	traceHeaders := traceHasWroteHeaderField(trace)
+
+	// Header list size is ok. Write the headers.
+	var headerFields []qlog.HeaderField
+	if doQlog {
+		headerFields = make([]qlog.HeaderField, 0, len(req.Header))
+	}
+	enumerateHeaders(func(name, value string) {
+		name = strings.ToLower(name)
+		w.encoder.WriteField(qpack.HeaderField{Name: name, Value: value})
+		if traceHeaders {
+			traceWroteHeaderField(trace, name, value)
+		}
+		if doQlog {
+			headerFields = append(headerFields, qlog.HeaderField{Name: name, Value: value})
+		}
+	})
+
+	return headerFields, nil
+}
+
+// authorityAddr returns a given authority (a host/IP, or host:port / ip:port)
+// and returns a host:port. The port 443 is added if needed.
+func authorityAddr(authority string) (addr string) {
+	host, port, err := net.SplitHostPort(authority)
+	if err != nil { // authority didn't have a port
+		port = "443"
+		host = authority
+	}
+	if a, err := idna.ToASCII(host); err == nil {
+		host = a
+	}
+	// IPv6 address literal, without a port:
+	if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
+		return host + ":" + port
+	}
+	return net.JoinHostPort(host, port)
+}
+
+// validPseudoPath reports whether v is a valid :path pseudo-header
+// value. It must be either:
+//
+//	*) a non-empty string starting with '/'
+//	*) the string '*', for OPTIONS requests.
+//
+// For now this is only used a quick check for deciding when to clean
+// up Opaque URLs before sending requests from the Transport.
+// See golang.org/issue/16847
+//
+// We used to enforce that the path also didn't start with "//", but
+// Google's GFE accepts such paths and Chrome sends them, so ignore
+// that part of the spec. See golang.org/issue/19103.
+func validPseudoPath(v string) bool {
+	return (len(v) > 0 && v[0] == '/') || v == "*"
+}
+
+// actualContentLength returns a sanitized version of
+// req.ContentLength, where 0 actually means zero (not unknown) and -1
+// means unknown.
+func actualContentLength(req *http.Request) int64 {
+	if req.Body == nil {
+		return 0
+	}
+	if req.ContentLength != 0 {
+		return req.ContentLength
+	}
+	return -1
+}
+
+// shouldSendReqContentLength reports whether the http2.Transport should send
+// a "content-length" request header. This logic is basically a copy of the net/http
+// transferWriter.shouldSendContentLength.
+// The contentLength is the corrected contentLength (so 0 means actually 0, not unknown).
+// -1 means unknown.
+func shouldSendReqContentLength(method string, contentLength int64) bool {
+	if contentLength > 0 {
+		return true
+	}
+	if contentLength < 0 {
+		return false
+	}
+	// For zero bodies, whether we send a content-length depends on the method.
+	// It also kinda doesn't matter for http2 either way, with END_STREAM.
+	switch method {
+	case "POST", "PUT", "PATCH":
+		return true
+	default:
+		return false
+	}
+}
+
+// WriteRequestTrailer writes HTTP trailers to the stream.
+// It should be called after the request body has been fully written.
+func (w *requestWriter) WriteRequestTrailer(wr io.Writer, req *http.Request, streamID quic.StreamID, qlogger qlogwriter.Recorder) error {
+	_, err := writeTrailers(wr, req.Trailer, streamID, qlogger)
+	return err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/request_writer_test.go b/electron/native/private-transport/third_party/quic-go/http3/request_writer_test.go
new file mode 100644
index 000000000..6aa8a740c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/request_writer_test.go
@@ -0,0 +1,175 @@
+package http3
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+)
+
+func decodeRequest(t *testing.T, str io.Reader, streamID quic.StreamID, eventRecorder *events.Recorder) map[string]string {
+	t.Helper()
+
+	r := io.LimitedReader{R: str, N: 1000}
+	fp := frameParser{r: &r}
+	frame, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &headersFrame{}, frame)
+	headersFrame := frame.(*headersFrame)
+	data := make([]byte, headersFrame.Length)
+	_, err = io.ReadFull(&r, data)
+	require.NoError(t, err)
+	hfs := decodeQpackHeaderFields(t, data)
+	values := make(map[string]string)
+	for _, hf := range hfs {
+		values[hf.Name] = hf.Value
+	}
+
+	headerFields := make([]qlog.HeaderField, len(hfs))
+	for i, hf := range hfs {
+		headerFields[i] = qlog.HeaderField{Name: hf.Name, Value: hf.Value}
+	}
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.FrameCreated{
+				StreamID: streamID,
+				Raw: qlog.RawInfo{
+					Length:        int(1000 - r.N),
+					PayloadLength: int(headersFrame.Length),
+				},
+				Frame: qlog.Frame{Frame: qlog.HeadersFrame{HeaderFields: headerFields}},
+			},
+		},
+		eventRecorder.Events(qlog.FrameCreated{}),
+	)
+
+	return values
+}
+
+func TestRequestWriterGetRequestGzip(t *testing.T) {
+	t.Run("gzip", func(t *testing.T) {
+		testRequestWriterGzip(t, true)
+	})
+	t.Run("no gzip", func(t *testing.T) {
+		testRequestWriterGzip(t, false)
+	})
+}
+
+func testRequestWriterGzip(t *testing.T, gzip bool) {
+	req := httptest.NewRequest(http.MethodGet, "https://quic-go.net/index.html?foo=bar", nil)
+	req.AddCookie(&http.Cookie{Name: "foo", Value: "bar"})
+	req.AddCookie(&http.Cookie{Name: "baz", Value: "lorem ipsum"})
+
+	rw := newRequestWriter()
+	var eventRecorder events.Recorder
+	buf := &bytes.Buffer{}
+	require.NoError(t, rw.WriteRequestHeader(buf, req, gzip, 42, &eventRecorder))
+	headerFields := decodeRequest(t, buf, 42, &eventRecorder)
+	require.Equal(t, "quic-go.net", headerFields[":authority"])
+	require.Equal(t, http.MethodGet, headerFields[":method"])
+	require.Equal(t, "/index.html?foo=bar", headerFields[":path"])
+	require.Equal(t, "https", headerFields[":scheme"])
+	require.Equal(t, `foo=bar; baz="lorem ipsum"`, headerFields["cookie"])
+	switch gzip {
+	case true:
+		require.Equal(t, "gzip", headerFields["accept-encoding"])
+	case false:
+		require.NotContains(t, headerFields, "accept-encoding")
+	}
+}
+
+func TestRequestWriterInvalidHostHeader(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, "https://quic-go.net/index.html?foo=bar", nil)
+	req.Host = "foo@bar" // @ is invalid
+	rw := newRequestWriter()
+	require.EqualError(t,
+		rw.WriteRequestHeader(&bytes.Buffer{}, req, false, 0, nil),
+		"http3: invalid Host header",
+	)
+}
+
+func TestRequestWriterInvalidHeaderValue(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, "https://quic-go.net", nil)
+	req.Header.Set("Authorization", "Bearer secret\x00")
+	err := newRequestWriter().WriteRequestHeader(&bytes.Buffer{}, req, false, 0, nil)
+	require.EqualError(t, err, `invalid HTTP header value for header "Authorization"`)
+}
+
+func TestRequestWriterConnect(t *testing.T) {
+	// httptest.NewRequest does not properly support the CONNECT method
+	req, err := http.NewRequest(http.MethodConnect, "https://quic-go.net/", nil)
+	require.NoError(t, err)
+	rw := newRequestWriter()
+	buf := &bytes.Buffer{}
+	var eventRecorder events.Recorder
+	require.NoError(t, rw.WriteRequestHeader(buf, req, false, 1337, &eventRecorder))
+	headerFields := decodeRequest(t, buf, 1337, &eventRecorder)
+	require.Equal(t, http.MethodConnect, headerFields[":method"])
+	require.Equal(t, "quic-go.net", headerFields[":authority"])
+	require.NotContains(t, headerFields, ":path")
+	require.NotContains(t, headerFields, ":scheme")
+	require.NotContains(t, headerFields, ":protocol")
+}
+
+func TestRequestWriterExtendedConnect(t *testing.T) {
+	// httptest.NewRequest does not properly support the CONNECT method
+	req, err := http.NewRequest(http.MethodConnect, "https://quic-go.net/", nil)
+	require.NoError(t, err)
+	req.Proto = "webtransport"
+	rw := newRequestWriter()
+	buf := &bytes.Buffer{}
+	var eventRecorder events.Recorder
+	require.NoError(t, rw.WriteRequestHeader(buf, req, false, 1234, &eventRecorder))
+	headerFields := decodeRequest(t, buf, 1234, &eventRecorder)
+	require.Equal(t, "quic-go.net", headerFields[":authority"])
+	require.Equal(t, http.MethodConnect, headerFields[":method"])
+	require.Equal(t, "/", headerFields[":path"])
+	require.Equal(t, "https", headerFields[":scheme"])
+	require.Equal(t, "webtransport", headerFields[":protocol"])
+}
+
+func TestRequestWriterExtendedConnectInvalidProtocol(t *testing.T) {
+	// httptest.NewRequest does not properly support the CONNECT method
+	req, err := http.NewRequest(http.MethodConnect, "https://quic-go.net/", nil)
+	require.NoError(t, err)
+	req.Proto = "HTTP/3.0"
+	rw := newRequestWriter()
+	require.EqualError(t,
+		rw.WriteRequestHeader(&bytes.Buffer{}, req, false, 0, nil),
+		`invalid request :protocol "HTTP/3.0"`,
+	)
+}
+
+func TestRequestWriterTrailers(t *testing.T) {
+	req := httptest.NewRequest(http.MethodPost, "https://quic-go.net/upload", nil)
+	req.Trailer = http.Header{
+		"Trailer1":       []string{"foo"},
+		"Trailer2":       []string{"bar"},
+		"Content-Length": []string{"42"}, // Content-Length is not a valid trailer
+	}
+
+	rw := newRequestWriter()
+	buf := &bytes.Buffer{}
+	require.NoError(t, rw.WriteRequestHeader(buf, req, false, 42, nil))
+	headers := decodeHeader(t, buf)
+	require.Len(t, headers["trailer"], 1)
+	require.Contains(t, headers["trailer"][0], "Trailer1")
+	require.Contains(t, headers["trailer"][0], "Trailer2")
+	require.NotContains(t, headers["trailer"][0], "Content-Length")
+
+	require.NoError(t, rw.WriteRequestTrailer(buf, req, 42, nil))
+
+	trailers := decodeHeader(t, buf)
+	require.Equal(t, map[string][]string{
+		"trailer1": {"foo"},
+		"trailer2": {"bar"},
+	}, trailers)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/response_writer.go b/electron/native/private-transport/third_party/quic-go/http3/response_writer.go
new file mode 100644
index 000000000..63091b8f9
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/response_writer.go
@@ -0,0 +1,373 @@
+package http3
+
+import (
+	"bytes"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/textproto"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/quic-go/qpack"
+	"github.com/quic-go/quic-go/http3/qlog"
+
+	"golang.org/x/net/http/httpguts"
+)
+
+// HTTPStreamer allows an HTTP handler to take over an HTTP/3 stream.
+// It is implemented by the [http.ResponseWriter] passed to HTTP/3 handlers.
+// When a stream is taken over, it's the caller's responsibility to close the stream.
+type HTTPStreamer interface {
+	HTTPStream() *Stream
+}
+
+const maxSmallResponseSize = 4096
+
+type responseWriter struct {
+	str *Stream
+
+	conn     *rawConn
+	header   http.Header
+	trailers map[string]struct{}
+	buf      []byte
+	status   int // status code passed to WriteHeader
+
+	// for responses smaller than maxSmallResponseSize, we buffer calls to Write,
+	// and automatically add the Content-Length header
+	smallResponseBuf []byte
+
+	contentLen     int64 // if handler set valid Content-Length header
+	numWritten     int64 // bytes written
+	headerComplete bool  // set once WriteHeader is called with a status code >= 200
+	headerWritten  bool  // set once the response header has been serialized to the stream
+	isHead         bool
+	trailerWritten bool // set once the response trailers has been serialized to the stream
+
+	hijacked bool // set on HTTPStream is called
+
+	logger *slog.Logger
+}
+
+var (
+	_ http.ResponseWriter = &responseWriter{}
+	_ http.Flusher        = &responseWriter{}
+	_ Settingser          = &responseWriter{}
+	_ HTTPStreamer        = &responseWriter{}
+	// make sure that we implement (some of the) methods used by the http.ResponseController
+	_ interface {
+		SetReadDeadline(time.Time) error
+		SetWriteDeadline(time.Time) error
+		Flush()
+		FlushError() error
+	} = &responseWriter{}
+)
+
+func newResponseWriter(str *Stream, conn *rawConn, isHead bool, logger *slog.Logger) *responseWriter {
+	return &responseWriter{
+		str:    str,
+		conn:   conn,
+		header: http.Header{},
+		buf:    make([]byte, frameHeaderLen),
+		isHead: isHead,
+		logger: logger,
+	}
+}
+
+func (w *responseWriter) Header() http.Header {
+	return w.header
+}
+
+func (w *responseWriter) WriteHeader(status int) {
+	if w.headerComplete {
+		return
+	}
+
+	// http status must be 3 digits
+	if status < 100 || status > 999 {
+		panic(fmt.Sprintf("invalid WriteHeader code %v", status))
+	}
+	w.status = status
+
+	// immediately write 1xx headers
+	if status < 200 {
+		w.writeHeader(status)
+		return
+	}
+
+	// We're done with headers once we write a status >= 200.
+	w.headerComplete = true
+	// Add Date header.
+	// This is what the standard library does.
+	// Can be disabled by setting the Date header to nil.
+	if _, ok := w.header["Date"]; !ok {
+		w.header.Set("Date", time.Now().UTC().Format(http.TimeFormat))
+	}
+	// Content-Length checking
+	// use ParseUint instead of ParseInt, as negative values are invalid
+	if clen := w.header.Get("Content-Length"); clen != "" {
+		if cl, err := strconv.ParseUint(clen, 10, 63); err == nil {
+			w.contentLen = int64(cl)
+		} else {
+			// emit a warning for malformed Content-Length and remove it
+			logger := w.logger
+			if logger == nil {
+				logger = slog.Default()
+			}
+			logger.Error("Malformed Content-Length", "value", clen)
+			w.header.Del("Content-Length")
+		}
+	}
+}
+
+func (w *responseWriter) sniffContentType(p []byte) {
+	// If no content type, apply sniffing algorithm to body.
+	// We can't use `w.header.Get` here since if the Content-Type was set to nil, we shouldn't do sniffing.
+	_, haveType := w.header["Content-Type"]
+
+	// If the Content-Encoding was set and is non-blank, we shouldn't sniff the body.
+	hasCE := w.header.Get("Content-Encoding") != ""
+	if !hasCE && !haveType && len(p) > 0 {
+		w.header.Set("Content-Type", http.DetectContentType(p))
+	}
+}
+
+func (w *responseWriter) Write(p []byte) (int, error) {
+	bodyAllowed := bodyAllowedForStatus(w.status)
+	if !w.headerComplete {
+		w.sniffContentType(p)
+		w.WriteHeader(http.StatusOK)
+		bodyAllowed = true
+	}
+	if !bodyAllowed {
+		return 0, http.ErrBodyNotAllowed
+	}
+
+	w.numWritten += int64(len(p))
+	if w.contentLen != 0 && w.numWritten > w.contentLen {
+		return 0, http.ErrContentLength
+	}
+
+	if w.isHead {
+		return len(p), nil
+	}
+
+	if !w.headerWritten {
+		// Buffer small responses.
+		// This allows us to automatically set the Content-Length field.
+		if len(w.smallResponseBuf)+len(p) < maxSmallResponseSize {
+			w.smallResponseBuf = append(w.smallResponseBuf, p...)
+			return len(p), nil
+		}
+	}
+	return w.doWrite(p)
+}
+
+func (w *responseWriter) doWrite(p []byte) (int, error) {
+	if !w.headerWritten {
+		w.sniffContentType(w.smallResponseBuf)
+		if err := w.writeHeader(w.status); err != nil {
+			return 0, maybeReplaceError(err)
+		}
+		w.headerWritten = true
+	}
+
+	l := uint64(len(w.smallResponseBuf) + len(p))
+	if l == 0 {
+		return 0, nil
+	}
+	df := &dataFrame{Length: l}
+	w.buf = w.buf[:0]
+	w.buf = df.Append(w.buf)
+	if w.str.qlogger != nil {
+		w.str.qlogger.RecordEvent(qlog.FrameCreated{
+			StreamID: w.str.StreamID(),
+			Raw:      qlog.RawInfo{Length: len(w.buf) + int(l), PayloadLength: int(l)},
+			Frame:    qlog.Frame{Frame: qlog.DataFrame{}},
+		})
+	}
+	if _, err := w.str.writeUnframed(w.buf); err != nil {
+		return 0, maybeReplaceError(err)
+	}
+	if len(w.smallResponseBuf) > 0 {
+		if _, err := w.str.writeUnframed(w.smallResponseBuf); err != nil {
+			return 0, maybeReplaceError(err)
+		}
+		w.smallResponseBuf = nil
+	}
+	var n int
+	if len(p) > 0 {
+		var err error
+		n, err = w.str.writeUnframed(p)
+		if err != nil {
+			return n, maybeReplaceError(err)
+		}
+	}
+	return n, nil
+}
+
+func (w *responseWriter) writeHeader(status int) error {
+	var headerFields []qlog.HeaderField // only used for qlog
+	var headers bytes.Buffer
+	enc := qpack.NewEncoder(&headers)
+	if err := enc.WriteField(qpack.HeaderField{Name: ":status", Value: strconv.Itoa(status)}); err != nil {
+		return err
+	}
+	if w.str.qlogger != nil {
+		headerFields = append(headerFields, qlog.HeaderField{Name: ":status", Value: strconv.Itoa(status)})
+	}
+
+	// Handle trailer fields
+	if vals, ok := w.header["Trailer"]; ok {
+		for _, val := range vals {
+			for trailer := range strings.SplitSeq(val, ",") {
+				// We need to convert to the canonical header key value here because this will be called when using
+				// headers.Add or headers.Set.
+				trailer = textproto.CanonicalMIMEHeaderKey(strings.TrimSpace(trailer))
+				w.declareTrailer(trailer)
+			}
+		}
+	}
+
+	for k, v := range w.header {
+		if _, excluded := w.trailers[k]; excluded {
+			continue
+		}
+		// Ignore "Trailer:" prefixed headers
+		if strings.HasPrefix(k, http.TrailerPrefix) {
+			continue
+		}
+		for index := range v {
+			name := strings.ToLower(k)
+			value := v[index]
+			if err := enc.WriteField(qpack.HeaderField{Name: name, Value: value}); err != nil {
+				return err
+			}
+			if w.str.qlogger != nil {
+				headerFields = append(headerFields, qlog.HeaderField{Name: name, Value: value})
+			}
+		}
+	}
+
+	buf := make([]byte, 0, frameHeaderLen+headers.Len())
+	buf = (&headersFrame{Length: uint64(headers.Len())}).Append(buf)
+	buf = append(buf, headers.Bytes()...)
+
+	if w.str.qlogger != nil {
+		qlogCreatedHeadersFrame(w.str.qlogger, w.str.StreamID(), len(buf), headers.Len(), headerFields)
+	}
+
+	_, err := w.str.writeUnframed(buf)
+	return err
+}
+
+func (w *responseWriter) FlushError() error {
+	if !w.headerComplete {
+		w.WriteHeader(http.StatusOK)
+	}
+	_, err := w.doWrite(nil)
+	return err
+}
+
+func (w *responseWriter) flushTrailers() {
+	if w.trailerWritten {
+		return
+	}
+	if err := w.writeTrailers(); err != nil {
+		if w.logger != nil {
+			w.logger.Debug("could not write trailers", "error", err)
+		}
+	}
+}
+
+func (w *responseWriter) Flush() {
+	if err := w.FlushError(); err != nil {
+		if w.logger != nil {
+			w.logger.Debug("could not flush to stream", "error", err)
+		}
+	}
+}
+
+// declareTrailer adds a trailer to the trailer list, while also validating that the trailer has a
+// valid name.
+func (w *responseWriter) declareTrailer(k string) {
+	if !httpguts.ValidTrailerHeader(k) {
+		// Forbidden by RFC 9110, section 6.5.1.
+		if w.logger != nil {
+			w.logger.Debug("ignoring invalid trailer", slog.String("header", k))
+		}
+		return
+	}
+	if w.trailers == nil {
+		w.trailers = make(map[string]struct{})
+	}
+	w.trailers[k] = struct{}{}
+}
+
+// writeTrailers will write trailers to the stream if there are any.
+func (w *responseWriter) writeTrailers() error {
+	// promote headers added via "Trailer:" convention as trailers, these can be added after
+	// streaming the status/headers have been written.
+	for k := range w.header {
+		if strings.HasPrefix(k, http.TrailerPrefix) {
+			w.declareTrailer(k)
+		}
+	}
+
+	if len(w.trailers) == 0 {
+		return nil
+	}
+
+	trailers := make(http.Header, len(w.trailers))
+	for trailer := range w.trailers {
+		if vals, ok := w.header[trailer]; ok {
+			trailers[strings.TrimPrefix(trailer, http.TrailerPrefix)] = vals
+		}
+	}
+
+	written, err := writeTrailers(w.str.datagramStream, trailers, w.str.StreamID(), w.str.qlogger)
+	if written {
+		w.trailerWritten = true
+	}
+	return err
+}
+
+func (w *responseWriter) HTTPStream() *Stream {
+	w.hijacked = true
+	w.Flush()
+	return w.str
+}
+
+func (w *responseWriter) wasStreamHijacked() bool { return w.hijacked }
+
+func (w *responseWriter) ReceivedSettings() <-chan struct{} {
+	return w.conn.ReceivedSettings()
+}
+
+func (w *responseWriter) Settings() *Settings {
+	return w.conn.Settings()
+}
+
+func (w *responseWriter) SetReadDeadline(deadline time.Time) error {
+	return w.str.SetReadDeadline(deadline)
+}
+
+func (w *responseWriter) SetWriteDeadline(deadline time.Time) error {
+	return w.str.SetWriteDeadline(deadline)
+}
+
+// copied from http2/http2.go
+// bodyAllowedForStatus reports whether a given response status code
+// permits a body. See RFC 2616, section 4.4.
+func bodyAllowedForStatus(status int) bool {
+	switch {
+	case status >= 100 && status <= 199:
+		return false
+	case status == http.StatusNoContent:
+		return false
+	case status == http.StatusNotModified:
+		return false
+	}
+	return true
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/response_writer_test.go b/electron/native/private-transport/third_party/quic-go/http3/response_writer_test.go
new file mode 100644
index 000000000..253c78426
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/response_writer_test.go
@@ -0,0 +1,258 @@
+package http3
+
+import (
+	"bytes"
+	"io"
+	"log/slog"
+	"net/http"
+	"testing"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+type testResponseWriter struct {
+	*responseWriter
+	eventRecorder *events.Recorder
+	buf           *bytes.Buffer
+}
+
+func (rw *testResponseWriter) DecodeHeaders(t *testing.T, idx int) map[string][]string {
+	t.Helper()
+
+	rw.Flush()
+	rw.flushTrailers()
+	startLen := rw.buf.Len()
+	frame, err := (&frameParser{r: rw.buf}).ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &headersFrame{}, frame)
+	payloadLen := frame.(*headersFrame).Length
+	data := make([]byte, payloadLen)
+	headerFrameLen := startLen - rw.buf.Len() + len(data)
+	_, err = io.ReadFull(rw.buf, data)
+	require.NoError(t, err)
+	hfs := decodeQpackHeaderFields(t, data)
+
+	// check that the decoded header fields are properly logged
+	require.GreaterOrEqual(t, len(rw.eventRecorder.Events(qlog.FrameCreated{})), idx+1)
+	require.IsType(t, qlog.HeadersFrame{}, rw.eventRecorder.Events()[idx].(qlog.FrameCreated).Frame.Frame)
+	ev := rw.eventRecorder.Events()[idx].(qlog.FrameCreated)
+	assert.Equal(t, quic.StreamID(42), ev.StreamID)
+	assert.Equal(t, headerFrameLen, ev.Raw.Length, "raw.Length")
+	assert.Equal(t, int(payloadLen), ev.Raw.PayloadLength, "raw.PayloadLength")
+
+	fields := make(map[string][]string)
+	for _, p := range hfs {
+		fields[p.Name] = append(fields[p.Name], p.Value)
+		require.Contains(t,
+			ev.Frame.Frame.(qlog.HeadersFrame).HeaderFields,
+			qlog.HeaderField{Name: p.Name, Value: p.Value},
+		)
+	}
+
+	return fields
+}
+
+func (rw *testResponseWriter) DecodeBody(t *testing.T) []byte {
+	t.Helper()
+
+	frame, err := (&frameParser{r: rw.buf}).ParseNext(nil)
+	if err == io.EOF {
+		return nil
+	}
+	require.NoError(t, err)
+	require.IsType(t, &dataFrame{}, frame)
+	body := make([]byte, frame.(*dataFrame).Length)
+	_, err = io.ReadFull(rw.buf, body)
+	require.NoError(t, err)
+	return body
+}
+
+func newTestResponseWriter(t *testing.T) *testResponseWriter {
+	var eventRecorder events.Recorder
+	buf := &bytes.Buffer{}
+	mockCtrl := gomock.NewController(t)
+	str := NewMockDatagramStream(mockCtrl)
+	str.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	str.EXPECT().Write(gomock.Any()).DoAndReturn(buf.Write).AnyTimes()
+	str.EXPECT().SetReadDeadline(gomock.Any()).Return(nil).AnyTimes()
+	str.EXPECT().SetWriteDeadline(gomock.Any()).Return(nil).AnyTimes()
+	rw := newResponseWriter(
+		newStream(str, nil, nil, func(io.Reader, *headersFrame) error { return nil }, &eventRecorder),
+		nil,
+		false,
+		slog.Default(),
+	)
+	return &testResponseWriter{
+		responseWriter: rw,
+		eventRecorder:  &eventRecorder,
+		buf:            buf,
+	}
+}
+
+func TestResponseWriterInvalidStatus(t *testing.T) {
+	rw := newTestResponseWriter(t)
+	require.Panics(t, func() { rw.WriteHeader(99) })
+	require.Panics(t, func() { rw.WriteHeader(1000) })
+}
+
+func TestResponseWriterHeader(t *testing.T) {
+	rw := newTestResponseWriter(t)
+	rw.Header().Add("Content-Length", "42")
+	rw.Header().Set("Priority", "u=0")
+	rw.WriteHeader(http.StatusTeapot) // 418
+	// repeated WriteHeader calls are ignored
+	rw.WriteHeader(http.StatusInternalServerError)
+
+	// set cookies
+	http.SetCookie(rw, &http.Cookie{Name: "foo", Value: "bar"})
+	http.SetCookie(rw, &http.Cookie{Name: "baz", Value: "lorem ipsum"})
+	// write some data
+	rw.Write([]byte("foobar"))
+
+	fields := rw.DecodeHeaders(t, 0)
+	require.Equal(t, []string{"418"}, fields[":status"])
+	require.Equal(t, []string{"42"}, fields["content-length"])
+	require.Equal(t, []string{"u=0"}, fields["priority"])
+	require.Equal(t,
+		[]string{"foo=bar", `baz="lorem ipsum"`},
+		fields["set-cookie"],
+	)
+	require.Equal(t, []byte("foobar"), rw.DecodeBody(t))
+}
+
+func TestResponseWriterDataWithoutHeader(t *testing.T) {
+	rw := newTestResponseWriter(t)
+	rw.Write([]byte("foobar"))
+
+	fields := rw.DecodeHeaders(t, 0)
+	require.Equal(t, []string{"200"}, fields[":status"])
+	require.Equal(t, []byte("foobar"), rw.DecodeBody(t))
+}
+
+func TestResponseWriterDataStatusWithoutBody(t *testing.T) {
+	rw := newTestResponseWriter(t)
+	rw.WriteHeader(http.StatusNotModified)
+	n, err := rw.Write([]byte("foobar"))
+	require.Zero(t, n)
+	require.ErrorIs(t, err, http.ErrBodyNotAllowed)
+
+	fields := rw.DecodeHeaders(t, 0)
+	require.Equal(t, []string{"304"}, fields[":status"])
+	require.Empty(t, rw.DecodeBody(t))
+}
+
+func TestResponseWriterContentLength(t *testing.T) {
+	rw := newTestResponseWriter(t)
+	rw.Header().Set("Content-Length", "6")
+	n, err := rw.Write([]byte("foobar"))
+	require.Equal(t, 6, n)
+	require.NoError(t, err)
+
+	n, err = rw.Write([]byte{0x42})
+	require.Zero(t, n)
+	require.ErrorIs(t, err, http.ErrContentLength)
+
+	fields := rw.DecodeHeaders(t, 0)
+	require.Equal(t, []string{"200"}, fields[":status"])
+	require.Equal(t, []string{"6"}, fields["content-length"])
+	require.Equal(t, []byte("foobar"), rw.DecodeBody(t))
+}
+
+func TestResponseWriterContentTypeSniffing(t *testing.T) {
+	t.Run("no content type", func(t *testing.T) {
+		testContentTypeSniffing(t, map[string]string{}, "text/html; charset=utf-8")
+	})
+
+	t.Run("explicit content type", func(t *testing.T) {
+		testContentTypeSniffing(t, map[string]string{"Content-Type": "text/plain"}, "text/plain")
+	})
+
+	t.Run("with content encoding", func(t *testing.T) {
+		testContentTypeSniffing(t, map[string]string{"Content-Encoding": "gzip"}, "")
+	})
+}
+
+func testContentTypeSniffing(t *testing.T, hdrs map[string]string, expectedContentType string) {
+	rw := newTestResponseWriter(t)
+	for k, v := range hdrs {
+		rw.Header().Set(k, v)
+	}
+	rw.Write([]byte("<html></html>"))
+
+	fields := rw.DecodeHeaders(t, 0)
+	require.Equal(t, []string{"200"}, fields[":status"])
+	if expectedContentType == "" {
+		require.NotContains(t, fields, "content-type")
+	} else {
+		require.Equal(t, []string{expectedContentType}, fields["content-type"])
+	}
+}
+
+func TestResponseWriterEarlyHints(t *testing.T) {
+	rw := newTestResponseWriter(t)
+	rw.Header().Add("Link", "</style.css>; rel=preload; as=style")
+	rw.Header().Add("Link", "</script.js>; rel=preload; as=script")
+	rw.WriteHeader(http.StatusEarlyHints) // status 103
+
+	n, err := rw.Write([]byte("foobar"))
+	require.Equal(t, 6, n)
+	require.NoError(t, err)
+
+	// Early Hints must have been received
+	fields := rw.DecodeHeaders(t, 0)
+	require.Equal(t, 2, len(fields))
+	require.Equal(t, []string{"103"}, fields[":status"])
+	require.Equal(t,
+		[]string{"</style.css>; rel=preload; as=style", "</script.js>; rel=preload; as=script"},
+		fields["link"],
+	)
+
+	// headers sent in the informational response must also be included in the final response
+	fields = rw.DecodeHeaders(t, 1)
+	require.Equal(t, 4, len(fields))
+	require.Equal(t, []string{"200"}, fields[":status"])
+	require.Contains(t, fields, "date")
+	require.Contains(t, fields, "content-type")
+	require.Equal(t,
+		[]string{"</style.css>; rel=preload; as=style", "</script.js>; rel=preload; as=script"},
+		fields["link"],
+	)
+
+	require.Equal(t, []byte("foobar"), rw.DecodeBody(t))
+}
+
+func TestResponseWriterTrailers(t *testing.T) {
+	rw := newTestResponseWriter(t)
+
+	rw.Header().Add("Trailer", "key, Content-Length") // Content-Length is not a valid trailer
+	n, err := rw.Write([]byte("foobar"))
+	require.Equal(t, 6, n)
+	require.NoError(t, err)
+
+	// writeTrailers needs to be called after writing the full body
+	headers := rw.DecodeHeaders(t, 0)
+	require.Equal(t, []string{"key, Content-Length"}, headers["trailer"])
+	require.NotContains(t, headers, "foo")
+	require.Equal(t, []byte("foobar"), rw.DecodeBody(t))
+
+	// headers set after writing the body are trailers
+	rw.Header().Set("key", "value")                      // announced trailer
+	rw.Header().Set("foo", "bar")                        // this trailer was not announced, and will therefore be ignored
+	rw.Header().Set(http.TrailerPrefix+"lorem", "ipsum") // unannounced trailer with trailer prefix
+	rw.Header().Set("Content-Length", "999")             // invalid trailer, will be ignored
+	require.NoError(t, rw.writeTrailers())
+
+	trailers := rw.DecodeHeaders(t, 2)
+	require.Equal(t, []string{"value"}, trailers["key"])
+	require.Equal(t, []string{"ipsum"}, trailers["lorem"])
+	// trailers without the trailer prefix that were not announced are ignored
+	require.NotContains(t, trailers, "foo")
+	// invalid trailers are ignored
+	require.NotContains(t, trailers, "content-length")
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/server.go b/electron/native/private-transport/third_party/quic-go/http3/server.go
new file mode 100644
index 000000000..6dce97fbc
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/server.go
@@ -0,0 +1,780 @@
+package http3
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+// NextProtoH3 is the ALPN protocol negotiated during the TLS handshake, for QUIC v1 and v2.
+const NextProtoH3 = "h3"
+
+// StreamType is the stream type of a unidirectional stream.
+type StreamType uint64
+
+const (
+	streamTypeControlStream      = 0
+	streamTypePushStream         = 1
+	streamTypeQPACKEncoderStream = 2
+	streamTypeQPACKDecoderStream = 3
+)
+
+// A QUICListener listens for incoming QUIC connections.
+type QUICListener interface {
+	Accept(context.Context) (*quic.Conn, error)
+	Addr() net.Addr
+	io.Closer
+}
+
+var _ QUICListener = &quic.EarlyListener{}
+
+// ConfigureTLSConfig creates a new [tls.Config] which can be used
+// to create a [quic.Listener] meant for serving HTTP/3.
+func ConfigureTLSConfig(tlsConf *tls.Config) *tls.Config {
+	return configureTLSConfig(tlsConf, nil)
+}
+
+func configureTLSConfig(tlsConf *tls.Config, configure func(*tls.Config)) *tls.Config {
+	// Workaround for https://github.com/golang/go/issues/60506.
+	// This initializes the session tickets _before_ cloning the config.
+	_, _ = tlsConf.DecryptTicket(nil, tls.ConnectionState{})
+	config := tlsConf.Clone()
+	config.NextProtos = []string{NextProtoH3}
+	if configure != nil {
+		configure(config)
+	}
+	if gfc := config.GetConfigForClient; gfc != nil {
+		config.GetConfigForClient = func(ch *tls.ClientHelloInfo) (*tls.Config, error) {
+			conf, err := gfc(ch)
+			if conf == nil || err != nil {
+				return conf, err
+			}
+			return configureTLSConfig(conf, configure), nil
+		}
+	}
+	return config
+}
+
+func (s *Server) configureTLSConfig(tlsConf *tls.Config) *tls.Config {
+	settings := s.settings()
+	settingsExtra := settingsForSessionTicket(settings)
+	return configureTLSConfig(tlsConf, func(config *tls.Config) {
+		wrapSession := config.WrapSession
+		if wrapSession == nil {
+			wrapSession = config.EncryptTicket
+		}
+		config.WrapSession = func(cs tls.ConnectionState, ss *tls.SessionState) ([]byte, error) {
+			ss.Extra = append(ss.Extra, bytes.Clone(settingsExtra))
+			return wrapSession(cs, ss)
+		}
+		unwrapSession := config.UnwrapSession
+		if unwrapSession == nil {
+			unwrapSession = config.DecryptTicket
+		}
+		config.UnwrapSession = func(identity []byte, cs tls.ConnectionState) (*tls.SessionState, error) {
+			ss, err := unwrapSession(identity, cs)
+			if err != nil || ss == nil || !ss.EarlyData {
+				return ss, err
+			}
+			settingsData, ok := settingsDataFromSessionTicket(ss.Extra)
+			if !ok || !settingsCompatibleFor0RTT(settingsData, settings) {
+				ss.EarlyData = false
+			}
+			return ss, nil
+		}
+	})
+}
+
+// contextKey is a value for use with context.WithValue. It's used as
+// a pointer so it fits in an interface{} without allocation.
+type contextKey struct {
+	name string
+}
+
+func (k *contextKey) String() string { return "quic-go/http3 context value " + k.name }
+
+// ServerContextKey is a context key. It can be used in HTTP
+// handlers with [context.Context.Value] to access the server that
+// started the handler. The associated value will be of
+// type [*Server].
+var ServerContextKey = &contextKey{"http3-server"}
+
+// RemoteAddrContextKey is a context key. It can be used in
+// HTTP handlers with [context.Context.Value] to access the remote
+// address of the connection. The associated value will be of
+// type [net.Addr].
+//
+// Use this value instead of [http.Request.RemoteAddr] if you
+// require access to the remote address of the connection rather
+// than its string representation.
+var RemoteAddrContextKey = &contextKey{"remote-addr"}
+
+// listener contains info about specific listener added with addListener
+type listener struct {
+	ln   *QUICListener
+	port int // 0 means that no info about port is available
+
+	// if this listener was constructed by the application, it won't be closed when the server is closed
+	createdLocally bool
+}
+
+// Server is a HTTP/3 server.
+type Server struct {
+	// Addr optionally specifies the UDP address for the server to listen on,
+	// in the form "host:port".
+	//
+	// When used by [Server.ListenAndServe] and [Server.ListenAndServeTLS], if empty,
+	// ":https" (port 443) is used. See [net.Dial] for details of the address
+	// format.
+	//
+	// Otherwise, if Port is not set and underlying QUIC listeners do not
+	// have valid port numbers, the port part is used in Alt-Svc headers set
+	// with [Server.SetQUICHeaders].
+	Addr string
+
+	// Port is used in Alt-Svc response headers set with [Server.SetQUICHeaders]. If
+	// needed Port can be manually set when the Server is created.
+	//
+	// This is useful when a Layer 4 firewall is redirecting UDP traffic and
+	// clients must use a port different from the port the Server is
+	// listening on.
+	Port int
+
+	// TLSConfig provides a TLS configuration for use by server. It must be
+	// set for [Server.ListenAndServe] and [Server.Serve].
+	TLSConfig *tls.Config
+
+	// QUICConfig provides the parameters for QUIC connections created with [Server.Serve].
+	// If nil, it uses reasonable default values.
+	QUICConfig *quic.Config
+
+	// Handler is the HTTP request handler. If nil, [http.DefaultServeMux] is used.
+	Handler http.Handler
+
+	// EnableDatagrams enables support for HTTP/3 datagrams (RFC 9297).
+	// For connections created by the server, this also enables [quic.Config.EnableDatagrams].
+	EnableDatagrams bool
+
+	// MaxHeaderBytes controls the maximum number of bytes the server will
+	// read parsing the request HEADERS frame. It does not limit the size of
+	// the request body. If zero or negative, [http.DefaultMaxHeaderBytes] is
+	// used.
+	MaxHeaderBytes int
+
+	// AdditionalSettings specifies additional HTTP/3 settings.
+	// It is invalid to specify any settings defined by RFC 9114 (HTTP/3) and RFC 9297 (HTTP Datagrams).
+	AdditionalSettings map[uint64]uint64
+
+	// IdleTimeout specifies how long until idle clients connection should be
+	// closed. Idle refers only to the HTTP/3 layer, activity at the QUIC layer
+	// like PING frames are not considered.
+	// If zero or negative, there is no timeout.
+	IdleTimeout time.Duration
+
+	// ConnContext optionally specifies a function that modifies the context used for a new connection c.
+	// The provided ctx has a ServerContextKey value.
+	ConnContext func(ctx context.Context, c *quic.Conn) context.Context
+
+	Logger *slog.Logger
+
+	mutex     sync.RWMutex
+	listeners []listener
+
+	closed           bool
+	closeCtx         context.Context    // canceled when the server is closed
+	closeCancel      context.CancelFunc // cancels the closeCtx
+	graceCtx         context.Context    // canceled when the server is closed or gracefully closed
+	graceCancel      context.CancelFunc // cancels the graceCtx
+	connCount        atomic.Int64
+	connHandlingDone chan struct{}
+
+	altSvcHeader string
+}
+
+// ListenAndServe listens on the UDP address [Server.Addr] and calls [Server.Handler]
+// to handle HTTP/3 requests on incoming connections.
+//
+// If [Server.Addr] is blank, ":https" is used.
+func (s *Server) ListenAndServe() error {
+	ln, err := s.setupListenerForConn(s.TLSConfig, nil)
+	if err != nil {
+		return err
+	}
+	defer s.removeListener(ln)
+
+	return s.serveListener(*ln)
+}
+
+// ListenAndServeTLS listens on the UDP address [Server.Addr] and calls [Server.Handler]
+// to handle HTTP/3 requests on incoming connections.
+//
+// If [Server.Addr] is blank, ":https" is used.
+func (s *Server) ListenAndServeTLS(certFile, keyFile string) error {
+	var err error
+	certs := make([]tls.Certificate, 1)
+	certs[0], err = tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		return err
+	}
+	// We currently only use the cert-related stuff from tls.Config,
+	// so we don't need to make a full copy.
+	ln, err := s.setupListenerForConn(&tls.Config{Certificates: certs}, nil)
+	if err != nil {
+		return err
+	}
+	defer s.removeListener(ln)
+
+	return s.serveListener(*ln)
+}
+
+// Serve an existing UDP connection.
+// It is possible to reuse the same connection for outgoing connections.
+// Closing the server does not close the connection.
+func (s *Server) Serve(conn net.PacketConn) error {
+	ln, err := s.setupListenerForConn(s.TLSConfig, conn)
+	if err != nil {
+		return err
+	}
+	defer s.removeListener(ln)
+
+	return s.serveListener(*ln)
+}
+
+// init initializes the contexts used for shutting down the server.
+// It must be called with the mutex held.
+func (s *Server) init() {
+	if s.closeCtx == nil {
+		s.closeCtx, s.closeCancel = context.WithCancel(context.Background())
+		s.graceCtx, s.graceCancel = context.WithCancel(s.closeCtx)
+	}
+	s.connHandlingDone = make(chan struct{}, 1)
+}
+
+func (s *Server) decreaseConnCount() {
+	if s.connCount.Add(-1) == 0 && s.graceCtx.Err() != nil {
+		close(s.connHandlingDone)
+	}
+}
+
+// ServeQUICConn serves a single QUIC connection.
+func (s *Server) ServeQUICConn(conn *quic.Conn) error {
+	s.mutex.Lock()
+	if s.closed {
+		s.mutex.Unlock()
+		return http.ErrServerClosed
+	}
+
+	s.init()
+	s.mutex.Unlock()
+
+	s.connCount.Add(1)
+	defer s.decreaseConnCount()
+
+	return s.handleConn(conn)
+}
+
+// ServeListener serves an existing QUIC listener.
+// Use [ConfigureTLSConfig] to configure a [tls.Config] for the QUIC listener.
+// Closing the server does not close the listener; closing the listener is the application's responsibility.
+// ServeListener always returns a non-nil error. After [Server.Shutdown] or [Server.Close],
+// it returns [http.ErrServerClosed].
+func (s *Server) ServeListener(ln QUICListener) error {
+	s.mutex.Lock()
+	if err := s.addListener(&ln, false); err != nil {
+		s.mutex.Unlock()
+		return err
+	}
+	s.mutex.Unlock()
+	defer s.removeListener(&ln)
+
+	return s.serveListener(ln)
+}
+
+func (s *Server) serveListener(ln QUICListener) error {
+	for {
+		conn, err := ln.Accept(s.graceCtx)
+		// server closed
+		if errors.Is(err, quic.ErrServerClosed) || s.graceCtx.Err() != nil {
+			return http.ErrServerClosed
+		}
+		if err != nil {
+			return err
+		}
+		s.connCount.Add(1)
+		go func() {
+			defer s.decreaseConnCount()
+			if err := s.handleConn(conn); err != nil {
+				if s.Logger != nil {
+					s.Logger.Debug("handling connection failed", "error", err)
+				}
+			}
+		}()
+	}
+}
+
+var errServerWithoutTLSConfig = errors.New("use of http3.Server without TLSConfig")
+
+func (s *Server) setupListenerForConn(tlsConf *tls.Config, conn net.PacketConn) (*QUICListener, error) {
+	if tlsConf == nil {
+		return nil, errServerWithoutTLSConfig
+	}
+
+	baseConf := s.configureTLSConfig(tlsConf)
+	quicConf := s.QUICConfig
+	if quicConf == nil {
+		quicConf = &quic.Config{Allow0RTT: true}
+	} else {
+		quicConf = s.QUICConfig.Clone()
+	}
+	if s.EnableDatagrams {
+		quicConf.EnableDatagrams = true
+	}
+
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	closed := s.closed
+	if closed {
+		return nil, http.ErrServerClosed
+	}
+
+	var ln QUICListener
+	var err error
+	if conn == nil {
+		addr := s.Addr
+		if addr == "" {
+			addr = ":https"
+		}
+		ln, err = quic.ListenAddrEarly(addr, baseConf, quicConf)
+	} else {
+		ln, err = quic.ListenEarly(conn, baseConf, quicConf)
+	}
+	if err != nil {
+		return nil, err
+	}
+	if err := s.addListener(&ln, true); err != nil {
+		return nil, err
+	}
+	return &ln, nil
+}
+
+func extractPort(addr string) (int, error) {
+	_, portStr, err := net.SplitHostPort(addr)
+	if err != nil {
+		return 0, err
+	}
+
+	portInt, err := net.LookupPort("tcp", portStr)
+	if err != nil {
+		return 0, err
+	}
+	return portInt, nil
+}
+
+func (s *Server) generateAltSvcHeader() {
+	if len(s.listeners) == 0 {
+		// Don't announce any ports since no one is listening for connections
+		s.altSvcHeader = ""
+		return
+	}
+
+	// This code assumes that we will use protocol.SupportedVersions if no quic.Config is passed.
+
+	var altSvc []string
+	addPort := func(port int) {
+		altSvc = append(altSvc, fmt.Sprintf(`%s=":%d"; ma=2592000`, NextProtoH3, port))
+	}
+
+	if s.Port != 0 {
+		// if Port is specified, we must use it instead of the
+		// listener addresses since there's a reason it's specified.
+		addPort(s.Port)
+	} else {
+		// if we have some listeners assigned, try to find ports
+		// which we can announce, otherwise nothing should be announced
+		validPortsFound := false
+		for _, info := range s.listeners {
+			if info.port != 0 {
+				addPort(info.port)
+				validPortsFound = true
+			}
+		}
+		if !validPortsFound {
+			if port, err := extractPort(s.Addr); err == nil {
+				addPort(port)
+			}
+		}
+	}
+
+	s.altSvcHeader = strings.Join(altSvc, ",")
+}
+
+func (s *Server) addListener(l *QUICListener, createdLocally bool) error {
+	if s.closed {
+		return http.ErrServerClosed
+	}
+	s.init()
+
+	laddr := (*l).Addr()
+	if port, err := extractPort(laddr.String()); err == nil {
+		s.listeners = append(s.listeners, listener{ln: l, port: port, createdLocally: createdLocally})
+	} else {
+		logger := s.Logger
+		if logger == nil {
+			logger = slog.Default()
+		}
+		logger.Error("Unable to extract port from listener, will not be announced using SetQUICHeaders", "local addr", laddr, "error", err)
+		s.listeners = append(s.listeners, listener{ln: l, port: 0, createdLocally: createdLocally})
+	}
+	s.generateAltSvcHeader()
+	return nil
+}
+
+func (s *Server) removeListener(l *QUICListener) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	s.listeners = slices.DeleteFunc(s.listeners, func(info listener) bool {
+		return info.ln == l
+	})
+	s.generateAltSvcHeader()
+}
+
+func (s *Server) NewRawServerConn(conn *quic.Conn) (*RawServerConn, error) {
+	hconn, _, _, err := s.newRawServerConn(conn)
+	if err != nil {
+		return nil, err
+	}
+	return hconn, nil
+}
+
+func (s *Server) newRawServerConn(conn *quic.Conn) (*RawServerConn, *quic.SendStream, qlogwriter.Recorder, error) {
+	var qlogger qlogwriter.Recorder
+	if qlogTrace := conn.QlogTrace(); qlogTrace != nil && qlogTrace.SupportsSchemas(qlog.EventSchema) {
+		qlogger = qlogTrace.AddProducer()
+	}
+	connCtx := conn.Context()
+	connCtx = context.WithValue(connCtx, ServerContextKey, s)
+	connCtx = context.WithValue(connCtx, http.LocalAddrContextKey, conn.LocalAddr())
+	connCtx = context.WithValue(connCtx, RemoteAddrContextKey, conn.RemoteAddr())
+	if s.ConnContext != nil {
+		connCtx = s.ConnContext(connCtx, conn)
+		if connCtx == nil {
+			panic("http3: ConnContext returned nil")
+		}
+	}
+	hconn := newRawServerConn(
+		conn,
+		s.EnableDatagrams,
+		s.IdleTimeout,
+		qlogger,
+		s.Logger,
+		connCtx,
+		s.Handler,
+		s.maxHeaderBytes(),
+	)
+
+	// open the control stream and send a SETTINGS frame, it's also used to send a GOAWAY frame later
+	// when the server is gracefully closed
+	ctrlStr, err := hconn.openControlStream(s.settings())
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("opening the control stream failed: %w", err)
+	}
+	return hconn, ctrlStr, qlogger, nil
+}
+
+func (s *Server) settings() *settings {
+	return &settings{
+		MaxFieldSectionSize: int64(s.maxHeaderBytes()),
+		Datagram:            s.EnableDatagrams,
+		ExtendedConnect:     true,
+		Other:               s.AdditionalSettings,
+	}
+}
+
+// handleConn handles the HTTP/3 exchange on a QUIC connection.
+// It blocks until all HTTP handlers for all streams have returned.
+func (s *Server) handleConn(conn *quic.Conn) error {
+	hconn, ctrlStr, qlogger, err := s.newRawServerConn(conn)
+	if err != nil {
+		return err
+	}
+
+	var wg sync.WaitGroup
+	wg.Go(func() {
+		for {
+			str, err := conn.AcceptUniStream(context.Background())
+			if err != nil {
+				return
+			}
+			go hconn.HandleUnidirectionalStream(str)
+		}
+	})
+
+	var nextStreamID quic.StreamID
+	var handleErr error
+	var inGracefulShutdown bool
+	// Process all requests immediately.
+	// It's the client's responsibility to decide which requests are eligible for 0-RTT.
+	ctx := s.graceCtx
+	for {
+		// The context used here is:
+		// * before graceful shutdown: s.graceCtx
+		// * after graceful shutdown: s.closeCtx
+		// This allows us to keep accepting (and resetting) streams after graceful shutdown has started.
+		str, err := conn.AcceptStream(ctx)
+		if err != nil {
+			// the underlying connection was closed (by either side)
+			if conn.Context().Err() != nil {
+				appErr, ok := errors.AsType[*quic.ApplicationError](err)
+				if !ok || appErr.ErrorCode != quic.ApplicationErrorCode(ErrCodeNoError) {
+					handleErr = fmt.Errorf("accepting stream failed: %w", err)
+				}
+				break
+			}
+			// server (not gracefully) closed, close the connection immediately
+			if s.closeCtx.Err() != nil {
+				hconn.CloseWithError(quic.ApplicationErrorCode(ErrCodeNoError), "")
+				handleErr = http.ErrServerClosed
+				break
+			}
+			inGracefulShutdown = s.graceCtx.Err() != nil
+			if !inGracefulShutdown {
+				appErr, ok := errors.AsType[*quic.ApplicationError](err)
+				if !ok || appErr.ErrorCode != quic.ApplicationErrorCode(ErrCodeNoError) {
+					handleErr = fmt.Errorf("accepting stream failed: %w", err)
+				}
+				break
+			}
+
+			// gracefully closed, send GOAWAY frame and wait for requests to complete or grace period to end
+			// new requests will be rejected and shouldn't be sent
+			if qlogger != nil {
+				qlogger.RecordEvent(qlog.FrameCreated{
+					StreamID: ctrlStr.StreamID(),
+					Frame:    qlog.Frame{Frame: qlog.GoAwayFrame{StreamID: nextStreamID}},
+				})
+			}
+			// Send the GOAWAY frame in a separate Goroutine.
+			// Sending might block if the peer didn't grant enough flow control credit.
+			// Write is guaranteed to return once the connection is closed.
+			wg.Go(func() {
+				_, _ = ctrlStr.Write((&goAwayFrame{StreamID: nextStreamID}).Append(nil))
+			})
+			ctx = s.closeCtx
+			continue
+		}
+		if inGracefulShutdown {
+			str.CancelRead(quic.StreamErrorCode(ErrCodeRequestRejected))
+			str.CancelWrite(quic.StreamErrorCode(ErrCodeRequestRejected))
+			continue
+		}
+
+		nextStreamID = str.StreamID() + 4
+		wg.Go(func() {
+			// HandleRequestStream will return once the request has been handled,
+			// or the underlying connection is closed.
+			hconn.HandleRequestStream(str)
+		})
+	}
+	wg.Wait()
+	return handleErr
+}
+
+func (s *Server) maxHeaderBytes() int {
+	if s.MaxHeaderBytes <= 0 {
+		return http.DefaultMaxHeaderBytes
+	}
+	return s.MaxHeaderBytes
+}
+
+// Close closes the server immediately, aborting requests and sending CONNECTION_CLOSE frames to connected clients.
+// Calling Close concurrently with [Server.ListenAndServe] may race with UDP socket creation;
+// use [Server.Serve] to avoid this.
+// It is the caller's responsibility to close any connection passed to [Server.ServeQUICConn].
+func (s *Server) Close() error {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	s.closed = true
+	// server is never used
+	if s.closeCtx == nil {
+		return nil
+	}
+	s.closeCancel()
+
+	var err error
+	for _, l := range s.listeners {
+		if l.createdLocally {
+			if cerr := (*l.ln).Close(); cerr != nil && err == nil {
+				err = cerr
+			}
+		}
+	}
+	if s.connCount.Load() == 0 {
+		return err
+	}
+	// wait for all connections to be closed
+	<-s.connHandlingDone
+	return err
+}
+
+// Shutdown gracefully shuts down the server without interrupting any active connections.
+// The server sends a GOAWAY frame first, then waits for all running requests to complete.
+// Calling Shutdown concurrently with [Server.ListenAndServe] may race with UDP socket creation;
+// use [Server.Serve] to avoid this.
+func (s *Server) Shutdown(ctx context.Context) error {
+	s.mutex.Lock()
+	s.closed = true
+	// server was never used
+	if s.closeCtx == nil {
+		s.mutex.Unlock()
+		return nil
+	}
+	s.graceCancel()
+
+	// close all listeners
+	var closeErrs []error
+	for _, l := range s.listeners {
+		if l.createdLocally {
+			if err := (*l.ln).Close(); err != nil {
+				closeErrs = append(closeErrs, err)
+			}
+		}
+	}
+	s.mutex.Unlock()
+	if len(closeErrs) > 0 {
+		return errors.Join(closeErrs...)
+	}
+
+	if s.connCount.Load() == 0 {
+		return s.Close()
+	}
+	select {
+	case <-s.connHandlingDone: // all connections were closed
+		// When receiving a GOAWAY frame, HTTP/3 clients are expected to close the connection
+		// once all requests were successfully handled...
+		return s.Close()
+	case <-ctx.Done():
+		// ... however, clients handling long-lived requests (and misbehaving clients),
+		// might not do so before the context is cancelled.
+		// In this case, we close the server, which closes all existing connections
+		// (expect those passed to ServeQUICConn).
+		_ = s.Close()
+		return ctx.Err()
+	}
+}
+
+// ErrNoAltSvcPort is returned by [Server.SetQUICHeaders] when no port was found
+// for Alt-Svc to announce. This can happen if listening on a [net.PacketConn] without a port
+// (UNIX socket, for example) and no port is specified in [Server.Port] or [Server.Addr].
+var ErrNoAltSvcPort = errors.New("no port can be announced, specify it explicitly using Server.Port or Server.Addr")
+
+// SetQUICHeaders can be used to set the proper headers that announce that this server supports HTTP/3.
+// The values set by default advertise all the ports the server is listening on, but can be
+// changed to a specific port by setting [Server.Port] before launching the server.
+// If none of the server's listeners report a valid port through [QUICListener.Addr],
+// [Server.Addr] is used to extract the port, if specified.
+// For example, a server launched using [Server.ListenAndServe] on an address with port 443 would set:
+//
+//	Alt-Svc: h3=":443"; ma=2592000
+func (s *Server) SetQUICHeaders(hdr http.Header) error {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	if s.altSvcHeader == "" {
+		return ErrNoAltSvcPort
+	}
+	// use the map directly to avoid constant canonicalization since the key is already canonicalized
+	hdr["Alt-Svc"] = append(hdr["Alt-Svc"], s.altSvcHeader)
+	return nil
+}
+
+// ListenAndServeQUIC listens on the UDP network address addr and calls the
+// handler for HTTP/3 requests on incoming connections. [http.DefaultServeMux] is
+// used when handler is nil.
+func ListenAndServeQUIC(addr, certFile, keyFile string, handler http.Handler) error {
+	server := &Server{
+		Addr:    addr,
+		Handler: handler,
+	}
+	return server.ListenAndServeTLS(certFile, keyFile)
+}
+
+// ListenAndServeTLS listens on the given network address for both TLS/TCP and QUIC
+// connections in parallel. It returns if one of the two returns an error.
+// [http.DefaultServeMux] is used when handler is nil.
+// The correct Alt-Svc headers for QUIC are set.
+func ListenAndServeTLS(addr, certFile, keyFile string, handler http.Handler) error {
+	// Load certs
+	var err error
+	certs := make([]tls.Certificate, 1)
+	certs[0], err = tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		return err
+	}
+	// We currently only use the cert-related stuff from tls.Config,
+	// so we don't need to make a full copy.
+	config := &tls.Config{
+		Certificates: certs,
+	}
+
+	if addr == "" {
+		addr = ":https"
+	}
+
+	// Open the listeners
+	udpAddr, err := net.ResolveUDPAddr("udp", addr)
+	if err != nil {
+		return err
+	}
+	udpConn, err := net.ListenUDP("udp", udpAddr)
+	if err != nil {
+		return err
+	}
+	defer udpConn.Close()
+
+	if handler == nil {
+		handler = http.DefaultServeMux
+	}
+	// Start the servers
+	quicServer := &Server{
+		TLSConfig: config,
+		Handler:   handler,
+	}
+
+	hErr := make(chan error, 1)
+	qErr := make(chan error, 1)
+	go func() {
+		hErr <- http.ListenAndServeTLS(addr, certFile, keyFile, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			quicServer.SetQUICHeaders(w.Header())
+			handler.ServeHTTP(w, r)
+		}))
+	}()
+	go func() {
+		qErr <- quicServer.Serve(udpConn)
+	}()
+
+	select {
+	case err := <-hErr:
+		quicServer.Close()
+		return err
+	case err := <-qErr:
+		// Cannot close the HTTP server or wait for requests to complete properly :/
+		return err
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/server_conn.go b/electron/native/private-transport/third_party/quic-go/http3/server_conn.go
new file mode 100644
index 000000000..2bb8566b6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/server_conn.go
@@ -0,0 +1,316 @@
+package http3
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/qpack"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+// RawServerConn is an HTTP/3 server connection.
+// It can be used for advanced use cases where the application wants to manage the QUIC connection lifecycle.
+type RawServerConn struct {
+	rawConn rawConn
+
+	idleTimeout time.Duration
+	idleTimer   *time.Timer
+
+	serverContext  context.Context
+	requestHandler http.Handler
+	maxHeaderBytes int
+
+	decoder       *qpack.Decoder
+	priorityAware atomic.Bool // whether the client sent an RFC 9218 priority signal
+
+	qlogger qlogwriter.Recorder
+	logger  *slog.Logger
+}
+
+func newRawServerConn(
+	conn *quic.Conn,
+	enableDatagrams bool,
+	idleTimeout time.Duration,
+	qlogger qlogwriter.Recorder,
+	logger *slog.Logger,
+	serverContext context.Context,
+	requestHandler http.Handler,
+	maxHeaderBytes int,
+) *RawServerConn {
+	c := &RawServerConn{
+		idleTimeout:    idleTimeout,
+		serverContext:  serverContext,
+		requestHandler: requestHandler,
+		maxHeaderBytes: maxHeaderBytes,
+		decoder:        qpack.NewDecoder(),
+		qlogger:        qlogger,
+		logger:         logger,
+	}
+	c.rawConn = *newRawConn(conn, enableDatagrams, c.onStreamsEmpty, c.handleControlStream, qlogger, logger)
+	if idleTimeout > 0 {
+		c.idleTimer = time.AfterFunc(idleTimeout, func() {
+			conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeNoError), "idle timeout")
+		})
+	}
+	return c
+}
+
+func (c *RawServerConn) onStreamsEmpty() {
+	if c.idleTimeout > 0 {
+		c.idleTimer.Reset(c.idleTimeout)
+	}
+}
+
+// CloseWithError closes the connection with the given error code and message.
+func (c *RawServerConn) CloseWithError(code quic.ApplicationErrorCode, msg string) error {
+	if c.idleTimer != nil {
+		c.idleTimer.Stop()
+	}
+	return c.rawConn.CloseWithError(code, msg)
+}
+
+// HandleRequestStream handles an HTTP/3 request on a bidirectional request stream.
+// The stream can either be obtained by calling [quic.Conn.AcceptStream] on the underlying QUIC connection,
+// or (internally) by using the server's stream accept loop.
+func (c *RawServerConn) HandleRequestStream(str *quic.Stream) {
+	hstr := c.rawConn.TrackStream(str)
+	c.handleRequestStream(hstr)
+}
+
+func (c *RawServerConn) requestMaxHeaderBytes() int {
+	if c.maxHeaderBytes <= 0 {
+		return http.DefaultMaxHeaderBytes
+	}
+	return c.maxHeaderBytes
+}
+
+func (c *RawServerConn) openControlStream(settings *settingsFrame) (*quic.SendStream, error) {
+	return c.rawConn.openControlStream(settings)
+}
+
+func (c *RawServerConn) handleRequestStream(str *stateTrackingStream) {
+	if c.idleTimeout > 0 {
+		// This only applies if the stream is the first active stream,
+		// but it's ok to stop a stopped timer.
+		c.idleTimer.Stop()
+	}
+
+	conn := &c.rawConn
+	qlogger := c.qlogger
+	decoder := c.decoder
+	connCtx := c.serverContext
+	maxHeaderBytes := c.requestMaxHeaderBytes()
+
+	fp := &frameParser{closeConn: conn.CloseWithError, r: str, streamID: str.StreamID()}
+	frame, err := fp.ParseNext(qlogger)
+	if err != nil {
+		if errors.Is(err, errPriorityUpdateForPush) {
+			conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "")
+			return
+		}
+		str.CancelRead(quic.StreamErrorCode(ErrCodeRequestIncomplete))
+		str.CancelWrite(quic.StreamErrorCode(ErrCodeRequestIncomplete))
+		return
+	}
+	hf, ok := frame.(*headersFrame)
+	if !ok {
+		conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "expected first frame to be a HEADERS frame")
+		return
+	}
+	if hf.Length > uint64(maxHeaderBytes) {
+		maybeQlogInvalidHeadersFrame(qlogger, str.StreamID(), hf.Length)
+		// stop the client from sending more data
+		str.CancelRead(quic.StreamErrorCode(ErrCodeExcessiveLoad))
+		// send a 431 Response (Request Header Fields Too Large)
+		c.rejectWithHeaderFieldsTooLarge(str)
+		return
+	}
+	headerBlock := make([]byte, hf.Length)
+	if _, err := io.ReadFull(str, headerBlock); err != nil {
+		maybeQlogInvalidHeadersFrame(qlogger, str.StreamID(), hf.Length)
+		str.CancelRead(quic.StreamErrorCode(ErrCodeRequestIncomplete))
+		str.CancelWrite(quic.StreamErrorCode(ErrCodeRequestIncomplete))
+		return
+	}
+	decodeFn := decoder.Decode(headerBlock)
+	var hfs []qpack.HeaderField
+	if qlogger != nil {
+		hfs = make([]qpack.HeaderField, 0, 16)
+	}
+	req, err := requestFromHeaders(decodeFn, maxHeaderBytes, &hfs)
+	if qlogger != nil {
+		qlogParsedHeadersFrame(qlogger, str.StreamID(), hf, hfs)
+	}
+	if err != nil {
+		if errors.Is(err, errHeaderTooLarge) {
+			// stop the client from sending more data
+			str.CancelRead(quic.StreamErrorCode(ErrCodeExcessiveLoad))
+			// send a 431 Response (Request Header Fields Too Large)
+			c.rejectWithHeaderFieldsTooLarge(str)
+			return
+		}
+
+		errCode := ErrCodeMessageError
+		if _, ok := errors.AsType[*qpackError](err); ok {
+			errCode = ErrCodeQPACKDecompressionFailed
+		}
+		str.CancelRead(quic.StreamErrorCode(errCode))
+		str.CancelWrite(quic.StreamErrorCode(errCode))
+		return
+	}
+
+	connState := conn.ConnectionState().TLS
+	req.TLS = &connState
+	req.RemoteAddr = conn.RemoteAddr().String()
+
+	// Check that the client doesn't send more data in DATA frames than indicated by the Content-Length header (if set).
+	// See section 4.1.2 of RFC 9114.
+	contentLength := int64(-1)
+	if _, ok := req.Header["Content-Length"]; ok && req.ContentLength >= 0 {
+		contentLength = req.ContentLength
+	}
+	hstr := newStream(str, conn, nil, func(r io.Reader, hf *headersFrame) error {
+		trailers, err := decodeTrailers(r, hf, maxHeaderBytes, decoder, qlogger, str.StreamID())
+		if err != nil {
+			return err
+		}
+		req.Trailer = trailers
+		return nil
+	}, qlogger)
+
+	// We only use the client's priority for local scheduling.
+	// A Priority response header is only transmitted so that potential intermediaries can use it,
+	// it doesn't affect local scheduling.
+	// This mirrors the behavior of HTTP/2, see https://github.com/golang/go/issues/75500.
+	var urgency int8
+	var incremental bool
+	if values, ok := req.Header["Priority"]; !ok {
+		urgency, incremental = defaultPriorityUrgency, !c.priorityAware.Load()
+	} else {
+		c.priorityAware.Store(true)
+		urgency, incremental = parsePriority(strings.Join(values, ","))
+	}
+	hstr.SetPriority(urgency, incremental)
+
+	body := newRequestBody(hstr, contentLength, connCtx, conn.ReceivedSettings(), conn.Settings)
+	req.Body = body
+
+	if c.logger != nil {
+		c.logger.Debug("handling request", "method", req.Method, "host", req.Host, "uri", req.RequestURI)
+	}
+
+	ctx, cancel := context.WithCancel(connCtx)
+	req = req.WithContext(ctx)
+	context.AfterFunc(str.Context(), cancel)
+
+	r := newResponseWriter(hstr, conn, req.Method == http.MethodHead, c.logger)
+	handler := c.requestHandler
+	if handler == nil {
+		handler = http.DefaultServeMux
+	}
+
+	// It's the client's responsibility to decide which requests are eligible for 0-RTT.
+	var panicked bool
+	func() {
+		defer func() {
+			if p := recover(); p != nil {
+				panicked = true
+				if p == http.ErrAbortHandler {
+					return
+				}
+				// Copied from net/http/server.go
+				const size = 64 << 10
+				buf := make([]byte, size)
+				buf = buf[:runtime.Stack(buf, false)]
+				logger := c.logger
+				if logger == nil {
+					logger = slog.Default()
+				}
+				logger.Error("http3: panic serving", "arg", p, "trace", string(buf))
+			}
+		}()
+		handler.ServeHTTP(r, req)
+	}()
+
+	if r.wasStreamHijacked() {
+		return
+	}
+
+	// abort the stream when there is a panic
+	if panicked {
+		str.CancelRead(quic.StreamErrorCode(ErrCodeInternalError))
+		str.CancelWrite(quic.StreamErrorCode(ErrCodeInternalError))
+		return
+	}
+
+	// response not written to the client yet, set Content-Length
+	if !r.headerWritten {
+		if _, haveCL := r.header["Content-Length"]; !haveCL {
+			r.header.Set("Content-Length", strconv.FormatInt(r.numWritten, 10))
+		}
+	}
+	r.Flush()
+	r.flushTrailers()
+
+	// If the EOF was read by the handler, CancelRead() is a no-op.
+	str.CancelRead(quic.StreamErrorCode(ErrCodeNoError))
+	str.Close()
+}
+
+func (c *RawServerConn) handleControlStream(_ *quic.ReceiveStream, fp *frameParser) {
+	for {
+		f, err := fp.ParseNext(c.qlogger)
+		if err != nil {
+			if errors.Is(err, errPriorityUpdateForPush) {
+				// Server push is not supported. Since we never send PUSH_PROMISE frames,
+				// the client can't reference a valid push ID.
+				c.CloseWithError(quic.ApplicationErrorCode(ErrCodeIDError), "")
+				return
+			}
+			_, isStreamError := errors.AsType[*quic.StreamError](err)
+			if err == io.EOF || isStreamError {
+				c.CloseWithError(quic.ApplicationErrorCode(ErrCodeClosedCriticalStream), "")
+				return
+			}
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameError), "")
+			return
+		}
+		switch frame := f.(type) {
+		case *priorityUpdateFrame:
+			if frame.ElementID%4 != 0 {
+				c.CloseWithError(quic.ApplicationErrorCode(ErrCodeIDError), "")
+				return
+			}
+			c.priorityAware.Store(true)
+			urgency, incremental := parsePriority(frame.PriorityFieldValue)
+			c.rawConn.UpdateStreamPriority(quic.StreamID(frame.ElementID), urgency, incremental)
+		case *goAwayFrame:
+			// Server push is not supported, so there is no push state to update.
+		default:
+			c.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "")
+			return
+		}
+	}
+}
+
+func (c *RawServerConn) rejectWithHeaderFieldsTooLarge(str *stateTrackingStream) {
+	hstr := newStream(str, &c.rawConn, nil, nil, c.qlogger)
+	defer hstr.Close()
+	r := newResponseWriter(hstr, &c.rawConn, false, c.logger)
+	r.WriteHeader(http.StatusRequestHeaderFieldsTooLarge)
+	r.Flush()
+}
+
+// HandleUnidirectionalStream handles an incoming unidirectional stream.
+func (c *RawServerConn) HandleUnidirectionalStream(str *quic.ReceiveStream) {
+	c.rawConn.handleUnidirectionalStream(str, true)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/server_test.go b/electron/native/private-transport/third_party/quic-go/http3/server_test.go
new file mode 100644
index 000000000..93d6da024
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/server_test.go
@@ -0,0 +1,802 @@
+package http3
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/internal/testdata"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigureTLSConfig(t *testing.T) {
+	t.Run("basic config", func(t *testing.T) {
+		conf := ConfigureTLSConfig(&tls.Config{})
+		require.Equal(t, conf.NextProtos, []string{NextProtoH3})
+	})
+
+	t.Run("ALPN set", func(t *testing.T) {
+		conf := ConfigureTLSConfig(&tls.Config{NextProtos: []string{"foo", "bar"}})
+		require.Equal(t, []string{NextProtoH3}, conf.NextProtos)
+	})
+
+	// for configs that define GetConfigForClient, the ALPN is set to h3
+	t.Run("GetConfigForClient", func(t *testing.T) {
+		staticConf := &tls.Config{NextProtos: []string{"foo", "bar"}}
+		conf := ConfigureTLSConfig(&tls.Config{
+			GetConfigForClient: func(*tls.ClientHelloInfo) (*tls.Config, error) {
+				return staticConf, nil
+			},
+		})
+		innerConf, err := conf.GetConfigForClient(&tls.ClientHelloInfo{ServerName: "example.com"})
+		require.NoError(t, err)
+		require.NotNil(t, innerConf)
+		require.Equal(t, []string{NextProtoH3}, innerConf.NextProtos)
+		// make sure the original config was not modified
+		require.Equal(t, []string{"foo", "bar"}, staticConf.NextProtos)
+	})
+
+	// GetConfigForClient might return a nil tls.Config
+	t.Run("GetConfigForClient returns nil", func(t *testing.T) {
+		conf := ConfigureTLSConfig(&tls.Config{
+			GetConfigForClient: func(*tls.ClientHelloInfo) (*tls.Config, error) {
+				return nil, nil
+			},
+		})
+		innerConf, err := conf.GetConfigForClient(&tls.ClientHelloInfo{ServerName: "example.com"})
+		require.NoError(t, err)
+		require.Nil(t, innerConf)
+	})
+}
+
+func TestServerSettings(t *testing.T) {
+	t.Run("enable datagrams", func(t *testing.T) {
+		testServerSettings(t, true, nil)
+	})
+	t.Run("additional settings", func(t *testing.T) {
+		testServerSettings(t, false, map[uint64]uint64{13: 37})
+	})
+}
+
+func testServerSettings(t *testing.T, enableDatagrams bool, other map[uint64]uint64) {
+	s := Server{
+		EnableDatagrams:    enableDatagrams,
+		AdditionalSettings: other,
+	}
+	s.init()
+
+	testDone := make(chan struct{})
+	defer close(testDone)
+
+	clientConn, serverConn := newConnPair(t)
+	go s.handleConn(serverConn)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	settingsStr, err := clientConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	settingsStr.SetReadDeadline(time.Now().Add(time.Second))
+	b := make([]byte, 1024)
+	n, err := settingsStr.Read(b)
+	require.NoError(t, err)
+	b = b[:n]
+
+	typ, l, err := quicvarint.Parse(b)
+	require.NoError(t, err)
+	require.EqualValues(t, streamTypeControlStream, typ)
+	fp := (&frameParser{r: bytes.NewReader(b[l:])})
+	f, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &settingsFrame{}, f)
+	settingsFrame := f.(*settingsFrame)
+	// Extended CONNECT is always supported
+	require.True(t, settingsFrame.ExtendedConnect)
+	require.Equal(t, settingsFrame.Datagram, enableDatagrams)
+	require.Equal(t, settingsFrame.Other, other)
+}
+
+func TestServerRequestHandling(t *testing.T) {
+	t.Run("200 with an empty handler", func(t *testing.T) {
+		var eventRecorder events.Recorder
+		hfs, body := testServerRequestHandling(t,
+			func(w http.ResponseWriter, r *http.Request) {},
+			httptest.NewRequest(http.MethodGet, "https://www.example.com", nil),
+			&eventRecorder,
+		)
+		require.Equal(t, hfs[":status"], []string{"200"})
+		require.Empty(t, body)
+
+		require.Len(t, eventRecorder.Events(qlog.FrameParsed{}), 1)
+		require.IsType(t, qlog.HeadersFrame{}, eventRecorder.Events(qlog.FrameParsed{})[0].(qlog.FrameParsed).Frame.Frame)
+		fp := eventRecorder.Events(qlog.FrameParsed{})[0].(qlog.FrameParsed)
+		require.Equal(t, quic.StreamID(0), fp.StreamID)
+		require.NotZero(t, fp.Raw.PayloadLength)
+		require.Contains(t, fp.Frame.Frame.(qlog.HeadersFrame).HeaderFields, qlog.HeaderField{Name: ":method", Value: "GET"})
+		require.Contains(t, fp.Frame.Frame.(qlog.HeadersFrame).HeaderFields, qlog.HeaderField{Name: ":authority", Value: "www.example.com"})
+
+		events := filterQlogEventsForFrame(eventRecorder.Events(qlog.FrameCreated{}), qlog.HeadersFrame{})
+		require.Len(t, events, 1)
+		fc := events[0].(qlog.FrameCreated)
+		require.Equal(t, quic.StreamID(0), fp.StreamID)
+		require.NotZero(t, fc.Raw.PayloadLength)
+		require.Contains(t, fc.Frame.Frame.(qlog.HeadersFrame).HeaderFields, qlog.HeaderField{Name: ":status", Value: "200"})
+	})
+
+	t.Run("content-length", func(t *testing.T) {
+		hfs, body := testServerRequestHandling(t,
+			func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusTeapot)
+				w.Write([]byte("foobar"))
+			},
+			httptest.NewRequest(http.MethodGet, "https://www.example.com", nil),
+			nil,
+		)
+		require.Equal(t, hfs[":status"], []string{"418"})
+		require.Equal(t, hfs["content-length"], []string{"6"})
+		require.Equal(t, body, []byte("foobar"))
+	})
+
+	t.Run("no content-length when flushed", func(t *testing.T) {
+		hfs, body := testServerRequestHandling(t,
+			func(w http.ResponseWriter, r *http.Request) {
+				w.Write([]byte("foo"))
+				w.(http.Flusher).Flush()
+				w.Write([]byte("bar"))
+			},
+			httptest.NewRequest(http.MethodGet, "https://www.example.com", nil),
+			nil,
+		)
+		require.Equal(t, hfs[":status"], []string{"200"})
+		require.NotContains(t, hfs, "content-length")
+		require.Equal(t, body, []byte("foobar"))
+	})
+
+	t.Run("HEAD request", func(t *testing.T) {
+		hfs, body := testServerRequestHandling(t,
+			func(w http.ResponseWriter, r *http.Request) {
+				w.Write([]byte("foobar"))
+			},
+			httptest.NewRequest(http.MethodHead, "https://www.example.com", nil),
+			nil,
+		)
+		require.Equal(t, hfs[":status"], []string{"200"})
+		require.Empty(t, body)
+	})
+
+	t.Run("POST request", func(t *testing.T) {
+		hfs, body := testServerRequestHandling(t,
+			func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusTeapot)
+				data, _ := io.ReadAll(r.Body)
+				w.Write(data)
+			},
+			httptest.NewRequest(http.MethodPost, "https://www.example.com", bytes.NewBuffer([]byte("foobar"))),
+			nil,
+		)
+		require.Equal(t, hfs[":status"], []string{"418"})
+		require.Equal(t, []byte("foobar"), body)
+	})
+}
+
+func testServerRequestHandling(t *testing.T,
+	handler http.HandlerFunc,
+	req *http.Request,
+	rec qlogwriter.Recorder,
+) (responseHeaders map[string][]string, body []byte) {
+	clientConn, serverConn := newConnPair(t, withServerRecorder(rec))
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	_, err = str.Write(encodeRequest(t, req))
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+
+	s := &Server{Handler: handler}
+	go s.ServeQUICConn(serverConn)
+
+	hfs := decodeHeader(t, str)
+	fp := frameParser{r: str}
+	var content []byte
+	for {
+		frame, err := fp.ParseNext(nil)
+		if err == io.EOF {
+			break
+		}
+		require.NoError(t, err)
+		require.IsType(t, &dataFrame{}, frame)
+		b := make([]byte, frame.(*dataFrame).Length)
+		_, err = io.ReadFull(str, b)
+		require.NoError(t, err)
+		content = append(content, b...)
+	}
+	return hfs, content
+}
+
+func TestServerFirstFrameNotHeaders(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+
+	var buf bytes.Buffer
+	buf.Write((&dataFrame{Length: 6}).Append(nil))
+	buf.Write([]byte("foobar"))
+	_, err = str.Write(buf.Bytes())
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+
+	s := &Server{}
+	go s.ServeQUICConn(serverConn)
+
+	select {
+	case <-clientConn.Context().Done():
+		err := context.Cause(clientConn.Context())
+		var appErr *quic.ApplicationError
+		require.ErrorAs(t, err, &appErr)
+		require.Equal(t, quic.ApplicationErrorCode(ErrCodeFrameUnexpected), appErr.ErrorCode)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestServerRejectsPriorityUpdateForPush(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+	go (&Server{}).ServeQUICConn(serverConn)
+
+	str, err := clientConn.OpenUniStream()
+	require.NoError(t, err)
+	b := quicvarint.Append(nil, streamTypeControlStream)
+	b = (&settingsFrame{}).Append(b)
+	b = quicvarint.Append(b, 0xf0701)
+	b = quicvarint.Append(b, 42)
+	b = append(b, make([]byte, 42)...)
+	_, err = str.Write(b)
+	require.NoError(t, err)
+
+	select {
+	case <-clientConn.Context().Done():
+		require.ErrorIs(t,
+			context.Cause(clientConn.Context()),
+			&quic.ApplicationError{Remote: true, ErrorCode: quic.ApplicationErrorCode(ErrCodeIDError)},
+		)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for close")
+	}
+}
+
+func TestServerHandlerBodyNotRead(t *testing.T) {
+	t.Run("GET request with a body", func(t *testing.T) {
+		testServerHandlerBodyNotRead(t,
+			httptest.NewRequest(http.MethodGet, "https://www.example.com", bytes.NewBuffer([]byte("foobar"))),
+			func(w http.ResponseWriter, r *http.Request) {},
+		)
+	})
+
+	t.Run("POST body not read", func(t *testing.T) {
+		testServerHandlerBodyNotRead(t,
+			httptest.NewRequest(http.MethodPost, "https://www.example.com", bytes.NewBuffer([]byte("foobar"))),
+			func(w http.ResponseWriter, r *http.Request) {},
+		)
+	})
+
+	t.Run("POST request, with a replaced body", func(t *testing.T) {
+		testServerHandlerBodyNotRead(t,
+			httptest.NewRequest(http.MethodPost, "https://www.example.com", bytes.NewBuffer([]byte("foobar"))),
+			func(w http.ResponseWriter, r *http.Request) {
+				r.Body = struct {
+					io.Reader
+					io.Closer
+				}{}
+			},
+		)
+	})
+}
+
+func testServerHandlerBodyNotRead(t *testing.T, req *http.Request, handler http.HandlerFunc) {
+	clientConn, serverConn := newConnPair(t)
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	_, err = str.Write(encodeRequest(t, req))
+	require.NoError(t, err)
+
+	done := make(chan struct{})
+	s := &Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			defer close(done)
+			handler(w, r)
+		}),
+	}
+
+	go s.ServeQUICConn(serverConn)
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestServerStreamResetByClient(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	str.CancelWrite(1337)
+
+	var called bool
+	s := &Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			called = true
+		}),
+	}
+
+	go s.ServeQUICConn(serverConn)
+
+	expectStreamReadReset(t, str, quic.StreamErrorCode(ErrCodeRequestIncomplete))
+	require.False(t, called)
+}
+
+func TestServerPanickingHandler(t *testing.T) {
+	t.Run("panicking handler", func(t *testing.T) {
+		logOutput := testServerPanickingHandler(t, func(w http.ResponseWriter, r *http.Request) {
+			panic("foobar")
+		})
+		require.Contains(t, logOutput, "http3: panic serving")
+		require.Contains(t, logOutput, "foobar")
+	})
+
+	t.Run("http.ErrAbortHandler", func(t *testing.T) {
+		logOutput := testServerPanickingHandler(t, func(w http.ResponseWriter, r *http.Request) {
+			panic(http.ErrAbortHandler)
+		})
+		require.NotContains(t, logOutput, "http3: panic serving")
+		require.NotContains(t, logOutput, "http.ErrAbortHandler")
+	})
+}
+
+func testServerPanickingHandler(t *testing.T, handler http.HandlerFunc) (logOutput string) {
+	clientConn, serverConn := newConnPair(t)
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	_, err = str.Write(encodeRequest(t, httptest.NewRequest(http.MethodHead, "https://www.example.com", nil)))
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+
+	var logBuf bytes.Buffer
+	s := &Server{
+		Handler: handler,
+		Logger:  slog.New(slog.NewTextHandler(&logBuf, nil)),
+	}
+
+	go s.ServeQUICConn(serverConn)
+
+	expectStreamReadReset(t, str, quic.StreamErrorCode(ErrCodeInternalError))
+	s.Close()
+
+	return logBuf.String()
+}
+
+func TestServerRequestHeaderTooLarge(t *testing.T) {
+	t.Run("default value", func(t *testing.T) {
+		var eventRecorder events.Recorder
+		// use 2*DefaultMaxHeaderBytes here. qpack will compress the request,
+		// but the request will still end up larger than DefaultMaxHeaderBytes.
+		url := bytes.Repeat([]byte{'a'}, http.DefaultMaxHeaderBytes*2)
+		testServerRequestHeaderTooLarge(t,
+			httptest.NewRequest(http.MethodGet, "https://"+string(url), nil),
+			0,
+			&eventRecorder,
+		)
+		events := eventRecorder.Events(qlog.FrameParsed{})
+		require.Len(t, events, 1)
+		require.Equal(t, qlog.HeadersFrame{}, events[0].(qlog.FrameParsed).Frame.Frame)
+		// The request is QPACK-compressed, so it will be smaller than 2*http.DefaultMaxHeaderBytes
+		require.Greater(t, events[0].(qlog.FrameParsed).Raw.PayloadLength, http.DefaultMaxHeaderBytes)
+		require.Less(t, events[0].(qlog.FrameParsed).Raw.PayloadLength, http.DefaultMaxHeaderBytes*2)
+	})
+
+	t.Run("custom value", func(t *testing.T) {
+		var eventRecorder events.Recorder
+		testServerRequestHeaderTooLarge(t,
+			httptest.NewRequest(http.MethodGet, "https://www.example.com", nil),
+			20,
+			&eventRecorder,
+		)
+		events := eventRecorder.Events(qlog.FrameParsed{})
+		require.Len(t, events, 1)
+		require.Equal(t, qlog.HeadersFrame{}, events[0].(qlog.FrameParsed).Frame.Frame)
+		require.Greater(t, events[0].(qlog.FrameParsed).Raw.PayloadLength, 20)
+		require.Less(t, events[0].(qlog.FrameParsed).Raw.PayloadLength, 40)
+	})
+}
+
+func testServerRequestHeaderTooLarge(t *testing.T, req *http.Request, maxHeaderBytes int, rec qlogwriter.Recorder) {
+	var called bool
+	s := &Server{
+		MaxHeaderBytes: maxHeaderBytes,
+		Handler:        http.HandlerFunc(func(http.ResponseWriter, *http.Request) { called = true }),
+	}
+	s.init()
+
+	clientConn, serverConn := newConnPair(t, withServerRecorder(rec))
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	_, err = str.Write(encodeRequest(t, req))
+	require.NoError(t, err)
+
+	go s.ServeQUICConn(serverConn)
+
+	hfs := decodeHeader(t, str)
+	require.Equal(t, []string{"431"}, hfs[":status"])
+	expectStreamWriteReset(t, str, quic.StreamErrorCode(ErrCodeExcessiveLoad))
+	require.False(t, called)
+}
+
+func TestServerRequestContext(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	_, err = str.Write(encodeRequest(t, httptest.NewRequest(http.MethodHead, "https://www.example.com", nil)))
+	require.NoError(t, err)
+
+	ctxChan := make(chan context.Context, 1)
+	block := make(chan struct{})
+	s := &Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			ctxChan <- r.Context()
+			<-block
+		}),
+	}
+
+	go s.ServeQUICConn(serverConn)
+
+	var requestContext context.Context
+	select {
+	case requestContext = <-ctxChan:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	require.Equal(t, s, requestContext.Value(ServerContextKey))
+	require.Equal(t, serverConn.LocalAddr(), requestContext.Value(http.LocalAddrContextKey))
+	require.Equal(t, serverConn.RemoteAddr(), requestContext.Value(RemoteAddrContextKey))
+	select {
+	case <-requestContext.Done():
+		t.Fatal("request context was canceled")
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	}
+
+	str.CancelRead(1337)
+
+	select {
+	case <-requestContext.Done():
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	require.Equal(t, context.Canceled, requestContext.Err())
+	close(block)
+}
+
+func TestServerHTTPStreamHijacking(t *testing.T) {
+	clientConn, serverConn := newConnPair(t)
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	_, err = str.Write(encodeRequest(t, httptest.NewRequest(http.MethodHead, "https://www.example.com", nil)))
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+
+	s := &Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			str := w.(HTTPStreamer).HTTPStream()
+			str.Write([]byte("foobar"))
+			str.Close()
+		}),
+	}
+	go s.ServeQUICConn(serverConn)
+
+	str.SetReadDeadline(time.Now().Add(time.Second))
+	rsp, err := io.ReadAll(str)
+	require.NoError(t, err)
+	r := bytes.NewReader(rsp)
+	hfs := decodeHeader(t, r)
+	require.Equal(t, hfs[":status"], []string{"200"})
+	fp := frameParser{r: r}
+	frame, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &dataFrame{}, frame)
+	dataFrame := frame.(*dataFrame)
+	require.Equal(t, uint64(6), dataFrame.Length)
+	data, err := io.ReadAll(r)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), data)
+}
+
+func getAltSvc(s *Server) (string, bool) {
+	hdr := http.Header{}
+	s.SetQUICHeaders(hdr)
+	if altSvc, ok := hdr["Alt-Svc"]; ok {
+		return altSvc[0], true
+	}
+	return "", false
+}
+
+func TestServerAltSvcFromListenersAndConns(t *testing.T) {
+	t.Run("default", func(t *testing.T) {
+		testServerAltSvcFromListenersAndConns(t, []quic.Version{})
+	})
+	t.Run("v1", func(t *testing.T) {
+		testServerAltSvcFromListenersAndConns(t, []quic.Version{quic.Version1})
+	})
+	t.Run("v1 and v2", func(t *testing.T) {
+		testServerAltSvcFromListenersAndConns(t, []quic.Version{quic.Version1, quic.Version2})
+	})
+}
+
+func testServerAltSvcFromListenersAndConns(t *testing.T, versions []quic.Version) {
+	ln1, err := quic.ListenEarly(newUDPConnLocalhost(t), getTLSConfig(), nil)
+	require.NoError(t, err)
+	port1 := ln1.Addr().(*net.UDPAddr).Port
+
+	s := &Server{
+		Addr:       ":1337", // will be ignored since we're using listeners
+		TLSConfig:  getTLSConfig(),
+		QUICConfig: &quic.Config{Versions: versions},
+	}
+	done1 := make(chan struct{})
+	go func() {
+		defer close(done1)
+		s.ServeListener(ln1)
+	}()
+	time.Sleep(scaleDuration(10 * time.Millisecond))
+	altSvc, ok := getAltSvc(s)
+	require.True(t, ok)
+	require.Equal(t, fmt.Sprintf(`h3=":%d"; ma=2592000`, port1), altSvc)
+
+	udpConn := newUDPConnLocalhost(t)
+	port2 := udpConn.LocalAddr().(*net.UDPAddr).Port
+	done2 := make(chan struct{})
+	go func() {
+		defer close(done2)
+		s.Serve(udpConn)
+	}()
+	time.Sleep(scaleDuration(10 * time.Millisecond))
+	altSvc, ok = getAltSvc(s)
+	require.True(t, ok)
+	require.Equal(t, fmt.Sprintf(`h3=":%d"; ma=2592000,h3=":%d"; ma=2592000`, port1, port2), altSvc)
+
+	// Close the first listener.
+	// This should remove the associated Alt-Svc entry.
+	require.NoError(t, ln1.Close())
+	select {
+	case <-done1:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	altSvc, ok = getAltSvc(s)
+	require.True(t, ok)
+	require.Equal(t, fmt.Sprintf(`h3=":%d"; ma=2592000`, port2), altSvc)
+
+	// Close the second listener.
+	// This should remove the Alt-Svc entry altogether.
+	require.NoError(t, udpConn.Close())
+	select {
+	case <-done2:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	_, ok = getAltSvc(s)
+	require.False(t, ok)
+}
+
+func TestServerAltSvcFromPort(t *testing.T) {
+	s := &Server{Port: 1337}
+	_, ok := getAltSvc(s)
+	require.False(t, ok)
+
+	ln, err := quic.ListenEarly(newUDPConnLocalhost(t), getTLSConfig(), nil)
+	require.NoError(t, err)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		s.ServeListener(ln)
+	}()
+	time.Sleep(scaleDuration(10 * time.Millisecond))
+
+	altSvc, ok := getAltSvc(s)
+	require.True(t, ok)
+	require.Equal(t, `h3=":1337"; ma=2592000`, altSvc)
+
+	require.NoError(t, ln.Close())
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	_, ok = getAltSvc(s)
+	require.False(t, ok)
+}
+
+type unixSocketListener struct {
+	*quic.EarlyListener
+}
+
+func (l *unixSocketListener) Addr() net.Addr {
+	return &net.UnixAddr{Net: "unix", Name: "/tmp/quic.sock"}
+}
+
+func TestServerAltSvcFromUnixSocket(t *testing.T) {
+	t.Run("with Server.Addr not set", func(t *testing.T) {
+		_, ok := testServerAltSvcFromUnixSocket(t, "")
+		require.False(t, ok)
+	})
+
+	t.Run("with Server.Addr set", func(t *testing.T) {
+		altSvc, ok := testServerAltSvcFromUnixSocket(t, ":1337")
+		require.True(t, ok)
+		require.Equal(t, `h3=":1337"; ma=2592000`, altSvc)
+	})
+}
+
+func testServerAltSvcFromUnixSocket(t *testing.T, addr string) (altSvc string, ok bool) {
+	ln, err := quic.ListenEarly(newUDPConnLocalhost(t), testdata.GetTLSConfig(), nil)
+	require.NoError(t, err)
+
+	var logBuf bytes.Buffer
+	s := &Server{
+		Addr:   addr,
+		Logger: slog.New(slog.NewTextHandler(&logBuf, nil)),
+	}
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		s.ServeListener(&unixSocketListener{EarlyListener: ln})
+	}()
+	time.Sleep(scaleDuration(10 * time.Millisecond))
+
+	altSvc, ok = getAltSvc(s)
+	require.NoError(t, ln.Close())
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	require.Contains(t, logBuf.String(), "Unable to extract port from listener, will not be announced using SetQUICHeaders")
+	return altSvc, ok
+}
+
+func TestServerListenAndServeErrors(t *testing.T) {
+	require.EqualError(t, (&Server{}).ListenAndServe(), "use of http3.Server without TLSConfig")
+	s := &Server{
+		Addr:      ":123456",
+		TLSConfig: testdata.GetTLSConfig(),
+	}
+	require.ErrorContains(t, s.ListenAndServe(), "invalid port")
+}
+
+func TestServerClosing(t *testing.T) {
+	s := &Server{TLSConfig: getTLSConfig()}
+	require.NoError(t, s.Close())
+	require.NoError(t, s.Close()) // duplicate calls are ok
+	require.ErrorIs(t, s.ListenAndServe(), http.ErrServerClosed)
+	require.ErrorIs(t, s.ListenAndServeTLS(testdata.GetCertificatePaths()), http.ErrServerClosed)
+	require.ErrorIs(t, s.Serve(nil), http.ErrServerClosed)
+	require.ErrorIs(t, s.ServeListener(nil), http.ErrServerClosed)
+	require.ErrorIs(t, s.ServeQUICConn(nil), http.ErrServerClosed)
+}
+
+func TestServerConcurrentServeAndClose(t *testing.T) {
+	addr, err := net.ResolveUDPAddr("udp", "localhost:0")
+	require.NoError(t, err)
+	c, err := net.ListenUDP("udp", addr)
+	require.NoError(t, err)
+	done := make(chan struct{})
+	s := &Server{TLSConfig: testdata.GetTLSConfig()}
+	go func() {
+		defer close(done)
+		s.Serve(c)
+	}()
+	runtime.Gosched()
+	s.Close()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestServerImmediateGracefulShutdown(t *testing.T) {
+	s := &Server{TLSConfig: testdata.GetTLSConfig()}
+	errChan := make(chan error, 1)
+	go func() { errChan <- s.Shutdown(context.Background()) }()
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestServerGracefulShutdown(t *testing.T) {
+	requestChan := make(chan struct{}, 1)
+	s := &Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requestChan <- struct{}{}
+	})}
+
+	clientConn, serverConn := newConnPair(t)
+	go s.ServeQUICConn(serverConn)
+
+	firstStream, err := clientConn.OpenStream()
+	require.NoError(t, err)
+	_, err = firstStream.Write(encodeRequest(t, httptest.NewRequest(http.MethodGet, "https://www.example.com", nil)))
+	require.NoError(t, err)
+
+	select {
+	case <-requestChan:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	controlStr, err := clientConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	typ, err := quicvarint.Read(quicvarint.NewReader(controlStr))
+	require.NoError(t, err)
+	require.EqualValues(t, streamTypeControlStream, typ)
+	fp := &frameParser{r: controlStr}
+	f, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.IsType(t, &settingsFrame{}, f)
+
+	shutdownCtx, shutdownCancel := context.WithCancel(context.Background())
+	errChan := make(chan error)
+	go func() {
+		errChan <- s.Shutdown(shutdownCtx)
+	}()
+
+	f, err = fp.ParseNext(nil)
+	require.NoError(t, err)
+	require.Equal(t, &goAwayFrame{StreamID: 4}, f)
+
+	select {
+	case <-errChan:
+		t.Fatal("didn't expect Shutdown to return")
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	}
+
+	// all further streams are getting rejected
+	for range 3 {
+		str, err := clientConn.OpenStream()
+		require.NoError(t, err)
+		_, _ = str.Write(encodeRequest(t, httptest.NewRequest(http.MethodGet, "https://www.example.com", nil)))
+		expectStreamReadReset(t, str, quic.StreamErrorCode(ErrCodeRequestRejected))
+		expectStreamWriteReset(t, str, quic.StreamErrorCode(ErrCodeRequestRejected))
+	}
+
+	// cancel the context passed to Shutdown
+	shutdownCancel()
+
+	select {
+	case err := <-errChan:
+		require.ErrorIs(t, err, context.Canceled)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/settings_0rtt.go b/electron/native/private-transport/third_party/quic-go/http3/settings_0rtt.go
new file mode 100644
index 000000000..0b7c73d32
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/settings_0rtt.go
@@ -0,0 +1,56 @@
+package http3
+
+import (
+	"bytes"
+
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+const serverSettingsSessionTicketPrefix = "quic-go h3 settings v1"
+
+type settings = settingsFrame
+
+func settingsForSessionTicket(current *settings) []byte {
+	return current.Append([]byte(serverSettingsSessionTicketPrefix))
+}
+
+func settingsDataFromSessionTicket(extras [][]byte) ([]byte, bool) {
+	prefix := []byte(serverSettingsSessionTicketPrefix)
+	for _, extra := range extras {
+		if data, ok := bytes.CutPrefix(extra, prefix); ok {
+			return data, true
+		}
+	}
+	return nil, false
+}
+
+func settingsCompatibleFor0RTT(data []byte, current *settings) bool {
+	r := bytes.NewReader(data)
+	frameType, err := quicvarint.Read(r)
+	if err != nil || frameType != 0x4 {
+		return false
+	}
+	length, err := quicvarint.Read(r)
+	if err != nil || uint64(r.Len()) != length {
+		return false
+	}
+	old, err := parseSettingsFrame(&countingByteReader{Reader: r}, length, 0, nil)
+	if err != nil {
+		return false
+	}
+	// An unknown setting might belong to an extension that this version no longer supports.
+	if len(old.Other) > 0 {
+		return false
+	}
+
+	if current.MaxFieldSectionSize >= 0 && (old.MaxFieldSectionSize < 0 || old.MaxFieldSectionSize > current.MaxFieldSectionSize) {
+		return false
+	}
+	if old.Datagram && !current.Datagram {
+		return false
+	}
+	if old.ExtendedConnect && !current.ExtendedConnect {
+		return false
+	}
+	return true
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/settings_0rtt_test.go b/electron/native/private-transport/third_party/quic-go/http3/settings_0rtt_test.go
new file mode 100644
index 000000000..b8b95ea3a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/settings_0rtt_test.go
@@ -0,0 +1,62 @@
+package http3
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSettingsCompatibleFor0RTT(t *testing.T) {
+	ticket := func(saved *settings) [][]byte {
+		return [][]byte{settingsForSessionTicket(saved)}
+	}
+
+	for _, tc := range []struct {
+		name       string
+		current    *settings
+		extra      [][]byte
+		compatible bool
+	}{
+		{
+			name:       "max field section size increased",
+			current:    &settings{MaxFieldSectionSize: 101},
+			extra:      ticket(&settings{MaxFieldSectionSize: 100}),
+			compatible: true,
+		},
+		{
+			name:    "missing settings",
+			current: &settings{},
+		},
+		{
+			name:    "malformed settings",
+			current: &settings{},
+			extra:   [][]byte{append([]byte(serverSettingsSessionTicketPrefix), 0xff)},
+		},
+		{
+			name:    "max field section size reduced",
+			current: &settings{MaxFieldSectionSize: 100},
+			extra:   ticket(&settings{MaxFieldSectionSize: 101}),
+		},
+		{
+			name:    "datagrams disabled",
+			current: &settings{MaxFieldSectionSize: 100},
+			extra: ticket(&settings{
+				MaxFieldSectionSize: 100,
+				Datagram:            true,
+			}),
+		},
+		{
+			name:    "unknown setting",
+			current: &settings{MaxFieldSectionSize: 100},
+			extra: ticket(&settings{
+				MaxFieldSectionSize: 100,
+				Other:               map[uint64]uint64{13: 37},
+			}),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			data, ok := settingsDataFromSessionTicket(tc.extra)
+			require.Equal(t, tc.compatible, ok && settingsCompatibleFor0RTT(data, tc.current))
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/state_tracking_stream.go b/electron/native/private-transport/third_party/quic-go/http3/state_tracking_stream.go
new file mode 100644
index 000000000..a137724a5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/state_tracking_stream.go
@@ -0,0 +1,193 @@
+package http3
+
+import (
+	"context"
+	"errors"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/datagrambuffer"
+)
+
+const streamDatagramQueueLen = 32
+
+// stateTrackingStream is an implementation of quic.Stream that delegates
+// to an underlying stream
+// it takes care of proxying send and receive errors onto an implementation of
+// the errorSetter interface (intended to be occupied by a datagrammer)
+// it is also responsible for clearing the stream based on its ID from its
+// parent connection, this is done through the streamClearer interface when
+// both the send and receive sides are closed
+type stateTrackingStream struct {
+	*quic.Stream
+
+	sendDatagram func([]byte) error
+	hasData      chan struct{}
+	queue        *datagrambuffer.Queue
+
+	mx      sync.Mutex
+	sendErr error
+	recvErr error
+
+	clearer streamClearer
+}
+
+var _ datagramStream = &stateTrackingStream{}
+
+type streamClearer interface {
+	clearStream(quic.StreamID)
+}
+
+func newStateTrackingStream(s *quic.Stream, clearer streamClearer, sendDatagram func([]byte) error) *stateTrackingStream {
+	t := &stateTrackingStream{
+		Stream:       s,
+		clearer:      clearer,
+		sendDatagram: sendDatagram,
+		hasData:      make(chan struct{}, 1),
+		queue:        datagrambuffer.New(streamDatagramQueueLen),
+	}
+
+	context.AfterFunc(s.Context(), func() {
+		t.closeSend(context.Cause(s.Context()))
+	})
+
+	return t
+}
+
+func (s *stateTrackingStream) closeSend(e error) {
+	s.mx.Lock()
+	defer s.mx.Unlock()
+
+	// clear the stream the first time both the send
+	// and receive are finished
+	if s.sendErr == nil {
+		if s.recvErr != nil {
+			s.clearer.clearStream(s.StreamID())
+		}
+		s.sendErr = e
+	}
+}
+
+func (s *stateTrackingStream) closeReceive(e error) {
+	s.mx.Lock()
+	defer s.mx.Unlock()
+
+	// clear the stream the first time both the send
+	// and receive are finished
+	if s.recvErr == nil {
+		if s.sendErr != nil {
+			s.clearer.clearStream(s.StreamID())
+		}
+		s.recvErr = e
+		s.queue.Close()
+		s.signalHasDatagram()
+	}
+}
+
+func (s *stateTrackingStream) Close() error {
+	s.closeSend(errors.New("write on closed stream"))
+	return s.Stream.Close()
+}
+
+func (s *stateTrackingStream) CancelWrite(e quic.StreamErrorCode) {
+	s.closeSend(&quic.StreamError{StreamID: s.StreamID(), ErrorCode: e})
+	s.Stream.CancelWrite(e)
+}
+
+func (s *stateTrackingStream) Write(b []byte) (int, error) {
+	n, err := s.Stream.Write(b)
+	if err != nil && !errors.Is(err, os.ErrDeadlineExceeded) {
+		s.closeSend(err)
+	}
+	return n, err
+}
+
+func (s *stateTrackingStream) TryWriteAll(b []byte) error {
+	err := s.Stream.TryWriteAll(b)
+	if err != nil && !errors.Is(err, quic.ErrWouldBlock) {
+		s.closeSend(err)
+	}
+	return err
+}
+
+func (s *stateTrackingStream) CancelRead(e quic.StreamErrorCode) {
+	s.closeReceive(&quic.StreamError{StreamID: s.StreamID(), ErrorCode: e})
+	s.Stream.CancelRead(e)
+}
+
+func (s *stateTrackingStream) Read(b []byte) (int, error) {
+	n, err := s.Stream.Read(b)
+	if err != nil && !errors.Is(err, os.ErrDeadlineExceeded) {
+		s.closeReceive(err)
+	}
+	return n, err
+}
+
+func (s *stateTrackingStream) SendDatagram(b []byte) error {
+	s.mx.Lock()
+	sendErr := s.sendErr
+	s.mx.Unlock()
+	if sendErr != nil {
+		return sendErr
+	}
+
+	return s.sendDatagram(b)
+}
+
+func (s *stateTrackingStream) signalHasDatagram() {
+	select {
+	case s.hasData <- struct{}{}:
+	default:
+	}
+}
+
+func (s *stateTrackingStream) enqueueDatagram(data []byte) {
+	s.mx.Lock()
+	defer s.mx.Unlock()
+
+	if s.recvErr != nil {
+		return
+	}
+	if !s.queue.Push(data, time.Now()) {
+		return
+	}
+	s.signalHasDatagram()
+}
+
+func (s *stateTrackingStream) ReceiveDatagram(ctx context.Context) ([]byte, error) {
+start:
+	s.mx.Lock()
+	if data, ok := s.queue.Pop(time.Now()); ok {
+		s.mx.Unlock()
+		return data, nil
+	}
+	if receiveErr := s.recvErr; receiveErr != nil {
+		s.mx.Unlock()
+		return nil, receiveErr
+	}
+	s.mx.Unlock()
+
+	select {
+	case <-ctx.Done():
+		return nil, context.Cause(ctx)
+	case <-s.hasData:
+	}
+	goto start
+}
+
+func (s *stateTrackingStream) QUICStream() *quic.Stream {
+	return s.Stream
+}
+
+func (s *stateTrackingStream) enableDatagramReceiveBuffer() {
+	s.mx.Lock()
+	defer s.mx.Unlock()
+	s.queue.EnableBurst()
+}
+func (s *stateTrackingStream) datagramReceiveBufferStats() quic.DatagramReceiveBufferStats {
+	s.mx.Lock()
+	defer s.mx.Unlock()
+	return s.queue.Stats()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/state_tracking_stream_test.go b/electron/native/private-transport/third_party/quic-go/http3/state_tracking_stream_test.go
new file mode 100644
index 000000000..b98c1d88c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/state_tracking_stream_test.go
@@ -0,0 +1,319 @@
+package http3
+
+import (
+	"context"
+	"io"
+	"net"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newStreamPair(t *testing.T) (client, server *quic.Stream) {
+	t.Helper()
+
+	clientConn, serverConn := newConnPair(t)
+	serverStr, err := serverConn.OpenStream()
+	require.NoError(t, err)
+	// need to send something to the client to make it accept the stream
+	_, err = serverStr.Write([]byte{0})
+	require.NoError(t, err)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	clientStr, err := clientConn.AcceptStream(ctx)
+	require.NoError(t, err)
+	clientStr.SetReadDeadline(time.Now().Add(time.Second))
+	_, err = clientStr.Read([]byte{0})
+	require.NoError(t, err)
+	clientStr.SetWriteDeadline(time.Time{})
+	return clientStr, serverStr
+}
+
+func canceledCtx() context.Context {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	return ctx
+}
+
+func checkDatagramReceive(t *testing.T, str *stateTrackingStream) {
+	t.Helper()
+	_, err := str.ReceiveDatagram(canceledCtx())
+	require.ErrorIs(t, err, context.Canceled)
+}
+
+func checkDatagramSend(t *testing.T, str *stateTrackingStream) {
+	t.Helper()
+	require.NoError(t, str.SendDatagram([]byte("test")))
+}
+
+type mockStreamClearer struct {
+	cleared *quic.StreamID
+}
+
+func (s *mockStreamClearer) clearStream(id quic.StreamID) {
+	s.cleared = &id
+}
+
+func TestStateTrackingStreamRead(t *testing.T) {
+	t.Run("io.EOF", func(t *testing.T) {
+		testStateTrackingStreamRead(t, false)
+	})
+	t.Run("remote stream reset", func(t *testing.T) {
+		testStateTrackingStreamRead(t, true)
+	})
+}
+
+func testStateTrackingStreamRead(t *testing.T, reset bool) {
+	client, server := newStreamPair(t)
+
+	var clearer mockStreamClearer
+	str := newStateTrackingStream(client, &clearer, func(b []byte) error { return nil })
+
+	// deadline errors are ignored
+	client.SetReadDeadline(time.Now())
+	_, err := str.Read(make([]byte, 3))
+	require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+	require.Nil(t, clearer.cleared)
+	client.SetReadDeadline(time.Time{})
+
+	_, err = server.Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	if !reset {
+		server.Close()
+
+		for range 3 {
+			_, err := str.Read([]byte{0})
+			require.NoError(t, err)
+			require.Nil(t, clearer.cleared)
+			checkDatagramReceive(t, str)
+		}
+	} else {
+		server.CancelWrite(42)
+	}
+
+	var expectedErr error
+	_, err = io.ReadAll(str)
+	if !reset {
+		require.NoError(t, err)
+		expectedErr = io.EOF
+	} else {
+		expectedErr = &quic.StreamError{Remote: true, StreamID: server.StreamID(), ErrorCode: 42}
+		require.ErrorIs(t, err, expectedErr)
+	}
+	require.Nil(t, clearer.cleared)
+	// the receive side registered the error
+	_, err = str.ReceiveDatagram(canceledCtx())
+	require.ErrorIs(t, err, expectedErr)
+	// the send side is still open
+	require.NoError(t, str.SendDatagram([]byte("foo")))
+}
+
+func TestStateTrackingStreamRemoteCancelation(t *testing.T) {
+	client, server := newStreamPair(t)
+
+	var clearer mockStreamClearer
+	str := newStateTrackingStream(client, &clearer, func(b []byte) error { return nil })
+
+	_, err := str.Write([]byte("foo"))
+	require.NoError(t, err)
+	require.Nil(t, clearer.cleared)
+	checkDatagramReceive(t, str)
+	checkDatagramSend(t, str)
+
+	// deadline errors are ignored
+	client.SetWriteDeadline(time.Now())
+	_, err = str.Write([]byte("baz"))
+	require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+	require.Nil(t, clearer.cleared)
+	checkDatagramReceive(t, str)
+	checkDatagramSend(t, str)
+	client.SetWriteDeadline(time.Time{})
+
+	server.CancelRead(123)
+
+	var writeErr error
+	require.Eventually(t, func() bool {
+		_, writeErr = str.Write([]byte("bar"))
+		return writeErr != nil
+	}, time.Second, scaleDuration(time.Millisecond))
+	expectedErr := &quic.StreamError{Remote: true, StreamID: server.StreamID(), ErrorCode: 123}
+	require.ErrorIs(t, writeErr, expectedErr)
+	require.Nil(t, clearer.cleared)
+	checkDatagramReceive(t, str)
+	require.ErrorIs(t, str.SendDatagram([]byte("test")), expectedErr)
+}
+
+func TestStateTrackingStreamLocalCancelation(t *testing.T) {
+	client, _ := newStreamPair(t)
+
+	var clearer mockStreamClearer
+	str := newStateTrackingStream(client, &clearer, func(b []byte) error { return nil })
+
+	_, err := str.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.Nil(t, clearer.cleared)
+	checkDatagramReceive(t, str)
+	checkDatagramSend(t, str)
+
+	str.CancelWrite(1337)
+	require.Nil(t, clearer.cleared)
+	checkDatagramReceive(t, str)
+	require.ErrorIs(t, str.SendDatagram([]byte("test")), &quic.StreamError{StreamID: client.StreamID(), ErrorCode: 1337})
+}
+
+func TestStateTrackingStreamClose(t *testing.T) {
+	client, _ := newStreamPair(t)
+
+	var clearer mockStreamClearer
+	str := newStateTrackingStream(client, &clearer, func(b []byte) error { return nil })
+
+	require.Nil(t, clearer.cleared)
+	checkDatagramReceive(t, str)
+	checkDatagramSend(t, str)
+
+	require.NoError(t, client.Close())
+	require.Eventually(t, func() bool {
+		err := str.SendDatagram([]byte("test"))
+		if err == nil {
+			return false
+		}
+		require.ErrorIs(t, err, context.Canceled)
+		return true
+	}, time.Second, scaleDuration(5*time.Millisecond))
+
+	checkDatagramReceive(t, str)
+	require.Nil(t, clearer.cleared)
+}
+
+func TestStateTrackingStreamReceiveThenSend(t *testing.T) {
+	client, server := newStreamPair(t)
+
+	var clearer mockStreamClearer
+	str := newStateTrackingStream(client, &clearer, func(b []byte) error { return nil })
+
+	_, err := server.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.NoError(t, server.Close())
+
+	_, err = io.ReadAll(str)
+	require.NoError(t, err)
+
+	require.Nil(t, clearer.cleared)
+	_, err = str.ReceiveDatagram(canceledCtx())
+	require.ErrorIs(t, err, io.EOF)
+
+	client.CancelWrite(123)
+
+	id := client.StreamID()
+	_, err = str.Write([]byte("bar"))
+	require.ErrorIs(t, err, &quic.StreamError{StreamID: id, ErrorCode: 123})
+	require.ErrorIs(t, str.SendDatagram([]byte("test")), &quic.StreamError{StreamID: id, ErrorCode: 123})
+
+	require.Equal(t, &id, clearer.cleared)
+}
+
+func TestStateTrackingStreamSendThenReceive(t *testing.T) {
+	client, server := newStreamPair(t)
+
+	var clearer mockStreamClearer
+	str := newStateTrackingStream(client, &clearer, func(b []byte) error { return nil })
+
+	server.CancelRead(1234)
+
+	var writeErr error
+	require.Eventually(t, func() bool {
+		_, writeErr = str.Write([]byte("bar"))
+		return writeErr != nil
+	}, time.Second, scaleDuration(time.Millisecond))
+	id := server.StreamID()
+	expectedErr := &quic.StreamError{Remote: true, StreamID: id, ErrorCode: 1234}
+	require.ErrorIs(t, writeErr, expectedErr)
+	require.Nil(t, clearer.cleared)
+	require.ErrorIs(t, str.SendDatagram([]byte("test")), expectedErr)
+
+	_, err := server.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.NoError(t, server.Close())
+
+	_, err = io.ReadAll(str)
+	require.NoError(t, err)
+	_, err = str.ReceiveDatagram(canceledCtx())
+	require.ErrorIs(t, err, io.EOF)
+
+	require.Equal(t, &id, clearer.cleared)
+}
+
+func TestDatagramReceiving(t *testing.T) {
+	client, _ := newStreamPair(t)
+
+	str := newStateTrackingStream(client, nil, func(b []byte) error { return nil })
+	type result struct {
+		data []byte
+		err  error
+	}
+
+	// Receive blocks until a datagram is received
+	resultChan := make(chan result)
+	go func() {
+		defer close(resultChan)
+		data, err := str.ReceiveDatagram(context.Background())
+		resultChan <- result{data: data, err: err}
+	}()
+
+	select {
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	case <-resultChan:
+		t.Fatal("should not have received a datagram")
+	}
+	str.enqueueDatagram([]byte("foobar"))
+
+	select {
+	case res := <-resultChan:
+		require.NoError(t, res.err)
+		require.Equal(t, []byte("foobar"), res.data)
+	case <-time.After(time.Second):
+		t.Fatal("should have received a datagram")
+	}
+
+	// up to 32 datagrams can be queued
+	for i := range streamDatagramQueueLen + 1 {
+		str.enqueueDatagram([]byte{uint8(i)})
+	}
+	for i := range streamDatagramQueueLen {
+		data, err := str.ReceiveDatagram(context.Background())
+		require.NoError(t, err)
+		require.Equal(t, []byte{uint8(i)}, data)
+	}
+
+	// Receive respects the context
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	_, err := str.ReceiveDatagram(ctx)
+	require.ErrorIs(t, err, context.Canceled)
+}
+
+func TestDatagramSending(t *testing.T) {
+	var sendQueue [][]byte
+	errors := []error{nil, nil, assert.AnError}
+	client, _ := newStreamPair(t)
+
+	str := newStateTrackingStream(client, nil, func(b []byte) error {
+		sendQueue = append(sendQueue, b)
+		err := errors[0]
+		errors = errors[1:]
+		return err
+	})
+	require.NoError(t, str.SendDatagram([]byte("foo")))
+	require.NoError(t, str.SendDatagram([]byte("bar")))
+	require.ErrorIs(t, str.SendDatagram([]byte("baz")), assert.AnError)
+	require.Equal(t, [][]byte{[]byte("foo"), []byte("bar"), []byte("baz")}, sendQueue)
+
+	str.closeSend(net.ErrClosed)
+	require.ErrorIs(t, str.SendDatagram([]byte("foobar")), net.ErrClosed)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/stream.go b/electron/native/private-transport/third_party/quic-go/http3/stream.go
new file mode 100644
index 000000000..c08d014f7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/stream.go
@@ -0,0 +1,442 @@
+package http3
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptrace"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+
+	"github.com/quic-go/qpack"
+)
+
+type datagramStream interface {
+	io.ReadWriteCloser
+	CancelRead(quic.StreamErrorCode)
+	CancelWrite(quic.StreamErrorCode)
+	StreamID() quic.StreamID
+	Context() context.Context
+	SetDeadline(time.Time) error
+	SetReadDeadline(time.Time) error
+	SetWriteDeadline(time.Time) error
+	SetPriority(urgency int8, incremental bool)
+	TryWriteAll([]byte) error
+	SendDatagram(b []byte) error
+	ReceiveDatagram(ctx context.Context) ([]byte, error)
+
+	QUICStream() *quic.Stream
+}
+
+// A Stream is an HTTP/3 stream.
+//
+// When writing to and reading from the stream, data is framed in HTTP/3 DATA frames.
+type Stream struct {
+	datagramStream
+	conn        *rawConn
+	frameParser *frameParser
+
+	buf []byte // used as a temporary buffer when writing the HTTP/3 frame headers
+
+	bytesRemainingInFrame uint64
+
+	qlogger qlogwriter.Recorder
+
+	parseTrailer  func(io.Reader, *headersFrame) error
+	parsedTrailer bool
+}
+
+func newStream(
+	str datagramStream,
+	conn *rawConn,
+	trace *httptrace.ClientTrace,
+	parseTrailer func(io.Reader, *headersFrame) error,
+	qlogger qlogwriter.Recorder,
+) *Stream {
+	return &Stream{
+		datagramStream: str,
+		conn:           conn,
+		buf:            make([]byte, 16),
+		qlogger:        qlogger,
+		parseTrailer:   parseTrailer,
+		frameParser: &frameParser{
+			r:         &tracingReader{Reader: str, trace: trace},
+			streamID:  str.StreamID(),
+			closeConn: conn.CloseWithError,
+		},
+	}
+}
+
+func (s *Stream) Read(b []byte) (int, error) {
+	if s.bytesRemainingInFrame == 0 {
+	parseLoop:
+		for {
+			frame, err := s.frameParser.ParseNext(s.qlogger)
+			if err != nil {
+				if errors.Is(err, errPriorityUpdateForPush) {
+					s.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "")
+				}
+				return 0, err
+			}
+			switch f := frame.(type) {
+			case *dataFrame:
+				if s.parsedTrailer {
+					return 0, errors.New("DATA frame received after trailers")
+				}
+				s.bytesRemainingInFrame = f.Length
+				break parseLoop
+			case *headersFrame:
+				if s.parsedTrailer {
+					maybeQlogInvalidHeadersFrame(s.qlogger, s.StreamID(), f.Length)
+					return 0, errors.New("additional HEADERS frame received after trailers")
+				}
+				s.parsedTrailer = true
+				return 0, s.parseTrailer(s.datagramStream, f)
+			default:
+				s.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "")
+				// parseNextFrame skips over unknown frame types
+				// Therefore, this condition is only entered when we parsed another known frame type.
+				return 0, fmt.Errorf("peer sent an unexpected frame: %T", f)
+			}
+		}
+	}
+
+	var n int
+	var err error
+	if s.bytesRemainingInFrame < uint64(len(b)) {
+		n, err = s.datagramStream.Read(b[:s.bytesRemainingInFrame])
+	} else {
+		n, err = s.datagramStream.Read(b)
+	}
+	s.bytesRemainingInFrame -= uint64(n)
+	return n, err
+}
+
+func (s *Stream) hasMoreData() bool {
+	return s.bytesRemainingInFrame > 0
+}
+
+func (s *Stream) Write(b []byte) (int, error) {
+	s.buf = s.buf[:0]
+	s.buf = (&dataFrame{Length: uint64(len(b))}).Append(s.buf)
+	if s.qlogger != nil {
+		s.qlogger.RecordEvent(qlog.FrameCreated{
+			StreamID: s.StreamID(),
+			Raw: qlog.RawInfo{
+				Length:        len(s.buf) + len(b),
+				PayloadLength: len(b),
+			},
+			Frame: qlog.Frame{Frame: qlog.DataFrame{}},
+		})
+	}
+	if _, err := s.datagramStream.Write(s.buf); err != nil {
+		return 0, err
+	}
+	return s.datagramStream.Write(b)
+}
+
+// TryWriteAll writes b in a DATA frame if the entire frame can be queued immediately.
+// It returns [quic.ErrWouldBlock] without queueing anything otherwise.
+func (s *Stream) TryWriteAll(b []byte) error {
+	data := make([]byte, 0, frameHeaderLen+len(b))
+	data = (&dataFrame{Length: uint64(len(b))}).Append(data)
+	data = append(data, b...)
+	if err := s.datagramStream.TryWriteAll(data); err != nil {
+		return err
+	}
+	if s.qlogger != nil {
+		s.qlogger.RecordEvent(qlog.FrameCreated{
+			StreamID: s.StreamID(),
+			Raw: qlog.RawInfo{
+				Length:        len(data),
+				PayloadLength: len(b),
+			},
+			Frame: qlog.Frame{Frame: qlog.DataFrame{}},
+		})
+	}
+	return nil
+}
+
+func (s *Stream) writeUnframed(b []byte) (int, error) {
+	return s.datagramStream.Write(b)
+}
+
+func (s *Stream) StreamID() quic.StreamID {
+	return s.datagramStream.StreamID()
+}
+
+func (s *Stream) SendDatagram(b []byte) error {
+	// TODO: reject if datagrams are not negotiated (yet)
+	return s.datagramStream.SendDatagram(b)
+}
+
+func (s *Stream) ReceiveDatagram(ctx context.Context) ([]byte, error) {
+	// TODO: reject if datagrams are not negotiated (yet)
+	return s.datagramStream.ReceiveDatagram(ctx)
+}
+
+// A RequestStream is a low-level abstraction representing an HTTP/3 request stream.
+// It decouples sending of the HTTP request from reading the HTTP response, allowing
+// the application to optimistically use the stream (and, for example, send datagrams)
+// before receiving the response.
+//
+// This is only needed for advanced use case, e.g. WebTransport and the various
+// MASQUE proxying protocols.
+type RequestStream struct {
+	str *Stream
+
+	responseBody io.ReadCloser // set by ReadResponse
+
+	decoder            *qpack.Decoder
+	requestWriter      *requestWriter
+	maxHeaderBytes     int
+	reqDone            chan<- struct{}
+	disableCompression bool
+	response           *http.Response
+
+	sentRequest   bool
+	requestedGzip bool
+	isConnect     bool
+}
+
+func newRequestStream(
+	str *Stream,
+	requestWriter *requestWriter,
+	reqDone chan<- struct{},
+	decoder *qpack.Decoder,
+	disableCompression bool,
+	maxHeaderBytes int,
+	rsp *http.Response,
+) *RequestStream {
+	return &RequestStream{
+		str:                str,
+		requestWriter:      requestWriter,
+		reqDone:            reqDone,
+		decoder:            decoder,
+		disableCompression: disableCompression,
+		maxHeaderBytes:     maxHeaderBytes,
+		response:           rsp,
+	}
+}
+
+// Read reads data from the underlying stream.
+//
+// It can only be used after the request has been sent using [RequestStream.SendRequestHeader]
+// and [RequestStream.ReadResponse] has returned the response.
+func (s *RequestStream) Read(b []byte) (int, error) {
+	if s.responseBody == nil {
+		return 0, errors.New("http3: invalid use of RequestStream.Read before ReadResponse")
+	}
+	return s.responseBody.Read(b)
+}
+
+// StreamID returns the QUIC stream ID of the underlying QUIC stream.
+func (s *RequestStream) StreamID() quic.StreamID {
+	return s.str.StreamID()
+}
+
+// Write writes data to the stream.
+//
+// It can only be used after the request has been sent using [RequestStream.SendRequestHeader].
+func (s *RequestStream) Write(b []byte) (int, error) {
+	if !s.sentRequest {
+		return 0, errors.New("http3: invalid use of RequestStream.Write before SendRequestHeader")
+	}
+	return s.str.Write(b)
+}
+
+// TryWriteAll writes b if the entire DATA frame can be queued immediately.
+// It can only be used after the request has been sent using [RequestStream.SendRequestHeader].
+func (s *RequestStream) TryWriteAll(b []byte) error {
+	if !s.sentRequest {
+		return errors.New("http3: invalid use of RequestStream.TryWriteAll before SendRequestHeader")
+	}
+	return s.str.TryWriteAll(b)
+}
+
+// Close closes the send-direction of the stream.
+// It does not close the receive-direction of the stream.
+func (s *RequestStream) Close() error {
+	return s.str.Close()
+}
+
+// CancelRead aborts receiving on this stream.
+// See [quic.Stream.CancelRead] for more details.
+func (s *RequestStream) CancelRead(errorCode quic.StreamErrorCode) {
+	s.str.CancelRead(errorCode)
+}
+
+// CancelWrite aborts sending on this stream.
+// See [quic.Stream.CancelWrite] for more details.
+func (s *RequestStream) CancelWrite(errorCode quic.StreamErrorCode) {
+	s.str.CancelWrite(errorCode)
+}
+
+// Context returns a context derived from the underlying QUIC stream's context.
+// See [quic.Stream.Context] for more details.
+func (s *RequestStream) Context() context.Context {
+	return s.str.Context()
+}
+
+// SetReadDeadline sets the deadline for [RequestStream.Read] calls.
+func (s *RequestStream) SetReadDeadline(t time.Time) error {
+	return s.str.SetReadDeadline(t)
+}
+
+// SetWriteDeadline sets the deadline for [RequestStream.Write] calls.
+func (s *RequestStream) SetWriteDeadline(t time.Time) error {
+	return s.str.SetWriteDeadline(t)
+}
+
+// SetDeadline sets the read and write deadlines associated with the stream.
+// It is equivalent to calling both [RequestStream.SetReadDeadline] and [RequestStream.SetWriteDeadline].
+func (s *RequestStream) SetDeadline(t time.Time) error {
+	return s.str.SetDeadline(t)
+}
+
+// SendDatagram sends a new HTTP Datagram (RFC 9297).
+//
+// It is only possible to send datagrams if the server enabled support for this extension.
+// It is recommended (though not required) to send the request before calling this method,
+// as the server might drop datagrams which it can't associate with an existing request.
+func (s *RequestStream) SendDatagram(b []byte) error {
+	return s.str.SendDatagram(b)
+}
+
+// ReceiveDatagram receives HTTP Datagrams (RFC 9297).
+//
+// It is only possible if HTTP Datagram support was enabled using [Transport.EnableDatagrams].
+func (s *RequestStream) ReceiveDatagram(ctx context.Context) ([]byte, error) {
+	return s.str.ReceiveDatagram(ctx)
+}
+
+// SendRequestHeader sends the HTTP request.
+//
+// It can only be used for requests that don't have a request body.
+// It is invalid to call it more than once.
+func (s *RequestStream) SendRequestHeader(req *http.Request) error {
+	if req.Body != nil && req.Body != http.NoBody {
+		return errors.New("http3: invalid use of RequestStream.SendRequestHeader with a request that has a request body")
+	}
+	return s.sendRequestHeader(req)
+}
+
+func (s *RequestStream) sendRequestHeader(req *http.Request) error {
+	if s.sentRequest {
+		return errors.New("http3: invalid duplicate use of RequestStream.SendRequestHeader")
+	}
+	if !s.disableCompression && req.Method != http.MethodHead &&
+		req.Header.Get("Accept-Encoding") == "" && req.Header.Get("Range") == "" {
+		s.requestedGzip = true
+	}
+	s.isConnect = req.Method == http.MethodConnect
+	s.sentRequest = true
+	return s.requestWriter.WriteRequestHeader(s.str.datagramStream, req, s.requestedGzip, s.str.StreamID(), s.str.qlogger)
+}
+
+// sendRequestTrailer sends request trailers to the stream.
+// It should be called after the request body has been fully written.
+func (s *RequestStream) sendRequestTrailer(req *http.Request) error {
+	return s.requestWriter.WriteRequestTrailer(s.str.datagramStream, req, s.str.StreamID(), s.str.qlogger)
+}
+
+// ReadResponse reads the HTTP response from the stream.
+//
+// It must be called after sending the request using [RequestStream.SendRequestHeader].
+// It is invalid to call it more than once.
+// It doesn't set [http.Response.Request] or [http.Response.TLS].
+func (s *RequestStream) ReadResponse() (*http.Response, error) {
+	if !s.sentRequest {
+		return nil, errors.New("http3: invalid use of RequestStream.ReadResponse before SendRequestHeader")
+	}
+	frame, err := s.str.frameParser.ParseNext(s.str.qlogger)
+	if err != nil {
+		if errors.Is(err, errPriorityUpdateForPush) {
+			s.str.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "")
+			return nil, err
+		}
+		s.str.CancelRead(quic.StreamErrorCode(ErrCodeFrameError))
+		s.str.CancelWrite(quic.StreamErrorCode(ErrCodeFrameError))
+		return nil, fmt.Errorf("http3: parsing frame failed: %w", err)
+	}
+	hf, ok := frame.(*headersFrame)
+	if !ok {
+		s.str.conn.CloseWithError(quic.ApplicationErrorCode(ErrCodeFrameUnexpected), "expected first frame to be a HEADERS frame")
+		return nil, errors.New("http3: expected first frame to be a HEADERS frame")
+	}
+	if hf.Length > uint64(s.maxHeaderBytes) {
+		maybeQlogInvalidHeadersFrame(s.str.qlogger, s.str.StreamID(), hf.Length)
+		s.str.CancelRead(quic.StreamErrorCode(ErrCodeFrameError))
+		s.str.CancelWrite(quic.StreamErrorCode(ErrCodeFrameError))
+		return nil, fmt.Errorf("http3: HEADERS frame too large: %d bytes (max: %d)", hf.Length, s.maxHeaderBytes)
+	}
+	headerBlock := make([]byte, hf.Length)
+	if _, err := io.ReadFull(s.str.datagramStream, headerBlock); err != nil {
+		maybeQlogInvalidHeadersFrame(s.str.qlogger, s.str.StreamID(), hf.Length)
+		s.str.CancelRead(quic.StreamErrorCode(ErrCodeRequestIncomplete))
+		s.str.CancelWrite(quic.StreamErrorCode(ErrCodeRequestIncomplete))
+		return nil, fmt.Errorf("http3: failed to read response headers: %w", err)
+	}
+	decodeFn := s.decoder.Decode(headerBlock)
+	var hfs []qpack.HeaderField
+	if s.str.qlogger != nil {
+		hfs = make([]qpack.HeaderField, 0, 16)
+	}
+	res := s.response
+	err = updateResponseFromHeaders(res, decodeFn, s.maxHeaderBytes, &hfs)
+	if s.str.qlogger != nil {
+		qlogParsedHeadersFrame(s.str.qlogger, s.str.StreamID(), hf, hfs)
+	}
+	if err != nil {
+		errCode := ErrCodeMessageError
+		if _, ok := errors.AsType[*qpackError](err); ok {
+			errCode = ErrCodeQPACKDecompressionFailed
+		}
+		s.str.CancelRead(quic.StreamErrorCode(errCode))
+		s.str.CancelWrite(quic.StreamErrorCode(errCode))
+		return nil, fmt.Errorf("http3: invalid response: %w", err)
+	}
+
+	// Check that the server doesn't send more data in DATA frames than indicated by the Content-Length header (if set).
+	// See section 4.1.2 of RFC 9114.
+	respBody := newResponseBody(s.str, res.ContentLength, s.reqDone)
+
+	// Rules for when to set Content-Length are defined in https://tools.ietf.org/html/rfc7230#section-3.3.2.
+	isInformational := res.StatusCode >= 100 && res.StatusCode < 200
+	isNoContent := res.StatusCode == http.StatusNoContent
+	isSuccessfulConnect := s.isConnect && res.StatusCode >= 200 && res.StatusCode < 300
+	if (isInformational || isNoContent || isSuccessfulConnect) && res.ContentLength == -1 {
+		res.ContentLength = 0
+	}
+	if s.requestedGzip && !isSuccessfulConnect && res.Header.Get("Content-Encoding") == "gzip" {
+		res.Header.Del("Content-Encoding")
+		res.Header.Del("Content-Length")
+		res.ContentLength = -1
+		s.responseBody = newGzipReader(respBody)
+		res.Uncompressed = true
+	} else {
+		s.responseBody = respBody
+	}
+	res.Body = s.responseBody
+	return res, nil
+}
+
+type tracingReader struct {
+	io.Reader
+	readFirst bool
+	trace     *httptrace.ClientTrace
+}
+
+func (r *tracingReader) Read(b []byte) (int, error) {
+	n, err := r.Reader.Read(b)
+	if n > 0 && !r.readFirst {
+		traceGotFirstResponseByte(r.trace)
+		r.readFirst = true
+	}
+	return n, err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/stream_test.go b/electron/native/private-transport/third_party/quic-go/http3/stream_test.go
new file mode 100644
index 000000000..b8c97391e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/stream_test.go
@@ -0,0 +1,266 @@
+package http3
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"math"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httptrace"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/quic-go/qpack"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func getDataFrame(data []byte) []byte {
+	b := (&dataFrame{Length: uint64(len(data))}).Append(nil)
+	return append(b, data...)
+}
+
+func TestStreamReadDataFrames(t *testing.T) {
+	var buf bytes.Buffer
+	mockCtrl := gomock.NewController(t)
+	qstr := NewMockDatagramStream(mockCtrl)
+	qstr.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	qstr.EXPECT().Write(gomock.Any()).DoAndReturn(buf.Write).AnyTimes()
+	qstr.EXPECT().Read(gomock.Any()).DoAndReturn(buf.Read).AnyTimes()
+
+	var eventRecorder events.Recorder
+	clientConn, _ := newConnPair(t, withClientRecorder(&eventRecorder))
+	str := newStream(
+		qstr,
+		newRawConn(clientConn, false, nil, nopControlStrHandler, &eventRecorder, nil),
+		nil,
+		func(io.Reader, *headersFrame) error { return nil },
+		&eventRecorder,
+	)
+
+	buf.Write(getDataFrame([]byte("foobar")))
+	b := make([]byte, 3)
+	n, err := str.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 3, n)
+	require.Equal(t, []byte("foo"), b)
+	n, err = str.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 3, n)
+	require.Equal(t, []byte("bar"), b)
+
+	expectedLen, _ := expectedFrameLength(t, &dataFrame{Length: 6})
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.FrameParsed{
+				StreamID: 42,
+				Raw:      qlog.RawInfo{Length: expectedLen, PayloadLength: 6},
+				Frame:    qlog.Frame{Frame: qlog.DataFrame{}},
+			},
+		},
+		eventRecorder.Events(qlog.FrameParsed{}),
+	)
+	eventRecorder.Clear()
+
+	buf.Write(getDataFrame([]byte("baz")))
+	b = make([]byte, 10)
+	n, err = str.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 3, n)
+	require.Equal(t, []byte("baz"), b[:n])
+	require.Len(t, eventRecorder.Events(qlog.FrameParsed{}), 1)
+	eventRecorder.Clear()
+
+	buf.Write(getDataFrame([]byte("lorem")))
+	buf.Write(getDataFrame([]byte("ipsum")))
+
+	data, err := io.ReadAll(str)
+	require.NoError(t, err)
+	require.Equal(t, "loremipsum", string(data))
+	require.Len(t, eventRecorder.Events(qlog.FrameParsed{}), 2)
+	eventRecorder.Clear()
+
+	// invalid frame
+	buf.Write([]byte("invalid"))
+	_, err = str.Read([]byte{0})
+	require.Error(t, err)
+}
+
+func TestStreamInvalidFrame(t *testing.T) {
+	var buf bytes.Buffer
+	b := (&settingsFrame{}).Append(nil)
+	buf.Write(b)
+
+	mockCtrl := gomock.NewController(t)
+	qstr := NewMockDatagramStream(mockCtrl)
+	qstr.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	qstr.EXPECT().Write(gomock.Any()).DoAndReturn(buf.Write).AnyTimes()
+	qstr.EXPECT().Read(gomock.Any()).DoAndReturn(buf.Read).AnyTimes()
+	clientConn, serverConn := newConnPair(t)
+
+	str := newStream(
+		qstr,
+		newRawConn(clientConn, false, nil, nopControlStrHandler, nil, nil),
+		nil,
+		func(io.Reader, *headersFrame) error { return nil },
+		nil,
+	)
+
+	_, err := str.Read([]byte{0})
+	require.ErrorContains(t, err, "peer sent an unexpected frame")
+
+	select {
+	case <-serverConn.Context().Done():
+		var appErr *quic.ApplicationError
+		require.ErrorAs(t, context.Cause(serverConn.Context()), &appErr)
+		require.Equal(t, quic.ApplicationErrorCode(ErrCodeFrameUnexpected), appErr.ErrorCode)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestStreamWrite(t *testing.T) {
+	var buf bytes.Buffer
+	mockCtrl := gomock.NewController(t)
+	qstr := NewMockDatagramStream(mockCtrl)
+	qstr.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	qstr.EXPECT().Write(gomock.Any()).DoAndReturn(buf.Write).AnyTimes()
+	var eventRecorder events.Recorder
+	str := newStream(qstr, nil, nil, func(io.Reader, *headersFrame) error { return nil }, &eventRecorder)
+	str.Write([]byte("foo"))
+	str.Write([]byte("foobar"))
+
+	fp := frameParser{r: &buf}
+	f, err := fp.ParseNext(nil)
+	require.NoError(t, err)
+	f1Len, f1PayloadLen := expectedFrameLength(t, &dataFrame{Length: 3})
+	require.Equal(t, &dataFrame{Length: 3}, f)
+	b := make([]byte, 3)
+	_, err = io.ReadFull(&buf, b)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foo"), b)
+
+	fp = frameParser{r: &buf}
+	f, err = fp.ParseNext(nil)
+	require.NoError(t, err)
+	f2Len, f2PayloadLen := expectedFrameLength(t, &dataFrame{Length: 6})
+	require.Equal(t, &dataFrame{Length: 6}, f)
+	b = make([]byte, 6)
+	_, err = io.ReadFull(&buf, b)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), b)
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.FrameCreated{
+				StreamID: 42,
+				Raw:      qlog.RawInfo{Length: f1Len, PayloadLength: f1PayloadLen},
+				Frame:    qlog.Frame{Frame: qlog.DataFrame{}},
+			},
+			qlog.FrameCreated{
+				StreamID: 42,
+				Raw:      qlog.RawInfo{Length: f2Len, PayloadLength: f2PayloadLen},
+				Frame:    qlog.Frame{Frame: qlog.DataFrame{}},
+			},
+		},
+		eventRecorder.Events(qlog.FrameCreated{}),
+	)
+}
+
+func TestStreamTryWriteAll(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	qstr := NewMockDatagramStream(mockCtrl)
+	qstr.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	qstr.EXPECT().TryWriteAll(getDataFrame([]byte("foobar"))).Return(nil)
+	qstr.EXPECT().TryWriteAll(getDataFrame([]byte("blocked"))).Return(quic.ErrWouldBlock)
+
+	var eventRecorder events.Recorder
+	str := newStream(qstr, nil, nil, func(io.Reader, *headersFrame) error { return nil }, &eventRecorder)
+	require.NoError(t, str.TryWriteAll([]byte("foobar")))
+	require.ErrorIs(t, str.TryWriteAll([]byte("blocked")), quic.ErrWouldBlock)
+
+	frameLen, payloadLen := expectedFrameLength(t, &dataFrame{Length: 6})
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.FrameCreated{
+				StreamID: 42,
+				Raw:      qlog.RawInfo{Length: frameLen, PayloadLength: payloadLen},
+				Frame:    qlog.Frame{Frame: qlog.DataFrame{}},
+			},
+		},
+		eventRecorder.Events(qlog.FrameCreated{}),
+	)
+}
+
+func TestRequestStream(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	qstr := NewMockDatagramStream(mockCtrl)
+	qstr.EXPECT().StreamID().Return(quic.StreamID(42)).AnyTimes()
+	requestWriter := newRequestWriter()
+	clientConn, _ := newConnPair(t)
+	str := newRequestStream(
+		newStream(
+			qstr,
+			newRawConn(clientConn, false, nil, nopControlStrHandler, nil, nil),
+			&httptrace.ClientTrace{},
+			func(io.Reader, *headersFrame) error { return nil },
+			nil,
+		),
+		requestWriter,
+		make(chan struct{}),
+		qpack.NewDecoder(),
+		true,
+		math.MaxInt,
+		&http.Response{},
+	)
+
+	_, err := str.Read([]byte{0})
+	require.EqualError(t, err, "http3: invalid use of RequestStream.Read before ReadResponse")
+	_, err = str.Write([]byte{0})
+	require.EqualError(t, err, "http3: invalid use of RequestStream.Write before SendRequestHeader")
+	require.EqualError(t,
+		str.TryWriteAll([]byte{0}),
+		"http3: invalid use of RequestStream.TryWriteAll before SendRequestHeader",
+	)
+
+	// calling ReadResponse before SendRequestHeader is not valid
+	_, err = str.ReadResponse()
+	require.EqualError(t, err, "http3: invalid use of RequestStream.ReadResponse before SendRequestHeader")
+	// SendRequestHeader can't be used for requests that have a request body
+	require.EqualError(t,
+		str.SendRequestHeader(
+			httptest.NewRequest(http.MethodGet, "https://quic-go.net", strings.NewReader("foobar")),
+		),
+		"http3: invalid use of RequestStream.SendRequestHeader with a request that has a request body",
+	)
+
+	req := httptest.NewRequest(http.MethodGet, "https://quic-go.net", nil)
+	qstr.EXPECT().Write(gomock.Any()).AnyTimes()
+	require.NoError(t, str.SendRequestHeader(req))
+	// duplicate calls are not allowed
+	require.EqualError(t, str.SendRequestHeader(req), "http3: invalid duplicate use of RequestStream.SendRequestHeader")
+	qstr.EXPECT().TryWriteAll(getDataFrame([]byte("request body"))).Return(nil)
+	require.NoError(t, str.TryWriteAll([]byte("request body")))
+
+	buf := bytes.NewBuffer(encodeResponse(t, http.StatusOK))
+	buf.Write((&dataFrame{Length: 6}).Append(nil))
+	buf.Write([]byte("foobar"))
+	qstr.EXPECT().Read(gomock.Any()).DoAndReturn(buf.Read).AnyTimes()
+	rsp, err := str.ReadResponse()
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, rsp.StatusCode)
+
+	b := make([]byte, 10)
+	n, err := str.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 6, n)
+	require.Equal(t, []byte("foobar"), b[:n])
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/trace.go b/electron/native/private-transport/third_party/quic-go/http3/trace.go
new file mode 100644
index 000000000..2bc70017a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/trace.go
@@ -0,0 +1,105 @@
+package http3
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http/httptrace"
+	"net/textproto"
+	"time"
+
+	"github.com/quic-go/quic-go"
+)
+
+func traceGetConn(trace *httptrace.ClientTrace, hostPort string) {
+	if trace != nil && trace.GetConn != nil {
+		trace.GetConn(hostPort)
+	}
+}
+
+// fakeConn is a wrapper for quic.EarlyConnection
+// because the quic connection does not implement net.Conn.
+type fakeConn struct {
+	conn *quic.Conn
+}
+
+func (c *fakeConn) Close() error                       { panic("connection operation prohibited") }
+func (c *fakeConn) Read(p []byte) (int, error)         { panic("connection operation prohibited") }
+func (c *fakeConn) Write(p []byte) (int, error)        { panic("connection operation prohibited") }
+func (c *fakeConn) SetDeadline(t time.Time) error      { panic("connection operation prohibited") }
+func (c *fakeConn) SetReadDeadline(t time.Time) error  { panic("connection operation prohibited") }
+func (c *fakeConn) SetWriteDeadline(t time.Time) error { panic("connection operation prohibited") }
+func (c *fakeConn) RemoteAddr() net.Addr               { return c.conn.RemoteAddr() }
+func (c *fakeConn) LocalAddr() net.Addr                { return c.conn.LocalAddr() }
+
+func traceGotConn(trace *httptrace.ClientTrace, conn *quic.Conn, reused bool) {
+	if trace != nil && trace.GotConn != nil {
+		trace.GotConn(httptrace.GotConnInfo{
+			Conn:   &fakeConn{conn: conn},
+			Reused: reused,
+		})
+	}
+}
+
+func traceGotFirstResponseByte(trace *httptrace.ClientTrace) {
+	if trace != nil && trace.GotFirstResponseByte != nil {
+		trace.GotFirstResponseByte()
+	}
+}
+
+func traceGot1xxResponse(trace *httptrace.ClientTrace, code int, header textproto.MIMEHeader) {
+	if trace != nil && trace.Got1xxResponse != nil {
+		trace.Got1xxResponse(code, header)
+	}
+}
+
+func traceGot100Continue(trace *httptrace.ClientTrace) {
+	if trace != nil && trace.Got100Continue != nil {
+		trace.Got100Continue()
+	}
+}
+
+func traceHasWroteHeaderField(trace *httptrace.ClientTrace) bool {
+	return trace != nil && trace.WroteHeaderField != nil
+}
+
+func traceWroteHeaderField(trace *httptrace.ClientTrace, k, v string) {
+	if trace != nil && trace.WroteHeaderField != nil {
+		trace.WroteHeaderField(k, []string{v})
+	}
+}
+
+func traceWroteHeaders(trace *httptrace.ClientTrace) {
+	if trace != nil && trace.WroteHeaders != nil {
+		trace.WroteHeaders()
+	}
+}
+
+func traceWroteRequest(trace *httptrace.ClientTrace, err error) {
+	if trace != nil && trace.WroteRequest != nil {
+		trace.WroteRequest(httptrace.WroteRequestInfo{Err: err})
+	}
+}
+
+func traceConnectStart(trace *httptrace.ClientTrace, network, addr string) {
+	if trace != nil && trace.ConnectStart != nil {
+		trace.ConnectStart(network, addr)
+	}
+}
+
+func traceConnectDone(trace *httptrace.ClientTrace, network, addr string, err error) {
+	if trace != nil && trace.ConnectDone != nil {
+		trace.ConnectDone(network, addr, err)
+	}
+}
+
+func traceTLSHandshakeStart(trace *httptrace.ClientTrace) {
+	if trace != nil && trace.TLSHandshakeStart != nil {
+		trace.TLSHandshakeStart()
+	}
+}
+
+func traceTLSHandshakeDone(trace *httptrace.ClientTrace, state tls.ConnectionState, err error) {
+	if trace != nil && trace.TLSHandshakeDone != nil {
+		trace.TLSHandshakeDone(state, err)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/transport.go b/electron/native/private-transport/third_party/quic-go/http3/transport.go
new file mode 100644
index 000000000..e3e64ccd3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/transport.go
@@ -0,0 +1,539 @@
+package http3
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httptrace"
+	"net/url"
+	"strings"
+	"sync"
+	"sync/atomic"
+
+	"golang.org/x/net/http/httpguts"
+
+	"github.com/quic-go/quic-go"
+)
+
+// Settings are HTTP/3 settings that apply to the underlying connection.
+type Settings struct {
+	// Support for HTTP/3 datagrams (RFC 9297)
+	EnableDatagrams bool
+	// Extended CONNECT, RFC 9220
+	EnableExtendedConnect bool
+	// Other settings, defined by the application
+	Other map[uint64]uint64
+}
+
+// RoundTripOpt contains options for [Transport.RoundTripOpt].
+type RoundTripOpt struct {
+	// OnlyCachedConn controls whether the Transport may create a new QUIC connection.
+	// If true and no cached connection is available, [Transport.RoundTripOpt] returns [ErrNoCachedConn].
+	OnlyCachedConn bool
+}
+
+type clientConn interface {
+	OpenRequestStream(context.Context) (*RequestStream, error)
+	RoundTrip(*http.Request) (*http.Response, error)
+	handleUnidirectionalStream(*quic.ReceiveStream)
+}
+
+type roundTripperWithCount struct {
+	cancel     context.CancelFunc
+	dialing    chan struct{} // closed as soon as quic.Dial(Early) returned
+	dialErr    error
+	conn       *quic.Conn
+	clientConn clientConn
+
+	useCount atomic.Int64
+}
+
+func (r *roundTripperWithCount) Close() error {
+	r.cancel()
+	<-r.dialing
+	if r.conn != nil {
+		return r.conn.CloseWithError(0, "")
+	}
+	return nil
+}
+
+// Transport implements the [http.RoundTripper] interface.
+type Transport struct {
+	// TLSClientConfig specifies the TLS configuration to use with
+	// [tls.Client]. If nil, the default configuration is used.
+	TLSClientConfig *tls.Config
+
+	// QUICConfig is the [quic.Config] used for dialing new connections.
+	// If nil, reasonable default values will be used.
+	QUICConfig *quic.Config
+
+	// Dial specifies an optional dial function for creating QUIC
+	// connections for requests.
+	// If [Transport.Dial] is nil, a [net.UDPConn] will be created at the first request
+	// and will be reused for subsequent connections to other servers.
+	Dial func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error)
+
+	// Enable support for HTTP/3 datagrams (RFC 9297).
+	// If [Transport.QUICConfig] is set, [quic.Config.EnableDatagrams] must also be enabled.
+	EnableDatagrams bool
+
+	// Additional HTTP/3 settings.
+	// It is invalid to specify any settings defined by RFC 9114 (HTTP/3) and RFC 9297 (HTTP Datagrams).
+	AdditionalSettings map[uint64]uint64
+
+	// MaxResponseHeaderBytes specifies a limit on how many response bytes are
+	// allowed in the server's response header.
+	// Zero means to use a default limit.
+	MaxResponseHeaderBytes int
+
+	// DisableCompression, if true, prevents the Transport from requesting compression with an
+	// "Accept-Encoding: gzip" request header when the Request contains no existing Accept-Encoding value.
+	// If the Transport requests gzip on its own and gets a gzipped response, it's transparently
+	// decoded in the Response.Body.
+	// However, if the user explicitly requested gzip it is not automatically uncompressed.
+	DisableCompression bool
+
+	Logger *slog.Logger
+
+	mutex sync.Mutex
+
+	initOnce sync.Once
+	initErr  error
+
+	newClientConn func(*quic.Conn) clientConn
+
+	clients   map[string]*roundTripperWithCount
+	transport *quic.Transport
+	closed    bool
+}
+
+var (
+	_ http.RoundTripper = &Transport{}
+	_ io.Closer         = &Transport{}
+)
+
+var (
+	// ErrNoCachedConn is returned by [Transport.RoundTripOpt] when [RoundTripOpt.OnlyCachedConn]
+	// is true and no cached connection is available.
+	ErrNoCachedConn = errors.New("http3: no cached connection was available")
+	// ErrTransportClosed is returned by [Transport.RoundTrip] and [Transport.RoundTripOpt]
+	// after the transport is closed.
+	ErrTransportClosed = errors.New("http3: transport is closed")
+)
+
+func (t *Transport) init() error {
+	if t.newClientConn == nil {
+		t.newClientConn = func(conn *quic.Conn) clientConn {
+			return newClientConn(
+				conn,
+				t.EnableDatagrams,
+				t.AdditionalSettings,
+				t.MaxResponseHeaderBytes,
+				t.DisableCompression,
+				t.Logger,
+			)
+		}
+	}
+	if t.QUICConfig == nil {
+		t.QUICConfig = defaultQuicConfig.Clone()
+		t.QUICConfig.EnableDatagrams = t.EnableDatagrams
+	}
+	if t.EnableDatagrams && !t.QUICConfig.EnableDatagrams {
+		return errors.New("HTTP Datagrams enabled, but QUIC Datagrams disabled")
+	}
+	if len(t.QUICConfig.Versions) == 0 {
+		t.QUICConfig = t.QUICConfig.Clone()
+		t.QUICConfig.Versions = []quic.Version{quic.SupportedVersions()[0]}
+	}
+	if len(t.QUICConfig.Versions) != 1 {
+		return errors.New("can only use a single QUIC version for dialing a HTTP/3 connection")
+	}
+	if t.QUICConfig.MaxIncomingStreams == 0 {
+		t.QUICConfig.MaxIncomingStreams = -1 // don't allow any bidirectional streams
+	}
+	if t.Dial == nil {
+		udpConn, err := net.ListenUDP("udp", nil)
+		if err != nil {
+			return err
+		}
+		t.transport = &quic.Transport{Conn: udpConn}
+	}
+	return nil
+}
+
+// RoundTripOpt is like [Transport.RoundTrip], but takes options.
+func (t *Transport) RoundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Response, error) {
+	rsp, err := t.roundTripOpt(req, opt)
+	if err != nil {
+		if req.Body != nil {
+			req.Body.Close()
+		}
+		return nil, err
+	}
+	return rsp, nil
+}
+
+func (t *Transport) roundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Response, error) {
+	t.initOnce.Do(func() { t.initErr = t.init() })
+	if t.initErr != nil {
+		return nil, t.initErr
+	}
+
+	if req.URL == nil {
+		return nil, errors.New("http3: nil Request.URL")
+	}
+	if req.URL.Scheme != "https" {
+		return nil, fmt.Errorf("http3: unsupported protocol scheme: %s", req.URL.Scheme)
+	}
+	if req.URL.Host == "" {
+		return nil, errors.New("http3: no Host in request URL")
+	}
+	if req.Header == nil {
+		return nil, errors.New("http3: nil Request.Header")
+	}
+	if req.Method != "" && !validMethod(req.Method) {
+		return nil, fmt.Errorf("http3: invalid method %q", req.Method)
+	}
+	for k, vv := range req.Header {
+		if !httpguts.ValidHeaderFieldName(k) {
+			return nil, fmt.Errorf("http3: invalid http header field name %q", k)
+		}
+		for _, v := range vv {
+			if !httpguts.ValidHeaderFieldValue(v) {
+				return nil, fmt.Errorf("http3: invalid http header field value for key %q", k)
+			}
+		}
+	}
+
+	return t.doRoundTripOpt(req, opt, false)
+}
+
+func (t *Transport) doRoundTripOpt(req *http.Request, opt RoundTripOpt, isRetried bool) (*http.Response, error) {
+	hostname := authorityAddr(hostnameFromURL(req.URL))
+	trace := httptrace.ContextClientTrace(req.Context())
+	traceGetConn(trace, hostname)
+	cl, isReused, err := t.getClient(req.Context(), hostname, opt.OnlyCachedConn)
+	if err != nil {
+		return nil, err
+	}
+
+	select {
+	case <-cl.dialing:
+	case <-req.Context().Done():
+		return nil, context.Cause(req.Context())
+	}
+
+	if cl.dialErr != nil {
+		t.removeClient(hostname)
+		return nil, cl.dialErr
+	}
+	defer cl.useCount.Add(-1)
+	traceGotConn(trace, cl.conn, isReused)
+	rsp, err := cl.clientConn.RoundTrip(req)
+	if err != nil {
+		// request aborted due to context cancellation
+		select {
+		case <-req.Context().Done():
+			return nil, err
+		default:
+		}
+		if isRetried {
+			return nil, err
+		}
+
+		t.removeClient(hostname)
+		req, err = canRetryRequest(err, req)
+		if err != nil {
+			return nil, err
+		}
+		return t.doRoundTripOpt(req, opt, true)
+	}
+	return rsp, nil
+}
+
+func canRetryRequest(err error, req *http.Request) (*http.Request, error) {
+	// error occurred while opening the stream, we can be sure that the request wasn't sent out
+	if _, ok := errors.AsType[*errConnUnusable](err); ok {
+		return req, nil
+	}
+
+	// If the request stream is reset, we can only be sure that the request wasn't processed
+	// if the error code is H3_REQUEST_REJECTED.
+	e, ok := errors.AsType[*Error](err)
+	if !ok || e.ErrorCode != ErrCodeRequestRejected {
+		return nil, err
+	}
+	// if the body is nil (or http.NoBody), it's safe to reuse this request and its body
+	if req.Body == nil || req.Body == http.NoBody {
+		return req, nil
+	}
+	// if the request body can be reset back to its original state via req.GetBody, do that
+	if req.GetBody != nil {
+		newBody, err := req.GetBody()
+		if err != nil {
+			return nil, err
+		}
+		reqCopy := *req
+		reqCopy.Body = newBody
+		req = &reqCopy
+		return &reqCopy, nil
+	}
+	return nil, fmt.Errorf("http3: Transport: cannot retry err [%w] after Request.Body was written; define Request.GetBody to avoid this error", err)
+}
+
+// RoundTrip does a round trip.
+func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
+	return t.RoundTripOpt(req, RoundTripOpt{})
+}
+
+func (t *Transport) getClient(ctx context.Context, hostname string, onlyCached bool) (rtc *roundTripperWithCount, isReused bool, err error) {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+	if t.closed {
+		return nil, false, ErrTransportClosed
+	}
+
+	if t.clients == nil {
+		t.clients = make(map[string]*roundTripperWithCount)
+	}
+
+	cl, ok := t.clients[hostname]
+	if !ok {
+		if onlyCached {
+			return nil, false, ErrNoCachedConn
+		}
+		ctx, cancel := context.WithCancel(ctx)
+		cl = &roundTripperWithCount{
+			dialing: make(chan struct{}),
+			cancel:  cancel,
+		}
+		go func() {
+			defer close(cl.dialing)
+			defer cancel()
+			conn, rt, err := t.dial(ctx, hostname)
+			if err != nil {
+				cl.dialErr = err
+				return
+			}
+			cl.conn = conn
+			cl.clientConn = rt
+		}()
+		t.clients[hostname] = cl
+	}
+	select {
+	case <-cl.dialing:
+		if cl.dialErr != nil {
+			delete(t.clients, hostname)
+			return nil, false, cl.dialErr
+		}
+		select {
+		case <-cl.conn.HandshakeComplete():
+			isReused = true
+		default:
+		}
+	default:
+	}
+	cl.useCount.Add(1)
+	return cl, isReused, nil
+}
+
+func (t *Transport) dial(ctx context.Context, hostname string) (*quic.Conn, clientConn, error) {
+	var tlsConf *tls.Config
+	if t.TLSClientConfig == nil {
+		tlsConf = &tls.Config{}
+	} else {
+		tlsConf = t.TLSClientConfig.Clone()
+	}
+	if tlsConf.ServerName == "" {
+		sni, _, err := net.SplitHostPort(hostname)
+		if err != nil {
+			// It's ok if net.SplitHostPort returns an error - it could be a hostname/IP address without a port.
+			sni = hostname
+		}
+		tlsConf.ServerName = sni
+	}
+	// Replace existing ALPNs by H3
+	tlsConf.NextProtos = []string{NextProtoH3}
+
+	dial := t.Dial
+	if dial == nil {
+		dial = func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
+			network := "udp"
+			udpAddr, err := t.resolveUDPAddr(ctx, network, addr)
+			if err != nil {
+				return nil, err
+			}
+			trace := httptrace.ContextClientTrace(ctx)
+			traceConnectStart(trace, network, udpAddr.String())
+			traceTLSHandshakeStart(trace)
+			conn, err := t.transport.DialEarly(ctx, udpAddr, tlsCfg, cfg)
+			var state tls.ConnectionState
+			if conn != nil {
+				state = conn.ConnectionState().TLS
+			}
+			traceTLSHandshakeDone(trace, state, err)
+			traceConnectDone(trace, network, udpAddr.String(), err)
+			return conn, err
+		}
+	}
+	conn, err := dial(ctx, hostname, tlsConf, t.QUICConfig)
+	if err != nil {
+		return nil, nil, err
+	}
+	clientConn := t.newClientConn(conn)
+	go func() {
+		for {
+			str, err := conn.AcceptUniStream(context.Background())
+			if err != nil {
+				return
+			}
+			go clientConn.handleUnidirectionalStream(str)
+		}
+	}()
+	return conn, clientConn, nil
+}
+
+func (t *Transport) resolveUDPAddr(ctx context.Context, network, addr string) (*net.UDPAddr, error) {
+	host, portStr, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, err
+	}
+	port, err := net.LookupPort(network, portStr)
+	if err != nil {
+		return nil, err
+	}
+	resolver := net.DefaultResolver
+	ipAddrs, err := resolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		return nil, err
+	}
+	addrs := addrList(ipAddrs)
+	ip := addrs.forResolve(network, addr)
+	return &net.UDPAddr{IP: ip.IP, Port: port, Zone: ip.Zone}, nil
+}
+
+func (t *Transport) removeClient(hostname string) {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+	if t.clients == nil {
+		return
+	}
+	delete(t.clients, hostname)
+}
+
+// NewClientConn creates a new HTTP/3 client connection on top of a QUIC connection.
+// Most users should use [Transport.RoundTrip] instead of creating a connection directly.
+// Specifically, it is not needed to perform GET, POST, HEAD and CONNECT requests.
+//
+// Obtaining a [ClientConn] is only needed for more advanced use cases, such as
+// using Extended CONNECT for WebTransport or the various MASQUE protocols.
+func (t *Transport) NewClientConn(conn *quic.Conn) *ClientConn {
+	c := newClientConn(
+		conn,
+		t.EnableDatagrams,
+		t.AdditionalSettings,
+		t.MaxResponseHeaderBytes,
+		t.DisableCompression,
+		t.Logger,
+	)
+	go func() {
+		for {
+			str, err := conn.AcceptUniStream(context.Background())
+			if err != nil {
+				return
+			}
+			go c.handleUnidirectionalStream(str)
+		}
+	}()
+	return c
+}
+
+// NewRawClientConn creates a new low-level HTTP/3 client connection on top of a QUIC connection.
+// Unlike [Transport.NewClientConn], the returned [RawClientConn] allows the application to take control
+// of the stream accept loops by calling [RawClientConn.HandleUnidirectionalStream] for incoming
+// unidirectional streams and [ClientConn.HandleBidirectionalStream] for incoming bidirectional streams.
+func (t *Transport) NewRawClientConn(conn *quic.Conn) *RawClientConn {
+	return &RawClientConn{
+		ClientConn: newClientConn(
+			conn,
+			t.EnableDatagrams,
+			t.AdditionalSettings,
+			t.MaxResponseHeaderBytes,
+			t.DisableCompression,
+			t.Logger,
+		),
+	}
+}
+
+// Close closes the QUIC connections that this Transport has used.
+// A Transport cannot be used after it has been closed.
+func (t *Transport) Close() error {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+	for _, cl := range t.clients {
+		if err := cl.Close(); err != nil {
+			return err
+		}
+	}
+	t.clients = nil
+	if t.transport != nil {
+		if err := t.transport.Close(); err != nil {
+			return err
+		}
+		if err := t.transport.Conn.Close(); err != nil {
+			return err
+		}
+		t.transport = nil
+	}
+	t.closed = true
+	return nil
+}
+
+func hostnameFromURL(url *url.URL) string {
+	if url != nil {
+		return url.Host
+	}
+	return ""
+}
+
+func validMethod(method string) bool {
+	/*
+				     Method         = "OPTIONS"                ; Section 9.2
+		   		                    | "GET"                    ; Section 9.3
+		   		                    | "HEAD"                   ; Section 9.4
+		   		                    | "POST"                   ; Section 9.5
+		   		                    | "PUT"                    ; Section 9.6
+		   		                    | "DELETE"                 ; Section 9.7
+		   		                    | "TRACE"                  ; Section 9.8
+		   		                    | "CONNECT"                ; Section 9.9
+		   		                    | extension-method
+		   		   extension-method = token
+		   		     token          = 1*<any CHAR except CTLs or separators>
+	*/
+	return len(method) > 0 && strings.IndexFunc(method, isNotToken) == -1
+}
+
+// copied from net/http/http.go
+func isNotToken(r rune) bool {
+	return !httpguts.IsTokenRune(r)
+}
+
+// CloseIdleConnections closes any QUIC connections in the transport's pool that are currently idle.
+// An idle connection is one that was previously used for requests but is now sitting unused.
+// This method does not interrupt any connections currently in use.
+// It also does not affect connections obtained via [Transport.NewClientConn].
+func (t *Transport) CloseIdleConnections() {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+	for hostname, cl := range t.clients {
+		if cl.useCount.Load() == 0 {
+			cl.Close()
+			delete(t.clients, hostname)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/http3/transport_test.go b/electron/native/private-transport/third_party/quic-go/http3/transport_test.go
new file mode 100644
index 000000000..e1b63b3fb
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/http3/transport_test.go
@@ -0,0 +1,572 @@
+package http3
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+type mockBody struct {
+	reader   bytes.Reader
+	readErr  error
+	closeErr error
+	closed   bool
+}
+
+// make sure the mockBody can be used as a http.Request.Body
+var _ io.ReadCloser = &mockBody{}
+
+func (m *mockBody) Read(p []byte) (int, error) {
+	if m.readErr != nil {
+		return 0, m.readErr
+	}
+	return m.reader.Read(p)
+}
+
+func (m *mockBody) SetData(data []byte) {
+	m.reader = *bytes.NewReader(data)
+}
+
+func (m *mockBody) Close() error {
+	m.closed = true
+	return m.closeErr
+}
+
+func TestRequestValidation(t *testing.T) {
+	var tr Transport
+
+	for _, tt := range []struct {
+		name                string
+		req                 *http.Request
+		expectedErr         string
+		expectedErrContains string
+	}{
+		{
+			name:        "plain HTTP",
+			req:         httptest.NewRequest(http.MethodGet, "http://www.example.org/", nil),
+			expectedErr: "http3: unsupported protocol scheme: http",
+		},
+		{
+			name: "missing URL",
+			req: func() *http.Request {
+				r := httptest.NewRequest(http.MethodGet, "https://www.example.org/", nil)
+				r.URL = nil
+				return r
+			}(),
+			expectedErr: "http3: nil Request.URL",
+		},
+		{
+			name: "missing URL Host",
+			req: func() *http.Request {
+				r := httptest.NewRequest(http.MethodGet, "https://www.example.org/", nil)
+				r.URL.Host = ""
+				return r
+			}(),
+			expectedErr: "http3: no Host in request URL",
+		},
+		{
+			name: "missing header",
+			req: func() *http.Request {
+				r := httptest.NewRequest(http.MethodGet, "https://www.example.org/", nil)
+				r.Header = nil
+				return r
+			}(),
+			expectedErr: "http3: nil Request.Header",
+		},
+		{
+			name: "invalid header name",
+			req: func() *http.Request {
+				r := httptest.NewRequest(http.MethodGet, "https://www.example.org/", nil)
+				r.Header.Add("foobär", "value")
+				return r
+			}(),
+			expectedErr: "http3: invalid http header field name \"foobär\"",
+		},
+		{
+			name: "invalid header value",
+			req: func() *http.Request {
+				r := httptest.NewRequest(http.MethodGet, "https://www.example.org/", nil)
+				r.Header.Add("Authorization", "Bearer secret\x00")
+				return r
+			}(),
+			expectedErr: `http3: invalid http header field value for key "Authorization"`,
+		},
+		{
+			name: "invalid method",
+			req: func() *http.Request {
+				r := httptest.NewRequest(http.MethodGet, "https://www.example.org/", nil)
+				r.Method = "foobär"
+				return r
+			}(),
+			expectedErr: "http3: invalid method \"foobär\"",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.req.Body = &mockBody{}
+			_, err := tr.RoundTrip(tt.req)
+			if tt.expectedErr != "" {
+				require.EqualError(t, err, tt.expectedErr)
+			}
+			if tt.expectedErrContains != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.expectedErrContains)
+			}
+			require.True(t, tt.req.Body.(*mockBody).closed)
+		})
+	}
+}
+
+func TestTransportDialHostname(t *testing.T) {
+	type hostnameConfig struct {
+		dialHostname  string
+		tlsServerName string
+	}
+	hostnameChan := make(chan hostnameConfig, 1)
+	tr := &Transport{
+		Dial: func(_ context.Context, hostname string, tlsConf *tls.Config, _ *quic.Config) (*quic.Conn, error) {
+			hostnameChan <- hostnameConfig{
+				dialHostname:  hostname,
+				tlsServerName: tlsConf.ServerName,
+			}
+			return nil, errors.New("test done")
+		},
+	}
+
+	t.Run("port set", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "https://quic-go.net:1234", nil)
+		_, err := tr.RoundTripOpt(req, RoundTripOpt{})
+		require.EqualError(t, err, "test done")
+		select {
+		case c := <-hostnameChan:
+			require.Equal(t, "quic-go.net:1234", c.dialHostname)
+			require.Equal(t, "quic-go.net", c.tlsServerName)
+		case <-time.After(1 * time.Second):
+			t.Fatal("timeout")
+		}
+	})
+
+	// if the request doesn't have a port, the default port is used
+	t.Run("port not set", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "https://quic-go.net", nil)
+		_, err := tr.RoundTripOpt(req, RoundTripOpt{})
+		require.EqualError(t, err, "test done")
+		select {
+		case c := <-hostnameChan:
+			require.Equal(t, "quic-go.net:443", c.dialHostname)
+			require.Equal(t, "quic-go.net", c.tlsServerName)
+		case <-time.After(1 * time.Second):
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestTransportDatagrams(t *testing.T) {
+	// if the default quic.Config is used, the transport automatically enables QUIC datagrams
+	t.Run("default quic.Config", func(t *testing.T) {
+		tr := &Transport{
+			EnableDatagrams: true,
+			Dial: func(_ context.Context, _ string, _ *tls.Config, quicConf *quic.Config) (*quic.Conn, error) {
+				require.True(t, quicConf.EnableDatagrams)
+				return nil, assert.AnError
+			},
+		}
+		req := httptest.NewRequest(http.MethodGet, "https://example.com", nil)
+		_, err := tr.RoundTripOpt(req, RoundTripOpt{})
+		require.ErrorIs(t, err, assert.AnError)
+	})
+
+	// if a custom quic.Config is used, the transport just checks that QUIC datagrams are enabled
+	t.Run("custom quic.Config", func(t *testing.T) {
+		tr := &Transport{
+			EnableDatagrams: true,
+			QUICConfig:      &quic.Config{EnableDatagrams: false},
+			Dial: func(_ context.Context, _ string, _ *tls.Config, quicConf *quic.Config) (*quic.Conn, error) {
+				t.Fatal("dial should not be called")
+				return nil, nil
+			},
+		}
+		req := httptest.NewRequest(http.MethodGet, "https://example.com", nil)
+		_, err := tr.RoundTripOpt(req, RoundTripOpt{})
+		require.EqualError(t, err, "HTTP Datagrams enabled, but QUIC Datagrams disabled")
+	})
+}
+
+func TestTransportMultipleQUICVersions(t *testing.T) {
+	qconf := &quic.Config{
+		Versions: []quic.Version{quic.Version2, quic.Version1},
+	}
+	tr := &Transport{QUICConfig: qconf}
+	req := httptest.NewRequest(http.MethodGet, "https://example.com", nil)
+	_, err := tr.RoundTrip(req)
+	require.EqualError(t, err, "can only use a single QUIC version for dialing a HTTP/3 connection")
+}
+
+func TestTransportConnectionReuse(t *testing.T) {
+	conn, _ := newConnPair(t)
+	mockCtrl := gomock.NewController(t)
+	cl := NewMockClientConn(mockCtrl)
+	var dialCount int
+	tr := &Transport{
+		Dial: func(context.Context, string, *tls.Config, *quic.Config) (*quic.Conn, error) {
+			dialCount++
+			return conn, nil
+		},
+		newClientConn: func(*quic.Conn) clientConn { return cl },
+	}
+
+	req1 := httptest.NewRequest(http.MethodGet, "https://quic-go.net/file1.html", nil)
+	// if OnlyCachedConn is set, no connection is dialed
+	_, err := tr.RoundTripOpt(req1, RoundTripOpt{OnlyCachedConn: true})
+	require.ErrorIs(t, err, ErrNoCachedConn)
+	require.Zero(t, dialCount)
+
+	// the first request establishes the connection...
+	cl.EXPECT().RoundTrip(req1).Return(&http.Response{Request: req1}, nil)
+	rsp, err := tr.RoundTrip(req1)
+	require.NoError(t, err)
+	require.Equal(t, req1, rsp.Request)
+	require.Equal(t, 1, dialCount)
+
+	// ... which is then used for the second request
+	req2 := httptest.NewRequest(http.MethodGet, "https://quic-go.net/file2.html", nil)
+	cl.EXPECT().RoundTrip(req2).Return(&http.Response{Request: req2}, nil)
+	rsp, err = tr.RoundTrip(req2)
+	require.NoError(t, err)
+	require.Equal(t, req2, rsp.Request)
+	require.Equal(t, 1, dialCount)
+}
+
+// Requests reuse the same underlying QUIC connection.
+// If a request experiences an error, the behavior depends on the nature of that error.
+func TestTransportConnectionRedial(t *testing.T) {
+	nonRetryableReq := httptest.NewRequest(
+		http.MethodGet,
+		"https://quic-go.org",
+		strings.NewReader("foobar"),
+	)
+	require.Nil(t, nonRetryableReq.GetBody)
+
+	retryableReq := nonRetryableReq.Clone(context.Background())
+	retryableReq.GetBody = func() (io.ReadCloser, error) {
+		return io.NopCloser(strings.NewReader("foobaz")), nil
+	}
+
+	// If the error occurs when opening the stream, it is safe to retry the request:
+	// We can be certain that it wasn't sent out (not even partially).
+	t.Run("error when opening the stream", func(t *testing.T) {
+		require.NoError(t,
+			testTransportConnectionRedial(t, nonRetryableReq, &errConnUnusable{errors.New("test")}, "foobar", true),
+		)
+	})
+
+	// If the error occurs when opening the stream, it is safe to retry the request:
+	// We can be certain that it wasn't sent out (not even partially).
+	t.Run("non-retryable request error after opening the stream", func(t *testing.T) {
+		require.ErrorIs(t,
+			testTransportConnectionRedial(t, nonRetryableReq, assert.AnError, "foobar", false),
+			assert.AnError,
+		)
+	})
+
+	t.Run("retryable request after opening the stream", func(t *testing.T) {
+		require.ErrorIs(t,
+			testTransportConnectionRedial(t, retryableReq, assert.AnError, "", false),
+			assert.AnError,
+		)
+	})
+
+	t.Run("retryable request after H3_REQUEST_REJECTED", func(t *testing.T) {
+		require.NoError(t,
+			testTransportConnectionRedial(t,
+				retryableReq,
+				&Error{ErrorCode: ErrCodeRequestRejected},
+				"foobaz",
+				true,
+			),
+		)
+	})
+
+	t.Run("retryable request where GetBody returns an error", func(t *testing.T) {
+		req := nonRetryableReq.Clone(context.Background())
+		req.GetBody = func() (io.ReadCloser, error) {
+			return nil, assert.AnError
+		}
+		require.ErrorIs(t,
+			testTransportConnectionRedial(t, req, &Error{ErrorCode: ErrCodeRequestRejected}, "", false),
+			assert.AnError,
+		)
+	})
+}
+
+func testTransportConnectionRedial(t *testing.T, req *http.Request, roundtripErr error, expectedBody string, expectRedial bool) error {
+	conn, _ := newConnPair(t)
+	mockCtrl := gomock.NewController(t)
+	cl := NewMockClientConn(mockCtrl)
+	var dialCount int
+	tr := &Transport{
+		Dial: func(context.Context, string, *tls.Config, *quic.Config) (*quic.Conn, error) {
+			dialCount++
+			return conn, nil
+		},
+		newClientConn: func(*quic.Conn) clientConn { return cl },
+	}
+
+	var body string
+	cl.EXPECT().RoundTrip(req).Return(nil, roundtripErr)
+	if expectRedial {
+		cl.EXPECT().RoundTrip(gomock.Any()).DoAndReturn(func(r *http.Request) (*http.Response, error) {
+			b, err := io.ReadAll(r.Body)
+			if err != nil {
+				panic(fmt.Sprintf("reading body failed: %v", err))
+			}
+			body = string(b)
+			return &http.Response{Request: req}, nil
+		})
+	}
+
+	_, err := tr.RoundTrip(req)
+	if !expectRedial {
+		assert.Equal(t, 1, dialCount)
+	} else {
+		assert.Equal(t, 2, dialCount)
+		assert.Equal(t, expectedBody, body)
+	}
+	return err
+}
+
+func TestTransportRequestContextCancellation(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cl := NewMockClientConn(mockCtrl)
+	conn, _ := newConnPair(t)
+	var dialCount int
+	tr := &Transport{
+		Dial: func(context.Context, string, *tls.Config, *quic.Config) (*quic.Conn, error) {
+			dialCount++
+			return conn, nil
+		},
+		newClientConn: func(*quic.Conn) clientConn { return cl },
+	}
+
+	// the first request succeeds
+	req1 := httptest.NewRequest(http.MethodGet, "https://quic-go.net/file1.html", nil)
+	cl.EXPECT().RoundTrip(req1).Return(&http.Response{Request: req1}, nil)
+	rsp, err := tr.RoundTrip(req1)
+	require.NoError(t, err)
+	require.Equal(t, req1, rsp.Request)
+	require.Equal(t, 1, dialCount)
+
+	// the second request reuses the QUIC connection, and runs into the cancelled context
+	req2 := httptest.NewRequest(http.MethodGet, "https://quic-go.net/file2.html", nil)
+	ctx, cancel := context.WithCancel(context.Background())
+	req2 = req2.WithContext(ctx)
+	cl.EXPECT().RoundTrip(req2).DoAndReturn(
+		func(r *http.Request) (*http.Response, error) {
+			cancel()
+			return nil, context.Canceled
+		},
+	)
+	_, err = tr.RoundTrip(req2)
+	require.ErrorIs(t, err, context.Canceled)
+	require.Equal(t, 1, dialCount)
+
+	// the next request reuses the QUIC connection
+	req3 := httptest.NewRequest(http.MethodGet, "https://quic-go.net/file2.html", nil)
+	cl.EXPECT().RoundTrip(req3).Return(&http.Response{Request: req3}, nil)
+	rsp, err = tr.RoundTrip(req3)
+	require.NoError(t, err)
+	require.Equal(t, req3, rsp.Request)
+	require.Equal(t, 1, dialCount)
+}
+
+func TestTransportConnetionRedialHandshakeError(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cl := NewMockClientConn(mockCtrl)
+	conn, _ := newConnPair(t)
+	var dialCount int
+	tr := &Transport{
+		Dial: func(context.Context, string, *tls.Config, *quic.Config) (*quic.Conn, error) {
+			dialCount++
+			if dialCount == 1 {
+				return nil, assert.AnError
+			}
+			return conn, nil
+		},
+		newClientConn: func(*quic.Conn) clientConn { return cl },
+	}
+
+	req1 := httptest.NewRequest(http.MethodGet, "https://quic-go.net/file1.html", nil)
+	_, err := tr.RoundTrip(req1)
+	require.ErrorIs(t, err, assert.AnError)
+	require.Equal(t, 1, dialCount)
+
+	req2 := httptest.NewRequest(http.MethodGet, "https://quic-go.net/file2.html", nil)
+	cl.EXPECT().RoundTrip(req2).Return(&http.Response{Request: req2}, nil)
+	rsp, err := tr.RoundTrip(req2)
+	require.NoError(t, err)
+	require.Equal(t, req2, rsp.Request)
+	require.Equal(t, 2, dialCount)
+}
+
+func TestTransportCloseEstablishedConnections(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	conn, _ := newConnPair(t)
+	tr := &Transport{
+		Dial: func(context.Context, string, *tls.Config, *quic.Config) (*quic.Conn, error) {
+			return conn, nil
+		},
+		newClientConn: func(*quic.Conn) clientConn {
+			cl := NewMockClientConn(mockCtrl)
+			cl.EXPECT().RoundTrip(gomock.Any()).Return(&http.Response{}, nil)
+			return cl
+		},
+	}
+	req := httptest.NewRequest(http.MethodGet, "https://quic-go.net/foobar.html", nil)
+	_, err := tr.RoundTrip(req)
+	require.NoError(t, err)
+	require.NoError(t, tr.Close())
+
+	select {
+	case <-conn.Context().Done():
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestTransportCloseInFlightDials(t *testing.T) {
+	tr := &Transport{
+		Dial: func(ctx context.Context, _ string, _ *tls.Config, _ *quic.Config) (*quic.Conn, error) {
+			var err error
+			select {
+			case <-ctx.Done():
+				err = ctx.Err()
+			case <-time.After(time.Second):
+				err = errors.New("timeout")
+			}
+			return nil, err
+		},
+	}
+	req := httptest.NewRequest(http.MethodGet, "https://quic-go.net/foobar.html", nil)
+
+	errChan := make(chan error, 1)
+	go func() {
+		_, err := tr.RoundTrip(req)
+		errChan <- err
+	}()
+
+	select {
+	case err := <-errChan:
+		t.Fatalf("received unexpected error: %v", err)
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	}
+
+	require.NoError(t, tr.Close())
+	select {
+	case err := <-errChan:
+		require.ErrorIs(t, err, context.Canceled)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestTransportCloseIdleConnections(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	conn1, _ := newConnPair(t)
+	conn2, _ := newConnPair(t)
+	roundTripCalled := make(chan struct{})
+	tr := &Transport{
+		Dial: func(_ context.Context, hostname string, _ *tls.Config, _ *quic.Config) (*quic.Conn, error) {
+			switch hostname {
+			case "site1.com:443":
+				return conn1, nil
+			case "site2.com:443":
+				return conn2, nil
+			default:
+				t.Fatal("unexpected hostname")
+				return nil, errors.New("unexpected hostname")
+			}
+		},
+		newClientConn: func(*quic.Conn) clientConn {
+			cl := NewMockClientConn(mockCtrl)
+			cl.EXPECT().RoundTrip(gomock.Any()).DoAndReturn(func(r *http.Request) (*http.Response, error) {
+				roundTripCalled <- struct{}{}
+				<-r.Context().Done()
+				return nil, nil
+			})
+			return cl
+		},
+	}
+	req1 := httptest.NewRequest(http.MethodGet, "https://site1.com", nil)
+	req2 := httptest.NewRequest(http.MethodGet, "https://site2.com", nil)
+	require.NotEqual(t, req1.Host, req2.Host)
+	ctx1, cancel1 := context.WithCancel(context.Background())
+	ctx2, cancel2 := context.WithCancel(context.Background())
+	req1 = req1.WithContext(ctx1)
+	req2 = req2.WithContext(ctx2)
+	reqFinished := make(chan struct{})
+	go func() {
+		tr.RoundTrip(req1)
+		reqFinished <- struct{}{}
+	}()
+	go func() {
+		tr.RoundTrip(req2)
+		reqFinished <- struct{}{}
+	}()
+	<-roundTripCalled
+	<-roundTripCalled
+	// Both two requests are started.
+	cancel1()
+	<-reqFinished
+	// req1 is finished
+	tr.CloseIdleConnections()
+	select {
+	case <-conn1.Context().Done():
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	cancel2()
+	<-reqFinished
+	// all requests are finished
+	tr.CloseIdleConnections()
+	select {
+	case <-conn2.Context().Done():
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestTransportClose(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	conn, _ := newConnPair(t)
+	tr := &Transport{
+		Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
+			return conn, nil
+		},
+		newClientConn: func(*quic.Conn) clientConn {
+			cl := NewMockClientConn(mockCtrl)
+			cl.EXPECT().RoundTrip(gomock.Any()).Return(nil, nil)
+			return cl
+		},
+	}
+	req, err := http.NewRequest(http.MethodGet, "https://example.com", nil)
+	require.NoError(t, err)
+	_, err = tr.RoundTrip(req)
+	require.NoError(t, err)
+	require.NoError(t, tr.Close())
+	_, err = tr.RoundTrip(req)
+	require.ErrorIs(t, err, ErrTransportClosed)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/benchmark_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/benchmark_test.go
new file mode 100644
index 000000000..008d9561f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/benchmark_test.go
@@ -0,0 +1,151 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+
+	"github.com/stretchr/testify/require"
+)
+
+func BenchmarkHandshake(b *testing.B) {
+	b.ReportAllocs()
+
+	ln, err := quic.Listen(newUDPConnLocalhost(b), tlsConfig, nil)
+	require.NoError(b, err)
+	defer ln.Close()
+
+	connChan := make(chan *quic.Conn, 1)
+	go func() {
+		for {
+			conn, err := ln.Accept(context.Background())
+			if err != nil {
+				return
+			}
+			connChan <- conn
+		}
+	}()
+
+	tr := &quic.Transport{Conn: newUDPConnLocalhost(b)}
+	defer tr.Close()
+
+	for b.Loop() {
+		c, err := tr.Dial(context.Background(), ln.Addr(), tlsClientConfig, nil)
+		if err != nil {
+			b.Fatalf("error dialing: %v", err)
+		}
+		serverConn := <-connChan
+		serverConn.CloseWithError(0, "")
+		c.CloseWithError(0, "")
+	}
+}
+
+func BenchmarkStreamChurn(b *testing.B) {
+	b.ReportAllocs()
+
+	ln, err := quic.Listen(newUDPConnLocalhost(b), tlsConfig, &quic.Config{MaxIncomingStreams: 1e10})
+	require.NoError(b, err)
+	defer ln.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(b), ln.Addr(), tlsClientConfig, nil)
+	require.NoError(b, err)
+	defer conn.CloseWithError(0, "")
+
+	serverConn, err := ln.Accept(context.Background())
+	require.NoError(b, err)
+	defer serverConn.CloseWithError(0, "")
+
+	go func() {
+		for {
+			str, err := serverConn.AcceptStream(context.Background())
+			if err != nil {
+				return
+			}
+			str.Close()
+		}
+	}()
+
+	for b.Loop() {
+		str, err := conn.OpenStreamSync(context.Background())
+		if err != nil {
+			b.Fatalf("error opening stream: %v", err)
+		}
+		if err := str.Close(); err != nil {
+			b.Fatalf("error closing stream: %v", err)
+		}
+	}
+}
+
+func BenchmarkTransfer(b *testing.B) {
+	b.Run(fmt.Sprintf("%d kb", len(PRData)/1024), func(b *testing.B) { benchmarkTransfer(b, PRData) })
+	b.Run(fmt.Sprintf("%d kb", len(PRDataLong)/1024), func(b *testing.B) { benchmarkTransfer(b, PRDataLong) })
+}
+
+func benchmarkTransfer(b *testing.B, data []byte) {
+	b.ReportAllocs()
+
+	ln, err := quic.Listen(newUDPConnLocalhost(b), tlsConfig, nil)
+	require.NoError(b, err)
+	defer ln.Close()
+
+	connChan := make(chan *quic.Conn, 1)
+	go func() {
+		for {
+			conn, err := ln.Accept(context.Background())
+			if err != nil {
+				return
+			}
+			connChan <- conn
+			str, err := conn.OpenUniStream()
+			if err != nil {
+				b.Logf("error opening stream: %v", err)
+				return
+			}
+			if _, err := str.Write(data); err != nil {
+				b.Logf("error writing data: %v", err)
+				return
+			}
+			if err := str.Close(); err != nil {
+				b.Logf("error closing stream: %v", err)
+				return
+			}
+		}
+	}()
+
+	tr := &quic.Transport{Conn: newUDPConnLocalhost(b)}
+	defer tr.Close()
+
+	buf := make([]byte, len(data))
+
+	for b.Loop() {
+		c, err := tr.Dial(context.Background(), ln.Addr(), tlsClientConfig, nil)
+		if err != nil {
+			b.Fatalf("error dialing: %v", err)
+		}
+
+		str, err := c.AcceptUniStream(context.Background())
+		if err != nil {
+			b.Fatalf("error accepting stream: %v", err)
+		}
+		if _, err := io.ReadFull(str, buf); err != nil {
+			b.Fatalf("error reading data: %v", err)
+		}
+		if _, err := str.Read([]byte{0}); err != io.EOF {
+			b.Fatalf("error reading EOF: %v", err)
+		}
+		if !bytes.Equal(buf, data) {
+			b.Fatalf("data mismatch: got %x, expected %x", buf, data)
+		}
+
+		serverConn := <-connChan
+		serverConn.CloseWithError(0, "")
+		c.CloseWithError(0, "")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/cancelation_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/cancelation_test.go
new file mode 100644
index 000000000..4be17e1f5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/cancelation_test.go
@@ -0,0 +1,598 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"math/rand/v2"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStreamReadCancellation(t *testing.T) {
+	t.Run("immediate", func(t *testing.T) {
+		testStreamCancellation(t, func(str *quic.ReceiveStream) error {
+			str.CancelRead(quic.StreamErrorCode(str.StreamID()))
+			_, err := str.Read([]byte{0})
+			return err
+		}, nil)
+	})
+
+	t.Run("after reading some data", func(t *testing.T) {
+		testStreamCancellation(t, func(str *quic.ReceiveStream) error {
+			length := rand.IntN(len(PRData) - 1)
+			if _, err := io.ReadAll(io.LimitReader(str, int64(length))); err != nil {
+				return fmt.Errorf("reading stream data failed: %w", err)
+			}
+			str.CancelRead(quic.StreamErrorCode(str.StreamID()))
+			_, err := str.Read([]byte{0})
+			return err
+		}, nil)
+	})
+
+	// This test is especially valuable when run with race detector,
+	// see https://github.com/quic-go/quic-go/issues/3239.
+	t.Run("concurrent", func(t *testing.T) {
+		testStreamCancellation(t, func(str *quic.ReceiveStream) error {
+			errChan := make(chan error, 1)
+			go func() {
+				for {
+					if _, err := str.Read(make([]byte, 16)); err != nil {
+						errChan <- err
+						return
+					}
+					time.Sleep(time.Millisecond)
+				}
+			}()
+
+			done := make(chan struct{})
+			go func() {
+				defer close(done)
+				str.CancelRead(quic.StreamErrorCode(str.StreamID()))
+			}()
+
+			timeout := time.After(time.Second)
+			select {
+			case <-done:
+			case <-timeout:
+				return fmt.Errorf("timeout canceling")
+			}
+			select {
+			case err := <-errChan:
+				return err
+			case <-timeout:
+				return fmt.Errorf("timeout canceling")
+			}
+		}, nil)
+	})
+}
+
+func TestStreamWriteCancellation(t *testing.T) {
+	t.Run("immediate", func(t *testing.T) {
+		testStreamCancellation(t, nil, func(str *quic.SendStream) error {
+			str.CancelWrite(quic.StreamErrorCode(str.StreamID()))
+			_, err := str.Write([]byte{0})
+			return err
+		})
+	})
+
+	t.Run("after writing some data", func(t *testing.T) {
+		testStreamCancellation(t, nil, func(str *quic.SendStream) error {
+			length := rand.IntN(len(PRData) - 1)
+			if _, err := str.Write(PRData[:length]); err != nil {
+				return fmt.Errorf("writing stream data failed: %w", err)
+			}
+			str.CancelWrite(quic.StreamErrorCode(str.StreamID()))
+			_, err := str.Write([]byte{0})
+			return err
+		})
+	})
+
+	// This test is especially valuable when run with race detector,
+	// see https://github.com/quic-go/quic-go/issues/3239.
+	t.Run("concurrent", func(t *testing.T) {
+		testStreamCancellation(t, nil, func(str *quic.SendStream) error {
+			errChan := make(chan error, 1)
+			go func() {
+				var offset int
+				for {
+					n, err := str.Write(PRData[offset : offset+128])
+					if err != nil {
+						errChan <- err
+						return
+					}
+					offset += n
+					time.Sleep(time.Millisecond)
+				}
+			}()
+
+			done := make(chan struct{})
+			go func() {
+				defer close(done)
+				str.CancelWrite(quic.StreamErrorCode(str.StreamID()))
+			}()
+
+			timeout := time.After(time.Second)
+			select {
+			case <-done:
+			case <-timeout:
+				return fmt.Errorf("timeout canceling")
+			}
+			select {
+			case err := <-errChan:
+				return err
+			case <-timeout:
+				return fmt.Errorf("timeout canceling")
+			}
+		})
+	})
+}
+
+func TestStreamReadWriteCancellation(t *testing.T) {
+	t.Run("immediate", func(t *testing.T) {
+		testStreamCancellation(t,
+			func(str *quic.ReceiveStream) error {
+				str.CancelRead(quic.StreamErrorCode(str.StreamID()))
+				_, err := str.Read([]byte{0})
+				return err
+			},
+			func(str *quic.SendStream) error {
+				str.CancelWrite(quic.StreamErrorCode(str.StreamID()))
+				_, err := str.Write([]byte{0})
+				return err
+			},
+		)
+	})
+
+	t.Run("after writing some data", func(t *testing.T) {
+		testStreamCancellation(t,
+			func(str *quic.ReceiveStream) error {
+				length := rand.IntN(len(PRData) - 1)
+				if _, err := io.ReadAll(io.LimitReader(str, int64(length))); err != nil {
+					return fmt.Errorf("reading stream data failed: %w", err)
+				}
+				str.CancelRead(quic.StreamErrorCode(str.StreamID()))
+				_, err := str.Read([]byte{0})
+				return err
+			},
+			func(str *quic.SendStream) error {
+				length := rand.IntN(len(PRData) - 1)
+				if _, err := str.Write(PRData[:length]); err != nil {
+					return fmt.Errorf("writing stream data failed: %w", err)
+				}
+				str.CancelWrite(quic.StreamErrorCode(str.StreamID()))
+				_, err := str.Write([]byte{0})
+				return err
+			},
+		)
+	})
+}
+
+// If readFunc is set, the read side is canceled for 50% of the streams.
+// If writeFunc is set, the write side is canceled for 50% of the streams.
+func testStreamCancellation(
+	t *testing.T,
+	readFunc func(str *quic.ReceiveStream) error,
+	writeFunc func(str *quic.SendStream) error,
+) {
+	const numStreams = 80
+
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), scaleDuration(2*time.Second))
+	defer cancel()
+	conn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{MaxIncomingUniStreams: numStreams / 2}),
+	)
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+
+	type cancellationErr struct {
+		StreamID quic.StreamID
+		Err      error
+	}
+
+	var numCancellations int
+	actions := make([]bool, numStreams)
+	for i := range actions {
+		actions[i] = rand.IntN(2) == 0
+		if actions[i] {
+			numCancellations++
+		}
+	}
+
+	// The server accepts a single connection, and then opens numStreams unidirectional streams.
+	// On each of these streams, it (tries to) write PRData.
+	serverErrChan := make(chan *cancellationErr, numStreams)
+	go func() {
+		for _, doCancel := range actions {
+			str, err := serverConn.OpenUniStreamSync(ctx)
+			if err != nil {
+				serverErrChan <- &cancellationErr{StreamID: protocol.InvalidStreamID, Err: fmt.Errorf("opening stream failed: %w", err)}
+				return
+			}
+			go func() {
+				if writeFunc != nil && doCancel {
+					if err := writeFunc(str); err != nil {
+						serverErrChan <- &cancellationErr{StreamID: str.StreamID(), Err: err}
+						return
+					}
+					serverErrChan <- nil
+					return
+				}
+				defer str.Close()
+				if _, err := str.Write(PRData); err != nil {
+					serverErrChan <- &cancellationErr{StreamID: str.StreamID(), Err: err}
+					return
+				}
+				serverErrChan <- nil
+			}()
+		}
+	}()
+
+	clientErrChan := make(chan *cancellationErr, numStreams)
+	for _, doCancel := range actions {
+		str, err := conn.AcceptUniStream(ctx)
+		require.NoError(t, err)
+		go func(str *quic.ReceiveStream) {
+			if readFunc != nil && doCancel {
+				if err := readFunc(str); err != nil {
+					clientErrChan <- &cancellationErr{StreamID: str.StreamID(), Err: err}
+					return
+				}
+			}
+			data, err := io.ReadAll(str)
+			if err != nil {
+				clientErrChan <- &cancellationErr{StreamID: str.StreamID(), Err: fmt.Errorf("reading stream data failed: %w", err)}
+				return
+			}
+			if !bytes.Equal(data, PRData) {
+				clientErrChan <- &cancellationErr{StreamID: str.StreamID(), Err: fmt.Errorf("received data mismatch")}
+				return
+			}
+			clientErrChan <- nil
+		}(str)
+	}
+
+	timeout := time.After(time.Second)
+	var clientErrs, serverErrs int
+	for range numStreams {
+		select {
+		case err := <-serverErrChan:
+			if err != nil {
+				if err.StreamID == protocol.InvalidStreamID { // failed opening a stream
+					require.NoError(t, err.Err)
+					continue
+				}
+				var streamErr *quic.StreamError
+				require.ErrorAs(t, err.Err, &streamErr)
+				assert.Equal(t, streamErr.StreamID, err.StreamID)
+				assert.Equal(t, streamErr.ErrorCode, quic.StreamErrorCode(err.StreamID))
+				if readFunc != nil && writeFunc == nil {
+					assert.Equal(t, streamErr.Remote, readFunc != nil)
+				}
+				serverErrs++
+			}
+		case <-timeout:
+			t.Fatalf("timeout")
+		}
+		select {
+		case err := <-clientErrChan:
+			if err != nil {
+				if err.StreamID == protocol.InvalidStreamID { // failed accepting a stream
+					require.NoError(t, err.Err)
+					continue
+				}
+				var streamErr *quic.StreamError
+				require.ErrorAs(t, err.Err, &streamErr)
+				assert.Equal(t, streamErr.StreamID, err.StreamID)
+				assert.Equal(t, streamErr.ErrorCode, quic.StreamErrorCode(err.StreamID))
+				if readFunc != nil && writeFunc == nil {
+					assert.Equal(t, streamErr.Remote, writeFunc != nil)
+				}
+				clientErrs++
+			}
+		case <-timeout:
+			t.Fatalf("timeout")
+		}
+	}
+	assert.Equal(t, numCancellations, clientErrs, "client canceled streams")
+	// The server will only count a stream as being reset if it learns about the cancellation
+	// before it finished writing all data.
+	assert.LessOrEqual(t, serverErrs, numCancellations, "server-observed canceled streams")
+	assert.NotZero(t, serverErrs, "server-observed canceled streams")
+}
+
+func TestCancelAcceptStream(t *testing.T) {
+	const numStreams = 30
+
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{MaxIncomingUniStreams: numStreams / 3}),
+	)
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	serverErrChan := make(chan error, 1)
+	go func() {
+		defer close(serverErrChan)
+		ctx, cancel := context.WithTimeout(context.Background(), scaleDuration(2*time.Second))
+		defer cancel()
+		ticker := time.NewTicker(5 * time.Millisecond)
+		defer ticker.Stop()
+		for range numStreams {
+			<-ticker.C
+			str, err := serverConn.OpenUniStreamSync(ctx)
+			if err != nil {
+				serverErrChan <- err
+				return
+			}
+			if _, err := str.Write(PRData); err != nil {
+				serverErrChan <- err
+				return
+			}
+			str.Close()
+		}
+	}()
+
+	var numToAccept int
+	var counter atomic.Int32
+	var wg sync.WaitGroup
+	wg.Add(numStreams)
+	for numToAccept < numStreams {
+		ctx, cancel := context.WithCancel(context.Background())
+		// cancel accepting half of the streams
+		if rand.Int()%2 == 0 {
+			cancel()
+		} else {
+			numToAccept++
+			defer cancel()
+		}
+
+		go func() {
+			str, err := conn.AcceptUniStream(ctx)
+			if err != nil {
+				if errors.Is(err, context.Canceled) {
+					counter.Add(1)
+				}
+				return
+			}
+			go func() {
+				data, err := io.ReadAll(str)
+				if err != nil {
+					t.Errorf("ReadAll failed: %v", err)
+					return
+				}
+				if !bytes.Equal(data, PRData) {
+					t.Errorf("received data mismatch")
+					return
+				}
+				wg.Done()
+			}()
+		}()
+	}
+	wg.Wait()
+
+	count := counter.Load()
+	t.Logf("canceled AcceptStream %d times", count)
+	require.Greater(t, count, int32(numStreams/4))
+	require.NoError(t, conn.CloseWithError(0, ""))
+	require.NoError(t, server.Close())
+	require.NoError(t, <-serverErrChan)
+}
+
+func TestCancelOpenStreamSync(t *testing.T) {
+	const (
+		numStreams         = 16
+		maxIncomingStreams = 4
+	)
+
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	conn, err := quic.Dial(
+		context.Background(),
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{MaxIncomingUniStreams: maxIncomingStreams}),
+	)
+	require.NoError(t, err)
+
+	msg := make(chan struct{}, 1)
+	serverErrChan := make(chan error, numStreams+1)
+	var numCanceled int
+	serverConn, err := server.Accept(context.Background())
+	require.NoError(t, err)
+	go func() {
+		defer close(msg)
+		var numOpened int
+		for numOpened < numStreams {
+			ctx, cancel := context.WithTimeout(context.Background(), scaleDuration(10*time.Millisecond))
+			defer cancel()
+			str, err := serverConn.OpenUniStreamSync(ctx)
+			if err != nil {
+				if !errors.Is(err, context.DeadlineExceeded) {
+					serverErrChan <- err
+					return
+				}
+				numCanceled++
+				select {
+				case msg <- struct{}{}:
+				default:
+				}
+				continue
+			}
+			numOpened++
+			go func(str *quic.SendStream) {
+				defer str.Close()
+				if _, err := str.Write(PRData); err != nil {
+					serverErrChan <- err
+				}
+			}(str)
+		}
+	}()
+
+	clientErrChan := make(chan error, numStreams)
+	for range numStreams {
+		<-msg
+		str, err := conn.AcceptUniStream(context.Background())
+		require.NoError(t, err)
+		go func(str *quic.ReceiveStream) {
+			data, err := io.ReadAll(str)
+			if err != nil {
+				clientErrChan <- err
+				return
+			}
+			if !bytes.Equal(data, PRData) {
+				clientErrChan <- fmt.Errorf("received data mismatch")
+				return
+			}
+			clientErrChan <- nil
+		}(str)
+	}
+
+	timeout := time.After(scaleDuration(2 * time.Second))
+	for range numStreams {
+		select {
+		case err := <-clientErrChan:
+			require.NoError(t, err)
+		case err := <-serverErrChan:
+			require.NoError(t, err)
+		case <-timeout:
+			t.Fatalf("timeout")
+		}
+	}
+
+	count := numCanceled
+	t.Logf("Canceled OpenStreamSync %d times", count)
+	require.GreaterOrEqual(t, count, numStreams-maxIncomingStreams)
+	require.NoError(t, conn.CloseWithError(0, ""))
+	require.NoError(t, server.Close())
+}
+
+func TestHeavyStreamCancellation(t *testing.T) {
+	const maxIncomingStreams = 500
+
+	server, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{MaxIncomingStreams: maxIncomingStreams, MaxIdleTimeout: 10 * time.Second}),
+	)
+	require.NoError(t, err)
+	defer server.Close()
+
+	var wg sync.WaitGroup
+	wg.Add(2 * 4 * maxIncomingStreams)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+
+	serverConn, err := server.Accept(context.Background())
+	require.NoError(t, err)
+
+	handleStream := func(str *quic.Stream) {
+		str.SetDeadline(time.Now().Add(time.Second))
+		go func() {
+			defer wg.Done()
+			if rand.Int()%2 == 0 {
+				io.ReadAll(str)
+			}
+		}()
+		go func() {
+			defer wg.Done()
+			if rand.Int()%2 == 0 {
+				str.Write([]byte("foobar"))
+				if rand.Int()%2 == 0 {
+					str.Close()
+				}
+			}
+		}()
+		go func() {
+			defer wg.Done()
+			// Make sure we at least send out *something* for the last stream,
+			// otherwise the peer might never receive this anything for this stream.
+			if rand.Int()%2 == 0 || str.StreamID() == 4*(maxIncomingStreams-1) {
+				str.CancelWrite(1234)
+			}
+		}()
+		go func() {
+			defer wg.Done()
+			if rand.Int()%2 == 0 {
+				str.CancelRead(1234)
+			}
+		}()
+	}
+
+	serverErrChan := make(chan error, 1)
+	go func() {
+		defer close(serverErrChan)
+
+		for {
+			str, err := serverConn.AcceptStream(context.Background())
+			if err != nil {
+				serverErrChan <- err
+				return
+			}
+			handleStream(str)
+		}
+	}()
+
+	for range maxIncomingStreams {
+		str, err := conn.OpenStreamSync(context.Background())
+		require.NoError(t, err)
+		handleStream(str)
+	}
+
+	// We don't expect to accept any stream here.
+	// We're just making sure the connection stays open and there's no error.
+	ctx, cancel = context.WithTimeout(context.Background(), scaleDuration(50*time.Millisecond))
+	defer cancel()
+	_, err = conn.AcceptStream(ctx)
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+
+	wg.Wait()
+
+	require.NoError(t, conn.CloseWithError(0, ""))
+	select {
+	case err := <-serverErrChan:
+		require.IsType(t, &quic.ApplicationError{}, err)
+	case <-time.After(scaleDuration(time.Second)):
+		t.Fatal("timeout waiting for server to stop")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/close_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/close_test.go
new file mode 100644
index 000000000..9852a210d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/close_test.go
@@ -0,0 +1,230 @@
+package self_test
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConnectionCloseRetransmission(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 10 * time.Millisecond
+		serverAddr := &net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9002}
+
+		var drop atomic.Bool
+		var mx sync.Mutex
+		var dropped [][]byte
+		n := &simnet.Simnet{
+			Router: &droppingRouter{Drop: func(p simnet.Packet) bool {
+				shouldDrop := drop.Load() && p.From.String() == serverAddr.String()
+				if shouldDrop {
+					mx.Lock()
+					dropped = append(dropped, p.Data)
+					mx.Unlock()
+				}
+				return shouldDrop
+			}},
+		}
+		settings := simnet.NodeBiDiLinkSettings{Latency: rtt / 2}
+		clientConn := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}, settings)
+		serverConn := n.NewEndpoint(serverAddr, settings)
+		require.NoError(t, n.Start())
+		defer n.Close()
+
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		server, err := tr.Listen(
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true}),
+		)
+		require.NoError(t, err)
+		defer server.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		conn, err := quic.Dial(ctx, clientConn, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+		defer conn.CloseWithError(0, "")
+
+		sconn, err := server.Accept(ctx)
+		require.NoError(t, err)
+
+		time.Sleep(rtt)
+
+		drop.Store(true)
+		sconn.CloseWithError(1337, "closing")
+
+		// send 100 packets
+		for range 100 {
+			str, err := conn.OpenStream()
+			require.NoError(t, err)
+			_, err = str.Write([]byte("foobar"))
+			require.NoError(t, err)
+
+			// A closed connection will drop packets if a very short queue overflows.
+			// Waiting for one nanosecond makes synctest process the packet before advancing
+			// the synthetic clock.
+			time.Sleep(time.Nanosecond)
+		}
+
+		time.Sleep(rtt)
+
+		mx.Lock()
+		defer mx.Unlock()
+
+		// Expect retransmissions of the CONNECTION_CLOSE for the
+		// 1st, 2nd, 4th, 8th, 16th, 32th, 64th packet: 7 in total (+1 for the original packet)
+		require.Len(t, dropped, 8)
+
+		// verify all retransmitted packets were identical
+		for i := 1; i < len(dropped); i++ {
+			require.Equal(t, dropped[0], dropped[i])
+		}
+	})
+}
+
+func TestDrainServerAcceptQueue(t *testing.T) {
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	dialer := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	defer dialer.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	// fill up the accept queue
+	conns := make([]*quic.Conn, 0, protocol.MaxAcceptQueueSize)
+	for range protocol.MaxAcceptQueueSize {
+		conn, err := dialer.Dial(ctx, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+		conns = append(conns, conn)
+	}
+	time.Sleep(scaleDuration(25 * time.Millisecond)) // wait for connections to be queued
+
+	server.Close()
+	for i := range protocol.MaxAcceptQueueSize {
+		c, err := server.Accept(ctx)
+		require.NoError(t, err)
+		// make sure the connection is not closed
+		require.NoError(t, context.Cause(conns[i].Context()), "client connection closed")
+		require.NoError(t, context.Cause(c.Context()), "server connection closed")
+		c.CloseWithError(0, "")
+	}
+	_, err = server.Accept(ctx)
+	require.ErrorIs(t, err, quic.ErrServerClosed)
+}
+
+type brokenConn struct {
+	net.PacketConn
+
+	broken   chan struct{}
+	breakErr atomic.Pointer[error]
+}
+
+func newBrokenConn(conn net.PacketConn) *brokenConn {
+	c := &brokenConn{
+		PacketConn: conn,
+		broken:     make(chan struct{}),
+	}
+	go func() {
+		<-c.broken
+		// make calls to ReadFrom return
+		c.SetDeadline(time.Now())
+	}()
+	return c
+}
+
+func (c *brokenConn) ReadFrom(b []byte) (int, net.Addr, error) {
+	if err := c.breakErr.Load(); err != nil {
+		return 0, nil, *err
+	}
+	n, addr, err := c.PacketConn.ReadFrom(b)
+	if err != nil {
+		select {
+		case <-c.broken:
+			err = *c.breakErr.Load()
+		default:
+		}
+	}
+	return n, addr, err
+}
+
+func (c *brokenConn) Break(e error) {
+	c.breakErr.Store(&e)
+	close(c.broken)
+}
+
+func TestTransportClose(t *testing.T) {
+	t.Run("Close", func(t *testing.T) {
+		conn := newUDPConnLocalhost(t)
+		testTransportClose(t, conn, func() { conn.Close() }, nil)
+	})
+
+	t.Run("connection error", func(t *testing.T) {
+		t.Setenv("QUIC_GO_DISABLE_RECEIVE_BUFFER_WARNING", "true")
+
+		bc := newBrokenConn(newUDPConnLocalhost(t))
+		testTransportClose(t, bc, func() { bc.Break(assert.AnError) }, assert.AnError)
+	})
+}
+
+func testTransportClose(t *testing.T, conn net.PacketConn, closeFn func(), expectedErr error) {
+	server := newUDPConnLocalhost(t)
+	tr := &quic.Transport{Conn: conn}
+
+	errChan := make(chan error, 1)
+	go func() {
+		_, err := tr.Dial(context.Background(), server.LocalAddr(), &tls.Config{}, getQuicConfig(nil))
+		errChan <- err
+	}()
+
+	select {
+	case <-errChan:
+		t.Fatal("didn't expect Dial to return yet")
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	}
+
+	closeFn()
+
+	select {
+	case err := <-errChan:
+		require.Error(t, err)
+		require.ErrorIs(t, err, quic.ErrTransportClosed)
+		if expectedErr != nil {
+			require.ErrorIs(t, err, expectedErr)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	// it's not possible to dial new connections
+	ctx, cancel := context.WithTimeout(context.Background(), scaleDuration(50*time.Millisecond))
+	defer cancel()
+	_, err := tr.Dial(ctx, server.LocalAddr(), &tls.Config{}, getQuicConfig(nil))
+	require.Error(t, err)
+	require.ErrorIs(t, err, quic.ErrTransportClosed)
+	if expectedErr != nil {
+		require.ErrorIs(t, err, expectedErr)
+	}
+
+	// it's not possible to create new listeners
+	_, err = tr.Listen(&tls.Config{}, nil)
+	require.Error(t, err)
+	require.ErrorIs(t, err, quic.ErrTransportClosed)
+	if expectedErr != nil {
+		require.ErrorIs(t, err, expectedErr)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/conn_id_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/conn_id_test.go
new file mode 100644
index 000000000..83a8fc596
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/conn_id_test.go
@@ -0,0 +1,151 @@
+package self_test
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+	"io"
+	mrand "math/rand/v2"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlogwriter"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type connIDGenerator struct {
+	Length int
+}
+
+var _ quic.ConnectionIDGenerator = &connIDGenerator{}
+
+func (c *connIDGenerator) GenerateConnectionID() (quic.ConnectionID, error) {
+	b := make([]byte, c.Length)
+	if _, err := rand.Read(b); err != nil {
+		return quic.ConnectionID{}, fmt.Errorf("generating conn ID failed: %w", err)
+	}
+	return protocol.ParseConnectionID(b), nil
+}
+
+func (c *connIDGenerator) ConnectionIDLen() int { return c.Length }
+
+func randomConnIDLen() int { return 2 + mrand.IntN(19) }
+
+func TestConnectionIDsZeroLength(t *testing.T) {
+	testTransferWithConnectionIDs(t, randomConnIDLen(), 0, nil, nil)
+}
+
+func TestConnectionIDsRandomLengths(t *testing.T) {
+	testTransferWithConnectionIDs(t, randomConnIDLen(), randomConnIDLen(), nil, nil)
+}
+
+func TestConnectionIDsCustomGenerator(t *testing.T) {
+	testTransferWithConnectionIDs(t, 0, 0,
+		&connIDGenerator{Length: randomConnIDLen()},
+		&connIDGenerator{Length: randomConnIDLen()},
+	)
+}
+
+// connIDLen is ignored when connIDGenerator is set
+func testTransferWithConnectionIDs(
+	t *testing.T,
+	serverConnIDLen, clientConnIDLen int,
+	serverConnIDGenerator, clientConnIDGenerator quic.ConnectionIDGenerator,
+) {
+	t.Helper()
+
+	if serverConnIDGenerator != nil {
+		t.Logf("using %d byte connection ID generator for the server", serverConnIDGenerator.ConnectionIDLen())
+	} else {
+		t.Logf("issuing %d byte connection ID from the server", serverConnIDLen)
+	}
+	if clientConnIDGenerator != nil {
+		t.Logf("using %d byte connection ID generator for the client", clientConnIDGenerator.ConnectionIDLen())
+	} else {
+		t.Logf("issuing %d byte connection ID from the client", clientConnIDLen)
+	}
+
+	// setup server
+	serverTr := &quic.Transport{
+		Conn:                  newUDPConnLocalhost(t),
+		ConnectionIDLength:    serverConnIDLen,
+		ConnectionIDGenerator: serverConnIDGenerator,
+	}
+	defer serverTr.Close()
+	addTracer(serverTr)
+	serverCounter, serverTracer := newPacketTracer()
+	ln, err := serverTr.Listen(
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{
+			Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+				return serverTracer
+			},
+		}),
+	)
+	require.NoError(t, err)
+
+	// setup client
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	var conn *quic.Conn
+	clientCounter, clientTracer := newPacketTracer()
+	clientQUICConf := getQuicConfig(&quic.Config{
+		Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return clientTracer },
+	})
+	if clientConnIDGenerator == nil && clientConnIDLen == 0 {
+		conn, err = quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), clientQUICConf)
+		require.NoError(t, err)
+	} else {
+		clientTr := &quic.Transport{
+			Conn:                  newUDPConnLocalhost(t),
+			ConnectionIDLength:    clientConnIDLen,
+			ConnectionIDGenerator: clientConnIDGenerator,
+		}
+		defer clientTr.Close()
+		addTracer(clientTr)
+		conn, err = clientTr.Dial(ctx, ln.Addr(), getTLSClientConfig(), clientQUICConf)
+		require.NoError(t, err)
+	}
+
+	serverConn, err := ln.Accept(context.Background())
+	require.NoError(t, err)
+	serverStr, err := serverConn.OpenStream()
+	require.NoError(t, err)
+
+	go func() {
+		serverStr.Write(PRData)
+		serverStr.Close()
+	}()
+
+	str, err := conn.AcceptStream(context.Background())
+	require.NoError(t, err)
+	data, err := io.ReadAll(str)
+	require.NoError(t, err)
+	require.Equal(t, PRData, data)
+
+	conn.CloseWithError(0, "")
+	serverConn.CloseWithError(0, "")
+
+	for _, p := range serverCounter.getRcvdShortHeaderPackets() {
+		expectedLen := serverConnIDLen
+		if serverConnIDGenerator != nil {
+			expectedLen = serverConnIDGenerator.ConnectionIDLen()
+		}
+		if !assert.Equal(t, expectedLen, p.hdr.DestConnectionID.Len(), "server conn length mismatch") {
+			break
+		}
+	}
+	for _, p := range clientCounter.getRcvdShortHeaderPackets() {
+		expectedLen := clientConnIDLen
+		if clientConnIDGenerator != nil {
+			expectedLen = clientConnIDGenerator.ConnectionIDLen()
+		}
+		if !assert.Equal(t, expectedLen, p.hdr.DestConnectionID.Len(), "client conn length mismatch") {
+			break
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/connection_migration_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/connection_migration_test.go
new file mode 100644
index 000000000..507ee6db7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/connection_migration_test.go
@@ -0,0 +1,144 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestConnectionMigration(t *testing.T) {
+	ln, err := quic.ListenAddr("localhost:0", getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer ln.Close()
+
+	tr1 := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	defer tr1.Close()
+	tr2 := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	defer tr2.Close()
+
+	var packetsPath1, packetsPath2 atomic.Int64
+
+	const rtt = 5 * time.Millisecond
+	proxy := quicproxy.Proxy{
+		Conn:       newUDPConnLocalhost(t),
+		ServerAddr: ln.Addr().(*net.UDPAddr),
+		DelayPacket: func(dir quicproxy.Direction, from, to net.Addr, _ []byte) time.Duration {
+			var port int
+			switch dir {
+			case quicproxy.DirectionIncoming:
+				port = from.(*net.UDPAddr).Port
+			case quicproxy.DirectionOutgoing:
+				port = to.(*net.UDPAddr).Port
+			}
+			switch port {
+			case tr1.Conn.LocalAddr().(*net.UDPAddr).Port:
+				packetsPath1.Add(1)
+			case tr2.Conn.LocalAddr().(*net.UDPAddr).Port:
+				packetsPath2.Add(1)
+			default:
+				fmt.Println("address not found", from)
+			}
+			return rtt / 2
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	conn, err := tr1.Dial(ctx, proxy.LocalAddr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	sconn, err := ln.Accept(ctx)
+	require.NoError(t, err)
+	defer sconn.CloseWithError(0, "")
+
+	sendAndReceiveFile := func(t *testing.T) {
+		t.Helper()
+		str, err := conn.OpenUniStream()
+		require.NoError(t, err)
+
+		errChan := make(chan error, 1)
+		go func() {
+			defer close(errChan)
+			sstr, err := sconn.AcceptUniStream(ctx)
+			if err != nil {
+				errChan <- fmt.Errorf("accepting stream: %w", err)
+				return
+			}
+			data, err := io.ReadAll(sstr)
+			if err != nil {
+				errChan <- fmt.Errorf("reading stream data: %w", err)
+				return
+			}
+			if !bytes.Equal(data, PRData) {
+				errChan <- errors.New("unexpected data")
+			}
+		}()
+
+		_, err = str.Write(PRData)
+		require.NoError(t, err)
+		require.NoError(t, str.Close())
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			t.Fatal("timed out waiting for data")
+		}
+	}
+
+	sendAndReceiveFile(t) // stream 2
+	require.NotZero(t, packetsPath1.Load())
+	require.Zero(t, packetsPath2.Load())
+
+	// probing the path causes a few packets to be sent on path 2
+	path, err := conn.AddPath(tr2)
+	require.NoError(t, err)
+	require.ErrorIs(t, path.Switch(), quic.ErrPathNotValidated)
+	require.NoError(t, path.Probe(ctx))
+	require.Less(t, int(packetsPath2.Load()), 5)
+
+	// make sure that no more packets are sent on path 2 before switching to the path
+	c2 := packetsPath2.Load()
+	sendAndReceiveFile(t) // stream 6
+	require.Equal(t, packetsPath2.Load(), c2)
+
+	time.Sleep(3 * rtt) // wait for ACKs
+
+	// now switch and make sure that no packets are sent on path 1
+	require.NoError(t, path.Switch())
+	sendAndReceiveFile(t) // stream 10
+	c1 := packetsPath1.Load()
+	require.Equal(t, c1, packetsPath1.Load())
+	require.Greater(t, packetsPath2.Load(), c2)
+	require.Equal(t, tr2.Conn.LocalAddr(), conn.LocalAddr())
+
+	// switch back to the handshake path
+	time.Sleep(3 * rtt) // wait for ACKs
+	c1BeforeSwitch := packetsPath1.Load()
+	c2BeforeSwitch := packetsPath2.Load()
+	path2, err := conn.AddPath(tr1)
+	require.NoError(t, err)
+	require.NoError(t, path2.Probe(ctx))
+	time.Sleep(3 * rtt) // wait for ACKs
+	require.NoError(t, path2.Switch())
+	sendAndReceiveFile(t) // stream 14
+	require.Greater(t, packetsPath1.Load(), c1BeforeSwitch)
+	// some path probing might have happened
+	require.Less(t, int(packetsPath2.Load()-c2BeforeSwitch), 20)
+	require.Equal(t, tr1.Conn.LocalAddr(), conn.LocalAddr())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/datagram_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/datagram_test.go
new file mode 100644
index 000000000..9ec7a4642
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/datagram_test.go
@@ -0,0 +1,339 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"io"
+	mrand "math/rand/v2"
+	"net"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/testutils/events"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDatagramNegotiation(t *testing.T) {
+	t.Run("server enable, client enable", func(t *testing.T) {
+		testDatagramNegotiation(t, true, true)
+	})
+	t.Run("server enable, client disable", func(t *testing.T) {
+		testDatagramNegotiation(t, true, false)
+	})
+	t.Run("server disable, client enable", func(t *testing.T) {
+		testDatagramNegotiation(t, false, true)
+	})
+	t.Run("server disable, client disable", func(t *testing.T) {
+		testDatagramNegotiation(t, false, false)
+	})
+}
+
+func testDatagramNegotiation(t *testing.T, serverEnableDatagram, clientEnableDatagram bool) {
+	server, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{EnableDatagrams: serverEnableDatagram}),
+	)
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	clientConn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{EnableDatagrams: clientEnableDatagram}),
+	)
+	require.NoError(t, err)
+	defer clientConn.CloseWithError(0, "")
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	defer serverConn.CloseWithError(0, "")
+
+	serverState := serverConn.ConnectionState().SupportsDatagrams
+	clientState := clientConn.ConnectionState().SupportsDatagrams
+	require.Equal(t, serverEnableDatagram, serverState.Local, "server local datagram support")
+	require.Equal(t, clientEnableDatagram, serverState.Remote, "server view of client datagram support")
+	require.Equal(t, clientEnableDatagram, clientState.Local, "client local datagram support")
+	require.Equal(t, serverEnableDatagram, clientState.Remote, "client view of server datagram support")
+
+	if clientEnableDatagram {
+		require.NoError(t, serverConn.SendDatagram([]byte("foo")))
+		datagram, err := clientConn.ReceiveDatagram(ctx)
+		require.NoError(t, err)
+		require.Equal(t, []byte("foo"), datagram)
+	} else {
+		require.Error(t, serverConn.SendDatagram([]byte("foo")))
+	}
+
+	if serverEnableDatagram {
+		require.NoError(t, clientConn.SendDatagram([]byte("bar")))
+		datagram, err := serverConn.ReceiveDatagram(ctx)
+		require.NoError(t, err)
+		require.Equal(t, []byte("bar"), datagram)
+	} else {
+		require.Error(t, clientConn.SendDatagram([]byte("bar")))
+	}
+}
+
+func TestDatagramSizeLimit(t *testing.T) {
+	const maxDatagramSize = 456
+	originalMaxDatagramSize := wire.MaxDatagramSize
+	wire.MaxDatagramSize = maxDatagramSize
+	t.Cleanup(func() { wire.MaxDatagramSize = originalMaxDatagramSize })
+
+	server, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{EnableDatagrams: true}),
+	)
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	clientConn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{EnableDatagrams: true}),
+	)
+	require.NoError(t, err)
+	defer clientConn.CloseWithError(0, "")
+
+	err = clientConn.SendDatagram(bytes.Repeat([]byte("a"), maxDatagramSize+100)) // definitely too large
+	require.Error(t, err)
+	var sizeErr *quic.DatagramTooLargeError
+	require.ErrorAs(t, err, &sizeErr)
+	require.InDelta(t, sizeErr.MaxDatagramPayloadSize, maxDatagramSize, 10)
+
+	require.NoError(t, clientConn.SendDatagram(bytes.Repeat([]byte("b"), int(sizeErr.MaxDatagramPayloadSize))))
+	require.Error(t, clientConn.SendDatagram(bytes.Repeat([]byte("c"), int(sizeErr.MaxDatagramPayloadSize+1))))
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	defer serverConn.CloseWithError(0, "")
+	datagram, err := serverConn.ReceiveDatagram(ctx)
+	require.NoError(t, err)
+	require.Equal(t, bytes.Repeat([]byte("b"), int(sizeErr.MaxDatagramPayloadSize)), datagram)
+}
+
+func TestDatagramSizeLimitWithMTUDiscovery(t *testing.T) {
+	server, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{EnableDatagrams: true}),
+	)
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var eventRecorder events.Recorder
+	clientConn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{
+			InitialPacketSize: protocol.MinInitialPacketSize,
+			EnableDatagrams:   true,
+			Tracer:            newTracer(&eventRecorder),
+		}),
+	)
+	require.NoError(t, err)
+	defer clientConn.CloseWithError(0, "")
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	defer serverConn.CloseWithError(0, "")
+
+	serverErrChan := make(chan error, 1)
+	go func() {
+		str, err := serverConn.AcceptStream(ctx)
+		if err != nil {
+			serverErrChan <- err
+			return
+		}
+		_, err = io.Copy(io.Discard, str)
+		serverErrChan <- err
+	}()
+
+	str, err := clientConn.OpenStream()
+	require.NoError(t, err)
+
+	data := bytes.Repeat([]byte("d"), 16*1024)
+	var discoveredMTU int
+	for discoveredMTU == 0 {
+		_, err = str.Write(data)
+		require.NoError(t, err)
+		events := eventRecorder.Events(qlog.MTUUpdated{})
+		if len(events) > 0 {
+			update := events[len(events)-1].(qlog.MTUUpdated)
+			if update.Done {
+				discoveredMTU = update.Value
+			}
+		}
+		require.NoError(t, ctx.Err())
+	}
+	require.NoError(t, str.Close())
+
+	// Receiving the stream FIN guarantees that the client applied the MTU update observed above.
+	select {
+	case err := <-serverErrChan:
+		require.NoError(t, err)
+	case <-ctx.Done():
+		require.NoError(t, ctx.Err())
+	}
+
+	err = clientConn.SendDatagram(bytes.Repeat([]byte("x"), 2000))
+	var sizeErr *quic.DatagramTooLargeError
+	require.ErrorAs(t, err, &sizeErr)
+	maxPayloadSize := sizeErr.MaxDatagramPayloadSize
+	require.Greater(t, maxPayloadSize, int64(protocol.MinInitialPacketSize), "MTU discovery should increase the datagram size limit")
+	require.Less(t, maxPayloadSize, int64(discoveredMTU), "datagram payload must leave room for packet overhead")
+
+	datagramData := bytes.Repeat([]byte("z"), int(maxPayloadSize))
+	require.NoError(t, clientConn.SendDatagram(datagramData))
+	datagram, err := serverConn.ReceiveDatagram(ctx)
+	require.NoError(t, err, "datagram should be deliverable when respecting MaxDatagramPayloadSize")
+	require.Equal(t, datagramData, datagram)
+}
+
+func TestDatagramLoss(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 100 * time.Millisecond
+		const numDatagrams = 100
+		const datagramSize = 500
+
+		clientAddr := &net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}
+		serverAddr := &net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9002}
+		var droppedToClient, droppedToServer, total atomic.Int32
+		n := &simnet.Simnet{
+			Router: &directionAwareDroppingRouter{
+				ClientAddr: clientAddr,
+				ServerAddr: serverAddr,
+				Drop: func(d direction, p simnet.Packet) bool {
+					if wire.IsLongHeaderPacket(p.Data[0]) { // don't drop Long Header packets
+						return false
+					}
+					if len(p.Data) < datagramSize { // don't drop ACK-only packets
+						return false
+					}
+					total.Add(1)
+					// drop about 20% of Short Header packets with DATAGRAM frames
+					if mrand.Int()%5 == 0 {
+						switch d {
+						case directionToClient:
+							droppedToClient.Add(1)
+						case directionToServer:
+							droppedToServer.Add(1)
+						}
+						return true
+					}
+					return false
+				},
+			},
+		}
+		settings := simnet.NodeBiDiLinkSettings{Latency: rtt / 2}
+		clientPacketConn := n.NewEndpoint(clientAddr, settings)
+		defer clientPacketConn.Close()
+		serverPacketConn := n.NewEndpoint(serverAddr, settings)
+		defer serverPacketConn.Close()
+		require.NoError(t, n.Start())
+		defer n.Close()
+
+		server, err := quic.Listen(
+			serverPacketConn,
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true, EnableDatagrams: true}),
+		)
+		require.NoError(t, err)
+		defer server.Close()
+
+		const sendInterval = time.Second // send a datagram every second
+		ctx, cancel := context.WithTimeout(context.Background(), (numDatagrams+10)*sendInterval)
+		defer cancel()
+		clientConn, err := quic.Dial(
+			ctx,
+			clientPacketConn,
+			serverPacketConn.LocalAddr(),
+			getTLSClientConfig(),
+			getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true, EnableDatagrams: true}),
+		)
+		require.NoError(t, err)
+		defer clientConn.CloseWithError(0, "")
+
+		serverConn, err := server.Accept(ctx)
+		require.NoError(t, err)
+		defer serverConn.CloseWithError(0, "")
+
+		var clientDatagrams, serverDatagrams int
+		clientErrChan := make(chan error, 1)
+		go func() {
+			defer close(clientErrChan)
+			for {
+				if _, err := clientConn.ReceiveDatagram(ctx); err != nil {
+					clientErrChan <- err
+					return
+				}
+				clientDatagrams++
+			}
+		}()
+
+		for i := range numDatagrams {
+			payload := bytes.Repeat([]byte{uint8(i)}, datagramSize)
+			require.NoError(t, clientConn.SendDatagram(payload))
+			require.NoError(t, serverConn.SendDatagram(payload))
+			time.Sleep(sendInterval)
+		}
+
+		serverErrChan := make(chan error, 1)
+		go func() {
+			defer close(serverErrChan)
+			for {
+				if _, err := serverConn.ReceiveDatagram(ctx); err != nil {
+					serverErrChan <- err
+					return
+				}
+				serverDatagrams++
+			}
+		}()
+
+		select {
+		case err := <-clientErrChan:
+			require.ErrorIs(t, err, context.DeadlineExceeded)
+		case <-time.After(5 * numDatagrams * sendInterval):
+			t.Fatal("timeout")
+		}
+		select {
+		case err := <-serverErrChan:
+			require.ErrorIs(t, err, context.DeadlineExceeded)
+		case <-time.After(5 * numDatagrams * sendInterval):
+			t.Fatal("timeout")
+		}
+
+		numDroppedToClient := droppedToClient.Load()
+		numDroppedToServer := droppedToServer.Load()
+		t.Logf("dropped %d to client and %d to server out of %d packets", numDroppedToClient, numDroppedToServer, total.Load())
+		assert.NotZero(t, numDroppedToClient)
+		assert.NotZero(t, numDroppedToServer)
+		t.Logf("server received %d out of %d sent datagrams", serverDatagrams, numDatagrams)
+		assert.EqualValues(t, numDatagrams-numDroppedToServer, serverDatagrams, "datagrams received by the server")
+		t.Logf("client received %d out of %d sent datagrams", clientDatagrams, numDatagrams)
+		assert.EqualValues(t, numDatagrams-numDroppedToClient, clientDatagrams, "datagrams received by the client")
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/deadline_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/deadline_test.go
new file mode 100644
index 000000000..ed577f4d0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/deadline_test.go
@@ -0,0 +1,235 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+
+	"github.com/stretchr/testify/require"
+)
+
+func setupDeadlineTest(t *testing.T) (serverStr, clientStr *quic.Stream) {
+	t.Helper()
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	t.Cleanup(func() { server.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.CloseWithError(0, "") })
+	clientStr, err = conn.OpenStream()
+	require.NoError(t, err)
+	_, err = clientStr.Write([]byte{0}) // need to write one byte so the server learns about the stream
+	require.NoError(t, err)
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	t.Cleanup(func() { serverConn.CloseWithError(0, "") })
+	serverStr, err = serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+
+	_, err = serverStr.Read([]byte{0})
+	require.NoError(t, err)
+	return serverStr, clientStr
+}
+
+func TestReadDeadlineSync(t *testing.T) {
+	serverStr, clientStr := setupDeadlineTest(t)
+
+	const timeout = time.Millisecond
+	errChan := make(chan error, 1)
+	go func() {
+		_, err := serverStr.Write(PRDataLong)
+		errChan <- err
+	}()
+
+	var bytesRead int
+	var timeoutCounter int
+	buf := make([]byte, 1<<10)
+	data := make([]byte, len(PRDataLong))
+	clientStr.SetReadDeadline(time.Now().Add(timeout))
+	for bytesRead < len(PRDataLong) {
+		n, err := clientStr.Read(buf)
+		if nerr, ok := err.(net.Error); ok && nerr.Timeout() {
+			timeoutCounter++
+			clientStr.SetReadDeadline(time.Now().Add(timeout))
+		} else {
+			require.NoError(t, err)
+		}
+		copy(data[bytesRead:], buf[:n])
+		bytesRead += n
+	}
+	require.Equal(t, PRDataLong, data)
+	// make sure the test actually worked and Read actually ran into the deadline a few times
+	t.Logf("ran into deadline %d times", timeoutCounter)
+	require.GreaterOrEqual(t, timeoutCounter, 10)
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestReadDeadlineAsync(t *testing.T) {
+	serverStr, clientStr := setupDeadlineTest(t)
+
+	const timeout = time.Millisecond
+	errChan := make(chan error, 1)
+	go func() {
+		_, err := serverStr.Write(PRDataLong)
+		errChan <- err
+	}()
+
+	var bytesRead int
+	var timeoutCounter int
+	buf := make([]byte, 1<<10)
+	data := make([]byte, len(PRDataLong))
+	received := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-received:
+				return
+			default:
+				time.Sleep(timeout)
+			}
+			clientStr.SetReadDeadline(time.Now().Add(timeout))
+		}
+	}()
+
+	for bytesRead < len(PRDataLong) {
+		n, err := clientStr.Read(buf)
+		if nerr, ok := err.(net.Error); ok && nerr.Timeout() {
+			timeoutCounter++
+		} else {
+			require.NoError(t, err)
+		}
+		copy(data[bytesRead:], buf[:n])
+		bytesRead += n
+	}
+
+	require.Equal(t, PRDataLong, data)
+	close(received)
+
+	// make sure the test actually worked and Read actually ran into the deadline a few times
+	t.Logf("ran into deadline %d times", timeoutCounter)
+	require.GreaterOrEqual(t, timeoutCounter, 10)
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestWriteDeadlineSync(t *testing.T) {
+	serverStr, clientStr := setupDeadlineTest(t)
+
+	const timeout = time.Millisecond
+
+	errChan := make(chan error, 1)
+	go func() {
+		defer close(errChan)
+		data, err := io.ReadAll(serverStr)
+		if err != nil {
+			errChan <- err
+		}
+		if !bytes.Equal(PRDataLong, data) {
+			errChan <- fmt.Errorf("data mismatch")
+		}
+	}()
+
+	var bytesWritten int
+	var timeoutCounter int
+	clientStr.SetWriteDeadline(time.Now().Add(timeout))
+	for bytesWritten < len(PRDataLong) {
+		n, err := clientStr.Write(PRDataLong[bytesWritten:])
+		if nerr, ok := err.(net.Error); ok && nerr.Timeout() {
+			timeoutCounter++
+			clientStr.SetWriteDeadline(time.Now().Add(timeout))
+		} else {
+			require.NoError(t, err)
+		}
+		bytesWritten += n
+	}
+	clientStr.Close()
+
+	// make sure the test actually worked and Write actually ran into the deadline a few times
+	t.Logf("ran into deadline %d times", timeoutCounter)
+	require.GreaterOrEqual(t, timeoutCounter, 10)
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestWriteDeadlineAsync(t *testing.T) {
+	serverStr, clientStr := setupDeadlineTest(t)
+
+	const timeout = time.Millisecond
+
+	errChan := make(chan error, 1)
+	go func() {
+		defer close(errChan)
+		data, err := io.ReadAll(serverStr)
+		if err != nil {
+			errChan <- err
+		}
+		if !bytes.Equal(PRDataLong, data) {
+			errChan <- fmt.Errorf("data mismatch")
+		}
+	}()
+
+	clientStr.SetWriteDeadline(time.Now().Add(timeout))
+	readDone := make(chan struct{})
+	deadlineDone := make(chan struct{})
+	go func() {
+		defer close(deadlineDone)
+		for {
+			select {
+			case <-readDone:
+				return
+			default:
+				time.Sleep(timeout)
+			}
+			clientStr.SetWriteDeadline(time.Now().Add(timeout))
+		}
+	}()
+
+	var bytesWritten int
+	var timeoutCounter int
+	clientStr.SetWriteDeadline(time.Now().Add(timeout))
+	for bytesWritten < len(PRDataLong) {
+		n, err := clientStr.Write(PRDataLong[bytesWritten:])
+		if nerr, ok := err.(net.Error); ok && nerr.Timeout() {
+			timeoutCounter++
+		} else {
+			require.NoError(t, err)
+		}
+		bytesWritten += n
+	}
+	clientStr.Close()
+
+	close(readDone)
+
+	// make sure the test actually worked and Write actually ran into the deadline a few times
+	t.Logf("ran into deadline %d times", timeoutCounter)
+	require.GreaterOrEqual(t, timeoutCounter, 10)
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/drop_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/drop_test.go
new file mode 100644
index 000000000..ca12fc48c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/drop_test.go
@@ -0,0 +1,117 @@
+package self_test
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPacketDrops(t *testing.T) {
+	for _, direction := range []protocol.Perspective{protocol.PerspectiveClient, protocol.PerspectiveServer} {
+		t.Run(fmt.Sprintf("from %s", direction), func(t *testing.T) {
+			testPacketDrops(t, direction)
+		})
+	}
+}
+
+func testPacketDrops(t *testing.T, direction protocol.Perspective) {
+	synctest.Test(t, func(t *testing.T) {
+		const numMessages = 50
+		const rtt = 10 * time.Millisecond
+
+		addrClient := &net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}
+		addrServer := &net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9002}
+
+		var numDroppedPackets atomic.Int32
+		messageInterval := randomDuration(10*time.Millisecond, 100*time.Millisecond)
+		dropDuration := randomDuration(messageInterval*3, 2*time.Second)
+		dropDelay := randomDuration(25*time.Millisecond, numMessages*messageInterval/2)
+
+		startTime := time.Now()
+		n := &simnet.Simnet{
+			Router: &droppingRouter{
+				Drop: func(p simnet.Packet) bool {
+					switch p.To {
+					case addrClient:
+						if direction == protocol.PerspectiveClient {
+							return false
+						}
+					case addrServer:
+						if direction == protocol.PerspectiveServer {
+							return false
+						}
+					}
+					if wire.IsLongHeaderPacket(p.Data[0]) { // don't interfere with the handshake
+						return false
+					}
+					drop := time.Now().After(startTime.Add(dropDelay)) && time.Now().Before(startTime.Add(dropDelay).Add(dropDuration))
+					if drop {
+						numDroppedPackets.Add(1)
+					}
+					return drop
+				},
+			},
+		}
+		settings := simnet.NodeBiDiLinkSettings{Latency: rtt / 2}
+		clientPacketConn := n.NewEndpoint(addrClient, settings)
+		defer clientPacketConn.Close()
+		serverPacketConn := n.NewEndpoint(addrServer, settings)
+		defer serverPacketConn.Close()
+
+		require.NoError(t, n.Start())
+		defer n.Close()
+
+		t.Logf("sending a message every %s, %d times", messageInterval, numMessages)
+		t.Logf("dropping packets for %s, after a delay of %s", dropDuration, dropDelay)
+
+		ln, err := quic.Listen(serverPacketConn, getTLSConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+		defer ln.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		conn, err := quic.Dial(ctx, clientPacketConn, ln.Addr().(*net.UDPAddr), getTLSClientConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+		defer conn.CloseWithError(0, "")
+
+		serverConn, err := ln.Accept(ctx)
+		require.NoError(t, err)
+		defer serverConn.CloseWithError(0, "")
+		serverStr, err := serverConn.OpenUniStream()
+		require.NoError(t, err)
+		errChan := make(chan error, 1)
+		go func() {
+			for i := range numMessages {
+				time.Sleep(messageInterval)
+				if _, err := serverStr.Write([]byte{uint8(i + 1)}); err != nil {
+					errChan <- err
+					return
+				}
+			}
+		}()
+
+		str, err := conn.AcceptUniStream(ctx)
+		require.NoError(t, err)
+		for i := range numMessages {
+			b := []byte{0}
+			n, err := str.Read(b)
+			require.NoError(t, err)
+			require.Equal(t, 1, n)
+			require.Equal(t, byte(i+1), b[0])
+		}
+		numDropped := numDroppedPackets.Load()
+		t.Logf("dropped %d packets", numDropped)
+		require.NotZero(t, numDropped)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/early_data_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/early_data_test.go
new file mode 100644
index 000000000..d33ea2ed0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/early_data_test.go
@@ -0,0 +1,72 @@
+package self_test
+
+import (
+	"context"
+	"io"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestEarlyData(t *testing.T) {
+	const rtt = 80 * time.Millisecond
+	ln, err := quic.ListenEarly(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer ln.Close()
+
+	proxy := &quicproxy.Proxy{
+		Conn:        newUDPConnLocalhost(t),
+		ServerAddr:  ln.Addr().(*net.UDPAddr),
+		DelayPacket: func(quicproxy.Direction, net.Addr, net.Addr, []byte) time.Duration { return rtt / 2 },
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	connChan := make(chan *quic.Conn)
+	errChan := make(chan error)
+	go func() {
+		conn, err := ln.Accept(context.Background())
+		if err != nil {
+			errChan <- err
+			return
+		}
+		connChan <- conn
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	clientConn, err := quic.Dial(ctx, newUDPConnLocalhost(t), proxy.LocalAddr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+
+	var serverConn *quic.Conn
+	select {
+	case serverConn = <-connChan:
+	case err := <-errChan:
+		t.Fatalf("error accepting connection: %s", err)
+	}
+	str, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = str.Write([]byte("early data"))
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+	// the write should have completed before the handshake
+	select {
+	case <-serverConn.HandshakeComplete():
+		t.Fatal("handshake shouldn't be completed yet")
+	default:
+	}
+
+	clientStr, err := clientConn.AcceptUniStream(context.Background())
+	require.NoError(t, err)
+	data, err := io.ReadAll(clientStr)
+	require.NoError(t, err)
+	require.Equal(t, []byte("early data"), data)
+
+	clientConn.CloseWithError(0, "")
+	<-serverConn.Context().Done()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_context_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_context_test.go
new file mode 100644
index 000000000..bc5b1cf69
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_context_test.go
@@ -0,0 +1,289 @@
+package self_test
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlogwriter"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestHandshakeContextTimeout(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), scaleDuration(20*time.Millisecond))
+	defer cancel()
+
+	conn := newUDPConnLocalhost(t)
+
+	errChan := make(chan error, 1)
+	go func() {
+		_, err := quic.Dial(ctx, newUDPConnLocalhost(t), conn.LocalAddr(), getTLSClientConfig(), getQuicConfig(nil))
+		errChan <- err
+	}()
+
+	require.ErrorIs(t, <-errChan, context.DeadlineExceeded)
+}
+
+func TestHandshakeCancellationError(t *testing.T) {
+	ctx, cancel := context.WithCancelCause(context.Background())
+	errChan := make(chan error, 1)
+	conn := newUDPConnLocalhost(t)
+	go func() {
+		_, err := quic.Dial(ctx, newUDPConnLocalhost(t), conn.LocalAddr(), getTLSClientConfig(), getQuicConfig(nil))
+		errChan <- err
+	}()
+
+	cancel(errors.New("application cancelled"))
+	require.EqualError(t, <-errChan, "application cancelled")
+}
+
+func TestConnContextOnServerSide(t *testing.T) {
+	tlsGetConfigForClientContextChan := make(chan context.Context, 1)
+	tlsGetCertificateContextChan := make(chan context.Context, 1)
+	tracerContextChan := make(chan context.Context, 1)
+	connContextChan := make(chan context.Context, 1)
+	streamContextChan := make(chan context.Context, 1)
+
+	tr := &quic.Transport{
+		Conn: newUDPConnLocalhost(t),
+		ConnContext: func(ctx context.Context, _ *quic.ClientInfo) (context.Context, error) {
+			return context.WithValue(ctx, "foo", "bar"), nil
+		},
+	}
+	defer tr.Close()
+
+	server, err := tr.Listen(
+		&tls.Config{
+			GetConfigForClient: func(info *tls.ClientHelloInfo) (*tls.Config, error) {
+				tlsGetConfigForClientContextChan <- info.Context()
+				tlsConf := getTLSConfig()
+				tlsConf.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+					tlsGetCertificateContextChan <- info.Context()
+					return &tlsConf.Certificates[0], nil
+				}
+				return tlsConf, nil
+			},
+		},
+		getQuicConfig(&quic.Config{
+			Tracer: func(ctx context.Context, _ bool, _ quic.ConnectionID) qlogwriter.Trace {
+				tracerContextChan <- ctx
+				return nil
+			},
+		}),
+	)
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	c, err := quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	connContextChan <- serverConn.Context()
+	str, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	streamContextChan <- str.Context()
+	str.Write([]byte{1, 2, 3})
+
+	_, err = c.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	c.CloseWithError(1337, "bye")
+
+	checkContext := func(c <-chan context.Context, checkCancellationCause bool) {
+		t.Helper()
+		var ctx context.Context
+		select {
+		case ctx = <-c:
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for context")
+		}
+
+		val := ctx.Value("foo")
+		require.NotNil(t, val)
+		v := val.(string)
+		require.Equal(t, "bar", v)
+
+		select {
+		case <-ctx.Done():
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for context to be done")
+		}
+
+		if !checkCancellationCause {
+			return
+		}
+		ctxErr := context.Cause(ctx)
+		var appErr *quic.ApplicationError
+		require.ErrorAs(t, ctxErr, &appErr)
+		require.Equal(t, quic.ApplicationErrorCode(1337), appErr.ErrorCode)
+	}
+
+	checkContext(connContextChan, true)
+	checkContext(tracerContextChan, true)
+	checkContext(streamContextChan, true)
+	// crypto/tls cancels the context when the TLS handshake completes.
+	checkContext(tlsGetConfigForClientContextChan, false)
+	checkContext(tlsGetCertificateContextChan, false)
+}
+
+func TestConnContextRejection(t *testing.T) {
+	t.Run("rejecting", func(t *testing.T) {
+		testConnContextRejection(t, true)
+	})
+	t.Run("not rejecting", func(t *testing.T) {
+		testConnContextRejection(t, false)
+	})
+}
+
+func testConnContextRejection(t *testing.T, reject bool) {
+	tr := &quic.Transport{
+		Conn: newUDPConnLocalhost(t),
+		ConnContext: func(ctx context.Context, ci *quic.ClientInfo) (context.Context, error) {
+			if reject {
+				return nil, errors.New("rejecting connection")
+			}
+			return context.WithValue(ctx, "addr", ci.RemoteAddr), nil
+		},
+	}
+	defer tr.Close()
+
+	server, err := tr.Listen(
+		getTLSConfig(),
+		getQuicConfig(nil),
+	)
+	require.NoError(t, err)
+	defer server.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	pc := newUDPConnLocalhost(t)
+	c, err := quic.Dial(ctx, pc, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	if reject {
+		require.ErrorIs(t, err, &quic.TransportError{Remote: true, ErrorCode: quic.ConnectionRefused})
+		return
+	}
+	require.NoError(t, err)
+	defer c.CloseWithError(0, "")
+
+	conn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	require.Equal(t, pc.LocalAddr().String(), conn.Context().Value("addr").(net.Addr).String())
+	conn.CloseWithError(0, "")
+}
+
+// Users are not supposed to return a fresh context from ConnContext, but we should handle it gracefully.
+func TestConnContextFreshContext(t *testing.T) {
+	tr := &quic.Transport{
+		Conn: newUDPConnLocalhost(t),
+		ConnContext: func(ctx context.Context, _ *quic.ClientInfo) (context.Context, error) {
+			return context.Background(), nil
+		},
+	}
+	defer tr.Close()
+	server, err := tr.Listen(getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	errChan := make(chan error, 1)
+	go func() {
+		conn, err := server.Accept(context.Background())
+		if err != nil {
+			errChan <- err
+			return
+		}
+		conn.CloseWithError(1337, "bye")
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	c, err := quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+
+	select {
+	case <-c.Context().Done():
+	case err := <-errChan:
+		t.Fatalf("accept failed: %v", err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestContextOnClientSide(t *testing.T) {
+	tlsServerConf := getTLSConfig()
+	tlsServerConf.ClientAuth = tls.RequestClientCert
+	server, err := quic.Listen(newUDPConnLocalhost(t), tlsServerConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	tlsContextChan := make(chan context.Context, 1)
+	tracerContextChan := make(chan context.Context, 1)
+	tlsConf := getTLSClientConfig()
+	tlsConf.GetClientCertificate = func(info *tls.CertificateRequestInfo) (*tls.Certificate, error) {
+		tlsContextChan <- info.Context()
+		return &tlsServerConf.Certificates[0], nil
+	}
+
+	ctx, cancel := context.WithCancel(context.WithValue(context.Background(), "foo", "bar"))
+	conn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		tlsConf,
+		getQuicConfig(&quic.Config{
+			Tracer: func(ctx context.Context, _ bool, _ quic.ConnectionID) qlogwriter.Trace {
+				tracerContextChan <- ctx
+				return nil
+			},
+		}),
+	)
+	require.NoError(t, err)
+	cancel()
+
+	// Make sure the connection context is not cancelled (even though derived from the ctx passed to Dial)
+	select {
+	case <-conn.Context().Done():
+		t.Fatal("context should not be cancelled")
+	default:
+	}
+
+	checkContext := func(ctx context.Context, checkCancellationCause bool) {
+		t.Helper()
+		val := ctx.Value("foo")
+		require.NotNil(t, val)
+		require.Equal(t, "bar", val.(string))
+		if !checkCancellationCause {
+			return
+		}
+		ctxErr := context.Cause(ctx)
+		var appErr *quic.ApplicationError
+		require.ErrorAs(t, ctxErr, &appErr)
+		require.EqualValues(t, 1337, appErr.ErrorCode)
+	}
+
+	checkContextFromChan := func(c <-chan context.Context, checkCancellationCause bool) {
+		t.Helper()
+		var ctx context.Context
+		select {
+		case ctx = <-c:
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for context")
+		}
+		checkContext(ctx, checkCancellationCause)
+	}
+
+	str, err := conn.OpenUniStream()
+	require.NoError(t, err)
+	conn.CloseWithError(1337, "bye")
+
+	checkContext(conn.Context(), true)
+	checkContext(str.Context(), true)
+	// crypto/tls cancels the context when the TLS handshake completes
+	checkContextFromChan(tlsContextChan, false)
+	checkContextFromChan(tracerContextChan, false)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_drop_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_drop_test.go
new file mode 100644
index 000000000..2163b0918
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_drop_test.go
@@ -0,0 +1,411 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	mrand "math/rand/v2"
+	"net"
+	"slices"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/testutils/events"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/require"
+)
+
+func dropTestProtocolClientSpeaksFirst(t *testing.T, ln *quic.Listener, clientConn net.PacketConn, clientConf *tls.Config, timeout time.Duration, data []byte) *quic.Conn {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	conn, err := quic.Dial(
+		ctx,
+		clientConn,
+		ln.Addr(),
+		clientConf,
+		getQuicConfig(&quic.Config{
+			MaxIdleTimeout:          timeout,
+			HandshakeIdleTimeout:    timeout,
+			DisablePathMTUDiscovery: true,
+		}),
+	)
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	str, err := conn.OpenUniStream()
+	require.NoError(t, err)
+	errChan := make(chan error, 1)
+	go func() {
+		defer str.Close()
+		_, err := str.Write(data)
+		errChan <- err
+	}()
+
+	serverConn, err := ln.Accept(ctx)
+	require.NoError(t, err)
+	serverStr, err := serverConn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	b, err := io.ReadAll(&readerWithTimeout{Reader: serverStr, Timeout: timeout})
+	require.NoError(t, err)
+	require.Equal(t, b, data)
+	serverConn.CloseWithError(0, "")
+
+	return conn
+}
+
+func dropTestProtocolServerSpeaksFirst(t *testing.T, ln *quic.Listener, clientConn net.PacketConn, clientConf *tls.Config, timeout time.Duration, data []byte) *quic.Conn {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	conn, err := quic.Dial(
+		ctx,
+		clientConn,
+		ln.Addr(),
+		clientConf,
+		getQuicConfig(&quic.Config{
+			MaxIdleTimeout:          timeout,
+			HandshakeIdleTimeout:    timeout,
+			DisablePathMTUDiscovery: true,
+		}),
+	)
+	require.NoError(t, err)
+
+	errChan := make(chan error, 1)
+	go func() {
+		defer close(errChan)
+		defer conn.CloseWithError(0, "")
+		str, err := conn.AcceptUniStream(ctx)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		b, err := io.ReadAll(&readerWithTimeout{Reader: str, Timeout: timeout})
+		if err != nil {
+			errChan <- err
+			return
+		}
+		if !bytes.Equal(b, data) {
+			errChan <- fmt.Errorf("data mismatch: %x != %x", b, data)
+			return
+		}
+	}()
+
+	serverConn, err := ln.Accept(ctx)
+	require.NoError(t, err)
+	serverStr, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+	_, err = serverStr.Write(data)
+	require.NoError(t, err)
+	require.NoError(t, serverStr.Close())
+
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(timeout):
+		t.Fatal("server connection not closed")
+	}
+
+	select {
+	case <-conn.Context().Done():
+	case <-time.After(timeout):
+		t.Fatal("server connection not closed")
+	}
+
+	return conn
+}
+
+func dropTestProtocolNobodySpeaks(t *testing.T, ln *quic.Listener, clientConn net.PacketConn, clientConf *tls.Config, timeout time.Duration, _ []byte) *quic.Conn {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	conn, err := quic.Dial(
+		ctx,
+		clientConn,
+		ln.Addr(),
+		clientConf,
+		getQuicConfig(&quic.Config{
+			MaxIdleTimeout:          timeout,
+			HandshakeIdleTimeout:    timeout,
+			DisablePathMTUDiscovery: true,
+		}),
+	)
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	serverConn, err := ln.Accept(ctx)
+	require.NoError(t, err)
+	serverConn.CloseWithError(0, "")
+
+	return conn
+}
+
+func dropCallbackDropNthPacket(dir direction, ns ...int) func(direction, simnet.Packet) bool {
+	var toClient, toServer atomic.Int32
+	return func(d direction, p simnet.Packet) bool {
+		switch d {
+		case directionToClient:
+			c := toClient.Add(1)
+			if d == dir || dir == directionBoth {
+				return slices.Contains(ns, int(c))
+			}
+		case directionToServer:
+			c := toServer.Add(1)
+			if dir == d || dir == directionBoth {
+				return slices.Contains(ns, int(c))
+			}
+		}
+		return false
+	}
+}
+
+func dropCallbackDropOneThird(_ direction) func(direction, simnet.Packet) bool {
+	const maxSequentiallyDropped = 10
+	var mx sync.Mutex
+	var toClient, toServer int
+	return func(d direction, p simnet.Packet) bool {
+		drop := mrand.IntN(3) == 0
+
+		mx.Lock()
+		defer mx.Unlock()
+		// never drop more than 10 consecutive packets
+		if d == directionToClient || d == directionBoth {
+			if drop {
+				toClient++
+				if toClient > maxSequentiallyDropped {
+					drop = false
+				}
+			}
+			if !drop {
+				toClient = 0
+			}
+		}
+		if d == directionToServer || d == directionBoth {
+			if drop {
+				toServer++
+				if toServer > maxSequentiallyDropped {
+					drop = false
+				}
+			}
+			if !drop {
+				toServer = 0
+			}
+		}
+		return drop
+	}
+}
+
+func TestHandshakeWithPacketLoss(t *testing.T) {
+	data := GeneratePRData(5000)
+	const timeout = 2 * time.Minute
+	const rtt = 20 * time.Millisecond
+
+	type dropPattern string
+
+	const (
+		dropPatternDrop1stPacket         dropPattern = "drop 1st packet"
+		dropPatternDropFirst3Packets     dropPattern = "drop first 3 packets"
+		dropPatternDropOneThirdOfPackets dropPattern = "drop 1/3 of packets"
+	)
+
+	type testConfig struct {
+		postQuantum   bool
+		longCertChain bool
+		doRetry       bool
+	}
+
+	for _, dir := range []direction{directionToClient, directionToServer, directionBoth} {
+		for _, pattern := range []dropPattern{
+			dropPatternDrop1stPacket,
+			dropPatternDropFirst3Packets,
+			dropPatternDropOneThirdOfPackets,
+		} {
+			t.Run(fmt.Sprintf("%s in direction %s", pattern, dir), func(t *testing.T) {
+				for _, conf := range []testConfig{
+					{postQuantum: false, longCertChain: false, doRetry: true},
+					{postQuantum: false, longCertChain: false, doRetry: false},
+					{postQuantum: false, longCertChain: true, doRetry: false},
+					{postQuantum: true, longCertChain: false, doRetry: false},
+					{postQuantum: true, longCertChain: true, doRetry: false},
+				} {
+					for _, test := range []struct {
+						name string
+						fn   func(t *testing.T, ln *quic.Listener, clientConn net.PacketConn, clientConf *tls.Config, timeout time.Duration, data []byte) *quic.Conn
+					}{
+						{"client speaks first", dropTestProtocolClientSpeaksFirst},
+						{"server speaks first", dropTestProtocolServerSpeaksFirst},
+						{"nobody speaks", dropTestProtocolNobodySpeaks},
+					} {
+						t.Run(fmt.Sprintf("retry: %t/%s", conf.doRetry, test.name), func(t *testing.T) {
+							synctest.Test(t, func(t *testing.T) {
+								clientAddr := &net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}
+								serverAddr := &net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9002}
+								var fn func(direction, simnet.Packet) bool
+								switch pattern {
+								case dropPatternDrop1stPacket:
+									fn = dropCallbackDropNthPacket(dir, 1)
+								case dropPatternDropFirst3Packets:
+									fn = dropCallbackDropNthPacket(dir, 1, 2, 3)
+								case dropPatternDropOneThirdOfPackets:
+									fn = dropCallbackDropOneThird(dir)
+								}
+								var numDropped atomic.Int32
+								n := &simnet.Simnet{
+									Router: &directionAwareDroppingRouter{
+										ClientAddr: clientAddr,
+										ServerAddr: serverAddr,
+										Drop: func(d direction, p simnet.Packet) bool {
+											drop := fn(d, p)
+											if drop {
+												numDropped.Add(1)
+											}
+											return drop
+										},
+									},
+								}
+								settings := simnet.NodeBiDiLinkSettings{Latency: rtt / 2}
+								clientConn := n.NewEndpoint(clientAddr, settings)
+								defer clientConn.Close()
+								serverConn := n.NewEndpoint(serverAddr, settings)
+								defer serverConn.Close()
+								require.NoError(t, n.Start())
+								defer n.Close()
+
+								var tlsConf *tls.Config
+								if conf.longCertChain {
+									tlsConf = getTLSConfigWithLongCertChain()
+								} else {
+									tlsConf = getTLSConfig()
+								}
+								clientConf := getTLSClientConfig()
+								if !conf.postQuantum {
+									clientConf.CurvePreferences = []tls.CurveID{tls.CurveP384}
+								}
+
+								tr := &quic.Transport{
+									Conn:                serverConn,
+									VerifySourceAddress: func(net.Addr) bool { return conf.doRetry },
+								}
+								defer tr.Close()
+
+								ln, err := tr.Listen(
+									tlsConf,
+									getQuicConfig(&quic.Config{
+										MaxIdleTimeout:          timeout,
+										HandshakeIdleTimeout:    timeout,
+										DisablePathMTUDiscovery: true,
+									}),
+								)
+								require.NoError(t, err)
+								defer ln.Close()
+
+								conn := test.fn(t, ln, clientConn, clientConf, timeout, data)
+								curveID := getCurveID(conn.ConnectionState().TLS)
+								if conf.postQuantum {
+									require.Equal(t, tls.X25519MLKEM768, curveID)
+								} else {
+									require.Equal(t, tls.CurveP384, curveID)
+								}
+
+								if pattern != dropPatternDropOneThirdOfPackets {
+									require.NotZero(t, numDropped.Load())
+								}
+								t.Logf("dropped %d packets", numDropped.Load())
+							})
+						})
+					}
+				}
+			})
+		}
+	}
+}
+
+func TestHandshakePacketBuffering(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 20 * time.Millisecond
+
+		clientAddr := &net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}
+		serverAddr := &net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9002}
+		var droppedFirst atomic.Bool
+		n := &simnet.Simnet{
+			Router: &directionAwareDroppingRouter{
+				ClientAddr: clientAddr,
+				ServerAddr: serverAddr,
+				Drop: func(d direction, p simnet.Packet) bool {
+					if droppedFirst.Load() {
+						return false
+					}
+					if d == directionToClient && containsPacketType(p.Data, protocol.PacketTypeInitial) {
+						droppedFirst.Store(true)
+						return true
+					}
+					return false
+				},
+			},
+		}
+		settings := simnet.NodeBiDiLinkSettings{Latency: rtt / 2}
+		clientConn := n.NewEndpoint(clientAddr, settings)
+		defer clientConn.Close()
+		serverConn := n.NewEndpoint(serverAddr, settings)
+		defer serverConn.Close()
+		require.NoError(t, n.Start())
+		defer n.Close()
+
+		var serverEventRecorder events.Recorder
+		ln, err := quic.Listen(
+			serverConn,
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{Tracer: newTracer(&serverEventRecorder)}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		var clientEventRecorder events.Recorder
+		conn, err := quic.Dial(
+			context.Background(),
+			clientConn,
+			ln.Addr(),
+			getTLSClientConfig(),
+			getQuicConfig(&quic.Config{Tracer: newTracer(&clientEventRecorder)}),
+		)
+		require.NoError(t, err)
+		defer conn.CloseWithError(0, "")
+		str, err := conn.OpenUniStream()
+		require.NoError(t, err)
+		data := []byte("foobar")
+		_, err = str.Write(data)
+		require.NoError(t, err)
+		require.NoError(t, str.Close())
+
+		require.Empty(t, serverEventRecorder.Events(qlog.PacketBuffered{}))
+		buffered := clientEventRecorder.Events(qlog.PacketBuffered{})
+		t.Logf("buffered packets: %d", len(buffered))
+		require.NotEmpty(t, buffered)
+		receivedPackets := make(map[qlog.DatagramPayloadChecksum][]qlog.PacketType)
+		for _, ev := range clientEventRecorder.Events(qlog.PacketReceived{}) {
+			checksum := ev.(qlog.PacketReceived).DatagramPayloadChecksum
+			receivedPackets[checksum] = append(receivedPackets[checksum], ev.(qlog.PacketReceived).Header.PacketType)
+		}
+		for _, ev := range buffered {
+			checksum := ev.(qlog.PacketBuffered).DatagramPayloadChecksum
+			require.Contains(t, receivedPackets, checksum)
+			require.Contains(t, receivedPackets[checksum], qlog.PacketTypeHandshake)
+		}
+
+		sconn, err := ln.Accept(context.Background())
+		require.NoError(t, err)
+		defer sconn.CloseWithError(0, "")
+		sstr, err := sconn.AcceptUniStream(context.Background())
+		require.NoError(t, err)
+		b, err := io.ReadAll(sstr)
+		require.NoError(t, err)
+		require.Equal(t, data, b)
+		require.Equal(t, rtt, sconn.ConnectionStats().SmoothedRTT)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_rtt_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_rtt_test.go
new file mode 100644
index 000000000..34791b284
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_rtt_test.go
@@ -0,0 +1,207 @@
+package self_test
+
+import (
+	"context"
+	"crypto/tls"
+	"io"
+	"net"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestHandshakeRTTRetry(t *testing.T) {
+	t.Run("retry", func(t *testing.T) {
+		testHandshakeRTTRetry(t, true)
+	})
+	t.Run("no retry", func(t *testing.T) {
+		testHandshakeRTTRetry(t, false)
+	})
+}
+
+func testHandshakeRTTRetry(t *testing.T, doRetry bool) {
+	var addrVerified bool
+	rtts := testHandshakeMeasureHandshake(t,
+		func(net.Addr) bool { return doRetry },
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{
+			GetConfigForClient: func(info *quic.ClientInfo) (*quic.Config, error) {
+				addrVerified = info.AddrVerified
+				return nil, nil
+			},
+		}),
+	)
+	if doRetry {
+		require.True(t, addrVerified, "should have verified address")
+		require.GreaterOrEqual(t, rtts, float64(2))
+		require.Less(t, rtts, float64(2.1))
+	} else {
+		require.False(t, addrVerified, "should not have verified address")
+		require.GreaterOrEqual(t, rtts, float64(1))
+		require.Less(t, rtts, float64(1.1))
+	}
+}
+
+func TestHandshakeRTTHelloRetryRequest(t *testing.T) {
+	tlsConf := getTLSConfig()
+	tlsConf.CurvePreferences = []tls.CurveID{tls.CurveP384}
+	var helloRetryRequest bool
+	tlsConf.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+		helloRetryRequest = info.HelloRetryRequest
+		return nil, nil
+	}
+	rtts := testHandshakeMeasureHandshake(t, nil, tlsConf, getQuicConfig(nil))
+	require.True(t, helloRetryRequest)
+	require.GreaterOrEqual(t, rtts, float64(2))
+	require.Less(t, rtts, float64(2.1))
+}
+
+func testHandshakeMeasureHandshake(t *testing.T, verifySourceAddress func(net.Addr) bool, tlsConf *tls.Config, quicConf *quic.Config) float64 {
+	var rtts float64
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 100 * time.Millisecond
+
+		clientPacketConn, serverPacketConn, close := newSimnetLink(t, rtt)
+		defer close(t)
+
+		tr := &quic.Transport{
+			Conn:                serverPacketConn,
+			VerifySourceAddress: verifySourceAddress,
+		}
+		addTracer(tr)
+		defer tr.Close()
+		ln, err := tr.Listen(tlsConf, quicConf)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		clientConfig := getQuicConfig(nil)
+		start := time.Now()
+		ctx, cancel := context.WithTimeout(context.Background(), 10*rtt)
+		defer cancel()
+		conn, err := quic.Dial(
+			ctx,
+			clientPacketConn,
+			serverPacketConn.LocalAddr(),
+			getTLSClientConfig(),
+			clientConfig,
+		)
+		require.NoError(t, err)
+		defer conn.CloseWithError(0, "")
+
+		rtts = time.Since(start).Seconds() / rtt.Seconds()
+	})
+	return rtts
+}
+
+func TestHandshake05RTT(t *testing.T) {
+	t.Run("using ListenEarly", func(t *testing.T) {
+		testHandshake05RTT(t, true)
+	})
+	t.Run("using Listen", func(t *testing.T) {
+		testHandshake05RTT(t, false)
+	})
+}
+
+func testHandshake05RTT(t *testing.T, use05RTT bool) {
+	synctest.Test(t, func(t *testing.T) {
+		type accepter interface {
+			Accept(context.Context) (*quic.Conn, error)
+		}
+
+		const rtt = 100 * time.Millisecond
+		clientPacketConn, serverPacketConn, close := newSimnetLink(t, rtt)
+		defer close(t)
+		var ln accepter
+		if use05RTT {
+			var err error
+			server, err := quic.ListenEarly(serverPacketConn, getTLSConfig(), getQuicConfig(nil))
+			require.NoError(t, err)
+			defer server.Close()
+			ln = server
+		} else {
+			var err error
+			server, err := quic.Listen(serverPacketConn, getTLSConfig(), getQuicConfig(nil))
+			require.NoError(t, err)
+			defer server.Close()
+			ln = server
+		}
+
+		connChan := make(chan *quic.Conn, 1)
+		errChan := make(chan error, 1)
+		go func() {
+			conn, err := ln.Accept(context.Background())
+			if err != nil {
+				errChan <- err
+				return
+			}
+			str, err := conn.OpenUniStream()
+			if err != nil {
+				errChan <- err
+				return
+			}
+			if _, err := str.Write([]byte("foobar")); err != nil {
+				errChan <- err
+				return
+			}
+			if err := str.Close(); err != nil {
+				errChan <- err
+				return
+			}
+
+			connChan <- conn
+		}()
+
+		start := time.Now()
+		ctx, cancel := context.WithTimeout(context.Background(), 10*rtt)
+		defer cancel()
+		conn, err := quic.Dial(
+			ctx,
+			clientPacketConn,
+			serverPacketConn.LocalAddr(),
+			getTLSClientConfig(),
+			getQuicConfig(nil),
+		)
+		require.NoError(t, err)
+		defer conn.CloseWithError(0, "")
+
+		rtts := time.Since(start).Seconds() / rtt.Seconds()
+		require.GreaterOrEqual(t, rtts, float64(1))
+		require.Less(t, rtts, float64(1.1))
+
+		start = time.Now()
+
+		select {
+		case err := <-errChan:
+			t.Fatal("failed to accept connection:", err)
+		case conn := <-connChan:
+			if !use05RTT {
+				// the server finishes the handshake 0.5 RTTs later
+				rtts = time.Since(start).Seconds() / rtt.Seconds()
+				require.GreaterOrEqual(t, rtts, float64(0.5))
+				require.Less(t, rtts, float64(0.6))
+			}
+			defer conn.CloseWithError(0, "")
+		}
+
+		// If 0.5 RTT was used, the message should be received immediately,
+		// otherwise it should take 1 RTT.
+		str, err := conn.AcceptUniStream(ctx)
+		require.NoError(t, err)
+		data, err := io.ReadAll(str)
+		require.NoError(t, err)
+		require.Equal(t, []byte("foobar"), data)
+
+		rtts = time.Since(start).Seconds() / rtt.Seconds()
+		if use05RTT {
+			require.GreaterOrEqual(t, rtts, float64(0))
+			require.Less(t, rtts, float64(0.1))
+		} else {
+			require.GreaterOrEqual(t, rtts, float64(1))
+			require.Less(t, rtts, float64(1.1))
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_test.go
new file mode 100644
index 000000000..9dafc13df
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/handshake_test.go
@@ -0,0 +1,820 @@
+package self_test
+
+import (
+	"context"
+	"crypto/fips140"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"runtime"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/qtls"
+
+	"github.com/stretchr/testify/require"
+)
+
+type tokenStore struct {
+	store quic.TokenStore
+	gets  chan<- string
+	puts  chan<- string
+}
+
+var _ quic.TokenStore = &tokenStore{}
+
+func newTokenStore(gets, puts chan<- string) quic.TokenStore {
+	return &tokenStore{
+		store: quic.NewLRUTokenStore(10, 4),
+		gets:  gets,
+		puts:  puts,
+	}
+}
+
+func (c *tokenStore) Put(key string, token *quic.ClientToken) {
+	c.puts <- key
+	c.store.Put(key, token)
+}
+
+func (c *tokenStore) Pop(key string) *quic.ClientToken {
+	c.gets <- key
+	return c.store.Pop(key)
+}
+
+func TestHandshakeAddrResolutionHelpers(t *testing.T) {
+	server, err := quic.ListenAddr("localhost:0", getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.DialAddr(
+		ctx,
+		fmt.Sprintf("localhost:%d", server.Addr().(*net.UDPAddr).Port),
+		getTLSClientConfig(),
+		getQuicConfig(nil),
+	)
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	defer serverConn.CloseWithError(0, "")
+}
+
+func TestHandshake(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		conf *tls.Config
+	}{
+		{"short cert chain", getTLSConfig()},
+		{"long cert chain", getTLSConfigWithLongCertChain()},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			server, err := quic.Listen(newUDPConnLocalhost(t), tt.conf, getQuicConfig(nil))
+			require.NoError(t, err)
+			defer server.Close()
+
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+			require.NoError(t, err)
+			defer conn.CloseWithError(0, "")
+
+			serverConn, err := server.Accept(ctx)
+			require.NoError(t, err)
+			defer serverConn.CloseWithError(0, "")
+		})
+	}
+}
+
+func TestHandshakeServerMismatch(t *testing.T) {
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	conf := getTLSClientConfig()
+	conf.ServerName = "foo.bar"
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	_, err = quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), conf, getQuicConfig(nil))
+	require.Error(t, err)
+	transportErr, ok := errors.AsType[*quic.TransportError](err)
+	require.True(t, ok)
+	require.True(t, transportErr.ErrorCode.IsCryptoError())
+	require.Contains(t, transportErr.Error(), "x509: certificate is valid for localhost, not foo.bar")
+	_, ok = errors.AsType[*tls.CertificateVerificationError](transportErr)
+	require.True(t, ok)
+}
+
+func TestHandshakeCipherSuites(t *testing.T) {
+	for _, suiteID := range []uint16{
+		tls.TLS_AES_128_GCM_SHA256,
+		tls.TLS_AES_256_GCM_SHA384,
+		tls.TLS_CHACHA20_POLY1305_SHA256,
+	} {
+		t.Run(tls.CipherSuiteName(suiteID), func(t *testing.T) {
+			if fips140.Enabled() && suiteID == tls.TLS_CHACHA20_POLY1305_SHA256 {
+				t.Skip("ChaCha20-Poly1305 is not allowed in FIPS 140-3 mode")
+			}
+
+			reset := qtls.SetCipherSuite(suiteID)
+			defer reset()
+
+			ln, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+			require.NoError(t, err)
+			defer ln.Close()
+
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+			require.NoError(t, err)
+			defer conn.CloseWithError(0, "")
+
+			serverConn, err := ln.Accept(context.Background())
+			require.NoError(t, err)
+			defer serverConn.CloseWithError(0, "")
+			serverStr, err := serverConn.OpenStream()
+			require.NoError(t, err)
+			errChan := make(chan error, 1)
+			go func() {
+				defer serverStr.Close()
+				_, err = serverStr.Write(PRData)
+				errChan <- err
+			}()
+			require.NoError(t, <-errChan)
+
+			str, err := conn.AcceptStream(context.Background())
+			require.NoError(t, err)
+			data, err := io.ReadAll(str)
+			require.NoError(t, err)
+			require.Equal(t, PRData, data)
+			require.Equal(t, suiteID, conn.ConnectionState().TLS.CipherSuite)
+		})
+	}
+}
+
+func TestTLSGetConfigForClientError(t *testing.T) {
+	tr := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	addTracer(tr)
+	defer tr.Close()
+
+	tlsConf := &tls.Config{
+		GetConfigForClient: func(info *tls.ClientHelloInfo) (*tls.Config, error) {
+			return nil, errors.New("nope")
+		},
+	}
+	ln, err := tr.Listen(tlsConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	defer ln.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	_, err = quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	var transportErr *quic.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.True(t, transportErr.ErrorCode.IsCryptoError())
+}
+
+// Since we're not operating on a net.Conn, we need to jump through some hoops to set the addresses on the tls.ClientHelloInfo.
+// Use a recursive setup to test that this works under all conditions.
+func TestTLSConfigGetConfigForClientAddresses(t *testing.T) {
+	var local, remote net.Addr
+	var local2, remote2 net.Addr
+	done := make(chan struct{})
+	tlsConf := &tls.Config{
+		GetConfigForClient: func(info *tls.ClientHelloInfo) (*tls.Config, error) {
+			local = info.Conn.LocalAddr()
+			remote = info.Conn.RemoteAddr()
+			conf := getTLSConfig()
+			conf.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+				defer close(done)
+				local2 = info.Conn.LocalAddr()
+				remote2 = info.Conn.RemoteAddr()
+				return &conf.Certificates[0], nil
+			}
+			return conf, nil
+		},
+	}
+	server, err := quic.Listen(newUDPConnLocalhost(t), tlsConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for GetCertificate callback")
+	}
+
+	require.Equal(t, server.Addr(), local)
+	require.Equal(t, conn.LocalAddr().(*net.UDPAddr).Port, remote.(*net.UDPAddr).Port)
+	require.Equal(t, local, local2)
+	require.Equal(t, remote, remote2)
+}
+
+func TestHandshakeFailsWithoutClientCert(t *testing.T) {
+	tlsConf := getTLSConfig()
+	tlsConf.ClientAuth = tls.RequireAndVerifyClientCert
+
+	server, err := quic.Listen(newUDPConnLocalhost(t), tlsConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+
+	// Usually, the error will occur after the client already finished the handshake.
+	// However, there's a race condition here. The server's CONNECTION_CLOSE might be
+	// received before the connection is returned, so we might already get the error while dialing.
+	if err == nil {
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := conn.AcceptStream(context.Background())
+			errChan <- err
+		}()
+
+		err = <-errChan
+	}
+
+	require.Error(t, err)
+	var transportErr *quic.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.True(t, transportErr.ErrorCode.IsCryptoError())
+	require.Condition(t, func() bool {
+		errStr := transportErr.Error()
+		return strings.Contains(errStr, "tls: certificate required") ||
+			strings.Contains(errStr, "tls: bad certificate")
+	})
+}
+
+func TestClosedConnectionsInAcceptQueue(t *testing.T) {
+	dialer := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	defer dialer.Close()
+
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	// Create first connection
+	conn1, err := dialer.Dial(ctx, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	conn2, err := dialer.Dial(ctx, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer conn2.CloseWithError(0, "")
+	// close the first connection
+	const appErrCode quic.ApplicationErrorCode = 12345
+	require.NoError(t, conn1.CloseWithError(appErrCode, ""))
+
+	time.Sleep(scaleDuration(25 * time.Millisecond)) // wait for connections to be queued and closed
+
+	// accept all connections, and find the closed one
+	var closedConn *quic.Conn
+	for range 2 {
+		conn, err := server.Accept(ctx)
+		require.NoError(t, err)
+		if conn.Context().Err() != nil {
+			require.Nil(t, closedConn, "only expected a single closed connection")
+			closedConn = conn
+		}
+	}
+	require.NotNil(t, closedConn, "expected one closed connection")
+
+	_, err = closedConn.AcceptStream(context.Background())
+	var appErr *quic.ApplicationError
+	require.ErrorAs(t, err, &appErr)
+	require.Equal(t, appErrCode, appErr.ErrorCode)
+}
+
+func TestServerAcceptQueueOverflow(t *testing.T) {
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	dialer := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	defer dialer.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	// fill up the accept queue
+	for range protocol.MaxAcceptQueueSize {
+		conn, err := dialer.Dial(ctx, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+		defer conn.CloseWithError(0, "")
+	}
+	time.Sleep(scaleDuration(25 * time.Millisecond)) // wait for connections to be queued
+
+	// next connection should be rejected
+	conn, err := dialer.Dial(ctx, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	_, err = conn.AcceptStream(ctx)
+	var transportErr *quic.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, quic.ConnectionRefused, transportErr.ErrorCode)
+
+	// accept one connection to free up a spot
+	_, err = server.Accept(ctx)
+	require.NoError(t, err)
+
+	// should be able to dial again
+	conn2, err := dialer.Dial(ctx, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer conn2.CloseWithError(0, "")
+	time.Sleep(scaleDuration(25 * time.Millisecond))
+
+	// but next connection should be rejected again
+	conn3, err := dialer.Dial(ctx, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	_, err = conn3.AcceptStream(ctx)
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, quic.ConnectionRefused, transportErr.ErrorCode)
+}
+
+func TestHandshakeCloseListener(t *testing.T) {
+	t.Run("using Transport.Listen", func(t *testing.T) {
+		testHandshakeCloseListener(t, func(tlsConf *tls.Config) *quic.Listener {
+			tr := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+			addTracer(tr)
+			t.Cleanup(func() { tr.Close() })
+
+			ln, err := tr.Listen(tlsConf, getQuicConfig(nil))
+			require.NoError(t, err)
+			return ln
+		})
+	})
+
+	t.Run("using Listen", func(t *testing.T) {
+		conn := newUDPConnLocalhost(t)
+		testHandshakeCloseListener(t, func(tlsConf *tls.Config) *quic.Listener {
+			ln, err := quic.Listen(conn, tlsConf, getQuicConfig(nil))
+			require.NoError(t, err)
+			return ln
+		})
+
+		// make sure that the Transport didn't close the underlying connection
+		conn2 := newUDPConnLocalhost(t)
+		_, err := conn2.WriteTo([]byte("test"), conn2.LocalAddr())
+		require.NoError(t, err)
+
+		conn2.SetReadDeadline(time.Now().Add(time.Second))
+		b := make([]byte, 1000)
+		n, err := conn2.Read(b)
+		require.NoError(t, err)
+		require.Equal(t, "test", string(b[:n]))
+	})
+
+	// This test is somewhat slow (600ms), since the connection entries are kept for 3 PTOs.
+	t.Run("using ListenAddr", func(t *testing.T) {
+		var lnAddr *net.UDPAddr
+		testHandshakeCloseListener(t, func(tlsConf *tls.Config) *quic.Listener {
+			ln, err := quic.ListenAddr("127.0.0.1:0", tlsConf, getQuicConfig(nil))
+			require.NoError(t, err)
+			lnAddr = ln.Addr().(*net.UDPAddr)
+			return ln
+		})
+
+		// make sure that the Transport closed the underlying connection
+		if runtime.GOOS != "windows" { // this check doesn't work on Windows
+			require.Eventually(t, func() bool {
+				conn, err := net.DialUDP("udp", nil, lnAddr)
+				require.NoError(t, err)
+				defer conn.Close()
+				_, err = conn.Write([]byte("test"))
+				require.NoError(t, err)
+				conn.SetReadDeadline(time.Now().Add(scaleDuration(10 * time.Millisecond)))
+				_, err = conn.Read(make([]byte, 1000))
+				require.Error(t, err)
+				return strings.Contains(err.Error(), "read: connection refused")
+			}, time.Second, 50*time.Millisecond)
+		}
+	})
+}
+
+func testHandshakeCloseListener(t *testing.T, createListener func(*tls.Config) *quic.Listener) {
+	connQueued := make(chan struct{})
+	var sawFirst atomic.Bool
+	tlsConf := &tls.Config{
+		GetConfigForClient: func(info *tls.ClientHelloInfo) (*tls.Config, error) {
+			isFirst := sawFirst.CompareAndSwap(false, true)
+			if isFirst {
+			} else {
+				// Sleep for a bit.
+				// This allows the server to close the connection before the handshake completes.
+				close(connQueued)
+				time.Sleep(scaleDuration(10 * time.Millisecond))
+			}
+			return getTLSConfig(), nil
+		},
+	}
+
+	ln := createListener(tlsConf)
+
+	// dial the first connection
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+	_, err = ln.Accept(ctx)
+	require.NoError(t, err)
+
+	errChan := make(chan error, 1)
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_, err := quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+		errChan <- err
+	}()
+
+	select {
+	case <-connQueued:
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+		t.Fatal("timeout waiting for connection queued")
+	}
+
+	require.NoError(t, ln.Close())
+
+	select {
+	case err := <-errChan:
+		var transportErr *quic.TransportError
+		require.ErrorAs(t, err, &transportErr)
+		require.Equal(t, quic.ConnectionRefused, transportErr.ErrorCode)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for handshaking connection to be rejected")
+	}
+
+	// the first connection should not be closed
+	select {
+	case <-conn.Context().Done():
+		t.Fatal("connection was closed")
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	}
+}
+
+func TestALPN(t *testing.T) {
+	ln, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer ln.Close()
+
+	acceptChan := make(chan *quic.Conn, 2)
+	go func() {
+		for {
+			conn, err := ln.Accept(context.Background())
+			if err != nil {
+				return
+			}
+			acceptChan <- conn
+		}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), nil)
+	require.NoError(t, err)
+	cs := conn.ConnectionState()
+	require.Equal(t, alpn, cs.TLS.NegotiatedProtocol)
+
+	select {
+	case c := <-acceptChan:
+		require.Equal(t, alpn, c.ConnectionState().TLS.NegotiatedProtocol)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for server connection")
+	}
+	require.NoError(t, conn.CloseWithError(0, ""))
+
+	// now try with a different ALPN
+	tlsConf := getTLSClientConfig()
+	tlsConf.NextProtos = []string{"foobar"}
+	ctx, cancel = context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	_, err = quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), tlsConf, nil)
+	require.Error(t, err)
+	var transportErr *quic.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.True(t, transportErr.ErrorCode.IsCryptoError())
+	require.Contains(t, transportErr.Error(), "no application protocol")
+}
+
+func TestTokensFromNewTokenFrames(t *testing.T) {
+	t.Run("MaxTokenAge: 1 hour", func(t *testing.T) {
+		testTokensFromNewTokenFrames(t, 0, true)
+	})
+	// If unset, the default value is 24h.
+	t.Run("MaxTokenAge: default", func(t *testing.T) {
+		testTokensFromNewTokenFrames(t, 0, true)
+	})
+	t.Run("MaxTokenAge: very short", func(t *testing.T) {
+		testTokensFromNewTokenFrames(t, time.Microsecond, false)
+	})
+}
+
+func testTokensFromNewTokenFrames(t *testing.T, maxTokenAge time.Duration, expectTokenUsed bool) {
+	addrVerifiedChan := make(chan bool, 2)
+	quicConf := getQuicConfig(nil)
+	quicConf.GetConfigForClient = func(info *quic.ClientInfo) (*quic.Config, error) {
+		addrVerifiedChan <- info.AddrVerified
+		return quicConf, nil
+	}
+	tr := &quic.Transport{Conn: newUDPConnLocalhost(t), MaxTokenAge: maxTokenAge}
+	addTracer(tr)
+	defer tr.Close()
+	server, err := tr.Listen(getTLSConfig(), quicConf)
+	require.NoError(t, err)
+	defer server.Close()
+
+	// dial the first connection and receive the token
+	acceptChan := make(chan error, 2)
+	go func() {
+		_, err := server.Accept(context.Background())
+		acceptChan <- err
+		_, err = server.Accept(context.Background())
+		acceptChan <- err
+	}()
+
+	gets := make(chan string, 2)
+	puts := make(chan string, 2)
+	ts := newTokenStore(gets, puts)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), getTLSClientConfig(), getQuicConfig(&quic.Config{TokenStore: ts}))
+	require.NoError(t, err)
+
+	// verify token store was used
+	select {
+	case <-gets:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for token store get")
+	}
+	select {
+	case <-puts:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for token store put")
+	}
+	select {
+	case addrVerified := <-addrVerifiedChan:
+		require.False(t, addrVerified)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for addr verified")
+	}
+	select {
+	case <-acceptChan:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for accept")
+	}
+	// received a token. Close this connection.
+	require.NoError(t, conn.CloseWithError(0, ""))
+
+	time.Sleep(scaleDuration(5 * time.Millisecond))
+	conn, err = quic.Dial(ctx, newUDPConnLocalhost(t), server.Addr(), getTLSClientConfig(), getQuicConfig(&quic.Config{TokenStore: ts}))
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	select {
+	case addrVerified := <-addrVerifiedChan:
+		// this time, the address was verified using the token
+		if expectTokenUsed {
+			require.True(t, addrVerified)
+		} else {
+			require.False(t, addrVerified)
+		}
+
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for addr verified")
+	}
+	select {
+	case <-gets:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for token store get")
+	}
+	select {
+	case <-acceptChan:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for accept")
+	}
+}
+
+func TestInvalidToken(t *testing.T) {
+	const rtt = 10 * time.Millisecond
+
+	// The validity period of the retry token is the handshake timeout,
+	// which is twice the handshake idle timeout.
+	// By setting the handshake timeout shorter than the RTT, the token will have
+	// expired by the time it reaches the server.
+	serverConfig := getQuicConfig(&quic.Config{HandshakeIdleTimeout: rtt / 5})
+
+	tr := &quic.Transport{
+		Conn:                newUDPConnLocalhost(t),
+		VerifySourceAddress: func(net.Addr) bool { return true },
+	}
+	addTracer(tr)
+	defer tr.Close()
+
+	server, err := tr.Listen(getTLSConfig(), serverConfig)
+	require.NoError(t, err)
+	defer server.Close()
+
+	proxy := quicproxy.Proxy{
+		Conn:        newUDPConnLocalhost(t),
+		ServerAddr:  server.Addr().(*net.UDPAddr),
+		DelayPacket: func(quicproxy.Direction, net.Addr, net.Addr, []byte) time.Duration { return rtt / 2 },
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	_, err = quic.Dial(ctx, newUDPConnLocalhost(t), proxy.LocalAddr(), getTLSClientConfig(), nil)
+	require.Error(t, err)
+	var transportErr *quic.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, quic.InvalidToken, transportErr.ErrorCode)
+}
+
+func TestGetConfigForClient(t *testing.T) {
+	var calledFrom net.Addr
+	serverConfig := getQuicConfig(&quic.Config{EnableDatagrams: true})
+	serverConfig.GetConfigForClient = func(info *quic.ClientInfo) (*quic.Config, error) {
+		conf := serverConfig.Clone()
+		conf.EnableDatagrams = true
+		calledFrom = info.RemoteAddr
+		return getQuicConfig(conf), nil
+	}
+	ln, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), serverConfig)
+	require.NoError(t, err)
+
+	acceptDone := make(chan struct{})
+	go func() {
+		_, err := ln.Accept(context.Background())
+		require.NoError(t, err)
+		close(acceptDone)
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(&quic.Config{EnableDatagrams: true}))
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	cs := conn.ConnectionState()
+	require.True(t, cs.SupportsDatagrams.Remote, "server should advertise datagram support")
+	require.True(t, cs.SupportsDatagrams.Local, "client should have datagram support enabled")
+
+	select {
+	case <-acceptDone:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for accept")
+	}
+
+	require.NoError(t, ln.Close())
+	require.Equal(t, conn.LocalAddr().(*net.UDPAddr).Port, calledFrom.(*net.UDPAddr).Port)
+}
+
+func TestGetConfigForClientErrorsConnectionRejection(t *testing.T) {
+	ln, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{
+			GetConfigForClient: func(info *quic.ClientInfo) (*quic.Config, error) {
+				return nil, errors.New("rejected")
+			},
+		}),
+	)
+	require.NoError(t, err)
+
+	acceptChan := make(chan bool, 1)
+	go func() {
+		_, err := ln.Accept(context.Background())
+		acceptChan <- err == nil
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	_, err = quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	var transportErr *quic.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, qerr.ConnectionRefused, transportErr.ErrorCode)
+
+	// verify no connection was accepted
+	ln.Close()
+	require.False(t, <-acceptChan)
+}
+
+func TestNoPacketsSentWhenClientHelloFails(t *testing.T) {
+	conn := newUDPConnLocalhost(t)
+
+	packetChan := make(chan struct{}, 1)
+	go func() {
+		for {
+			_, _, err := conn.ReadFromUDP(make([]byte, protocol.MaxPacketBufferSize))
+			if err != nil {
+				return
+			}
+			select {
+			case packetChan <- struct{}{}:
+			default:
+			}
+		}
+	}()
+
+	tlsConf := getTLSClientConfig()
+	tlsConf.NextProtos = []string{""}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	_, err := quic.Dial(ctx, newUDPConnLocalhost(t), conn.LocalAddr(), tlsConf, getQuicConfig(nil))
+
+	var transportErr *quic.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.True(t, transportErr.ErrorCode.IsCryptoError())
+	require.Contains(t, err.Error(), "tls: invalid NextProtos value")
+
+	// verify no packets were sent
+	select {
+	case <-packetChan:
+		t.Fatal("received unexpected packet")
+	case <-time.After(50 * time.Millisecond):
+		// no packets received, as expected
+	}
+}
+
+func TestServerTransportClose(t *testing.T) {
+	tlsServerConf := getTLSConfig()
+	tr := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	server, err := tr.Listen(tlsServerConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	// the first conn is accepted by the server...
+	conn1, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{MaxIdleTimeout: scaleDuration(50 * time.Millisecond)}),
+	)
+	require.NoError(t, err)
+
+	sconn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	require.Equal(t, conn1.LocalAddr(), sconn.RemoteAddr())
+
+	// ...the second conn isn't, it remains in the server's accept queue
+	conn2, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{MaxIdleTimeout: scaleDuration(50 * time.Millisecond)}),
+	)
+	require.NoError(t, err)
+
+	time.Sleep(scaleDuration(10 * time.Millisecond))
+
+	// closing the Transport abruptly terminates connections
+	require.NoError(t, tr.Close())
+
+	select {
+	case <-sconn.Context().Done():
+		require.ErrorIs(t, context.Cause(sconn.Context()), quic.ErrTransportClosed)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	// no CONNECTION_CLOSE frame is sent to the peers
+	select {
+	case <-conn1.Context().Done():
+		require.ErrorIs(t, context.Cause(conn1.Context()), &quic.IdleTimeoutError{})
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	select {
+	case <-conn2.Context().Done():
+		require.ErrorIs(t, context.Cause(conn1.Context()), &quic.IdleTimeoutError{})
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	// Accept should error after the transport was closed
+	ctx, cancel = context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	accepted, err := server.Accept(ctx)
+	require.ErrorIs(t, err, quic.ErrTransportClosed)
+	require.Nil(t, accepted)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/http3_stream_priority_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http3_stream_priority_test.go
new file mode 100644
index 000000000..325e43776
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http3_stream_priority_test.go
@@ -0,0 +1,92 @@
+package self_test
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"testing"
+	"testing/synctest"
+
+	"github.com/quic-go/quic-go/http3"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTP3StreamPriority(t *testing.T) {
+	for _, test := range streamPriorityTests {
+		t.Run(test.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				client, server := newStreamPriorityTestConnections(t)
+
+				paths := [...]string{"/0", "/1", "/2", "/3"}
+				started := make(chan struct{}, len(paths))
+				startWrites := make(chan struct{}, len(paths))
+				t.Cleanup(func() { close(startWrites) })
+				serverWriteErrs := make(chan error, len(paths))
+				mux := http.NewServeMux()
+				for i, path := range paths {
+					mux.HandleFunc("GET "+path, func(w http.ResponseWriter, _ *http.Request) {
+						started <- struct{}{}
+						<-startWrites
+						_, err := w.Write(PRData[:test.sizes[i]])
+						serverWriteErrs <- err
+					})
+				}
+				h3Server := &http3.Server{Handler: mux}
+				go h3Server.ServeQUICConn(server)
+
+				cc := (&http3.Transport{}).NewClientConn(client)
+				t.Cleanup(func() { cc.CloseWithError(0, "") })
+				var streams [4]*http3.RequestStream
+				for i := range streams {
+					str, err := cc.OpenRequestStream(t.Context())
+					require.NoError(t, err)
+					req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://example.com"+paths[i], nil)
+					require.NoError(t, err)
+					priority := fmt.Sprintf("u=%d", test.urgencies[i])
+					if test.incremental {
+						priority += ", i"
+					}
+					req.Header.Set("Priority", priority)
+					require.NoError(t, str.SendRequestHeader(req))
+					require.NoError(t, str.Close())
+					streams[i] = str
+				}
+				for range streams {
+					<-started
+				}
+
+				type readResult struct {
+					i   int
+					n   int64
+					err error
+				}
+				completed := make(chan readResult, len(streams))
+				for i, str := range streams {
+					go func() {
+						resp, err := str.ReadResponse()
+						var n int64
+						if err == nil {
+							n, err = io.Copy(io.Discard, resp.Body)
+							resp.Body.Close()
+						}
+						completed <- readResult{i: i, n: n, err: err}
+					}()
+				}
+				for range streams {
+					startWrites <- struct{}{}
+				}
+
+				for _, i := range test.order {
+					result := <-completed
+					require.NoError(t, result.err)
+					require.Equal(t, i, result.i)
+					require.EqualValues(t, test.sizes[i], result.n)
+				}
+				for range streams {
+					require.NoError(t, <-serverWriteErrs)
+				}
+			})
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_0rtt_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_0rtt_test.go
new file mode 100644
index 000000000..807849e37
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_0rtt_test.go
@@ -0,0 +1,158 @@
+package self_test
+
+import (
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTP0RTT(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/0rtt", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, strconv.FormatBool(!r.TLS.HandshakeComplete))
+	})
+	port := startHTTPServer(t, mux)
+
+	var num0RTTPackets atomic.Uint32
+	proxy := quicproxy.Proxy{
+		Conn:       newUDPConnLocalhost(t),
+		ServerAddr: &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port},
+		DelayPacket: func(_ quicproxy.Direction, _, _ net.Addr, data []byte) time.Duration {
+			if containsPacketType(data, protocol.PacketType0RTT) {
+				num0RTTPackets.Add(1)
+			}
+			return scaleDuration(25 * time.Millisecond)
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	tlsConf := getTLSClientConfigWithoutServerName()
+	puts := make(chan string, 10)
+	tlsConf.ClientSessionCache = newClientSessionCache(tls.NewLRUClientSessionCache(10), nil, puts)
+	tr := &http3.Transport{
+		TLSClientConfig:    tlsConf,
+		QUICConfig:         getQuicConfig(&quic.Config{MaxIdleTimeout: 10 * time.Second}),
+		DisableCompression: true,
+	}
+	defer tr.Close()
+	addDialCallback(t, tr)
+
+	proxyPort := proxy.LocalAddr().(*net.UDPAddr).Port
+	req, err := http.NewRequest(http3.MethodGet0RTT, fmt.Sprintf("https://localhost:%d/0rtt", proxyPort), nil)
+	require.NoError(t, err)
+	rsp, err := tr.RoundTrip(req)
+	require.NoError(t, err)
+	require.Equal(t, 200, rsp.StatusCode)
+	data, err := io.ReadAll(rsp.Body)
+	require.NoError(t, err)
+	require.Equal(t, "false", string(data))
+	require.Zero(t, num0RTTPackets.Load())
+
+	select {
+	case <-puts:
+	case <-time.After(time.Second):
+		t.Fatal("did not receive session ticket")
+	}
+
+	tr2 := &http3.Transport{
+		TLSClientConfig:    tr.TLSClientConfig,
+		QUICConfig:         tr.QUICConfig,
+		DisableCompression: true,
+	}
+	defer tr2.Close()
+	addDialCallback(t, tr2)
+	rsp, err = tr2.RoundTrip(req)
+	require.NoError(t, err)
+	require.Equal(t, 200, rsp.StatusCode)
+	data, err = io.ReadAll(rsp.Body)
+	require.NoError(t, err)
+	require.Equal(t, "true", string(data))
+	require.NotZero(t, num0RTTPackets.Load())
+}
+
+func TestHTTP0RTTWithChangedServerSettings(t *testing.T) {
+	const originalMaxHeaderBytes = 1024
+
+	for _, tc := range []struct {
+		name              string
+		newMaxHeaderBytes int
+		expect0RTT        bool
+	}{
+		{name: "increased", newMaxHeaderBytes: 1025, expect0RTT: true},
+		{name: "decreased", newMaxHeaderBytes: 1023, expect0RTT: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			mux := http.NewServeMux()
+			mux.HandleFunc("/0rtt", func(w http.ResponseWriter, r *http.Request) {
+				io.WriteString(w, strconv.FormatBool(!r.TLS.HandshakeComplete))
+			})
+			serverTLSConf := getTLSConfig()
+			port := startHTTPServer(t, mux, func(s *http3.Server) {
+				s.TLSConfig = serverTLSConf
+				s.MaxHeaderBytes = originalMaxHeaderBytes
+			})
+
+			puts := make(chan string, 1)
+			clientTLSConf := getTLSClientConfigWithoutServerName()
+			clientTLSConf.ClientSessionCache = newClientSessionCache(tls.NewLRUClientSessionCache(1), nil, puts)
+			doRequest := func(port int) (string, error) {
+				cl := newHTTP3Client(t, func(tr *http3.Transport) { tr.TLSClientConfig = clientTLSConf })
+				req, err := http.NewRequest(http3.MethodGet0RTT, fmt.Sprintf("https://localhost:%d/0rtt", port), nil)
+				require.NoError(t, err)
+				rsp, err := cl.Do(req)
+				if err != nil {
+					return "", err
+				}
+				defer rsp.Body.Close()
+				body, err := io.ReadAll(rsp.Body)
+				return string(body), err
+			}
+
+			body, err := doRequest(port)
+			require.NoError(t, err)
+			require.Equal(t, "false", body)
+			select {
+			case <-puts:
+			case <-time.After(time.Second):
+				t.Fatal("did not receive session ticket")
+			}
+
+			port = startHTTPServer(t, mux, func(s *http3.Server) {
+				s.TLSConfig = serverTLSConf
+				s.MaxHeaderBytes = tc.newMaxHeaderBytes
+			})
+			proxy := quicproxy.Proxy{
+				Conn:       newUDPConnLocalhost(t),
+				ServerAddr: &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port},
+				DelayPacket: func(quicproxy.Direction, net.Addr, net.Addr, []byte) time.Duration {
+					return scaleDuration(25 * time.Millisecond)
+				},
+			}
+			require.NoError(t, proxy.Start())
+			defer proxy.Close()
+
+			proxyPort := proxy.LocalAddr().(*net.UDPAddr).Port
+			body, err = doRequest(proxyPort)
+			if tc.expect0RTT {
+				require.NoError(t, err)
+				require.Equal(t, "true", body)
+			} else {
+				require.ErrorIs(t, err, quic.Err0RTTRejected)
+			}
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_datagram_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_datagram_test.go
new file mode 100644
index 000000000..92c0a9abe
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_datagram_test.go
@@ -0,0 +1,323 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTPSettings(t *testing.T) {
+	mux := http.NewServeMux()
+	port := startHTTPServer(t, mux)
+
+	t.Run("server settings", func(t *testing.T) {
+		tlsConf := tlsClientConfigWithoutServerName.Clone()
+		tlsConf.NextProtos = []string{http3.NextProtoH3}
+		conn, err := quic.Dial(
+			context.Background(),
+			newUDPConnLocalhost(t),
+			&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port},
+			tlsConf,
+			getQuicConfig(nil),
+		)
+		require.NoError(t, err)
+		defer conn.CloseWithError(0, "")
+		var tr http3.Transport
+		cc := tr.NewClientConn(conn)
+
+		select {
+		case <-cc.ReceivedSettings():
+		case <-time.After(time.Second):
+			t.Fatal("didn't receive HTTP/3 settings")
+		}
+
+		settings := cc.Settings()
+		require.True(t, settings.EnableExtendedConnect)
+		require.False(t, settings.EnableDatagrams)
+		require.Empty(t, settings.Other)
+	})
+
+	t.Run("client settings", func(t *testing.T) {
+		connChan := make(chan http3.Settingser, 1)
+		mux.HandleFunc("/settings", func(w http.ResponseWriter, r *http.Request) {
+			connChan <- w.(http3.Settingser)
+			w.WriteHeader(http.StatusOK)
+		})
+
+		tr := &http3.Transport{
+			TLSClientConfig: getTLSClientConfigWithoutServerName(),
+			QUICConfig: getQuicConfig(&quic.Config{
+				MaxIdleTimeout:  10 * time.Second,
+				EnableDatagrams: true,
+			}),
+			EnableDatagrams:    true,
+			AdditionalSettings: map[uint64]uint64{1337: 42},
+		}
+		addDialCallback(t, tr)
+		defer tr.Close()
+		req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://localhost:%d/settings", port), nil)
+		require.NoError(t, err)
+
+		_, err = tr.RoundTrip(req)
+		require.NoError(t, err)
+		var conn http3.Settingser
+		select {
+		case conn = <-connChan:
+		case <-time.After(time.Second):
+			t.Fatal("didn't receive HTTP/3 connection")
+		}
+
+		select {
+		case <-conn.ReceivedSettings():
+		case <-time.After(time.Second):
+			t.Fatal("didn't receive HTTP/3 settings")
+		}
+		settings := conn.Settings()
+		require.NotNil(t, settings)
+		require.True(t, settings.EnableDatagrams)
+		require.False(t, settings.EnableExtendedConnect)
+		require.Equal(t, uint64(42), settings.Other[1337])
+	})
+}
+
+func dialAndOpenHTTPDatagramStream(t *testing.T, addr string) *http3.RequestStream {
+	t.Helper()
+
+	u, err := url.Parse(addr)
+	require.NoError(t, err)
+
+	tlsConf := getTLSClientConfigWithoutServerName()
+	tlsConf.NextProtos = []string{http3.NextProtoH3}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	serverAddr, err := net.ResolveUDPAddr("udp4", u.Host)
+	require.NoError(t, err)
+	conn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		serverAddr,
+		tlsConf,
+		getQuicConfig(&quic.Config{EnableDatagrams: true}),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.CloseWithError(0, "") })
+
+	tr := http3.Transport{EnableDatagrams: true}
+	t.Cleanup(func() { tr.Close() })
+	cc := tr.NewClientConn(conn)
+	t.Cleanup(func() { cc.CloseWithError(0, "") })
+	str, err := cc.OpenRequestStream(ctx)
+	require.NoError(t, err)
+	req := &http.Request{
+		Method: http.MethodConnect,
+		Proto:  "datagrams",
+		Host:   u.Host,
+		URL:    u,
+	}
+	require.NoError(t, str.SendRequestHeader(req))
+
+	rsp, err := str.ReadResponse()
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, rsp.StatusCode)
+	return str
+}
+
+func TestHTTPDatagrams(t *testing.T) {
+	errChan := make(chan error, 1)
+	const num = 5
+	datagramChan := make(chan struct{}, num)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/datagrams", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodConnect {
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+		s := w.(http3.Settingser)
+		select {
+		case <-s.ReceivedSettings():
+		case <-time.After(time.Second):
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		if !s.Settings().EnableDatagrams {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+
+		str := w.(http3.HTTPStreamer).HTTPStream()
+		go str.Read([]byte{0}) // need to continue reading from stream to observe state transitions
+
+		for {
+			if _, err := str.ReceiveDatagram(context.Background()); err != nil {
+				errChan <- err
+				return
+			}
+			datagramChan <- struct{}{}
+		}
+	})
+
+	port := startHTTPServer(t, mux, func(s *http3.Server) { s.EnableDatagrams = true })
+	str := dialAndOpenHTTPDatagramStream(t, fmt.Sprintf("https://localhost:%d/datagrams", port))
+
+	for i := range num {
+		b := make([]byte, 8)
+		binary.BigEndian.PutUint64(b, uint64(i))
+		require.NoError(t, str.SendDatagram(bytes.Repeat(b, 100)))
+	}
+	var count int
+loop:
+	for {
+		select {
+		case <-datagramChan:
+			count++
+			if count >= num*4/5 {
+				break loop
+			}
+		case err := <-errChan:
+			t.Fatalf("receiving datagrams failed: %s", err)
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	}
+	str.CancelWrite(42)
+
+	select {
+	case err := <-errChan:
+		var serr *quic.StreamError
+		require.ErrorAs(t, err, &serr)
+		require.Equal(t, quic.StreamErrorCode(42), serr.ErrorCode)
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive error")
+	}
+}
+
+func TestHTTPDatagramClose(t *testing.T) {
+	errChan := make(chan error, 1)
+	datagramChan := make(chan []byte, 1)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/datagrams", func(w http.ResponseWriter, r *http.Request) {
+		s := w.(http3.Settingser)
+		select {
+		case <-s.ReceivedSettings():
+		case <-time.After(time.Second):
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		if !s.Settings().EnableDatagrams {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+
+		str := w.(http3.HTTPStreamer).HTTPStream()
+		go str.Read([]byte{0}) // need to continue reading from stream to observe state transitions
+
+		for {
+			data, err := str.ReceiveDatagram(context.Background())
+			if err != nil {
+				errChan <- err
+				return
+			}
+			datagramChan <- data
+		}
+	})
+
+	port := startHTTPServer(t, mux, func(s *http3.Server) { s.EnableDatagrams = true })
+	str := dialAndOpenHTTPDatagramStream(t, fmt.Sprintf("https://localhost:%d/datagrams", port))
+	go str.Read([]byte{0})
+
+	require.NoError(t, str.SendDatagram([]byte("foo")))
+	select {
+	case data := <-datagramChan:
+		require.Equal(t, []byte("foo"), data)
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive datagram")
+	}
+	// signal that we're done sending
+	str.Close()
+
+	var resetErr error
+	select {
+	case resetErr = <-errChan:
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive error")
+	}
+	require.Equal(t, io.EOF, resetErr)
+
+	// make sure we can't send anymore
+	require.Error(t, str.SendDatagram([]byte("foo")))
+}
+
+func TestHTTPDatagramStreamReset(t *testing.T) {
+	errChan := make(chan error, 1)
+	datagramChan := make(chan []byte, 1)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/datagrams", func(w http.ResponseWriter, r *http.Request) {
+		s := w.(http3.Settingser)
+		select {
+		case <-s.ReceivedSettings():
+		case <-time.After(time.Second):
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		if !s.Settings().EnableDatagrams {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+
+		str := w.(http3.HTTPStreamer).HTTPStream()
+		go str.Read([]byte{0}) // need to continue reading from stream to observe state transitions
+
+		for {
+			data, err := str.ReceiveDatagram(context.Background())
+			if err != nil {
+				errChan <- err
+				return
+			}
+			str.CancelRead(42)
+			datagramChan <- data
+		}
+	})
+
+	port := startHTTPServer(t, mux, func(s *http3.Server) { s.EnableDatagrams = true })
+	str := dialAndOpenHTTPDatagramStream(t, fmt.Sprintf("https://localhost:%d/datagrams", port))
+	go str.Read([]byte{0})
+
+	require.NoError(t, str.SendDatagram([]byte("foo")))
+	select {
+	case data := <-datagramChan:
+		require.Equal(t, []byte("foo"), data)
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive datagram")
+	}
+
+	var resetErr error
+	select {
+	case resetErr = <-errChan:
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive error")
+	}
+	require.Equal(t, &quic.StreamError{ErrorCode: 42, Remote: false}, resetErr)
+
+	var err error
+	require.Eventually(t, func() bool {
+		err = str.SendDatagram([]byte("foo"))
+		return err != nil
+	}, time.Second, 10*time.Millisecond)
+	// make sure we can't send anymore
+	require.Equal(t, &quic.StreamError{ErrorCode: 42, Remote: true}, err)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_hotswap_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_hotswap_test.go
new file mode 100644
index 000000000..c144fb0be
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_hotswap_test.go
@@ -0,0 +1,111 @@
+package self_test
+
+import (
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTP3ServerHotswap(t *testing.T) {
+	mux1 := http.NewServeMux()
+	mux1.HandleFunc("/hello1", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "Hello, World 1!\n") // don't check the error here. Stream may be reset.
+	})
+
+	mux2 := http.NewServeMux()
+	mux2.HandleFunc("/hello2", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "Hello, World 2!\n") // don't check the error here. Stream may be reset.
+	})
+
+	server1 := &http3.Server{
+		Handler:    mux1,
+		QUICConfig: getQuicConfig(nil),
+	}
+	server2 := &http3.Server{
+		Handler:    mux2,
+		QUICConfig: getQuicConfig(nil),
+	}
+
+	tlsConf := http3.ConfigureTLSConfig(getTLSConfig())
+	ln, err := quic.ListenEarly(newUDPConnLocalhost(t), tlsConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	port := strconv.Itoa(ln.Addr().(*net.UDPAddr).Port)
+
+	newClient := func() *http.Client {
+		return &http.Client{
+			Transport: &http3.Transport{
+				TLSClientConfig:    getTLSClientConfig(),
+				DisableCompression: true,
+				QUICConfig:         getQuicConfig(&quic.Config{MaxIdleTimeout: 10 * time.Second}),
+			},
+		}
+	}
+
+	client := newClient()
+
+	defer func() {
+		require.NoError(t, ln.Close())
+	}()
+
+	// open first server and make single request to it
+	errChan1 := make(chan error, 1)
+	go func() { errChan1 <- server1.ServeListener(ln) }()
+
+	resp, err := client.Get("https://localhost:" + port + "/hello1")
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, "Hello, World 1!\n", string(body))
+
+	// open second server with same underlying listener
+	errChan2 := make(chan error, 1)
+	go func() { errChan2 <- server2.ServeListener(ln) }()
+
+	time.Sleep(scaleDuration(20 * time.Millisecond))
+	select {
+	case err := <-errChan1:
+		t.Fatalf("server1 stopped unexpectedly: %v", err)
+	case err := <-errChan2:
+		t.Fatalf("server2 stopped unexpectedly: %v", err)
+	default:
+	}
+
+	// now close first server
+	require.NoError(t, server1.Close())
+	select {
+	case err := <-errChan1:
+		require.ErrorIs(t, err, http.ErrServerClosed)
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for server1 to stop")
+	}
+	require.NoError(t, client.Transport.(*http3.Transport).Close())
+	client = newClient()
+	defer func() {
+		require.NoError(t, client.Transport.(*http3.Transport).Close())
+	}()
+
+	// verify that new connections are handled by the second server now
+	resp, err = client.Get("https://localhost:" + port + "/hello2")
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	body, err = io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, "Hello, World 2!\n", string(body))
+
+	// close the other server
+	require.NoError(t, server2.Close())
+	select {
+	case err := <-errChan2:
+		require.ErrorIs(t, err, http.ErrServerClosed)
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for server2 to stop")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_qlog_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_qlog_test.go
new file mode 100644
index 000000000..503a6ea9e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_qlog_test.go
@@ -0,0 +1,83 @@
+package self_test
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	h3qlog "github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTP3Qlog(t *testing.T) {
+	serverTrace := newMockTrace()
+	clientTrace := newMockTrace()
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/hello", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "Hello, World!\n")
+	})
+
+	server := &http3.Server{
+		Handler:   mux,
+		TLSConfig: getTLSConfig(),
+		QUICConfig: getQuicConfig(&quic.Config{
+			Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+				return serverTrace
+			},
+		}),
+	}
+
+	conn := newUDPConnLocalhost(t)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		server.Serve(conn)
+	}()
+	port := conn.LocalAddr().(*net.UDPAddr).Port
+
+	tr := &http3.Transport{
+		TLSClientConfig: getTLSClientConfigWithoutServerName(),
+		QUICConfig: getQuicConfig(&quic.Config{
+			Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+				return clientTrace
+			},
+		}),
+	}
+	addDialCallback(t, tr)
+	cl := &http.Client{Transport: tr}
+
+	resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/hello", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, "Hello, World!\n", string(body))
+	resp.Body.Close()
+
+	assert.Equal(t, 2, clientTrace.OpenRecorders())
+	assert.Equal(t, 2, serverTrace.OpenRecorders())
+
+	tr.Close()
+	server.Close()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("server didn't shut down")
+	}
+
+	// Recorders are closed in an AfterFunc, so we need to wait for them to be closed.
+	assert.Eventually(t, func() bool { return clientTrace.OpenRecorders() == 0 }, time.Second, 10*time.Millisecond, "client recorders should be closed")
+	assert.Eventually(t, func() bool { return serverTrace.OpenRecorders() == 0 }, time.Second, 10*time.Millisecond, "server recorders should be closed")
+	assert.Equal(t, []string{h3qlog.EventSchema}, clientTrace.SchemasChecked)
+	assert.Equal(t, []string{h3qlog.EventSchema}, serverTrace.SchemasChecked)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_raw_conn_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_raw_conn_test.go
new file mode 100644
index 000000000..d8c2c2027
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_raw_conn_test.go
@@ -0,0 +1,171 @@
+package self_test
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"sync"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/require"
+)
+
+// This test tests the HTTP/3 raw connection functionality,
+// which is primarily used by WebTransport.
+func TestHTTPRawConn(t *testing.T) {
+	const magicValue = 0x123456
+
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 10 * time.Millisecond
+
+		clientPacketConn, serverPacketConn, closeFn := newSimnetLink(t, rtt)
+		defer closeFn(t)
+
+		ln, err := quic.ListenEarly(
+			serverPacketConn,
+			http3.ConfigureTLSConfig(getTLSConfig()),
+			getQuicConfig(&quic.Config{EnableDatagrams: true}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		start := time.Now()
+
+		mux := http.NewServeMux()
+		mux.HandleFunc("/data", func(w http.ResponseWriter, r *http.Request) { w.Write(PRData) })
+		server := &http3.Server{
+			Handler:         mux,
+			EnableDatagrams: true,
+		}
+		defer server.Close()
+
+		// run the server in a separate Goroutine, so we can make sure that SETTINGS are sent in 0.5-RTT data
+		errChan := make(chan error, 1)
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			serverConn, err := ln.Accept(ctx)
+			if err != nil {
+				errChan <- err
+				return
+			}
+
+			rawServerConn, err := server.NewRawServerConn(serverConn)
+			if err != nil {
+				errChan <- err
+				return
+			}
+			var wg sync.WaitGroup
+			// accept and handle unidirectional streams opened by the client
+			wg.Go(func() {
+				for {
+					str, err := serverConn.AcceptUniStream(context.Background())
+					if err != nil {
+						return
+					}
+					go rawServerConn.HandleUnidirectionalStream(str)
+				}
+			})
+			// accept and handle bidirectional streams opened by the client
+			wg.Go(func() {
+				for {
+					str, err := serverConn.AcceptStream(context.Background())
+					if err != nil {
+						return
+					}
+					v, _ := quicvarint.Peek(str)
+					if v == magicValue {
+						go func() {
+							// read the previously peeked value
+							quicvarint.Read(quicvarint.NewReader(str))
+							defer str.Close()
+							io.Copy(str, str)
+						}()
+					} else {
+						go rawServerConn.HandleRequestStream(str)
+					}
+				}
+			})
+			wg.Wait()
+			<-serverConn.Context().Done()
+			errChan <- nil
+		}()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Hour)
+		defer cancel()
+		clientConn, err := quic.Dial(
+			ctx,
+			clientPacketConn,
+			serverPacketConn.LocalAddr(),
+			http3.ConfigureTLSConfig(getTLSClientConfig()),
+			getQuicConfig(&quic.Config{EnableDatagrams: true}),
+		)
+		require.NoError(t, err)
+		defer clientConn.CloseWithError(0, "")
+
+		tr := &http3.Transport{
+			EnableDatagrams: true,
+		}
+		rawClientConn := tr.NewRawClientConn(clientConn)
+		// accept and handle unidirectional streams opened by the server
+		go func() {
+			for {
+				str, err := clientConn.AcceptUniStream(ctx)
+				if err != nil {
+					return
+				}
+				go rawClientConn.HandleUnidirectionalStream(str)
+			}
+		}()
+
+		select {
+		case <-rawClientConn.ReceivedSettings():
+			settings := rawClientConn.Settings()
+			require.True(t, settings.EnableDatagrams)
+			// the server sends SETTINGS in 0.5-RTT data, so they should be received after 1 RTT
+			require.Equal(t, rtt, time.Since(start))
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for HTTP/3 settings")
+		}
+
+		req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://%s/data", serverPacketConn.LocalAddr().(*net.UDPAddr)), nil)
+		require.NoError(t, err)
+		reqStr, err := rawClientConn.OpenRequestStream(ctx)
+		require.NoError(t, err)
+		require.NoError(t, reqStr.SendRequestHeader(req))
+		resp, err := reqStr.ReadResponse()
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		data, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+		require.Equal(t, PRData, data)
+		require.NoError(t, resp.Body.Close())
+
+		str, err := clientConn.OpenStream()
+		require.NoError(t, err)
+		b := quicvarint.Append(nil, magicValue)
+		b = append(b, []byte("lorem ipsum dolor sit amet")...)
+		_, err = str.Write(b)
+		require.NoError(t, err)
+		require.NoError(t, str.Close())
+		data, err = io.ReadAll(str)
+		require.NoError(t, err)
+		require.Equal(t, []byte("lorem ipsum dolor sit amet"), data)
+
+		clientConn.CloseWithError(0, "")
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for server to close")
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_shutdown_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_shutdown_test.go
new file mode 100644
index 000000000..7b9c363b6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_shutdown_test.go
@@ -0,0 +1,520 @@
+package self_test
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTPShutdown(t *testing.T) {
+	mux := http.NewServeMux()
+	var server *http3.Server
+	port := startHTTPServer(t, mux, func(s *http3.Server) { server = s })
+	client := newHTTP3Client(t)
+
+	mux.HandleFunc("/shutdown", func(w http.ResponseWriter, r *http.Request) {
+		go func() {
+			require.NoError(t, server.Close())
+		}()
+		time.Sleep(scaleDuration(10 * time.Millisecond)) // make sure the server started shutting down
+	})
+
+	_, err := client.Get(fmt.Sprintf("https://localhost:%d/shutdown", port))
+	require.Error(t, err)
+	var appErr *http3.Error
+	require.ErrorAs(t, err, &appErr)
+	require.Equal(t, http3.ErrCodeNoError, appErr.ErrorCode)
+}
+
+func TestGracefulShutdownShortRequest(t *testing.T) {
+	var server *http3.Server
+	mux := http.NewServeMux()
+	port := startHTTPServer(t, mux, func(s *http3.Server) { server = s })
+	errChan := make(chan error, 1)
+	proceed := make(chan struct{})
+	mux.HandleFunc("/shutdown", func(w http.ResponseWriter, r *http.Request) {
+		go func() {
+			defer close(errChan)
+			errChan <- server.Shutdown(context.Background())
+		}()
+		w.WriteHeader(http.StatusOK)
+		w.(http.Flusher).Flush()
+		<-proceed
+		w.Write([]byte("shutdown"))
+	})
+
+	connChan := make(chan *quic.Conn, 1)
+	tr := &http3.Transport{
+		TLSClientConfig: getTLSClientConfigWithoutServerName(),
+		Dial: func(ctx context.Context, a string, tlsConf *tls.Config, conf *quic.Config) (*quic.Conn, error) {
+			addr, err := net.ResolveUDPAddr("udp", a)
+			if err != nil {
+				return nil, err
+			}
+			conn, err := quic.DialEarly(ctx, newUDPConnLocalhost(t), addr, tlsConf, conf)
+			connChan <- conn
+			return conn, err
+		},
+	}
+	t.Cleanup(func() { tr.Close() })
+
+	client := &http.Client{Transport: tr}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://localhost:%d/shutdown", port), nil)
+	require.NoError(t, err)
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	var conn *quic.Conn
+	select {
+	case conn = <-connChan:
+	default:
+		t.Fatal("expected a connection")
+	}
+
+	type result struct {
+		body []byte
+		err  error
+	}
+	resultChan := make(chan result, 1)
+	go func() {
+		body, err := io.ReadAll(resp.Body)
+		resultChan <- result{body: body, err: err}
+	}()
+	select {
+	case <-resultChan:
+		t.Fatal("request body shouldn't have been read yet")
+	case <-time.After(scaleDuration(10 * time.Millisecond)):
+	}
+	select {
+	case <-conn.Context().Done():
+		t.Fatal("connection shouldn't have been closed")
+	default:
+	}
+
+	// allow the request to proceed
+	close(proceed)
+	select {
+	case res := <-resultChan:
+		require.NoError(t, res.err)
+		require.Equal(t, []byte("shutdown"), res.body)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	// now that the stream count dropped to 0, the client should close the connection
+	select {
+	case <-conn.Context().Done():
+		var appErr *quic.ApplicationError
+		require.ErrorAs(t, context.Cause(conn.Context()), &appErr)
+		assert.False(t, appErr.Remote)
+		assert.Equal(t, quic.ApplicationErrorCode(http3.ErrCodeNoError), appErr.ErrorCode)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("shutdown did not complete")
+	}
+}
+
+func TestGracefulShutdownIdleConnection(t *testing.T) {
+	var server *http3.Server
+	port := startHTTPServer(t, http.NewServeMux(), func(s *http3.Server) { server = s })
+
+	connChan := make(chan *quic.Conn, 1)
+	tr := &http3.Transport{
+		TLSClientConfig: getTLSClientConfigWithoutServerName(),
+		Dial: func(ctx context.Context, a string, tlsConf *tls.Config, conf *quic.Config) (*quic.Conn, error) {
+			addr, err := net.ResolveUDPAddr("udp", a)
+			if err != nil {
+				return nil, err
+			}
+			conn, err := quic.DialEarly(ctx, newUDPConnLocalhost(t), addr, tlsConf, conf)
+			connChan <- conn
+			return conn, err
+		},
+	}
+	t.Cleanup(func() { tr.Close() })
+
+	client := &http.Client{Transport: tr}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://localhost:%d/", port), nil)
+	require.NoError(t, err)
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusNotFound, resp.StatusCode)
+	require.NoError(t, resp.Body.Close())
+
+	var conn *quic.Conn
+	select {
+	case conn = <-connChan:
+	default:
+		t.Fatal("expected a connection")
+	}
+	// the connection should still be alive (and idle)
+	select {
+	case <-conn.Context().Done():
+		t.Fatal("connection shouldn't have been closed")
+	default:
+	}
+
+	shutdownChan := make(chan error, 1)
+	go func() { shutdownChan <- server.Shutdown(context.Background()) }()
+
+	// since the connection is idle, the client should close it immediately
+	select {
+	case <-conn.Context().Done():
+		var appErr *quic.ApplicationError
+		require.ErrorAs(t, context.Cause(conn.Context()), &appErr)
+		assert.False(t, appErr.Remote)
+		assert.Equal(t, quic.ApplicationErrorCode(http3.ErrCodeNoError), appErr.ErrorCode)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestGracefulShutdownLongLivedRequest(t *testing.T) {
+	delay := scaleDuration(25 * time.Millisecond)
+	errChan := make(chan error, 1)
+	requestChan := make(chan time.Duration, 1)
+
+	var server *http3.Server
+	mux := http.NewServeMux()
+	port := startHTTPServer(t, mux, func(s *http3.Server) { server = s })
+	mux.HandleFunc("/shutdown", func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+		w.WriteHeader(http.StatusOK)
+		w.(http.Flusher).Flush()
+
+		// The request simulated here takes longer than the server's graceful shutdown period.
+		// We expect it to be terminated once the server shuts down.
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), delay)
+			defer cancel()
+			errChan <- server.Shutdown(ctx)
+		}()
+
+		// measure how long it takes until the request errors
+		for t := range time.NewTicker(delay / 10).C {
+			if _, err := w.Write([]byte(t.String())); err != nil {
+				requestChan <- time.Since(start)
+				return
+			}
+		}
+	})
+
+	start := time.Now()
+	resp, err := newHTTP3Client(t).Get(fmt.Sprintf("https://localhost:%d/shutdown", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	_, err = io.Copy(io.Discard, resp.Body)
+	require.Error(t, err)
+	var h3Err *http3.Error
+	require.ErrorAs(t, err, &h3Err)
+	require.Equal(t, http3.ErrCodeNoError, h3Err.ErrorCode)
+	took := time.Since(start)
+	require.InDelta(t, delay.Seconds(), took.Seconds(), (delay / 2).Seconds())
+
+	// make sure that shutdown returned due to context deadline
+	select {
+	case err := <-errChan:
+		require.ErrorIs(t, err, context.DeadlineExceeded)
+	case <-time.After(time.Second):
+		t.Fatal("shutdown did not return due to context deadline")
+	}
+
+	select {
+	case requestDuration := <-requestChan:
+		require.InDelta(t, delay.Seconds(), requestDuration.Seconds(), (delay / 2).Seconds())
+	case <-time.After(time.Second):
+		t.Fatal("did not receive request duration")
+	}
+}
+
+func TestGracefulShutdownPendingStreams(t *testing.T) {
+	rtt := scaleDuration(25 * time.Millisecond)
+
+	handlerChan := make(chan struct{}, 1)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/helloworld", func(w http.ResponseWriter, r *http.Request) {
+		handlerChan <- struct{}{}
+		time.Sleep(rtt)
+		w.Write([]byte("hello world"))
+	})
+	var server *http3.Server
+	port := startHTTPServer(t, mux, func(s *http3.Server) { server = s })
+	connChan := make(chan *quic.Conn, 1)
+	tr := &http3.Transport{
+		TLSClientConfig: getTLSClientConfigWithoutServerName(),
+		Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
+			a, err := net.ResolveUDPAddr("udp", addr)
+			if err != nil {
+				return nil, err
+			}
+			conn, err := quic.DialEarly(ctx, newUDPConnLocalhost(t), a, tlsCfg, cfg)
+			connChan <- conn
+			return conn, err
+		},
+	}
+	cl := &http.Client{Transport: tr}
+
+	proxy := quicproxy.Proxy{
+		Conn:        newUDPConnLocalhost(t),
+		ServerAddr:  &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port},
+		DelayPacket: func(_ quicproxy.Direction, _, _ net.Addr, _ []byte) time.Duration { return rtt },
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	errChan := make(chan error, 1)
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://%s/helloworld", proxy.LocalAddr()), nil)
+	require.NoError(t, err)
+	go func() {
+		resp, err := cl.Do(req)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		if resp.StatusCode != http.StatusOK {
+			errChan <- fmt.Errorf("expected status code %d, got %d", http.StatusOK, resp.StatusCode)
+		}
+	}()
+
+	select {
+	case <-handlerChan:
+	case <-time.After(time.Second):
+		t.Fatal("did not receive request")
+	}
+
+	shutdownChan := make(chan error, 1)
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() { shutdownChan <- server.Shutdown(ctx) }()
+	time.Sleep(rtt / 2) // wait for the server to start shutting down
+
+	var conn *quic.Conn
+	select {
+	case conn = <-connChan:
+	case <-time.After(time.Second):
+		t.Fatal("connection was not opened")
+	}
+
+	// make sure that the server rejects further requests
+	for range 3 {
+		str, err := conn.OpenStreamSync(ctx)
+		require.NoError(t, err)
+		str.Write([]byte("foobar"))
+		select {
+		case <-str.Context().Done():
+		case <-time.After(time.Second):
+			t.Fatal("stream was not rejected")
+		}
+		_, err = str.Read(make([]byte, 10))
+		var serr *quic.StreamError
+		require.ErrorAs(t, err, &serr)
+		require.Equal(t, quic.StreamErrorCode(http3.ErrCodeRequestRejected), serr.ErrorCode)
+	}
+
+	cancel()
+	select {
+	case err := <-shutdownChan:
+		require.ErrorIs(t, err, context.Canceled)
+	case <-time.After(time.Second):
+		t.Fatal("shutdown did not complete")
+	}
+}
+
+func TestHTTP3ListenerClosing(t *testing.T) {
+	t.Run("application listener", func(t *testing.T) {
+		testHTTP3ListenerClosing(t, false, true)
+	})
+	t.Run("listener created by the http3.Server", func(t *testing.T) {
+		testHTTP3ListenerClosing(t, false, false)
+	})
+}
+
+func TestHTTP3ListenerGracefulShutdown(t *testing.T) {
+	t.Run("application listener", func(t *testing.T) {
+		testHTTP3ListenerClosing(t, true, true)
+	})
+	t.Run("listener created by the http3.Server", func(t *testing.T) {
+		testHTTP3ListenerClosing(t, true, false)
+	})
+}
+
+func testHTTP3ListenerClosing(t *testing.T, graceful, useApplicationListener bool) {
+	dial := func(t *testing.T, ctx context.Context, u *url.URL) error {
+		t.Helper()
+		tlsConf := getTLSClientConfig()
+		tlsConf.NextProtos = []string{http3.NextProtoH3}
+		tr := &http3.Transport{TLSClientConfig: tlsConf}
+		defer tr.Close()
+		addDialCallback(t, tr)
+		cl := &http.Client{Transport: tr}
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+		require.NoError(t, err)
+		resp, err := cl.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		return nil
+	}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/ok", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+	handlerChan := make(chan struct{})
+	mux.HandleFunc("/long", func(w http.ResponseWriter, r *http.Request) {
+		<-handlerChan
+		w.WriteHeader(http.StatusOK)
+	})
+
+	tlsConf := http3.ConfigureTLSConfig(getTLSConfig())
+	server := &http3.Server{
+		Handler: mux,
+		// the following values will be ignored when using ServeListener
+		TLSConfig:  tlsConf,
+		QUICConfig: getQuicConfig(nil),
+		Addr:       "127.0.0.1:0",
+	}
+
+	serveChan := make(chan error, 1)
+	var host string
+	var ln *quic.EarlyListener // only set when using application listener
+	if useApplicationListener {
+		var err error
+		ln, err = quic.ListenEarly(newUDPConnLocalhost(t), tlsConf, getQuicConfig(nil))
+		require.NoError(t, err)
+		defer ln.Close()
+		host = ln.Addr().String()
+		go func() { serveChan <- server.ServeListener(ln) }()
+	} else {
+		go func() { serveChan <- server.ListenAndServe() }()
+		// The server is listening on a random port, and the only way to get the port
+		// is to parse the Alt-Svc header.
+		var port int
+		require.Eventually(t, func() bool {
+			hdr := make(http.Header)
+			server.SetQUICHeaders(hdr)
+			altSvc := hdr.Get("Alt-Svc")
+			n, err := fmt.Sscanf(altSvc, `h3=":%d"`, &port)
+			return err == nil && n == 1
+		}, time.Second, 10*time.Millisecond)
+		host = fmt.Sprintf("127.0.0.1:%d", port)
+	}
+
+	u := &url.URL{Scheme: "https", Host: host, Path: "/ok"}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	require.NoError(t, dial(t, ctx, u))
+
+	longReqChan := make(chan error, 1)
+	shutdownChan := make(chan error, 1)
+	if graceful {
+		go func() {
+			u := &url.URL{Scheme: "https", Host: host, Path: "/long"}
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			longReqChan <- dial(t, ctx, u)
+		}()
+		time.Sleep(scaleDuration(10 * time.Millisecond))
+
+		go func() { shutdownChan <- server.Shutdown(context.Background()) }()
+	} else {
+		require.NoError(t, server.Close())
+	}
+
+	select {
+	case err := <-serveChan:
+		require.ErrorIs(t, err, http.ErrServerClosed)
+	case <-time.After(time.Second):
+		t.Fatal("server did not stop")
+	}
+
+	// If the listener was created by the http3.Server, it will now be closed.
+	if !useApplicationListener {
+		ctx, cancel := context.WithTimeout(context.Background(), scaleDuration(10*time.Millisecond))
+		defer cancel()
+		require.ErrorIs(t, dial(t, ctx, u), context.DeadlineExceeded)
+	} else {
+		// If the listener was created by the application, it will not be closed,
+		// and it can be used to accept new connections.
+		errChan := make(chan error, 1)
+		go func() {
+			for {
+				conn, err := ln.Accept(context.Background())
+				if err != nil {
+					errChan <- err
+					return
+				}
+				select {
+				case <-conn.HandshakeComplete():
+					conn.CloseWithError(1337, "")
+				case <-time.After(time.Second):
+					errChan <- fmt.Errorf("connection did not complete handshake")
+				}
+				errChan <- nil
+			}
+		}()
+
+		for range 2 {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			require.ErrorIs(t, dial(t, ctx, u), &http3.Error{ErrorCode: 1337, Remote: true})
+			select {
+			case err := <-errChan:
+				require.NoError(t, err)
+			case <-time.After(time.Second):
+				t.Fatal("server did not accept connection")
+			}
+		}
+	}
+
+	// the long request should have been terminated
+	if graceful {
+		select {
+		case err := <-longReqChan:
+			t.Fatalf("request should not have terminated: %v", err)
+		case err := <-shutdownChan:
+			t.Fatalf("graceful shutdown should not have returned: %v", err)
+		case <-time.After(scaleDuration(10 * time.Millisecond)):
+		}
+
+		close(handlerChan)
+		select {
+		case err := <-longReqChan:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			t.Fatal("long request did not terminate")
+		}
+
+		select {
+		case err := <-shutdownChan:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			t.Fatal("shutdown did not complete")
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_test.go
new file mode 100644
index 000000000..068c8d1d1
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_test.go
@@ -0,0 +1,1359 @@
+package self_test
+
+import (
+	"bufio"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	mrand "math/rand/v2"
+	"net"
+	"net/http"
+	"net/http/httptrace"
+	"net/textproto"
+	"os"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"golang.org/x/sync/errgroup"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/http3/qlog"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type neverEnding byte
+
+func (b neverEnding) Read(p []byte) (n int, err error) {
+	for i := range p {
+		p[i] = byte(b)
+	}
+	return len(p), nil
+}
+
+func randomString(length int) string {
+	const alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	b := make([]byte, length)
+	for i := range b {
+		n := mrand.IntN(len(alphabet))
+		b[i] = alphabet[n]
+	}
+	return string(b)
+}
+
+func startHTTPServer(t *testing.T, mux *http.ServeMux, opts ...func(*http3.Server)) (port int) {
+	t.Helper()
+	server := &http3.Server{
+		Handler:    mux,
+		TLSConfig:  getTLSConfig(),
+		QUICConfig: getQuicConfig(&quic.Config{Allow0RTT: true, EnableDatagrams: true}),
+	}
+	for _, opt := range opts {
+		opt(server)
+	}
+
+	conn := newUDPConnLocalhost(t)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		server.Serve(conn)
+	}()
+
+	t.Cleanup(func() {
+		conn.Close()
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("server didn't shut down")
+		}
+	})
+	return conn.LocalAddr().(*net.UDPAddr).Port
+}
+
+func newHTTP3Client(t *testing.T, opts ...func(*http3.Transport)) *http.Client {
+	tr := &http3.Transport{
+		TLSClientConfig:    getTLSClientConfigWithoutServerName(),
+		QUICConfig:         getQuicConfig(&quic.Config{MaxIdleTimeout: 10 * time.Second}),
+		DisableCompression: true,
+	}
+	for _, opt := range opts {
+		opt(tr)
+	}
+	addDialCallback(t, tr)
+	t.Cleanup(func() { tr.Close() })
+	return &http.Client{Transport: tr}
+}
+
+func TestHTTPGet(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/hello", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "Hello, World!\n")
+	})
+	mux.HandleFunc("/long", func(w http.ResponseWriter, r *http.Request) {
+		w.Write(PRDataLong)
+	})
+	port := startHTTPServer(t, mux)
+
+	cl := newHTTP3Client(t)
+
+	t.Run("small", func(t *testing.T) {
+		resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/hello", port))
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		body, err := io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 2 * time.Second})
+		require.NoError(t, err)
+		require.Equal(t, "Hello, World!\n", string(body))
+	})
+
+	t.Run("big", func(t *testing.T) {
+		resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/long", port))
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		body, err := io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 10 * time.Second})
+		require.NoError(t, err)
+		require.Equal(t, PRDataLong, body)
+	})
+}
+
+func TestHTTPPost(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/echo", func(w http.ResponseWriter, r *http.Request) {
+		io.Copy(w, r.Body)
+	})
+	port := startHTTPServer(t, mux)
+
+	cl := newHTTP3Client(t)
+
+	t.Run("small", func(t *testing.T) {
+		resp, err := cl.Post(
+			fmt.Sprintf("https://localhost:%d/echo", port),
+			"text/plain",
+			bytes.NewReader([]byte("Hello, world!")),
+		)
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		body, err := io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 2 * time.Second})
+		require.NoError(t, err)
+		require.Equal(t, []byte("Hello, world!"), body)
+	})
+
+	t.Run("big", func(t *testing.T) {
+		resp, err := cl.Post(
+			fmt.Sprintf("https://localhost:%d/echo", port),
+			"text/plain",
+			bytes.NewReader(PRData),
+		)
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		body, err := io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 10 * time.Second})
+		require.NoError(t, err)
+		require.Equal(t, PRData, body)
+	})
+}
+
+func TestHTTPMultipleRequests(t *testing.T) {
+	mux := http.NewServeMux()
+	port := startHTTPServer(t, mux)
+
+	t.Run("reading the response", func(t *testing.T) {
+		mux.HandleFunc("/hello", func(w http.ResponseWriter, r *http.Request) {
+			io.WriteString(w, "Hello, World!\n")
+		})
+
+		cl := newHTTP3Client(t)
+		var eg errgroup.Group
+		for range 200 {
+			eg.Go(func() error {
+				resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/hello", port))
+				if err != nil {
+					return err
+				}
+				if resp.StatusCode != http.StatusOK {
+					return fmt.Errorf("unexpected status code: %d", resp.StatusCode)
+				}
+				body, err := io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 3 * time.Second})
+				if err != nil {
+					return err
+				}
+				if string(body) != "Hello, World!\n" {
+					return fmt.Errorf("unexpected body: %q", body)
+				}
+				return nil
+			})
+		}
+		require.NoError(t, eg.Wait())
+	})
+
+	t.Run("not reading the response", func(t *testing.T) {
+		mux.HandleFunc("/prdata", func(w http.ResponseWriter, r *http.Request) {
+			w.Write(PRData)
+		})
+
+		cl := newHTTP3Client(t)
+		const num = 150
+
+		for range num {
+			resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/prdata", port))
+			require.NoError(t, err)
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			require.NoError(t, resp.Body.Close())
+		}
+	})
+}
+
+func TestContentLengthForSmallResponse(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/small", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "foo")
+		io.WriteString(w, "bar")
+	})
+	port := startHTTPServer(t, mux)
+
+	resp, err := newHTTP3Client(t).Get(fmt.Sprintf("https://localhost:%d/small", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, "6", resp.Header.Get("Content-Length"))
+}
+
+func TestHTTPHeaders(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/headers/response", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("foo", "bar")
+		w.Header().Set("lorem", "ipsum")
+		w.Header().Set("echo", r.Header.Get("echo"))
+	})
+	port := startHTTPServer(t, mux)
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://localhost:%d/headers/response", port), nil)
+	require.NoError(t, err)
+	echoHdr := randomString(128)
+	req.Header.Set("echo", echoHdr)
+
+	resp, err := newHTTP3Client(t).Do(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, "bar", resp.Header.Get("foo"))
+	require.Equal(t, "ipsum", resp.Header.Get("lorem"))
+	require.Equal(t, echoHdr, resp.Header.Get("echo"))
+}
+
+func TestHTTPHeaderSizeLimitServer(t *testing.T) {
+	t.Run("large HEADERS frame", func(t *testing.T) {
+		const limit = 1024
+		hdr := make(http.Header)
+		for range 20 {
+			hdr.Add(randomString(50), randomString(50))
+		}
+		headersFrameSize := testHTTPHeaderSizeLimitServer(t, hdr, limit)
+		require.Greater(t, headersFrameSize, limit)
+	})
+
+	t.Run("large decompressed HEADERS frame", func(t *testing.T) {
+		const limit = 1024
+		hdr := make(http.Header)
+		for range 200 {
+			// This is a QPACK static table entry, so it will be compressed.
+			hdr.Add("content-type", "text/plain;charset=utf-8")
+		}
+		headersFrameSize := testHTTPHeaderSizeLimitServer(t, hdr, limit)
+		require.Less(t, headersFrameSize, limit)
+	})
+}
+
+func testHTTPHeaderSizeLimitServer(t *testing.T, hdr http.Header, limit int) (headersFrameSize int) {
+	mux := http.NewServeMux()
+	var handlerCalled bool
+	mux.HandleFunc("/headers", func(w http.ResponseWriter, r *http.Request) {
+		handlerCalled = true
+	})
+	port := startHTTPServer(t, mux, func(s *http3.Server) { s.MaxHeaderBytes = limit })
+
+	var eventRecorder events.Recorder
+	cl := newHTTP3Client(t, func(tr *http3.Transport) {
+		tr.QUICConfig = getQuicConfig(&quic.Config{
+			MaxIdleTimeout: 10 * time.Second,
+			Tracer:         newTracer(&eventRecorder),
+		})
+	})
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://localhost:%d/headers", port), nil)
+	require.NoError(t, err)
+	req.Header = hdr
+
+	resp, err := cl.Do(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusRequestHeaderFieldsTooLarge, resp.StatusCode)
+	require.False(t, handlerCalled)
+
+	for _, ev := range eventRecorder.Events(qlog.FrameCreated{}) {
+		fc := ev.(qlog.FrameCreated)
+		if _, ok := fc.Frame.Frame.(qlog.HeadersFrame); ok {
+			headersFrameSize = fc.Raw.Length
+			break
+		}
+	}
+	return headersFrameSize
+}
+
+func TestHTTPHeaderSizeLimitClient(t *testing.T) {
+	t.Run("large HEADERS frame", func(t *testing.T) {
+		const limit = 1024
+		hdr := make(http.Header)
+		for range 20 {
+			hdr.Add(randomString(50), randomString(50))
+		}
+		headersFrameSize, requestErr := testHTTPHeaderSizeLimitClient(t, hdr, limit)
+		require.ErrorContains(t, requestErr, "http3: HEADERS frame too large")
+		require.Greater(t, headersFrameSize, limit)
+	})
+
+	t.Run("large decompressed HEADERS frame", func(t *testing.T) {
+		const limit = 1024
+		hdr := make(http.Header)
+		for range 200 {
+			// This is a QPACK static table entry, so it will be compressed.
+			hdr.Add("content-type", "text/plain;charset=utf-8")
+		}
+		headersFrameSize, requestErr := testHTTPHeaderSizeLimitClient(t, hdr, limit)
+		require.ErrorContains(t, requestErr, "http3: headers too large")
+		require.Less(t, headersFrameSize, limit)
+	})
+}
+
+func testHTTPHeaderSizeLimitClient(t *testing.T, hdr http.Header, limit int) (headersFrameSize int, requestErr error) {
+	mux := http.NewServeMux()
+	var handlerCalled atomic.Bool
+	mux.HandleFunc("/headers", func(w http.ResponseWriter, r *http.Request) {
+		handlerCalled.Store(true)
+		for k, v := range hdr {
+			for _, val := range v {
+				w.Header().Add(k, val)
+			}
+		}
+	})
+	port := startHTTPServer(t, mux)
+
+	var eventRecorder events.Recorder
+	cl := newHTTP3Client(t,
+		func(tr *http3.Transport) {
+			tr.MaxResponseHeaderBytes = limit
+			tr.QUICConfig = getQuicConfig(&quic.Config{
+				MaxIdleTimeout: 10 * time.Second,
+				Tracer:         newTracer(&eventRecorder),
+			})
+		},
+	)
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://localhost:%d/headers", port), nil)
+	require.NoError(t, err)
+
+	_, requestErr = cl.Do(req)
+	require.Error(t, requestErr)
+	require.True(t, handlerCalled.Load())
+
+	var found bool
+	for _, ev := range eventRecorder.Events(qlog.FrameParsed{}) {
+		fp := ev.(qlog.FrameParsed)
+		if _, ok := fp.Frame.Frame.(qlog.HeadersFrame); ok {
+			headersFrameSize = fp.Raw.PayloadLength
+			found = true
+			break
+		}
+	}
+	require.True(t, found)
+	return headersFrameSize, requestErr
+}
+
+func TestHTTPResponseTrailers(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/trailers", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Trailer", "AtEnd1, AtEnd2")
+		w.Header().Add("Trailer", "Never")
+		w.Header().Add("Trailer", "LAST")
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8") // normal header
+		w.WriteHeader(http.StatusOK)
+		w.Header().Set("AtEnd1", "value 1")
+		io.WriteString(w, "This HTTP response has both headers before this text and trailers at the end.\n")
+		w.(http.Flusher).Flush()
+		w.Header().Set("AtEnd2", "value 2")
+		io.WriteString(w, "More text\n")
+		w.(http.Flusher).Flush()
+		w.Header().Set("LAST", "value 3")
+		w.Header().Set(http.TrailerPrefix+"Unannounced", "Surprise!")
+		w.Header().Set("Late-Header", "No surprise!")
+	})
+
+	port := startHTTPServer(t, mux)
+
+	resp, err := newHTTP3Client(t).Get(fmt.Sprintf("https://localhost:%d/trailers", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.Empty(t, resp.Header.Get("Trailer"))
+	require.NotContains(t, resp.Header, "Atend1")
+	require.NotContains(t, resp.Header, "Atend2")
+	require.NotContains(t, resp.Header, "Never")
+	require.NotContains(t, resp.Header, "Last")
+	require.NotContains(t, resp.Header, "Late-Header")
+	require.Equal(t, http.Header(map[string][]string{
+		"Atend1": nil,
+		"Atend2": nil,
+		"Never":  nil,
+		"Last":   nil,
+	}), resp.Trailer)
+
+	body, err := io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 3 * time.Second})
+	require.NoError(t, err)
+	require.Equal(t, "This HTTP response has both headers before this text and trailers at the end.\nMore text\n", string(body))
+	for k := range resp.Header {
+		require.NotContains(t, k, http.TrailerPrefix)
+	}
+	require.Equal(t, http.Header(map[string][]string{
+		"Atend1":      {"value 1"},
+		"Atend2":      {"value 2"},
+		"Last":        {"value 3"},
+		"Unannounced": {"Surprise!"},
+	}), resp.Trailer)
+}
+
+func TestHTTPRequestTrailers(t *testing.T) {
+	trailerChan := make(chan http.Header, 2)
+	bodyChan := make(chan string, 1)
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/client-trailers", func(w http.ResponseWriter, r *http.Request) {
+		trailerBeforeBody := make(http.Header)
+		maps.Copy(trailerBeforeBody, r.Trailer)
+		trailerChan <- trailerBeforeBody
+
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		bodyChan <- string(body)
+
+		trailer := make(http.Header)
+		maps.Copy(trailer, r.Trailer)
+		trailerChan <- trailer
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	port := startHTTPServer(t, mux)
+
+	pr, pw := io.Pipe()
+	req, err := http.NewRequest(http.MethodPost, fmt.Sprintf("https://localhost:%d/client-trailers", port), pr)
+	require.NoError(t, err)
+	req.Trailer = http.Header{
+		"Trailer1": nil,
+		"Trailer2": {"to-be-updated"},
+	}
+
+	go func() {
+		// send the first half of the body
+		pw.Write(PRData[:len(PRData)/2])
+		// then update the trailer values
+		req.Trailer.Set("Trailer1", "foo")
+		req.Trailer.Set("Trailer2", "bar")
+		req.Trailer.Set("Trailer3", "baz")
+		// send the rest of the body
+		pw.Write(PRData[len(PRData)/2:])
+		pw.Close()
+	}()
+
+	resp, err := newHTTP3Client(t).Do(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	select {
+	case trailersBefore := <-trailerChan:
+		// trailers before body should have announced keys with nil values
+		require.Equal(t, http.Header(map[string][]string{"Trailer1": nil, "Trailer2": nil}), trailersBefore)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for trailer announcement")
+	}
+
+	select {
+	case body := <-bodyChan:
+		require.Equal(t, string(PRData), body)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for body")
+	}
+
+	select {
+	case trailers := <-trailerChan:
+		require.Equal(t, http.Header(map[string][]string{
+			"Trailer1": {"foo"},
+			"Trailer2": {"bar"},
+			"Trailer3": {"baz"},
+		}), trailers)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for trailers")
+	}
+}
+
+func TestHTTPErrAbortHandler(t *testing.T) {
+	respChan := make(chan struct{})
+	mux := http.NewServeMux()
+	mux.HandleFunc("/abort", func(w http.ResponseWriter, r *http.Request) {
+		// no recover here as it will interfere with the handler
+		io.WriteString(w, "foobar")
+		w.(http.Flusher).Flush()
+		// wait for the client to receive the response
+		<-respChan
+		panic(http.ErrAbortHandler)
+	})
+	port := startHTTPServer(t, mux)
+
+	resp, err := newHTTP3Client(t).Get(fmt.Sprintf("https://localhost:%d/abort", port))
+	close(respChan)
+	require.NoError(t, err)
+	body, err := io.ReadAll(resp.Body)
+	require.Error(t, err)
+	h3Err, ok := errors.AsType[*http3.Error](err)
+	require.True(t, ok)
+	require.Equal(t, http3.ErrCodeInternalError, h3Err.ErrorCode)
+	// the body will be a prefix of what's written
+	require.True(t, bytes.HasPrefix([]byte("foobar"), body))
+}
+
+func TestHTTPGzip(t *testing.T) {
+	mux := http.NewServeMux()
+	var acceptEncoding string
+	mux.HandleFunc("/hellogz", func(w http.ResponseWriter, r *http.Request) {
+		acceptEncoding = r.Header.Get("Accept-Encoding")
+		w.Header().Set("Content-Encoding", "gzip")
+		w.Header().Set("foo", "bar")
+
+		gw := gzip.NewWriter(w)
+		defer gw.Close()
+		_, err := gw.Write([]byte("Hello, World!\n"))
+		require.NoError(t, err)
+	})
+	port := startHTTPServer(t, mux)
+
+	cl := newHTTP3Client(t)
+	cl.Transport.(*http3.Transport).DisableCompression = false
+	resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/hellogz", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	require.True(t, resp.Uncompressed)
+
+	body, err := io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 3 * time.Second})
+	require.NoError(t, err)
+	require.Equal(t, "Hello, World!\n", string(body))
+
+	// make sure the server received the Accept-Encoding header
+	require.Equal(t, "gzip", acceptEncoding)
+}
+
+func TestHTTPDifferentOrigins(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/remote-addr", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-RemoteAddr", r.RemoteAddr)
+		w.WriteHeader(http.StatusOK)
+	})
+	port := startHTTPServer(t, mux)
+
+	tr := &http3.Transport{
+		TLSClientConfig: getTLSClientConfigWithoutServerName(),
+		QUICConfig:      getQuicConfig(nil),
+	}
+	t.Cleanup(func() { tr.Close() })
+	cl := &http.Client{Transport: tr}
+
+	resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/remote-addr", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	addr1 := resp.Header.Get("X-RemoteAddr")
+	require.NotEmpty(t, addr1)
+	resp, err = cl.Get(fmt.Sprintf("https://127.0.0.1:%d/remote-addr", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	addr2 := resp.Header.Get("X-RemoteAddr")
+	require.NotEmpty(t, addr2)
+	require.Equal(t, addr1, addr2)
+}
+
+func TestHTTPServerIdleTimeout(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/hello", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "Hello, World!\n")
+	})
+	idleTimeout := scaleDuration(10 * time.Millisecond)
+	port := startHTTPServer(t, mux, func(s *http3.Server) { s.IdleTimeout = idleTimeout })
+
+	connChan := make(chan *quic.Conn, 1)
+	tr := &http3.Transport{
+		TLSClientConfig: getTLSClientConfigWithoutServerName(),
+		Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
+			conn, err := quic.DialAddrEarly(ctx, addr, tlsCfg, cfg)
+			connChan <- conn
+			return conn, err
+		},
+	}
+	t.Cleanup(func() { tr.Close() })
+	cl := &http.Client{Transport: tr}
+
+	resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/hello", port))
+	require.NoError(t, err)
+	// Wait for the server to close the request stream and start the idle timer.
+	_, err = io.Copy(io.Discard, resp.Body)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+
+	var conn *quic.Conn
+	select {
+	case conn = <-connChan:
+	case <-time.After(time.Second):
+		t.Fatal("connection was not opened")
+	}
+
+	select {
+	case <-time.After(3 * idleTimeout):
+		t.Fatal("connection was not closed")
+	case <-conn.Context().Done():
+	}
+}
+
+func TestHTTPReestablishConnectionAfterDialError(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/hello", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "Hello, World!\n")
+	})
+	port := startHTTPServer(t, mux)
+
+	var dialCounter int
+	cl := http.Client{
+		Transport: &http3.Transport{
+			TLSClientConfig: getTLSClientConfig(),
+			Dial: func(ctx context.Context, addr string, tlsConf *tls.Config, conf *quic.Config) (*quic.Conn, error) {
+				dialCounter++
+				if dialCounter == 1 { // make the first dial fail
+					return nil, assert.AnError
+				}
+				return quic.DialAddrEarly(ctx, addr, tlsConf, conf)
+			},
+		},
+	}
+	defer cl.Transport.(io.Closer).Close()
+
+	_, err := cl.Get(fmt.Sprintf("https://localhost:%d/hello", port))
+	require.ErrorIs(t, err, assert.AnError)
+	resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/hello", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+}
+
+func TestHTTPClientRequestContextCancellation(t *testing.T) {
+	mux := http.NewServeMux()
+	port := startHTTPServer(t, mux)
+	cl := newHTTP3Client(t)
+
+	t.Run("before response", func(t *testing.T) {
+		mux.HandleFunc("/cancel-before", func(w http.ResponseWriter, r *http.Request) {
+			<-r.Context().Done()
+		})
+
+		ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+		defer cancel()
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://localhost:%d/cancel-before", port), nil)
+		require.NoError(t, err)
+		_, err = cl.Do(req)
+		require.Error(t, err)
+		require.ErrorIs(t, err, context.DeadlineExceeded)
+	})
+
+	t.Run("after response", func(t *testing.T) {
+		errChan := make(chan error, 1)
+		mux.HandleFunc("/cancel-after", func(w http.ResponseWriter, r *http.Request) {
+			// TODO(#4508): check for request context cancellations
+			for {
+				if _, err := io.WriteString(w, "foobar"); err != nil {
+					errChan <- err
+					return
+				}
+			}
+		})
+
+		ctx, cancel := context.WithCancel(context.Background())
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://localhost:%d/cancel-after", port), nil)
+		require.NoError(t, err)
+		resp, err := cl.Do(req)
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		cancel()
+
+		select {
+		case err := <-errChan:
+			require.Error(t, err)
+			http3Err, ok := errors.AsType[*http3.Error](err)
+			require.True(t, ok)
+			require.Equal(t, http3.ErrCodeRequestCanceled, http3Err.ErrorCode)
+			require.True(t, http3Err.Remote)
+		case <-time.After(time.Second):
+			t.Fatal("handler was not called")
+		}
+
+		_, err = resp.Body.Read([]byte{0})
+		http3Err, ok := errors.AsType[*http3.Error](err)
+		require.True(t, ok)
+		require.Equal(t, http3.ErrCodeRequestCanceled, http3Err.ErrorCode)
+		require.False(t, http3Err.Remote)
+	})
+}
+
+func TestHTTPDeadlines(t *testing.T) {
+	const deadlineDelay = 50 * time.Millisecond
+
+	mux := http.NewServeMux()
+	port := startHTTPServer(t, mux)
+	cl := newHTTP3Client(t)
+
+	t.Run("read deadline", func(t *testing.T) {
+		type result struct {
+			body []byte
+			err  error
+		}
+
+		resultChan := make(chan result, 1)
+		mux.HandleFunc("/read-deadline", func(w http.ResponseWriter, r *http.Request) {
+			rc := http.NewResponseController(w)
+			require.NoError(t, rc.SetReadDeadline(time.Now().Add(deadlineDelay)))
+			body, err := io.ReadAll(r.Body)
+			resultChan <- result{body: body, err: err}
+			io.WriteString(w, "ok")
+		})
+
+		expectedEnd := time.Now().Add(deadlineDelay)
+		resp, err := cl.Post(
+			fmt.Sprintf("https://localhost:%d/read-deadline", port),
+			"text/plain",
+			neverEnding('a'),
+		)
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+
+		body, err := io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 2 * deadlineDelay})
+		require.NoError(t, err)
+		require.True(t, time.Now().After(expectedEnd))
+		require.Equal(t, "ok", string(body))
+
+		select {
+		case result := <-resultChan:
+			require.ErrorIs(t, result.err, os.ErrDeadlineExceeded)
+			require.Contains(t, string(result.body), "aa")
+		default:
+			t.Fatal("handler was not called")
+		}
+	})
+
+	t.Run("write deadline", func(t *testing.T) {
+		errChan := make(chan error, 1)
+		mux.HandleFunc("/write-deadline", func(w http.ResponseWriter, r *http.Request) {
+			rc := http.NewResponseController(w)
+			require.NoError(t, rc.SetWriteDeadline(time.Now().Add(deadlineDelay)))
+
+			_, err := io.Copy(w, neverEnding('a'))
+			errChan <- err
+		})
+
+		expectedEnd := time.Now().Add(deadlineDelay)
+
+		resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/write-deadline", port))
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+
+		body, err := io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 2 * deadlineDelay})
+		require.NoError(t, err)
+		require.True(t, time.Now().After(expectedEnd))
+		require.Contains(t, string(body), "aa")
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+		case <-time.After(2 * deadlineDelay):
+			t.Fatal("handler was not called")
+		}
+	})
+}
+
+func TestHTTPServeQUICConn(t *testing.T) {
+	tlsConf := getTLSConfig()
+	tlsConf.NextProtos = []string{http3.NextProtoH3}
+	ln, err := quic.Listen(newUDPConnLocalhost(t), tlsConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	defer ln.Close()
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/hello", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "Hello, World!\n")
+	})
+	server := &http3.Server{
+		TLSConfig:  tlsConf,
+		QUICConfig: getQuicConfig(nil),
+		Handler:    mux,
+	}
+	errChan := make(chan error, 1)
+	go func() {
+		conn, err := ln.Accept(context.Background())
+		if err != nil {
+			errChan <- fmt.Errorf("failed to accept QUIC connection: %w", err)
+			return
+		}
+		errChan <- server.ServeQUICConn(conn) // returns once the client closes
+	}()
+
+	cl := newHTTP3Client(t)
+	resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/hello", ln.Addr().(*net.UDPAddr).Port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	require.NoError(t, cl.Transport.(io.Closer).Close())
+	select {
+	case err := <-errChan:
+		require.Error(t, err)
+		require.ErrorContains(t, err, "accepting stream failed")
+	case <-time.After(time.Second):
+		t.Fatal("server didn't shut down")
+	}
+}
+
+func TestHTTPContextFromQUIC(t *testing.T) {
+	conn := newUDPConnLocalhost(t)
+	tr := &quic.Transport{
+		Conn: conn,
+		ConnContext: func(ctx context.Context, _ *quic.ClientInfo) (context.Context, error) {
+			return context.WithValue(ctx, "foo", "bar"), nil
+		},
+	}
+	defer tr.Close()
+	tlsConf := getTLSConfig()
+	tlsConf.NextProtos = []string{http3.NextProtoH3}
+	ln, err := tr.Listen(tlsConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	defer ln.Close()
+
+	mux := http.NewServeMux()
+	ctxChan := make(chan context.Context, 1)
+	mux.HandleFunc("/quic-conn-context", func(w http.ResponseWriter, r *http.Request) {
+		ctxChan <- r.Context()
+	})
+
+	server := &http3.Server{Handler: mux}
+	go func() {
+		c, err := ln.Accept(context.Background())
+		require.NoError(t, err)
+		server.ServeQUICConn(c)
+	}()
+
+	cl := newHTTP3Client(t)
+	resp, err := cl.Get(fmt.Sprintf("https://localhost:%d/quic-conn-context", conn.LocalAddr().(*net.UDPAddr).Port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	select {
+	case ctx := <-ctxChan:
+		v, ok := ctx.Value("foo").(string)
+		require.True(t, ok)
+		require.Equal(t, "bar", v)
+	default:
+		t.Fatal("context not set")
+	}
+}
+
+func TestHTTPConnContext(t *testing.T) {
+	mux := http.NewServeMux()
+	requestCtxChan := make(chan context.Context, 1)
+	mux.HandleFunc("/context", func(w http.ResponseWriter, r *http.Request) {
+		requestCtxChan <- r.Context()
+	})
+
+	var server *http3.Server
+	connCtxChan := make(chan context.Context, 1)
+	port := startHTTPServer(t,
+		mux,
+		func(s *http3.Server) { server = s },
+		func(s *http3.Server) {
+			s.ConnContext = func(ctx context.Context, c *quic.Conn) context.Context {
+				connCtxChan <- ctx
+				ctx = context.WithValue(ctx, "foo", "bar")
+				return ctx
+			}
+		},
+	)
+
+	resp, err := newHTTP3Client(t).Get(fmt.Sprintf("https://localhost:%d/context", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	select {
+	case ctx := <-connCtxChan:
+		serv, ok := ctx.Value(http3.ServerContextKey).(*http3.Server)
+		require.True(t, ok)
+		require.Equal(t, server, serv)
+	default:
+		t.Fatal("handler was not called")
+	}
+
+	select {
+	case ctx := <-requestCtxChan:
+		v, ok := ctx.Value("foo").(string)
+		require.True(t, ok)
+		require.Equal(t, "bar", v)
+
+		serv, ok := ctx.Value(http3.ServerContextKey).(*http3.Server)
+		require.True(t, ok)
+		require.Equal(t, server, serv)
+	default:
+		t.Fatal("handler was not called")
+	}
+}
+
+func TestHTTPRemoteAddrContextKey(t *testing.T) {
+	ctxChan := make(chan context.Context, 1)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/remote-addr", func(w http.ResponseWriter, r *http.Request) {
+		ctxChan <- r.Context()
+	})
+
+	port := startHTTPServer(t, mux)
+
+	resp, err := newHTTP3Client(t).Get(fmt.Sprintf("https://localhost:%d/remote-addr", port))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	select {
+	case ctx := <-ctxChan:
+		_, ok := ctx.Value(http3.RemoteAddrContextKey).(net.Addr)
+		require.True(t, ok)
+		require.Equal(t, "127.0.0.1", ctx.Value(http3.RemoteAddrContextKey).(*net.UDPAddr).IP.String())
+	default:
+		t.Fatal("handler was not called")
+	}
+}
+
+func TestHTTPStreamedRequests(t *testing.T) {
+	errChan := make(chan error, 1)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/echoline", func(w http.ResponseWriter, r *http.Request) {
+		defer close(errChan)
+		w.WriteHeader(200)
+		w.(http.Flusher).Flush()
+		reader := bufio.NewReader(r.Body)
+		for {
+			msg, err := reader.ReadString('\n')
+			if err != nil {
+				return
+			}
+			if _, err := io.WriteString(w, msg); err != nil {
+				errChan <- err
+				return
+			}
+			w.(http.Flusher).Flush()
+		}
+	})
+
+	port := startHTTPServer(t, mux)
+
+	r, w := io.Pipe()
+	req, err := http.NewRequest(http.MethodPut, fmt.Sprintf("https://localhost:%d/echoline", port), r)
+	require.NoError(t, err)
+	client := newHTTP3Client(t)
+	rsp, err := client.Do(req)
+	require.NoError(t, err)
+	require.Equal(t, 200, rsp.StatusCode)
+
+	reader := bufio.NewReader(rsp.Body)
+	for i := range 5 {
+		msg := fmt.Sprintf("Hello world, %d!\n", i)
+		fmt.Fprint(w, msg)
+		msgRcvd, err := reader.ReadString('\n')
+		require.NoError(t, err)
+		require.Equal(t, msg, msgRcvd)
+	}
+	require.NoError(t, req.Body.Close())
+
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("handler did not complete")
+	}
+}
+
+func TestHTTP1xxResponse(t *testing.T) {
+	header1 := "</style.css>; rel=preload; as=style"
+	header2 := "</script.js>; rel=preload; as=script"
+	data := "1xx-test-data"
+	mux := http.NewServeMux()
+	mux.HandleFunc("/103-early-data", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Link", header1)
+		w.Header().Add("Link", header2)
+		w.WriteHeader(http.StatusEarlyHints)
+		io.WriteString(w, data)
+		w.WriteHeader(http.StatusOK)
+	})
+
+	port := startHTTPServer(t, mux)
+
+	var (
+		cnt    int
+		status int
+		hdr    textproto.MIMEHeader
+	)
+	ctx := httptrace.WithClientTrace(context.Background(), &httptrace.ClientTrace{
+		Got1xxResponse: func(code int, header textproto.MIMEHeader) error {
+			hdr = header
+			status = code
+			cnt++
+			return nil
+		},
+	})
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://localhost:%d/103-early-data", port), nil)
+	require.NoError(t, err)
+	resp, err := newHTTP3Client(t).Do(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, data, string(body))
+	require.Equal(t, http.StatusEarlyHints, status)
+	require.Equal(t, []string{header1, header2}, hdr.Values("Link"))
+	require.Equal(t, 1, cnt)
+	require.Equal(t, []string{header1, header2}, resp.Header.Values("Link"))
+	require.NoError(t, resp.Body.Close())
+}
+
+func TestHTTP1xxTerminalResponse(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/101-switch-protocols", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("foo", "bar")
+		w.WriteHeader(http.StatusSwitchingProtocols)
+	})
+
+	port := startHTTPServer(t, mux)
+
+	var (
+		cnt    int
+		status int
+	)
+	ctx := httptrace.WithClientTrace(context.Background(), &httptrace.ClientTrace{
+		Got1xxResponse: func(code int, header textproto.MIMEHeader) error {
+			status = code
+			cnt++
+			return nil
+		},
+	})
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://localhost:%d/101-switch-protocols", port), nil)
+	require.NoError(t, err)
+	resp, err := newHTTP3Client(t).Do(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusSwitchingProtocols, resp.StatusCode)
+	require.Equal(t, "bar", resp.Header.Get("Foo"))
+	require.Zero(t, status)
+	require.Zero(t, cnt)
+	require.NoError(t, resp.Body.Close())
+}
+
+func TestHTTPStreamer(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/httpstreamer", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+
+		str := w.(http3.HTTPStreamer).HTTPStream()
+		str.Write([]byte("foobar"))
+
+		// Do this in a Go routine, so that the handler returns early.
+		// This way, we can also check that the HTTP/3 doesn't close the stream.
+		go func() {
+			defer str.Close()
+			_, _ = io.Copy(str, str)
+		}()
+	})
+
+	port := startHTTPServer(t, mux)
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://localhost:%d/httpstreamer", port), nil)
+	require.NoError(t, err)
+	tlsConf := getTLSClientConfigWithoutServerName()
+	tlsConf.NextProtos = []string{http3.NextProtoH3}
+	ctx := t.Context()
+	conn, err := quic.Dial(ctx, newUDPConnLocalhost(t), &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port}, tlsConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+	tr := http3.Transport{}
+	addDialCallback(t, &tr)
+	cc := tr.NewClientConn(conn)
+	str, err := cc.OpenRequestStream(ctx)
+	require.NoError(t, err)
+	require.NoError(t, str.SendRequestHeader(req))
+
+	rsp, err := str.ReadResponse()
+	require.NoError(t, err)
+	require.Equal(t, 200, rsp.StatusCode)
+
+	b := make([]byte, 6)
+	_, err = io.ReadFull(str, b)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), b)
+
+	_, err = str.Write(PRData)
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+	repl, err := io.ReadAll(str)
+	require.NoError(t, err)
+	require.Equal(t, PRData, repl)
+}
+
+type blackHoleConn struct {
+	net.PacketConn
+	block atomic.Bool
+	close chan struct{}
+}
+
+func (c *blackHoleConn) WriteTo(b []byte, addr net.Addr) (int, error) {
+	return c.PacketConn.WriteTo(b, addr)
+}
+
+func (c *blackHoleConn) ReadFrom(b []byte) (int, net.Addr, error) {
+	if c.block.Load() {
+		<-c.close
+		return 0, nil, errors.New("blocked")
+	}
+	n, _, err := c.PacketConn.ReadFrom(b)
+	if c.block.Load() {
+		<-c.close
+		return 0, nil, errors.New("blocked")
+	}
+	return n, nil, err
+}
+
+func (c *blackHoleConn) Close() error {
+	close(c.close)
+	return c.PacketConn.Close()
+}
+
+func (c *blackHoleConn) StartBlocking() { c.block.Store(true) }
+
+func TestHTTPRequestRetryAfterIdleTimeout(t *testing.T) {
+	t.Run("only cached conn", func(t *testing.T) {
+		testHTTPRequestRetryAfterIdleTimeout(t, true)
+	})
+	t.Run("allow re-dialing", func(t *testing.T) {
+		testHTTPRequestRetryAfterIdleTimeout(t, false)
+	})
+}
+
+func testHTTPRequestRetryAfterIdleTimeout(t *testing.T, onlyCachedConn bool) {
+	t.Setenv("QUIC_GO_DISABLE_RECEIVE_BUFFER_WARNING", "true")
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/remote-addr", func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, r.RemoteAddr)
+	})
+	port := startHTTPServer(t, mux, func(s *http3.Server) {})
+
+	firstConn := &blackHoleConn{PacketConn: newUDPConnLocalhost(t), close: make(chan struct{})}
+	secondConn := newUDPConnLocalhost(t)
+	conns := []net.PacketConn{firstConn, secondConn}
+	require.NotEqual(t, firstConn.LocalAddr().String(), secondConn.LocalAddr().String())
+
+	idleTimeout := scaleDuration(10 * time.Millisecond)
+	connChan := make(chan *quic.Conn, 2)
+	tr := &http3.Transport{
+		TLSClientConfig: getTLSClientConfigWithoutServerName(),
+		QUICConfig:      getQuicConfig(&quic.Config{MaxIdleTimeout: idleTimeout}),
+		Dial: func(ctx context.Context, a string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
+			conn := conns[0]
+			conns = conns[1:]
+			addr, err := net.ResolveUDPAddr("udp", a)
+			if err != nil {
+				return nil, err
+			}
+			c, err := quic.DialEarly(ctx, conn, addr, tlsCfg, cfg)
+			if err != nil {
+				return nil, err
+			}
+			connChan <- c
+			return c, nil
+		},
+		DisableCompression: true,
+	}
+	t.Cleanup(func() { tr.Close() })
+
+	var headersCount int
+	req, err := http.NewRequestWithContext(
+		httptrace.WithClientTrace(context.Background(), &httptrace.ClientTrace{
+			WroteHeaders: func() { headersCount++ },
+		}),
+		http.MethodGet,
+		fmt.Sprintf("https://127.0.0.1:%d/remote-addr", port),
+		// Add a body (wrappped so that http.NewRequest doesn't set the GetBody callback),
+		// to make it impossible to retry this request.
+		// This tests that the detection logic works properly:
+		// If the request fails before the stream can be opened, it is always safe to retry.
+		io.LimitReader(strings.NewReader("foobar"), 1000),
+	)
+	require.NoError(t, err)
+
+	resp, err := tr.RoundTripOpt(req, http3.RoundTripOpt{})
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, firstConn.LocalAddr().String(), string(body))
+
+	firstConn.StartBlocking()
+	// wait for the connection to time out
+	select {
+	case c := <-connChan:
+		select {
+		case <-c.Context().Done():
+		case <-time.After(time.Second):
+			t.Fatal("connection did not time out")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("no connection was created")
+	}
+
+	// second request should succeed after re-dialing
+	resp, err = tr.RoundTripOpt(req, http3.RoundTripOpt{OnlyCachedConn: onlyCachedConn})
+	if onlyCachedConn {
+		require.EqualError(t, err, "http3: no cached connection was available")
+		require.Len(t, conns, 1) // no second dial attempt
+		require.Equal(t, 1, headersCount)
+		return
+	}
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	body, err = io.ReadAll(&readerWithTimeout{Reader: resp.Body, Timeout: 2 * time.Second})
+	require.NoError(t, err)
+	require.Equal(t, secondConn.LocalAddr().String(), string(body))
+
+	require.Equal(t, 2, headersCount)
+	require.Empty(t, conns) // make sure we dialed 2 connections
+}
+
+func TestHTTPRequestAfterGracefulShutdown(t *testing.T) {
+	t.Run("Request.GetBody set", func(t *testing.T) {
+		testHTTPRequestAfterGracefulShutdown(t, true)
+	})
+	t.Run("Request.GetBody not set", func(t *testing.T) {
+		testHTTPRequestAfterGracefulShutdown(t, false)
+	})
+}
+
+func testHTTPRequestAfterGracefulShutdown(t *testing.T, setGetBody bool) {
+	t.Setenv("QUIC_GO_DISABLE_RECEIVE_BUFFER_WARNING", "true")
+
+	ln, err := quic.ListenEarly(
+		newUDPConnLocalhost(t),
+		http3.ConfigureTLSConfig(getTLSConfig()),
+		getQuicConfig(nil),
+	)
+	require.NoError(t, err)
+
+	var inShutdown atomic.Bool
+	proxy := quicproxy.Proxy{
+		Conn:       newUDPConnLocalhost(t),
+		ServerAddr: ln.Addr().(*net.UDPAddr),
+		DelayPacket: func(_ quicproxy.Direction, _, _ net.Addr, data []byte) time.Duration {
+			if inShutdown.Load() {
+				return scaleDuration(10 * time.Millisecond)
+			}
+			return scaleDuration(2 * time.Millisecond)
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	mux2 := http.NewServeMux()
+	mux2.HandleFunc("/echo", func(w http.ResponseWriter, r *http.Request) {
+		data, _ := io.ReadAll(r.Body)
+		w.Write(data)
+	})
+	server2 := &http3.Server{Handler: mux2}
+
+	done := make(chan struct{})
+	defer close(done)
+	server1 := &http3.Server{Handler: http.NewServeMux()}
+
+	go server1.ServeListener(ln)
+
+	tlsConf := getTLSClientConfigWithoutServerName()
+	tlsConf.NextProtos = []string{http3.NextProtoH3}
+	var dialCount int
+	tr := &http3.Transport{
+		TLSClientConfig: tlsConf,
+		Dial: func(ctx context.Context, a string, tlsConf *tls.Config, conf *quic.Config) (*quic.Conn, error) {
+			addr, err := net.ResolveUDPAddr("udp", a)
+			if err != nil {
+				return nil, err
+			}
+			dialCount++
+			return quic.DialEarly(ctx, newUDPConnLocalhost(t), addr, tlsConf, conf)
+		},
+	}
+	t.Cleanup(func() { tr.Close() })
+	cl := &http.Client{Transport: tr}
+
+	// first request to establish the connection
+	resp, err := cl.Get(fmt.Sprintf("https://%s/", proxy.LocalAddr()))
+	require.NoError(t, err)
+	require.Equal(t, http.StatusNotFound, resp.StatusCode)
+
+	// If the body is a strings.Reader, http.NewRequest automatically sets the GetBody callback.
+	// This can be prevented by using a different kind of reader, e.g. the io.LimitReader.
+	var headersCount int
+	req, err := http.NewRequestWithContext(
+		httptrace.WithClientTrace(context.Background(), &httptrace.ClientTrace{
+			WroteHeaders: func() { headersCount++ },
+		}),
+		http.MethodGet,
+		fmt.Sprintf("https://%s/echo", proxy.LocalAddr()),
+		io.LimitReader(strings.NewReader("foobar"), 1000),
+	)
+	require.NoError(t, err)
+	if setGetBody {
+		req.GetBody = func() (io.ReadCloser, error) {
+			return io.NopCloser(strings.NewReader("foobaz")), nil
+		}
+	} else {
+		require.Nil(t, req.GetBody)
+	}
+
+	// By increasing the RTT, we make sure that the request is sent before the client receives the GOAWAY frame.
+	inShutdown.Store(true)
+	go server1.Shutdown(context.Background())
+	go server2.ServeListener(ln)
+	defer server2.Close()
+
+	resp, err = cl.Do(req)
+	if !setGetBody {
+		require.ErrorContains(t, err, "after Request.Body was written; define Request.GetBody to avoid this error")
+		require.Equal(t, 1, dialCount)
+		require.Equal(t, 1, headersCount)
+		return
+	}
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, "foobaz", string(body))
+	require.Equal(t, 2, dialCount)
+	require.Equal(t, 2, headersCount)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_trace_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_trace_test.go
new file mode 100644
index 000000000..aa1baaac4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/http_trace_test.go
@@ -0,0 +1,137 @@
+package self_test
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptrace"
+	"net/textproto"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/http3"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTPClientTrace(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/client-trace", func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(100 * time.Millisecond)
+		w.WriteHeader(http.StatusContinue)
+	})
+	port := startHTTPServer(t, mux)
+
+	buf := make([]byte, 1)
+	type event struct {
+		Key  string
+		Args any
+	}
+	eventQueue := make(chan event, 100)
+	wait100Continue := false
+	trace := httptrace.ClientTrace{
+		GetConn:              func(hostPort string) { eventQueue <- event{Key: "GetConn", Args: hostPort} },
+		GotConn:              func(info httptrace.GotConnInfo) { eventQueue <- event{Key: "GotConn", Args: info} },
+		GotFirstResponseByte: func() { eventQueue <- event{Key: "GotFirstResponseByte"} },
+		Got100Continue:       func() { eventQueue <- event{Key: "Got100Continue"} },
+		Got1xxResponse: func(code int, header textproto.MIMEHeader) error {
+			eventQueue <- event{Key: "Got1xxResponse", Args: code}
+			return nil
+		},
+		DNSStart: func(di httptrace.DNSStartInfo) { eventQueue <- event{Key: "DNSStart", Args: di} },
+		DNSDone:  func(di httptrace.DNSDoneInfo) { eventQueue <- event{Key: "DNSDone", Args: di} },
+		ConnectStart: func(network, addr string) {
+			eventQueue <- event{Key: "ConnectStart", Args: map[string]string{"network": network, "addr": addr}}
+		},
+		ConnectDone: func(network, addr string, err error) {
+			eventQueue <- event{Key: "ConnectDone", Args: map[string]any{"network": network, "addr": addr, "err": err}}
+		},
+		TLSHandshakeStart: func() { eventQueue <- event{Key: "TLSHandshakeStart"} },
+		TLSHandshakeDone: func(state tls.ConnectionState, err error) {
+			eventQueue <- event{Key: "TLSHandshakeDone", Args: map[string]any{"state": state, "err": err}}
+		},
+		WroteHeaderField: func(key string, value []string) {
+			if key != ":authority" {
+				return
+			}
+			eventQueue <- event{Key: "WroteHeaderField", Args: value[0]}
+		},
+		WroteHeaders:    func() { eventQueue <- event{Key: "WroteHeaders"} },
+		Wait100Continue: func() { wait100Continue = true },
+		WroteRequest:    func(i httptrace.WroteRequestInfo) { eventQueue <- event{Key: "WroteRequest", Args: i} },
+	}
+	ctx := httptrace.WithClientTrace(context.Background(), &trace)
+
+	tr := &http3.Transport{
+		TLSClientConfig: getTLSClientConfigWithoutServerName(),
+		QUICConfig:      getQuicConfig(nil),
+	}
+	t.Cleanup(func() { tr.Close() })
+	cl := &http.Client{Transport: tr}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://localhost:%d/client-trace", port), nil)
+	require.NoError(t, err)
+	resp, err := cl.Do(req)
+	close(eventQueue)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	events := make([]string, 0, len(eventQueue))
+	for e := range eventQueue {
+		events = append(events, e.Key)
+		switch e.Key {
+		case "GetConn":
+			require.Equal(t, fmt.Sprintf("localhost:%d", port), e.Args.(string))
+		case "GotConn":
+			info := e.Args.(httptrace.GotConnInfo)
+			require.Equal(t, fmt.Sprintf("127.0.0.1:%d", port), info.Conn.RemoteAddr().String())
+			host, _, err := net.SplitHostPort(info.Conn.LocalAddr().String())
+			require.NoError(t, err)
+			require.Contains(t, []string{"::", "0.0.0.0"}, host)
+			require.Panics(t, func() { info.Conn.Close() })
+			require.Panics(t, func() { info.Conn.Read(buf) })
+			require.Panics(t, func() { info.Conn.Write(buf) })
+			require.Panics(t, func() { info.Conn.SetDeadline(time.Now()) })
+			require.Panics(t, func() { info.Conn.SetReadDeadline(time.Now()) })
+			require.Panics(t, func() { info.Conn.SetWriteDeadline(time.Now()) })
+		case "Got1xxResponse":
+			require.Equal(t, 100, e.Args.(int))
+		case "DNSStart":
+			require.Equal(t, "localhost", e.Args.(httptrace.DNSStartInfo).Host)
+		case "DNSDone":
+			require.Condition(t, func() bool {
+				localhost := net.IPv4(127, 0, 0, 1)
+				localhostTo16 := localhost.To16()
+				for _, addr := range e.Args.(httptrace.DNSDoneInfo).Addrs {
+					if addr.IP.Equal(localhost) || addr.IP.Equal(localhostTo16) {
+						return true
+					}
+				}
+				return false
+			})
+		case "ConnectStart":
+			require.Equal(t, "udp", e.Args.(map[string]string)["network"])
+			require.Equal(t, fmt.Sprintf("127.0.0.1:%d", port), e.Args.(map[string]string)["addr"])
+		case "ConnectDone":
+			require.Equal(t, "udp", e.Args.(map[string]any)["network"])
+			require.Equal(t, fmt.Sprintf("127.0.0.1:%d", port), e.Args.(map[string]any)["addr"])
+			require.Nil(t, e.Args.(map[string]any)["err"])
+		case "TLSHandshakeDone":
+			require.Nil(t, e.Args.(map[string]any)["err"])
+			state := e.Args.(map[string]any)["state"].(tls.ConnectionState)
+			require.Equal(t, 1, len(state.PeerCertificates))
+			require.Equal(t, "localhost", state.PeerCertificates[0].DNSNames[0])
+		case "WroteHeaderField":
+			require.Equal(t, fmt.Sprintf("localhost:%d", port), e.Args.(string))
+		case "WroteRequest":
+			require.NoError(t, e.Args.(httptrace.WroteRequestInfo).Err)
+		}
+	}
+	require.Equal(t,
+		[]string{
+			"GetConn", "DNSStart", "DNSDone", "ConnectStart", "TLSHandshakeStart", "TLSHandshakeDone",
+			"ConnectDone", "GotConn", "WroteHeaderField", "WroteHeaders", "WroteRequest",
+			"GotFirstResponseByte", "Got1xxResponse", "Got100Continue",
+		}, events)
+	require.Falsef(t, wait100Continue, "wait 100 continue") // Note: not supported Expect: 100-continue
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/key_update_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/key_update_test.go
new file mode 100644
index 000000000..9262f6306
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/key_update_test.go
@@ -0,0 +1,93 @@
+package self_test
+
+import (
+	"context"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestKeyUpdates(t *testing.T) {
+	reset := handshake.SetKeyUpdateInterval(1) // update keys as frequently as possible
+	t.Cleanup(reset)
+
+	countKeyPhases := func(events []qlogwriter.Event) (sent, received int) {
+		lastKeyPhaseSend := protocol.KeyPhaseOne
+		lastKeyPhaseReceive := protocol.KeyPhaseOne
+		for _, ev := range events {
+			switch ev := ev.(type) {
+			case qlog.PacketSent:
+				if ev.Header.KeyPhaseBit != lastKeyPhaseSend {
+					sent++
+					lastKeyPhaseSend = ev.Header.KeyPhaseBit
+				}
+			case qlog.PacketReceived:
+				if ev.Header.KeyPhaseBit != lastKeyPhaseReceive {
+					received++
+					lastKeyPhaseReceive = ev.Header.KeyPhaseBit
+				}
+			}
+		}
+		return
+	}
+
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), nil)
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	var eventRecorder events.Recorder
+	conn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{Tracer: newTracer(&eventRecorder)}),
+	)
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	defer serverConn.CloseWithError(0, "")
+
+	serverErrChan := make(chan error, 1)
+	go func() {
+		str, err := serverConn.OpenUniStream()
+		if err != nil {
+			serverErrChan <- err
+			return
+		}
+		defer str.Close()
+		if _, err := str.Write(PRDataLong); err != nil {
+			serverErrChan <- err
+			return
+		}
+		close(serverErrChan)
+	}()
+
+	str, err := conn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	data, err := io.ReadAll(str)
+	require.NoError(t, err)
+	require.Equal(t, PRDataLong, data)
+	require.NoError(t, conn.CloseWithError(0, ""))
+
+	require.NoError(t, <-serverErrChan)
+
+	keyPhasesSent, keyPhasesReceived := countKeyPhases(eventRecorder.Events())
+	t.Logf("Used %d key phases on outgoing and %d key phases on incoming packets.", keyPhasesSent, keyPhasesReceived)
+	assert.Greater(t, keyPhasesReceived, 10)
+	assert.InDelta(t, keyPhasesSent, keyPhasesReceived, 2)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/mitm_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/mitm_test.go
new file mode 100644
index 000000000..7a4e1fb3e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/mitm_test.go
@@ -0,0 +1,428 @@
+package self_test
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"io"
+	"math"
+	mrand "math/rand/v2"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/testutils"
+
+	"github.com/stretchr/testify/require"
+)
+
+const mitmTestConnIDLen = 6
+
+func getTransportsForMITMTest(t *testing.T) (serverTransport, clientTransport *quic.Transport) {
+	serverTransport = &quic.Transport{
+		Conn:               newUDPConnLocalhost(t),
+		ConnectionIDLength: mitmTestConnIDLen,
+	}
+	addTracer(serverTransport)
+	t.Cleanup(func() { serverTransport.Close() })
+
+	clientTransport = &quic.Transport{
+		Conn:               newUDPConnLocalhost(t),
+		ConnectionIDLength: mitmTestConnIDLen,
+	}
+	addTracer(clientTransport)
+	t.Cleanup(func() { clientTransport.Close() })
+
+	return serverTransport, clientTransport
+}
+
+func TestMITMInjectRandomPackets(t *testing.T) {
+	t.Run("towards the server", func(t *testing.T) {
+		testMITMInjectRandomPackets(t, quicproxy.DirectionIncoming)
+	})
+
+	t.Run("towards the client", func(t *testing.T) {
+		testMITMInjectRandomPackets(t, quicproxy.DirectionOutgoing)
+	})
+}
+
+func TestMITMDuplicatePackets(t *testing.T) {
+	t.Run("towards the server", func(t *testing.T) {
+		testMITMDuplicatePackets(t, quicproxy.DirectionIncoming)
+	})
+
+	t.Run("towards the client", func(t *testing.T) {
+		testMITMDuplicatePackets(t, quicproxy.DirectionOutgoing)
+	})
+}
+
+func TestMITCorruptPackets(t *testing.T) {
+	t.Run("towards the server", func(t *testing.T) {
+		testMITMCorruptPackets(t, quicproxy.DirectionIncoming)
+	})
+
+	t.Run("towards the client", func(t *testing.T) {
+		testMITMCorruptPackets(t, quicproxy.DirectionOutgoing)
+	})
+}
+
+func testMITMInjectRandomPackets(t *testing.T, direction quicproxy.Direction) {
+	createRandomPacketOfSameType := func(b []byte) []byte {
+		if wire.IsLongHeaderPacket(b[0]) {
+			hdr, _, _, err := wire.ParsePacket(b)
+			if err != nil {
+				return nil
+			}
+			replyHdr := &wire.ExtendedHeader{
+				Header: wire.Header{
+					DestConnectionID: hdr.DestConnectionID,
+					SrcConnectionID:  hdr.SrcConnectionID,
+					Type:             hdr.Type,
+					Version:          hdr.Version,
+				},
+				PacketNumber:    protocol.PacketNumber(mrand.Int32N(math.MaxInt32 / 4)),
+				PacketNumberLen: protocol.PacketNumberLen(mrand.IntN(4) + 1),
+			}
+			payloadLen := mrand.IntN(100)
+			replyHdr.Length = protocol.ByteCount(mrand.IntN(payloadLen + 1))
+			data, err := replyHdr.Append(nil, hdr.Version)
+			if err != nil {
+				panic("failed to append header: " + err.Error())
+			}
+			r := make([]byte, payloadLen)
+			rand.Read(r)
+			return append(data, r...)
+		}
+		// short header packet
+		connID, err := wire.ParseConnectionID(b, mitmTestConnIDLen)
+		if err != nil {
+			return nil
+		}
+		_, pn, pnLen, _, err := wire.ParseShortHeader(b, mitmTestConnIDLen)
+		if err != nil && !errors.Is(err, wire.ErrInvalidReservedBits) { // normally, ParseShortHeader is called after decrypting the header
+			panic("failed to parse short header: " + err.Error())
+		}
+		data, err := wire.AppendShortHeader(nil, connID, pn, pnLen, protocol.KeyPhaseBit(mrand.IntN(2)))
+		if err != nil {
+			return nil
+		}
+		payloadLen := mrand.IntN(100)
+		r := make([]byte, payloadLen)
+		rand.Read(r)
+		return append(data, r...)
+	}
+
+	rtt := scaleDuration(10 * time.Millisecond)
+	serverTransport, clientTransport := getTransportsForMITMTest(t)
+
+	dropCallback := func(dir quicproxy.Direction, _, _ net.Addr, b []byte) bool {
+		if dir != direction {
+			return false
+		}
+		go func() {
+			ticker := time.NewTicker(rtt / 10)
+			defer ticker.Stop()
+			for range 10 {
+				switch direction {
+				case quicproxy.DirectionIncoming:
+					clientTransport.WriteTo(createRandomPacketOfSameType(b), serverTransport.Conn.LocalAddr())
+				case quicproxy.DirectionOutgoing:
+					serverTransport.WriteTo(createRandomPacketOfSameType(b), clientTransport.Conn.LocalAddr())
+				}
+				<-ticker.C
+			}
+		}()
+		return false
+	}
+
+	runMITMTest(t, serverTransport, clientTransport, rtt, dropCallback)
+}
+
+func testMITMDuplicatePackets(t *testing.T, direction quicproxy.Direction) {
+	serverTransport, clientTransport := getTransportsForMITMTest(t)
+	rtt := scaleDuration(10 * time.Millisecond)
+
+	dropCallback := func(dir quicproxy.Direction, _, _ net.Addr, b []byte) bool {
+		if dir != direction {
+			return false
+		}
+		switch direction {
+		case quicproxy.DirectionIncoming:
+			clientTransport.WriteTo(b, serverTransport.Conn.LocalAddr())
+		case quicproxy.DirectionOutgoing:
+			serverTransport.WriteTo(b, clientTransport.Conn.LocalAddr())
+		}
+		return false
+	}
+
+	runMITMTest(t, serverTransport, clientTransport, rtt, dropCallback)
+}
+
+func testMITMCorruptPackets(t *testing.T, direction quicproxy.Direction) {
+	serverTransport, clientTransport := getTransportsForMITMTest(t)
+	rtt := scaleDuration(5 * time.Millisecond)
+
+	var numCorrupted atomic.Int32
+	dropCallback := func(dir quicproxy.Direction, _, _ net.Addr, b []byte) bool {
+		if dir != direction {
+			return false
+		}
+		isLongHeaderPacket := wire.IsLongHeaderPacket(b[0])
+		// corrupt 20% of long header packets and 5% of short header packets
+		if isLongHeaderPacket && mrand.IntN(4) != 0 {
+			return false
+		}
+		if !isLongHeaderPacket && mrand.IntN(20) != 0 {
+			return false
+		}
+		numCorrupted.Add(1)
+		pos := mrand.IntN(len(b))
+		b[pos] = byte(mrand.IntN(256))
+		switch direction {
+		case quicproxy.DirectionIncoming:
+			clientTransport.WriteTo(b, serverTransport.Conn.LocalAddr())
+		case quicproxy.DirectionOutgoing:
+			serverTransport.WriteTo(b, clientTransport.Conn.LocalAddr())
+		}
+		return true
+	}
+
+	runMITMTest(t, serverTransport, clientTransport, rtt, dropCallback)
+	t.Logf("corrupted %d packets", numCorrupted.Load())
+	require.NotZero(t, int(numCorrupted.Load()))
+}
+
+func runMITMTest(t *testing.T, serverTr, clientTr *quic.Transport, rtt time.Duration, dropCb quicproxy.DropCallback) {
+	ln, err := serverTr.Listen(getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer ln.Close()
+
+	proxy := quicproxy.Proxy{
+		Conn:        newUDPConnLocalhost(t),
+		ServerAddr:  ln.Addr().(*net.UDPAddr),
+		DelayPacket: func(quicproxy.Direction, net.Addr, net.Addr, []byte) time.Duration { return rtt / 2 },
+		DropPacket:  dropCb,
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), scaleDuration(time.Second))
+	defer cancel()
+	conn, err := clientTr.Dial(ctx, proxy.LocalAddr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	serverConn, err := ln.Accept(ctx)
+	require.NoError(t, err)
+	defer serverConn.CloseWithError(0, "")
+
+	str, err := conn.OpenStreamSync(ctx)
+	require.NoError(t, err)
+	clientErrChan := make(chan error, 1)
+	go func() {
+		_, err := str.Write(PRData)
+		clientErrChan <- err
+		str.Close()
+	}()
+
+	serverStr, err := serverConn.AcceptStream(ctx)
+	require.NoError(t, err)
+	serverErrChan := make(chan error, 1)
+	go func() {
+		defer close(serverErrChan)
+		if _, err := io.Copy(serverStr, serverStr); err != nil {
+			serverErrChan <- err
+			return
+		}
+		serverStr.Close()
+	}()
+	require.NoError(t, <-serverErrChan)
+
+	data, err := io.ReadAll(str)
+	require.NoError(t, err)
+	require.Equal(t, PRData, data)
+
+	select {
+	case err := <-clientErrChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	select {
+	case err := <-serverErrChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestMITMForgedVersionNegotiationPacket(t *testing.T) {
+	serverTransport, clientTransport := getTransportsForMITMTest(t)
+	rtt := scaleDuration(10 * time.Millisecond)
+
+	const supportedVersion protocol.Version = 42
+
+	var once sync.Once
+	delayCb := func(dir quicproxy.Direction, _, _ net.Addr, raw []byte) time.Duration {
+		if dir != quicproxy.DirectionIncoming {
+			return rtt / 2
+		}
+		once.Do(func() {
+			hdr, _, _, err := wire.ParsePacket(raw)
+			if err != nil {
+				panic("failed to parse packet: " + err.Error())
+			}
+			// create fake version negotiation packet with a fake supported version
+			packet := wire.ComposeVersionNegotiation(
+				protocol.ArbitraryLenConnectionID(hdr.SrcConnectionID.Bytes()),
+				protocol.ArbitraryLenConnectionID(hdr.DestConnectionID.Bytes()),
+				[]protocol.Version{supportedVersion},
+			)
+			if _, err := serverTransport.WriteTo(packet, clientTransport.Conn.LocalAddr()); err != nil {
+				panic("failed to write packet: " + err.Error())
+			}
+		})
+		return rtt / 2
+	}
+
+	err := runMITMTestSuccessful(t, serverTransport, clientTransport, delayCb)
+	var vnErr *quic.VersionNegotiationError
+	require.ErrorAs(t, err, &vnErr)
+	require.Contains(t, vnErr.Theirs, supportedVersion) // might contain greased versions
+}
+
+// times out, because client doesn't accept subsequent real retry packets from server
+// as it has already accepted a retry.
+// TODO: determine behavior when server does not send Retry packets
+func TestMITMForgedRetryPacket(t *testing.T) {
+	serverTransport, clientTransport := getTransportsForMITMTest(t)
+	serverTransport.VerifySourceAddress = func(net.Addr) bool { return true }
+	rtt := scaleDuration(10 * time.Millisecond)
+
+	var once sync.Once
+	delayCb := func(dir quicproxy.Direction, _, _ net.Addr, raw []byte) time.Duration {
+		hdr, _, _, err := wire.ParsePacket(raw)
+		if err != nil {
+			panic("failed to parse packet: " + err.Error())
+		}
+		if dir == quicproxy.DirectionIncoming && hdr.Type == protocol.PacketTypeInitial {
+			once.Do(func() {
+				fakeSrcConnID := protocol.ParseConnectionID([]byte{0x12, 0x12, 0x12, 0x12, 0x12, 0x12, 0x12, 0x12})
+				retryPacket := testutils.ComposeRetryPacket(fakeSrcConnID, hdr.SrcConnectionID, hdr.DestConnectionID, []byte("token"), hdr.Version)
+				if _, err := serverTransport.WriteTo(retryPacket, clientTransport.Conn.LocalAddr()); err != nil {
+					panic("failed to write packet: " + err.Error())
+				}
+			})
+		}
+		return rtt / 2
+	}
+	err := runMITMTestSuccessful(t, serverTransport, clientTransport, delayCb)
+	var nerr net.Error
+	require.ErrorAs(t, err, &nerr)
+	require.True(t, nerr.Timeout())
+}
+
+func TestMITMForgedInitialPacket(t *testing.T) {
+	serverTransport, clientTransport := getTransportsForMITMTest(t)
+	rtt := scaleDuration(10 * time.Millisecond)
+
+	var once sync.Once
+	delayCb := func(dir quicproxy.Direction, _, _ net.Addr, raw []byte) time.Duration {
+		if dir == quicproxy.DirectionIncoming {
+			hdr, _, _, err := wire.ParsePacket(raw)
+			if err != nil {
+				panic("failed to parse packet: " + err.Error())
+			}
+			if hdr.Type != protocol.PacketTypeInitial {
+				return 0
+			}
+			once.Do(func() {
+				initialPacket := testutils.ComposeInitialPacket(
+					hdr.DestConnectionID,
+					hdr.SrcConnectionID,
+					hdr.DestConnectionID,
+					nil,
+					nil,
+					protocol.PerspectiveServer,
+					hdr.Version,
+				)
+				if _, err := serverTransport.WriteTo(initialPacket, clientTransport.Conn.LocalAddr()); err != nil {
+					panic("failed to write packet: " + err.Error())
+				}
+			})
+		}
+		return rtt / 2
+	}
+	err := runMITMTestSuccessful(t, serverTransport, clientTransport, delayCb)
+	var nerr net.Error
+	require.ErrorAs(t, err, &nerr)
+	require.True(t, nerr.Timeout())
+}
+
+func TestMITMForgedInitialPacketWithAck(t *testing.T) {
+	serverTransport, clientTransport := getTransportsForMITMTest(t)
+	rtt := scaleDuration(10 * time.Millisecond)
+
+	var once sync.Once
+	delayCb := func(dir quicproxy.Direction, _, _ net.Addr, raw []byte) time.Duration {
+		if dir == quicproxy.DirectionIncoming {
+			hdr, _, _, err := wire.ParsePacket(raw)
+			if err != nil {
+				panic("failed to parse packet: " + err.Error())
+			}
+			if hdr.Type != protocol.PacketTypeInitial {
+				return 0
+			}
+			once.Do(func() {
+				// Fake Initial with ACK for packet 2 (unsent)
+				ack := &wire.AckFrame{AckRanges: []wire.AckRange{{Smallest: 2, Largest: 2}}}
+				initialPacket := testutils.ComposeInitialPacket(
+					hdr.DestConnectionID,
+					hdr.SrcConnectionID,
+					hdr.DestConnectionID,
+					nil,
+					[]wire.Frame{ack},
+					protocol.PerspectiveServer,
+					hdr.Version,
+				)
+				if _, err := serverTransport.WriteTo(initialPacket, clientTransport.Conn.LocalAddr()); err != nil {
+					panic("failed to write packet: " + err.Error())
+				}
+			})
+		}
+		return rtt / 2
+	}
+
+	err := runMITMTestSuccessful(t, serverTransport, clientTransport, delayCb)
+	var transportErr *quic.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, quic.ProtocolViolation, transportErr.ErrorCode)
+	require.Contains(t, transportErr.ErrorMessage, "received ACK for an unsent packet")
+}
+
+func runMITMTestSuccessful(t *testing.T, serverTransport, clientTransport *quic.Transport, delayCb quicproxy.DelayCallback) error {
+	t.Helper()
+	ln, err := serverTransport.Listen(getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer ln.Close()
+
+	proxy := quicproxy.Proxy{
+		Conn:        newUDPConnLocalhost(t),
+		ServerAddr:  ln.Addr().(*net.UDPAddr),
+		DelayPacket: delayCb,
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), scaleDuration(50*time.Millisecond))
+	defer cancel()
+	_, err = clientTransport.Dial(ctx, proxy.LocalAddr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.Error(t, err)
+	return err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/mtu_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/mtu_test.go
new file mode 100644
index 000000000..a0f6a50db
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/mtu_test.go
@@ -0,0 +1,197 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestInitialPacketSize(t *testing.T) {
+	server := newUDPConnLocalhost(t)
+	client := newUDPConnLocalhost(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		quic.Dial(ctx, client, server.LocalAddr(), getTLSClientConfig(), getQuicConfig(&quic.Config{
+			InitialPacketSize: 1337,
+		}))
+	}()
+
+	buf := make([]byte, 2000)
+	n, _, err := server.ReadFrom(buf)
+	require.NoError(t, err)
+	require.Equal(t, 1337, n)
+
+	cancel()
+	<-done
+}
+
+func TestPathMTUDiscovery(t *testing.T) {
+	rtt := scaleDuration(5 * time.Millisecond)
+	const mtu = 1400
+
+	ln, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{
+			InitialPacketSize:       1234,
+			DisablePathMTUDiscovery: true,
+			EnableDatagrams:         true,
+		}),
+	)
+	require.NoError(t, err)
+	defer ln.Close()
+
+	serverErrChan := make(chan error, 1)
+	go func() {
+		conn, err := ln.Accept(context.Background())
+		if err != nil {
+			serverErrChan <- err
+			return
+		}
+		str, err := conn.AcceptStream(context.Background())
+		if err != nil {
+			serverErrChan <- err
+			return
+		}
+		defer str.Close()
+		if _, err := io.Copy(str, str); err != nil {
+			serverErrChan <- err
+			return
+		}
+	}()
+
+	var mx sync.Mutex
+	var maxPacketSizeServer int
+	var clientPacketSizes []int
+	proxy := &quicproxy.Proxy{
+		Conn:        newUDPConnLocalhost(t),
+		ServerAddr:  ln.Addr().(*net.UDPAddr),
+		DelayPacket: func(quicproxy.Direction, net.Addr, net.Addr, []byte) time.Duration { return rtt / 2 },
+		DropPacket: func(dir quicproxy.Direction, _, _ net.Addr, packet []byte) bool {
+			if len(packet) > mtu {
+				return true
+			}
+			mx.Lock()
+			defer mx.Unlock()
+			switch dir {
+			case quicproxy.DirectionIncoming:
+				clientPacketSizes = append(clientPacketSizes, len(packet))
+			case quicproxy.DirectionOutgoing:
+				if len(packet) > maxPacketSizeServer {
+					maxPacketSizeServer = len(packet)
+				}
+			}
+			return false
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	// Make sure to use v4-only socket here.
+	// We can't reliably set the DF bit on dual-stack sockets on older versions of macOS (before Sequoia).
+	tr := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	defer tr.Close()
+
+	var eventRecorder events.Recorder
+	conn, err := tr.Dial(
+		context.Background(),
+		proxy.LocalAddr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{
+			InitialPacketSize: protocol.MinInitialPacketSize,
+			EnableDatagrams:   true,
+			Tracer:            newTracer(&eventRecorder),
+		}),
+	)
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	err = conn.SendDatagram(make([]byte, 2000))
+	require.Error(t, err)
+	var datagramErr *quic.DatagramTooLargeError
+	require.ErrorAs(t, err, &datagramErr)
+	initialMaxDatagramSize := datagramErr.MaxDatagramPayloadSize
+
+	str, err := conn.OpenStream()
+	require.NoError(t, err)
+
+	clientErrChan := make(chan error, 1)
+	go func() {
+		data, err := io.ReadAll(str)
+		if err != nil {
+			clientErrChan <- err
+			return
+		}
+		if !bytes.Equal(data, PRDataLong) {
+			clientErrChan <- fmt.Errorf("echoed data doesn't match: %x", data)
+			return
+		}
+		clientErrChan <- nil
+	}()
+
+	_, err = str.Write(PRDataLong)
+	require.NoError(t, err)
+	str.Close()
+
+	select {
+	case err := <-clientErrChan:
+		require.NoError(t, err)
+	case err := <-serverErrChan:
+		t.Fatalf("server error: %v", err)
+	case <-time.After(20 * time.Second):
+		t.Fatal("timeout")
+	}
+
+	err = conn.SendDatagram(make([]byte, 2000))
+	require.Error(t, err)
+	require.ErrorAs(t, err, &datagramErr)
+	finalMaxDatagramSize := datagramErr.MaxDatagramPayloadSize
+
+	mx.Lock()
+	defer mx.Unlock()
+	require.NotEmpty(t, eventRecorder.Events(qlog.MTUUpdated{}))
+
+	var mtus []int
+	for _, ev := range eventRecorder.Events(qlog.MTUUpdated{}) {
+		mtus = append(mtus, ev.(qlog.MTUUpdated).Value)
+	}
+
+	maxPacketSizeClient := mtus[len(mtus)-1]
+	t.Logf("max client packet size: %d, MTU: %d", maxPacketSizeClient, mtu)
+	t.Logf("max datagram size: initial: %d, final: %d", initialMaxDatagramSize, finalMaxDatagramSize)
+	t.Logf("max server packet size: %d, MTU: %d", maxPacketSizeServer, mtu)
+
+	require.GreaterOrEqual(t, maxPacketSizeClient, mtu-25)
+	const maxDiff = 40 // this includes the 21 bytes for the short header, 16 bytes for the encryption tag, and framing overhead
+	require.GreaterOrEqual(t, int(initialMaxDatagramSize), protocol.MinInitialPacketSize-maxDiff)
+	require.GreaterOrEqual(t, int(finalMaxDatagramSize), maxPacketSizeClient-maxDiff)
+	// MTU discovery was disabled on the server side
+	require.Equal(t, 1234, maxPacketSizeServer)
+
+	var numPacketsLargerThanDiscoveredMTU int
+	for _, s := range clientPacketSizes {
+		if s > maxPacketSizeClient {
+			numPacketsLargerThanDiscoveredMTU++
+		}
+	}
+	// The client shouldn't have sent any packets larger than the MTU it discovered,
+	// except for at most one MTU probe packet.
+	require.LessOrEqual(t, numPacketsLargerThanDiscoveredMTU, 1)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/multiplex_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/multiplex_test.go
new file mode 100644
index 000000000..119b6a1a7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/multiplex_test.go
@@ -0,0 +1,346 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"io"
+	mrand "math/rand/v2"
+	"net"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+
+	"github.com/stretchr/testify/require"
+)
+
+func runMultiplexTestServer(t *testing.T, ln *quic.Listener) {
+	t.Helper()
+	for {
+		conn, err := ln.Accept(context.Background())
+		if err != nil {
+			return
+		}
+		str, err := conn.OpenUniStream()
+		require.NoError(t, err)
+		go func() {
+			defer str.Close()
+			_, err = str.Write(PRData)
+			require.NoError(t, err)
+		}()
+
+		t.Cleanup(func() { conn.CloseWithError(0, "") })
+	}
+}
+
+func dialAndReceiveData(tr *quic.Transport, addr net.Addr) error {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := tr.Dial(ctx, addr, getTLSClientConfig(), getQuicConfig(nil))
+	if err != nil {
+		return fmt.Errorf("error dialing: %w", err)
+	}
+	str, err := conn.AcceptUniStream(ctx)
+	if err != nil {
+		return fmt.Errorf("error accepting stream: %w", err)
+	}
+	data, err := io.ReadAll(str)
+	if err != nil {
+		return fmt.Errorf("error reading data: %w", err)
+	}
+	if !bytes.Equal(data, PRData) {
+		return fmt.Errorf("data mismatch: got %q, expected %q", data, PRData)
+	}
+	return nil
+}
+
+func TestMultiplexesConnectionsToSameServer(t *testing.T) {
+	server, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+	go runMultiplexTestServer(t, server)
+
+	tr := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	addTracer(tr)
+	defer tr.Close()
+
+	errChan1 := make(chan error, 1)
+	go func() { errChan1 <- dialAndReceiveData(tr, server.Addr()) }()
+	errChan2 := make(chan error, 1)
+	go func() { errChan2 <- dialAndReceiveData(tr, server.Addr()) }()
+
+	select {
+	case err := <-errChan1:
+		require.NoError(t, err, "error dialing server 1")
+	case <-time.After(5 * time.Second):
+		t.Error("timeout waiting for done1 to close")
+	}
+	select {
+	case err := <-errChan2:
+		require.NoError(t, err)
+	case <-time.After(5 * time.Second):
+		t.Error("timeout waiting for done2 to close")
+	}
+}
+
+func TestMultiplexingToDifferentServers(t *testing.T) {
+	server1, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server1.Close()
+	go runMultiplexTestServer(t, server1)
+
+	server2, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server2.Close()
+	go runMultiplexTestServer(t, server2)
+
+	tr := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	addTracer(tr)
+	defer tr.Close()
+
+	errChan1 := make(chan error, 1)
+	go func() { errChan1 <- dialAndReceiveData(tr, server1.Addr()) }()
+	errChan2 := make(chan error, 1)
+	go func() { errChan2 <- dialAndReceiveData(tr, server2.Addr()) }()
+
+	select {
+	case err := <-errChan1:
+		require.NoError(t, err, "error dialing server 1")
+	case <-time.After(5 * time.Second):
+		t.Error("timeout waiting for done1 to close")
+	}
+	select {
+	case err := <-errChan2:
+		require.NoError(t, err, "error dialing server 2")
+	case <-time.After(5 * time.Second):
+		t.Error("timeout waiting for done2 to close")
+	}
+}
+
+func TestMultiplexingConnectToSelf(t *testing.T) {
+	tr := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	addTracer(tr)
+	defer tr.Close()
+
+	server, err := tr.Listen(getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+	go runMultiplexTestServer(t, server)
+
+	errChan := make(chan error, 1)
+	go func() { errChan <- dialAndReceiveData(tr, server.Addr()) }()
+
+	select {
+	case err := <-errChan:
+		require.NoError(t, err, "error dialing server")
+	case <-time.After(5 * time.Second):
+		t.Error("timeout waiting for connection to close")
+	}
+}
+
+func TestMultiplexingServerAndClientOnSameConn(t *testing.T) {
+	if runtime.GOOS == "linux" {
+		t.Skip("This test requires setting of iptables rules on Linux, see https://stackoverflow.com/questions/23859164/linux-udp-socket-sendto-operation-not-permitted.")
+	}
+
+	tr1 := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	addTracer(tr1)
+	defer tr1.Close()
+	server1, err := tr1.Listen(getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server1.Close()
+
+	tr2 := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	addTracer(tr2)
+	defer tr2.Close()
+	server2, err := tr2.Listen(getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server2.Close()
+
+	done1 := make(chan struct{})
+	go func() {
+		defer close(done1)
+		dialAndReceiveData(tr2, server1.Addr())
+	}()
+
+	done2 := make(chan struct{})
+	go func() {
+		defer close(done2)
+		dialAndReceiveData(tr1, server2.Addr())
+	}()
+
+	select {
+	case <-done1:
+	case <-time.After(5 * time.Second):
+		t.Error("timeout waiting for done1 to close")
+	}
+	select {
+	case <-done2:
+	case <-time.After(time.Second):
+		t.Error("timeout waiting for done2 to close")
+	}
+}
+
+func TestMultiplexingNonQUICPackets(t *testing.T) {
+	const numPackets = 100
+
+	tr1 := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	defer tr1.Close()
+	addTracer(tr1)
+	server, err := tr1.Listen(getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer server.Close()
+
+	tr2 := &quic.Transport{Conn: newUDPConnLocalhost(t)}
+	defer tr2.Close()
+	addTracer(tr2)
+
+	type nonQUICPacket struct {
+		b    []byte
+		addr net.Addr
+		err  error
+	}
+	rcvdPackets := make(chan nonQUICPacket, numPackets)
+	receiveCtx := t.Context()
+	// start receiving non-QUIC packets
+	go func() {
+		for {
+			b := make([]byte, 1024)
+			n, addr, err := tr2.ReadNonQUICPacket(receiveCtx, b)
+			if errors.Is(err, context.Canceled) {
+				return
+			}
+			rcvdPackets <- nonQUICPacket{b: b[:n], addr: addr, err: err}
+		}
+	}()
+
+	ctx2, cancel2 := context.WithTimeout(context.Background(), time.Second)
+	defer cancel2()
+	conn, err := tr2.Dial(ctx2, server.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	serverConn, err := server.Accept(ctx2)
+	require.NoError(t, err)
+	serverStr, err := serverConn.OpenUniStream()
+	require.NoError(t, err)
+
+	// send a non-QUIC packet every 100µs
+	const packetLen = 128
+	errChanNonQUIC := make(chan error, 1)
+	sendNonQUICPacket := make(chan struct{}, 1)
+	go func() {
+		var seed [32]byte
+		rand.Read(seed[:])
+		random := mrand.NewChaCha8(seed)
+		defer close(errChanNonQUIC)
+		var sentPackets int
+		for range sendNonQUICPacket {
+			b := make([]byte, packetLen)
+			random.Read(b[1:]) // keep the first byte set to 0, so it's not classified as a QUIC packet
+			_, err := tr1.WriteTo(b, tr2.Conn.LocalAddr())
+			// The first sendmsg call on a new UDP socket sometimes errors on Linux.
+			// It's not clear why this happens.
+			// See https://github.com/golang/go/issues/63322.
+			if err != nil && sentPackets == 0 && runtime.GOOS == "linux" && isPermissionError(err) {
+				_, err = tr1.WriteTo(b, tr2.Conn.LocalAddr())
+			}
+			if err != nil {
+				errChanNonQUIC <- err
+				return
+			}
+			sentPackets++
+		}
+	}()
+
+	sendQUICPacket := make(chan struct{}, 1)
+	errChanQUIC := make(chan error, 1)
+	var dataSent []byte
+	go func() {
+		defer close(errChanQUIC)
+		defer serverStr.Close()
+
+		var seed [32]byte
+		rand.Read(seed[:])
+		random := mrand.NewChaCha8(seed)
+		for range sendQUICPacket {
+			b := make([]byte, 1024)
+			random.Read(b)
+			if _, err := serverStr.Write(b); err != nil {
+				errChanQUIC <- err
+				return
+			}
+			dataSent = append(dataSent, b...)
+		}
+	}()
+
+	dataChan := make(chan []byte, 1)
+	readErr := make(chan error, 1)
+	go func() {
+		str, err := conn.AcceptUniStream(ctx2)
+		if err != nil {
+			readErr <- err
+			return
+		}
+		data, err := io.ReadAll(str)
+		if err != nil {
+			readErr <- err
+			return
+		}
+		dataChan <- data
+	}()
+
+	ticker := time.NewTicker(scaleDuration(200 * time.Microsecond))
+	defer ticker.Stop()
+	for range numPackets {
+		sendNonQUICPacket <- struct{}{}
+		sendQUICPacket <- struct{}{}
+		<-ticker.C
+	}
+	close(sendNonQUICPacket)
+	close(sendQUICPacket)
+
+	select {
+	case err := <-errChanNonQUIC:
+		require.NoError(t, err, "error sending non-QUIC packets")
+	case <-time.After(time.Second):
+		t.Fatalf("timeout waiting for non-QUIC packets to be sent")
+	}
+	select {
+	case err := <-errChanQUIC:
+		require.NoError(t, err, "error sending QUIC packets")
+	case <-time.After(time.Second):
+		t.Fatalf("timeout waiting for QUIC packets to be sent")
+	}
+	select {
+	case err := <-readErr:
+		require.NoError(t, err, "error reading stream data")
+	case dataRcvd := <-dataChan:
+		require.Equal(t, dataSent, dataRcvd, "stream data mismatch")
+	case <-time.After(time.Second):
+		t.Fatalf("timeout waiting for stream data to be read")
+	}
+
+	// make sure we don't overflow the capacity of the channel
+	require.LessOrEqual(t, numPackets, cap(rcvdPackets), "too many non-QUIC packets sent: %d > %d", numPackets, cap(rcvdPackets))
+
+	// now receive these packets
+	minExpected := numPackets * 4 / 5
+	timeout := time.After(time.Second)
+	var counter int
+	for counter < minExpected {
+		select {
+		case p := <-rcvdPackets:
+			require.Equal(t, tr1.Conn.LocalAddr(), p.addr, "non-QUIC packet received from wrong address")
+			require.Equal(t, packetLen, len(p.b), "non-QUIC packet incorrect length")
+			require.NoError(t, p.err, "error receiving non-QUIC packet")
+			counter++
+		case <-timeout:
+			t.Fatalf("didn't receive enough non-QUIC packets: %d < %d", counter, minExpected)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/nat_rebinding_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/nat_rebinding_test.go
new file mode 100644
index 000000000..79f273b73
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/nat_rebinding_test.go
@@ -0,0 +1,126 @@
+package self_test
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNATRebinding(t *testing.T) {
+	tr, tracer := newPacketTracer()
+	tlsConf := getTLSConfig()
+	f, err := os.Create("keylog.txt")
+	require.NoError(t, err)
+	defer f.Close()
+	tlsConf.KeyLogWriter = f
+	server, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		tlsConf,
+		getQuicConfig(&quic.Config{
+			Tracer: func(ctx context.Context, isClient bool, connID quic.ConnectionID) qlogwriter.Trace { return tracer },
+		}),
+	)
+	require.NoError(t, err)
+	defer server.Close()
+
+	newPath := newUDPConnLocalhost(t)
+	clientUDPConn := newUDPConnLocalhost(t)
+
+	oldPathRTT := scaleDuration(10 * time.Millisecond)
+	newPathRTT := scaleDuration(20 * time.Millisecond)
+	proxy := quicproxy.Proxy{
+		ServerAddr: server.Addr().(*net.UDPAddr),
+		Conn:       newUDPConnLocalhost(t),
+	}
+	var mx sync.Mutex
+	var switchedPath bool
+	var dataTransferred int
+	proxy.DelayPacket = func(dir quicproxy.Direction, _, _ net.Addr, b []byte) time.Duration {
+		mx.Lock()
+		defer mx.Unlock()
+
+		if dir == quicproxy.DirectionOutgoing {
+			dataTransferred += len(b)
+			if dataTransferred > len(PRData)/3 {
+				if !switchedPath {
+					if err := proxy.SwitchConn(clientUDPConn.LocalAddr().(*net.UDPAddr), newPath); err != nil {
+						panic(fmt.Sprintf("failed to switch connection: %s", err))
+					}
+					switchedPath = true
+				}
+			}
+		}
+		if switchedPath {
+			return newPathRTT
+		}
+		return oldPathRTT
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(ctx, clientUDPConn, proxy.LocalAddr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+	defer serverConn.CloseWithError(0, "")
+
+	go func() {
+		str, err := serverConn.OpenUniStream()
+		require.NoError(t, err)
+		go func() {
+			defer str.Close()
+			_, err = str.Write(PRData)
+			require.NoError(t, err)
+		}()
+	}()
+
+	str, err := conn.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	str.SetReadDeadline(time.Now().Add(5 * time.Second))
+	data, err := io.ReadAll(str)
+	require.NoError(t, err)
+	require.Equal(t, PRData, data)
+	conn.CloseWithError(0, "")
+
+	// check that a PATH_CHALLENGE was sent
+	var pathChallenge [8]byte
+	var foundPathChallenge bool
+	for _, p := range tr.getSentShortHeaderPackets() {
+		for _, f := range p.frames {
+			switch fr := f.Frame.(type) {
+			case *qlog.PathChallengeFrame:
+				pathChallenge = fr.Data
+				foundPathChallenge = true
+			}
+		}
+	}
+	require.True(t, foundPathChallenge)
+
+	// check that a PATH_RESPONSE with the correct data was received
+	var foundPathResponse bool
+	for _, p := range tr.getRcvdShortHeaderPackets() {
+		for _, f := range p.frames {
+			switch fr := f.Frame.(type) {
+			case *qlog.PathResponseFrame:
+				require.Equal(t, pathChallenge, fr.Data)
+				foundPathResponse = true
+			}
+		}
+	}
+	require.True(t, foundPathResponse)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/packetization_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/packetization_test.go
new file mode 100644
index 000000000..6ffcc7316
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/packetization_test.go
@@ -0,0 +1,273 @@
+package self_test
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestACKBundling(t *testing.T) {
+	const numMsg = 100
+
+	serverCounter, serverTracer := newPacketTracer()
+	server, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{
+			DisablePathMTUDiscovery: true,
+			Tracer:                  func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return serverTracer },
+		}),
+	)
+	require.NoError(t, err)
+	defer server.Close()
+
+	proxy := quicproxy.Proxy{
+		Conn:       newUDPConnLocalhost(t),
+		ServerAddr: server.Addr().(*net.UDPAddr),
+		DelayPacket: func(quicproxy.Direction, net.Addr, net.Addr, []byte) time.Duration {
+			return 5 * time.Millisecond
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	clientCounter, clientTracer := newPacketTracer()
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		proxy.LocalAddr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{
+			DisablePathMTUDiscovery: true,
+			Tracer:                  func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return clientTracer },
+		}),
+	)
+	require.NoError(t, err)
+	defer conn.CloseWithError(0, "")
+
+	serverErrChan := make(chan error, 1)
+	go func() {
+		defer close(serverErrChan)
+		conn, err := server.Accept(context.Background())
+		if err != nil {
+			serverErrChan <- fmt.Errorf("accept failed: %w", err)
+			return
+		}
+		str, err := conn.AcceptStream(context.Background())
+		if err != nil {
+			serverErrChan <- fmt.Errorf("accept stream failed: %w", err)
+			return
+		}
+		b := make([]byte, 1)
+		// Echo every byte received from the client.
+		for {
+			if _, err := str.Read(b); err != nil {
+				break
+			}
+			_, err = str.Write(b)
+			if err != nil {
+				serverErrChan <- fmt.Errorf("write failed: %w", err)
+				return
+			}
+		}
+	}()
+
+	str, err := conn.OpenStreamSync(context.Background())
+	require.NoError(t, err)
+	b := make([]byte, 1)
+	// Send numMsg 1-byte messages.
+	for i := range numMsg {
+		_, err = str.Write([]byte{uint8(i)})
+		require.NoError(t, err)
+		_, err = str.Read(b)
+		require.NoError(t, err)
+		require.Equal(t, uint8(i), b[0])
+	}
+	require.NoError(t, conn.CloseWithError(0, ""))
+	require.NoError(t, <-serverErrChan)
+
+	countBundledPackets := func(packets []packet) (numBundled int) {
+		for _, p := range packets {
+			var hasAck, hasStreamFrame bool
+			for _, f := range p.frames {
+				switch f.Frame.(type) {
+				case *qlog.AckFrame:
+					hasAck = true
+				case *qlog.StreamFrame:
+					hasStreamFrame = true
+				}
+			}
+			if hasAck && hasStreamFrame {
+				numBundled++
+			}
+		}
+		return
+	}
+
+	numBundledIncoming := countBundledPackets(clientCounter.getRcvdShortHeaderPackets())
+	numBundledOutgoing := countBundledPackets(serverCounter.getRcvdShortHeaderPackets())
+	t.Logf("bundled incoming packets: %d / %d", numBundledIncoming, numMsg)
+	t.Logf("bundled outgoing packets: %d / %d", numBundledOutgoing, numMsg)
+
+	require.LessOrEqual(t, numBundledIncoming, numMsg)
+	require.Greater(t, numBundledIncoming, numMsg*9/10)
+	require.LessOrEqual(t, numBundledOutgoing, numMsg)
+	require.Greater(t, numBundledOutgoing, numMsg*9/10)
+}
+
+func TestStreamDataBlocked(t *testing.T) {
+	testConnAndStreamDataBlocked(t, true, false)
+}
+
+func TestConnDataBlocked(t *testing.T) {
+	testConnAndStreamDataBlocked(t, false, true)
+}
+
+func testConnAndStreamDataBlocked(t *testing.T, limitStream, limitConn bool) {
+	const window = 100
+	const numBatches = 3
+
+	initialStreamWindow := uint64(quicvarint.Max)
+	initialConnWindow := uint64(quicvarint.Max)
+	if limitStream {
+		initialStreamWindow = window
+	}
+	if limitConn {
+		initialConnWindow = window
+	}
+	rtt := scaleDuration(5 * time.Millisecond)
+
+	ln, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{
+			InitialStreamReceiveWindow:     initialStreamWindow,
+			InitialConnectionReceiveWindow: initialConnWindow,
+		}),
+	)
+	require.NoError(t, err)
+	defer ln.Close()
+
+	proxy := quicproxy.Proxy{
+		Conn:       newUDPConnLocalhost(t),
+		ServerAddr: ln.Addr().(*net.UDPAddr),
+		DelayPacket: func(quicproxy.Direction, net.Addr, net.Addr, []byte) time.Duration {
+			return rtt / 2
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	counter, tracer := newPacketTracer()
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		proxy.LocalAddr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{
+			Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+		}),
+	)
+	require.NoError(t, err)
+
+	serverConn, err := ln.Accept(ctx)
+	require.NoError(t, err)
+
+	str, err := conn.OpenUniStreamSync(ctx)
+	require.NoError(t, err)
+
+	// Stream data is consumed (almost) immediately, so flow-control window auto-tuning kicks in.
+	// The window size is doubled for every batch.
+	var windowSizes []protocol.ByteCount
+	for i := range numBatches {
+		windowSizes = append(windowSizes, window<<i)
+	}
+
+	var serverStr *quic.ReceiveStream
+	for i := range numBatches {
+		str.SetWriteDeadline(time.Now().Add(rtt))
+		n, err := str.Write(make([]byte, 10000))
+		require.Error(t, err)
+		require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+		require.Equal(t, int(windowSizes[i]), n)
+
+		if i == 0 {
+			serverStr, err = serverConn.AcceptUniStream(ctx)
+			require.NoError(t, err)
+		}
+		serverStr.SetReadDeadline(time.Now().Add(rtt))
+		n2, err := io.ReadFull(serverStr, make([]byte, 10000))
+		require.Error(t, err)
+		require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+		require.Equal(t, n, n2)
+	}
+
+	conn.CloseWithError(0, "")
+	serverConn.CloseWithError(0, "")
+
+	var streamDataBlockedFrames []qlog.StreamDataBlockedFrame
+	var dataBlockedFrames []qlog.DataBlockedFrame
+	var bundledCounter int
+	for _, p := range counter.getSentShortHeaderPackets() {
+		blockedOffset := protocol.InvalidByteCount
+		for _, f := range p.frames {
+			switch frame := f.Frame.(type) {
+			case *qlog.StreamDataBlockedFrame:
+				streamDataBlockedFrames = append(streamDataBlockedFrames, *frame)
+				blockedOffset = frame.MaximumStreamData
+			case *qlog.DataBlockedFrame:
+				dataBlockedFrames = append(dataBlockedFrames, *frame)
+				blockedOffset = frame.MaximumData
+			case *qlog.StreamFrame:
+				// the STREAM frame is always packed last
+				if frame.Offset+frame.Length == int64(blockedOffset) {
+					bundledCounter++
+				}
+			}
+		}
+	}
+
+	var expectedBlockOffsets []protocol.ByteCount
+	for i := range numBatches {
+		var offset protocol.ByteCount
+		for _, s := range windowSizes[:i+1] {
+			offset += s
+		}
+		expectedBlockOffsets = append(expectedBlockOffsets, offset)
+	}
+
+	assert.Equal(t, numBatches, bundledCounter)
+	if limitStream {
+		assert.Empty(t, dataBlockedFrames)
+		assert.Len(t, streamDataBlockedFrames, numBatches)
+		for i, f := range streamDataBlockedFrames {
+			assert.Equal(t, str.StreamID(), f.StreamID)
+			assert.Equal(t, expectedBlockOffsets[i], f.MaximumStreamData)
+		}
+	}
+	if limitConn {
+		assert.Empty(t, streamDataBlockedFrames)
+		assert.Len(t, dataBlockedFrames, numBatches)
+		for i, f := range dataBlockedFrames {
+			assert.Equal(t, expectedBlockOffsets[i], f.MaximumData)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/qlog_dir_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/qlog_dir_test.go
new file mode 100644
index 000000000..eceee0c3d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/qlog_dir_test.go
@@ -0,0 +1,75 @@
+package self_test
+
+import (
+	"context"
+	"os"
+	"path"
+	"regexp"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlog"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestQlogDirEnvironmentVariable(t *testing.T) {
+	tempDir := t.TempDir()
+	qlogDir := path.Join(tempDir, "qlogs")
+	t.Setenv("QLOGDIR", qlogDir)
+
+	serverStopped := make(chan struct{})
+	server, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		&quic.Config{Tracer: qlog.DefaultConnectionTracer},
+	)
+	require.NoError(t, err)
+
+	go func() {
+		defer close(serverStopped)
+		for {
+			if _, err := server.Accept(context.Background()); err != nil {
+				return
+			}
+		}
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		&quic.Config{Tracer: qlog.DefaultConnectionTracer},
+	)
+	require.NoError(t, err)
+	conn.CloseWithError(0, "")
+	server.Close()
+	<-serverStopped
+
+	_, err = os.Stat(qlogDir)
+	qlogDirCreated := !os.IsNotExist(err)
+	require.True(t, qlogDirCreated)
+
+	childs, err := os.ReadDir(qlogDir)
+	require.NoError(t, err)
+	require.Len(t, childs, 2)
+
+	odcids := make([]string, 0, 2)
+	vantagePoints := make([]string, 0, 2)
+	qlogFileNameRegexp := regexp.MustCompile(`^([0-f]+)_(client|server).sqlog$`)
+
+	for _, child := range childs {
+		matches := qlogFileNameRegexp.FindStringSubmatch(child.Name())
+		require.Len(t, matches, 3)
+		odcids = append(odcids, matches[1])
+		vantagePoints = append(vantagePoints, matches[2])
+	}
+
+	require.Equal(t, odcids[0], odcids[1])
+	require.Contains(t, vantagePoints, "client")
+	require.Contains(t, vantagePoints, "server")
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/qlog_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/qlog_test.go
new file mode 100644
index 000000000..258208c6a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/qlog_test.go
@@ -0,0 +1,138 @@
+package self_test
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/qlogwriter"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type mockTrace struct {
+	openRecorders atomic.Int32
+
+	SchemasChecked []string
+}
+
+var _ qlogwriter.Trace = &mockTrace{}
+
+func newMockTrace() *mockTrace {
+	return &mockTrace{}
+}
+
+func (t *mockTrace) AddProducer() qlogwriter.Recorder {
+	t.openRecorders.Add(1)
+	return &mockRecorder{onClose: func() { t.openRecorders.Add(-1) }}
+}
+
+func (t *mockTrace) SupportsSchemas(schema string) bool {
+	t.SchemasChecked = append(t.SchemasChecked, schema)
+	return true
+}
+
+func (t *mockTrace) OpenRecorders() int {
+	return int(t.openRecorders.Load())
+}
+
+type mockRecorder struct {
+	onClose func()
+}
+
+var _ qlogwriter.Recorder = &mockRecorder{}
+
+func (r *mockRecorder) RecordEvent(qlogwriter.Event) {}
+
+func (r *mockRecorder) Close() error {
+	r.onClose()
+	return nil
+}
+
+func TestQlogHandshake(t *testing.T) {
+	serverTrace := newMockTrace()
+	clientTrace := newMockTrace()
+
+	server, err := quic.Listen(
+		newUDPConnLocalhost(t),
+		getTLSConfig(),
+		getQuicConfig(&quic.Config{
+			Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+				return serverTrace
+			},
+		}),
+	)
+	require.NoError(t, err)
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	clientConn, err := quic.Dial(
+		ctx,
+		newUDPConnLocalhost(t),
+		server.Addr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{
+			Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+				return clientTrace
+			},
+		}),
+	)
+	require.NoError(t, err)
+
+	serverConn, err := server.Accept(ctx)
+	require.NoError(t, err)
+
+	assert.NotZero(t, clientTrace.OpenRecorders())
+	assert.NotZero(t, serverTrace.OpenRecorders())
+
+	clientConn.CloseWithError(0, "")
+	serverConn.CloseWithError(0, "")
+
+	assert.Zero(t, clientTrace.OpenRecorders(), "client recorders should be closed")
+	assert.Zero(t, serverTrace.OpenRecorders(), "server recorders should be closed")
+	assert.Empty(t, clientTrace.SchemasChecked)
+	assert.Empty(t, serverTrace.SchemasChecked)
+}
+
+func TestQlogHandshakeFailed(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const handshakeIdleTimeout = 3 * time.Second
+
+		clientTrace := newMockTrace()
+		clientPacketConn, serverPacketConn, closeFn := newSimnetLink(t, time.Millisecond)
+		defer closeFn(t)
+
+		// Don't start a server, so the handshake will timeout
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := quic.Dial(
+				context.Background(),
+				clientPacketConn,
+				serverPacketConn.LocalAddr(),
+				getTLSClientConfig(),
+				getQuicConfig(&quic.Config{
+					HandshakeIdleTimeout: handshakeIdleTimeout,
+					Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+						return clientTrace
+					},
+				}),
+			)
+			errChan <- err
+		}()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, &quic.IdleTimeoutError{})
+		case <-time.After(5 * time.Second):
+			t.Fatal("timeout waiting for dial error")
+		}
+
+		require.Zero(t, clientTrace.OpenRecorders(), "client recorders should be closed after failed handshake")
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/resumption_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/resumption_test.go
new file mode 100644
index 000000000..2dc04dcd4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/resumption_test.go
@@ -0,0 +1,149 @@
+package self_test
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/require"
+)
+
+type clientSessionCache struct {
+	cache tls.ClientSessionCache
+	gets  chan<- string
+	puts  chan<- string
+}
+
+func newClientSessionCache(cache tls.ClientSessionCache, gets, puts chan<- string) *clientSessionCache {
+	return &clientSessionCache{
+		cache: cache,
+		gets:  gets,
+		puts:  puts,
+	}
+}
+
+var _ tls.ClientSessionCache = &clientSessionCache{}
+
+func (c *clientSessionCache) Get(sessionKey string) (*tls.ClientSessionState, bool) {
+	session, ok := c.cache.Get(sessionKey)
+	if c.gets != nil {
+		c.gets <- sessionKey
+	}
+	return session, ok
+}
+
+func (c *clientSessionCache) Put(sessionKey string, cs *tls.ClientSessionState) {
+	c.cache.Put(sessionKey, cs)
+	if c.puts != nil {
+		c.puts <- sessionKey
+	}
+}
+
+func TestTLSSessionResumption(t *testing.T) {
+	t.Run("uses session resumption", func(t *testing.T) {
+		handshakeWithSessionResumption(t, getTLSConfig(), true)
+	})
+
+	t.Run("disabled in tls.Config", func(t *testing.T) {
+		sConf := getTLSConfig()
+		sConf.SessionTicketsDisabled = true
+		handshakeWithSessionResumption(t, sConf, false)
+	})
+
+	t.Run("disabled in tls.Config.GetConfigForClient", func(t *testing.T) {
+		sConf := &tls.Config{
+			GetConfigForClient: func(*tls.ClientHelloInfo) (*tls.Config, error) {
+				conf := getTLSConfig()
+				conf.SessionTicketsDisabled = true
+				return conf, nil
+			},
+		}
+		handshakeWithSessionResumption(t, sConf, false)
+	})
+}
+
+func handshakeWithSessionResumption(t *testing.T, serverTLSConf *tls.Config, expectSessionTicket bool) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 10 * time.Millisecond
+
+		n := &simnet.Simnet{Router: &simnet.PerfectRouter{}}
+		defer n.Close()
+		settings := simnet.NodeBiDiLinkSettings{Latency: rtt / 2}
+		clientPacketConn1 := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}, settings)
+		defer clientPacketConn1.Close()
+		clientPacketConn2 := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9001}, settings)
+		defer clientPacketConn2.Close()
+		serverPacketConn := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.3"), Port: 9002}, settings)
+		defer serverPacketConn.Close()
+
+		require.NoError(t, n.Start())
+
+		server, err := quic.Listen(serverPacketConn, serverTLSConf, getQuicConfig(nil))
+		require.NoError(t, err)
+		defer server.Close()
+
+		gets := make(chan string, 100)
+		puts := make(chan string, 100)
+		cache := newClientSessionCache(tls.NewLRUClientSessionCache(10), gets, puts)
+		tlsConf := getTLSClientConfig()
+		tlsConf.ClientSessionCache = cache
+
+		// first connection - doesn't use resumption
+		conn1, err := quic.Dial(context.Background(), clientPacketConn1, server.Addr(), tlsConf, getQuicConfig(nil))
+		require.NoError(t, err)
+		defer conn1.CloseWithError(0, "")
+		require.False(t, conn1.ConnectionState().TLS.DidResume)
+
+		var sessionKey string
+		select {
+		case sessionKey = <-puts:
+			if !expectSessionTicket {
+				t.Fatal("unexpected session ticket")
+			}
+		case <-time.After(time.Hour):
+			if expectSessionTicket {
+				t.Fatal("timeout waiting for session ticket")
+			}
+		}
+
+		serverConn1, err := server.Accept(context.Background())
+		require.NoError(t, err)
+		require.False(t, serverConn1.ConnectionState().TLS.DidResume)
+		defer serverConn1.CloseWithError(0, "")
+
+		// second connection - will use resumption, if enabled
+		conn2, err := quic.Dial(context.Background(), clientPacketConn2, server.Addr(), tlsConf, getQuicConfig(nil))
+		require.NoError(t, err)
+		defer conn2.CloseWithError(0, "")
+
+		select {
+		case k := <-gets:
+			if expectSessionTicket {
+				// we can only perform this check if we got a session ticket before
+				require.Equal(t, sessionKey, k)
+			}
+		case <-time.After(time.Hour):
+			if expectSessionTicket {
+				t.Fatal("timeout waiting for retrieval of session ticket")
+			}
+		}
+
+		serverConn2, err := server.Accept(context.Background())
+		require.NoError(t, err)
+		defer serverConn2.CloseWithError(0, "")
+
+		if expectSessionTicket {
+			require.True(t, conn2.ConnectionState().TLS.DidResume)
+			require.True(t, serverConn2.ConnectionState().TLS.DidResume)
+		} else {
+			require.False(t, conn2.ConnectionState().TLS.DidResume)
+			require.False(t, serverConn2.ConnectionState().TLS.DidResume)
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/rtt_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/rtt_test.go
new file mode 100644
index 000000000..f7190e44b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/rtt_test.go
@@ -0,0 +1,183 @@
+package self_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"math/rand/v2"
+	"net"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func runServerForRTTTest(t *testing.T, serverConn net.PacketConn) <-chan *quic.Conn {
+	t.Helper()
+
+	ln, err := quic.Listen(serverConn, getTLSConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	t.Cleanup(func() { ln.Close() })
+
+	connChan := make(chan *quic.Conn, 1)
+	go func() {
+		for {
+			conn, err := ln.Accept(context.Background())
+			if err != nil {
+				if !errors.Is(err, net.ErrClosed) {
+					t.Logf("accept error: %v", err)
+				}
+				return
+			}
+			connChan <- conn
+			str, err := conn.OpenStream()
+			if err != nil {
+				t.Logf("open stream error: %v", err)
+				return
+			}
+			if _, err := str.Write(PRData); err != nil {
+				t.Logf("write error: %v", err)
+				return
+			}
+			str.Close()
+		}
+	}()
+
+	return connChan
+}
+
+func TestDownloadWithFixedRTT(t *testing.T) {
+	for _, rtt := range []time.Duration{
+		10 * time.Millisecond,
+		100 * time.Millisecond,
+		500 * time.Millisecond,
+	} {
+		t.Run(rtt.String(), func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				clientConn, serverConn, closeFn := newSimnetLink(t, rtt)
+				defer closeFn(t)
+
+				sconnChan := runServerForRTTTest(t, serverConn)
+
+				ctx, cancel := context.WithTimeout(context.Background(), time.Hour)
+				defer cancel()
+				conn, err := quic.Dial(
+					ctx,
+					clientConn,
+					serverConn.LocalAddr(),
+					getTLSClientConfig(),
+					getQuicConfig(nil),
+				)
+				require.NoError(t, err)
+				defer conn.CloseWithError(0, "")
+
+				str, err := conn.AcceptStream(ctx)
+				require.NoError(t, err)
+				data, err := io.ReadAll(str)
+				require.NoError(t, err)
+				require.Equal(t, PRData, data)
+
+				sconn := <-sconnChan
+				defer sconn.CloseWithError(0, "")
+
+				checkRTTs := func(stats quic.ConnectionStats) {
+					t.Helper()
+					require.GreaterOrEqual(t, stats.SmoothedRTT, rtt)
+					require.GreaterOrEqual(t, stats.MinRTT, rtt)
+					require.LessOrEqual(t, stats.SmoothedRTT, rtt+time.Millisecond)
+					require.LessOrEqual(t, stats.MinRTT, rtt+time.Millisecond)
+				}
+				checkRTTs(conn.ConnectionStats())
+				checkRTTs(sconn.ConnectionStats())
+			})
+		})
+	}
+}
+
+func TestDownloadWithReordering(t *testing.T) {
+	for _, rtt := range []time.Duration{
+		5 * time.Millisecond,
+		50 * time.Millisecond,
+		250 * time.Millisecond,
+	} {
+		t.Run(rtt.String(), func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				counter, tracer := newPacketTracer()
+
+				n := &simnet.Simnet{Router: &simnet.PerfectRouter{}}
+				settings := simnet.NodeBiDiLinkSettings{
+					LatencyFunc: func(simnet.Packet) time.Duration {
+						min := rtt * 9 / 10
+						max := rtt * 11 / 10
+						return (min + time.Duration(rand.IntN(int(max-min)))) / 2
+					},
+				}
+				clientConn := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}, settings)
+				serverConn := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9002}, settings)
+				require.NoError(t, n.Start())
+				defer func() {
+					require.NoError(t, clientConn.Close())
+					require.NoError(t, serverConn.Close())
+					require.NoError(t, n.Close())
+				}()
+
+				sconnChan := runServerForRTTTest(t, serverConn)
+
+				ctx, cancel := context.WithTimeout(context.Background(), time.Hour)
+				defer cancel()
+				conn, err := quic.Dial(
+					ctx,
+					clientConn,
+					serverConn.LocalAddr(),
+					getTLSClientConfig(),
+					getQuicConfig(&quic.Config{
+						Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+					}),
+				)
+				require.NoError(t, err)
+				defer conn.CloseWithError(0, "")
+
+				str, err := conn.AcceptStream(ctx)
+				require.NoError(t, err)
+				data, err := io.ReadAll(str)
+				require.NoError(t, err)
+				require.Equal(t, PRData, data)
+
+				sconn := <-sconnChan
+				defer sconn.CloseWithError(0, "")
+
+				packets := counter.getRcvdShortHeaderPackets()
+				var packetNumbers []protocol.PacketNumber
+				for _, p := range packets {
+					packetNumbers = append(packetNumbers, p.hdr.PacketNumber)
+				}
+
+				// Count reorderings: a reordering occurs when we receive a packet
+				// with a number lower than the highest number we've seen so far
+				var reorderings int
+				var highestSeen protocol.PacketNumber
+				for _, pn := range packetNumbers {
+					if pn < highestSeen {
+						reorderings++
+					}
+					if pn > highestSeen {
+						highestSeen = pn
+					}
+				}
+
+				t.Logf("Smoothed RTT: %s", conn.ConnectionStats().SmoothedRTT)
+				assert.GreaterOrEqual(t, conn.ConnectionStats().SmoothedRTT, rtt*9/10)
+				assert.LessOrEqual(t, conn.ConnectionStats().SmoothedRTT, rtt*11/10)
+				t.Logf("received %d short header packets, detected %d reorderings", len(packetNumbers), reorderings)
+				assert.GreaterOrEqual(t, reorderings, 20, "expected at least 20 reorderings")
+			})
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_go124_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_go124_test.go
new file mode 100644
index 000000000..16146e757
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_go124_test.go
@@ -0,0 +1,9 @@
+//go:build !go1.25
+
+package self_test
+
+import "crypto/tls"
+
+func getCurveID(connState tls.ConnectionState) tls.CurveID {
+	return 0
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_go125_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_go125_test.go
new file mode 100644
index 000000000..3474e1552
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_go125_test.go
@@ -0,0 +1,9 @@
+//go:build go1.25
+
+package self_test
+
+import "crypto/tls"
+
+func getCurveID(connState tls.ConnectionState) tls.CurveID {
+	return connState.CurveID
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_suite_linux_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_suite_linux_test.go
new file mode 100644
index 000000000..df8b51969
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_suite_linux_test.go
@@ -0,0 +1,20 @@
+//go:build linux
+
+package self_test
+
+import (
+	"errors"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+// The first sendmsg call on a new UDP socket sometimes errors on Linux.
+// It's not clear why this happens.
+// See https://github.com/golang/go/issues/63322.
+func isPermissionError(err error) bool {
+	if serr, ok := errors.AsType[*os.SyscallError](err); ok {
+		return serr.Syscall == "sendmsg" && serr.Err == unix.EPERM
+	}
+	return false
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_suite_others_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_suite_others_test.go
new file mode 100644
index 000000000..c0080d358
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_suite_others_test.go
@@ -0,0 +1,7 @@
+//go:build !linux
+
+package self_test
+
+func isPermissionError(err error) bool {
+	return false
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_test.go
new file mode 100644
index 000000000..3653a02a4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/self_test.go
@@ -0,0 +1,352 @@
+package self_test
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"flag"
+	"fmt"
+	"io"
+	"math/rand/v2"
+	"net"
+	"os"
+	"runtime"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/integrationtests/tools"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+)
+
+const alpn = tools.ALPN
+
+const (
+	dataLen     = 500 * 1024       // 500 KB
+	dataLenLong = 50 * 1024 * 1024 // 50 MB
+)
+
+var (
+	// PRData contains dataLen bytes of pseudo-random data.
+	PRData = GeneratePRData(dataLen)
+	// PRDataLong contains dataLenLong bytes of pseudo-random data.
+	PRDataLong = GeneratePRData(dataLenLong)
+)
+
+// See https://en.wikipedia.org/wiki/Lehmer_random_number_generator
+func GeneratePRData(l int) []byte {
+	res := make([]byte, l)
+	seed := uint64(1)
+	for i := range l {
+		seed = seed * 48271 % 2147483647
+		res[i] = byte(seed)
+	}
+	return res
+}
+
+var (
+	version    quic.Version
+	enableQlog bool
+
+	tlsConfig                        *tls.Config
+	tlsConfigLongChain               *tls.Config
+	tlsClientConfig                  *tls.Config
+	tlsClientConfigWithoutServerName *tls.Config
+)
+
+func init() {
+	ca, caPrivateKey, err := tools.GenerateCA()
+	if err != nil {
+		panic(err)
+	}
+	leafCert, leafPrivateKey, err := tools.GenerateLeafCert(ca, caPrivateKey)
+	if err != nil {
+		panic(err)
+	}
+	tlsConfig = &tls.Config{
+		Certificates: []tls.Certificate{{
+			Certificate: [][]byte{leafCert.Raw},
+			PrivateKey:  leafPrivateKey,
+		}},
+		NextProtos: []string{alpn},
+	}
+	tlsConfLongChain, err := tools.GenerateTLSConfigWithLongCertChain(ca, caPrivateKey)
+	if err != nil {
+		panic(err)
+	}
+	tlsConfigLongChain = tlsConfLongChain
+
+	root := x509.NewCertPool()
+	root.AddCert(ca)
+	tlsClientConfig = &tls.Config{
+		ServerName: "localhost",
+		RootCAs:    root,
+		NextProtos: []string{alpn},
+	}
+	tlsClientConfigWithoutServerName = &tls.Config{
+		RootCAs:    root,
+		NextProtos: []string{alpn},
+	}
+}
+
+func getTLSConfig() *tls.Config                  { return tlsConfig.Clone() }
+func getTLSConfigWithLongCertChain() *tls.Config { return tlsConfigLongChain.Clone() }
+func getTLSClientConfig() *tls.Config            { return tlsClientConfig.Clone() }
+func getTLSClientConfigWithoutServerName() *tls.Config {
+	return tlsClientConfigWithoutServerName.Clone()
+}
+
+type multiplexedRecorder struct {
+	Recorders []qlogwriter.Recorder
+}
+
+var _ qlogwriter.Recorder = &multiplexedRecorder{}
+
+func (r *multiplexedRecorder) Close() error {
+	for _, recorder := range r.Recorders {
+		recorder.Close()
+	}
+	return nil
+}
+
+func (r *multiplexedRecorder) RecordEvent(ev qlogwriter.Event) {
+	for _, recorder := range r.Recorders {
+		recorder.RecordEvent(ev)
+	}
+}
+
+type multiplexedTrace struct {
+	Traces []qlogwriter.Trace
+}
+
+var _ qlogwriter.Trace = &multiplexedTrace{}
+
+func (t *multiplexedTrace) AddProducer() qlogwriter.Recorder {
+	recorders := make([]qlogwriter.Recorder, 0, len(t.Traces))
+	for _, tr := range t.Traces {
+		recorders = append(recorders, tr.AddProducer())
+	}
+	return &multiplexedRecorder{Recorders: recorders}
+}
+
+func (t *multiplexedTrace) SupportsSchemas(schema string) bool {
+	return true
+}
+
+func getQuicConfig(conf *quic.Config) *quic.Config {
+	if conf == nil {
+		conf = &quic.Config{}
+	} else {
+		conf = conf.Clone()
+	}
+	if !enableQlog {
+		return conf
+	}
+	if conf.Tracer == nil {
+		conf.Tracer = func(ctx context.Context, isClient bool, connID quic.ConnectionID) qlogwriter.Trace {
+			return tools.NewQlogConnectionTracer(os.Stdout)(ctx, isClient, connID)
+		}
+		return conf
+	}
+	origTracer := conf.Tracer
+	conf.Tracer = func(ctx context.Context, isClient bool, connID quic.ConnectionID) qlogwriter.Trace {
+		tr := origTracer(ctx, isClient, connID)
+		qlogger := tools.NewQlogConnectionTracer(os.Stdout)(ctx, isClient, connID)
+		if tr == nil {
+			return qlogger
+		}
+		return &multiplexedTrace{Traces: []qlogwriter.Trace{tr, qlogger}}
+	}
+	return conf
+}
+
+func addTracer(tr *quic.Transport) {
+	if !enableQlog {
+		return
+	}
+	if tr.Tracer == nil {
+		tr.Tracer = tools.QlogTracer(os.Stdout).AddProducer()
+		return
+	}
+	origTracer := tr.Tracer
+	tr.Tracer = &multiplexedRecorder{
+		Recorders: []qlogwriter.Recorder{origTracer, tools.QlogTracer(os.Stdout).AddProducer()},
+	}
+}
+
+func newUDPConnLocalhost(t testing.TB) *net.UDPConn {
+	t.Helper()
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.Close() })
+	return conn
+}
+
+func TestMain(m *testing.M) {
+	var versionParam string
+	flag.StringVar(&versionParam, "version", "1", "QUIC version")
+	flag.BoolVar(&enableQlog, "qlog", false, "enable qlog")
+	flag.Parse()
+
+	switch versionParam {
+	case "1":
+		version = quic.Version1
+	case "2":
+		version = quic.Version2
+	default:
+		fmt.Printf("unknown QUIC version: %s\n", versionParam)
+		os.Exit(1)
+	}
+	fmt.Printf("using QUIC version: %s\n", version)
+
+	os.Exit(m.Run())
+}
+
+func scaleDuration(d time.Duration) time.Duration {
+	scaleFactor := 1
+	if f, err := strconv.Atoi(os.Getenv("TIMESCALE_FACTOR")); err == nil { // parsing "" errors, so this works fine if the env is not set
+		scaleFactor = f
+	}
+	if scaleFactor == 0 {
+		panic("TIMESCALE_FACTOR is 0")
+	}
+	return time.Duration(scaleFactor) * d
+}
+
+func newTracer(tracer qlogwriter.Recorder) func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+	return func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+		return &events.Trace{Recorder: tracer}
+	}
+}
+
+type packet struct {
+	time   time.Time
+	hdr    qlog.PacketHeader
+	frames []qlog.Frame
+}
+
+type packetCounter struct {
+	recorder *events.Recorder
+}
+
+func (t *packetCounter) getSentShortHeaderPackets() []packet {
+	var sentShortHdr []packet
+	for _, ev := range t.recorder.EventsWithTime(qlog.PacketSent{}) {
+		e := ev.Event.(qlog.PacketSent)
+		if e.Header.PacketType != qlog.PacketType1RTT {
+			continue
+		}
+		sentShortHdr = append(sentShortHdr, packet{time: ev.Time, hdr: e.Header, frames: e.Frames})
+	}
+	return sentShortHdr
+}
+
+func (t *packetCounter) getRcvdLongHeaderPackets() []packet {
+	var rcvdLongHdr []packet
+	for _, ev := range t.recorder.EventsWithTime(qlog.PacketReceived{}) {
+		e := ev.Event.(qlog.PacketReceived)
+		if e.Header.PacketType == qlog.PacketType1RTT {
+			continue
+		}
+		rcvdLongHdr = append(rcvdLongHdr, packet{time: ev.Time, hdr: e.Header, frames: e.Frames})
+	}
+	return rcvdLongHdr
+}
+
+func (t *packetCounter) getRcvd0RTTPacketNumbers() []protocol.PacketNumber {
+	var zeroRTTPackets []protocol.PacketNumber
+	for _, p := range t.getRcvdLongHeaderPackets() {
+		if p.hdr.PacketType == qlog.PacketType0RTT {
+			zeroRTTPackets = append(zeroRTTPackets, p.hdr.PacketNumber)
+		}
+	}
+	return zeroRTTPackets
+}
+
+func (t *packetCounter) getRcvdShortHeaderPackets() []packet {
+	var rcvdShortHdr []packet
+	for _, ev := range t.recorder.EventsWithTime(qlog.PacketReceived{}) {
+		e := ev.Event.(qlog.PacketReceived)
+		if e.Header.PacketType != qlog.PacketType1RTT {
+			continue
+		}
+		rcvdShortHdr = append(rcvdShortHdr, packet{time: ev.Time, hdr: e.Header, frames: e.Frames})
+	}
+	return rcvdShortHdr
+}
+
+func newPacketTracer() (*packetCounter, qlogwriter.Trace) {
+	c := &packetCounter{recorder: &events.Recorder{}}
+	return c, &events.Trace{Recorder: c.recorder}
+}
+
+type readerWithTimeout struct {
+	io.Reader
+	Timeout time.Duration
+}
+
+func (r *readerWithTimeout) Read(p []byte) (n int, err error) {
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		n, err = r.Reader.Read(p)
+	}()
+
+	select {
+	case <-done:
+		return n, err
+	case <-time.After(r.Timeout):
+		return 0, fmt.Errorf("read timeout after %s", r.Timeout)
+	}
+}
+
+func randomDuration(min, max time.Duration) time.Duration {
+	return min + time.Duration(rand.IntN(int(max-min)))
+}
+
+// containsPacketType checks if a packet contains a long header packet of the specified type.
+// It correctly handles coalesced packets.
+func containsPacketType(data []byte, packetType protocol.PacketType) bool {
+	for len(data) > 0 {
+		if !wire.IsLongHeaderPacket(data[0]) {
+			return false
+		}
+		hdr, _, rest, err := wire.ParsePacket(data)
+		if err != nil {
+			return false
+		}
+		if hdr.Type == packetType {
+			return true
+		}
+		data = rest
+	}
+	return false
+}
+
+// addDialCallback explicitly adds the http3.Transport's Dial callback.
+// This is needed since dialing on dual-stack sockets is flaky on macOS,
+// see https://github.com/golang/go/issues/67226.
+func addDialCallback(t *testing.T, tr *http3.Transport) {
+	t.Helper()
+
+	if runtime.GOOS != "darwin" {
+		return
+	}
+
+	require.Nil(t, tr.Dial)
+	tr.Dial = func(ctx context.Context, addr string, tlsConf *tls.Config, conf *quic.Config) (*quic.Conn, error) {
+		a, err := net.ResolveUDPAddr("udp", addr)
+		if err != nil {
+			return nil, err
+		}
+		return quic.DialEarly(ctx, newUDPConnLocalhost(t), a, tlsConf, conf)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/simnet_helper_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/simnet_helper_test.go
new file mode 100644
index 000000000..181c4d657
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/simnet_helper_test.go
@@ -0,0 +1,105 @@
+package self_test
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/require"
+)
+
+func newSimnetLink(t *testing.T, rtt time.Duration) (client, server *simnet.SimConn, close func(t *testing.T)) {
+	t.Helper()
+
+	return newSimnetLinkWithRouter(t, rtt, &simnet.PerfectRouter{})
+}
+
+func newSimnetLinkWithRouter(t *testing.T, rtt time.Duration, router simnet.Router) (client, server *simnet.SimConn, close func(t *testing.T)) {
+	t.Helper()
+
+	n := &simnet.Simnet{Router: router}
+	settings := simnet.NodeBiDiLinkSettings{Latency: rtt / 2}
+	clientPacketConn := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}, settings)
+	serverPacketConn := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9002}, settings)
+
+	require.NoError(t, n.Start())
+
+	return clientPacketConn, serverPacketConn, func(t *testing.T) {
+		require.NoError(t, clientPacketConn.Close())
+		require.NoError(t, serverPacketConn.Close())
+		require.NoError(t, n.Close())
+	}
+}
+
+type droppingRouter struct {
+	simnet.PerfectRouter
+
+	Drop func(simnet.Packet) bool
+}
+
+func (d *droppingRouter) SendPacket(p simnet.Packet) error {
+	if d.Drop(p) {
+		return nil
+	}
+	return d.PerfectRouter.SendPacket(p)
+}
+
+type callbackRouter struct {
+	simnet.Router
+
+	OnSendPacket func(simnet.Packet)
+}
+
+func (c *callbackRouter) SendPacket(p simnet.Packet) error {
+	c.OnSendPacket(p)
+	return c.Router.SendPacket(p)
+}
+
+type direction uint8
+
+const (
+	directionUnknown = iota
+	directionToClient
+	directionToServer
+	directionBoth
+)
+
+func (d direction) String() string {
+	switch d {
+	case directionToClient:
+		return "to client"
+	case directionToServer:
+		return "to server"
+	case directionBoth:
+		return "both"
+	}
+	return "unknown"
+}
+
+var _ simnet.Router = &droppingRouter{}
+
+type directionAwareDroppingRouter struct {
+	simnet.PerfectRouter
+
+	ClientAddr, ServerAddr *net.UDPAddr
+
+	Drop func(direction direction, p simnet.Packet) bool
+}
+
+func (d *directionAwareDroppingRouter) SendPacket(p simnet.Packet) error {
+	var dir direction
+	switch p.To.String() {
+	case d.ClientAddr.String():
+		dir = directionToClient
+	case d.ServerAddr.String():
+		dir = directionToServer
+	default:
+		dir = directionUnknown
+	}
+	if d.Drop(dir, p) {
+		return nil
+	}
+	return d.PerfectRouter.SendPacket(p)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/stateless_reset_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/stateless_reset_test.go
new file mode 100644
index 000000000..f87d31e02
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/stateless_reset_test.go
@@ -0,0 +1,127 @@
+package self_test
+
+import (
+	"context"
+	"crypto/rand"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestStatelessResets(t *testing.T) {
+	t.Run("zero-length connection IDs", func(t *testing.T) {
+		testStatelessReset(t, 0)
+	})
+	t.Run("10 byte connection IDs", func(t *testing.T) {
+		testStatelessReset(t, 10)
+	})
+}
+
+func testStatelessReset(t *testing.T, connIDLen int) {
+	synctest.Test(t, func(t *testing.T) {
+		var drop atomic.Bool
+		clientPacketConn, serverPacketConn, closeFn := newSimnetLinkWithRouter(t,
+			time.Millisecond,
+			&droppingRouter{Drop: func(p simnet.Packet) bool { return drop.Load() }},
+		)
+		defer closeFn(t)
+
+		var statelessResetKey quic.StatelessResetKey
+		rand.Read(statelessResetKey[:])
+
+		tr := &quic.Transport{
+			Conn:              serverPacketConn,
+			StatelessResetKey: &statelessResetKey,
+		}
+		defer tr.Close()
+
+		ln, err := tr.Listen(getTLSConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+
+		serverErr := make(chan error, 1)
+		go func() {
+			conn, err := ln.Accept(context.Background())
+			if err != nil {
+				serverErr <- err
+				return
+			}
+			str, err := conn.OpenStream()
+			if err != nil {
+				serverErr <- err
+				return
+			}
+			_, err = str.Write([]byte("foobar"))
+			if err != nil {
+				serverErr <- err
+				return
+			}
+			close(serverErr)
+		}()
+
+		var conn *quic.Conn
+		if connIDLen > 0 {
+			cl := &quic.Transport{
+				Conn:               clientPacketConn,
+				ConnectionIDLength: connIDLen,
+			}
+			defer cl.Close()
+			var err error
+			conn, err = cl.Dial(
+				context.Background(),
+				serverPacketConn.LocalAddr(),
+				getTLSClientConfig(),
+				getQuicConfig(&quic.Config{MaxIdleTimeout: 2 * time.Second}),
+			)
+			require.NoError(t, err)
+		} else {
+			conn, err = quic.Dial(
+				context.Background(),
+				clientPacketConn,
+				serverPacketConn.LocalAddr(),
+				getTLSClientConfig(),
+				getQuicConfig(&quic.Config{MaxIdleTimeout: 2 * time.Second}),
+			)
+			require.NoError(t, err)
+		}
+		str, err := conn.AcceptStream(context.Background())
+		require.NoError(t, err)
+		data := make([]byte, 6)
+		_, err = str.Read(data)
+		require.NoError(t, err)
+		require.Equal(t, []byte("foobar"), data)
+
+		// make sure that the CONNECTION_CLOSE is dropped
+		drop.Store(true)
+		require.NoError(t, ln.Close())
+		require.NoError(t, tr.Close())
+		require.NoError(t, <-serverErr)
+		time.Sleep(100 * time.Millisecond)
+
+		// We need to create a new Transport here, since the old one is still sending out
+		// CONNECTION_CLOSE packets for (recently) closed connections).
+		tr2 := &quic.Transport{
+			Conn:              serverPacketConn,
+			StatelessResetKey: &statelessResetKey,
+		}
+		defer tr2.Close()
+		ln2, err := tr2.Listen(getTLSConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+		drop.Store(false)
+
+		// Trigger something (not too small) to be sent, so that we receive the stateless reset.
+		// If the client already sent another packet, it might already have received a packet.
+		_, serr := str.Write([]byte("Lorem ipsum dolor sit amet."))
+		if serr == nil {
+			_, serr = str.Read([]byte{0})
+		}
+		require.Error(t, serr)
+		require.IsType(t, &quic.StatelessResetError{}, serr)
+		require.NoError(t, ln2.Close())
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/stream_priority_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/stream_priority_test.go
new file mode 100644
index 000000000..af013f1e1
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/stream_priority_test.go
@@ -0,0 +1,155 @@
+package self_test
+
+import (
+	"io"
+	"net"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/require"
+)
+
+func newStreamPriorityTestConnections(t *testing.T) (client, server *quic.Conn) {
+	t.Helper()
+
+	const (
+		rtt               = 10 * time.Millisecond
+		bandwidthBytesSec = 1 << 20
+	)
+	n := &simnet.Simnet{Router: &simnet.PerfectRouter{}}
+	linkSettings := func() simnet.NodeBiDiLinkSettings {
+		var nextTransmission time.Time
+		return simnet.NodeBiDiLinkSettings{
+			LatencyFunc: func(p simnet.Packet) time.Duration {
+				now := time.Now()
+				if nextTransmission.Before(now) {
+					nextTransmission = now
+				}
+				nextTransmission = nextTransmission.Add(time.Duration(len(p.Data)) * time.Second / bandwidthBytesSec)
+				return nextTransmission.Add(rtt / 2).Sub(now)
+			},
+		}
+	}
+	clientPacketConn := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}, linkSettings())
+	serverPacketConn := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9002}, linkSettings())
+	require.NoError(t, n.Start())
+	t.Cleanup(func() {
+		require.NoError(t, clientPacketConn.Close())
+		require.NoError(t, serverPacketConn.Close())
+		require.NoError(t, n.Close())
+	})
+
+	serverConfig := getQuicConfig(&quic.Config{
+		InitialStreamReceiveWindow:     uint64(len(PRData)),
+		InitialConnectionReceiveWindow: uint64(len(PRData)),
+		DisablePathMTUDiscovery:        true,
+	})
+	listener, err := quic.Listen(
+		serverPacketConn,
+		getTLSConfig(),
+		serverConfig,
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { listener.Close() })
+
+	client, err = quic.Dial(
+		t.Context(),
+		clientPacketConn,
+		serverPacketConn.LocalAddr(),
+		getTLSClientConfig(),
+		getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true}),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { client.CloseWithError(0, "") })
+	server, err = listener.Accept(t.Context())
+	require.NoError(t, err)
+	t.Cleanup(func() { server.CloseWithError(0, "") })
+	return client, server
+}
+
+type streamPriorityTestCase struct {
+	name        string
+	incremental bool
+	urgencies   [4]int8
+	sizes       [4]int
+	order       [4]int
+}
+
+var streamPriorityTests = [...]streamPriorityTestCase{
+	{
+		name:        "incremental streams use urgency and round robin",
+		incremental: true,
+		urgencies:   [4]int8{0, 0, 1, 1},
+		sizes:       [4]int{len(PRData) / 2, len(PRData) / 4, len(PRData) / 8, len(PRData) / 16},
+		// Round robin makes the smaller stream at each urgency finish first,
+		// while both urgency 0 streams finish before either urgency 1 stream.
+		order: [4]int{1, 0, 3, 2},
+	},
+	{
+		name:        "non-incremental streams use stream ID",
+		incremental: false,
+		urgencies:   [4]int8{3, 3, 3, 3},
+		sizes:       [4]int{len(PRData) / 2, len(PRData) / 4, len(PRData) / 8, len(PRData) / 16},
+		order:       [4]int{0, 1, 2, 3},
+	},
+}
+
+func TestStreamPriority(t *testing.T) {
+	for _, test := range streamPriorityTests {
+		t.Run(test.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				client, server := newStreamPriorityTestConnections(t)
+
+				var streams [4]*quic.SendStream
+				for i := range streams {
+					str, err := client.OpenUniStreamSync(t.Context())
+					require.NoError(t, err)
+					str.SetPriority(test.urgencies[i], test.incremental)
+					_, err = str.Write([]byte{0}) // make the stream visible to the peer
+					require.NoError(t, err)
+					streams[i] = str
+				}
+
+				type readResult struct {
+					id  quic.StreamID
+					n   int64
+					err error
+				}
+				completed := make(chan readResult, len(streams))
+				for range streams {
+					str, err := server.AcceptUniStream(t.Context())
+					require.NoError(t, err)
+					go func() {
+						n, err := io.Copy(io.Discard, str)
+						completed <- readResult{id: str.StreamID(), n: n, err: err}
+					}()
+				}
+
+				writeErrs := make(chan error, len(streams))
+				for i, str := range streams {
+					go func() {
+						_, err := str.Write(PRData[:test.sizes[i]])
+						if err == nil {
+							err = str.Close()
+						}
+						writeErrs <- err
+					}()
+				}
+
+				for _, i := range test.order {
+					result := <-completed
+					require.NoError(t, result.err)
+					require.Equal(t, streams[i].StreamID(), result.id)
+					require.EqualValues(t, test.sizes[i]+1, result.n)
+				}
+				for range streams {
+					require.NoError(t, <-writeErrs)
+				}
+			})
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/stream_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/stream_test.go
new file mode 100644
index 000000000..4bf877735
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/stream_test.go
@@ -0,0 +1,375 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"golang.org/x/sync/errgroup"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWriteWithLimitStreamFlowControl(t *testing.T) {
+	testWriteWithLimitFlowControl(t, &quic.Config{
+		InitialStreamReceiveWindow:     100,
+		InitialConnectionReceiveWindow: quicvarint.Max,
+	})
+}
+
+func TestWriteWithLimitConnectionFlowControl(t *testing.T) {
+	testWriteWithLimitFlowControl(t, &quic.Config{
+		InitialStreamReceiveWindow:     quicvarint.Max,
+		InitialConnectionReceiveWindow: 100,
+	})
+}
+
+func testWriteWithLimitFlowControl(t *testing.T, config *quic.Config) {
+	ln, err := quic.Listen(newUDPConnLocalhost(t), getTLSConfig(), getQuicConfig(config))
+	require.NoError(t, err)
+	defer ln.Close()
+
+	deadline := time.Now().Add(time.Second)
+	ctx, cancel := context.WithDeadline(context.Background(), deadline)
+	defer cancel()
+	client, err := quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+	require.NoError(t, err)
+	defer client.CloseWithError(0, "")
+
+	server, err := ln.Accept(ctx)
+	require.NoError(t, err)
+	str, err := client.OpenUniStreamSync(ctx)
+	require.NoError(t, err)
+	require.NoError(t, str.SetWriteDeadline(deadline))
+
+	data := GeneratePRData(101)
+	n, err := str.WriteWithLimit(data, func(maxBytes int) int {
+		return min(maxBytes, 25)
+	})
+	require.Equal(t, 25, n)
+	require.ErrorIs(t, err, quic.ErrWriteLimitReached)
+
+	receiveStr, err := server.AcceptUniStream(ctx)
+	require.NoError(t, err)
+	require.NoError(t, receiveStr.SetReadDeadline(deadline))
+	received := make([]byte, n)
+	_, err = io.ReadFull(receiveStr, received)
+	require.NoError(t, err)
+	require.Equal(t, data[:n], received)
+
+	written, err := str.WriteWithLimit(data[n:], func(maxBytes int) int { return maxBytes })
+	require.Equal(t, len(data)-n, written)
+	require.NoError(t, err)
+
+	require.NoError(t, str.Close())
+	rest, err := io.ReadAll(receiveStr)
+	require.NoError(t, err)
+	require.Equal(t, data, append(received, rest...))
+}
+
+func TestBidirectionalStreamMultiplexing(t *testing.T) {
+	const numStreams = 75
+
+	runSendingPeer := func(conn *quic.Conn) error {
+		g := new(errgroup.Group)
+		for i := range numStreams {
+			str, err := conn.OpenStreamSync(context.Background())
+			if err != nil {
+				return err
+			}
+			data := GeneratePRData(50 * i)
+			g.Go(func() error {
+				if _, err := str.Write(data); err != nil {
+					return err
+				}
+				return str.Close()
+			})
+			g.Go(func() error {
+				dataRead, err := io.ReadAll(str)
+				if err != nil {
+					return err
+				}
+				if !bytes.Equal(dataRead, data) {
+					return fmt.Errorf("data mismatch: %q != %q", dataRead, data)
+				}
+				return nil
+			})
+		}
+		return g.Wait()
+	}
+
+	runReceivingPeer := func(conn *quic.Conn) error {
+		g := new(errgroup.Group)
+		for range numStreams {
+			str, err := conn.AcceptStream(context.Background())
+			if err != nil {
+				return err
+			}
+			g.Go(func() error {
+				// shouldn't use io.Copy here
+				// we should read from the stream as early as possible, to free flow control credit
+				data, err := io.ReadAll(str)
+				if err != nil {
+					return err
+				}
+				if _, err := str.Write(data); err != nil {
+					return err
+				}
+				return str.Close()
+			})
+		}
+		return g.Wait()
+	}
+
+	t.Run("client -> server", func(t *testing.T) {
+		ln, err := quic.Listen(
+			newUDPConnLocalhost(t),
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{
+				MaxIncomingStreams:             10,
+				InitialStreamReceiveWindow:     10000,
+				InitialConnectionReceiveWindow: 5000,
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		client, err := quic.Dial(
+			ctx,
+			newUDPConnLocalhost(t),
+			ln.Addr(),
+			getTLSClientConfig(),
+			getQuicConfig(&quic.Config{InitialConnectionReceiveWindow: 2000}),
+		)
+		require.NoError(t, err)
+
+		conn, err := ln.Accept(ctx)
+		require.NoError(t, err)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- runReceivingPeer(conn) }()
+		require.NoError(t, runSendingPeer(client))
+		client.CloseWithError(0, "")
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			require.Fail(t, "timeout")
+		}
+		select {
+		case <-conn.Context().Done():
+		case <-time.After(time.Second):
+			require.Fail(t, "timeout")
+		}
+	})
+
+	t.Run("client <-> server", func(t *testing.T) {
+		ln, err := quic.Listen(
+			newUDPConnLocalhost(t),
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{
+				MaxIncomingStreams:             30,
+				InitialStreamReceiveWindow:     25000,
+				InitialConnectionReceiveWindow: 50000,
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		client, err := quic.Dial(
+			ctx,
+			newUDPConnLocalhost(t),
+			ln.Addr(),
+			getTLSClientConfig(),
+			getQuicConfig(&quic.Config{InitialConnectionReceiveWindow: 2000}),
+		)
+		require.NoError(t, err)
+
+		conn, err := ln.Accept(ctx)
+		require.NoError(t, err)
+
+		errChan1 := make(chan error, 1)
+		errChan2 := make(chan error, 1)
+		errChan3 := make(chan error, 1)
+		errChan4 := make(chan error, 1)
+
+		go func() { errChan1 <- runReceivingPeer(conn) }()
+		go func() { errChan2 <- runSendingPeer(conn) }()
+		go func() { errChan3 <- runReceivingPeer(client) }()
+		go func() { errChan4 <- runSendingPeer(client) }()
+
+		for _, ch := range []chan error{errChan1, errChan2, errChan3, errChan4} {
+			select {
+			case err := <-ch:
+				require.NoError(t, err)
+			case <-time.After(time.Second):
+				require.Fail(t, "timeout")
+			}
+		}
+
+		client.CloseWithError(0, "")
+		select {
+		case <-conn.Context().Done():
+		case <-time.After(time.Second):
+			require.Fail(t, "timeout")
+		}
+	})
+}
+
+func TestUnidirectionalStreams(t *testing.T) {
+	const numStreams = 500
+
+	dataForStream := func(id uint64) []byte { return GeneratePRData(10 * int(id)) }
+
+	runSendingPeer := func(conn *quic.Conn) error {
+		g := new(errgroup.Group)
+		for range numStreams {
+			str, err := conn.OpenUniStreamSync(context.Background())
+			if err != nil {
+				return err
+			}
+			g.Go(func() error {
+				if _, err := str.Write(dataForStream(uint64(str.StreamID()))); err != nil {
+					return err
+				}
+				return str.Close()
+			})
+		}
+		return g.Wait()
+	}
+
+	runReceivingPeer := func(conn *quic.Conn) error {
+		g := new(errgroup.Group)
+		for range numStreams {
+			str, err := conn.AcceptUniStream(context.Background())
+			if err != nil {
+				return err
+			}
+			g.Go(func() error {
+				data, err := io.ReadAll(str)
+				if err != nil {
+					return err
+				}
+				if !bytes.Equal(data, dataForStream(uint64(str.StreamID()))) {
+					return fmt.Errorf("data mismatch")
+				}
+				return nil
+			})
+		}
+		return g.Wait()
+	}
+
+	t.Run("client -> server", func(t *testing.T) {
+		ln, err := quic.Listen(
+			newUDPConnLocalhost(t),
+			getTLSConfig(),
+			getQuicConfig(nil),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		client, err := quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+
+		serverConn, err := ln.Accept(ctx)
+		require.NoError(t, err)
+		errChan := make(chan error, 1)
+		go func() { errChan <- runSendingPeer(client) }()
+		require.NoError(t, runReceivingPeer(serverConn))
+		serverConn.CloseWithError(0, "")
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			require.Fail(t, "timeout")
+		}
+	})
+
+	t.Run("server -> client", func(t *testing.T) {
+		ln, err := quic.Listen(
+			newUDPConnLocalhost(t),
+			getTLSConfig(),
+			getQuicConfig(nil),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		client, err := quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+
+		serverConn, err := ln.Accept(ctx)
+		require.NoError(t, err)
+		errChan := make(chan error, 1)
+		go func() { errChan <- runSendingPeer(serverConn) }()
+
+		require.NoError(t, runReceivingPeer(client))
+		client.CloseWithError(0, "")
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			require.Fail(t, "timeout")
+		}
+	})
+
+	t.Run("client <-> server", func(t *testing.T) {
+		ln, err := quic.Listen(
+			newUDPConnLocalhost(t),
+			getTLSConfig(),
+			getQuicConfig(nil),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		errChan1 := make(chan error, 1)
+		errChan2 := make(chan error, 1)
+		go func() {
+			conn, err := ln.Accept(context.Background())
+			if err != nil {
+				errChan1 <- err
+				errChan2 <- err
+				return
+			}
+			errChan1 <- runReceivingPeer(conn)
+			errChan2 <- runSendingPeer(conn)
+		}()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		client, err := quic.Dial(ctx, newUDPConnLocalhost(t), ln.Addr(), getTLSClientConfig(), getQuicConfig(nil))
+		require.NoError(t, err)
+
+		errChan3 := make(chan error, 1)
+		go func() {
+			errChan3 <- runSendingPeer(client)
+		}()
+		require.NoError(t, runReceivingPeer(client))
+
+		for _, ch := range []chan error{errChan1, errChan2, errChan3} {
+			select {
+			case err := <-ch:
+				require.NoError(t, err)
+			case <-time.After(time.Second):
+				require.Fail(t, "timeout")
+			}
+		}
+		client.CloseWithError(0, "")
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/timeout_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/timeout_test.go
new file mode 100644
index 000000000..143df4653
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/timeout_test.go
@@ -0,0 +1,504 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	mrand "math/rand/v2"
+	"net"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/require"
+)
+
+func requireIdleTimeoutError(t *testing.T, err error) {
+	t.Helper()
+
+	require.Error(t, err)
+	var idleTimeoutErr *quic.IdleTimeoutError
+	require.ErrorAs(t, err, &idleTimeoutErr)
+	require.True(t, idleTimeoutErr.Timeout())
+	nerr, ok := errors.AsType[net.Error](err)
+	require.True(t, ok)
+	require.True(t, nerr.Timeout())
+}
+
+func TestHandshakeIdleTimeout(t *testing.T) {
+	t.Run("Dial", func(t *testing.T) {
+		testHandshakeIdleTimeout(t, quic.Dial)
+	})
+
+	t.Run("DialEarly", func(t *testing.T) {
+		testHandshakeIdleTimeout(t, quic.DialEarly)
+	})
+}
+
+func testHandshakeIdleTimeout(t *testing.T, dialFn func(context.Context, net.PacketConn, net.Addr, *tls.Config, *quic.Config) (*quic.Conn, error)) {
+	synctest.Test(t, func(t *testing.T) {
+		const handshakeIdleTimeout = 3 * time.Second
+
+		clientPacketConn, serverPacketConn, closeFn := newSimnetLink(t, time.Millisecond)
+		defer closeFn(t)
+
+		errChan := make(chan error, 1)
+		start := time.Now()
+		go func() {
+			_, err := dialFn(
+				context.Background(),
+				clientPacketConn,
+				serverPacketConn.LocalAddr(),
+				getTLSClientConfig(),
+				getQuicConfig(&quic.Config{HandshakeIdleTimeout: handshakeIdleTimeout}),
+			)
+			errChan <- err
+		}()
+		select {
+		case err := <-errChan:
+			requireIdleTimeoutError(t, err)
+			require.Equal(t, handshakeIdleTimeout, time.Since(start))
+		case <-time.After(5 * time.Second):
+			t.Fatal("timeout waiting for dial error")
+		}
+	})
+}
+
+func TestIdleTimeout(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const idleTimeout = 20 * time.Second
+
+		var drop atomic.Bool
+		clientPacketConn, serverPacketConn, closeFn := newSimnetLinkWithRouter(t,
+			time.Millisecond,
+			&droppingRouter{Drop: func(p simnet.Packet) bool { return drop.Load() }},
+		)
+		defer closeFn(t)
+
+		server, err := quic.Listen(
+			serverPacketConn,
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true}),
+		)
+		require.NoError(t, err)
+		defer server.Close()
+
+		conn, err := quic.Dial(
+			context.Background(),
+			clientPacketConn,
+			serverPacketConn.LocalAddr(),
+			getTLSClientConfig(),
+			getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true, MaxIdleTimeout: idleTimeout}),
+		)
+		require.NoError(t, err)
+
+		serverConn, err := server.Accept(context.Background())
+		require.NoError(t, err)
+		str, err := serverConn.OpenStream()
+		require.NoError(t, err)
+		_, err = str.Write([]byte("foobar"))
+		require.NoError(t, err)
+
+		serverStart := time.Now()
+
+		strIn, err := conn.AcceptStream(context.Background())
+		require.NoError(t, err)
+		strOut, err := conn.OpenStream()
+		require.NoError(t, err)
+		_, err = strIn.Read(make([]byte, 6))
+		require.NoError(t, err)
+
+		clientStart := time.Now()
+
+		drop.Store(true)
+
+		select {
+		case <-serverConn.Context().Done():
+			took := time.Since(serverStart)
+			require.GreaterOrEqual(t, took, idleTimeout)
+			t.Logf("server connection timed out after %s (idle timeout: %s)", took, idleTimeout)
+		case <-time.After(2 * idleTimeout):
+			t.Fatal("timeout waiting for idle timeout")
+		}
+
+		select {
+		case <-conn.Context().Done():
+			took := time.Since(clientStart)
+			require.GreaterOrEqual(t, took, idleTimeout)
+			t.Logf("client connection timed out after %s (idle timeout: %s)", took, idleTimeout)
+		case <-time.After(2 * idleTimeout):
+			t.Fatal("timeout waiting for idle timeout")
+		}
+
+		_, err = strIn.Write([]byte("test"))
+		requireIdleTimeoutError(t, err)
+		_, err = strIn.Read([]byte{0})
+		requireIdleTimeoutError(t, err)
+		_, err = strOut.Write([]byte("test"))
+		requireIdleTimeoutError(t, err)
+		_, err = strOut.Read([]byte{0})
+		requireIdleTimeoutError(t, err)
+		_, err = conn.OpenStream()
+		requireIdleTimeoutError(t, err)
+		_, err = conn.OpenUniStream()
+		requireIdleTimeoutError(t, err)
+		_, err = conn.AcceptStream(context.Background())
+		requireIdleTimeoutError(t, err)
+		_, err = conn.AcceptUniStream(context.Background())
+		requireIdleTimeoutError(t, err)
+	})
+}
+
+func TestKeepAlive(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const idleTimeout = 4 * time.Second
+
+		var drop atomic.Bool
+		clientPacketConn, serverPacketConn, closeFn := newSimnetLinkWithRouter(t,
+			time.Millisecond,
+			&droppingRouter{Drop: func(p simnet.Packet) bool { return drop.Load() }},
+		)
+		defer closeFn(t)
+
+		server, err := quic.Listen(
+			serverPacketConn,
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true}),
+		)
+		require.NoError(t, err)
+		defer server.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		conn, err := quic.Dial(
+			ctx,
+			clientPacketConn,
+			serverPacketConn.LocalAddr(),
+			getTLSClientConfig(),
+			getQuicConfig(&quic.Config{
+				MaxIdleTimeout:          idleTimeout,
+				KeepAlivePeriod:         idleTimeout / 2,
+				DisablePathMTUDiscovery: true,
+			}),
+		)
+		require.NoError(t, err)
+
+		serverConn, err := server.Accept(ctx)
+		require.NoError(t, err)
+
+		// wait longer than the idle timeout
+		time.Sleep(3 * idleTimeout)
+		str, err := conn.OpenUniStream()
+		require.NoError(t, err)
+		_, err = str.Write([]byte("foobar"))
+		require.NoError(t, err)
+
+		// verify connection is still alive
+		select {
+		case <-serverConn.Context().Done():
+			t.Fatal("server connection closed unexpectedly")
+		default:
+		}
+
+		// idle timeout will still kick in if PINGs are dropped
+		drop.Store(true)
+		time.Sleep(2 * idleTimeout)
+		_, err = str.Write([]byte("foobar"))
+		requireIdleTimeoutError(t, err)
+
+		// can't rely on the server connection closing, since we impose a minimum idle timeout of 5s,
+		// see https://github.com/quic-go/quic-go/issues/4751
+		serverConn.CloseWithError(0, "")
+	})
+}
+
+func TestTimeoutAfterInactivity(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const idleTimeout = 15 * time.Second
+
+		clientPacketConn, serverPacketConn, closeFn := newSimnetLink(t, time.Millisecond)
+		defer closeFn(t)
+
+		server, err := quic.Listen(
+			serverPacketConn,
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true}),
+		)
+		require.NoError(t, err)
+		defer server.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		counter, tr := newPacketTracer()
+		conn, err := quic.Dial(
+			ctx,
+			clientPacketConn,
+			server.Addr(),
+			getTLSClientConfig(),
+			getQuicConfig(&quic.Config{
+				MaxIdleTimeout:          idleTimeout,
+				Tracer:                  func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tr },
+				DisablePathMTUDiscovery: true,
+			}),
+		)
+		require.NoError(t, err)
+
+		serverConn, err := server.Accept(ctx)
+		require.NoError(t, err)
+		defer serverConn.CloseWithError(0, "")
+
+		ctx, cancel = context.WithTimeout(context.Background(), 2*idleTimeout)
+		defer cancel()
+		_, err = conn.AcceptStream(ctx)
+		requireIdleTimeoutError(t, err)
+
+		var lastAckElicitingPacketSentAt time.Time
+		for _, p := range counter.getSentShortHeaderPackets() {
+			var hasAckElicitingFrame bool
+			for _, f := range p.frames {
+				if _, ok := f.Frame.(qlog.AckFrame); ok {
+					continue
+				}
+				hasAckElicitingFrame = true
+				break
+			}
+			if hasAckElicitingFrame {
+				lastAckElicitingPacketSentAt = p.time
+			}
+		}
+		rcvdPackets := counter.getRcvdShortHeaderPackets()
+		lastPacketRcvdAt := rcvdPackets[len(rcvdPackets)-1].time
+		// We're ignoring here that only the first ack-eliciting packet sent resets the idle timeout.
+		// This is ok since we're dealing with a lossless connection here,
+		// and we'd expect to receive an ACK for additional other ack-eliciting packet sent.
+		timeSinceLastAckEliciting := time.Since(lastAckElicitingPacketSentAt)
+		timeSinceLastRcvd := time.Since(lastPacketRcvdAt)
+		require.Equal(t, idleTimeout, max(timeSinceLastAckEliciting, timeSinceLastRcvd))
+
+		select {
+		case <-serverConn.Context().Done():
+			t.Fatal("server connection closed unexpectedly")
+		default:
+		}
+	})
+}
+
+func TestTimeoutAfterSendingPacket(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const idleTimeout = 15 * time.Second
+
+		var drop atomic.Bool
+		clientPacketConn, serverPacketConn, closeFn := newSimnetLinkWithRouter(t,
+			time.Millisecond,
+			&droppingRouter{Drop: func(p simnet.Packet) bool { return drop.Load() }},
+		)
+		defer closeFn(t)
+
+		server, err := quic.Listen(
+			serverPacketConn,
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true}),
+		)
+		require.NoError(t, err)
+		defer server.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		conn, err := quic.Dial(
+			ctx,
+			clientPacketConn,
+			serverPacketConn.LocalAddr(),
+			getTLSClientConfig(),
+			getQuicConfig(&quic.Config{MaxIdleTimeout: idleTimeout, DisablePathMTUDiscovery: true}),
+		)
+		require.NoError(t, err)
+
+		serverConn, err := server.Accept(ctx)
+		require.NoError(t, err)
+
+		serverStart := time.Now()
+
+		// wait half the idle timeout, then send a packet
+		time.Sleep(idleTimeout / 2)
+		drop.Store(true)
+
+		clientStart := time.Now()
+		str, err := conn.OpenUniStream()
+		require.NoError(t, err)
+		_, err = str.Write([]byte("foobar"))
+		require.NoError(t, err)
+
+		select {
+		case <-serverConn.Context().Done():
+			took := time.Since(serverStart)
+			require.GreaterOrEqual(t, took, idleTimeout)
+			require.Less(t, took, idleTimeout+time.Second)
+		case <-time.After(2 * idleTimeout):
+			t.Fatal("timeout waiting for idle timeout")
+		}
+
+		select {
+		case <-conn.Context().Done():
+			took := time.Since(clientStart)
+			require.Equal(t, took, idleTimeout)
+		case <-time.After(2 * idleTimeout):
+			t.Fatal("timeout waiting for idle timeout")
+		}
+	})
+}
+
+type faultyConn struct {
+	net.PacketConn
+
+	MaxPackets int
+	counter    atomic.Int32
+}
+
+func (c *faultyConn) ReadFrom(p []byte) (int, net.Addr, error) {
+	n, addr, err := c.PacketConn.ReadFrom(p)
+	counter := c.counter.Add(1)
+	if counter <= int32(c.MaxPackets) {
+		return n, addr, err
+	}
+	return 0, nil, io.ErrClosedPipe
+}
+
+func (c *faultyConn) WriteTo(p []byte, addr net.Addr) (int, error) {
+	counter := c.counter.Add(1)
+	if counter <= int32(c.MaxPackets) {
+		return c.PacketConn.WriteTo(p, addr)
+	}
+	return 0, io.ErrClosedPipe
+}
+
+func TestFaultyPacketConn(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testFaultyPacketConn(t, protocol.PerspectiveClient)
+	})
+
+	t.Run("server", func(t *testing.T) {
+		testFaultyPacketConn(t, protocol.PerspectiveServer)
+	})
+}
+
+func testFaultyPacketConn(t *testing.T, pers protocol.Perspective) {
+	t.Setenv("QUIC_GO_DISABLE_RECEIVE_BUFFER_WARNING", "true")
+
+	synctest.Test(t, func(t *testing.T) {
+		runServer := func(ln *quic.Listener) error {
+			conn, err := ln.Accept(context.Background())
+			if err != nil {
+				return err
+			}
+			str, err := conn.OpenUniStream()
+			if err != nil {
+				return err
+			}
+			defer str.Close()
+			_, err = str.Write(PRData)
+			return err
+		}
+
+		runClient := func(conn *quic.Conn) error {
+			str, err := conn.AcceptUniStream(context.Background())
+			if err != nil {
+				return err
+			}
+			data, err := io.ReadAll(str)
+			if err != nil {
+				return err
+			}
+			if !bytes.Equal(data, PRData) {
+				return fmt.Errorf("wrong data: %q vs %q", data, PRData)
+			}
+			return conn.CloseWithError(0, "done")
+		}
+
+		clientPacketConn, serverPacketConn, closeFn := newSimnetLink(t, 100*time.Millisecond)
+		defer closeFn(t)
+
+		var cconn, sconn net.PacketConn = clientPacketConn, serverPacketConn
+		maxPackets := mrand.IntN(25)
+		// sanity check: sending PRData should generate at least 25 packets
+		require.Greater(t, len(PRData)/1500, 25)
+
+		t.Logf("blocking %s's connection after %d packets", pers, maxPackets)
+		switch pers {
+		case protocol.PerspectiveClient:
+			cconn = &faultyConn{PacketConn: cconn, MaxPackets: maxPackets}
+		case protocol.PerspectiveServer:
+			sconn = &faultyConn{PacketConn: sconn, MaxPackets: maxPackets}
+		}
+
+		ln, err := quic.Listen(
+			sconn,
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		serverErrChan := make(chan error, 1)
+		go func() { serverErrChan <- runServer(ln) }()
+
+		clientErrChan := make(chan error, 1)
+		go func() {
+			conn, err := quic.Dial(
+				context.Background(),
+				cconn,
+				ln.Addr(),
+				getTLSClientConfig(),
+				getQuicConfig(&quic.Config{DisablePathMTUDiscovery: true}),
+			)
+			if err != nil {
+				clientErrChan <- err
+				return
+			}
+			clientErrChan <- runClient(conn)
+		}()
+
+		var clientErr error
+		select {
+		case clientErr = <-clientErrChan:
+		case <-time.After(time.Hour):
+			t.Fatal("timeout waiting for client error")
+		}
+		require.Error(t, clientErr)
+		if pers == protocol.PerspectiveClient {
+			require.Contains(t, clientErr.Error(), io.ErrClosedPipe.Error())
+		} else {
+			nerr, ok := errors.AsType[net.Error](clientErr)
+			require.True(t, ok)
+			require.True(t, nerr.Timeout())
+		}
+
+		select {
+		case serverErr := <-serverErrChan: // The handshake completed on the server side.
+			require.Error(t, serverErr)
+			if pers == protocol.PerspectiveServer {
+				require.Contains(t, serverErr.Error(), io.ErrClosedPipe.Error())
+			} else {
+				nerr, ok := errors.AsType[net.Error](serverErr)
+				require.True(t, ok)
+				require.True(t, nerr.Timeout())
+			}
+		default: // The handshake didn't complete
+			require.NoError(t, ln.Close())
+			select {
+			case <-serverErrChan:
+			case <-time.After(time.Hour):
+				t.Fatal("timeout waiting for server to close")
+			}
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/self/zero_rtt_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/self/zero_rtt_test.go
new file mode 100644
index 000000000..2c52f525d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/self/zero_rtt_test.go
@@ -0,0 +1,1154 @@
+package self_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/require"
+)
+
+type zeroRTTCountingRouter struct {
+	simnet.Router
+	counter atomic.Uint32
+}
+
+var _ simnet.Router = &zeroRTTCountingRouter{}
+
+func (r *zeroRTTCountingRouter) SendPacket(p simnet.Packet) error {
+	if containsPacketType(p.Data, protocol.PacketType0RTT) {
+		r.counter.Add(1)
+	}
+	return r.Router.SendPacket(p)
+}
+
+func (r *zeroRTTCountingRouter) Num0RTTPackets() int {
+	return int(r.counter.Load())
+}
+
+func dialAndReceiveTicket(t *testing.T, ln *quic.EarlyListener, clientConn net.PacketConn, sessionCache tls.ClientSessionCache) (clientTLSConf *tls.Config) {
+	t.Helper()
+
+	clientTLSConf = getTLSClientConfig()
+	puts := make(chan string, 100)
+	cache := sessionCache
+	if cache == nil {
+		cache = tls.NewLRUClientSessionCache(100)
+	}
+	clientTLSConf.ClientSessionCache = newClientSessionCache(cache, nil, puts)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	tr := &quic.Transport{Conn: clientConn}
+	defer tr.Close()
+	conn, err := tr.Dial(ctx, ln.Addr(), clientTLSConf, getQuicConfig(nil))
+	require.NoError(t, err)
+	require.False(t, conn.ConnectionState().Used0RTT)
+
+	select {
+	case <-puts:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for session ticket")
+	}
+	require.NoError(t, conn.CloseWithError(0, ""))
+
+	serverConn, err := ln.Accept(ctx)
+	require.NoError(t, err)
+
+	select {
+	case <-serverConn.Context().Done():
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for connection to close")
+	}
+	return clientTLSConf
+}
+
+func transfer0RTTData(
+	t *testing.T,
+	ln *quic.EarlyListener,
+	clientPacketConn net.PacketConn,
+	clientTLSConf *tls.Config,
+	clientConf *quic.Config,
+	testdata []byte, // data to transfer
+) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	tr := &quic.Transport{Conn: clientPacketConn}
+	defer tr.Close()
+	conn, err := tr.DialEarly(ctx, ln.Addr(), clientTLSConf, clientConf)
+	require.NoError(t, err)
+
+	errChan := make(chan error, 1)
+	serverConnChan := make(chan *quic.Conn, 1)
+	go func() {
+		defer close(errChan)
+		conn, err := ln.Accept(context.Background())
+		if err != nil {
+			errChan <- err
+			return
+		}
+		serverConnChan <- conn
+		str, err := conn.AcceptStream(ctx)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		defer str.Close()
+		if _, err := io.Copy(str, str); err != nil {
+			errChan <- err
+			return
+		}
+	}()
+
+	str, err := conn.OpenStream()
+	require.NoError(t, err)
+
+	clientErrChan := make(chan error, 1)
+	go func() {
+		defer close(clientErrChan)
+		// wait for the EOF from the server to arrive before closing the conn
+		data, err := io.ReadAll(str)
+		if err != nil {
+			t.Error(err)
+			clientErrChan <- err
+			return
+		}
+		if !bytes.Equal(testdata, data) {
+			clientErrChan <- fmt.Errorf("data mismatch")
+		}
+	}()
+
+	_, err = str.Write(testdata)
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+	select {
+	case <-conn.HandshakeComplete():
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for handshake to complete")
+	}
+
+	select {
+	case err := <-clientErrChan:
+		require.NoError(t, err)
+	case <-time.After(time.Hour):
+		t.Fatal("timeout waiting for client to read data")
+	}
+
+	select {
+	case err := <-errChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for server to process data")
+	}
+
+	var serverConn *quic.Conn
+	select {
+	case serverConn = <-serverConnChan:
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for server to process data")
+	}
+
+	require.True(t, conn.ConnectionState().Used0RTT)
+	require.True(t, serverConn.ConnectionState().Used0RTT)
+	conn.CloseWithError(0, "")
+
+	select {
+	case <-serverConn.Context().Done():
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for connection to close")
+	}
+}
+
+func Test0RTTTransfer(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 50 * time.Millisecond
+
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tlsConf := getTLSConfig()
+		tr := &quic.Transport{Conn: serverConn}
+		counter, tracer := newPacketTracer()
+		defer tr.Close()
+		ln, err := tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT: true,
+				Tracer:    func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+
+		time.Sleep(time.Hour)
+		synctest.Wait()
+
+		transfer0RTTData(t, ln, clientConn, clientTLSConf, getQuicConfig(nil), PRData)
+
+		num0RTT := router.Num0RTTPackets()
+		t.Logf("sent %d 0-RTT packets", num0RTT)
+		zeroRTTPackets := counter.getRcvd0RTTPacketNumbers()
+		t.Logf("received %d 0-RTT packets", len(zeroRTTPackets))
+		require.Greater(t, num0RTT, 20)
+		require.Contains(t, zeroRTTPackets, protocol.PacketNumber(0))
+	})
+}
+
+func Test0RTTDisabledOnDial(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 25 * time.Millisecond
+
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tlsConf := getTLSConfig()
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		ln, err := tr.ListenEarly(tlsConf, getQuicConfig(&quic.Config{Allow0RTT: true}))
+		require.NoError(t, err)
+		defer ln.Close()
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+
+		time.Sleep(time.Hour)
+		synctest.Wait()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		conn, err := quic.Dial(ctx, clientConn, serverConn.LocalAddr(), clientTLSConf, getQuicConfig(nil))
+		require.NoError(t, err)
+		// session Resumption is enabled at the TLS layer, but not 0-RTT at the QUIC layer
+		require.True(t, conn.ConnectionState().TLS.DidResume)
+		require.False(t, conn.ConnectionState().Used0RTT)
+		conn.CloseWithError(0, "")
+
+		require.Zero(t, router.Num0RTTPackets())
+	})
+}
+
+func Test0RTTWaitForHandshakeCompletion(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 50 * time.Millisecond
+
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tlsConf := getTLSConfig()
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		counter, tracer := newPacketTracer()
+		ln, err := tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT: true,
+				Tracer:    func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+
+		zeroRTTData := GeneratePRData(5 << 10)
+		oneRTTData := PRData
+
+		// now accept the second connection, and receive the 0-RTT data
+		errChan := make(chan error, 1)
+		firstStrDataChan := make(chan []byte, 1)
+		secondStrDataChan := make(chan []byte, 1)
+		go func() {
+			defer close(errChan)
+			conn, err := ln.Accept(context.Background())
+			if err != nil {
+				errChan <- err
+				return
+			}
+			str, err := conn.AcceptUniStream(context.Background())
+			if err != nil {
+				errChan <- err
+				return
+			}
+			data, err := io.ReadAll(str)
+			if err != nil {
+				errChan <- err
+				return
+			}
+			firstStrDataChan <- data
+			str, err = conn.AcceptUniStream(context.Background())
+			if err != nil {
+				errChan <- err
+				return
+			}
+			data, err = io.ReadAll(str)
+			if err != nil {
+				errChan <- err
+				return
+			}
+			secondStrDataChan <- data
+			<-conn.Context().Done()
+		}()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		conn, err := quic.DialEarly(
+			ctx,
+			clientConn,
+			serverConn.LocalAddr(),
+			clientTLSConf,
+			getQuicConfig(nil),
+		)
+		require.NoError(t, err)
+		firstStr, err := conn.OpenUniStream()
+		require.NoError(t, err)
+		_, err = firstStr.Write(zeroRTTData)
+		require.NoError(t, err)
+		require.NoError(t, firstStr.Close())
+
+		// wait for the handshake to complete
+		select {
+		case <-conn.HandshakeComplete():
+		case <-time.After(time.Second):
+			t.Fatal("handshake did not complete in time")
+		}
+		str, err := conn.OpenUniStream()
+		require.NoError(t, err)
+		_, err = str.Write(PRData)
+		require.NoError(t, err)
+		require.NoError(t, str.Close())
+
+		select {
+		case data := <-firstStrDataChan:
+			require.Equal(t, zeroRTTData, data)
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for first stream data")
+		}
+		select {
+		case data := <-secondStrDataChan:
+			require.Equal(t, oneRTTData, data)
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for second stream data")
+		}
+		conn.CloseWithError(0, "")
+		select {
+		case err := <-errChan:
+			require.NoError(t, err, "server error")
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for connection to close")
+		}
+
+		// check that 0-RTT packets only contain STREAM frames for the first stream
+		var num0RTT int
+		for _, p := range counter.getRcvdLongHeaderPackets() {
+			if p.hdr.PacketType != qlog.PacketType0RTT {
+				continue
+			}
+			for _, f := range p.frames {
+				sf, ok := f.Frame.(*qlog.StreamFrame)
+				if !ok {
+					continue
+				}
+				num0RTT++
+				require.Equal(t, firstStr.StreamID(), sf.StreamID)
+			}
+		}
+		t.Logf("received %d STREAM frames in 0-RTT packets", num0RTT)
+		require.NotZero(t, num0RTT)
+	})
+}
+
+func Test0RTTDataLoss(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 5 * time.Millisecond
+		tlsConf := getTLSConfig()
+
+		var num0RTTPackets, numDropped atomic.Uint32
+		router := &droppingRouter{
+			Drop: func(p simnet.Packet) bool {
+				if !wire.IsLongHeaderPacket(p.Data[0]) {
+					return false
+				}
+				hdr, _, _, _ := wire.ParsePacket(p.Data)
+				if hdr.Type == protocol.PacketType0RTT {
+					count := num0RTTPackets.Add(1)
+					// drop 25% of the 0-RTT packets
+					drop := count%4 == 0
+					if drop {
+						numDropped.Add(1)
+					}
+					return drop
+				}
+				return false
+			},
+		}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		counter, tracer := newPacketTracer()
+		ln, err := tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT: true,
+				Tracer:    func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+
+		transfer0RTTData(t, ln, clientConn, clientTLSConf, getQuicConfig(nil), PRData)
+
+		num0RTT := num0RTTPackets.Load()
+		dropped := numDropped.Load()
+		t.Logf("sent %d 0-RTT packets, dropped %d of those.", num0RTT, dropped)
+		require.NotZero(t, num0RTT)
+		require.NotZero(t, dropped)
+		require.NotEmpty(t, counter.getRcvd0RTTPacketNumbers())
+	})
+}
+
+func Test0RTTRetransmitOnRetry(t *testing.T) {
+	t.Run("no retry", func(t *testing.T) {
+		test0RTTRetransmitOnRetry(t, false)
+	})
+	t.Run("with retry", func(t *testing.T) {
+		test0RTTRetransmitOnRetry(t, true)
+	})
+}
+
+func test0RTTRetransmitOnRetry(t *testing.T, useRetry bool) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 5 * time.Millisecond
+		tlsConf := getTLSConfig()
+
+		type connIDCounter struct {
+			connID protocol.ConnectionID
+			bytes  protocol.ByteCount
+		}
+		var mutex sync.Mutex
+		var connIDToCounter []*connIDCounter
+		countZeroRTTBytes := func(data []byte) (n protocol.ByteCount) {
+			for len(data) > 0 {
+				hdr, _, rest, err := wire.ParsePacket(data)
+				if err != nil {
+					return
+				}
+				data = rest
+				if hdr.Type == protocol.PacketType0RTT {
+					n += hdr.Length - 16 /* AEAD tag */
+				}
+			}
+			return
+		}
+
+		router := &zeroRTTCountingRouter{
+			Router: &callbackRouter{
+				Router: &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}},
+				OnSendPacket: func(p simnet.Packet) {
+					if l := countZeroRTTBytes(p.Data); l > 0 {
+						mutex.Lock()
+						defer mutex.Unlock()
+
+						connID, err := wire.ParseConnectionID(p.Data, 0)
+						if err != nil {
+							panic("failed to parse connection ID")
+						}
+						var found bool
+						for _, c := range connIDToCounter {
+							if c.connID == connID {
+								c.bytes += l
+								found = true
+								break
+							}
+						}
+						if !found {
+							connIDToCounter = append(connIDToCounter, &connIDCounter{connID: connID, bytes: l})
+						}
+					}
+				},
+			},
+		}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tr := &quic.Transport{
+			Conn:                serverConn,
+			VerifySourceAddress: func(net.Addr) bool { return useRetry },
+		}
+		defer tr.Close()
+		counter, tracer := newPacketTracer()
+		ln, err := tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT: true,
+				Tracer:    func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+		require.Empty(t, connIDToCounter)
+
+		transfer0RTTData(t, ln, clientConn, clientTLSConf, getQuicConfig(nil), GeneratePRData(5000)) // ~5 packets
+
+		mutex.Lock()
+		defer mutex.Unlock()
+
+		if !useRetry {
+			require.Len(t, connIDToCounter, 1)
+			return
+		}
+
+		require.Len(t, connIDToCounter, 2)
+		require.InDelta(t, 5000+100 /* framing overhead */, int(connIDToCounter[0].bytes), 100) // the FIN bit might be sent extra
+		require.InDelta(t, int(connIDToCounter[0].bytes), int(connIDToCounter[1].bytes), 30)
+		zeroRTTPackets := counter.getRcvd0RTTPacketNumbers()
+		require.GreaterOrEqual(t, len(zeroRTTPackets), 5)
+		require.GreaterOrEqual(t, zeroRTTPackets[0], protocol.PacketNumber(5))
+	})
+}
+
+func Test0RTTWithIncreasedStreamLimit(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 10 * time.Millisecond
+
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tlsConf := getTLSConfig()
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		ln, err := tr.ListenEarly(tlsConf, getQuicConfig(&quic.Config{Allow0RTT: true, MaxIncomingUniStreams: 1}))
+		require.NoError(t, err)
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+		require.Zero(t, router.Num0RTTPackets())
+		require.NoError(t, ln.Close())
+
+		time.Sleep(time.Hour)
+		synctest.Wait()
+
+		ln, err = tr.ListenEarly(tlsConf, getQuicConfig(&quic.Config{Allow0RTT: true, MaxIncomingUniStreams: 2}))
+		require.NoError(t, err)
+		defer ln.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		conn, err := quic.DialEarly(
+			ctx,
+			clientConn,
+			ln.Addr(),
+			clientTLSConf,
+			getQuicConfig(nil),
+		)
+		require.NoError(t, err)
+		require.False(t, conn.ConnectionState().TLS.HandshakeComplete)
+		str, err := conn.OpenUniStream()
+		require.NoError(t, err)
+		_, err = str.Write([]byte("foobar"))
+		require.NoError(t, err)
+		require.NoError(t, str.Close())
+		// the client remembers the old limit and refuses to open a new stream
+		_, err = conn.OpenUniStream()
+		require.ErrorIs(t, err, &quic.StreamLimitReachedError{})
+
+		// after handshake completion, the new limit applies
+		select {
+		case <-conn.HandshakeComplete():
+		case <-time.After(time.Second):
+			t.Fatal("handshake did not complete in time")
+		}
+		_, err = conn.OpenUniStream()
+		require.NoError(t, err)
+		require.True(t, conn.ConnectionState().Used0RTT)
+		require.NoError(t, conn.CloseWithError(0, ""))
+
+		require.NotZero(t, router.Num0RTTPackets())
+	})
+}
+
+func check0RTTRejected(t *testing.T,
+	ln *quic.EarlyListener,
+	clientPacketConn net.PacketConn,
+	addr net.Addr,
+	conf *tls.Config,
+	sendData bool,
+) (clientConn, serverConn *quic.Conn) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	conn, err := quic.DialEarly(ctx, clientPacketConn, addr, conf, getQuicConfig(nil))
+	require.NoError(t, err)
+	require.False(t, conn.ConnectionState().TLS.HandshakeComplete)
+	if sendData {
+		str, err := conn.OpenUniStream()
+		require.NoError(t, err)
+		_, err = str.Write(make([]byte, 3000))
+		require.NoError(t, err)
+		require.NoError(t, str.Close())
+	}
+
+	select {
+	case <-conn.HandshakeComplete():
+	case <-time.After(time.Second):
+		t.Fatal("handshake did not complete in time")
+	}
+	require.False(t, conn.ConnectionState().Used0RTT)
+
+	// make sure the server doesn't process the data
+	ctx, cancel = context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	serverConn, err = ln.Accept(ctx)
+	require.NoError(t, err)
+	require.False(t, serverConn.ConnectionState().Used0RTT)
+	if sendData {
+		_, err = serverConn.AcceptUniStream(ctx)
+		require.Equal(t, context.DeadlineExceeded, err)
+	}
+
+	ctx, cancel = context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	nextConn, err := conn.NextConnection(ctx)
+	require.NoError(t, err)
+	require.True(t, nextConn.ConnectionState().TLS.HandshakeComplete)
+	require.False(t, nextConn.ConnectionState().Used0RTT)
+	return nextConn, serverConn
+}
+
+func Test0RTTRejectedOnStreamLimitDecrease(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 5 * time.Millisecond
+
+		const (
+			maxBidiStreams    = 42
+			maxUniStreams     = 10
+			newMaxBidiStreams = maxBidiStreams - 1
+			newMaxUniStreams  = maxUniStreams - 1
+		)
+
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tlsConf := getTLSConfig()
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		ln, err := tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT:             true,
+				MaxIncomingStreams:    maxBidiStreams,
+				MaxIncomingUniStreams: maxUniStreams,
+			}),
+		)
+		require.NoError(t, err)
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+		require.NoError(t, ln.Close())
+
+		time.Sleep(time.Hour)
+		synctest.Wait()
+
+		counter, tracer := newPacketTracer()
+		ln, err = tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT:             true,
+				MaxIncomingStreams:    newMaxBidiStreams,
+				MaxIncomingUniStreams: newMaxUniStreams,
+				Tracer:                func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		conn, sconn := check0RTTRejected(t, ln, clientConn, ln.Addr(), clientTLSConf, true)
+		defer conn.CloseWithError(0, "")
+
+		// It should now be possible to open new bidirectional streams up to the new limit...
+		for range newMaxBidiStreams {
+			_, err = conn.OpenStream()
+			require.NoError(t, err)
+		}
+		// ... but not beyond it.
+		_, err = conn.OpenStream()
+		require.ErrorIs(t, err, &quic.StreamLimitReachedError{})
+
+		// It should now be possible to open new unidirectional streams up to the new limit...
+		for range newMaxUniStreams {
+			_, err = conn.OpenUniStream()
+			require.NoError(t, err)
+		}
+		// ... but not beyond it.
+		_, err = conn.OpenUniStream()
+		require.ErrorIs(t, err, &quic.StreamLimitReachedError{})
+
+		sconn.CloseWithError(0, "")
+		// The client should send 0-RTT packets, but the server doesn't process them.
+		n := router.Num0RTTPackets()
+		t.Logf("sent %d 0-RTT packets", n)
+		require.NotZero(t, n)
+		require.Empty(t, counter.getRcvd0RTTPacketNumbers())
+	})
+}
+
+func Test0RTTRejectedOnConnectionWindowDecrease(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 5 * time.Millisecond
+
+		const (
+			connFlowControlWindow    = 100
+			newConnFlowControlWindow = connFlowControlWindow - 1
+		)
+
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tlsConf := getTLSConfig()
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		ln, err := tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT:                      true,
+				InitialConnectionReceiveWindow: connFlowControlWindow,
+			}),
+		)
+		require.NoError(t, err)
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+		require.NoError(t, ln.Close())
+
+		time.Sleep(time.Hour)
+		synctest.Wait()
+
+		ln, err = tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT:                      true,
+				InitialConnectionReceiveWindow: newConnFlowControlWindow,
+			}),
+		)
+		require.NoError(t, err)
+
+		conn, sconn := check0RTTRejected(t, ln, clientConn, ln.Addr(), clientTLSConf, false)
+		defer conn.CloseWithError(0, "")
+		defer sconn.CloseWithError(0, "")
+
+		str, err := conn.OpenStream()
+		require.NoError(t, err)
+		str.SetWriteDeadline(time.Now().Add(time.Second))
+		n, err := str.Write(make([]byte, 2000))
+		require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+		require.Equal(t, newConnFlowControlWindow, n)
+
+		// make sure that only 99 bytes were received
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		serverStr, err := sconn.AcceptStream(ctx)
+		require.NoError(t, err)
+		serverStr.SetReadDeadline(time.Now().Add(time.Second))
+		n, err = io.ReadFull(serverStr, make([]byte, newConnFlowControlWindow))
+		require.NoError(t, err)
+		require.Equal(t, newConnFlowControlWindow, n)
+		_, err = serverStr.Read([]byte{0})
+		require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+	})
+}
+
+func Test0RTTRejectedOnALPNChanged(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 5 * time.Millisecond
+
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tlsConf := getTLSConfig()
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		ln, err := tr.ListenEarly(tlsConf, getQuicConfig(&quic.Config{Allow0RTT: true}))
+		require.NoError(t, err)
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+		require.NoError(t, ln.Close())
+
+		time.Sleep(time.Hour)
+		synctest.Wait()
+
+		// switch to different ALPN on the server side
+		tlsConf.NextProtos = []string{"new-alpn"}
+		// Append to the client's ALPN.
+		// crypto/tls will attempt to resume with the ALPN from the original connection
+		clientTLSConf.NextProtos = append(clientTLSConf.NextProtos, "new-alpn")
+		counter, tracer := newPacketTracer()
+		ln, err = tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT: true,
+				Tracer:    func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		conn, sconn := check0RTTRejected(t, ln, clientConn, ln.Addr(), clientTLSConf, true)
+		defer conn.CloseWithError(0, "")
+
+		require.Equal(t, "new-alpn", conn.ConnectionState().TLS.NegotiatedProtocol)
+
+		sconn.CloseWithError(0, "")
+		// The client should send 0-RTT packets, but the server doesn't process them.
+		num0RTT := router.Num0RTTPackets()
+		t.Logf("Sent %d 0-RTT packets.", num0RTT)
+		require.NotZero(t, num0RTT)
+		require.Empty(t, counter.getRcvd0RTTPacketNumbers())
+	})
+}
+
+func Test0RTTRejectedWhenDisabled(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 5 * time.Millisecond
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tlsConf := getTLSConfig()
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		ln, err := tr.ListenEarly(tlsConf, getQuicConfig(&quic.Config{Allow0RTT: true}))
+		require.NoError(t, err)
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+		require.NoError(t, ln.Close())
+
+		time.Sleep(time.Hour)
+		synctest.Wait()
+
+		counter, tracer := newPacketTracer()
+		ln, err = tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT: false,
+				Tracer:    func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+		conn, sconn := check0RTTRejected(t, ln, clientConn, ln.Addr(), clientTLSConf, true)
+		defer conn.CloseWithError(0, "")
+
+		sconn.CloseWithError(0, "")
+		// The client should send 0-RTT packets, but the server doesn't process them.
+		num0RTT := router.Num0RTTPackets()
+		t.Logf("Sent %d 0-RTT packets.", num0RTT)
+		require.NotZero(t, num0RTT)
+		require.Empty(t, counter.getRcvd0RTTPacketNumbers())
+	})
+}
+
+func Test0RTTRejectedOnDatagramsDisabled(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 5 * time.Millisecond
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tlsConf := getTLSConfig()
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		ln, err := tr.ListenEarly(tlsConf, getQuicConfig(&quic.Config{Allow0RTT: true, EnableDatagrams: true}))
+		require.NoError(t, err)
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+		require.NoError(t, ln.Close())
+
+		time.Sleep(time.Hour)
+		synctest.Wait()
+
+		counter, tracer := newPacketTracer()
+		ln, err = tr.ListenEarly(
+			tlsConf,
+			getQuicConfig(&quic.Config{
+				Allow0RTT:       true,
+				EnableDatagrams: false,
+				Tracer:          func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+		conn, sconn := check0RTTRejected(t, ln, clientConn, ln.Addr(), clientTLSConf, true)
+		defer conn.CloseWithError(0, "")
+		require.False(t, conn.ConnectionState().SupportsDatagrams.Remote)
+		require.False(t, conn.ConnectionState().SupportsDatagrams.Local)
+
+		sconn.CloseWithError(0, "")
+		// The client should send 0-RTT packets, but the server doesn't process them.
+		num0RTT := router.Num0RTTPackets()
+		t.Logf("Sent %d 0-RTT packets.", num0RTT)
+		require.NotZero(t, num0RTT)
+		require.Empty(t, counter.getRcvd0RTTPacketNumbers())
+	})
+}
+
+type metadataClientSessionCache struct {
+	toAdd    []byte
+	restored func([]byte)
+
+	cache tls.ClientSessionCache
+}
+
+func (m metadataClientSessionCache) Get(key string) (*tls.ClientSessionState, bool) {
+	session, ok := m.cache.Get(key)
+	if !ok || session == nil {
+		return session, ok
+	}
+	ticket, state, err := session.ResumptionState()
+	if err != nil {
+		panic("failed to get resumption state: " + err.Error())
+	}
+	if len(state.Extra) != 2 { // ours, and the quic-go's
+		panic("expected 2 state entries" + fmt.Sprintf("%v", state.Extra))
+	}
+	m.restored(state.Extra[1])
+	// as of Go 1.23, this function never returns an error
+	session, err = tls.NewResumptionState(ticket, state)
+	if err != nil {
+		panic("failed to create resumption state: " + err.Error())
+	}
+	return session, true
+}
+
+func (m metadataClientSessionCache) Put(key string, session *tls.ClientSessionState) {
+	ticket, state, err := session.ResumptionState()
+	if err != nil {
+		panic("failed to get resumption state: " + err.Error())
+	}
+	state.Extra = append(state.Extra, m.toAdd)
+	session, err = tls.NewResumptionState(ticket, state)
+	if err != nil {
+		panic("failed to create resumption state: " + err.Error())
+	}
+	m.cache.Put(key, session)
+}
+
+func Test0RTTWithSessionTicketData(t *testing.T) {
+	const rtt = 5 * time.Millisecond
+
+	t.Run("server", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			tlsConf := getTLSConfig()
+			tlsConf.WrapSession = func(cs tls.ConnectionState, ss *tls.SessionState) ([]byte, error) {
+				ss.Extra = append(ss.Extra, []byte("foobar"))
+				return tlsConf.EncryptTicket(cs, ss)
+			}
+			router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+			clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+			defer closeFn(t)
+
+			tr := &quic.Transport{Conn: serverConn}
+			defer tr.Close()
+			ln, err := tr.ListenEarly(tlsConf, getQuicConfig(&quic.Config{Allow0RTT: true}))
+			require.NoError(t, err)
+
+			clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+			stateChan := make(chan *tls.SessionState, 1)
+			tlsConf.UnwrapSession = func(identity []byte, cs tls.ConnectionState) (*tls.SessionState, error) {
+				state, err := tlsConf.DecryptTicket(identity, cs)
+				if err != nil {
+					panic("failed to decrypt ticket")
+				}
+				stateChan <- state
+				return state, nil
+			}
+
+			transfer0RTTData(t, ln, clientConn, clientTLSConf, getQuicConfig(nil), PRData)
+
+			select {
+			case state := <-stateChan:
+				require.Len(t, state.Extra, 2)
+				require.Equal(t, []byte("foobar"), state.Extra[1])
+			case <-time.After(time.Second):
+				t.Fatal("timed out waiting for session state")
+			}
+		})
+	})
+
+	t.Run("client", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+			clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+			defer closeFn(t)
+
+			tr := &quic.Transport{Conn: serverConn}
+			defer tr.Close()
+			ln, err := tr.ListenEarly(getTLSConfig(), getQuicConfig(&quic.Config{Allow0RTT: true}))
+			require.NoError(t, err)
+			defer ln.Close()
+
+			restoreChan := make(chan []byte, 1)
+			clientTLSConf := dialAndReceiveTicket(t,
+				ln,
+				clientConn,
+				&metadataClientSessionCache{
+					toAdd:    []byte("foobar"),
+					restored: func(b []byte) { restoreChan <- b },
+					cache:    tls.NewLRUClientSessionCache(100),
+				},
+			)
+
+			transfer0RTTData(t, ln, clientConn, clientTLSConf, getQuicConfig(nil), PRData)
+			select {
+			case b := <-restoreChan:
+				require.Equal(t, []byte("foobar"), b)
+			case <-time.After(time.Second):
+				t.Fatal("timed out waiting for session state")
+			}
+		})
+	})
+}
+
+func Test0RTTPacketQueueing(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 5 * time.Millisecond
+		n := &simnet.Simnet{Router: &simnet.PerfectRouter{}}
+		serverAddr := &net.UDPAddr{IP: net.ParseIP("1.0.0.2"), Port: 9002}
+		settings := simnet.NodeBiDiLinkSettings{
+			LatencyFunc: func(p simnet.Packet) time.Duration {
+				if p.To.String() == serverAddr.String() {
+					if wire.IsLongHeaderPacket(p.Data[0]) {
+						hdr, _, _, err := wire.ParsePacket(p.Data)
+						if err == nil && hdr.Type == protocol.PacketTypeInitial {
+							return rtt * 3 / 2
+						}
+					}
+				}
+				return rtt / 2
+			},
+		}
+		clientConn := n.NewEndpoint(&net.UDPAddr{IP: net.ParseIP("1.0.0.1"), Port: 9001}, settings)
+		serverConn := n.NewEndpoint(serverAddr, settings)
+		require.NoError(t, n.Start())
+		defer func() {
+			require.NoError(t, clientConn.Close())
+			require.NoError(t, serverConn.Close())
+			require.NoError(t, n.Close())
+		}()
+
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+		counter, tracer := newPacketTracer()
+		ln, err := tr.ListenEarly(
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{
+				Allow0RTT: true,
+				Tracer:    func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+
+		data := GeneratePRData(5000) // ~5 packets
+		transfer0RTTData(t, ln, clientConn, clientTLSConf, getQuicConfig(nil), data)
+
+		require.Equal(t, qlog.PacketTypeInitial, counter.getRcvdLongHeaderPackets()[0].hdr.PacketType)
+		zeroRTTPackets := counter.getRcvd0RTTPacketNumbers()
+		require.GreaterOrEqual(t, len(zeroRTTPackets), 5)
+		// make sure the data wasn't retransmitted
+		var dataSent protocol.ByteCount
+		for _, p := range counter.getRcvdLongHeaderPackets() {
+			for _, f := range p.frames {
+				if sf, ok := f.Frame.(*qlog.StreamFrame); ok {
+					dataSent += protocol.ByteCount(sf.Length)
+				}
+			}
+		}
+		for _, p := range counter.getRcvdShortHeaderPackets() {
+			for _, f := range p.frames {
+				if sf, ok := f.Frame.(*qlog.StreamFrame); ok {
+					dataSent += protocol.ByteCount(sf.Length)
+				}
+			}
+		}
+		require.Less(t, int(dataSent), 6000)
+		require.Equal(t, protocol.PacketNumber(0), zeroRTTPackets[0])
+	})
+}
+
+func Test0RTTDatagrams(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 5 * time.Millisecond
+		router := &zeroRTTCountingRouter{Router: &simnet.PerfectRouter{}}
+		clientConn, serverConn, closeFn := newSimnetLinkWithRouter(t, rtt, router)
+		defer closeFn(t)
+
+		tr := &quic.Transport{Conn: serverConn}
+		defer tr.Close()
+
+		counter, tracer := newPacketTracer()
+		ln, err := tr.ListenEarly(
+			getTLSConfig(),
+			getQuicConfig(&quic.Config{
+				Allow0RTT:       true,
+				EnableDatagrams: true,
+				Tracer:          func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace { return tracer },
+			}),
+		)
+		require.NoError(t, err)
+		defer ln.Close()
+
+		clientTLSConf := dialAndReceiveTicket(t, ln, clientConn, nil)
+
+		msg := GeneratePRData(100)
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		conn, err := quic.DialEarly(ctx,
+			clientConn,
+			ln.Addr(),
+			clientTLSConf,
+			getQuicConfig(&quic.Config{EnableDatagrams: true}),
+		)
+		require.NoError(t, err)
+		defer conn.CloseWithError(0, "")
+		require.True(t, conn.ConnectionState().SupportsDatagrams.Remote)
+		require.True(t, conn.ConnectionState().SupportsDatagrams.Local)
+		require.NoError(t, conn.SendDatagram(msg))
+		select {
+		case <-conn.HandshakeComplete():
+		case <-time.After(time.Second):
+			t.Fatal("handshake did not complete in time")
+		}
+
+		sconn, err := ln.Accept(ctx)
+		require.NoError(t, err)
+		rcvdMsg, err := sconn.ReceiveDatagram(ctx)
+		require.NoError(t, err)
+		require.True(t, sconn.ConnectionState().Used0RTT)
+		require.Equal(t, msg, rcvdMsg)
+
+		num0RTT := router.Num0RTTPackets()
+		t.Logf("sent %d 0-RTT packets", num0RTT)
+		require.NotZero(t, num0RTT)
+		sconn.CloseWithError(0, "")
+		require.Len(t, counter.getRcvd0RTTPacketNumbers(), 1)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/tools/crypto.go b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/crypto.go
new file mode 100644
index 000000000..9c7bd3743
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/crypto.go
@@ -0,0 +1,127 @@
+package tools
+
+import (
+	"crypto"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"math/big"
+	"net"
+	"time"
+)
+
+const ALPN = "quic-go integration tests"
+
+// use a very long validity period to cover the synthetic clock used in synctest
+var (
+	notBefore = time.Date(1990, 1, 1, 0, 0, 0, 0, time.UTC)
+	notAfter  = time.Date(2100, 1, 1, 0, 0, 0, 0, time.UTC)
+)
+
+func GenerateCA() (*x509.Certificate, crypto.PrivateKey, error) {
+	certTempl := &x509.Certificate{
+		SerialNumber:          big.NewInt(2019),
+		Subject:               pkix.Name{},
+		NotBefore:             notBefore,
+		NotAfter:              notAfter,
+		IsCA:                  true,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+	caBytes, err := x509.CreateCertificate(rand.Reader, certTempl, certTempl, pub, priv)
+	if err != nil {
+		return nil, nil, err
+	}
+	ca, err := x509.ParseCertificate(caBytes)
+	if err != nil {
+		return nil, nil, err
+	}
+	return ca, priv, nil
+}
+
+func GenerateLeafCert(ca *x509.Certificate, caPriv crypto.PrivateKey) (*x509.Certificate, crypto.PrivateKey, error) {
+	certTempl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		DNSNames:     []string{"localhost"},
+		IPAddresses:  []net.IP{net.IPv4(127, 0, 0, 1)},
+		NotBefore:    notBefore,
+		NotAfter:     notAfter,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+	certBytes, err := x509.CreateCertificate(rand.Reader, certTempl, ca, pub, caPriv)
+	if err != nil {
+		return nil, nil, err
+	}
+	cert, err := x509.ParseCertificate(certBytes)
+	if err != nil {
+		return nil, nil, err
+	}
+	return cert, priv, nil
+}
+
+// GenerateTLSConfigWithLongCertChain generates a tls.Config that uses a long certificate chain.
+// The Root CA used is the same as for the config returned from getTLSConfig().
+func GenerateTLSConfigWithLongCertChain(ca *x509.Certificate, caPrivateKey crypto.PrivateKey) (*tls.Config, error) {
+	const chainLen = 16
+	certTempl := &x509.Certificate{
+		SerialNumber:          big.NewInt(2019),
+		Subject:               pkix.Name{},
+		NotBefore:             notBefore,
+		NotAfter:              notAfter,
+		IsCA:                  true,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+	}
+
+	lastCA := ca
+	lastCAPrivKey := caPrivateKey
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	certs := make([]*x509.Certificate, chainLen)
+	for i := range chainLen {
+		caBytes, err := x509.CreateCertificate(rand.Reader, certTempl, lastCA, priv.Public(), lastCAPrivKey)
+		if err != nil {
+			return nil, err
+		}
+		ca, err := x509.ParseCertificate(caBytes)
+		if err != nil {
+			return nil, err
+		}
+		certs[i] = ca
+		lastCA = ca
+		lastCAPrivKey = priv
+	}
+	leafCert, leafPrivateKey, err := GenerateLeafCert(lastCA, lastCAPrivKey)
+	if err != nil {
+		return nil, err
+	}
+
+	rawCerts := make([][]byte, chainLen+1)
+	for i, cert := range certs {
+		rawCerts[chainLen-i] = cert.Raw
+	}
+	rawCerts[0] = leafCert.Raw
+
+	return &tls.Config{
+		Certificates: []tls.Certificate{{
+			Certificate: rawCerts,
+			PrivateKey:  leafPrivateKey,
+		}},
+		NextProtos: []string{ALPN},
+	}, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/tools/crypto_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/crypto_test.go
new file mode 100644
index 000000000..15551ba7e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/crypto_test.go
@@ -0,0 +1,99 @@
+package tools
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"io"
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+type countingConn struct {
+	net.Conn
+	BytesReceived int
+}
+
+func (c *countingConn) Read(b []byte) (int, error) {
+	n, err := c.Conn.Read(b)
+	c.BytesReceived += n
+	return n, err
+}
+
+func TestGenerateTLSConfig(t *testing.T) {
+	ca, caPriv, err := GenerateCA()
+	require.NoError(t, err)
+	certPool := x509.NewCertPool()
+	certPool.AddCert(ca)
+	clientConf := &tls.Config{
+		ServerName: "localhost",
+		RootCAs:    certPool,
+	}
+
+	t.Run("short chain", func(t *testing.T) {
+		leaf, leafPriv, err := GenerateLeafCert(ca, caPriv)
+		require.NoError(t, err)
+
+		serverConf := &tls.Config{
+			Certificates: []tls.Certificate{{
+				Certificate: [][]byte{leaf.Raw},
+				PrivateKey:  leafPriv,
+			}},
+		}
+
+		bytesReceived := testGenerateTLSConfig(t, serverConf, clientConf)
+		t.Logf("bytes received: %d", bytesReceived)
+		require.Less(t, bytesReceived, 2000)
+	})
+
+	t.Run("long chain", func(t *testing.T) {
+		serverConf, err := GenerateTLSConfigWithLongCertChain(ca, caPriv)
+		require.NoError(t, err)
+
+		bytesReceived := testGenerateTLSConfig(t, serverConf, clientConf)
+		t.Logf("bytes received: %d", bytesReceived)
+		require.Greater(t, bytesReceived, 5000)
+	})
+}
+
+func testGenerateTLSConfig(t *testing.T, serverConf, clientConf *tls.Config) int {
+	ln, err := tls.Listen("tcp", "127.0.0.1:0", serverConf)
+	require.NoError(t, err)
+	defer ln.Close()
+
+	type result struct {
+		err error
+		msg string
+	}
+
+	resultChan := make(chan result, 1)
+	go func() {
+		conn, err := ln.Accept()
+		if err != nil {
+			resultChan <- result{err: err}
+			return
+		}
+		defer conn.Close()
+		msg, err := io.ReadAll(conn)
+		resultChan <- result{err: err, msg: string(msg)}
+	}()
+
+	tcpConn, err := net.Dial("tcp", ln.Addr().String())
+	require.NoError(t, err)
+	defer tcpConn.Close()
+	countingConn := &countingConn{Conn: tcpConn}
+
+	tlsConn := tls.Client(countingConn, clientConf)
+	require.NoError(t, tlsConn.Handshake())
+
+	_, err = tlsConn.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.NoError(t, tlsConn.Close())
+
+	res := <-resultChan
+	require.NoError(t, res.err)
+	require.Equal(t, "foobar", res.msg)
+
+	return countingConn.BytesReceived
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/tools/israce/norace.go b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/israce/norace.go
new file mode 100644
index 000000000..0bf3b8c47
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/israce/norace.go
@@ -0,0 +1,6 @@
+//go:build !race
+
+package israce
+
+// Enabled reports if the race detector is enabled.
+const Enabled = false
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/tools/israce/race.go b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/israce/race.go
new file mode 100644
index 000000000..3751e5c8c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/israce/race.go
@@ -0,0 +1,6 @@
+//go:build race
+
+package israce
+
+// Enabled reports if the race detector is enabled.
+const Enabled = true
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/tools/proxy/proxy.go b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/proxy/proxy.go
new file mode 100644
index 000000000..cb567ab4b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/proxy/proxy.go
@@ -0,0 +1,374 @@
+package quicproxy
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+const desiredBufferSize = 2 << 20 // 2 MiB
+
+// Connection is a UDP connection
+type connection struct {
+	ClientAddr *net.UDPAddr // Address of the client
+	ServerAddr *net.UDPAddr // Address of the server
+
+	mx         sync.Mutex
+	ServerConn *net.UDPConn // UDP connection to server
+
+	incomingPackets chan packetEntry
+
+	Incoming *queue
+	Outgoing *queue
+}
+
+func (c *connection) queuePacket(t monotime.Time, b []byte) {
+	c.incomingPackets <- packetEntry{Time: t, Raw: b}
+}
+
+func (c *connection) SwitchConn(conn *net.UDPConn) {
+	c.mx.Lock()
+	defer c.mx.Unlock()
+
+	old := c.ServerConn
+	old.SetReadDeadline(time.Now())
+	c.ServerConn = conn
+}
+
+func (c *connection) GetServerConn() *net.UDPConn {
+	c.mx.Lock()
+	defer c.mx.Unlock()
+
+	return c.ServerConn
+}
+
+// Direction is the direction a packet is sent.
+type Direction int
+
+const (
+	// DirectionIncoming is the direction from the client to the server.
+	DirectionIncoming Direction = iota
+	// DirectionOutgoing is the direction from the server to the client.
+	DirectionOutgoing
+	// DirectionBoth is both incoming and outgoing
+	DirectionBoth
+)
+
+type packetEntry struct {
+	Time monotime.Time
+	Raw  []byte
+}
+
+type queue struct {
+	sync.Mutex
+
+	timer   *time.Timer
+	Packets []packetEntry // sorted by the packetEntry.Time
+}
+
+func newQueue() *queue {
+	// there's no way to initialize a time.Timer that's not running
+	return &queue{timer: time.NewTimer(24 * time.Hour)}
+}
+
+func (q *queue) Add(e packetEntry) {
+	q.Lock()
+	defer q.Unlock()
+
+	if len(q.Packets) == 0 {
+		q.Packets = append(q.Packets, e)
+		q.timer.Reset(monotime.Until(e.Time))
+		return
+	}
+
+	// The packets slice is sorted by the packetEntry.Time.
+	// We only need to insert the packet at the correct position.
+	idx := slices.IndexFunc(q.Packets, func(p packetEntry) bool {
+		return p.Time.After(e.Time)
+	})
+	if idx == -1 {
+		q.Packets = append(q.Packets, e)
+	} else {
+		q.Packets = slices.Insert(q.Packets, idx, e)
+	}
+	if idx == 0 {
+		q.timer.Reset(monotime.Until(q.Packets[0].Time))
+	}
+}
+
+func (q *queue) Get() []byte {
+	q.Lock()
+	raw := q.Packets[0].Raw
+	q.Packets = q.Packets[1:]
+	if len(q.Packets) > 0 {
+		q.timer.Reset(monotime.Until(q.Packets[0].Time))
+	}
+	q.Unlock()
+	return raw
+}
+
+func (q *queue) Timer() <-chan time.Time { return q.timer.C }
+
+func (q *queue) Close() { q.timer.Stop() }
+
+func (d Direction) String() string {
+	switch d {
+	case DirectionIncoming:
+		return "Incoming"
+	case DirectionOutgoing:
+		return "Outgoing"
+	case DirectionBoth:
+		return "both"
+	default:
+		panic("unknown direction")
+	}
+}
+
+// Is says if one direction matches another direction.
+// For example, incoming matches both incoming and both, but not outgoing.
+func (d Direction) Is(dir Direction) bool {
+	if d == DirectionBoth || dir == DirectionBoth {
+		return true
+	}
+	return d == dir
+}
+
+// DropCallback is a callback that determines which packet gets dropped.
+type DropCallback func(dir Direction, from, to net.Addr, packet []byte) bool
+
+// DelayCallback is a callback that determines how much delay to apply to a packet.
+type DelayCallback func(dir Direction, from, to net.Addr, packet []byte) time.Duration
+
+// Proxy is a QUIC proxy that can drop and delay packets.
+type Proxy struct {
+	// Conn is the UDP socket that the proxy listens on for incoming packets from clients.
+	Conn *net.UDPConn
+
+	// ServerAddr is the address of the server that the proxy forwards packets to.
+	ServerAddr *net.UDPAddr
+
+	// DropPacket is a callback that determines which packet gets dropped.
+	DropPacket DropCallback
+
+	// DelayPacket is a callback that determines how much delay to apply to a packet.
+	DelayPacket DelayCallback
+
+	closeChan chan struct{}
+	logger    utils.Logger
+
+	// mapping from client addresses (as host:port) to connection
+	mutex      sync.Mutex
+	clientDict map[string]*connection
+}
+
+func (p *Proxy) Start() error {
+	p.clientDict = make(map[string]*connection)
+	p.closeChan = make(chan struct{})
+	p.logger = utils.DefaultLogger.WithPrefix("proxy")
+
+	if err := p.Conn.SetReadBuffer(desiredBufferSize); err != nil {
+		return err
+	}
+	if err := p.Conn.SetWriteBuffer(desiredBufferSize); err != nil {
+		return err
+	}
+
+	p.logger.Debugf("Starting UDP Proxy %s <-> %s", p.Conn.LocalAddr(), p.ServerAddr)
+	go p.runProxy()
+	return nil
+}
+
+// SwitchConn switches the connection for a client,
+// identified the address that the client is sending from.
+func (p *Proxy) SwitchConn(clientAddr *net.UDPAddr, conn *net.UDPConn) error {
+	if err := conn.SetReadBuffer(desiredBufferSize); err != nil {
+		return err
+	}
+	if err := conn.SetWriteBuffer(desiredBufferSize); err != nil {
+		return err
+	}
+	p.mutex.Lock()
+	defer p.mutex.Unlock()
+	c, ok := p.clientDict[clientAddr.String()]
+	if !ok {
+		return fmt.Errorf("client %s not found", clientAddr)
+	}
+	c.SwitchConn(conn)
+	return nil
+}
+
+// Close stops the UDP Proxy
+func (p *Proxy) Close() error {
+	p.mutex.Lock()
+	defer p.mutex.Unlock()
+
+	close(p.closeChan)
+	for _, c := range p.clientDict {
+		if err := c.GetServerConn().Close(); err != nil {
+			return err
+		}
+		c.Incoming.Close()
+		c.Outgoing.Close()
+	}
+	return nil
+}
+
+// LocalAddr is the address the proxy is listening on.
+func (p *Proxy) LocalAddr() net.Addr { return p.Conn.LocalAddr() }
+
+func (p *Proxy) newConnection(cliAddr *net.UDPAddr) (*connection, error) {
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	if err != nil {
+		return nil, err
+	}
+	if err := conn.SetReadBuffer(desiredBufferSize); err != nil {
+		return nil, err
+	}
+	if err := conn.SetWriteBuffer(desiredBufferSize); err != nil {
+		return nil, err
+	}
+	return &connection{
+		ClientAddr:      cliAddr,
+		ServerAddr:      p.ServerAddr,
+		incomingPackets: make(chan packetEntry, 10),
+		Incoming:        newQueue(),
+		Outgoing:        newQueue(),
+		ServerConn:      conn,
+	}, nil
+}
+
+// runProxy listens on the proxy address and handles incoming packets.
+func (p *Proxy) runProxy() error {
+	for {
+		buffer := make([]byte, protocol.MaxPacketBufferSize)
+		n, cliaddr, err := p.Conn.ReadFromUDP(buffer)
+		if err != nil {
+			return err
+		}
+		raw := buffer[:n]
+
+		p.mutex.Lock()
+		conn, ok := p.clientDict[cliaddr.String()]
+
+		if !ok {
+			conn, err = p.newConnection(cliaddr)
+			if err != nil {
+				p.mutex.Unlock()
+				return err
+			}
+			p.clientDict[cliaddr.String()] = conn
+			go p.runIncomingConnection(conn)
+			go p.runOutgoingConnection(conn)
+		}
+		p.mutex.Unlock()
+
+		if p.DropPacket != nil && p.DropPacket(DirectionIncoming, cliaddr, conn.ServerAddr, raw) {
+			if p.logger.Debug() {
+				p.logger.Debugf("dropping incoming packet(%d bytes)", n)
+			}
+			continue
+		}
+
+		var delay time.Duration
+		if p.DelayPacket != nil {
+			delay = p.DelayPacket(DirectionIncoming, cliaddr, conn.ServerAddr, raw)
+		}
+		if delay == 0 {
+			if p.logger.Debug() {
+				p.logger.Debugf("forwarding incoming packet (%d bytes) to %s", len(raw), conn.ServerAddr)
+			}
+			if _, err := conn.GetServerConn().WriteTo(raw, conn.ServerAddr); err != nil {
+				return err
+			}
+		} else {
+			now := monotime.Now()
+			if p.logger.Debug() {
+				p.logger.Debugf("delaying incoming packet (%d bytes) to %s by %s", len(raw), conn.ServerAddr, delay)
+			}
+			conn.queuePacket(now.Add(delay), raw)
+		}
+	}
+}
+
+// runConnection handles packets from server to a single client
+func (p *Proxy) runOutgoingConnection(conn *connection) error {
+	outgoingPackets := make(chan packetEntry, 10)
+	go func() {
+		for {
+			buffer := make([]byte, protocol.MaxPacketBufferSize)
+			n, addr, err := conn.GetServerConn().ReadFrom(buffer)
+			if err != nil {
+				// when the connection is switched out, we set a deadline on the old connection,
+				// in order to return it immediately
+				if errors.Is(err, os.ErrDeadlineExceeded) {
+					continue
+				}
+				return
+			}
+			raw := buffer[0:n]
+
+			if p.DropPacket != nil && p.DropPacket(DirectionOutgoing, addr, conn.ClientAddr, raw) {
+				if p.logger.Debug() {
+					p.logger.Debugf("dropping outgoing packet(%d bytes)", n)
+				}
+				continue
+			}
+
+			var delay time.Duration
+			if p.DelayPacket != nil {
+				delay = p.DelayPacket(DirectionOutgoing, addr, conn.ClientAddr, raw)
+			}
+			if delay == 0 {
+				if p.logger.Debug() {
+					p.logger.Debugf("forwarding outgoing packet (%d bytes) to %s", len(raw), conn.ClientAddr)
+				}
+				if _, err := p.Conn.WriteToUDP(raw, conn.ClientAddr); err != nil {
+					return
+				}
+			} else {
+				now := monotime.Now()
+				if p.logger.Debug() {
+					p.logger.Debugf("delaying outgoing packet (%d bytes) to %s by %s", len(raw), conn.ClientAddr, delay)
+				}
+				outgoingPackets <- packetEntry{Time: now.Add(delay), Raw: raw}
+			}
+		}
+	}()
+
+	for {
+		select {
+		case <-p.closeChan:
+			return nil
+		case e := <-outgoingPackets:
+			conn.Outgoing.Add(e)
+		case <-conn.Outgoing.Timer():
+			if _, err := p.Conn.WriteTo(conn.Outgoing.Get(), conn.ClientAddr); err != nil {
+				return err
+			}
+		}
+	}
+}
+
+func (p *Proxy) runIncomingConnection(conn *connection) error {
+	for {
+		select {
+		case <-p.closeChan:
+			return nil
+		case e := <-conn.incomingPackets:
+			// Send the packet to the server
+			conn.Incoming.Add(e)
+		case <-conn.Incoming.Timer():
+			if _, err := conn.GetServerConn().WriteTo(conn.Incoming.Get(), conn.ServerAddr); err != nil {
+				return err
+			}
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/tools/proxy/proxy_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/proxy/proxy_test.go
new file mode 100644
index 000000000..d625612d6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/proxy/proxy_test.go
@@ -0,0 +1,503 @@
+package quicproxy
+
+import (
+	"net"
+	"strconv"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPacketQueue(t *testing.T) {
+	q := newQueue()
+
+	getPackets := func() []string {
+		packets := make([]string, 0, len(q.Packets))
+		for _, p := range q.Packets {
+			packets = append(packets, string(p.Raw))
+		}
+		return packets
+	}
+
+	require.Empty(t, getPackets())
+	now := monotime.Now()
+
+	q.Add(packetEntry{Time: now, Raw: []byte("p3")})
+	require.Equal(t, []string{"p3"}, getPackets())
+	q.Add(packetEntry{Time: now.Add(time.Second), Raw: []byte("p4")})
+	require.Equal(t, []string{"p3", "p4"}, getPackets())
+	q.Add(packetEntry{Time: now.Add(-time.Second), Raw: []byte("p1")})
+	require.Equal(t, []string{"p1", "p3", "p4"}, getPackets())
+	q.Add(packetEntry{Time: now.Add(time.Second), Raw: []byte("p5")})
+	require.Equal(t, []string{"p1", "p3", "p4", "p5"}, getPackets())
+	q.Add(packetEntry{Time: now.Add(-time.Second), Raw: []byte("p2")})
+	require.Equal(t, []string{"p1", "p2", "p3", "p4", "p5"}, getPackets())
+}
+
+func newUPDConnLocalhost(t testing.TB) *net.UDPConn {
+	t.Helper()
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.Close() })
+	return conn
+}
+
+func makePacket(t *testing.T, p protocol.PacketNumber, payload []byte) []byte {
+	t.Helper()
+	hdr := wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             protocol.PacketTypeInitial,
+			Version:          protocol.Version1,
+			Length:           4 + protocol.ByteCount(len(payload)),
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef, 0, 0, 0x13, 0x37}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef, 0, 0, 0x13, 0x37}),
+		},
+		PacketNumber:    p,
+		PacketNumberLen: protocol.PacketNumberLen4,
+	}
+	b, err := hdr.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	b = append(b, payload...)
+	return b
+}
+
+func readPacketNumber(t *testing.T, b []byte) protocol.PacketNumber {
+	t.Helper()
+	hdr, data, _, err := wire.ParsePacket(b)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketTypeInitial, hdr.Type)
+	extHdr, err := hdr.ParseExtended(data)
+	require.NoError(t, err)
+	return extHdr.PacketNumber
+}
+
+// Set up a dumb UDP server.
+// In production this would be a QUIC server.
+func runServer(t *testing.T) (*net.UDPAddr, chan []byte) {
+	done := make(chan struct{})
+	t.Cleanup(func() {
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	})
+
+	serverConn := newUPDConnLocalhost(t)
+	serverReceivedPackets := make(chan []byte, 100)
+	go func() {
+		defer close(done)
+		for {
+			buf := make([]byte, protocol.MaxPacketBufferSize)
+			// the ReadFromUDP will error as soon as the UDP conn is closed
+			n, addr, err := serverConn.ReadFromUDP(buf)
+			if err != nil {
+				return
+			}
+			serverReceivedPackets <- buf[:n]
+			// echo the packet
+			if _, err := serverConn.WriteToUDP(buf[:n], addr); err != nil {
+				return
+			}
+		}
+	}()
+
+	return serverConn.LocalAddr().(*net.UDPAddr), serverReceivedPackets
+}
+
+func TestProxyingBackAndForth(t *testing.T) {
+	serverAddr, _ := runServer(t)
+	proxy := Proxy{
+		Conn:       newUPDConnLocalhost(t),
+		ServerAddr: serverAddr,
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+	clientConn, err := net.DialUDP("udp", nil, proxy.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+
+	// send the first packet
+	_, err = clientConn.Write(makePacket(t, 1, []byte("foobar")))
+	require.NoError(t, err)
+	// send the second packet
+	_, err = clientConn.Write(makePacket(t, 2, []byte("decafbad")))
+	require.NoError(t, err)
+
+	buf := make([]byte, 1024)
+	n, err := clientConn.Read(buf)
+	require.NoError(t, err)
+	require.Contains(t, string(buf[:n]), "foobar")
+	n, err = clientConn.Read(buf)
+	require.NoError(t, err)
+	require.Contains(t, string(buf[:n]), "decafbad")
+}
+
+func TestDropIncomingPackets(t *testing.T) {
+	const numPackets = 6
+	serverAddr, serverReceivedPackets := runServer(t)
+	var counter atomic.Int32
+	var fromAddr, toAddr atomic.Pointer[net.Addr]
+	proxy := Proxy{
+		Conn:       newUPDConnLocalhost(t),
+		ServerAddr: serverAddr,
+		DropPacket: func(d Direction, from, to net.Addr, _ []byte) bool {
+			if d != DirectionIncoming {
+				return false
+			}
+			fromAddr.Store(&from)
+			toAddr.Store(&to)
+			return counter.Add(1)%2 == 1
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+	clientConn, err := net.DialUDP("udp", nil, proxy.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+
+	for i := 1; i <= numPackets; i++ {
+		_, err := clientConn.Write(makePacket(t, protocol.PacketNumber(i), []byte("foobar"+strconv.Itoa(i))))
+		require.NoError(t, err)
+	}
+
+	for range numPackets / 2 {
+		select {
+		case <-serverReceivedPackets:
+		case <-time.After(time.Second):
+			t.Fatalf("timeout")
+		}
+	}
+	select {
+	case <-serverReceivedPackets:
+		t.Fatalf("received unexpected packet")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	require.Equal(t, *fromAddr.Load(), clientConn.LocalAddr())
+	require.Equal(t, *toAddr.Load(), serverAddr)
+}
+
+func TestDropOutgoingPackets(t *testing.T) {
+	const numPackets = 6
+	serverAddr, serverReceivedPackets := runServer(t)
+	var counter atomic.Int32
+	var fromAddr, toAddr atomic.Pointer[net.Addr]
+	proxy := Proxy{
+		Conn:       newUPDConnLocalhost(t),
+		ServerAddr: serverAddr,
+		DropPacket: func(d Direction, from, to net.Addr, _ []byte) bool {
+			if d != DirectionOutgoing {
+				return false
+			}
+			fromAddr.Store(&from)
+			toAddr.Store(&to)
+			return counter.Add(1)%2 == 1
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+	clientConn, err := net.DialUDP("udp", nil, proxy.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+
+	clientReceivedPackets := make(chan struct{}, numPackets)
+	// receive the packets echoed by the server on client side
+	go func() {
+		for {
+			buf := make([]byte, protocol.MaxPacketBufferSize)
+			if _, _, err := clientConn.ReadFromUDP(buf); err != nil {
+				return
+			}
+			clientReceivedPackets <- struct{}{}
+		}
+	}()
+
+	for i := 1; i <= numPackets; i++ {
+		_, err := clientConn.Write(makePacket(t, protocol.PacketNumber(i), []byte("foobar"+strconv.Itoa(i))))
+		require.NoError(t, err)
+	}
+
+	for range numPackets / 2 {
+		select {
+		case <-clientReceivedPackets:
+		case <-time.After(time.Second):
+			t.Fatalf("timeout")
+		}
+	}
+	select {
+	case <-clientReceivedPackets:
+		t.Fatalf("received unexpected packet")
+	case <-time.After(100 * time.Millisecond):
+	}
+	require.Len(t, serverReceivedPackets, numPackets)
+
+	require.Equal(t, *fromAddr.Load(), serverAddr)
+	require.Equal(t, *toAddr.Load(), clientConn.LocalAddr())
+}
+
+func TestDelayIncomingPackets(t *testing.T) {
+	const numPackets = 3
+	const delay = 200 * time.Millisecond
+	serverAddr, serverReceivedPackets := runServer(t)
+	var counter atomic.Int32
+	proxy := Proxy{
+		Conn:       newUPDConnLocalhost(t),
+		ServerAddr: serverAddr,
+		DelayPacket: func(d Direction, _, _ net.Addr, _ []byte) time.Duration {
+			// delay packet 1 by 200 ms
+			// delay packet 2 by 400 ms
+			// ...
+			if d == DirectionOutgoing {
+				return 0
+			}
+			p := counter.Add(1)
+			return time.Duration(p) * delay
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+	clientConn, err := net.DialUDP("udp", nil, proxy.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+
+	start := time.Now()
+	for i := 1; i <= numPackets; i++ {
+		_, err := clientConn.Write(makePacket(t, protocol.PacketNumber(i), []byte("foobar"+strconv.Itoa(i))))
+		require.NoError(t, err)
+	}
+
+	for i := 1; i <= numPackets; i++ {
+		select {
+		case data := <-serverReceivedPackets:
+			require.WithinDuration(t, start.Add(time.Duration(i)*delay), time.Now(), delay/2)
+			require.Equal(t, protocol.PacketNumber(i), readPacketNumber(t, data))
+		case <-time.After(time.Second):
+			t.Fatalf("timeout waiting for packet %d", i)
+		}
+	}
+}
+
+func TestPacketReordering(t *testing.T) {
+	const delay = 200 * time.Millisecond
+	expectDelay := func(startTime time.Time, numRTTs int) {
+		expectedReceiveTime := startTime.Add(time.Duration(numRTTs) * delay)
+		now := time.Now()
+		require.True(t, now.After(expectedReceiveTime) || now.Equal(expectedReceiveTime))
+		require.True(t, now.Before(expectedReceiveTime.Add(delay/2)))
+	}
+
+	serverAddr, serverReceivedPackets := runServer(t)
+	var counter atomic.Int32
+	proxy := Proxy{
+		Conn:       newUPDConnLocalhost(t),
+		ServerAddr: serverAddr,
+		DelayPacket: func(d Direction, _, _ net.Addr, _ []byte) time.Duration {
+			// delay packet 1 by 600 ms
+			// delay packet 2 by 400 ms
+			// delay packet 3 by 200 ms
+			if d == DirectionOutgoing {
+				return 0
+			}
+			p := counter.Add(1)
+			return 600*time.Millisecond - time.Duration(p-1)*delay
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+	clientConn, err := net.DialUDP("udp", nil, proxy.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+
+	// send 3 packets
+	start := time.Now()
+	for i := 1; i <= 3; i++ {
+		_, err := clientConn.Write(makePacket(t, protocol.PacketNumber(i), []byte("foobar"+strconv.Itoa(i))))
+		require.NoError(t, err)
+	}
+	for i := 1; i <= 3; i++ {
+		select {
+		case packet := <-serverReceivedPackets:
+			expectDelay(start, i)
+			expectedPacketNumber := protocol.PacketNumber(4 - i) // 3, 2, 1 in reverse order
+			require.Equal(t, expectedPacketNumber, readPacketNumber(t, packet))
+		case <-time.After(time.Second):
+			t.Fatalf("timeout waiting for packet %d", i)
+		}
+	}
+}
+
+func TestConstantDelay(t *testing.T) { // no reordering expected here
+	serverAddr, serverReceivedPackets := runServer(t)
+	proxy := Proxy{
+		Conn:       newUPDConnLocalhost(t),
+		ServerAddr: serverAddr,
+		DelayPacket: func(d Direction, _, _ net.Addr, _ []byte) time.Duration {
+			if d == DirectionOutgoing {
+				return 0
+			}
+			return 100 * time.Millisecond
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+	clientConn, err := net.DialUDP("udp", nil, proxy.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+
+	// send 100 packets
+	for i := range 100 {
+		_, err := clientConn.Write(makePacket(t, protocol.PacketNumber(i), []byte("foobar"+strconv.Itoa(i))))
+		require.NoError(t, err)
+	}
+	require.Eventually(t, func() bool { return len(serverReceivedPackets) == 100 }, 5*time.Second, 10*time.Millisecond)
+	timeout := time.After(5 * time.Second)
+	for i := range 100 {
+		select {
+		case packet := <-serverReceivedPackets:
+			require.Equal(t, protocol.PacketNumber(i), readPacketNumber(t, packet))
+		case <-timeout:
+			t.Fatalf("timeout waiting for packet %d", i)
+		}
+	}
+}
+
+func TestDelayOutgoingPackets(t *testing.T) {
+	const numPackets = 3
+	const delay = 200 * time.Millisecond
+
+	serverAddr, serverReceivedPackets := runServer(t)
+	var counter atomic.Int32
+	proxy := Proxy{
+		Conn:       newUPDConnLocalhost(t),
+		ServerAddr: serverAddr,
+		DelayPacket: func(d Direction, _, _ net.Addr, _ []byte) time.Duration {
+			// delay packet 1 by 200 ms
+			// delay packet 2 by 400 ms
+			// ...
+			if d == DirectionIncoming {
+				return 0
+			}
+			p := counter.Add(1)
+			return time.Duration(p) * delay
+		},
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+	clientConn, err := net.DialUDP("udp", nil, proxy.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+
+	clientReceivedPackets := make(chan []byte, numPackets)
+	// receive the packets echoed by the server on client side
+	go func() {
+		for {
+			buf := make([]byte, protocol.MaxPacketBufferSize)
+			n, _, err := clientConn.ReadFromUDP(buf)
+			if err != nil {
+				return
+			}
+			clientReceivedPackets <- buf[:n]
+		}
+	}()
+
+	start := time.Now()
+	for i := 1; i <= numPackets; i++ {
+		_, err := clientConn.Write(makePacket(t, protocol.PacketNumber(i), []byte("foobar"+strconv.Itoa(i))))
+		require.NoError(t, err)
+	}
+	// the packets should have arrived immediately at the server
+	for range numPackets {
+		select {
+		case <-serverReceivedPackets:
+		case <-time.After(time.Second):
+			t.Fatalf("timeout")
+		}
+	}
+	require.WithinDuration(t, start, time.Now(), delay/2)
+
+	for i := 1; i <= numPackets; i++ {
+		select {
+		case packet := <-clientReceivedPackets:
+			require.Equal(t, protocol.PacketNumber(i), readPacketNumber(t, packet))
+			require.WithinDuration(t, start.Add(time.Duration(i)*delay), time.Now(), delay/2)
+		case <-time.After(time.Second):
+			t.Fatalf("timeout waiting for packet %d", i)
+		}
+	}
+}
+
+func TestProxySwitchConn(t *testing.T) {
+	serverConn := newUPDConnLocalhost(t)
+
+	type packet struct {
+		Data []byte
+		Addr *net.UDPAddr
+	}
+	serverReceivedPackets := make(chan packet, 1)
+	go func() {
+		for {
+			buf := make([]byte, 1000)
+			n, addr, err := serverConn.ReadFromUDP(buf)
+			if err != nil {
+				return
+			}
+			serverReceivedPackets <- packet{Data: buf[:n], Addr: addr}
+		}
+	}()
+
+	proxy := Proxy{
+		Conn:       newUPDConnLocalhost(t),
+		ServerAddr: serverConn.LocalAddr().(*net.UDPAddr),
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	clientConn := newUPDConnLocalhost(t)
+	_, err := clientConn.WriteToUDP([]byte("hello"), proxy.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+	clientConn.SetReadDeadline(time.Now().Add(time.Second))
+
+	var firstConnAddr *net.UDPAddr
+	select {
+	case p := <-serverReceivedPackets:
+		require.Equal(t, "hello", string(p.Data))
+		require.NotEqual(t, clientConn.LocalAddr(), p.Addr)
+		firstConnAddr = p.Addr
+	case <-time.After(time.Second):
+		t.Fatalf("timeout")
+	}
+
+	_, err = serverConn.WriteToUDP([]byte("hi"), firstConnAddr)
+	require.NoError(t, err)
+	buf := make([]byte, 1000)
+	n, addr, err := clientConn.ReadFromUDP(buf)
+	require.NoError(t, err)
+	require.Equal(t, "hi", string(buf[:n]))
+	require.Equal(t, proxy.LocalAddr(), addr)
+
+	newConn := newUPDConnLocalhost(t)
+	require.NoError(t, proxy.SwitchConn(clientConn.LocalAddr().(*net.UDPAddr), newConn))
+
+	_, err = clientConn.WriteToUDP([]byte("foobar"), proxy.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+
+	select {
+	case p := <-serverReceivedPackets:
+		require.Equal(t, "foobar", string(p.Data))
+		require.NotEqual(t, clientConn.LocalAddr(), p.Addr)
+		require.NotEqual(t, firstConnAddr, p.Addr)
+		require.Equal(t, newConn.LocalAddr(), p.Addr)
+	case <-time.After(time.Second):
+		t.Fatalf("timeout")
+	}
+
+	// the old connection doesn't deliver any packets to the client anymore
+	_, err = serverConn.WriteTo([]byte("invalid"), firstConnAddr)
+	require.NoError(t, err)
+	_, err = serverConn.WriteTo([]byte("foobaz"), newConn.LocalAddr())
+	require.NoError(t, err)
+	n, addr, err = clientConn.ReadFromUDP(buf)
+	require.NoError(t, err)
+	require.Equal(t, "foobaz", string(buf[:n])) // "invalid" is not delivered
+	require.Equal(t, proxy.LocalAddr(), addr)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/tools/qlog.go b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/qlog.go
new file mode 100644
index 000000000..a35c33104
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/tools/qlog.go
@@ -0,0 +1,55 @@
+package tools
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	h3qlog "github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+func QlogTracer(logger io.Writer) qlogwriter.Trace {
+	filename := fmt.Sprintf("log_%s_transport.qlog", time.Now().Format("2006-01-02T15:04:05"))
+	fmt.Fprintf(logger, "Creating %s.\n", filename)
+	f, err := os.Create(filename)
+	if err != nil {
+		log.Fatalf("failed to create qlog file: %s", err)
+		return nil
+	}
+	bw := bufio.NewWriter(f)
+	fileSeq := qlogwriter.NewFileSeq(utils.NewBufferedWriteCloser(bw, f))
+	go fileSeq.Run()
+	return fileSeq
+}
+
+func NewQlogConnectionTracer(logger io.Writer) func(ctx context.Context, isClient bool, connID quic.ConnectionID) qlogwriter.Trace {
+	return func(_ context.Context, isClient bool, connID quic.ConnectionID) qlogwriter.Trace {
+		pers := "server"
+		if isClient {
+			pers = "client"
+		}
+		filename := fmt.Sprintf("log_%s_%s.qlog", connID, pers)
+		fmt.Fprintf(logger, "Creating %s.\n", filename)
+		f, err := os.Create(filename)
+		if err != nil {
+			log.Fatalf("failed to create qlog file: %s", err)
+			return nil
+		}
+		fileSeq := qlogwriter.NewConnectionFileSeq(
+			utils.NewBufferedWriteCloser(bufio.NewWriter(f), f),
+			isClient,
+			connID,
+			[]string{qlog.EventSchema, h3qlog.EventSchema},
+		)
+		go fileSeq.Run()
+		return fileSeq
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/versionnegotiation/handshake_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/versionnegotiation/handshake_test.go
new file mode 100644
index 000000000..c98645e7a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/versionnegotiation/handshake_test.go
@@ -0,0 +1,192 @@
+package versionnegotiation
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestServerSupportsMoreVersionsThanClient(t *testing.T) {
+	supportedVersions := append([]quic.Version{}, protocol.SupportedVersions...)
+	protocol.SupportedVersions = append(protocol.SupportedVersions, []protocol.Version{7, 8, 9, 10}...)
+	defer func() { protocol.SupportedVersions = supportedVersions }()
+
+	var serverEventTracer events.Recorder
+	serverConfig := &quic.Config{
+		Versions: []protocol.Version{7, 8, protocol.SupportedVersions[0], 9},
+		Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+			return &events.Trace{Recorder: &serverEventTracer}
+		},
+	}
+	server, err := quic.ListenAddr("localhost:0", getTLSConfig(), serverConfig)
+	require.NoError(t, err)
+	defer server.Close()
+
+	var clientEventTracer events.Recorder
+	conn, err := quic.DialAddr(
+		context.Background(),
+		fmt.Sprintf("localhost:%d", server.Addr().(*net.UDPAddr).Port),
+		getTLSClientConfig(),
+		maybeAddQLOGTracer(&quic.Config{Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+			return &events.Trace{Recorder: &clientEventTracer}
+		}}),
+	)
+	require.NoError(t, err)
+
+	expectedVersion := protocol.SupportedVersions[0]
+	sconn, err := server.Accept(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, expectedVersion, sconn.ConnectionState().Version)
+
+	require.Equal(t, expectedVersion, conn.ConnectionState().Version)
+	require.NoError(t, conn.CloseWithError(0, ""))
+
+	select {
+	case <-sconn.Context().Done():
+		// Expected behavior
+	case <-time.After(5 * time.Second):
+		t.Fatal("Timeout waiting for connection to close")
+	}
+
+	require.Empty(t, clientEventTracer.Events(qlog.VersionNegotiationReceived{}))
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.VersionInformation{
+				ClientVersions: protocol.SupportedVersions,
+				ChosenVersion:  expectedVersion,
+			},
+		},
+		clientEventTracer.Events(qlog.VersionInformation{}),
+	)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.VersionInformation{
+				ServerVersions: serverConfig.Versions,
+				ChosenVersion:  expectedVersion,
+			},
+		},
+		serverEventTracer.Events(qlog.VersionInformation{}),
+	)
+}
+
+func TestClientSupportsMoreVersionsThanServer(t *testing.T) {
+	supportedVersions := append([]quic.Version{}, protocol.SupportedVersions...)
+	protocol.SupportedVersions = append(protocol.SupportedVersions, []protocol.Version{7, 8, 9, 10}...)
+	defer func() { protocol.SupportedVersions = supportedVersions }()
+
+	expectedVersion := protocol.SupportedVersions[0]
+	// The server doesn't support the highest supported version, which is the first one the client will try,
+	// but it supports a bunch of versions that the client doesn't speak
+	var serverEventTracer events.Recorder
+	serverConfig := &quic.Config{
+		Versions: supportedVersions,
+		Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+			return &events.Trace{Recorder: &serverEventTracer}
+		},
+	}
+	server, err := quic.ListenAddr("localhost:0", getTLSConfig(), serverConfig)
+	require.NoError(t, err)
+	defer server.Close()
+
+	clientVersions := []protocol.Version{7, 8, 9, protocol.SupportedVersions[0], 10}
+	var clientEventTracer events.Recorder
+	conn, err := quic.DialAddr(
+		context.Background(),
+		fmt.Sprintf("localhost:%d", server.Addr().(*net.UDPAddr).Port),
+		getTLSClientConfig(),
+		maybeAddQLOGTracer(&quic.Config{
+			Versions: clientVersions,
+			Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+				return &events.Trace{Recorder: &clientEventTracer}
+			},
+		}),
+	)
+	require.NoError(t, err)
+
+	sconn, err := server.Accept(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, expectedVersion, sconn.ConnectionState().Version)
+
+	require.Equal(t, protocol.SupportedVersions[0], conn.ConnectionState().Version)
+	require.NoError(t, conn.CloseWithError(0, ""))
+
+	select {
+	case <-sconn.Context().Done():
+		// Expected behavior
+	case <-time.After(5 * time.Second):
+		t.Fatal("Timeout waiting for connection to close")
+	}
+
+	require.Len(t, clientEventTracer.Events(qlog.VersionNegotiationReceived{}), 1)
+	supportedVersionInclGreased := clientEventTracer.Events(qlog.VersionNegotiationReceived{})[0].(qlog.VersionNegotiationReceived).SupportedVersions
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.VersionInformation{
+				ClientVersions: clientVersions,
+				ServerVersions: supportedVersionInclGreased,
+				ChosenVersion:  expectedVersion,
+			},
+		},
+		clientEventTracer.Events(qlog.VersionInformation{}),
+	)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.VersionInformation{
+				ServerVersions: supportedVersions,
+				ChosenVersion:  expectedVersion,
+			},
+		},
+		serverEventTracer.Events(qlog.VersionInformation{}),
+	)
+}
+
+func TestServerDisablesVersionNegotiation(t *testing.T) {
+	// The server doesn't support the highest supported version, which is the first one the client will try,
+	// but it supports a bunch of versions that the client doesn't speak
+	var serverEventTracer events.Recorder
+	serverConfig := &quic.Config{
+		Versions: []protocol.Version{quic.Version1},
+		Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+			return &events.Trace{Recorder: &serverEventTracer}
+		},
+	}
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	require.NoError(t, err)
+	tr := &quic.Transport{
+		Conn:                             conn,
+		DisableVersionNegotiationPackets: true,
+	}
+	ln, err := tr.Listen(getTLSConfig(), serverConfig)
+	require.NoError(t, err)
+	defer ln.Close()
+
+	var clientEventTracer events.Recorder
+	_, err = quic.DialAddr(
+		context.Background(),
+		fmt.Sprintf("localhost:%d", conn.LocalAddr().(*net.UDPAddr).Port),
+		getTLSClientConfig(),
+		maybeAddQLOGTracer(&quic.Config{
+			Versions: []protocol.Version{quic.Version2},
+			Tracer: func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
+				return &events.Trace{Recorder: &clientEventTracer}
+			},
+			HandshakeIdleTimeout: 100 * time.Millisecond,
+		}),
+	)
+	require.Error(t, err)
+	nerr, ok := errors.AsType[net.Error](err)
+	require.True(t, ok)
+	require.True(t, nerr.Timeout())
+	require.Empty(t, clientEventTracer.Events(qlog.VersionNegotiationReceived{}))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/versionnegotiation/rtt_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/versionnegotiation/rtt_test.go
new file mode 100644
index 000000000..0d6c18342
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/versionnegotiation/rtt_test.go
@@ -0,0 +1,58 @@
+package versionnegotiation
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	quicproxy "github.com/quic-go/quic-go/integrationtests/tools/proxy"
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+const rtt = 400 * time.Millisecond
+
+func expectDurationInRTTs(t *testing.T, startTime time.Time, num int) {
+	t.Helper()
+	testDuration := time.Since(startTime)
+	rtts := float32(testDuration) / float32(rtt)
+	require.GreaterOrEqual(t, rtts, float32(num))
+	require.Less(t, rtts, float32(num+1))
+}
+
+func TestVersionNegotiationFailure(t *testing.T) {
+	if len(protocol.SupportedVersions) == 1 {
+		t.Fatal("Test requires at least 2 supported versions.")
+	}
+
+	serverConfig := &quic.Config{}
+	serverConfig.Versions = protocol.SupportedVersions[:1]
+	ln, err := quic.ListenAddr("localhost:0", getTLSConfig(), serverConfig)
+	require.NoError(t, err)
+	defer ln.Close()
+
+	proxyConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	defer proxyConn.Close()
+	// start the proxy
+	proxy := quicproxy.Proxy{
+		Conn:        proxyConn,
+		ServerAddr:  ln.Addr().(*net.UDPAddr),
+		DelayPacket: func(quicproxy.Direction, net.Addr, net.Addr, []byte) time.Duration { return rtt / 2 },
+	}
+	require.NoError(t, proxy.Start())
+	defer proxy.Close()
+
+	startTime := time.Now()
+	_, err = quic.DialAddr(
+		context.Background(),
+		proxy.LocalAddr().String(),
+		getTLSClientConfig(),
+		maybeAddQLOGTracer(&quic.Config{Versions: protocol.SupportedVersions[1:2]}),
+	)
+	require.Error(t, err)
+	expectDurationInRTTs(t, startTime, 1)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/integrationtests/versionnegotiation/test_helper_test.go b/electron/native/private-transport/third_party/quic-go/integrationtests/versionnegotiation/test_helper_test.go
new file mode 100644
index 000000000..9b9a5814b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/integrationtests/versionnegotiation/test_helper_test.go
@@ -0,0 +1,111 @@
+package versionnegotiation
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"flag"
+	"os"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/integrationtests/tools"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+var (
+	enableQlog      bool
+	tlsConfig       *tls.Config
+	tlsClientConfig *tls.Config
+)
+
+func init() {
+	flag.BoolVar(&enableQlog, "qlog", false, "enable qlog")
+
+	ca, caPrivateKey, err := tools.GenerateCA()
+	if err != nil {
+		panic(err)
+	}
+	leafCert, leafPrivateKey, err := tools.GenerateLeafCert(ca, caPrivateKey)
+	if err != nil {
+		panic(err)
+	}
+	tlsConfig = &tls.Config{
+		Certificates: []tls.Certificate{{
+			Certificate: [][]byte{leafCert.Raw},
+			PrivateKey:  leafPrivateKey,
+		}},
+		NextProtos: []string{tools.ALPN},
+	}
+
+	root := x509.NewCertPool()
+	root.AddCert(ca)
+	tlsClientConfig = &tls.Config{
+		ServerName: "localhost",
+		RootCAs:    root,
+		NextProtos: []string{tools.ALPN},
+	}
+}
+
+func getTLSConfig() *tls.Config       { return tlsConfig }
+func getTLSClientConfig() *tls.Config { return tlsClientConfig }
+
+type multiplexedRecorder struct {
+	Recorders []qlogwriter.Recorder
+}
+
+var _ qlogwriter.Recorder = &multiplexedRecorder{}
+
+func (r *multiplexedRecorder) Close() error {
+	for _, recorder := range r.Recorders {
+		recorder.Close()
+	}
+	return nil
+}
+
+func (r *multiplexedRecorder) RecordEvent(ev qlogwriter.Event) {
+	for _, recorder := range r.Recorders {
+		recorder.RecordEvent(ev)
+	}
+}
+
+type multiplexedTrace struct {
+	Traces []qlogwriter.Trace
+}
+
+var _ qlogwriter.Trace = &multiplexedTrace{}
+
+func (t *multiplexedTrace) SupportsSchemas(schema string) bool { return true }
+
+func (t *multiplexedTrace) AddProducer() qlogwriter.Recorder {
+	recorders := make([]qlogwriter.Recorder, 0, len(t.Traces))
+	for _, tr := range t.Traces {
+		recorders = append(recorders, tr.AddProducer())
+	}
+	return &multiplexedRecorder{Recorders: recorders}
+}
+
+func maybeAddQLOGTracer(c *quic.Config) *quic.Config {
+	if c == nil {
+		c = &quic.Config{}
+	}
+	if !enableQlog {
+		return c
+	}
+	qlogger := tools.NewQlogConnectionTracer(os.Stdout)
+	if c.Tracer == nil {
+		c.Tracer = qlogger
+	} else if qlogger != nil {
+		origTracer := c.Tracer
+		c.Tracer = func(ctx context.Context, p bool, connID quic.ConnectionID) qlogwriter.Trace {
+			var traces []qlogwriter.Trace
+			if origTracer != nil {
+				traces = append(traces, origTracer(ctx, p, connID))
+			}
+			if qlogger != nil {
+				traces = append(traces, qlogger(ctx, p, connID))
+			}
+			return &multiplexedTrace{Traces: traces}
+		}
+	}
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/interface.go b/electron/native/private-transport/third_party/quic-go/interface.go
new file mode 100644
index 000000000..ad2bb9913
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/interface.go
@@ -0,0 +1,222 @@
+package quic
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"net"
+	"slices"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+// The StreamID is the ID of a QUIC stream.
+type StreamID = protocol.StreamID
+
+// A Version is a QUIC version number.
+type Version = protocol.Version
+
+const (
+	// Version1 is RFC 9000
+	Version1 = protocol.Version1
+	// Version2 is RFC 9369
+	Version2 = protocol.Version2
+)
+
+// SupportedVersions returns the support versions, sorted in descending order of preference.
+func SupportedVersions() []Version {
+	// clone the slice to prevent the caller from modifying the slice
+	return slices.Clone(protocol.SupportedVersions)
+}
+
+// A ClientToken is a token received by the client.
+// It can be used to skip address validation on future connection attempts.
+type ClientToken struct {
+	data []byte
+	rtt  time.Duration
+}
+
+type TokenStore interface {
+	// Pop searches for a ClientToken associated with the given key.
+	// Since tokens are not supposed to be reused, it must remove the token from the cache.
+	// It returns nil when no token is found.
+	Pop(key string) (token *ClientToken)
+
+	// Put adds a token to the cache with the given key. It might get called
+	// multiple times in a connection.
+	Put(key string, token *ClientToken)
+}
+
+// Err0RTTRejected can be returned by methods such as:
+//   - [Conn.OpenStream], [Conn.OpenStreamSync], [Conn.OpenUniStream], and [Conn.OpenUniStreamSync]
+//   - [Conn.AcceptStream] and [Conn.AcceptUniStream]
+//   - [Stream.Read] and [Stream.Write]
+//
+// when the server rejects a 0-RTT connection attempt.
+var Err0RTTRejected = errors.New("0-RTT rejected")
+
+// ErrWouldBlock is returned by [SendStream.TryWriteAll] if the entire slice can't be queued immediately.
+var ErrWouldBlock = errors.New("operation would block")
+
+// ErrWriteLimitReached is returned by [SendStream.WriteWithLimit] when its limiter prevents accepting the entire slice.
+var ErrWriteLimitReached = errors.New("write limit reached")
+
+// QUICVersionContextKey can be used to find out the QUIC version of a TLS handshake from the
+// context returned by [tls.ClientHelloInfo.Context].
+var QUICVersionContextKey = handshake.QUICVersionContextKey
+
+// StatelessResetKey is a key used to derive stateless reset tokens.
+type StatelessResetKey [32]byte
+
+// TokenGeneratorKey is a key used to encrypt session resumption tokens.
+type TokenGeneratorKey = handshake.TokenProtectorKey
+
+// A ConnectionID is a QUIC Connection ID, as defined in RFC 9000.
+// It is not able to handle QUIC Connection IDs longer than 20 bytes,
+// as they are allowed by RFC 8999.
+type ConnectionID = protocol.ConnectionID
+
+// ConnectionIDFromBytes interprets b as a [ConnectionID]. It panics if b is
+// longer than 20 bytes.
+func ConnectionIDFromBytes(b []byte) ConnectionID {
+	return protocol.ParseConnectionID(b)
+}
+
+// A ConnectionIDGenerator allows the application to take control over the generation of Connection IDs.
+// Connection IDs generated by an implementation must be of constant length.
+type ConnectionIDGenerator interface {
+	// GenerateConnectionID generates a new Connection ID.
+	// Generated Connection IDs must be unique and observers should not be able to correlate two Connection IDs.
+	GenerateConnectionID() (ConnectionID, error)
+
+	// ConnectionIDLen returns the length of Connection IDs generated by this implementation.
+	// Implementations must return constant-length Connection IDs with lengths between 0 and 20 bytes.
+	// A length of 0 can only be used when an endpoint doesn't need to multiplex connections during migration.
+	ConnectionIDLen() int
+}
+
+// Config contains all configuration data needed for a QUIC server or client.
+type Config struct {
+	// GetConfigForClient is called for incoming connections.
+	// If the error is not nil, the connection attempt is refused.
+	GetConfigForClient func(info *ClientInfo) (*Config, error)
+	// The QUIC versions that can be negotiated.
+	// If not set, it uses all versions available.
+	Versions []Version
+	// HandshakeIdleTimeout is the idle timeout before completion of the handshake.
+	// If we don't receive any packet from the peer within this time, the connection attempt is aborted.
+	// Additionally, if the handshake doesn't complete in twice this time, the connection attempt is also aborted.
+	// If this value is zero, the timeout is set to 5 seconds.
+	HandshakeIdleTimeout time.Duration
+	// MaxIdleTimeout is the maximum duration that may pass without any incoming network activity.
+	// The actual value for the idle timeout is the minimum of this value and the peer's.
+	// This value only applies after the handshake has completed.
+	// If the timeout is exceeded, the connection is closed.
+	// If this value is zero, the timeout is set to 30 seconds.
+	MaxIdleTimeout time.Duration
+	// The TokenStore stores tokens received from the server.
+	// Tokens are used to skip address validation on future connection attempts.
+	// The key used to store tokens is the ServerName from the tls.Config, if set
+	// otherwise the token is associated with the server's IP address.
+	TokenStore TokenStore
+	// InitialStreamReceiveWindow is the initial size of the stream-level flow control window for receiving data.
+	// If the application is consuming data quickly enough, the flow control auto-tuning algorithm
+	// will increase the window up to MaxStreamReceiveWindow.
+	// If this value is zero, it will default to 512 KB.
+	// Values larger than the maximum varint (quicvarint.Max) will be clipped to that value.
+	InitialStreamReceiveWindow uint64
+	// MaxStreamReceiveWindow is the maximum stream-level flow control window for receiving data.
+	// If this value is zero, it will default to 6 MB.
+	// Values larger than the maximum varint (quicvarint.Max) will be clipped to that value.
+	MaxStreamReceiveWindow uint64
+	// InitialConnectionReceiveWindow is the initial size of the stream-level flow control window for receiving data.
+	// If the application is consuming data quickly enough, the flow control auto-tuning algorithm
+	// will increase the window up to MaxConnectionReceiveWindow.
+	// If this value is zero, it will default to 512 KB.
+	// Values larger than the maximum varint (quicvarint.Max) will be clipped to that value.
+	InitialConnectionReceiveWindow uint64
+	// MaxConnectionReceiveWindow is the connection-level flow control window for receiving data.
+	// If this value is zero, it will default to 15 MB.
+	// Values larger than the maximum varint (quicvarint.Max) will be clipped to that value.
+	MaxConnectionReceiveWindow uint64
+	// AllowConnectionWindowIncrease is called every time the connection flow controller attempts
+	// to increase the connection flow control window.
+	// If set, the caller can prevent an increase of the window. Typically, it would do so to
+	// limit the memory usage.
+	// To avoid deadlocks, it is not valid to call other functions on the connection or on streams
+	// in this callback.
+	AllowConnectionWindowIncrease func(conn *Conn, delta uint64) bool
+	// MaxIncomingStreams is the maximum number of concurrent bidirectional streams that a peer is allowed to open.
+	// If not set, it will default to 100.
+	// If set to a negative value, it doesn't allow any bidirectional streams.
+	// Values larger than 2^60 will be clipped to that value.
+	MaxIncomingStreams int64
+	// MaxIncomingUniStreams is the maximum number of concurrent unidirectional streams that a peer is allowed to open.
+	// If not set, it will default to 100.
+	// If set to a negative value, it doesn't allow any unidirectional streams.
+	// Values larger than 2^60 will be clipped to that value.
+	MaxIncomingUniStreams int64
+	// KeepAlivePeriod defines whether this peer will periodically send a packet to keep the connection alive.
+	// If set to 0, then no keep alive is sent. Otherwise, the keep alive is sent on that period (or at most
+	// every half of MaxIdleTimeout, whichever is smaller).
+	KeepAlivePeriod time.Duration
+	// InitialPacketSize is the initial size (and the lower limit) for packets sent.
+	// Under most circumstances, it is not necessary to manually set this value,
+	// since path MTU discovery quickly finds the path's MTU.
+	// If set too high, the path might not support packets of that size, leading to a timeout of the QUIC handshake.
+	// Values below 1200 are invalid.
+	InitialPacketSize uint16
+	// DisablePathMTUDiscovery disables Path MTU Discovery (RFC 8899).
+	// This allows the sending of QUIC packets that fully utilize the available MTU of the path.
+	// Path MTU discovery is only available on systems that allow setting of the Don't Fragment (DF) bit.
+	DisablePathMTUDiscovery bool
+	// Allow0RTT allows the application to decide if a 0-RTT connection attempt should be accepted.
+	// Only valid for the server.
+	Allow0RTT bool
+	// Enable QUIC datagram support (RFC 9221).
+	EnableDatagrams bool
+	// Enable QUIC Stream Resets with Partial Delivery.
+	// See https://datatracker.ietf.org/doc/html/draft-ietf-quic-reliable-stream-reset-09.
+	EnableStreamResetPartialDelivery bool
+
+	Tracer func(ctx context.Context, isClient bool, connID ConnectionID) qlogwriter.Trace
+}
+
+// ClientInfo contains information about an incoming connection attempt.
+type ClientInfo struct {
+	// RemoteAddr is the remote address on the Initial packet.
+	// Unless AddrVerified is set, the address is not yet verified, and could be a spoofed IP address.
+	RemoteAddr net.Addr
+	// AddrVerified reports whether the remote address was verified by a valid address validation token,
+	// including a token received in a NEW_TOKEN frame.
+	// The Retry mechanism costs one network roundtrip and is only used when
+	// [Transport.VerifySourceAddress] requests it.
+	AddrVerified bool
+}
+
+// ConnectionState records basic details about a QUIC connection.
+type ConnectionState struct {
+	// TLS contains information about the TLS connection state, incl. the tls.ConnectionState.
+	TLS tls.ConnectionState
+	// SupportsDatagrams indicates support for QUIC datagrams (RFC 9221).
+	SupportsDatagrams struct {
+		// Remote is true if the peer advertised datagram support.
+		// Local is true if datagram support was enabled via Config.EnableDatagrams.
+		Remote, Local bool
+	}
+	// SupportsStreamResetPartialDelivery indicates support for QUIC Stream Resets with Partial Delivery.
+	SupportsStreamResetPartialDelivery struct {
+		// Remote is true if the peer advertised support.
+		// Local is true if support was enabled via Config.EnableStreamResetPartialDelivery.
+		Remote, Local bool
+	}
+	// Used0RTT says if 0-RTT resumption was used.
+	Used0RTT bool
+	// Version is the QUIC version of the QUIC connection.
+	Version Version
+	// GSO says if generic segmentation offload is used.
+	GSO bool
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ack_eliciting.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ack_eliciting.go
new file mode 100644
index 000000000..8d8436123
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ack_eliciting.go
@@ -0,0 +1,33 @@
+package ackhandler
+
+import "github.com/quic-go/quic-go/internal/wire"
+
+// IsFrameTypeAckEliciting returns true if the frame is ack-eliciting.
+func IsFrameTypeAckEliciting(t wire.FrameType) bool {
+	//nolint:exhaustive // The default case catches the rest.
+	switch t {
+	case wire.FrameTypeAck, wire.FrameTypeAckECN:
+		return false
+	case wire.FrameTypeConnectionClose, wire.FrameTypeApplicationClose:
+		return false
+	default:
+		return true
+	}
+}
+
+// IsFrameAckEliciting returns true if the frame is ack-eliciting.
+func IsFrameAckEliciting(f wire.Frame) bool {
+	_, isAck := f.(*wire.AckFrame)
+	_, isConnectionClose := f.(*wire.ConnectionCloseFrame)
+	return !isAck && !isConnectionClose
+}
+
+// HasAckElicitingFrames returns true if at least one frame is ack-eliciting.
+func HasAckElicitingFrames(fs []Frame) bool {
+	for _, f := range fs {
+		if IsFrameAckEliciting(f.Frame) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ack_eliciting_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ack_eliciting_test.go
new file mode 100644
index 000000000..7bb839c3a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ack_eliciting_test.go
@@ -0,0 +1,74 @@
+package ackhandler
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsFrameTypeAckEliciting(t *testing.T) {
+	testCases := map[wire.FrameType]bool{
+		wire.FrameTypePing:               true,
+		wire.FrameTypeAck:                false,
+		wire.FrameTypeAckECN:             false,
+		wire.FrameTypeResetStream:        true,
+		wire.FrameTypeStopSending:        true,
+		wire.FrameTypeCrypto:             true,
+		wire.FrameTypeNewToken:           true,
+		wire.FrameType(0x08):             true,
+		wire.FrameType(0x09):             true,
+		wire.FrameType(0x0a):             true,
+		wire.FrameType(0x0b):             true,
+		wire.FrameType(0x0c):             true,
+		wire.FrameType(0x0d):             true,
+		wire.FrameType(0x0e):             true,
+		wire.FrameType(0x0f):             true,
+		wire.FrameTypeMaxData:            true,
+		wire.FrameTypeMaxStreamData:      true,
+		wire.FrameTypeBidiMaxStreams:     true,
+		wire.FrameTypeUniMaxStreams:      true,
+		wire.FrameTypeDataBlocked:        true,
+		wire.FrameTypeStreamDataBlocked:  true,
+		wire.FrameTypeBidiStreamBlocked:  true,
+		wire.FrameTypeUniStreamBlocked:   true,
+		wire.FrameTypeNewConnectionID:    true,
+		wire.FrameTypeRetireConnectionID: true,
+		wire.FrameTypePathChallenge:      true,
+		wire.FrameTypePathResponse:       true,
+		wire.FrameTypeConnectionClose:    false,
+		wire.FrameTypeApplicationClose:   false,
+		wire.FrameTypeHandshakeDone:      true,
+		wire.FrameTypeResetStreamAt:      true,
+		wire.FrameTypeDatagramNoLength:   true,
+		wire.FrameTypeDatagramWithLength: true,
+		wire.FrameTypeAckFrequency:       true,
+		wire.FrameTypeImmediateAck:       true,
+	}
+
+	for ft, expected := range testCases {
+		require.Equal(t, expected, IsFrameTypeAckEliciting(ft), "unexpected result for frame type 0x%x", ft)
+	}
+}
+
+func TestAckElicitingFrames(t *testing.T) {
+	testCases := map[wire.Frame]bool{
+		&wire.AckFrame{}:             false,
+		&wire.ConnectionCloseFrame{}: false,
+		&wire.DataBlockedFrame{}:     true,
+		&wire.PingFrame{}:            true,
+		&wire.ResetStreamFrame{}:     true,
+		&wire.StreamFrame{}:          true,
+		&wire.DatagramFrame{}:        true,
+		&wire.MaxDataFrame{}:         true,
+		&wire.MaxStreamDataFrame{}:   true,
+		&wire.StopSendingFrame{}:     true,
+		&wire.AckFrequencyFrame{}:    true,
+		&wire.ImmediateAckFrame{}:    true,
+	}
+
+	for f, expected := range testCases {
+		require.Equal(t, expected, IsFrameAckEliciting(f))
+		require.Equal(t, expected, HasAckElicitingFrames([]Frame{{Frame: f}}))
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ecn.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ecn.go
new file mode 100644
index 000000000..123d3a341
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ecn.go
@@ -0,0 +1,340 @@
+package ackhandler
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+type ecnState uint8
+
+const (
+	ecnStateInitial ecnState = iota
+	ecnStateTesting
+	ecnStateUnknown
+	ecnStateCapable
+	ecnStateFailed
+)
+
+const (
+	// ecnFailedNoECNCounts is emitted when an ACK acknowledges ECN-marked packets,
+	// but doesn't contain any ECN counts
+	ecnFailedNoECNCounts = "ACK doesn't contain ECN marks"
+	// ecnFailedDecreasedECNCounts is emitted when an ACK frame decreases ECN counts
+	ecnFailedDecreasedECNCounts = "ACK decreases ECN counts"
+	// ecnFailedLostAllTestingPackets is emitted when all ECN testing packets are declared lost
+	ecnFailedLostAllTestingPackets = "all ECN testing packets declared lost"
+	// ecnFailedMoreECNCountsThanSent is emitted when an ACK contains more ECN counts than ECN-marked packets were sent
+	ecnFailedMoreECNCountsThanSent = "ACK contains more ECN counts than ECN-marked packets sent"
+	// ecnFailedTooFewECNCounts is emitted when an ACK contains fewer ECN counts than it acknowledges packets
+	ecnFailedTooFewECNCounts = "ACK contains fewer new ECN counts than acknowledged ECN-marked packets"
+	// ecnFailedManglingDetected is emitted when the path marks all ECN-marked packets as CE
+	ecnFailedManglingDetected = "ECN mangling detected"
+)
+
+// must fit into an uint8, otherwise numSentTesting and numLostTesting must have a larger type
+const numECNTestingPackets = 10
+
+type ecnHandler interface {
+	SentPacket(protocol.PacketNumber, protocol.ECN)
+	Mode() protocol.ECN
+	HandleNewlyAcked(packets []packetWithPacketNumber, ect0, ect1, ecnce int64) (congested bool)
+	LostPacket(protocol.PacketNumber)
+}
+
+// The ecnTracker performs ECN validation of a path.
+// Once failed, it doesn't do any re-validation of the path.
+// It is designed only work for 1-RTT packets, it doesn't handle multiple packet number spaces.
+// In order to avoid revealing any internal state to on-path observers,
+// callers should make sure to start using ECN (i.e. calling Mode) for the very first 1-RTT packet sent.
+// The validation logic implemented here strictly follows the algorithm described in RFC 9000 section 13.4.2 and A.4.
+type ecnTracker struct {
+	state                          ecnState
+	numSentTesting, numLostTesting uint8
+
+	firstTestingPacket protocol.PacketNumber
+	lastTestingPacket  protocol.PacketNumber
+	firstCapablePacket protocol.PacketNumber
+
+	numSentECT0, numSentECT1                  int64
+	numAckedECT0, numAckedECT1, numAckedECNCE int64
+
+	qlogger qlogwriter.Recorder
+	logger  utils.Logger
+}
+
+var _ ecnHandler = &ecnTracker{}
+
+func newECNTracker(logger utils.Logger, qlogger qlogwriter.Recorder) *ecnTracker {
+	return &ecnTracker{
+		firstTestingPacket: protocol.InvalidPacketNumber,
+		lastTestingPacket:  protocol.InvalidPacketNumber,
+		firstCapablePacket: protocol.InvalidPacketNumber,
+		state:              ecnStateInitial,
+		logger:             logger,
+		qlogger:            qlogger,
+	}
+}
+
+func (e *ecnTracker) SentPacket(pn protocol.PacketNumber, ecn protocol.ECN) {
+	//nolint:exhaustive // These are the only ones we need to take care of.
+	switch ecn {
+	case protocol.ECNNon:
+		return
+	case protocol.ECT0:
+		e.numSentECT0++
+	case protocol.ECT1:
+		e.numSentECT1++
+	case protocol.ECNUnsupported:
+		if e.state != ecnStateFailed {
+			panic("didn't expect ECN to be unsupported")
+		}
+	default:
+		panic(fmt.Sprintf("sent packet with unexpected ECN marking: %s", ecn))
+	}
+
+	if e.state == ecnStateCapable && e.firstCapablePacket == protocol.InvalidPacketNumber {
+		e.firstCapablePacket = pn
+	}
+
+	if e.state != ecnStateTesting {
+		return
+	}
+
+	e.numSentTesting++
+	if e.firstTestingPacket == protocol.InvalidPacketNumber {
+		e.firstTestingPacket = pn
+	}
+	if e.numSentECT0+e.numSentECT1 >= numECNTestingPackets {
+		if e.qlogger != nil {
+			e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+				State: qlog.ECNStateUnknown,
+			})
+		}
+		e.state = ecnStateUnknown
+		e.lastTestingPacket = pn
+	}
+}
+
+func (e *ecnTracker) Mode() protocol.ECN {
+	switch e.state {
+	case ecnStateInitial:
+		if e.qlogger != nil {
+			e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+				State: qlog.ECNStateTesting,
+			})
+		}
+		e.state = ecnStateTesting
+		return e.Mode()
+	case ecnStateTesting, ecnStateCapable:
+		return protocol.ECT0
+	case ecnStateUnknown, ecnStateFailed:
+		return protocol.ECNNon
+	default:
+		panic(fmt.Sprintf("unknown ECN state: %d", e.state))
+	}
+}
+
+func (e *ecnTracker) LostPacket(pn protocol.PacketNumber) {
+	if e.state != ecnStateTesting && e.state != ecnStateUnknown {
+		return
+	}
+	if !e.isTestingPacket(pn) {
+		return
+	}
+	e.numLostTesting++
+	// Only proceed if we have sent all 10 testing packets.
+	if e.state != ecnStateUnknown {
+		return
+	}
+	if e.numLostTesting >= e.numSentTesting {
+		e.logger.Debugf("Disabling ECN. All testing packets were lost.")
+		if e.qlogger != nil {
+			e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+				State:   qlog.ECNStateFailed,
+				Trigger: ecnFailedLostAllTestingPackets,
+			})
+		}
+		e.state = ecnStateFailed
+		return
+	}
+	// Path validation also fails if some testing packets are lost, and all other testing packets where CE-marked
+	e.failIfMangled()
+}
+
+// HandleNewlyAcked handles the ECN counts on an ACK frame.
+// It must only be called for ACK frames that increase the largest acknowledged packet number,
+// see section 13.4.2.1 of RFC 9000.
+func (e *ecnTracker) HandleNewlyAcked(packets []packetWithPacketNumber, ect0, ect1, ecnce int64) (congested bool) {
+	if e.state == ecnStateFailed {
+		return false
+	}
+
+	// ECN validation can fail if the received total count for either ECT(0) or ECT(1) exceeds
+	// the total number of packets sent with each corresponding ECT codepoint.
+	if ect0 > e.numSentECT0 || ect1 > e.numSentECT1 {
+		e.logger.Debugf("Disabling ECN. Received more ECT(0) / ECT(1) acknowledgements than packets sent.")
+		if e.qlogger != nil {
+			e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+				State:   qlog.ECNStateFailed,
+				Trigger: ecnFailedMoreECNCountsThanSent,
+			})
+		}
+		e.state = ecnStateFailed
+		return false
+	}
+
+	// Count ECT0 and ECT1 marks that we used when sending the packets that are now being acknowledged.
+	var ackedECT0, ackedECT1 int64
+	for _, p := range packets {
+		//nolint:exhaustive // We only ever send ECT(0) and ECT(1).
+		switch e.ecnMarking(p.PacketNumber) {
+		case protocol.ECT0:
+			ackedECT0++
+		case protocol.ECT1:
+			ackedECT1++
+		}
+	}
+
+	// If an ACK frame newly acknowledges a packet that the endpoint sent with either the ECT(0) or ECT(1)
+	// codepoint set, ECN validation fails if the corresponding ECN counts are not present in the ACK frame.
+	// This check detects:
+	// * paths that bleach all ECN marks, and
+	// * peers that don't report any ECN counts
+	if (ackedECT0 > 0 || ackedECT1 > 0) && ect0 == 0 && ect1 == 0 && ecnce == 0 {
+		e.logger.Debugf("Disabling ECN. ECN-marked packet acknowledged, but no ECN counts on ACK frame.")
+		if e.qlogger != nil {
+			e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+				State:   qlog.ECNStateFailed,
+				Trigger: ecnFailedNoECNCounts,
+			})
+		}
+		e.state = ecnStateFailed
+		return false
+	}
+
+	// Determine the increase in ECT0, ECT1 and ECNCE marks
+	newECT0 := ect0 - e.numAckedECT0
+	newECT1 := ect1 - e.numAckedECT1
+	newECNCE := ecnce - e.numAckedECNCE
+
+	// We're only processing ACKs that increase the Largest Acked.
+	// Therefore, the ECN counters should only ever increase.
+	// Any decrease means that the peer's counting logic is broken.
+	if newECT0 < 0 || newECT1 < 0 || newECNCE < 0 {
+		e.logger.Debugf("Disabling ECN. ECN counts decreased unexpectedly.")
+		if e.qlogger != nil {
+			e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+				State:   qlog.ECNStateFailed,
+				Trigger: ecnFailedDecreasedECNCounts,
+			})
+		}
+		e.state = ecnStateFailed
+		return false
+	}
+
+	// ECN validation also fails if the sum of the increase in ECT(0) and ECN-CE counts is less than the number
+	// of newly acknowledged packets that were originally sent with an ECT(0) marking.
+	// This could be the result of (partial) bleaching.
+	if newECT0+newECNCE < ackedECT0 {
+		e.logger.Debugf("Disabling ECN. Received less ECT(0) + ECN-CE than packets sent with ECT(0).")
+		if e.qlogger != nil {
+			e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+				State:   qlog.ECNStateFailed,
+				Trigger: ecnFailedTooFewECNCounts,
+			})
+		}
+		e.state = ecnStateFailed
+		return false
+	}
+	// Similarly, ECN validation fails if the sum of the increases to ECT(1) and ECN-CE counts is less than
+	// the number of newly acknowledged packets sent with an ECT(1) marking.
+	if newECT1+newECNCE < ackedECT1 {
+		e.logger.Debugf("Disabling ECN. Received less ECT(1) + ECN-CE than packets sent with ECT(1).")
+		if e.qlogger != nil {
+			e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+				State:   qlog.ECNStateFailed,
+				Trigger: ecnFailedTooFewECNCounts,
+			})
+		}
+		e.state = ecnStateFailed
+		return false
+	}
+
+	// update our counters
+	e.numAckedECT0 = ect0
+	e.numAckedECT1 = ect1
+	e.numAckedECNCE = ecnce
+
+	// Detect mangling (a path remarking all ECN-marked testing packets as CE),
+	// once all 10 testing packets have been sent out.
+	if e.state == ecnStateUnknown {
+		e.failIfMangled()
+		if e.state == ecnStateFailed {
+			return false
+		}
+	}
+	if e.state == ecnStateTesting || e.state == ecnStateUnknown {
+		var ackedTestingPacket bool
+		for _, p := range packets {
+			if e.isTestingPacket(p.PacketNumber) {
+				ackedTestingPacket = true
+				break
+			}
+		}
+		// This check won't succeed if the path is mangling ECN-marks (i.e. rewrites all ECN-marked packets to CE).
+		if ackedTestingPacket && (newECT0 > 0 || newECT1 > 0) {
+			e.logger.Debugf("ECN capability confirmed.")
+			if e.qlogger != nil {
+				e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+					State: qlog.ECNStateCapable,
+				})
+			}
+			e.state = ecnStateCapable
+		}
+	}
+
+	// Don't trust CE marks before having confirmed ECN capability of the path.
+	// Otherwise, mangling would be misinterpreted as actual congestion.
+	return e.state == ecnStateCapable && newECNCE > 0
+}
+
+// failIfMangled fails ECN validation if all testing packets are lost or CE-marked.
+func (e *ecnTracker) failIfMangled() {
+	numAckedECNCE := e.numAckedECNCE + int64(e.numLostTesting)
+	if e.numSentECT0+e.numSentECT1 > numAckedECNCE {
+		return
+	}
+	if e.qlogger != nil {
+		e.qlogger.RecordEvent(qlog.ECNStateUpdated{
+			State:   qlog.ECNStateFailed,
+			Trigger: ecnFailedManglingDetected,
+		})
+	}
+	e.state = ecnStateFailed
+}
+
+func (e *ecnTracker) ecnMarking(pn protocol.PacketNumber) protocol.ECN {
+	if pn < e.firstTestingPacket || e.firstTestingPacket == protocol.InvalidPacketNumber {
+		return protocol.ECNNon
+	}
+	if pn < e.lastTestingPacket || e.lastTestingPacket == protocol.InvalidPacketNumber {
+		return protocol.ECT0
+	}
+	if pn < e.firstCapablePacket || e.firstCapablePacket == protocol.InvalidPacketNumber {
+		return protocol.ECNNon
+	}
+	// We don't need to deal with the case when ECN validation fails,
+	// since we're ignoring any ECN counts reported in ACK frames in that case.
+	return protocol.ECT0
+}
+
+func (e *ecnTracker) isTestingPacket(pn protocol.PacketNumber) bool {
+	if e.firstTestingPacket == protocol.InvalidPacketNumber {
+		return false
+	}
+	return pn >= e.firstTestingPacket && (pn <= e.lastTestingPacket || e.lastTestingPacket == protocol.InvalidPacketNumber)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ecn_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ecn_test.go
new file mode 100644
index 000000000..7a766f9c3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/ecn_test.go
@@ -0,0 +1,353 @@
+package ackhandler
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+)
+
+func getAckedPackets(pns ...protocol.PacketNumber) []packetWithPacketNumber {
+	var packets []packetWithPacketNumber
+	for _, p := range pns {
+		packets = append(packets, packetWithPacketNumber{PacketNumber: p})
+	}
+	return packets
+}
+
+// sendECNTestingPackets sends 10 ECT(0) packets, and then one more packet
+// Packet numbers: 0 through 9.
+func sendECNTestingPackets(t *testing.T, ecnTracker *ecnTracker, recorder *events.Recorder) {
+	t.Helper()
+
+	for i := range protocol.PacketNumber(9) {
+		require.Equal(t, protocol.ECT0, ecnTracker.Mode())
+		// do this twice to make sure only sent packets are counted
+		require.Equal(t, protocol.ECT0, ecnTracker.Mode())
+		ecnTracker.SentPacket(i, protocol.ECT0)
+	}
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateTesting}},
+		recorder.Events(),
+	)
+	require.Equal(t, protocol.ECT0, ecnTracker.Mode())
+	recorder.Clear()
+	ecnTracker.SentPacket(9, protocol.ECT0)
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateUnknown}},
+		recorder.Events(),
+	)
+	recorder.Clear()
+	// in unknown state, packets shouldn't be ECN-marked
+	require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+}
+
+// ECN validation fails if *all* ECN testing packets are lost.
+func TestECNTestingPacketsLoss(t *testing.T) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	sendECNTestingPackets(t, ecnTracker, &eventRecorder)
+
+	// send non-testing packets
+	for i := range protocol.PacketNumber(10) {
+		require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+		ecnTracker.SentPacket(10+i, protocol.ECNNon)
+	}
+
+	// lose all but one packet
+	for pn := range protocol.PacketNumber(10) {
+		if pn == 4 {
+			continue
+		}
+		ecnTracker.LostPacket(pn)
+	}
+	// loss of non-testing packets doesn't matter
+	ecnTracker.LostPacket(13)
+	ecnTracker.LostPacket(14)
+
+	// now lose the last testing packet
+	require.Empty(t, eventRecorder.Events())
+	eventRecorder.Clear()
+	ecnTracker.LostPacket(4)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.ECNStateUpdated{State: qlog.ECNStateFailed, Trigger: ecnFailedLostAllTestingPackets},
+		},
+		eventRecorder.Events(),
+	)
+}
+
+// ECN support is validated once an acknowledgment for any testing packet is received.
+// This applies even if that happens before all testing packets have been sent out.
+func TestECNValidationInTestingState(t *testing.T) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	for i := range 5 {
+		require.Equal(t, protocol.ECT0, ecnTracker.Mode())
+		ecnTracker.SentPacket(protocol.PacketNumber(i), protocol.ECT0)
+	}
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateTesting}},
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(3), 1, 0, 0))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateCapable}},
+		eventRecorder.Events(),
+	)
+
+	// make sure we continue sending ECT(0) packets
+	for i := 5; i < 100; i++ {
+		require.Equal(t, protocol.ECT0, ecnTracker.Mode())
+		ecnTracker.SentPacket(protocol.PacketNumber(i), protocol.ECT0)
+	}
+}
+
+// ENC is also validated after all testing packets have been sent out,
+// once an acknowledgment for any testing packet is received.
+func TestECNValidationInUnknownState(t *testing.T) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	sendECNTestingPackets(t, ecnTracker, &eventRecorder)
+
+	for i := range protocol.PacketNumber(10) {
+		require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+		pn := 10 + i
+		ecnTracker.SentPacket(pn, protocol.ECNNon)
+		// lose some packets to make sure this doesn't influence the outcome.
+		if i%2 == 0 {
+			ecnTracker.LostPacket(pn)
+		}
+	}
+	require.Empty(t, eventRecorder.Events())
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(7), 1, 0, 0))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateCapable}},
+		eventRecorder.Events(),
+	)
+}
+
+func TestECNValidationFailures(t *testing.T) {
+	t.Run("ECN bleaching", func(t *testing.T) {
+		// this ACK doesn't contain any ECN counts
+		testECNValidationFailure(t, getAckedPackets(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12), 0, 0, 0, ecnFailedNoECNCounts)
+	})
+
+	t.Run("wrong ECN code point", func(t *testing.T) {
+		// we sent ECT(0), but this ACK acknowledges ECT(1)
+		testECNValidationFailure(t, getAckedPackets(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12), 0, 1, 0, ecnFailedMoreECNCountsThanSent)
+	})
+
+	t.Run("more ECN counts than sent packets", func(t *testing.T) {
+		// only 10 ECT(0) packets were sent, but the ACK claims to have received 12 of them
+		testECNValidationFailure(t, getAckedPackets(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12), 12, 0, 0, ecnFailedMoreECNCountsThanSent)
+	})
+}
+
+func testECNValidationFailure(
+	t *testing.T,
+	ackedPackets []packetWithPacketNumber,
+	ect0, ect1, ecnce int64,
+	expectedTrigger string,
+) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	sendECNTestingPackets(t, ecnTracker, &eventRecorder)
+	for i := 10; i < 20; i++ {
+		require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+		ecnTracker.SentPacket(protocol.PacketNumber(i), protocol.ECNNon)
+	}
+
+	require.False(t, ecnTracker.HandleNewlyAcked(ackedPackets, ect0, ect1, ecnce))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateFailed, Trigger: expectedTrigger}},
+		eventRecorder.Events(),
+	)
+}
+
+func TestECNValidationNotEnoughECNCounts(t *testing.T) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	sendECNTestingPackets(t, ecnTracker, &eventRecorder)
+	for i := 10; i < 20; i++ {
+		require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+		ecnTracker.SentPacket(protocol.PacketNumber(i), protocol.ECNNon)
+	}
+	require.Empty(t, eventRecorder.Events())
+	// First only acknowledge some packets sent with ECN marks.
+	require.True(t, ecnTracker.HandleNewlyAcked(getAckedPackets(1, 2, 3, 12), 2, 0, 1))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateCapable}},
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// Now acknowledge some more packets sent with ECN marks, but don't increase the counters enough.
+	// This ACK acknowledges 3 more ECN-marked packets, but the counters only increase by 2.
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(4, 5, 6, 15), 3, 0, 2))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateFailed, Trigger: ecnFailedTooFewECNCounts}},
+		eventRecorder.Events(),
+	)
+}
+
+func TestECNNonsensicalECNCountDecrease(t *testing.T) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	sendECNTestingPackets(t, ecnTracker, &eventRecorder)
+	for i := 10; i < 20; i++ {
+		require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+		ecnTracker.SentPacket(protocol.PacketNumber(i), protocol.ECNNon)
+	}
+	require.Empty(t, eventRecorder.Events())
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(1, 2, 3, 12), 3, 0, 0))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateCapable}},
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// Now acknowledge some more packets, but decrease the ECN counts. Obviously, this doesn't make any sense.
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(4, 5, 6, 13), 2, 0, 0))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateFailed, Trigger: ecnFailedDecreasedECNCounts}},
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// make sure that new ACKs are ignored
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(7, 8, 9, 14), 5, 0, 0))
+	require.Empty(t, eventRecorder.Events())
+}
+
+func TestECNACKReordering(t *testing.T) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	sendECNTestingPackets(t, ecnTracker, &eventRecorder)
+	for i := 10; i < 20; i++ {
+		require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+		ecnTracker.SentPacket(protocol.PacketNumber(i), protocol.ECNNon)
+	}
+	require.Empty(t, eventRecorder.Events())
+
+	// The ACK contains more ECN counts than it acknowledges packets.
+	// This can happen if ACKs are lost / reordered.
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(1, 2, 3, 12), 8, 0, 0))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateCapable}},
+		eventRecorder.Events(),
+	)
+}
+
+// Mangling is detected if all testing packets are marked CE.
+func TestECNManglingAllPacketsMarkedCE(t *testing.T) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	sendECNTestingPackets(t, ecnTracker, &eventRecorder)
+	for i := 10; i < 20; i++ {
+		require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+		ecnTracker.SentPacket(protocol.PacketNumber(i), protocol.ECNNon)
+	}
+
+	// ECN capability not confirmed yet, therefore CE marks are not regarded as congestion events
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(0, 1, 2, 3), 0, 0, 4))
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(4, 5, 6, 10, 11, 12), 0, 0, 7))
+	require.Empty(t, eventRecorder.Events())
+
+	// With the next ACK, all testing packets will now have been marked CE.
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(7, 8, 9, 13), 0, 0, 10))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateFailed, Trigger: ecnFailedManglingDetected}},
+		eventRecorder.Events(),
+	)
+}
+
+// Mangling is also detected if some testing packets are lost, and then others are marked CE.
+func TestECNManglingSomePacketsLostSomeMarkedCE(t *testing.T) {
+	t.Run("packet loss first", func(t *testing.T) {
+		testECNManglingSomePacketsLostSomeMarkedCE(t, true)
+	})
+	t.Run("CE marking first", func(t *testing.T) {
+		testECNManglingSomePacketsLostSomeMarkedCE(t, false)
+	})
+}
+
+func testECNManglingSomePacketsLostSomeMarkedCE(t *testing.T, packetLossFirst bool) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	sendECNTestingPackets(t, ecnTracker, &eventRecorder)
+	for i := 10; i < 20; i++ {
+		require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+		ecnTracker.SentPacket(protocol.PacketNumber(i), protocol.ECNNon)
+	}
+	// Lose a few packets.
+	if packetLossFirst {
+		ecnTracker.LostPacket(0)
+		ecnTracker.LostPacket(1)
+		ecnTracker.LostPacket(2)
+	}
+	// ECN capability not confirmed yet, therefore CE marks are not regarded as congestion events
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(3, 4, 5, 6, 7, 8), 0, 0, 6))
+	require.Empty(t, eventRecorder.Events())
+	// By CE-marking the last unacknowledged testing packets, we should detect the mangling.
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(9), 0, 0, 7))
+	if packetLossFirst {
+		require.Equal(t,
+			[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateFailed, Trigger: ecnFailedManglingDetected}},
+			eventRecorder.Events(),
+		)
+	} else {
+		require.Empty(t, eventRecorder.Events())
+	}
+
+	if !packetLossFirst {
+		ecnTracker.LostPacket(0)
+		ecnTracker.LostPacket(1)
+		ecnTracker.LostPacket(2)
+
+		require.Equal(t,
+			[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateFailed, Trigger: ecnFailedManglingDetected}},
+			eventRecorder.Events(),
+		)
+	}
+}
+
+func TestECNCongestionDetection(t *testing.T) {
+	var eventRecorder events.Recorder
+	ecnTracker := newECNTracker(utils.DefaultLogger, &eventRecorder)
+
+	sendECNTestingPackets(t, ecnTracker, &eventRecorder)
+	for i := 10; i < 20; i++ {
+		require.Equal(t, protocol.ECNNon, ecnTracker.Mode())
+		ecnTracker.SentPacket(protocol.PacketNumber(i), protocol.ECNNon)
+	}
+	// Receive one CE count.
+	require.True(t, ecnTracker.HandleNewlyAcked(getAckedPackets(1, 2, 3, 12), 2, 0, 1))
+	require.Equal(t,
+		[]qlogwriter.Event{qlog.ECNStateUpdated{State: qlog.ECNStateCapable}},
+		eventRecorder.Events(),
+	)
+
+	// No increase in CE. No congestion.
+	require.False(t, ecnTracker.HandleNewlyAcked(getAckedPackets(4, 5, 6, 13), 5, 0, 1))
+	eventRecorder.Clear()
+
+	// Increase in CE. More congestion.
+	require.True(t, ecnTracker.HandleNewlyAcked(getAckedPackets(7, 8, 9, 14), 7, 0, 2))
+	require.Empty(t, eventRecorder.Events())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/frame.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/frame.go
new file mode 100644
index 000000000..e03a8080c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/frame.go
@@ -0,0 +1,21 @@
+package ackhandler
+
+import (
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+// FrameHandler handles the acknowledgement and the loss of a frame.
+type FrameHandler interface {
+	OnAcked(wire.Frame)
+	OnLost(wire.Frame)
+}
+
+type Frame struct {
+	Frame   wire.Frame // nil if the frame has already been acknowledged in another packet
+	Handler FrameHandler
+}
+
+type StreamFrame struct {
+	Frame   *wire.StreamFrame
+	Handler FrameHandler
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/interfaces.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/interfaces.go
new file mode 100644
index 000000000..620a5e11f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/interfaces.go
@@ -0,0 +1,39 @@
+package ackhandler
+
+import (
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+// SentPacketHandler handles ACKs received for outgoing packets
+type SentPacketHandler interface {
+	// SentPacket may modify the packet
+	SentPacket(t monotime.Time, pn, largestAcked protocol.PacketNumber, streamFrames []StreamFrame, frames []Frame, encLevel protocol.EncryptionLevel, ecn protocol.ECN, size protocol.ByteCount, isPathMTUProbePacket, isPathProbePacket bool)
+	// ReceivedAck processes an ACK frame.
+	// It does not store a copy of the frame.
+	ReceivedAck(f *wire.AckFrame, encLevel protocol.EncryptionLevel, rcvTime monotime.Time) (bool /* 1-RTT packet acked */, error)
+	ReceivedPacket(protocol.EncryptionLevel, monotime.Time)
+	ReceivedBytes(_ protocol.ByteCount, rcvTime monotime.Time)
+	DropPackets(_ protocol.EncryptionLevel, rcvTime monotime.Time)
+	ResetForRetry(rcvTime monotime.Time)
+
+	// The SendMode determines if and what kind of packets can be sent.
+	SendMode(now monotime.Time) SendMode
+	// TimeUntilSend is the time when the next packet should be sent.
+	// It is used for pacing packets.
+	TimeUntilSend() monotime.Time
+	SetMaxDatagramSize(count protocol.ByteCount)
+
+	// only to be called once the handshake is complete
+	QueueProbePacket(protocol.EncryptionLevel) bool /* was a packet queued */
+
+	ECNMode(isShortHeaderPacket bool) protocol.ECN // isShortHeaderPacket should only be true for non-coalesced 1-RTT packets
+	PeekPacketNumber(protocol.EncryptionLevel) (protocol.PacketNumber, protocol.PacketNumberLen)
+	PopPacketNumber(protocol.EncryptionLevel) protocol.PacketNumber
+
+	GetLossDetectionTimeout() monotime.Time
+	OnLossDetectionTimeout(now monotime.Time) error
+
+	MigratedPath(now monotime.Time, initialMaxPacketSize protocol.ByteCount)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/lost_packet_tracker.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/lost_packet_tracker.go
new file mode 100644
index 000000000..40665734d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/lost_packet_tracker.go
@@ -0,0 +1,73 @@
+package ackhandler
+
+import (
+	"iter"
+	"slices"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+type lostPacket struct {
+	PacketNumber protocol.PacketNumber
+	SendTime     monotime.Time
+}
+
+type lostPacketTracker struct {
+	maxLength   int
+	lostPackets []lostPacket
+}
+
+func newLostPacketTracker(maxLength int) *lostPacketTracker {
+	return &lostPacketTracker{
+		maxLength: maxLength,
+		// Preallocate a small slice only.
+		// Hopefully we won't lose many packets.
+		lostPackets: make([]lostPacket, 0, 4),
+	}
+}
+
+func (t *lostPacketTracker) Add(p protocol.PacketNumber, sendTime monotime.Time) {
+	if len(t.lostPackets) == t.maxLength {
+		t.lostPackets = t.lostPackets[1:]
+	}
+	t.lostPackets = append(t.lostPackets, lostPacket{
+		PacketNumber: p,
+		SendTime:     sendTime,
+	})
+}
+
+// Delete deletes a packet from the lost packet tracker.
+// This function is not optimized for performance if many packets are lost,
+// but it is only used when a spurious loss is detected, which is rare.
+func (t *lostPacketTracker) Delete(pn protocol.PacketNumber) {
+	t.lostPackets = slices.DeleteFunc(t.lostPackets, func(p lostPacket) bool {
+		return p.PacketNumber == pn
+	})
+}
+
+func (t *lostPacketTracker) All() iter.Seq2[protocol.PacketNumber, monotime.Time] {
+	return func(yield func(protocol.PacketNumber, monotime.Time) bool) {
+		for _, p := range t.lostPackets {
+			if !yield(p.PacketNumber, p.SendTime) {
+				return
+			}
+		}
+	}
+}
+
+func (t *lostPacketTracker) DeleteBefore(ti monotime.Time) {
+	if len(t.lostPackets) == 0 {
+		return
+	}
+	if !t.lostPackets[0].SendTime.Before(ti) {
+		return
+	}
+	var idx int
+	for ; idx < len(t.lostPackets); idx++ {
+		if !t.lostPackets[idx].SendTime.Before(ti) {
+			break
+		}
+	}
+	t.lostPackets = slices.Delete(t.lostPackets, 0, idx)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/lost_packet_tracker_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/lost_packet_tracker_test.go
new file mode 100644
index 000000000..3394048fd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/lost_packet_tracker_test.go
@@ -0,0 +1,75 @@
+package ackhandler
+
+import (
+	"maps"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLostPacketTracker(t *testing.T) {
+	lt := newLostPacketTracker(4)
+
+	start := monotime.Now()
+	lt.Add(1, start)
+	lt.Add(5, start.Add(time.Second))
+	lt.Add(8, start.Add(2*time.Second))
+	require.Equal(t, map[protocol.PacketNumber]monotime.Time{
+		1: start,
+		5: start.Add(time.Second),
+		8: start.Add(2 * time.Second),
+	}, maps.Collect(lt.All()))
+
+	// Lose 2 more packets. The first one should be removed.
+	lt.Add(10, start.Add(3*time.Second))
+	lt.Add(11, start.Add(4*time.Second))
+	require.Equal(t, map[protocol.PacketNumber]monotime.Time{
+		5:  start.Add(time.Second),
+		8:  start.Add(2 * time.Second),
+		10: start.Add(3 * time.Second),
+		11: start.Add(4 * time.Second),
+	}, maps.Collect(lt.All()))
+
+	lt.Delete(5)
+	lt.Delete(10)
+	require.Equal(t, map[protocol.PacketNumber]monotime.Time{
+		8:  start.Add(2 * time.Second),
+		11: start.Add(4 * time.Second),
+	}, maps.Collect(lt.All()))
+}
+
+func TestLostPacketTrackerDeleteBefore(t *testing.T) {
+	lt := newLostPacketTracker(4)
+
+	trackedPackets := func(lt *lostPacketTracker) []protocol.PacketNumber {
+		var pns []protocol.PacketNumber
+		for pn := range lt.All() {
+			pns = append(pns, pn)
+		}
+		return pns
+	}
+
+	start := monotime.Now()
+	lt.Add(1, start)
+	lt.Add(5, start.Add(time.Second))
+	lt.Add(8, start.Add(2*time.Second))
+	lt.Add(10, start.Add(3*time.Second))
+
+	require.Equal(t, []protocol.PacketNumber{1, 5, 8, 10}, trackedPackets(lt))
+
+	lt.DeleteBefore(start) // this should be a no-op
+	require.Equal(t, []protocol.PacketNumber{1, 5, 8, 10}, trackedPackets(lt))
+
+	lt.DeleteBefore(start.Add(2 * time.Second))
+	require.Equal(t, []protocol.PacketNumber{8, 10}, trackedPackets(lt))
+
+	lt.DeleteBefore(start.Add(time.Second * 5 / 2))
+	require.Equal(t, []protocol.PacketNumber{10}, trackedPackets(lt))
+
+	lt.DeleteBefore(start.Add(time.Hour))
+	require.Empty(t, trackedPackets(lt))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/mock_ecn_handler_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/mock_ecn_handler_test.go
new file mode 100644
index 000000000..2e69bfa1d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/mock_ecn_handler_test.go
@@ -0,0 +1,189 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/internal/ackhandler (interfaces: ECNHandler)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package ackhandler -destination mock_ecn_handler_test.go github.com/quic-go/quic-go/internal/ackhandler ECNHandler
+//
+
+// Package ackhandler is a generated GoMock package.
+package ackhandler
+
+import (
+	reflect "reflect"
+
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockECNHandler is a mock of ECNHandler interface.
+type MockECNHandler struct {
+	ctrl     *gomock.Controller
+	recorder *MockECNHandlerMockRecorder
+	isgomock struct{}
+}
+
+// MockECNHandlerMockRecorder is the mock recorder for MockECNHandler.
+type MockECNHandlerMockRecorder struct {
+	mock *MockECNHandler
+}
+
+// NewMockECNHandler creates a new mock instance.
+func NewMockECNHandler(ctrl *gomock.Controller) *MockECNHandler {
+	mock := &MockECNHandler{ctrl: ctrl}
+	mock.recorder = &MockECNHandlerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockECNHandler) EXPECT() *MockECNHandlerMockRecorder {
+	return m.recorder
+}
+
+// HandleNewlyAcked mocks base method.
+func (m *MockECNHandler) HandleNewlyAcked(packets []packetWithPacketNumber, ect0, ect1, ecnce int64) bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HandleNewlyAcked", packets, ect0, ect1, ecnce)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// HandleNewlyAcked indicates an expected call of HandleNewlyAcked.
+func (mr *MockECNHandlerMockRecorder) HandleNewlyAcked(packets, ect0, ect1, ecnce any) *MockECNHandlerHandleNewlyAckedCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HandleNewlyAcked", reflect.TypeOf((*MockECNHandler)(nil).HandleNewlyAcked), packets, ect0, ect1, ecnce)
+	return &MockECNHandlerHandleNewlyAckedCall{Call: call}
+}
+
+// MockECNHandlerHandleNewlyAckedCall wrap *gomock.Call
+type MockECNHandlerHandleNewlyAckedCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockECNHandlerHandleNewlyAckedCall) Return(congested bool) *MockECNHandlerHandleNewlyAckedCall {
+	c.Call = c.Call.Return(congested)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockECNHandlerHandleNewlyAckedCall) Do(f func([]packetWithPacketNumber, int64, int64, int64) bool) *MockECNHandlerHandleNewlyAckedCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockECNHandlerHandleNewlyAckedCall) DoAndReturn(f func([]packetWithPacketNumber, int64, int64, int64) bool) *MockECNHandlerHandleNewlyAckedCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// LostPacket mocks base method.
+func (m *MockECNHandler) LostPacket(arg0 protocol.PacketNumber) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "LostPacket", arg0)
+}
+
+// LostPacket indicates an expected call of LostPacket.
+func (mr *MockECNHandlerMockRecorder) LostPacket(arg0 any) *MockECNHandlerLostPacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LostPacket", reflect.TypeOf((*MockECNHandler)(nil).LostPacket), arg0)
+	return &MockECNHandlerLostPacketCall{Call: call}
+}
+
+// MockECNHandlerLostPacketCall wrap *gomock.Call
+type MockECNHandlerLostPacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockECNHandlerLostPacketCall) Return() *MockECNHandlerLostPacketCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockECNHandlerLostPacketCall) Do(f func(protocol.PacketNumber)) *MockECNHandlerLostPacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockECNHandlerLostPacketCall) DoAndReturn(f func(protocol.PacketNumber)) *MockECNHandlerLostPacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Mode mocks base method.
+func (m *MockECNHandler) Mode() protocol.ECN {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Mode")
+	ret0, _ := ret[0].(protocol.ECN)
+	return ret0
+}
+
+// Mode indicates an expected call of Mode.
+func (mr *MockECNHandlerMockRecorder) Mode() *MockECNHandlerModeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Mode", reflect.TypeOf((*MockECNHandler)(nil).Mode))
+	return &MockECNHandlerModeCall{Call: call}
+}
+
+// MockECNHandlerModeCall wrap *gomock.Call
+type MockECNHandlerModeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockECNHandlerModeCall) Return(arg0 protocol.ECN) *MockECNHandlerModeCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockECNHandlerModeCall) Do(f func() protocol.ECN) *MockECNHandlerModeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockECNHandlerModeCall) DoAndReturn(f func() protocol.ECN) *MockECNHandlerModeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SentPacket mocks base method.
+func (m *MockECNHandler) SentPacket(arg0 protocol.PacketNumber, arg1 protocol.ECN) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SentPacket", arg0, arg1)
+}
+
+// SentPacket indicates an expected call of SentPacket.
+func (mr *MockECNHandlerMockRecorder) SentPacket(arg0, arg1 any) *MockECNHandlerSentPacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SentPacket", reflect.TypeOf((*MockECNHandler)(nil).SentPacket), arg0, arg1)
+	return &MockECNHandlerSentPacketCall{Call: call}
+}
+
+// MockECNHandlerSentPacketCall wrap *gomock.Call
+type MockECNHandlerSentPacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockECNHandlerSentPacketCall) Return() *MockECNHandlerSentPacketCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockECNHandlerSentPacketCall) Do(f func(protocol.PacketNumber, protocol.ECN)) *MockECNHandlerSentPacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockECNHandlerSentPacketCall) DoAndReturn(f func(protocol.PacketNumber, protocol.ECN)) *MockECNHandlerSentPacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/mockgen.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/mockgen.go
new file mode 100644
index 000000000..3add80d1f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/mockgen.go
@@ -0,0 +1,6 @@
+//go:build gomock || generate
+
+package ackhandler
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\"  -package ackhandler -destination mock_ecn_handler_test.go github.com/quic-go/quic-go/internal/ackhandler ECNHandler"
+type ECNHandler = ecnHandler
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/packet.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/packet.go
new file mode 100644
index 000000000..7d9863000
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/packet.go
@@ -0,0 +1,60 @@
+package ackhandler
+
+import (
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+type packetWithPacketNumber struct {
+	PacketNumber protocol.PacketNumber
+	*packet
+}
+
+// A Packet is a packet
+type packet struct {
+	SendTime        monotime.Time
+	StreamFrames    []StreamFrame
+	Frames          []Frame
+	LargestAcked    protocol.PacketNumber // InvalidPacketNumber if the packet doesn't contain an ACK
+	Length          protocol.ByteCount
+	EncryptionLevel protocol.EncryptionLevel
+
+	IsPathMTUProbePacket bool // We don't report the loss of Path MTU probe packets to the congestion controller.
+
+	includedInBytesInFlight bool
+	isPathProbePacket       bool
+}
+
+func (p *packet) Outstanding() bool {
+	return !p.IsPathMTUProbePacket && !p.isPathProbePacket && p.IsAckEliciting()
+}
+
+func (p *packet) IsAckEliciting() bool {
+	return len(p.StreamFrames) > 0 || len(p.Frames) > 0
+}
+
+var packetPool = sync.Pool{New: func() any { return &packet{} }}
+
+func getPacket() *packet {
+	p := packetPool.Get().(*packet)
+	p.StreamFrames = nil
+	p.Frames = nil
+	p.LargestAcked = 0
+	p.Length = 0
+	p.EncryptionLevel = protocol.EncryptionLevel(0)
+	p.SendTime = 0
+	p.IsPathMTUProbePacket = false
+	p.includedInBytesInFlight = false
+	p.isPathProbePacket = false
+	return p
+}
+
+// We currently only return Packets back into the pool when they're acknowledged (not when they're lost).
+// This simplifies the code, and gives the vast majority of the performance benefit we can gain from using the pool.
+func putPacket(p *packet) {
+	p.Frames = nil
+	p.StreamFrames = nil
+	packetPool.Put(p)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/packet_number_generator.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/packet_number_generator.go
new file mode 100644
index 000000000..4a9db8635
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/packet_number_generator.go
@@ -0,0 +1,84 @@
+package ackhandler
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+type packetNumberGenerator interface {
+	Peek() protocol.PacketNumber
+	// Pop pops the packet number.
+	// It reports if the packet number (before the one just popped) was skipped.
+	// It never skips more than one packet number in a row.
+	Pop() (skipped bool, _ protocol.PacketNumber)
+}
+
+type sequentialPacketNumberGenerator struct {
+	next protocol.PacketNumber
+}
+
+var _ packetNumberGenerator = &sequentialPacketNumberGenerator{}
+
+func newSequentialPacketNumberGenerator(initial protocol.PacketNumber) packetNumberGenerator {
+	return &sequentialPacketNumberGenerator{next: initial}
+}
+
+func (p *sequentialPacketNumberGenerator) Peek() protocol.PacketNumber {
+	return p.next
+}
+
+func (p *sequentialPacketNumberGenerator) Pop() (bool, protocol.PacketNumber) {
+	next := p.next
+	p.next++
+	return false, next
+}
+
+// The skippingPacketNumberGenerator generates the packet number for the next packet
+// it randomly skips a packet number every averagePeriod packets (on average).
+// It is guaranteed to never skip two consecutive packet numbers.
+type skippingPacketNumberGenerator struct {
+	period    protocol.PacketNumber
+	maxPeriod protocol.PacketNumber
+
+	next       protocol.PacketNumber
+	nextToSkip protocol.PacketNumber
+
+	rng utils.Rand
+}
+
+var _ packetNumberGenerator = &skippingPacketNumberGenerator{}
+
+func newSkippingPacketNumberGenerator(initial, initialPeriod, maxPeriod protocol.PacketNumber) packetNumberGenerator {
+	g := &skippingPacketNumberGenerator{
+		next:      initial,
+		period:    initialPeriod,
+		maxPeriod: maxPeriod,
+	}
+	g.generateNewSkip()
+	return g
+}
+
+func (p *skippingPacketNumberGenerator) Peek() protocol.PacketNumber {
+	if p.next == p.nextToSkip {
+		return p.next + 1
+	}
+	return p.next
+}
+
+func (p *skippingPacketNumberGenerator) Pop() (bool, protocol.PacketNumber) {
+	next := p.next
+	if p.next == p.nextToSkip {
+		next++
+		p.next += 2
+		p.generateNewSkip()
+		return true, next
+	}
+	p.next++ // generate a new packet number for the next packet
+	return false, next
+}
+
+func (p *skippingPacketNumberGenerator) generateNewSkip() {
+	// make sure that there are never two consecutive packet numbers that are skipped
+	p.nextToSkip = p.next + 3 + protocol.PacketNumber(p.rng.Int31n(int32(2*p.period)))
+	p.period = min(2*p.period, p.maxPeriod)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/packet_number_generator_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/packet_number_generator_test.go
new file mode 100644
index 000000000..9ec93c158
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/packet_number_generator_test.go
@@ -0,0 +1,92 @@
+package ackhandler
+
+import (
+	"math"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSequentialPacketNumberGenerator(t *testing.T) {
+	const initialPN protocol.PacketNumber = 123
+	png := newSequentialPacketNumberGenerator(initialPN)
+
+	for i := initialPN; i < initialPN+1000; i++ {
+		require.Equal(t, i, png.Peek())
+		require.Equal(t, i, png.Peek())
+		skipNext, pn := png.Pop()
+		require.False(t, skipNext)
+		require.Equal(t, i, pn)
+	}
+}
+
+func TestSkippingPacketNumberGenerator(t *testing.T) {
+	// the maximum period must be sufficiently small such that using a 32-bit random number is ok
+	require.Less(t, 2*protocol.SkipPacketMaxPeriod, protocol.PacketNumber(math.MaxInt32))
+
+	const initialPeriod protocol.PacketNumber = 25
+	const maxPeriod protocol.PacketNumber = 300
+
+	png := newSkippingPacketNumberGenerator(100, initialPeriod, maxPeriod)
+	require.Equal(t, protocol.PacketNumber(100), png.Peek())
+	require.Equal(t, protocol.PacketNumber(100), png.Peek())
+	require.Equal(t, protocol.PacketNumber(100), png.Peek())
+	_, pn := png.Pop()
+	require.Equal(t, protocol.PacketNumber(100), pn)
+
+	var last protocol.PacketNumber
+	var skipped bool
+	for i := range maxPeriod {
+		didSkip, num := png.Pop()
+		if didSkip {
+			skipped = true
+			_, nextNum := png.Pop()
+			require.Equal(t, num+1, nextNum)
+			break
+		}
+		if i != 0 {
+			require.Equal(t, num, last+1)
+		}
+		last = num
+	}
+	require.True(t, skipped)
+}
+
+func TestSkippingPacketNumberGeneratorPeriods(t *testing.T) {
+	const initialPN protocol.PacketNumber = 8
+	const initialPeriod protocol.PacketNumber = 25
+	const maxPeriod protocol.PacketNumber = 300
+
+	const rep = 2500
+	periods := make([][]protocol.PacketNumber, rep)
+	expectedPeriods := []protocol.PacketNumber{25, 50, 100, 200, 300, 300, 300}
+
+	for i := range rep {
+		png := newSkippingPacketNumberGenerator(initialPN, initialPeriod, maxPeriod)
+		lastSkip := initialPN
+		for len(periods[i]) < len(expectedPeriods) {
+			skipNext, next := png.Pop()
+			if skipNext {
+				skipped := next + 1
+				require.Greater(t, skipped, lastSkip+1)
+				periods[i] = append(periods[i], skipped-lastSkip-1)
+				lastSkip = skipped
+			}
+		}
+	}
+
+	for j := range expectedPeriods {
+		var average float64
+		for i := range rep {
+			average += float64(periods[i][j]) / float64(len(periods))
+		}
+		t.Logf("Period %d: %.2f (expected %d)\n", j, average, expectedPeriods[j])
+		require.InDelta(t,
+			float64(expectedPeriods[j]+1),
+			average,
+			float64(max(protocol.PacketNumber(5), expectedPeriods[j]/10)),
+		)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_handler.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_handler.go
new file mode 100644
index 000000000..d0d24bf30
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_handler.go
@@ -0,0 +1,119 @@
+package ackhandler
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type ReceivedPacketHandler struct {
+	initialPackets   *receivedPacketTracker
+	handshakePackets *receivedPacketTracker
+	appDataPackets   appDataReceivedPacketTracker
+
+	lowest1RTTPacket protocol.PacketNumber
+}
+
+func NewReceivedPacketHandler(logger utils.Logger) *ReceivedPacketHandler {
+	return &ReceivedPacketHandler{
+		initialPackets:   newReceivedPacketTracker(),
+		handshakePackets: newReceivedPacketTracker(),
+		appDataPackets:   *newAppDataReceivedPacketTracker(logger),
+		lowest1RTTPacket: protocol.InvalidPacketNumber,
+	}
+}
+
+func (h *ReceivedPacketHandler) ReceivedPacket(
+	pn protocol.PacketNumber,
+	ecn protocol.ECN,
+	encLevel protocol.EncryptionLevel,
+	rcvTime monotime.Time,
+	ackEliciting bool,
+) error {
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return h.initialPackets.ReceivedPacket(pn, ecn, ackEliciting)
+	case protocol.EncryptionHandshake:
+		// The Handshake packet number space might already have been dropped as a result
+		// of processing the CRYPTO frame that was contained in this packet.
+		if h.handshakePackets == nil {
+			return nil
+		}
+		return h.handshakePackets.ReceivedPacket(pn, ecn, ackEliciting)
+	case protocol.Encryption0RTT:
+		if h.lowest1RTTPacket != protocol.InvalidPacketNumber && pn > h.lowest1RTTPacket {
+			return fmt.Errorf("received packet number %d on a 0-RTT packet after receiving %d on a 1-RTT packet", pn, h.lowest1RTTPacket)
+		}
+		return h.appDataPackets.ReceivedPacket(pn, ecn, rcvTime, ackEliciting)
+	case protocol.Encryption1RTT:
+		if h.lowest1RTTPacket == protocol.InvalidPacketNumber || pn < h.lowest1RTTPacket {
+			h.lowest1RTTPacket = pn
+		}
+		return h.appDataPackets.ReceivedPacket(pn, ecn, rcvTime, ackEliciting)
+	default:
+		panic(fmt.Sprintf("received packet with unknown encryption level: %s", encLevel))
+	}
+}
+
+func (h *ReceivedPacketHandler) IgnorePacketsBelow(pn protocol.PacketNumber) {
+	h.appDataPackets.IgnoreBelow(pn)
+}
+
+func (h *ReceivedPacketHandler) DropPackets(encLevel protocol.EncryptionLevel) {
+	//nolint:exhaustive // 1-RTT packet number space is never dropped.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		h.initialPackets = nil
+	case protocol.EncryptionHandshake:
+		h.handshakePackets = nil
+	case protocol.Encryption0RTT:
+		// Nothing to do here.
+		// If we are rejecting 0-RTT, no 0-RTT packets will have been decrypted.
+	default:
+		panic(fmt.Sprintf("Cannot drop keys for encryption level %s", encLevel))
+	}
+}
+
+func (h *ReceivedPacketHandler) GetAlarmTimeout() monotime.Time {
+	return h.appDataPackets.GetAlarmTimeout()
+}
+
+func (h *ReceivedPacketHandler) GetAckFrame(encLevel protocol.EncryptionLevel, now monotime.Time, onlyIfQueued bool) *wire.AckFrame {
+	//nolint:exhaustive // 0-RTT packets can't contain ACK frames.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		if h.initialPackets != nil {
+			return h.initialPackets.GetAckFrame()
+		}
+		return nil
+	case protocol.EncryptionHandshake:
+		if h.handshakePackets != nil {
+			return h.handshakePackets.GetAckFrame()
+		}
+		return nil
+	case protocol.Encryption1RTT:
+		return h.appDataPackets.GetAckFrame(now, onlyIfQueued)
+	default:
+		// 0-RTT packets can't contain ACK frames
+		return nil
+	}
+}
+
+func (h *ReceivedPacketHandler) IsPotentiallyDuplicate(pn protocol.PacketNumber, encLevel protocol.EncryptionLevel) bool {
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		if h.initialPackets != nil {
+			return h.initialPackets.IsPotentiallyDuplicate(pn)
+		}
+	case protocol.EncryptionHandshake:
+		if h.handshakePackets != nil {
+			return h.handshakePackets.IsPotentiallyDuplicate(pn)
+		}
+	case protocol.Encryption0RTT, protocol.Encryption1RTT:
+		return h.appDataPackets.IsPotentiallyDuplicate(pn)
+	}
+	panic("unexpected encryption level")
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_handler_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_handler_test.go
new file mode 100644
index 000000000..5b566c4f8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_handler_test.go
@@ -0,0 +1,144 @@
+package ackhandler
+
+import (
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateACKsForPacketNumberSpaces(t *testing.T) {
+	handler := NewReceivedPacketHandler(utils.DefaultLogger)
+
+	now := monotime.Now()
+	sendTime := now.Add(-time.Second)
+
+	require.NoError(t, handler.ReceivedPacket(2, protocol.ECT0, protocol.EncryptionInitial, sendTime, true))
+	require.NoError(t, handler.ReceivedPacket(1, protocol.ECT1, protocol.EncryptionHandshake, sendTime, true))
+	require.NoError(t, handler.ReceivedPacket(5, protocol.ECNCE, protocol.Encryption1RTT, sendTime, true))
+	require.NoError(t, handler.ReceivedPacket(3, protocol.ECT0, protocol.EncryptionInitial, sendTime, true))
+	require.NoError(t, handler.ReceivedPacket(2, protocol.ECT1, protocol.EncryptionHandshake, sendTime, true))
+	require.NoError(t, handler.ReceivedPacket(4, protocol.ECNCE, protocol.Encryption1RTT, sendTime, true))
+
+	// Initial
+	initialAck := handler.GetAckFrame(protocol.EncryptionInitial, now, true)
+	require.NotNil(t, initialAck)
+	require.Equal(t, []wire.AckRange{{Smallest: 2, Largest: 3}}, initialAck.AckRanges)
+	require.Zero(t, initialAck.DelayTime)
+	require.EqualValues(t, 2, initialAck.ECT0)
+	require.Zero(t, initialAck.ECT1)
+	require.Zero(t, initialAck.ECNCE)
+
+	// Handshake
+	handshakeAck := handler.GetAckFrame(protocol.EncryptionHandshake, now, true)
+	require.NotNil(t, handshakeAck)
+	require.Equal(t, []wire.AckRange{{Smallest: 1, Largest: 2}}, handshakeAck.AckRanges)
+	require.Zero(t, handshakeAck.DelayTime)
+	require.Zero(t, handshakeAck.ECT0)
+	require.EqualValues(t, 2, handshakeAck.ECT1)
+	require.Zero(t, handshakeAck.ECNCE)
+
+	// 1-RTT
+	oneRTTAck := handler.GetAckFrame(protocol.Encryption1RTT, now, true)
+	require.NotNil(t, oneRTTAck)
+	require.Equal(t, []wire.AckRange{{Smallest: 4, Largest: 5}}, oneRTTAck.AckRanges)
+	require.Equal(t, time.Second, oneRTTAck.DelayTime)
+	require.Zero(t, oneRTTAck.ECT0)
+	require.Zero(t, oneRTTAck.ECT1)
+	require.EqualValues(t, 2, oneRTTAck.ECNCE)
+}
+
+func TestReceive0RTTAnd1RTT(t *testing.T) {
+	handler := NewReceivedPacketHandler(utils.DefaultLogger)
+
+	sendTime := monotime.Now().Add(-time.Second)
+
+	require.NoError(t, handler.ReceivedPacket(2, protocol.ECNNon, protocol.Encryption0RTT, sendTime, true))
+	require.NoError(t, handler.ReceivedPacket(3, protocol.ECNNon, protocol.Encryption1RTT, sendTime, true))
+
+	ack := handler.GetAckFrame(protocol.Encryption1RTT, monotime.Now(), true)
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{{Smallest: 2, Largest: 3}}, ack.AckRanges)
+
+	// 0-RTT packets with higher packet numbers than 1-RTT packets are rejected...
+	require.Error(t, handler.ReceivedPacket(4, protocol.ECNNon, protocol.Encryption0RTT, sendTime, true))
+	// ... but reordered 0-RTT packets are allowed
+	require.NoError(t, handler.ReceivedPacket(1, protocol.ECNNon, protocol.Encryption0RTT, sendTime, true))
+}
+
+func TestDropPackets(t *testing.T) {
+	handler := NewReceivedPacketHandler(utils.DefaultLogger)
+
+	sendTime := monotime.Now().Add(-time.Second)
+
+	require.NoError(t, handler.ReceivedPacket(2, protocol.ECNNon, protocol.EncryptionInitial, sendTime, true))
+	require.NoError(t, handler.ReceivedPacket(1, protocol.ECNNon, protocol.EncryptionHandshake, sendTime, true))
+	require.NoError(t, handler.ReceivedPacket(2, protocol.ECNNon, protocol.Encryption1RTT, sendTime, true))
+
+	// Initial
+	require.NotNil(t, handler.GetAckFrame(protocol.EncryptionInitial, monotime.Now(), true))
+	handler.DropPackets(protocol.EncryptionInitial)
+	require.Nil(t, handler.GetAckFrame(protocol.EncryptionInitial, monotime.Now(), true))
+
+	// Handshake
+	require.NotNil(t, handler.GetAckFrame(protocol.EncryptionHandshake, monotime.Now(), true))
+	handler.DropPackets(protocol.EncryptionHandshake)
+	require.Nil(t, handler.GetAckFrame(protocol.EncryptionHandshake, monotime.Now(), true))
+
+	// 1-RTT
+	require.NotNil(t, handler.GetAckFrame(protocol.Encryption1RTT, monotime.Now(), true))
+
+	// 0-RTT is a no-op
+	handler.DropPackets(protocol.Encryption0RTT)
+}
+
+func TestAckRangePruning(t *testing.T) {
+	handler := NewReceivedPacketHandler(utils.DefaultLogger)
+
+	sendTime := monotime.Now()
+	require.NoError(t, handler.ReceivedPacket(1, protocol.ECNNon, protocol.Encryption1RTT, sendTime, true))
+	require.NoError(t, handler.ReceivedPacket(2, protocol.ECNNon, protocol.Encryption1RTT, sendTime, true))
+
+	ack := handler.GetAckFrame(protocol.Encryption1RTT, monotime.Now(), true)
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{{Smallest: 1, Largest: 2}}, ack.AckRanges)
+
+	require.NoError(t, handler.ReceivedPacket(3, protocol.ECNNon, protocol.Encryption1RTT, sendTime, true))
+	handler.IgnorePacketsBelow(2)
+	require.NoError(t, handler.ReceivedPacket(4, protocol.ECNNon, protocol.Encryption1RTT, sendTime, true))
+
+	ack = handler.GetAckFrame(protocol.Encryption1RTT, monotime.Now(), true)
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{{Smallest: 2, Largest: 4}}, ack.AckRanges)
+}
+
+func TestPacketDuplicateDetection(t *testing.T) {
+	handler := NewReceivedPacketHandler(utils.DefaultLogger)
+	sendTime := monotime.Now()
+
+	// 1-RTT is tested separately at the end
+	encLevels := []protocol.EncryptionLevel{
+		protocol.EncryptionInitial,
+		protocol.EncryptionHandshake,
+		protocol.Encryption0RTT,
+	}
+
+	for _, encLevel := range encLevels {
+		// first, packet 3 is not a duplicate
+		require.False(t, handler.IsPotentiallyDuplicate(3, encLevel))
+		require.NoError(t, handler.ReceivedPacket(3, protocol.ECNNon, encLevel, sendTime, true))
+		// now packet 3 is considered a duplicate
+		require.True(t, handler.IsPotentiallyDuplicate(3, encLevel))
+	}
+
+	// 1-RTT
+	require.True(t, handler.IsPotentiallyDuplicate(3, protocol.Encryption1RTT))
+	require.False(t, handler.IsPotentiallyDuplicate(4, protocol.Encryption1RTT))
+	require.NoError(t, handler.ReceivedPacket(4, protocol.ECNNon, protocol.Encryption1RTT, sendTime, true))
+	require.True(t, handler.IsPotentiallyDuplicate(4, protocol.Encryption1RTT))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_history.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_history.go
new file mode 100644
index 000000000..d065b6e65
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_history.go
@@ -0,0 +1,159 @@
+package ackhandler
+
+import (
+	"iter"
+	"slices"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// interval is an interval from one PacketNumber to the other
+type interval struct {
+	Start protocol.PacketNumber
+	End   protocol.PacketNumber
+}
+
+// The receivedPacketHistory stores if a packet number has already been received.
+// It generates ACK ranges which can be used to assemble an ACK frame.
+// It does not store packet contents.
+type receivedPacketHistory struct {
+	ranges []interval // maximum length: protocol.MaxNumAckRanges
+
+	deletedBelow protocol.PacketNumber
+}
+
+func newReceivedPacketHistory() *receivedPacketHistory {
+	return &receivedPacketHistory{
+		deletedBelow: protocol.InvalidPacketNumber,
+	}
+}
+
+// ReceivedPacket registers a packet with PacketNumber p and updates the ranges
+func (h *receivedPacketHistory) ReceivedPacket(p protocol.PacketNumber) bool /* is a new packet (and not a duplicate / delayed packet) */ {
+	// ignore delayed packets, if we already deleted the range
+	if p < h.deletedBelow {
+		return false
+	}
+
+	isNew := h.addToRanges(p)
+	// Delete old ranges, if we're tracking too many of them.
+	// This is a DoS defense against a peer that sends us too many gaps.
+	if len(h.ranges) > protocol.MaxNumAckRanges {
+		h.ranges = slices.Delete(h.ranges, 0, len(h.ranges)-protocol.MaxNumAckRanges)
+	}
+	return isNew
+}
+
+func (h *receivedPacketHistory) addToRanges(p protocol.PacketNumber) bool /* is a new packet (and not a duplicate / delayed packet) */ {
+	if len(h.ranges) == 0 {
+		h.ranges = append(h.ranges, interval{Start: p, End: p})
+		return true
+	}
+
+	for i := len(h.ranges) - 1; i >= 0; i-- {
+		// p already included in an existing range. Nothing to do here
+		if p >= h.ranges[i].Start && p <= h.ranges[i].End {
+			return false
+		}
+
+		if h.ranges[i].End == p-1 { // extend a range at the end
+			h.ranges[i].End = p
+			return true
+		}
+		if h.ranges[i].Start == p+1 { // extend a range at the beginning
+			h.ranges[i].Start = p
+
+			if i > 0 && h.ranges[i-1].End+1 == h.ranges[i].Start { // merge two ranges
+				h.ranges[i-1].End = h.ranges[i].End
+				h.ranges = slices.Delete(h.ranges, i, i+1)
+			}
+			return true
+		}
+
+		// create a new range after the current one
+		if p > h.ranges[i].End {
+			h.ranges = slices.Insert(h.ranges, i+1, interval{Start: p, End: p})
+			return true
+		}
+	}
+
+	// create a new range at the beginning
+	h.ranges = slices.Insert(h.ranges, 0, interval{Start: p, End: p})
+	return true
+}
+
+// DeleteBelow deletes all entries below (but not including) p
+func (h *receivedPacketHistory) DeleteBelow(p protocol.PacketNumber) {
+	if p < h.deletedBelow {
+		return
+	}
+	h.deletedBelow = p
+
+	if len(h.ranges) == 0 {
+		return
+	}
+
+	idx := -1
+	for i := 0; i < len(h.ranges); i++ {
+		if h.ranges[i].End < p { // delete a whole range
+			idx = i
+		} else if p > h.ranges[i].Start && p <= h.ranges[i].End {
+			h.ranges[i].Start = p
+			break
+		} else { // no ranges affected. Nothing to do
+			break
+		}
+	}
+	if idx >= 0 {
+		h.ranges = slices.Delete(h.ranges, 0, idx+1)
+	}
+}
+
+// Backward returns an iterator over the ranges in reverse order
+func (h *receivedPacketHistory) Backward() iter.Seq[interval] {
+	return func(yield func(interval) bool) {
+		for i := len(h.ranges) - 1; i >= 0; i-- {
+			if !yield(h.ranges[i]) {
+				return
+			}
+		}
+	}
+}
+
+func (h *receivedPacketHistory) HighestMissingUpTo(p protocol.PacketNumber) protocol.PacketNumber {
+	if len(h.ranges) == 0 || (h.deletedBelow != protocol.InvalidPacketNumber && p < h.deletedBelow) {
+		return protocol.InvalidPacketNumber
+	}
+	p = min(h.ranges[len(h.ranges)-1].End, p)
+	for i := len(h.ranges) - 1; i >= 0; i-- {
+		r := h.ranges[i]
+		if p >= r.Start && p <= r.End { // p is contained in this range
+			highest := r.Start - 1 // highest packet in the gap before this range
+			if h.deletedBelow != protocol.InvalidPacketNumber && highest < h.deletedBelow {
+				return protocol.InvalidPacketNumber
+			}
+			return highest
+		}
+		if i >= 1 && p > h.ranges[i-1].End && p <= r.Start {
+			// p is in the gap between the previous range and this range
+			return p
+		}
+	}
+	return p
+}
+
+func (h *receivedPacketHistory) IsPotentiallyDuplicate(p protocol.PacketNumber) bool {
+	if p < h.deletedBelow {
+		return true
+	}
+	// Iterating over the slices is faster than using a binary search (using slices.BinarySearchFunc).
+	for i := len(h.ranges) - 1; i >= 0; i-- {
+		if p > h.ranges[i].End {
+			return false
+		}
+		if p <= h.ranges[i].End && p >= h.ranges[i].Start {
+			return true
+		}
+	}
+	return false
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_history_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_history_test.go
new file mode 100644
index 000000000..9e0d883ca
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_history_test.go
@@ -0,0 +1,304 @@
+package ackhandler
+
+import (
+	"math/rand/v2"
+	"slices"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestReceivedPacketHistorySingleRange(t *testing.T) {
+	hist := newReceivedPacketHistory()
+
+	require.True(t, hist.ReceivedPacket(4))
+	require.Equal(t, []interval{{Start: 4, End: 4}}, slices.Collect(hist.Backward()))
+
+	// add a duplicate packet
+	require.False(t, hist.ReceivedPacket(4))
+	require.Equal(t, []interval{{Start: 4, End: 4}}, slices.Collect(hist.Backward()))
+
+	// add a few more packets to extend the range
+	require.True(t, hist.ReceivedPacket(5))
+	require.True(t, hist.ReceivedPacket(6))
+	require.Equal(t, []interval{{Start: 4, End: 6}}, slices.Collect(hist.Backward()))
+
+	// add a duplicate within this range
+	require.False(t, hist.ReceivedPacket(5))
+	require.Equal(t, []interval{{Start: 4, End: 6}}, slices.Collect(hist.Backward()))
+
+	// extend the range at the front
+	require.True(t, hist.ReceivedPacket(3))
+	require.Equal(t, []interval{{Start: 3, End: 6}}, slices.Collect(hist.Backward()))
+}
+
+func TestReceivedPacketHistoryRanges(t *testing.T) {
+	hist := newReceivedPacketHistory()
+	require.Equal(t, protocol.InvalidPacketNumber, hist.HighestMissingUpTo(1000))
+
+	require.True(t, hist.ReceivedPacket(4))
+	require.Equal(t, protocol.PacketNumber(3), hist.HighestMissingUpTo(1000))
+	require.Equal(t, protocol.PacketNumber(3), hist.HighestMissingUpTo(4))
+	require.Equal(t, protocol.PacketNumber(3), hist.HighestMissingUpTo(3))
+	require.Equal(t, protocol.PacketNumber(2), hist.HighestMissingUpTo(2))
+	require.True(t, hist.ReceivedPacket(10))
+	require.Equal(t, protocol.PacketNumber(9), hist.HighestMissingUpTo(1000))
+	require.Equal(t, []interval{
+		{Start: 10, End: 10},
+		{Start: 4, End: 4},
+	}, slices.Collect(hist.Backward()))
+
+	// create a new range in the middle
+	require.True(t, hist.ReceivedPacket(7))
+	require.Equal(t, []interval{
+		{Start: 10, End: 10},
+		{Start: 7, End: 7},
+		{Start: 4, End: 4},
+	}, slices.Collect(hist.Backward()))
+
+	// create a new range at the front
+	require.True(t, hist.ReceivedPacket(1))
+	require.Equal(t, []interval{
+		{Start: 10, End: 10},
+		{Start: 7, End: 7},
+		{Start: 4, End: 4},
+		{Start: 1, End: 1},
+	}, slices.Collect(hist.Backward()))
+
+	// extend an existing range at the end
+	require.True(t, hist.ReceivedPacket(8))
+	require.Equal(t, []interval{
+		{Start: 10, End: 10},
+		{Start: 7, End: 8},
+		{Start: 4, End: 4},
+		{Start: 1, End: 1},
+	}, slices.Collect(hist.Backward()))
+
+	// extend an existing range at the front
+	require.True(t, hist.ReceivedPacket(6))
+	require.Equal(t, []interval{
+		{Start: 10, End: 10},
+		{Start: 6, End: 8},
+		{Start: 4, End: 4},
+		{Start: 1, End: 1},
+	}, slices.Collect(hist.Backward()))
+
+	// close a range
+	require.True(t, hist.ReceivedPacket(9))
+	require.Equal(t, []interval{
+		{Start: 6, End: 10},
+		{Start: 4, End: 4},
+		{Start: 1, End: 1},
+	}, slices.Collect(hist.Backward()))
+}
+
+func TestReceivedPacketHistoryMaxNumAckRanges(t *testing.T) {
+	hist := newReceivedPacketHistory()
+
+	for i := range protocol.MaxNumAckRanges {
+		require.True(t, hist.ReceivedPacket(protocol.PacketNumber(2*i)))
+	}
+	require.Len(t, hist.ranges, protocol.MaxNumAckRanges)
+	require.Equal(t, interval{Start: 0, End: 0}, hist.ranges[0])
+
+	hist.ReceivedPacket(2*protocol.MaxNumAckRanges + 1000)
+	// check that the oldest ACK range was deleted
+	require.Len(t, hist.ranges, protocol.MaxNumAckRanges)
+	require.Equal(t, interval{Start: 2, End: 2}, hist.ranges[0])
+}
+
+func TestReceivedPacketHistoryDeleteBelow(t *testing.T) {
+	hist := newReceivedPacketHistory()
+
+	hist.DeleteBelow(2)
+	require.Empty(t, slices.Collect(hist.Backward()))
+
+	require.True(t, hist.ReceivedPacket(2))
+	require.True(t, hist.ReceivedPacket(4))
+	require.True(t, hist.ReceivedPacket(5))
+	require.True(t, hist.ReceivedPacket(6))
+	require.True(t, hist.ReceivedPacket(10))
+
+	require.Equal(t, protocol.PacketNumber(3), hist.HighestMissingUpTo(6))
+	hist.DeleteBelow(6)
+	require.Equal(t, protocol.InvalidPacketNumber, hist.HighestMissingUpTo(6))
+	require.Equal(t, protocol.PacketNumber(9), hist.HighestMissingUpTo(10))
+	require.Equal(t, []interval{
+		{Start: 10, End: 10},
+		{Start: 6, End: 6},
+	}, slices.Collect(hist.Backward()))
+
+	// deleting from an existing range
+	require.True(t, hist.ReceivedPacket(7))
+	require.True(t, hist.ReceivedPacket(8))
+	hist.DeleteBelow(7)
+	require.Equal(t, []interval{
+		{Start: 10, End: 10},
+		{Start: 7, End: 8},
+	}, slices.Collect(hist.Backward()))
+
+	// keep a one-packet range
+	hist.DeleteBelow(10)
+	require.Equal(t, []interval{{Start: 10, End: 10}}, slices.Collect(hist.Backward()))
+
+	// delayed packets below deleted ranges are ignored
+	require.False(t, hist.ReceivedPacket(5))
+	require.Equal(t, []interval{{Start: 10, End: 10}}, slices.Collect(hist.Backward()))
+}
+
+func TestReceivedPacketHistoryDuplicateDetection(t *testing.T) {
+	hist := newReceivedPacketHistory()
+
+	require.False(t, hist.IsPotentiallyDuplicate(5))
+
+	require.True(t, hist.ReceivedPacket(4))
+	require.True(t, hist.ReceivedPacket(5))
+	require.True(t, hist.ReceivedPacket(6))
+	require.True(t, hist.ReceivedPacket(8))
+	require.True(t, hist.ReceivedPacket(9))
+
+	require.False(t, hist.IsPotentiallyDuplicate(3))
+	require.True(t, hist.IsPotentiallyDuplicate(4))
+	require.True(t, hist.IsPotentiallyDuplicate(5))
+	require.True(t, hist.IsPotentiallyDuplicate(6))
+	require.False(t, hist.IsPotentiallyDuplicate(7))
+	require.True(t, hist.IsPotentiallyDuplicate(8))
+	require.True(t, hist.IsPotentiallyDuplicate(9))
+	require.False(t, hist.IsPotentiallyDuplicate(10))
+
+	// delete and check for potential duplicates
+	hist.DeleteBelow(8)
+	require.True(t, hist.IsPotentiallyDuplicate(7))
+	require.True(t, hist.IsPotentiallyDuplicate(8))
+	require.True(t, hist.IsPotentiallyDuplicate(9))
+	require.False(t, hist.IsPotentiallyDuplicate(10))
+}
+
+func TestReceivedPacketHistoryRandomized(t *testing.T) {
+	hist := newReceivedPacketHistory()
+	packets := make(map[protocol.PacketNumber]struct{})
+	const num = 2 * protocol.MaxNumAckRanges
+	numLostPackets := rand.IntN(protocol.MaxNumAckRanges)
+	numRcvdPackets := num - numLostPackets
+
+	for i := range num {
+		packets[protocol.PacketNumber(i)] = struct{}{}
+	}
+	lostPackets := make([]protocol.PacketNumber, 0, numLostPackets)
+	for len(lostPackets) < numLostPackets {
+		p := protocol.PacketNumber(rand.IntN(num - 1)) // lose a random packet, but not the last one
+		if _, ok := packets[p]; ok {
+			lostPackets = append(lostPackets, p)
+			delete(packets, p)
+		}
+	}
+	slices.Sort(lostPackets)
+	t.Logf("Losing packets: %v", lostPackets)
+
+	ordered := make([]protocol.PacketNumber, 0, numRcvdPackets)
+	for p := range packets {
+		ordered = append(ordered, p)
+	}
+	rand.Shuffle(len(ordered), func(i, j int) { ordered[i], ordered[j] = ordered[j], ordered[i] })
+
+	t.Logf("Receiving packets: %v", ordered)
+	for i, p := range ordered {
+		require.True(t, hist.ReceivedPacket(p))
+		// sometimes receive a duplicate
+		if i > 0 && rand.Int()%5 == 0 {
+			require.False(t, hist.ReceivedPacket(ordered[rand.IntN(i)]))
+		}
+	}
+	var counter int
+	ackRanges := slices.Collect(hist.Backward())
+	t.Logf("ACK ranges: %v", ackRanges)
+	require.LessOrEqual(t, len(ackRanges), numLostPackets+1)
+	for _, ackRange := range ackRanges {
+		for p := ackRange.Start; p <= ackRange.End; p++ {
+			counter++
+			require.Contains(t, packets, p)
+		}
+	}
+	require.Equal(t, numRcvdPackets, counter)
+
+	deletedBelow := protocol.PacketNumber(rand.IntN(num * 2 / 3))
+	t.Logf("Deleting below %d", deletedBelow)
+	hist.DeleteBelow(deletedBelow)
+	for pn := range protocol.PacketNumber(num) {
+		if pn < deletedBelow {
+			require.Equal(t, protocol.InvalidPacketNumber, hist.HighestMissingUpTo(pn))
+			continue
+		}
+		expected := protocol.InvalidPacketNumber
+		for _, lost := range lostPackets {
+			if lost < deletedBelow {
+				continue
+			}
+			if lost > pn {
+				break
+			}
+			expected = lost
+		}
+		hm := hist.HighestMissingUpTo(pn)
+		require.Equalf(t, expected, hm, "highest missing up to %d: %d", pn, hm)
+	}
+}
+
+func BenchmarkHistoryReceiveSequentialPackets(b *testing.B) {
+	hist := newReceivedPacketHistory()
+	var pn protocol.PacketNumber
+	for b.Loop() {
+		hist.ReceivedPacket(pn)
+		pn++
+	}
+}
+
+// Packets are received sequentially, with occasional gaps
+func BenchmarkHistoryReceiveCommonCase(b *testing.B) {
+	hist := newReceivedPacketHistory()
+	var pn protocol.PacketNumber
+	for b.Loop() {
+		hist.ReceivedPacket(pn)
+		pn++
+		if pn%2000 == 0 {
+			pn += 4
+		}
+	}
+}
+
+func BenchmarkHistoryReceiveSequentialPacketsWithGaps(b *testing.B) {
+	hist := newReceivedPacketHistory()
+	var pn protocol.PacketNumber
+	for b.Loop() {
+		hist.ReceivedPacket(pn)
+		pn += 2
+	}
+}
+
+func BenchmarkHistoryReceiveReversePacketsWithGaps(b *testing.B) {
+	hist := newReceivedPacketHistory()
+	for i := 0; i < b.N; i++ {
+		hist.ReceivedPacket(protocol.PacketNumber(2 * (b.N - i)))
+	}
+}
+
+func BenchmarkHistoryIsDuplicate(b *testing.B) {
+	b.ReportAllocs()
+	hist := newReceivedPacketHistory()
+	var pn protocol.PacketNumber
+	for range protocol.MaxNumAckRanges {
+		for range 5 {
+			hist.ReceivedPacket(pn)
+			pn++
+		}
+		pn += 5 // create a gap
+	}
+
+	var p protocol.PacketNumber
+	for b.Loop() {
+		hist.IsPotentiallyDuplicate(p % pn)
+		p++
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_tracker.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_tracker.go
new file mode 100644
index 000000000..64092cccf
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_tracker.go
@@ -0,0 +1,228 @@
+package ackhandler
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+const reorderingThreshold = 1
+
+// The receivedPacketTracker tracks packets for the Initial and Handshake packet number space.
+// Every received packet is acknowledged immediately.
+type receivedPacketTracker struct {
+	ect0, ect1, ecnce uint64
+
+	packetHistory receivedPacketHistory
+
+	lastAck   *wire.AckFrame
+	hasNewAck bool // true as soon as we received an ack-eliciting new packet
+}
+
+func newReceivedPacketTracker() *receivedPacketTracker {
+	return &receivedPacketTracker{packetHistory: *newReceivedPacketHistory()}
+}
+
+func (h *receivedPacketTracker) ReceivedPacket(pn protocol.PacketNumber, ecn protocol.ECN, ackEliciting bool) error {
+	if isNew := h.packetHistory.ReceivedPacket(pn); !isNew {
+		return fmt.Errorf("receivedPacketTracker BUG: ReceivedPacket called for old / duplicate packet %d", pn)
+	}
+
+	//nolint:exhaustive // Only need to count ECT(0), ECT(1) and ECN-CE.
+	switch ecn {
+	case protocol.ECT0:
+		h.ect0++
+	case protocol.ECT1:
+		h.ect1++
+	case protocol.ECNCE:
+		h.ecnce++
+	}
+	if !ackEliciting {
+		return nil
+	}
+	h.hasNewAck = true
+	return nil
+}
+
+func (h *receivedPacketTracker) GetAckFrame() *wire.AckFrame {
+	if !h.hasNewAck {
+		return nil
+	}
+
+	// This function always returns the same ACK frame struct, filled with the most recent values.
+	ack := h.lastAck
+	if ack == nil {
+		ack = &wire.AckFrame{}
+	}
+	ack.Reset()
+	ack.ECT0 = h.ect0
+	ack.ECT1 = h.ect1
+	ack.ECNCE = h.ecnce
+	for r := range h.packetHistory.Backward() {
+		ack.AckRanges = append(ack.AckRanges, wire.AckRange{Smallest: r.Start, Largest: r.End})
+	}
+
+	h.lastAck = ack
+	h.hasNewAck = false
+	return ack
+}
+
+func (h *receivedPacketTracker) IsPotentiallyDuplicate(pn protocol.PacketNumber) bool {
+	return h.packetHistory.IsPotentiallyDuplicate(pn)
+}
+
+// number of ack-eliciting packets received before sending an ACK
+const packetsBeforeAck = 2
+
+// The appDataReceivedPacketTracker tracks packets received in the Application Data packet number space.
+// It waits until at least 2 packets were received before queueing an ACK, or until the max_ack_delay was reached.
+type appDataReceivedPacketTracker struct {
+	receivedPacketTracker
+
+	largestObservedRcvdTime monotime.Time
+
+	largestObserved protocol.PacketNumber
+	ignoreBelow     protocol.PacketNumber
+
+	maxAckDelay time.Duration
+	ackQueued   bool // true if we need send a new ACK
+
+	ackElicitingPacketsReceivedSinceLastAck int
+	ackAlarm                                monotime.Time
+
+	logger utils.Logger
+}
+
+func newAppDataReceivedPacketTracker(logger utils.Logger) *appDataReceivedPacketTracker {
+	h := &appDataReceivedPacketTracker{
+		receivedPacketTracker: *newReceivedPacketTracker(),
+		maxAckDelay:           protocol.MaxAckDelay,
+		logger:                logger,
+	}
+	return h
+}
+
+func (h *appDataReceivedPacketTracker) ReceivedPacket(pn protocol.PacketNumber, ecn protocol.ECN, rcvTime monotime.Time, ackEliciting bool) error {
+	if err := h.receivedPacketTracker.ReceivedPacket(pn, ecn, ackEliciting); err != nil {
+		return err
+	}
+	if pn >= h.largestObserved {
+		h.largestObserved = pn
+		h.largestObservedRcvdTime = rcvTime
+	}
+	if !ackEliciting {
+		return nil
+	}
+	h.ackElicitingPacketsReceivedSinceLastAck++
+	isMissing := h.isMissing(pn)
+	if !h.ackQueued && h.shouldQueueACK(pn, ecn, isMissing) {
+		h.ackQueued = true
+		h.ackAlarm = 0 // cancel the ack alarm
+	}
+	if !h.ackQueued {
+		// No ACK queued, but we'll need to acknowledge the packet after max_ack_delay.
+		h.ackAlarm = rcvTime.Add(h.maxAckDelay)
+		if h.logger.Debug() {
+			h.logger.Debugf("\tSetting ACK timer to max ack delay: %s", h.maxAckDelay)
+		}
+	}
+	return nil
+}
+
+// IgnoreBelow sets a lower limit for acknowledging packets.
+// Packets with packet numbers smaller than p will not be acked.
+func (h *appDataReceivedPacketTracker) IgnoreBelow(pn protocol.PacketNumber) {
+	if pn <= h.ignoreBelow {
+		return
+	}
+	h.ignoreBelow = pn
+	h.packetHistory.DeleteBelow(pn)
+	if h.logger.Debug() {
+		h.logger.Debugf("\tIgnoring all packets below %d.", pn)
+	}
+}
+
+// isMissing says if a packet was reported missing in the last ACK.
+func (h *appDataReceivedPacketTracker) isMissing(p protocol.PacketNumber) bool {
+	if h.lastAck == nil || p < h.ignoreBelow {
+		return false
+	}
+	return p < h.lastAck.LargestAcked() && !h.lastAck.AcksPacket(p)
+}
+
+func (h *appDataReceivedPacketTracker) hasNewMissingPackets() bool {
+	if h.lastAck == nil {
+		return false
+	}
+	if h.largestObserved < reorderingThreshold {
+		return false
+	}
+	highestMissing := h.packetHistory.HighestMissingUpTo(h.largestObserved - reorderingThreshold)
+	if highestMissing == protocol.InvalidPacketNumber {
+		return false
+	}
+	if highestMissing < h.lastAck.LargestAcked() {
+		// the packet was already reported missing in the last ACK
+		return false
+	}
+	return highestMissing > h.lastAck.LargestAcked()-reorderingThreshold
+}
+
+func (h *appDataReceivedPacketTracker) shouldQueueACK(pn protocol.PacketNumber, ecn protocol.ECN, wasMissing bool) bool {
+	// Send an ACK if this packet was reported missing in an ACK sent before.
+	// Ack decimation with reordering relies on the timer to send an ACK, but if
+	// missing packets we reported in the previous ACK, send an ACK immediately.
+	if wasMissing {
+		if h.logger.Debug() {
+			h.logger.Debugf("\tQueueing ACK because packet %d was missing before.", pn)
+		}
+		return true
+	}
+
+	// send an ACK every 2 ack-eliciting packets
+	if h.ackElicitingPacketsReceivedSinceLastAck >= packetsBeforeAck {
+		if h.logger.Debug() {
+			h.logger.Debugf("\tQueueing ACK because packet %d packets were received after the last ACK (using initial threshold: %d).", h.ackElicitingPacketsReceivedSinceLastAck, packetsBeforeAck)
+		}
+		return true
+	}
+
+	// queue an ACK if there are new missing packets to report
+	if h.hasNewMissingPackets() {
+		h.logger.Debugf("\tQueuing ACK because there's a new missing packet to report.")
+		return true
+	}
+
+	// queue an ACK if the packet was ECN-CE marked
+	if ecn == protocol.ECNCE {
+		h.logger.Debugf("\tQueuing ACK because the packet was ECN-CE marked.")
+		return true
+	}
+	return false
+}
+
+func (h *appDataReceivedPacketTracker) GetAckFrame(now monotime.Time, onlyIfQueued bool) *wire.AckFrame {
+	if onlyIfQueued && !h.ackQueued {
+		if h.ackAlarm.IsZero() || h.ackAlarm.After(now) {
+			return nil
+		}
+		if h.logger.Debug() && !h.ackAlarm.IsZero() {
+			h.logger.Debugf("Sending ACK because the ACK timer expired.")
+		}
+	}
+	ack := h.receivedPacketTracker.GetAckFrame()
+	if ack == nil {
+		return nil
+	}
+	ack.DelayTime = max(0, now.Sub(h.largestObservedRcvdTime))
+	h.ackQueued = false
+	h.ackAlarm = 0
+	h.ackElicitingPacketsReceivedSinceLastAck = 0
+	return ack
+}
+
+func (h *appDataReceivedPacketTracker) GetAlarmTimeout() monotime.Time { return h.ackAlarm }
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_tracker_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_tracker_test.go
new file mode 100644
index 000000000..119a38c42
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/received_packet_tracker_test.go
@@ -0,0 +1,188 @@
+package ackhandler
+
+import (
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestReceivedPacketTrackerGenerateACKs(t *testing.T) {
+	tracker := newReceivedPacketTracker()
+
+	require.NoError(t, tracker.ReceivedPacket(protocol.PacketNumber(3), protocol.ECNNon, true))
+	ack := tracker.GetAckFrame()
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{{Smallest: 3, Largest: 3}}, ack.AckRanges)
+	require.Zero(t, ack.DelayTime)
+
+	require.NoError(t, tracker.ReceivedPacket(protocol.PacketNumber(4), protocol.ECNNon, true))
+	ack = tracker.GetAckFrame()
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{{Smallest: 3, Largest: 4}}, ack.AckRanges)
+	require.Zero(t, ack.DelayTime)
+
+	require.NoError(t, tracker.ReceivedPacket(protocol.PacketNumber(1), protocol.ECNNon, true))
+	ack = tracker.GetAckFrame()
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{
+		{Smallest: 3, Largest: 4},
+		{Smallest: 1, Largest: 1},
+	}, ack.AckRanges)
+	require.Zero(t, ack.DelayTime)
+
+	// non-ack-eliciting packets don't trigger ACKs
+	require.NoError(t, tracker.ReceivedPacket(protocol.PacketNumber(10), protocol.ECNNon, false))
+	require.Nil(t, tracker.GetAckFrame())
+
+	require.NoError(t, tracker.ReceivedPacket(protocol.PacketNumber(11), protocol.ECNNon, true))
+	ack = tracker.GetAckFrame()
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{
+		{Smallest: 10, Largest: 11},
+		{Smallest: 3, Largest: 4},
+		{Smallest: 1, Largest: 1},
+	}, ack.AckRanges)
+}
+
+func TestAppDataReceivedPacketTrackerECN(t *testing.T) {
+	tr := newAppDataReceivedPacketTracker(utils.DefaultLogger)
+
+	require.NoError(t, tr.ReceivedPacket(0, protocol.ECT0, monotime.Now(), true))
+	pn := protocol.PacketNumber(1)
+	for range 2 {
+		require.NoError(t, tr.ReceivedPacket(pn, protocol.ECT1, monotime.Now(), true))
+		pn++
+	}
+	for range 3 {
+		require.NoError(t, tr.ReceivedPacket(pn, protocol.ECNCE, monotime.Now(), true))
+		pn++
+	}
+	ack := tr.GetAckFrame(monotime.Now(), false)
+	require.Equal(t, uint64(1), ack.ECT0)
+	require.Equal(t, uint64(2), ack.ECT1)
+	require.Equal(t, uint64(3), ack.ECNCE)
+}
+
+func TestAppDataReceivedPacketTrackerAckEverySecondPacket(t *testing.T) {
+	tr := newAppDataReceivedPacketTracker(utils.DefaultLogger)
+	require.Nil(t, tr.GetAckFrame(monotime.Now(), true))
+
+	for p := protocol.PacketNumber(1); p <= 20; p++ {
+		require.NoError(t, tr.ReceivedPacket(p, protocol.ECNNon, monotime.Now(), true))
+		switch p % 2 {
+		case 0:
+			require.NotNil(t, tr.GetAckFrame(monotime.Now(), true))
+		case 1:
+			require.Nil(t, tr.GetAckFrame(monotime.Now(), true))
+		}
+	}
+}
+
+func TestAppDataReceivedPacketTrackerAlarmTimeout(t *testing.T) {
+	tr := newAppDataReceivedPacketTracker(utils.DefaultLogger)
+
+	now := monotime.Now()
+	require.NoError(t, tr.ReceivedPacket(1, protocol.ECNNon, now, false))
+	require.Nil(t, tr.GetAckFrame(monotime.Now(), true))
+	require.Zero(t, tr.GetAlarmTimeout())
+
+	rcvTime := now.Add(10 * time.Millisecond)
+	require.NoError(t, tr.ReceivedPacket(2, protocol.ECNNon, rcvTime, true))
+	require.Equal(t, rcvTime.Add(protocol.MaxAckDelay), tr.GetAlarmTimeout())
+	require.Nil(t, tr.GetAckFrame(monotime.Now(), true))
+
+	// no timeout after the ACK has been dequeued
+	require.NotNil(t, tr.GetAckFrame(monotime.Now(), false))
+	require.Zero(t, tr.GetAlarmTimeout())
+}
+
+func TestAppDataReceivedPacketTrackerQueuesECNCE(t *testing.T) {
+	tr := newAppDataReceivedPacketTracker(utils.DefaultLogger)
+
+	require.NoError(t, tr.ReceivedPacket(1, protocol.ECNCE, monotime.Now(), true))
+	ack := tr.GetAckFrame(monotime.Now(), true)
+	require.NotNil(t, ack)
+	require.Equal(t, protocol.PacketNumber(1), ack.LargestAcked())
+	require.EqualValues(t, 1, ack.ECNCE)
+}
+
+func TestAppDataReceivedPacketTrackerMissingPackets(t *testing.T) {
+	tr := newAppDataReceivedPacketTracker(utils.DefaultLogger)
+
+	now := monotime.Now()
+	require.NoError(t, tr.ReceivedPacket(0, protocol.ECNNon, now, true))
+	require.Nil(t, tr.GetAckFrame(now, true))
+
+	require.NoError(t, tr.ReceivedPacket(5, protocol.ECNNon, now, true))
+	ack := tr.GetAckFrame(now, true) // ACK: 0 and 5, missing: 1, 2, 3, 4
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{{Smallest: 5, Largest: 5}, {Smallest: 0, Largest: 0}}, ack.AckRanges)
+
+	// now receive one of the missing packets
+	require.NoError(t, tr.ReceivedPacket(3, protocol.ECNNon, now, true))
+	ack = tr.GetAckFrame(now, true)
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{
+		{Smallest: 5, Largest: 5},
+		{Smallest: 3, Largest: 3},
+		{Smallest: 0, Largest: 0},
+	}, ack.AckRanges)
+
+	require.NoError(t, tr.ReceivedPacket(6, protocol.ECNNon, now, true))
+	require.Nil(t, tr.GetAckFrame(now, true))
+	require.NoError(t, tr.ReceivedPacket(8, protocol.ECNNon, now, true))
+	require.NotNil(t, tr.GetAckFrame(now, true))
+}
+
+func TestAppDataReceivedPacketTrackerDelayTime(t *testing.T) {
+	tr := newAppDataReceivedPacketTracker(utils.DefaultLogger)
+
+	now := monotime.Now()
+	require.NoError(t, tr.ReceivedPacket(1, protocol.ECNNon, now, true))
+	require.NoError(t, tr.ReceivedPacket(2, protocol.ECNNon, now.Add(-1337*time.Millisecond), true))
+	ack := tr.GetAckFrame(now, true)
+	require.NotNil(t, ack)
+	require.Equal(t, 1337*time.Millisecond, ack.DelayTime)
+
+	// don't use a negative delay time
+	require.NoError(t, tr.ReceivedPacket(3, protocol.ECNNon, now.Add(time.Hour), true))
+	ack = tr.GetAckFrame(now, false)
+	require.NotNil(t, ack)
+	require.Zero(t, ack.DelayTime)
+}
+
+func TestAppDataReceivedPacketTrackerIgnoreBelow(t *testing.T) {
+	tr := newAppDataReceivedPacketTracker(utils.DefaultLogger)
+
+	tr.IgnoreBelow(4)
+	// check that packets below 7 are considered duplicates
+	require.True(t, tr.IsPotentiallyDuplicate(3))
+	require.False(t, tr.IsPotentiallyDuplicate(4))
+
+	for i := 5; i <= 10; i++ {
+		require.NoError(t, tr.ReceivedPacket(protocol.PacketNumber(i), protocol.ECNNon, monotime.Now(), true))
+	}
+	ack := tr.GetAckFrame(monotime.Now(), true)
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{{Smallest: 5, Largest: 10}}, ack.AckRanges)
+
+	tr.IgnoreBelow(7)
+
+	require.NoError(t, tr.ReceivedPacket(11, protocol.ECNNon, monotime.Now(), true))
+	require.NoError(t, tr.ReceivedPacket(12, protocol.ECNNon, monotime.Now(), true))
+	ack = tr.GetAckFrame(monotime.Now(), true)
+	require.NotNil(t, ack)
+	require.Equal(t, []wire.AckRange{{Smallest: 7, Largest: 12}}, ack.AckRanges)
+
+	// make sure that old packets are not accepted
+	require.ErrorContains(t,
+		tr.ReceivedPacket(4, protocol.ECNNon, monotime.Now(), true),
+		"receivedPacketTracker BUG: ReceivedPacket called for old / duplicate packet 4",
+	)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/send_mode.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/send_mode.go
new file mode 100644
index 000000000..c03f3a6f0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/send_mode.go
@@ -0,0 +1,46 @@
+package ackhandler
+
+import "fmt"
+
+// The SendMode says what kind of packets can be sent.
+type SendMode uint8
+
+const (
+	// SendNone means that no packets should be sent
+	SendNone SendMode = iota
+	// SendAck means an ACK-only packet should be sent
+	SendAck
+	// SendPTOInitial means that an Initial probe packet should be sent
+	SendPTOInitial
+	// SendPTOHandshake means that a Handshake probe packet should be sent
+	SendPTOHandshake
+	// SendPTOAppData means that an Application data probe packet should be sent
+	SendPTOAppData
+	// SendPacingLimited means that the pacer doesn't allow sending of a packet right now,
+	// but will do in a little while.
+	// The timestamp when sending is allowed again can be obtained via the SentPacketHandler.TimeUntilSend.
+	SendPacingLimited
+	// SendAny means that any packet should be sent
+	SendAny
+)
+
+func (s SendMode) String() string {
+	switch s {
+	case SendNone:
+		return "none"
+	case SendAck:
+		return "ack"
+	case SendPTOInitial:
+		return "pto (Initial)"
+	case SendPTOHandshake:
+		return "pto (Handshake)"
+	case SendPTOAppData:
+		return "pto (Application Data)"
+	case SendAny:
+		return "any"
+	case SendPacingLimited:
+		return "pacing limited"
+	default:
+		return fmt.Sprintf("invalid send mode: %d", s)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/send_mode_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/send_mode_test.go
new file mode 100644
index 000000000..0159ba07e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/send_mode_test.go
@@ -0,0 +1,18 @@
+package ackhandler
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSendModeStringer(t *testing.T) {
+	require.Equal(t, "none", SendNone.String())
+	require.Equal(t, "any", SendAny.String())
+	require.Equal(t, "pacing limited", SendPacingLimited.String())
+	require.Equal(t, "ack", SendAck.String())
+	require.Equal(t, "pto (Initial)", SendPTOInitial.String())
+	require.Equal(t, "pto (Handshake)", SendPTOHandshake.String())
+	require.Equal(t, "pto (Application Data)", SendPTOAppData.String())
+	require.Equal(t, "invalid send mode: 123", SendMode(123).String())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_handler.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_handler.go
new file mode 100644
index 000000000..9b539eadd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_handler.go
@@ -0,0 +1,1143 @@
+package ackhandler
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/congestion"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+const (
+	// Maximum reordering in time space before time based loss detection considers a packet lost.
+	// Specified as an RTT multiplier.
+	timeThreshold = 9.0 / 8
+	// Maximum reordering in packets before packet threshold loss detection considers a packet lost.
+	packetThreshold = 3
+	// Before validating the client's address, the server won't send more than 3x bytes than it received.
+	amplificationFactor = 3
+	// We use Retry packets to derive an RTT estimate. Make sure we don't set the RTT to a super low value yet.
+	minRTTAfterRetry = 5 * time.Millisecond
+	// The PTO duration uses exponential backoff, but is truncated to a maximum value, as allowed by RFC 8961, section 4.4.
+	maxPTODuration = 60 * time.Second
+)
+
+// Path probe packets are declared lost after this time.
+const pathProbePacketLossTimeout = time.Second
+
+type packetNumberSpace struct {
+	history sentPacketHistory
+	pns     packetNumberGenerator
+
+	lossTime                   monotime.Time
+	lastAckElicitingPacketTime monotime.Time
+
+	largestAcked protocol.PacketNumber
+	largestSent  protocol.PacketNumber
+}
+
+func newPacketNumberSpace(initialPN protocol.PacketNumber, isAppData bool) *packetNumberSpace {
+	var pns packetNumberGenerator
+	if isAppData {
+		pns = newSkippingPacketNumberGenerator(initialPN, protocol.SkipPacketInitialPeriod, protocol.SkipPacketMaxPeriod)
+	} else {
+		pns = newSequentialPacketNumberGenerator(initialPN)
+	}
+	return &packetNumberSpace{
+		history:      *newSentPacketHistory(isAppData),
+		pns:          pns,
+		largestSent:  protocol.InvalidPacketNumber,
+		largestAcked: protocol.InvalidPacketNumber,
+	}
+}
+
+type alarmTimer struct {
+	Time            monotime.Time
+	TimerType       qlog.TimerType
+	EncryptionLevel protocol.EncryptionLevel
+}
+
+type sentPacketHandler struct {
+	initialPackets   *packetNumberSpace
+	handshakePackets *packetNumberSpace
+	appDataPackets   *packetNumberSpace
+	lostPackets      lostPacketTracker // only for application-data packet number space
+	// send time of the largest acknowledged packet, across all packet number spaces
+	largestAckedTime monotime.Time
+
+	// Do we know that the peer completed address validation yet?
+	// Always true for the server.
+	peerCompletedAddressValidation bool
+	bytesReceived                  protocol.ByteCount
+	bytesSent                      protocol.ByteCount
+	// Have we validated the peer's address yet?
+	// Always true for the client.
+	peerAddressValidated bool
+
+	handshakeConfirmed bool
+
+	ignorePacketsBelow func(protocol.PacketNumber)
+
+	ackedPackets []packetWithPacketNumber // to avoid allocations in detectAndRemoveAckedPackets
+
+	bytesInFlight protocol.ByteCount
+
+	congestion congestion.SendAlgorithmWithDebugInfos
+	rttStats   *utils.RTTStats
+	connStats  *utils.ConnectionStats
+
+	// The number of times a PTO has been sent without receiving an ack.
+	ptoCount uint32
+	ptoMode  SendMode
+	// The number of PTO probe packets that should be sent.
+	// Only applies to the application-data packet number space.
+	numProbesToSend int
+
+	// The alarm timeout
+	alarm alarmTimer
+
+	enableECN  bool
+	ecnTracker ecnHandler
+
+	perspective protocol.Perspective
+
+	qlogger     qlogwriter.Recorder
+	lastMetrics qlog.MetricsUpdated
+	logger      utils.Logger
+}
+
+var _ SentPacketHandler = &sentPacketHandler{}
+
+// clientAddressValidated indicates whether the address was validated beforehand by an address validation token.
+// If the address was validated, the amplification limit doesn't apply. It has no effect for a client.
+func NewSentPacketHandler(
+	initialPN protocol.PacketNumber,
+	initialMaxDatagramSize protocol.ByteCount,
+	rttStats *utils.RTTStats,
+	connStats *utils.ConnectionStats,
+	clientAddressValidated bool,
+	enableECN bool,
+	ignorePacketsBelow func(protocol.PacketNumber),
+	pers protocol.Perspective,
+	qlogger qlogwriter.Recorder,
+	logger utils.Logger,
+) SentPacketHandler {
+	congestion := congestion.NewCubicSender(
+		congestion.DefaultClock{},
+		rttStats,
+		connStats,
+		initialMaxDatagramSize,
+		true, // use Reno
+		qlogger,
+	)
+
+	h := &sentPacketHandler{
+		peerCompletedAddressValidation: pers == protocol.PerspectiveServer,
+		peerAddressValidated:           pers == protocol.PerspectiveClient || clientAddressValidated,
+		initialPackets:                 newPacketNumberSpace(initialPN, false),
+		handshakePackets:               newPacketNumberSpace(0, false),
+		appDataPackets:                 newPacketNumberSpace(0, true),
+		lostPackets:                    *newLostPacketTracker(64),
+		rttStats:                       rttStats,
+		connStats:                      connStats,
+		congestion:                     congestion,
+		ignorePacketsBelow:             ignorePacketsBelow,
+		perspective:                    pers,
+		qlogger:                        qlogger,
+		logger:                         logger,
+	}
+	if enableECN {
+		h.enableECN = true
+		h.ecnTracker = newECNTracker(logger, qlogger)
+	}
+	return h
+}
+
+func (h *sentPacketHandler) removeFromBytesInFlight(p *packet) {
+	if p.includedInBytesInFlight {
+		if p.Length > h.bytesInFlight {
+			panic("negative bytes_in_flight")
+		}
+		h.bytesInFlight -= p.Length
+		p.includedInBytesInFlight = false
+	}
+}
+
+func (h *sentPacketHandler) DropPackets(encLevel protocol.EncryptionLevel, now monotime.Time) {
+	// The server won't await address validation after the handshake is confirmed.
+	// This applies even if we didn't receive an ACK for a Handshake packet.
+	if h.perspective == protocol.PerspectiveClient && encLevel == protocol.EncryptionHandshake {
+		h.peerCompletedAddressValidation = true
+	}
+	// remove outstanding packets from bytes_in_flight
+	if encLevel == protocol.EncryptionInitial || encLevel == protocol.EncryptionHandshake {
+		pnSpace := h.getPacketNumberSpace(encLevel)
+		// We might already have dropped this packet number space.
+		if pnSpace == nil {
+			return
+		}
+		for _, p := range pnSpace.history.Packets() {
+			h.removeFromBytesInFlight(p)
+		}
+	}
+	// drop the packet history
+	//nolint:exhaustive // Not every packet number space can be dropped.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		h.initialPackets = nil
+	case protocol.EncryptionHandshake:
+		// Dropping the handshake packet number space means that the handshake is confirmed,
+		// see section 4.9.2 of RFC 9001.
+		h.handshakeConfirmed = true
+		h.handshakePackets = nil
+	case protocol.Encryption0RTT:
+		// This function is only called when 0-RTT is rejected,
+		// and not when the client drops 0-RTT keys when the handshake completes.
+		// When 0-RTT is rejected, all application data sent so far becomes invalid.
+		// Delete the packets from the history and remove them from bytes_in_flight.
+		for pn, p := range h.appDataPackets.history.Packets() {
+			if p.EncryptionLevel != protocol.Encryption0RTT {
+				break
+			}
+			h.removeFromBytesInFlight(p)
+			h.appDataPackets.history.Remove(pn)
+		}
+	default:
+		panic(fmt.Sprintf("Cannot drop keys for encryption level %s", encLevel))
+	}
+	if h.qlogger != nil && h.ptoCount != 0 {
+		h.qlogger.RecordEvent(qlog.PTOCountUpdated{PTOCount: 0})
+	}
+	h.ptoCount = 0
+	h.numProbesToSend = 0
+	h.ptoMode = SendNone
+	h.setLossDetectionTimer(now)
+}
+
+func (h *sentPacketHandler) ReceivedBytes(n protocol.ByteCount, t monotime.Time) {
+	h.connStats.BytesReceived.Add(uint64(n))
+	wasAmplificationLimit := h.isAmplificationLimited()
+	h.bytesReceived += n
+	if wasAmplificationLimit && !h.isAmplificationLimited() {
+		h.setLossDetectionTimer(t)
+	}
+}
+
+func (h *sentPacketHandler) ReceivedPacket(l protocol.EncryptionLevel, t monotime.Time) {
+	h.connStats.PacketsReceived.Add(1)
+	if h.perspective == protocol.PerspectiveServer && l == protocol.EncryptionHandshake && !h.peerAddressValidated {
+		h.peerAddressValidated = true
+		h.setLossDetectionTimer(t)
+	}
+}
+
+func (h *sentPacketHandler) packetsInFlight() int {
+	packetsInFlight := h.appDataPackets.history.NumOutstanding()
+	if h.handshakePackets != nil {
+		packetsInFlight += h.handshakePackets.history.NumOutstanding()
+	}
+	if h.initialPackets != nil {
+		packetsInFlight += h.initialPackets.history.NumOutstanding()
+	}
+	return packetsInFlight
+}
+
+func (h *sentPacketHandler) SentPacket(
+	t monotime.Time,
+	pn, largestAcked protocol.PacketNumber,
+	streamFrames []StreamFrame,
+	frames []Frame,
+	encLevel protocol.EncryptionLevel,
+	ecn protocol.ECN,
+	size protocol.ByteCount,
+	isPathMTUProbePacket bool,
+	isPathProbePacket bool,
+) {
+	h.bytesSent += size
+	h.connStats.BytesSent.Add(uint64(size))
+	h.connStats.PacketsSent.Add(1)
+
+	pnSpace := h.getPacketNumberSpace(encLevel)
+	if h.logger.Debug() && (pnSpace.history.HasOutstandingPackets() || pnSpace.history.HasOutstandingPathProbes()) {
+		for p := max(0, pnSpace.largestSent+1); p < pn; p++ {
+			h.logger.Debugf("Skipping packet number %d", p)
+		}
+	}
+
+	pnSpace.largestSent = pn
+
+	p := getPacket()
+	p.SendTime = t
+	p.EncryptionLevel = encLevel
+	p.Length = size
+	p.Frames = frames
+	p.LargestAcked = largestAcked
+	p.StreamFrames = streamFrames
+	p.IsPathMTUProbePacket = isPathMTUProbePacket
+	p.isPathProbePacket = isPathProbePacket
+	isAckEliciting := p.IsAckEliciting()
+
+	if isPathProbePacket {
+		pnSpace.history.SentPathProbePacket(pn, p)
+		h.setLossDetectionTimer(t)
+		return
+	}
+	if isAckEliciting {
+		pnSpace.lastAckElicitingPacketTime = t
+		h.bytesInFlight += size
+		p.includedInBytesInFlight = true
+		if h.numProbesToSend > 0 {
+			h.numProbesToSend--
+		}
+	}
+	h.congestion.OnPacketSent(t, h.bytesInFlight, pn, size, isAckEliciting)
+
+	if encLevel == protocol.Encryption1RTT && h.ecnTracker != nil {
+		h.ecnTracker.SentPacket(pn, ecn)
+	}
+
+	pnSpace.history.SentPacket(pn, p)
+	if !isAckEliciting {
+		if !h.peerCompletedAddressValidation {
+			h.setLossDetectionTimer(t)
+		}
+		return
+	}
+	if h.qlogger != nil {
+		h.qlogMetricsUpdated()
+	}
+	h.setLossDetectionTimer(t)
+}
+
+func (h *sentPacketHandler) qlogMetricsUpdated() {
+	var metricsUpdatedEvent qlog.MetricsUpdated
+	var updated bool
+	if h.rttStats.HasMeasurement() {
+		if h.lastMetrics.MinRTT != h.rttStats.MinRTT() {
+			metricsUpdatedEvent.MinRTT = h.rttStats.MinRTT()
+			h.lastMetrics.MinRTT = metricsUpdatedEvent.MinRTT
+			updated = true
+		}
+		if h.lastMetrics.SmoothedRTT != h.rttStats.SmoothedRTT() {
+			metricsUpdatedEvent.SmoothedRTT = h.rttStats.SmoothedRTT()
+			h.lastMetrics.SmoothedRTT = metricsUpdatedEvent.SmoothedRTT
+			updated = true
+		}
+		if h.lastMetrics.LatestRTT != h.rttStats.LatestRTT() {
+			metricsUpdatedEvent.LatestRTT = h.rttStats.LatestRTT()
+			h.lastMetrics.LatestRTT = metricsUpdatedEvent.LatestRTT
+			updated = true
+		}
+		if h.lastMetrics.RTTVariance != h.rttStats.MeanDeviation() {
+			metricsUpdatedEvent.RTTVariance = h.rttStats.MeanDeviation()
+			h.lastMetrics.RTTVariance = metricsUpdatedEvent.RTTVariance
+			updated = true
+		}
+	}
+	if cwnd := h.congestion.GetCongestionWindow(); h.lastMetrics.CongestionWindow != int(cwnd) {
+		metricsUpdatedEvent.CongestionWindow = int(cwnd)
+		h.lastMetrics.CongestionWindow = metricsUpdatedEvent.CongestionWindow
+		updated = true
+	}
+	if h.lastMetrics.BytesInFlight != int(h.bytesInFlight) {
+		metricsUpdatedEvent.BytesInFlight = int(h.bytesInFlight)
+		h.lastMetrics.BytesInFlight = metricsUpdatedEvent.BytesInFlight
+		updated = true
+	}
+	packetsInFlight := h.packetsInFlight()
+	if h.lastMetrics.PacketsInFlight != packetsInFlight {
+		metricsUpdatedEvent.PacketsInFlight = packetsInFlight
+		h.lastMetrics.PacketsInFlight = metricsUpdatedEvent.PacketsInFlight
+		updated = true
+	}
+	if updated {
+		h.qlogger.RecordEvent(metricsUpdatedEvent)
+	}
+}
+
+func (h *sentPacketHandler) getPacketNumberSpace(encLevel protocol.EncryptionLevel) *packetNumberSpace {
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return h.initialPackets
+	case protocol.EncryptionHandshake:
+		return h.handshakePackets
+	case protocol.Encryption0RTT, protocol.Encryption1RTT:
+		return h.appDataPackets
+	default:
+		panic("invalid packet number space")
+	}
+}
+
+func (h *sentPacketHandler) ReceivedAck(ack *wire.AckFrame, encLevel protocol.EncryptionLevel, rcvTime monotime.Time) (bool /* contained 1-RTT packet */, error) {
+	pnSpace := h.getPacketNumberSpace(encLevel)
+
+	largestAcked := ack.LargestAcked()
+	if largestAcked > pnSpace.largestSent {
+		return false, &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "received ACK for an unsent packet",
+		}
+	}
+
+	// Servers complete address validation when a protected packet is received.
+	if h.perspective == protocol.PerspectiveClient && !h.peerCompletedAddressValidation &&
+		(encLevel == protocol.EncryptionHandshake || encLevel == protocol.Encryption1RTT) {
+		h.peerCompletedAddressValidation = true
+		h.logger.Debugf("Peer doesn't await address validation any longer.")
+		// Make sure that the timer is reset, even if this ACK doesn't acknowledge any (ack-eliciting) packets.
+		h.setLossDetectionTimer(rcvTime)
+	}
+
+	priorInFlight := h.bytesInFlight
+	ackedPackets, hasAckEliciting, err := h.detectAndRemoveAckedPackets(ack, encLevel)
+	if err != nil || len(ackedPackets) == 0 {
+		return false, err
+	}
+	// update the RTT, if:
+	// * the largest acked is newly acknowledged, AND
+	// * at least one new ack-eliciting packet was acknowledged
+	if len(ackedPackets) > 0 {
+		if p := ackedPackets[len(ackedPackets)-1]; p.PacketNumber == ack.LargestAcked() && !p.isPathProbePacket && hasAckEliciting {
+			// don't use the ack delay for Initial and Handshake packets
+			var ackDelay time.Duration
+			if encLevel == protocol.Encryption1RTT {
+				ackDelay = min(ack.DelayTime, h.rttStats.MaxAckDelay())
+			}
+			if h.largestAckedTime.IsZero() || !p.SendTime.Before(h.largestAckedTime) {
+				h.rttStats.UpdateRTT(rcvTime.Sub(p.SendTime), ackDelay)
+				if h.logger.Debug() {
+					h.logger.Debugf("\tupdated RTT: %s (σ: %s)", h.rttStats.SmoothedRTT(), h.rttStats.MeanDeviation())
+				}
+				h.largestAckedTime = p.SendTime
+			}
+			h.congestion.MaybeExitSlowStart()
+		}
+	}
+
+	// Only inform the ECN tracker about new 1-RTT ACKs if the ACK increases the largest acked.
+	if encLevel == protocol.Encryption1RTT && h.ecnTracker != nil && largestAcked > pnSpace.largestAcked {
+		congested := h.ecnTracker.HandleNewlyAcked(ackedPackets, int64(ack.ECT0), int64(ack.ECT1), int64(ack.ECNCE))
+		if congested {
+			h.congestion.OnCongestionEvent(largestAcked, 0, priorInFlight)
+		}
+	}
+
+	pnSpace.largestAcked = max(pnSpace.largestAcked, largestAcked)
+
+	h.detectLostPackets(rcvTime, encLevel)
+	if encLevel == protocol.Encryption1RTT {
+		h.detectLostPathProbes(rcvTime)
+	}
+	var acked1RTTPacket bool
+	for _, p := range ackedPackets {
+		if p.includedInBytesInFlight {
+			h.congestion.OnPacketAcked(p.PacketNumber, p.Length, priorInFlight, rcvTime)
+		}
+		if p.EncryptionLevel == protocol.Encryption1RTT {
+			acked1RTTPacket = true
+		}
+		h.removeFromBytesInFlight(p.packet)
+		if !p.isPathProbePacket {
+			putPacket(p.packet)
+		}
+	}
+
+	// detect spurious losses for application data packets, if the ACK was not reordered
+	if encLevel == protocol.Encryption1RTT && largestAcked == pnSpace.largestAcked {
+		h.detectSpuriousLosses(
+			ack,
+			rcvTime.Add(-min(ack.DelayTime, h.rttStats.MaxAckDelay())),
+		)
+		// clean up lost packet history
+		h.lostPackets.DeleteBefore(rcvTime.Add(-3 * h.rttStats.PTO(false)))
+	}
+
+	// After this point, we must not use ackedPackets any longer!
+	// We've already returned the buffers.
+	ackedPackets = nil    //nolint:ineffassign // This is just to be on the safe side.
+	clear(h.ackedPackets) // make sure the memory is released
+	h.ackedPackets = h.ackedPackets[:0]
+
+	// Reset the pto_count unless the client is unsure if the server has validated the client's address.
+	if h.peerCompletedAddressValidation {
+		if h.qlogger != nil && h.ptoCount != 0 {
+			h.qlogger.RecordEvent(qlog.PTOCountUpdated{PTOCount: 0})
+		}
+		h.ptoCount = 0
+	}
+	h.numProbesToSend = 0
+
+	if h.qlogger != nil {
+		h.qlogMetricsUpdated()
+	}
+
+	h.setLossDetectionTimer(rcvTime)
+	return acked1RTTPacket, nil
+}
+
+func (h *sentPacketHandler) detectSpuriousLosses(ack *wire.AckFrame, ackTime monotime.Time) {
+	var maxPacketReordering protocol.PacketNumber
+	var maxTimeReordering time.Duration
+	ackRangeIdx := len(ack.AckRanges) - 1
+	var spuriousLosses []protocol.PacketNumber
+	for pn, sendTime := range h.lostPackets.All() {
+		ackRange := ack.AckRanges[ackRangeIdx]
+		for pn > ackRange.Largest {
+			// this should never happen, since detectSpuriousLosses is only called for ACKs that increase the largest acked
+			if ackRangeIdx == 0 {
+				break
+			}
+			ackRangeIdx--
+			ackRange = ack.AckRanges[ackRangeIdx]
+		}
+		if pn < ackRange.Smallest {
+			continue
+		}
+		if pn <= ackRange.Largest {
+			packetReordering := h.appDataPackets.history.Difference(ack.LargestAcked(), pn)
+			timeReordering := ackTime.Sub(sendTime)
+			maxPacketReordering = max(maxPacketReordering, packetReordering)
+			maxTimeReordering = max(maxTimeReordering, timeReordering)
+
+			if h.qlogger != nil {
+				h.qlogger.RecordEvent(qlog.SpuriousLoss{
+					EncryptionLevel:  protocol.Encryption1RTT,
+					PacketNumber:     pn,
+					PacketReordering: uint64(packetReordering),
+					TimeReordering:   timeReordering,
+				})
+			}
+			spuriousLosses = append(spuriousLosses, pn)
+		}
+	}
+	for _, pn := range spuriousLosses {
+		h.lostPackets.Delete(pn)
+	}
+}
+
+// Packets are returned in ascending packet number order.
+func (h *sentPacketHandler) detectAndRemoveAckedPackets(
+	ack *wire.AckFrame,
+	encLevel protocol.EncryptionLevel,
+) (_ []packetWithPacketNumber, hasAckEliciting bool, _ error) {
+	if len(h.ackedPackets) > 0 {
+		return nil, false, errors.New("ackhandler BUG: ackedPackets slice not empty")
+	}
+
+	pnSpace := h.getPacketNumberSpace(encLevel)
+
+	if encLevel == protocol.Encryption1RTT {
+		for p := range pnSpace.history.SkippedPackets() {
+			if ack.AcksPacket(p) {
+				return nil, false, &qerr.TransportError{
+					ErrorCode:    qerr.ProtocolViolation,
+					ErrorMessage: fmt.Sprintf("received an ACK for skipped packet number: %d (%s)", p, encLevel),
+				}
+			}
+		}
+	}
+
+	var ackRangeIndex int
+	lowestAcked := ack.LowestAcked()
+	largestAcked := ack.LargestAcked()
+	for pn, p := range pnSpace.history.Packets() {
+		// ignore packets below the lowest acked
+		if pn < lowestAcked {
+			continue
+		}
+		if pn > largestAcked {
+			break
+		}
+
+		if ack.HasMissingRanges() {
+			ackRange := ack.AckRanges[len(ack.AckRanges)-1-ackRangeIndex]
+
+			for pn > ackRange.Largest && ackRangeIndex < len(ack.AckRanges)-1 {
+				ackRangeIndex++
+				ackRange = ack.AckRanges[len(ack.AckRanges)-1-ackRangeIndex]
+			}
+
+			if pn < ackRange.Smallest { // packet not contained in ACK range
+				continue
+			}
+			if pn > ackRange.Largest {
+				return nil, false, fmt.Errorf("BUG: ackhandler would have acked wrong packet %d, while evaluating range %d -> %d", pn, ackRange.Smallest, ackRange.Largest)
+			}
+		}
+		if p.isPathProbePacket {
+			probePacket := pnSpace.history.RemovePathProbe(pn)
+			// the probe packet might already have been declared lost
+			if probePacket != nil {
+				h.ackedPackets = append(h.ackedPackets, packetWithPacketNumber{PacketNumber: pn, packet: probePacket})
+			}
+			continue
+		}
+		if p.IsAckEliciting() {
+			hasAckEliciting = true
+		}
+		h.ackedPackets = append(h.ackedPackets, packetWithPacketNumber{PacketNumber: pn, packet: p})
+	}
+	if h.logger.Debug() && len(h.ackedPackets) > 0 {
+		pns := make([]protocol.PacketNumber, len(h.ackedPackets))
+		for i, p := range h.ackedPackets {
+			pns[i] = p.PacketNumber
+		}
+		h.logger.Debugf("\tnewly acked packets (%d): %d", len(pns), pns)
+	}
+
+	for _, p := range h.ackedPackets {
+		if p.LargestAcked != protocol.InvalidPacketNumber && encLevel == protocol.Encryption1RTT && h.ignorePacketsBelow != nil {
+			h.ignorePacketsBelow(p.LargestAcked + 1)
+		}
+
+		for _, f := range p.Frames {
+			if f.Handler != nil {
+				f.Handler.OnAcked(f.Frame)
+			}
+		}
+		for _, f := range p.StreamFrames {
+			if f.Handler != nil {
+				f.Handler.OnAcked(f.Frame)
+			}
+		}
+		if err := pnSpace.history.Remove(p.PacketNumber); err != nil {
+			return nil, false, err
+		}
+	}
+	// TODO: add support for the transport:packets_acked qlog event
+	return h.ackedPackets, hasAckEliciting, nil
+}
+
+func (h *sentPacketHandler) getLossTimeAndSpace() (monotime.Time, protocol.EncryptionLevel) {
+	var encLevel protocol.EncryptionLevel
+	var lossTime monotime.Time
+
+	if h.initialPackets != nil {
+		lossTime = h.initialPackets.lossTime
+		encLevel = protocol.EncryptionInitial
+	}
+	if h.handshakePackets != nil && (lossTime.IsZero() || (!h.handshakePackets.lossTime.IsZero() && h.handshakePackets.lossTime.Before(lossTime))) {
+		lossTime = h.handshakePackets.lossTime
+		encLevel = protocol.EncryptionHandshake
+	}
+	if lossTime.IsZero() || (!h.appDataPackets.lossTime.IsZero() && h.appDataPackets.lossTime.Before(lossTime)) {
+		lossTime = h.appDataPackets.lossTime
+		encLevel = protocol.Encryption1RTT
+	}
+	return lossTime, encLevel
+}
+
+func (h *sentPacketHandler) getScaledPTO(includeMaxAckDelay bool) time.Duration {
+	pto := h.rttStats.PTO(includeMaxAckDelay) << h.ptoCount
+	if pto > maxPTODuration || pto <= 0 {
+		return maxPTODuration
+	}
+	return pto
+}
+
+// same logic as getLossTimeAndSpace, but for lastAckElicitingPacketTime instead of lossTime
+func (h *sentPacketHandler) getPTOTimeAndSpace(now monotime.Time) (pto monotime.Time, encLevel protocol.EncryptionLevel) {
+	// We only send application data probe packets once the handshake is confirmed,
+	// because before that, we don't have the keys to decrypt ACKs sent in 1-RTT packets.
+	if !h.handshakeConfirmed && !h.hasOutstandingCryptoPackets() {
+		if h.peerCompletedAddressValidation {
+			return
+		}
+		t := now.Add(h.getScaledPTO(false))
+		if h.initialPackets != nil {
+			return t, protocol.EncryptionInitial
+		}
+		return t, protocol.EncryptionHandshake
+	}
+
+	if h.initialPackets != nil && h.initialPackets.history.HasOutstandingPackets() &&
+		!h.initialPackets.lastAckElicitingPacketTime.IsZero() {
+		encLevel = protocol.EncryptionInitial
+		if t := h.initialPackets.lastAckElicitingPacketTime; !t.IsZero() {
+			pto = t.Add(h.getScaledPTO(false))
+		}
+	}
+	if h.handshakePackets != nil && h.handshakePackets.history.HasOutstandingPackets() &&
+		!h.handshakePackets.lastAckElicitingPacketTime.IsZero() {
+		t := h.handshakePackets.lastAckElicitingPacketTime.Add(h.getScaledPTO(false))
+		if pto.IsZero() || (!t.IsZero() && t.Before(pto)) {
+			pto = t
+			encLevel = protocol.EncryptionHandshake
+		}
+	}
+	if h.handshakeConfirmed && h.appDataPackets.history.HasOutstandingPackets() &&
+		!h.appDataPackets.lastAckElicitingPacketTime.IsZero() {
+		t := h.appDataPackets.lastAckElicitingPacketTime.Add(h.getScaledPTO(true))
+		if pto.IsZero() || (!t.IsZero() && t.Before(pto)) {
+			pto = t
+			encLevel = protocol.Encryption1RTT
+		}
+	}
+	return pto, encLevel
+}
+
+func (h *sentPacketHandler) hasOutstandingCryptoPackets() bool {
+	if h.initialPackets != nil && h.initialPackets.history.HasOutstandingPackets() {
+		return true
+	}
+	if h.handshakePackets != nil && h.handshakePackets.history.HasOutstandingPackets() {
+		return true
+	}
+	return false
+}
+
+func (h *sentPacketHandler) setLossDetectionTimer(now monotime.Time) {
+	oldAlarm := h.alarm // only needed in case tracing is enabled
+	newAlarm := h.lossDetectionTime(now)
+	h.alarm = newAlarm
+
+	hasAlarm := !newAlarm.Time.IsZero()
+	if !hasAlarm && !oldAlarm.Time.IsZero() {
+		h.logger.Debugf("Canceling loss detection timer.")
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.LossTimerUpdated{
+				Type: qlog.LossTimerUpdateTypeCancelled,
+			})
+		}
+	}
+
+	if h.qlogger != nil && hasAlarm && newAlarm != oldAlarm {
+		h.qlogger.RecordEvent(qlog.LossTimerUpdated{
+			Type:      qlog.LossTimerUpdateTypeSet,
+			TimerType: newAlarm.TimerType,
+			EncLevel:  newAlarm.EncryptionLevel,
+			Time:      newAlarm.Time.ToTime(),
+		})
+	}
+}
+
+func (h *sentPacketHandler) lossDetectionTime(now monotime.Time) alarmTimer {
+	// cancel the alarm if no packets are outstanding
+	if h.peerCompletedAddressValidation && !h.hasOutstandingCryptoPackets() &&
+		!h.appDataPackets.history.HasOutstandingPackets() && !h.appDataPackets.history.HasOutstandingPathProbes() {
+		return alarmTimer{}
+	}
+
+	// cancel the alarm if amplification limited
+	if h.isAmplificationLimited() {
+		return alarmTimer{}
+	}
+
+	var pathProbeLossTime monotime.Time
+	if h.appDataPackets.history.HasOutstandingPathProbes() {
+		if _, p := h.appDataPackets.history.FirstOutstandingPathProbe(); p != nil {
+			pathProbeLossTime = p.SendTime.Add(pathProbePacketLossTimeout)
+		}
+	}
+
+	// early retransmit timer or time loss detection
+	lossTime, encLevel := h.getLossTimeAndSpace()
+	if !lossTime.IsZero() && (pathProbeLossTime.IsZero() || lossTime.Before(pathProbeLossTime)) {
+		return alarmTimer{
+			Time:            lossTime,
+			TimerType:       qlog.TimerTypeACK,
+			EncryptionLevel: encLevel,
+		}
+	}
+	ptoTime, encLevel := h.getPTOTimeAndSpace(now)
+	if !ptoTime.IsZero() && (pathProbeLossTime.IsZero() || ptoTime.Before(pathProbeLossTime)) {
+		return alarmTimer{
+			Time:            ptoTime,
+			TimerType:       qlog.TimerTypePTO,
+			EncryptionLevel: encLevel,
+		}
+	}
+	if !pathProbeLossTime.IsZero() {
+		return alarmTimer{
+			Time:            pathProbeLossTime,
+			TimerType:       qlog.TimerTypePathProbe,
+			EncryptionLevel: protocol.Encryption1RTT,
+		}
+	}
+	return alarmTimer{}
+}
+
+func (h *sentPacketHandler) detectLostPathProbes(now monotime.Time) {
+	if !h.appDataPackets.history.HasOutstandingPathProbes() {
+		return
+	}
+	lossTime := now.Add(-pathProbePacketLossTimeout)
+	// RemovePathProbe cannot be called while iterating.
+	var lostPathProbes []packetWithPacketNumber
+	for pn, p := range h.appDataPackets.history.PathProbes() {
+		if !p.SendTime.After(lossTime) {
+			lostPathProbes = append(lostPathProbes, packetWithPacketNumber{PacketNumber: pn, packet: p})
+		}
+	}
+	for _, p := range lostPathProbes {
+		for _, f := range p.Frames {
+			f.Handler.OnLost(f.Frame)
+		}
+		h.appDataPackets.history.RemovePathProbe(p.PacketNumber)
+	}
+}
+
+func (h *sentPacketHandler) detectLostPackets(now monotime.Time, encLevel protocol.EncryptionLevel) {
+	pnSpace := h.getPacketNumberSpace(encLevel)
+	pnSpace.lossTime = 0
+
+	maxRTT := float64(max(h.rttStats.LatestRTT(), h.rttStats.SmoothedRTT()))
+	lossDelay := time.Duration(timeThreshold * maxRTT)
+
+	// Minimum time of granularity before packets are deemed lost.
+	lossDelay = max(lossDelay, protocol.TimerGranularity)
+
+	// Packets sent before this time are deemed lost.
+	lostSendTime := now.Add(-lossDelay)
+
+	priorInFlight := h.bytesInFlight
+	for pn, p := range pnSpace.history.Packets() {
+		if pn > pnSpace.largestAcked {
+			break
+		}
+
+		var packetLost bool
+		if !p.SendTime.After(lostSendTime) {
+			packetLost = true
+			if !p.isPathProbePacket && p.IsAckEliciting() {
+				if h.logger.Debug() {
+					h.logger.Debugf("\tlost packet %d (time threshold)", pn)
+				}
+				if h.qlogger != nil {
+					h.qlogger.RecordEvent(qlog.PacketLost{
+						Header: qlog.PacketHeader{
+							PacketType:   qlog.EncryptionLevelToPacketType(p.EncryptionLevel),
+							PacketNumber: pn,
+						},
+						Trigger: qlog.PacketLossTimeThreshold,
+					})
+				}
+			}
+		} else if pnSpace.history.Difference(pnSpace.largestAcked, pn) >= packetThreshold {
+			packetLost = true
+			if !p.isPathProbePacket && p.IsAckEliciting() {
+				if h.logger.Debug() {
+					h.logger.Debugf("\tlost packet %d (reordering threshold)", pn)
+				}
+				if h.qlogger != nil {
+					h.qlogger.RecordEvent(qlog.PacketLost{
+						Header: qlog.PacketHeader{
+							PacketType:   qlog.EncryptionLevelToPacketType(p.EncryptionLevel),
+							PacketNumber: pn,
+						},
+						Trigger: qlog.PacketLossReorderingThreshold,
+					})
+				}
+			}
+		} else if pnSpace.lossTime.IsZero() {
+			// Note: This conditional is only entered once per call
+			lossTime := p.SendTime.Add(lossDelay)
+			if h.logger.Debug() {
+				h.logger.Debugf("\tsetting loss timer for packet %d (%s) to %s (in %s)", pn, encLevel, lossDelay, lossTime)
+			}
+			pnSpace.lossTime = lossTime
+		}
+		if packetLost {
+			if encLevel == protocol.Encryption0RTT || encLevel == protocol.Encryption1RTT {
+				h.lostPackets.Add(pn, p.SendTime)
+			}
+			pnSpace.history.DeclareLost(pn)
+			if !p.isPathProbePacket && p.IsAckEliciting() {
+				// the bytes in flight need to be reduced no matter if the frames in this packet will be retransmitted
+				h.removeFromBytesInFlight(p)
+				h.queueFramesForRetransmission(p)
+				if !p.IsPathMTUProbePacket {
+					h.congestion.OnCongestionEvent(pn, p.Length, priorInFlight)
+				}
+				if encLevel == protocol.Encryption1RTT && h.ecnTracker != nil {
+					h.ecnTracker.LostPacket(pn)
+				}
+			}
+		}
+	}
+}
+
+func (h *sentPacketHandler) OnLossDetectionTimeout(now monotime.Time) error {
+	defer h.setLossDetectionTimer(now)
+
+	if h.handshakeConfirmed {
+		h.detectLostPathProbes(now)
+	}
+
+	earliestLossTime, encLevel := h.getLossTimeAndSpace()
+	if !earliestLossTime.IsZero() {
+		if h.logger.Debug() {
+			h.logger.Debugf("Loss detection alarm fired in loss timer mode. Loss time: %s", earliestLossTime)
+		}
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.LossTimerUpdated{
+				Type:      qlog.LossTimerUpdateTypeExpired,
+				TimerType: qlog.TimerTypeACK,
+				EncLevel:  encLevel,
+			})
+		}
+		// Early retransmit or time loss detection
+		h.detectLostPackets(now, encLevel)
+		return nil
+	}
+
+	// PTO
+	// When all outstanding are acknowledged, the alarm is canceled in setLossDetectionTimer.
+	// However, there's no way to reset the timer in the connection.
+	// When OnLossDetectionTimeout is called, we therefore need to make sure that there are
+	// actually packets outstanding.
+	if h.bytesInFlight == 0 && !h.peerCompletedAddressValidation {
+		h.ptoCount++
+		h.numProbesToSend++
+		if h.initialPackets != nil {
+			h.ptoMode = SendPTOInitial
+		} else if h.handshakePackets != nil {
+			h.ptoMode = SendPTOHandshake
+		} else {
+			return errors.New("sentPacketHandler BUG: PTO fired, but bytes_in_flight is 0 and Initial and Handshake already dropped")
+		}
+		return nil
+	}
+
+	ptoTime, encLevel := h.getPTOTimeAndSpace(now)
+	if ptoTime.IsZero() {
+		return nil
+	}
+	ps := h.getPacketNumberSpace(encLevel)
+	if !ps.history.HasOutstandingPackets() && !ps.history.HasOutstandingPathProbes() && !h.peerCompletedAddressValidation {
+		return nil
+	}
+	h.ptoCount++
+	if h.logger.Debug() {
+		h.logger.Debugf("Loss detection alarm for %s fired in PTO mode. PTO count: %d", encLevel, h.ptoCount)
+	}
+	if h.qlogger != nil {
+		h.qlogger.RecordEvent(qlog.LossTimerUpdated{
+			Type:      qlog.LossTimerUpdateTypeExpired,
+			TimerType: qlog.TimerTypePTO,
+			EncLevel:  encLevel,
+		})
+		h.qlogger.RecordEvent(qlog.PTOCountUpdated{PTOCount: h.ptoCount})
+	}
+	h.numProbesToSend += 2
+	//nolint:exhaustive // We never arm a PTO timer for 0-RTT packets.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		h.ptoMode = SendPTOInitial
+	case protocol.EncryptionHandshake:
+		h.ptoMode = SendPTOHandshake
+	case protocol.Encryption1RTT:
+		// skip a packet number in order to elicit an immediate ACK
+		pn := h.PopPacketNumber(protocol.Encryption1RTT)
+		h.getPacketNumberSpace(protocol.Encryption1RTT).history.SkippedPacket(pn)
+		h.ptoMode = SendPTOAppData
+	default:
+		return fmt.Errorf("PTO timer in unexpected encryption level: %s", encLevel)
+	}
+	return nil
+}
+
+func (h *sentPacketHandler) GetLossDetectionTimeout() monotime.Time {
+	return h.alarm.Time
+}
+
+func (h *sentPacketHandler) ECNMode(isShortHeaderPacket bool) protocol.ECN {
+	if !h.enableECN {
+		return protocol.ECNUnsupported
+	}
+	if !isShortHeaderPacket {
+		return protocol.ECNNon
+	}
+	return h.ecnTracker.Mode()
+}
+
+func (h *sentPacketHandler) PeekPacketNumber(encLevel protocol.EncryptionLevel) (protocol.PacketNumber, protocol.PacketNumberLen) {
+	pnSpace := h.getPacketNumberSpace(encLevel)
+	pn := pnSpace.pns.Peek()
+	// See section 17.1 of RFC 9000.
+	return pn, protocol.PacketNumberLengthForHeader(pn, pnSpace.largestAcked)
+}
+
+func (h *sentPacketHandler) PopPacketNumber(encLevel protocol.EncryptionLevel) protocol.PacketNumber {
+	pnSpace := h.getPacketNumberSpace(encLevel)
+	skipped, pn := pnSpace.pns.Pop()
+	if skipped {
+		skippedPN := pn - 1
+		pnSpace.history.SkippedPacket(skippedPN)
+		if h.logger.Debug() {
+			h.logger.Debugf("Skipping packet number %d", skippedPN)
+		}
+	}
+	return pn
+}
+
+func (h *sentPacketHandler) SendMode(now monotime.Time) SendMode {
+	numTrackedPackets := h.appDataPackets.history.Len()
+	if h.initialPackets != nil {
+		numTrackedPackets += h.initialPackets.history.Len()
+	}
+	if h.handshakePackets != nil {
+		numTrackedPackets += h.handshakePackets.history.Len()
+	}
+
+	if h.isAmplificationLimited() {
+		h.logger.Debugf("Amplification window limited. Received %d bytes, already sent out %d bytes", h.bytesReceived, h.bytesSent)
+		return SendNone
+	}
+	// Don't send any packets if we're keeping track of the maximum number of packets.
+	// Note that since MaxOutstandingSentPackets is smaller than MaxTrackedSentPackets,
+	// we will stop sending out new data when reaching MaxOutstandingSentPackets,
+	// but still allow sending of retransmissions and ACKs.
+	if numTrackedPackets >= protocol.MaxTrackedSentPackets {
+		if h.logger.Debug() {
+			h.logger.Debugf("Limited by the number of tracked packets: tracking %d packets, maximum %d", numTrackedPackets, protocol.MaxTrackedSentPackets)
+		}
+		return SendNone
+	}
+	if h.numProbesToSend > 0 {
+		return h.ptoMode
+	}
+	// Only send ACKs if we're congestion limited.
+	if !h.congestion.CanSend(h.bytesInFlight) {
+		if h.logger.Debug() {
+			h.logger.Debugf("Congestion limited: bytes in flight %d, window %d", h.bytesInFlight, h.congestion.GetCongestionWindow())
+		}
+		return SendAck
+	}
+	if numTrackedPackets >= protocol.MaxOutstandingSentPackets {
+		if h.logger.Debug() {
+			h.logger.Debugf("Max outstanding limited: tracking %d packets, maximum: %d", numTrackedPackets, protocol.MaxOutstandingSentPackets)
+		}
+		return SendAck
+	}
+	if !h.congestion.HasPacingBudget(now) {
+		return SendPacingLimited
+	}
+	return SendAny
+}
+
+func (h *sentPacketHandler) TimeUntilSend() monotime.Time {
+	return h.congestion.TimeUntilSend(h.bytesInFlight)
+}
+
+func (h *sentPacketHandler) SetMaxDatagramSize(s protocol.ByteCount) {
+	h.congestion.SetMaxDatagramSize(s)
+}
+
+func (h *sentPacketHandler) isAmplificationLimited() bool {
+	if h.peerAddressValidated {
+		return false
+	}
+	return h.bytesSent >= amplificationFactor*h.bytesReceived
+}
+
+func (h *sentPacketHandler) QueueProbePacket(encLevel protocol.EncryptionLevel) bool {
+	pnSpace := h.getPacketNumberSpace(encLevel)
+	pn, p := pnSpace.history.FirstOutstanding()
+	if p == nil {
+		return false
+	}
+	// TODO: don't declare the packet lost here.
+	// Keep track of acknowledged frames instead.
+	// Call DeclareLost before queueFramesForRetransmission, which clears the packet's frames.
+	pnSpace.history.DeclareLost(pn)
+	h.removeFromBytesInFlight(p)
+	h.queueFramesForRetransmission(p)
+	return true
+}
+
+func (h *sentPacketHandler) queueFramesForRetransmission(p *packet) {
+	if len(p.Frames) == 0 && len(p.StreamFrames) == 0 {
+		panic("no frames")
+	}
+	for _, f := range p.Frames {
+		if f.Handler != nil {
+			f.Handler.OnLost(f.Frame)
+		}
+	}
+	for _, f := range p.StreamFrames {
+		if f.Handler != nil {
+			f.Handler.OnLost(f.Frame)
+		}
+	}
+	p.StreamFrames = nil
+	p.Frames = nil
+}
+
+func (h *sentPacketHandler) ResetForRetry(now monotime.Time) {
+	h.bytesInFlight = 0
+	var firstPacketSendTime monotime.Time
+	for _, p := range h.initialPackets.history.Packets() {
+		if firstPacketSendTime.IsZero() {
+			firstPacketSendTime = p.SendTime
+		}
+		if p.IsAckEliciting() {
+			h.queueFramesForRetransmission(p)
+		}
+	}
+	// All application data packets sent at this point are 0-RTT packets.
+	// In the case of a Retry, we can assume that the server dropped all of them.
+	for _, p := range h.appDataPackets.history.Packets() {
+		if p.IsAckEliciting() {
+			h.queueFramesForRetransmission(p)
+		}
+	}
+
+	// Only use the Retry to estimate the RTT if we didn't send any retransmission for the Initial.
+	// Otherwise, we don't know which Initial the Retry was sent in response to.
+	if h.ptoCount == 0 {
+		// Don't set the RTT to a value lower than 5ms here.
+		h.rttStats.UpdateRTT(max(minRTTAfterRetry, now.Sub(firstPacketSendTime)), 0)
+		if h.logger.Debug() {
+			h.logger.Debugf("\tupdated RTT: %s (σ: %s)", h.rttStats.SmoothedRTT(), h.rttStats.MeanDeviation())
+		}
+		if h.qlogger != nil {
+			h.qlogMetricsUpdated()
+		}
+	}
+	h.initialPackets = newPacketNumberSpace(h.initialPackets.pns.Peek(), false)
+	h.appDataPackets = newPacketNumberSpace(h.appDataPackets.pns.Peek(), true)
+	oldAlarm := h.alarm
+	h.alarm = alarmTimer{}
+	if h.qlogger != nil {
+		h.qlogger.RecordEvent(qlog.PTOCountUpdated{PTOCount: 0})
+		if !oldAlarm.Time.IsZero() {
+			h.qlogger.RecordEvent(qlog.LossTimerUpdated{
+				Type: qlog.LossTimerUpdateTypeCancelled,
+			})
+		}
+	}
+	h.ptoCount = 0
+}
+
+func (h *sentPacketHandler) MigratedPath(now monotime.Time, initialMaxDatagramSize protocol.ByteCount) {
+	h.rttStats.ResetForPathMigration()
+	for pn, p := range h.appDataPackets.history.Packets() {
+		h.appDataPackets.history.DeclareLost(pn)
+		if !p.isPathProbePacket {
+			h.removeFromBytesInFlight(p)
+			if p.IsAckEliciting() {
+				h.queueFramesForRetransmission(p)
+			}
+		}
+	}
+	for pn := range h.appDataPackets.history.PathProbes() {
+		h.appDataPackets.history.RemovePathProbe(pn)
+	}
+	h.congestion = congestion.NewCubicSender(
+		congestion.DefaultClock{},
+		h.rttStats,
+		h.connStats,
+		initialMaxDatagramSize,
+		true, // use Reno
+		h.qlogger,
+	)
+	h.setLossDetectionTimer(now)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_handler_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_handler_test.go
new file mode 100644
index 000000000..099252975
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_handler_test.go
@@ -0,0 +1,1772 @@
+package ackhandler
+
+import (
+	"encoding/binary"
+	"fmt"
+	"math/rand/v2"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/mocks"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+type customFrameHandler struct {
+	onLost, onAcked func(wire.Frame)
+}
+
+func (h *customFrameHandler) OnLost(f wire.Frame) {
+	if h.onLost != nil {
+		h.onLost(f)
+	}
+}
+
+func (h *customFrameHandler) OnAcked(f wire.Frame) {
+	if h.onAcked != nil {
+		h.onAcked(f)
+	}
+}
+
+type packetTracker struct {
+	Acked []protocol.PacketNumber
+	Lost  []protocol.PacketNumber
+}
+
+func (t *packetTracker) Reset() {
+	t.Acked = nil
+	t.Lost = nil
+}
+
+func (t *packetTracker) NewPingFrame(pn protocol.PacketNumber) Frame {
+	return Frame{
+		Frame: &wire.PingFrame{},
+		Handler: &customFrameHandler{
+			onAcked: func(wire.Frame) { t.Acked = append(t.Acked, pn) },
+			onLost:  func(wire.Frame) { t.Lost = append(t.Lost, pn) },
+		},
+	}
+}
+
+func (h *sentPacketHandler) getBytesInFlight() protocol.ByteCount {
+	return h.bytesInFlight
+}
+
+func ackRanges(pns ...protocol.PacketNumber) []wire.AckRange {
+	return appendAckRanges(nil, pns...)
+}
+
+func appendAckRanges(ranges []wire.AckRange, pns ...protocol.PacketNumber) []wire.AckRange {
+	if len(pns) == 0 {
+		return ranges
+	}
+	slices.Sort(pns)
+	slices.Reverse(pns)
+
+	start := pns[0]
+	for i := 1; i < len(pns); i++ {
+		if pns[i-1]-pns[i] > 1 {
+			ranges = append(ranges, wire.AckRange{Smallest: pns[i-1], Largest: start})
+			start = pns[i]
+		}
+	}
+	return append(ranges, wire.AckRange{Smallest: pns[len(pns)-1], Largest: start})
+}
+
+func TestAckRanges(t *testing.T) {
+	require.Equal(t, []wire.AckRange{{Smallest: 1, Largest: 1}}, ackRanges(1))
+	require.Equal(t, []wire.AckRange{{Smallest: 1, Largest: 2}}, ackRanges(1, 2))
+	require.Equal(t, []wire.AckRange{{Smallest: 1, Largest: 3}}, ackRanges(1, 2, 3))
+	require.Equal(t, []wire.AckRange{{Smallest: 1, Largest: 3}}, ackRanges(3, 2, 1))
+	require.Equal(t, []wire.AckRange{{Smallest: 1, Largest: 3}}, ackRanges(1, 3, 2))
+
+	require.Equal(t, []wire.AckRange{{Smallest: 3, Largest: 3}, {Smallest: 1, Largest: 1}}, ackRanges(1, 3))
+	require.Equal(t, []wire.AckRange{{Smallest: 3, Largest: 4}, {Smallest: 1, Largest: 1}}, ackRanges(1, 3, 4))
+	require.Equal(t, []wire.AckRange{{Smallest: 5, Largest: 6}, {Smallest: 0, Largest: 2}}, ackRanges(0, 1, 2, 5, 6))
+}
+
+func TestSentPacketHandlerSendAndAcknowledge(t *testing.T) {
+	t.Run("Initial", func(t *testing.T) {
+		testSentPacketHandlerSendAndAcknowledge(t, protocol.EncryptionInitial)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testSentPacketHandlerSendAndAcknowledge(t, protocol.EncryptionHandshake)
+	})
+	t.Run("1-RTT", func(t *testing.T) {
+		testSentPacketHandlerSendAndAcknowledge(t, protocol.Encryption1RTT)
+	})
+}
+
+func testSentPacketHandlerSendAndAcknowledge(t *testing.T, encLevel protocol.EncryptionLevel) {
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		utils.NewRTTStats(),
+		&utils.ConnectionStats{},
+		false,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	var packets packetTracker
+	var pns []protocol.PacketNumber
+	now := monotime.Now()
+	for i := range 10 {
+		e := encLevel
+		// also send some 0-RTT packets to make sure they're acknowledged in the same packet number space
+		if encLevel == protocol.Encryption1RTT && i < 5 {
+			e = protocol.Encryption0RTT
+		}
+		pn := sph.PopPacketNumber(e)
+		sph.SentPacket(now, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, e, protocol.ECNNon, 1200, false, false)
+		pns = append(pns, pn)
+	}
+
+	_, err := sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[0], pns[1], pns[2], pns[3], pns[4], pns[7], pns[8], pns[9])},
+		encLevel,
+		monotime.Now(),
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[0], pns[1], pns[2], pns[3], pns[4], pns[7], pns[8], pns[9]}, packets.Acked)
+
+	// ACKs that don't acknowledge new packets are ok
+	_, err = sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[1], pns[2], pns[3])},
+		encLevel,
+		monotime.Now(),
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[0], pns[1], pns[2], pns[3], pns[4], pns[7], pns[8], pns[9]}, packets.Acked)
+
+	// ACKs that don't acknowledge packets that we didn't send are not ok
+	_, err = sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[7], pns[8], pns[9], pns[9]+1)},
+		encLevel,
+		monotime.Now(),
+	)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+	require.ErrorContains(t, err, "received ACK for an unsent packet")
+}
+
+func TestSentPacketHandlerAcknowledgeSkippedPacket(t *testing.T) {
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		utils.NewRTTStats(),
+		&utils.ConnectionStats{},
+		false,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	now := monotime.Now()
+	lastPN := protocol.InvalidPacketNumber
+	skippedPN := protocol.InvalidPacketNumber
+	for {
+		pn, _ := sph.PeekPacketNumber(protocol.Encryption1RTT)
+		require.Equal(t, pn, sph.PopPacketNumber(protocol.Encryption1RTT))
+		if pn > lastPN+1 {
+			skippedPN = pn - 1
+		}
+		if pn >= 1e6 {
+			t.Fatal("expected a skipped packet number")
+		}
+		sph.SentPacket(now, pn, protocol.InvalidPacketNumber, nil, []Frame{{Frame: &wire.PingFrame{}}}, protocol.Encryption1RTT, protocol.ECNNon, 1200, false, false)
+		lastPN = pn
+		if skippedPN != protocol.InvalidPacketNumber {
+			break
+		}
+	}
+
+	_, err := sph.ReceivedAck(&wire.AckFrame{
+		AckRanges: []wire.AckRange{{Smallest: 0, Largest: lastPN}},
+	}, protocol.Encryption1RTT, monotime.Now())
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+	require.ErrorContains(t, err, fmt.Sprintf("received an ACK for skipped packet number: %d (1-RTT)", skippedPN))
+}
+
+func TestSentPacketHandlerRTTAckEliciting(t *testing.T) {
+	var eventRecorder events.Recorder
+
+	rttStats := utils.NewRTTStats()
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		false,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		&eventRecorder,
+		utils.DefaultLogger,
+	)
+
+	getPacketsInFlight := func() int {
+		evs := eventRecorder.Events(qlog.MetricsUpdated{})
+		return evs[len(evs)-1].(qlog.MetricsUpdated).PacketsInFlight
+	}
+	getBytesInFlight := func() int {
+		evs := eventRecorder.Events(qlog.MetricsUpdated{})
+		return evs[len(evs)-1].(qlog.MetricsUpdated).BytesInFlight
+	}
+
+	sendPacket := func(t *testing.T, ti monotime.Time, size protocol.ByteCount, ackEliciting bool) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(protocol.Encryption1RTT)
+		var frames []Frame
+		if ackEliciting {
+			frames = []Frame{{Frame: &wire.PingFrame{}}}
+		}
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, frames, protocol.Encryption1RTT, protocol.ECNNon, size, false, false)
+		return pn
+	}
+
+	ackPackets := func(t *testing.T, ti monotime.Time, pns ...protocol.PacketNumber) {
+		t.Helper()
+		_, err := sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pns...)}, protocol.Encryption1RTT, ti)
+		require.NoError(t, err)
+	}
+
+	now := monotime.Now()
+	pn1 := sendPacket(t, now, 1200, true)
+	require.Equal(t, 1, getPacketsInFlight())
+	require.Equal(t, 1200, getBytesInFlight())
+	pn2 := sendPacket(t, now, 1100, false)
+	// Sending a non-ack-eliciting packet doesn't change bytes or packets in flight.
+	// Non-ack-eliciting packets are not included in congestion control.
+	require.Equal(t, 1, getPacketsInFlight())
+	require.Equal(t, 1200, getBytesInFlight())
+	pn3 := sendPacket(t, now, 1000, true)
+	require.Equal(t, 2, getPacketsInFlight())
+	require.Equal(t, 2200, getBytesInFlight())
+	// the RTT is recorded, since the largest acknowledged packet is ack-eliciting
+	now = now.Add(200 * time.Millisecond)
+	ackPackets(t, now, pn1, pn2, pn3)
+	require.Equal(t, 200*time.Millisecond, rttStats.LatestRTT())
+	require.Zero(t, getPacketsInFlight())
+	require.Zero(t, getBytesInFlight())
+
+	pn4 := sendPacket(t, now, 1200, false)
+	// non-ack-eliciting packets don't trigger metrics updates
+	require.Zero(t, getPacketsInFlight())
+	require.Zero(t, getBytesInFlight())
+	pn5 := sendPacket(t, now, 500, false)
+	require.Zero(t, getPacketsInFlight())
+	require.Zero(t, getBytesInFlight())
+	now = now.Add(500 * time.Millisecond)
+	// only non-ack-eliciting packets are newly acknowledged, so the RTT is not updated
+	ackPackets(t, now, pn2, pn3, pn4, pn5)
+	require.Equal(t, 200*time.Millisecond, rttStats.LatestRTT())
+
+	pn6 := sendPacket(t, now, 1400, true)
+	require.Equal(t, 1, getPacketsInFlight())
+	require.Equal(t, 1400, getBytesInFlight())
+	pn7 := sendPacket(t, now, 1100, false)
+	// non-ack-eliciting packet doesn't change metrics
+	require.Equal(t, 1, getPacketsInFlight())
+	require.Equal(t, 1400, getBytesInFlight())
+	now = now.Add(800 * time.Millisecond)
+	// largest acknowledged packet is not ack-eliciting, but one new ack-eliciting
+	// packet was acknowledged, so the RTT is updated
+	ackPackets(t, now, pn6, pn7)
+	require.Equal(t, 800*time.Millisecond, rttStats.LatestRTT())
+	require.Zero(t, getPacketsInFlight())
+	require.Zero(t, getBytesInFlight())
+}
+
+func TestSentPacketHandlerRTTAcrossPacketNumberSpaces(t *testing.T) {
+	rttStats := utils.NewRTTStats()
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		false,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	sendPacket := func(t *testing.T, ti monotime.Time, encLevel protocol.EncryptionLevel) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(encLevel)
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{{Frame: &wire.PingFrame{}}}, encLevel, protocol.ECNNon, 1200, false, false)
+		return pn
+	}
+
+	ackPackets := func(t *testing.T, ti monotime.Time, encLevel protocol.EncryptionLevel, pns ...protocol.PacketNumber) {
+		t.Helper()
+		_, err := sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pns...)}, encLevel, ti)
+		require.NoError(t, err)
+	}
+
+	now := monotime.Now()
+	initial1 := sendPacket(t, now, protocol.EncryptionInitial)
+	handshake1 := sendPacket(t, now.Add(time.Second), protocol.EncryptionHandshake)
+	initial2 := sendPacket(t, now.Add(2*time.Second), protocol.EncryptionInitial)
+	handshake2 := sendPacket(t, now.Add(2*time.Second), protocol.EncryptionHandshake)
+
+	ackPackets(t, now.Add(3*time.Second), protocol.EncryptionInitial, initial1, initial2)
+	require.Equal(t, time.Second, rttStats.LatestRTT())
+
+	// No RTT measurement, since the second initial packet was sent after the first handshake packet.
+	ackPackets(t, now.Add(4*time.Second), protocol.EncryptionHandshake, handshake1)
+	require.Equal(t, time.Second, rttStats.LatestRTT())
+
+	// This causes an RTT measurement, since the second handshake packet was sent last.
+	ackPackets(t, now.Add(5*time.Second), protocol.EncryptionHandshake, handshake1, handshake2)
+	require.Equal(t, 3*time.Second, rttStats.LatestRTT())
+}
+
+func TestSentPacketHandlerRTTAckDelays(t *testing.T) {
+	t.Run("Initial", func(t *testing.T) {
+		testSentPacketHandlerRTTAckDelays(t, protocol.EncryptionInitial, false)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testSentPacketHandlerRTTAckDelays(t, protocol.EncryptionHandshake, false)
+	})
+	t.Run("1-RTT", func(t *testing.T) {
+		testSentPacketHandlerRTTAckDelays(t, protocol.Encryption1RTT, true)
+	})
+}
+
+func testSentPacketHandlerRTTAckDelays(t *testing.T, encLevel protocol.EncryptionLevel, usesAckDelay bool) {
+	expectedRTTStats := utils.NewRTTStats()
+	expectedRTTStats.SetMaxAckDelay(time.Second)
+	rttStats := utils.NewRTTStats()
+	rttStats.SetMaxAckDelay(time.Second)
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		false,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	sendPacket := func(t *testing.T, ti monotime.Time) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(encLevel)
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{{Frame: &wire.PingFrame{}}}, encLevel, protocol.ECNNon, 1200, false, false)
+		return pn
+	}
+
+	ackPacket := func(pn protocol.PacketNumber, ti monotime.Time, d time.Duration) {
+		t.Helper()
+		_, err := sph.ReceivedAck(&wire.AckFrame{DelayTime: d, AckRanges: ackRanges(pn)}, encLevel, ti)
+		require.NoError(t, err)
+	}
+
+	var packets []protocol.PacketNumber
+	now := monotime.Now()
+	// send some packets and receive ACKs with 0 ack delay
+	for range 5 {
+		packets = append(packets, sendPacket(t, now))
+	}
+	for i := range 5 {
+		expectedRTTStats.UpdateRTT(time.Duration(i+1)*time.Second, 0)
+		now = now.Add(time.Second)
+		ackPacket(packets[i], now, 0)
+		require.Equal(t, expectedRTTStats.SmoothedRTT(), rttStats.SmoothedRTT())
+		require.Equal(t, time.Second, rttStats.MinRTT())
+		require.Equal(t, time.Duration(i+1)*time.Second, rttStats.LatestRTT())
+	}
+	packets = packets[:0]
+
+	// send some more packets and receive ACKs with non-zero ack delay
+	for range 5 {
+		packets = append(packets, sendPacket(t, now))
+	}
+	expectedRTTStatsNoAckDelay := expectedRTTStats.Clone()
+	for i := range 5 {
+		const ackDelay = 500 * time.Millisecond
+		expectedRTTStats.UpdateRTT(time.Duration(i+1)*time.Second, ackDelay)
+		expectedRTTStatsNoAckDelay.UpdateRTT(time.Duration(i+1)*time.Second, 0)
+		now = now.Add(time.Second)
+		ackPacket(packets[i], now, ackDelay)
+		if usesAckDelay {
+			require.Equal(t, expectedRTTStats.SmoothedRTT(), rttStats.SmoothedRTT())
+		} else {
+			require.Equal(t, expectedRTTStatsNoAckDelay.SmoothedRTT(), rttStats.SmoothedRTT())
+		}
+	}
+	packets = packets[:0]
+	// make sure that taking ack delay into account actually changes the RTT,
+	// otherwise the test is not meaningful
+	require.NotEqual(t, expectedRTTStats.SmoothedRTT(), expectedRTTStatsNoAckDelay.SmoothedRTT())
+
+	// Send two more packets, and acknowledge them in opposite order.
+	// This tests that the RTT is updated even if the ACK doesn't increase the largest acked.
+	packets = append(packets, sendPacket(t, now))
+	packets = append(packets, sendPacket(t, now))
+	ackPacket(packets[1], now.Add(time.Second), 0)
+	rtt := rttStats.SmoothedRTT()
+	ackPacket(packets[0], now.Add(10*time.Second), 0)
+	require.NotEqual(t, rtt, rttStats.SmoothedRTT())
+
+	// Send one more packet, and send where the largest acked is acknowledged twice.
+	pn := sendPacket(t, now)
+	ackPacket(pn, now.Add(time.Second), 0)
+	rtt = rttStats.SmoothedRTT()
+	ackPacket(pn, now.Add(10*time.Second), 0)
+	require.Equal(t, rtt, rttStats.SmoothedRTT())
+}
+
+func TestSentPacketHandlerAmplificationLimitServer(t *testing.T) {
+	t.Run("address validated", func(t *testing.T) {
+		testSentPacketHandlerAmplificationLimitServer(t, true)
+	})
+	t.Run("address not validated", func(t *testing.T) {
+		testSentPacketHandlerAmplificationLimitServer(t, false)
+	})
+}
+
+func testSentPacketHandlerAmplificationLimitServer(t *testing.T, addressValidated bool) {
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		utils.NewRTTStats(),
+		&utils.ConnectionStats{},
+		addressValidated,
+		false,
+		nil,
+		protocol.PerspectiveServer,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	if addressValidated {
+		require.Equal(t, SendAny, sph.SendMode(monotime.Now()))
+		return
+	}
+
+	// no data received yet, so we can't send any packet yet
+	require.Equal(t, SendNone, sph.SendMode(monotime.Now()))
+	require.Zero(t, sph.GetLossDetectionTimeout())
+
+	// Receive 1000 bytes from the client.
+	// As long as we haven't sent out 3x the amount of bytes received, we can send out new packets,
+	// even if we go above the 3x limit by sending the last packet.
+	sph.ReceivedBytes(1000, monotime.Now())
+	for i := range 4 {
+		require.Equal(t, SendAny, sph.SendMode(monotime.Now()))
+		pn := sph.PopPacketNumber(protocol.EncryptionInitial)
+		sph.SentPacket(monotime.Now(), pn, protocol.InvalidPacketNumber, nil, []Frame{{Frame: &wire.PingFrame{}}}, protocol.EncryptionInitial, protocol.ECNNon, 999, false, false)
+		if i != 3 {
+			require.NotZero(t, sph.GetLossDetectionTimeout())
+		}
+	}
+	require.Equal(t, SendNone, sph.SendMode(monotime.Now()))
+	// no need to set a loss detection timer, as we're blocked by the amplification limit
+	require.Zero(t, sph.GetLossDetectionTimeout())
+
+	// receiving more data allows us to send out more packets
+	sph.ReceivedBytes(1000, monotime.Now())
+	require.NotZero(t, sph.GetLossDetectionTimeout())
+	for range 3 {
+		require.Equal(t, SendAny, sph.SendMode(monotime.Now()))
+		pn := sph.PopPacketNumber(protocol.EncryptionInitial)
+		sph.SentPacket(monotime.Now(), pn, protocol.InvalidPacketNumber, nil, []Frame{{Frame: &wire.PingFrame{}}}, protocol.EncryptionInitial, protocol.ECNNon, 1000, false, false)
+	}
+	require.Equal(t, SendNone, sph.SendMode(monotime.Now()))
+	require.Zero(t, sph.GetLossDetectionTimeout())
+
+	// receiving an Initial packet doesn't validate the client's address
+	sph.ReceivedPacket(protocol.EncryptionInitial, monotime.Now())
+	require.Equal(t, SendNone, sph.SendMode(monotime.Now()))
+	require.Zero(t, sph.GetLossDetectionTimeout())
+
+	// receiving a Handshake packet validates the client's address
+	sph.ReceivedPacket(protocol.EncryptionHandshake, monotime.Now())
+	require.Equal(t, SendAny, sph.SendMode(monotime.Now()))
+	require.NotZero(t, sph.GetLossDetectionTimeout())
+}
+
+func TestSentPacketHandlerAmplificationLimitClient(t *testing.T) {
+	t.Run("handshake ACK", func(t *testing.T) {
+		testSentPacketHandlerAmplificationLimitClient(t, false)
+	})
+
+	t.Run("drop Handshake without ACK", func(t *testing.T) {
+		testSentPacketHandlerAmplificationLimitClient(t, true)
+	})
+}
+
+func testSentPacketHandlerAmplificationLimitClient(t *testing.T, dropHandshake bool) {
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		utils.NewRTTStats(),
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	require.Equal(t, SendAny, sph.SendMode(monotime.Now()))
+	pn := sph.PopPacketNumber(protocol.EncryptionInitial)
+	sph.SentPacket(monotime.Now(), pn, protocol.InvalidPacketNumber, nil, []Frame{{Frame: &wire.PingFrame{}}}, protocol.EncryptionInitial, protocol.ECNNon, 999, false, false)
+	// it's not surprising that the loss detection timer is set, as this packet might be lost...
+	require.NotZero(t, sph.GetLossDetectionTimeout())
+	// ... but it's still set after receiving an ACK for this packet,
+	// since we might need to unblock the server's amplification limit
+	_, err := sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pn)}, protocol.EncryptionInitial, monotime.Now())
+	require.NoError(t, err)
+	require.NotZero(t, sph.GetLossDetectionTimeout())
+	require.Equal(t, SendAny, sph.SendMode(monotime.Now()))
+
+	// when the timer expires, we should send a PTO packet
+	sph.OnLossDetectionTimeout(monotime.Now())
+	require.Equal(t, SendPTOInitial, sph.SendMode(monotime.Now()))
+	require.NotZero(t, sph.GetLossDetectionTimeout())
+
+	if dropHandshake {
+		// dropping the handshake packet number space completes the handshake,
+		// even if no ACK for a handshake packet was received
+		sph.DropPackets(protocol.EncryptionHandshake, monotime.Now())
+		require.Zero(t, sph.GetLossDetectionTimeout())
+		return
+	}
+
+	// once the Initial packet number space is dropped, we need to send a Handshake PTO packet,
+	// even if we haven't sent any packet in the Handshake packet number space yet
+	sph.DropPackets(protocol.EncryptionInitial, monotime.Now())
+	require.NotZero(t, sph.GetLossDetectionTimeout())
+	sph.OnLossDetectionTimeout(monotime.Now())
+	require.Equal(t, SendPTOHandshake, sph.SendMode(monotime.Now()))
+
+	// receiving an ACK for a handshake packet shows that the server completed address validation
+	pn = sph.PopPacketNumber(protocol.EncryptionHandshake)
+	sph.SentPacket(monotime.Now(), pn, protocol.InvalidPacketNumber, nil, []Frame{{Frame: &wire.PingFrame{}}}, protocol.EncryptionHandshake, protocol.ECNNon, 999, false, false)
+	require.NotZero(t, sph.GetLossDetectionTimeout())
+	_, err = sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pn)}, protocol.EncryptionHandshake, monotime.Now())
+	require.NoError(t, err)
+	require.Zero(t, sph.GetLossDetectionTimeout())
+}
+
+func TestSentPacketHandlerDelayBasedLossDetection(t *testing.T) {
+	rttStats := utils.NewRTTStats()
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveServer,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	var packets packetTracker
+	sendPacket := func(t *testing.T, ti monotime.Time, isPathMTUProbePacket bool) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(protocol.EncryptionInitial)
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, protocol.EncryptionInitial, protocol.ECNNon, 1000, isPathMTUProbePacket, false)
+		return pn
+	}
+
+	const rtt = time.Second
+	now := monotime.Now()
+	t1 := now.Add(-rtt)
+	t2 := now.Add(-10 * time.Millisecond)
+	// Send 3 packets
+	pn1 := sendPacket(t, t1, false)
+	pn2 := sendPacket(t, t2, false)
+	// Also send a Path MTU probe packet.
+	// We expect the same loss recovery logic to be applied to it.
+	pn3 := sendPacket(t, t2, true)
+	pn4 := sendPacket(t, now, false)
+
+	_, err := sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pn4)},
+		protocol.EncryptionInitial,
+		now.Add(time.Second),
+	)
+	require.NoError(t, err)
+	// make sure that the RTT is actually 1s
+	require.Equal(t, rtt, rttStats.SmoothedRTT())
+	require.Equal(t, []protocol.PacketNumber{pn4}, packets.Acked)
+	// only the first packet was lost
+	require.Equal(t, []protocol.PacketNumber{pn1}, packets.Lost)
+	// ... but we armed a timer to declare packet 2 lost after 9/8 RTTs
+	require.Equal(t, t2.Add(time.Second*9/8), sph.GetLossDetectionTimeout())
+
+	sph.OnLossDetectionTimeout(sph.GetLossDetectionTimeout().Add(-time.Microsecond))
+	require.Len(t, packets.Lost, 1)
+	sph.OnLossDetectionTimeout(sph.GetLossDetectionTimeout())
+	require.Equal(t, []protocol.PacketNumber{pn1, pn2, pn3}, packets.Lost)
+}
+
+func TestSentPacketHandlerPacketBasedLossDetection(t *testing.T) {
+	rttStats := utils.NewRTTStats()
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveServer,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	var packets packetTracker
+	now := monotime.Now()
+	var pns []protocol.PacketNumber
+	for range 5 {
+		pn := sph.PopPacketNumber(protocol.EncryptionInitial)
+		sph.SentPacket(now, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, protocol.EncryptionInitial, protocol.ECNNon, 1000, false, false)
+		pns = append(pns, pn)
+	}
+
+	_, err := sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[3])},
+		protocol.EncryptionInitial,
+		now.Add(time.Second),
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[3]}, packets.Acked)
+	require.Equal(t, []protocol.PacketNumber{pns[0]}, packets.Lost)
+
+	_, err = sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[4])},
+		protocol.EncryptionInitial,
+		now.Add(time.Second),
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[3], pns[4]}, packets.Acked)
+	require.Equal(t, []protocol.PacketNumber{pns[0], pns[1]}, packets.Lost)
+}
+
+func TestSentPacketHandlerPTO(t *testing.T) {
+	t.Run("Initial", func(t *testing.T) {
+		testSentPacketHandlerPTO(t, protocol.EncryptionInitial, SendPTOInitial)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testSentPacketHandlerPTO(t, protocol.EncryptionHandshake, SendPTOHandshake)
+	})
+	t.Run("1-RTT", func(t *testing.T) {
+		testSentPacketHandlerPTO(t, protocol.Encryption1RTT, SendPTOAppData)
+	})
+}
+
+func testSentPacketHandlerPTO(t *testing.T, encLevel protocol.EncryptionLevel, ptoMode SendMode) {
+	var packets packetTracker
+	var eventRecorder events.Recorder
+
+	rttStats := utils.NewRTTStats()
+	rttStats.SetMaxAckDelay(25 * time.Millisecond)
+	rttStats.UpdateRTT(500*time.Millisecond, 0)
+	rttStats.UpdateRTT(1000*time.Millisecond, 0)
+	rttStats.UpdateRTT(1500*time.Millisecond, 0)
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveServer,
+		&eventRecorder,
+		utils.DefaultLogger,
+	)
+
+	// in the application-data packet number space, the PTO is only set
+	if encLevel == protocol.Encryption1RTT {
+		sph.DropPackets(protocol.EncryptionInitial, monotime.Now())
+		sph.DropPackets(protocol.EncryptionHandshake, monotime.Now())
+	}
+
+	sendPacket := func(t *testing.T, ti monotime.Time, ackEliciting bool, ptoCount uint) protocol.PacketNumber {
+		t.Helper()
+
+		pn := sph.PopPacketNumber(encLevel)
+		if ackEliciting {
+			sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, encLevel, protocol.ECNNon, 1000, false, false)
+			require.Equal(t,
+				[]qlogwriter.Event{
+					qlog.LossTimerUpdated{
+						Type:      qlog.LossTimerUpdateTypeSet,
+						TimerType: qlog.TimerTypePTO,
+						EncLevel:  encLevel,
+						Time:      ti.ToTime().Add(rttStats.PTO(encLevel == protocol.Encryption1RTT) << ptoCount),
+					},
+				},
+				eventRecorder.Events(qlog.LossTimerUpdated{}),
+			)
+			eventRecorder.Clear()
+		} else {
+			sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, nil, encLevel, protocol.ECNNon, 1000, true, false)
+			require.Empty(t, eventRecorder.Events(qlog.LossTimerUpdated{}))
+		}
+		return pn
+	}
+
+	now := monotime.Now()
+	sendTimes := []monotime.Time{
+		now,
+		now.Add(100 * time.Millisecond),
+		now.Add(200 * time.Millisecond),
+		now.Add(300 * time.Millisecond),
+	}
+	var pns []protocol.PacketNumber
+	// send packet 0, 1, 2, 3
+	for i := range 3 {
+		pns = append(pns, sendPacket(t, sendTimes[i], true, 0))
+	}
+	pns = append(pns, sendPacket(t, sendTimes[3], false, 0))
+
+	// The PTO includes the max_ack_delay only for the application-data packet number space.
+	// Make sure that the value is actually different, so this test is meaningful.
+	require.NotEqual(t, rttStats.PTO(true), rttStats.PTO(false))
+
+	timeout := sph.GetLossDetectionTimeout()
+	// the PTO is based on the *last* ack-eliciting packet
+	require.Equal(t, sendTimes[2].Add(rttStats.PTO(encLevel == protocol.Encryption1RTT)), timeout)
+
+	eventRecorder.Clear()
+	sph.OnLossDetectionTimeout(timeout)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.LossTimerUpdated{
+				Type:      qlog.LossTimerUpdateTypeExpired,
+				TimerType: qlog.TimerTypePTO,
+				EncLevel:  encLevel,
+			},
+			qlog.PTOCountUpdated{PTOCount: 1},
+			qlog.LossTimerUpdated{
+				Type:      qlog.LossTimerUpdateTypeSet,
+				TimerType: qlog.TimerTypePTO,
+				EncLevel:  encLevel,
+				Time:      sendTimes[2].Add(2 * rttStats.PTO(encLevel == protocol.Encryption1RTT)).ToTime(),
+			},
+		},
+		eventRecorder.Events(qlog.PTOCountUpdated{}, qlog.LossTimerUpdated{}),
+	)
+	// PTO timer expiration doesn't declare packets lost
+	require.Empty(t, packets.Lost)
+
+	now = timeout
+	require.Equal(t, ptoMode, sph.SendMode(now))
+	// queue a probe packet
+	require.True(t, sph.QueueProbePacket(encLevel))
+	require.True(t, sph.QueueProbePacket(encLevel))
+	require.True(t, sph.QueueProbePacket(encLevel))
+	// there are only two ack-eliciting packets that could be queued
+	require.False(t, sph.QueueProbePacket(encLevel))
+	// Queueing probe packets currently works by declaring them lost.
+	// We shouldn't do this, but this is how the code is currently written.
+	require.Equal(t, pns[:3], packets.Lost)
+	packets.Lost = packets.Lost[:0]
+
+	eventRecorder.Clear()
+
+	// send packet 4 and 6 as probe packets
+	// 5 doesn't count, since it's not an ack-eliciting packet
+	sendTimes = append(sendTimes, now.Add(100*time.Millisecond))
+	sendTimes = append(sendTimes, now.Add(200*time.Millisecond))
+	sendTimes = append(sendTimes, now.Add(300*time.Millisecond))
+	require.Equal(t, ptoMode, sph.SendMode(sendTimes[4])) // first probe packet
+	pns = append(pns, sendPacket(t, sendTimes[4], true, 1))
+	require.Equal(t, ptoMode, sph.SendMode(sendTimes[5])) // next probe packet
+	pns = append(pns, sendPacket(t, sendTimes[5], false, 1))
+	require.Equal(t, ptoMode, sph.SendMode(sendTimes[6])) // non-ack-eliciting packet didn't count as a probe packet
+	pns = append(pns, sendPacket(t, sendTimes[6], true, 1))
+	require.Equal(t, SendAny, sph.SendMode(sendTimes[6])) // enough probe packets sent
+
+	timeout = sph.GetLossDetectionTimeout()
+	// exponential backoff
+	require.Equal(t, sendTimes[6].Add(2*rttStats.PTO(encLevel == protocol.Encryption1RTT)), timeout)
+	now = timeout
+
+	sph.OnLossDetectionTimeout(timeout)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.LossTimerUpdated{
+				Type:      qlog.LossTimerUpdateTypeExpired,
+				TimerType: qlog.TimerTypePTO,
+				EncLevel:  encLevel,
+			},
+			qlog.PTOCountUpdated{PTOCount: 2},
+			qlog.LossTimerUpdated{
+				Type:      qlog.LossTimerUpdateTypeSet,
+				TimerType: qlog.TimerTypePTO,
+				EncLevel:  encLevel,
+				Time:      sendTimes[6].Add(4 * rttStats.PTO(encLevel == protocol.Encryption1RTT)).ToTime(),
+			},
+		},
+		eventRecorder.Events(qlog.LossTimerUpdated{}, qlog.PTOCountUpdated{}),
+	)
+	eventRecorder.Clear()
+	// PTO timer expiration doesn't declare packets lost
+	require.Empty(t, packets.Lost)
+
+	// send packet 7, 8 as probe packets
+	sendTimes = append(sendTimes, now.Add(100*time.Millisecond))
+	sendTimes = append(sendTimes, now.Add(200*time.Millisecond))
+	require.Equal(t, ptoMode, sph.SendMode(sendTimes[7])) // first probe packet
+	pns = append(pns, sendPacket(t, sendTimes[7], true, 2))
+	require.Equal(t, ptoMode, sph.SendMode(sendTimes[8])) // next probe packet
+	pns = append(pns, sendPacket(t, sendTimes[8], true, 2))
+	require.Equal(t, SendAny, sph.SendMode(sendTimes[8])) // enough probe packets sent
+
+	timeout = sph.GetLossDetectionTimeout()
+
+	// exponential backoff, again
+	require.Equal(t, sendTimes[8].Add(4*rttStats.PTO(encLevel == protocol.Encryption1RTT)), timeout)
+
+	eventRecorder.Clear()
+
+	// Receive an ACK for packet 7.
+	// This now declares packets lost, and leads to arming of a timer for packet 8.
+	_, err := sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[7])},
+		encLevel,
+		sendTimes[7].Add(time.Microsecond),
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[7]}, packets.Acked)
+	require.Equal(t, []protocol.PacketNumber{pns[4], pns[6]}, packets.Lost)
+	require.Len(t, eventRecorder.Events(qlog.PacketLost{}), 2)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PTOCountUpdated{PTOCount: 0},
+		},
+		eventRecorder.Events(qlog.PTOCountUpdated{})[:1],
+	)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.LossTimerUpdated{
+				Type:      qlog.LossTimerUpdateTypeSet,
+				TimerType: qlog.TimerTypePTO,
+				EncLevel:  encLevel,
+				Time:      sendTimes[8].Add(rttStats.PTO(encLevel == protocol.Encryption1RTT)).ToTime(),
+			},
+		},
+		eventRecorder.Events(qlog.LossTimerUpdated{}),
+	)
+	require.Contains(t, packets.Acked, pns[7])
+
+	// The PTO timer is now set for the last remaining packet (8),
+	// with no exponential backoff.
+	require.Equal(t, sendTimes[8].Add(rttStats.PTO(encLevel == protocol.Encryption1RTT)), sph.GetLossDetectionTimeout())
+
+	// Acknowledge the last packet (8).
+	// This should cancel the loss detection timer since there are no more outstanding packets.
+	eventRecorder.Clear()
+	_, err = sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[8])},
+		encLevel,
+		sendTimes[8].Add(time.Second),
+	)
+	require.NoError(t, err)
+	require.Contains(t, packets.Acked, pns[8])
+
+	// The loss detection timer should be cancelled since there are no more outstanding packets.
+	require.True(t, sph.GetLossDetectionTimeout().IsZero())
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.LossTimerUpdated{Type: qlog.LossTimerUpdateTypeCancelled},
+		},
+		eventRecorder.Events(qlog.LossTimerUpdated{}),
+	)
+}
+
+func TestSentPacketHandlerPacketNumberSpacesPTO(t *testing.T) {
+	rttStats := utils.NewRTTStats()
+	const rtt = time.Second
+	rttStats.UpdateRTT(rtt, 0)
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveServer,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	sendPacket := func(t *testing.T, ti monotime.Time, encLevel protocol.EncryptionLevel) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(encLevel)
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{{Frame: &wire.PingFrame{}}}, encLevel, protocol.ECNNon, 1000, false, false)
+		return pn
+	}
+
+	var initialPNs, handshakePNs [4]protocol.PacketNumber
+	var initialTimes, handshakeTimes [4]monotime.Time
+	now := monotime.Now()
+	initialPNs[0] = sendPacket(t, now, protocol.EncryptionInitial)
+	initialTimes[0] = now
+	now = now.Add(100 * time.Millisecond)
+	handshakePNs[0] = sendPacket(t, now, protocol.EncryptionHandshake)
+	handshakeTimes[0] = now
+	now = now.Add(100 * time.Millisecond)
+	initialPNs[1] = sendPacket(t, now, protocol.EncryptionInitial)
+	initialTimes[1] = now
+	now = now.Add(100 * time.Millisecond)
+	handshakePNs[1] = sendPacket(t, now, protocol.EncryptionHandshake)
+	handshakeTimes[1] = now
+	require.Equal(t, protocol.ByteCount(4000), sph.(*sentPacketHandler).getBytesInFlight())
+
+	// the PTO is the earliest time of the PTO times for both packet number spaces,
+	// i.e. the 2nd Initial packet sent
+	timeout := sph.GetLossDetectionTimeout()
+	require.Equal(t, initialTimes[1].Add(rttStats.PTO(false)), timeout)
+	sph.OnLossDetectionTimeout(timeout)
+	require.Equal(t, SendPTOInitial, sph.SendMode(timeout))
+	// send a PTO probe packet (Initial)
+	now = timeout.Add(100 * time.Millisecond)
+	initialPNs[2] = sendPacket(t, now, protocol.EncryptionInitial)
+	initialTimes[2] = now
+
+	// the earliest PTO time is now the 2nd Handshake packet
+	timeout = sph.GetLossDetectionTimeout()
+	// pto_count is a global property, so there's now an exponential backoff
+	require.Equal(t, handshakeTimes[1].Add(2*rttStats.PTO(false)), timeout)
+	sph.OnLossDetectionTimeout(timeout)
+	require.Equal(t, SendPTOHandshake, sph.SendMode(timeout))
+	// send a PTO probe packet (Handshake)
+	now = timeout.Add(100 * time.Millisecond)
+	handshakePNs[2] = sendPacket(t, now, protocol.EncryptionHandshake)
+	handshakeTimes[2] = now
+
+	// the earliest PTO time is now the 3rd Initial packet
+	timeout = sph.GetLossDetectionTimeout()
+	require.Equal(t, initialTimes[2].Add(4*rttStats.PTO(false)), timeout)
+	sph.OnLossDetectionTimeout(timeout)
+	require.Equal(t, SendPTOInitial, sph.SendMode(timeout))
+
+	// drop the Initial packet number space
+	now = timeout.Add(100 * time.Millisecond)
+	require.Equal(t, protocol.ByteCount(6000), sph.(*sentPacketHandler).getBytesInFlight())
+	sph.DropPackets(protocol.EncryptionInitial, now)
+	require.Equal(t, protocol.ByteCount(3000), sph.(*sentPacketHandler).getBytesInFlight())
+
+	// Since the Initial packets are gone:
+	// * the earliest PTO time is now based on the 3rd Handshake packet
+	// * the PTO count is reset to 0
+	timeout = sph.GetLossDetectionTimeout()
+	require.Equal(t, handshakeTimes[2].Add(rttStats.PTO(false)), timeout)
+
+	// send a 1-RTT packet
+	now = timeout.Add(100 * time.Millisecond)
+	sendTime := now
+	sendPacket(t, now, protocol.Encryption1RTT)
+
+	// until handshake confirmation, the PTO timer is based on the Handshake packet number space
+	require.Equal(t, timeout, sph.GetLossDetectionTimeout())
+	sph.OnLossDetectionTimeout(timeout)
+	require.Equal(t, SendPTOHandshake, sph.SendMode(now))
+
+	// Drop Handshake packet number space.
+	// This confirms the handshake, and the PTO timer is now based on the 1-RTT packet number space.
+	sph.DropPackets(protocol.EncryptionHandshake, now)
+	require.Equal(t, sendTime.Add(rttStats.PTO(false)), sph.GetLossDetectionTimeout())
+}
+
+func TestSentPacketHandler0RTT(t *testing.T) {
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		utils.NewRTTStats(),
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	var appDataPackets packetTracker
+	sendPacket := func(t *testing.T, ti monotime.Time, encLevel protocol.EncryptionLevel) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(encLevel)
+		var frames []Frame
+		if encLevel == protocol.Encryption0RTT || encLevel == protocol.Encryption1RTT {
+			frames = []Frame{appDataPackets.NewPingFrame(pn)}
+		} else {
+			frames = []Frame{{Frame: &wire.PingFrame{}}}
+		}
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, frames, encLevel, protocol.ECNNon, 1000, false, false)
+		return pn
+	}
+
+	now := monotime.Now()
+	sendPacket(t, now, protocol.Encryption0RTT)
+	sendPacket(t, now.Add(100*time.Millisecond), protocol.EncryptionHandshake)
+	sendPacket(t, now.Add(200*time.Millisecond), protocol.Encryption0RTT)
+	sendPacket(t, now.Add(300*time.Millisecond), protocol.Encryption1RTT)
+	sendPacket(t, now.Add(400*time.Millisecond), protocol.Encryption1RTT)
+	require.Equal(t, protocol.ByteCount(5000), sph.(*sentPacketHandler).getBytesInFlight())
+
+	// The PTO timer is based on the Handshake packet number space, not the 0-RTT packets
+	timeout := sph.GetLossDetectionTimeout()
+	require.NotZero(t, timeout)
+	sph.OnLossDetectionTimeout(timeout)
+	require.Equal(t, SendPTOHandshake, sph.SendMode(timeout))
+
+	now = timeout.Add(100 * time.Millisecond)
+	sph.DropPackets(protocol.Encryption0RTT, now)
+	require.Equal(t, protocol.ByteCount(3000), sph.(*sentPacketHandler).getBytesInFlight())
+	// 0-RTT are discarded, not lost
+	require.Empty(t, appDataPackets.Lost)
+}
+
+func TestSentPacketHandlerCongestion(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cong := mocks.NewMockSendAlgorithmWithDebugInfos(mockCtrl)
+	rttStats := utils.NewRTTStats()
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveServer,
+		nil,
+		utils.DefaultLogger,
+	)
+	sph.(*sentPacketHandler).congestion = cong
+
+	var packets packetTracker
+	// Send the first 5 packets: not congestion-limited, not pacing-limited.
+	// The 2nd packet is a Path MTU Probe packet.
+	now := monotime.Now()
+	var bytesInFlight protocol.ByteCount
+	var pns []protocol.PacketNumber
+	var sendTimes []monotime.Time
+	for i := range 5 {
+		gomock.InOrder(
+			cong.EXPECT().CanSend(bytesInFlight).Return(true),
+			cong.EXPECT().HasPacingBudget(now).Return(true),
+		)
+		require.Equal(t, SendAny, sph.SendMode(now))
+		pn := sph.PopPacketNumber(protocol.EncryptionInitial)
+		bytesInFlight += 1000
+		cong.EXPECT().OnPacketSent(now, bytesInFlight, pn, protocol.ByteCount(1000), true)
+		sph.SentPacket(now, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, protocol.EncryptionInitial, protocol.ECNNon, 1000, i == 1, false)
+		pns = append(pns, pn)
+		sendTimes = append(sendTimes, now)
+		now = now.Add(100 * time.Millisecond)
+	}
+
+	// try to send another packet: not congestion-limited, but pacing-limited
+	now = now.Add(100 * time.Millisecond)
+	gomock.InOrder(
+		cong.EXPECT().CanSend(bytesInFlight).Return(true),
+		cong.EXPECT().HasPacingBudget(now).Return(false),
+	)
+	require.Equal(t, SendPacingLimited, sph.SendMode(now))
+	// the connection would call TimeUntilSend, to find out when a new packet can be sent again
+	pacingDeadline := now.Add(500 * time.Millisecond)
+	cong.EXPECT().TimeUntilSend(bytesInFlight).Return(pacingDeadline)
+	require.Equal(t, pacingDeadline, sph.TimeUntilSend())
+
+	// try to send another packet, but now we're congestion limited
+	now = now.Add(100 * time.Millisecond)
+	cong.EXPECT().CanSend(bytesInFlight).Return(false)
+	require.Equal(t, SendAck, sph.SendMode(now)) // ACKs are allowed even if congestion limited
+
+	// Receive an ACK for packet 3 and 4 (which declares the 1st and 2nd packet lost).
+	// However, since the 2nd packet was a Path MTU probe packet, it won't get reported
+	// to the congestion controller.
+	ackTime := sendTimes[3].Add(time.Second)
+	gomock.InOrder(
+		cong.EXPECT().MaybeExitSlowStart(),
+		cong.EXPECT().OnCongestionEvent(pns[0], protocol.ByteCount(1000), protocol.ByteCount(5000)),
+		cong.EXPECT().OnPacketAcked(pns[2], protocol.ByteCount(1000), protocol.ByteCount(5000), ackTime),
+		cong.EXPECT().OnPacketAcked(pns[3], protocol.ByteCount(1000), protocol.ByteCount(5000), ackTime),
+	)
+	_, err := sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pns[2], pns[3])}, protocol.EncryptionInitial, ackTime)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[2], pns[3]}, packets.Acked)
+	require.Equal(t, []protocol.PacketNumber{pns[0], pns[1]}, packets.Lost)
+
+	// Now receive a (delayed) ACK for the 1st packet.
+	// Since this packet was already lost, we don't expect any calls to the congestion controller.
+	_, err = sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pns[0])}, protocol.EncryptionInitial, ackTime)
+	require.NoError(t, err)
+
+	// we should now have a PTO timer armed for the 4th packet
+	timeout := sph.GetLossDetectionTimeout()
+	require.NotZero(t, timeout)
+	sph.OnLossDetectionTimeout(timeout)
+	require.Equal(t, SendPTOInitial, sph.SendMode(timeout))
+
+	// send another packet to check that bytes_in_flight was correctly adjusted
+	now = timeout.Add(100 * time.Millisecond)
+	pn := sph.PopPacketNumber(protocol.EncryptionInitial)
+	cong.EXPECT().OnPacketSent(now, protocol.ByteCount(2000), pn, protocol.ByteCount(1000), true)
+	sph.SentPacket(now, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, protocol.EncryptionInitial, protocol.ECNNon, 1000, false, false)
+}
+
+func TestSentPacketHandlerRetry(t *testing.T) {
+	t.Run("long RTT measurement", func(t *testing.T) {
+		testSentPacketHandlerRetry(t, time.Second, time.Second)
+	})
+
+	// The estimated RTT should be at least 5ms, even if the RTT measurement is very short.
+	t.Run("short RTT measurement", func(t *testing.T) {
+		testSentPacketHandlerRetry(t, minRTTAfterRetry/3, minRTTAfterRetry)
+	})
+}
+
+func testSentPacketHandlerRetry(t *testing.T, rtt, expectedRTT time.Duration) {
+	var initialPackets, appDataPackets packetTracker
+
+	rttStats := utils.NewRTTStats()
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	start := monotime.Now()
+	now := start
+	var initialPNs, appDataPNs []protocol.PacketNumber
+	// send 2 initial and 2 0-RTT packets
+	for range 2 {
+		pn := sph.PopPacketNumber(protocol.EncryptionInitial)
+		initialPNs = append(initialPNs, pn)
+		sph.SentPacket(now, pn, protocol.InvalidPacketNumber, nil, []Frame{initialPackets.NewPingFrame(pn)}, protocol.EncryptionInitial, protocol.ECNNon, 1000, false, false)
+		now = now.Add(100 * time.Millisecond)
+
+		pn = sph.PopPacketNumber(protocol.Encryption0RTT)
+		appDataPNs = append(appDataPNs, pn)
+		sph.SentPacket(now, pn, protocol.InvalidPacketNumber, nil, []Frame{appDataPackets.NewPingFrame(pn)}, protocol.Encryption0RTT, protocol.ECNNon, 1000, false, false)
+		now = now.Add(100 * time.Millisecond)
+	}
+	require.Equal(t, protocol.ByteCount(4000), sph.(*sentPacketHandler).getBytesInFlight())
+	require.NotZero(t, sph.GetLossDetectionTimeout())
+
+	sph.ResetForRetry(start.Add(rtt))
+	// receiving a Retry cancels all timers
+	require.Zero(t, sph.GetLossDetectionTimeout())
+	// all packets sent so far are declared lost
+	require.Equal(t, []protocol.PacketNumber{initialPNs[0], initialPNs[1]}, initialPackets.Lost)
+	require.Equal(t, []protocol.PacketNumber{appDataPNs[0], appDataPNs[1]}, appDataPackets.Lost)
+	require.False(t, sph.QueueProbePacket(protocol.EncryptionInitial))
+	require.False(t, sph.QueueProbePacket(protocol.Encryption0RTT))
+	// the RTT measurement is taken from the first packet sent
+	require.Equal(t, expectedRTT, rttStats.SmoothedRTT())
+	require.Zero(t, sph.(*sentPacketHandler).getBytesInFlight())
+
+	// packet numbers continue increasing
+	initialPN, _ := sph.PeekPacketNumber(protocol.EncryptionInitial)
+	require.Greater(t, initialPN, initialPNs[1])
+	appDataPN, _ := sph.PeekPacketNumber(protocol.Encryption0RTT)
+	require.Greater(t, appDataPN, appDataPNs[1])
+}
+
+func TestSentPacketHandlerRetryAfterPTO(t *testing.T) {
+	rttStats := utils.NewRTTStats()
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+
+	var packets packetTracker
+	start := monotime.Now()
+	now := start
+	pn1 := sph.PopPacketNumber(protocol.EncryptionInitial)
+	sph.SentPacket(now, pn1, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn1)}, protocol.EncryptionInitial, protocol.ECNNon, 1000, false, false)
+
+	timeout := sph.GetLossDetectionTimeout()
+	require.NotZero(t, timeout)
+	sph.OnLossDetectionTimeout(timeout)
+	require.Equal(t, SendPTOInitial, sph.SendMode(timeout))
+	require.True(t, sph.QueueProbePacket(protocol.EncryptionInitial))
+
+	// send a retransmission for the first packet
+	now = timeout.Add(100 * time.Millisecond)
+	pn2 := sph.PopPacketNumber(protocol.EncryptionInitial)
+	sph.SentPacket(now, pn2, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn2)}, protocol.EncryptionInitial, protocol.ECNNon, 900, false, false)
+
+	const rtt = time.Second
+	sph.ResetForRetry(now.Add(rtt))
+
+	require.Equal(t, []protocol.PacketNumber{pn1, pn2}, packets.Lost)
+	// no RTT measurement is taken, since the PTO timer fired
+	require.Equal(t, utils.DefaultInitialRTT, rttStats.SmoothedRTT())
+}
+
+func TestSentPacketHandlerECN(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cong := mocks.NewMockSendAlgorithmWithDebugInfos(mockCtrl)
+	cong.EXPECT().OnPacketSent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	cong.EXPECT().OnPacketAcked(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	cong.EXPECT().MaybeExitSlowStart().AnyTimes()
+	ecnHandler := NewMockECNHandler(mockCtrl)
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		utils.NewRTTStats(),
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+	sph.(*sentPacketHandler).ecnTracker = ecnHandler
+	sph.(*sentPacketHandler).congestion = cong
+
+	// ECN marks on non-1-RTT packets are ignored
+	sph.SentPacket(monotime.Now(), sph.PopPacketNumber(protocol.EncryptionInitial), protocol.InvalidPacketNumber, nil, nil, protocol.EncryptionInitial, protocol.ECT1, 1200, false, false)
+	sph.SentPacket(monotime.Now(), sph.PopPacketNumber(protocol.EncryptionHandshake), protocol.InvalidPacketNumber, nil, nil, protocol.EncryptionHandshake, protocol.ECT0, 1200, false, false)
+	sph.SentPacket(monotime.Now(), sph.PopPacketNumber(protocol.Encryption0RTT), protocol.InvalidPacketNumber, nil, nil, protocol.Encryption0RTT, protocol.ECNCE, 1200, false, false)
+
+	var packets packetTracker
+	sendPacket := func(t *testing.T, ti monotime.Time, ecn protocol.ECN) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(protocol.Encryption1RTT)
+		ecnHandler.EXPECT().SentPacket(pn, ecn)
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, protocol.Encryption1RTT, ecn, 1200, false, false)
+		return pn
+	}
+
+	pns := make([]protocol.PacketNumber, 4)
+	now := monotime.Now()
+	pns[0] = sendPacket(t, now, protocol.ECT1)
+	now = now.Add(time.Second)
+	pns[1] = sendPacket(t, now, protocol.ECT0)
+	pns[2] = sendPacket(t, now, protocol.ECT0)
+	pns[3] = sendPacket(t, now, protocol.ECT0)
+
+	// Receive an ACK with a short RTT, such that the first packet is lost.
+	cong.EXPECT().OnCongestionEvent(gomock.Any(), gomock.Any(), gomock.Any())
+	ecnHandler.EXPECT().LostPacket(pns[0])
+	ecnHandler.EXPECT().HandleNewlyAcked(gomock.Any(), int64(10), int64(11), int64(12)).DoAndReturn(func(packets []packetWithPacketNumber, _, _, _ int64) bool {
+		require.Len(t, packets, 2)
+		require.Equal(t, pns[2], packets[0].PacketNumber)
+		require.Equal(t, pns[3], packets[1].PacketNumber)
+		return false
+	})
+	_, err := sph.ReceivedAck(
+		&wire.AckFrame{
+			AckRanges: ackRanges(pns[2], pns[3]),
+			ECT0:      10,
+			ECT1:      11,
+			ECNCE:     12,
+		},
+		protocol.Encryption1RTT,
+		now.Add(100*time.Millisecond),
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[0]}, packets.Lost)
+
+	// The second packet is still outstanding.
+	// Receive a (delayed) ACK for it.
+	// Since the new ECN counts were already reported, ECN marks on this ACK frame are ignored.
+	now = now.Add(100 * time.Millisecond)
+	_, err = sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pns[1])}, protocol.Encryption1RTT, now)
+	require.NoError(t, err)
+
+	// Send two more packets, and receive an ACK for the second one.
+	pns = pns[:2]
+	pns[0] = sendPacket(t, now, protocol.ECT1)
+	pns[1] = sendPacket(t, now, protocol.ECT1)
+	ecnHandler.EXPECT().HandleNewlyAcked(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+		func(packets []packetWithPacketNumber, _, _, _ int64) bool {
+			require.Len(t, packets, 1)
+			require.Equal(t, pns[1], packets[0].PacketNumber)
+			return false
+		},
+	)
+	now = now.Add(100 * time.Millisecond)
+	_, err = sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pns[1])}, protocol.Encryption1RTT, now)
+	require.NoError(t, err)
+	// Receiving an ACK that covers both packets doesn't cause the ECN marks to be reported,
+	// since the largest acked didn't increase.
+	now = now.Add(100 * time.Millisecond)
+	_, err = sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pns[0], pns[1])}, protocol.Encryption1RTT, now)
+	require.NoError(t, err)
+
+	// Send another packet, and have the ECN handler report congestion.
+	// This needs to be reported to the congestion controller.
+	pns = pns[:1]
+	now = now.Add(time.Second)
+	pns[0] = sendPacket(t, now, protocol.ECT1)
+
+	gomock.InOrder(
+		ecnHandler.EXPECT().HandleNewlyAcked(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(true),
+		cong.EXPECT().OnCongestionEvent(pns[0], protocol.ByteCount(0), gomock.Any()),
+	)
+	_, err = sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(pns[0])}, protocol.Encryption1RTT, now.Add(100*time.Millisecond))
+	require.NoError(t, err)
+}
+
+func TestSentPacketHandlerPathProbe(t *testing.T) {
+	const rtt = 10 * time.Millisecond // RTT of the original path
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(rtt, 0)
+
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+	sph.DropPackets(protocol.EncryptionInitial, monotime.Now())
+	sph.DropPackets(protocol.EncryptionHandshake, monotime.Now())
+
+	var packets packetTracker
+	sendPacket := func(t *testing.T, ti monotime.Time, isPathProbe bool) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(protocol.Encryption1RTT)
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, protocol.Encryption1RTT, protocol.ECNNon, 1200, false, isPathProbe)
+		return pn
+	}
+
+	// send 5 packets: 2 non-probe packets, 1 probe packet, 2 non-probe packets
+	now := monotime.Now()
+	var pns [5]protocol.PacketNumber
+	pns[0] = sendPacket(t, now, false)
+	now = now.Add(rtt)
+	pns[1] = sendPacket(t, now, false)
+	pns[2] = sendPacket(t, now, true)
+	pathProbeTimeout := now.Add(pathProbePacketLossTimeout)
+	now = now.Add(rtt)
+	pns[3] = sendPacket(t, now, false)
+	now = now.Add(rtt)
+	pns[4] = sendPacket(t, now, false)
+	require.Less(t, sph.GetLossDetectionTimeout(), pathProbeTimeout)
+
+	now = now.Add(100 * time.Millisecond)
+	// make sure that this ACK doesn't declare the path probe packet lost
+	require.Greater(t, pathProbeTimeout, now)
+	_, err := sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[0], pns[3], pns[4])},
+		protocol.Encryption1RTT,
+		now,
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[0], pns[3], pns[4]}, packets.Acked)
+	// despite having been sent at the same time, the probe packet was not lost
+	require.Equal(t, []protocol.PacketNumber{pns[1]}, packets.Lost)
+
+	// the timeout is now based on the probe packet
+	timeout := sph.GetLossDetectionTimeout()
+	require.Equal(t, pathProbeTimeout, timeout)
+	require.Zero(t, sph.(*sentPacketHandler).getBytesInFlight())
+	pn1 := sendPacket(t, now, false)
+	pn2 := sendPacket(t, now, false)
+	require.Equal(t, protocol.ByteCount(2400), sph.(*sentPacketHandler).getBytesInFlight())
+
+	// send one more non-probe packet
+	pn := sendPacket(t, now, false)
+	// the timeout is now based on this packet
+	require.Less(t, sph.GetLossDetectionTimeout(), pathProbeTimeout)
+	_, err = sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[2], pn)},
+		protocol.Encryption1RTT,
+		now,
+	)
+	require.NoError(t, err)
+
+	packets.Lost = packets.Lost[:0]
+	sph.MigratedPath(now, 1200)
+	require.Zero(t, sph.(*sentPacketHandler).getBytesInFlight())
+	require.Equal(t, utils.DefaultInitialRTT, rttStats.SmoothedRTT())
+	require.Equal(t, []protocol.PacketNumber{pn1, pn2}, packets.Lost)
+}
+
+func TestSentPacketHandlerPathProbeAckAndLoss(t *testing.T) {
+	const rtt = 10 * time.Millisecond // RTT of the original path
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(rtt, 0)
+
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+	sph.DropPackets(protocol.EncryptionInitial, monotime.Now())
+	sph.DropPackets(protocol.EncryptionHandshake, monotime.Now())
+
+	var packets packetTracker
+	sendPacket := func(t *testing.T, ti monotime.Time, isPathProbe bool) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(protocol.Encryption1RTT)
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, protocol.Encryption1RTT, protocol.ECNNon, 1200, false, isPathProbe)
+		return pn
+	}
+
+	now := monotime.Now()
+	pn1 := sendPacket(t, now, true)
+	t1 := now
+	now = now.Add(100 * time.Millisecond)
+	_ = sendPacket(t, now, true)
+	t2 := now
+	now = now.Add(100 * time.Millisecond)
+	pn3 := sendPacket(t, now, true)
+
+	now = now.Add(100 * time.Millisecond)
+	require.Equal(t, t1.Add(pathProbePacketLossTimeout), sph.GetLossDetectionTimeout())
+	require.NoError(t, sph.OnLossDetectionTimeout(sph.GetLossDetectionTimeout()))
+	require.Equal(t, []protocol.PacketNumber{pn1}, packets.Lost)
+	packets.Lost = packets.Lost[:0]
+
+	// receive a delayed ACK for the path probe packet
+	_, err := sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pn1, pn3)},
+		protocol.Encryption1RTT,
+		now,
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pn3}, packets.Acked)
+	require.Empty(t, packets.Lost)
+
+	require.Equal(t, t2.Add(pathProbePacketLossTimeout), sph.GetLossDetectionTimeout())
+}
+
+// The packet tracking logic is pretty complex.
+// We test it with a randomized approach, to make sure that it doesn't panic under any circumstances.
+func TestSentPacketHandlerRandomized(t *testing.T) {
+	seed := uint64(time.Now().UnixNano())
+	for i := range 5 {
+		t.Run(fmt.Sprintf("run %d (seed %d)", i+1, seed), func(t *testing.T) {
+			testSentPacketHandlerRandomized(t, seed)
+		})
+		seed++
+	}
+}
+
+func testSentPacketHandlerRandomized(t *testing.T, seed uint64) {
+	var b [32]byte
+	binary.BigEndian.PutUint64(b[:], seed)
+	r := rand.New(rand.NewChaCha8(b))
+
+	rttStats := utils.NewRTTStats()
+	rtt := []time.Duration{10 * time.Millisecond, 100 * time.Millisecond, 1000 * time.Millisecond}[r.IntN(3)]
+	t.Logf("rtt: %dms", rtt.Milliseconds())
+	rttStats.UpdateRTT(rtt, 0) // RTT of the original path
+
+	randDuration := func(min, max time.Duration) time.Duration {
+		return time.Duration(rand.Int64N(int64(max-min))) + min
+	}
+
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+	sph.DropPackets(protocol.EncryptionInitial, monotime.Now())
+	sph.DropPackets(protocol.EncryptionHandshake, monotime.Now())
+
+	var packets packetTracker
+	sendPacket := func(t *testing.T, ti monotime.Time, isPathProbe bool) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(protocol.Encryption1RTT)
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, protocol.Encryption1RTT, protocol.ECNNon, 1200, false, isPathProbe)
+		return pn
+	}
+
+	now := monotime.Now()
+	start := now
+	var pns []protocol.PacketNumber
+	for range 4 {
+		isProbe := r.Int()%2 == 0
+		pn := sendPacket(t, now, isProbe)
+		t.Logf("t=%dms: sending packet %d (probe packet: %t)", now.Sub(start).Milliseconds(), pn, isProbe)
+		pns = append(pns, pn)
+		now = now.Add(randDuration(0, 500*time.Millisecond))
+		if r.Int()%3 == 0 {
+			sph.OnLossDetectionTimeout(now)
+			t.Logf("t=%dms: loss detection timeout (lost: %v)", now.Sub(start).Milliseconds(), packets.Lost)
+			packets.Reset()
+			now = now.Add(randDuration(0, 500*time.Millisecond))
+		}
+		if r.Int()%3 == 0 {
+			// acknowledge up to 2 random packet numbers from the pns slice
+			var ackPns []protocol.PacketNumber
+			if len(pns) > 0 {
+				numToAck := min(1+r.IntN(2), len(pns))
+				for range numToAck {
+					ackPns = append(ackPns, pns[r.IntN(len(pns))])
+				}
+			}
+			if len(ackPns) > 1 {
+				slices.Sort(ackPns)
+				ackPns = slices.Compact(ackPns)
+			}
+			sph.ReceivedAck(&wire.AckFrame{AckRanges: ackRanges(ackPns...)}, protocol.Encryption1RTT, now)
+			t.Logf("t=%dms: received ACK for packets %v (acked: %v, lost: %v)", now.Sub(start).Milliseconds(), ackPns, packets.Acked, packets.Lost)
+			packets.Reset()
+			now = now.Add(randDuration(0, 500*time.Millisecond))
+		}
+		if r.Int()%10 == 0 {
+			sph.MigratedPath(now, 1200)
+			now = now.Add(randDuration(0, 500*time.Millisecond))
+		}
+	}
+	t.Logf("t=%dms: loss detection timeout (lost: %v)", now.Sub(start).Milliseconds(), packets.Lost)
+	sph.OnLossDetectionTimeout(now)
+}
+
+func TestSentPacketHandlerSpuriousLoss(t *testing.T) {
+	const rtt = time.Second
+
+	var eventRecorder events.Recorder
+
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		utils.NewRTTStats(),
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		&eventRecorder,
+		utils.DefaultLogger,
+	)
+
+	var packets packetTracker
+	sendPacket := func(t *testing.T, ti monotime.Time) protocol.PacketNumber {
+		t.Helper()
+		pn := sph.PopPacketNumber(protocol.Encryption1RTT)
+		sph.SentPacket(ti, pn, protocol.InvalidPacketNumber, nil, []Frame{packets.NewPingFrame(pn)}, protocol.Encryption1RTT, protocol.ECNNon, 1000, false, false)
+		return pn
+	}
+
+	start := monotime.Now()
+	now := start
+	var pns []protocol.PacketNumber
+	for range 20 {
+		pns = append(pns, sendPacket(t, now))
+		now = now.Add(10 * time.Millisecond)
+	}
+
+	now = start.Add(rtt)
+	_, err := sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[0], pns[6])},
+		protocol.Encryption1RTT,
+		now,
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[0], pns[6]}, packets.Acked)
+	// pns[4] and pns[5] are not yet declared lost
+	require.Equal(t, []protocol.PacketNumber{pns[1], pns[2], pns[3]}, packets.Lost)
+
+	packets.Reset()
+	eventRecorder.Clear()
+
+	const secondAckDelay = 50 * time.Millisecond
+
+	now = now.Add(secondAckDelay)
+	_, err = sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[0], pns[1], pns[2], pns[3], pns[4], pns[5], pns[6], pns[12], pns[16])},
+		protocol.Encryption1RTT,
+		now,
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[4], pns[5], pns[12], pns[16]}, packets.Acked)
+	require.Equal(t, []protocol.PacketNumber{pns[7], pns[8], pns[9], pns[10], pns[11], pns[13]}, packets.Lost)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.SpuriousLoss{
+				EncryptionLevel:  protocol.Encryption1RTT,
+				PacketNumber:     pns[1],
+				PacketReordering: 16 - 1,
+				TimeReordering:   rtt + secondAckDelay - 10*time.Millisecond,
+			},
+			qlog.SpuriousLoss{
+				EncryptionLevel:  protocol.Encryption1RTT,
+				PacketNumber:     pns[2],
+				PacketReordering: 16 - 2,
+				TimeReordering:   rtt + secondAckDelay - 20*time.Millisecond,
+			},
+			qlog.SpuriousLoss{
+				EncryptionLevel:  protocol.Encryption1RTT,
+				PacketNumber:     pns[3],
+				PacketReordering: 16 - 3,
+				TimeReordering:   rtt + secondAckDelay - 30*time.Millisecond,
+			},
+		},
+		eventRecorder.Events(qlog.SpuriousLoss{}),
+	)
+	eventRecorder.Clear()
+
+	now = now.Add(secondAckDelay)
+	_, err = sph.ReceivedAck(
+		&wire.AckFrame{AckRanges: ackRanges(pns[0], pns[1], pns[2], pns[3], pns[4], pns[5], pns[6], pns[7], pns[8], pns[9], pns[10], pns[16], pns[17], pns[18])},
+		protocol.Encryption1RTT,
+		now,
+	)
+	require.NoError(t, err)
+	require.Equal(t, []protocol.PacketNumber{pns[4], pns[5], pns[12], pns[16], pns[17], pns[18]}, packets.Acked)
+	require.Equal(t, []protocol.PacketNumber{pns[7], pns[8], pns[9], pns[10], pns[11], pns[13], pns[14], pns[15]}, packets.Lost)
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.SpuriousLoss{
+				EncryptionLevel:  protocol.Encryption1RTT,
+				PacketNumber:     pns[7],
+				PacketReordering: 18 - 7,
+				TimeReordering:   rtt + 2*secondAckDelay - 70*time.Millisecond,
+			},
+			qlog.SpuriousLoss{
+				EncryptionLevel:  protocol.Encryption1RTT,
+				PacketNumber:     pns[8],
+				PacketReordering: 18 - 8,
+				TimeReordering:   rtt + 2*secondAckDelay - 80*time.Millisecond,
+			},
+			qlog.SpuriousLoss{
+				EncryptionLevel:  protocol.Encryption1RTT,
+				PacketNumber:     pns[9],
+				PacketReordering: 18 - 9,
+				TimeReordering:   rtt + 2*secondAckDelay - 90*time.Millisecond,
+			},
+			qlog.SpuriousLoss{
+				EncryptionLevel:  protocol.Encryption1RTT,
+				PacketNumber:     pns[10],
+				PacketReordering: 18 - 10,
+				TimeReordering:   rtt + 2*secondAckDelay - 100*time.Millisecond,
+			},
+		},
+		eventRecorder.Events(qlog.SpuriousLoss{}),
+	)
+}
+
+func BenchmarkSendAndAcknowledge(b *testing.B) {
+	b.Run("ack every: 2, in flight: 0", func(b *testing.B) {
+		benchmarkSendAndAcknowledge(b, 2, 0)
+	})
+	b.Run("ack every: 10, in flight: 100", func(b *testing.B) {
+		benchmarkSendAndAcknowledge(b, 10, 100)
+	})
+	b.Run("ack every: 100, in flight: 1000", func(b *testing.B) {
+		benchmarkSendAndAcknowledge(b, 100, 1000)
+	})
+}
+
+func benchmarkSendAndAcknowledge(b *testing.B, ackEvery, inFlight int) {
+	b.ReportAllocs()
+
+	rttStats := utils.NewRTTStats()
+	sph := NewSentPacketHandler(
+		0,
+		1200,
+		rttStats,
+		&utils.ConnectionStats{},
+		true,
+		false,
+		nil,
+		protocol.PerspectiveClient,
+		nil,
+		utils.DefaultLogger,
+	)
+	now := monotime.Now()
+	sph.DropPackets(protocol.EncryptionInitial, now)
+	sph.DropPackets(protocol.EncryptionHandshake, now)
+
+	streamFrames := []StreamFrame{{Frame: &wire.StreamFrame{}}}
+
+	pns := make([]protocol.PacketNumber, 0, ackEvery+inFlight)
+
+	var counter int
+	ranges := make([]wire.AckRange, 0, ackEvery)
+	for b.Loop() {
+		counter++
+		pn := sph.PopPacketNumber(protocol.Encryption1RTT)
+		sph.SentPacket(
+			now,
+			pn,
+			protocol.InvalidPacketNumber,
+			streamFrames,
+			nil,
+			protocol.Encryption1RTT,
+			protocol.ECNNon,
+			1200,
+			false, false,
+		)
+		now = now.Add(time.Millisecond)
+		pns = append(pns, pn)
+
+		if counter > inFlight && counter%ackEvery == 0 {
+			sph.ReceivedAck(
+				&wire.AckFrame{AckRanges: appendAckRanges(ranges, pns[:ackEvery]...)},
+				protocol.Encryption1RTT,
+				now,
+			)
+			pns = append(pns[:0], pns[ackEvery:]...)
+			ranges = ranges[:0]
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_history.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_history.go
new file mode 100644
index 000000000..1500e1cdf
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_history.go
@@ -0,0 +1,274 @@
+package ackhandler
+
+import (
+	"fmt"
+	"iter"
+	"slices"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+const maxSkippedPackets = 4
+
+type sentPacketHistory struct {
+	packets          []*packet
+	pathProbePackets []packetWithPacketNumber
+	skippedPackets   []protocol.PacketNumber
+
+	numOutstanding int
+
+	firstPacketNumber   protocol.PacketNumber
+	highestPacketNumber protocol.PacketNumber
+}
+
+func newSentPacketHistory(isAppData bool) *sentPacketHistory {
+	h := &sentPacketHistory{
+		highestPacketNumber: protocol.InvalidPacketNumber,
+		firstPacketNumber:   protocol.InvalidPacketNumber,
+	}
+	if isAppData {
+		h.packets = make([]*packet, 0, 32)
+		h.skippedPackets = make([]protocol.PacketNumber, 0, maxSkippedPackets)
+	} else {
+		h.packets = make([]*packet, 0, 6)
+	}
+	return h
+}
+
+func (h *sentPacketHistory) checkSequentialPacketNumberUse(pn protocol.PacketNumber) {
+	if h.highestPacketNumber != protocol.InvalidPacketNumber {
+		if pn != h.highestPacketNumber+1 {
+			panic("non-sequential packet number use")
+		}
+	}
+	h.highestPacketNumber = pn
+	if len(h.packets) == 0 {
+		h.firstPacketNumber = pn
+	}
+}
+
+func (h *sentPacketHistory) SkippedPacket(pn protocol.PacketNumber) {
+	h.checkSequentialPacketNumberUse(pn)
+	if len(h.packets) > 0 {
+		h.packets = append(h.packets, nil)
+	}
+	if len(h.skippedPackets) == maxSkippedPackets {
+		h.skippedPackets = slices.Delete(h.skippedPackets, 0, 1)
+	}
+	h.skippedPackets = append(h.skippedPackets, pn)
+}
+
+func (h *sentPacketHistory) SentPacket(pn protocol.PacketNumber, p *packet) {
+	h.checkSequentialPacketNumberUse(pn)
+	h.packets = append(h.packets, p)
+	if p.Outstanding() {
+		h.numOutstanding++
+	}
+}
+
+func (h *sentPacketHistory) SentPathProbePacket(pn protocol.PacketNumber, p *packet) {
+	h.checkSequentialPacketNumberUse(pn)
+	h.packets = append(h.packets, &packet{isPathProbePacket: true})
+	h.pathProbePackets = append(h.pathProbePackets, packetWithPacketNumber{PacketNumber: pn, packet: p})
+}
+
+func (h *sentPacketHistory) Packets() iter.Seq2[protocol.PacketNumber, *packet] {
+	return func(yield func(protocol.PacketNumber, *packet) bool) {
+		// h.firstPacketNumber might be updated in the yield function,
+		// so we need to save it here.
+		firstPacketNumber := h.firstPacketNumber
+		for i, p := range h.packets {
+			if p == nil {
+				continue
+			}
+			if !yield(firstPacketNumber+protocol.PacketNumber(i), p) {
+				return
+			}
+		}
+	}
+}
+
+func (h *sentPacketHistory) PathProbes() iter.Seq2[protocol.PacketNumber, *packet] {
+	return func(yield func(protocol.PacketNumber, *packet) bool) {
+		for _, p := range h.pathProbePackets {
+			if !yield(p.PacketNumber, p.packet) {
+				return
+			}
+		}
+	}
+}
+
+// FirstOutstanding returns the first outstanding packet.
+func (h *sentPacketHistory) FirstOutstanding() (protocol.PacketNumber, *packet) {
+	if !h.HasOutstandingPackets() {
+		return protocol.InvalidPacketNumber, nil
+	}
+	for i, p := range h.packets {
+		if p != nil && p.Outstanding() {
+			return h.firstPacketNumber + protocol.PacketNumber(i), p
+		}
+	}
+	return protocol.InvalidPacketNumber, nil
+}
+
+// FirstOutstandingPathProbe returns the first outstanding path probe packet
+func (h *sentPacketHistory) FirstOutstandingPathProbe() (protocol.PacketNumber, *packet) {
+	if len(h.pathProbePackets) == 0 {
+		return protocol.InvalidPacketNumber, nil
+	}
+	return h.pathProbePackets[0].PacketNumber, h.pathProbePackets[0].packet
+}
+
+func (h *sentPacketHistory) SkippedPackets() iter.Seq[protocol.PacketNumber] {
+	return func(yield func(protocol.PacketNumber) bool) {
+		for _, p := range h.skippedPackets {
+			if !yield(p) {
+				return
+			}
+		}
+	}
+}
+
+func (h *sentPacketHistory) Len() int {
+	return len(h.packets)
+}
+
+func (h *sentPacketHistory) NumOutstanding() int {
+	return h.numOutstanding
+}
+
+// Remove removes a packet from the sent packet history.
+// It must not be used for skipped packet numbers.
+func (h *sentPacketHistory) Remove(pn protocol.PacketNumber) error {
+	idx, ok := h.getIndex(pn)
+	if !ok {
+		return fmt.Errorf("packet %d not found in sent packet history", pn)
+	}
+	p := h.packets[idx]
+	if p.Outstanding() {
+		h.numOutstanding--
+		if h.numOutstanding < 0 {
+			panic("negative number of outstanding packets")
+		}
+	}
+	h.packets[idx] = nil
+	// clean up all skipped packets directly before this packet number
+	var hasPacketBefore bool
+	for idx > 0 {
+		idx--
+		if h.packets[idx] != nil {
+			hasPacketBefore = true
+			break
+		}
+	}
+	if !hasPacketBefore {
+		h.cleanupStart()
+	}
+	if len(h.packets) > 0 && h.packets[0] == nil {
+		panic("cleanup failed")
+	}
+	return nil
+}
+
+// RemovePathProbe removes a path probe packet.
+// It scales O(N), but that's ok, since we don't expect to send many path probe packets.
+// It is not valid to call this function in IteratePathProbes.
+func (h *sentPacketHistory) RemovePathProbe(pn protocol.PacketNumber) *packet {
+	var packetToDelete *packet
+	idx := -1
+	for i, p := range h.pathProbePackets {
+		if p.PacketNumber == pn {
+			packetToDelete = p.packet
+			idx = i
+			break
+		}
+	}
+	if idx != -1 {
+		// don't use slices.Delete, because it zeros the deleted element
+		copy(h.pathProbePackets[idx:], h.pathProbePackets[idx+1:])
+		h.pathProbePackets = h.pathProbePackets[:len(h.pathProbePackets)-1]
+	}
+	return packetToDelete
+}
+
+// getIndex gets the index of packet p in the packets slice.
+func (h *sentPacketHistory) getIndex(p protocol.PacketNumber) (int, bool) {
+	if len(h.packets) == 0 {
+		return 0, false
+	}
+	if p < h.firstPacketNumber {
+		return 0, false
+	}
+	index := int(p - h.firstPacketNumber)
+	if index > len(h.packets)-1 {
+		return 0, false
+	}
+	return index, true
+}
+
+func (h *sentPacketHistory) HasOutstandingPackets() bool {
+	return h.numOutstanding > 0
+}
+
+func (h *sentPacketHistory) HasOutstandingPathProbes() bool {
+	return len(h.pathProbePackets) > 0
+}
+
+// delete all nil entries at the beginning of the packets slice
+func (h *sentPacketHistory) cleanupStart() {
+	for i, p := range h.packets {
+		if p != nil {
+			h.packets = h.packets[i:]
+			h.firstPacketNumber += protocol.PacketNumber(i)
+			return
+		}
+	}
+	h.packets = h.packets[:0]
+	h.firstPacketNumber = protocol.InvalidPacketNumber
+}
+
+func (h *sentPacketHistory) LowestPacketNumber() protocol.PacketNumber {
+	if len(h.packets) == 0 {
+		return protocol.InvalidPacketNumber
+	}
+	return h.firstPacketNumber
+}
+
+func (h *sentPacketHistory) DeclareLost(pn protocol.PacketNumber) {
+	idx, ok := h.getIndex(pn)
+	if !ok {
+		return
+	}
+	p := h.packets[idx]
+	if p.Outstanding() {
+		h.numOutstanding--
+		if h.numOutstanding < 0 {
+			panic("negative number of outstanding packets")
+		}
+	}
+	h.packets[idx] = nil
+	if idx == 0 {
+		h.cleanupStart()
+	}
+}
+
+// Difference returns the difference between two packet numbers a and b (a - b),
+// taking into account any skipped packet numbers between them.
+//
+// Note that old skipped packets are garbage collected at some point,
+// so this function is not guaranteed to return the correct result after a while.
+func (h *sentPacketHistory) Difference(a, b protocol.PacketNumber) protocol.PacketNumber {
+	diff := a - b
+	if len(h.skippedPackets) == 0 {
+		return diff
+	}
+	if a < h.skippedPackets[0] || b > h.skippedPackets[len(h.skippedPackets)-1] {
+		return diff
+	}
+	for _, p := range h.skippedPackets {
+		if p > b && p < a {
+			diff--
+		}
+	}
+	return diff
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_history_test.go b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_history_test.go
new file mode 100644
index 000000000..256683234
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/ackhandler/sent_packet_history_test.go
@@ -0,0 +1,343 @@
+package ackhandler
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func ackElicitingPacket() *packet {
+	return &packet{StreamFrames: []StreamFrame{{Frame: &wire.StreamFrame{StreamID: 1}}}}
+}
+
+func (h *sentPacketHistory) getPacketNumbers() []protocol.PacketNumber {
+	pns := make([]protocol.PacketNumber, 0, len(h.packets))
+	for pn := range h.Packets() {
+		pns = append(pns, pn)
+	}
+	return pns
+}
+
+func TestSentPacketHistoryPacketTracking(t *testing.T) {
+	t.Run("first packet ack-eliciting", func(t *testing.T) {
+		testSentPacketHistoryPacketTracking(t, true)
+	})
+	t.Run("first packet non-ack-eliciting", func(t *testing.T) {
+		testSentPacketHistoryPacketTracking(t, false)
+	})
+}
+
+func testSentPacketHistoryPacketTracking(t *testing.T, firstPacketAckEliciting bool) {
+	hist := newSentPacketHistory(true)
+
+	require.False(t, hist.HasOutstandingPackets())
+	if firstPacketAckEliciting {
+		hist.SentPacket(0, ackElicitingPacket())
+		require.True(t, hist.HasOutstandingPackets())
+	} else {
+		hist.SentPacket(0, &packet{})
+		require.False(t, hist.HasOutstandingPackets())
+	}
+	hist.SentPacket(1, ackElicitingPacket())
+	hist.SentPacket(2, ackElicitingPacket())
+	require.Equal(t, []protocol.PacketNumber{0, 1, 2}, hist.getPacketNumbers())
+	require.Empty(t, slices.Collect(hist.SkippedPackets()))
+	require.Equal(t, 3, hist.Len())
+	if firstPacketAckEliciting {
+		require.Equal(t, 3, hist.NumOutstanding())
+	} else {
+		require.Equal(t, 2, hist.NumOutstanding())
+	}
+
+	// non-ack-eliciting packets are saved, but don't count as outstanding
+	hist.SentPacket(3, &packet{})
+	hist.SentPacket(4, ackElicitingPacket())
+	hist.SentPacket(5, &packet{})
+	hist.SentPacket(6, ackElicitingPacket())
+	require.Equal(t, []protocol.PacketNumber{0, 1, 2, 3, 4, 5, 6}, hist.getPacketNumbers())
+	if firstPacketAckEliciting {
+		require.Equal(t, 5, hist.NumOutstanding())
+	} else {
+		require.Equal(t, 4, hist.NumOutstanding())
+	}
+
+	// handle skipped packet numbers
+	hist.SkippedPacket(7)
+	hist.SentPacket(8, ackElicitingPacket())
+	hist.SentPacket(9, &packet{})
+	hist.SkippedPacket(10)
+	hist.SentPacket(11, ackElicitingPacket())
+	require.Equal(t, []protocol.PacketNumber{0, 1, 2, 3, 4, 5, 6, 8, 9, 11}, hist.getPacketNumbers())
+	require.Equal(t, []protocol.PacketNumber{7, 10}, slices.Collect(hist.SkippedPackets()))
+	require.Equal(t, 12, hist.Len())
+	if firstPacketAckEliciting {
+		require.Equal(t, 7, hist.NumOutstanding())
+	} else {
+		require.Equal(t, 6, hist.NumOutstanding())
+	}
+}
+
+func TestSentPacketHistoryNonSequentialPacketNumberUse(t *testing.T) {
+	hist := newSentPacketHistory(true)
+	hist.SentPacket(100, ackElicitingPacket())
+	require.Panics(t, func() {
+		hist.SentPacket(102, ackElicitingPacket())
+	})
+}
+
+func TestSentPacketHistoryRemovePackets(t *testing.T) {
+	hist := newSentPacketHistory(true)
+
+	hist.SentPacket(0, ackElicitingPacket())
+	hist.SentPacket(1, ackElicitingPacket())
+	hist.SkippedPacket(2)
+	hist.SkippedPacket(3)
+	hist.SentPacket(4, ackElicitingPacket())
+	hist.SkippedPacket(5)
+	hist.SentPacket(6, ackElicitingPacket())
+	require.Equal(t, []protocol.PacketNumber{0, 1, 4, 6}, hist.getPacketNumbers())
+	require.Equal(t, []protocol.PacketNumber{2, 3, 5}, slices.Collect(hist.SkippedPackets()))
+
+	require.NoError(t, hist.Remove(0))
+	require.Equal(t, []protocol.PacketNumber{2, 3, 5}, slices.Collect(hist.SkippedPackets()))
+	require.NoError(t, hist.Remove(1))
+	require.Equal(t, []protocol.PacketNumber{4, 6}, hist.getPacketNumbers())
+	// skipped packets should be preserved
+	require.Equal(t, []protocol.PacketNumber{2, 3, 5}, slices.Collect(hist.SkippedPackets()))
+
+	// add one more packet
+	hist.SentPacket(7, ackElicitingPacket())
+	require.Equal(t, []protocol.PacketNumber{4, 6, 7}, hist.getPacketNumbers())
+
+	// remove last packet and add another
+	require.NoError(t, hist.Remove(7))
+	hist.SentPacket(8, ackElicitingPacket())
+	require.Equal(t, []protocol.PacketNumber{4, 6, 8}, hist.getPacketNumbers())
+
+	// try to remove non-existent packet
+	err := hist.Remove(9)
+	require.Error(t, err)
+	require.EqualError(t, err, "packet 9 not found in sent packet history")
+
+	// only the last 4 skipped packets should be preserved
+	hist.SkippedPacket(9)
+	hist.SkippedPacket(10)
+	hist.SentPacket(11, ackElicitingPacket())
+	hist.SkippedPacket(12)
+	require.Equal(t, []protocol.PacketNumber{5, 9, 10, 12}, slices.Collect(hist.SkippedPackets()))
+
+	// Remove all packets
+	require.NoError(t, hist.Remove(4))
+	require.NoError(t, hist.Remove(6))
+	require.NoError(t, hist.Remove(8))
+	require.NoError(t, hist.Remove(11))
+	require.Empty(t, hist.getPacketNumbers())
+	require.Len(t, slices.Collect(hist.SkippedPackets()), 4)
+	require.False(t, hist.HasOutstandingPackets())
+}
+
+func TestSentPacketHistoryFirstOutstandingPacket(t *testing.T) {
+	hist := newSentPacketHistory(true)
+
+	pn, p := hist.FirstOutstanding()
+	require.Equal(t, protocol.InvalidPacketNumber, pn)
+	require.Nil(t, p)
+
+	hist.SentPacket(2, ackElicitingPacket())
+	hist.SentPacket(3, ackElicitingPacket())
+	pn, p = hist.FirstOutstanding()
+	require.Equal(t, protocol.PacketNumber(2), pn)
+	require.NotNil(t, p)
+
+	// remove the first packet
+	hist.Remove(2)
+	pn, p = hist.FirstOutstanding()
+	require.Equal(t, protocol.PacketNumber(3), pn)
+	require.NotNil(t, p)
+
+	// Path MTU packets are not regarded as outstanding
+	hist = newSentPacketHistory(true)
+	hist.SentPacket(2, ackElicitingPacket())
+	hist.SkippedPacket(3)
+	p = ackElicitingPacket()
+	p.IsPathMTUProbePacket = true
+	hist.SentPacket(4, p)
+	pn, p = hist.FirstOutstanding()
+	require.NotNil(t, p)
+	require.Equal(t, protocol.PacketNumber(2), pn)
+}
+
+func TestSentPacketHistoryIterating(t *testing.T) {
+	hist := newSentPacketHistory(true)
+	hist.SkippedPacket(0)
+	hist.SentPacket(1, ackElicitingPacket())
+	hist.SentPacket(2, ackElicitingPacket())
+	hist.SentPacket(3, ackElicitingPacket())
+	hist.SkippedPacket(4)
+	hist.SkippedPacket(5)
+	hist.SentPacket(6, ackElicitingPacket())
+	require.Equal(t, []protocol.PacketNumber{0, 4, 5}, slices.Collect(hist.SkippedPackets()))
+	require.NoError(t, hist.Remove(3))
+
+	var packets []protocol.PacketNumber
+	for pn, p := range hist.Packets() {
+		require.NotNil(t, p)
+		packets = append(packets, pn)
+	}
+
+	require.Equal(t, []protocol.PacketNumber{1, 2, 6}, packets)
+	require.Equal(t, []protocol.PacketNumber{0, 4, 5}, slices.Collect(hist.SkippedPackets()))
+}
+
+func TestSentPacketHistoryDeleteWhileIterating(t *testing.T) {
+	hist := newSentPacketHistory(true)
+	hist.SentPacket(0, ackElicitingPacket())
+	hist.SentPacket(1, ackElicitingPacket())
+	hist.SkippedPacket(2)
+	hist.SentPacket(3, ackElicitingPacket())
+	hist.SkippedPacket(4)
+	hist.SentPacket(5, ackElicitingPacket())
+
+	var iterations []protocol.PacketNumber
+	for pn := range hist.Packets() {
+		iterations = append(iterations, pn)
+		switch pn {
+		case 0:
+			require.NoError(t, hist.Remove(0))
+		case 3:
+			require.NoError(t, hist.Remove(3))
+		}
+	}
+
+	require.Equal(t, []protocol.PacketNumber{0, 1, 3, 5}, iterations)
+	require.Equal(t, []protocol.PacketNumber{1, 5}, hist.getPacketNumbers())
+	require.Equal(t, []protocol.PacketNumber{2, 4}, slices.Collect(hist.SkippedPackets()))
+}
+
+func TestSentPacketHistoryPathProbes(t *testing.T) {
+	hist := newSentPacketHistory(true)
+	hist.SentPacket(0, ackElicitingPacket())
+	hist.SentPacket(1, ackElicitingPacket())
+	hist.SentPathProbePacket(2, ackElicitingPacket())
+	hist.SentPacket(3, ackElicitingPacket())
+	hist.SentPacket(4, ackElicitingPacket())
+	hist.SentPathProbePacket(5, ackElicitingPacket())
+
+	getPacketsInHistory := func(t *testing.T) []protocol.PacketNumber {
+		t.Helper()
+		var pns []protocol.PacketNumber
+		for pn, p := range hist.Packets() {
+			pns = append(pns, pn)
+			switch pn {
+			case 2, 5:
+				require.True(t, p.isPathProbePacket)
+			default:
+				require.False(t, p.isPathProbePacket)
+			}
+		}
+		return pns
+	}
+
+	getPacketsInPathProbeHistory := func(t *testing.T) []protocol.PacketNumber {
+		t.Helper()
+		var pns []protocol.PacketNumber
+		for pn := range hist.PathProbes() {
+			pns = append(pns, pn)
+		}
+		return pns
+	}
+
+	require.Equal(t, []protocol.PacketNumber{0, 1, 2, 3, 4, 5}, getPacketsInHistory(t))
+	require.Equal(t, []protocol.PacketNumber{2, 5}, getPacketsInPathProbeHistory(t))
+
+	// Removing packets from the regular packet history might happen before the path probe
+	// is declared lost, as the original path might have a smaller RTT than the path timeout.
+	// Therefore, the path probe packet is not removed from the path probe history.
+	require.NoError(t, hist.Remove(0))
+	require.NoError(t, hist.Remove(1))
+	require.NoError(t, hist.Remove(2))
+	require.NoError(t, hist.Remove(3))
+	require.Equal(t, []protocol.PacketNumber{4, 5}, getPacketsInHistory(t))
+	require.Equal(t, []protocol.PacketNumber{2, 5}, getPacketsInPathProbeHistory(t))
+	require.True(t, hist.HasOutstandingPackets())
+	require.True(t, hist.HasOutstandingPathProbes())
+	pn, p := hist.FirstOutstanding()
+	require.Equal(t, protocol.PacketNumber(4), pn)
+	require.NotNil(t, p)
+	pn, p = hist.FirstOutstandingPathProbe()
+	require.NotNil(t, p)
+	require.Equal(t, protocol.PacketNumber(2), pn)
+
+	hist.RemovePathProbe(2)
+	require.Equal(t, []protocol.PacketNumber{4, 5}, getPacketsInHistory(t))
+	require.Equal(t, []protocol.PacketNumber{5}, getPacketsInPathProbeHistory(t))
+	require.True(t, hist.HasOutstandingPathProbes())
+	pn, p = hist.FirstOutstandingPathProbe()
+	require.NotNil(t, p)
+	require.Equal(t, protocol.PacketNumber(5), pn)
+
+	hist.RemovePathProbe(5)
+	require.Equal(t, []protocol.PacketNumber{4, 5}, getPacketsInHistory(t))
+	require.Empty(t, getPacketsInPathProbeHistory(t))
+	require.True(t, hist.HasOutstandingPackets())
+	require.False(t, hist.HasOutstandingPathProbes())
+	pn, p = hist.FirstOutstandingPathProbe()
+	require.Equal(t, protocol.InvalidPacketNumber, pn)
+	require.Nil(t, p)
+
+	require.NoError(t, hist.Remove(4))
+	require.NoError(t, hist.Remove(5))
+	require.Empty(t, getPacketsInHistory(t))
+	require.False(t, hist.HasOutstandingPackets())
+	pn, p = hist.FirstOutstanding()
+	require.Equal(t, protocol.InvalidPacketNumber, pn)
+	require.Nil(t, p)
+
+	// path probe packets are considered outstanding
+	hist.SentPathProbePacket(6, ackElicitingPacket())
+	require.False(t, hist.HasOutstandingPackets())
+	require.True(t, hist.HasOutstandingPathProbes())
+	pn, p = hist.FirstOutstandingPathProbe()
+	require.NotNil(t, p)
+	require.Equal(t, protocol.PacketNumber(6), pn)
+
+	hist.RemovePathProbe(6)
+	require.False(t, hist.HasOutstandingPackets())
+	pn, p = hist.FirstOutstanding()
+	require.Equal(t, protocol.InvalidPacketNumber, pn)
+	require.Nil(t, p)
+	require.False(t, hist.HasOutstandingPathProbes())
+	pn, p = hist.FirstOutstandingPathProbe()
+	require.Equal(t, protocol.InvalidPacketNumber, pn)
+	require.Nil(t, p)
+}
+
+func TestSentPacketHistoryDifference(t *testing.T) {
+	hist := newSentPacketHistory(true)
+	hist.SentPacket(0, &packet{})
+	hist.SentPacket(1, ackElicitingPacket())
+	hist.SentPacket(2, ackElicitingPacket())
+	hist.SentPacket(3, ackElicitingPacket())
+	hist.SkippedPacket(4)
+	hist.SkippedPacket(5)
+	hist.SentPacket(6, ackElicitingPacket())
+	hist.SentPacket(7, &packet{})
+	hist.SkippedPacket(8)
+	hist.SentPacket(9, ackElicitingPacket())
+
+	require.Zero(t, hist.Difference(1, 1))
+	require.Zero(t, hist.Difference(2, 2))
+	require.Zero(t, hist.Difference(7, 7))
+
+	require.Equal(t, protocol.PacketNumber(1), hist.Difference(2, 1))
+	require.Equal(t, protocol.PacketNumber(2), hist.Difference(3, 1))
+	require.Equal(t, protocol.PacketNumber(3), hist.Difference(4, 1))
+	require.Equal(t, protocol.PacketNumber(3), hist.Difference(6, 1)) // 4 and 5 were skipped
+	require.Equal(t, protocol.PacketNumber(4), hist.Difference(7, 1)) // 4 and 5 were skipped
+	require.Equal(t, protocol.PacketNumber(3), hist.Difference(7, 2)) // 4 and 5 were skipped
+	require.Equal(t, protocol.PacketNumber(5), hist.Difference(9, 1)) // 4, 5 and 8 were skipped
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/bandwidth.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/bandwidth.go
new file mode 100644
index 000000000..3ad827d2b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/bandwidth.go
@@ -0,0 +1,22 @@
+package congestion
+
+import (
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// Bandwidth of a connection
+type Bandwidth uint64
+
+const (
+	// BitsPerSecond is 1 bit per second
+	BitsPerSecond Bandwidth = 1
+	// BytesPerSecond is 1 byte per second
+	BytesPerSecond = 8 * BitsPerSecond
+)
+
+// BandwidthFromDelta calculates the bandwidth from a number of bytes and a time delta
+func BandwidthFromDelta(bytes protocol.ByteCount, delta time.Duration) Bandwidth {
+	return Bandwidth(bytes) * Bandwidth(time.Second) / Bandwidth(delta) * BytesPerSecond
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/bandwidth_test.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/bandwidth_test.go
new file mode 100644
index 000000000..2545d582d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/bandwidth_test.go
@@ -0,0 +1,12 @@
+package congestion
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestBandwidthFromDelta(t *testing.T) {
+	require.Equal(t, 1000*BytesPerSecond, BandwidthFromDelta(1, time.Millisecond))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/clock.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/clock.go
new file mode 100644
index 000000000..8315026f6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/clock.go
@@ -0,0 +1,20 @@
+package congestion
+
+import (
+	"github.com/quic-go/quic-go/internal/monotime"
+)
+
+// A Clock returns the current time
+type Clock interface {
+	Now() monotime.Time
+}
+
+// DefaultClock implements the Clock interface using the Go stdlib clock.
+type DefaultClock struct{}
+
+var _ Clock = DefaultClock{}
+
+// Now gets the current time
+func (DefaultClock) Now() monotime.Time {
+	return monotime.Now()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic.go
new file mode 100644
index 000000000..40655de61
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic.go
@@ -0,0 +1,214 @@
+package congestion
+
+import (
+	"math"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// This cubic implementation is based on the one found in Chromiums's QUIC
+// implementation, in the files net/quic/congestion_control/cubic.{hh,cc}.
+
+// Constants based on TCP defaults.
+// The following constants are in 2^10 fractions of a second instead of ms to
+// allow a 10 shift right to divide.
+
+// 1024*1024^3 (first 1024 is from 0.100^3)
+// where 0.100 is 100 ms which is the scaling round trip time.
+const (
+	cubeScale                 = 40
+	cubeCongestionWindowScale = 410
+	cubeFactor                = 1 << cubeScale / cubeCongestionWindowScale / maxDatagramSize
+	// TODO: when re-enabling cubic, make sure to use the actual packet size here
+	maxDatagramSize = protocol.ByteCount(protocol.InitialPacketSize)
+)
+
+const defaultNumConnections = 1
+
+// Default Cubic backoff factor
+const beta float32 = 0.7
+
+// Additional backoff factor when loss occurs in the concave part of the Cubic
+// curve. This additional backoff factor is expected to give up bandwidth to
+// new concurrent flows and speed up convergence.
+const betaLastMax float32 = 0.85
+
+// Cubic implements the cubic algorithm from TCP
+type Cubic struct {
+	clock Clock
+
+	// Number of connections to simulate.
+	numConnections int
+
+	// Time when this cycle started, after last loss event.
+	epoch monotime.Time
+
+	// Max congestion window used just before last loss event.
+	// Note: to improve fairness to other streams an additional back off is
+	// applied to this value if the new value is below our latest value.
+	lastMaxCongestionWindow protocol.ByteCount
+
+	// Number of acked bytes since the cycle started (epoch).
+	ackedBytesCount protocol.ByteCount
+
+	// TCP Reno equivalent congestion window in packets.
+	estimatedTCPcongestionWindow protocol.ByteCount
+
+	// Origin point of cubic function.
+	originPointCongestionWindow protocol.ByteCount
+
+	// Time to origin point of cubic function in 2^10 fractions of a second.
+	timeToOriginPoint uint32
+
+	// Last congestion window in packets computed by cubic function.
+	lastTargetCongestionWindow protocol.ByteCount
+}
+
+// NewCubic returns a new Cubic instance
+func NewCubic(clock Clock) *Cubic {
+	c := &Cubic{
+		clock:          clock,
+		numConnections: defaultNumConnections,
+	}
+	c.Reset()
+	return c
+}
+
+// Reset is called after a timeout to reset the cubic state
+func (c *Cubic) Reset() {
+	c.epoch = 0
+	c.lastMaxCongestionWindow = 0
+	c.ackedBytesCount = 0
+	c.estimatedTCPcongestionWindow = 0
+	c.originPointCongestionWindow = 0
+	c.timeToOriginPoint = 0
+	c.lastTargetCongestionWindow = 0
+}
+
+func (c *Cubic) alpha() float32 {
+	// TCPFriendly alpha is described in Section 3.3 of the CUBIC paper. Note that
+	// beta here is a cwnd multiplier, and is equal to 1-beta from the paper.
+	// We derive the equivalent alpha for an N-connection emulation as:
+	b := c.beta()
+	return 3 * float32(c.numConnections) * float32(c.numConnections) * (1 - b) / (1 + b)
+}
+
+func (c *Cubic) beta() float32 {
+	// kNConnectionBeta is the backoff factor after loss for our N-connection
+	// emulation, which emulates the effective backoff of an ensemble of N
+	// TCP-Reno connections on a single loss event. The effective multiplier is
+	// computed as:
+	return (float32(c.numConnections) - 1 + beta) / float32(c.numConnections)
+}
+
+func (c *Cubic) betaLastMax() float32 {
+	// betaLastMax is the additional backoff factor after loss for our
+	// N-connection emulation, which emulates the additional backoff of
+	// an ensemble of N TCP-Reno connections on a single loss event. The
+	// effective multiplier is computed as:
+	return (float32(c.numConnections) - 1 + betaLastMax) / float32(c.numConnections)
+}
+
+// OnApplicationLimited is called on ack arrival when sender is unable to use
+// the available congestion window. Resets Cubic state during quiescence.
+func (c *Cubic) OnApplicationLimited() {
+	// When sender is not using the available congestion window, the window does
+	// not grow. But to be RTT-independent, Cubic assumes that the sender has been
+	// using the entire window during the time since the beginning of the current
+	// "epoch" (the end of the last loss recovery period). Since
+	// application-limited periods break this assumption, we reset the epoch when
+	// in such a period. This reset effectively freezes congestion window growth
+	// through application-limited periods and allows Cubic growth to continue
+	// when the entire window is being used.
+	c.epoch = 0
+}
+
+// CongestionWindowAfterPacketLoss computes a new congestion window to use after
+// a loss event. Returns the new congestion window in packets. The new
+// congestion window is a multiplicative decrease of our current window.
+func (c *Cubic) CongestionWindowAfterPacketLoss(currentCongestionWindow protocol.ByteCount) protocol.ByteCount {
+	if currentCongestionWindow+maxDatagramSize < c.lastMaxCongestionWindow {
+		// We never reached the old max, so assume we are competing with another
+		// flow. Use our extra back off factor to allow the other flow to go up.
+		c.lastMaxCongestionWindow = protocol.ByteCount(c.betaLastMax() * float32(currentCongestionWindow))
+	} else {
+		c.lastMaxCongestionWindow = currentCongestionWindow
+	}
+	c.epoch = 0 // Reset time.
+	return protocol.ByteCount(float32(currentCongestionWindow) * c.beta())
+}
+
+// CongestionWindowAfterAck computes a new congestion window to use after a received ACK.
+// Returns the new congestion window in packets. The new congestion window
+// follows a cubic function that depends on the time passed since last
+// packet loss.
+func (c *Cubic) CongestionWindowAfterAck(
+	ackedBytes protocol.ByteCount,
+	currentCongestionWindow protocol.ByteCount,
+	delayMin time.Duration,
+	eventTime monotime.Time,
+) protocol.ByteCount {
+	c.ackedBytesCount += ackedBytes
+
+	if c.epoch.IsZero() {
+		// First ACK after a loss event.
+		c.epoch = eventTime            // Start of epoch.
+		c.ackedBytesCount = ackedBytes // Reset count.
+		// Reset estimated_tcp_congestion_window_ to be in sync with cubic.
+		c.estimatedTCPcongestionWindow = currentCongestionWindow
+		if c.lastMaxCongestionWindow <= currentCongestionWindow {
+			c.timeToOriginPoint = 0
+			c.originPointCongestionWindow = currentCongestionWindow
+		} else {
+			c.timeToOriginPoint = uint32(math.Cbrt(float64(cubeFactor * (c.lastMaxCongestionWindow - currentCongestionWindow))))
+			c.originPointCongestionWindow = c.lastMaxCongestionWindow
+		}
+	}
+
+	// Change the time unit from microseconds to 2^10 fractions per second. Take
+	// the round trip time in account. This is done to allow us to use shift as a
+	// divide operator.
+	elapsedTime := int64(eventTime.Add(delayMin).Sub(c.epoch)/time.Microsecond) << 10 / (1000 * 1000)
+
+	// Right-shifts of negative, signed numbers have implementation-dependent
+	// behavior, so force the offset to be positive, as is done in the kernel.
+	offset := int64(c.timeToOriginPoint) - elapsedTime
+	if offset < 0 {
+		offset = -offset
+	}
+
+	deltaCongestionWindow := protocol.ByteCount(cubeCongestionWindowScale*offset*offset*offset) * maxDatagramSize >> cubeScale
+	var targetCongestionWindow protocol.ByteCount
+	if elapsedTime > int64(c.timeToOriginPoint) {
+		targetCongestionWindow = c.originPointCongestionWindow + deltaCongestionWindow
+	} else {
+		targetCongestionWindow = c.originPointCongestionWindow - deltaCongestionWindow
+	}
+	// Limit the CWND increase to half the acked bytes.
+	targetCongestionWindow = min(targetCongestionWindow, currentCongestionWindow+c.ackedBytesCount/2)
+
+	// Increase the window by approximately Alpha * 1 MSS of bytes every
+	// time we ack an estimated tcp window of bytes.  For small
+	// congestion windows (less than 25), the formula below will
+	// increase slightly slower than linearly per estimated tcp window
+	// of bytes.
+	c.estimatedTCPcongestionWindow += protocol.ByteCount(float32(c.ackedBytesCount) * c.alpha() * float32(maxDatagramSize) / float32(c.estimatedTCPcongestionWindow))
+	c.ackedBytesCount = 0
+
+	// We have a new cubic congestion window.
+	c.lastTargetCongestionWindow = targetCongestionWindow
+
+	// Compute target congestion_window based on cubic target and estimated TCP
+	// congestion_window, use highest (fastest).
+	if targetCongestionWindow < c.estimatedTCPcongestionWindow {
+		targetCongestionWindow = c.estimatedTCPcongestionWindow
+	}
+	return targetCongestionWindow
+}
+
+// SetNumConnections sets the number of emulated connections
+func (c *Cubic) SetNumConnections(n int) {
+	c.numConnections = n
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic_sender.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic_sender.go
new file mode 100644
index 000000000..e5457ddb8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic_sender.go
@@ -0,0 +1,330 @@
+package congestion
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+const (
+	// maxDatagramSize is the default maximum packet size used in the Linux TCP implementation.
+	// Used in QUIC for congestion window computations in bytes.
+	initialMaxDatagramSize     = protocol.ByteCount(protocol.InitialPacketSize)
+	maxBurstPackets            = 3
+	renoBeta                   = 0.7 // Reno backoff factor.
+	minCongestionWindowPackets = 2
+	initialCongestionWindow    = 32
+)
+
+type cubicSender struct {
+	hybridSlowStart HybridSlowStart
+	rttStats        *utils.RTTStats
+	connStats       *utils.ConnectionStats
+	cubic           *Cubic
+	pacer           *pacer
+	clock           Clock
+
+	reno bool
+
+	// Track the largest packet that has been sent.
+	largestSentPacketNumber protocol.PacketNumber
+
+	// Track the largest packet that has been acked.
+	largestAckedPacketNumber protocol.PacketNumber
+
+	// Track the largest packet number outstanding when a CWND cutback occurs.
+	largestSentAtLastCutback protocol.PacketNumber
+
+	// Whether the last loss event caused us to exit slowstart.
+	// Used for stats collection of slowstartPacketsLost
+	lastCutbackExitedSlowstart bool
+
+	// Congestion window in bytes.
+	congestionWindow protocol.ByteCount
+
+	// Slow start congestion window in bytes, aka ssthresh.
+	slowStartThreshold protocol.ByteCount
+
+	// ACK counter for the Reno implementation.
+	numAckedPackets uint64
+
+	initialCongestionWindow    protocol.ByteCount
+	initialMaxCongestionWindow protocol.ByteCount
+
+	maxDatagramSize protocol.ByteCount
+
+	lastState qlog.CongestionState
+	qlogger   qlogwriter.Recorder
+}
+
+var (
+	_ SendAlgorithm               = &cubicSender{}
+	_ SendAlgorithmWithDebugInfos = &cubicSender{}
+)
+
+// NewCubicSender makes a new cubic sender
+func NewCubicSender(
+	clock Clock,
+	rttStats *utils.RTTStats,
+	connStats *utils.ConnectionStats,
+	initialMaxDatagramSize protocol.ByteCount,
+	reno bool,
+	qlogger qlogwriter.Recorder,
+) *cubicSender {
+	return newCubicSender(
+		clock,
+		rttStats,
+		connStats,
+		reno,
+		initialMaxDatagramSize,
+		initialCongestionWindow*initialMaxDatagramSize,
+		protocol.MaxCongestionWindowPackets*initialMaxDatagramSize,
+		qlogger,
+	)
+}
+
+func newCubicSender(
+	clock Clock,
+	rttStats *utils.RTTStats,
+	connStats *utils.ConnectionStats,
+	reno bool,
+	initialMaxDatagramSize,
+	initialCongestionWindow,
+	initialMaxCongestionWindow protocol.ByteCount,
+	qlogger qlogwriter.Recorder,
+) *cubicSender {
+	c := &cubicSender{
+		rttStats:                   rttStats,
+		connStats:                  connStats,
+		largestSentPacketNumber:    protocol.InvalidPacketNumber,
+		largestAckedPacketNumber:   protocol.InvalidPacketNumber,
+		largestSentAtLastCutback:   protocol.InvalidPacketNumber,
+		initialCongestionWindow:    initialCongestionWindow,
+		initialMaxCongestionWindow: initialMaxCongestionWindow,
+		congestionWindow:           initialCongestionWindow,
+		slowStartThreshold:         protocol.MaxByteCount,
+		cubic:                      NewCubic(clock),
+		clock:                      clock,
+		reno:                       reno,
+		qlogger:                    qlogger,
+		maxDatagramSize:            initialMaxDatagramSize,
+	}
+	c.pacer = newPacer(c.BandwidthEstimate)
+	if c.qlogger != nil {
+		c.lastState = qlog.CongestionStateSlowStart
+		c.qlogger.RecordEvent(qlog.CongestionStateUpdated{
+			State: qlog.CongestionStateSlowStart,
+		})
+	}
+	return c
+}
+
+// TimeUntilSend returns when the next packet should be sent.
+func (c *cubicSender) TimeUntilSend(_ protocol.ByteCount) monotime.Time {
+	return c.pacer.TimeUntilSend()
+}
+
+func (c *cubicSender) HasPacingBudget(now monotime.Time) bool {
+	return c.pacer.Budget(now) >= c.maxDatagramSize
+}
+
+func (c *cubicSender) maxCongestionWindow() protocol.ByteCount {
+	return c.maxDatagramSize * protocol.MaxCongestionWindowPackets
+}
+
+func (c *cubicSender) minCongestionWindow() protocol.ByteCount {
+	return c.maxDatagramSize * minCongestionWindowPackets
+}
+
+func (c *cubicSender) OnPacketSent(
+	sentTime monotime.Time,
+	_ protocol.ByteCount,
+	packetNumber protocol.PacketNumber,
+	bytes protocol.ByteCount,
+	isRetransmittable bool,
+) {
+	c.pacer.SentPacket(sentTime, bytes)
+	if !isRetransmittable {
+		return
+	}
+	c.largestSentPacketNumber = packetNumber
+	c.hybridSlowStart.OnPacketSent(packetNumber)
+}
+
+func (c *cubicSender) CanSend(bytesInFlight protocol.ByteCount) bool {
+	return bytesInFlight < c.GetCongestionWindow()
+}
+
+func (c *cubicSender) InRecovery() bool {
+	return c.largestAckedPacketNumber != protocol.InvalidPacketNumber && c.largestAckedPacketNumber <= c.largestSentAtLastCutback
+}
+
+func (c *cubicSender) InSlowStart() bool {
+	return c.GetCongestionWindow() < c.slowStartThreshold
+}
+
+func (c *cubicSender) GetCongestionWindow() protocol.ByteCount {
+	return c.congestionWindow
+}
+
+func (c *cubicSender) MaybeExitSlowStart() {
+	if c.InSlowStart() &&
+		c.hybridSlowStart.ShouldExitSlowStart(c.rttStats.LatestRTT(), c.rttStats.MinRTT(), c.GetCongestionWindow()/c.maxDatagramSize) {
+		// exit slow start
+		c.slowStartThreshold = c.congestionWindow
+		c.maybeQlogStateChange(qlog.CongestionStateCongestionAvoidance)
+	}
+}
+
+func (c *cubicSender) OnPacketAcked(
+	ackedPacketNumber protocol.PacketNumber,
+	ackedBytes protocol.ByteCount,
+	priorInFlight protocol.ByteCount,
+	eventTime monotime.Time,
+) {
+	c.largestAckedPacketNumber = max(ackedPacketNumber, c.largestAckedPacketNumber)
+	if c.InRecovery() {
+		return
+	}
+	c.maybeIncreaseCwnd(ackedPacketNumber, ackedBytes, priorInFlight, eventTime)
+	if c.InSlowStart() {
+		c.hybridSlowStart.OnPacketAcked(ackedPacketNumber)
+	}
+}
+
+func (c *cubicSender) OnCongestionEvent(packetNumber protocol.PacketNumber, lostBytes, priorInFlight protocol.ByteCount) {
+	c.connStats.PacketsLost.Add(1)
+	c.connStats.BytesLost.Add(uint64(lostBytes))
+
+	// TCP NewReno (RFC6582) says that once a loss occurs, any losses in packets
+	// already sent should be treated as a single loss event, since it's expected.
+	if packetNumber <= c.largestSentAtLastCutback {
+		return
+	}
+	c.lastCutbackExitedSlowstart = c.InSlowStart()
+	c.maybeQlogStateChange(qlog.CongestionStateRecovery)
+
+	if c.reno {
+		c.congestionWindow = protocol.ByteCount(float64(c.congestionWindow) * renoBeta)
+	} else {
+		c.congestionWindow = c.cubic.CongestionWindowAfterPacketLoss(c.congestionWindow)
+	}
+	if minCwnd := c.minCongestionWindow(); c.congestionWindow < minCwnd {
+		c.congestionWindow = minCwnd
+	}
+	c.slowStartThreshold = c.congestionWindow
+	c.largestSentAtLastCutback = c.largestSentPacketNumber
+	// reset packet count from congestion avoidance mode. We start
+	// counting again when we're out of recovery.
+	c.numAckedPackets = 0
+}
+
+// Called when we receive an ack. Normal TCP tracks how many packets one ack
+// represents, but quic has a separate ack for each packet.
+func (c *cubicSender) maybeIncreaseCwnd(
+	_ protocol.PacketNumber,
+	ackedBytes protocol.ByteCount,
+	priorInFlight protocol.ByteCount,
+	eventTime monotime.Time,
+) {
+	// Do not increase the congestion window unless the sender is close to using
+	// the current window.
+	if !c.isCwndLimited(priorInFlight) {
+		c.cubic.OnApplicationLimited()
+		c.maybeQlogStateChange(qlog.CongestionStateApplicationLimited)
+		return
+	}
+	if c.congestionWindow >= c.maxCongestionWindow() {
+		return
+	}
+	if c.InSlowStart() {
+		// TCP slow start, exponential growth, increase by one for each ACK.
+		c.congestionWindow += c.maxDatagramSize
+		c.maybeQlogStateChange(qlog.CongestionStateSlowStart)
+		return
+	}
+	// Congestion avoidance
+	c.maybeQlogStateChange(qlog.CongestionStateCongestionAvoidance)
+	if c.reno {
+		// Classic Reno congestion avoidance.
+		c.numAckedPackets++
+		if c.numAckedPackets >= uint64(c.congestionWindow/c.maxDatagramSize) {
+			c.congestionWindow += c.maxDatagramSize
+			c.numAckedPackets = 0
+		}
+	} else {
+		c.congestionWindow = min(
+			c.maxCongestionWindow(),
+			c.cubic.CongestionWindowAfterAck(ackedBytes, c.congestionWindow, c.rttStats.MinRTT(), eventTime),
+		)
+	}
+}
+
+func (c *cubicSender) isCwndLimited(bytesInFlight protocol.ByteCount) bool {
+	congestionWindow := c.GetCongestionWindow()
+	if bytesInFlight >= congestionWindow {
+		return true
+	}
+	availableBytes := congestionWindow - bytesInFlight
+	slowStartLimited := c.InSlowStart() && bytesInFlight > congestionWindow/2
+	return slowStartLimited || availableBytes <= maxBurstPackets*c.maxDatagramSize
+}
+
+// BandwidthEstimate returns the current bandwidth estimate
+func (c *cubicSender) BandwidthEstimate() Bandwidth {
+	srtt := c.rttStats.SmoothedRTT()
+	if srtt == 0 {
+		// This should never happen, but if it does, avoid division by zero.
+		srtt = protocol.TimerGranularity
+	}
+	return BandwidthFromDelta(c.GetCongestionWindow(), srtt)
+}
+
+// OnRetransmissionTimeout is called on an retransmission timeout
+func (c *cubicSender) OnRetransmissionTimeout(packetsRetransmitted bool) {
+	c.largestSentAtLastCutback = protocol.InvalidPacketNumber
+	if !packetsRetransmitted {
+		return
+	}
+	c.hybridSlowStart.Restart()
+	c.cubic.Reset()
+	c.slowStartThreshold = c.congestionWindow / 2
+	c.congestionWindow = c.minCongestionWindow()
+}
+
+// OnConnectionMigration is called when the connection is migrated (?)
+func (c *cubicSender) OnConnectionMigration() {
+	c.hybridSlowStart.Restart()
+	c.largestSentPacketNumber = protocol.InvalidPacketNumber
+	c.largestAckedPacketNumber = protocol.InvalidPacketNumber
+	c.largestSentAtLastCutback = protocol.InvalidPacketNumber
+	c.lastCutbackExitedSlowstart = false
+	c.cubic.Reset()
+	c.numAckedPackets = 0
+	c.congestionWindow = c.initialCongestionWindow
+	c.slowStartThreshold = c.initialMaxCongestionWindow
+}
+
+func (c *cubicSender) maybeQlogStateChange(new qlog.CongestionState) {
+	if c.qlogger == nil || new == c.lastState {
+		return
+	}
+	c.qlogger.RecordEvent(qlog.CongestionStateUpdated{State: new})
+	c.lastState = new
+}
+
+func (c *cubicSender) SetMaxDatagramSize(s protocol.ByteCount) {
+	if s < c.maxDatagramSize {
+		panic(fmt.Sprintf("congestion BUG: decreased max datagram size from %d to %d", c.maxDatagramSize, s))
+	}
+	cwndIsMinCwnd := c.congestionWindow == c.minCongestionWindow()
+	c.maxDatagramSize = s
+	if cwndIsMinCwnd {
+		c.congestionWindow = c.minCongestionWindow()
+	}
+	c.pacer.SetMaxDatagramSize(s)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic_sender_test.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic_sender_test.go
new file mode 100644
index 000000000..d8a223058
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic_sender_test.go
@@ -0,0 +1,594 @@
+package congestion
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	initialCongestionWindowPackets = 10
+	defaultWindowTCP               = protocol.ByteCount(initialCongestionWindowPackets) * maxDatagramSize
+)
+
+type mockClock monotime.Time
+
+func (c *mockClock) Now() monotime.Time {
+	return monotime.Time(*c)
+}
+
+func (c *mockClock) Advance(d time.Duration) {
+	*c = mockClock(monotime.Time(*c).Add(d))
+}
+
+const MaxCongestionWindow = 200 * maxDatagramSize
+
+type testCubicSender struct {
+	sender            *cubicSender
+	clock             *mockClock
+	rttStats          *utils.RTTStats
+	bytesInFlight     protocol.ByteCount
+	packetNumber      protocol.PacketNumber
+	ackedPacketNumber protocol.PacketNumber
+}
+
+func newTestCubicSender(cubic bool) *testCubicSender {
+	var clock mockClock
+	rttStats := utils.RTTStats{}
+	return &testCubicSender{
+		clock:        &clock,
+		rttStats:     &rttStats,
+		packetNumber: 1,
+		sender: newCubicSender(
+			&clock,
+			&rttStats,
+			&utils.ConnectionStats{},
+			!cubic,
+			protocol.InitialPacketSize,
+			initialCongestionWindowPackets*maxDatagramSize,
+			MaxCongestionWindow,
+			nil,
+		),
+	}
+}
+
+func (s *testCubicSender) SendAvailableSendWindowLen(packetLength protocol.ByteCount) int {
+	var packetsSent int
+	for s.sender.CanSend(s.bytesInFlight) {
+		s.sender.OnPacketSent(s.clock.Now(), s.bytesInFlight, s.packetNumber, packetLength, true)
+		s.packetNumber++
+		packetsSent++
+		s.bytesInFlight += packetLength
+	}
+	return packetsSent
+}
+
+func (s *testCubicSender) AckNPackets(n int) {
+	s.rttStats.UpdateRTT(60*time.Millisecond, 0)
+	s.sender.MaybeExitSlowStart()
+	for range n {
+		s.ackedPacketNumber++
+		s.sender.OnPacketAcked(s.ackedPacketNumber, maxDatagramSize, s.bytesInFlight, s.clock.Now())
+	}
+	s.bytesInFlight -= protocol.ByteCount(n) * maxDatagramSize
+	s.clock.Advance(time.Millisecond)
+}
+
+func (s *testCubicSender) LoseNPacketsLen(n int, packetLength protocol.ByteCount) {
+	for range n {
+		s.ackedPacketNumber++
+		s.sender.OnCongestionEvent(s.ackedPacketNumber, packetLength, s.bytesInFlight)
+	}
+	s.bytesInFlight -= protocol.ByteCount(n) * packetLength
+}
+
+func (s *testCubicSender) LosePacket(number protocol.PacketNumber) {
+	s.sender.OnCongestionEvent(number, maxDatagramSize, s.bytesInFlight)
+	s.bytesInFlight -= maxDatagramSize
+}
+
+func (s *testCubicSender) SendAvailableSendWindow() int {
+	return s.SendAvailableSendWindowLen(maxDatagramSize)
+}
+
+func (s *testCubicSender) LoseNPackets(n int) {
+	s.LoseNPacketsLen(n, maxDatagramSize)
+}
+
+func TestCubicSenderStartup(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	// At startup make sure we are at the default.
+	require.Equal(t, defaultWindowTCP, sender.sender.GetCongestionWindow())
+
+	// Make sure we can send.
+	require.Zero(t, sender.sender.TimeUntilSend(0))
+	require.True(t, sender.sender.CanSend(sender.bytesInFlight))
+
+	// And that window is un-affected.
+	require.Equal(t, defaultWindowTCP, sender.sender.GetCongestionWindow())
+
+	// Fill the send window with data, then verify that we can't send.
+	sender.SendAvailableSendWindow()
+	require.False(t, sender.sender.CanSend(sender.bytesInFlight))
+}
+
+func TestCubicSenderPacing(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	// Set up RTT and advance clock
+	sender.rttStats.UpdateRTT(10*time.Millisecond, 0)
+	sender.clock.Advance(time.Hour)
+
+	// Fill the send window with data, then verify that we can't send.
+	sender.SendAvailableSendWindow()
+	sender.AckNPackets(1)
+
+	// Check that we can't send immediately due to pacing
+	delay := sender.sender.TimeUntilSend(sender.bytesInFlight)
+	require.NotZero(t, delay)
+	require.Less(t, delay.Sub(monotime.Time(*sender.clock)), time.Hour)
+}
+
+func TestCubicSenderApplicationLimitedSlowStart(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	// At startup make sure we can send.
+	require.True(t, sender.sender.CanSend(0))
+	require.Zero(t, sender.sender.TimeUntilSend(0))
+
+	// Send exactly 10 packets and ensure the CWND ends at 14 packets.
+	const numberOfAcks = 5
+	sender.SendAvailableSendWindow()
+	for range numberOfAcks {
+		sender.AckNPackets(2)
+	}
+
+	bytesToSend := sender.sender.GetCongestionWindow()
+	// It's expected 2 acks will arrive when the bytes_in_flight are greater than
+	// half the CWND.
+	require.Equal(t, defaultWindowTCP+maxDatagramSize*2*2, bytesToSend)
+}
+
+func TestCubicSenderExponentialSlowStart(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	// At startup make sure we can send.
+	require.True(t, sender.sender.CanSend(0))
+	require.Zero(t, sender.sender.TimeUntilSend(0))
+
+	const numberOfAcks = 20
+	for range numberOfAcks {
+		// Send our full send window.
+		sender.SendAvailableSendWindow()
+		sender.AckNPackets(2)
+	}
+
+	cwnd := sender.sender.GetCongestionWindow()
+	require.Equal(t, defaultWindowTCP+maxDatagramSize*2*numberOfAcks, cwnd)
+	require.Equal(t, BandwidthFromDelta(cwnd, sender.rttStats.SmoothedRTT()), sender.sender.BandwidthEstimate())
+}
+
+func TestCubicSenderSlowStartPacketLoss(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	const numberOfAcks = 10
+	for range numberOfAcks {
+		// Send our full send window.
+		sender.SendAvailableSendWindow()
+		sender.AckNPackets(2)
+	}
+	sender.SendAvailableSendWindow()
+	expectedSendWindow := defaultWindowTCP + (maxDatagramSize * 2 * numberOfAcks)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// Lose a packet to exit slow start.
+	sender.LoseNPackets(1)
+	packetsInRecoveryWindow := expectedSendWindow / maxDatagramSize
+
+	// We should now have fallen out of slow start with a reduced window.
+	expectedSendWindow = protocol.ByteCount(float32(expectedSendWindow) * renoBeta)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// Recovery phase. We need to ack every packet in the recovery window before
+	// we exit recovery.
+	numberOfPacketsInWindow := expectedSendWindow / maxDatagramSize
+	sender.AckNPackets(int(packetsInRecoveryWindow))
+	sender.SendAvailableSendWindow()
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// We need to ack an entire window before we increase CWND by 1.
+	fmt.Println(numberOfPacketsInWindow)
+	sender.AckNPackets(int(numberOfPacketsInWindow) - 2)
+	sender.SendAvailableSendWindow()
+	fmt.Println(sender.clock.Now())
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// Next ack should increase cwnd by 1.
+	sender.AckNPackets(1)
+	expectedSendWindow += maxDatagramSize
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// Now RTO and ensure slow start gets reset.
+	require.True(t, sender.sender.hybridSlowStart.Started())
+	sender.sender.OnRetransmissionTimeout(true)
+	require.False(t, sender.sender.hybridSlowStart.Started())
+}
+
+func TestCubicSenderSlowStartPacketLossPRR(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	// Test based on the first example in RFC6937.
+	// Ack 10 packets in 5 acks to raise the CWND to 20, as in the example.
+	const numberOfAcks = 5
+	for range numberOfAcks {
+		// Send our full send window.
+		sender.SendAvailableSendWindow()
+		sender.AckNPackets(2)
+	}
+	sender.SendAvailableSendWindow()
+	expectedSendWindow := defaultWindowTCP + (maxDatagramSize * 2 * numberOfAcks)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	sender.LoseNPackets(1)
+
+	// We should now have fallen out of slow start with a reduced window.
+	sendWindowBeforeLoss := expectedSendWindow
+	expectedSendWindow = protocol.ByteCount(float32(expectedSendWindow) * renoBeta)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// Testing TCP proportional rate reduction.
+	// We should send packets paced over the received acks for the remaining
+	// outstanding packets. The number of packets before we exit recovery is the
+	// original CWND minus the packet that has been lost and the one which
+	// triggered the loss.
+	remainingPacketsInRecovery := sendWindowBeforeLoss/maxDatagramSize - 2
+
+	for range remainingPacketsInRecovery {
+		sender.AckNPackets(1)
+		sender.SendAvailableSendWindow()
+		require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+	}
+
+	// We need to ack another window before we increase CWND by 1.
+	numberOfPacketsInWindow := expectedSendWindow / maxDatagramSize
+	for range numberOfPacketsInWindow {
+		sender.AckNPackets(1)
+		require.Equal(t, 1, sender.SendAvailableSendWindow())
+		require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+	}
+
+	sender.AckNPackets(1)
+	expectedSendWindow += maxDatagramSize
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+}
+
+func TestCubicSenderSlowStartBurstPacketLossPRR(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	// Test based on the second example in RFC6937, though we also implement
+	// forward acknowledgements, so the first two incoming acks will trigger
+	// PRR immediately.
+	// Ack 20 packets in 10 acks to raise the CWND to 30.
+	const numberOfAcks = 10
+	for range numberOfAcks {
+		// Send our full send window.
+		sender.SendAvailableSendWindow()
+		sender.AckNPackets(2)
+	}
+	sender.SendAvailableSendWindow()
+	expectedSendWindow := defaultWindowTCP + (maxDatagramSize * 2 * numberOfAcks)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// Lose one more than the congestion window reduction, so that after loss,
+	// bytes_in_flight is lesser than the congestion window.
+	sendWindowAfterLoss := protocol.ByteCount(renoBeta * float32(expectedSendWindow))
+	numPacketsToLose := (expectedSendWindow-sendWindowAfterLoss)/maxDatagramSize + 1
+	sender.LoseNPackets(int(numPacketsToLose))
+	// Immediately after the loss, ensure at least one packet can be sent.
+	// Losses without subsequent acks can occur with timer based loss detection.
+	require.True(t, sender.sender.CanSend(sender.bytesInFlight))
+	sender.AckNPackets(1)
+
+	// We should now have fallen out of slow start with a reduced window.
+	expectedSendWindow = protocol.ByteCount(float32(expectedSendWindow) * renoBeta)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// Only 2 packets should be allowed to be sent, per PRR-SSRB
+	require.Equal(t, 2, sender.SendAvailableSendWindow())
+
+	// Ack the next packet, which triggers another loss.
+	sender.LoseNPackets(1)
+	sender.AckNPackets(1)
+
+	// Send 2 packets to simulate PRR-SSRB.
+	require.Equal(t, 2, sender.SendAvailableSendWindow())
+
+	// Ack the next packet, which triggers another loss.
+	sender.LoseNPackets(1)
+	sender.AckNPackets(1)
+
+	// Send 2 packets to simulate PRR-SSRB.
+	require.Equal(t, 2, sender.SendAvailableSendWindow())
+
+	// Exit recovery and return to sending at the new rate.
+	for range numberOfAcks {
+		sender.AckNPackets(1)
+		require.Equal(t, 1, sender.SendAvailableSendWindow())
+	}
+}
+
+func TestCubicSenderRTOCongestionWindow(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	require.Equal(t, defaultWindowTCP, sender.sender.GetCongestionWindow())
+	require.Equal(t, protocol.MaxByteCount, sender.sender.slowStartThreshold)
+
+	// Expect the window to decrease to the minimum once the RTO fires
+	// and slow start threshold to be set to 1/2 of the CWND.
+	sender.sender.OnRetransmissionTimeout(true)
+	require.Equal(t, 2*maxDatagramSize, sender.sender.GetCongestionWindow())
+	require.Equal(t, 5*maxDatagramSize, sender.sender.slowStartThreshold)
+}
+
+func TestCubicSenderTCPCubicResetEpochOnQuiescence(t *testing.T) {
+	sender := newTestCubicSender(true)
+
+	const maxCongestionWindow = 50
+	const maxCongestionWindowBytes = maxCongestionWindow * maxDatagramSize
+
+	numSent := sender.SendAvailableSendWindow()
+
+	// Make sure we fall out of slow start.
+	savedCwnd := sender.sender.GetCongestionWindow()
+	sender.LoseNPackets(1)
+	require.Greater(t, savedCwnd, sender.sender.GetCongestionWindow())
+
+	// Ack the rest of the outstanding packets to get out of recovery.
+	for i := 1; i < numSent; i++ {
+		sender.AckNPackets(1)
+	}
+	require.Zero(t, sender.bytesInFlight)
+
+	// Send a new window of data and ack all; cubic growth should occur.
+	savedCwnd = sender.sender.GetCongestionWindow()
+	numSent = sender.SendAvailableSendWindow()
+	for range numSent {
+		sender.AckNPackets(1)
+	}
+	require.Less(t, savedCwnd, sender.sender.GetCongestionWindow())
+	require.Greater(t, maxCongestionWindowBytes, sender.sender.GetCongestionWindow())
+	require.Zero(t, sender.bytesInFlight)
+
+	// Quiescent time of 100 seconds
+	sender.clock.Advance(100 * time.Second)
+
+	// Send new window of data and ack one packet. Cubic epoch should have
+	// been reset; ensure cwnd increase is not dramatic.
+	savedCwnd = sender.sender.GetCongestionWindow()
+	sender.SendAvailableSendWindow()
+	sender.AckNPackets(1)
+	require.InDelta(t, float64(savedCwnd), float64(sender.sender.GetCongestionWindow()), float64(maxDatagramSize))
+	require.Greater(t, maxCongestionWindowBytes, sender.sender.GetCongestionWindow())
+}
+
+func TestCubicSenderMultipleLossesInOneWindow(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	sender.SendAvailableSendWindow()
+	initialWindow := sender.sender.GetCongestionWindow()
+	sender.LosePacket(sender.ackedPacketNumber + 1)
+	postLossWindow := sender.sender.GetCongestionWindow()
+	require.True(t, initialWindow > postLossWindow)
+	sender.LosePacket(sender.ackedPacketNumber + 3)
+	require.Equal(t, postLossWindow, sender.sender.GetCongestionWindow())
+	sender.LosePacket(sender.packetNumber - 1)
+	require.Equal(t, postLossWindow, sender.sender.GetCongestionWindow())
+
+	// Lose a later packet and ensure the window decreases.
+	sender.LosePacket(sender.packetNumber)
+	require.True(t, postLossWindow > sender.sender.GetCongestionWindow())
+}
+
+func TestCubicSender1ConnectionCongestionAvoidanceAtEndOfRecovery(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	// Ack 10 packets in 5 acks to raise the CWND to 20.
+	const numberOfAcks = 5
+	for range numberOfAcks {
+		// Send our full send window.
+		sender.SendAvailableSendWindow()
+		sender.AckNPackets(2)
+	}
+	sender.SendAvailableSendWindow()
+	expectedSendWindow := defaultWindowTCP + (maxDatagramSize * 2 * numberOfAcks)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	sender.LoseNPackets(1)
+
+	// We should now have fallen out of slow start with a reduced window.
+	expectedSendWindow = protocol.ByteCount(float32(expectedSendWindow) * renoBeta)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// No congestion window growth should occur in recovery phase, i.e., until the
+	// currently outstanding 20 packets are acked.
+	for range 10 {
+		// Send our full send window.
+		sender.SendAvailableSendWindow()
+		require.True(t, sender.sender.InRecovery())
+		sender.AckNPackets(2)
+		require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+	}
+	require.False(t, sender.sender.InRecovery())
+
+	// Out of recovery now. Congestion window should not grow during RTT.
+	for i := protocol.ByteCount(0); i < expectedSendWindow/maxDatagramSize-2; i += 2 {
+		// Send our full send window.
+		sender.SendAvailableSendWindow()
+		sender.AckNPackets(2)
+		require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+	}
+
+	// Next ack should cause congestion window to grow by 1MSS.
+	sender.SendAvailableSendWindow()
+	sender.AckNPackets(2)
+	expectedSendWindow += maxDatagramSize
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+}
+
+func TestCubicSenderNoPRR(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	sender.SendAvailableSendWindow()
+	sender.LoseNPackets(9)
+	sender.AckNPackets(1)
+
+	require.Equal(t, protocol.ByteCount(renoBeta*float32(defaultWindowTCP)), sender.sender.GetCongestionWindow())
+	windowInPackets := int(renoBeta * float32(defaultWindowTCP) / float32(maxDatagramSize))
+	numSent := sender.SendAvailableSendWindow()
+	require.Equal(t, windowInPackets, numSent)
+}
+
+func TestCubicSenderResetAfterConnectionMigration(t *testing.T) {
+	sender := newTestCubicSender(false)
+
+	require.Equal(t, defaultWindowTCP, sender.sender.GetCongestionWindow())
+	require.Equal(t, protocol.MaxByteCount, sender.sender.slowStartThreshold)
+
+	// Starts with slow start.
+	const numberOfAcks = 10
+	for range numberOfAcks {
+		// Send our full send window.
+		sender.SendAvailableSendWindow()
+		sender.AckNPackets(2)
+	}
+	sender.SendAvailableSendWindow()
+	expectedSendWindow := defaultWindowTCP + (maxDatagramSize * 2 * numberOfAcks)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+
+	// Loses a packet to exit slow start.
+	sender.LoseNPackets(1)
+
+	// We should now have fallen out of slow start with a reduced window. Slow
+	// start threshold is also updated.
+	expectedSendWindow = protocol.ByteCount(float32(expectedSendWindow) * renoBeta)
+	require.Equal(t, expectedSendWindow, sender.sender.GetCongestionWindow())
+	require.Equal(t, expectedSendWindow, sender.sender.slowStartThreshold)
+
+	// Resets cwnd and slow start threshold on connection migrations.
+	sender.sender.OnConnectionMigration()
+	require.Equal(t, defaultWindowTCP, sender.sender.GetCongestionWindow())
+	require.Equal(t, MaxCongestionWindow, sender.sender.slowStartThreshold)
+	require.False(t, sender.sender.hybridSlowStart.Started())
+}
+
+func TestCubicSenderSlowStartsUpToMaximumCongestionWindow(t *testing.T) {
+	var clock mockClock
+	rttStats := utils.RTTStats{}
+	const initialMaxCongestionWindow = protocol.MaxCongestionWindowPackets * initialMaxDatagramSize
+	sender := newCubicSender(
+		&clock,
+		&rttStats,
+		&utils.ConnectionStats{},
+		true,
+		protocol.InitialPacketSize,
+		initialCongestionWindowPackets*maxDatagramSize,
+		initialMaxCongestionWindow,
+		nil,
+	)
+
+	for i := 1; i < protocol.MaxCongestionWindowPackets; i++ {
+		sender.MaybeExitSlowStart()
+		sender.OnPacketAcked(protocol.PacketNumber(i), 1350, sender.GetCongestionWindow(), clock.Now())
+	}
+	require.Equal(t, initialMaxCongestionWindow, sender.GetCongestionWindow())
+}
+
+func TestCubicSenderMaximumPacketSizeReduction(t *testing.T) {
+	sender := newTestCubicSender(false)
+	require.Panics(t, func() { sender.sender.SetMaxDatagramSize(initialMaxDatagramSize - 1) })
+}
+
+func TestCubicSenderSlowStartsPacketSizeIncrease(t *testing.T) {
+	var clock mockClock
+	rttStats := utils.RTTStats{}
+	const initialMaxCongestionWindow = protocol.MaxCongestionWindowPackets * initialMaxDatagramSize
+	sender := newCubicSender(
+		&clock,
+		&rttStats,
+		&utils.ConnectionStats{},
+		true,
+		protocol.InitialPacketSize,
+		initialCongestionWindowPackets*maxDatagramSize,
+		initialMaxCongestionWindow,
+		nil,
+	)
+	const packetSize = initialMaxDatagramSize + 100
+	sender.SetMaxDatagramSize(packetSize)
+	for i := 1; i < protocol.MaxCongestionWindowPackets; i++ {
+		sender.OnPacketAcked(protocol.PacketNumber(i), packetSize, sender.GetCongestionWindow(), clock.Now())
+	}
+	const maxCwnd = protocol.MaxCongestionWindowPackets * packetSize
+	require.True(t, sender.GetCongestionWindow() > maxCwnd)
+	require.True(t, sender.GetCongestionWindow() <= maxCwnd+packetSize)
+}
+
+func TestCubicSenderLimitCwndIncreaseInCongestionAvoidance(t *testing.T) {
+	// Enable Cubic.
+	var clock mockClock
+	rttStats := utils.RTTStats{}
+	sender := newCubicSender(
+		&clock,
+		&rttStats,
+		&utils.ConnectionStats{},
+		false,
+		protocol.InitialPacketSize,
+		initialCongestionWindowPackets*maxDatagramSize,
+		MaxCongestionWindow,
+		nil,
+	)
+	testSender := &testCubicSender{
+		sender:   sender,
+		clock:    &clock,
+		rttStats: &rttStats,
+	}
+
+	numSent := testSender.SendAvailableSendWindow()
+
+	// Make sure we fall out of slow start.
+	savedCwnd := sender.GetCongestionWindow()
+	testSender.LoseNPackets(1)
+	require.Greater(t, savedCwnd, sender.GetCongestionWindow())
+
+	// Ack the rest of the outstanding packets to get out of recovery.
+	for i := 1; i < numSent; i++ {
+		testSender.AckNPackets(1)
+	}
+	require.Equal(t, protocol.ByteCount(0), testSender.bytesInFlight)
+
+	savedCwnd = sender.GetCongestionWindow()
+	testSender.SendAvailableSendWindow()
+
+	// Ack packets until the CWND increases.
+	for sender.GetCongestionWindow() == savedCwnd {
+		testSender.AckNPackets(1)
+		testSender.SendAvailableSendWindow()
+	}
+	// Bytes in flight may be larger than the CWND if the CWND isn't an exact
+	// multiple of the packet sizes being sent.
+	require.GreaterOrEqual(t, testSender.bytesInFlight, sender.GetCongestionWindow())
+	savedCwnd = sender.GetCongestionWindow()
+
+	// Advance time 2 seconds waiting for an ack.
+	clock.Advance(2 * time.Second)
+
+	// Ack two packets.  The CWND should increase by only one packet.
+	testSender.AckNPackets(2)
+	require.Equal(t, savedCwnd+maxDatagramSize, sender.GetCongestionWindow())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic_test.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic_test.go
new file mode 100644
index 000000000..70bd1f26c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/cubic_test.go
@@ -0,0 +1,205 @@
+package congestion
+
+import (
+	"math"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	numConnections         uint32  = 2
+	nConnectionBeta        float32 = (float32(numConnections) - 1 + beta) / float32(numConnections)
+	nConnectionBetaLastMax float32 = (float32(numConnections) - 1 + betaLastMax) / float32(numConnections)
+	nConnectionAlpha       float32 = 3 * float32(numConnections) * float32(numConnections) * (1 - nConnectionBeta) / (1 + nConnectionBeta)
+	maxCubicTimeInterval           = 30 * time.Millisecond
+)
+
+func renoCwnd(currentCwnd protocol.ByteCount) protocol.ByteCount {
+	return currentCwnd + protocol.ByteCount(float32(maxDatagramSize)*nConnectionAlpha*float32(maxDatagramSize)/float32(currentCwnd))
+}
+
+func cubicConvexCwnd(initialCwnd protocol.ByteCount, rtt, elapsedTime time.Duration) protocol.ByteCount {
+	offset := protocol.ByteCount((elapsedTime+rtt)/time.Microsecond) << 10 / 1000000
+	deltaCongestionWindow := 410 * offset * offset * offset * maxDatagramSize >> 40
+	return initialCwnd + deltaCongestionWindow
+}
+
+func TestCubicAboveOriginWithTighterBounds(t *testing.T) {
+	var clock mockClock
+	cubic := NewCubic(&clock)
+	cubic.SetNumConnections(int(numConnections))
+
+	// Convex growth.
+	const rttMin = 100 * time.Millisecond
+	const rttMinS = float32(rttMin/time.Millisecond) / 1000.0
+	currentCwnd := 10 * maxDatagramSize
+	initialCwnd := currentCwnd
+
+	clock.Advance(time.Millisecond)
+	initialTime := clock.Now()
+	expectedFirstCwnd := renoCwnd(currentCwnd)
+	currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, initialTime)
+	require.Equal(t, expectedFirstCwnd, currentCwnd)
+
+	// Normal TCP phase.
+	// The maximum number of expected reno RTTs can be calculated by
+	// finding the point where the cubic curve and the reno curve meet.
+	maxRenoRtts := int(math.Sqrt(float64(nConnectionAlpha/(0.4*rttMinS*rttMinS*rttMinS))) - 2)
+	for range maxRenoRtts {
+		numAcksThisEpoch := int(float32(currentCwnd/maxDatagramSize) / nConnectionAlpha)
+
+		initialCwndThisEpoch := currentCwnd
+		for range numAcksThisEpoch {
+			// Call once per ACK.
+			expectedNextCwnd := renoCwnd(currentCwnd)
+			currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+			require.Equal(t, expectedNextCwnd, currentCwnd)
+		}
+		cwndChangeThisEpoch := currentCwnd - initialCwndThisEpoch
+		require.InDelta(t, float64(maxDatagramSize), float64(cwndChangeThisEpoch), float64(maxDatagramSize)/2)
+		clock.Advance(100 * time.Millisecond)
+	}
+
+	for range 54 {
+		maxAcksThisEpoch := currentCwnd / maxDatagramSize
+		interval := time.Duration(100*1000/maxAcksThisEpoch) * time.Microsecond
+		for range int(maxAcksThisEpoch) {
+			clock.Advance(interval)
+			currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+			expectedCwnd := cubicConvexCwnd(initialCwnd, rttMin, clock.Now().Sub(initialTime))
+			require.Equal(t, expectedCwnd, currentCwnd)
+		}
+	}
+	expectedCwnd := cubicConvexCwnd(initialCwnd, rttMin, clock.Now().Sub(initialTime))
+	currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+	require.Equal(t, expectedCwnd, currentCwnd)
+}
+
+func TestCubicAboveOriginWithFineGrainedCubing(t *testing.T) {
+	var clock mockClock
+	cubic := NewCubic(&clock)
+	cubic.SetNumConnections(int(numConnections))
+
+	currentCwnd := 1000 * maxDatagramSize
+	initialCwnd := currentCwnd
+	rttMin := 100 * time.Millisecond
+	clock.Advance(time.Millisecond)
+	initialTime := clock.Now()
+
+	currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+	clock.Advance(600 * time.Millisecond)
+	currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+
+	for range 100 {
+		clock.Advance(10 * time.Millisecond)
+		expectedCwnd := cubicConvexCwnd(initialCwnd, rttMin, clock.Now().Sub(initialTime))
+		nextCwnd := cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+		require.Equal(t, expectedCwnd, nextCwnd)
+		require.Greater(t, nextCwnd, currentCwnd)
+		cwndDelta := nextCwnd - currentCwnd
+		require.Less(t, cwndDelta, maxDatagramSize/10)
+		currentCwnd = nextCwnd
+	}
+}
+
+func TestCubicHandlesPerAckUpdates(t *testing.T) {
+	var clock mockClock
+	cubic := NewCubic(&clock)
+	cubic.SetNumConnections(int(numConnections))
+
+	initialCwndPackets := 150
+	currentCwnd := protocol.ByteCount(initialCwndPackets) * maxDatagramSize
+	rttMin := 350 * time.Millisecond
+
+	clock.Advance(time.Millisecond)
+	rCwnd := renoCwnd(currentCwnd)
+	currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+	initialCwnd := currentCwnd
+
+	maxAcks := int(float32(initialCwndPackets) / nConnectionAlpha)
+	interval := maxCubicTimeInterval / time.Duration(maxAcks+1)
+
+	clock.Advance(interval)
+	rCwnd = renoCwnd(rCwnd)
+	require.Equal(t, currentCwnd, cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now()))
+
+	for range maxAcks - 1 {
+		clock.Advance(interval)
+		nextCwnd := cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+		rCwnd = renoCwnd(rCwnd)
+		require.Greater(t, nextCwnd, currentCwnd)
+		require.Equal(t, rCwnd, nextCwnd)
+		currentCwnd = nextCwnd
+	}
+
+	minimumExpectedIncrease := maxDatagramSize * 9 / 10
+	require.Greater(t, currentCwnd, initialCwnd+minimumExpectedIncrease)
+}
+
+func TestCubicHandlesLossEvents(t *testing.T) {
+	var clock mockClock
+	cubic := NewCubic(&clock)
+	cubic.SetNumConnections(int(numConnections))
+
+	rttMin := 100 * time.Millisecond
+	currentCwnd := 422 * maxDatagramSize
+	expectedCwnd := renoCwnd(currentCwnd)
+
+	clock.Advance(time.Millisecond)
+	require.Equal(t, expectedCwnd, cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now()))
+
+	preLossCwnd := currentCwnd
+	require.Zero(t, cubic.lastMaxCongestionWindow)
+	expectedCwnd = protocol.ByteCount(float32(currentCwnd) * nConnectionBeta)
+	require.Equal(t, expectedCwnd, cubic.CongestionWindowAfterPacketLoss(currentCwnd))
+	require.Equal(t, preLossCwnd, cubic.lastMaxCongestionWindow)
+	currentCwnd = expectedCwnd
+
+	preLossCwnd = currentCwnd
+	expectedCwnd = protocol.ByteCount(float32(currentCwnd) * nConnectionBeta)
+	require.Equal(t, expectedCwnd, cubic.CongestionWindowAfterPacketLoss(currentCwnd))
+	currentCwnd = expectedCwnd
+	require.Greater(t, preLossCwnd, cubic.lastMaxCongestionWindow)
+	expectedLastMax := protocol.ByteCount(float32(preLossCwnd) * nConnectionBetaLastMax)
+	require.Equal(t, expectedLastMax, cubic.lastMaxCongestionWindow)
+	require.Less(t, expectedCwnd, cubic.lastMaxCongestionWindow)
+
+	currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+	require.Greater(t, cubic.lastMaxCongestionWindow, currentCwnd)
+
+	currentCwnd = cubic.lastMaxCongestionWindow - 1
+	preLossCwnd = currentCwnd
+	expectedCwnd = protocol.ByteCount(float32(currentCwnd) * nConnectionBeta)
+	require.Equal(t, expectedCwnd, cubic.CongestionWindowAfterPacketLoss(currentCwnd))
+	expectedLastMax = preLossCwnd
+	require.Equal(t, expectedLastMax, cubic.lastMaxCongestionWindow)
+}
+
+func TestCubicBelowOrigin(t *testing.T) {
+	var clock mockClock
+	cubic := NewCubic(&clock)
+	cubic.SetNumConnections(int(numConnections))
+
+	rttMin := 100 * time.Millisecond
+	currentCwnd := 422 * maxDatagramSize
+	expectedCwnd := renoCwnd(currentCwnd)
+
+	clock.Advance(time.Millisecond)
+	require.Equal(t, expectedCwnd, cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now()))
+
+	expectedCwnd = protocol.ByteCount(float32(currentCwnd) * nConnectionBeta)
+	require.Equal(t, expectedCwnd, cubic.CongestionWindowAfterPacketLoss(currentCwnd))
+	currentCwnd = expectedCwnd
+
+	currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+
+	for range 40 {
+		clock.Advance(100 * time.Millisecond)
+		currentCwnd = cubic.CongestionWindowAfterAck(maxDatagramSize, currentCwnd, rttMin, clock.Now())
+	}
+	expectedCwnd = 553632 * maxDatagramSize / 1460
+	require.Equal(t, expectedCwnd, currentCwnd)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/hybrid_slow_start.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/hybrid_slow_start.go
new file mode 100644
index 000000000..554a93005
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/hybrid_slow_start.go
@@ -0,0 +1,113 @@
+package congestion
+
+import (
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// Note(pwestin): the magic clamping numbers come from the original code in
+// tcp_cubic.c.
+const hybridStartLowWindow = protocol.ByteCount(16)
+
+// Number of delay samples for detecting the increase of delay.
+const hybridStartMinSamples = uint32(8)
+
+// Exit slow start if the min rtt has increased by more than 1/8th.
+const hybridStartDelayFactorExp = 3 // 2^3 = 8
+
+// The original paper specifies 2 and 8ms, but those have changed over time.
+const (
+	hybridStartDelayMinThresholdUs = int64(4000)
+	hybridStartDelayMaxThresholdUs = int64(16000)
+)
+
+// HybridSlowStart implements the TCP hybrid slow start algorithm
+type HybridSlowStart struct {
+	endPacketNumber      protocol.PacketNumber
+	lastSentPacketNumber protocol.PacketNumber
+	started              bool
+	currentMinRTT        time.Duration
+	rttSampleCount       uint32
+	hystartFound         bool
+}
+
+// StartReceiveRound is called for the start of each receive round (burst) in the slow start phase.
+func (s *HybridSlowStart) StartReceiveRound(lastSent protocol.PacketNumber) {
+	s.endPacketNumber = lastSent
+	s.currentMinRTT = 0
+	s.rttSampleCount = 0
+	s.started = true
+}
+
+// IsEndOfRound returns true if this ack is the last packet number of our current slow start round.
+func (s *HybridSlowStart) IsEndOfRound(ack protocol.PacketNumber) bool {
+	return s.endPacketNumber < ack
+}
+
+// ShouldExitSlowStart should be called on every new ack frame, since a new
+// RTT measurement can be made then.
+// rtt: the RTT for this ack packet.
+// minRTT: is the lowest delay (RTT) we have seen during the session.
+// congestionWindow: the congestion window in packets.
+func (s *HybridSlowStart) ShouldExitSlowStart(latestRTT time.Duration, minRTT time.Duration, congestionWindow protocol.ByteCount) bool {
+	if !s.started {
+		// Time to start the hybrid slow start.
+		s.StartReceiveRound(s.lastSentPacketNumber)
+	}
+	if s.hystartFound {
+		return true
+	}
+	// Second detection parameter - delay increase detection.
+	// Compare the minimum delay (s.currentMinRTT) of the current
+	// burst of packets relative to the minimum delay during the session.
+	// Note: we only look at the first few(8) packets in each burst, since we
+	// only want to compare the lowest RTT of the burst relative to previous
+	// bursts.
+	s.rttSampleCount++
+	if s.rttSampleCount <= hybridStartMinSamples {
+		if s.currentMinRTT == 0 || s.currentMinRTT > latestRTT {
+			s.currentMinRTT = latestRTT
+		}
+	}
+	// We only need to check this once per round.
+	if s.rttSampleCount == hybridStartMinSamples {
+		// Divide minRTT by 8 to get a rtt increase threshold for exiting.
+		minRTTincreaseThresholdUs := int64(minRTT / time.Microsecond >> hybridStartDelayFactorExp)
+		// Ensure the rtt threshold is never less than 2ms or more than 16ms.
+		minRTTincreaseThresholdUs = min(minRTTincreaseThresholdUs, hybridStartDelayMaxThresholdUs)
+		minRTTincreaseThreshold := time.Duration(max(minRTTincreaseThresholdUs, hybridStartDelayMinThresholdUs)) * time.Microsecond
+
+		if s.currentMinRTT > (minRTT + minRTTincreaseThreshold) {
+			s.hystartFound = true
+		}
+	}
+	// Exit from slow start if the cwnd is greater than 16 and
+	// increasing delay is found.
+	return congestionWindow >= hybridStartLowWindow && s.hystartFound
+}
+
+// OnPacketSent is called when a packet was sent
+func (s *HybridSlowStart) OnPacketSent(packetNumber protocol.PacketNumber) {
+	s.lastSentPacketNumber = packetNumber
+}
+
+// OnPacketAcked gets invoked after ShouldExitSlowStart, so it's best to end
+// the round when the final packet of the burst is received and start it on
+// the next incoming ack.
+func (s *HybridSlowStart) OnPacketAcked(ackedPacketNumber protocol.PacketNumber) {
+	if s.IsEndOfRound(ackedPacketNumber) {
+		s.started = false
+	}
+}
+
+// Started returns true if started
+func (s *HybridSlowStart) Started() bool {
+	return s.started
+}
+
+// Restart the slow start phase
+func (s *HybridSlowStart) Restart() {
+	s.started = false
+	s.hystartFound = false
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/hybrid_slow_start_test.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/hybrid_slow_start_test.go
new file mode 100644
index 000000000..0e50c7b4c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/hybrid_slow_start_test.go
@@ -0,0 +1,68 @@
+package congestion
+
+import (
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestHybridSlowStartSimpleCase(t *testing.T) {
+	slowStart := HybridSlowStart{}
+
+	packetNumber := protocol.PacketNumber(1)
+	endPacketNumber := protocol.PacketNumber(3)
+	slowStart.StartReceiveRound(endPacketNumber)
+
+	packetNumber++
+	require.False(t, slowStart.IsEndOfRound(packetNumber))
+
+	// Test duplicates.
+	require.False(t, slowStart.IsEndOfRound(packetNumber))
+
+	packetNumber++
+	require.False(t, slowStart.IsEndOfRound(packetNumber))
+	packetNumber++
+	require.True(t, slowStart.IsEndOfRound(packetNumber))
+
+	// Test without a new registered end_packet_number;
+	packetNumber++
+	require.True(t, slowStart.IsEndOfRound(packetNumber))
+
+	endPacketNumber = 20
+	slowStart.StartReceiveRound(endPacketNumber)
+	for packetNumber < endPacketNumber {
+		packetNumber++
+		require.False(t, slowStart.IsEndOfRound(packetNumber))
+	}
+	packetNumber++
+	require.True(t, slowStart.IsEndOfRound(packetNumber))
+}
+
+func TestHybridSlowStartWithDelay(t *testing.T) {
+	slowStart := HybridSlowStart{}
+	const rtt = 60 * time.Millisecond
+	// We expect to detect the increase at +1/8 of the RTT; hence at a typical
+	// RTT of 60ms the detection will happen at 67.5 ms.
+	const hybridStartMinSamples = 8 // Number of acks required to trigger.
+
+	endPacketNumber := protocol.PacketNumber(1)
+	endPacketNumber++
+	slowStart.StartReceiveRound(endPacketNumber)
+
+	// Will not trigger since our lowest RTT in our burst is the same as the long
+	// term RTT provided.
+	for n := range hybridStartMinSamples {
+		require.False(t, slowStart.ShouldExitSlowStart(rtt+time.Duration(n)*time.Millisecond, rtt, 100))
+	}
+	endPacketNumber++
+	slowStart.StartReceiveRound(endPacketNumber)
+	for n := 1; n < hybridStartMinSamples; n++ {
+		require.False(t, slowStart.ShouldExitSlowStart(rtt+(time.Duration(n)+10)*time.Millisecond, rtt, 100))
+	}
+	// Expect to trigger since all packets in this burst was above the long term
+	// RTT provided.
+	require.True(t, slowStart.ShouldExitSlowStart(rtt+10*time.Millisecond, rtt, 100))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/interface.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/interface.go
new file mode 100644
index 000000000..996907c61
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/interface.go
@@ -0,0 +1,27 @@
+package congestion
+
+import (
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// A SendAlgorithm performs congestion control
+type SendAlgorithm interface {
+	TimeUntilSend(bytesInFlight protocol.ByteCount) monotime.Time
+	HasPacingBudget(now monotime.Time) bool
+	OnPacketSent(sentTime monotime.Time, bytesInFlight protocol.ByteCount, packetNumber protocol.PacketNumber, bytes protocol.ByteCount, isRetransmittable bool)
+	CanSend(bytesInFlight protocol.ByteCount) bool
+	MaybeExitSlowStart()
+	OnPacketAcked(number protocol.PacketNumber, ackedBytes protocol.ByteCount, priorInFlight protocol.ByteCount, eventTime monotime.Time)
+	OnCongestionEvent(number protocol.PacketNumber, lostBytes protocol.ByteCount, priorInFlight protocol.ByteCount)
+	OnRetransmissionTimeout(packetsRetransmitted bool)
+	SetMaxDatagramSize(protocol.ByteCount)
+}
+
+// A SendAlgorithmWithDebugInfos is a SendAlgorithm that exposes some debug infos
+type SendAlgorithmWithDebugInfos interface {
+	SendAlgorithm
+	InSlowStart() bool
+	InRecovery() bool
+	GetCongestionWindow() protocol.ByteCount
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/pacer.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/pacer.go
new file mode 100644
index 000000000..7656f5296
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/pacer.go
@@ -0,0 +1,110 @@
+package congestion
+
+import (
+	"math"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+const maxBurstSizePackets = 10
+
+// The pacer implements a token bucket pacing algorithm.
+type pacer struct {
+	budgetAtLastSent  protocol.ByteCount
+	maxDatagramSize   protocol.ByteCount
+	lastSentTime      monotime.Time
+	adjustedBandwidth func() uint64 // in bytes/s
+}
+
+func newPacer(getBandwidth func() Bandwidth) *pacer {
+	p := &pacer{
+		maxDatagramSize: initialMaxDatagramSize,
+		adjustedBandwidth: func() uint64 {
+			// Bandwidth is in bits/s. We need the value in bytes/s.
+			bw := uint64(getBandwidth() / BytesPerSecond)
+			// Use a slightly higher value than the actual measured bandwidth.
+			// RTT variations then won't result in under-utilization of the congestion window.
+			// Ultimately, this will result in sending packets as acknowledgments are received rather than when timers fire,
+			// provided the congestion window is fully utilized and acknowledgments arrive at regular intervals.
+			return bw * 5 / 4
+		},
+	}
+	p.budgetAtLastSent = p.maxBurstSize()
+	return p
+}
+
+func (p *pacer) SentPacket(sendTime monotime.Time, size protocol.ByteCount) {
+	budget := p.Budget(sendTime)
+	if size >= budget {
+		p.budgetAtLastSent = 0
+	} else {
+		p.budgetAtLastSent = budget - size
+	}
+	p.lastSentTime = sendTime
+}
+
+func (p *pacer) Budget(now monotime.Time) protocol.ByteCount {
+	if p.lastSentTime.IsZero() {
+		return p.maxBurstSize()
+	}
+	delta := now.Sub(p.lastSentTime)
+	var added protocol.ByteCount
+	if delta > 0 {
+		added = p.timeScaledBandwidth(uint64(delta.Nanoseconds()))
+	}
+	budget := p.budgetAtLastSent + added
+	if added > 0 && budget < p.budgetAtLastSent {
+		budget = protocol.MaxByteCount
+	}
+	return min(p.maxBurstSize(), budget)
+}
+
+func (p *pacer) maxBurstSize() protocol.ByteCount {
+	return max(
+		p.timeScaledBandwidth(uint64((protocol.MinPacingDelay + protocol.TimerGranularity).Nanoseconds())),
+		maxBurstSizePackets*p.maxDatagramSize,
+	)
+}
+
+// timeScaledBandwidth calculates the number of bytes that may be sent within
+// a given time interval (ns nanoseconds), based on the current bandwidth estimate.
+// It caps the scaled value to the maximum allowed burst and handles overflows.
+func (p *pacer) timeScaledBandwidth(ns uint64) protocol.ByteCount {
+	bw := p.adjustedBandwidth()
+	if bw == 0 {
+		return 0
+	}
+	const nsPerSecond = 1e9
+	maxBurst := maxBurstSizePackets * p.maxDatagramSize
+	var scaled protocol.ByteCount
+	if ns > math.MaxUint64/bw {
+		scaled = maxBurst
+	} else {
+		scaled = protocol.ByteCount(bw * ns / nsPerSecond)
+	}
+	return scaled
+}
+
+// TimeUntilSend returns when the next packet should be sent.
+// It returns zero if a packet can be sent immediately.
+func (p *pacer) TimeUntilSend() monotime.Time {
+	if p.budgetAtLastSent >= p.maxDatagramSize {
+		return 0
+	}
+	diff := 1e9 * uint64(p.maxDatagramSize-p.budgetAtLastSent)
+	bw := p.adjustedBandwidth()
+	// We might need to round up this value.
+	// Otherwise, we might have a budget (slightly) smaller than the datagram size when the timer expires.
+	d := diff / bw
+	// this is effectively a math.Ceil, but using only integer math
+	if diff%bw > 0 {
+		d++
+	}
+	return p.lastSentTime.Add(max(protocol.MinPacingDelay, time.Duration(d)*time.Nanosecond))
+}
+
+func (p *pacer) SetMaxDatagramSize(s protocol.ByteCount) {
+	p.maxDatagramSize = s
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/congestion/pacer_test.go b/electron/native/private-transport/third_party/quic-go/internal/congestion/pacer_test.go
new file mode 100644
index 000000000..795cd2179
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/congestion/pacer_test.go
@@ -0,0 +1,154 @@
+package congestion
+
+import (
+	"math"
+	"math/rand/v2"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPacerPacing(t *testing.T) {
+	bandwidth := 50 * initialMaxDatagramSize // 50 full-size packets per second
+	p := newPacer(func() Bandwidth { return Bandwidth(bandwidth) * BytesPerSecond * 4 / 5 })
+	now := monotime.Now()
+	require.Zero(t, p.TimeUntilSend())
+	budget := p.Budget(now)
+	require.Equal(t, maxBurstSizePackets*initialMaxDatagramSize, budget)
+
+	// consume the initial budget by sending packets
+	for budget > 0 {
+		require.Zero(t, p.TimeUntilSend())
+		require.Equal(t, budget, p.Budget(now))
+		p.SentPacket(now, initialMaxDatagramSize)
+		budget -= initialMaxDatagramSize
+	}
+
+	// now packets are being paced
+	for range 5 {
+		require.Zero(t, p.Budget(now))
+		nextPacket := p.TimeUntilSend()
+		require.NotZero(t, nextPacket)
+		require.Equal(t, time.Second/50, nextPacket.Sub(now))
+		now = nextPacket
+		p.SentPacket(now, initialMaxDatagramSize)
+	}
+
+	nextPacket := p.TimeUntilSend()
+	require.Equal(t, time.Second/50, nextPacket.Sub(now))
+	// send this packet a bit later, simulating timer delay
+	p.SentPacket(nextPacket.Add(time.Millisecond), initialMaxDatagramSize)
+	// the next packet should be paced again, without a delay
+	require.Equal(t, time.Second/50, p.TimeUntilSend().Sub(nextPacket))
+
+	// now send a half-size packet
+	now = p.TimeUntilSend()
+	p.SentPacket(now, initialMaxDatagramSize/2)
+	require.Equal(t, initialMaxDatagramSize/2, p.Budget(now))
+	require.Equal(t, time.Second/100, p.TimeUntilSend().Sub(now))
+	p.SentPacket(p.TimeUntilSend(), initialMaxDatagramSize/2)
+
+	now = p.TimeUntilSend()
+	// budget accumulates if no packets are sent for a while
+	// we should have accumulated budget to send a burst now
+	require.Equal(t, 5*initialMaxDatagramSize, p.Budget(now.Add(4*time.Second/50)))
+	// but the budget is capped at the max burst size
+	require.Equal(t, maxBurstSizePackets*initialMaxDatagramSize, p.Budget(now.Add(time.Hour)))
+	p.SentPacket(now, initialMaxDatagramSize)
+	require.Zero(t, p.Budget(now))
+
+	// reduce the bandwidth
+	bandwidth = 10 * initialMaxDatagramSize // 10 full-size packets per second
+	require.Equal(t, time.Second/10, p.TimeUntilSend().Sub(now))
+}
+
+func TestPacerUpdatePacketSize(t *testing.T) {
+	const bandwidth = 50 * initialMaxDatagramSize // 50 full-size packets per second
+	p := newPacer(func() Bandwidth { return Bandwidth(bandwidth) * BytesPerSecond * 4 / 5 })
+
+	// consume the initial budget by sending packets
+	now := monotime.Now()
+	for p.Budget(now) > 0 {
+		p.SentPacket(now, initialMaxDatagramSize)
+	}
+
+	require.Equal(t, time.Second/50, p.TimeUntilSend().Sub(now))
+	// Double the packet size. We now need to wait twice as long to send the next packet.
+	const newDatagramSize = 2 * initialMaxDatagramSize
+	p.SetMaxDatagramSize(newDatagramSize)
+	require.Equal(t, 2*time.Second/50, p.TimeUntilSend().Sub(now))
+
+	// check that the maximum burst size is updated
+	require.Equal(t, maxBurstSizePackets*newDatagramSize, p.Budget(now.Add(time.Hour)))
+}
+
+func TestPacerFastPacing(t *testing.T) {
+	const bandwidth = 10000 * initialMaxDatagramSize // 10,000 full-size packets per second
+	p := newPacer(func() Bandwidth { return Bandwidth(bandwidth) * BytesPerSecond * 4 / 5 })
+
+	// consume the initial budget by sending packets
+	now := monotime.Now()
+	for p.Budget(now) > 0 {
+		p.SentPacket(now, initialMaxDatagramSize)
+	}
+
+	// If we were pacing by packet, we'd expect the next packet to send in 1/10ms.
+	// However, we don't want to arm the pacing timer for less than 1ms,
+	// so we wait for 1ms, and then send 10 packets in a burst.
+	require.Equal(t, time.Millisecond, p.TimeUntilSend().Sub(now))
+	require.Equal(t, 10*initialMaxDatagramSize, p.Budget(now.Add(time.Millisecond)))
+
+	now = now.Add(time.Millisecond)
+	for range 10 {
+		require.NotZero(t, p.Budget(now))
+		p.SentPacket(now, initialMaxDatagramSize)
+	}
+	require.Zero(t, p.Budget(now))
+	require.Equal(t, time.Millisecond, p.TimeUntilSend().Sub(now))
+}
+
+func TestPacerNoOverflows(t *testing.T) {
+	p := newPacer(func() Bandwidth { return math.MaxUint64 })
+	now := monotime.Now()
+	p.SentPacket(now, initialMaxDatagramSize)
+	for range 100000 {
+		require.NotZero(t, p.Budget(now.Add(time.Duration(rand.Int64N(math.MaxInt64)))))
+	}
+
+	burstCount := 1
+	for p.Budget(now) > 0 {
+		burstCount++
+		p.SentPacket(now, initialMaxDatagramSize)
+	}
+	require.Equal(t, maxBurstSizePackets, burstCount)
+	require.Zero(t, p.Budget(now))
+
+	next := p.TimeUntilSend()
+	require.Equal(t, next.Sub(now), protocol.MinPacingDelay)
+	require.Greater(t, p.Budget(next), initialMaxDatagramSize)
+}
+
+func BenchmarkPacer(b *testing.B) {
+	const bandwidth = 50 * initialMaxDatagramSize // 50 full-size packets per second
+	p := newPacer(func() Bandwidth { return Bandwidth(bandwidth) * BytesPerSecond * 4 / 5 })
+
+	now := monotime.Now()
+
+	var i int
+	for b.Loop() {
+		i++
+		for p.Budget(now) > 0 {
+			p.SentPacket(now, initialMaxDatagramSize)
+		}
+		next := p.TimeUntilSend()
+		if i%2 == 0 {
+			now = next
+		} else {
+			now = now.Add(100 * time.Millisecond)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/datagrambuffer/buffer.go b/electron/native/private-transport/third_party/quic-go/internal/datagrambuffer/buffer.go
new file mode 100644
index 000000000..9347e8ee8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/datagrambuffer/buffer.go
@@ -0,0 +1,163 @@
+// Package datagrambuffer implements bounded receive-side burst absorption.
+// Callers serialize access to a Queue. Accounting is shared across all QUIC
+// and HTTP/3 receive queues in this process, including unauthenticated queues.
+package datagrambuffer
+
+import (
+	"sync/atomic"
+	"time"
+)
+
+const GlobalLimit = 32 * 1024 * 1024
+const packetOverhead = 64 // conservatively charge slice / ring bookkeeping
+const BurstPackets = 1024
+const BurstBytes = 1024 * 1024
+const BurstAge = 50 * time.Millisecond
+
+type Stats struct {
+	QueuedBytes        int64
+	PeakBytes          int64
+	DroppedFull        uint64
+	DroppedBudget      uint64
+	DroppedExpired     uint64
+	MaxResidenceMicros uint64
+	RawPacketDrops     uint64
+}
+
+var used atomic.Int64
+var peak atomic.Int64
+var full, budget, expired atomic.Uint64
+var rawPacketDrops atomic.Uint64
+
+func RecordRawPacketDrop() { rawPacketDrops.Add(1) }
+
+func reserve(charge int64) bool {
+	for {
+		n := used.Load()
+		if n+charge > GlobalLimit {
+			return false
+		}
+		if used.CompareAndSwap(n, n+charge) {
+			for p := peak.Load(); n+charge > p; p = peak.Load() {
+				if peak.CompareAndSwap(p, n+charge) {
+					break
+				}
+			}
+			return true
+		}
+	}
+}
+
+func GlobalStats() Stats {
+	return Stats{QueuedBytes: used.Load(), PeakBytes: peak.Load(), DroppedFull: full.Load(), DroppedBudget: budget.Load(), DroppedExpired: expired.Load(), RawPacketDrops: rawPacketDrops.Load()}
+}
+
+type entry struct {
+	data []byte
+	at   time.Time
+}
+type Queue struct {
+	items              []entry
+	head, count, bytes int
+	ringCharge         int
+	limit              int
+	maxAge             time.Duration
+	closed             bool
+	stats              Stats
+}
+
+func New(limit int) *Queue { return &Queue{limit: limit} }
+func (q *Queue) EnableBurst() {
+	q.limit = BurstPackets
+	q.maxAge = BurstAge
+}
+
+// Push takes its own compact copy: a small datagram must not retain a larger
+// decrypted packet backing array. Reserve globally before allocating that copy.
+func (q *Queue) Push(data []byte, now time.Time) bool {
+	if q.closed {
+		return false
+	}
+	q.expire(now)
+	charge := len(data) + packetOverhead
+	if q.count >= q.limit || q.bytes+charge > BurstBytes {
+		q.stats.DroppedFull++
+		full.Add(1)
+		return false
+	}
+	if !reserve(int64(charge)) {
+		q.stats.DroppedBudget++
+		budget.Add(1)
+		return false
+	}
+	if q.count == len(q.items) {
+		n := min(q.limit, max(8, len(q.items)*2))
+		// Reserve the full replacement while the old ring still exists, not just
+		// the difference. This bounds transient growth allocations as well.
+		if !reserve(int64(n * 64)) {
+			used.Add(-int64(charge))
+			q.stats.DroppedBudget++
+			budget.Add(1)
+			return false
+		}
+		items := make([]entry, n)
+		for i := 0; i < q.count; i++ {
+			items[i] = q.items[(q.head+i)%len(q.items)]
+		}
+		used.Add(-int64(q.ringCharge))
+		q.ringCharge = n * 64
+		q.items, q.head = items, 0
+	}
+	q.items[(q.head+q.count)%len(q.items)] = entry{data: append([]byte{}, data...), at: now}
+	q.count++
+	q.bytes += charge
+	q.stats.PeakBytes = max(q.stats.PeakBytes, int64(q.bytes+q.ringCharge))
+	return true
+}
+
+func (q *Queue) remove(now time.Time) []byte {
+	e := q.items[q.head]
+	q.items[q.head] = entry{} // release backing storage immediately
+	q.head = (q.head + 1) % len(q.items)
+	q.count--
+	charge := len(e.data) + packetOverhead
+	q.bytes -= charge
+	used.Add(-int64(charge))
+	if q.count == 0 && len(q.items) > 32 {
+		used.Add(-int64(q.ringCharge))
+		q.ringCharge = 0
+		q.items = nil
+		q.head = 0
+	}
+	if age := now.Sub(e.at); age > 0 {
+		q.stats.MaxResidenceMicros = max(q.stats.MaxResidenceMicros, uint64(age/time.Microsecond))
+	}
+	return e.data
+}
+func (q *Queue) expire(now time.Time) {
+	for q.count > 0 && q.maxAge > 0 && now.Sub(q.items[q.head].at) > q.maxAge {
+		q.remove(now)
+		q.stats.DroppedExpired++
+		expired.Add(1)
+	}
+}
+func (q *Queue) Pop(now time.Time) ([]byte, bool) {
+	q.expire(now)
+	if q.count == 0 {
+		return nil, false
+	}
+	return q.remove(now), true
+}
+func (q *Queue) Close() {
+	if q.closed {
+		return
+	}
+	q.closed = true
+	used.Add(-int64(q.bytes + q.ringCharge))
+	q.ringCharge = 0
+	q.items = nil
+	q.count = 0
+	q.bytes = 0
+	q.head = 0
+}
+func (q *Queue) Stats() Stats { s := q.stats; s.QueuedBytes = int64(q.bytes + q.ringCharge); return s }
diff --git a/electron/native/private-transport/third_party/quic-go/internal/datagrambuffer/buffer_test.go b/electron/native/private-transport/third_party/quic-go/internal/datagrambuffer/buffer_test.go
new file mode 100644
index 000000000..c05273cc4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/datagrambuffer/buffer_test.go
@@ -0,0 +1,133 @@
+package datagrambuffer
+
+import (
+	"bytes"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestLimitsOrderCopyAndCleanup(t *testing.T) {
+	base := used.Load()
+	q := New(32)
+	now := time.Now()
+	defer func() {
+		q.Close()
+		if used.Load() != base {
+			t.Fatal("budget leak", used.Load(), base)
+		}
+	}()
+	for i := 0; i < 32; i++ {
+		b := []byte{byte(i)}
+		if !q.Push(b, now) {
+			t.Fatal("early reject")
+		}
+		b[0] = 255
+	}
+	if q.Push([]byte{1}, now) || q.Stats().DroppedFull != 1 {
+		t.Fatal("unauthorized cap")
+	}
+	q.EnableBurst()
+	for i := 32; i < 1024; i++ {
+		if !q.Push([]byte{byte(i)}, now) {
+			t.Fatal("burst", i)
+		}
+	}
+	if q.Push([]byte{1}, now) {
+		t.Fatal("packet cap")
+	}
+	for i := 0; i < 1024; i++ {
+		b, ok := q.Pop(now)
+		if !ok || b[0] != byte(i) {
+			t.Fatal("order/copy", i)
+		}
+	}
+	if len(q.items) != 0 {
+		t.Fatal("large empty ring retained")
+	}
+	q.Close()
+	q.Close()
+	if q.Push([]byte{1}, now) {
+		t.Fatal("accepted after close")
+	}
+}
+
+func TestExpiryAndByteBound(t *testing.T) {
+	base := used.Load()
+	q := New(32)
+	q.EnableBurst()
+	defer q.Close()
+	now := time.Now()
+	if q.Push(make([]byte, BurstBytes), now) {
+		t.Fatal("missing bookkeeping in cap")
+	}
+	if !q.Push([]byte{1}, now) {
+		t.Fatal("push")
+	}
+	if _, ok := q.Pop(now.Add(BurstAge + time.Nanosecond)); ok {
+		t.Fatal("stale delivery")
+	}
+	if q.Stats().DroppedExpired != 1 {
+		t.Fatal("expiry counter")
+	}
+	q.Close()
+	if used.Load() != base {
+		t.Fatal("expiry leaked budget")
+	}
+}
+
+func TestGlobalBoundAndConcurrentQueues(t *testing.T) {
+	base := used.Load()
+	var wg sync.WaitGroup
+	for i := 0; i < 64; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			q := New(32)
+			q.EnableBurst()
+			defer q.Close()
+			for j := 0; j < 500; j++ {
+				q.Push(bytes.Repeat([]byte{1}, 1200), time.Now())
+				if used.Load() > GlobalLimit {
+					t.Error("global bound")
+				}
+			}
+		}()
+	}
+	wg.Wait()
+	if used.Load() != base {
+		t.Fatal("concurrent leak")
+	}
+	// Deterministically fill the shared budget, then verify rejection / recovery.
+	var qs []*Queue
+	defer func() {
+		for _, q := range qs {
+			q.Close()
+		}
+		if used.Load() != base {
+			t.Fatal("budget leak")
+		}
+	}()
+	for i := 0; i < 40; i++ {
+		q := New(32)
+		q.EnableBurst()
+		qs = append(qs, q)
+		for j := 0; j < 800; j++ {
+			q.Push(make([]byte, 1200), time.Now())
+		}
+	}
+	q := New(32)
+	qs = append(qs, q)
+	if q.Push(make([]byte, 60000), time.Now()) {
+		t.Fatal("global budget not enforced")
+	}
+	if q.Stats().DroppedBudget != 1 {
+		t.Fatal("missing budget counter")
+	}
+	for _, other := range qs[:len(qs)-1] {
+		other.Close()
+	}
+	if !q.Push([]byte{1}, time.Now()) {
+		t.Fatal("budget not reusable")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/aead.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/aead.go
new file mode 100644
index 000000000..f12c932a5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/aead.go
@@ -0,0 +1,91 @@
+package handshake
+
+import (
+	"crypto/cipher"
+	"encoding/binary"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+func createAEAD(suite cipherSuite, trafficSecret []byte, v protocol.Version) cipher.AEAD {
+	keyLabel := hkdfLabelKeyV1
+	ivLabel := hkdfLabelIVV1
+	if v == protocol.Version2 {
+		keyLabel = hkdfLabelKeyV2
+		ivLabel = hkdfLabelIVV2
+	}
+	key := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, keyLabel, suite.KeyLen)
+	iv := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, ivLabel, suite.IVLen())
+	return suite.AEAD(key, iv)
+}
+
+type longHeaderSealer struct {
+	aead            cipher.AEAD
+	headerProtector headerProtector
+	nonceBuf        [8]byte
+}
+
+var _ LongHeaderSealer = &longHeaderSealer{}
+
+func newLongHeaderSealer(aead cipher.AEAD, headerProtector headerProtector) LongHeaderSealer {
+	if aead.NonceSize() != 8 {
+		panic("unexpected nonce size")
+	}
+	return &longHeaderSealer{
+		aead:            aead,
+		headerProtector: headerProtector,
+	}
+}
+
+func (s *longHeaderSealer) Seal(dst, src []byte, pn protocol.PacketNumber, ad []byte) []byte {
+	binary.BigEndian.PutUint64(s.nonceBuf[:], uint64(pn))
+	return s.aead.Seal(dst, s.nonceBuf[:], src, ad)
+}
+
+func (s *longHeaderSealer) EncryptHeader(sample []byte, firstByte *byte, pnBytes []byte) {
+	s.headerProtector.EncryptHeader(sample, firstByte, pnBytes)
+}
+
+func (s *longHeaderSealer) Overhead() int {
+	return s.aead.Overhead()
+}
+
+type longHeaderOpener struct {
+	aead            cipher.AEAD
+	headerProtector headerProtector
+	highestRcvdPN   protocol.PacketNumber // highest packet number received (which could be successfully unprotected)
+
+	// use a single array to avoid allocations
+	nonceBuf [8]byte
+}
+
+var _ LongHeaderOpener = &longHeaderOpener{}
+
+func newLongHeaderOpener(aead cipher.AEAD, headerProtector headerProtector) LongHeaderOpener {
+	if aead.NonceSize() != 8 {
+		panic("unexpected nonce size")
+	}
+	return &longHeaderOpener{
+		aead:            aead,
+		headerProtector: headerProtector,
+	}
+}
+
+func (o *longHeaderOpener) DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber {
+	return protocol.DecodePacketNumber(wirePNLen, o.highestRcvdPN, wirePN)
+}
+
+func (o *longHeaderOpener) Open(dst, src []byte, pn protocol.PacketNumber, ad []byte) ([]byte, error) {
+	binary.BigEndian.PutUint64(o.nonceBuf[:], uint64(pn))
+	dec, err := o.aead.Open(dst, o.nonceBuf[:], src, ad)
+	if err == nil {
+		o.highestRcvdPN = max(o.highestRcvdPN, pn)
+	} else {
+		err = ErrDecryptionFailed
+	}
+	return dec, err
+}
+
+func (o *longHeaderOpener) DecryptHeader(sample []byte, firstByte *byte, pnBytes []byte) {
+	o.headerProtector.DecryptHeader(sample, firstByte, pnBytes)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/aead_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/aead_test.go
new file mode 100644
index 000000000..859dcd6a6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/aead_test.go
@@ -0,0 +1,108 @@
+package handshake
+
+import (
+	"crypto/rand"
+	"crypto/tls"
+	"fmt"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func getSealerAndOpener(t *testing.T, cs cipherSuite, v protocol.Version) (LongHeaderSealer, LongHeaderOpener) {
+	t.Helper()
+	trafficSecret := make([]byte, cs.Hash.Size())
+	hpKey := make([]byte, 16)
+	rand.Read(trafficSecret)
+	rand.Read(hpKey)
+	aead := createAEAD(cs, trafficSecret, v)
+	return newLongHeaderSealer(aead, newHeaderProtector(cs, hpKey, true, v)),
+		newLongHeaderOpener(aead, newHeaderProtector(cs, hpKey, true, v))
+}
+
+func TestEncryptAndDecryptMessage(t *testing.T) {
+	for _, v := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		for _, cs := range cipherSuites {
+			t.Run(fmt.Sprintf("QUIC %s/%s", v, tls.CipherSuiteName(cs.ID)), func(t *testing.T) {
+				sealer, opener := getSealerAndOpener(t, cs, v)
+				msg := []byte("Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.")
+				ad := []byte("Donec in velit neque.")
+
+				encrypted := sealer.Seal(nil, msg, 0x1337, ad)
+
+				opened, err := opener.Open(nil, encrypted, 0x1337, ad)
+				require.NoError(t, err)
+				require.Equal(t, msg, opened)
+
+				// incorrect associated data
+				_, err = opener.Open(nil, encrypted, 0x1337, []byte("wrong ad"))
+				require.Equal(t, ErrDecryptionFailed, err)
+
+				// incorrect packet number
+				_, err = opener.Open(nil, encrypted, 0x42, ad)
+				require.Equal(t, ErrDecryptionFailed, err)
+			})
+		}
+	}
+}
+
+func TestDecodePacketNumber(t *testing.T) {
+	msg := []byte("Lorem ipsum dolor sit amet")
+	ad := []byte("Donec in velit neque.")
+
+	sealer, opener := getSealerAndOpener(t, getCipherSuite(tls.TLS_AES_128_GCM_SHA256), protocol.Version1)
+	encrypted := sealer.Seal(nil, msg, 0x1337, ad)
+
+	// can't decode the packet number if encryption failed
+	_, err := opener.Open(nil, encrypted[:len(encrypted)-1], 0x1337, ad)
+	require.Error(t, err)
+	require.Equal(t, protocol.PacketNumber(0x38), opener.DecodePacketNumber(0x38, protocol.PacketNumberLen1))
+
+	_, err = opener.Open(nil, encrypted, 0x1337, ad)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketNumber(0x1338), opener.DecodePacketNumber(0x38, protocol.PacketNumberLen1))
+}
+
+func TestEncryptAndDecryptHeader(t *testing.T) {
+	for _, v := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		t.Run("QUIC "+v.String(), func(t *testing.T) {
+			for _, cs := range cipherSuites {
+				t.Run(tls.CipherSuiteName(cs.ID), func(t *testing.T) {
+					testEncryptAndDecryptHeader(t, cs, v)
+				})
+			}
+		})
+	}
+}
+
+func testEncryptAndDecryptHeader(t *testing.T, cs cipherSuite, v protocol.Version) {
+	sealer, opener := getSealerAndOpener(t, cs, v)
+	var lastFourBitsDifferent int
+
+	for range 100 {
+		sample := make([]byte, 16)
+		rand.Read(sample)
+		header := []byte{0xb5, 1, 2, 3, 4, 5, 6, 7, 8, 0xde, 0xad, 0xbe, 0xef}
+		sealer.EncryptHeader(sample, &header[0], header[9:13])
+		if header[0]&0xf != 0xb5&0xf {
+			lastFourBitsDifferent++
+		}
+		require.Equal(t, byte(0xb5&0xf0), header[0]&0xf0)
+		require.Equal(t, []byte{1, 2, 3, 4, 5, 6, 7, 8}, header[1:9])
+		require.NotEqual(t, []byte{0xde, 0xad, 0xbe, 0xef}, header[9:13])
+		opener.DecryptHeader(sample, &header[0], header[9:13])
+		require.Equal(t, []byte{0xb5, 1, 2, 3, 4, 5, 6, 7, 8, 0xde, 0xad, 0xbe, 0xef}, header)
+	}
+	require.Greater(t, lastFourBitsDifferent, 75)
+
+	// decryption failure with different sample
+	header := []byte{0xb5, 1, 2, 3, 4, 5, 6, 7, 8, 0xde, 0xad, 0xbe, 0xef}
+	sample := make([]byte, 16)
+	rand.Read(sample)
+	sealer.EncryptHeader(sample, &header[0], header[9:13])
+	rand.Read(sample) // use a different sample
+	opener.DecryptHeader(sample, &header[0], header[9:13])
+	require.NotEqual(t, []byte{0xb5, 1, 2, 3, 4, 5, 6, 7, 8, 0xde, 0xad, 0xbe, 0xef}, header)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/cipher_suite.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/cipher_suite.go
new file mode 100644
index 000000000..98112a818
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/cipher_suite.go
@@ -0,0 +1,114 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/fips140"
+	"crypto/tls"
+	"fmt"
+
+	"golang.org/x/crypto/chacha20poly1305"
+)
+
+// These cipher suite implementations are copied from the standard library crypto/tls package.
+
+const aeadNonceLength = 12
+
+type cipherSuite struct {
+	ID     uint16
+	Hash   crypto.Hash
+	KeyLen int
+	AEAD   func(key, nonceMask []byte) cipher.AEAD
+}
+
+func (s cipherSuite) IVLen() int { return aeadNonceLength }
+
+func getCipherSuite(id uint16) cipherSuite {
+	switch id {
+	case tls.TLS_AES_128_GCM_SHA256:
+		return cipherSuite{ID: tls.TLS_AES_128_GCM_SHA256, Hash: crypto.SHA256, KeyLen: 16, AEAD: aeadAESGCMTLS13}
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		// The usual convention is to only panic on fips140.Enforced (and not on fips140.Enabled),
+		// but this function panics in the default case anyway, so we might as well panic here.
+		if fips140.Enabled() {
+			panic("tls: TLS_CHACHA20_POLY1305_SHA256 is not allowed in FIPS 140-3 mode")
+		}
+		return cipherSuite{ID: tls.TLS_CHACHA20_POLY1305_SHA256, Hash: crypto.SHA256, KeyLen: 32, AEAD: aeadChaCha20Poly1305}
+	case tls.TLS_AES_256_GCM_SHA384:
+		return cipherSuite{ID: tls.TLS_AES_256_GCM_SHA384, Hash: crypto.SHA384, KeyLen: 32, AEAD: aeadAESGCMTLS13}
+	default:
+		panic(fmt.Sprintf("unknown cypher suite: %d", id))
+	}
+}
+
+func aeadAESGCMTLS13(key, nonceMask []byte) cipher.AEAD {
+	if fips140.Enabled() {
+		return aeadAESGCMTLS13FIPS140(key, nonceMask)
+	}
+
+	if len(nonceMask) != aeadNonceLength {
+		panic("tls: internal error: wrong nonce length")
+	}
+	aes, err := aes.NewCipher(key)
+	if err != nil {
+		panic(err)
+	}
+	aead, err := cipher.NewGCM(aes)
+	if err != nil {
+		panic(err)
+	}
+
+	ret := &xorNonceAEAD{aead: aead}
+	copy(ret.nonceMask[:], nonceMask)
+	return ret
+}
+
+func aeadChaCha20Poly1305(key, nonceMask []byte) cipher.AEAD {
+	if len(nonceMask) != aeadNonceLength {
+		panic("tls: internal error: wrong nonce length")
+	}
+	aead, err := chacha20poly1305.New(key)
+	if err != nil {
+		panic(err)
+	}
+
+	ret := &xorNonceAEAD{aead: aead}
+	copy(ret.nonceMask[:], nonceMask)
+	return ret
+}
+
+// xorNonceAEAD wraps an AEAD by XORing in a fixed pattern to the nonce
+// before each call.
+type xorNonceAEAD struct {
+	nonceMask [aeadNonceLength]byte
+	aead      cipher.AEAD
+}
+
+func (f *xorNonceAEAD) NonceSize() int        { return 8 } // 64-bit sequence number
+func (f *xorNonceAEAD) Overhead() int         { return f.aead.Overhead() }
+func (f *xorNonceAEAD) explicitNonceLen() int { return 0 }
+
+func (f *xorNonceAEAD) Seal(out, nonce, plaintext, additionalData []byte) []byte {
+	for i, b := range nonce {
+		f.nonceMask[4+i] ^= b
+	}
+	result := f.aead.Seal(out, f.nonceMask[:], plaintext, additionalData)
+	for i, b := range nonce {
+		f.nonceMask[4+i] ^= b
+	}
+
+	return result
+}
+
+func (f *xorNonceAEAD) Open(out, nonce, ciphertext, additionalData []byte) ([]byte, error) {
+	for i, b := range nonce {
+		f.nonceMask[4+i] ^= b
+	}
+	result, err := f.aead.Open(out, f.nonceMask[:], ciphertext, additionalData)
+	for i, b := range nonce {
+		f.nonceMask[4+i] ^= b
+	}
+
+	return result, err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/cipher_suite_fips140.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/cipher_suite_fips140.go
new file mode 100644
index 000000000..2248cbad3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/cipher_suite_fips140.go
@@ -0,0 +1,48 @@
+package handshake
+
+import (
+	"crypto/cipher"
+	_ "unsafe" // for go:linkname
+)
+
+// Reaching into crypto/tls is a bit of a hack, but it's the only way to get the FIPS 140
+// compliant AEAD, because the standard library doesn't yet expose the NewGCMForQUIC constructor
+// added in https://go-review.googlesource.com/c/go/+/723760.
+// See https://github.com/golang/go/issues/79219 for details.
+//
+// Once the standard library exposes the necessary constructors, we can use a shared code path
+// for both FIPS 140 and non-FIPS 140 modes.
+//
+//go:linkname cryptoTLSAEAD_AESGCMTLS13 crypto/tls.aeadAESGCMTLS13
+func cryptoTLSAEAD_AESGCMTLS13(key, nonceMask []byte) cipher.AEAD
+
+func aeadAESGCMTLS13FIPS140(key, nonceMask []byte) cipher.AEAD {
+	return &tls13AESGCMAEADFIPS140{aead: cryptoTLSAEAD_AESGCMTLS13(key, nonceMask)}
+}
+
+type tls13AESGCMAEADFIPS140 struct {
+	aead       cipher.AEAD
+	primedSeal bool
+}
+
+func (f *tls13AESGCMAEADFIPS140) NonceSize() int { return f.aead.NonceSize() }
+func (f *tls13AESGCMAEADFIPS140) Overhead() int  { return f.aead.Overhead() }
+
+func (f *tls13AESGCMAEADFIPS140) Seal(out, nonce, plaintext, additionalData []byte) []byte {
+	if !f.primedSeal {
+		f.primedSeal = true
+		if nonce[0]|nonce[1]|nonce[2]|nonce[3]|nonce[4]|nonce[5]|nonce[6]|nonce[7] != 0 {
+			// Go's TLS 1.3 AES-GCM AEAD learns the XOR mask from the first Seal
+			// call and enforces monotonically increasing packet numbers after that.
+			// QUIC packet numbers don't reset on key updates, so prime it with
+			// packet number 0 before the first real, non-zero packet number.
+			var zeroNonce [8]byte
+			f.aead.Seal(nil, zeroNonce[:], nil, nil)
+		}
+	}
+	return f.aead.Seal(out, nonce, plaintext, additionalData)
+}
+
+func (f *tls13AESGCMAEADFIPS140) Open(out, nonce, ciphertext, additionalData []byte) ([]byte, error) {
+	return f.aead.Open(out, nonce, ciphertext, additionalData)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/crypto_setup.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/crypto_setup.go
new file mode 100644
index 000000000..7ba715b9a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/crypto_setup.go
@@ -0,0 +1,722 @@
+package handshake
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+type quicVersionContextKey struct{}
+
+var QUICVersionContextKey = &quicVersionContextKey{}
+
+const clientSessionStateRevision = 5
+
+type cryptoSetup struct {
+	tlsConf *tls.Config
+	conn    *tls.QUICConn
+
+	events []Event
+
+	version protocol.Version
+
+	ourParams  *wire.TransportParameters
+	peerParams *wire.TransportParameters
+
+	zeroRTTParameters *wire.TransportParameters
+	allow0RTT         bool
+
+	rttStats *utils.RTTStats
+
+	qlogger qlogwriter.Recorder
+	logger  utils.Logger
+
+	perspective protocol.Perspective
+
+	handshakeCompleteTime time.Time
+
+	zeroRTTOpener LongHeaderOpener // only set for the server
+	zeroRTTSealer LongHeaderSealer // only set for the client
+
+	initialOpener LongHeaderOpener
+	initialSealer LongHeaderSealer
+
+	handshakeOpener LongHeaderOpener
+	handshakeSealer LongHeaderSealer
+
+	used0RTT atomic.Bool
+
+	aead          *updatableAEAD
+	has1RTTSealer bool
+	has1RTTOpener bool
+}
+
+var _ CryptoSetup = &cryptoSetup{}
+
+// NewCryptoSetupClient creates a new crypto setup for the client
+func NewCryptoSetupClient(
+	connID protocol.ConnectionID,
+	tp *wire.TransportParameters,
+	tlsConf *tls.Config,
+	enable0RTT bool,
+	rttStats *utils.RTTStats,
+	qlogger qlogwriter.Recorder,
+	logger utils.Logger,
+	version protocol.Version,
+) CryptoSetup {
+	cs := newCryptoSetup(
+		connID,
+		tp,
+		rttStats,
+		qlogger,
+		logger,
+		protocol.PerspectiveClient,
+		version,
+	)
+
+	tlsConf = setupConfigForClient(tlsConf)
+	cs.tlsConf = tlsConf
+	cs.allow0RTT = enable0RTT
+
+	cs.conn = tls.QUICClient(&tls.QUICConfig{
+		TLSConfig:           tlsConf,
+		EnableSessionEvents: true,
+	})
+	cs.conn.SetTransportParameters(cs.ourParams.Marshal(protocol.PerspectiveClient))
+
+	return cs
+}
+
+// NewCryptoSetupServer creates a new crypto setup for the server
+func NewCryptoSetupServer(
+	connID protocol.ConnectionID,
+	localAddr, remoteAddr net.Addr,
+	tp *wire.TransportParameters,
+	tlsConf *tls.Config,
+	allow0RTT bool,
+	rttStats *utils.RTTStats,
+	qlogger qlogwriter.Recorder,
+	logger utils.Logger,
+	version protocol.Version,
+) CryptoSetup {
+	cs := newCryptoSetup(
+		connID,
+		tp,
+		rttStats,
+		qlogger,
+		logger,
+		protocol.PerspectiveServer,
+		version,
+	)
+	cs.allow0RTT = allow0RTT
+
+	tlsConf = setupConfigForServer(tlsConf, localAddr, remoteAddr)
+
+	cs.tlsConf = tlsConf
+	cs.conn = tls.QUICServer(getQUICConfig(tlsConf, localAddr, remoteAddr))
+	return cs
+}
+
+func newCryptoSetup(
+	connID protocol.ConnectionID,
+	tp *wire.TransportParameters,
+	rttStats *utils.RTTStats,
+	qlogger qlogwriter.Recorder,
+	logger utils.Logger,
+	perspective protocol.Perspective,
+	version protocol.Version,
+) *cryptoSetup {
+	initialSealer, initialOpener := NewInitialAEAD(connID, perspective, version)
+	if qlogger != nil {
+		qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.EncryptionInitial, protocol.PerspectiveClient),
+		})
+		qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.EncryptionInitial, protocol.PerspectiveServer),
+		})
+	}
+	return &cryptoSetup{
+		initialSealer: initialSealer,
+		initialOpener: initialOpener,
+		aead:          newUpdatableAEAD(rttStats, qlogger, logger, version),
+		events:        make([]Event, 0, 16),
+		ourParams:     tp,
+		rttStats:      rttStats,
+		qlogger:       qlogger,
+		logger:        logger,
+		perspective:   perspective,
+		version:       version,
+	}
+}
+
+func (h *cryptoSetup) ChangeConnectionID(id protocol.ConnectionID) {
+	initialSealer, initialOpener := NewInitialAEAD(id, h.perspective, h.version)
+	h.initialSealer = initialSealer
+	h.initialOpener = initialOpener
+	if h.qlogger != nil {
+		h.qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.EncryptionInitial, protocol.PerspectiveClient),
+		})
+		h.qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.EncryptionInitial, protocol.PerspectiveServer),
+		})
+	}
+}
+
+func (h *cryptoSetup) SetLargest1RTTAcked(pn protocol.PacketNumber) error {
+	return h.aead.SetLargestAcked(pn)
+}
+
+func (h *cryptoSetup) StartHandshake(ctx context.Context) error {
+	err := h.conn.Start(context.WithValue(ctx, QUICVersionContextKey, h.version))
+	if err != nil {
+		return wrapError(err)
+	}
+	for {
+		ev := h.conn.NextEvent()
+		if err := h.handleEvent(ev); err != nil {
+			return wrapError(err)
+		}
+		if ev.Kind == tls.QUICNoEvent {
+			break
+		}
+	}
+	if h.perspective == protocol.PerspectiveClient {
+		if h.zeroRTTSealer != nil && h.zeroRTTParameters != nil {
+			h.logger.Debugf("Doing 0-RTT.")
+			h.events = append(h.events, Event{Kind: EventRestoredTransportParameters, TransportParameters: h.zeroRTTParameters})
+		} else {
+			h.logger.Debugf("Not doing 0-RTT. Has sealer: %t, has params: %t", h.zeroRTTSealer != nil, h.zeroRTTParameters != nil)
+		}
+	}
+	return nil
+}
+
+// Close closes the crypto setup.
+// It aborts the handshake, if it is still running.
+func (h *cryptoSetup) Close() error {
+	return h.conn.Close()
+}
+
+// HandleMessage handles a TLS handshake message.
+// It is called by the crypto streams when a new message is available.
+func (h *cryptoSetup) HandleMessage(data []byte, encLevel protocol.EncryptionLevel) error {
+	if err := h.handleMessage(data, encLevel); err != nil {
+		return wrapError(err)
+	}
+	return nil
+}
+
+func (h *cryptoSetup) handleMessage(data []byte, encLevel protocol.EncryptionLevel) error {
+	if err := h.conn.HandleData(encLevel.ToTLSEncryptionLevel(), data); err != nil {
+		return err
+	}
+	for {
+		ev := h.conn.NextEvent()
+		if err := h.handleEvent(ev); err != nil {
+			return err
+		}
+		if ev.Kind == tls.QUICNoEvent {
+			return nil
+		}
+	}
+}
+
+func (h *cryptoSetup) handleEvent(ev tls.QUICEvent) (err error) {
+	switch ev.Kind {
+	case tls.QUICNoEvent:
+		return nil
+	case tls.QUICSetReadSecret:
+		h.setReadKey(ev.Level, ev.Suite, ev.Data)
+		return nil
+	case tls.QUICSetWriteSecret:
+		h.setWriteKey(ev.Level, ev.Suite, ev.Data)
+		return nil
+	case tls.QUICTransportParameters:
+		return h.handleTransportParameters(ev.Data)
+	case tls.QUICTransportParametersRequired:
+		h.conn.SetTransportParameters(h.ourParams.Marshal(h.perspective))
+		return nil
+	case tls.QUICRejectedEarlyData:
+		h.rejected0RTT()
+		return nil
+	case tls.QUICWriteData:
+		h.writeRecord(ev.Level, ev.Data)
+		return nil
+	case tls.QUICHandshakeDone:
+		h.handshakeComplete()
+		return nil
+	case tls.QUICStoreSession:
+		if h.perspective == protocol.PerspectiveServer {
+			panic("cryptoSetup BUG: unexpected QUICStoreSession event for the server")
+		}
+		ev.SessionState.Extra = append(
+			ev.SessionState.Extra,
+			addSessionStateExtraPrefix(h.marshalDataForSessionState(ev.SessionState.EarlyData)),
+		)
+		return h.conn.StoreSession(ev.SessionState)
+	case tls.QUICResumeSession:
+		var allowEarlyData bool
+		switch h.perspective {
+		case protocol.PerspectiveClient:
+			// for clients, this event occurs when a session ticket is selected
+			allowEarlyData = h.handleDataFromSessionState(
+				findSessionStateExtraData(ev.SessionState.Extra),
+				ev.SessionState.EarlyData,
+			)
+		case protocol.PerspectiveServer:
+			// for servers, this event occurs when receiving the client's session ticket
+			allowEarlyData = h.handleSessionTicket(
+				findSessionStateExtraData(ev.SessionState.Extra),
+				ev.SessionState.EarlyData,
+			)
+		}
+		if ev.SessionState.EarlyData {
+			ev.SessionState.EarlyData = allowEarlyData
+		}
+		return nil
+	case tls.QUICErrorEvent:
+		return ev.Err
+	default:
+		// Unknown events should be ignored.
+		// crypto/tls will ensure that this is safe to do.
+		// See the discussion following https://github.com/golang/go/issues/68124#issuecomment-2187042510 for details.
+		return nil
+	}
+}
+
+func (h *cryptoSetup) NextEvent() Event {
+	if len(h.events) == 0 {
+		return Event{Kind: EventNoEvent}
+	}
+	ev := h.events[0]
+	h.events = h.events[1:]
+	return ev
+}
+
+func (h *cryptoSetup) handleTransportParameters(data []byte) error {
+	var tp wire.TransportParameters
+	if err := tp.Unmarshal(data, h.perspective.Opposite()); err != nil {
+		return err
+	}
+	h.peerParams = &tp
+	h.events = append(h.events, Event{Kind: EventReceivedTransportParameters, TransportParameters: h.peerParams})
+	return nil
+}
+
+// must be called after receiving the transport parameters
+func (h *cryptoSetup) marshalDataForSessionState(earlyData bool) []byte {
+	b := make([]byte, 0, 256)
+	b = quicvarint.Append(b, clientSessionStateRevision)
+	if earlyData {
+		// only save the transport parameters for 0-RTT enabled session tickets
+		return h.peerParams.MarshalForSessionTicket(b)
+	}
+	return b
+}
+
+func (h *cryptoSetup) handleDataFromSessionState(data []byte, earlyData bool) (allowEarlyData bool) {
+	tp, err := decodeDataFromSessionState(data, earlyData)
+	if err != nil {
+		h.logger.Debugf("Restoring of transport parameters from session ticket failed: %s", err.Error())
+		return
+	}
+	// The session ticket might have been saved from a connection that allowed 0-RTT,
+	// and therefore contain transport parameters.
+	// Only use them if 0-RTT is actually used on the new connection.
+	if tp != nil && h.allow0RTT {
+		h.zeroRTTParameters = tp
+		return true
+	}
+	return false
+}
+
+func decodeDataFromSessionState(b []byte, earlyData bool) (*wire.TransportParameters, error) {
+	ver, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, err
+	}
+	b = b[l:]
+	if ver != clientSessionStateRevision {
+		return nil, fmt.Errorf("mismatching version. Got %d, expected %d", ver, clientSessionStateRevision)
+	}
+	if !earlyData {
+		return nil, nil
+	}
+	var tp wire.TransportParameters
+	if err := tp.UnmarshalFromSessionTicket(b); err != nil {
+		return nil, err
+	}
+	return &tp, nil
+}
+
+func (h *cryptoSetup) getDataForSessionTicket() []byte {
+	return (&sessionTicket{
+		Parameters: h.ourParams,
+	}).Marshal()
+}
+
+// GetSessionTicket generates a new session ticket.
+// Due to limitations in crypto/tls, it's only possible to generate a single session ticket per connection.
+// It is only valid for the server.
+func (h *cryptoSetup) GetSessionTicket() ([]byte, error) {
+	if err := h.conn.SendSessionTicket(tls.QUICSessionTicketOptions{
+		EarlyData: h.allow0RTT,
+		Extra:     [][]byte{addSessionStateExtraPrefix(h.getDataForSessionTicket())},
+	}); err != nil {
+		// Session tickets might be disabled by tls.Config.SessionTicketsDisabled.
+		// We can't check h.tlsConfig here, since the actual config might have been obtained from
+		// the GetConfigForClient callback.
+		// See https://github.com/golang/go/issues/62032.
+		// This error assertion can be removed once we drop support for Go 1.25.
+		if strings.Contains(err.Error(), "session ticket keys unavailable") {
+			return nil, nil
+		}
+		return nil, err
+	}
+	// If session tickets are disabled, NextEvent will immediately return QUICNoEvent,
+	// and we will return a nil ticket.
+	var ticket []byte
+	for {
+		ev := h.conn.NextEvent()
+		if ev.Kind == tls.QUICNoEvent {
+			break
+		}
+		if ev.Kind == tls.QUICWriteData && ev.Level == tls.QUICEncryptionLevelApplication {
+			if ticket != nil {
+				h.logger.Errorf("unexpected multiple session tickets")
+				continue
+			}
+			ticket = ev.Data
+		} else {
+			h.logger.Errorf("unexpected event: %v", ev.Kind)
+		}
+	}
+	return ticket, nil
+}
+
+// handleSessionTicket is called for the server when receiving the client's session ticket.
+// It reads parameters from the session ticket and checks whether to accept 0-RTT if the session ticket enabled 0-RTT.
+// Note that the fact that the session ticket allows 0-RTT doesn't mean that the actual TLS handshake enables 0-RTT:
+// A client may use a 0-RTT enabled session to resume a TLS session without using 0-RTT.
+func (h *cryptoSetup) handleSessionTicket(data []byte, using0RTT bool) (allowEarlyData bool) {
+	var t sessionTicket
+	if err := t.Unmarshal(data); err != nil {
+		h.logger.Debugf("Unmarshalling session ticket failed: %s", err.Error())
+		return false
+	}
+	if !using0RTT {
+		return false
+	}
+	valid := h.ourParams.ValidFor0RTT(t.Parameters)
+	if !valid {
+		h.logger.Debugf("Transport parameters changed. Rejecting 0-RTT.")
+		return false
+	}
+	if !h.allow0RTT {
+		h.logger.Debugf("0-RTT not allowed. Rejecting 0-RTT.")
+		return false
+	}
+	return true
+}
+
+// rejected0RTT is called for the client when the server rejects 0-RTT.
+func (h *cryptoSetup) rejected0RTT() {
+	h.logger.Debugf("0-RTT was rejected. Dropping 0-RTT keys.")
+
+	had0RTTKeys := h.zeroRTTSealer != nil
+	h.zeroRTTSealer = nil
+
+	if had0RTTKeys {
+		h.events = append(h.events, Event{Kind: EventDiscard0RTTKeys})
+	}
+}
+
+func (h *cryptoSetup) setReadKey(el tls.QUICEncryptionLevel, suiteID uint16, trafficSecret []byte) {
+	suite := getCipherSuite(suiteID)
+	var ev EventKind
+	//nolint:exhaustive // The TLS stack doesn't export Initial keys.
+	switch el {
+	case tls.QUICEncryptionLevelEarly:
+		ev = EventReceived0RTTReadKeys
+		if h.perspective == protocol.PerspectiveClient {
+			panic("Received 0-RTT read key for the client")
+		}
+		h.zeroRTTOpener = newLongHeaderOpener(
+			createAEAD(suite, trafficSecret, h.version),
+			newHeaderProtector(suite, trafficSecret, true, h.version),
+		)
+		h.used0RTT.Store(true)
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed 0-RTT Read keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+	case tls.QUICEncryptionLevelHandshake:
+		ev = EventReceivedHandshakeReadKeys
+		h.handshakeOpener = newLongHeaderOpener(
+			createAEAD(suite, trafficSecret, h.version),
+			newHeaderProtector(suite, trafficSecret, true, h.version),
+		)
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed Handshake Read keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+	case tls.QUICEncryptionLevelApplication:
+		ev = EventReceived1RTTReadKeys
+		h.aead.SetReadKey(suite, trafficSecret)
+		h.has1RTTOpener = true
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed 1-RTT Read keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+	default:
+		panic("unexpected read encryption level")
+	}
+	h.events = append(h.events, Event{Kind: ev})
+	if h.qlogger != nil {
+		h.qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.FromTLSEncryptionLevel(el), h.perspective.Opposite()),
+		})
+	}
+}
+
+func (h *cryptoSetup) setWriteKey(el tls.QUICEncryptionLevel, suiteID uint16, trafficSecret []byte) {
+	suite := getCipherSuite(suiteID)
+	//nolint:exhaustive // The TLS stack doesn't export Initial keys.
+	switch el {
+	case tls.QUICEncryptionLevelEarly:
+		if h.perspective == protocol.PerspectiveServer {
+			panic("Received 0-RTT write key for the server")
+		}
+		h.zeroRTTSealer = newLongHeaderSealer(
+			createAEAD(suite, trafficSecret, h.version),
+			newHeaderProtector(suite, trafficSecret, true, h.version),
+		)
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed 0-RTT Write keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger: qlog.KeyUpdateTLS,
+				KeyType: encLevelToKeyType(protocol.Encryption0RTT, h.perspective),
+			})
+		}
+		// don't set used0RTT here. 0-RTT might still get rejected.
+		return
+	case tls.QUICEncryptionLevelHandshake:
+		h.handshakeSealer = newLongHeaderSealer(
+			createAEAD(suite, trafficSecret, h.version),
+			newHeaderProtector(suite, trafficSecret, true, h.version),
+		)
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed Handshake Write keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+	case tls.QUICEncryptionLevelApplication:
+		h.aead.SetWriteKey(suite, trafficSecret)
+		h.has1RTTSealer = true
+		if h.logger.Debug() {
+			h.logger.Debugf("Installed 1-RTT Write keys (using %s)", tls.CipherSuiteName(suite.ID))
+		}
+		if h.zeroRTTSealer != nil {
+			// Once we receive handshake keys, we know that 0-RTT was not rejected.
+			h.used0RTT.Store(true)
+			h.zeroRTTSealer = nil
+			h.logger.Debugf("Dropping 0-RTT keys.")
+			if h.qlogger != nil {
+				h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeClient0RTT})
+			}
+		}
+	default:
+		panic("unexpected write encryption level")
+	}
+	if h.qlogger != nil {
+		h.qlogger.RecordEvent(qlog.KeyUpdated{
+			Trigger: qlog.KeyUpdateTLS,
+			KeyType: encLevelToKeyType(protocol.FromTLSEncryptionLevel(el), h.perspective),
+		})
+	}
+}
+
+// writeRecord is called when TLS writes data
+func (h *cryptoSetup) writeRecord(encLevel tls.QUICEncryptionLevel, p []byte) {
+	//nolint:exhaustive // handshake records can only be written for Initial and Handshake.
+	switch encLevel {
+	case tls.QUICEncryptionLevelInitial:
+		h.events = append(h.events, Event{Kind: EventWriteInitialData, Data: p})
+	case tls.QUICEncryptionLevelHandshake:
+		h.events = append(h.events, Event{Kind: EventWriteHandshakeData, Data: p})
+	case tls.QUICEncryptionLevelApplication:
+		panic("unexpected write")
+	default:
+		panic(fmt.Sprintf("unexpected write encryption level: %s", encLevel))
+	}
+}
+
+func (h *cryptoSetup) DiscardInitialKeys() {
+	dropped := h.initialOpener != nil
+	h.initialOpener = nil
+	h.initialSealer = nil
+	if dropped {
+		h.logger.Debugf("Dropping Initial keys.")
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeClientInitial})
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeServerInitial})
+		}
+	}
+}
+
+func (h *cryptoSetup) handshakeComplete() {
+	h.handshakeCompleteTime = time.Now()
+	h.events = append(h.events, Event{Kind: EventHandshakeComplete})
+}
+
+func (h *cryptoSetup) SetHandshakeConfirmed() {
+	h.aead.SetHandshakeConfirmed()
+	// drop Handshake keys
+	var dropped bool
+	if h.handshakeOpener != nil {
+		h.handshakeOpener = nil
+		h.handshakeSealer = nil
+		dropped = true
+	}
+	if dropped {
+		h.logger.Debugf("Dropping Handshake keys.")
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeClientHandshake})
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeServerHandshake})
+		}
+	}
+}
+
+func (h *cryptoSetup) GetInitialSealer() (LongHeaderSealer, error) {
+	if h.initialSealer == nil {
+		return nil, ErrKeysDropped
+	}
+	return h.initialSealer, nil
+}
+
+func (h *cryptoSetup) Get0RTTSealer() (LongHeaderSealer, error) {
+	if h.zeroRTTSealer == nil {
+		return nil, ErrKeysDropped
+	}
+	return h.zeroRTTSealer, nil
+}
+
+func (h *cryptoSetup) GetHandshakeSealer() (LongHeaderSealer, error) {
+	if h.handshakeSealer == nil {
+		if h.initialSealer == nil {
+			return nil, ErrKeysDropped
+		}
+		return nil, ErrKeysNotYetAvailable
+	}
+	return h.handshakeSealer, nil
+}
+
+func (h *cryptoSetup) Get1RTTSealer() (ShortHeaderSealer, error) {
+	if !h.has1RTTSealer {
+		return nil, ErrKeysNotYetAvailable
+	}
+	return h.aead, nil
+}
+
+func (h *cryptoSetup) GetInitialOpener() (LongHeaderOpener, error) {
+	if h.initialOpener == nil {
+		return nil, ErrKeysDropped
+	}
+	return h.initialOpener, nil
+}
+
+func (h *cryptoSetup) Get0RTTOpener() (LongHeaderOpener, error) {
+	if h.zeroRTTOpener == nil {
+		if h.initialOpener != nil {
+			return nil, ErrKeysNotYetAvailable
+		}
+		// if the initial opener is also not available, the keys were already dropped
+		return nil, ErrKeysDropped
+	}
+	return h.zeroRTTOpener, nil
+}
+
+func (h *cryptoSetup) GetHandshakeOpener() (LongHeaderOpener, error) {
+	if h.handshakeOpener == nil {
+		if h.initialOpener != nil {
+			return nil, ErrKeysNotYetAvailable
+		}
+		// if the initial opener is also not available, the keys were already dropped
+		return nil, ErrKeysDropped
+	}
+	return h.handshakeOpener, nil
+}
+
+func (h *cryptoSetup) Get1RTTOpener() (ShortHeaderOpener, error) {
+	if h.zeroRTTOpener != nil && time.Since(h.handshakeCompleteTime) > 3*h.rttStats.PTO(true) {
+		h.zeroRTTOpener = nil
+		h.logger.Debugf("Dropping 0-RTT keys.")
+		if h.qlogger != nil {
+			h.qlogger.RecordEvent(qlog.KeyDiscarded{KeyType: qlog.KeyTypeClient0RTT})
+		}
+	}
+
+	if !h.has1RTTOpener {
+		return nil, ErrKeysNotYetAvailable
+	}
+	return h.aead, nil
+}
+
+func (h *cryptoSetup) ConnectionState() ConnectionState {
+	return ConnectionState{
+		ConnectionState: h.conn.ConnectionState(),
+		Used0RTT:        h.used0RTT.Load(),
+	}
+}
+
+func wrapError(err error) error {
+	if alertErr, ok := errors.AsType[tls.AlertError](err); ok {
+		return qerr.NewLocalCryptoError(uint8(alertErr), err)
+	}
+	return &qerr.TransportError{ErrorCode: qerr.InternalError, ErrorMessage: err.Error()}
+}
+
+func encLevelToKeyType(encLevel protocol.EncryptionLevel, pers protocol.Perspective) qlog.KeyType {
+	if pers == protocol.PerspectiveServer {
+		switch encLevel {
+		case protocol.EncryptionInitial:
+			return qlog.KeyTypeServerInitial
+		case protocol.EncryptionHandshake:
+			return qlog.KeyTypeServerHandshake
+		case protocol.Encryption0RTT:
+			return qlog.KeyTypeServer0RTT
+		case protocol.Encryption1RTT:
+			return qlog.KeyTypeServer1RTT
+		default:
+			return ""
+		}
+	}
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return qlog.KeyTypeClientInitial
+	case protocol.EncryptionHandshake:
+		return qlog.KeyTypeClientHandshake
+	case protocol.Encryption0RTT:
+		return qlog.KeyTypeClient0RTT
+	case protocol.Encryption1RTT:
+		return qlog.KeyTypeClient1RTT
+	default:
+		return ""
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/crypto_setup_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/crypto_setup_test.go
new file mode 100644
index 000000000..82f22b0f1
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/crypto_setup_test.go
@@ -0,0 +1,566 @@
+package handshake
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"errors"
+	"math/big"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/testdata"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	typeClientHello      = 1
+	typeNewSessionTicket = 4
+)
+
+type mockClientSessionCache struct {
+	cache tls.ClientSessionCache
+	puts  chan *tls.ClientSessionState
+}
+
+var _ tls.ClientSessionCache = &mockClientSessionCache{}
+
+func newMockClientSessionCache() *mockClientSessionCache {
+	return &mockClientSessionCache{
+		puts:  make(chan *tls.ClientSessionState, 1),
+		cache: tls.NewLRUClientSessionCache(1),
+	}
+}
+
+func (m *mockClientSessionCache) Get(sessionKey string) (session *tls.ClientSessionState, ok bool) {
+	return m.cache.Get(sessionKey)
+}
+
+func (m *mockClientSessionCache) Put(sessionKey string, cs *tls.ClientSessionState) {
+	m.puts <- cs
+	m.cache.Put(sessionKey, cs)
+}
+
+func getTLSConfigs() (clientConf, serverConf *tls.Config) {
+	clientConf = &tls.Config{
+		ServerName: "localhost",
+		RootCAs:    testdata.GetRootCA(),
+		NextProtos: []string{"crypto-setup"},
+	}
+	serverConf = testdata.GetTLSConfig()
+	serverConf.NextProtos = []string{"crypto-setup"}
+	return clientConf, serverConf
+}
+
+func TestErrorBeforeClientHelloGeneration(t *testing.T) {
+	tlsConf := testdata.GetTLSConfig()
+	tlsConf.InsecureSkipVerify = true
+	tlsConf.NextProtos = []string{""}
+	cl := NewCryptoSetupClient(
+		protocol.ConnectionID{},
+		&wire.TransportParameters{},
+		tlsConf,
+		false,
+		utils.NewRTTStats(),
+		nil,
+		utils.DefaultLogger.WithPrefix("client"),
+		protocol.Version1,
+	)
+
+	err := cl.StartHandshake(context.Background())
+	terr, ok := errors.AsType[*qerr.TransportError](err)
+	require.True(t, ok)
+	require.Equal(t, uint64(0x100+0x50), uint64(terr.ErrorCode))
+	require.Contains(t, err.Error(), "tls: invalid NextProtos value")
+}
+
+func TestMessageReceivedAtWrongEncryptionLevel(t *testing.T) {
+	var token protocol.StatelessResetToken
+	server := NewCryptoSetupServer(
+		protocol.ConnectionID{},
+		&net.UDPAddr{IP: net.IPv6loopback, Port: 1234},
+		&net.UDPAddr{IP: net.IPv6loopback, Port: 4321},
+		&wire.TransportParameters{StatelessResetToken: &token},
+		testdata.GetTLSConfig(),
+		false,
+		utils.NewRTTStats(),
+		nil,
+		utils.DefaultLogger.WithPrefix("server"),
+		protocol.Version1,
+	)
+
+	require.NoError(t, server.StartHandshake(context.Background()))
+
+	fakeCH := append([]byte{typeClientHello, 0, 0, 6}, []byte("foobar")...)
+	// wrong encryption level
+	err := server.HandleMessage(fakeCH, protocol.EncryptionHandshake)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "tls: handshake data received at wrong level")
+}
+
+// The clientEvents and serverEvents contain all events that were not processed by the function,
+// i.e. not EventWriteInitialData, EventWriteHandshakeData, EventHandshakeComplete.
+func handshake(t *testing.T, client, server CryptoSetup) (clientEvents []Event, clientErr error, serverEvents []Event, serverErr error) {
+	t.Helper()
+	require.NoError(t, client.StartHandshake(context.Background()))
+	require.NoError(t, server.StartHandshake(context.Background()))
+
+	var clientHandshakeComplete, serverHandshakeComplete bool
+
+	for {
+	clientLoop:
+		for {
+			ev := client.NextEvent()
+			switch ev.Kind {
+			case EventNoEvent:
+				break clientLoop
+			case EventWriteInitialData:
+				serverErr = server.HandleMessage(ev.Data, protocol.EncryptionInitial)
+				if serverErr != nil {
+					return
+				}
+			case EventWriteHandshakeData:
+				serverErr = server.HandleMessage(ev.Data, protocol.EncryptionHandshake)
+				if serverErr != nil {
+					return
+				}
+			case EventHandshakeComplete:
+				clientHandshakeComplete = true
+			default:
+				clientEvents = append(clientEvents, ev)
+			}
+		}
+
+	serverLoop:
+		for {
+			ev := server.NextEvent()
+			switch ev.Kind {
+			case EventNoEvent:
+				break serverLoop
+			case EventWriteInitialData:
+				clientErr = client.HandleMessage(ev.Data, protocol.EncryptionInitial)
+				if clientErr != nil {
+					return
+				}
+			case EventWriteHandshakeData:
+				clientErr = client.HandleMessage(ev.Data, protocol.EncryptionHandshake)
+				if clientErr != nil {
+					return
+				}
+			case EventHandshakeComplete:
+				serverHandshakeComplete = true
+				ticket, err := server.GetSessionTicket()
+				require.NoError(t, err)
+				if ticket != nil {
+					require.NoError(t, client.HandleMessage(ticket, protocol.Encryption1RTT))
+				}
+			default:
+				serverEvents = append(serverEvents, ev)
+			}
+		}
+
+		if clientHandshakeComplete && serverHandshakeComplete {
+			break
+		}
+	}
+	return
+}
+
+func handshakeWithTLSConf(
+	t *testing.T,
+	clientConf, serverConf *tls.Config,
+	clientRTTStats, serverRTTStats *utils.RTTStats,
+	clientTransportParameters, serverTransportParameters *wire.TransportParameters,
+	enable0RTT bool,
+) (CryptoSetup /* client */, []Event /* more client events */, error, /* client error */
+	CryptoSetup /* server */, []Event /* more server events */, error, /* server error */
+) {
+	t.Helper()
+	client := NewCryptoSetupClient(
+		protocol.ConnectionID{},
+		clientTransportParameters,
+		clientConf,
+		enable0RTT,
+		clientRTTStats,
+		nil,
+		utils.DefaultLogger.WithPrefix("client"),
+		protocol.Version1,
+	)
+
+	if serverTransportParameters.StatelessResetToken == nil {
+		var token protocol.StatelessResetToken
+		serverTransportParameters.StatelessResetToken = &token
+	}
+	server := NewCryptoSetupServer(
+		protocol.ConnectionID{},
+		&net.UDPAddr{IP: net.IPv6loopback, Port: 1234},
+		&net.UDPAddr{IP: net.IPv6loopback, Port: 4321},
+		serverTransportParameters,
+		serverConf,
+		enable0RTT,
+		serverRTTStats,
+		nil,
+		utils.DefaultLogger.WithPrefix("server"),
+		protocol.Version1,
+	)
+	cEvents, cErr, sEvents, sErr := handshake(t, client, server)
+	return client, cEvents, cErr, server, sEvents, sErr
+}
+
+func TestHandshake(t *testing.T) {
+	clientConf, serverConf := getTLSConfigs()
+	_, _, clientErr, _, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2}, &wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		false,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+}
+
+func TestHelloRetryRequest(t *testing.T) {
+	clientConf, serverConf := getTLSConfigs()
+	serverConf.CurvePreferences = []tls.CurveID{tls.CurveP384}
+	var helloRetryRequest bool
+	serverConf.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+		helloRetryRequest = info.HelloRetryRequest
+		return nil, nil
+	}
+	_, _, clientErr, _, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2}, &wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		false,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+	require.True(t, helloRetryRequest)
+}
+
+func TestWithClientAuth(t *testing.T) {
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	tmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{},
+		SignatureAlgorithm:    x509.PureEd25519,
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(time.Hour),
+		BasicConstraintsValid: true,
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, pub, priv)
+	require.NoError(t, err)
+	clientCert := tls.Certificate{
+		PrivateKey:  priv,
+		Certificate: [][]byte{certDER},
+	}
+
+	clientConf, serverConf := getTLSConfigs()
+	clientConf.Certificates = []tls.Certificate{clientCert}
+	serverConf.ClientAuth = tls.RequireAnyClientCert
+	_, _, clientErr, _, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2}, &wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		false,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+}
+
+func TestTransportParameters(t *testing.T) {
+	clientConf, serverConf := getTLSConfigs()
+	cTransportParameters := &wire.TransportParameters{ActiveConnectionIDLimit: 2, MaxIdleTimeout: 42 * time.Second}
+	client := NewCryptoSetupClient(
+		protocol.ConnectionID{},
+		cTransportParameters,
+		clientConf,
+		false,
+		utils.NewRTTStats(),
+		nil,
+		utils.DefaultLogger.WithPrefix("client"),
+		protocol.Version1,
+	)
+
+	var token protocol.StatelessResetToken
+	sTransportParameters := &wire.TransportParameters{
+		MaxIdleTimeout:          1337 * time.Second,
+		StatelessResetToken:     &token,
+		ActiveConnectionIDLimit: 2,
+	}
+	server := NewCryptoSetupServer(
+		protocol.ConnectionID{},
+		&net.UDPAddr{IP: net.IPv6loopback, Port: 1234},
+		&net.UDPAddr{IP: net.IPv6loopback, Port: 4321},
+		sTransportParameters,
+		serverConf,
+		false,
+		utils.NewRTTStats(),
+		nil,
+		utils.DefaultLogger.WithPrefix("server"),
+		protocol.Version1,
+	)
+
+	clientEvents, cErr, serverEvents, sErr := handshake(t, client, server)
+	require.NoError(t, cErr)
+	require.NoError(t, sErr)
+	var clientReceivedTransportParameters *wire.TransportParameters
+	for _, ev := range clientEvents {
+		if ev.Kind == EventReceivedTransportParameters {
+			clientReceivedTransportParameters = ev.TransportParameters
+		}
+	}
+	require.NotNil(t, clientReceivedTransportParameters)
+	require.Equal(t, 1337*time.Second, clientReceivedTransportParameters.MaxIdleTimeout)
+
+	var serverReceivedTransportParameters *wire.TransportParameters
+	for _, ev := range serverEvents {
+		if ev.Kind == EventReceivedTransportParameters {
+			serverReceivedTransportParameters = ev.TransportParameters
+		}
+	}
+	require.NotNil(t, serverReceivedTransportParameters)
+	require.Equal(t, 42*time.Second, serverReceivedTransportParameters.MaxIdleTimeout)
+}
+
+func TestNewSessionTicketAtWrongEncryptionLevel(t *testing.T) {
+	clientConf, serverConf := getTLSConfigs()
+	client, _, clientErr, _, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2}, &wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		false,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+
+	// inject an invalid session ticket
+	b := append([]byte{uint8(typeNewSessionTicket), 0, 0, 6}, []byte("foobar")...)
+	err := client.HandleMessage(b, protocol.EncryptionHandshake)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "tls: handshake data received at wrong level")
+}
+
+func TestHandlingNewSessionTicketFails(t *testing.T) {
+	clientConf, serverConf := getTLSConfigs()
+	client, _, clientErr, _, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2}, &wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		false,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+
+	// inject an invalid session ticket
+	b := append([]byte{uint8(typeNewSessionTicket), 0, 0, 6}, []byte("foobar")...)
+	err := client.HandleMessage(b, protocol.Encryption1RTT)
+	require.IsType(t, &qerr.TransportError{}, err)
+	require.True(t, err.(*qerr.TransportError).ErrorCode.IsCryptoError())
+}
+
+func TestSessionResumption(t *testing.T) {
+	clientConf, serverConf := getTLSConfigs()
+	csc := newMockClientSessionCache()
+	clientConf.ClientSessionCache = csc
+	client, _, clientErr, server, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2}, &wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		false,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+	select {
+	case <-csc.puts:
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive a session ticket")
+	}
+	require.False(t, server.ConnectionState().DidResume)
+	require.False(t, client.ConnectionState().DidResume)
+
+	clientRTTStats := utils.NewRTTStats()
+	serverRTTStats := utils.NewRTTStats()
+	client, _, clientErr, server, _, serverErr = handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		clientRTTStats, serverRTTStats,
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2}, &wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		false,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+	select {
+	case <-csc.puts:
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive a session ticket")
+	}
+	require.True(t, server.ConnectionState().DidResume)
+	require.True(t, client.ConnectionState().DidResume)
+}
+
+func TestSessionResumptionDisabled(t *testing.T) {
+	clientConf, serverConf := getTLSConfigs()
+	csc := newMockClientSessionCache()
+	clientConf.ClientSessionCache = csc
+	client, _, clientErr, server, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2}, &wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		false,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+	select {
+	case <-csc.puts:
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive a session ticket")
+	}
+	require.False(t, server.ConnectionState().DidResume)
+	require.False(t, client.ConnectionState().DidResume)
+
+	serverConf.SessionTicketsDisabled = true
+	client, _, clientErr, server, _, serverErr = handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2}, &wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		false,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+	select {
+	case <-csc.puts:
+		t.Fatal("didn't expect to receive a session ticket")
+	case <-time.After(25 * time.Millisecond):
+	}
+	require.False(t, server.ConnectionState().DidResume)
+	require.False(t, client.ConnectionState().DidResume)
+}
+
+func Test0RTT(t *testing.T) {
+	clientConf, serverConf := getTLSConfigs()
+	csc := newMockClientSessionCache()
+	clientConf.ClientSessionCache = csc
+	const initialMaxData protocol.ByteCount = 1337
+	client, _, clientErr, server, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2, InitialMaxData: initialMaxData},
+		true,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+	select {
+	case <-csc.puts:
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive a session ticket")
+	}
+	require.False(t, server.ConnectionState().DidResume)
+	require.False(t, client.ConnectionState().DidResume)
+
+	client, clientEvents, clientErr, server, serverEvents, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2, InitialMaxData: initialMaxData},
+		true,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+
+	var tp *wire.TransportParameters
+	for _, ev := range clientEvents {
+		switch ev.Kind {
+		case EventRestoredTransportParameters:
+			tp = ev.TransportParameters
+		}
+	}
+	require.NotNil(t, tp)
+	require.Equal(t, initialMaxData, tp.InitialMaxData)
+
+	var serverReceived0RTTKeys bool
+	for _, ev := range serverEvents {
+		switch ev.Kind {
+		case EventReceived0RTTReadKeys:
+			serverReceived0RTTKeys = true
+		}
+	}
+	require.True(t, serverReceived0RTTKeys)
+
+	require.True(t, server.ConnectionState().DidResume)
+	require.True(t, client.ConnectionState().DidResume)
+	require.True(t, server.ConnectionState().Used0RTT)
+	require.True(t, client.ConnectionState().Used0RTT)
+}
+
+func Test0RTTRejectionOnTransportParametersChanged(t *testing.T) {
+	clientConf, serverConf := getTLSConfigs()
+	csc := newMockClientSessionCache()
+	clientConf.ClientSessionCache = csc
+	const initialMaxData protocol.ByteCount = 1337
+	client, _, clientErr, server, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		utils.NewRTTStats(), utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2, InitialMaxData: initialMaxData},
+		true,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+	select {
+	case <-csc.puts:
+	case <-time.After(time.Second):
+		t.Fatal("didn't receive a session ticket")
+	}
+	require.False(t, server.ConnectionState().DidResume)
+	require.False(t, client.ConnectionState().DidResume)
+
+	clientRTTStats := utils.NewRTTStats()
+	client, clientEvents, clientErr, server, _, serverErr := handshakeWithTLSConf(
+		t,
+		clientConf, serverConf,
+		clientRTTStats, utils.NewRTTStats(),
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2},
+		&wire.TransportParameters{ActiveConnectionIDLimit: 2, InitialMaxData: initialMaxData - 1},
+		true,
+	)
+	require.NoError(t, clientErr)
+	require.NoError(t, serverErr)
+
+	var tp *wire.TransportParameters
+	for _, ev := range clientEvents {
+		switch ev.Kind {
+		case EventRestoredTransportParameters:
+			tp = ev.TransportParameters
+		}
+	}
+	require.NotNil(t, tp)
+	require.Equal(t, initialMaxData, tp.InitialMaxData)
+
+	require.True(t, server.ConnectionState().DidResume)
+	require.True(t, client.ConnectionState().DidResume)
+	require.False(t, server.ConnectionState().Used0RTT)
+	require.False(t, client.ConnectionState().Used0RTT)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/fake_conn.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/fake_conn.go
new file mode 100644
index 000000000..54af823ba
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/fake_conn.go
@@ -0,0 +1,21 @@
+package handshake
+
+import (
+	"net"
+	"time"
+)
+
+type conn struct {
+	localAddr, remoteAddr net.Addr
+}
+
+var _ net.Conn = &conn{}
+
+func (c *conn) Read([]byte) (int, error)         { return 0, nil }
+func (c *conn) Write([]byte) (int, error)        { return 0, nil }
+func (c *conn) Close() error                     { return nil }
+func (c *conn) RemoteAddr() net.Addr             { return c.remoteAddr }
+func (c *conn) LocalAddr() net.Addr              { return c.localAddr }
+func (c *conn) SetReadDeadline(time.Time) error  { return nil }
+func (c *conn) SetWriteDeadline(time.Time) error { return nil }
+func (c *conn) SetDeadline(time.Time) error      { return nil }
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/handshake_fuzz_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/handshake_fuzz_test.go
new file mode 100644
index 000000000..e9aa1fe07
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/handshake_fuzz_test.go
@@ -0,0 +1,395 @@
+package handshake
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"errors"
+	"math/big"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qtls"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	ossfuzzseeds "github.com/quic-go/go-ossfuzz-seeds"
+)
+
+var (
+	fuzzCert, fuzzAltCert *tls.Certificate
+	fuzzCertPool          *x509.CertPool
+)
+
+func init() {
+	var err error
+	fuzzCert, fuzzCertPool, err = generateFuzzCertificate()
+	if err != nil {
+		panic(err)
+	}
+	fuzzAltCert, _, err = generateFuzzCertificate()
+	if err != nil {
+		panic(err)
+	}
+}
+
+func generateFuzzCertificate() (*tls.Certificate, *x509.CertPool, error) {
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+	tmpl := x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{Organization: []string{"quic-go fuzzer"}},
+		NotBefore:             time.Now().Add(-24 * time.Hour),
+		NotAfter:              time.Now().Add(30 * 24 * time.Hour),
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		DNSNames:              []string{"localhost"},
+		BasicConstraintsValid: true,
+	}
+	derBytes, err := x509.CreateCertificate(rand.Reader, &tmpl, &tmpl, priv.Public(), priv)
+	if err != nil {
+		return nil, nil, err
+	}
+	cert, err := x509.ParseCertificate(derBytes)
+	if err != nil {
+		return nil, nil, err
+	}
+	pool := x509.NewCertPool()
+	pool.AddCert(cert)
+	return &tls.Certificate{
+		Certificate: [][]byte{derBytes},
+		PrivateKey:  priv,
+	}, pool, nil
+}
+
+const fuzzALPN = "fuzzing"
+
+var fuzzSessionTicketKey = [32]byte{
+	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+	17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32,
+}
+
+func FuzzHandshake(f *testing.F) {
+	corpus := ossfuzzseeds.New(f)
+
+	corpus.Add(
+		uint8(0),    // cipherSuite
+		uint8(0),    // clientAuth
+		uint8(0xFF), // messageToReplace: won't match
+		uint8(0),    // messageEncLevel
+		uint8(0),    // zeroRTTMode
+		uint8(0),    // postHandshakeTarget
+		uint8(0),    // invalidTP
+		uint8(0),    // sessionMode
+		uint8(0),    // tlsCallbacks
+		uint8(0),    // alpnMode
+		[]byte("foobar"),
+	)
+	corpus.Add(
+		uint8(2), // cipherSuite: ChaCha20
+		uint8(0), // clientAuth
+		uint8(1), // messageToReplace: ClientHello
+		uint8(0), // messageEncLevel: Initial
+		uint8(3), // zeroRTTMode: both
+		uint8(0), // postHandshakeTarget
+		uint8(0), // invalidTP
+		uint8(1), // sessionMode: cache+ticket+enabled
+		uint8(0), // tlsCallbacks
+		uint8(0), // alpnMode
+		[]byte("hello world"),
+	)
+
+	// Parameters:
+	//   - cipherSuite (0-3): AES-128-GCM, AES-256-GCM, ChaCha20, default
+	//   - clientAuth (0-4): maps to tls.ClientAuthType
+	//   - messageToReplace: TLS message type byte to replace with fuzz data
+	//   - messageEncLevel (0-2): encryption level for replaced message (Initial, Handshake, 1-RTT)
+	//   - zeroRTTMode (0-3): 0=neither, 1=client, 2=server, 3=both
+	//   - postHandshakeTarget (0-3): 0=neither, 1=client, 2=server, 3=both
+	//   - invalidTP (0-3): 0=both valid, 1=client invalid, 2=server invalid, 3=both invalid
+	//   - sessionMode (0-3): 0=no cache, 1=cache+ticket+enabled, 2=cache+disabled, 3=cache+no ticket
+	//   - tlsCallbacks (0-15): getConfigForClient (val%4) x getCertificate (val/4)
+	//     each: 0=off, 1=return value, 2=return error, 3=return nil
+	//   - alpnMode (0-2): 0=correct, 1=wrong, 2=both correct and wrong
+	f.Fuzz(func(t *testing.T, cipherSuite, clientAuth, messageToReplace, messageEncLevel, zeroRTTMode, postHandshakeTarget, invalidTP, sessionMode, tlsCallbacks, alpnMode uint8, data []byte) {
+		if len(data) == 0 {
+			return
+		}
+		if cipherSuite > 3 || clientAuth > 4 || messageEncLevel > 2 || zeroRTTMode > 3 || postHandshakeTarget > 3 || invalidTP > 3 || sessionMode > 3 || tlsCallbacks > 15 || alpnMode > 2 {
+			return
+		}
+
+		clientConf := &tls.Config{
+			MinVersion: tls.VersionTLS13,
+			ServerName: "localhost",
+			NextProtos: []string{fuzzALPN},
+			RootCAs:    fuzzCertPool,
+		}
+		if sessionMode > 0 {
+			clientConf.ClientSessionCache = tls.NewLRUClientSessionCache(5)
+		}
+
+		fuzzRunHandshake(t, cipherSuite, clientAuth, messageToReplace, messageEncLevel, zeroRTTMode, postHandshakeTarget, invalidTP, sessionMode, tlsCallbacks, alpnMode, clientConf, data)
+		fuzzRunHandshake(t, cipherSuite, clientAuth, messageToReplace, messageEncLevel, zeroRTTMode, postHandshakeTarget, invalidTP, sessionMode, tlsCallbacks, alpnMode, clientConf, data)
+	})
+}
+
+func fuzzRunHandshake(
+	t *testing.T,
+	cipherSuiteVal, clientAuthVal, messageToReplace, messageEncLevelVal, zeroRTTMode, postHandshakeTarget, invalidTP, sessionMode, tlsCallbacks, alpnMode uint8,
+	clientConf *tls.Config,
+	data []byte,
+) {
+	t.Helper()
+
+	switch cipherSuiteVal {
+	case 0:
+		defer qtls.SetCipherSuite(tls.TLS_AES_128_GCM_SHA256)()
+	case 1:
+		defer qtls.SetCipherSuite(tls.TLS_AES_256_GCM_SHA384)()
+	case 2:
+		defer qtls.SetCipherSuite(tls.TLS_CHACHA20_POLY1305_SHA256)()
+	case 3:
+		// use default cipher suites
+	}
+
+	var tlsClientAuth tls.ClientAuthType
+	switch clientAuthVal {
+	case 0:
+		tlsClientAuth = tls.NoClientCert
+	case 1:
+		tlsClientAuth = tls.RequestClientCert
+	case 2:
+		tlsClientAuth = tls.RequireAnyClientCert
+	case 3:
+		tlsClientAuth = tls.VerifyClientCertIfGiven
+	case 4:
+		tlsClientAuth = tls.RequireAndVerifyClientCert
+	}
+
+	var msgEncLevel protocol.EncryptionLevel
+	switch messageEncLevelVal {
+	case 0:
+		msgEncLevel = protocol.EncryptionInitial
+	case 1:
+		msgEncLevel = protocol.EncryptionHandshake
+	case 2:
+		msgEncLevel = protocol.Encryption1RTT
+	}
+
+	serverConf := &tls.Config{
+		MinVersion:   tls.VersionTLS13,
+		Certificates: []tls.Certificate{*fuzzCert},
+		NextProtos:   []string{fuzzALPN},
+		ClientAuth:   tlsClientAuth,
+	}
+	serverConf.SetSessionTicketKeys([][32]byte{fuzzSessionTicketKey})
+
+	enable0RTTClient := zeroRTTMode == 1 || zeroRTTMode == 3
+	enable0RTTServer := zeroRTTMode == 2 || zeroRTTMode == 3
+	sendPostHandshakeToClient := postHandshakeTarget == 1 || postHandshakeTarget == 3
+	sendPostHandshakeToServer := postHandshakeTarget == 2 || postHandshakeTarget == 3
+
+	sendSessionTicket := sessionMode == 1
+	serverConf.SessionTicketsDisabled = sessionMode == 2
+
+	getConfigForClient := tlsCallbacks % 4
+	getCertificate := tlsCallbacks / 4
+
+	if getConfigForClient > 0 {
+		serverConf.GetConfigForClient = func(*tls.ClientHelloInfo) (*tls.Config, error) {
+			switch getConfigForClient {
+			case 1:
+				return serverConf, nil
+			case 2:
+				return nil, errors.New("getting client config failed")
+			case 3:
+				return nil, nil
+			}
+			return nil, nil
+		}
+	}
+	if getCertificate > 0 {
+		serverConf.GetCertificate = func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+			switch getCertificate {
+			case 1:
+				return fuzzAltCert, nil
+			case 2:
+				return nil, errors.New("getting certificate failed")
+			case 3:
+				return nil, nil
+			}
+			return nil, nil
+		}
+	}
+
+	switch alpnMode {
+	case 1:
+		serverConf.NextProtos = []string{"wrong"}
+	case 2:
+		serverConf.NextProtos = []string{"wrong", fuzzALPN}
+	}
+
+	clientTP := &wire.TransportParameters{
+		ActiveConnectionIDLimit:        2,
+		InitialMaxData:                 1 << 20,
+		InitialMaxStreamDataBidiLocal:  1 << 16,
+		InitialMaxStreamDataBidiRemote: 1 << 16,
+		InitialMaxStreamDataUni:        1 << 16,
+	}
+	serverTP := &wire.TransportParameters{
+		ActiveConnectionIDLimit:        2,
+		InitialMaxData:                 1 << 20,
+		InitialMaxStreamDataBidiLocal:  1 << 16,
+		InitialMaxStreamDataBidiRemote: 1 << 16,
+		InitialMaxStreamDataUni:        1 << 16,
+	}
+	if invalidTP == 1 || invalidTP == 3 {
+		clientTP.MaxAckDelay = protocol.MaxMaxAckDelay + 5
+	}
+	if invalidTP == 2 || invalidTP == 3 {
+		serverTP.MaxAckDelay = protocol.MaxMaxAckDelay + 5
+	}
+
+	client := NewCryptoSetupClient(
+		protocol.ConnectionID{},
+		clientTP,
+		clientConf,
+		enable0RTTClient,
+		&utils.RTTStats{},
+		nil,
+		utils.DefaultLogger.WithPrefix("client"),
+		protocol.Version1,
+	)
+	if err := client.StartHandshake(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer client.Close()
+
+	server := NewCryptoSetupServer(
+		protocol.ConnectionID{},
+		&net.UDPAddr{IP: net.IPv6loopback, Port: 1234},
+		&net.UDPAddr{IP: net.IPv6loopback, Port: 4321},
+		serverTP,
+		serverConf,
+		enable0RTTServer,
+		&utils.RTTStats{},
+		nil,
+		utils.DefaultLogger.WithPrefix("server"),
+		protocol.Version1,
+	)
+	if err := server.StartHandshake(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer server.Close()
+
+	var clientHandshakeComplete, serverHandshakeComplete bool
+	for {
+		var processedEvent bool
+	clientLoop:
+		for {
+			ev := client.NextEvent()
+			switch ev.Kind {
+			case EventNoEvent:
+				if !processedEvent && !clientHandshakeComplete {
+					return
+				}
+				break clientLoop
+			case EventWriteInitialData, EventWriteHandshakeData:
+				msg := ev.Data
+				encLevel := protocol.EncryptionInitial
+				if ev.Kind == EventWriteHandshakeData {
+					encLevel = protocol.EncryptionHandshake
+				}
+				if msg[0] == messageToReplace {
+					msg = data
+					encLevel = msgEncLevel
+				}
+				if err := server.HandleMessage(msg, encLevel); err != nil {
+					return
+				}
+			case EventHandshakeComplete:
+				clientHandshakeComplete = true
+			}
+			processedEvent = true
+		}
+		processedEvent = false
+	serverLoop:
+		for {
+			ev := server.NextEvent()
+			switch ev.Kind {
+			case EventNoEvent:
+				if !processedEvent && !serverHandshakeComplete {
+					return
+				}
+				break serverLoop
+			case EventWriteInitialData, EventWriteHandshakeData:
+				msg := ev.Data
+				encLevel := protocol.EncryptionInitial
+				if ev.Kind == EventWriteHandshakeData {
+					encLevel = protocol.EncryptionHandshake
+				}
+				if msg[0] == messageToReplace {
+					msg = data
+					encLevel = msgEncLevel
+				}
+				if err := client.HandleMessage(msg, encLevel); err != nil {
+					return
+				}
+			case EventHandshakeComplete:
+				serverHandshakeComplete = true
+			}
+			processedEvent = true
+		}
+
+		if serverHandshakeComplete && clientHandshakeComplete {
+			break
+		}
+	}
+
+	_ = client.ConnectionState()
+	_ = server.ConnectionState()
+
+	sealer, err := client.Get1RTTSealer()
+	if err != nil {
+		t.Fatal("expected to get a 1-RTT sealer")
+	}
+	opener, err := server.Get1RTTOpener()
+	if err != nil {
+		t.Fatal("expected to get a 1-RTT opener")
+	}
+	const plaintext = "Lorem ipsum dolor sit amet, consectetur adipiscing elit."
+	encrypted := sealer.Seal(nil, []byte(plaintext), 1337, []byte("foobar"))
+	decrypted, err := opener.Open(nil, encrypted, 0, 1337, protocol.KeyPhaseZero, []byte("foobar"))
+	if err != nil {
+		t.Fatalf("decrypting message failed: %s", err)
+	}
+	if string(decrypted) != plaintext {
+		t.Fatal("decrypted message doesn't match")
+	}
+
+	if sendSessionTicket && !serverConf.SessionTicketsDisabled {
+		ticket, err := server.GetSessionTicket()
+		if err != nil {
+			t.Fatalf("error getting session ticket: %s", err)
+		}
+		if ticket == nil {
+			t.Fatal("expected non-nil session ticket")
+		}
+		client.HandleMessage(ticket, protocol.Encryption1RTT)
+	}
+
+	if sendPostHandshakeToClient {
+		client.HandleMessage(data, msgEncLevel)
+	}
+	if sendPostHandshakeToServer {
+		server.HandleMessage(data, msgEncLevel)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/handshake_helpers_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/handshake_helpers_test.go
new file mode 100644
index 000000000..9949578ea
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/handshake_helpers_test.go
@@ -0,0 +1,41 @@
+package handshake
+
+import (
+	"crypto/fips140"
+	"crypto/tls"
+	"encoding/hex"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func splitHexString(t *testing.T, s string) (slice []byte) {
+	t.Helper()
+	for ss := range strings.SplitSeq(s, " ") {
+		if ss[0:2] == "0x" {
+			ss = ss[2:]
+		}
+		d, err := hex.DecodeString(ss)
+		require.NoError(t, err)
+		slice = append(slice, d...)
+	}
+	return
+}
+
+func TestSplitHexString(t *testing.T) {
+	require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, splitHexString(t, "0xdeadbeef"))
+	require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, splitHexString(t, "deadbeef"))
+	require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, splitHexString(t, "dead beef"))
+}
+
+var cipherSuites = []cipherSuite{
+	getCipherSuite(tls.TLS_AES_128_GCM_SHA256),
+	getCipherSuite(tls.TLS_AES_256_GCM_SHA384),
+}
+
+func init() {
+	if !fips140.Enabled() {
+		cipherSuites = append(cipherSuites, getCipherSuite(tls.TLS_CHACHA20_POLY1305_SHA256))
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/header_protector.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/header_protector.go
new file mode 100644
index 000000000..3ea7caf13
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/header_protector.go
@@ -0,0 +1,134 @@
+package handshake
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/tls"
+	"encoding/binary"
+	"fmt"
+
+	"golang.org/x/crypto/chacha20"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+type headerProtector interface {
+	EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte)
+	DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte)
+}
+
+func hkdfHeaderProtectionLabel(v protocol.Version) string {
+	if v == protocol.Version2 {
+		return "quicv2 hp"
+	}
+	return "quic hp"
+}
+
+func newHeaderProtector(suite cipherSuite, trafficSecret []byte, isLongHeader bool, v protocol.Version) headerProtector {
+	hkdfLabel := hkdfHeaderProtectionLabel(v)
+	switch suite.ID {
+	case tls.TLS_AES_128_GCM_SHA256, tls.TLS_AES_256_GCM_SHA384:
+		return newAESHeaderProtector(suite, trafficSecret, isLongHeader, hkdfLabel)
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		return newChaChaHeaderProtector(suite, trafficSecret, isLongHeader, hkdfLabel)
+	default:
+		panic(fmt.Sprintf("Invalid cipher suite id: %d", suite.ID))
+	}
+}
+
+type aesHeaderProtector struct {
+	mask         [16]byte // AES always has a 16 byte block size
+	block        cipher.Block
+	isLongHeader bool
+}
+
+var _ headerProtector = &aesHeaderProtector{}
+
+func newAESHeaderProtector(suite cipherSuite, trafficSecret []byte, isLongHeader bool, hkdfLabel string) headerProtector {
+	hpKey := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, hkdfLabel, suite.KeyLen)
+	block, err := aes.NewCipher(hpKey)
+	if err != nil {
+		panic(fmt.Sprintf("error creating new AES cipher: %s", err))
+	}
+	return &aesHeaderProtector{
+		block:        block,
+		isLongHeader: isLongHeader,
+	}
+}
+
+func (p *aesHeaderProtector) DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *aesHeaderProtector) EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *aesHeaderProtector) apply(sample []byte, firstByte *byte, hdrBytes []byte) {
+	if len(sample) != len(p.mask) {
+		panic("invalid sample size")
+	}
+	p.block.Encrypt(p.mask[:], sample)
+	if p.isLongHeader {
+		*firstByte ^= p.mask[0] & 0xf
+	} else {
+		*firstByte ^= p.mask[0] & 0x1f
+	}
+	for i := range hdrBytes {
+		hdrBytes[i] ^= p.mask[i+1]
+	}
+}
+
+type chachaHeaderProtector struct {
+	mask [5]byte
+
+	key          [32]byte
+	isLongHeader bool
+}
+
+var _ headerProtector = &chachaHeaderProtector{}
+
+func newChaChaHeaderProtector(suite cipherSuite, trafficSecret []byte, isLongHeader bool, hkdfLabel string) headerProtector {
+	hpKey := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, hkdfLabel, suite.KeyLen)
+
+	p := &chachaHeaderProtector{
+		isLongHeader: isLongHeader,
+	}
+	copy(p.key[:], hpKey)
+	return p
+}
+
+func (p *chachaHeaderProtector) DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *chachaHeaderProtector) EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *chachaHeaderProtector) apply(sample []byte, firstByte *byte, hdrBytes []byte) {
+	if len(sample) != 16 {
+		panic("invalid sample size")
+	}
+	for i := range 5 {
+		p.mask[i] = 0
+	}
+	cipher, err := chacha20.NewUnauthenticatedCipher(p.key[:], sample[4:])
+	if err != nil {
+		panic(err)
+	}
+	cipher.SetCounter(binary.LittleEndian.Uint32(sample[:4]))
+	cipher.XORKeyStream(p.mask[:], p.mask[:])
+	p.applyMask(firstByte, hdrBytes)
+}
+
+func (p *chachaHeaderProtector) applyMask(firstByte *byte, hdrBytes []byte) {
+	if p.isLongHeader {
+		*firstByte ^= p.mask[0] & 0xf
+	} else {
+		*firstByte ^= p.mask[0] & 0x1f
+	}
+	for i := range hdrBytes {
+		hdrBytes[i] ^= p.mask[i+1]
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/hkdf.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/hkdf.go
new file mode 100644
index 000000000..b28c1f1d7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/hkdf.go
@@ -0,0 +1,26 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/hkdf"
+	"encoding/binary"
+	"fmt"
+)
+
+// hkdfExpandLabel HKDF expands a label as defined in RFC 8446, section 7.1.
+func hkdfExpandLabel(hash crypto.Hash, secret, context []byte, label string, length int) []byte {
+	b := make([]byte, 3, 3+6+len(label)+1+len(context))
+	binary.BigEndian.PutUint16(b, uint16(length))
+	b[2] = uint8(6 + len(label))
+	b = append(b, []byte("tls13 ")...)
+	b = append(b, []byte(label)...)
+	b = b[:3+6+len(label)+1]
+	b[3+6+len(label)] = uint8(len(context))
+	b = append(b, context...)
+
+	expanded, err := hkdf.Expand(hash.New, secret, string(b), length)
+	if err != nil {
+		panic(fmt.Errorf("quic: HKDF-Expand-Label invocation failed unexpectedly: %v", err))
+	}
+	return expanded
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/hkdf_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/hkdf_test.go
new file mode 100644
index 000000000..e43084f3d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/hkdf_test.go
@@ -0,0 +1,76 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/tls"
+	"testing"
+	"unsafe"
+
+	"github.com/stretchr/testify/require"
+)
+
+var tls13CipherSuites = []uint16{tls.TLS_AES_128_GCM_SHA256, tls.TLS_AES_256_GCM_SHA384, tls.TLS_CHACHA20_POLY1305_SHA256}
+
+type cipherSuiteTLS13 struct {
+	ID     uint16
+	KeyLen int
+	AEAD   func(key, fixedNonce []byte) cipher.AEAD
+	Hash   crypto.Hash
+}
+
+//go:linkname cipherSuitesTLS13 crypto/tls.cipherSuitesTLS13
+var cipherSuitesTLS13 []unsafe.Pointer
+
+func cipherSuiteTLS13ByID(id uint16) *cipherSuiteTLS13 {
+	for _, v := range cipherSuitesTLS13 {
+		cs := (*cipherSuiteTLS13)(v)
+		if cs.ID == id {
+			return cs
+		}
+	}
+	return nil
+}
+
+//go:linkname nextTrafficSecret crypto/tls.(*cipherSuiteTLS13).nextTrafficSecret
+func nextTrafficSecret(cs *cipherSuiteTLS13, trafficSecret []byte) []byte
+
+func TestHKDF(t *testing.T) {
+	for _, id := range tls13CipherSuites {
+		t.Run(tls.CipherSuiteName(id), func(t *testing.T) {
+			cs := cipherSuiteTLS13ByID(id)
+			expected := nextTrafficSecret(cs, []byte("foobar"))
+			expanded := hkdfExpandLabel(cs.Hash, []byte("foobar"), nil, "traffic upd", cs.Hash.Size())
+			require.Equal(t, expected, expanded)
+		})
+	}
+}
+
+// As of Go 1.24, the standard library and our implementation of hkdfExpandLabel should provide the same performance.
+func BenchmarkHKDFExpandLabelStandardLibrary(b *testing.B) {
+	for _, id := range tls13CipherSuites {
+		b.Run(tls.CipherSuiteName(id), func(b *testing.B) { benchmarkHKDFExpandLabel(b, id, true) })
+	}
+}
+
+func BenchmarkHKDFExpandLabelOurs(b *testing.B) {
+	for _, id := range tls13CipherSuites {
+		b.Run(tls.CipherSuiteName(id), func(b *testing.B) { benchmarkHKDFExpandLabel(b, id, false) })
+	}
+}
+
+func benchmarkHKDFExpandLabel(b *testing.B, cipherSuite uint16, useStdLib bool) {
+	b.ReportAllocs()
+	cs := cipherSuiteTLS13ByID(cipherSuite)
+	secret := make([]byte, 32)
+	rand.Read(secret)
+
+	for b.Loop() {
+		if useStdLib {
+			nextTrafficSecret(cs, secret)
+		} else {
+			hkdfExpandLabel(cs.Hash, secret, nil, "traffic upd", cs.Hash.Size())
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/initial_aead.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/initial_aead.go
new file mode 100644
index 000000000..a8a94fe84
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/initial_aead.go
@@ -0,0 +1,81 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/fips140"
+	"crypto/hkdf"
+	"crypto/tls"
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+var (
+	quicSaltV1 = []byte{0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17, 0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a}
+	quicSaltV2 = []byte{0x0d, 0xed, 0xe3, 0xde, 0xf7, 0x00, 0xa6, 0xdb, 0x81, 0x93, 0x81, 0xbe, 0x6e, 0x26, 0x9d, 0xcb, 0xf9, 0xbd, 0x2e, 0xd9}
+)
+
+const (
+	hkdfLabelKeyV1 = "quic key"
+	hkdfLabelKeyV2 = "quicv2 key"
+	hkdfLabelIVV1  = "quic iv"
+	hkdfLabelIVV2  = "quicv2 iv"
+)
+
+var initialSuite = getCipherSuite(tls.TLS_AES_128_GCM_SHA256)
+
+// NewInitialAEAD creates a new AEAD for Initial encryption / decryption.
+func NewInitialAEAD(connID protocol.ConnectionID, pers protocol.Perspective, v protocol.Version) (LongHeaderSealer, LongHeaderOpener) {
+	var sealer LongHeaderSealer
+	var opener LongHeaderOpener
+	// The keys for the Initial AEAD are derived from the connection ID and constants defined in RFC 9001, Section 5.2.
+	// By design, the Initial encryption level provides no confidentiality against any attacker who has read the RFC.
+	// Its sole purpose is integrity protection. The Initial encryption level is therefore out of scope for FIPS 140.
+	// See also this thread on the IETF QUIC mailing list: https://mailarchive.ietf.org/arch/msg/quic/k2kl2W_n5WDEZBbt3O31Ef2XBbM.
+	fips140.WithoutEnforcement(func() {
+		clientSecret, serverSecret := computeSecrets(connID, v)
+		var mySecret, otherSecret []byte
+		if pers == protocol.PerspectiveClient {
+			mySecret = clientSecret
+			otherSecret = serverSecret
+		} else {
+			mySecret = serverSecret
+			otherSecret = clientSecret
+		}
+		myKey, myIV := computeInitialKeyAndIV(mySecret, v)
+		otherKey, otherIV := computeInitialKeyAndIV(otherSecret, v)
+
+		encrypter := initialSuite.AEAD(myKey, myIV)
+		decrypter := initialSuite.AEAD(otherKey, otherIV)
+
+		sealer = newLongHeaderSealer(encrypter, newHeaderProtector(initialSuite, mySecret, true, v))
+		opener = newLongHeaderOpener(decrypter, newHeaderProtector(initialSuite, otherSecret, true, v))
+	})
+	return sealer, opener
+}
+
+func computeSecrets(connID protocol.ConnectionID, v protocol.Version) (clientSecret, serverSecret []byte) {
+	salt := quicSaltV1
+	if v == protocol.Version2 {
+		salt = quicSaltV2
+	}
+	initialSecret, err := hkdf.Extract(crypto.SHA256.New, connID.Bytes(), salt)
+	if err != nil {
+		panic(fmt.Errorf("quic: HKDF-Extract invocation failed unexpectedly: %v", err))
+	}
+	clientSecret = hkdfExpandLabel(crypto.SHA256, initialSecret, []byte{}, "client in", crypto.SHA256.Size())
+	serverSecret = hkdfExpandLabel(crypto.SHA256, initialSecret, []byte{}, "server in", crypto.SHA256.Size())
+	return
+}
+
+func computeInitialKeyAndIV(secret []byte, v protocol.Version) (key, iv []byte) {
+	keyLabel := hkdfLabelKeyV1
+	ivLabel := hkdfLabelIVV1
+	if v == protocol.Version2 {
+		keyLabel = hkdfLabelKeyV2
+		ivLabel = hkdfLabelIVV2
+	}
+	key = hkdfExpandLabel(crypto.SHA256, secret, []byte{}, keyLabel, 16)
+	iv = hkdfExpandLabel(crypto.SHA256, secret, []byte{}, ivLabel, 12)
+	return
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/initial_aead_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/initial_aead_test.go
new file mode 100644
index 000000000..21ee92845
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/initial_aead_test.go
@@ -0,0 +1,317 @@
+package handshake
+
+import (
+	"bytes"
+	"crypto/rand"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestComputeClientKeyAndIV(t *testing.T) {
+	connID := protocol.ParseConnectionID(splitHexString(t, "0x8394c8f03e515708"))
+
+	tests := []struct {
+		name                 string
+		version              protocol.Version
+		expectedClientSecret []byte
+		expectedKey          []byte
+		expectedIV           []byte
+	}{
+		{
+			name:                 "QUIC v1",
+			version:              protocol.Version1,
+			expectedClientSecret: splitHexString(t, "c00cf151ca5be075ed0ebfb5c80323c4 2d6b7db67881289af4008f1f6c357aea"),
+			expectedKey:          splitHexString(t, "1f369613dd76d5467730efcbe3b1a22d"),
+			expectedIV:           splitHexString(t, "fa044b2f42a3fd3b46fb255c"),
+		},
+		{
+			name:                 "QUIC v2",
+			version:              protocol.Version2,
+			expectedClientSecret: splitHexString(t, "14ec9d6eb9fd7af83bf5a668bc17a7e2 83766aade7ecd0891f70f9ff7f4bf47b"),
+			expectedKey:          splitHexString(t, "8b1a0bc121284290a29e0971b5cd045d"),
+			expectedIV:           splitHexString(t, "91f73e2351d8fa91660e909f"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			clientSecret, _ := computeSecrets(connID, tt.version)
+			require.Equal(t, tt.expectedClientSecret, clientSecret)
+			key, iv := computeInitialKeyAndIV(clientSecret, tt.version)
+			require.Equal(t, tt.expectedKey, key)
+			require.Equal(t, tt.expectedIV, iv)
+		})
+	}
+}
+
+func TestComputeServerKeyAndIV(t *testing.T) {
+	connID := protocol.ParseConnectionID(splitHexString(t, "0x8394c8f03e515708"))
+
+	tests := []struct {
+		name                 string
+		version              protocol.Version
+		expectedServerSecret []byte
+		expectedKey          []byte
+		expectedIV           []byte
+	}{
+		{
+			name:                 "QUIC v1",
+			version:              protocol.Version1,
+			expectedServerSecret: splitHexString(t, "3c199828fd139efd216c155ad844cc81 fb82fa8d7446fa7d78be803acdda951b"),
+			expectedKey:          splitHexString(t, "cf3a5331653c364c88f0f379b6067e37"),
+			expectedIV:           splitHexString(t, "0ac1493ca1905853b0bba03e"),
+		},
+		{
+			name:                 "QUIC v2",
+			version:              protocol.Version2,
+			expectedServerSecret: splitHexString(t, "0263db1782731bf4588e7e4d93b74639 07cb8cd8200b5da55a8bd488eafc37c1"),
+			expectedKey:          splitHexString(t, "82db637861d55e1d011f19ea71d5d2a7"),
+			expectedIV:           splitHexString(t, "dd13c276499c0249d3310652"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, serverSecret := computeSecrets(connID, tt.version)
+			require.Equal(t, tt.expectedServerSecret, serverSecret)
+			key, iv := computeInitialKeyAndIV(serverSecret, tt.version)
+			require.Equal(t, tt.expectedKey, key)
+			require.Equal(t, tt.expectedIV, iv)
+		})
+	}
+}
+
+func TestClientInitial(t *testing.T) {
+	connID := protocol.ParseConnectionID(splitHexString(t, "0x8394c8f03e515708"))
+
+	tests := []struct {
+		version              protocol.Version
+		header               []byte
+		data                 []byte
+		expectedSample       []byte
+		expectedHdrFirstByte byte
+		expectedHdr          []byte
+		expectedPacket       []byte
+	}{
+		{
+			version:              protocol.Version1,
+			header:               splitHexString(t, "c300000001088394c8f03e5157080000449e00000002"),
+			data:                 splitHexString(t, "060040f1010000ed0303ebf8fa56f129 39b9584a3896472ec40bb863cfd3e868 04fe3a47f06a2b69484c000004130113 02010000c000000010000e00000b6578 616d706c652e636f6dff01000100000a 00080006001d00170018001000070005 04616c706e0005000501000000000033 00260024001d00209370b2c9caa47fba baf4559fedba753de171fa71f50f1ce1 5d43e994ec74d748002b000302030400 0d0010000e0403050306030203080408 050806002d00020101001c0002400100 3900320408ffffffffffffffff050480 00ffff07048000ffff08011001048000 75300901100f088394c8f03e51570806 048000ffff"),
+			expectedSample:       splitHexString(t, "d1b1c98dd7689fb8ec11d242b123dc9b"),
+			expectedHdrFirstByte: byte(0xc0),
+			expectedHdr:          splitHexString(t, "7b9aec34"),
+			expectedPacket:       splitHexString(t, "c000000001088394c8f03e5157080000 449e7b9aec34d1b1c98dd7689fb8ec11 d242b123dc9bd8bab936b47d92ec356c 0bab7df5976d27cd449f63300099f399 1c260ec4c60d17b31f8429157bb35a12 82a643a8d2262cad67500cadb8e7378c 8eb7539ec4d4905fed1bee1fc8aafba1 7c750e2c7ace01e6005f80fcb7df6212 30c83711b39343fa028cea7f7fb5ff89 eac2308249a02252155e2347b63d58c5 457afd84d05dfffdb20392844ae81215 4682e9cf012f9021a6f0be17ddd0c208 4dce25ff9b06cde535d0f920a2db1bf3 62c23e596d11a4f5a6cf3948838a3aec 4e15daf8500a6ef69ec4e3feb6b1d98e 610ac8b7ec3faf6ad760b7bad1db4ba3 485e8a94dc250ae3fdb41ed15fb6a8e5 eba0fc3dd60bc8e30c5c4287e53805db 059ae0648db2f64264ed5e39be2e20d8 2df566da8dd5998ccabdae053060ae6c 7b4378e846d29f37ed7b4ea9ec5d82e7 961b7f25a9323851f681d582363aa5f8 9937f5a67258bf63ad6f1a0b1d96dbd4 faddfcefc5266ba6611722395c906556 be52afe3f565636ad1b17d508b73d874 3eeb524be22b3dcbc2c7468d54119c74 68449a13d8e3b95811a198f3491de3e7 fe942b330407abf82a4ed7c1b311663a c69890f4157015853d91e923037c227a 33cdd5ec281ca3f79c44546b9d90ca00 f064c99e3dd97911d39fe9c5d0b23a22 9a234cb36186c4819e8b9c5927726632 291d6a418211cc2962e20fe47feb3edf 330f2c603a9d48c0fcb5699dbfe58964 25c5bac4aee82e57a85aaf4e2513e4f0 5796b07ba2ee47d80506f8d2c25e50fd 14de71e6c418559302f939b0e1abd576 f279c4b2e0feb85c1f28ff18f58891ff ef132eef2fa09346aee33c28eb130ff2 8f5b766953334113211996d20011a198 e3fc433f9f2541010ae17c1bf202580f 6047472fb36857fe843b19f5984009dd c324044e847a4f4a0ab34f719595de37 252d6235365e9b84392b061085349d73 203a4a13e96f5432ec0fd4a1ee65accd d5e3904df54c1da510b0ff20dcc0c77f cb2c0e0eb605cb0504db87632cf3d8b4 dae6e705769d1de354270123cb11450e fc60ac47683d7b8d0f811365565fd98c 4c8eb936bcab8d069fc33bd801b03ade a2e1fbc5aa463d08ca19896d2bf59a07 1b851e6c239052172f296bfb5e724047 90a2181014f3b94a4e97d117b4381303 68cc39dbb2d198065ae3986547926cd2 162f40a29f0c3c8745c0f50fba3852e5 66d44575c29d39a03f0cda721984b6f4 40591f355e12d439ff150aab7613499d bd49adabc8676eef023b15b65bfc5ca0 6948109f23f350db82123535eb8a7433 bdabcb909271a6ecbcb58b936a88cd4e 8f2e6ff5800175f113253d8fa9ca8885 c2f552e657dc603f252e1a8e308f76f0 be79e2fb8f5d5fbbe2e30ecadd220723 c8c0aea8078cdfcb3868263ff8f09400 54da48781893a7e49ad5aff4af300cd8 04a6b6279ab3ff3afb64491c85194aab 760d58a606654f9f4400e8b38591356f bf6425aca26dc85244259ff2b19c41b9 f96f3ca9ec1dde434da7d2d392b905dd f3d1f9af93d1af5950bd493f5aa731b4 056df31bd267b6b90a079831aaf579be 0a39013137aac6d404f518cfd4684064 7e78bfe706ca4cf5e9c5453e9f7cfd2b 8b4c8d169a44e55c88d4a9a7f9474241 e221af44860018ab0856972e194cd934"),
+		},
+		{
+			version:              protocol.Version2,
+			header:               splitHexString(t, "d36b3343cf088394c8f03e5157080000449e00000002"),
+			data:                 splitHexString(t, "060040f1010000ed0303ebf8fa56f129 39b9584a3896472ec40bb863cfd3e868 04fe3a47f06a2b69484c000004130113 02010000c000000010000e00000b6578 616d706c652e636f6dff01000100000a 00080006001d00170018001000070005 04616c706e0005000501000000000033 00260024001d00209370b2c9caa47fba baf4559fedba753de171fa71f50f1ce1 5d43e994ec74d748002b000302030400 0d0010000e0403050306030203080408 050806002d00020101001c0002400100 3900320408ffffffffffffffff050480 00ffff07048000ffff08011001048000 75300901100f088394c8f03e51570806 048000ffff"),
+			expectedSample:       splitHexString(t, "ffe67b6abcdb4298b485dd04de806071"),
+			expectedHdrFirstByte: byte(0xd7),
+			expectedHdr:          splitHexString(t, "a0c95e82"),
+			expectedPacket:       splitHexString(t, "d76b3343cf088394c8f03e5157080000 449ea0c95e82ffe67b6abcdb4298b485 dd04de806071bf03dceebfa162e75d6c 96058bdbfb127cdfcbf903388e99ad04 9f9a3dd4425ae4d0992cfff18ecf0fdb 5a842d09747052f17ac2053d21f57c5d 250f2c4f0e0202b70785b7946e992e58 a59ac52dea6774d4f03b55545243cf1a 12834e3f249a78d395e0d18f4d766004 f1a2674802a747eaa901c3f10cda5500 cb9122faa9f1df66c392079a1b40f0de 1c6054196a11cbea40afb6ef5253cd68 18f6625efce3b6def6ba7e4b37a40f77 32e093daa7d52190935b8da58976ff33 12ae50b187c1433c0f028edcc4c2838b 6a9bfc226ca4b4530e7a4ccee1bfa2a3 d396ae5a3fb512384b2fdd851f784a65 e03f2c4fbe11a53c7777c023462239dd 6f7521a3f6c7d5dd3ec9b3f233773d4b 46d23cc375eb198c63301c21801f6520 bcfb7966fc49b393f0061d974a2706df 8c4a9449f11d7f3d2dcbb90c6b877045 636e7c0c0fe4eb0f697545460c806910 d2c355f1d253bc9d2452aaa549e27a1f ac7cf4ed77f322e8fa894b6a83810a34 b361901751a6f5eb65a0326e07de7c12 16ccce2d0193f958bb3850a833f7ae43 2b65bc5a53975c155aa4bcb4f7b2c4e5 4df16efaf6ddea94e2c50b4cd1dfe060 17e0e9d02900cffe1935e0491d77ffb4 fdf85290fdd893d577b1131a610ef6a5 c32b2ee0293617a37cbb08b847741c3b 8017c25ca9052ca1079d8b78aebd4787 6d330a30f6a8c6d61dd1ab5589329de7 14d19d61370f8149748c72f132f0fc99 f34d766c6938597040d8f9e2bb522ff9 9c63a344d6a2ae8aa8e51b7b90a4a806 105fcbca31506c446151adfeceb51b91 abfe43960977c87471cf9ad4074d30e1 0d6a7f03c63bd5d4317f68ff325ba3bd 80bf4dc8b52a0ba031758022eb025cdd 770b44d6d6cf0670f4e990b22347a7db 848265e3e5eb72dfe8299ad7481a4083 22cac55786e52f633b2fb6b614eaed18 d703dd84045a274ae8bfa73379661388 d6991fe39b0d93debb41700b41f90a15 c4d526250235ddcd6776fc77bc97e7a4 17ebcb31600d01e57f32162a8560cacc 7e27a096d37a1a86952ec71bd89a3e9a 30a2a26162984d7740f81193e8238e61 f6b5b984d4d3dfa033c1bb7e4f0037fe bf406d91c0dccf32acf423cfa1e70710 10d3f270121b493ce85054ef58bada42 310138fe081adb04e2bd901f2f13458b 3d6758158197107c14ebb193230cd115 7380aa79cae1374a7c1e5bbcb80ee23e 06ebfde206bfb0fcbc0edc4ebec30966 1bdd908d532eb0c6adc38b7ca7331dce 8dfce39ab71e7c32d318d136b6100671 a1ae6a6600e3899f31f0eed19e3417d1 34b90c9058f8632c798d4490da498730 7cba922d61c39805d072b589bd52fdf1 e86215c2d54e6670e07383a27bbffb5a ddf47d66aa85a0c6f9f32e59d85a44dd 5d3b22dc2be80919b490437ae4f36a0a e55edf1d0b5cb4e9a3ecabee93dfc6e3 8d209d0fa6536d27a5d6fbb17641cde2 7525d61093f1b28072d111b2b4ae5f89 d5974ee12e5cf7d5da4d6a31123041f3 3e61407e76cffcdcfd7e19ba58cf4b53 6f4c4938ae79324dc402894b44faf8af bab35282ab659d13c93f70412e85cb19 9a37ddec600545473cfb5a05e08d0b20 9973b2172b4d21fb69745a262ccde96b a18b2faa745b6fe189cf772a9f84cbfc"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.version.String(), func(t *testing.T) {
+			sealer, _ := NewInitialAEAD(connID, protocol.PerspectiveClient, tt.version)
+			tt.data = append(tt.data, make([]byte, 1162-len(tt.data))...) // add PADDING
+			sealed := sealer.Seal(nil, tt.data, 2, tt.header)
+			sample := sealed[0:16]
+			require.Equal(t, tt.expectedSample, sample)
+			sealer.EncryptHeader(sample, &tt.header[0], tt.header[len(tt.header)-4:])
+			require.Equal(t, tt.expectedHdrFirstByte, tt.header[0])
+			require.Equal(t, tt.expectedHdr, tt.header[len(tt.header)-4:])
+			packet := append(tt.header, sealed...)
+			require.Equal(t, tt.expectedPacket, packet)
+		})
+	}
+}
+
+func TestServersInitial(t *testing.T) {
+	connID := protocol.ParseConnectionID(splitHexString(t, "0x8394c8f03e515708"))
+
+	testCases := []struct {
+		name           string
+		version        protocol.Version
+		header         []byte
+		data           []byte
+		expectedSample []byte
+		expectedHdr    []byte
+		expectedPacket []byte
+	}{
+		{
+			name:           "QUIC v1",
+			version:        protocol.Version1,
+			header:         splitHexString(t, "c1000000010008f067a5502a4262b50040750001"),
+			data:           splitHexString(t, "02000000000600405a020000560303ee fce7f7b37ba1d1632e96677825ddf739 88cfc79825df566dc5430b9a045a1200 130100002e00330024001d00209d3c94 0d89690b84d08a60993c144eca684d10 81287c834d5311bcf32bb9da1a002b00 020304"),
+			expectedSample: splitHexString(t, "2cd0991cd25b0aac406a5816b6394100"),
+			expectedHdr:    splitHexString(t, "cf000000010008f067a5502a4262b5004075c0d9"),
+			expectedPacket: splitHexString(t, "cf000000010008f067a5502a4262b500 4075c0d95a482cd0991cd25b0aac406a 5816b6394100f37a1c69797554780bb3 8cc5a99f5ede4cf73c3ec2493a1839b3 dbcba3f6ea46c5b7684df3548e7ddeb9 c3bf9c73cc3f3bded74b562bfb19fb84 022f8ef4cdd93795d77d06edbb7aaf2f 58891850abbdca3d20398c276456cbc4 2158407dd074ee"),
+		},
+		{
+			name:           "QUIC v2",
+			version:        protocol.Version2,
+			header:         splitHexString(t, "d16b3343cf0008f067a5502a4262b50040750001"),
+			data:           splitHexString(t, "02000000000600405a020000560303ee fce7f7b37ba1d1632e96677825ddf739 88cfc79825df566dc5430b9a045a1200 130100002e00330024001d00209d3c94 0d89690b84d08a60993c144eca684d10 81287c834d5311bcf32bb9da1a002b00 020304"),
+			expectedSample: splitHexString(t, "6f05d8a4398c47089698baeea26b91eb"),
+			expectedHdr:    splitHexString(t, "dc6b3343cf0008f067a5502a4262b5004075d92f"),
+			expectedPacket: splitHexString(t, "dc6b3343cf0008f067a5502a4262b500 4075d92faaf16f05d8a4398c47089698 baeea26b91eb761d9b89237bbf872630 17915358230035f7fd3945d88965cf17 f9af6e16886c61bfc703106fbaf3cb4c fa52382dd16a393e42757507698075b2 c984c707f0a0812d8cd5a6881eaf21ce da98f4bd23f6fe1a3e2c43edd9ce7ca8 4bed8521e2e140"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			sealer, _ := NewInitialAEAD(connID, protocol.PerspectiveServer, tc.version)
+			sealed := sealer.Seal(nil, tc.data, 1, tc.header)
+			sample := sealed[2 : 2+16]
+			require.Equal(t, tc.expectedSample, sample)
+			sealer.EncryptHeader(sample, &tc.header[0], tc.header[len(tc.header)-2:])
+			require.Equal(t, tc.expectedHdr, tc.header)
+			packet := append(tc.header, sealed...)
+			require.Equal(t, tc.expectedPacket, packet)
+		})
+	}
+}
+
+func TestInitialAEADSealsAndOpens(t *testing.T) {
+	for _, ver := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		t.Run(ver.String(), func(t *testing.T) {
+			connectionID := protocol.ParseConnectionID([]byte{0x12, 0x34, 0x56, 0x78, 0x90, 0xab, 0xcd, 0xef})
+			clientSealer, clientOpener := NewInitialAEAD(connectionID, protocol.PerspectiveClient, ver)
+			serverSealer, serverOpener := NewInitialAEAD(connectionID, protocol.PerspectiveServer, ver)
+
+			clientMessage := clientSealer.Seal(nil, []byte("foobar"), 42, []byte("aad"))
+			m, err := serverOpener.Open(nil, clientMessage, 42, []byte("aad"))
+			require.NoError(t, err)
+			require.Equal(t, []byte("foobar"), m)
+			serverMessage := serverSealer.Seal(nil, []byte("raboof"), 99, []byte("daa"))
+			m, err = clientOpener.Open(nil, serverMessage, 99, []byte("daa"))
+			require.NoError(t, err)
+			require.Equal(t, []byte("raboof"), m)
+		})
+	}
+}
+
+func TestInitialAEADFailsWithDifferentConnectionIDs(t *testing.T) {
+	for _, ver := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		t.Run(ver.String(), func(t *testing.T) {
+			c1 := protocol.ParseConnectionID([]byte{0, 0, 0, 0, 0, 0, 0, 1})
+			c2 := protocol.ParseConnectionID([]byte{0, 0, 0, 0, 0, 0, 0, 2})
+			clientSealer, _ := NewInitialAEAD(c1, protocol.PerspectiveClient, ver)
+			_, serverOpener := NewInitialAEAD(c2, protocol.PerspectiveServer, ver)
+
+			clientMessage := clientSealer.Seal(nil, []byte("foobar"), 42, []byte("aad"))
+			_, err := serverOpener.Open(nil, clientMessage, 42, []byte("aad"))
+			require.Equal(t, ErrDecryptionFailed, err)
+		})
+	}
+}
+
+func TestInitialAEADEncryptsAndDecryptsHeader(t *testing.T) {
+	for _, ver := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		t.Run(ver.String(), func(t *testing.T) {
+			connID := protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad})
+			clientSealer, clientOpener := NewInitialAEAD(connID, protocol.PerspectiveClient, ver)
+			serverSealer, serverOpener := NewInitialAEAD(connID, protocol.PerspectiveServer, ver)
+
+			header := []byte{0x5e, 0, 1, 2, 3, 4, 0xde, 0xad, 0xbe, 0xef}
+			sample := make([]byte, 16)
+			rand.Read(sample)
+			clientSealer.EncryptHeader(sample, &header[0], header[6:10])
+			require.Equal(t, byte(0x5e&0xf0), header[0]&0xf0)
+			require.Equal(t, []byte{0, 1, 2, 3, 4}, header[1:6])
+			require.NotEqual(t, []byte{0xde, 0xad, 0xbe, 0xef}, header[6:10])
+			serverOpener.DecryptHeader(sample, &header[0], header[6:10])
+			require.Equal(t, byte(0x5e), header[0])
+			require.Equal(t, []byte{0, 1, 2, 3, 4}, header[1:6])
+			require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, header[6:10])
+
+			serverSealer.EncryptHeader(sample, &header[0], header[6:10])
+			require.Equal(t, byte(0x5e&0xf0), header[0]&0xf0)
+			require.Equal(t, []byte{0, 1, 2, 3, 4}, header[1:6])
+			require.NotEqual(t, []byte{0xde, 0xad, 0xbe, 0xef}, header[6:10])
+			clientOpener.DecryptHeader(sample, &header[0], header[6:10])
+			require.Equal(t, byte(0x5e), header[0])
+			require.Equal(t, []byte{0, 1, 2, 3, 4}, header[1:6])
+			require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, header[6:10])
+		})
+	}
+}
+
+func BenchmarkInitialAEADCreate(b *testing.B) {
+	b.ReportAllocs()
+	connID := protocol.ParseConnectionID([]byte{0x12, 0x34, 0x56, 0x78, 0x90, 0xab, 0xcd, 0xef})
+
+	for b.Loop() {
+		NewInitialAEAD(connID, protocol.PerspectiveServer, protocol.Version1)
+	}
+}
+
+func BenchmarkInitialAEAD(b *testing.B) {
+	connectionID := protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb, 0xc, 0xd})
+	clientSealer, _ := NewInitialAEAD(connectionID, protocol.PerspectiveClient, protocol.Version1)
+	_, serverOpener := NewInitialAEAD(connectionID, protocol.PerspectiveServer, protocol.Version1)
+
+	packetData := make([]byte, 1200)
+	rand.Read(packetData)
+	hdr := make([]byte, 50)
+	rand.Read(hdr)
+	msg := clientSealer.Seal(nil, packetData, 42, hdr)
+	m, err := serverOpener.Open(nil, msg, 42, hdr)
+	if err != nil {
+		b.Fatalf("opening failed: %s", err)
+	}
+	if !bytes.Equal(m, packetData) {
+		b.Fatal("decrypted data doesn't match")
+	}
+
+	b.ResetTimer()
+	b.Run("opening 100 bytes", func(b *testing.B) {
+		sealer, _ := NewInitialAEAD(connectionID, protocol.PerspectiveClient, protocol.Version1)
+		_, opener := NewInitialAEAD(connectionID, protocol.PerspectiveServer, protocol.Version1)
+		benchmarkOpen(b, opener, sealer.Seal(nil, packetData[:100], 42, hdr), 42, hdr)
+	})
+	b.Run("opening 1200 bytes", func(b *testing.B) {
+		sealer, _ := NewInitialAEAD(connectionID, protocol.PerspectiveClient, protocol.Version1)
+		_, opener := NewInitialAEAD(connectionID, protocol.PerspectiveServer, protocol.Version1)
+		benchmarkOpen(b, opener, sealer.Seal(nil, packetData, 42, hdr), 42, hdr)
+	})
+
+	b.Run("sealing 100 bytes", func(b *testing.B) {
+		sealer, _ := NewInitialAEAD(connectionID, protocol.PerspectiveClient, protocol.Version1)
+		benchmarkSeal(b, sealer, packetData[:100], hdr)
+	})
+	b.Run("sealing 1200 bytes", func(b *testing.B) {
+		sealer, _ := NewInitialAEAD(connectionID, protocol.PerspectiveClient, protocol.Version1)
+		benchmarkSeal(b, sealer, packetData, hdr)
+	})
+}
+
+func benchmarkOpen(b *testing.B, aead LongHeaderOpener, msg []byte, pn protocol.PacketNumber, hdr []byte) {
+	b.ReportAllocs()
+	dst := make([]byte, 0, 1500)
+
+	for b.Loop() {
+		dst = dst[:0]
+		if _, err := aead.Open(dst, msg, pn, hdr); err != nil {
+			b.Fatalf("opening failed: %s", err)
+		}
+	}
+}
+
+func benchmarkSeal(b *testing.B, aead LongHeaderSealer, msg, hdr []byte) {
+	b.ReportAllocs()
+	dst := make([]byte, 0, 1500)
+
+	var pn protocol.PacketNumber
+	for b.Loop() {
+		dst = dst[:0]
+		aead.Seal(dst, msg, pn, hdr)
+		pn++
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/interface.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/interface.go
new file mode 100644
index 000000000..177859d14
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/interface.go
@@ -0,0 +1,147 @@
+package handshake
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+var (
+	// ErrKeysNotYetAvailable is returned when an opener or a sealer is requested for an encryption level,
+	// but the corresponding opener has not yet been initialized
+	// This can happen when packets arrive out of order.
+	ErrKeysNotYetAvailable = errors.New("CryptoSetup: keys at this encryption level not yet available")
+	// ErrKeysDropped is returned when an opener or a sealer is requested for an encryption level,
+	// but the corresponding keys have already been dropped.
+	ErrKeysDropped = errors.New("CryptoSetup: keys were already dropped")
+	// ErrDecryptionFailed is returned when the AEAD fails to open the packet.
+	ErrDecryptionFailed = errors.New("decryption failed")
+)
+
+type headerDecryptor interface {
+	DecryptHeader(sample []byte, firstByte *byte, pnBytes []byte)
+}
+
+// LongHeaderOpener opens a long header packet
+type LongHeaderOpener interface {
+	headerDecryptor
+	DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber
+	Open(dst, src []byte, pn protocol.PacketNumber, associatedData []byte) ([]byte, error)
+}
+
+// ShortHeaderOpener opens a short header packet
+type ShortHeaderOpener interface {
+	headerDecryptor
+	DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber
+	Open(dst, src []byte, rcvTime monotime.Time, pn protocol.PacketNumber, kp protocol.KeyPhaseBit, associatedData []byte) ([]byte, error)
+}
+
+// LongHeaderSealer seals a long header packet
+type LongHeaderSealer interface {
+	Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte
+	EncryptHeader(sample []byte, firstByte *byte, pnBytes []byte)
+	Overhead() int
+}
+
+// ShortHeaderSealer seals a short header packet
+type ShortHeaderSealer interface {
+	LongHeaderSealer
+	KeyPhase() protocol.KeyPhaseBit
+}
+
+type ConnectionState struct {
+	tls.ConnectionState
+	Used0RTT bool
+}
+
+// EventKind is the kind of handshake event.
+type EventKind uint8
+
+const (
+	// EventNoEvent signals that there are no new handshake events
+	EventNoEvent EventKind = iota + 1
+	// EventWriteInitialData contains new CRYPTO data to send at the Initial encryption level
+	EventWriteInitialData
+	// EventWriteHandshakeData contains new CRYPTO data to send at the Handshake encryption level
+	EventWriteHandshakeData
+	// EventReceived0RTTReadKeys signals that 0-RTT decryption keys are available.
+	EventReceived0RTTReadKeys
+	// EventReceivedHandshakeReadKeys signals that Handshake decryption keys are available.
+	EventReceivedHandshakeReadKeys
+	// EventReceived1RTTReadKeys signals that 1-RTT decryption keys are available.
+	EventReceived1RTTReadKeys
+	// EventDiscard0RTTKeys signals that the Handshake keys were discarded.
+	EventDiscard0RTTKeys
+	// EventReceivedTransportParameters contains the transport parameters sent by the peer.
+	EventReceivedTransportParameters
+	// EventRestoredTransportParameters contains the transport parameters restored from the session ticket.
+	// It is only used for the client.
+	EventRestoredTransportParameters
+	// EventHandshakeComplete signals that the TLS handshake was completed.
+	EventHandshakeComplete
+)
+
+func (k EventKind) String() string {
+	switch k {
+	case EventNoEvent:
+		return "EventNoEvent"
+	case EventWriteInitialData:
+		return "EventWriteInitialData"
+	case EventWriteHandshakeData:
+		return "EventWriteHandshakeData"
+	case EventReceived0RTTReadKeys:
+		return "EventReceived0RTTReadKeys"
+	case EventReceivedHandshakeReadKeys:
+		return "EventReceivedHandshakeReadKeys"
+	case EventReceived1RTTReadKeys:
+		return "EventReceived1RTTReadKeys"
+	case EventDiscard0RTTKeys:
+		return "EventDiscard0RTTKeys"
+	case EventReceivedTransportParameters:
+		return "EventReceivedTransportParameters"
+	case EventRestoredTransportParameters:
+		return "EventRestoredTransportParameters"
+	case EventHandshakeComplete:
+		return "EventHandshakeComplete"
+	default:
+		return "Unknown EventKind"
+	}
+}
+
+// Event is a handshake event.
+type Event struct {
+	Kind                EventKind
+	Data                []byte
+	TransportParameters *wire.TransportParameters
+}
+
+// CryptoSetup handles the handshake and protecting / unprotecting packets
+type CryptoSetup interface {
+	StartHandshake(context.Context) error
+	io.Closer
+	ChangeConnectionID(protocol.ConnectionID)
+	GetSessionTicket() ([]byte, error)
+
+	HandleMessage([]byte, protocol.EncryptionLevel) error
+	NextEvent() Event
+
+	SetLargest1RTTAcked(protocol.PacketNumber) error
+	DiscardInitialKeys()
+	SetHandshakeConfirmed()
+	ConnectionState() ConnectionState
+
+	GetInitialOpener() (LongHeaderOpener, error)
+	GetHandshakeOpener() (LongHeaderOpener, error)
+	Get0RTTOpener() (LongHeaderOpener, error)
+	Get1RTTOpener() (ShortHeaderOpener, error)
+
+	GetInitialSealer() (LongHeaderSealer, error)
+	GetHandshakeSealer() (LongHeaderSealer, error)
+	Get0RTTSealer() (LongHeaderSealer, error)
+	Get1RTTSealer() (ShortHeaderSealer, error)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/retry.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/retry.go
new file mode 100644
index 000000000..b5caa2911
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/retry.go
@@ -0,0 +1,68 @@
+package handshake
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/fips140"
+	"fmt"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// used for QUIC v1 (RFC 9000)
+var retryAEADv1 = initAEAD([16]byte{0xbe, 0x0c, 0x69, 0x0b, 0x9f, 0x66, 0x57, 0x5a, 0x1d, 0x76, 0x6b, 0x54, 0xe3, 0x68, 0xc8, 0x4e})
+
+// used for QUIC v2 (RFC 9369)
+var retryAEADv2 = initAEAD([16]byte{0x8f, 0xb4, 0xb0, 0x1b, 0x56, 0xac, 0x48, 0xe2, 0x60, 0xfb, 0xcb, 0xce, 0xad, 0x7c, 0xcc, 0x92})
+
+func initAEAD(key [16]byte) cipher.AEAD {
+	aes, err := aes.NewCipher(key[:])
+	if err != nil {
+		panic(err)
+	}
+	var aead cipher.AEAD
+	// Retry packet authentication uses the fixed key and nonce specified by RFC 9000.
+	// It acts as an integrity tag for the Retry packet itself, protecting against
+	// accidental modification and making injection harder. It is not used to encrypt
+	// packet contents and therefore outside the scope of FIPS 140 enforcement.
+	fips140.WithoutEnforcement(func() {
+		var err error
+		aead, err = cipher.NewGCM(aes)
+		if err != nil {
+			panic(err)
+		}
+	})
+	return aead
+}
+
+var (
+	retryBuf     bytes.Buffer
+	retryMutex   sync.Mutex
+	retryNonceV1 = [12]byte{0x46, 0x15, 0x99, 0xd3, 0x5d, 0x63, 0x2b, 0xf2, 0x23, 0x98, 0x25, 0xbb}
+	retryNonceV2 = [12]byte{0xd8, 0x69, 0x69, 0xbc, 0x2d, 0x7c, 0x6d, 0x99, 0x90, 0xef, 0xb0, 0x4a}
+)
+
+// GetRetryIntegrityTag calculates the integrity tag on a Retry packet
+func GetRetryIntegrityTag(retry []byte, origDestConnID protocol.ConnectionID, version protocol.Version) *[16]byte {
+	retryMutex.Lock()
+	defer retryMutex.Unlock()
+
+	retryBuf.WriteByte(uint8(origDestConnID.Len()))
+	retryBuf.Write(origDestConnID.Bytes())
+	retryBuf.Write(retry)
+	defer retryBuf.Reset()
+
+	var tag [16]byte
+	var sealed []byte
+	if version == protocol.Version2 {
+		sealed = retryAEADv2.Seal(tag[:0], retryNonceV2[:], nil, retryBuf.Bytes())
+	} else {
+		sealed = retryAEADv1.Seal(tag[:0], retryNonceV1[:], nil, retryBuf.Bytes())
+	}
+	if len(sealed) != 16 {
+		panic(fmt.Sprintf("unexpected Retry integrity tag length: %d", len(sealed)))
+	}
+	return &tag
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/retry_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/retry_test.go
new file mode 100644
index 000000000..6ccbb473a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/retry_test.go
@@ -0,0 +1,56 @@
+package handshake
+
+import (
+	"encoding/binary"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRetryIntegrityTagCalculation(t *testing.T) {
+	connID := protocol.ParseConnectionID([]byte{1, 2, 3, 4})
+	fooTag := GetRetryIntegrityTag([]byte("foo"), connID, protocol.Version1)
+	barTag := GetRetryIntegrityTag([]byte("bar"), connID, protocol.Version1)
+	require.NotNil(t, fooTag)
+	require.NotNil(t, barTag)
+	require.NotEqual(t, *fooTag, *barTag)
+}
+
+func TestRetryIntegrityTagWithDifferentConnectionIDs(t *testing.T) {
+	connID1 := protocol.ParseConnectionID([]byte{1, 2, 3, 4})
+	connID2 := protocol.ParseConnectionID([]byte{4, 3, 2, 1})
+	t1 := GetRetryIntegrityTag([]byte("foobar"), connID1, protocol.Version1)
+	t2 := GetRetryIntegrityTag([]byte("foobar"), connID2, protocol.Version1)
+	require.NotEqual(t, *t1, *t2)
+}
+
+func TestRetryIntegrityTagWithTestVectors(t *testing.T) {
+	tests := []struct {
+		name    string
+		version protocol.Version
+		data    []byte
+	}{
+		{
+			name:    "v1",
+			version: protocol.Version1,
+			data:    splitHexString(t, "ff000000010008f067a5502a4262b574 6f6b656e04a265ba2eff4d829058fb3f 0f2496ba"),
+		},
+		{
+			name:    "v2",
+			version: protocol.Version2,
+			data:    splitHexString(t, "cf6b3343cf0008f067a5502a4262b574 6f6b656ec8646ce8bfe33952d9555436 65dcc7b6"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := binary.BigEndian.Uint32(tt.data[1:5])
+			require.Equal(t, tt.version, protocol.Version(v))
+			connID := protocol.ParseConnectionID(splitHexString(t, "0x8394c8f03e515708"))
+			tag := GetRetryIntegrityTag(tt.data[:len(tt.data)-16], connID, tt.version)
+			require.Equal(t, tt.data[len(tt.data)-16:], tag[:])
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/session_ticket.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/session_ticket.go
new file mode 100644
index 000000000..eee09d35c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/session_ticket.go
@@ -0,0 +1,55 @@
+package handshake
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+const sessionTicketRevision = 5
+
+type sessionTicket struct {
+	Parameters *wire.TransportParameters
+}
+
+func (t *sessionTicket) Marshal() []byte {
+	b := make([]byte, 0, 256)
+	b = quicvarint.Append(b, sessionTicketRevision)
+	return t.Parameters.MarshalForSessionTicket(b)
+}
+
+func (t *sessionTicket) Unmarshal(b []byte) error {
+	rev, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return errors.New("failed to read session ticket revision")
+	}
+	b = b[l:]
+	if rev != sessionTicketRevision {
+		return fmt.Errorf("unknown session ticket revision: %d", rev)
+	}
+	var tp wire.TransportParameters
+	if err := tp.UnmarshalFromSessionTicket(b); err != nil {
+		return fmt.Errorf("unmarshaling transport parameters from session ticket failed: %s", err.Error())
+	}
+	t.Parameters = &tp
+	return nil
+}
+
+const extraPrefix = "quic-go1"
+
+func addSessionStateExtraPrefix(b []byte) []byte {
+	return append([]byte(extraPrefix), b...)
+}
+
+func findSessionStateExtraData(extras [][]byte) []byte {
+	prefix := []byte(extraPrefix)
+	for _, extra := range extras {
+		if data, ok := bytes.CutPrefix(extra, prefix); ok {
+			return data
+		}
+	}
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/session_ticket_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/session_ticket_test.go
new file mode 100644
index 000000000..579ad9dc1
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/session_ticket_test.go
@@ -0,0 +1,46 @@
+package handshake
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMarshalUnmarshalSessionTicket(t *testing.T) {
+	ticket := &sessionTicket{
+		Parameters: &wire.TransportParameters{
+			InitialMaxStreamDataBidiLocal:  1,
+			InitialMaxStreamDataBidiRemote: 2,
+			ActiveConnectionIDLimit:        10,
+			MaxDatagramFrameSize:           20,
+		},
+	}
+	var t2 sessionTicket
+	require.NoError(t, t2.Unmarshal(ticket.Marshal()))
+	require.EqualValues(t, 1, t2.Parameters.InitialMaxStreamDataBidiLocal)
+	require.EqualValues(t, 2, t2.Parameters.InitialMaxStreamDataBidiRemote)
+	require.EqualValues(t, 10, t2.Parameters.ActiveConnectionIDLimit)
+	require.EqualValues(t, 20, t2.Parameters.MaxDatagramFrameSize)
+}
+
+func TestUnmarshalRefusesTooShortTicket(t *testing.T) {
+	err := (&sessionTicket{}).Unmarshal([]byte{})
+	require.EqualError(t, err, "failed to read session ticket revision")
+}
+
+func TestUnmarshalRefusesUnknownRevision(t *testing.T) {
+	b := quicvarint.Append(nil, 1337)
+	err := (&sessionTicket{}).Unmarshal(b)
+	require.EqualError(t, err, "unknown session ticket revision: 1337")
+}
+
+func TestUnmarshal0RTTRefusesInvalidTransportParameters(t *testing.T) {
+	b := quicvarint.Append(nil, sessionTicketRevision)
+	b = append(b, []byte("foobar")...)
+	err := (&sessionTicket{}).Unmarshal(b)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "unmarshaling transport parameters from session ticket failed")
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/tls_config_go126.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/tls_config_go126.go
new file mode 100644
index 000000000..693a08db3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/tls_config_go126.go
@@ -0,0 +1,54 @@
+//go:build !go1.27
+
+package handshake
+
+import (
+	"crypto/tls"
+	"net"
+)
+
+func setupConfigForClient(conf *tls.Config) *tls.Config {
+	conf = conf.Clone()
+	conf.MinVersion = tls.VersionTLS13
+	return conf
+}
+
+func setupConfigForServer(conf *tls.Config, localAddr, remoteAddr net.Addr) *tls.Config {
+	// Workaround for https://github.com/golang/go/issues/60506.
+	// This initializes the session tickets _before_ cloning the config.
+	_, _ = conf.DecryptTicket(nil, tls.ConnectionState{})
+
+	conf = conf.Clone()
+	conf.MinVersion = tls.VersionTLS13
+
+	// The tls.Config contains two callbacks that pass in a tls.ClientHelloInfo.
+	// Since crypto/tls doesn't do it, we need to make sure to set the Conn field with a fake net.Conn
+	// that allows the caller to get the local and the remote address.
+	if conf.GetConfigForClient != nil {
+		gcfc := conf.GetConfigForClient
+		conf.GetConfigForClient = func(info *tls.ClientHelloInfo) (*tls.Config, error) {
+			info.Conn = &conn{localAddr: localAddr, remoteAddr: remoteAddr}
+			c, err := gcfc(info)
+			if c != nil {
+				// we're returning a tls.Config here, so we need to apply this recursively
+				c = setupConfigForServer(c, localAddr, remoteAddr)
+			}
+			return c, err
+		}
+	}
+	if conf.GetCertificate != nil {
+		gc := conf.GetCertificate
+		conf.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+			info.Conn = &conn{localAddr: localAddr, remoteAddr: remoteAddr}
+			return gc(info)
+		}
+	}
+	return conf
+}
+
+func getQUICConfig(tlsConf *tls.Config, _, _ net.Addr) *tls.QUICConfig {
+	return &tls.QUICConfig{
+		TLSConfig:           tlsConf,
+		EnableSessionEvents: true,
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/tls_config_go126_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/tls_config_go126_test.go
new file mode 100644
index 000000000..b9303f29d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/tls_config_go126_test.go
@@ -0,0 +1,99 @@
+//go:build !go1.27
+
+package handshake
+
+import (
+	"crypto/tls"
+	"net"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMinimumTLSVersion(t *testing.T) {
+	local := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42}
+	remote := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1), Port: 1337}
+
+	orig := &tls.Config{MinVersion: tls.VersionTLS12}
+	conf := setupConfigForServer(orig, local, remote)
+	require.EqualValues(t, tls.VersionTLS13, conf.MinVersion)
+	// check that the original config wasn't modified
+	require.EqualValues(t, tls.VersionTLS12, orig.MinVersion)
+}
+
+func TestServerConfigGetCertificate(t *testing.T) {
+	local := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42}
+	remote := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1), Port: 1337}
+
+	var localAddr, remoteAddr net.Addr
+	tlsConf := &tls.Config{
+		GetCertificate: func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+			localAddr = info.Conn.LocalAddr()
+			remoteAddr = info.Conn.RemoteAddr()
+			return &tls.Certificate{}, nil
+		},
+	}
+	conf := setupConfigForServer(tlsConf, local, remote)
+	_, err := conf.GetCertificate(&tls.ClientHelloInfo{})
+	require.NoError(t, err)
+	require.Equal(t, local, localAddr)
+	require.Equal(t, remote, remoteAddr)
+}
+
+func TestServerConfigGetConfigForClient(t *testing.T) {
+	local := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42}
+	remote := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1), Port: 1337}
+
+	var localAddr, remoteAddr net.Addr
+	tlsConf := setupConfigForServer(
+		&tls.Config{
+			GetConfigForClient: func(info *tls.ClientHelloInfo) (*tls.Config, error) {
+				localAddr = info.Conn.LocalAddr()
+				remoteAddr = info.Conn.RemoteAddr()
+				return &tls.Config{}, nil
+			},
+		},
+		local,
+		remote,
+	)
+	conf, err := tlsConf.GetConfigForClient(&tls.ClientHelloInfo{})
+	require.NoError(t, err)
+	require.Equal(t, local, localAddr)
+	require.Equal(t, remote, remoteAddr)
+	require.NotNil(t, conf)
+	require.EqualValues(t, tls.VersionTLS13, conf.MinVersion)
+}
+
+func TestServerConfigGetConfigForClientRecursively(t *testing.T) {
+	local := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42}
+	remote := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1), Port: 1337}
+
+	var localAddr, remoteAddr net.Addr
+	tlsConf := &tls.Config{}
+	var innerConf *tls.Config
+	getCert := func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+		localAddr = info.Conn.LocalAddr()
+		remoteAddr = info.Conn.RemoteAddr()
+		return &tls.Certificate{}, nil
+	}
+	tlsConf.GetConfigForClient = func(info *tls.ClientHelloInfo) (*tls.Config, error) {
+		innerConf = tlsConf.Clone()
+		// set the MaxVersion, so we can check that quic-go doesn't overwrite the user's config
+		innerConf.MaxVersion = tls.VersionTLS12
+		innerConf.GetCertificate = getCert
+		return innerConf, nil
+	}
+	tlsConf = setupConfigForServer(tlsConf, local, remote)
+	conf, err := tlsConf.GetConfigForClient(&tls.ClientHelloInfo{})
+	require.NoError(t, err)
+	require.NotNil(t, conf)
+	require.EqualValues(t, tls.VersionTLS13, conf.MinVersion)
+	_, err = conf.GetCertificate(&tls.ClientHelloInfo{})
+	require.NoError(t, err)
+	require.Equal(t, local, localAddr)
+	require.Equal(t, remote, remoteAddr)
+	// make sure that the tls.Config returned by GetConfigForClient isn't modified
+	require.True(t, reflect.ValueOf(innerConf.GetCertificate).Pointer() == reflect.ValueOf(getCert).Pointer())
+	require.EqualValues(t, tls.VersionTLS12, innerConf.MaxVersion)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/tls_config_go127.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/tls_config_go127.go
new file mode 100644
index 000000000..7b9d48166
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/tls_config_go127.go
@@ -0,0 +1,24 @@
+//go:build go1.27
+
+package handshake
+
+import (
+	"crypto/tls"
+	"net"
+)
+
+func setupConfigForClient(conf *tls.Config) *tls.Config {
+	return conf
+}
+
+func setupConfigForServer(conf *tls.Config, _, _ net.Addr) *tls.Config {
+	return conf
+}
+
+func getQUICConfig(tlsConf *tls.Config, localAddr, remoteAddr net.Addr) *tls.QUICConfig {
+	return &tls.QUICConfig{
+		TLSConfig:           tlsConf,
+		EnableSessionEvents: true,
+		ClientHelloInfoConn: &conn{localAddr: localAddr, remoteAddr: remoteAddr},
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/token_generator.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/token_generator.go
new file mode 100644
index 000000000..933670dd7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/token_generator.go
@@ -0,0 +1,126 @@
+package handshake
+
+import (
+	"bytes"
+	"encoding/asn1"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+const (
+	tokenPrefixIP byte = iota
+	tokenPrefixString
+)
+
+// A Token is derived from the client address and can be used to verify the ownership of this address.
+type Token struct {
+	IsRetryToken      bool
+	SentTime          time.Time
+	encodedRemoteAddr []byte
+	// only set for tokens sent in NEW_TOKEN frames
+	RTT time.Duration
+	// only set for retry tokens
+	OriginalDestConnectionID protocol.ConnectionID
+	RetrySrcConnectionID     protocol.ConnectionID
+}
+
+// ValidateRemoteAddr validates the address, but does not check expiration
+func (t *Token) ValidateRemoteAddr(addr net.Addr) bool {
+	return bytes.Equal(encodeRemoteAddr(addr), t.encodedRemoteAddr)
+}
+
+// token is the struct that is used for ASN1 serialization and deserialization
+type token struct {
+	IsRetryToken             bool
+	RemoteAddr               []byte
+	Timestamp                int64
+	RTT                      int64 // in mus
+	OriginalDestConnectionID []byte
+	RetrySrcConnectionID     []byte
+}
+
+// A TokenGenerator generates tokens
+type TokenGenerator struct {
+	tokenProtector tokenProtector
+}
+
+// NewTokenGenerator initializes a new TokenGenerator
+func NewTokenGenerator(key TokenProtectorKey) *TokenGenerator {
+	return &TokenGenerator{tokenProtector: *newTokenProtector(key)}
+}
+
+// NewRetryToken generates a new token for a Retry for a given source address
+func (g *TokenGenerator) NewRetryToken(
+	raddr net.Addr,
+	origDestConnID protocol.ConnectionID,
+	retrySrcConnID protocol.ConnectionID,
+) ([]byte, error) {
+	data, err := asn1.Marshal(token{
+		IsRetryToken:             true,
+		RemoteAddr:               encodeRemoteAddr(raddr),
+		OriginalDestConnectionID: origDestConnID.Bytes(),
+		RetrySrcConnectionID:     retrySrcConnID.Bytes(),
+		Timestamp:                time.Now().UnixNano(),
+	})
+	if err != nil {
+		return nil, err
+	}
+	return g.tokenProtector.NewToken(data)
+}
+
+// NewToken generates a new token to be sent in a NEW_TOKEN frame
+func (g *TokenGenerator) NewToken(raddr net.Addr, rtt time.Duration) ([]byte, error) {
+	data, err := asn1.Marshal(token{
+		RemoteAddr: encodeRemoteAddr(raddr),
+		Timestamp:  time.Now().UnixNano(),
+		RTT:        rtt.Microseconds(),
+	})
+	if err != nil {
+		return nil, err
+	}
+	return g.tokenProtector.NewToken(data)
+}
+
+// DecodeToken decodes a token
+func (g *TokenGenerator) DecodeToken(encrypted []byte) (*Token, error) {
+	// if the client didn't send any token, DecodeToken will be called with a nil-slice
+	if len(encrypted) == 0 {
+		return nil, nil
+	}
+
+	data, err := g.tokenProtector.DecodeToken(encrypted)
+	if err != nil {
+		return nil, err
+	}
+	t := &token{}
+	rest, err := asn1.Unmarshal(data, t)
+	if err != nil {
+		return nil, err
+	}
+	if len(rest) != 0 {
+		return nil, fmt.Errorf("rest when unpacking token: %d", len(rest))
+	}
+	token := &Token{
+		IsRetryToken:      t.IsRetryToken,
+		SentTime:          time.Unix(0, t.Timestamp),
+		encodedRemoteAddr: t.RemoteAddr,
+	}
+	if t.IsRetryToken {
+		token.OriginalDestConnectionID = protocol.ParseConnectionID(t.OriginalDestConnectionID)
+		token.RetrySrcConnectionID = protocol.ParseConnectionID(t.RetrySrcConnectionID)
+	} else {
+		token.RTT = time.Duration(t.RTT) * time.Microsecond
+	}
+	return token, nil
+}
+
+// encodeRemoteAddr encodes a remote address such that it can be saved in the token
+func encodeRemoteAddr(remoteAddr net.Addr) []byte {
+	if udpAddr, ok := remoteAddr.(*net.UDPAddr); ok {
+		return append([]byte{tokenPrefixIP}, udpAddr.IP...)
+	}
+	return append([]byte{tokenPrefixString}, []byte(remoteAddr.String())...)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/token_generator_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/token_generator_test.go
new file mode 100644
index 000000000..bb58fd108
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/token_generator_test.go
@@ -0,0 +1,140 @@
+package handshake
+
+import (
+	"crypto/rand"
+	"encoding/asn1"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func newTokenGenerator(t *testing.T) *TokenGenerator {
+	var key TokenProtectorKey
+	_, err := rand.Read(key[:])
+	require.NoError(t, err)
+	return NewTokenGenerator(key)
+}
+
+func TestTokenGeneratorNilTokens(t *testing.T) {
+	tokenGen := newTokenGenerator(t)
+	nilToken, err := tokenGen.DecodeToken(nil)
+	require.NoError(t, err)
+	require.Nil(t, nilToken)
+}
+
+func TestTokenGeneratorValidToken(t *testing.T) {
+	tokenGen := newTokenGenerator(t)
+
+	addr := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1), Port: 1337}
+	connID1 := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef})
+	connID2 := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xc0, 0xde})
+	tokenEnc, err := tokenGen.NewRetryToken(addr, connID1, connID2)
+	require.NoError(t, err)
+	decodedToken, err := tokenGen.DecodeToken(tokenEnc)
+	require.NoError(t, err)
+	require.True(t, decodedToken.ValidateRemoteAddr(addr))
+	require.False(t, decodedToken.ValidateRemoteAddr(&net.UDPAddr{IP: net.IPv4(192, 168, 0, 2), Port: 1337}))
+	require.WithinDuration(t, time.Now(), decodedToken.SentTime, 100*time.Millisecond)
+	require.Equal(t, connID1, decodedToken.OriginalDestConnectionID)
+	require.Equal(t, connID2, decodedToken.RetrySrcConnectionID)
+}
+
+func TestTokenGeneratorRejectsInvalidTokens(t *testing.T) {
+	tokenGen := newTokenGenerator(t)
+
+	_, err := tokenGen.DecodeToken([]byte("invalid token"))
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "too short")
+}
+
+func TestTokenGeneratorDecodingFailed(t *testing.T) {
+	tokenGen := newTokenGenerator(t)
+
+	invalidToken, err := tokenGen.tokenProtector.NewToken([]byte("foobar"))
+	require.NoError(t, err)
+	_, err = tokenGen.DecodeToken(invalidToken)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "asn1")
+}
+
+func TestTokenGeneratorAdditionalPayload(t *testing.T) {
+	tokenGen := newTokenGenerator(t)
+
+	tok, err := asn1.Marshal(token{RemoteAddr: []byte("foobar")})
+	require.NoError(t, err)
+	tok = append(tok, []byte("rest")...)
+	enc, err := tokenGen.tokenProtector.NewToken(tok)
+	require.NoError(t, err)
+	_, err = tokenGen.DecodeToken(enc)
+	require.EqualError(t, err, "rest when unpacking token: 4")
+}
+
+func TestTokenGeneratorEmptyTokens(t *testing.T) {
+	tokenGen := newTokenGenerator(t)
+
+	emptyTok, err := asn1.Marshal(token{RemoteAddr: []byte("")})
+	require.NoError(t, err)
+	emptyEnc, err := tokenGen.tokenProtector.NewToken(emptyTok)
+	require.NoError(t, err)
+	_, err = tokenGen.DecodeToken(emptyEnc)
+	require.NoError(t, err)
+}
+
+func TestTokenGeneratorIPv6(t *testing.T) {
+	tokenGen := newTokenGenerator(t)
+
+	addresses := []string{
+		"2001:db8::68",
+		"2001:0000:4136:e378:8000:63bf:3fff:fdd2",
+		"2001::1",
+		"ff01:0:0:0:0:0:0:2",
+	}
+	for _, addr := range addresses {
+		ip := net.ParseIP(addr)
+		require.NotNil(t, ip)
+		raddr := &net.UDPAddr{IP: ip, Port: 1337}
+		tokenEnc, err := tokenGen.NewRetryToken(raddr, protocol.ConnectionID{}, protocol.ConnectionID{})
+		require.NoError(t, err)
+		token, err := tokenGen.DecodeToken(tokenEnc)
+		require.NoError(t, err)
+		require.True(t, token.ValidateRemoteAddr(raddr))
+		require.WithinDuration(t, time.Now(), token.SentTime, 100*time.Millisecond)
+	}
+}
+
+func TestTokenGeneratorNonUDPAddr(t *testing.T) {
+	tokenGen := newTokenGenerator(t)
+
+	raddr := &net.TCPAddr{IP: net.IPv4(192, 168, 13, 37), Port: 1337}
+	tokenEnc, err := tokenGen.NewRetryToken(raddr, protocol.ConnectionID{}, protocol.ConnectionID{})
+	require.NoError(t, err)
+	token, err := tokenGen.DecodeToken(tokenEnc)
+	require.NoError(t, err)
+	require.True(t, token.ValidateRemoteAddr(raddr))
+	require.False(t, token.ValidateRemoteAddr(&net.TCPAddr{IP: net.IPv4(192, 168, 13, 37), Port: 1338}))
+	require.WithinDuration(t, time.Now(), token.SentTime, 100*time.Millisecond)
+}
+
+func BenchmarkTokenGeneratorDecodeToken(b *testing.B) {
+	b.ReportAllocs()
+
+	var key TokenProtectorKey
+	_, err := rand.Read(key[:])
+	require.NoError(b, err)
+	tokenGen := NewTokenGenerator(key)
+	addr := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1), Port: 1337}
+	connID1 := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef})
+	connID2 := protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10})
+	tokenEnc, err := tokenGen.NewRetryToken(addr, connID1, connID2)
+	require.NoError(b, err)
+
+	for b.Loop() {
+		if _, err := tokenGen.DecodeToken(tokenEnc); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/token_protector.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/token_protector.go
new file mode 100644
index 000000000..74cd7d7ba
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/token_protector.go
@@ -0,0 +1,78 @@
+package handshake
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/hkdf"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+)
+
+// TokenProtectorKey is the key used to encrypt both Retry and session resumption tokens.
+type TokenProtectorKey [32]byte
+
+const tokenSaltSize = 32
+
+// tokenProtector is used to create and verify a token
+type tokenProtector struct {
+	key TokenProtectorKey
+}
+
+// newTokenProtector creates a source for source address tokens
+func newTokenProtector(key TokenProtectorKey) *tokenProtector {
+	return &tokenProtector{key: key}
+}
+
+// NewToken encodes data into a new token.
+func (s *tokenProtector) NewToken(data []byte) ([]byte, error) {
+	var salt [tokenSaltSize]byte
+	if _, err := rand.Read(salt[:]); err != nil {
+		return nil, err
+	}
+	aead, err := s.createAEAD(salt[:])
+	if err != nil {
+		return nil, err
+	}
+	return append(salt[:], aead.Seal(nil, nil, data, nil)...), nil
+}
+
+// DecodeToken decodes a token.
+func (s *tokenProtector) DecodeToken(p []byte) ([]byte, error) {
+	if len(p) < tokenSaltSize {
+		return nil, fmt.Errorf("token too short: %d", len(p))
+	}
+	salt := p[:tokenSaltSize]
+	aead, err := s.createAEAD(salt)
+	if err != nil {
+		return nil, err
+	}
+	if len(p[tokenSaltSize:]) < aead.Overhead() {
+		return nil, fmt.Errorf("token too short: %d", len(p))
+	}
+	return aead.Open(nil, nil, p[tokenSaltSize:], nil)
+}
+
+const tokenProtectorHKDFInfo = "quic-go token source"
+
+func (s *tokenProtector) createAEAD(salt []byte) (cipher.AEAD, error) {
+	prk, err := hkdf.Extract(sha256.New, s.key[:], salt)
+	if err != nil {
+		return nil, err
+	}
+
+	key, err := hkdf.Expand(sha256.New, prk, tokenProtectorHKDFInfo, 32)
+	if err != nil {
+		return nil, err
+	}
+
+	c, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	aead, err := cipher.NewGCMWithRandomNonce(c)
+	if err != nil {
+		return nil, err
+	}
+	return aead, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/token_protector_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/token_protector_test.go
new file mode 100644
index 000000000..f2a290a4e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/token_protector_test.go
@@ -0,0 +1,70 @@
+package handshake
+
+import (
+	"crypto/rand"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestTokenProtectorEncodeAndDecode(t *testing.T) {
+	var key TokenProtectorKey
+	rand.Read(key[:])
+	tp := newTokenProtector(key)
+
+	token, err := tp.NewToken([]byte("foobar"))
+	require.NoError(t, err)
+	require.NotContains(t, string(token), "foobar")
+
+	decoded, err := tp.DecodeToken(token)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), decoded)
+}
+
+func TestTokenProtectorDifferentKeys(t *testing.T) {
+	var key1, key2 TokenProtectorKey
+	rand.Read(key1[:])
+	rand.Read(key2[:])
+	tp1 := newTokenProtector(key1)
+	tp2 := newTokenProtector(key2)
+
+	t1, err := tp1.NewToken([]byte("foo"))
+	require.NoError(t, err)
+	t2, err := tp2.NewToken([]byte("foo"))
+	require.NoError(t, err)
+
+	_, err = tp1.DecodeToken(t1)
+	require.NoError(t, err)
+	_, err = tp1.DecodeToken(t2)
+	require.Error(t, err)
+
+	tp3 := newTokenProtector(key1)
+	_, err = tp3.DecodeToken(t1)
+	require.NoError(t, err)
+	_, err = tp3.DecodeToken(t2)
+	require.Error(t, err)
+}
+
+func TestTokenProtectorInvalidTokens(t *testing.T) {
+	var key TokenProtectorKey
+	rand.Read(key[:])
+	tp := newTokenProtector(key)
+
+	token, err := tp.NewToken([]byte("foobar"))
+	require.NoError(t, err)
+	_, err = tp.DecodeToken(token[1:])
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "message authentication failed")
+}
+
+func TestTokenProtectorTooShortTokens(t *testing.T) {
+	var key TokenProtectorKey
+	rand.Read(key[:])
+	tp := newTokenProtector(key)
+
+	_, err := tp.DecodeToken([]byte("foobar"))
+	require.EqualError(t, err, "token too short: 6")
+
+	_, err = tp.DecodeToken(make([]byte, tokenSaltSize))
+	require.EqualError(t, err, "token too short: 32")
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/updatable_aead.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/updatable_aead.go
new file mode 100644
index 000000000..f88f76ad8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/updatable_aead.go
@@ -0,0 +1,372 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/cipher"
+	"crypto/tls"
+	"encoding/binary"
+	"fmt"
+	"sync/atomic"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+var keyUpdateInterval atomic.Uint64
+
+func init() {
+	keyUpdateInterval.Store(protocol.KeyUpdateInterval)
+}
+
+func SetKeyUpdateInterval(v uint64) (reset func()) {
+	old := keyUpdateInterval.Swap(v)
+	return func() { keyUpdateInterval.Store(old) }
+}
+
+// FirstKeyUpdateInterval is the maximum number of packets we send or receive before initiating the first key update.
+// It's a package-level variable to allow modifying it for testing purposes.
+var FirstKeyUpdateInterval uint64 = 100
+
+type updatableAEAD struct {
+	suite cipherSuite
+
+	keyPhase           protocol.KeyPhase
+	largestAcked       protocol.PacketNumber
+	firstPacketNumber  protocol.PacketNumber
+	handshakeConfirmed bool
+
+	invalidPacketLimit uint64
+	invalidPacketCount uint64
+
+	// Time when the keys should be dropped. Keys are dropped on the next call to Open().
+	prevRcvAEADExpiry monotime.Time
+	prevRcvAEAD       cipher.AEAD
+
+	firstRcvdWithCurrentKey protocol.PacketNumber
+	firstSentWithCurrentKey protocol.PacketNumber
+	highestRcvdPN           protocol.PacketNumber // highest packet number received (which could be successfully unprotected)
+	numRcvdWithCurrentKey   uint64
+	numSentWithCurrentKey   uint64
+	rcvAEAD                 cipher.AEAD
+	sendAEAD                cipher.AEAD
+	// caches cipher.AEAD.Overhead(). This speeds up calls to Overhead().
+	aeadOverhead int
+
+	nextRcvAEAD           cipher.AEAD
+	nextSendAEAD          cipher.AEAD
+	nextRcvTrafficSecret  []byte
+	nextSendTrafficSecret []byte
+
+	headerDecrypter headerProtector
+	headerEncrypter headerProtector
+
+	rttStats *utils.RTTStats
+
+	qlogger qlogwriter.Recorder
+	logger  utils.Logger
+	version protocol.Version
+
+	// use a single slice to avoid allocations
+	nonceBuf []byte
+}
+
+var (
+	_ ShortHeaderOpener = &updatableAEAD{}
+	_ ShortHeaderSealer = &updatableAEAD{}
+)
+
+func newUpdatableAEAD(rttStats *utils.RTTStats, qlogger qlogwriter.Recorder, logger utils.Logger, version protocol.Version) *updatableAEAD {
+	return &updatableAEAD{
+		firstPacketNumber:       protocol.InvalidPacketNumber,
+		largestAcked:            protocol.InvalidPacketNumber,
+		firstRcvdWithCurrentKey: protocol.InvalidPacketNumber,
+		firstSentWithCurrentKey: protocol.InvalidPacketNumber,
+		rttStats:                rttStats,
+		qlogger:                 qlogger,
+		logger:                  logger,
+		version:                 version,
+	}
+}
+
+func (a *updatableAEAD) rollKeys() {
+	if a.prevRcvAEAD != nil {
+		a.logger.Debugf("Dropping key phase %d ahead of scheduled time. Drop time was: %s", a.keyPhase-1, a.prevRcvAEADExpiry)
+		if a.qlogger != nil {
+			a.qlogger.RecordEvent(qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: a.keyPhase - 1,
+			})
+			a.qlogger.RecordEvent(qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: a.keyPhase - 1,
+			})
+		}
+		a.prevRcvAEADExpiry = 0
+	}
+
+	a.keyPhase++
+	a.firstRcvdWithCurrentKey = protocol.InvalidPacketNumber
+	a.firstSentWithCurrentKey = protocol.InvalidPacketNumber
+	a.numRcvdWithCurrentKey = 0
+	a.numSentWithCurrentKey = 0
+	a.prevRcvAEAD = a.rcvAEAD
+	a.rcvAEAD = a.nextRcvAEAD
+	a.sendAEAD = a.nextSendAEAD
+
+	a.nextRcvTrafficSecret = a.getNextTrafficSecret(a.suite.Hash, a.nextRcvTrafficSecret)
+	a.nextSendTrafficSecret = a.getNextTrafficSecret(a.suite.Hash, a.nextSendTrafficSecret)
+	a.nextRcvAEAD = createAEAD(a.suite, a.nextRcvTrafficSecret, a.version)
+	a.nextSendAEAD = createAEAD(a.suite, a.nextSendTrafficSecret, a.version)
+}
+
+func (a *updatableAEAD) startKeyDropTimer(now monotime.Time) {
+	d := 3 * a.rttStats.PTO(true)
+	a.logger.Debugf("Starting key drop timer to drop key phase %d (in %s)", a.keyPhase-1, d)
+	a.prevRcvAEADExpiry = now.Add(d)
+}
+
+func (a *updatableAEAD) getNextTrafficSecret(hash crypto.Hash, ts []byte) []byte {
+	return hkdfExpandLabel(hash, ts, []byte{}, "quic ku", hash.Size())
+}
+
+// SetReadKey sets the read key.
+// For the client, this function is called before SetWriteKey.
+// For the server, this function is called after SetWriteKey.
+func (a *updatableAEAD) SetReadKey(suite cipherSuite, trafficSecret []byte) {
+	a.rcvAEAD = createAEAD(suite, trafficSecret, a.version)
+	a.headerDecrypter = newHeaderProtector(suite, trafficSecret, false, a.version)
+	if a.suite.ID == 0 { // suite is not set yet
+		a.setAEADParameters(a.rcvAEAD, suite)
+	}
+
+	a.nextRcvTrafficSecret = a.getNextTrafficSecret(suite.Hash, trafficSecret)
+	a.nextRcvAEAD = createAEAD(suite, a.nextRcvTrafficSecret, a.version)
+}
+
+// SetWriteKey sets the write key.
+// For the client, this function is called after SetReadKey.
+// For the server, this function is called before SetReadKey.
+func (a *updatableAEAD) SetWriteKey(suite cipherSuite, trafficSecret []byte) {
+	a.sendAEAD = createAEAD(suite, trafficSecret, a.version)
+	a.headerEncrypter = newHeaderProtector(suite, trafficSecret, false, a.version)
+	if a.suite.ID == 0 { // suite is not set yet
+		a.setAEADParameters(a.sendAEAD, suite)
+	}
+
+	a.nextSendTrafficSecret = a.getNextTrafficSecret(suite.Hash, trafficSecret)
+	a.nextSendAEAD = createAEAD(suite, a.nextSendTrafficSecret, a.version)
+}
+
+func (a *updatableAEAD) setAEADParameters(aead cipher.AEAD, suite cipherSuite) {
+	a.nonceBuf = make([]byte, aead.NonceSize())
+	a.aeadOverhead = aead.Overhead()
+	a.suite = suite
+	switch suite.ID {
+	case tls.TLS_AES_128_GCM_SHA256, tls.TLS_AES_256_GCM_SHA384:
+		a.invalidPacketLimit = protocol.InvalidPacketLimitAES
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		a.invalidPacketLimit = protocol.InvalidPacketLimitChaCha
+	default:
+		panic(fmt.Sprintf("unknown cipher suite %d", suite.ID))
+	}
+}
+
+func (a *updatableAEAD) DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber {
+	return protocol.DecodePacketNumber(wirePNLen, a.highestRcvdPN, wirePN)
+}
+
+func (a *updatableAEAD) Open(dst, src []byte, rcvTime monotime.Time, pn protocol.PacketNumber, kp protocol.KeyPhaseBit, ad []byte) ([]byte, error) {
+	dec, err := a.open(dst, src, rcvTime, pn, kp, ad)
+	if err == ErrDecryptionFailed {
+		a.invalidPacketCount++
+		if a.invalidPacketCount >= a.invalidPacketLimit {
+			return nil, &qerr.TransportError{ErrorCode: qerr.AEADLimitReached}
+		}
+	}
+	if err == nil {
+		a.highestRcvdPN = max(a.highestRcvdPN, pn)
+	}
+	return dec, err
+}
+
+func (a *updatableAEAD) open(dst, src []byte, rcvTime monotime.Time, pn protocol.PacketNumber, kp protocol.KeyPhaseBit, ad []byte) ([]byte, error) {
+	if a.prevRcvAEAD != nil && !a.prevRcvAEADExpiry.IsZero() && rcvTime.After(a.prevRcvAEADExpiry) {
+		a.prevRcvAEAD = nil
+		a.logger.Debugf("Dropping key phase %d", a.keyPhase-1)
+		a.prevRcvAEADExpiry = 0
+		if a.qlogger != nil {
+			a.qlogger.RecordEvent(qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: a.keyPhase - 1,
+			})
+			a.qlogger.RecordEvent(qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: a.keyPhase - 1,
+			})
+		}
+	}
+	binary.BigEndian.PutUint64(a.nonceBuf[len(a.nonceBuf)-8:], uint64(pn))
+	if kp != a.keyPhase.Bit() {
+		if a.keyPhase > 0 && a.firstRcvdWithCurrentKey == protocol.InvalidPacketNumber || pn < a.firstRcvdWithCurrentKey {
+			if a.prevRcvAEAD == nil {
+				return nil, ErrKeysDropped
+			}
+			// we updated the key, but the peer hasn't updated yet
+			dec, err := a.prevRcvAEAD.Open(dst, a.nonceBuf, src, ad)
+			if err != nil {
+				err = ErrDecryptionFailed
+			}
+			return dec, err
+		}
+		// try opening the packet with the next key phase
+		dec, err := a.nextRcvAEAD.Open(dst, a.nonceBuf, src, ad)
+		if err != nil {
+			return nil, ErrDecryptionFailed
+		}
+		// Opening succeeded. Check if the peer was allowed to update.
+		if a.keyPhase > 0 && a.firstSentWithCurrentKey == protocol.InvalidPacketNumber {
+			return nil, &qerr.TransportError{
+				ErrorCode:    qerr.KeyUpdateError,
+				ErrorMessage: "keys updated too quickly",
+			}
+		}
+		a.rollKeys()
+		a.logger.Debugf("Peer updated keys to %d", a.keyPhase)
+		// The peer initiated this key update. It's safe to drop the keys for the previous generation now.
+		// Start a timer to drop the previous key generation.
+		a.startKeyDropTimer(rcvTime)
+		if a.qlogger != nil {
+			a.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger:  qlog.KeyUpdateRemote,
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: a.keyPhase,
+			})
+			a.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger:  qlog.KeyUpdateRemote,
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: a.keyPhase,
+			})
+		}
+		a.firstRcvdWithCurrentKey = pn
+		return dec, err
+	}
+	// The AEAD we're using here will be the qtls.aeadAESGCM13.
+	// It uses the nonce provided here and XOR it with the IV.
+	dec, err := a.rcvAEAD.Open(dst, a.nonceBuf, src, ad)
+	if err != nil {
+		return dec, ErrDecryptionFailed
+	}
+	a.numRcvdWithCurrentKey++
+	if a.firstRcvdWithCurrentKey == protocol.InvalidPacketNumber {
+		// We initiated the key updated, and now we received the first packet protected with the new key phase.
+		// Therefore, we are certain that the peer rolled its keys as well. Start a timer to drop the old keys.
+		if a.keyPhase > 0 {
+			a.logger.Debugf("Peer confirmed key update to phase %d", a.keyPhase)
+			a.startKeyDropTimer(rcvTime)
+		}
+		a.firstRcvdWithCurrentKey = pn
+	}
+	return dec, err
+}
+
+func (a *updatableAEAD) Seal(dst, src []byte, pn protocol.PacketNumber, ad []byte) []byte {
+	if a.firstSentWithCurrentKey == protocol.InvalidPacketNumber {
+		a.firstSentWithCurrentKey = pn
+	}
+	if a.firstPacketNumber == protocol.InvalidPacketNumber {
+		a.firstPacketNumber = pn
+	}
+	a.numSentWithCurrentKey++
+	binary.BigEndian.PutUint64(a.nonceBuf[len(a.nonceBuf)-8:], uint64(pn))
+	// The AEAD we're using here will be the qtls.aeadAESGCM13.
+	// It uses the nonce provided here and XOR it with the IV.
+	return a.sendAEAD.Seal(dst, a.nonceBuf, src, ad)
+}
+
+func (a *updatableAEAD) SetLargestAcked(pn protocol.PacketNumber) error {
+	if a.firstSentWithCurrentKey != protocol.InvalidPacketNumber &&
+		pn >= a.firstSentWithCurrentKey && a.numRcvdWithCurrentKey == 0 {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.KeyUpdateError,
+			ErrorMessage: fmt.Sprintf("received ACK for key phase %d, but peer didn't update keys", a.keyPhase),
+		}
+	}
+	a.largestAcked = pn
+	return nil
+}
+
+func (a *updatableAEAD) SetHandshakeConfirmed() {
+	a.handshakeConfirmed = true
+}
+
+func (a *updatableAEAD) updateAllowed() bool {
+	if !a.handshakeConfirmed {
+		return false
+	}
+	// the first key update is allowed as soon as the handshake is confirmed
+	return a.keyPhase == 0 ||
+		// subsequent key updates as soon as a packet sent with that key phase has been acknowledged
+		(a.firstSentWithCurrentKey != protocol.InvalidPacketNumber &&
+			a.largestAcked != protocol.InvalidPacketNumber &&
+			a.largestAcked >= a.firstSentWithCurrentKey)
+}
+
+func (a *updatableAEAD) shouldInitiateKeyUpdate() bool {
+	if !a.updateAllowed() {
+		return false
+	}
+	// Initiate the first key update shortly after the handshake, in order to exercise the key update mechanism.
+	if a.keyPhase == 0 {
+		if a.numRcvdWithCurrentKey >= FirstKeyUpdateInterval || a.numSentWithCurrentKey >= FirstKeyUpdateInterval {
+			return true
+		}
+	}
+	if a.numRcvdWithCurrentKey >= keyUpdateInterval.Load() {
+		a.logger.Debugf("Received %d packets with current key phase. Initiating key update to the next key phase: %d", a.numRcvdWithCurrentKey, a.keyPhase+1)
+		return true
+	}
+	if a.numSentWithCurrentKey >= keyUpdateInterval.Load() {
+		a.logger.Debugf("Sent %d packets with current key phase. Initiating key update to the next key phase: %d", a.numSentWithCurrentKey, a.keyPhase+1)
+		return true
+	}
+	return false
+}
+
+func (a *updatableAEAD) KeyPhase() protocol.KeyPhaseBit {
+	if a.shouldInitiateKeyUpdate() {
+		a.rollKeys()
+		if a.qlogger != nil {
+			a.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger:  qlog.KeyUpdateLocal,
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: a.keyPhase,
+			})
+			a.qlogger.RecordEvent(qlog.KeyUpdated{
+				Trigger:  qlog.KeyUpdateLocal,
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: a.keyPhase,
+			})
+		}
+	}
+	return a.keyPhase.Bit()
+}
+
+func (a *updatableAEAD) Overhead() int {
+	return a.aeadOverhead
+}
+
+func (a *updatableAEAD) EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	a.headerEncrypter.EncryptHeader(sample, firstByte, hdrBytes)
+}
+
+func (a *updatableAEAD) DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	a.headerDecrypter.DecryptHeader(sample, firstByte, hdrBytes)
+}
+
+func (a *updatableAEAD) FirstPacketNumber() protocol.PacketNumber {
+	return a.firstPacketNumber
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/handshake/updatable_aead_test.go b/electron/native/private-transport/third_party/quic-go/internal/handshake/updatable_aead_test.go
new file mode 100644
index 000000000..95869d54c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/handshake/updatable_aead_test.go
@@ -0,0 +1,736 @@
+package handshake
+
+import (
+	"crypto/fips140"
+	"crypto/rand"
+	"crypto/tls"
+	"fmt"
+	mrand "math/rand/v2"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	msg = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua."
+	ad  = "Donec in velit neque."
+)
+
+func randomCipherSuite() cipherSuite { return cipherSuites[mrand.IntN(len(cipherSuites))] }
+
+func setupEndpoints(t *testing.T, serverRTTStats *utils.RTTStats) (client, server *updatableAEAD, serverEventRecorder *events.Recorder) {
+	cs := randomCipherSuite()
+	var eventRecorder events.Recorder
+
+	trafficSecret1 := make([]byte, 16)
+	trafficSecret2 := make([]byte, 16)
+	rand.Read(trafficSecret1)
+	rand.Read(trafficSecret2)
+
+	client = newUpdatableAEAD(utils.NewRTTStats(), nil, utils.DefaultLogger, protocol.Version1)
+	server = newUpdatableAEAD(serverRTTStats, &eventRecorder, utils.DefaultLogger, protocol.Version1)
+	client.SetReadKey(cs, trafficSecret2)
+	client.SetWriteKey(cs, trafficSecret1)
+	server.SetReadKey(cs, trafficSecret1)
+	server.SetWriteKey(cs, trafficSecret2)
+	return client, server, &eventRecorder
+}
+
+func bothSides(ev qlogwriter.Event) []qlogwriter.Event {
+	switch ev := ev.(type) {
+	case qlog.KeyDiscarded:
+		return []qlogwriter.Event{
+			qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: ev.KeyPhase,
+			},
+			qlog.KeyDiscarded{
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: ev.KeyPhase,
+			},
+		}
+	case qlog.KeyUpdated:
+		return []qlogwriter.Event{
+			qlog.KeyUpdated{
+				KeyType:  qlog.KeyTypeClient1RTT,
+				KeyPhase: ev.KeyPhase,
+				Trigger:  ev.Trigger,
+			},
+			qlog.KeyUpdated{
+				KeyType:  qlog.KeyTypeServer1RTT,
+				KeyPhase: ev.KeyPhase,
+				Trigger:  ev.Trigger,
+			},
+		}
+	default:
+		panic("unexpected event type: " + ev.Name())
+	}
+}
+
+func TestChaChaTestVector(t *testing.T) {
+	if fips140.Enabled() {
+		t.Skip("ChaCha20-Poly1305 is not allowed in FIPS 140-3 mode")
+	}
+
+	testCases := []struct {
+		name            string
+		version         protocol.Version
+		expectedPayload []byte
+		expectedPacket  []byte
+	}{
+		{
+			version:         protocol.Version1,
+			expectedPayload: splitHexString(t, "655e5cd55c41f69080575d7999c25a5bfb"),
+			expectedPacket:  splitHexString(t, "4cfe4189655e5cd55c41f69080575d7999c25a5bfb"),
+		},
+		{
+			version:         protocol.Version2,
+			expectedPayload: splitHexString(t, "0ae7b6b932bc27d786f4bc2bb20f2162ba"),
+			expectedPacket:  splitHexString(t, "5558b1c60ae7b6b932bc27d786f4bc2bb20f2162ba"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(fmt.Sprintf("QUIC %s", tc.version), func(t *testing.T) {
+			secret := splitHexString(t, "9ac312a7f877468ebe69422748ad00a1 5443f18203a07d6060f688f30f21632b")
+			aead := newUpdatableAEAD(utils.NewRTTStats(), nil, nil, tc.version)
+			chacha := getCipherSuite(tls.TLS_CHACHA20_POLY1305_SHA256)
+			require.Equal(t, tls.TLS_CHACHA20_POLY1305_SHA256, chacha.ID)
+			aead.SetWriteKey(chacha, secret)
+			const pnOffset = 1
+			header := splitHexString(t, "4200bff4")
+			payloadOffset := len(header)
+			plaintext := splitHexString(t, "01")
+			payload := aead.Seal(nil, plaintext, 654360564, header)
+			require.Equal(t, tc.expectedPayload, payload)
+			packet := append(header, payload...)
+			aead.EncryptHeader(packet[pnOffset+4:pnOffset+4+16], &packet[0], packet[pnOffset:payloadOffset])
+			require.Equal(t, tc.expectedPacket, packet)
+		})
+	}
+}
+
+func TestUpdatableAEADHeaderProtection(t *testing.T) {
+	for _, v := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		for _, cs := range cipherSuites {
+			t.Run(fmt.Sprintf("QUIC %s/%s", v, tls.CipherSuiteName(cs.ID)), func(t *testing.T) {
+				trafficSecret1 := make([]byte, 16)
+				trafficSecret2 := make([]byte, 16)
+				rand.Read(trafficSecret1)
+				rand.Read(trafficSecret2)
+
+				client := newUpdatableAEAD(utils.NewRTTStats(), nil, utils.DefaultLogger, v)
+				server := newUpdatableAEAD(utils.NewRTTStats(), nil, utils.DefaultLogger, v)
+				client.SetReadKey(cs, trafficSecret2)
+				client.SetWriteKey(cs, trafficSecret1)
+				server.SetReadKey(cs, trafficSecret1)
+				server.SetWriteKey(cs, trafficSecret2)
+
+				var lastFiveBitsDifferent int
+				for range 100 {
+					sample := make([]byte, 16)
+					rand.Read(sample)
+					header := []byte{0xb5, 1, 2, 3, 4, 5, 6, 7, 8, 0xde, 0xad, 0xbe, 0xef}
+					client.EncryptHeader(sample, &header[0], header[9:13])
+					if header[0]&0x1f != 0xb5&0x1f {
+						lastFiveBitsDifferent++
+					}
+					require.Equal(t, byte(0xb5&0xe0), header[0]&0xe0)
+					require.Equal(t, []byte{1, 2, 3, 4, 5, 6, 7, 8}, header[1:9])
+					require.NotEqual(t, []byte{0xde, 0xad, 0xbe, 0xef}, header[9:13])
+					server.DecryptHeader(sample, &header[0], header[9:13])
+					require.Equal(t, []byte{0xb5, 1, 2, 3, 4, 5, 6, 7, 8, 0xde, 0xad, 0xbe, 0xef}, header)
+				}
+				require.Greater(t, lastFiveBitsDifferent, 75)
+			})
+		}
+	}
+}
+
+func TestUpdatableAEADEncryptDecryptMessage(t *testing.T) {
+	for _, v := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		for _, cs := range cipherSuites {
+			t.Run(fmt.Sprintf("QUIC %s/%s", v, tls.CipherSuiteName(cs.ID)), func(t *testing.T) {
+				rttStats := utils.RTTStats{}
+				trafficSecret1 := make([]byte, 16)
+				trafficSecret2 := make([]byte, 16)
+				rand.Read(trafficSecret1)
+				rand.Read(trafficSecret2)
+
+				client := newUpdatableAEAD(&rttStats, nil, utils.DefaultLogger, v)
+				server := newUpdatableAEAD(&rttStats, nil, utils.DefaultLogger, v)
+				client.SetReadKey(cs, trafficSecret2)
+				client.SetWriteKey(cs, trafficSecret1)
+				server.SetReadKey(cs, trafficSecret1)
+				server.SetWriteKey(cs, trafficSecret2)
+
+				msg := []byte("Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.")
+				ad := []byte("Donec in velit neque.")
+
+				encrypted := server.Seal(nil, msg, 0x1337, ad)
+
+				opened, err := client.Open(nil, encrypted, monotime.Now(), 0x1337, protocol.KeyPhaseZero, ad)
+				require.NoError(t, err)
+				require.Equal(t, msg, opened)
+
+				_, err = client.Open(nil, encrypted, monotime.Now(), 0x1337, protocol.KeyPhaseZero, []byte("wrong ad"))
+				require.Equal(t, ErrDecryptionFailed, err)
+
+				_, err = client.Open(nil, encrypted, monotime.Now(), 0x42, protocol.KeyPhaseZero, ad)
+				require.Equal(t, ErrDecryptionFailed, err)
+			})
+		}
+	}
+}
+
+func TestUpdatableAEADPacketNumbers(t *testing.T) {
+	client, server, _ := setupEndpoints(t, utils.NewRTTStats())
+	msg := []byte("Lorem ipsum")
+	ad := []byte("Donec in velit neque.")
+
+	encrypted := server.Seal(nil, msg, 0x1337, ad)
+	require.Equal(t, protocol.PacketNumber(0x1337), server.FirstPacketNumber()) // make sure we save the first packet number
+	_ = server.Seal(nil, msg, 0x1338, ad)
+	require.Equal(t, protocol.PacketNumber(0x1337), server.FirstPacketNumber()) // make sure we save the first packet number
+
+	// check that decoding the packet number works as expected
+	_, err := client.Open(nil, encrypted[:len(encrypted)-1], monotime.Now(), 0x1337, protocol.KeyPhaseZero, ad)
+	require.Error(t, err)
+	require.Equal(t, protocol.PacketNumber(0x38), client.DecodePacketNumber(0x38, protocol.PacketNumberLen1))
+
+	_, err = client.Open(nil, encrypted, monotime.Now(), 0x1337, protocol.KeyPhaseZero, ad)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketNumber(0x1338), client.DecodePacketNumber(0x38, protocol.PacketNumberLen1))
+}
+
+func TestAEADLimitReached(t *testing.T) {
+	client, _, _ := setupEndpoints(t, utils.NewRTTStats())
+	client.invalidPacketLimit = 10
+	for i := range 9 {
+		_, err := client.Open(nil, []byte("foobar"), monotime.Now(), protocol.PacketNumber(i), protocol.KeyPhaseZero, []byte("ad"))
+		require.Equal(t, ErrDecryptionFailed, err)
+	}
+	_, err := client.Open(nil, []byte("foobar"), monotime.Now(), 10, protocol.KeyPhaseZero, []byte("ad"))
+	require.Error(t, err)
+	var transportErr *qerr.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, qerr.AEADLimitReached, transportErr.ErrorCode)
+}
+
+func TestKeyUpdates(t *testing.T) {
+	client, server, _ := setupEndpoints(t, utils.NewRTTStats())
+
+	now := monotime.Now()
+	require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+	encrypted0 := server.Seal(nil, []byte(msg), 0x1337, []byte(ad))
+	server.rollKeys()
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	encrypted1 := server.Seal(nil, []byte(msg), 0x1337, []byte(ad))
+	require.NotEqual(t, encrypted0, encrypted1)
+
+	_, err := client.Open(nil, encrypted1, now, 0x1337, protocol.KeyPhaseZero, []byte(ad))
+	require.Equal(t, ErrDecryptionFailed, err)
+
+	client.rollKeys()
+	decrypted, err := client.Open(nil, encrypted1, now, 0x1337, protocol.KeyPhaseOne, []byte(ad))
+	require.NoError(t, err)
+	require.Equal(t, msg, string(decrypted))
+}
+
+// func TestUpdatesKeysWhenReceivingPacketWithNextKeyPhase(t *testing.T) {
+// 	rttStats := utils.RTTStats{}
+// 	mockCtrl := gomock.NewController(t)
+// 	serverTracer := mocklogging.NewMockConnectionTracer(mockCtrl)
+
+// 	trafficSecret1 := make([]byte, 16)
+// 	trafficSecret2 := make([]byte, 16)
+// 	rand.Read(trafficSecret1)
+// 	rand.Read(trafficSecret2)
+
+// 	client := newUpdatableAEAD(&rttStats, nil, utils.DefaultLogger, protocol.Version1)
+// 	server := newUpdatableAEAD(&rttStats, serverTracer, utils.DefaultLogger, protocol.Version1)
+// 	client.SetReadKey(cs, trafficSecret2)
+// 	client.SetWriteKey(cs, trafficSecret1)
+// 	server.SetReadKey(cs, trafficSecret1)
+// 	server.SetWriteKey(cs, trafficSecret2)
+
+// 	now := monotime.Now()
+// 	encrypted0 := client.Seal(nil, []byte(msg), 0x42, ad)
+// 	decrypted, err := server.Open(nil, encrypted0, now, 0x42, protocol.KeyPhaseZero, ad)
+// 	require.NoError(t, err)
+// 	require.Equal(t, msg, decrypted)
+
+// 	require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+// 	_ = server.Seal(nil, msg, 0x1, ad)
+
+// 	client.rollKeys()
+// 	encrypted1 := client.Seal(nil, msg, 0x43, ad)
+// 	serverTracer.EXPECT().UpdatedKey(protocol.KeyPhase(1), true)
+// 	decrypted, err = server.Open(nil, encrypted1, now, 0x43, protocol.KeyPhaseOne, ad)
+// 	require.NoError(t, err)
+// 	require.Equal(t, msg, decrypted)
+// 	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+// }
+
+func TestReorderedPacketAfterKeyUpdate(t *testing.T) {
+	client, server, eventRecorder := setupEndpoints(t, utils.NewRTTStats())
+
+	now := monotime.Now()
+	encrypted01 := client.Seal(nil, []byte(msg), 0x42, []byte(ad))
+	encrypted02 := client.Seal(nil, []byte(msg), 0x43, []byte(ad))
+	_, err := server.Open(nil, encrypted01, now, 0x42, protocol.KeyPhaseZero, []byte(ad))
+	require.NoError(t, err)
+	_ = server.Seal(nil, []byte(msg), 0x1, []byte(ad))
+
+	client.rollKeys()
+	encrypted1 := client.Seal(nil, []byte(msg), 0x44, []byte(ad))
+	require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+	_, err = server.Open(nil, encrypted1, now, 0x44, protocol.KeyPhaseOne, []byte(ad))
+	require.NoError(t, err)
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	require.Equal(t,
+		bothSides(qlog.KeyUpdated{Trigger: qlog.KeyUpdateRemote, KeyPhase: 1}),
+		eventRecorder.Events(),
+	)
+
+	// now receive a reordered packet
+	decrypted, err := server.Open(nil, encrypted02, now, 0x43, protocol.KeyPhaseZero, []byte(ad))
+	require.NoError(t, err)
+	require.Equal(t, msg, string(decrypted))
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+}
+
+func TestDropsKeys3PTOsAfterKeyUpdate(t *testing.T) {
+	rttStats := utils.NewRTTStats()
+	client, server, eventRecorder := setupEndpoints(t, rttStats)
+
+	now := monotime.Now()
+	rttStats.UpdateRTT(10*time.Millisecond, 0)
+	pto := rttStats.PTO(true)
+	encrypted01 := client.Seal(nil, []byte(msg), 0x42, []byte(ad))
+	encrypted02 := client.Seal(nil, []byte(msg), 0x43, []byte(ad))
+	_, err := server.Open(nil, encrypted01, now, 0x42, protocol.KeyPhaseZero, []byte(ad))
+	require.NoError(t, err)
+	_ = server.Seal(nil, []byte(msg), 0x1, []byte(ad))
+
+	client.rollKeys()
+	encrypted1 := client.Seal(nil, []byte(msg), 0x44, []byte(ad))
+	require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+	_, err = server.Open(nil, encrypted1, now, 0x44, protocol.KeyPhaseOne, []byte(ad))
+	require.NoError(t, err)
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	require.Equal(t,
+		bothSides(qlog.KeyUpdated{KeyPhase: 1, Trigger: qlog.KeyUpdateRemote}),
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// packet arrived too late, the key was already dropped
+	_, err = server.Open(nil, encrypted02, now.Add(3*pto).Add(time.Nanosecond), 0x43, protocol.KeyPhaseZero, []byte(ad))
+	require.Equal(t, ErrKeysDropped, err)
+	require.Equal(t,
+		bothSides(qlog.KeyDiscarded{KeyPhase: 0}),
+		eventRecorder.Events(),
+	)
+}
+
+func TestAllowsFirstKeyUpdateImmediately(t *testing.T) {
+	client, server, serverTracer := setupEndpoints(t, utils.NewRTTStats())
+	client.rollKeys()
+	encrypted := client.Seal(nil, []byte(msg), 0x1337, []byte(ad))
+
+	// if decryption failed, we don't expect a key phase update
+	_, err := server.Open(nil, encrypted[:len(encrypted)-1], monotime.Now(), 0x1337, protocol.KeyPhaseOne, []byte(ad))
+	require.Equal(t, ErrDecryptionFailed, err)
+
+	// the key phase is updated on first successful decryption
+	_, err = server.Open(nil, encrypted, monotime.Now(), 0x1337, protocol.KeyPhaseOne, []byte(ad))
+	require.NoError(t, err)
+	require.Equal(t,
+		bothSides(qlog.KeyUpdated{KeyPhase: 1, Trigger: qlog.KeyUpdateRemote}),
+		serverTracer.Events(),
+	)
+}
+
+func TestRejectFrequentKeyUpdates(t *testing.T) {
+	client, server, _ := setupEndpoints(t, utils.NewRTTStats())
+
+	server.rollKeys()
+	client.rollKeys()
+	encrypted0 := client.Seal(nil, []byte(msg), 0x42, []byte(ad))
+	_, err := server.Open(nil, encrypted0, monotime.Now(), 0x42, protocol.KeyPhaseOne, []byte(ad))
+	require.NoError(t, err)
+
+	client.rollKeys()
+	encrypted1 := client.Seal(nil, []byte(msg), 0x42, []byte(ad))
+	_, err = server.Open(nil, encrypted1, monotime.Now(), 0x42, protocol.KeyPhaseZero, []byte(ad))
+	require.Equal(t, &qerr.TransportError{
+		ErrorCode:    qerr.KeyUpdateError,
+		ErrorMessage: "keys updated too quickly",
+	}, err)
+}
+
+func setKeyUpdateIntervals(t *testing.T, firstKeyUpdateInterval, keyUpdateInterval uint64) {
+	reset := SetKeyUpdateInterval(keyUpdateInterval)
+	t.Cleanup(reset)
+
+	origFirstKeyUpdateInterval := FirstKeyUpdateInterval
+	FirstKeyUpdateInterval = firstKeyUpdateInterval
+
+	t.Cleanup(func() { FirstKeyUpdateInterval = origFirstKeyUpdateInterval })
+}
+
+func TestInitiateKeyUpdateAfterSendingMaxPackets(t *testing.T) {
+	const firstKeyUpdateInterval = 5
+	const keyUpdateInterval = 20
+	setKeyUpdateIntervals(t, firstKeyUpdateInterval, keyUpdateInterval)
+
+	client, server, eventRecorder := setupEndpoints(t, utils.NewRTTStats())
+	server.SetHandshakeConfirmed()
+
+	var pn protocol.PacketNumber
+	// first key update
+	for range firstKeyUpdateInterval {
+		require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+		server.Seal(nil, []byte(msg), pn, []byte(ad))
+		pn++
+	}
+	// the first update is allowed without receiving an acknowledgement
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	require.Equal(t,
+		bothSides(qlog.KeyUpdated{KeyPhase: 1, Trigger: qlog.KeyUpdateLocal}),
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// subsequent key update
+	for range 2 * keyUpdateInterval {
+		require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+		server.Seal(nil, []byte(msg), pn, []byte(ad))
+		pn++
+	}
+	// no update allowed before receiving an acknowledgement for the current key phase
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	// receive an ACK for a packet sent in key phase 1
+	client.rollKeys()
+	b := client.Seal(nil, []byte("foobar"), 1, []byte("ad"))
+	_, err := server.Open(nil, b, monotime.Now(), 1, protocol.KeyPhaseOne, []byte("ad"))
+	require.NoError(t, err)
+	require.NoError(t, server.SetLargestAcked(firstKeyUpdateInterval))
+	require.Empty(t, eventRecorder.Events())
+
+	require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+	require.Equal(t,
+		append(
+			bothSides(qlog.KeyDiscarded{KeyPhase: 0}),
+			bothSides(qlog.KeyUpdated{KeyPhase: 2, Trigger: qlog.KeyUpdateLocal})...,
+		),
+		eventRecorder.Events(),
+	)
+}
+
+func TestKeyUpdateEnforceACKKeyPhase(t *testing.T) {
+	const firstKeyUpdateInterval = 5
+	setKeyUpdateIntervals(t, firstKeyUpdateInterval, protocol.KeyUpdateInterval)
+
+	_, server, eventRecorder := setupEndpoints(t, utils.NewRTTStats())
+	server.SetHandshakeConfirmed()
+
+	// First make sure that we update our keys.
+	for i := range firstKeyUpdateInterval {
+		pn := protocol.PacketNumber(i)
+		require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+		server.Seal(nil, []byte(msg), pn, []byte(ad))
+	}
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	require.Equal(t,
+		bothSides(qlog.KeyUpdated{KeyPhase: 1, Trigger: qlog.KeyUpdateLocal}),
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// Now that our keys are updated, send a packet using the new keys.
+	const nextPN = firstKeyUpdateInterval + 1
+	server.Seal(nil, []byte(msg), nextPN, []byte(ad))
+
+	for i := range firstKeyUpdateInterval {
+		// We haven't decrypted any packet in the new key phase yet.
+		// This means that the ACK must have been sent in the old key phase.
+		require.NoError(t, server.SetLargestAcked(protocol.PacketNumber(i)))
+	}
+
+	// We haven't decrypted any packet in the new key phase yet.
+	// This means that the ACK must have been sent in the old key phase.
+	err := server.SetLargestAcked(nextPN)
+	require.Error(t, err)
+	var transportErr *qerr.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, qerr.KeyUpdateError, transportErr.ErrorCode)
+	require.Equal(t, "received ACK for key phase 1, but peer didn't update keys", transportErr.ErrorMessage)
+	require.Empty(t, eventRecorder.Events())
+}
+
+func TestKeyUpdateAfterOpeningMaxPackets(t *testing.T) {
+	const firstKeyUpdateInterval = 5
+	const keyUpdateInterval = 20
+	setKeyUpdateIntervals(t, firstKeyUpdateInterval, keyUpdateInterval)
+
+	client, server, eventRecorder := setupEndpoints(t, utils.NewRTTStats())
+	server.SetHandshakeConfirmed()
+
+	msg := []byte("message")
+	ad := []byte("additional data")
+
+	// first key update
+	var pn protocol.PacketNumber
+	for range firstKeyUpdateInterval {
+		require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+		encrypted := client.Seal(nil, msg, pn, ad)
+		_, err := server.Open(nil, encrypted, monotime.Now(), pn, protocol.KeyPhaseZero, ad)
+		require.NoError(t, err)
+		pn++
+	}
+
+	// the first update is allowed without receiving an acknowledgement
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	require.Equal(t,
+		bothSides(qlog.KeyUpdated{KeyPhase: 1, Trigger: qlog.KeyUpdateLocal}),
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// subsequent key update
+	client.rollKeys()
+	for range keyUpdateInterval {
+		require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+		encrypted := client.Seal(nil, msg, pn, ad)
+		_, err := server.Open(nil, encrypted, monotime.Now(), pn, protocol.KeyPhaseOne, ad)
+		require.NoError(t, err)
+		pn++
+	}
+
+	// No update allowed before receiving an acknowledgement for the current key phase
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	server.Seal(nil, msg, 1, ad)
+	require.NoError(t, server.SetLargestAcked(firstKeyUpdateInterval+1))
+	require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+	require.Equal(t,
+		append(
+			bothSides(qlog.KeyDiscarded{KeyPhase: 0}),
+			bothSides(qlog.KeyUpdated{KeyPhase: 2, Trigger: qlog.KeyUpdateLocal})...,
+		),
+		eventRecorder.Events(),
+	)
+}
+
+func TestKeyUpdateKeyPhaseSkipping(t *testing.T) {
+	const firstKeyUpdateInterval = 5
+	const keyUpdateInterval = 20
+	setKeyUpdateIntervals(t, firstKeyUpdateInterval, keyUpdateInterval)
+
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(10*time.Millisecond, 0)
+	client, server, eventRecorder := setupEndpoints(t, rttStats)
+	server.SetHandshakeConfirmed()
+
+	now := monotime.Now()
+	data1 := client.Seal(nil, []byte(msg), 1, []byte(ad))
+	_, err := server.Open(nil, data1, now, 1, protocol.KeyPhaseZero, []byte(ad))
+	require.NoError(t, err)
+	for i := range firstKeyUpdateInterval {
+		pn := protocol.PacketNumber(i)
+		require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+		server.Seal(nil, []byte(msg), pn, []byte(ad))
+		require.NoError(t, server.SetLargestAcked(pn))
+	}
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	require.Equal(t,
+		bothSides(qlog.KeyUpdated{KeyPhase: 1, Trigger: qlog.KeyUpdateLocal}),
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// The server never received a packet at key phase 1.
+	// Make sure the key phase 0 is still there at a much later point.
+	data2 := client.Seal(nil, []byte(msg), 2, []byte(ad))
+	_, err = server.Open(nil, data2, now.Add(10*rttStats.PTO(true)), 2, protocol.KeyPhaseZero, []byte(ad))
+	require.NoError(t, err)
+	require.Empty(t, eventRecorder.Events())
+}
+
+func TestFastKeyUpdatesByPeer(t *testing.T) {
+	const firstKeyUpdateInterval = 5
+	const keyUpdateInterval = 20
+	setKeyUpdateIntervals(t, firstKeyUpdateInterval, keyUpdateInterval)
+
+	client, server, eventRecorder := setupEndpoints(t, utils.NewRTTStats())
+	server.SetHandshakeConfirmed()
+
+	var pn protocol.PacketNumber
+	for range firstKeyUpdateInterval {
+		require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+		server.Seal(nil, []byte(msg), pn, []byte(ad))
+		pn++
+	}
+	b := client.Seal(nil, []byte("foobar"), 1, []byte("ad"))
+	_, err := server.Open(nil, b, monotime.Now(), 1, protocol.KeyPhaseZero, []byte("ad"))
+	require.NoError(t, err)
+	require.NoError(t, server.SetLargestAcked(0))
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	require.Equal(t,
+		bothSides(qlog.KeyUpdated{KeyPhase: 1, Trigger: qlog.KeyUpdateLocal}),
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// Send and receive an acknowledgement for a packet in key phase 1.
+	// We are now running a timer to drop the keys with 3 PTO.
+	server.Seal(nil, []byte(msg), pn, []byte(ad))
+	client.rollKeys()
+	dataKeyPhaseOne := client.Seal(nil, []byte(msg), 2, []byte(ad))
+	now := monotime.Now()
+	_, err = server.Open(nil, dataKeyPhaseOne, now, 2, protocol.KeyPhaseOne, []byte(ad))
+	require.NoError(t, err)
+	require.NoError(t, server.SetLargestAcked(pn))
+	// Now the client sends us a packet in key phase 2, forcing us to update keys before the 3 PTO period is over.
+	// This mean that we need to drop the keys for key phase 0 immediately.
+	client.rollKeys()
+	dataKeyPhaseTwo := client.Seal(nil, []byte(msg), 3, []byte(ad))
+
+	_, err = server.Open(nil, dataKeyPhaseTwo, now, 3, protocol.KeyPhaseZero, []byte(ad))
+	require.NoError(t, err)
+	require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+	require.Equal(t,
+		append(
+			bothSides(qlog.KeyDiscarded{KeyPhase: 0}),
+			bothSides(qlog.KeyUpdated{KeyPhase: 2, Trigger: qlog.KeyUpdateRemote})...,
+		),
+		eventRecorder.Events(),
+	)
+}
+
+func TestFastKeyUpdateByUs(t *testing.T) {
+	const firstKeyUpdateInterval = 5
+	const keyUpdateInterval = 20
+	setKeyUpdateIntervals(t, firstKeyUpdateInterval, keyUpdateInterval)
+
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(10*time.Millisecond, 0)
+	client, server, eventRecorder := setupEndpoints(t, rttStats)
+	server.SetHandshakeConfirmed()
+
+	// send so many packets that we initiate the first key update
+	for i := range firstKeyUpdateInterval {
+		pn := protocol.PacketNumber(i)
+		require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+		server.Seal(nil, []byte(msg), pn, []byte(ad))
+	}
+	b := client.Seal(nil, []byte("foobar"), 1, []byte("ad"))
+	_, err := server.Open(nil, b, monotime.Now(), 1, protocol.KeyPhaseZero, []byte("ad"))
+	require.NoError(t, err)
+	require.NoError(t, server.SetLargestAcked(0))
+	require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+	require.Equal(t,
+		bothSides(qlog.KeyUpdated{KeyPhase: 1, Trigger: qlog.KeyUpdateLocal}),
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// send so many packets that we initiate the next key update
+	for i := keyUpdateInterval; i < 2*keyUpdateInterval; i++ {
+		pn := protocol.PacketNumber(i)
+		require.Equal(t, protocol.KeyPhaseOne, server.KeyPhase())
+		server.Seal(nil, []byte(msg), pn, []byte(ad))
+	}
+	client.rollKeys()
+	b = client.Seal(nil, []byte("foobar"), 2, []byte("ad"))
+	now := monotime.Now()
+	_, err = server.Open(nil, b, now, 2, protocol.KeyPhaseOne, []byte("ad"))
+	require.NoError(t, err)
+	require.NoError(t, server.SetLargestAcked(keyUpdateInterval))
+	require.Equal(t, protocol.KeyPhaseZero, server.KeyPhase())
+	require.Equal(t,
+		append(
+			bothSides(qlog.KeyDiscarded{KeyPhase: 0}),
+			bothSides(qlog.KeyUpdated{KeyPhase: 2, Trigger: qlog.KeyUpdateLocal})...,
+		),
+		eventRecorder.Events(),
+	)
+	eventRecorder.Clear()
+
+	// We haven't received an ACK for a packet sent in key phase 2 yet.
+	// Make sure we canceled the timer to drop the previous key phase.
+	b = client.Seal(nil, []byte("foobar"), 3, []byte("ad"))
+	_, err = server.Open(nil, b, now.Add(10*rttStats.PTO(true)), 3, protocol.KeyPhaseOne, []byte("ad"))
+	require.NoError(t, err)
+	require.Empty(t, eventRecorder.Events())
+}
+
+func getClientAndServer() (client, server *updatableAEAD) {
+	trafficSecret1 := make([]byte, 16)
+	trafficSecret2 := make([]byte, 16)
+	rand.Read(trafficSecret1)
+	rand.Read(trafficSecret2)
+
+	cs := cipherSuites[0]
+	rttStats := utils.NewRTTStats()
+	client = newUpdatableAEAD(rttStats, nil, utils.DefaultLogger, protocol.Version1)
+	server = newUpdatableAEAD(rttStats, nil, utils.DefaultLogger, protocol.Version1)
+	client.SetReadKey(cs, trafficSecret2)
+	client.SetWriteKey(cs, trafficSecret1)
+	server.SetReadKey(cs, trafficSecret1)
+	server.SetWriteKey(cs, trafficSecret2)
+	return
+}
+
+func BenchmarkPacketEncryption(b *testing.B) {
+	client, _ := getClientAndServer()
+	const l = 1200
+	src := make([]byte, l)
+	rand.Read(src)
+	ad := make([]byte, 32)
+	rand.Read(ad)
+
+	var pn protocol.PacketNumber
+	for b.Loop() {
+		src = client.Seal(src[:0], src[:l], pn, ad)
+		pn++
+	}
+}
+
+func BenchmarkPacketDecryption(b *testing.B) {
+	client, server := getClientAndServer()
+	const l = 1200
+	src := make([]byte, l)
+	dst := make([]byte, l)
+	rand.Read(src)
+	ad := make([]byte, 32)
+	rand.Read(ad)
+	src = client.Seal(src[:0], src[:l], 1337, ad)
+
+	for b.Loop() {
+		if _, err := server.Open(dst[:0], src, 0, 1337, protocol.KeyPhaseZero, ad); err != nil {
+			b.Fatalf("opening failed: %v", err)
+		}
+	}
+}
+
+func BenchmarkRollKeys(b *testing.B) {
+	client, _ := getClientAndServer()
+
+	for b.Loop() {
+		client.rollKeys()
+	}
+	if int(client.keyPhase) != b.N {
+		b.Fatal("didn't roll keys often enough")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/mocks/ackhandler/sent_packet_handler.go b/electron/native/private-transport/third_party/quic-go/internal/mocks/ackhandler/sent_packet_handler.go
new file mode 100644
index 000000000..d4dc26efb
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/mocks/ackhandler/sent_packet_handler.go
@@ -0,0 +1,640 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/internal/ackhandler (interfaces: SentPacketHandler)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package mockackhandler -destination ackhandler/sent_packet_handler.go github.com/quic-go/quic-go/internal/ackhandler SentPacketHandler
+//
+
+// Package mockackhandler is a generated GoMock package.
+package mockackhandler
+
+import (
+	reflect "reflect"
+
+	ackhandler "github.com/quic-go/quic-go/internal/ackhandler"
+	monotime "github.com/quic-go/quic-go/internal/monotime"
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	wire "github.com/quic-go/quic-go/internal/wire"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockSentPacketHandler is a mock of SentPacketHandler interface.
+type MockSentPacketHandler struct {
+	ctrl     *gomock.Controller
+	recorder *MockSentPacketHandlerMockRecorder
+	isgomock struct{}
+}
+
+// MockSentPacketHandlerMockRecorder is the mock recorder for MockSentPacketHandler.
+type MockSentPacketHandlerMockRecorder struct {
+	mock *MockSentPacketHandler
+}
+
+// NewMockSentPacketHandler creates a new mock instance.
+func NewMockSentPacketHandler(ctrl *gomock.Controller) *MockSentPacketHandler {
+	mock := &MockSentPacketHandler{ctrl: ctrl}
+	mock.recorder = &MockSentPacketHandlerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSentPacketHandler) EXPECT() *MockSentPacketHandlerMockRecorder {
+	return m.recorder
+}
+
+// DropPackets mocks base method.
+func (m *MockSentPacketHandler) DropPackets(arg0 protocol.EncryptionLevel, rcvTime monotime.Time) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DropPackets", arg0, rcvTime)
+}
+
+// DropPackets indicates an expected call of DropPackets.
+func (mr *MockSentPacketHandlerMockRecorder) DropPackets(arg0, rcvTime any) *MockSentPacketHandlerDropPacketsCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DropPackets", reflect.TypeOf((*MockSentPacketHandler)(nil).DropPackets), arg0, rcvTime)
+	return &MockSentPacketHandlerDropPacketsCall{Call: call}
+}
+
+// MockSentPacketHandlerDropPacketsCall wrap *gomock.Call
+type MockSentPacketHandlerDropPacketsCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerDropPacketsCall) Return() *MockSentPacketHandlerDropPacketsCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerDropPacketsCall) Do(f func(protocol.EncryptionLevel, monotime.Time)) *MockSentPacketHandlerDropPacketsCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerDropPacketsCall) DoAndReturn(f func(protocol.EncryptionLevel, monotime.Time)) *MockSentPacketHandlerDropPacketsCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ECNMode mocks base method.
+func (m *MockSentPacketHandler) ECNMode(isShortHeaderPacket bool) protocol.ECN {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ECNMode", isShortHeaderPacket)
+	ret0, _ := ret[0].(protocol.ECN)
+	return ret0
+}
+
+// ECNMode indicates an expected call of ECNMode.
+func (mr *MockSentPacketHandlerMockRecorder) ECNMode(isShortHeaderPacket any) *MockSentPacketHandlerECNModeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ECNMode", reflect.TypeOf((*MockSentPacketHandler)(nil).ECNMode), isShortHeaderPacket)
+	return &MockSentPacketHandlerECNModeCall{Call: call}
+}
+
+// MockSentPacketHandlerECNModeCall wrap *gomock.Call
+type MockSentPacketHandlerECNModeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerECNModeCall) Return(arg0 protocol.ECN) *MockSentPacketHandlerECNModeCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerECNModeCall) Do(f func(bool) protocol.ECN) *MockSentPacketHandlerECNModeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerECNModeCall) DoAndReturn(f func(bool) protocol.ECN) *MockSentPacketHandlerECNModeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// GetLossDetectionTimeout mocks base method.
+func (m *MockSentPacketHandler) GetLossDetectionTimeout() monotime.Time {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetLossDetectionTimeout")
+	ret0, _ := ret[0].(monotime.Time)
+	return ret0
+}
+
+// GetLossDetectionTimeout indicates an expected call of GetLossDetectionTimeout.
+func (mr *MockSentPacketHandlerMockRecorder) GetLossDetectionTimeout() *MockSentPacketHandlerGetLossDetectionTimeoutCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetLossDetectionTimeout", reflect.TypeOf((*MockSentPacketHandler)(nil).GetLossDetectionTimeout))
+	return &MockSentPacketHandlerGetLossDetectionTimeoutCall{Call: call}
+}
+
+// MockSentPacketHandlerGetLossDetectionTimeoutCall wrap *gomock.Call
+type MockSentPacketHandlerGetLossDetectionTimeoutCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerGetLossDetectionTimeoutCall) Return(arg0 monotime.Time) *MockSentPacketHandlerGetLossDetectionTimeoutCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerGetLossDetectionTimeoutCall) Do(f func() monotime.Time) *MockSentPacketHandlerGetLossDetectionTimeoutCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerGetLossDetectionTimeoutCall) DoAndReturn(f func() monotime.Time) *MockSentPacketHandlerGetLossDetectionTimeoutCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// MigratedPath mocks base method.
+func (m *MockSentPacketHandler) MigratedPath(now monotime.Time, initialMaxPacketSize protocol.ByteCount) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "MigratedPath", now, initialMaxPacketSize)
+}
+
+// MigratedPath indicates an expected call of MigratedPath.
+func (mr *MockSentPacketHandlerMockRecorder) MigratedPath(now, initialMaxPacketSize any) *MockSentPacketHandlerMigratedPathCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MigratedPath", reflect.TypeOf((*MockSentPacketHandler)(nil).MigratedPath), now, initialMaxPacketSize)
+	return &MockSentPacketHandlerMigratedPathCall{Call: call}
+}
+
+// MockSentPacketHandlerMigratedPathCall wrap *gomock.Call
+type MockSentPacketHandlerMigratedPathCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerMigratedPathCall) Return() *MockSentPacketHandlerMigratedPathCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerMigratedPathCall) Do(f func(monotime.Time, protocol.ByteCount)) *MockSentPacketHandlerMigratedPathCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerMigratedPathCall) DoAndReturn(f func(monotime.Time, protocol.ByteCount)) *MockSentPacketHandlerMigratedPathCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// OnLossDetectionTimeout mocks base method.
+func (m *MockSentPacketHandler) OnLossDetectionTimeout(now monotime.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "OnLossDetectionTimeout", now)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// OnLossDetectionTimeout indicates an expected call of OnLossDetectionTimeout.
+func (mr *MockSentPacketHandlerMockRecorder) OnLossDetectionTimeout(now any) *MockSentPacketHandlerOnLossDetectionTimeoutCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnLossDetectionTimeout", reflect.TypeOf((*MockSentPacketHandler)(nil).OnLossDetectionTimeout), now)
+	return &MockSentPacketHandlerOnLossDetectionTimeoutCall{Call: call}
+}
+
+// MockSentPacketHandlerOnLossDetectionTimeoutCall wrap *gomock.Call
+type MockSentPacketHandlerOnLossDetectionTimeoutCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerOnLossDetectionTimeoutCall) Return(arg0 error) *MockSentPacketHandlerOnLossDetectionTimeoutCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerOnLossDetectionTimeoutCall) Do(f func(monotime.Time) error) *MockSentPacketHandlerOnLossDetectionTimeoutCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerOnLossDetectionTimeoutCall) DoAndReturn(f func(monotime.Time) error) *MockSentPacketHandlerOnLossDetectionTimeoutCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// PeekPacketNumber mocks base method.
+func (m *MockSentPacketHandler) PeekPacketNumber(arg0 protocol.EncryptionLevel) (protocol.PacketNumber, protocol.PacketNumberLen) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PeekPacketNumber", arg0)
+	ret0, _ := ret[0].(protocol.PacketNumber)
+	ret1, _ := ret[1].(protocol.PacketNumberLen)
+	return ret0, ret1
+}
+
+// PeekPacketNumber indicates an expected call of PeekPacketNumber.
+func (mr *MockSentPacketHandlerMockRecorder) PeekPacketNumber(arg0 any) *MockSentPacketHandlerPeekPacketNumberCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PeekPacketNumber", reflect.TypeOf((*MockSentPacketHandler)(nil).PeekPacketNumber), arg0)
+	return &MockSentPacketHandlerPeekPacketNumberCall{Call: call}
+}
+
+// MockSentPacketHandlerPeekPacketNumberCall wrap *gomock.Call
+type MockSentPacketHandlerPeekPacketNumberCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerPeekPacketNumberCall) Return(arg0 protocol.PacketNumber, arg1 protocol.PacketNumberLen) *MockSentPacketHandlerPeekPacketNumberCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerPeekPacketNumberCall) Do(f func(protocol.EncryptionLevel) (protocol.PacketNumber, protocol.PacketNumberLen)) *MockSentPacketHandlerPeekPacketNumberCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerPeekPacketNumberCall) DoAndReturn(f func(protocol.EncryptionLevel) (protocol.PacketNumber, protocol.PacketNumberLen)) *MockSentPacketHandlerPeekPacketNumberCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// PopPacketNumber mocks base method.
+func (m *MockSentPacketHandler) PopPacketNumber(arg0 protocol.EncryptionLevel) protocol.PacketNumber {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PopPacketNumber", arg0)
+	ret0, _ := ret[0].(protocol.PacketNumber)
+	return ret0
+}
+
+// PopPacketNumber indicates an expected call of PopPacketNumber.
+func (mr *MockSentPacketHandlerMockRecorder) PopPacketNumber(arg0 any) *MockSentPacketHandlerPopPacketNumberCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PopPacketNumber", reflect.TypeOf((*MockSentPacketHandler)(nil).PopPacketNumber), arg0)
+	return &MockSentPacketHandlerPopPacketNumberCall{Call: call}
+}
+
+// MockSentPacketHandlerPopPacketNumberCall wrap *gomock.Call
+type MockSentPacketHandlerPopPacketNumberCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerPopPacketNumberCall) Return(arg0 protocol.PacketNumber) *MockSentPacketHandlerPopPacketNumberCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerPopPacketNumberCall) Do(f func(protocol.EncryptionLevel) protocol.PacketNumber) *MockSentPacketHandlerPopPacketNumberCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerPopPacketNumberCall) DoAndReturn(f func(protocol.EncryptionLevel) protocol.PacketNumber) *MockSentPacketHandlerPopPacketNumberCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// QueueProbePacket mocks base method.
+func (m *MockSentPacketHandler) QueueProbePacket(arg0 protocol.EncryptionLevel) bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "QueueProbePacket", arg0)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// QueueProbePacket indicates an expected call of QueueProbePacket.
+func (mr *MockSentPacketHandlerMockRecorder) QueueProbePacket(arg0 any) *MockSentPacketHandlerQueueProbePacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "QueueProbePacket", reflect.TypeOf((*MockSentPacketHandler)(nil).QueueProbePacket), arg0)
+	return &MockSentPacketHandlerQueueProbePacketCall{Call: call}
+}
+
+// MockSentPacketHandlerQueueProbePacketCall wrap *gomock.Call
+type MockSentPacketHandlerQueueProbePacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerQueueProbePacketCall) Return(arg0 bool) *MockSentPacketHandlerQueueProbePacketCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerQueueProbePacketCall) Do(f func(protocol.EncryptionLevel) bool) *MockSentPacketHandlerQueueProbePacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerQueueProbePacketCall) DoAndReturn(f func(protocol.EncryptionLevel) bool) *MockSentPacketHandlerQueueProbePacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ReceivedAck mocks base method.
+func (m *MockSentPacketHandler) ReceivedAck(f *wire.AckFrame, encLevel protocol.EncryptionLevel, rcvTime monotime.Time) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ReceivedAck", f, encLevel, rcvTime)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ReceivedAck indicates an expected call of ReceivedAck.
+func (mr *MockSentPacketHandlerMockRecorder) ReceivedAck(f, encLevel, rcvTime any) *MockSentPacketHandlerReceivedAckCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReceivedAck", reflect.TypeOf((*MockSentPacketHandler)(nil).ReceivedAck), f, encLevel, rcvTime)
+	return &MockSentPacketHandlerReceivedAckCall{Call: call}
+}
+
+// MockSentPacketHandlerReceivedAckCall wrap *gomock.Call
+type MockSentPacketHandlerReceivedAckCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerReceivedAckCall) Return(arg0 bool, arg1 error) *MockSentPacketHandlerReceivedAckCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerReceivedAckCall) Do(f func(*wire.AckFrame, protocol.EncryptionLevel, monotime.Time) (bool, error)) *MockSentPacketHandlerReceivedAckCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerReceivedAckCall) DoAndReturn(f func(*wire.AckFrame, protocol.EncryptionLevel, monotime.Time) (bool, error)) *MockSentPacketHandlerReceivedAckCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ReceivedBytes mocks base method.
+func (m *MockSentPacketHandler) ReceivedBytes(arg0 protocol.ByteCount, rcvTime monotime.Time) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ReceivedBytes", arg0, rcvTime)
+}
+
+// ReceivedBytes indicates an expected call of ReceivedBytes.
+func (mr *MockSentPacketHandlerMockRecorder) ReceivedBytes(arg0, rcvTime any) *MockSentPacketHandlerReceivedBytesCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReceivedBytes", reflect.TypeOf((*MockSentPacketHandler)(nil).ReceivedBytes), arg0, rcvTime)
+	return &MockSentPacketHandlerReceivedBytesCall{Call: call}
+}
+
+// MockSentPacketHandlerReceivedBytesCall wrap *gomock.Call
+type MockSentPacketHandlerReceivedBytesCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerReceivedBytesCall) Return() *MockSentPacketHandlerReceivedBytesCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerReceivedBytesCall) Do(f func(protocol.ByteCount, monotime.Time)) *MockSentPacketHandlerReceivedBytesCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerReceivedBytesCall) DoAndReturn(f func(protocol.ByteCount, monotime.Time)) *MockSentPacketHandlerReceivedBytesCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ReceivedPacket mocks base method.
+func (m *MockSentPacketHandler) ReceivedPacket(arg0 protocol.EncryptionLevel, arg1 monotime.Time) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ReceivedPacket", arg0, arg1)
+}
+
+// ReceivedPacket indicates an expected call of ReceivedPacket.
+func (mr *MockSentPacketHandlerMockRecorder) ReceivedPacket(arg0, arg1 any) *MockSentPacketHandlerReceivedPacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReceivedPacket", reflect.TypeOf((*MockSentPacketHandler)(nil).ReceivedPacket), arg0, arg1)
+	return &MockSentPacketHandlerReceivedPacketCall{Call: call}
+}
+
+// MockSentPacketHandlerReceivedPacketCall wrap *gomock.Call
+type MockSentPacketHandlerReceivedPacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerReceivedPacketCall) Return() *MockSentPacketHandlerReceivedPacketCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerReceivedPacketCall) Do(f func(protocol.EncryptionLevel, monotime.Time)) *MockSentPacketHandlerReceivedPacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerReceivedPacketCall) DoAndReturn(f func(protocol.EncryptionLevel, monotime.Time)) *MockSentPacketHandlerReceivedPacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ResetForRetry mocks base method.
+func (m *MockSentPacketHandler) ResetForRetry(rcvTime monotime.Time) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ResetForRetry", rcvTime)
+}
+
+// ResetForRetry indicates an expected call of ResetForRetry.
+func (mr *MockSentPacketHandlerMockRecorder) ResetForRetry(rcvTime any) *MockSentPacketHandlerResetForRetryCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ResetForRetry", reflect.TypeOf((*MockSentPacketHandler)(nil).ResetForRetry), rcvTime)
+	return &MockSentPacketHandlerResetForRetryCall{Call: call}
+}
+
+// MockSentPacketHandlerResetForRetryCall wrap *gomock.Call
+type MockSentPacketHandlerResetForRetryCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerResetForRetryCall) Return() *MockSentPacketHandlerResetForRetryCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerResetForRetryCall) Do(f func(monotime.Time)) *MockSentPacketHandlerResetForRetryCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerResetForRetryCall) DoAndReturn(f func(monotime.Time)) *MockSentPacketHandlerResetForRetryCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SendMode mocks base method.
+func (m *MockSentPacketHandler) SendMode(now monotime.Time) ackhandler.SendMode {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SendMode", now)
+	ret0, _ := ret[0].(ackhandler.SendMode)
+	return ret0
+}
+
+// SendMode indicates an expected call of SendMode.
+func (mr *MockSentPacketHandlerMockRecorder) SendMode(now any) *MockSentPacketHandlerSendModeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SendMode", reflect.TypeOf((*MockSentPacketHandler)(nil).SendMode), now)
+	return &MockSentPacketHandlerSendModeCall{Call: call}
+}
+
+// MockSentPacketHandlerSendModeCall wrap *gomock.Call
+type MockSentPacketHandlerSendModeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerSendModeCall) Return(arg0 ackhandler.SendMode) *MockSentPacketHandlerSendModeCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerSendModeCall) Do(f func(monotime.Time) ackhandler.SendMode) *MockSentPacketHandlerSendModeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerSendModeCall) DoAndReturn(f func(monotime.Time) ackhandler.SendMode) *MockSentPacketHandlerSendModeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SentPacket mocks base method.
+func (m *MockSentPacketHandler) SentPacket(t monotime.Time, pn, largestAcked protocol.PacketNumber, streamFrames []ackhandler.StreamFrame, frames []ackhandler.Frame, encLevel protocol.EncryptionLevel, ecn protocol.ECN, size protocol.ByteCount, isPathMTUProbePacket, isPathProbePacket bool) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SentPacket", t, pn, largestAcked, streamFrames, frames, encLevel, ecn, size, isPathMTUProbePacket, isPathProbePacket)
+}
+
+// SentPacket indicates an expected call of SentPacket.
+func (mr *MockSentPacketHandlerMockRecorder) SentPacket(t, pn, largestAcked, streamFrames, frames, encLevel, ecn, size, isPathMTUProbePacket, isPathProbePacket any) *MockSentPacketHandlerSentPacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SentPacket", reflect.TypeOf((*MockSentPacketHandler)(nil).SentPacket), t, pn, largestAcked, streamFrames, frames, encLevel, ecn, size, isPathMTUProbePacket, isPathProbePacket)
+	return &MockSentPacketHandlerSentPacketCall{Call: call}
+}
+
+// MockSentPacketHandlerSentPacketCall wrap *gomock.Call
+type MockSentPacketHandlerSentPacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerSentPacketCall) Return() *MockSentPacketHandlerSentPacketCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerSentPacketCall) Do(f func(monotime.Time, protocol.PacketNumber, protocol.PacketNumber, []ackhandler.StreamFrame, []ackhandler.Frame, protocol.EncryptionLevel, protocol.ECN, protocol.ByteCount, bool, bool)) *MockSentPacketHandlerSentPacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerSentPacketCall) DoAndReturn(f func(monotime.Time, protocol.PacketNumber, protocol.PacketNumber, []ackhandler.StreamFrame, []ackhandler.Frame, protocol.EncryptionLevel, protocol.ECN, protocol.ByteCount, bool, bool)) *MockSentPacketHandlerSentPacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetMaxDatagramSize mocks base method.
+func (m *MockSentPacketHandler) SetMaxDatagramSize(count protocol.ByteCount) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetMaxDatagramSize", count)
+}
+
+// SetMaxDatagramSize indicates an expected call of SetMaxDatagramSize.
+func (mr *MockSentPacketHandlerMockRecorder) SetMaxDatagramSize(count any) *MockSentPacketHandlerSetMaxDatagramSizeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetMaxDatagramSize", reflect.TypeOf((*MockSentPacketHandler)(nil).SetMaxDatagramSize), count)
+	return &MockSentPacketHandlerSetMaxDatagramSizeCall{Call: call}
+}
+
+// MockSentPacketHandlerSetMaxDatagramSizeCall wrap *gomock.Call
+type MockSentPacketHandlerSetMaxDatagramSizeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerSetMaxDatagramSizeCall) Return() *MockSentPacketHandlerSetMaxDatagramSizeCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerSetMaxDatagramSizeCall) Do(f func(protocol.ByteCount)) *MockSentPacketHandlerSetMaxDatagramSizeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerSetMaxDatagramSizeCall) DoAndReturn(f func(protocol.ByteCount)) *MockSentPacketHandlerSetMaxDatagramSizeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// TimeUntilSend mocks base method.
+func (m *MockSentPacketHandler) TimeUntilSend() monotime.Time {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "TimeUntilSend")
+	ret0, _ := ret[0].(monotime.Time)
+	return ret0
+}
+
+// TimeUntilSend indicates an expected call of TimeUntilSend.
+func (mr *MockSentPacketHandlerMockRecorder) TimeUntilSend() *MockSentPacketHandlerTimeUntilSendCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TimeUntilSend", reflect.TypeOf((*MockSentPacketHandler)(nil).TimeUntilSend))
+	return &MockSentPacketHandlerTimeUntilSendCall{Call: call}
+}
+
+// MockSentPacketHandlerTimeUntilSendCall wrap *gomock.Call
+type MockSentPacketHandlerTimeUntilSendCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSentPacketHandlerTimeUntilSendCall) Return(arg0 monotime.Time) *MockSentPacketHandlerTimeUntilSendCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSentPacketHandlerTimeUntilSendCall) Do(f func() monotime.Time) *MockSentPacketHandlerTimeUntilSendCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSentPacketHandlerTimeUntilSendCall) DoAndReturn(f func() monotime.Time) *MockSentPacketHandlerTimeUntilSendCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/mocks/congestion.go b/electron/native/private-transport/third_party/quic-go/internal/mocks/congestion.go
new file mode 100644
index 000000000..51355d11f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/mocks/congestion.go
@@ -0,0 +1,486 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/internal/congestion (interfaces: SendAlgorithmWithDebugInfos)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package mocks -destination congestion.go github.com/quic-go/quic-go/internal/congestion SendAlgorithmWithDebugInfos
+//
+
+// Package mocks is a generated GoMock package.
+package mocks
+
+import (
+	reflect "reflect"
+
+	monotime "github.com/quic-go/quic-go/internal/monotime"
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockSendAlgorithmWithDebugInfos is a mock of SendAlgorithmWithDebugInfos interface.
+type MockSendAlgorithmWithDebugInfos struct {
+	ctrl     *gomock.Controller
+	recorder *MockSendAlgorithmWithDebugInfosMockRecorder
+	isgomock struct{}
+}
+
+// MockSendAlgorithmWithDebugInfosMockRecorder is the mock recorder for MockSendAlgorithmWithDebugInfos.
+type MockSendAlgorithmWithDebugInfosMockRecorder struct {
+	mock *MockSendAlgorithmWithDebugInfos
+}
+
+// NewMockSendAlgorithmWithDebugInfos creates a new mock instance.
+func NewMockSendAlgorithmWithDebugInfos(ctrl *gomock.Controller) *MockSendAlgorithmWithDebugInfos {
+	mock := &MockSendAlgorithmWithDebugInfos{ctrl: ctrl}
+	mock.recorder = &MockSendAlgorithmWithDebugInfosMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSendAlgorithmWithDebugInfos) EXPECT() *MockSendAlgorithmWithDebugInfosMockRecorder {
+	return m.recorder
+}
+
+// CanSend mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) CanSend(bytesInFlight protocol.ByteCount) bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CanSend", bytesInFlight)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// CanSend indicates an expected call of CanSend.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) CanSend(bytesInFlight any) *MockSendAlgorithmWithDebugInfosCanSendCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CanSend", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).CanSend), bytesInFlight)
+	return &MockSendAlgorithmWithDebugInfosCanSendCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosCanSendCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosCanSendCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosCanSendCall) Return(arg0 bool) *MockSendAlgorithmWithDebugInfosCanSendCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosCanSendCall) Do(f func(protocol.ByteCount) bool) *MockSendAlgorithmWithDebugInfosCanSendCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosCanSendCall) DoAndReturn(f func(protocol.ByteCount) bool) *MockSendAlgorithmWithDebugInfosCanSendCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// GetCongestionWindow mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) GetCongestionWindow() protocol.ByteCount {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetCongestionWindow")
+	ret0, _ := ret[0].(protocol.ByteCount)
+	return ret0
+}
+
+// GetCongestionWindow indicates an expected call of GetCongestionWindow.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) GetCongestionWindow() *MockSendAlgorithmWithDebugInfosGetCongestionWindowCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetCongestionWindow", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).GetCongestionWindow))
+	return &MockSendAlgorithmWithDebugInfosGetCongestionWindowCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosGetCongestionWindowCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosGetCongestionWindowCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosGetCongestionWindowCall) Return(arg0 protocol.ByteCount) *MockSendAlgorithmWithDebugInfosGetCongestionWindowCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosGetCongestionWindowCall) Do(f func() protocol.ByteCount) *MockSendAlgorithmWithDebugInfosGetCongestionWindowCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosGetCongestionWindowCall) DoAndReturn(f func() protocol.ByteCount) *MockSendAlgorithmWithDebugInfosGetCongestionWindowCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// HasPacingBudget mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) HasPacingBudget(now monotime.Time) bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HasPacingBudget", now)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// HasPacingBudget indicates an expected call of HasPacingBudget.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) HasPacingBudget(now any) *MockSendAlgorithmWithDebugInfosHasPacingBudgetCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HasPacingBudget", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).HasPacingBudget), now)
+	return &MockSendAlgorithmWithDebugInfosHasPacingBudgetCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosHasPacingBudgetCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosHasPacingBudgetCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosHasPacingBudgetCall) Return(arg0 bool) *MockSendAlgorithmWithDebugInfosHasPacingBudgetCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosHasPacingBudgetCall) Do(f func(monotime.Time) bool) *MockSendAlgorithmWithDebugInfosHasPacingBudgetCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosHasPacingBudgetCall) DoAndReturn(f func(monotime.Time) bool) *MockSendAlgorithmWithDebugInfosHasPacingBudgetCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// InRecovery mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) InRecovery() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InRecovery")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// InRecovery indicates an expected call of InRecovery.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) InRecovery() *MockSendAlgorithmWithDebugInfosInRecoveryCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InRecovery", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).InRecovery))
+	return &MockSendAlgorithmWithDebugInfosInRecoveryCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosInRecoveryCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosInRecoveryCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosInRecoveryCall) Return(arg0 bool) *MockSendAlgorithmWithDebugInfosInRecoveryCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosInRecoveryCall) Do(f func() bool) *MockSendAlgorithmWithDebugInfosInRecoveryCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosInRecoveryCall) DoAndReturn(f func() bool) *MockSendAlgorithmWithDebugInfosInRecoveryCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// InSlowStart mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) InSlowStart() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InSlowStart")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// InSlowStart indicates an expected call of InSlowStart.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) InSlowStart() *MockSendAlgorithmWithDebugInfosInSlowStartCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InSlowStart", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).InSlowStart))
+	return &MockSendAlgorithmWithDebugInfosInSlowStartCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosInSlowStartCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosInSlowStartCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosInSlowStartCall) Return(arg0 bool) *MockSendAlgorithmWithDebugInfosInSlowStartCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosInSlowStartCall) Do(f func() bool) *MockSendAlgorithmWithDebugInfosInSlowStartCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosInSlowStartCall) DoAndReturn(f func() bool) *MockSendAlgorithmWithDebugInfosInSlowStartCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// MaybeExitSlowStart mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) MaybeExitSlowStart() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "MaybeExitSlowStart")
+}
+
+// MaybeExitSlowStart indicates an expected call of MaybeExitSlowStart.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) MaybeExitSlowStart() *MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MaybeExitSlowStart", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).MaybeExitSlowStart))
+	return &MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall) Return() *MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall) Do(f func()) *MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall) DoAndReturn(f func()) *MockSendAlgorithmWithDebugInfosMaybeExitSlowStartCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// OnCongestionEvent mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) OnCongestionEvent(number protocol.PacketNumber, lostBytes, priorInFlight protocol.ByteCount) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "OnCongestionEvent", number, lostBytes, priorInFlight)
+}
+
+// OnCongestionEvent indicates an expected call of OnCongestionEvent.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) OnCongestionEvent(number, lostBytes, priorInFlight any) *MockSendAlgorithmWithDebugInfosOnCongestionEventCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnCongestionEvent", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).OnCongestionEvent), number, lostBytes, priorInFlight)
+	return &MockSendAlgorithmWithDebugInfosOnCongestionEventCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosOnCongestionEventCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosOnCongestionEventCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosOnCongestionEventCall) Return() *MockSendAlgorithmWithDebugInfosOnCongestionEventCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosOnCongestionEventCall) Do(f func(protocol.PacketNumber, protocol.ByteCount, protocol.ByteCount)) *MockSendAlgorithmWithDebugInfosOnCongestionEventCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosOnCongestionEventCall) DoAndReturn(f func(protocol.PacketNumber, protocol.ByteCount, protocol.ByteCount)) *MockSendAlgorithmWithDebugInfosOnCongestionEventCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// OnPacketAcked mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) OnPacketAcked(number protocol.PacketNumber, ackedBytes, priorInFlight protocol.ByteCount, eventTime monotime.Time) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "OnPacketAcked", number, ackedBytes, priorInFlight, eventTime)
+}
+
+// OnPacketAcked indicates an expected call of OnPacketAcked.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) OnPacketAcked(number, ackedBytes, priorInFlight, eventTime any) *MockSendAlgorithmWithDebugInfosOnPacketAckedCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnPacketAcked", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).OnPacketAcked), number, ackedBytes, priorInFlight, eventTime)
+	return &MockSendAlgorithmWithDebugInfosOnPacketAckedCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosOnPacketAckedCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosOnPacketAckedCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosOnPacketAckedCall) Return() *MockSendAlgorithmWithDebugInfosOnPacketAckedCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosOnPacketAckedCall) Do(f func(protocol.PacketNumber, protocol.ByteCount, protocol.ByteCount, monotime.Time)) *MockSendAlgorithmWithDebugInfosOnPacketAckedCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosOnPacketAckedCall) DoAndReturn(f func(protocol.PacketNumber, protocol.ByteCount, protocol.ByteCount, monotime.Time)) *MockSendAlgorithmWithDebugInfosOnPacketAckedCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// OnPacketSent mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) OnPacketSent(sentTime monotime.Time, bytesInFlight protocol.ByteCount, packetNumber protocol.PacketNumber, bytes protocol.ByteCount, isRetransmittable bool) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "OnPacketSent", sentTime, bytesInFlight, packetNumber, bytes, isRetransmittable)
+}
+
+// OnPacketSent indicates an expected call of OnPacketSent.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) OnPacketSent(sentTime, bytesInFlight, packetNumber, bytes, isRetransmittable any) *MockSendAlgorithmWithDebugInfosOnPacketSentCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnPacketSent", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).OnPacketSent), sentTime, bytesInFlight, packetNumber, bytes, isRetransmittable)
+	return &MockSendAlgorithmWithDebugInfosOnPacketSentCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosOnPacketSentCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosOnPacketSentCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosOnPacketSentCall) Return() *MockSendAlgorithmWithDebugInfosOnPacketSentCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosOnPacketSentCall) Do(f func(monotime.Time, protocol.ByteCount, protocol.PacketNumber, protocol.ByteCount, bool)) *MockSendAlgorithmWithDebugInfosOnPacketSentCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosOnPacketSentCall) DoAndReturn(f func(monotime.Time, protocol.ByteCount, protocol.PacketNumber, protocol.ByteCount, bool)) *MockSendAlgorithmWithDebugInfosOnPacketSentCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// OnRetransmissionTimeout mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) OnRetransmissionTimeout(packetsRetransmitted bool) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "OnRetransmissionTimeout", packetsRetransmitted)
+}
+
+// OnRetransmissionTimeout indicates an expected call of OnRetransmissionTimeout.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) OnRetransmissionTimeout(packetsRetransmitted any) *MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OnRetransmissionTimeout", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).OnRetransmissionTimeout), packetsRetransmitted)
+	return &MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall) Return() *MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall) Do(f func(bool)) *MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall) DoAndReturn(f func(bool)) *MockSendAlgorithmWithDebugInfosOnRetransmissionTimeoutCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetMaxDatagramSize mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) SetMaxDatagramSize(arg0 protocol.ByteCount) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetMaxDatagramSize", arg0)
+}
+
+// SetMaxDatagramSize indicates an expected call of SetMaxDatagramSize.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) SetMaxDatagramSize(arg0 any) *MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetMaxDatagramSize", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).SetMaxDatagramSize), arg0)
+	return &MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall) Return() *MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall) Do(f func(protocol.ByteCount)) *MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall) DoAndReturn(f func(protocol.ByteCount)) *MockSendAlgorithmWithDebugInfosSetMaxDatagramSizeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// TimeUntilSend mocks base method.
+func (m *MockSendAlgorithmWithDebugInfos) TimeUntilSend(bytesInFlight protocol.ByteCount) monotime.Time {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "TimeUntilSend", bytesInFlight)
+	ret0, _ := ret[0].(monotime.Time)
+	return ret0
+}
+
+// TimeUntilSend indicates an expected call of TimeUntilSend.
+func (mr *MockSendAlgorithmWithDebugInfosMockRecorder) TimeUntilSend(bytesInFlight any) *MockSendAlgorithmWithDebugInfosTimeUntilSendCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TimeUntilSend", reflect.TypeOf((*MockSendAlgorithmWithDebugInfos)(nil).TimeUntilSend), bytesInFlight)
+	return &MockSendAlgorithmWithDebugInfosTimeUntilSendCall{Call: call}
+}
+
+// MockSendAlgorithmWithDebugInfosTimeUntilSendCall wrap *gomock.Call
+type MockSendAlgorithmWithDebugInfosTimeUntilSendCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendAlgorithmWithDebugInfosTimeUntilSendCall) Return(arg0 monotime.Time) *MockSendAlgorithmWithDebugInfosTimeUntilSendCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendAlgorithmWithDebugInfosTimeUntilSendCall) Do(f func(protocol.ByteCount) monotime.Time) *MockSendAlgorithmWithDebugInfosTimeUntilSendCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendAlgorithmWithDebugInfosTimeUntilSendCall) DoAndReturn(f func(protocol.ByteCount) monotime.Time) *MockSendAlgorithmWithDebugInfosTimeUntilSendCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/mocks/crypto_setup.go b/electron/native/private-transport/third_party/quic-go/internal/mocks/crypto_setup.go
new file mode 100644
index 000000000..e1b4b627d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/mocks/crypto_setup.go
@@ -0,0 +1,730 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/internal/handshake (interfaces: CryptoSetup)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package mocks -destination crypto_setup.go github.com/quic-go/quic-go/internal/handshake CryptoSetup
+//
+
+// Package mocks is a generated GoMock package.
+package mocks
+
+import (
+	context "context"
+	reflect "reflect"
+
+	handshake "github.com/quic-go/quic-go/internal/handshake"
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockCryptoSetup is a mock of CryptoSetup interface.
+type MockCryptoSetup struct {
+	ctrl     *gomock.Controller
+	recorder *MockCryptoSetupMockRecorder
+	isgomock struct{}
+}
+
+// MockCryptoSetupMockRecorder is the mock recorder for MockCryptoSetup.
+type MockCryptoSetupMockRecorder struct {
+	mock *MockCryptoSetup
+}
+
+// NewMockCryptoSetup creates a new mock instance.
+func NewMockCryptoSetup(ctrl *gomock.Controller) *MockCryptoSetup {
+	mock := &MockCryptoSetup{ctrl: ctrl}
+	mock.recorder = &MockCryptoSetupMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockCryptoSetup) EXPECT() *MockCryptoSetupMockRecorder {
+	return m.recorder
+}
+
+// ChangeConnectionID mocks base method.
+func (m *MockCryptoSetup) ChangeConnectionID(arg0 protocol.ConnectionID) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ChangeConnectionID", arg0)
+}
+
+// ChangeConnectionID indicates an expected call of ChangeConnectionID.
+func (mr *MockCryptoSetupMockRecorder) ChangeConnectionID(arg0 any) *MockCryptoSetupChangeConnectionIDCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ChangeConnectionID", reflect.TypeOf((*MockCryptoSetup)(nil).ChangeConnectionID), arg0)
+	return &MockCryptoSetupChangeConnectionIDCall{Call: call}
+}
+
+// MockCryptoSetupChangeConnectionIDCall wrap *gomock.Call
+type MockCryptoSetupChangeConnectionIDCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupChangeConnectionIDCall) Return() *MockCryptoSetupChangeConnectionIDCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupChangeConnectionIDCall) Do(f func(protocol.ConnectionID)) *MockCryptoSetupChangeConnectionIDCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupChangeConnectionIDCall) DoAndReturn(f func(protocol.ConnectionID)) *MockCryptoSetupChangeConnectionIDCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Close mocks base method.
+func (m *MockCryptoSetup) Close() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Close")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Close indicates an expected call of Close.
+func (mr *MockCryptoSetupMockRecorder) Close() *MockCryptoSetupCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockCryptoSetup)(nil).Close))
+	return &MockCryptoSetupCloseCall{Call: call}
+}
+
+// MockCryptoSetupCloseCall wrap *gomock.Call
+type MockCryptoSetupCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupCloseCall) Return(arg0 error) *MockCryptoSetupCloseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupCloseCall) Do(f func() error) *MockCryptoSetupCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupCloseCall) DoAndReturn(f func() error) *MockCryptoSetupCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ConnectionState mocks base method.
+func (m *MockCryptoSetup) ConnectionState() handshake.ConnectionState {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ConnectionState")
+	ret0, _ := ret[0].(handshake.ConnectionState)
+	return ret0
+}
+
+// ConnectionState indicates an expected call of ConnectionState.
+func (mr *MockCryptoSetupMockRecorder) ConnectionState() *MockCryptoSetupConnectionStateCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ConnectionState", reflect.TypeOf((*MockCryptoSetup)(nil).ConnectionState))
+	return &MockCryptoSetupConnectionStateCall{Call: call}
+}
+
+// MockCryptoSetupConnectionStateCall wrap *gomock.Call
+type MockCryptoSetupConnectionStateCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupConnectionStateCall) Return(arg0 handshake.ConnectionState) *MockCryptoSetupConnectionStateCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupConnectionStateCall) Do(f func() handshake.ConnectionState) *MockCryptoSetupConnectionStateCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupConnectionStateCall) DoAndReturn(f func() handshake.ConnectionState) *MockCryptoSetupConnectionStateCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// DiscardInitialKeys mocks base method.
+func (m *MockCryptoSetup) DiscardInitialKeys() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DiscardInitialKeys")
+}
+
+// DiscardInitialKeys indicates an expected call of DiscardInitialKeys.
+func (mr *MockCryptoSetupMockRecorder) DiscardInitialKeys() *MockCryptoSetupDiscardInitialKeysCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DiscardInitialKeys", reflect.TypeOf((*MockCryptoSetup)(nil).DiscardInitialKeys))
+	return &MockCryptoSetupDiscardInitialKeysCall{Call: call}
+}
+
+// MockCryptoSetupDiscardInitialKeysCall wrap *gomock.Call
+type MockCryptoSetupDiscardInitialKeysCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupDiscardInitialKeysCall) Return() *MockCryptoSetupDiscardInitialKeysCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupDiscardInitialKeysCall) Do(f func()) *MockCryptoSetupDiscardInitialKeysCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupDiscardInitialKeysCall) DoAndReturn(f func()) *MockCryptoSetupDiscardInitialKeysCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Get0RTTOpener mocks base method.
+func (m *MockCryptoSetup) Get0RTTOpener() (handshake.LongHeaderOpener, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Get0RTTOpener")
+	ret0, _ := ret[0].(handshake.LongHeaderOpener)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Get0RTTOpener indicates an expected call of Get0RTTOpener.
+func (mr *MockCryptoSetupMockRecorder) Get0RTTOpener() *MockCryptoSetupGet0RTTOpenerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get0RTTOpener", reflect.TypeOf((*MockCryptoSetup)(nil).Get0RTTOpener))
+	return &MockCryptoSetupGet0RTTOpenerCall{Call: call}
+}
+
+// MockCryptoSetupGet0RTTOpenerCall wrap *gomock.Call
+type MockCryptoSetupGet0RTTOpenerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupGet0RTTOpenerCall) Return(arg0 handshake.LongHeaderOpener, arg1 error) *MockCryptoSetupGet0RTTOpenerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupGet0RTTOpenerCall) Do(f func() (handshake.LongHeaderOpener, error)) *MockCryptoSetupGet0RTTOpenerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupGet0RTTOpenerCall) DoAndReturn(f func() (handshake.LongHeaderOpener, error)) *MockCryptoSetupGet0RTTOpenerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Get0RTTSealer mocks base method.
+func (m *MockCryptoSetup) Get0RTTSealer() (handshake.LongHeaderSealer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Get0RTTSealer")
+	ret0, _ := ret[0].(handshake.LongHeaderSealer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Get0RTTSealer indicates an expected call of Get0RTTSealer.
+func (mr *MockCryptoSetupMockRecorder) Get0RTTSealer() *MockCryptoSetupGet0RTTSealerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get0RTTSealer", reflect.TypeOf((*MockCryptoSetup)(nil).Get0RTTSealer))
+	return &MockCryptoSetupGet0RTTSealerCall{Call: call}
+}
+
+// MockCryptoSetupGet0RTTSealerCall wrap *gomock.Call
+type MockCryptoSetupGet0RTTSealerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupGet0RTTSealerCall) Return(arg0 handshake.LongHeaderSealer, arg1 error) *MockCryptoSetupGet0RTTSealerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupGet0RTTSealerCall) Do(f func() (handshake.LongHeaderSealer, error)) *MockCryptoSetupGet0RTTSealerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupGet0RTTSealerCall) DoAndReturn(f func() (handshake.LongHeaderSealer, error)) *MockCryptoSetupGet0RTTSealerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Get1RTTOpener mocks base method.
+func (m *MockCryptoSetup) Get1RTTOpener() (handshake.ShortHeaderOpener, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Get1RTTOpener")
+	ret0, _ := ret[0].(handshake.ShortHeaderOpener)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Get1RTTOpener indicates an expected call of Get1RTTOpener.
+func (mr *MockCryptoSetupMockRecorder) Get1RTTOpener() *MockCryptoSetupGet1RTTOpenerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get1RTTOpener", reflect.TypeOf((*MockCryptoSetup)(nil).Get1RTTOpener))
+	return &MockCryptoSetupGet1RTTOpenerCall{Call: call}
+}
+
+// MockCryptoSetupGet1RTTOpenerCall wrap *gomock.Call
+type MockCryptoSetupGet1RTTOpenerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupGet1RTTOpenerCall) Return(arg0 handshake.ShortHeaderOpener, arg1 error) *MockCryptoSetupGet1RTTOpenerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupGet1RTTOpenerCall) Do(f func() (handshake.ShortHeaderOpener, error)) *MockCryptoSetupGet1RTTOpenerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupGet1RTTOpenerCall) DoAndReturn(f func() (handshake.ShortHeaderOpener, error)) *MockCryptoSetupGet1RTTOpenerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Get1RTTSealer mocks base method.
+func (m *MockCryptoSetup) Get1RTTSealer() (handshake.ShortHeaderSealer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Get1RTTSealer")
+	ret0, _ := ret[0].(handshake.ShortHeaderSealer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Get1RTTSealer indicates an expected call of Get1RTTSealer.
+func (mr *MockCryptoSetupMockRecorder) Get1RTTSealer() *MockCryptoSetupGet1RTTSealerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get1RTTSealer", reflect.TypeOf((*MockCryptoSetup)(nil).Get1RTTSealer))
+	return &MockCryptoSetupGet1RTTSealerCall{Call: call}
+}
+
+// MockCryptoSetupGet1RTTSealerCall wrap *gomock.Call
+type MockCryptoSetupGet1RTTSealerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupGet1RTTSealerCall) Return(arg0 handshake.ShortHeaderSealer, arg1 error) *MockCryptoSetupGet1RTTSealerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupGet1RTTSealerCall) Do(f func() (handshake.ShortHeaderSealer, error)) *MockCryptoSetupGet1RTTSealerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupGet1RTTSealerCall) DoAndReturn(f func() (handshake.ShortHeaderSealer, error)) *MockCryptoSetupGet1RTTSealerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// GetHandshakeOpener mocks base method.
+func (m *MockCryptoSetup) GetHandshakeOpener() (handshake.LongHeaderOpener, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetHandshakeOpener")
+	ret0, _ := ret[0].(handshake.LongHeaderOpener)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetHandshakeOpener indicates an expected call of GetHandshakeOpener.
+func (mr *MockCryptoSetupMockRecorder) GetHandshakeOpener() *MockCryptoSetupGetHandshakeOpenerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetHandshakeOpener", reflect.TypeOf((*MockCryptoSetup)(nil).GetHandshakeOpener))
+	return &MockCryptoSetupGetHandshakeOpenerCall{Call: call}
+}
+
+// MockCryptoSetupGetHandshakeOpenerCall wrap *gomock.Call
+type MockCryptoSetupGetHandshakeOpenerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupGetHandshakeOpenerCall) Return(arg0 handshake.LongHeaderOpener, arg1 error) *MockCryptoSetupGetHandshakeOpenerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupGetHandshakeOpenerCall) Do(f func() (handshake.LongHeaderOpener, error)) *MockCryptoSetupGetHandshakeOpenerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupGetHandshakeOpenerCall) DoAndReturn(f func() (handshake.LongHeaderOpener, error)) *MockCryptoSetupGetHandshakeOpenerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// GetHandshakeSealer mocks base method.
+func (m *MockCryptoSetup) GetHandshakeSealer() (handshake.LongHeaderSealer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetHandshakeSealer")
+	ret0, _ := ret[0].(handshake.LongHeaderSealer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetHandshakeSealer indicates an expected call of GetHandshakeSealer.
+func (mr *MockCryptoSetupMockRecorder) GetHandshakeSealer() *MockCryptoSetupGetHandshakeSealerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetHandshakeSealer", reflect.TypeOf((*MockCryptoSetup)(nil).GetHandshakeSealer))
+	return &MockCryptoSetupGetHandshakeSealerCall{Call: call}
+}
+
+// MockCryptoSetupGetHandshakeSealerCall wrap *gomock.Call
+type MockCryptoSetupGetHandshakeSealerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupGetHandshakeSealerCall) Return(arg0 handshake.LongHeaderSealer, arg1 error) *MockCryptoSetupGetHandshakeSealerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupGetHandshakeSealerCall) Do(f func() (handshake.LongHeaderSealer, error)) *MockCryptoSetupGetHandshakeSealerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupGetHandshakeSealerCall) DoAndReturn(f func() (handshake.LongHeaderSealer, error)) *MockCryptoSetupGetHandshakeSealerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// GetInitialOpener mocks base method.
+func (m *MockCryptoSetup) GetInitialOpener() (handshake.LongHeaderOpener, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetInitialOpener")
+	ret0, _ := ret[0].(handshake.LongHeaderOpener)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetInitialOpener indicates an expected call of GetInitialOpener.
+func (mr *MockCryptoSetupMockRecorder) GetInitialOpener() *MockCryptoSetupGetInitialOpenerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetInitialOpener", reflect.TypeOf((*MockCryptoSetup)(nil).GetInitialOpener))
+	return &MockCryptoSetupGetInitialOpenerCall{Call: call}
+}
+
+// MockCryptoSetupGetInitialOpenerCall wrap *gomock.Call
+type MockCryptoSetupGetInitialOpenerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupGetInitialOpenerCall) Return(arg0 handshake.LongHeaderOpener, arg1 error) *MockCryptoSetupGetInitialOpenerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupGetInitialOpenerCall) Do(f func() (handshake.LongHeaderOpener, error)) *MockCryptoSetupGetInitialOpenerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupGetInitialOpenerCall) DoAndReturn(f func() (handshake.LongHeaderOpener, error)) *MockCryptoSetupGetInitialOpenerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// GetInitialSealer mocks base method.
+func (m *MockCryptoSetup) GetInitialSealer() (handshake.LongHeaderSealer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetInitialSealer")
+	ret0, _ := ret[0].(handshake.LongHeaderSealer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetInitialSealer indicates an expected call of GetInitialSealer.
+func (mr *MockCryptoSetupMockRecorder) GetInitialSealer() *MockCryptoSetupGetInitialSealerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetInitialSealer", reflect.TypeOf((*MockCryptoSetup)(nil).GetInitialSealer))
+	return &MockCryptoSetupGetInitialSealerCall{Call: call}
+}
+
+// MockCryptoSetupGetInitialSealerCall wrap *gomock.Call
+type MockCryptoSetupGetInitialSealerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupGetInitialSealerCall) Return(arg0 handshake.LongHeaderSealer, arg1 error) *MockCryptoSetupGetInitialSealerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupGetInitialSealerCall) Do(f func() (handshake.LongHeaderSealer, error)) *MockCryptoSetupGetInitialSealerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupGetInitialSealerCall) DoAndReturn(f func() (handshake.LongHeaderSealer, error)) *MockCryptoSetupGetInitialSealerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// GetSessionTicket mocks base method.
+func (m *MockCryptoSetup) GetSessionTicket() ([]byte, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetSessionTicket")
+	ret0, _ := ret[0].([]byte)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetSessionTicket indicates an expected call of GetSessionTicket.
+func (mr *MockCryptoSetupMockRecorder) GetSessionTicket() *MockCryptoSetupGetSessionTicketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetSessionTicket", reflect.TypeOf((*MockCryptoSetup)(nil).GetSessionTicket))
+	return &MockCryptoSetupGetSessionTicketCall{Call: call}
+}
+
+// MockCryptoSetupGetSessionTicketCall wrap *gomock.Call
+type MockCryptoSetupGetSessionTicketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupGetSessionTicketCall) Return(arg0 []byte, arg1 error) *MockCryptoSetupGetSessionTicketCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupGetSessionTicketCall) Do(f func() ([]byte, error)) *MockCryptoSetupGetSessionTicketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupGetSessionTicketCall) DoAndReturn(f func() ([]byte, error)) *MockCryptoSetupGetSessionTicketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// HandleMessage mocks base method.
+func (m *MockCryptoSetup) HandleMessage(arg0 []byte, arg1 protocol.EncryptionLevel) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HandleMessage", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// HandleMessage indicates an expected call of HandleMessage.
+func (mr *MockCryptoSetupMockRecorder) HandleMessage(arg0, arg1 any) *MockCryptoSetupHandleMessageCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HandleMessage", reflect.TypeOf((*MockCryptoSetup)(nil).HandleMessage), arg0, arg1)
+	return &MockCryptoSetupHandleMessageCall{Call: call}
+}
+
+// MockCryptoSetupHandleMessageCall wrap *gomock.Call
+type MockCryptoSetupHandleMessageCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupHandleMessageCall) Return(arg0 error) *MockCryptoSetupHandleMessageCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupHandleMessageCall) Do(f func([]byte, protocol.EncryptionLevel) error) *MockCryptoSetupHandleMessageCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupHandleMessageCall) DoAndReturn(f func([]byte, protocol.EncryptionLevel) error) *MockCryptoSetupHandleMessageCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// NextEvent mocks base method.
+func (m *MockCryptoSetup) NextEvent() handshake.Event {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NextEvent")
+	ret0, _ := ret[0].(handshake.Event)
+	return ret0
+}
+
+// NextEvent indicates an expected call of NextEvent.
+func (mr *MockCryptoSetupMockRecorder) NextEvent() *MockCryptoSetupNextEventCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NextEvent", reflect.TypeOf((*MockCryptoSetup)(nil).NextEvent))
+	return &MockCryptoSetupNextEventCall{Call: call}
+}
+
+// MockCryptoSetupNextEventCall wrap *gomock.Call
+type MockCryptoSetupNextEventCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupNextEventCall) Return(arg0 handshake.Event) *MockCryptoSetupNextEventCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupNextEventCall) Do(f func() handshake.Event) *MockCryptoSetupNextEventCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupNextEventCall) DoAndReturn(f func() handshake.Event) *MockCryptoSetupNextEventCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetHandshakeConfirmed mocks base method.
+func (m *MockCryptoSetup) SetHandshakeConfirmed() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetHandshakeConfirmed")
+}
+
+// SetHandshakeConfirmed indicates an expected call of SetHandshakeConfirmed.
+func (mr *MockCryptoSetupMockRecorder) SetHandshakeConfirmed() *MockCryptoSetupSetHandshakeConfirmedCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetHandshakeConfirmed", reflect.TypeOf((*MockCryptoSetup)(nil).SetHandshakeConfirmed))
+	return &MockCryptoSetupSetHandshakeConfirmedCall{Call: call}
+}
+
+// MockCryptoSetupSetHandshakeConfirmedCall wrap *gomock.Call
+type MockCryptoSetupSetHandshakeConfirmedCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupSetHandshakeConfirmedCall) Return() *MockCryptoSetupSetHandshakeConfirmedCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupSetHandshakeConfirmedCall) Do(f func()) *MockCryptoSetupSetHandshakeConfirmedCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupSetHandshakeConfirmedCall) DoAndReturn(f func()) *MockCryptoSetupSetHandshakeConfirmedCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetLargest1RTTAcked mocks base method.
+func (m *MockCryptoSetup) SetLargest1RTTAcked(arg0 protocol.PacketNumber) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetLargest1RTTAcked", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetLargest1RTTAcked indicates an expected call of SetLargest1RTTAcked.
+func (mr *MockCryptoSetupMockRecorder) SetLargest1RTTAcked(arg0 any) *MockCryptoSetupSetLargest1RTTAckedCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetLargest1RTTAcked", reflect.TypeOf((*MockCryptoSetup)(nil).SetLargest1RTTAcked), arg0)
+	return &MockCryptoSetupSetLargest1RTTAckedCall{Call: call}
+}
+
+// MockCryptoSetupSetLargest1RTTAckedCall wrap *gomock.Call
+type MockCryptoSetupSetLargest1RTTAckedCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupSetLargest1RTTAckedCall) Return(arg0 error) *MockCryptoSetupSetLargest1RTTAckedCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupSetLargest1RTTAckedCall) Do(f func(protocol.PacketNumber) error) *MockCryptoSetupSetLargest1RTTAckedCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupSetLargest1RTTAckedCall) DoAndReturn(f func(protocol.PacketNumber) error) *MockCryptoSetupSetLargest1RTTAckedCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// StartHandshake mocks base method.
+func (m *MockCryptoSetup) StartHandshake(arg0 context.Context) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "StartHandshake", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// StartHandshake indicates an expected call of StartHandshake.
+func (mr *MockCryptoSetupMockRecorder) StartHandshake(arg0 any) *MockCryptoSetupStartHandshakeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "StartHandshake", reflect.TypeOf((*MockCryptoSetup)(nil).StartHandshake), arg0)
+	return &MockCryptoSetupStartHandshakeCall{Call: call}
+}
+
+// MockCryptoSetupStartHandshakeCall wrap *gomock.Call
+type MockCryptoSetupStartHandshakeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockCryptoSetupStartHandshakeCall) Return(arg0 error) *MockCryptoSetupStartHandshakeCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockCryptoSetupStartHandshakeCall) Do(f func(context.Context) error) *MockCryptoSetupStartHandshakeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockCryptoSetupStartHandshakeCall) DoAndReturn(f func(context.Context) error) *MockCryptoSetupStartHandshakeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/mocks/long_header_opener.go b/electron/native/private-transport/third_party/quic-go/internal/mocks/long_header_opener.go
new file mode 100644
index 000000000..d37d082c3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/mocks/long_header_opener.go
@@ -0,0 +1,154 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/internal/handshake (interfaces: LongHeaderOpener)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package mocks -destination long_header_opener.go github.com/quic-go/quic-go/internal/handshake LongHeaderOpener
+//
+
+// Package mocks is a generated GoMock package.
+package mocks
+
+import (
+	reflect "reflect"
+
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockLongHeaderOpener is a mock of LongHeaderOpener interface.
+type MockLongHeaderOpener struct {
+	ctrl     *gomock.Controller
+	recorder *MockLongHeaderOpenerMockRecorder
+	isgomock struct{}
+}
+
+// MockLongHeaderOpenerMockRecorder is the mock recorder for MockLongHeaderOpener.
+type MockLongHeaderOpenerMockRecorder struct {
+	mock *MockLongHeaderOpener
+}
+
+// NewMockLongHeaderOpener creates a new mock instance.
+func NewMockLongHeaderOpener(ctrl *gomock.Controller) *MockLongHeaderOpener {
+	mock := &MockLongHeaderOpener{ctrl: ctrl}
+	mock.recorder = &MockLongHeaderOpenerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockLongHeaderOpener) EXPECT() *MockLongHeaderOpenerMockRecorder {
+	return m.recorder
+}
+
+// DecodePacketNumber mocks base method.
+func (m *MockLongHeaderOpener) DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DecodePacketNumber", wirePN, wirePNLen)
+	ret0, _ := ret[0].(protocol.PacketNumber)
+	return ret0
+}
+
+// DecodePacketNumber indicates an expected call of DecodePacketNumber.
+func (mr *MockLongHeaderOpenerMockRecorder) DecodePacketNumber(wirePN, wirePNLen any) *MockLongHeaderOpenerDecodePacketNumberCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DecodePacketNumber", reflect.TypeOf((*MockLongHeaderOpener)(nil).DecodePacketNumber), wirePN, wirePNLen)
+	return &MockLongHeaderOpenerDecodePacketNumberCall{Call: call}
+}
+
+// MockLongHeaderOpenerDecodePacketNumberCall wrap *gomock.Call
+type MockLongHeaderOpenerDecodePacketNumberCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockLongHeaderOpenerDecodePacketNumberCall) Return(arg0 protocol.PacketNumber) *MockLongHeaderOpenerDecodePacketNumberCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockLongHeaderOpenerDecodePacketNumberCall) Do(f func(protocol.PacketNumber, protocol.PacketNumberLen) protocol.PacketNumber) *MockLongHeaderOpenerDecodePacketNumberCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockLongHeaderOpenerDecodePacketNumberCall) DoAndReturn(f func(protocol.PacketNumber, protocol.PacketNumberLen) protocol.PacketNumber) *MockLongHeaderOpenerDecodePacketNumberCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// DecryptHeader mocks base method.
+func (m *MockLongHeaderOpener) DecryptHeader(sample []byte, firstByte *byte, pnBytes []byte) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DecryptHeader", sample, firstByte, pnBytes)
+}
+
+// DecryptHeader indicates an expected call of DecryptHeader.
+func (mr *MockLongHeaderOpenerMockRecorder) DecryptHeader(sample, firstByte, pnBytes any) *MockLongHeaderOpenerDecryptHeaderCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DecryptHeader", reflect.TypeOf((*MockLongHeaderOpener)(nil).DecryptHeader), sample, firstByte, pnBytes)
+	return &MockLongHeaderOpenerDecryptHeaderCall{Call: call}
+}
+
+// MockLongHeaderOpenerDecryptHeaderCall wrap *gomock.Call
+type MockLongHeaderOpenerDecryptHeaderCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockLongHeaderOpenerDecryptHeaderCall) Return() *MockLongHeaderOpenerDecryptHeaderCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockLongHeaderOpenerDecryptHeaderCall) Do(f func([]byte, *byte, []byte)) *MockLongHeaderOpenerDecryptHeaderCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockLongHeaderOpenerDecryptHeaderCall) DoAndReturn(f func([]byte, *byte, []byte)) *MockLongHeaderOpenerDecryptHeaderCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Open mocks base method.
+func (m *MockLongHeaderOpener) Open(dst, src []byte, pn protocol.PacketNumber, associatedData []byte) ([]byte, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Open", dst, src, pn, associatedData)
+	ret0, _ := ret[0].([]byte)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Open indicates an expected call of Open.
+func (mr *MockLongHeaderOpenerMockRecorder) Open(dst, src, pn, associatedData any) *MockLongHeaderOpenerOpenCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Open", reflect.TypeOf((*MockLongHeaderOpener)(nil).Open), dst, src, pn, associatedData)
+	return &MockLongHeaderOpenerOpenCall{Call: call}
+}
+
+// MockLongHeaderOpenerOpenCall wrap *gomock.Call
+type MockLongHeaderOpenerOpenCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockLongHeaderOpenerOpenCall) Return(arg0 []byte, arg1 error) *MockLongHeaderOpenerOpenCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockLongHeaderOpenerOpenCall) Do(f func([]byte, []byte, protocol.PacketNumber, []byte) ([]byte, error)) *MockLongHeaderOpenerOpenCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockLongHeaderOpenerOpenCall) DoAndReturn(f func([]byte, []byte, protocol.PacketNumber, []byte) ([]byte, error)) *MockLongHeaderOpenerOpenCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/mocks/mockgen.go b/electron/native/private-transport/third_party/quic-go/internal/mocks/mockgen.go
new file mode 100644
index 000000000..e2692a1f5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/mocks/mockgen.go
@@ -0,0 +1,10 @@
+//go:build gomock || generate
+
+package mocks
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package mocks -destination short_header_sealer.go github.com/quic-go/quic-go/internal/handshake ShortHeaderSealer"
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package mocks -destination short_header_opener.go github.com/quic-go/quic-go/internal/handshake ShortHeaderOpener"
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package mocks -destination long_header_opener.go github.com/quic-go/quic-go/internal/handshake LongHeaderOpener"
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package mocks -destination crypto_setup.go github.com/quic-go/quic-go/internal/handshake CryptoSetup"
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package mocks -destination congestion.go github.com/quic-go/quic-go/internal/congestion SendAlgorithmWithDebugInfos"
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package mockackhandler -destination ackhandler/sent_packet_handler.go github.com/quic-go/quic-go/internal/ackhandler SentPacketHandler"
diff --git a/electron/native/private-transport/third_party/quic-go/internal/mocks/short_header_opener.go b/electron/native/private-transport/third_party/quic-go/internal/mocks/short_header_opener.go
new file mode 100644
index 000000000..de5cfe660
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/mocks/short_header_opener.go
@@ -0,0 +1,155 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/internal/handshake (interfaces: ShortHeaderOpener)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package mocks -destination short_header_opener.go github.com/quic-go/quic-go/internal/handshake ShortHeaderOpener
+//
+
+// Package mocks is a generated GoMock package.
+package mocks
+
+import (
+	reflect "reflect"
+
+	monotime "github.com/quic-go/quic-go/internal/monotime"
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockShortHeaderOpener is a mock of ShortHeaderOpener interface.
+type MockShortHeaderOpener struct {
+	ctrl     *gomock.Controller
+	recorder *MockShortHeaderOpenerMockRecorder
+	isgomock struct{}
+}
+
+// MockShortHeaderOpenerMockRecorder is the mock recorder for MockShortHeaderOpener.
+type MockShortHeaderOpenerMockRecorder struct {
+	mock *MockShortHeaderOpener
+}
+
+// NewMockShortHeaderOpener creates a new mock instance.
+func NewMockShortHeaderOpener(ctrl *gomock.Controller) *MockShortHeaderOpener {
+	mock := &MockShortHeaderOpener{ctrl: ctrl}
+	mock.recorder = &MockShortHeaderOpenerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockShortHeaderOpener) EXPECT() *MockShortHeaderOpenerMockRecorder {
+	return m.recorder
+}
+
+// DecodePacketNumber mocks base method.
+func (m *MockShortHeaderOpener) DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DecodePacketNumber", wirePN, wirePNLen)
+	ret0, _ := ret[0].(protocol.PacketNumber)
+	return ret0
+}
+
+// DecodePacketNumber indicates an expected call of DecodePacketNumber.
+func (mr *MockShortHeaderOpenerMockRecorder) DecodePacketNumber(wirePN, wirePNLen any) *MockShortHeaderOpenerDecodePacketNumberCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DecodePacketNumber", reflect.TypeOf((*MockShortHeaderOpener)(nil).DecodePacketNumber), wirePN, wirePNLen)
+	return &MockShortHeaderOpenerDecodePacketNumberCall{Call: call}
+}
+
+// MockShortHeaderOpenerDecodePacketNumberCall wrap *gomock.Call
+type MockShortHeaderOpenerDecodePacketNumberCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockShortHeaderOpenerDecodePacketNumberCall) Return(arg0 protocol.PacketNumber) *MockShortHeaderOpenerDecodePacketNumberCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockShortHeaderOpenerDecodePacketNumberCall) Do(f func(protocol.PacketNumber, protocol.PacketNumberLen) protocol.PacketNumber) *MockShortHeaderOpenerDecodePacketNumberCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockShortHeaderOpenerDecodePacketNumberCall) DoAndReturn(f func(protocol.PacketNumber, protocol.PacketNumberLen) protocol.PacketNumber) *MockShortHeaderOpenerDecodePacketNumberCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// DecryptHeader mocks base method.
+func (m *MockShortHeaderOpener) DecryptHeader(sample []byte, firstByte *byte, pnBytes []byte) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DecryptHeader", sample, firstByte, pnBytes)
+}
+
+// DecryptHeader indicates an expected call of DecryptHeader.
+func (mr *MockShortHeaderOpenerMockRecorder) DecryptHeader(sample, firstByte, pnBytes any) *MockShortHeaderOpenerDecryptHeaderCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DecryptHeader", reflect.TypeOf((*MockShortHeaderOpener)(nil).DecryptHeader), sample, firstByte, pnBytes)
+	return &MockShortHeaderOpenerDecryptHeaderCall{Call: call}
+}
+
+// MockShortHeaderOpenerDecryptHeaderCall wrap *gomock.Call
+type MockShortHeaderOpenerDecryptHeaderCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockShortHeaderOpenerDecryptHeaderCall) Return() *MockShortHeaderOpenerDecryptHeaderCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockShortHeaderOpenerDecryptHeaderCall) Do(f func([]byte, *byte, []byte)) *MockShortHeaderOpenerDecryptHeaderCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockShortHeaderOpenerDecryptHeaderCall) DoAndReturn(f func([]byte, *byte, []byte)) *MockShortHeaderOpenerDecryptHeaderCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Open mocks base method.
+func (m *MockShortHeaderOpener) Open(dst, src []byte, rcvTime monotime.Time, pn protocol.PacketNumber, kp protocol.KeyPhaseBit, associatedData []byte) ([]byte, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Open", dst, src, rcvTime, pn, kp, associatedData)
+	ret0, _ := ret[0].([]byte)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Open indicates an expected call of Open.
+func (mr *MockShortHeaderOpenerMockRecorder) Open(dst, src, rcvTime, pn, kp, associatedData any) *MockShortHeaderOpenerOpenCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Open", reflect.TypeOf((*MockShortHeaderOpener)(nil).Open), dst, src, rcvTime, pn, kp, associatedData)
+	return &MockShortHeaderOpenerOpenCall{Call: call}
+}
+
+// MockShortHeaderOpenerOpenCall wrap *gomock.Call
+type MockShortHeaderOpenerOpenCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockShortHeaderOpenerOpenCall) Return(arg0 []byte, arg1 error) *MockShortHeaderOpenerOpenCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockShortHeaderOpenerOpenCall) Do(f func([]byte, []byte, monotime.Time, protocol.PacketNumber, protocol.KeyPhaseBit, []byte) ([]byte, error)) *MockShortHeaderOpenerOpenCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockShortHeaderOpenerOpenCall) DoAndReturn(f func([]byte, []byte, monotime.Time, protocol.PacketNumber, protocol.KeyPhaseBit, []byte) ([]byte, error)) *MockShortHeaderOpenerOpenCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/mocks/short_header_sealer.go b/electron/native/private-transport/third_party/quic-go/internal/mocks/short_header_sealer.go
new file mode 100644
index 000000000..9e5e09b67
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/mocks/short_header_sealer.go
@@ -0,0 +1,191 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go/internal/handshake (interfaces: ShortHeaderSealer)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package mocks -destination short_header_sealer.go github.com/quic-go/quic-go/internal/handshake ShortHeaderSealer
+//
+
+// Package mocks is a generated GoMock package.
+package mocks
+
+import (
+	reflect "reflect"
+
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockShortHeaderSealer is a mock of ShortHeaderSealer interface.
+type MockShortHeaderSealer struct {
+	ctrl     *gomock.Controller
+	recorder *MockShortHeaderSealerMockRecorder
+	isgomock struct{}
+}
+
+// MockShortHeaderSealerMockRecorder is the mock recorder for MockShortHeaderSealer.
+type MockShortHeaderSealerMockRecorder struct {
+	mock *MockShortHeaderSealer
+}
+
+// NewMockShortHeaderSealer creates a new mock instance.
+func NewMockShortHeaderSealer(ctrl *gomock.Controller) *MockShortHeaderSealer {
+	mock := &MockShortHeaderSealer{ctrl: ctrl}
+	mock.recorder = &MockShortHeaderSealerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockShortHeaderSealer) EXPECT() *MockShortHeaderSealerMockRecorder {
+	return m.recorder
+}
+
+// EncryptHeader mocks base method.
+func (m *MockShortHeaderSealer) EncryptHeader(sample []byte, firstByte *byte, pnBytes []byte) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "EncryptHeader", sample, firstByte, pnBytes)
+}
+
+// EncryptHeader indicates an expected call of EncryptHeader.
+func (mr *MockShortHeaderSealerMockRecorder) EncryptHeader(sample, firstByte, pnBytes any) *MockShortHeaderSealerEncryptHeaderCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "EncryptHeader", reflect.TypeOf((*MockShortHeaderSealer)(nil).EncryptHeader), sample, firstByte, pnBytes)
+	return &MockShortHeaderSealerEncryptHeaderCall{Call: call}
+}
+
+// MockShortHeaderSealerEncryptHeaderCall wrap *gomock.Call
+type MockShortHeaderSealerEncryptHeaderCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockShortHeaderSealerEncryptHeaderCall) Return() *MockShortHeaderSealerEncryptHeaderCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockShortHeaderSealerEncryptHeaderCall) Do(f func([]byte, *byte, []byte)) *MockShortHeaderSealerEncryptHeaderCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockShortHeaderSealerEncryptHeaderCall) DoAndReturn(f func([]byte, *byte, []byte)) *MockShortHeaderSealerEncryptHeaderCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// KeyPhase mocks base method.
+func (m *MockShortHeaderSealer) KeyPhase() protocol.KeyPhaseBit {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "KeyPhase")
+	ret0, _ := ret[0].(protocol.KeyPhaseBit)
+	return ret0
+}
+
+// KeyPhase indicates an expected call of KeyPhase.
+func (mr *MockShortHeaderSealerMockRecorder) KeyPhase() *MockShortHeaderSealerKeyPhaseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "KeyPhase", reflect.TypeOf((*MockShortHeaderSealer)(nil).KeyPhase))
+	return &MockShortHeaderSealerKeyPhaseCall{Call: call}
+}
+
+// MockShortHeaderSealerKeyPhaseCall wrap *gomock.Call
+type MockShortHeaderSealerKeyPhaseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockShortHeaderSealerKeyPhaseCall) Return(arg0 protocol.KeyPhaseBit) *MockShortHeaderSealerKeyPhaseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockShortHeaderSealerKeyPhaseCall) Do(f func() protocol.KeyPhaseBit) *MockShortHeaderSealerKeyPhaseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockShortHeaderSealerKeyPhaseCall) DoAndReturn(f func() protocol.KeyPhaseBit) *MockShortHeaderSealerKeyPhaseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Overhead mocks base method.
+func (m *MockShortHeaderSealer) Overhead() int {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Overhead")
+	ret0, _ := ret[0].(int)
+	return ret0
+}
+
+// Overhead indicates an expected call of Overhead.
+func (mr *MockShortHeaderSealerMockRecorder) Overhead() *MockShortHeaderSealerOverheadCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Overhead", reflect.TypeOf((*MockShortHeaderSealer)(nil).Overhead))
+	return &MockShortHeaderSealerOverheadCall{Call: call}
+}
+
+// MockShortHeaderSealerOverheadCall wrap *gomock.Call
+type MockShortHeaderSealerOverheadCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockShortHeaderSealerOverheadCall) Return(arg0 int) *MockShortHeaderSealerOverheadCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockShortHeaderSealerOverheadCall) Do(f func() int) *MockShortHeaderSealerOverheadCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockShortHeaderSealerOverheadCall) DoAndReturn(f func() int) *MockShortHeaderSealerOverheadCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Seal mocks base method.
+func (m *MockShortHeaderSealer) Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Seal", dst, src, packetNumber, associatedData)
+	ret0, _ := ret[0].([]byte)
+	return ret0
+}
+
+// Seal indicates an expected call of Seal.
+func (mr *MockShortHeaderSealerMockRecorder) Seal(dst, src, packetNumber, associatedData any) *MockShortHeaderSealerSealCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Seal", reflect.TypeOf((*MockShortHeaderSealer)(nil).Seal), dst, src, packetNumber, associatedData)
+	return &MockShortHeaderSealerSealCall{Call: call}
+}
+
+// MockShortHeaderSealerSealCall wrap *gomock.Call
+type MockShortHeaderSealerSealCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockShortHeaderSealerSealCall) Return(arg0 []byte) *MockShortHeaderSealerSealCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockShortHeaderSealerSealCall) Do(f func([]byte, []byte, protocol.PacketNumber, []byte) []byte) *MockShortHeaderSealerSealCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockShortHeaderSealerSealCall) DoAndReturn(f func([]byte, []byte, protocol.PacketNumber, []byte) []byte) *MockShortHeaderSealerSealCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/monotime/time.go b/electron/native/private-transport/third_party/quic-go/internal/monotime/time.go
new file mode 100644
index 000000000..eda61dc69
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/monotime/time.go
@@ -0,0 +1,90 @@
+// Package monotime provides a monotonic time representation that is useful for
+// measuring elapsed time.
+// It is designed as a memory optimized drop-in replacement for time.Time, with
+// a monotime.Time consuming just 8 bytes instead of 24 bytes.
+package monotime
+
+import (
+	"time"
+)
+
+// The absolute value doesn't matter, but it should be in the past,
+// so that every timestamp obtained with Now() is non-zero,
+// even on systems with low timer resolutions (e.g. Windows).
+var start = time.Now().Add(-time.Hour)
+
+// A Time represents an instant in monotonic time.
+// Times can be compared using the comparison operators, but the specific
+// value is implementation-dependent and should not be relied upon.
+// The zero value of Time doesn't have any specific meaning.
+type Time int64
+
+// Now returns the current monotonic time.
+func Now() Time {
+	return Time(time.Since(start).Nanoseconds())
+}
+
+// Sub returns the duration t-t2. If the result exceeds the maximum (or minimum)
+// value that can be stored in a Duration, the maximum (or minimum) duration
+// will be returned.
+// To compute t-d for a duration d, use t.Add(-d).
+func (t Time) Sub(t2 Time) time.Duration {
+	return time.Duration(t - t2)
+}
+
+// Add returns the time t+d.
+func (t Time) Add(d time.Duration) Time {
+	return Time(int64(t) + d.Nanoseconds())
+}
+
+// After reports whether the time instant t is after t2.
+func (t Time) After(t2 Time) bool {
+	return t > t2
+}
+
+// Before reports whether the time instant t is before t2.
+func (t Time) Before(t2 Time) bool {
+	return t < t2
+}
+
+// IsZero reports whether t represents the zero time instant.
+func (t Time) IsZero() bool {
+	return t == 0
+}
+
+// Equal reports whether t and t2 represent the same time instant.
+func (t Time) Equal(t2 Time) bool {
+	return t == t2
+}
+
+// ToTime converts the monotonic time to a time.Time value.
+// The returned time.Time will have the same instant as the monotonic time,
+// but may be subject to clock adjustments.
+func (t Time) ToTime() time.Time {
+	if t.IsZero() {
+		return time.Time{}
+	}
+	return start.Add(time.Duration(t))
+}
+
+// Since returns the time elapsed since t. It is shorthand for Now().Sub(t).
+func Since(t Time) time.Duration {
+	return Now().Sub(t)
+}
+
+// Until returns the duration until t.
+// It is shorthand for t.Sub(Now()).
+// If t is in the past, the returned duration will be negative.
+func Until(t Time) time.Duration {
+	return time.Duration(t - Now())
+}
+
+// FromTime converts a time.Time to a monotonic Time.
+// The conversion is relative to the package's start time and may lose
+// precision if the time.Time is far from the start time.
+func FromTime(t time.Time) Time {
+	if t.IsZero() {
+		return 0
+	}
+	return Time(t.Sub(start).Nanoseconds())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/monotime/time_test.go b/electron/native/private-transport/third_party/quic-go/internal/monotime/time_test.go
new file mode 100644
index 000000000..390af6ebb
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/monotime/time_test.go
@@ -0,0 +1,78 @@
+package monotime
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestTimeRelations(t *testing.T) {
+	t1 := Now()
+	require.Equal(t, t1, t1)
+	require.False(t, t1.IsZero())
+
+	t2 := t1.Add(time.Second)
+
+	require.False(t, t1.Equal(t2))
+	require.False(t, t2.Equal(t1))
+
+	require.True(t, t2.After(t1))
+	require.False(t, t1.After(t2))
+	require.False(t, t2.Before(t1))
+
+	require.Equal(t, t2.Sub(t1), time.Second)
+	require.Equal(t, t1.Sub(t2), -time.Second)
+}
+
+func TestSince(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		t1 := Now()
+		time.Sleep(time.Second)
+		require.Equal(t, Since(t1), time.Second)
+		require.Equal(t, Now().Sub(t1), time.Second)
+		time.Sleep(time.Minute)
+		require.Equal(t, Since(t1), time.Minute+time.Second)
+		require.Equal(t, Now().Sub(t1), time.Minute+time.Second)
+	})
+}
+
+func TestUntil(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		t1 := Now().Add(time.Minute)
+		require.Equal(t, Until(t1), time.Minute)
+		require.Equal(t, t1.Sub(Now()), time.Minute)
+		time.Sleep(15 * time.Second)
+		require.Equal(t, Until(t1), 45*time.Second)
+		require.Equal(t, t1.Sub(Now()), 45*time.Second)
+	})
+}
+
+func TestConversions(t *testing.T) {
+	t1 := Now()
+	t1Time := t1.ToTime()
+	require.Equal(t, FromTime(t1Time), t1)
+	require.Zero(t, t1Time.Sub(t1.ToTime()))
+
+	var zeroTime time.Time
+	require.Zero(t, FromTime(zeroTime))
+	require.Zero(t, FromTime(zeroTime))
+
+	var zero Time
+	require.True(t, zero.ToTime().IsZero())
+}
+
+func BenchmarkNow(b *testing.B) {
+	b.Run("Now", func(b *testing.B) {
+		for b.Loop() {
+			_ = Now()
+		}
+	})
+
+	b.Run("time.Now", func(b *testing.B) {
+		for b.Loop() {
+			_ = time.Now()
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/connection_id.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/connection_id.go
new file mode 100644
index 000000000..ce3171fc5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/connection_id.go
@@ -0,0 +1,116 @@
+package protocol
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"io"
+)
+
+var ErrInvalidConnectionIDLen = errors.New("invalid Connection ID length")
+
+// An ArbitraryLenConnectionID is a QUIC Connection ID able to represent Connection IDs according to RFC 8999.
+// Future QUIC versions might allow connection ID lengths up to 255 bytes, while QUIC v1
+// restricts the length to 20 bytes.
+type ArbitraryLenConnectionID []byte
+
+func (c ArbitraryLenConnectionID) Len() int {
+	return len(c)
+}
+
+func (c ArbitraryLenConnectionID) Bytes() []byte {
+	return c
+}
+
+func (c ArbitraryLenConnectionID) String() string {
+	if c.Len() == 0 {
+		return "(empty)"
+	}
+	return hex.EncodeToString(c.Bytes())
+}
+
+const maxConnectionIDLen = 20
+
+// A ConnectionID in QUIC
+type ConnectionID struct {
+	b [20]byte
+	l uint8
+}
+
+// GenerateConnectionID generates a connection ID using cryptographic random
+func GenerateConnectionID(l int) (ConnectionID, error) {
+	var c ConnectionID
+	c.l = uint8(l)
+	_, err := rand.Read(c.b[:l])
+	return c, err
+}
+
+// ParseConnectionID interprets b as a Connection ID.
+// It panics if b is longer than 20 bytes.
+func ParseConnectionID(b []byte) ConnectionID {
+	if len(b) > maxConnectionIDLen {
+		panic("invalid conn id length")
+	}
+	var c ConnectionID
+	c.l = uint8(len(b))
+	copy(c.b[:c.l], b)
+	return c
+}
+
+// GenerateConnectionIDForInitial generates a connection ID for the Initial packet.
+// It uses a length randomly chosen between 8 and 20 bytes.
+func GenerateConnectionIDForInitial() (ConnectionID, error) {
+	r := make([]byte, 1)
+	if _, err := rand.Read(r); err != nil {
+		return ConnectionID{}, err
+	}
+	l := MinConnectionIDLenInitial + int(r[0])%(maxConnectionIDLen-MinConnectionIDLenInitial+1)
+	return GenerateConnectionID(l)
+}
+
+// ReadConnectionID reads a connection ID of length len from the given io.Reader.
+// It returns io.EOF if there are not enough bytes to read.
+func ReadConnectionID(r io.Reader, l int) (ConnectionID, error) {
+	var c ConnectionID
+	if l == 0 {
+		return c, nil
+	}
+	if l > maxConnectionIDLen {
+		return c, ErrInvalidConnectionIDLen
+	}
+	c.l = uint8(l)
+	_, err := io.ReadFull(r, c.b[:l])
+	if err == io.ErrUnexpectedEOF {
+		return c, io.EOF
+	}
+	return c, err
+}
+
+// Len returns the length of the connection ID in bytes
+func (c ConnectionID) Len() int {
+	return int(c.l)
+}
+
+// Bytes returns the byte representation
+func (c ConnectionID) Bytes() []byte {
+	return c.b[:c.l]
+}
+
+func (c ConnectionID) String() string {
+	if c.Len() == 0 {
+		return "(empty)"
+	}
+	return hex.EncodeToString(c.Bytes())
+}
+
+type DefaultConnectionIDGenerator struct {
+	ConnLen int
+}
+
+func (d *DefaultConnectionIDGenerator) GenerateConnectionID() (ConnectionID, error) {
+	return GenerateConnectionID(d.ConnLen)
+}
+
+func (d *DefaultConnectionIDGenerator) ConnectionIDLen() int {
+	return d.ConnLen
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/connection_id_test.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/connection_id_test.go
new file mode 100644
index 000000000..f658ca2c9
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/connection_id_test.go
@@ -0,0 +1,92 @@
+package protocol
+
+import (
+	"bytes"
+	"crypto/rand"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateRandomConnectionIDs(t *testing.T) {
+	c1, err := GenerateConnectionID(8)
+	require.NoError(t, err)
+	require.NotZero(t, c1)
+	require.Equal(t, 8, c1.Len())
+	c2, err := GenerateConnectionID(8)
+	require.NoError(t, err)
+	require.NotEqual(t, c1, c2)
+	require.Equal(t, 8, c2.Len())
+}
+
+func TestGenerateRandomLengthDestinationConnectionIDs(t *testing.T) {
+	var has8ByteConnID, has20ByteConnID bool
+	for range 1000 {
+		c, err := GenerateConnectionIDForInitial()
+		require.NoError(t, err)
+		require.GreaterOrEqual(t, c.Len(), 8)
+		require.LessOrEqual(t, c.Len(), 20)
+		if c.Len() == 8 {
+			has8ByteConnID = true
+		}
+		if c.Len() == 20 {
+			has20ByteConnID = true
+		}
+	}
+	require.True(t, has8ByteConnID)
+	require.True(t, has20ByteConnID)
+}
+
+func TestConnectionID(t *testing.T) {
+	buf := bytes.NewBuffer([]byte{0xde, 0xad, 0xbe, 0xef, 0x42})
+	c, err := ReadConnectionID(buf, 5)
+	require.NoError(t, err)
+	require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef, 0x42}, c.Bytes())
+	require.Equal(t, 5, c.Len())
+	require.Equal(t, "deadbeef42", c.String())
+
+	// too few bytes
+	_, err = ReadConnectionID(buf, 10)
+	require.Equal(t, io.EOF, err)
+
+	// zero length
+	c2, err := ReadConnectionID(buf, 0)
+	require.NoError(t, err)
+	require.Zero(t, c2.Len())
+
+	// connection ID can have a length of a maximum of 20 bytes
+	buf2 := bytes.NewBuffer(make([]byte, 21))
+	_, err = ReadConnectionID(buf2, 21)
+	require.Equal(t, ErrInvalidConnectionIDLen, err)
+}
+
+func TestConnectionIDZeroValue(t *testing.T) {
+	var c ConnectionID
+	require.Zero(t, c.Len())
+	require.Empty(t, c.Bytes())
+	require.Equal(t, "(empty)", (ConnectionID{}).String())
+}
+
+// The string representation of a connection ID is used in qlog, so it should be fast.
+func BenchmarkConnectionIDStringer(b *testing.B) {
+	c := ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef, 0x42})
+	b.ReportAllocs()
+	for b.Loop() {
+		_ = c.String()
+	}
+}
+
+func TestArbitraryLenConnectionID(t *testing.T) {
+	b := make([]byte, 42)
+	rand.Read(b)
+	c := ArbitraryLenConnectionID(b)
+	require.Equal(t, b, c.Bytes())
+	require.Equal(t, 42, c.Len())
+}
+
+func TestArbitraryLenConnectionIDStringer(t *testing.T) {
+	require.Equal(t, "(empty)", (ArbitraryLenConnectionID{}).String())
+	c := ArbitraryLenConnectionID([]byte{0xde, 0xad, 0xbe, 0xef, 0x42})
+	require.Equal(t, "deadbeef42", c.String())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/encryption_level.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/encryption_level.go
new file mode 100644
index 000000000..40aa331aa
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/encryption_level.go
@@ -0,0 +1,65 @@
+package protocol
+
+import (
+	"crypto/tls"
+	"fmt"
+)
+
+// EncryptionLevel is the encryption level
+// Default value is Unencrypted
+type EncryptionLevel uint8
+
+const (
+	// EncryptionInitial is the Initial encryption level
+	EncryptionInitial EncryptionLevel = 1 + iota
+	// EncryptionHandshake is the Handshake encryption level
+	EncryptionHandshake
+	// Encryption0RTT is the 0-RTT encryption level
+	Encryption0RTT
+	// Encryption1RTT is the 1-RTT encryption level
+	Encryption1RTT
+)
+
+func (e EncryptionLevel) String() string {
+	switch e {
+	case EncryptionInitial:
+		return "Initial"
+	case EncryptionHandshake:
+		return "Handshake"
+	case Encryption0RTT:
+		return "0-RTT"
+	case Encryption1RTT:
+		return "1-RTT"
+	}
+	return "unknown"
+}
+
+func (e EncryptionLevel) ToTLSEncryptionLevel() tls.QUICEncryptionLevel {
+	switch e {
+	case EncryptionInitial:
+		return tls.QUICEncryptionLevelInitial
+	case EncryptionHandshake:
+		return tls.QUICEncryptionLevelHandshake
+	case Encryption1RTT:
+		return tls.QUICEncryptionLevelApplication
+	case Encryption0RTT:
+		return tls.QUICEncryptionLevelEarly
+	default:
+		panic(fmt.Sprintf("unexpected encryption level: %s", e))
+	}
+}
+
+func FromTLSEncryptionLevel(e tls.QUICEncryptionLevel) EncryptionLevel {
+	switch e {
+	case tls.QUICEncryptionLevelInitial:
+		return EncryptionInitial
+	case tls.QUICEncryptionLevelHandshake:
+		return EncryptionHandshake
+	case tls.QUICEncryptionLevelApplication:
+		return Encryption1RTT
+	case tls.QUICEncryptionLevelEarly:
+		return Encryption0RTT
+	default:
+		panic(fmt.Sprintf("unexpect encryption level: %s", e))
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/encryption_level_test.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/encryption_level_test.go
new file mode 100644
index 000000000..7792a3642
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/encryption_level_test.go
@@ -0,0 +1,40 @@
+package protocol
+
+import (
+	"crypto/tls"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestEncryptionLevelNonZeroValue(t *testing.T) {
+	require.NotZero(t, EncryptionInitial*EncryptionHandshake*Encryption0RTT*Encryption1RTT)
+}
+
+func TestEncryptionLevelConversion(t *testing.T) {
+	testCases := []struct {
+		quicLevel EncryptionLevel
+		tlsLevel  tls.QUICEncryptionLevel
+	}{
+		{EncryptionInitial, tls.QUICEncryptionLevelInitial},
+		{EncryptionHandshake, tls.QUICEncryptionLevelHandshake},
+		{Encryption1RTT, tls.QUICEncryptionLevelApplication},
+		{Encryption0RTT, tls.QUICEncryptionLevelEarly},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.quicLevel.String(), func(t *testing.T) {
+			// conversion from QUIC to TLS encryption level
+			require.Equal(t, tc.tlsLevel, tc.quicLevel.ToTLSEncryptionLevel())
+			// conversion from TLS to QUIC encryption level
+			require.Equal(t, tc.quicLevel, FromTLSEncryptionLevel(tc.tlsLevel))
+		})
+	}
+}
+
+func TestEncryptionLevelStringRepresentation(t *testing.T) {
+	require.Equal(t, "Initial", EncryptionInitial.String())
+	require.Equal(t, "Handshake", EncryptionHandshake.String())
+	require.Equal(t, "0-RTT", Encryption0RTT.String())
+	require.Equal(t, "1-RTT", Encryption1RTT.String())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/key_phase.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/key_phase.go
new file mode 100644
index 000000000..edd740cf6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/key_phase.go
@@ -0,0 +1,36 @@
+package protocol
+
+// KeyPhase is the key phase
+type KeyPhase uint64
+
+// Bit determines the key phase bit
+func (p KeyPhase) Bit() KeyPhaseBit {
+	if p%2 == 0 {
+		return KeyPhaseZero
+	}
+	return KeyPhaseOne
+}
+
+// KeyPhaseBit is the key phase bit
+type KeyPhaseBit uint8
+
+const (
+	// KeyPhaseUndefined is an undefined key phase
+	KeyPhaseUndefined KeyPhaseBit = iota
+	// KeyPhaseZero is key phase 0
+	KeyPhaseZero
+	// KeyPhaseOne is key phase 1
+	KeyPhaseOne
+)
+
+func (p KeyPhaseBit) String() string {
+	//nolint:exhaustive
+	switch p {
+	case KeyPhaseZero:
+		return "0"
+	case KeyPhaseOne:
+		return "1"
+	default:
+		return "undefined"
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/key_phase_test.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/key_phase_test.go
new file mode 100644
index 000000000..34b335159
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/key_phase_test.go
@@ -0,0 +1,26 @@
+package protocol
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestKeyPhaseBitDefaultValue(t *testing.T) {
+	var k KeyPhaseBit
+	require.Equal(t, KeyPhaseUndefined, k)
+}
+
+func TestKeyPhaseStringRepresentation(t *testing.T) {
+	require.Equal(t, "0", KeyPhaseZero.String())
+	require.Equal(t, "1", KeyPhaseOne.String())
+}
+
+func TestKeyPhaseToBit(t *testing.T) {
+	require.Equal(t, KeyPhaseZero, KeyPhase(0).Bit())
+	require.Equal(t, KeyPhaseZero, KeyPhase(2).Bit())
+	require.Equal(t, KeyPhaseZero, KeyPhase(4).Bit())
+	require.Equal(t, KeyPhaseOne, KeyPhase(1).Bit())
+	require.Equal(t, KeyPhaseOne, KeyPhase(3).Bit())
+	require.Equal(t, KeyPhaseOne, KeyPhase(5).Bit())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/packet_number.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/packet_number.go
new file mode 100644
index 000000000..9422db924
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/packet_number.go
@@ -0,0 +1,57 @@
+package protocol
+
+// A PacketNumber in QUIC
+type PacketNumber int64
+
+// InvalidPacketNumber is a packet number that is never sent.
+// In QUIC, 0 is a valid packet number.
+const InvalidPacketNumber PacketNumber = -1
+
+// PacketNumberLen is the length of the packet number in bytes
+type PacketNumberLen uint8
+
+const (
+	// PacketNumberLen1 is a packet number length of 1 byte
+	PacketNumberLen1 PacketNumberLen = 1
+	// PacketNumberLen2 is a packet number length of 2 bytes
+	PacketNumberLen2 PacketNumberLen = 2
+	// PacketNumberLen3 is a packet number length of 3 bytes
+	PacketNumberLen3 PacketNumberLen = 3
+	// PacketNumberLen4 is a packet number length of 4 bytes
+	PacketNumberLen4 PacketNumberLen = 4
+)
+
+// DecodePacketNumber calculates the packet number based its length and the last seen packet number
+// This function is taken from https://www.rfc-editor.org/rfc/rfc9000.html#section-a.3.
+func DecodePacketNumber(length PacketNumberLen, largest PacketNumber, truncated PacketNumber) PacketNumber {
+	expected := largest + 1
+	win := PacketNumber(1 << (length * 8))
+	hwin := win / 2
+	mask := win - 1
+	candidate := (expected & ^mask) | truncated
+	if candidate <= expected-hwin && candidate < 1<<62-win {
+		return candidate + win
+	}
+	if candidate > expected+hwin && candidate >= win {
+		return candidate - win
+	}
+	return candidate
+}
+
+// PacketNumberLengthForHeader gets the length of the packet number for the public header
+// it never chooses a PacketNumberLen of 1 byte, since this is too short under certain circumstances
+func PacketNumberLengthForHeader(pn, largestAcked PacketNumber) PacketNumberLen {
+	var numUnacked PacketNumber
+	if largestAcked == InvalidPacketNumber {
+		numUnacked = pn + 1
+	} else {
+		numUnacked = pn - largestAcked
+	}
+	if numUnacked < 1<<(16-1) {
+		return PacketNumberLen2
+	}
+	if numUnacked < 1<<(24-1) {
+		return PacketNumberLen3
+	}
+	return PacketNumberLen4
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/packet_number_test.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/packet_number_test.go
new file mode 100644
index 000000000..43d30f8a7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/packet_number_test.go
@@ -0,0 +1,47 @@
+package protocol
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestInvalidPacketNumberIsSmallerThanAllValidPacketNumbers(t *testing.T) {
+	require.Less(t, InvalidPacketNumber, PacketNumber(0))
+}
+
+func TestPacketNumberLenHasCorrectValue(t *testing.T) {
+	require.EqualValues(t, 1, PacketNumberLen1)
+	require.EqualValues(t, 2, PacketNumberLen2)
+	require.EqualValues(t, 3, PacketNumberLen3)
+	require.EqualValues(t, 4, PacketNumberLen4)
+}
+
+func TestDecodePacketNumber(t *testing.T) {
+	require.Equal(t, PacketNumber(255), DecodePacketNumber(PacketNumberLen1, 10, 255))
+	require.Equal(t, PacketNumber(0), DecodePacketNumber(PacketNumberLen1, 10, 0))
+	require.Equal(t, PacketNumber(256), DecodePacketNumber(PacketNumberLen1, 127, 0))
+	require.Equal(t, PacketNumber(256), DecodePacketNumber(PacketNumberLen1, 128, 0))
+	require.Equal(t, PacketNumber(256), DecodePacketNumber(PacketNumberLen1, 256+126, 0))
+	require.Equal(t, PacketNumber(512), DecodePacketNumber(PacketNumberLen1, 256+127, 0))
+	require.Equal(t, PacketNumber(0xffff), DecodePacketNumber(PacketNumberLen2, 0xffff, 0xffff))
+	require.Equal(t, PacketNumber(0xffff), DecodePacketNumber(PacketNumberLen2, 0xffff+1, 0xffff))
+
+	// example from https://www.rfc-editor.org/rfc/rfc9000.html#section-a.3
+	require.Equal(t, PacketNumber(0xa82f9b32), DecodePacketNumber(PacketNumberLen2, 0xa82f30ea, 0x9b32))
+}
+
+func TestPacketNumberLengthForHeader(t *testing.T) {
+	require.Equal(t, PacketNumberLen2, PacketNumberLengthForHeader(1, InvalidPacketNumber))
+	require.Equal(t, PacketNumberLen2, PacketNumberLengthForHeader(1<<15-2, InvalidPacketNumber))
+	require.Equal(t, PacketNumberLen3, PacketNumberLengthForHeader(1<<15-1, InvalidPacketNumber))
+	require.Equal(t, PacketNumberLen3, PacketNumberLengthForHeader(1<<23-2, InvalidPacketNumber))
+	require.Equal(t, PacketNumberLen4, PacketNumberLengthForHeader(1<<23-1, InvalidPacketNumber))
+	require.Equal(t, PacketNumberLen2, PacketNumberLengthForHeader(1<<15+9, 10))
+	require.Equal(t, PacketNumberLen3, PacketNumberLengthForHeader(1<<15+10, 10))
+	require.Equal(t, PacketNumberLen3, PacketNumberLengthForHeader(1<<23+99, 100))
+	require.Equal(t, PacketNumberLen4, PacketNumberLengthForHeader(1<<23+100, 100))
+	// examples from https://www.rfc-editor.org/rfc/rfc9000.html#section-a.2
+	require.Equal(t, PacketNumberLen2, PacketNumberLengthForHeader(0xac5c02, 0xabe8b3))
+	require.Equal(t, PacketNumberLen3, PacketNumberLengthForHeader(0xace8fe, 0xabe8b3))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/params.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/params.go
new file mode 100644
index 000000000..77657eb27
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/params.go
@@ -0,0 +1,163 @@
+package protocol
+
+import "time"
+
+// InitialPacketSize is the initial (before Path MTU discovery) maximum packet size used.
+const InitialPacketSize = 1280
+
+// MaxCongestionWindowPackets is the maximum congestion window in packet.
+const MaxCongestionWindowPackets = 10000
+
+// MaxUndecryptablePackets limits the number of undecryptable packets that are queued in the connection.
+const MaxUndecryptablePackets = 32
+
+// ConnectionFlowControlMultiplier determines how much larger the connection flow control windows needs to be relative to any stream's flow control window
+// This is the value that Chromium is using
+const ConnectionFlowControlMultiplier = 1.5
+
+// DefaultInitialMaxStreamData is the default initial stream-level flow control window for receiving data
+const DefaultInitialMaxStreamData = (1 << 10) * 512 // 512 kb
+
+// DefaultInitialMaxData is the connection-level flow control window for receiving data
+const DefaultInitialMaxData = ConnectionFlowControlMultiplier * DefaultInitialMaxStreamData
+
+// DefaultMaxReceiveStreamFlowControlWindow is the default maximum stream-level flow control window for receiving data
+const DefaultMaxReceiveStreamFlowControlWindow = 6 * (1 << 20) // 6 MB
+
+// DefaultMaxReceiveConnectionFlowControlWindow is the default connection-level flow control window for receiving data
+const DefaultMaxReceiveConnectionFlowControlWindow = 15 * (1 << 20) // 15 MB
+
+// WindowUpdateThreshold is the fraction of the receive window that has to be consumed before an higher offset is advertised to the client
+const WindowUpdateThreshold = 0.25
+
+// DefaultMaxIncomingStreams is the maximum number of streams that a peer may open
+const DefaultMaxIncomingStreams = 100
+
+// DefaultMaxIncomingUniStreams is the maximum number of unidirectional streams that a peer may open
+const DefaultMaxIncomingUniStreams = 100
+
+// MaxServerUnprocessedPackets is the max number of packets stored in the server that are not yet processed.
+const MaxServerUnprocessedPackets = 1024
+
+// MaxConnUnprocessedPackets is the max number of packets stored in each connection that are not yet processed.
+const MaxConnUnprocessedPackets = 256
+
+// SkipPacketInitialPeriod is the initial period length used for packet number skipping to prevent an Optimistic ACK attack.
+// Every time a packet number is skipped, the period is doubled, up to SkipPacketMaxPeriod.
+const SkipPacketInitialPeriod PacketNumber = 256
+
+// SkipPacketMaxPeriod is the maximum period length used for packet number skipping.
+const SkipPacketMaxPeriod PacketNumber = 128 * 1024
+
+// MaxAcceptQueueSize is the maximum number of connections that the server queues for accepting.
+// If the queue is full, new connection attempts will be rejected.
+const MaxAcceptQueueSize = 32
+
+// TokenValidity is the duration that a (non-retry) token is considered valid
+const TokenValidity = 24 * time.Hour
+
+// MaxOutstandingSentPackets is maximum number of packets saved for retransmission.
+// When reached, it imposes a soft limit on sending new packets:
+// Sending ACKs and retransmission is still allowed, but now new regular packets can be sent.
+const MaxOutstandingSentPackets = 2 * MaxCongestionWindowPackets
+
+// MaxTrackedSentPackets is maximum number of sent packets saved for retransmission.
+// When reached, no more packets will be sent.
+// This value *must* be larger than MaxOutstandingSentPackets.
+const MaxTrackedSentPackets = MaxOutstandingSentPackets * 5 / 4
+
+// MaxNonAckElicitingAcks is the maximum number of packets containing an ACK,
+// but no ack-eliciting frames, that we send in a row
+const MaxNonAckElicitingAcks = 19
+
+// MaxStreamFrameSorterGaps is the maximum number of gaps between received StreamFrames
+// prevents DoS attacks against the streamFrameSorter
+const MaxStreamFrameSorterGaps = 1000
+
+// MinStreamFrameBufferSize is the minimum data length of a received STREAM frame
+// that we use the buffer for. This protects against a DoS where an attacker would send us
+// very small STREAM frames to consume a lot of memory.
+const MinStreamFrameBufferSize = 128
+
+// MinCoalescedPacketSize is the minimum size of a coalesced packet that we pack.
+// If a packet has less than this number of bytes, we won't coalesce any more packets onto it.
+const MinCoalescedPacketSize = 128
+
+// MaxCryptoStreamOffset is the maximum offset allowed on any of the crypto streams.
+// This limits the size of the ClientHello and Certificates that can be received.
+const MaxCryptoStreamOffset = 16 * (1 << 10)
+
+// MinRemoteIdleTimeout is the minimum value that we accept for the remote idle timeout
+const MinRemoteIdleTimeout = 5 * time.Second
+
+// DefaultIdleTimeout is the default idle timeout
+const DefaultIdleTimeout = 30 * time.Second
+
+// DefaultHandshakeIdleTimeout is the default idle timeout used before handshake completion.
+const DefaultHandshakeIdleTimeout = 5 * time.Second
+
+// MinStreamFrameSize is the minimum size that has to be left in a packet, so that we add another STREAM frame.
+// This avoids splitting up STREAM frames into small pieces, which has 2 advantages:
+// 1. it reduces the framing overhead
+// 2. it reduces the head-of-line blocking, when a packet is lost
+const MinStreamFrameSize ByteCount = 128
+
+// MaxPostHandshakeCryptoFrameSize is the maximum size of CRYPTO frames
+// we send after the handshake completes.
+const MaxPostHandshakeCryptoFrameSize = 1000
+
+// MaxNumAckRanges is the maximum number of ACK ranges that we send in an ACK frame.
+// It also serves as a limit for the packet history.
+// If at any point we keep track of more ranges, old ranges are discarded.
+//
+// This value also guarantees that ACK Range Count value in the ACK frame can be encoded
+// in a single byte varint.
+const MaxNumAckRanges = 64
+
+// MinPacingDelay is the minimum duration that is used for packet pacing
+// If the packet packing frequency is higher, multiple packets might be sent at once.
+// Example: For a packet pacing delay of 200μs, we would send 5 packets at once, wait for 1ms, and so forth.
+const MinPacingDelay = time.Millisecond
+
+// DefaultConnectionIDLength is the connection ID length that is used for multiplexed connections
+// if no other value is configured.
+const DefaultConnectionIDLength = 4
+
+// MaxActiveConnectionIDs is the number of connection IDs that we're storing.
+const MaxActiveConnectionIDs = 4
+
+// MaxIssuedConnectionIDs is the maximum number of connection IDs that we're issuing at the same time.
+const MaxIssuedConnectionIDs = 6
+
+// PacketsPerConnectionID is the number of packets we send using one connection ID.
+// If the peer provices us with enough new connection IDs, we switch to a new connection ID.
+const PacketsPerConnectionID = 10000
+
+// AckDelayExponent is the ack delay exponent used when sending ACKs.
+const AckDelayExponent = 3
+
+// Estimated timer granularity.
+// The loss detection timer will not be set to a value smaller than granularity.
+const TimerGranularity = time.Millisecond
+
+// MaxAckDelay is the maximum time by which we delay sending ACKs.
+const MaxAckDelay = 25 * time.Millisecond
+
+// MaxAckDelayInclGranularity is the max_ack_delay including the timer granularity.
+// This is the value that should be advertised to the peer.
+const MaxAckDelayInclGranularity = MaxAckDelay + TimerGranularity
+
+// KeyUpdateInterval is the maximum number of packets we send or receive before initiating a key update.
+const KeyUpdateInterval = 100 * 1000
+
+// Max0RTTQueueingDuration is the maximum time that we store 0-RTT packets in order to wait for the corresponding Initial to be received.
+const Max0RTTQueueingDuration = 100 * time.Millisecond
+
+// Max0RTTQueues is the maximum number of connections that we buffer 0-RTT packets for.
+const Max0RTTQueues = 32
+
+// Max0RTTQueueLen is the maximum number of 0-RTT packets that we buffer for each connection.
+// When a new connection is created, all buffered packets are passed to the connection immediately.
+// To avoid blocking, this value has to be smaller than MaxConnUnprocessedPackets.
+// To avoid packets being dropped as undecryptable by the connection, this value has to be smaller than MaxUndecryptablePackets.
+const Max0RTTQueueLen = 31
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/params_test.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/params_test.go
new file mode 100644
index 000000000..48e023d64
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/params_test.go
@@ -0,0 +1,13 @@
+package protocol
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPacketQueueCapacities(t *testing.T) {
+	// Ensure that the session can queue more packets than the 0-RTT queue
+	require.Greater(t, MaxConnUnprocessedPackets, Max0RTTQueueLen)
+	require.Greater(t, MaxUndecryptablePackets, Max0RTTQueueLen)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/perspective.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/perspective.go
new file mode 100644
index 000000000..5a29d3ce2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/perspective.go
@@ -0,0 +1,26 @@
+package protocol
+
+// Perspective determines if we're acting as a server or a client
+type Perspective int
+
+// the perspectives
+const (
+	PerspectiveServer Perspective = 1
+	PerspectiveClient Perspective = 2
+)
+
+// Opposite returns the perspective of the peer
+func (p Perspective) Opposite() Perspective {
+	return 3 - p
+}
+
+func (p Perspective) String() string {
+	switch p {
+	case PerspectiveServer:
+		return "server"
+	case PerspectiveClient:
+		return "client"
+	default:
+		return "invalid perspective"
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/perspective_test.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/perspective_test.go
new file mode 100644
index 000000000..121b478cd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/perspective_test.go
@@ -0,0 +1,18 @@
+package protocol
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPerspectiveOpposite(t *testing.T) {
+	require.Equal(t, PerspectiveServer, PerspectiveClient.Opposite())
+	require.Equal(t, PerspectiveClient, PerspectiveServer.Opposite())
+}
+
+func TestPerspectiveStringer(t *testing.T) {
+	require.Equal(t, "client", PerspectiveClient.String())
+	require.Equal(t, "server", PerspectiveServer.String())
+	require.Equal(t, "invalid perspective", Perspective(0).String())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/protocol.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/protocol.go
new file mode 100644
index 000000000..b1109ff43
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/protocol.go
@@ -0,0 +1,156 @@
+package protocol
+
+import (
+	"fmt"
+	"time"
+)
+
+// The PacketType is the Long Header Type
+type PacketType uint8
+
+const (
+	// PacketTypeInitial is the packet type of an Initial packet
+	PacketTypeInitial PacketType = 1 + iota
+	// PacketTypeRetry is the packet type of a Retry packet
+	PacketTypeRetry
+	// PacketTypeHandshake is the packet type of a Handshake packet
+	PacketTypeHandshake
+	// PacketType0RTT is the packet type of a 0-RTT packet
+	PacketType0RTT
+)
+
+func (t PacketType) String() string {
+	switch t {
+	case PacketTypeInitial:
+		return "Initial"
+	case PacketTypeRetry:
+		return "Retry"
+	case PacketTypeHandshake:
+		return "Handshake"
+	case PacketType0RTT:
+		return "0-RTT Protected"
+	default:
+		return fmt.Sprintf("unknown packet type: %d", t)
+	}
+}
+
+type ECN uint8
+
+const (
+	ECNUnsupported ECN = iota
+	ECNNon             // 00
+	ECT1               // 01
+	ECT0               // 10
+	ECNCE              // 11
+)
+
+func ParseECNHeaderBits(bits byte) ECN {
+	switch bits {
+	case 0:
+		return ECNNon
+	case 0b00000010:
+		return ECT0
+	case 0b00000001:
+		return ECT1
+	case 0b00000011:
+		return ECNCE
+	default:
+		panic("invalid ECN bits")
+	}
+}
+
+func (e ECN) ToHeaderBits() byte {
+	//nolint:exhaustive // There are only 4 values.
+	switch e {
+	case ECNNon:
+		return 0
+	case ECT0:
+		return 0b00000010
+	case ECT1:
+		return 0b00000001
+	case ECNCE:
+		return 0b00000011
+	default:
+		panic("ECN unsupported")
+	}
+}
+
+func (e ECN) String() string {
+	switch e {
+	case ECNUnsupported:
+		return "ECN unsupported"
+	case ECNNon:
+		return "Not-ECT"
+	case ECT1:
+		return "ECT(1)"
+	case ECT0:
+		return "ECT(0)"
+	case ECNCE:
+		return "CE"
+	default:
+		return fmt.Sprintf("invalid ECN value: %d", e)
+	}
+}
+
+// A ByteCount in QUIC
+type ByteCount int64
+
+// MaxByteCount is the maximum value of a ByteCount
+const MaxByteCount = ByteCount(1<<62 - 1)
+
+// InvalidByteCount is an invalid byte count
+const InvalidByteCount ByteCount = -1
+
+// A StatelessResetToken is a stateless reset token.
+type StatelessResetToken [16]byte
+
+// MaxPacketBufferSize maximum packet size of any QUIC packet, based on
+// ethernet's max size, minus the IP and UDP headers. IPv6 has a 40 byte header,
+// UDP adds an additional 8 bytes.  This is a total overhead of 48 bytes.
+// Ethernet's max packet size is 1500 bytes,  1500 - 48 = 1452.
+const MaxPacketBufferSize = 1452
+
+// MaxLargePacketBufferSize is used when using GSO
+const MaxLargePacketBufferSize = 20 * 1024
+
+// MinInitialPacketSize is the minimum size an Initial packet is required to have.
+const MinInitialPacketSize = 1200
+
+// MinUnknownVersionPacketSize is the minimum size a packet with an unknown version
+// needs to have in order to trigger a Version Negotiation packet.
+const MinUnknownVersionPacketSize = MinInitialPacketSize
+
+// MinStatelessResetSize is the minimum size of a stateless reset packet that we send
+const MinStatelessResetSize = 1 /* first byte */ + 20 /* max. conn ID length */ + 4 /* max. packet number length */ + 1 /* min. payload length */ + 16 /* token */
+
+// MinReceivedStatelessResetSize is the minimum size of a received stateless reset,
+// as specified in section 10.3 of RFC 9000.
+const MinReceivedStatelessResetSize = 5 + 16
+
+// MinConnectionIDLenInitial is the minimum length of the destination connection ID on an Initial packet.
+const MinConnectionIDLenInitial = 8
+
+// DefaultAckDelayExponent is the default ack delay exponent
+const DefaultAckDelayExponent = 3
+
+// DefaultActiveConnectionIDLimit is the default active connection ID limit
+const DefaultActiveConnectionIDLimit = 2
+
+// MaxAckDelayExponent is the maximum ack delay exponent
+const MaxAckDelayExponent = 20
+
+// DefaultMaxAckDelay is the default max_ack_delay
+const DefaultMaxAckDelay = 25 * time.Millisecond
+
+// MaxMaxAckDelay is the maximum max_ack_delay
+const MaxMaxAckDelay = (1<<14 - 1) * time.Millisecond
+
+// MaxConnIDLen is the maximum length of the connection ID
+const MaxConnIDLen = 20
+
+// InvalidPacketLimitAES is the maximum number of packets that we can fail to decrypt when using
+// AEAD_AES_128_GCM or AEAD_AES_265_GCM.
+const InvalidPacketLimitAES = 1 << 52
+
+// InvalidPacketLimitChaCha is the maximum number of packets that we can fail to decrypt when using AEAD_CHACHA20_POLY1305.
+const InvalidPacketLimitChaCha = 1 << 36
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/protocol_test.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/protocol_test.go
new file mode 100644
index 000000000..edf1895d6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/protocol_test.go
@@ -0,0 +1,39 @@
+package protocol
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLongHeaderPacketTypeStringer(t *testing.T) {
+	require.Equal(t, "Initial", PacketTypeInitial.String())
+	require.Equal(t, "Retry", PacketTypeRetry.String())
+	require.Equal(t, "Handshake", PacketTypeHandshake.String())
+	require.Equal(t, "0-RTT Protected", PacketType0RTT.String())
+	require.Equal(t, "unknown packet type: 10", PacketType(10).String())
+}
+
+func TestECNFromIPHeader(t *testing.T) {
+	require.Equal(t, ECNNon, ParseECNHeaderBits(0))
+	require.Equal(t, ECT0, ParseECNHeaderBits(0b00000010))
+	require.Equal(t, ECT1, ParseECNHeaderBits(0b00000001))
+	require.Equal(t, ECNCE, ParseECNHeaderBits(0b00000011))
+	require.Panics(t, func() { ParseECNHeaderBits(0b1010101) })
+}
+
+func TestECNConversionToIPHeaderBits(t *testing.T) {
+	for _, v := range [...]ECN{ECNNon, ECT0, ECT1, ECNCE} {
+		require.Equal(t, v, ParseECNHeaderBits(v.ToHeaderBits()))
+	}
+	require.Panics(t, func() { ECN(42).ToHeaderBits() })
+}
+
+func TestECNStringer(t *testing.T) {
+	require.Equal(t, "ECN unsupported", ECNUnsupported.String())
+	require.Equal(t, "Not-ECT", ECNNon.String())
+	require.Equal(t, "ECT(0)", ECT0.String())
+	require.Equal(t, "ECT(1)", ECT1.String())
+	require.Equal(t, "CE", ECNCE.String())
+	require.Equal(t, "invalid ECN value: 42", ECN(42).String())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/stream.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/stream.go
new file mode 100644
index 000000000..a71be52f0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/stream.go
@@ -0,0 +1,102 @@
+package protocol
+
+import "github.com/quic-go/quic-go/quicvarint"
+
+// StreamType encodes if this is a unidirectional or bidirectional stream
+type StreamType uint8
+
+const (
+	// StreamTypeUni is a unidirectional stream
+	StreamTypeUni StreamType = iota
+	// StreamTypeBidi is a bidirectional stream
+	StreamTypeBidi
+)
+
+// InvalidPacketNumber is a stream ID that is invalid.
+// The first valid stream ID in QUIC is 0.
+const InvalidStreamID StreamID = -1
+
+// StreamNum is the stream number
+type StreamNum int64
+
+const (
+	// InvalidStreamNum is an invalid stream number.
+	InvalidStreamNum = -1
+	// MaxStreamCount is the maximum stream count value that can be sent in MAX_STREAMS frames
+	// and as the stream count in the transport parameters
+	MaxStreamCount StreamNum = 1 << 60
+	// MaxStreamID is the maximum stream ID
+	MaxStreamID StreamID = quicvarint.Max
+)
+
+const (
+	// FirstOutgoingBidiStreamClient is the first bidirectional stream opened by the client
+	FirstOutgoingBidiStreamClient StreamID = 0
+	// FirstOutgoingUniStreamClient is the first unidirectional stream opened by the client
+	FirstOutgoingUniStreamClient StreamID = 2
+	// FirstOutgoingBidiStreamServer is the first bidirectional stream opened by the server
+	FirstOutgoingBidiStreamServer StreamID = 1
+	// FirstOutgoingUniStreamServer is the first unidirectional stream opened by the server
+	FirstOutgoingUniStreamServer StreamID = 3
+)
+
+const (
+	// FirstIncomingBidiStreamServer is the first bidirectional stream accepted by the server
+	FirstIncomingBidiStreamServer = FirstOutgoingBidiStreamClient
+	// FirstIncomingUniStreamServer is the first unidirectional stream accepted by the server
+	FirstIncomingUniStreamServer = FirstOutgoingUniStreamClient
+	// FirstIncomingBidiStreamClient is the first bidirectional stream accepted by the client
+	FirstIncomingBidiStreamClient = FirstOutgoingBidiStreamServer
+	// FirstIncomingUniStreamClient is the first unidirectional stream accepted by the client
+	FirstIncomingUniStreamClient = FirstOutgoingUniStreamServer
+)
+
+// StreamID calculates the stream ID.
+func (s StreamNum) StreamID(stype StreamType, pers Perspective) StreamID {
+	if s == 0 {
+		return InvalidStreamID
+	}
+	var first StreamID
+	switch stype {
+	case StreamTypeBidi:
+		switch pers {
+		case PerspectiveClient:
+			first = 0
+		case PerspectiveServer:
+			first = 1
+		}
+	case StreamTypeUni:
+		switch pers {
+		case PerspectiveClient:
+			first = 2
+		case PerspectiveServer:
+			first = 3
+		}
+	}
+	return first + 4*StreamID(s-1)
+}
+
+// A StreamID in QUIC
+type StreamID int64
+
+// StreamInitiator says if the stream was initiated by the client or by the server.
+func StreamInitiator(id StreamID) Perspective {
+	if id%2 == 0 {
+		return PerspectiveClient
+	}
+	return PerspectiveServer
+}
+
+// StreamTypeOf says if this is a unidirectional or bidirectional stream.
+func StreamTypeOf(id StreamID) StreamType {
+	if id%4 >= 2 {
+		return StreamTypeUni
+	}
+	return StreamTypeBidi
+}
+
+// StreamNum returns how many streams in total are below this
+// Example: for stream 9 it returns 3 (i.e. streams 1, 5 and 9)
+func (s StreamID) StreamNum() StreamNum {
+	return StreamNum(s/4) + 1
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/stream_test.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/stream_test.go
new file mode 100644
index 000000000..916a0b637
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/stream_test.go
@@ -0,0 +1,66 @@
+package protocol
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestInvalidStreamIDSmallerThanAllValidStreamIDs(t *testing.T) {
+	require.Less(t, InvalidStreamID, StreamID(0))
+}
+
+func TestStreamInitiator(t *testing.T) {
+	require.Equal(t, PerspectiveClient, StreamInitiator(4))
+	require.Equal(t, PerspectiveServer, StreamInitiator(5))
+	require.Equal(t, PerspectiveClient, StreamInitiator(6))
+	require.Equal(t, PerspectiveServer, StreamInitiator(7))
+}
+
+func TestStreamTypeOf(t *testing.T) {
+	require.Equal(t, StreamTypeBidi, StreamTypeOf(4))
+	require.Equal(t, StreamTypeBidi, StreamTypeOf(5))
+	require.Equal(t, StreamTypeUni, StreamTypeOf(6))
+	require.Equal(t, StreamTypeUni, StreamTypeOf(7))
+}
+
+func TestStreamIDStreamNum(t *testing.T) {
+	require.Equal(t, StreamNum(1), StreamID(0).StreamNum())
+	require.Equal(t, StreamNum(1), StreamID(1).StreamNum())
+	require.Equal(t, StreamNum(1), StreamID(2).StreamNum())
+	require.Equal(t, StreamNum(1), StreamID(3).StreamNum())
+	require.Equal(t, StreamNum(3), StreamID(8).StreamNum())
+	require.Equal(t, StreamNum(3), StreamID(9).StreamNum())
+	require.Equal(t, StreamNum(3), StreamID(10).StreamNum())
+	require.Equal(t, StreamNum(3), StreamID(11).StreamNum())
+}
+
+func TestStreamIDNumToStreamID(t *testing.T) {
+	// 1st stream
+	require.Equal(t, StreamID(0), StreamNum(1).StreamID(StreamTypeBidi, PerspectiveClient))
+	require.Equal(t, StreamID(1), StreamNum(1).StreamID(StreamTypeBidi, PerspectiveServer))
+	require.Equal(t, StreamID(2), StreamNum(1).StreamID(StreamTypeUni, PerspectiveClient))
+	require.Equal(t, StreamID(3), StreamNum(1).StreamID(StreamTypeUni, PerspectiveServer))
+
+	// 100th stream
+	require.Equal(t, StreamID(396), StreamNum(100).StreamID(StreamTypeBidi, PerspectiveClient))
+	require.Equal(t, StreamID(397), StreamNum(100).StreamID(StreamTypeBidi, PerspectiveServer))
+	require.Equal(t, StreamID(398), StreamNum(100).StreamID(StreamTypeUni, PerspectiveClient))
+	require.Equal(t, StreamID(399), StreamNum(100).StreamID(StreamTypeUni, PerspectiveServer))
+
+	// 0 is not a valid stream number
+	require.Equal(t, InvalidStreamID, StreamNum(0).StreamID(StreamTypeBidi, PerspectiveClient))
+	require.Equal(t, InvalidStreamID, StreamNum(0).StreamID(StreamTypeBidi, PerspectiveServer))
+	require.Equal(t, InvalidStreamID, StreamNum(0).StreamID(StreamTypeUni, PerspectiveClient))
+	require.Equal(t, InvalidStreamID, StreamNum(0).StreamID(StreamTypeUni, PerspectiveServer))
+}
+
+func TestMaxStreamCountValue(t *testing.T) {
+	const maxStreamID = StreamID(1<<62 - 1)
+	for _, dir := range []StreamType{StreamTypeUni, StreamTypeBidi} {
+		for _, pers := range []Perspective{PerspectiveClient, PerspectiveServer} {
+			require.LessOrEqual(t, MaxStreamCount.StreamID(dir, pers), maxStreamID)
+			require.Greater(t, (MaxStreamCount+1).StreamID(dir, pers), maxStreamID)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/version.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/version.go
new file mode 100644
index 000000000..8abca5060
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/version.go
@@ -0,0 +1,115 @@
+package protocol
+
+import (
+	"crypto/rand"
+	"encoding/binary"
+	"fmt"
+	"math"
+	mrand "math/rand/v2"
+	"slices"
+	"sync"
+)
+
+// Version is a version number as int
+type Version uint32
+
+// gQUIC version range as defined in the wiki: https://github.com/quicwg/base-drafts/wiki/QUIC-Versions
+const (
+	gquicVersion0   = 0x51303030
+	maxGquicVersion = 0x51303439
+)
+
+// The version numbers, making grepping easier
+const (
+	VersionUnknown Version = math.MaxUint32
+	versionDraft29 Version = 0xff00001d // draft-29 used to be a widely deployed version
+	Version1       Version = 0x1
+	Version2       Version = 0x6b3343cf
+)
+
+// SupportedVersions lists the versions that the server supports
+// must be in sorted descending order
+var SupportedVersions = []Version{Version1, Version2}
+
+// IsValidVersion says if the version is known to quic-go
+func IsValidVersion(v Version) bool {
+	return v == Version1 || IsSupportedVersion(SupportedVersions, v)
+}
+
+func (vn Version) String() string {
+	switch vn {
+	case VersionUnknown:
+		return "unknown"
+	case versionDraft29:
+		return "draft-29"
+	case Version1:
+		return "v1"
+	case Version2:
+		return "v2"
+	default:
+		if vn.isGQUIC() {
+			return fmt.Sprintf("gQUIC %d", vn.toGQUICVersion())
+		}
+		return fmt.Sprintf("%#x", uint32(vn))
+	}
+}
+
+func (vn Version) isGQUIC() bool {
+	return vn > gquicVersion0 && vn <= maxGquicVersion
+}
+
+func (vn Version) toGQUICVersion() int {
+	return int(10*(vn-gquicVersion0)/0x100) + int(vn%0x10)
+}
+
+// IsSupportedVersion returns true if the server supports this version
+func IsSupportedVersion(supported []Version, v Version) bool {
+	return slices.Contains(supported, v)
+}
+
+// ChooseSupportedVersion finds the best version in the overlap of ours and theirs
+// ours is a slice of versions that we support, sorted by our preference (descending)
+// theirs is a slice of versions offered by the peer. The order does not matter.
+// The bool returned indicates if a matching version was found.
+func ChooseSupportedVersion(ours, theirs []Version) (Version, bool) {
+	for _, ourVer := range ours {
+		if slices.Contains(theirs, ourVer) {
+			return ourVer, true
+		}
+	}
+	return 0, false
+}
+
+var (
+	versionNegotiationMx   sync.Mutex
+	versionNegotiationRand mrand.Rand
+)
+
+func init() {
+	var seed [16]byte
+	rand.Read(seed[:])
+	versionNegotiationRand = *mrand.New(mrand.NewPCG(
+		binary.BigEndian.Uint64(seed[:8]),
+		binary.BigEndian.Uint64(seed[8:]),
+	))
+}
+
+// generateReservedVersion generates a reserved version (v & 0x0f0f0f0f == 0x0a0a0a0a)
+func generateReservedVersion() Version {
+	var b [4]byte
+	binary.BigEndian.PutUint32(b[:], versionNegotiationRand.Uint32())
+	return Version((binary.BigEndian.Uint32(b[:]) | 0x0a0a0a0a) & 0xfafafafa)
+}
+
+// GetGreasedVersions adds one reserved version number to a slice of version numbers, at a random position.
+// It doesn't modify the supported slice.
+func GetGreasedVersions(supported []Version) []Version {
+	versionNegotiationMx.Lock()
+	defer versionNegotiationMx.Unlock()
+	randPos := versionNegotiationRand.IntN(len(supported) + 1)
+	greased := make([]Version, len(supported)+1)
+	copy(greased, supported[:randPos])
+	greased[randPos] = generateReservedVersion()
+	copy(greased[randPos+1:], supported[randPos:])
+	return greased
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/protocol/version_test.go b/electron/native/private-transport/third_party/quic-go/internal/protocol/version_test.go
new file mode 100644
index 000000000..f82137fd0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/protocol/version_test.go
@@ -0,0 +1,151 @@
+package protocol
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidVersion(t *testing.T) {
+	require.False(t, IsValidVersion(VersionUnknown))
+	require.False(t, IsValidVersion(versionDraft29))
+	require.True(t, IsValidVersion(Version1))
+	require.True(t, IsValidVersion(Version2))
+	require.False(t, IsValidVersion(1234))
+}
+
+func TestVersionStringRepresentation(t *testing.T) {
+	require.Equal(t, "unknown", VersionUnknown.String())
+	require.Equal(t, "draft-29", versionDraft29.String())
+	require.Equal(t, "v1", Version1.String())
+	require.Equal(t, "v2", Version2.String())
+	// check with unsupported version numbers from the wiki
+	require.Equal(t, "gQUIC 9", Version(0x51303039).String())
+	require.Equal(t, "gQUIC 13", Version(0x51303133).String())
+	require.Equal(t, "gQUIC 25", Version(0x51303235).String())
+	require.Equal(t, "gQUIC 48", Version(0x51303438).String())
+	require.Equal(t, "0x1234567", Version(0x01234567).String())
+}
+
+func TestRecognizesSupportedVersions(t *testing.T) {
+	require.False(t, IsSupportedVersion(SupportedVersions, 0))
+	require.False(t, IsSupportedVersion(SupportedVersions, maxGquicVersion))
+	require.True(t, IsSupportedVersion(SupportedVersions, SupportedVersions[0]))
+	require.True(t, IsSupportedVersion(SupportedVersions, SupportedVersions[len(SupportedVersions)-1]))
+}
+
+func TestVersionSelection(t *testing.T) {
+	tests := []struct {
+		name              string
+		supportedVersions []Version
+		otherVersions     []Version
+		expectedVersion   Version
+		expectedOK        bool
+	}{
+		{
+			name:              "finds matching version",
+			supportedVersions: []Version{1, 2, 3},
+			otherVersions:     []Version{6, 5, 4, 3},
+			expectedVersion:   3,
+			expectedOK:        true,
+		},
+		{
+			name:              "picks preferred version",
+			supportedVersions: []Version{2, 1, 3},
+			otherVersions:     []Version{3, 6, 1, 8, 2, 10},
+			expectedVersion:   2,
+			expectedOK:        true,
+		},
+		{
+			name:              "no matching version",
+			supportedVersions: []Version{1},
+			otherVersions:     []Version{2},
+			expectedOK:        false,
+		},
+		{
+			name:              "empty supported versions",
+			supportedVersions: []Version{},
+			otherVersions:     []Version{1, 2},
+			expectedOK:        false,
+		},
+		{
+			name:              "empty other versions",
+			supportedVersions: []Version{102, 101},
+			otherVersions:     []Version{},
+			expectedOK:        false,
+		},
+		{
+			name:              "both empty",
+			supportedVersions: []Version{},
+			otherVersions:     []Version{},
+			expectedOK:        false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ver, ok := ChooseSupportedVersion(tt.supportedVersions, tt.otherVersions)
+			require.Equal(t, tt.expectedOK, ok)
+			if tt.expectedOK {
+				require.Equal(t, tt.expectedVersion, ver)
+			}
+		})
+	}
+}
+
+func isReservedVersion(v Version) bool { return v&0x0f0f0f0f == 0x0a0a0a0a }
+
+func TestVersionGreasing(t *testing.T) {
+	// adding to an empty slice
+	greased := GetGreasedVersions([]Version{})
+	require.Len(t, greased, 1)
+	require.True(t, isReservedVersion(greased[0]))
+
+	// make sure that the greased versions are distinct,
+	// allowing for a small number of duplicates
+	var versions []Version
+	for range 25 {
+		versions = GetGreasedVersions(versions)
+	}
+	slices.Sort(versions)
+	var numDuplicates int
+	for i, v := range versions {
+		require.True(t, isReservedVersion(v))
+		if i > 0 && versions[i-1] == v {
+			numDuplicates++
+		}
+	}
+	require.LessOrEqual(t, numDuplicates, 3)
+
+	// adding it somewhere in a slice of supported versions
+	supported := []Version{10, 18, 29}
+	for _, v := range supported {
+		require.False(t, isReservedVersion(v))
+	}
+
+	var greasedVersionFirst, greasedVersionLast, greasedVersionMiddle int
+	for range 100 {
+		greased := GetGreasedVersions(supported)
+		require.Len(t, greased, 4)
+
+		var j int
+		for i, v := range greased {
+			if isReservedVersion(v) {
+				if i == 0 {
+					greasedVersionFirst++
+				}
+				if i == len(greased)-1 {
+					greasedVersionLast++
+				}
+				greasedVersionMiddle++
+				continue
+			}
+			require.Equal(t, supported[j], v)
+			j++
+		}
+	}
+	require.NotZero(t, greasedVersionFirst)
+	require.NotZero(t, greasedVersionLast)
+	require.NotZero(t, greasedVersionMiddle)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/qerr/error_codes.go b/electron/native/private-transport/third_party/quic-go/internal/qerr/error_codes.go
new file mode 100644
index 000000000..00361308e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/qerr/error_codes.go
@@ -0,0 +1,87 @@
+package qerr
+
+import (
+	"crypto/tls"
+	"fmt"
+)
+
+// TransportErrorCode is a QUIC transport error.
+type TransportErrorCode uint64
+
+// The error codes defined by QUIC
+const (
+	NoError                   TransportErrorCode = 0x0
+	InternalError             TransportErrorCode = 0x1
+	ConnectionRefused         TransportErrorCode = 0x2
+	FlowControlError          TransportErrorCode = 0x3
+	StreamLimitError          TransportErrorCode = 0x4
+	StreamStateError          TransportErrorCode = 0x5
+	FinalSizeError            TransportErrorCode = 0x6
+	FrameEncodingError        TransportErrorCode = 0x7
+	TransportParameterError   TransportErrorCode = 0x8
+	ConnectionIDLimitError    TransportErrorCode = 0x9
+	ProtocolViolation         TransportErrorCode = 0xa
+	InvalidToken              TransportErrorCode = 0xb
+	ApplicationErrorErrorCode TransportErrorCode = 0xc
+	CryptoBufferExceeded      TransportErrorCode = 0xd
+	KeyUpdateError            TransportErrorCode = 0xe
+	AEADLimitReached          TransportErrorCode = 0xf
+	NoViablePathError         TransportErrorCode = 0x10
+)
+
+func (e TransportErrorCode) IsCryptoError() bool {
+	return e >= 0x100 && e < 0x200
+}
+
+// Message is a description of the error.
+// It only returns a non-empty string for crypto errors.
+func (e TransportErrorCode) Message() string {
+	if !e.IsCryptoError() {
+		return ""
+	}
+	return tls.AlertError(e - 0x100).Error()
+}
+
+func (e TransportErrorCode) String() string {
+	switch e {
+	case NoError:
+		return "NO_ERROR"
+	case InternalError:
+		return "INTERNAL_ERROR"
+	case ConnectionRefused:
+		return "CONNECTION_REFUSED"
+	case FlowControlError:
+		return "FLOW_CONTROL_ERROR"
+	case StreamLimitError:
+		return "STREAM_LIMIT_ERROR"
+	case StreamStateError:
+		return "STREAM_STATE_ERROR"
+	case FinalSizeError:
+		return "FINAL_SIZE_ERROR"
+	case FrameEncodingError:
+		return "FRAME_ENCODING_ERROR"
+	case TransportParameterError:
+		return "TRANSPORT_PARAMETER_ERROR"
+	case ConnectionIDLimitError:
+		return "CONNECTION_ID_LIMIT_ERROR"
+	case ProtocolViolation:
+		return "PROTOCOL_VIOLATION"
+	case InvalidToken:
+		return "INVALID_TOKEN"
+	case ApplicationErrorErrorCode:
+		return "APPLICATION_ERROR"
+	case CryptoBufferExceeded:
+		return "CRYPTO_BUFFER_EXCEEDED"
+	case KeyUpdateError:
+		return "KEY_UPDATE_ERROR"
+	case AEADLimitReached:
+		return "AEAD_LIMIT_REACHED"
+	case NoViablePathError:
+		return "NO_VIABLE_PATH"
+	default:
+		if e.IsCryptoError() {
+			return fmt.Sprintf("CRYPTO_ERROR %#x", uint16(e))
+		}
+		return fmt.Sprintf("unknown error code: %#x", uint16(e))
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/qerr/errorcodes_test.go b/electron/native/private-transport/third_party/quic-go/internal/qerr/errorcodes_test.go
new file mode 100644
index 000000000..2e07fd416
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/qerr/errorcodes_test.go
@@ -0,0 +1,47 @@
+package qerr
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"path"
+	"runtime"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestTransportErrorCodeStringer(t *testing.T) {
+	_, thisfile, _, ok := runtime.Caller(0)
+	require.True(t, ok, "Failed to get current frame")
+
+	filename := path.Join(path.Dir(thisfile), "error_codes.go")
+	fileAst, err := parser.ParseFile(token.NewFileSet(), filename, nil, 0)
+	require.NoError(t, err)
+
+	constSpecs := fileAst.Decls[2].(*ast.GenDecl).Specs
+	require.Greater(t, len(constSpecs), 4, "Expected more than 4 constants")
+
+	for _, c := range constSpecs {
+		valString := c.(*ast.ValueSpec).Values[0].(*ast.BasicLit).Value
+		val, err := strconv.ParseInt(valString, 0, 64)
+		require.NoError(t, err)
+		require.NotEqual(t, "unknown error code", TransportErrorCode(val).String())
+	}
+
+	// test that there's a string representation for unknown error codes
+	require.Equal(t, "unknown error code: 0x1337", TransportErrorCode(0x1337).String())
+}
+
+func TestIsCryptoError(t *testing.T) {
+	for i := range 0x100 {
+		require.False(t, TransportErrorCode(i).IsCryptoError())
+	}
+	for i := 0x100; i < 0x200; i++ {
+		require.True(t, TransportErrorCode(i).IsCryptoError())
+	}
+	for i := 0x200; i < 0x300; i++ {
+		require.False(t, TransportErrorCode(i).IsCryptoError())
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/qerr/errors.go b/electron/native/private-transport/third_party/quic-go/internal/qerr/errors.go
new file mode 100644
index 000000000..7fe1c293d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/qerr/errors.go
@@ -0,0 +1,134 @@
+package qerr
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+var (
+	ErrHandshakeTimeout = &HandshakeTimeoutError{}
+	ErrIdleTimeout      = &IdleTimeoutError{}
+)
+
+type TransportError struct {
+	Remote       bool
+	FrameType    uint64
+	ErrorCode    TransportErrorCode
+	ErrorMessage string
+	error        error // only set for local errors, sometimes
+}
+
+var _ error = &TransportError{}
+
+// NewLocalCryptoError create a new TransportError instance for a crypto error
+func NewLocalCryptoError(tlsAlert uint8, err error) *TransportError {
+	return &TransportError{
+		ErrorCode: 0x100 + TransportErrorCode(tlsAlert),
+		error:     err,
+	}
+}
+
+func (e *TransportError) Error() string {
+	str := fmt.Sprintf("%s (%s)", e.ErrorCode.String(), getRole(e.Remote))
+	if e.FrameType != 0 {
+		str += fmt.Sprintf(" (frame type: %#x)", e.FrameType)
+	}
+	msg := e.ErrorMessage
+	if len(msg) == 0 && e.error != nil {
+		msg = e.error.Error()
+	}
+	if len(msg) == 0 {
+		msg = e.ErrorCode.Message()
+	}
+	if len(msg) == 0 {
+		return str
+	}
+	return str + ": " + msg
+}
+
+func (e *TransportError) Unwrap() []error { return []error{net.ErrClosed, e.error} }
+
+func (e *TransportError) Is(target error) bool {
+	t, ok := target.(*TransportError)
+	return ok && e.ErrorCode == t.ErrorCode && e.FrameType == t.FrameType && e.Remote == t.Remote
+}
+
+// An ApplicationErrorCode is an application-defined error code.
+type ApplicationErrorCode uint64
+
+// A StreamErrorCode is an error code used to cancel streams.
+type StreamErrorCode uint64
+
+type ApplicationError struct {
+	Remote       bool
+	ErrorCode    ApplicationErrorCode
+	ErrorMessage string
+}
+
+var _ error = &ApplicationError{}
+
+func (e *ApplicationError) Error() string {
+	if len(e.ErrorMessage) == 0 {
+		return fmt.Sprintf("Application error %#x (%s)", e.ErrorCode, getRole(e.Remote))
+	}
+	return fmt.Sprintf("Application error %#x (%s): %s", e.ErrorCode, getRole(e.Remote), e.ErrorMessage)
+}
+
+func (e *ApplicationError) Unwrap() error { return net.ErrClosed }
+
+func (e *ApplicationError) Is(target error) bool {
+	t, ok := target.(*ApplicationError)
+	return ok && e.ErrorCode == t.ErrorCode && e.Remote == t.Remote
+}
+
+type IdleTimeoutError struct{}
+
+var _ error = &IdleTimeoutError{}
+
+func (e *IdleTimeoutError) Timeout() bool   { return true }
+func (e *IdleTimeoutError) Temporary() bool { return false }
+func (e *IdleTimeoutError) Error() string   { return "timeout: no recent network activity" }
+func (e *IdleTimeoutError) Unwrap() error   { return net.ErrClosed }
+
+type HandshakeTimeoutError struct{}
+
+var _ error = &HandshakeTimeoutError{}
+
+func (e *HandshakeTimeoutError) Timeout() bool   { return true }
+func (e *HandshakeTimeoutError) Temporary() bool { return false }
+func (e *HandshakeTimeoutError) Error() string   { return "timeout: handshake did not complete in time" }
+func (e *HandshakeTimeoutError) Unwrap() error   { return net.ErrClosed }
+
+// A VersionNegotiationError occurs when the client and the server can't agree on a QUIC version.
+type VersionNegotiationError struct {
+	Ours   []protocol.Version
+	Theirs []protocol.Version
+}
+
+func (e *VersionNegotiationError) Error() string {
+	return fmt.Sprintf("no compatible QUIC version found (we support %s, server offered %s)", e.Ours, e.Theirs)
+}
+
+func (e *VersionNegotiationError) Unwrap() error { return net.ErrClosed }
+
+// A StatelessResetError occurs when we receive a stateless reset.
+type StatelessResetError struct{}
+
+var _ net.Error = &StatelessResetError{}
+
+func (e *StatelessResetError) Error() string {
+	return "received a stateless reset"
+}
+
+func (e *StatelessResetError) Unwrap() error   { return net.ErrClosed }
+func (e *StatelessResetError) Timeout() bool   { return false }
+func (e *StatelessResetError) Temporary() bool { return true }
+
+func getRole(remote bool) string {
+	if remote {
+		return "remote"
+	}
+	return "local"
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/qerr/errors_test.go b/electron/native/private-transport/third_party/quic-go/internal/qerr/errors_test.go
new file mode 100644
index 000000000..8c704565c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/qerr/errors_test.go
@@ -0,0 +1,176 @@
+package qerr
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTransportError(t *testing.T) {
+	require.True(t, errors.Is(&TransportError{}, net.ErrClosed))
+
+	require.True(t, errors.Is(
+		&TransportError{Remote: true, ErrorCode: 1, FrameType: 2},
+		&TransportError{Remote: true, ErrorCode: 1, FrameType: 2},
+	))
+	require.True(t, errors.Is(&TransportError{ErrorCode: 0x101}, &TransportError{ErrorCode: 0x101}))
+	require.False(t, errors.Is(&TransportError{}, &TransportError{ErrorCode: 0x101}))
+	require.False(t, errors.Is(&TransportError{}, &TransportError{FrameType: 0x1337}))
+	require.False(t, errors.Is(&TransportError{Remote: false}, &TransportError{Remote: true}))
+}
+
+func TestTransportErrorStringer(t *testing.T) {
+	t.Run("with error message", func(t *testing.T) {
+		err := &TransportError{
+			ErrorCode:    FlowControlError,
+			ErrorMessage: "foobar",
+		}
+		require.Equal(t, "FLOW_CONTROL_ERROR (local): foobar", err.Error())
+	})
+
+	t.Run("without error message", func(t *testing.T) {
+		err := &TransportError{ErrorCode: FlowControlError}
+		require.Equal(t, "FLOW_CONTROL_ERROR (local)", err.Error())
+	})
+
+	t.Run("with frame type", func(t *testing.T) {
+		err := &TransportError{
+			Remote:    true,
+			ErrorCode: FlowControlError,
+			FrameType: 0x1337,
+		}
+		require.Equal(t, "FLOW_CONTROL_ERROR (remote) (frame type: 0x1337)", err.Error())
+	})
+
+	t.Run("with frame type and error message", func(t *testing.T) {
+		err := &TransportError{
+			ErrorCode:    FlowControlError,
+			FrameType:    0x1337,
+			ErrorMessage: "foobar",
+		}
+		require.Equal(t, "FLOW_CONTROL_ERROR (local) (frame type: 0x1337): foobar", err.Error())
+	})
+}
+
+type myError int
+
+var _ error = myError(0)
+
+func (e myError) Error() string { return fmt.Sprintf("my error %d", e) }
+
+func TestCryptoError(t *testing.T) {
+	err := NewLocalCryptoError(0x42, myError(1337))
+	myErr, ok := errors.AsType[myError](err)
+	require.True(t, ok)
+	require.Equal(t, myError(1337), myErr)
+
+	err = NewLocalCryptoError(0x42, assert.AnError)
+	require.True(t, errors.Is(err, assert.AnError))
+	require.True(t, errors.Is(
+		NewLocalCryptoError(0x42, assert.AnError),
+		NewLocalCryptoError(0x42, assert.AnError),
+	))
+	require.False(t, errors.Is(
+		NewLocalCryptoError(0x42, assert.AnError),
+		NewLocalCryptoError(0x43, assert.AnError),
+	))
+}
+
+func TestCryptoErrorStringer(t *testing.T) {
+	t.Run("with error message", func(t *testing.T) {
+		myErr := myError(1337)
+		err := NewLocalCryptoError(0x42, myErr)
+		require.Equal(t, "CRYPTO_ERROR 0x142 (local): my error 1337", err.Error())
+	})
+
+	t.Run("without error message", func(t *testing.T) {
+		err := NewLocalCryptoError(0x2a, nil)
+		require.Equal(t, "CRYPTO_ERROR 0x12a (local): tls: bad certificate", err.Error())
+	})
+}
+
+func TestApplicationError(t *testing.T) {
+	require.True(t, errors.Is(&ApplicationError{}, net.ErrClosed))
+
+	require.True(t, errors.Is(
+		&ApplicationError{ErrorCode: 1, Remote: true},
+		&ApplicationError{ErrorCode: 1, Remote: true},
+	))
+	require.True(t, errors.Is(&ApplicationError{ErrorCode: 0x101}, &ApplicationError{ErrorCode: 0x101}))
+	require.False(t, errors.Is(&ApplicationError{}, &ApplicationError{ErrorCode: 0x101}))
+	require.False(t, errors.Is(&ApplicationError{Remote: false}, &ApplicationError{Remote: true}))
+}
+
+func TestApplicationErrorStringer(t *testing.T) {
+	t.Run("with error message", func(t *testing.T) {
+		err := &ApplicationError{
+			ErrorCode:    0x42,
+			ErrorMessage: "foobar",
+		}
+		require.Equal(t, "Application error 0x42 (local): foobar", err.Error())
+	})
+
+	t.Run("without error message", func(t *testing.T) {
+		err := &ApplicationError{
+			ErrorCode: 0x42,
+			Remote:    true,
+		}
+		require.Equal(t, "Application error 0x42 (remote)", err.Error())
+	})
+}
+
+func TestHandshakeTimeoutError(t *testing.T) {
+	require.True(t, errors.Is(&HandshakeTimeoutError{}, &HandshakeTimeoutError{}))
+	require.False(t, errors.Is(&HandshakeTimeoutError{}, &IdleTimeoutError{}))
+
+	//nolint:staticcheck // SA1021: we need to assign to an interface here
+	var err error
+	err = &HandshakeTimeoutError{}
+	nerr, ok := err.(net.Error)
+	require.True(t, ok)
+	require.True(t, nerr.Timeout())
+	require.Equal(t, "timeout: handshake did not complete in time", err.Error())
+	require.True(t, errors.Is(&HandshakeTimeoutError{}, net.ErrClosed))
+}
+
+func TestIdleTimeoutError(t *testing.T) {
+	require.True(t, errors.Is(&IdleTimeoutError{}, &IdleTimeoutError{}))
+	require.False(t, errors.Is(&IdleTimeoutError{}, &HandshakeTimeoutError{}))
+
+	//nolint:staticcheck // SA1021: we need to assign to an interface here
+	var err error
+	err = &IdleTimeoutError{}
+	nerr, ok := err.(net.Error)
+	require.True(t, ok)
+	require.True(t, nerr.Timeout())
+	require.Equal(t, "timeout: no recent network activity", err.Error())
+	require.True(t, errors.Is(&IdleTimeoutError{}, net.ErrClosed))
+}
+
+func TestVersionNegotiationErrorString(t *testing.T) {
+	err := &VersionNegotiationError{
+		Ours:   []protocol.Version{2, 3},
+		Theirs: []protocol.Version{4, 5, 6},
+	}
+	require.Equal(t, "no compatible QUIC version found (we support [0x2 0x3], server offered [0x4 0x5 0x6])", err.Error())
+	require.True(t, errors.Is(&VersionNegotiationError{}, net.ErrClosed))
+}
+
+func TestStatelessResetError(t *testing.T) {
+	require.Equal(t, "received a stateless reset", (&StatelessResetError{}).Error())
+	require.True(t, errors.Is(&StatelessResetError{}, &StatelessResetError{}))
+
+	//nolint:staticcheck // SA1021: we need to assign to an interface here
+	var err error
+	err = &StatelessResetError{}
+	nerr, ok := err.(net.Error)
+	require.True(t, ok)
+	require.False(t, nerr.Timeout())
+	require.True(t, errors.Is(&StatelessResetError{}, net.ErrClosed))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/qtls/cipher_suite.go b/electron/native/private-transport/third_party/quic-go/internal/qtls/cipher_suite.go
new file mode 100644
index 000000000..32a921cd5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/qtls/cipher_suite.go
@@ -0,0 +1,52 @@
+package qtls
+
+import (
+	"crypto/tls"
+	"fmt"
+	"unsafe"
+)
+
+//go:linkname cipherSuitesTLS13 crypto/tls.cipherSuitesTLS13
+var cipherSuitesTLS13 []unsafe.Pointer
+
+//go:linkname defaultCipherSuitesTLS13 crypto/tls.defaultCipherSuitesTLS13
+var defaultCipherSuitesTLS13 []uint16
+
+//go:linkname defaultCipherSuitesTLS13NoAES crypto/tls.defaultCipherSuitesTLS13NoAES
+var defaultCipherSuitesTLS13NoAES []uint16
+
+var cipherSuitesModified bool
+
+// SetCipherSuite modifies the cipherSuiteTLS13 slice of cipher suites inside qtls
+// such that it only contains the cipher suite with the chosen id.
+// The reset function returned resets them back to the original value.
+func SetCipherSuite(id uint16) (reset func()) {
+	if cipherSuitesModified {
+		panic("cipher suites modified multiple times without resetting")
+	}
+	cipherSuitesModified = true
+
+	origCipherSuitesTLS13 := append([]unsafe.Pointer{}, cipherSuitesTLS13...)
+	origDefaultCipherSuitesTLS13 := append([]uint16{}, defaultCipherSuitesTLS13...)
+	origDefaultCipherSuitesTLS13NoAES := append([]uint16{}, defaultCipherSuitesTLS13NoAES...)
+	// The order is given by the order of the slice elements in cipherSuitesTLS13 in qtls.
+	switch id {
+	case tls.TLS_AES_128_GCM_SHA256:
+		cipherSuitesTLS13 = cipherSuitesTLS13[:1]
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		cipherSuitesTLS13 = cipherSuitesTLS13[1:2]
+	case tls.TLS_AES_256_GCM_SHA384:
+		cipherSuitesTLS13 = cipherSuitesTLS13[2:]
+	default:
+		panic(fmt.Sprintf("unexpected cipher suite: %d", id))
+	}
+	defaultCipherSuitesTLS13 = []uint16{id}
+	defaultCipherSuitesTLS13NoAES = []uint16{id}
+
+	return func() {
+		cipherSuitesTLS13 = origCipherSuitesTLS13
+		defaultCipherSuitesTLS13 = origDefaultCipherSuitesTLS13
+		defaultCipherSuitesTLS13NoAES = origDefaultCipherSuitesTLS13NoAES
+		cipherSuitesModified = false
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/qtls/cipher_suite_test.go b/electron/native/private-transport/third_party/quic-go/internal/qtls/cipher_suite_test.go
new file mode 100644
index 000000000..2aedcf8b4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/qtls/cipher_suite_test.go
@@ -0,0 +1,54 @@
+package qtls
+
+import (
+	"crypto/fips140"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/testdata"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCipherSuiteSelection(t *testing.T) {
+	t.Run("TLS_AES_128_GCM_SHA256", func(t *testing.T) { testCipherSuiteSelection(t, tls.TLS_AES_128_GCM_SHA256) })
+	t.Run("TLS_CHACHA20_POLY1305_SHA256", func(t *testing.T) { testCipherSuiteSelection(t, tls.TLS_CHACHA20_POLY1305_SHA256) })
+	t.Run("TLS_AES_256_GCM_SHA384", func(t *testing.T) { testCipherSuiteSelection(t, tls.TLS_AES_256_GCM_SHA384) })
+}
+
+func testCipherSuiteSelection(t *testing.T, cs uint16) {
+	if fips140.Enabled() && cs == tls.TLS_CHACHA20_POLY1305_SHA256 {
+		t.Skip("ChaCha20-Poly1305 is not allowed in FIPS 140-3 mode")
+	}
+
+	reset := SetCipherSuite(cs)
+	defer reset()
+
+	ln, err := tls.Listen("tcp4", "localhost:0", testdata.GetTLSConfig())
+	require.NoError(t, err)
+	defer ln.Close()
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		conn, err := ln.Accept()
+		require.NoError(t, err)
+		_, err = conn.Read(make([]byte, 10))
+		require.NoError(t, err)
+		require.Equal(t, cs, conn.(*tls.Conn).ConnectionState().CipherSuite)
+	}()
+
+	conn, err := tls.Dial(
+		"tcp4",
+		fmt.Sprintf("localhost:%d", ln.Addr().(*net.TCPAddr).Port),
+		&tls.Config{RootCAs: testdata.GetRootCA()},
+	)
+	require.NoError(t, err)
+	_, err = conn.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.Equal(t, cs, conn.ConnectionState().CipherSuite)
+	require.NoError(t, conn.Close())
+	<-done
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/testdata/ca.pem b/electron/native/private-transport/third_party/quic-go/internal/testdata/ca.pem
new file mode 100644
index 000000000..67a5545e8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/testdata/ca.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICzDCCAbQCCQDA+rLymNnfJzANBgkqhkiG9w0BAQsFADAoMSYwJAYDVQQKDB1x
+dWljLWdvIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yMDA4MTgwOTIxMzVaFw0z
+MDA4MTYwOTIxMzVaMCgxJjAkBgNVBAoMHXF1aWMtZ28gQ2VydGlmaWNhdGUgQXV0
+aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1OcsYrVaSDfh
+iDppl6oteVspOY3yFb96T9Y/biaGPJAkBO9VGKcqwOUPmUeiWpedRAUB9LE7Srs6
+qBX4mnl90Icjp8jbIs5cPgIWLkIu8Qm549RghFzB3bn+EmCQSe4cxvyDMN3ndClp
+3YMXpZgXWgJGiPOylVi/OwHDdWDBorw4hvry+6yDtpQo2TuI2A/xtxXPT7BgsEJD
+WGffdgZOYXChcFA0c1XVLIYlu2w2JhxS8c2TUF6uSDlmcoONNKVoiNCuu1Z9MorS
+Qmg7a2G7dSPu123KcTcSQFcmJrt+1G81gOBtHB69kacD8xDmgksj09h/ODPL/gIU
+1ZcU2ci1/QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQB0Tb1JbLXp/BvWovSAhO/j
+wG7UEaUA1rCtkDB+fV2HS9bxCbV5eErdg8AMHKgB51ygUrq95vm/baZmUILr84XK
+uTEoxxrw5S9Z7SrhtbOpKCumoSeTsCPjDvCcwFExHv4XHFk+CPqZwbMHueVIMT0+
+nGWss/KecCPdJLdnUgMRz0tIuXzkoRuOiUiZfUeyBNVNbDFSrLigYshTeAPGaYjX
+CypoHxkeS93nWfOMUu8FTYLYkvGMU5i076zDoFGKJiEtbjSiNW+Hei7u2aSEuCzp
+qyTKzYPWYffAq3MM2MKJgZdL04e9GEGeuce/qhM1o3q77aI/XJImwEDdut2LDec1
+-----END CERTIFICATE-----
diff --git a/electron/native/private-transport/third_party/quic-go/internal/testdata/cert.go b/electron/native/private-transport/third_party/quic-go/internal/testdata/cert.go
new file mode 100644
index 000000000..f77a7b2dd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/testdata/cert.go
@@ -0,0 +1,56 @@
+package testdata
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"os"
+	"path"
+	"runtime"
+)
+
+var certPath string
+
+func init() {
+	_, filename, _, ok := runtime.Caller(0)
+	if !ok {
+		panic("Failed to get current frame")
+	}
+
+	certPath = path.Dir(filename)
+}
+
+// GetCertificatePaths returns the paths to certificate and key
+func GetCertificatePaths() (string, string) {
+	return path.Join(certPath, "cert.pem"), path.Join(certPath, "priv.key")
+}
+
+// GetTLSConfig returns a tls config for quic.clemente.io
+func GetTLSConfig() *tls.Config {
+	cert, err := tls.LoadX509KeyPair(GetCertificatePaths())
+	if err != nil {
+		panic(err)
+	}
+	return &tls.Config{
+		MinVersion:   tls.VersionTLS13,
+		Certificates: []tls.Certificate{cert},
+	}
+}
+
+// AddRootCA adds the root CA certificate to a cert pool
+func AddRootCA(certPool *x509.CertPool) {
+	caCertPath := path.Join(certPath, "ca.pem")
+	caCertRaw, err := os.ReadFile(caCertPath)
+	if err != nil {
+		panic(err)
+	}
+	if ok := certPool.AppendCertsFromPEM(caCertRaw); !ok {
+		panic("Could not add root ceritificate to pool.")
+	}
+}
+
+// GetRootCA returns an x509.CertPool containing (only) the CA certificate
+func GetRootCA() *x509.CertPool {
+	pool := x509.NewCertPool()
+	AddRootCA(pool)
+	return pool
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/testdata/cert.pem b/electron/native/private-transport/third_party/quic-go/internal/testdata/cert.pem
new file mode 100644
index 000000000..91d1aa9e7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/testdata/cert.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC1TCCAb2gAwIBAgIJAK2fcqC0BVA7MA0GCSqGSIb3DQEBCwUAMCgxJjAkBgNV
+BAoMHXF1aWMtZ28gQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIwMDgxODA5MjEz
+NVoXDTMwMDgxNjA5MjEzNVowEjEQMA4GA1UECgwHcXVpYy1nbzCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAN/YwrigSXdJCL/bdBGhb0UpqtU8H+krV870
++w1yCSykLImH8x3qHZEXt9sr/vgjcJoV6Z15RZmnbEqnAx84sIClIBoIgnk0VPxu
+WF+/U/dElbftCfYcfJAddhRckdmGB+yb3Wogb32UJ+q3my++h6NjHsYb+OwpJPnQ
+meXjOE7Kkf+bXfFywHF3R8kzVdh5JUFYeKbxYmYgxRps1YTsbCrZCrSy1CbQ9FJw
+Wg5C8t+7yvVFmOeWPECypBCz2xS2mu+kycMNIjIWMl0SL7oVM5cBkRKPeVIG/KcM
+i5+/4lRSLoPh0Txh2TKBWfpzLbIOdPU8/O7cAukIGWx0XsfHUQMCAwEAAaMYMBYw
+FAYDVR0RBA0wC4IJbG9jYWxob3N0MA0GCSqGSIb3DQEBCwUAA4IBAQAyxxvebdMz
+shp5pt1SxMOSXbo8sTa1cpaf2rTmb4nxjXs6KPBEn53hSBz9bhe5wXE4f94SHadf
+636rLh3d75KgrLUwO9Yq0HfCxMo1jUV/Ug++XwcHCI9vk58Tk/H4hqEM6C8RrdTj
+fYeuegQ0/oNLJ4uTw2P2A8TJbL6FC2dcICEAvUGZUcVyZ8m8tHXNRYYh6MZ7ubCh
+hinvL+AA5fY6EVlc5G/P4DN6fYxGn1cFNbiL4uZP4+W3dOmP+NV0YV9ihTyMzz0R
+vSoOZ9FeVkyw8EhMb3LoyXYKazvJy2VQST1ltzAGit9RiM1Gv4vuna74WsFzrn1U
+A/TbaR0ih/qG
+-----END CERTIFICATE-----
diff --git a/electron/native/private-transport/third_party/quic-go/internal/testdata/cert_test.go b/electron/native/private-transport/third_party/quic-go/internal/testdata/cert_test.go
new file mode 100644
index 000000000..2eff1fef2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/testdata/cert_test.go
@@ -0,0 +1,28 @@
+package testdata
+
+import (
+	"crypto/tls"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCertificates(t *testing.T) {
+	ln, err := tls.Listen("tcp", "localhost:4433", GetTLSConfig())
+	require.NoError(t, err)
+
+	go func() {
+		conn, err := ln.Accept()
+		require.NoError(t, err)
+		defer conn.Close()
+		_, err = conn.Write([]byte("foobar"))
+		require.NoError(t, err)
+	}()
+
+	conn, err := tls.Dial("tcp", "localhost:4433", &tls.Config{RootCAs: GetRootCA()})
+	require.NoError(t, err)
+	data, err := io.ReadAll(conn)
+	require.NoError(t, err)
+	require.Equal(t, "foobar", string(data))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/testdata/generate_key.sh b/electron/native/private-transport/third_party/quic-go/internal/testdata/generate_key.sh
new file mode 100644
index 000000000..7ecaa966d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/testdata/generate_key.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -e
+
+echo "Generating CA key and certificate:"
+openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:2048 \
+  -keyout ca.key -out ca.pem \
+  -subj "/O=quic-go Certificate Authority/"
+
+echo "Generating CSR"
+openssl req -out cert.csr -new -newkey rsa:2048 -nodes -keyout priv.key \
+  -subj "/O=quic-go/"
+
+echo "Sign certificate:"
+openssl x509 -req -sha256 -days 3650 -in cert.csr  -out cert.pem \
+  -CA ca.pem -CAkey ca.key -CAcreateserial \
+  -extfile <(printf "subjectAltName=DNS:localhost")
+
+# debug output the certificate
+openssl x509 -noout -text -in cert.pem
+
+# we don't need the CA key, the serial number and the CSR any more
+rm ca.key cert.csr ca.srl
+
diff --git a/electron/native/private-transport/third_party/quic-go/internal/testdata/priv.key b/electron/native/private-transport/third_party/quic-go/internal/testdata/priv.key
new file mode 100644
index 000000000..56b8d894d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/testdata/priv.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDf2MK4oEl3SQi/
+23QRoW9FKarVPB/pK1fO9PsNcgkspCyJh/Md6h2RF7fbK/74I3CaFemdeUWZp2xK
+pwMfOLCApSAaCIJ5NFT8blhfv1P3RJW37Qn2HHyQHXYUXJHZhgfsm91qIG99lCfq
+t5svvoejYx7GG/jsKST50Jnl4zhOypH/m13xcsBxd0fJM1XYeSVBWHim8WJmIMUa
+bNWE7Gwq2Qq0stQm0PRScFoOQvLfu8r1RZjnljxAsqQQs9sUtprvpMnDDSIyFjJd
+Ei+6FTOXAZESj3lSBvynDIufv+JUUi6D4dE8YdkygVn6cy2yDnT1PPzu3ALpCBls
+dF7Hx1EDAgMBAAECggEBAMm+mLDBdbUWk9YmuZNyRdC13wvT5obF05vo26OglXgw
+dxt09b6OVBuCnuff3SpS9pdJDIYq2HnFlSorH/sxopIvQKF17fHDIp1n7ipNTCXd
+IHrmHkY8Il/YzaVIUQMVc2rih0mw9greTqOS20DKnYC6QvAWIeDmrDaitTGl+ge3
+hm7e2lsgZi13R6fTNwQs9geEQSGzP2k7bFceHQFDChOYiQraR5+VZZ8S8AMGjk47
+AUa5EsKeUe6O9t2xuDSFxzYz5eadOAiErKGDos5KXXr3VQgFcC8uPEFFjcJ/yl+8
+tOe4iLeVwGSDJhTAThdR2deJOjaDcarWM7ixmxA3DAECgYEA/WVwmY4gWKwv49IJ
+Jnh1Gu93P772GqliMNpukdjTI+joQxfl4jRSt2hk4b1KRwyT9aaKfvdz0HFlXo/r
+9NVSAYT3/3vbcw61bfvPhhtz44qRAAKua6b5cUM6XqxVt1hqdP8lrf/blvA5ln+u
+O51S8+wpxZMuqKz/29zdWSG6tAMCgYEA4iWXMXX9dZajI6abVkWwuosvOakXdLk4
+tUy7zd+JPF7hmUzzj2gtg4hXoiQPAOi+GY3TX+1Nza3s1LD7iWaXSKeOWvvligw9
+Q/wVTNW2P1+tdhScJf9QudzW69xOm5HNBgx9uWV2cHfjC12vg5aTH0k5axvaq15H
+9WBXlH5q3wECgYBYoYGYBDFmMpvxmMagkSOMz1OrlVSpkLOKmOxx0SBRACc1SIec
+7mY8RqR6nOX9IfYixyTMMittLiyhvb9vfKnZZDQGRcFFZlCpbplws+t+HDqJgWaW
+uumm5zfkY2z7204pLBF24fZhvha2gGRl76pTLTiTJd79Gr3HnmJByd1vFwKBgHL7
+vfYuEeM55lT4Hz8sTAFtR2O/7+cvTgAQteSlZbfGXlp939DonUulhTkxsFc7/3wq
+unCpzcdoSWSTYDGqcf1FBIKKVVltg7EPeR0KBJIQabgCHqrLOBZojPZ7m5RJ+765
+lysuxZvFuTFMPzNe2gssRf+JuBMt6tR+WclsxZYBAoGAEEFs1ppDil1xlP5rdH7T
+d3TSw/u4eU/X8Ei1zi25hdRUiV76fP9fBELYFmSrPBhugYv91vtSv/LmD4zLfLv/
+yzwAD9j1lGbgM8Of8klCkk+XSJ88ryUwnMTJ5loQJW8t4L+zLv5Le7Ca9SAT0kJ1
+jT0GzDymgLMGp8RPdBkpk+w=
+-----END PRIVATE KEY-----
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/buffered_write_closer.go b/electron/native/private-transport/third_party/quic-go/internal/utils/buffered_write_closer.go
new file mode 100644
index 000000000..80ebfecb1
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/buffered_write_closer.go
@@ -0,0 +1,26 @@
+package utils
+
+import (
+	"bufio"
+	"io"
+)
+
+type bufferedWriteCloser struct {
+	*bufio.Writer
+	io.Closer
+}
+
+// NewBufferedWriteCloser creates an io.WriteCloser from a bufio.Writer and an io.Closer
+func NewBufferedWriteCloser(writer *bufio.Writer, closer io.Closer) io.WriteCloser {
+	return &bufferedWriteCloser{
+		Writer: writer,
+		Closer: closer,
+	}
+}
+
+func (h bufferedWriteCloser) Close() error {
+	if err := h.Flush(); err != nil {
+		return err
+	}
+	return h.Closer.Close()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/buffered_write_closer_test.go b/electron/native/private-transport/third_party/quic-go/internal/utils/buffered_write_closer_test.go
new file mode 100644
index 000000000..4abc9d9e2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/buffered_write_closer_test.go
@@ -0,0 +1,25 @@
+package utils
+
+import (
+	"bufio"
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+type nopCloser struct{}
+
+func (nopCloser) Close() error { return nil }
+
+func TestBufferedWriteCloserFlushBeforeClosing(t *testing.T) {
+	buf := &bytes.Buffer{}
+
+	w := bufio.NewWriter(buf)
+	wc := NewBufferedWriteCloser(w, &nopCloser{})
+	_, err := wc.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.Zero(t, buf.Len())
+	require.NoError(t, wc.Close())
+	require.Equal(t, "foobar", buf.String())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/connstats.go b/electron/native/private-transport/third_party/quic-go/internal/utils/connstats.go
new file mode 100644
index 000000000..19d883126
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/connstats.go
@@ -0,0 +1,14 @@
+package utils
+
+import "sync/atomic"
+
+// ConnectionStats stores stats for the connection. See the public
+// ConnectionStats struct in connection.go for more information
+type ConnectionStats struct {
+	BytesSent       atomic.Uint64
+	PacketsSent     atomic.Uint64
+	BytesReceived   atomic.Uint64
+	PacketsReceived atomic.Uint64
+	BytesLost       atomic.Uint64
+	PacketsLost     atomic.Uint64
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/linkedlist/README.md b/electron/native/private-transport/third_party/quic-go/internal/utils/linkedlist/README.md
new file mode 100644
index 000000000..66482f4fb
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/linkedlist/README.md
@@ -0,0 +1,6 @@
+# Usage
+
+This is the Go standard library implementation of a linked list 
+(https://golang.org/src/container/list/list.go), with the following modifications:
+* it uses Go generics
+* it allows passing in a `sync.Pool` (via the `NewWithPool` constructor) to reduce allocations of `Element` structs
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/linkedlist/linkedlist.go b/electron/native/private-transport/third_party/quic-go/internal/utils/linkedlist/linkedlist.go
new file mode 100644
index 000000000..804a34444
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/linkedlist/linkedlist.go
@@ -0,0 +1,264 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package list implements a doubly linked list.
+//
+// To iterate over a list (where l is a *List[T]):
+//
+//	for e := l.Front(); e != nil; e = e.Next() {
+//		// do something with e.Value
+//	}
+package list
+
+import "sync"
+
+func NewPool[T any]() *sync.Pool {
+	return &sync.Pool{New: func() any { return &Element[T]{} }}
+}
+
+// Element is an element of a linked list.
+type Element[T any] struct {
+	// Next and previous pointers in the doubly-linked list of elements.
+	// To simplify the implementation, internally a list l is implemented
+	// as a ring, such that &l.root is both the next element of the last
+	// list element (l.Back()) and the previous element of the first list
+	// element (l.Front()).
+	next, prev *Element[T]
+
+	// The list to which this element belongs.
+	list *List[T]
+
+	// The value stored with this element.
+	Value T
+}
+
+// Next returns the next list element or nil.
+func (e *Element[T]) Next() *Element[T] {
+	if p := e.next; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+// Prev returns the previous list element or nil.
+func (e *Element[T]) Prev() *Element[T] {
+	if p := e.prev; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+func (e *Element[T]) List() *List[T] {
+	return e.list
+}
+
+// List represents a doubly linked list.
+// The zero value for List is an empty list ready to use.
+type List[T any] struct {
+	root Element[T] // sentinel list element, only &root, root.prev, and root.next are used
+	len  int        // current list length excluding (this) sentinel element
+
+	pool *sync.Pool
+}
+
+// Init initializes or clears list l.
+func (l *List[T]) Init() *List[T] {
+	l.root.next = &l.root
+	l.root.prev = &l.root
+	l.len = 0
+	return l
+}
+
+// New returns an initialized list.
+func New[T any]() *List[T] { return new(List[T]).Init() }
+
+// NewWithPool returns an initialized list, using a sync.Pool for list elements.
+func NewWithPool[T any](pool *sync.Pool) *List[T] {
+	l := &List[T]{pool: pool}
+	return l.Init()
+}
+
+// Len returns the number of elements of list l.
+// The complexity is O(1).
+func (l *List[T]) Len() int { return l.len }
+
+// Front returns the first element of list l or nil if the list is empty.
+func (l *List[T]) Front() *Element[T] {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.next
+}
+
+// Back returns the last element of list l or nil if the list is empty.
+func (l *List[T]) Back() *Element[T] {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.prev
+}
+
+// lazyInit lazily initializes a zero List value.
+func (l *List[T]) lazyInit() {
+	if l.root.next == nil {
+		l.Init()
+	}
+}
+
+// insert inserts e after at, increments l.len, and returns e.
+func (l *List[T]) insert(e, at *Element[T]) *Element[T] {
+	e.prev = at
+	e.next = at.next
+	e.prev.next = e
+	e.next.prev = e
+	e.list = l
+	l.len++
+	return e
+}
+
+// insertValue is a convenience wrapper for insert(&Element{Value: v}, at).
+func (l *List[T]) insertValue(v T, at *Element[T]) *Element[T] {
+	var e *Element[T]
+	if l.pool != nil {
+		e = l.pool.Get().(*Element[T])
+	} else {
+		e = &Element[T]{}
+	}
+	e.Value = v
+	return l.insert(e, at)
+}
+
+// remove removes e from its list, decrements l.len
+func (l *List[T]) remove(e *Element[T]) {
+	e.prev.next = e.next
+	e.next.prev = e.prev
+	e.next = nil // avoid memory leaks
+	e.prev = nil // avoid memory leaks
+	e.list = nil
+	if l.pool != nil {
+		l.pool.Put(e)
+	}
+	l.len--
+}
+
+// move moves e to next to at.
+func (l *List[T]) move(e, at *Element[T]) {
+	if e == at {
+		return
+	}
+	e.prev.next = e.next
+	e.next.prev = e.prev
+
+	e.prev = at
+	e.next = at.next
+	e.prev.next = e
+	e.next.prev = e
+}
+
+// Remove removes e from l if e is an element of list l.
+// It returns the element value e.Value.
+// The element must not be nil.
+func (l *List[T]) Remove(e *Element[T]) T {
+	v := e.Value
+	if e.list == l {
+		// if e.list == l, l must have been initialized when e was inserted
+		// in l or l == nil (e is a zero Element) and l.remove will crash
+		l.remove(e)
+	}
+	return v
+}
+
+// PushFront inserts a new element e with value v at the front of list l and returns e.
+func (l *List[T]) PushFront(v T) *Element[T] {
+	l.lazyInit()
+	return l.insertValue(v, &l.root)
+}
+
+// PushBack inserts a new element e with value v at the back of list l and returns e.
+func (l *List[T]) PushBack(v T) *Element[T] {
+	l.lazyInit()
+	return l.insertValue(v, l.root.prev)
+}
+
+// InsertBefore inserts a new element e with value v immediately before mark and returns e.
+// If mark is not an element of l, the list is not modified.
+// The mark must not be nil.
+func (l *List[T]) InsertBefore(v T, mark *Element[T]) *Element[T] {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark.prev)
+}
+
+// InsertAfter inserts a new element e with value v immediately after mark and returns e.
+// If mark is not an element of l, the list is not modified.
+// The mark must not be nil.
+func (l *List[T]) InsertAfter(v T, mark *Element[T]) *Element[T] {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark)
+}
+
+// MoveToFront moves element e to the front of list l.
+// If e is not an element of l, the list is not modified.
+// The element must not be nil.
+func (l *List[T]) MoveToFront(e *Element[T]) {
+	if e.list != l || l.root.next == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.move(e, &l.root)
+}
+
+// MoveToBack moves element e to the back of list l.
+// If e is not an element of l, the list is not modified.
+// The element must not be nil.
+func (l *List[T]) MoveToBack(e *Element[T]) {
+	if e.list != l || l.root.prev == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.move(e, l.root.prev)
+}
+
+// MoveBefore moves element e to its new position before mark.
+// If e or mark is not an element of l, or e == mark, the list is not modified.
+// The element and mark must not be nil.
+func (l *List[T]) MoveBefore(e, mark *Element[T]) {
+	if e.list != l || e == mark || mark.list != l {
+		return
+	}
+	l.move(e, mark.prev)
+}
+
+// MoveAfter moves element e to its new position after mark.
+// If e or mark is not an element of l, or e == mark, the list is not modified.
+// The element and mark must not be nil.
+func (l *List[T]) MoveAfter(e, mark *Element[T]) {
+	if e.list != l || e == mark || mark.list != l {
+		return
+	}
+	l.move(e, mark)
+}
+
+// PushBackList inserts a copy of another list at the back of list l.
+// The lists l and other may be the same. They must not be nil.
+func (l *List[T]) PushBackList(other *List[T]) {
+	l.lazyInit()
+	for i, e := other.Len(), other.Front(); i > 0; i, e = i-1, e.Next() {
+		l.insertValue(e.Value, l.root.prev)
+	}
+}
+
+// PushFrontList inserts a copy of another list at the front of list l.
+// The lists l and other may be the same. They must not be nil.
+func (l *List[T]) PushFrontList(other *List[T]) {
+	l.lazyInit()
+	for i, e := other.Len(), other.Back(); i > 0; i, e = i-1, e.Prev() {
+		l.insertValue(e.Value, &l.root)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/log.go b/electron/native/private-transport/third_party/quic-go/internal/utils/log.go
new file mode 100644
index 000000000..558803ef2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/log.go
@@ -0,0 +1,131 @@
+package utils
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"strings"
+	"time"
+)
+
+// LogLevel of quic-go
+type LogLevel uint8
+
+const (
+	// LogLevelNothing disables
+	LogLevelNothing LogLevel = iota
+	// LogLevelError enables err logs
+	LogLevelError
+	// LogLevelInfo enables info logs (e.g. packets)
+	LogLevelInfo
+	// LogLevelDebug enables debug logs (e.g. packet contents)
+	LogLevelDebug
+)
+
+const logEnv = "QUIC_GO_LOG_LEVEL"
+
+// A Logger logs.
+type Logger interface {
+	SetLogLevel(LogLevel)
+	SetLogTimeFormat(format string)
+	WithPrefix(prefix string) Logger
+	Debug() bool
+
+	Errorf(format string, args ...any)
+	Infof(format string, args ...any)
+	Debugf(format string, args ...any)
+}
+
+// DefaultLogger is used by quic-go for logging.
+var DefaultLogger Logger
+
+type defaultLogger struct {
+	prefix string
+
+	logLevel   LogLevel
+	timeFormat string
+}
+
+var _ Logger = &defaultLogger{}
+
+// SetLogLevel sets the log level
+func (l *defaultLogger) SetLogLevel(level LogLevel) {
+	l.logLevel = level
+}
+
+// SetLogTimeFormat sets the format of the timestamp
+// an empty string disables the logging of timestamps
+func (l *defaultLogger) SetLogTimeFormat(format string) {
+	log.SetFlags(0) // disable timestamp logging done by the log package
+	l.timeFormat = format
+}
+
+// Debugf logs something
+func (l *defaultLogger) Debugf(format string, args ...any) {
+	if l.logLevel == LogLevelDebug {
+		l.logMessage(format, args...)
+	}
+}
+
+// Infof logs something
+func (l *defaultLogger) Infof(format string, args ...any) {
+	if l.logLevel >= LogLevelInfo {
+		l.logMessage(format, args...)
+	}
+}
+
+// Errorf logs something
+func (l *defaultLogger) Errorf(format string, args ...any) {
+	if l.logLevel >= LogLevelError {
+		l.logMessage(format, args...)
+	}
+}
+
+func (l *defaultLogger) logMessage(format string, args ...any) {
+	var pre string
+
+	if len(l.timeFormat) > 0 {
+		pre = time.Now().Format(l.timeFormat) + " "
+	}
+	if len(l.prefix) > 0 {
+		pre += l.prefix + " "
+	}
+	log.Printf(pre+format, args...)
+}
+
+func (l *defaultLogger) WithPrefix(prefix string) Logger {
+	if len(l.prefix) > 0 {
+		prefix = l.prefix + " " + prefix
+	}
+	return &defaultLogger{
+		logLevel:   l.logLevel,
+		timeFormat: l.timeFormat,
+		prefix:     prefix,
+	}
+}
+
+// Debug returns true if the log level is LogLevelDebug
+func (l *defaultLogger) Debug() bool {
+	return l.logLevel == LogLevelDebug
+}
+
+func init() {
+	DefaultLogger = &defaultLogger{}
+	DefaultLogger.SetLogLevel(readLoggingEnv())
+}
+
+func readLoggingEnv() LogLevel {
+	switch strings.ToLower(os.Getenv(logEnv)) {
+	case "":
+		return LogLevelNothing
+	case "debug":
+		return LogLevelDebug
+	case "info":
+		return LogLevelInfo
+	case "error":
+		return LogLevelError
+	default:
+		fmt.Fprintln(os.Stderr, "invalid quic-go log level, see https://github.com/quic-go/quic-go/wiki/Logging")
+		return LogLevelNothing
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/log_test.go b/electron/native/private-transport/third_party/quic-go/internal/utils/log_test.go
new file mode 100644
index 000000000..8fc7d051c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/log_test.go
@@ -0,0 +1,146 @@
+package utils
+
+import (
+	"bytes"
+	"log"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLogLevelNothing(t *testing.T) {
+	b := &bytes.Buffer{}
+	log.SetOutput(b)
+	defer log.SetOutput(os.Stdout)
+	defer DefaultLogger.SetLogLevel(LogLevelNothing)
+
+	DefaultLogger.SetLogLevel(LogLevelNothing)
+	DefaultLogger.Debugf("debug")
+	DefaultLogger.Infof("info")
+	DefaultLogger.Errorf("err")
+	require.Empty(t, b.String())
+}
+
+func TestLogLevelError(t *testing.T) {
+	b := &bytes.Buffer{}
+	log.SetOutput(b)
+	defer log.SetOutput(os.Stdout)
+	defer DefaultLogger.SetLogLevel(LogLevelNothing)
+
+	DefaultLogger.SetLogLevel(LogLevelError)
+	DefaultLogger.Debugf("debug")
+	DefaultLogger.Infof("info")
+	DefaultLogger.Errorf("err")
+	require.Contains(t, b.String(), "err\n")
+	require.NotContains(t, b.String(), "info")
+	require.NotContains(t, b.String(), "debug")
+}
+
+func TestLogLevelInfo(t *testing.T) {
+	b := &bytes.Buffer{}
+	log.SetOutput(b)
+	defer log.SetOutput(os.Stdout)
+	defer DefaultLogger.SetLogLevel(LogLevelNothing)
+
+	DefaultLogger.SetLogLevel(LogLevelInfo)
+	DefaultLogger.Debugf("debug")
+	DefaultLogger.Infof("info")
+	DefaultLogger.Errorf("err")
+	require.Contains(t, b.String(), "err\n")
+	require.Contains(t, b.String(), "info\n")
+	require.NotContains(t, b.String(), "debug")
+}
+
+func TestLogLevelDebug(t *testing.T) {
+	b := &bytes.Buffer{}
+	log.SetOutput(b)
+	defer log.SetOutput(os.Stdout)
+	defer DefaultLogger.SetLogLevel(LogLevelNothing)
+
+	require.False(t, DefaultLogger.Debug())
+	DefaultLogger.SetLogLevel(LogLevelDebug)
+	require.True(t, DefaultLogger.Debug())
+	DefaultLogger.Debugf("debug")
+	DefaultLogger.Infof("info")
+	DefaultLogger.Errorf("err")
+	require.Contains(t, b.String(), "err\n")
+	require.Contains(t, b.String(), "info\n")
+	require.Contains(t, b.String(), "debug\n")
+}
+
+func TestNoTimestampWithEmptyFormat(t *testing.T) {
+	b := &bytes.Buffer{}
+	log.SetOutput(b)
+	defer log.SetOutput(os.Stdout)
+	defer DefaultLogger.SetLogLevel(LogLevelNothing)
+
+	DefaultLogger.SetLogLevel(LogLevelDebug)
+	DefaultLogger.SetLogTimeFormat("")
+	DefaultLogger.Debugf("debug")
+	require.Equal(t, "debug\n", b.String())
+}
+
+func TestAddTimestamp(t *testing.T) {
+	b := &bytes.Buffer{}
+	log.SetOutput(b)
+	defer log.SetOutput(os.Stdout)
+	defer DefaultLogger.SetLogLevel(LogLevelNothing)
+
+	format := "Jan 2, 2006"
+	DefaultLogger.SetLogTimeFormat(format)
+	DefaultLogger.SetLogLevel(LogLevelInfo)
+	DefaultLogger.Infof("info")
+	timestamp := b.String()[:b.Len()-6]
+	parsedTime, err := time.ParseInLocation(format, timestamp, time.Local)
+	require.NoError(t, err)
+	require.WithinDuration(t, time.Now(), parsedTime, 25*time.Hour)
+}
+
+func TestLogAddPrefixes(t *testing.T) {
+	b := &bytes.Buffer{}
+	log.SetOutput(b)
+	defer log.SetOutput(os.Stdout)
+	defer DefaultLogger.SetLogLevel(LogLevelNothing)
+
+	DefaultLogger.SetLogLevel(LogLevelDebug)
+
+	// single prefix
+	prefixLogger := DefaultLogger.WithPrefix("prefix")
+	prefixLogger.Debugf("debug1")
+	require.Contains(t, b.String(), "prefix")
+	require.Contains(t, b.String(), "debug1")
+
+	// multiple prefixes
+	b.Reset()
+	prefixLogger1 := DefaultLogger.WithPrefix("prefix1")
+	prefixLogger2 := prefixLogger1.WithPrefix("prefix2")
+	prefixLogger2.Debugf("debug2")
+	require.Contains(t, b.String(), "prefix1")
+	require.Contains(t, b.String(), "prefix2")
+	require.Contains(t, b.String(), "debug2")
+}
+
+func TestLogLevelFromEnv(t *testing.T) {
+	testCases := []struct {
+		envValue string
+		expected LogLevel
+	}{
+		{"DEBUG", LogLevelDebug},
+		{"debug", LogLevelDebug},
+		{"INFO", LogLevelInfo},
+		{"ERROR", LogLevelError},
+	}
+
+	for _, tc := range testCases {
+		t.Setenv(logEnv, tc.envValue)
+		require.Equal(t, tc.expected, readLoggingEnv())
+	}
+
+	// invalid values
+	t.Setenv(logEnv, "")
+	require.Equal(t, LogLevelNothing, readLoggingEnv())
+	t.Setenv(logEnv, "asdf")
+	require.Equal(t, LogLevelNothing, readLoggingEnv())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/minheap/minheap.go b/electron/native/private-transport/third_party/quic-go/internal/utils/minheap/minheap.go
new file mode 100644
index 000000000..bfddbd9a4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/minheap/minheap.go
@@ -0,0 +1,78 @@
+package minheap
+
+import "cmp"
+
+type entry[K, V any] struct {
+	key   K
+	value V
+}
+
+// A Heap is a minimum heap ordered by key.
+type Heap[K cmp.Ordered, V any] []entry[K, V]
+
+func (h Heap[K, V]) Len() int    { return len(h) }
+func (h Heap[K, V]) Empty() bool { return len(h) == 0 }
+
+// Peek returns the smallest element in the heap.
+// It must not be called when the heap is empty.
+func (h Heap[K, V]) Peek() (K, V) {
+	v := h[0]
+	return v.key, v.value
+}
+
+// Push adds an element to the heap.
+func (h *Heap[K, V]) Push(key K, value V) {
+	*h = append(*h, entry[K, V]{key: key, value: value})
+	(*h).up(len(*h) - 1)
+}
+
+// Pop removes and returns the smallest element in the heap.
+// It must not be called when the heap is empty.
+func (h *Heap[K, V]) Pop() (K, V) {
+	values := *h
+	last := len(values) - 1
+	v := values[0]
+	values[0] = values[last]
+	var zero entry[K, V]
+	values[last] = zero
+	values = values[:last]
+	if last > 0 {
+		values.down(0)
+	}
+	*h = values
+	return v.key, v.value
+}
+
+// Clear removes all elements from the heap.
+func (h *Heap[K, V]) Clear() {
+	clear(*h)
+	*h = (*h)[:0]
+}
+
+func (h Heap[K, V]) up(i int) {
+	for i > 0 {
+		parent := (i - 1) / 2
+		if h[parent].key <= h[i].key {
+			return
+		}
+		h[parent], h[i] = h[i], h[parent]
+		i = parent
+	}
+}
+
+func (h Heap[K, V]) down(i int) {
+	for {
+		child := 2*i + 1
+		if child >= len(h) {
+			break
+		}
+		if right := child + 1; right < len(h) && h[right].key < h[child].key {
+			child = right
+		}
+		if h[i].key <= h[child].key {
+			break
+		}
+		h[i], h[child] = h[child], h[i]
+		i = child
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/minheap/minheap_test.go b/electron/native/private-transport/third_party/quic-go/internal/utils/minheap/minheap_test.go
new file mode 100644
index 000000000..18208326e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/minheap/minheap_test.go
@@ -0,0 +1,37 @@
+package minheap
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestHeap(t *testing.T) {
+	var h Heap[int, string]
+	require.True(t, h.Empty())
+	require.Panics(t, func() { h.Peek() })
+	require.Panics(t, func() { h.Pop() })
+
+	h.Push(4, "four")
+	h.Push(1, "one")
+	h.Push(3, "three")
+	h.Push(2, "two")
+	require.Equal(t, 4, h.Len())
+	key, value := h.Peek()
+	require.Equal(t, 1, key)
+	require.Equal(t, "one", value)
+	for _, expected := range []struct {
+		key   int
+		value string
+	}{{1, "one"}, {2, "two"}, {3, "three"}, {4, "four"}} {
+		key, value = h.Pop()
+		require.Equal(t, expected.key, key)
+		require.Equal(t, expected.value, value)
+	}
+	require.True(t, h.Empty())
+
+	h.Push(1, "one")
+	h.Push(2, "two")
+	h.Clear()
+	require.True(t, h.Empty())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/rand.go b/electron/native/private-transport/third_party/quic-go/internal/utils/rand.go
new file mode 100644
index 000000000..30069144a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/rand.go
@@ -0,0 +1,29 @@
+package utils
+
+import (
+	"crypto/rand"
+	"encoding/binary"
+)
+
+// Rand is a wrapper around crypto/rand that adds some convenience functions known from math/rand.
+type Rand struct {
+	buf [4]byte
+}
+
+func (r *Rand) Int31() int32 {
+	rand.Read(r.buf[:])
+	return int32(binary.BigEndian.Uint32(r.buf[:]) & ^uint32(1<<31))
+}
+
+// copied from the standard library math/rand implementation of Int63n
+func (r *Rand) Int31n(n int32) int32 {
+	if n&(n-1) == 0 { // n is power of two, can mask
+		return r.Int31() & (n - 1)
+	}
+	max := int32((1 << 31) - 1 - (1<<31)%uint32(n))
+	v := r.Int31()
+	for v > max {
+		v = r.Int31()
+	}
+	return v % n
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/rand_test.go b/electron/native/private-transport/third_party/quic-go/internal/utils/rand_test.go
new file mode 100644
index 000000000..fcef09711
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/rand_test.go
@@ -0,0 +1,32 @@
+package utils
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRandomNumbers(t *testing.T) {
+	const (
+		num = 1000
+		max = 12345678
+	)
+
+	var values [num]int32
+	var r Rand
+	for i := range num {
+		v := r.Int31n(max)
+		require.GreaterOrEqual(t, v, int32(0))
+		require.Less(t, v, int32(max))
+		values[i] = v
+	}
+
+	var sum uint64
+	for _, n := range values {
+		sum += uint64(n)
+	}
+	average := float64(sum) / num
+	expectedAverage := float64(max) / 2
+	tolerance := float64(max) / 25
+	require.InDelta(t, expectedAverage, average, tolerance)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/ringbuffer/ringbuffer.go b/electron/native/private-transport/third_party/quic-go/internal/utils/ringbuffer/ringbuffer.go
new file mode 100644
index 000000000..4200cc50d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/ringbuffer/ringbuffer.go
@@ -0,0 +1,92 @@
+package ringbuffer
+
+// RingBuffer is a growable FIFO queue that reuses its backing storage.
+// The slice length stores the queue length, so wrapped positions are accessed by reslicing to capacity.
+type RingBuffer[T any] struct {
+	ring    []T // len is the number of queued elements; cap is the storage size
+	headPos int // index of the first element in the full backing storage
+}
+
+// Init preallocates a buffer with a certain size.
+func (r *RingBuffer[T]) Init(size int) {
+	r.ring = make([]T, 0, size)
+	r.headPos = 0
+}
+
+// Len returns the number of elements in the ring buffer.
+func (r *RingBuffer[T]) Len() int {
+	return len(r.ring)
+}
+
+// Empty says if the ring buffer is empty.
+func (r *RingBuffer[T]) Empty() bool {
+	return len(r.ring) == 0
+}
+
+// PushBack adds a new element.
+// If the ring buffer is full, its capacity is increased first.
+func (r *RingBuffer[T]) PushBack(t T) {
+	if len(r.ring) == cap(r.ring) {
+		r.grow()
+	}
+	tailPos := r.headPos + len(r.ring)
+	if tailPos >= cap(r.ring) {
+		// both values in the sum are smaller than cap, so one subtraction wraps the index
+		tailPos -= cap(r.ring)
+	}
+	// r.ring's length is the element count, so tailPos may be beyond it after a wrap.
+	// Grow the length before temporarily exposing the whole backing array; this order
+	// lets the compiler eliminate a bounds check.
+	r.ring = r.ring[:len(r.ring)+1]
+	r.ring[:cap(r.ring)][tailPos] = t
+}
+
+// PopFront returns the next element.
+// It must not be called when the buffer is empty, that means that
+// callers might need to check if there are elements in the buffer first.
+func (r *RingBuffer[T]) PopFront() T {
+	if r.Empty() {
+		panic("github.com/quic-go/quic-go/internal/utils/ringbuffer: pop from an empty queue")
+	}
+	// Shrink first. The backing storage remains accessible through cap,
+	// and this ordering avoids an extra bounds check.
+	r.ring = r.ring[:len(r.ring)-1]
+	t := r.ring[:cap(r.ring)][r.headPos]
+	clear(r.ring[:cap(r.ring)][r.headPos : r.headPos+1])
+	r.headPos++
+	if r.headPos == cap(r.ring) {
+		r.headPos = 0
+	}
+	return t
+}
+
+// PeekFront returns the next element.
+// It must not be called when the buffer is empty, that means that
+// callers might need to check if there are elements in the buffer first.
+func (r *RingBuffer[T]) PeekFront() T {
+	if r.Empty() {
+		panic("github.com/quic-go/quic-go/internal/utils/ringbuffer: peek from an empty queue")
+	}
+	return r.ring[:cap(r.ring)][r.headPos]
+}
+
+// grow doubles the storage and copies the queued elements into FIFO order.
+func (r *RingBuffer[T]) grow() {
+	oldRing := r.ring
+	newSize := cap(oldRing) * 2
+	if newSize == 0 {
+		newSize = 1
+	}
+	newRing := make([]T, len(oldRing), newSize)
+	headLen := copy(newRing, oldRing[r.headPos:])
+	copy(newRing[headLen:], oldRing[:r.headPos])
+	r.ring = newRing
+	r.headPos = 0
+}
+
+// Clear removes all elements while retaining the allocated storage.
+func (r *RingBuffer[T]) Clear() {
+	clear(r.ring[:cap(r.ring)])
+	r.ring = r.ring[:0]
+	r.headPos = 0
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/ringbuffer/ringbuffer_test.go b/electron/native/private-transport/third_party/quic-go/internal/utils/ringbuffer/ringbuffer_test.go
new file mode 100644
index 000000000..ed20f2a9b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/ringbuffer/ringbuffer_test.go
@@ -0,0 +1,78 @@
+package ringbuffer
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPushPeekPop(t *testing.T) {
+	r := RingBuffer[int]{}
+	require.Equal(t, 0, len(r.ring))
+	require.Panics(t, func() { r.PopFront() })
+	r.PushBack(1)
+	r.PushBack(2)
+	r.PushBack(3)
+	require.Equal(t, 1, r.PeekFront())
+	require.Equal(t, 1, r.PeekFront())
+	require.Equal(t, 1, r.PopFront())
+	require.Equal(t, 2, r.PeekFront())
+	require.Equal(t, 2, r.PopFront())
+	r.PushBack(4)
+	r.PushBack(5)
+	require.Equal(t, 3, r.Len())
+	r.PushBack(6)
+	require.Equal(t, 4, r.Len())
+	r.PushBack(7) // grow with the buffer wrapped around
+	require.Equal(t, 5, r.Len())
+	require.Equal(t, 3, r.PopFront())
+	require.Equal(t, 4, r.PopFront())
+	require.Equal(t, 5, r.PopFront())
+	require.Equal(t, 6, r.PopFront())
+	require.Equal(t, 7, r.PopFront())
+}
+
+func TestPanicOnEmptyBuffer(t *testing.T) {
+	r := RingBuffer[string]{}
+	require.True(t, r.Empty())
+	require.Zero(t, r.Len())
+	require.Panics(t, func() { r.PeekFront() })
+	require.Panics(t, func() { r.PopFront() })
+}
+
+func TestClear(t *testing.T) {
+	r := RingBuffer[int]{}
+	r.Init(2)
+	r.PushBack(1)
+	r.PushBack(2)
+	require.Equal(t, 2, r.Len())
+	r.Clear()
+	require.True(t, r.Empty())
+	r.PushBack(3)
+	require.Equal(t, 3, r.PopFront())
+}
+
+func BenchmarkRingBuffer(b *testing.B) {
+	r := RingBuffer[int]{}
+
+	var val int
+	for b.Loop() {
+		r.PushBack(val)
+		r.PopFront()
+		val++
+	}
+}
+
+func BenchmarkRingBufferWrapped(b *testing.B) {
+	var r RingBuffer[int]
+	r.Init(32)
+	for i := range 16 {
+		r.PushBack(i)
+	}
+
+	var val int
+	for b.Loop() {
+		r.PushBack(val)
+		val = r.PopFront()
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/rtt_stats.go b/electron/native/private-transport/third_party/quic-go/internal/utils/rtt_stats.go
new file mode 100644
index 000000000..275313073
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/rtt_stats.go
@@ -0,0 +1,159 @@
+package utils
+
+import (
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+const (
+	rttAlpha      = 0.125
+	oneMinusAlpha = 1 - rttAlpha
+	rttBeta       = 0.25
+	oneMinusBeta  = 1 - rttBeta
+)
+
+// The default RTT used before an RTT sample is taken
+const DefaultInitialRTT = 100 * time.Millisecond
+
+// RTTStats provides round-trip statistics
+type RTTStats struct {
+	hasMeasurement bool
+
+	minRTT        atomic.Int64 // nanoseconds
+	latestRTT     atomic.Int64 // nanoseconds
+	smoothedRTT   atomic.Int64 // nanoseconds
+	meanDeviation atomic.Int64 // nanoseconds
+
+	maxAckDelay atomic.Int64 // nanoseconds
+}
+
+func NewRTTStats() *RTTStats {
+	var rttStats RTTStats
+	rttStats.minRTT.Store(DefaultInitialRTT.Nanoseconds())
+	rttStats.latestRTT.Store(DefaultInitialRTT.Nanoseconds())
+	rttStats.smoothedRTT.Store(DefaultInitialRTT.Nanoseconds())
+	return &rttStats
+}
+
+// MinRTT Returns the minRTT for the entire connection.
+// May return Zero if no valid updates have occurred.
+func (r *RTTStats) MinRTT() time.Duration {
+	return time.Duration(r.minRTT.Load())
+}
+
+// LatestRTT returns the most recent rtt measurement.
+// May return Zero if no valid updates have occurred.
+func (r *RTTStats) LatestRTT() time.Duration {
+	return time.Duration(r.latestRTT.Load())
+}
+
+// SmoothedRTT returns the smoothed RTT for the connection.
+// May return Zero if no valid updates have occurred.
+func (r *RTTStats) SmoothedRTT() time.Duration {
+	return time.Duration(r.smoothedRTT.Load())
+}
+
+// MeanDeviation gets the mean deviation
+func (r *RTTStats) MeanDeviation() time.Duration {
+	return time.Duration(r.meanDeviation.Load())
+}
+
+// MaxAckDelay gets the max_ack_delay advertised by the peer
+func (r *RTTStats) MaxAckDelay() time.Duration {
+	return time.Duration(r.maxAckDelay.Load())
+}
+
+// PTO gets the probe timeout duration.
+func (r *RTTStats) PTO(includeMaxAckDelay bool) time.Duration {
+	if !r.hasMeasurement {
+		return 2 * DefaultInitialRTT
+	}
+	pto := r.SmoothedRTT() + max(4*r.MeanDeviation(), protocol.TimerGranularity)
+	if includeMaxAckDelay {
+		pto += r.MaxAckDelay()
+	}
+	return pto
+}
+
+// UpdateRTT updates the RTT based on a new sample.
+func (r *RTTStats) UpdateRTT(sendDelta, ackDelay time.Duration) {
+	if sendDelta <= 0 {
+		return
+	}
+
+	// Update r.minRTT first. r.minRTT does not use an rttSample corrected for
+	// ackDelay but the raw observed sendDelta, since poor clock granularity at
+	// the client may cause a high ackDelay to result in underestimation of the
+	// r.minRTT.
+	minRTT := time.Duration(r.minRTT.Load())
+	if !r.hasMeasurement || minRTT > sendDelta {
+		minRTT = sendDelta
+		r.minRTT.Store(sendDelta.Nanoseconds())
+	}
+
+	// Correct for ackDelay if information received from the peer results in a
+	// an RTT sample at least as large as minRTT. Otherwise, only use the
+	// sendDelta.
+	sample := sendDelta
+	if sample-minRTT >= ackDelay {
+		sample -= ackDelay
+	}
+	r.latestRTT.Store(sample.Nanoseconds())
+	// First time call.
+	if !r.hasMeasurement {
+		r.hasMeasurement = true
+		r.smoothedRTT.Store(sample.Nanoseconds())
+		r.meanDeviation.Store(sample.Nanoseconds() / 2)
+	} else {
+		smoothedRTT := r.SmoothedRTT()
+		meanDev := time.Duration(oneMinusBeta*float32(r.MeanDeviation()/time.Microsecond)+rttBeta*float32((smoothedRTT-sample).Abs()/time.Microsecond)) * time.Microsecond
+		newSmoothedRTT := time.Duration((float32(smoothedRTT/time.Microsecond)*oneMinusAlpha)+(float32(sample/time.Microsecond)*rttAlpha)) * time.Microsecond
+		r.meanDeviation.Store(meanDev.Nanoseconds())
+		r.smoothedRTT.Store(newSmoothedRTT.Nanoseconds())
+	}
+}
+
+func (r *RTTStats) HasMeasurement() bool {
+	return r.hasMeasurement
+}
+
+// SetMaxAckDelay sets the max_ack_delay
+func (r *RTTStats) SetMaxAckDelay(mad time.Duration) {
+	r.maxAckDelay.Store(int64(mad))
+}
+
+// SetInitialRTT sets the initial RTT.
+// It is used during handshake when restoring the RTT stats from the token.
+func (r *RTTStats) SetInitialRTT(t time.Duration) {
+	// On the server side, by the time we get to process the session ticket,
+	// we might already have obtained an RTT measurement.
+	// This can happen if we received the ClientHello in multiple pieces, and one of those pieces was lost.
+	// Discard the restored value. A fresh measurement is always better.
+	if r.hasMeasurement {
+		return
+	}
+	r.smoothedRTT.Store(int64(t))
+	r.latestRTT.Store(int64(t))
+}
+
+func (r *RTTStats) ResetForPathMigration() {
+	r.hasMeasurement = false
+	r.minRTT.Store(DefaultInitialRTT.Nanoseconds())
+	r.latestRTT.Store(DefaultInitialRTT.Nanoseconds())
+	r.smoothedRTT.Store(DefaultInitialRTT.Nanoseconds())
+	r.meanDeviation.Store(0)
+	// max_ack_delay remains valid
+}
+
+func (r *RTTStats) Clone() *RTTStats {
+	out := &RTTStats{}
+	out.hasMeasurement = r.hasMeasurement
+	out.minRTT.Store(r.minRTT.Load())
+	out.latestRTT.Store(r.latestRTT.Load())
+	out.smoothedRTT.Store(r.smoothedRTT.Load())
+	out.meanDeviation.Store(r.meanDeviation.Load())
+	out.maxAckDelay.Store(r.maxAckDelay.Load())
+	return out
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/utils/rtt_stats_test.go b/electron/native/private-transport/third_party/quic-go/internal/utils/rtt_stats_test.go
new file mode 100644
index 000000000..b7504de13
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/utils/rtt_stats_test.go
@@ -0,0 +1,146 @@
+package utils
+
+import (
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRTTStatsDefaults(t *testing.T) {
+	rttStats := NewRTTStats()
+	require.False(t, rttStats.HasMeasurement())
+	require.Equal(t, DefaultInitialRTT, rttStats.MinRTT())
+	require.Equal(t, DefaultInitialRTT, rttStats.SmoothedRTT())
+}
+
+func TestRTTStatsSmoothedRTT(t *testing.T) {
+	rttStats := NewRTTStats()
+	require.False(t, rttStats.HasMeasurement())
+	// verify that ack_delay is ignored in the first measurement
+	rttStats.UpdateRTT(300*time.Millisecond, 100*time.Millisecond)
+	require.True(t, rttStats.HasMeasurement())
+	require.Equal(t, 300*time.Millisecond, rttStats.LatestRTT())
+	require.Equal(t, 300*time.Millisecond, rttStats.SmoothedRTT())
+	// verify that smoothed RTT includes max ack delay if it's reasonable
+	rttStats.UpdateRTT(350*time.Millisecond, 50*time.Millisecond)
+	require.Equal(t, 300*time.Millisecond, rttStats.LatestRTT())
+	require.Equal(t, 300*time.Millisecond, rttStats.SmoothedRTT())
+	// verify that large erroneous ack_delay does not change smoothed RTT
+	rttStats.UpdateRTT(200*time.Millisecond, 300*time.Millisecond)
+	require.Equal(t, 200*time.Millisecond, rttStats.LatestRTT())
+	require.Equal(t, 287500*time.Microsecond, rttStats.SmoothedRTT())
+}
+
+func TestRTTStatsMinRTT(t *testing.T) {
+	rttStats := NewRTTStats()
+	rttStats.UpdateRTT(200*time.Millisecond, 0)
+	require.Equal(t, 200*time.Millisecond, rttStats.MinRTT())
+	rttStats.UpdateRTT(10*time.Millisecond, 0)
+	require.Equal(t, 10*time.Millisecond, rttStats.MinRTT())
+	rttStats.UpdateRTT(50*time.Millisecond, 0)
+	require.Equal(t, 10*time.Millisecond, rttStats.MinRTT())
+	rttStats.UpdateRTT(50*time.Millisecond, 0)
+	require.Equal(t, 10*time.Millisecond, rttStats.MinRTT())
+	rttStats.UpdateRTT(50*time.Millisecond, 0)
+	require.Equal(t, 10*time.Millisecond, rttStats.MinRTT())
+	// verify that ack_delay does not go into recording of MinRTT
+	rttStats.UpdateRTT(7*time.Millisecond, 2*time.Millisecond)
+	require.Equal(t, 7*time.Millisecond, rttStats.MinRTT())
+}
+
+func TestRTTStatsMaxAckDelay(t *testing.T) {
+	rttStats := NewRTTStats()
+	rttStats.SetMaxAckDelay(42 * time.Minute)
+	require.Equal(t, 42*time.Minute, rttStats.MaxAckDelay())
+}
+
+func TestRTTStatsComputePTO(t *testing.T) {
+	const (
+		maxAckDelay = 42 * time.Minute
+		rtt         = time.Second
+	)
+	rttStats := NewRTTStats()
+	rttStats.SetMaxAckDelay(maxAckDelay)
+	rttStats.UpdateRTT(rtt, 0)
+	require.Equal(t, rtt, rttStats.SmoothedRTT())
+	require.Equal(t, rtt/2, rttStats.MeanDeviation())
+	require.Equal(t, rtt+4*(rtt/2), rttStats.PTO(false))
+	require.Equal(t, rtt+4*(rtt/2)+maxAckDelay, rttStats.PTO(true))
+}
+
+func TestRTTStatsPTOWithShortRTT(t *testing.T) {
+	const rtt = time.Microsecond
+	rttStats := NewRTTStats()
+	rttStats.UpdateRTT(rtt, 0)
+	require.Equal(t, rtt+protocol.TimerGranularity, rttStats.PTO(true))
+}
+
+func TestRTTStatsUpdateWithBadSendDeltas(t *testing.T) {
+	rttStats := NewRTTStats()
+	const initialRtt = 10 * time.Millisecond
+	rttStats.UpdateRTT(initialRtt, 0)
+	require.Equal(t, initialRtt, rttStats.MinRTT())
+	require.Equal(t, initialRtt, rttStats.SmoothedRTT())
+
+	badSendDeltas := []time.Duration{
+		0,
+		-1000 * time.Microsecond,
+	}
+
+	for _, badSendDelta := range badSendDeltas {
+		rttStats.UpdateRTT(badSendDelta, 0)
+		require.Equal(t, initialRtt, rttStats.MinRTT())
+		require.Equal(t, initialRtt, rttStats.SmoothedRTT())
+	}
+}
+
+func TestRTTStatsRestore(t *testing.T) {
+	rttStats := NewRTTStats()
+	rttStats.SetInitialRTT(10 * time.Second)
+	require.Equal(t, 10*time.Second, rttStats.LatestRTT())
+	require.Equal(t, 10*time.Second, rttStats.SmoothedRTT())
+	require.Zero(t, rttStats.MeanDeviation())
+	// update the RTT and make sure that the initial value is immediately forgotten
+	rttStats.UpdateRTT(200*time.Millisecond, 0)
+	require.Equal(t, 200*time.Millisecond, rttStats.LatestRTT())
+	require.Equal(t, 200*time.Millisecond, rttStats.SmoothedRTT())
+	require.Equal(t, 100*time.Millisecond, rttStats.MeanDeviation())
+}
+
+func TestRTTMeasurementAfterRestore(t *testing.T) {
+	rttStats := NewRTTStats()
+	const rtt = 10 * time.Millisecond
+	rttStats.UpdateRTT(rtt, 0)
+	require.Equal(t, rtt, rttStats.LatestRTT())
+	require.Equal(t, rtt, rttStats.SmoothedRTT())
+	rttStats.SetInitialRTT(time.Minute)
+	require.Equal(t, rtt, rttStats.LatestRTT())
+	require.Equal(t, rtt, rttStats.SmoothedRTT())
+}
+
+func TestRTTStatsResetForPathMigration(t *testing.T) {
+	rttStats := NewRTTStats()
+	rttStats.SetMaxAckDelay(42 * time.Millisecond)
+	rttStats.UpdateRTT(time.Second, 0)
+	rttStats.UpdateRTT(10*time.Second, 0)
+	require.True(t, rttStats.HasMeasurement())
+	require.Equal(t, time.Second, rttStats.MinRTT())
+	require.Equal(t, 10*time.Second, rttStats.LatestRTT())
+	require.NotZero(t, rttStats.SmoothedRTT())
+
+	rttStats.ResetForPathMigration()
+	require.False(t, rttStats.HasMeasurement())
+	require.Equal(t, DefaultInitialRTT, rttStats.MinRTT())
+	require.Equal(t, DefaultInitialRTT, rttStats.LatestRTT())
+	require.Equal(t, DefaultInitialRTT, rttStats.SmoothedRTT())
+	require.Equal(t, 2*DefaultInitialRTT, rttStats.PTO(false))
+	// make sure that max_ack_delay was not reset
+	require.Equal(t, 42*time.Millisecond, rttStats.MaxAckDelay())
+
+	rttStats.UpdateRTT(10*time.Millisecond, 0)
+	require.True(t, rttStats.HasMeasurement())
+	require.Equal(t, 10*time.Millisecond, rttStats.SmoothedRTT())
+	require.Equal(t, 10*time.Millisecond, rttStats.LatestRTT())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frame.go
new file mode 100644
index 000000000..191e15307
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frame.go
@@ -0,0 +1,298 @@
+package wire
+
+import (
+	"errors"
+	"math"
+	"sort"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+var errInvalidAckRanges = errors.New("AckFrame: ACK frame contains invalid ACK ranges")
+
+// An AckFrame is an ACK frame
+type AckFrame struct {
+	AckRanges []AckRange // has to be ordered. The highest ACK range goes first, the lowest ACK range goes last
+	DelayTime time.Duration
+
+	ECT0, ECT1, ECNCE uint64
+}
+
+// parseAckFrame reads an ACK frame
+func parseAckFrame(frame *AckFrame, b []byte, typ FrameType, ackDelayExponent uint8, _ protocol.Version) (int, error) {
+	startLen := len(b)
+	ecn := typ == FrameTypeAckECN
+
+	la, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	largestAcked := protocol.PacketNumber(la)
+	delay, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+
+	delayTime := time.Duration(delay*1<<ackDelayExponent) * time.Microsecond
+	if delayTime < 0 {
+		// If the delay time overflows, set it to the maximum encode-able value.
+		delayTime = time.Duration(math.MaxInt64)
+	}
+	frame.DelayTime = delayTime
+
+	numBlocks, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+
+	// read the first ACK range
+	ab, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	ackBlock := protocol.PacketNumber(ab)
+	if ackBlock > largestAcked {
+		return 0, errors.New("invalid first ACK range")
+	}
+	smallest := largestAcked - ackBlock
+	frame.AckRanges = append(frame.AckRanges, AckRange{Smallest: smallest, Largest: largestAcked})
+
+	// read all the other ACK ranges
+	for range numBlocks {
+		g, l, err := quicvarint.Parse(b)
+		if err != nil {
+			return 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+		gap := protocol.PacketNumber(g)
+		if smallest < gap+2 {
+			return 0, errInvalidAckRanges
+		}
+		largest := smallest - gap - 2
+
+		ab, l, err := quicvarint.Parse(b)
+		if err != nil {
+			return 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+		ackBlock := protocol.PacketNumber(ab)
+
+		if ackBlock > largest {
+			return 0, errInvalidAckRanges
+		}
+		smallest = largest - ackBlock
+		frame.AckRanges = append(frame.AckRanges, AckRange{Smallest: smallest, Largest: largest})
+	}
+
+	if !frame.validateAckRanges() {
+		return 0, errInvalidAckRanges
+	}
+
+	if ecn {
+		ect0, l, err := quicvarint.Parse(b)
+		if err != nil {
+			return 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+		frame.ECT0 = ect0
+		ect1, l, err := quicvarint.Parse(b)
+		if err != nil {
+			return 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+		frame.ECT1 = ect1
+		ecnce, l, err := quicvarint.Parse(b)
+		if err != nil {
+			return 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+		frame.ECNCE = ecnce
+	}
+
+	return startLen - len(b), nil
+}
+
+// Append appends an ACK frame.
+func (f *AckFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	hasECN := f.ECT0 > 0 || f.ECT1 > 0 || f.ECNCE > 0
+	if hasECN {
+		b = append(b, byte(FrameTypeAckECN))
+	} else {
+		b = append(b, byte(FrameTypeAck))
+	}
+	b = quicvarint.Append(b, uint64(f.LargestAcked()))
+	b = quicvarint.Append(b, encodeAckDelay(f.DelayTime))
+
+	numRanges := min(len(f.AckRanges), protocol.MaxNumAckRanges)
+	b = quicvarint.Append(b, uint64(numRanges-1))
+
+	// write the first range
+	_, firstRange := f.encodeAckRange(0)
+	b = quicvarint.Append(b, firstRange)
+
+	// write all the other range
+	for i := 1; i < numRanges; i++ {
+		gap, len := f.encodeAckRange(i)
+		b = quicvarint.Append(b, gap)
+		b = quicvarint.Append(b, len)
+	}
+
+	if hasECN {
+		b = quicvarint.Append(b, f.ECT0)
+		b = quicvarint.Append(b, f.ECT1)
+		b = quicvarint.Append(b, f.ECNCE)
+	}
+	return b, nil
+}
+
+// Length of a written frame
+func (f *AckFrame) Length(_ protocol.Version) protocol.ByteCount {
+	largestAcked := f.AckRanges[0].Largest
+
+	// The number of ACK ranges is limited to 64, which guarantees that the
+	// ACK Range Count value can be encoded in a single byte varint.
+	length := 1 + quicvarint.Len(uint64(largestAcked)) + quicvarint.Len(encodeAckDelay(f.DelayTime)) + 1
+
+	lowestInFirstRange := f.AckRanges[0].Smallest
+	length += quicvarint.Len(uint64(largestAcked - lowestInFirstRange))
+
+	for i := 1; i < min(len(f.AckRanges), protocol.MaxNumAckRanges); i++ {
+		gap, len := f.encodeAckRange(i)
+		length += quicvarint.Len(gap)
+		length += quicvarint.Len(len)
+	}
+	if f.ECT0 > 0 || f.ECT1 > 0 || f.ECNCE > 0 {
+		length += quicvarint.Len(f.ECT0) + quicvarint.Len(f.ECT1) + quicvarint.Len(f.ECNCE)
+	}
+	return protocol.ByteCount(length)
+}
+
+// Truncate truncates the ACK frame to fit into maxSize,
+// and to at most 64 ACK ranges.
+// maxSize must be large enough to fit at least one ACK range.
+func (f *AckFrame) Truncate(maxSize protocol.ByteCount, _ protocol.Version) {
+	f.AckRanges = f.AckRanges[:f.numEncodableAckRanges(maxSize)]
+}
+
+// gets the number of ACK ranges that can be encoded
+// such that the resulting frame is smaller than maxSize
+func (f *AckFrame) numEncodableAckRanges(maxSize protocol.ByteCount) int {
+	// Fast path: Most ACK frames are relatively small, and we don't need to calculate the exact length.
+	// We just assume the worst case scenario: every varint is encoded to 8 bytes.
+	// If the result is still smaller than the maximum ACK frame size, the actual ACK frame will definitely fit.
+	length := 1 + 8 /* largest acked */ + 8 /* delay */ + 1 /* ack range count */ + 8 /* first range */
+	if f.ECT0 > 0 || f.ECT1 > 0 || f.ECNCE > 0 {
+		length += 8 + 8 + 8
+	}
+	numRanges := min(len(f.AckRanges), protocol.MaxNumAckRanges)
+	length += 2 * 8 * (numRanges - 1)
+	if protocol.ByteCount(length) <= maxSize {
+		return numRanges
+	}
+
+	// Slow path: Calculate the exact length of the ACK frame.
+	length = 1 + quicvarint.Len(uint64(f.LargestAcked())) + quicvarint.Len(encodeAckDelay(f.DelayTime)) + 1
+	_, firstRange := f.encodeAckRange(0)
+	length += quicvarint.Len(firstRange)
+	if f.ECT0 > 0 || f.ECT1 > 0 || f.ECNCE > 0 {
+		length += quicvarint.Len(f.ECT0) + quicvarint.Len(f.ECT1) + quicvarint.Len(f.ECNCE)
+	}
+	for i := 1; i < numRanges; i++ {
+		gap, l := f.encodeAckRange(i)
+		rangeLen := quicvarint.Len(gap) + quicvarint.Len(l)
+		if protocol.ByteCount(length+rangeLen) > maxSize {
+			// Writing range i would exceed the maximum size,
+			// so encode one range less than that.
+			return i
+		}
+		length += rangeLen
+	}
+	return numRanges
+}
+
+func (f *AckFrame) encodeAckRange(i int) (gap, length uint64) {
+	if i == 0 {
+		return 0, uint64(f.AckRanges[0].Largest - f.AckRanges[0].Smallest)
+	}
+	return uint64(f.AckRanges[i-1].Smallest - f.AckRanges[i].Largest - 2),
+		uint64(f.AckRanges[i].Largest - f.AckRanges[i].Smallest)
+}
+
+// HasMissingRanges returns if this frame reports any missing packets
+func (f *AckFrame) HasMissingRanges() bool {
+	return len(f.AckRanges) > 1
+}
+
+func (f *AckFrame) validateAckRanges() bool {
+	if len(f.AckRanges) == 0 {
+		return false
+	}
+
+	// check the validity of every single ACK range
+	for _, ackRange := range f.AckRanges {
+		if ackRange.Smallest > ackRange.Largest {
+			return false
+		}
+	}
+
+	// check the consistency for ACK with multiple ACK ranges
+	for i, ackRange := range f.AckRanges {
+		if i == 0 {
+			continue
+		}
+		lastAckRange := f.AckRanges[i-1]
+		if lastAckRange.Smallest <= ackRange.Smallest {
+			return false
+		}
+		if lastAckRange.Smallest <= ackRange.Largest+1 {
+			return false
+		}
+	}
+
+	return true
+}
+
+// LargestAcked is the largest acked packet number
+func (f *AckFrame) LargestAcked() protocol.PacketNumber {
+	return f.AckRanges[0].Largest
+}
+
+// LowestAcked is the lowest acked packet number
+func (f *AckFrame) LowestAcked() protocol.PacketNumber {
+	return f.AckRanges[len(f.AckRanges)-1].Smallest
+}
+
+// AcksPacket determines if this ACK frame acks a certain packet number
+func (f *AckFrame) AcksPacket(p protocol.PacketNumber) bool {
+	if p < f.LowestAcked() || p > f.LargestAcked() {
+		return false
+	}
+
+	i := sort.Search(len(f.AckRanges), func(i int) bool {
+		return p >= f.AckRanges[i].Smallest
+	})
+	// i will always be < len(f.AckRanges), since we checked above that p is not bigger than the largest acked
+	return p <= f.AckRanges[i].Largest
+}
+
+func (f *AckFrame) Reset() {
+	f.DelayTime = 0
+	f.ECT0 = 0
+	f.ECT1 = 0
+	f.ECNCE = 0
+	for _, r := range f.AckRanges {
+		r.Largest = 0
+		r.Smallest = 0
+	}
+	f.AckRanges = f.AckRanges[:0]
+}
+
+func encodeAckDelay(delay time.Duration) uint64 {
+	return uint64(delay.Nanoseconds() / (1000 * (1 << protocol.AckDelayExponent)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frame_test.go
new file mode 100644
index 000000000..fbf83db18
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frame_test.go
@@ -0,0 +1,612 @@
+package wire
+
+import (
+	"io"
+	"math"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseACKWithoutRanges(t *testing.T) {
+	data := encodeVarInt(100)                // largest acked
+	data = append(data, encodeVarInt(0)...)  // delay
+	data = append(data, encodeVarInt(0)...)  // num blocks
+	data = append(data, encodeVarInt(10)...) // first ack block
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, data, FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), n)
+	require.Equal(t, protocol.PacketNumber(100), frame.LargestAcked())
+	require.Equal(t, protocol.PacketNumber(90), frame.LowestAcked())
+	require.False(t, frame.HasMissingRanges())
+}
+
+func TestParseACKSinglePacket(t *testing.T) {
+	data := encodeVarInt(55)                // largest acked
+	data = append(data, encodeVarInt(0)...) // delay
+	data = append(data, encodeVarInt(0)...) // num blocks
+	data = append(data, encodeVarInt(0)...) // first ack block
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, data, FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), n)
+	require.Equal(t, protocol.PacketNumber(55), frame.LargestAcked())
+	require.Equal(t, protocol.PacketNumber(55), frame.LowestAcked())
+	require.False(t, frame.HasMissingRanges())
+}
+
+func TestParseACKAllPacketsFrom0ToLargest(t *testing.T) {
+	data := encodeVarInt(20)                 // largest acked
+	data = append(data, encodeVarInt(0)...)  // delay
+	data = append(data, encodeVarInt(0)...)  // num blocks
+	data = append(data, encodeVarInt(20)...) // first ack block
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, data, FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), n)
+	require.Equal(t, protocol.PacketNumber(20), frame.LargestAcked())
+	require.Equal(t, protocol.PacketNumber(0), frame.LowestAcked())
+	require.False(t, frame.HasMissingRanges())
+}
+
+func TestParseACKRejectFirstBlockLargerThanLargestAcked(t *testing.T) {
+	data := encodeVarInt(20)                 // largest acked
+	data = append(data, encodeVarInt(0)...)  // delay
+	data = append(data, encodeVarInt(0)...)  // num blocks
+	data = append(data, encodeVarInt(21)...) // first ack block
+	var frame AckFrame
+	_, err := parseAckFrame(&frame, data, FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+	require.EqualError(t, err, "invalid first ACK range")
+}
+
+func TestParseACKWithSingleBlock(t *testing.T) {
+	data := encodeVarInt(1000)                // largest acked
+	data = append(data, encodeVarInt(0)...)   // delay
+	data = append(data, encodeVarInt(1)...)   // num blocks
+	data = append(data, encodeVarInt(100)...) // first ack block
+	data = append(data, encodeVarInt(98)...)  // gap
+	data = append(data, encodeVarInt(50)...)  // ack block
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, data, FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), n)
+	require.Equal(t, protocol.PacketNumber(1000), frame.LargestAcked())
+	require.Equal(t, protocol.PacketNumber(750), frame.LowestAcked())
+	require.True(t, frame.HasMissingRanges())
+	require.Equal(t, []AckRange{
+		{Largest: 1000, Smallest: 900},
+		{Largest: 800, Smallest: 750},
+	}, frame.AckRanges)
+}
+
+func TestParseACKWithMultipleBlocks(t *testing.T) {
+	data := encodeVarInt(100)               // largest acked
+	data = append(data, encodeVarInt(0)...) // delay
+	data = append(data, encodeVarInt(2)...) // num blocks
+	data = append(data, encodeVarInt(0)...) // first ack block
+	data = append(data, encodeVarInt(0)...) // gap
+	data = append(data, encodeVarInt(0)...) // ack block
+	data = append(data, encodeVarInt(1)...) // gap
+	data = append(data, encodeVarInt(1)...) // ack block
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, data, FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), n)
+	require.Equal(t, protocol.PacketNumber(100), frame.LargestAcked())
+	require.Equal(t, protocol.PacketNumber(94), frame.LowestAcked())
+	require.True(t, frame.HasMissingRanges())
+	require.Equal(t, []AckRange{
+		{Largest: 100, Smallest: 100},
+		{Largest: 98, Smallest: 98},
+		{Largest: 95, Smallest: 94},
+	}, frame.AckRanges)
+}
+
+func TestParseACKUseAckDelayExponent(t *testing.T) {
+	const delayTime = 1 << 10 * time.Millisecond
+	f := &AckFrame{
+		AckRanges: []AckRange{{Smallest: 1, Largest: 1}},
+		DelayTime: delayTime,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	for i := range uint8(8) {
+		typ, l, err := quicvarint.Parse(b)
+		require.NoError(t, err)
+		var frame AckFrame
+		n, err := parseAckFrame(&frame, b[l:], FrameType(typ), protocol.AckDelayExponent+i, protocol.Version1)
+		require.NoError(t, err)
+		require.Equal(t, len(b[l:]), n)
+		require.Equal(t, delayTime*(1<<i), frame.DelayTime)
+	}
+}
+
+func TestParseACKHandleDelayTimeOverflow(t *testing.T) {
+	data := encodeVarInt(100)                              // largest acked
+	data = append(data, encodeVarInt(math.MaxUint64/5)...) // delay
+	data = append(data, encodeVarInt(0)...)                // num blocks
+	data = append(data, encodeVarInt(0)...)                // first ack block
+	var frame AckFrame
+	_, err := parseAckFrame(&frame, data, FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Greater(t, frame.DelayTime, time.Duration(0))
+	// The maximum encodable duration is ~292 years.
+	require.InDelta(t, 292*365*24, frame.DelayTime.Hours(), 365*24)
+}
+
+func TestParseACKErrorOnEOF(t *testing.T) {
+	data := encodeVarInt(1000)                // largest acked
+	data = append(data, encodeVarInt(0)...)   // delay
+	data = append(data, encodeVarInt(1)...)   // num blocks
+	data = append(data, encodeVarInt(100)...) // first ack block
+	data = append(data, encodeVarInt(98)...)  // gap
+	data = append(data, encodeVarInt(50)...)  // ack block
+	var frame AckFrame
+	_, err := parseAckFrame(&frame, data, FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	for i := range data {
+		var frame AckFrame
+		_, err := parseAckFrame(&frame, data[:i], FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestParseACKECN(t *testing.T) {
+	data := encodeVarInt(100)                        // largest acked
+	data = append(data, encodeVarInt(0)...)          // delay
+	data = append(data, encodeVarInt(0)...)          // num blocks
+	data = append(data, encodeVarInt(10)...)         // first ack block
+	data = append(data, encodeVarInt(0x42)...)       // ECT(0)
+	data = append(data, encodeVarInt(0x12345)...)    // ECT(1)
+	data = append(data, encodeVarInt(0x12345678)...) // ECN-CE
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, data, FrameTypeAckECN, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), n)
+	require.Equal(t, protocol.PacketNumber(100), frame.LargestAcked())
+	require.Equal(t, protocol.PacketNumber(90), frame.LowestAcked())
+	require.False(t, frame.HasMissingRanges())
+	require.Equal(t, uint64(0x42), frame.ECT0)
+	require.Equal(t, uint64(0x12345), frame.ECT1)
+	require.Equal(t, uint64(0x12345678), frame.ECNCE)
+}
+
+func TestParseACKECNErrorOnEOF(t *testing.T) {
+	data := encodeVarInt(1000)                       // largest acked
+	data = append(data, encodeVarInt(0)...)          // delay
+	data = append(data, encodeVarInt(1)...)          // num blocks
+	data = append(data, encodeVarInt(100)...)        // first ack block
+	data = append(data, encodeVarInt(98)...)         // gap
+	data = append(data, encodeVarInt(50)...)         // ack block
+	data = append(data, encodeVarInt(0x42)...)       // ECT(0)
+	data = append(data, encodeVarInt(0x12345)...)    // ECT(1)
+	data = append(data, encodeVarInt(0x12345678)...) // ECN-CE
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, data, FrameTypeAckECN, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), n)
+	for i := range data {
+		var frame AckFrame
+		_, err := parseAckFrame(&frame, data[:i], FrameTypeAckECN, protocol.AckDelayExponent, protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteACKSimpleFrame(t *testing.T) {
+	f := &AckFrame{
+		AckRanges: []AckRange{{Smallest: 100, Largest: 1337}},
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeAck)}
+	expected = append(expected, encodeVarInt(1337)...) // largest acked
+	expected = append(expected, 0)                     // delay
+	expected = append(expected, encodeVarInt(0)...)    // num ranges
+	expected = append(expected, encodeVarInt(1337-100)...)
+	require.Equal(t, expected, b)
+}
+
+func TestWriteACKECNFrame(t *testing.T) {
+	f := &AckFrame{
+		AckRanges: []AckRange{{Smallest: 10, Largest: 2000}},
+		ECT0:      13,
+		ECT1:      37,
+		ECNCE:     12345,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+	expected := []byte{byte(FrameTypeAckECN)}
+	expected = append(expected, encodeVarInt(2000)...) // largest acked
+	expected = append(expected, 0)                     // delay
+	expected = append(expected, encodeVarInt(0)...)    // num ranges
+	expected = append(expected, encodeVarInt(2000-10)...)
+	expected = append(expected, encodeVarInt(13)...)
+	expected = append(expected, encodeVarInt(37)...)
+	expected = append(expected, encodeVarInt(12345)...)
+	require.Equal(t, expected, b)
+}
+
+func TestWriteACKSinglePacket(t *testing.T) {
+	f := &AckFrame{
+		AckRanges: []AckRange{{Smallest: 0x2eadbeef, Largest: 0x2eadbeef}},
+		DelayTime: 18 * time.Millisecond,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+	typ, l, err := quicvarint.Parse(b)
+	require.NoError(t, err)
+	b = b[l:]
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, b, FrameType(typ), protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(b), n)
+	require.Equal(t, f, &frame)
+	require.False(t, frame.HasMissingRanges())
+	require.Equal(t, f.DelayTime, frame.DelayTime)
+}
+
+func TestWriteACKManyPackets(t *testing.T) {
+	f := &AckFrame{
+		AckRanges: []AckRange{{Smallest: 0x1337, Largest: 0x2eadbeef}},
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+	typ, l, err := quicvarint.Parse(b)
+	require.NoError(t, err)
+	b = b[l:]
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, b, FrameType(typ), protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(b), n)
+	require.Equal(t, f, &frame)
+	require.False(t, frame.HasMissingRanges())
+}
+
+func TestWriteACKSingleGap(t *testing.T) {
+	f := &AckFrame{
+		AckRanges: []AckRange{
+			{Smallest: 400, Largest: 1000},
+			{Smallest: 100, Largest: 200},
+		},
+	}
+	require.True(t, f.validateAckRanges())
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+	typ, l, err := quicvarint.Parse(b)
+	require.NoError(t, err)
+	b = b[l:]
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, b, FrameType(typ), protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(b), n)
+	require.Equal(t, f, &frame)
+	require.True(t, frame.HasMissingRanges())
+}
+
+func TestWriteACKMultipleRanges(t *testing.T) {
+	f := &AckFrame{
+		AckRanges: []AckRange{
+			{Smallest: 10, Largest: 10},
+			{Smallest: 8, Largest: 8},
+			{Smallest: 5, Largest: 6},
+			{Smallest: 1, Largest: 3},
+		},
+	}
+	require.True(t, f.validateAckRanges())
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+	typ, l, err := quicvarint.Parse(b)
+	require.NoError(t, err)
+	b = b[l:]
+	var frame AckFrame
+	n, err := parseAckFrame(&frame, b, FrameType(typ), protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(b), n)
+	require.Equal(t, f, &frame)
+	require.True(t, frame.HasMissingRanges())
+}
+
+func TestACKTruncate(t *testing.T) {
+	t.Run("single range", func(t *testing.T) {
+		testACKTruncate(t, AckFrame{
+			DelayTime: 18 * time.Millisecond,
+			AckRanges: []AckRange{
+				{Smallest: 42, Largest: 1337},
+			},
+		})
+	})
+
+	t.Run("multiple ranges", func(t *testing.T) {
+		testACKTruncate(t, AckFrame{
+			DelayTime: 18 * time.Millisecond,
+			AckRanges: []AckRange{
+				{Smallest: 300, Largest: 12345678},
+				{Smallest: 200, Largest: 250},
+				{Smallest: 1, Largest: 100},
+			},
+		})
+	})
+
+	t.Run("multiple ranges, with ECN", func(t *testing.T) {
+		testACKTruncate(t, AckFrame{
+			DelayTime: 18 * time.Millisecond,
+			ECT0:      1234,
+			ECT1:      5678,
+			ECNCE:     9012,
+			AckRanges: []AckRange{
+				{Smallest: 50, Largest: 60},
+				{Smallest: 40, Largest: 48},
+				{Smallest: 30, Largest: 35},
+				{Smallest: 20, Largest: 28},
+				{Smallest: 10, Largest: 15},
+			},
+		})
+	})
+
+	t.Run("more than MaxNumAckRanges ranges", func(t *testing.T) {
+		const numRanges = 1000
+		ackRanges := make([]AckRange, numRanges)
+		for i := protocol.PacketNumber(1); i <= numRanges; i++ {
+			ackRanges[numRanges-i] = AckRange{Smallest: 2 * i, Largest: 2 * i}
+		}
+		f := &AckFrame{AckRanges: ackRanges}
+		require.True(t, f.validateAckRanges())
+		testACKTruncate(t, *f)
+	})
+}
+
+func testACKTruncate(t *testing.T, origACK AckFrame) {
+	require.True(t, origACK.validateAckRanges())
+
+	numRanges := len(origACK.AckRanges)
+	cloneACK := func() AckFrame {
+		ack := origACK
+		ack.AckRanges = slices.Clone(origACK.AckRanges)
+		return ack
+	}
+
+	expectedRanges := min(numRanges, protocol.MaxNumAckRanges)
+
+	ack := cloneACK()
+	l := ack.Length(protocol.Version1)
+	ack.Truncate(1000, protocol.Version1)
+	require.Equal(t, expectedRanges, len(ack.AckRanges))
+	ack.Truncate(l, protocol.Version1)
+	require.Equal(t, expectedRanges, len(ack.AckRanges))
+
+	maxLen := l
+	for {
+		ack = cloneACK()
+
+		ack.Truncate(maxLen, protocol.Version1)
+		require.Len(t, ack.AckRanges, expectedRanges)
+		b, err := ack.Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		require.Len(t, b, int(ack.Length(protocol.Version1)))
+		require.LessOrEqual(t, len(b), int(maxLen))
+		if len(b) == int(maxLen) {
+			expectedRanges--
+		}
+		maxLen--
+		if expectedRanges == 0 {
+			break
+		}
+	}
+}
+
+func TestACKTooManyRanges(t *testing.T) {
+	var ack AckFrame
+	numRanges := protocol.MaxNumAckRanges + 10
+	ack.AckRanges = make([]AckRange, numRanges)
+	for i := range numRanges {
+		ack.AckRanges[numRanges-i-1] = AckRange{Smallest: protocol.PacketNumber(2 * i), Largest: protocol.PacketNumber(2 * i)}
+	}
+	require.True(t, ack.validateAckRanges())
+
+	l := ack.Length(protocol.Version1)
+
+	buf, err := ack.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, buf, int(l))
+
+	var parsedAck AckFrame
+	n, err := parseAckFrame(&parsedAck, buf[1:], FrameTypeAck, protocol.AckDelayExponent, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(buf[1:]), n)
+	require.Len(t, parsedAck.AckRanges, protocol.MaxNumAckRanges)
+
+	ack.Truncate(1000, protocol.Version1)
+	require.Len(t, ack.AckRanges, protocol.MaxNumAckRanges)
+	require.Equal(t, ack, parsedAck)
+}
+
+func TestAckRangeValidator(t *testing.T) {
+	tests := []struct {
+		name      string
+		ackRanges []AckRange
+		valid     bool
+	}{
+		{
+			name:      "rejects ACKs without ranges",
+			ackRanges: nil,
+			valid:     false,
+		},
+		{
+			name:      "accepts an ACK without NACK Ranges",
+			ackRanges: []AckRange{{Smallest: 1, Largest: 7}},
+			valid:     true,
+		},
+		{
+			name: "rejects ACK ranges with Smallest greater than Largest",
+			ackRanges: []AckRange{
+				{Smallest: 8, Largest: 10},
+				{Smallest: 4, Largest: 3},
+			},
+			valid: false,
+		},
+		{
+			name: "rejects ACK ranges in the wrong order",
+			ackRanges: []AckRange{
+				{Smallest: 2, Largest: 2},
+				{Smallest: 6, Largest: 7},
+			},
+			valid: false,
+		},
+		{
+			name: "rejects with overlapping ACK ranges",
+			ackRanges: []AckRange{
+				{Smallest: 5, Largest: 7},
+				{Smallest: 2, Largest: 5},
+			},
+			valid: false,
+		},
+		{
+			name: "rejects ACK ranges that are part of a larger ACK range",
+			ackRanges: []AckRange{
+				{Smallest: 4, Largest: 7},
+				{Smallest: 5, Largest: 6},
+			},
+			valid: false,
+		},
+		{
+			name: "rejects with directly adjacent ACK ranges",
+			ackRanges: []AckRange{
+				{Smallest: 5, Largest: 7},
+				{Smallest: 2, Largest: 4},
+			},
+			valid: false,
+		},
+		{
+			name: "accepts an ACK with one lost packet",
+			ackRanges: []AckRange{
+				{Smallest: 5, Largest: 10},
+				{Smallest: 1, Largest: 3},
+			},
+			valid: true,
+		},
+		{
+			name: "accepts an ACK with multiple lost packets",
+			ackRanges: []AckRange{
+				{Smallest: 15, Largest: 20},
+				{Smallest: 10, Largest: 12},
+				{Smallest: 1, Largest: 3},
+			},
+			valid: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ack := AckFrame{AckRanges: tt.ackRanges}
+			result := ack.validateAckRanges()
+			require.Equal(t, tt.valid, result)
+		})
+	}
+}
+
+func TestAckFrameAcksPacketWithoutRanges(t *testing.T) {
+	f := AckFrame{
+		AckRanges: []AckRange{{Smallest: 5, Largest: 10}},
+	}
+	require.False(t, f.AcksPacket(1))
+	require.False(t, f.AcksPacket(4))
+	require.True(t, f.AcksPacket(5))
+	require.True(t, f.AcksPacket(8))
+	require.True(t, f.AcksPacket(10))
+	require.False(t, f.AcksPacket(11))
+	require.False(t, f.AcksPacket(20))
+}
+
+func TestAckFrameAcksPacketWithMultipleRanges(t *testing.T) {
+	f := AckFrame{
+		AckRanges: []AckRange{
+			{Smallest: 15, Largest: 20},
+			{Smallest: 5, Largest: 8},
+		},
+	}
+	require.False(t, f.AcksPacket(4))
+	require.True(t, f.AcksPacket(5))
+	require.True(t, f.AcksPacket(6))
+	require.True(t, f.AcksPacket(7))
+	require.True(t, f.AcksPacket(8))
+	require.False(t, f.AcksPacket(9))
+	require.False(t, f.AcksPacket(14))
+	require.True(t, f.AcksPacket(15))
+	require.True(t, f.AcksPacket(18))
+	require.True(t, f.AcksPacket(19))
+	require.True(t, f.AcksPacket(20))
+	require.False(t, f.AcksPacket(21))
+}
+
+func TestAckFrameReset(t *testing.T) {
+	f := &AckFrame{
+		DelayTime: time.Second,
+		AckRanges: []AckRange{{Smallest: 1, Largest: 3}},
+		ECT0:      1,
+		ECT1:      2,
+		ECNCE:     3,
+	}
+	f.Reset()
+	require.Empty(t, f.AckRanges)
+	require.Equal(t, 1, cap(f.AckRanges))
+	require.Zero(t, f.DelayTime)
+	require.Zero(t, f.ECT0)
+	require.Zero(t, f.ECT1)
+	require.Zero(t, f.ECNCE)
+}
+
+func BenchmarkACKSerialization(b *testing.B) {
+	b.Run("single range", func(b *testing.B) {
+		benchmarkACKSerialization(b, &AckFrame{
+			DelayTime: 18 * time.Millisecond,
+			ECT0:      1234,
+			ECNCE:     3,
+			AckRanges: []AckRange{{Smallest: 42, Largest: 1337}},
+		})
+	})
+
+	b.Run("multiple ranges", func(b *testing.B) {
+		benchmarkACKSerialization(b, &AckFrame{
+			DelayTime: 13 * time.Millisecond,
+			ECT0:      1234,
+			ECNCE:     4,
+			AckRanges: []AckRange{
+				{Smallest: 1000, Largest: 2000},
+				{Smallest: 800, Largest: 950},
+				{Smallest: 600, Largest: 700},
+				{Smallest: 300, Largest: 550},
+				{Smallest: 42, Largest: 150},
+			},
+		})
+	})
+}
+
+func benchmarkACKSerialization(b *testing.B, f *AckFrame) {
+	b.ReportAllocs()
+
+	numRanges := len(f.AckRanges)
+
+	buf := make([]byte, 0, 1024)
+	for b.Loop() {
+		buf = buf[:0]
+		var err error
+		f.Truncate(1000, protocol.Version1)
+		buf, err = f.Append(buf, protocol.Version1)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+
+	// the frame should not have been truncated
+	require.Equal(b, numRanges, len(f.AckRanges))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frequency_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frequency_frame.go
new file mode 100644
index 000000000..0735d70ba
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frequency_frame.go
@@ -0,0 +1,65 @@
+package wire
+
+import (
+	"math"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+type AckFrequencyFrame struct {
+	SequenceNumber        uint64
+	AckElicitingThreshold uint64
+	RequestMaxAckDelay    time.Duration
+	ReorderingThreshold   protocol.PacketNumber
+}
+
+func parseAckFrequencyFrame(b []byte, _ protocol.Version) (*AckFrequencyFrame, int, error) {
+	startLen := len(b)
+	seq, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	aeth, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	mad, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	// prevents overflows if the peer sends a very large value
+	maxAckDelay := time.Duration(mad) * time.Microsecond
+	if maxAckDelay < 0 {
+		maxAckDelay = math.MaxInt64
+	}
+	b = b[l:]
+	rth, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+
+	return &AckFrequencyFrame{
+		SequenceNumber:        seq,
+		AckElicitingThreshold: aeth,
+		RequestMaxAckDelay:    maxAckDelay,
+		ReorderingThreshold:   protocol.PacketNumber(rth),
+	}, startLen - len(b), nil
+}
+
+func (f *AckFrequencyFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = quicvarint.Append(b, uint64(FrameTypeAckFrequency))
+	b = quicvarint.Append(b, f.SequenceNumber)
+	b = quicvarint.Append(b, f.AckElicitingThreshold)
+	b = quicvarint.Append(b, uint64(f.RequestMaxAckDelay/time.Microsecond))
+	return quicvarint.Append(b, uint64(f.ReorderingThreshold)), nil
+}
+
+func (f *AckFrequencyFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return protocol.ByteCount(2 + quicvarint.Len(f.SequenceNumber) + quicvarint.Len(f.AckElicitingThreshold) +
+		quicvarint.Len(uint64(f.RequestMaxAckDelay/time.Microsecond)) + quicvarint.Len(uint64(f.ReorderingThreshold)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frequency_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frequency_frame_test.go
new file mode 100644
index 000000000..053f235e0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_frequency_frame_test.go
@@ -0,0 +1,71 @@
+package wire
+
+import (
+	"io"
+	"math"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseAckFrequency(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)             // sequence number
+	data = append(data, encodeVarInt(0xcafe)...) // threshold
+	data = append(data, encodeVarInt(1337)...)   // update max ack delay
+	data = append(data, encodeVarInt(12345)...)  // reordering threshold
+	frame, l, err := parseAckFrequencyFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, uint64(0xdeadbeef), frame.SequenceNumber)
+	require.Equal(t, uint64(0xcafe), frame.AckElicitingThreshold)
+	require.Equal(t, 1337*time.Microsecond, frame.RequestMaxAckDelay)
+	require.Equal(t, protocol.PacketNumber(12345), frame.ReorderingThreshold)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseAckFrequencyMaxAckDelayOverflow(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)                     // sequence number
+	data = append(data, encodeVarInt(0xcafe)...)         // threshold
+	data = append(data, encodeVarInt(quicvarint.Max)...) // update max ack delay
+	data = append(data, encodeVarInt(12345)...)          // reordering threshold
+	frame, l, err := parseAckFrequencyFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Greater(t, frame.RequestMaxAckDelay, time.Duration(0))
+	require.Equal(t, frame.RequestMaxAckDelay, time.Duration(math.MaxInt64))
+	require.Equal(t, len(data), l)
+}
+
+func TestParseAckFrequencyErrorsOnEOFs(t *testing.T) {
+	data := append([]byte{}, encodeVarInt(0xdeadbeef)...) // sequence number
+	data = append(data, encodeVarInt(0xcafe)...)          // threshold
+	data = append(data, encodeVarInt(1337)...)            // update max ack delay
+	data = append(data, encodeVarInt(12345)...)           // reordering threshold
+	_, l, err := parseAckFrequencyFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseAckFrequencyFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteAckFrequencyFrame(t *testing.T) {
+	frame := &AckFrequencyFrame{
+		SequenceNumber:        0xdecafbad,
+		AckElicitingThreshold: 0xdeadbeef,
+		RequestMaxAckDelay:    12345 * time.Microsecond,
+		ReorderingThreshold:   1337,
+	}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := encodeVarInt(uint64(FrameTypeAckFrequency))
+	expected = append(expected, encodeVarInt(0xdecafbad)...)
+	expected = append(expected, encodeVarInt(0xdeadbeef)...)
+	expected = append(expected, encodeVarInt(12345)...)
+	expected = append(expected, encodeVarInt(1337)...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/ack_range.go b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_range.go
new file mode 100644
index 000000000..03a1235ee
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_range.go
@@ -0,0 +1,14 @@
+package wire
+
+import "github.com/quic-go/quic-go/internal/protocol"
+
+// AckRange is an ACK range
+type AckRange struct {
+	Smallest protocol.PacketNumber
+	Largest  protocol.PacketNumber
+}
+
+// Len returns the number of packets contained in this ACK range
+func (r AckRange) Len() protocol.PacketNumber {
+	return r.Largest - r.Smallest + 1
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/ack_range_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_range_test.go
new file mode 100644
index 000000000..a645d9883
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/ack_range_test.go
@@ -0,0 +1,12 @@
+package wire
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAckRangeLength(t *testing.T) {
+	require.EqualValues(t, 1, AckRange{Smallest: 10, Largest: 10}.Len())
+	require.EqualValues(t, 4, AckRange{Smallest: 10, Largest: 13}.Len())
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/connection_close_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/connection_close_frame.go
new file mode 100644
index 000000000..6c71aab6b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/connection_close_frame.go
@@ -0,0 +1,75 @@
+package wire
+
+import (
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A ConnectionCloseFrame is a CONNECTION_CLOSE frame
+type ConnectionCloseFrame struct {
+	IsApplicationError bool
+	ErrorCode          uint64
+	FrameType          uint64
+	ReasonPhrase       string
+}
+
+func parseConnectionCloseFrame(b []byte, typ FrameType, _ protocol.Version) (*ConnectionCloseFrame, int, error) {
+	startLen := len(b)
+	f := &ConnectionCloseFrame{IsApplicationError: typ == FrameTypeApplicationClose}
+	ec, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	f.ErrorCode = ec
+	// read the Frame Type, if this is not an application error
+	if !f.IsApplicationError {
+		ft, l, err := quicvarint.Parse(b)
+		if err != nil {
+			return nil, 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+		f.FrameType = ft
+	}
+	var reasonPhraseLen uint64
+	reasonPhraseLen, l, err = quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	if int(reasonPhraseLen) > len(b) {
+		return nil, 0, io.EOF
+	}
+
+	reasonPhrase := make([]byte, reasonPhraseLen)
+	copy(reasonPhrase, b)
+	f.ReasonPhrase = string(reasonPhrase)
+	return f, startLen - len(b) + int(reasonPhraseLen), nil
+}
+
+// Length of a written frame
+func (f *ConnectionCloseFrame) Length(protocol.Version) protocol.ByteCount {
+	length := 1 + protocol.ByteCount(quicvarint.Len(f.ErrorCode)+quicvarint.Len(uint64(len(f.ReasonPhrase)))) + protocol.ByteCount(len(f.ReasonPhrase))
+	if !f.IsApplicationError {
+		length += protocol.ByteCount(quicvarint.Len(f.FrameType)) // for the frame type
+	}
+	return length
+}
+
+func (f *ConnectionCloseFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	if f.IsApplicationError {
+		b = append(b, byte(FrameTypeApplicationClose))
+	} else {
+		b = append(b, byte(FrameTypeConnectionClose))
+	}
+
+	b = quicvarint.Append(b, f.ErrorCode)
+	if !f.IsApplicationError {
+		b = quicvarint.Append(b, f.FrameType)
+	}
+	b = quicvarint.Append(b, uint64(len(f.ReasonPhrase)))
+	b = append(b, []byte(f.ReasonPhrase)...)
+	return b, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/connection_close_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/connection_close_frame_test.go
new file mode 100644
index 000000000..ae54113bd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/connection_close_frame_test.go
@@ -0,0 +1,137 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseConnectionCloseTransportError(t *testing.T) {
+	reason := "No recent network activity."
+	data := encodeVarInt(0x19)
+	data = append(data, encodeVarInt(0x1337)...)              // frame type
+	data = append(data, encodeVarInt(uint64(len(reason)))...) // reason phrase length
+	data = append(data, []byte(reason)...)
+	frame, l, err := parseConnectionCloseFrame(data, FrameTypeConnectionClose, protocol.Version1)
+	require.NoError(t, err)
+	require.False(t, frame.IsApplicationError)
+	require.EqualValues(t, 0x19, frame.ErrorCode)
+	require.EqualValues(t, 0x1337, frame.FrameType)
+	require.Equal(t, reason, frame.ReasonPhrase)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseConnectionCloseWithApplicationError(t *testing.T) {
+	reason := "The application messed things up."
+	data := encodeVarInt(0xcafe)
+	data = append(data, encodeVarInt(uint64(len(reason)))...) // reason phrase length
+	data = append(data, reason...)
+	frame, l, err := parseConnectionCloseFrame(data, FrameTypeApplicationClose, protocol.Version1)
+	require.NoError(t, err)
+	require.True(t, frame.IsApplicationError)
+	require.EqualValues(t, 0xcafe, frame.ErrorCode)
+	require.Equal(t, reason, frame.ReasonPhrase)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseConnectionCloseLongReasonPhrase(t *testing.T) {
+	data := encodeVarInt(0xcafe)
+	data = append(data, encodeVarInt(0x42)...)   // frame type
+	data = append(data, encodeVarInt(0xffff)...) // reason phrase length
+	_, _, err := parseConnectionCloseFrame(data, FrameTypeConnectionClose, protocol.Version1)
+	require.Equal(t, io.EOF, err)
+}
+
+func TestParseConnectionCloseErrorsOnEOFs(t *testing.T) {
+	reason := "No recent network activity."
+	data := encodeVarInt(0x19)
+	data = append(data, encodeVarInt(0x1337)...)              // frame type
+	data = append(data, encodeVarInt(uint64(len(reason)))...) // reason phrase length
+	data = append(data, []byte(reason)...)
+	_, l, err := parseConnectionCloseFrame(data, FrameTypeConnectionClose, protocol.Version1)
+	require.Equal(t, len(data), l)
+	require.NoError(t, err)
+	for i := range data {
+		_, _, err = parseConnectionCloseFrame(data[:i], FrameTypeConnectionClose, protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestParseConnectionCloseNoReasonPhrase(t *testing.T) {
+	data := encodeVarInt(0xcafe)
+	data = append(data, encodeVarInt(0x42)...) // frame type
+	data = append(data, encodeVarInt(0)...)
+	frame, l, err := parseConnectionCloseFrame(data, FrameTypeConnectionClose, protocol.Version1)
+	require.NoError(t, err)
+	require.Empty(t, frame.ReasonPhrase)
+	require.Equal(t, len(data), l)
+}
+
+func TestWriteConnectionCloseNoReasonPhrase(t *testing.T) {
+	frame := &ConnectionCloseFrame{
+		ErrorCode: 0xbeef,
+		FrameType: 0x12345,
+	}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeConnectionClose)}
+	expected = append(expected, encodeVarInt(0xbeef)...)
+	expected = append(expected, encodeVarInt(0x12345)...) // frame type
+	expected = append(expected, encodeVarInt(0)...)       // reason phrase length
+	require.Equal(t, expected, b)
+}
+
+func TestWriteConnectionCloseWithReasonPhrase(t *testing.T) {
+	frame := &ConnectionCloseFrame{
+		ErrorCode:    0xdead,
+		ReasonPhrase: "foobar",
+	}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeConnectionClose)}
+	expected = append(expected, encodeVarInt(0xdead)...)
+	expected = append(expected, encodeVarInt(0)...) // frame type
+	expected = append(expected, encodeVarInt(6)...) // reason phrase length
+	expected = append(expected, []byte("foobar")...)
+	require.Equal(t, expected, b)
+}
+
+func TestWriteConnectionCloseWithApplicationError(t *testing.T) {
+	frame := &ConnectionCloseFrame{
+		IsApplicationError: true,
+		ErrorCode:          0xdead,
+		ReasonPhrase:       "foobar",
+	}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeApplicationClose)}
+	expected = append(expected, encodeVarInt(0xdead)...)
+	expected = append(expected, encodeVarInt(6)...) // reason phrase length
+	expected = append(expected, []byte("foobar")...)
+	require.Equal(t, expected, b)
+}
+
+func TestWriteConnectionCloseTransportError(t *testing.T) {
+	f := &ConnectionCloseFrame{
+		ErrorCode:    0xcafe,
+		FrameType:    0xdeadbeef,
+		ReasonPhrase: "foobar",
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+}
+
+func TestWriteConnectionCloseLength(t *testing.T) {
+	f := &ConnectionCloseFrame{
+		IsApplicationError: true,
+		ErrorCode:          0xcafe,
+		ReasonPhrase:       "foobar",
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/crypto_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/crypto_frame.go
new file mode 100644
index 000000000..60a713f74
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/crypto_frame.go
@@ -0,0 +1,97 @@
+package wire
+
+import (
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A CryptoFrame is a CRYPTO frame
+type CryptoFrame struct {
+	Offset protocol.ByteCount
+	Data   []byte
+}
+
+func parseCryptoFrame(b []byte, _ protocol.Version) (*CryptoFrame, int, error) {
+	startLen := len(b)
+	frame := &CryptoFrame{}
+	offset, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	frame.Offset = protocol.ByteCount(offset)
+	dataLen, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	if dataLen > uint64(len(b)) {
+		return nil, 0, io.EOF
+	}
+	if dataLen != 0 {
+		frame.Data = make([]byte, dataLen)
+		copy(frame.Data, b)
+	}
+	return frame, startLen - len(b) + int(dataLen), nil
+}
+
+func (f *CryptoFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypeCrypto))
+	b = quicvarint.Append(b, uint64(f.Offset))
+	b = quicvarint.Append(b, uint64(len(f.Data)))
+	b = append(b, f.Data...)
+	return b, nil
+}
+
+// Length of a written frame
+func (f *CryptoFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return protocol.ByteCount(1 + quicvarint.Len(uint64(f.Offset)) + quicvarint.Len(uint64(len(f.Data))) + len(f.Data))
+}
+
+// MaxDataLen returns the maximum data length
+func (f *CryptoFrame) MaxDataLen(maxSize protocol.ByteCount) protocol.ByteCount {
+	// pretend that the data size will be 1 bytes
+	// if it turns out that varint encoding the length will consume 2 bytes, we need to adjust the data length afterwards
+	headerLen := protocol.ByteCount(1 + quicvarint.Len(uint64(f.Offset)) + 1)
+	if headerLen > maxSize {
+		return 0
+	}
+	maxDataLen := maxSize - headerLen
+	if quicvarint.Len(uint64(maxDataLen)) != 1 {
+		maxDataLen--
+	}
+	return maxDataLen
+}
+
+// MaybeSplitOffFrame splits a frame such that it is not bigger than n bytes.
+// It returns if the frame was actually split.
+// The frame might not be split if:
+// * the size is large enough to fit the whole frame
+// * the size is too small to fit even a 1-byte frame. In that case, the frame returned is nil.
+func (f *CryptoFrame) MaybeSplitOffFrame(maxSize protocol.ByteCount, version protocol.Version) (*CryptoFrame, bool /* was splitting required */) {
+	if f.Length(version) <= maxSize {
+		return nil, false
+	}
+
+	n := f.MaxDataLen(maxSize)
+	if n == 0 {
+		return nil, true
+	}
+
+	newLen := protocol.ByteCount(len(f.Data)) - n
+
+	new := &CryptoFrame{}
+	new.Offset = f.Offset
+	new.Data = make([]byte, newLen)
+
+	// swap the data slices
+	new.Data, f.Data = f.Data, new.Data
+
+	copy(f.Data, new.Data[n:])
+	new.Data = new.Data[:n]
+	f.Offset += n
+
+	return new, true
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/crypto_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/crypto_frame_test.go
new file mode 100644
index 000000000..674b03acb
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/crypto_frame_test.go
@@ -0,0 +1,123 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseCryptoFrame(t *testing.T) {
+	data := encodeVarInt(0xdecafbad)        // offset
+	data = append(data, encodeVarInt(6)...) // length
+	data = append(data, []byte("foobar")...)
+	frame, l, err := parseCryptoFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.ByteCount(0xdecafbad), frame.Offset)
+	require.Equal(t, []byte("foobar"), frame.Data)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseCryptoFrameErrorsOnEOFs(t *testing.T) {
+	data := encodeVarInt(0xdecafbad)        // offset
+	data = append(data, encodeVarInt(6)...) // data length
+	data = append(data, []byte("foobar")...)
+	_, l, err := parseCryptoFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseCryptoFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteCryptoFrame(t *testing.T) {
+	f := &CryptoFrame{
+		Offset: 0x123456,
+		Data:   []byte("foobar"),
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeCrypto)}
+	expected = append(expected, encodeVarInt(0x123456)...) // offset
+	expected = append(expected, encodeVarInt(6)...)        // length
+	expected = append(expected, []byte("foobar")...)
+	require.Equal(t, expected, b)
+	require.Equal(t, int(f.Length(protocol.Version1)), len(b))
+}
+
+func TestCryptoFrameMaxDataLength(t *testing.T) {
+	const maxSize = 3000
+
+	data := make([]byte, maxSize)
+	f := &CryptoFrame{
+		Offset: 0xdeadbeef,
+	}
+	var frameOneByteTooSmallCounter int
+	for i := 1; i < maxSize; i++ {
+		f.Data = nil
+		maxDataLen := f.MaxDataLen(protocol.ByteCount(i))
+		if maxDataLen == 0 { // 0 means that no valid CRYPTO frame can be written
+			// check that writing a minimal size CRYPTO frame (i.e. with 1 byte data) is actually larger than the desired size
+			f.Data = []byte{0}
+			b, err := f.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			require.Greater(t, len(b), i)
+			continue
+		}
+		f.Data = data[:int(maxDataLen)]
+		b, err := f.Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		// There's *one* pathological case, where a data length of x can be encoded into 1 byte
+		// but a data lengths of x+1 needs 2 bytes
+		// In that case, it's impossible to create a STREAM frame of the desired size
+		if len(b) == i-1 {
+			frameOneByteTooSmallCounter++
+			continue
+		}
+		require.Equal(t, i, len(b))
+	}
+	require.Equal(t, 1, frameOneByteTooSmallCounter)
+}
+
+func TestCryptoFrameSplitting(t *testing.T) {
+	f := &CryptoFrame{
+		Offset: 0x1337,
+		Data:   []byte("foobar"),
+	}
+	hdrLen := f.Length(protocol.Version1) - 6
+	new, needsSplit := f.MaybeSplitOffFrame(hdrLen+3, protocol.Version1)
+	require.True(t, needsSplit)
+	require.Equal(t, []byte("foo"), new.Data)
+	require.Equal(t, protocol.ByteCount(0x1337), new.Offset)
+	require.Equal(t, []byte("bar"), f.Data)
+	require.Equal(t, protocol.ByteCount(0x1337+3), f.Offset)
+}
+
+func TestCryptoFrameNoSplitWhenEnoughSpace(t *testing.T) {
+	f := &CryptoFrame{
+		Offset: 0x1337,
+		Data:   []byte("foobar"),
+	}
+	splitFrame, needsSplit := f.MaybeSplitOffFrame(f.Length(protocol.Version1), protocol.Version1)
+	require.False(t, needsSplit)
+	require.Nil(t, splitFrame)
+}
+
+func TestCryptoFrameNoSplitWhenSizeTooSmall(t *testing.T) {
+	f := &CryptoFrame{
+		Offset: 0x1337,
+		Data:   []byte("foobar"),
+	}
+	length := f.Length(protocol.Version1) - 6
+	for i := protocol.ByteCount(0); i <= length; i++ {
+		splitFrame, needsSplit := f.MaybeSplitOffFrame(i, protocol.Version1)
+		require.True(t, needsSplit)
+		require.Nil(t, splitFrame)
+	}
+	splitFrame, needsSplit := f.MaybeSplitOffFrame(length+1, protocol.Version1)
+	require.True(t, needsSplit)
+	require.NotNil(t, splitFrame)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/data_blocked_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/data_blocked_frame.go
new file mode 100644
index 000000000..11c72ea32
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/data_blocked_frame.go
@@ -0,0 +1,29 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A DataBlockedFrame is a DATA_BLOCKED frame
+type DataBlockedFrame struct {
+	MaximumData protocol.ByteCount
+}
+
+func parseDataBlockedFrame(b []byte, _ protocol.Version) (*DataBlockedFrame, int, error) {
+	offset, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	return &DataBlockedFrame{MaximumData: protocol.ByteCount(offset)}, l, nil
+}
+
+func (f *DataBlockedFrame) Append(b []byte, version protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypeDataBlocked))
+	return quicvarint.Append(b, uint64(f.MaximumData)), nil
+}
+
+// Length of a written frame
+func (f *DataBlockedFrame) Length(version protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(uint64(f.MaximumData)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/data_blocked_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/data_blocked_frame_test.go
new file mode 100644
index 000000000..ba19e8460
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/data_blocked_frame_test.go
@@ -0,0 +1,40 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseDataBlocked(t *testing.T) {
+	data := encodeVarInt(0x12345678)
+	frame, l, err := parseDataBlockedFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.ByteCount(0x12345678), frame.MaximumData)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseDataBlockedErrorsOnEOFs(t *testing.T) {
+	data := encodeVarInt(0x12345678)
+	_, l, err := parseDataBlockedFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseDataBlockedFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteDataBlocked(t *testing.T) {
+	frame := DataBlockedFrame{MaximumData: 0xdeadbeef}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeDataBlocked)}
+	expected = append(expected, encodeVarInt(0xdeadbeef)...)
+	require.Equal(t, expected, b)
+	require.Equal(t, protocol.ByteCount(1+quicvarint.Len(uint64(frame.MaximumData))), frame.Length(protocol.Version1))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/datagram_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/datagram_frame.go
new file mode 100644
index 000000000..a6034867e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/datagram_frame.go
@@ -0,0 +1,85 @@
+package wire
+
+import (
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// MaxDatagramSize is the maximum size of a DATAGRAM frame (RFC 9221).
+// By setting it to a large value, we allow all datagrams that fit into a QUIC packet.
+// The value is chosen such that it can still be encoded as a 2 byte varint.
+// This is a var and not a const so it can be set in tests.
+var MaxDatagramSize protocol.ByteCount = 16383
+
+// A DatagramFrame is a DATAGRAM frame
+type DatagramFrame struct {
+	DataLenPresent bool
+	Data           []byte
+}
+
+func parseDatagramFrame(b []byte, typ FrameType, _ protocol.Version) (*DatagramFrame, int, error) {
+	startLen := len(b)
+	f := &DatagramFrame{}
+	f.DataLenPresent = uint64(typ)&0x1 > 0
+
+	var length uint64
+	if f.DataLenPresent {
+		var err error
+		var l int
+		length, l, err = quicvarint.Parse(b)
+		if err != nil {
+			return nil, 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+		if length > uint64(len(b)) {
+			return nil, 0, io.EOF
+		}
+	} else {
+		length = uint64(len(b))
+	}
+	f.Data = make([]byte, length)
+	copy(f.Data, b)
+	return f, startLen - len(b) + int(length), nil
+}
+
+func (f *DatagramFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	typ := uint8(0x30)
+	if f.DataLenPresent {
+		typ ^= 0b1
+	}
+	b = append(b, typ)
+	if f.DataLenPresent {
+		b = quicvarint.Append(b, uint64(len(f.Data)))
+	}
+	b = append(b, f.Data...)
+	return b, nil
+}
+
+// MaxDataLen returns the maximum data length
+func (f *DatagramFrame) MaxDataLen(maxSize protocol.ByteCount, version protocol.Version) protocol.ByteCount {
+	headerLen := protocol.ByteCount(1)
+	if f.DataLenPresent {
+		// pretend that the data size will be 1 bytes
+		// if it turns out that varint encoding the length will consume 2 bytes, we need to adjust the data length afterwards
+		headerLen++
+	}
+	if headerLen > maxSize {
+		return 0
+	}
+	maxDataLen := maxSize - headerLen
+	if f.DataLenPresent && quicvarint.Len(uint64(maxDataLen)) != 1 {
+		maxDataLen--
+	}
+	return maxDataLen
+}
+
+// Length of a written frame
+func (f *DatagramFrame) Length(_ protocol.Version) protocol.ByteCount {
+	length := 1 + protocol.ByteCount(len(f.Data))
+	if f.DataLenPresent {
+		length += protocol.ByteCount(quicvarint.Len(uint64(len(f.Data))))
+	}
+	return length
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/datagram_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/datagram_frame_test.go
new file mode 100644
index 000000000..ce86bfc75
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/datagram_frame_test.go
@@ -0,0 +1,126 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseDatagramFrameWithLength(t *testing.T) {
+	data := encodeVarInt(0x6) // length
+	data = append(data, []byte("foobar")...)
+	frame, l, err := parseDatagramFrame(data, 0x30^0x1, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), frame.Data)
+	require.True(t, frame.DataLenPresent)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseDatagramFrameWithoutLength(t *testing.T) {
+	data := []byte("Lorem ipsum dolor sit amet")
+	frame, l, err := parseDatagramFrame(data, 0x30, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, []byte("Lorem ipsum dolor sit amet"), frame.Data)
+	require.False(t, frame.DataLenPresent)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseDatagramFrameErrorsOnLengthLongerThanFrame(t *testing.T) {
+	data := encodeVarInt(0x6) // length
+	data = append(data, []byte("fooba")...)
+	_, _, err := parseDatagramFrame(data, 0x30^0x1, protocol.Version1)
+	require.Equal(t, io.EOF, err)
+}
+
+func TestParseDatagramFrameErrorsOnEOFs(t *testing.T) {
+	const typ = 0x30 ^ 0x1
+	data := encodeVarInt(6) // length
+	data = append(data, []byte("foobar")...)
+	_, l, err := parseDatagramFrame(data, typ, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err = parseDatagramFrame(data[0:i], typ, protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteDatagramFrameWithLength(t *testing.T) {
+	f := &DatagramFrame{
+		DataLenPresent: true,
+		Data:           []byte("foobar"),
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{0x30 ^ 0x1}
+	expected = append(expected, encodeVarInt(0x6)...)
+	expected = append(expected, []byte("foobar")...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+}
+
+func TestWriteDatagramFrameWithoutLength(t *testing.T) {
+	f := &DatagramFrame{Data: []byte("Lorem ipsum")}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{0x30}
+	expected = append(expected, []byte("Lorem ipsum")...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+}
+
+func TestMaxDatagramLenWithoutDataLenPresent(t *testing.T) {
+	const maxSize = 3000
+	data := make([]byte, maxSize)
+	f := &DatagramFrame{}
+	for i := 1; i < 3000; i++ {
+		f.Data = nil
+		maxDataLen := f.MaxDataLen(protocol.ByteCount(i), protocol.Version1)
+		if maxDataLen == 0 { // 0 means that no valid DATAGRAM frame can be written
+			// check that writing a minimal size DATAGRAM frame (i.e. with 1 byte data) is actually larger than the desired size
+			f.Data = []byte{0}
+			b, err := f.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			require.Greater(t, len(b), i)
+			continue
+		}
+		f.Data = data[:int(maxDataLen)]
+		b, err := f.Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		require.Len(t, b, i)
+	}
+}
+
+func TestMaxDatagramLenWithDataLenPresent(t *testing.T) {
+	const maxSize = 3000
+	data := make([]byte, maxSize)
+	f := &DatagramFrame{DataLenPresent: true}
+	var frameOneByteTooSmallCounter int
+	for i := 1; i < 3000; i++ {
+		f.Data = nil
+		maxDataLen := f.MaxDataLen(protocol.ByteCount(i), protocol.Version1)
+		if maxDataLen == 0 { // 0 means that no valid DATAGRAM frame can be written
+			// check that writing a minimal size DATAGRAM frame (i.e. with 1 byte data) is actually larger than the desired size
+			f.Data = []byte{0}
+			b, err := f.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			require.Greater(t, len(b), i)
+			continue
+		}
+		f.Data = data[:int(maxDataLen)]
+		b, err := f.Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		// There's *one* pathological case, where a data length of x can be encoded into 1 byte
+		// but a data lengths of x+1 needs 2 bytes
+		// In that case, it's impossible to create a DATAGRAM frame of the desired size
+		if len(b) == i-1 {
+			frameOneByteTooSmallCounter++
+			continue
+		}
+		require.Len(t, b, i)
+	}
+	require.Equal(t, 1, frameOneByteTooSmallCounter)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/extended_header.go b/electron/native/private-transport/third_party/quic-go/internal/wire/extended_header.go
new file mode 100644
index 000000000..6ab9fb98a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/extended_header.go
@@ -0,0 +1,164 @@
+package wire
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// ErrInvalidReservedBits is returned when the reserved bits are incorrect.
+// When this error is returned, parsing continues, and an ExtendedHeader is returned.
+// This is necessary because we need to decrypt the packet in that case,
+// in order to avoid a timing side-channel.
+var ErrInvalidReservedBits = errors.New("invalid reserved bits")
+
+// ExtendedHeader is the header of a QUIC packet.
+type ExtendedHeader struct {
+	Header
+
+	typeByte byte
+
+	KeyPhase protocol.KeyPhaseBit
+
+	PacketNumberLen protocol.PacketNumberLen
+	PacketNumber    protocol.PacketNumber
+
+	parsedLen protocol.ByteCount
+}
+
+func (h *ExtendedHeader) parse(data []byte) (bool /* reserved bits valid */, error) {
+	// read the (now unencrypted) first byte
+	h.typeByte = data[0]
+	h.PacketNumberLen = protocol.PacketNumberLen(h.typeByte&0x3) + 1
+	if protocol.ByteCount(len(data)) < h.Header.ParsedLen()+protocol.ByteCount(h.PacketNumberLen) {
+		return false, io.EOF
+	}
+
+	pn, err := readPacketNumber(data[h.Header.ParsedLen():], h.PacketNumberLen)
+	if err != nil {
+		return true, nil
+	}
+	h.PacketNumber = pn
+	reservedBitsValid := h.typeByte&0xc == 0
+
+	h.parsedLen = h.Header.ParsedLen() + protocol.ByteCount(h.PacketNumberLen)
+	return reservedBitsValid, err
+}
+
+// Append appends the Header.
+func (h *ExtendedHeader) Append(b []byte, v protocol.Version) ([]byte, error) {
+	if h.DestConnectionID.Len() > protocol.MaxConnIDLen {
+		return nil, fmt.Errorf("invalid connection ID length: %d bytes", h.DestConnectionID.Len())
+	}
+	if h.SrcConnectionID.Len() > protocol.MaxConnIDLen {
+		return nil, fmt.Errorf("invalid connection ID length: %d bytes", h.SrcConnectionID.Len())
+	}
+
+	var packetType uint8
+	if v == protocol.Version2 {
+		switch h.Type {
+		case protocol.PacketTypeInitial:
+			packetType = 0b01
+		case protocol.PacketType0RTT:
+			packetType = 0b10
+		case protocol.PacketTypeHandshake:
+			packetType = 0b11
+		case protocol.PacketTypeRetry:
+			packetType = 0b00
+		}
+	} else {
+		switch h.Type {
+		case protocol.PacketTypeInitial:
+			packetType = 0b00
+		case protocol.PacketType0RTT:
+			packetType = 0b01
+		case protocol.PacketTypeHandshake:
+			packetType = 0b10
+		case protocol.PacketTypeRetry:
+			packetType = 0b11
+		}
+	}
+	firstByte := 0xc0 | packetType<<4
+	if h.Type != protocol.PacketTypeRetry {
+		// Retry packets don't have a packet number
+		firstByte |= uint8(h.PacketNumberLen - 1)
+	}
+
+	b = append(b, firstByte)
+	b = append(b, make([]byte, 4)...)
+	binary.BigEndian.PutUint32(b[len(b)-4:], uint32(h.Version))
+	b = append(b, uint8(h.DestConnectionID.Len()))
+	b = append(b, h.DestConnectionID.Bytes()...)
+	b = append(b, uint8(h.SrcConnectionID.Len()))
+	b = append(b, h.SrcConnectionID.Bytes()...)
+
+	//nolint:exhaustive
+	switch h.Type {
+	case protocol.PacketTypeRetry:
+		b = append(b, h.Token...)
+		return b, nil
+	case protocol.PacketTypeInitial:
+		b = quicvarint.Append(b, uint64(len(h.Token)))
+		b = append(b, h.Token...)
+	}
+	b = quicvarint.AppendWithLen(b, uint64(h.Length), 2)
+	return appendPacketNumber(b, h.PacketNumber, h.PacketNumberLen)
+}
+
+// ParsedLen returns the number of bytes that were consumed when parsing the header
+func (h *ExtendedHeader) ParsedLen() protocol.ByteCount {
+	return h.parsedLen
+}
+
+// GetLength determines the length of the Header.
+func (h *ExtendedHeader) GetLength(_ protocol.Version) protocol.ByteCount {
+	length := 1 /* type byte */ + 4 /* version */ + 1 /* dest conn ID len */ + protocol.ByteCount(h.DestConnectionID.Len()) + 1 /* src conn ID len */ + protocol.ByteCount(h.SrcConnectionID.Len()) + protocol.ByteCount(h.PacketNumberLen) + 2 /* length */
+	if h.Type == protocol.PacketTypeInitial {
+		length += protocol.ByteCount(quicvarint.Len(uint64(len(h.Token))) + len(h.Token))
+	}
+	return length
+}
+
+// Log logs the Header
+func (h *ExtendedHeader) Log(logger utils.Logger) {
+	var token string
+	if h.Type == protocol.PacketTypeInitial || h.Type == protocol.PacketTypeRetry {
+		if len(h.Token) == 0 {
+			token = "Token: (empty), "
+		} else {
+			token = fmt.Sprintf("Token: %#x, ", h.Token)
+		}
+		if h.Type == protocol.PacketTypeRetry {
+			logger.Debugf("\tLong Header{Type: %s, DestConnectionID: %s, SrcConnectionID: %s, %sVersion: %s}", h.Type, h.DestConnectionID, h.SrcConnectionID, token, h.Version)
+			return
+		}
+	}
+	logger.Debugf("\tLong Header{Type: %s, DestConnectionID: %s, SrcConnectionID: %s, %sPacketNumber: %d, PacketNumberLen: %d, Length: %d, Version: %s}", h.Type, h.DestConnectionID, h.SrcConnectionID, token, h.PacketNumber, h.PacketNumberLen, h.Length, h.Version)
+}
+
+func appendPacketNumber(b []byte, pn protocol.PacketNumber, pnLen protocol.PacketNumberLen) ([]byte, error) {
+	switch pnLen {
+	case protocol.PacketNumberLen1:
+		b = append(b, uint8(pn))
+	case protocol.PacketNumberLen2:
+		buf := make([]byte, 2)
+		binary.BigEndian.PutUint16(buf, uint16(pn))
+		b = append(b, buf...)
+	case protocol.PacketNumberLen3:
+		buf := make([]byte, 4)
+		binary.BigEndian.PutUint32(buf, uint32(pn))
+		b = append(b, buf[1:]...)
+	case protocol.PacketNumberLen4:
+		buf := make([]byte, 4)
+		binary.BigEndian.PutUint32(buf, uint32(pn))
+		b = append(b, buf...)
+	default:
+		return nil, fmt.Errorf("invalid packet number length: %d", pnLen)
+	}
+	return b, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/extended_header_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/extended_header_test.go
new file mode 100644
index 000000000..2c200257a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/extended_header_test.go
@@ -0,0 +1,269 @@
+package wire
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWritesLongHeaderVersion1(t *testing.T) {
+	header := &ExtendedHeader{
+		Header: Header{
+			Type:             protocol.PacketTypeHandshake,
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad, 0x0, 0x0, 0x13, 0x37}),
+			Version:          0x1020304,
+			Length:           1234,
+		},
+		PacketNumber:    0xdecaf,
+		PacketNumberLen: protocol.PacketNumberLen3,
+	}
+	b, err := header.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{
+		0xc0 | 0x2<<4 | 0x2,
+		0x1, 0x2, 0x3, 0x4, // version number
+		0x6,                                // dest connection ID length
+		0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, // dest connection ID
+		0x8,                                          // src connection ID length
+		0xde, 0xca, 0xfb, 0xad, 0x0, 0x0, 0x13, 0x37, // source connection ID
+	}
+	expected = append(expected, encodeVarInt(1234)...)      // length
+	expected = append(expected, []byte{0xd, 0xec, 0xaf}...) // packet number
+	require.Equal(t, expected, b)
+	require.Equal(t, protocol.ByteCount(len(b)), header.GetLength(protocol.Version1))
+}
+
+func TestWritesHandshakePacketVersion2(t *testing.T) {
+	header := &ExtendedHeader{
+		Header: Header{
+			Version: protocol.Version2,
+			Type:    protocol.PacketTypeHandshake,
+		},
+		PacketNumber:    0xdecafbad,
+		PacketNumberLen: protocol.PacketNumberLen4,
+	}
+	b, err := header.Append(nil, protocol.Version2)
+	require.NoError(t, err)
+	require.Equal(t, byte(0b11), b[0]>>4&0b11)
+	require.Equal(t, protocol.ByteCount(len(b)), header.GetLength(protocol.Version2))
+}
+
+func TestWritesHeaderWith20ByteConnectionID(t *testing.T) {
+	srcConnID := protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8})
+	header := &ExtendedHeader{
+		Header: Header{
+			SrcConnectionID:  srcConnID,
+			DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20}), // connection IDs must be at most 20 bytes long
+			Version:          0x1020304,
+			Type:             0x5,
+		},
+		PacketNumber:    0xdecafbad,
+		PacketNumberLen: protocol.PacketNumberLen4,
+	}
+	b, err := header.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Contains(t, string(b), string([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20}))
+	require.Equal(t, protocol.ByteCount(len(b)), header.GetLength(protocol.Version1))
+}
+
+func TestWritesInitialContainingToken(t *testing.T) {
+	token := []byte("Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.")
+	header := &ExtendedHeader{
+		Header: Header{
+			Version: 0x1020304,
+			Type:    protocol.PacketTypeInitial,
+			Token:   token,
+		},
+		PacketNumber:    0xdecafbad,
+		PacketNumberLen: protocol.PacketNumberLen4,
+	}
+	b, err := header.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, byte(0), b[0]>>4&0b11)
+	expectedSubstring := append(encodeVarInt(uint64(len(token))), token...)
+	require.Contains(t, string(b), string(expectedSubstring))
+	require.Equal(t, protocol.ByteCount(len(b)), header.GetLength(protocol.Version1))
+}
+
+func TestUses2ByteEncodingForLengthOnInitialPackets(t *testing.T) {
+	header := &ExtendedHeader{
+		Header: Header{
+			Version: 0x1020304,
+			Type:    protocol.PacketTypeInitial,
+			Length:  37,
+		},
+		PacketNumber:    0xdecafbad,
+		PacketNumberLen: protocol.PacketNumberLen4,
+	}
+	b, err := header.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	lengthEncoded := quicvarint.AppendWithLen(nil, 37, 2)
+	require.Equal(t, lengthEncoded, b[len(b)-6:len(b)-4])
+	require.Equal(t, protocol.ByteCount(len(b)), header.GetLength(protocol.Version1))
+}
+
+func TestWritesInitialPacketVersion2(t *testing.T) {
+	header := &ExtendedHeader{
+		Header: Header{
+			Version: protocol.Version2,
+			Type:    protocol.PacketTypeInitial,
+		},
+		PacketNumber:    0xdecafbad,
+		PacketNumberLen: protocol.PacketNumberLen4,
+	}
+	b, err := header.Append(nil, protocol.Version2)
+	require.NoError(t, err)
+	require.Equal(t, byte(0b01), b[0]>>4&0b11)
+	require.Equal(t, protocol.ByteCount(len(b)), header.GetLength(protocol.Version2))
+}
+
+func TestWrites0RTTPacketVersion2(t *testing.T) {
+	header := &ExtendedHeader{
+		Header: Header{
+			Version: protocol.Version2,
+			Type:    protocol.PacketType0RTT,
+		},
+		PacketNumber:    0xdecafbad,
+		PacketNumberLen: protocol.PacketNumberLen4,
+	}
+	b, err := header.Append(nil, protocol.Version2)
+	require.NoError(t, err)
+	require.Equal(t, byte(0b10), b[0]>>4&0b11)
+	require.Equal(t, protocol.ByteCount(len(b)), header.GetLength(protocol.Version2))
+}
+
+func TestWritesRetryPacket(t *testing.T) {
+	token := []byte("Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.")
+
+	for _, version := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		t.Run(version.String(), func(t *testing.T) {
+			header := &ExtendedHeader{Header: Header{
+				Version: version,
+				Type:    protocol.PacketTypeRetry,
+				Token:   token,
+			}}
+			b, err := header.Append(nil, version)
+			require.NoError(t, err)
+
+			var expected []byte
+			switch version {
+			case protocol.Version1:
+				expected = append(expected, 0xc0|0b11<<4)
+			case protocol.Version2:
+				expected = append(expected, 0xc0)
+			}
+
+			expected = appendVersion(expected, version)
+			expected = append(expected, 0x0) // dest connection ID length
+			expected = append(expected, 0x0) // src connection ID length
+			expected = append(expected, token...)
+			require.Equal(t, expected, b)
+		})
+	}
+}
+
+func TestLogsLongHeaders(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+
+	(&ExtendedHeader{
+		Header: Header{
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0x13, 0x37}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad, 0x013, 0x37, 0x13, 0x37}),
+			Type:             protocol.PacketTypeHandshake,
+			Length:           54321,
+			Version:          0xfeed,
+		},
+		PacketNumber:    1337,
+		PacketNumberLen: protocol.PacketNumberLen2,
+	}).Log(logger)
+	require.Contains(t, buf.String(), "Long Header{Type: Handshake, DestConnectionID: deadbeefcafe1337, SrcConnectionID: decafbad13371337, PacketNumber: 1337, PacketNumberLen: 2, Length: 54321, Version: 0xfeed}")
+}
+
+func TestLogsInitialPacketsWithToken(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+
+	(&ExtendedHeader{
+		Header: Header{
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xca, 0xfe, 0x13, 0x37}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}),
+			Type:             protocol.PacketTypeInitial,
+			Token:            []byte{0xde, 0xad, 0xbe, 0xef},
+			Length:           100,
+			Version:          0xfeed,
+		},
+		PacketNumber:    42,
+		PacketNumberLen: protocol.PacketNumberLen2,
+	}).Log(logger)
+	require.Contains(t, buf.String(), "Long Header{Type: Initial, DestConnectionID: cafe1337, SrcConnectionID: decafbad, Token: 0xdeadbeef, PacketNumber: 42, PacketNumberLen: 2, Length: 100, Version: 0xfeed}")
+}
+
+func TestLogsInitialPacketsWithoutToken(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+
+	(&ExtendedHeader{
+		Header: Header{
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xca, 0xfe, 0x13, 0x37}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}),
+			Type:             protocol.PacketTypeInitial,
+			Length:           100,
+			Version:          0xfeed,
+		},
+		PacketNumber:    42,
+		PacketNumberLen: protocol.PacketNumberLen2,
+	}).Log(logger)
+	require.Contains(t, buf.String(), "Long Header{Type: Initial, DestConnectionID: cafe1337, SrcConnectionID: decafbad, Token: (empty), PacketNumber: 42, PacketNumberLen: 2, Length: 100, Version: 0xfeed}")
+}
+
+func TestLogsRetryPacketsWithToken(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+
+	(&ExtendedHeader{
+		Header: Header{
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xca, 0xfe, 0x13, 0x37}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}),
+			Type:             protocol.PacketTypeRetry,
+			Token:            []byte{0x12, 0x34, 0x56},
+			Version:          0xfeed,
+		},
+	}).Log(logger)
+	require.Contains(t, buf.String(), "Long Header{Type: Retry, DestConnectionID: cafe1337, SrcConnectionID: decafbad, Token: 0x123456, Version: 0xfeed}")
+}
+
+func BenchmarkParseExtendedHeader(b *testing.B) {
+	b.ReportAllocs()
+
+	data, err := (&ExtendedHeader{
+		Header: Header{
+			Type:             protocol.PacketTypeHandshake,
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad, 0x0, 0x0, 0x13, 0x37}),
+			Version:          protocol.Version1,
+			Length:           1234,
+		},
+		PacketNumber:    0xdecaf,
+		PacketNumberLen: protocol.PacketNumberLen3,
+	}).Append(nil, protocol.Version1)
+	if err != nil {
+		b.Fatal(err)
+	}
+	data = append(data, make([]byte, 1231)...)
+
+	for b.Loop() {
+		hdr, _, _, err := ParsePacket(data)
+		if err != nil {
+			b.Fatal(err)
+		}
+		if _, err := hdr.ParseExtended(data); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/frame.go
new file mode 100644
index 000000000..09ea92f75
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/frame.go
@@ -0,0 +1,33 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// A Frame in QUIC
+type Frame interface {
+	Append(b []byte, version protocol.Version) ([]byte, error)
+	Length(version protocol.Version) protocol.ByteCount
+}
+
+// IsProbingFrame returns true if the frame is a probing frame.
+// See section 9.1 of RFC 9000.
+func IsProbingFrame(f Frame) bool {
+	switch f.(type) {
+	case *PathChallengeFrame, *PathResponseFrame, *NewConnectionIDFrame:
+		return true
+	}
+	return false
+}
+
+// IsProbingFrameType returns true if the FrameType is a probing frame.
+// See section 9.1 of RFC 9000.
+func IsProbingFrameType(f FrameType) bool {
+	//nolint:exhaustive // PATH_CHALLENGE, PATH_RESPONSE and NEW_CONNECTION_ID are the only probing frames
+	switch f {
+	case FrameTypePathChallenge, FrameTypePathResponse, FrameTypeNewConnectionID:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/frame_parser.go b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_parser.go
new file mode 100644
index 000000000..afc3bedb9
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_parser.go
@@ -0,0 +1,192 @@
+package wire
+
+import (
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+var errUnknownFrameType = errors.New("unknown frame type")
+
+// The FrameParser parses QUIC frames, one by one.
+type FrameParser struct {
+	ackDelayExponent      uint8
+	supportsDatagrams     bool
+	supportsResetStreamAt bool
+	supportsAckFrequency  bool
+
+	// To avoid allocating when parsing, keep a single ACK frame struct.
+	// It is used over and over again.
+	ackFrame *AckFrame
+}
+
+// NewFrameParser creates a new frame parser.
+func NewFrameParser(supportsDatagrams, supportsResetStreamAt, supportsAckFrequency bool) *FrameParser {
+	return &FrameParser{
+		supportsDatagrams:     supportsDatagrams,
+		supportsResetStreamAt: supportsResetStreamAt,
+		supportsAckFrequency:  supportsAckFrequency,
+		ackFrame:              &AckFrame{},
+	}
+}
+
+// ParseType parses the frame type of the next frame.
+// It skips over PADDING frames.
+func (p *FrameParser) ParseType(b []byte, encLevel protocol.EncryptionLevel) (FrameType, int, error) {
+	var parsed int
+	for len(b) != 0 {
+		typ, l, err := quicvarint.Parse(b)
+		parsed += l
+		if err != nil {
+			return 0, parsed, &qerr.TransportError{
+				ErrorCode:    qerr.FrameEncodingError,
+				ErrorMessage: err.Error(),
+			}
+		}
+		b = b[l:]
+		if typ == 0x0 { // skip PADDING frames
+			continue
+		}
+		ft := FrameType(typ)
+		valid := ft.isValidRFC9000() ||
+			(p.supportsDatagrams && ft.IsDatagramFrameType()) ||
+			(p.supportsResetStreamAt && ft == FrameTypeResetStreamAt) ||
+			(p.supportsAckFrequency && (ft == FrameTypeAckFrequency || ft == FrameTypeImmediateAck))
+		if !valid {
+			return 0, parsed, &qerr.TransportError{
+				ErrorCode:    qerr.FrameEncodingError,
+				FrameType:    typ,
+				ErrorMessage: errUnknownFrameType.Error(),
+			}
+		}
+		if !ft.isAllowedAtEncLevel(encLevel) {
+			return 0, parsed, &qerr.TransportError{
+				ErrorCode:    qerr.FrameEncodingError,
+				FrameType:    typ,
+				ErrorMessage: fmt.Sprintf("%d not allowed at encryption level %s", ft, encLevel),
+			}
+		}
+		return ft, parsed, nil
+	}
+	return 0, parsed, io.EOF
+}
+
+func (p *FrameParser) ParseStreamFrame(frameType FrameType, data []byte, v protocol.Version) (*StreamFrame, int, error) {
+	frame, n, err := ParseStreamFrame(data, frameType, v)
+	if err != nil {
+		return nil, n, &qerr.TransportError{
+			ErrorCode:    qerr.FrameEncodingError,
+			FrameType:    uint64(frameType),
+			ErrorMessage: err.Error(),
+		}
+	}
+	return frame, n, nil
+}
+
+func (p *FrameParser) ParseAckFrame(frameType FrameType, data []byte, encLevel protocol.EncryptionLevel, v protocol.Version) (*AckFrame, int, error) {
+	ackDelayExponent := p.ackDelayExponent
+	if encLevel != protocol.Encryption1RTT {
+		ackDelayExponent = protocol.DefaultAckDelayExponent
+	}
+	p.ackFrame.Reset()
+	l, err := parseAckFrame(p.ackFrame, data, frameType, ackDelayExponent, v)
+	if err != nil {
+		return nil, l, &qerr.TransportError{
+			ErrorCode:    qerr.FrameEncodingError,
+			FrameType:    uint64(frameType),
+			ErrorMessage: err.Error(),
+		}
+	}
+
+	return p.ackFrame, l, nil
+}
+
+func (p *FrameParser) ParseDatagramFrame(frameType FrameType, data []byte, v protocol.Version) (*DatagramFrame, int, error) {
+	f, l, err := parseDatagramFrame(data, frameType, v)
+	if err != nil {
+		return nil, 0, &qerr.TransportError{
+			ErrorCode:    qerr.FrameEncodingError,
+			FrameType:    uint64(frameType),
+			ErrorMessage: err.Error(),
+		}
+	}
+	return f, l, nil
+}
+
+// ParseLessCommonFrame parses everything except STREAM, ACK or DATAGRAM.
+// These cases should be handled separately for performance reasons.
+func (p *FrameParser) ParseLessCommonFrame(frameType FrameType, data []byte, v protocol.Version) (Frame, int, error) {
+	var frame Frame
+	var l int
+	var err error
+	//nolint:exhaustive // Common frames should already be handled.
+	switch frameType {
+	case FrameTypePing:
+		frame = &PingFrame{}
+	case FrameTypeResetStream:
+		frame, l, err = parseResetStreamFrame(data, false, v)
+	case FrameTypeStopSending:
+		frame, l, err = parseStopSendingFrame(data, v)
+	case FrameTypeCrypto:
+		frame, l, err = parseCryptoFrame(data, v)
+	case FrameTypeNewToken:
+		frame, l, err = parseNewTokenFrame(data, v)
+	case FrameTypeMaxData:
+		frame, l, err = parseMaxDataFrame(data, v)
+	case FrameTypeMaxStreamData:
+		frame, l, err = parseMaxStreamDataFrame(data, v)
+	case FrameTypeBidiMaxStreams, FrameTypeUniMaxStreams:
+		frame, l, err = parseMaxStreamsFrame(data, frameType, v)
+	case FrameTypeDataBlocked:
+		frame, l, err = parseDataBlockedFrame(data, v)
+	case FrameTypeStreamDataBlocked:
+		frame, l, err = parseStreamDataBlockedFrame(data, v)
+	case FrameTypeBidiStreamBlocked, FrameTypeUniStreamBlocked:
+		frame, l, err = parseStreamsBlockedFrame(data, frameType, v)
+	case FrameTypeNewConnectionID:
+		frame, l, err = parseNewConnectionIDFrame(data, v)
+	case FrameTypeRetireConnectionID:
+		frame, l, err = parseRetireConnectionIDFrame(data, v)
+	case FrameTypePathChallenge:
+		frame, l, err = parsePathChallengeFrame(data, v)
+	case FrameTypePathResponse:
+		frame, l, err = parsePathResponseFrame(data, v)
+	case FrameTypeConnectionClose, FrameTypeApplicationClose:
+		frame, l, err = parseConnectionCloseFrame(data, frameType, v)
+	case FrameTypeHandshakeDone:
+		frame = &HandshakeDoneFrame{}
+	case FrameTypeResetStreamAt:
+		frame, l, err = parseResetStreamFrame(data, true, v)
+	case FrameTypeAckFrequency:
+		frame, l, err = parseAckFrequencyFrame(data, v)
+	case FrameTypeImmediateAck:
+		frame = &ImmediateAckFrame{}
+	default:
+		err = errUnknownFrameType
+	}
+	if err != nil {
+		return frame, l, &qerr.TransportError{
+			ErrorCode:    qerr.FrameEncodingError,
+			FrameType:    uint64(frameType),
+			ErrorMessage: err.Error(),
+		}
+	}
+	return frame, l, err
+}
+
+// SetAckDelayExponent sets the acknowledgment delay exponent (sent in the transport parameters).
+// This value is used to scale the ACK Delay field in the ACK frame.
+func (p *FrameParser) SetAckDelayExponent(exp uint8) {
+	p.ackDelayExponent = exp
+}
+
+func replaceUnexpectedEOF(e error) error {
+	if e == io.ErrUnexpectedEOF {
+		return io.EOF
+	}
+	return e
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/frame_parser_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_parser_test.go
new file mode 100644
index 000000000..7de939883
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_parser_test.go
@@ -0,0 +1,1083 @@
+package wire
+
+import (
+	"bytes"
+	"crypto/rand"
+	"fmt"
+	"io"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	ossfuzzseeds "github.com/quic-go/go-ossfuzz-seeds"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestFrameTypeParsingReturnsNilWhenNothingToRead(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	frameType, l, err := parser.ParseType(nil, protocol.Encryption1RTT)
+	require.Equal(t, io.EOF, err)
+	require.Zero(t, frameType)
+	require.Zero(t, l)
+}
+
+func TestParseLessCommonFrameReturnsEOFWhenNothingToRead(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	l, f, err := parser.ParseLessCommonFrame(FrameTypeMaxStreamData, nil, protocol.Version1)
+	require.IsType(t, &qerr.TransportError{}, err)
+	require.Zero(t, l)
+	require.Zero(t, f)
+}
+
+func TestFrameParsingSkipsPaddingFrames(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	b := []byte{0, 0} // 2 PADDING frames
+	b, err := (&PingFrame{}).Append(b, protocol.Version1)
+	require.NoError(t, err)
+
+	frameType, l, err := parser.ParseType(b, protocol.Encryption1RTT)
+	require.NoError(t, err)
+	require.Equal(t, 3, l)
+	require.Equal(t, FrameTypePing, frameType)
+
+	frame, l, err := parser.ParseLessCommonFrame(frameType, b[1:], protocol.Version1)
+	require.NoError(t, err)
+	require.Zero(t, l)
+	require.IsType(t, &PingFrame{}, frame)
+}
+
+func TestFrameParsingHandlesPaddingAtEnd(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	b := []byte{0, 0, 0}
+
+	_, l, err := parser.ParseType(b, protocol.Encryption1RTT)
+	require.Equal(t, io.EOF, err)
+	require.Equal(t, 3, l)
+}
+
+func TestFrameParsingParsesSingleFrame(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	var b []byte
+	for range 10 {
+		var err error
+		b, err = (&PingFrame{}).Append(b, protocol.Version1)
+		require.NoError(t, err)
+	}
+	frameType, l, err := parser.ParseType(b, protocol.Encryption1RTT)
+	require.NoError(t, err)
+	require.Equal(t, FrameTypePing, frameType)
+	require.Equal(t, 1, l)
+
+	frame, l, err := parser.ParseLessCommonFrame(frameType, b, protocol.Version1)
+	require.NoError(t, err)
+	require.Zero(t, l)
+	require.IsType(t, &PingFrame{}, frame)
+}
+
+func TestFrameParserACK(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	f := &AckFrame{AckRanges: []AckRange{{Smallest: 1, Largest: 0x13}}}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	frameType, l, err := parser.ParseType(b, protocol.Encryption1RTT)
+	require.NoError(t, err)
+	require.Equal(t, FrameTypeAck, frameType)
+	require.Equal(t, 1, l)
+
+	frame, l, err := parser.ParseAckFrame(frameType, b[l:], protocol.Encryption1RTT, protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, frame)
+	require.Equal(t, protocol.PacketNumber(0x13), frame.LargestAcked())
+	require.Equal(t, len(b)-1, l)
+}
+
+func TestFrameParserAckDelay(t *testing.T) {
+	t.Run("1-RTT", func(t *testing.T) {
+		testFrameParserAckDelay(t, protocol.Encryption1RTT)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testFrameParserAckDelay(t, protocol.EncryptionHandshake)
+	})
+}
+
+func testFrameParserAckDelay(t *testing.T, encLevel protocol.EncryptionLevel) {
+	parser := NewFrameParser(true, true, true)
+	parser.SetAckDelayExponent(protocol.AckDelayExponent + 2)
+	f := &AckFrame{
+		AckRanges: []AckRange{{Smallest: 1, Largest: 1}},
+		DelayTime: time.Second,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	frameType, l, err := parser.ParseType(b, encLevel)
+	require.NoError(t, err)
+	require.Equal(t, FrameTypeAck, frameType)
+	require.Equal(t, 1, l)
+
+	frame, l, err := parser.ParseAckFrame(frameType, b[l:], encLevel, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(b)-1, l)
+	if encLevel == protocol.Encryption1RTT {
+		require.Equal(t, 4*time.Second, frame.DelayTime)
+	} else {
+		require.Equal(t, time.Second, frame.DelayTime)
+	}
+}
+
+func checkFrameUnsupported(t *testing.T, err error, expectedFrameType uint64) {
+	t.Helper()
+	require.ErrorContains(t, err, errUnknownFrameType.Error())
+	var transportErr *qerr.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, qerr.FrameEncodingError, transportErr.ErrorCode)
+	require.Equal(t, expectedFrameType, transportErr.FrameType)
+	require.Equal(t, "unknown frame type", transportErr.ErrorMessage)
+}
+
+func TestFrameParserStreamFrames(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	f := &StreamFrame{
+		StreamID: 0x42,
+		Offset:   0x1337,
+		Fin:      true,
+		Data:     []byte("foobar"),
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	frameType, l, err := parser.ParseType(b, protocol.Encryption1RTT)
+	require.NoError(t, err)
+	require.Equal(t, FrameType(0xd), frameType)
+	require.True(t, frameType.IsStreamFrameType())
+	require.Equal(t, 1, l)
+
+	// ParseLessCommonFrame should not handle Stream Frames
+	frame, l, err := parser.ParseLessCommonFrame(frameType, b[l:], protocol.Version1)
+	checkFrameUnsupported(t, err, 0xd)
+	require.Nil(t, frame)
+	require.Zero(t, l)
+}
+
+func TestParseStreamFrameWrapsError(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	f := &StreamFrame{
+		StreamID:       0x1234,
+		Offset:         0x1000,
+		Data:           []byte("hello world"),
+		DataLenPresent: true,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+
+	// Corrupt the buffer to trigger a parse error
+	b = b[:len(b)-2] // Remove last 2 bytes to cause an EOF
+
+	frameType, l, err := parser.ParseType(b, protocol.Encryption1RTT)
+	require.NoError(t, err)
+
+	frame, n, err := parser.ParseStreamFrame(frameType, b[l:], protocol.Version1)
+	require.Nil(t, frame)
+	require.Zero(t, n)
+
+	var transportErr *qerr.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, qerr.FrameEncodingError, transportErr.ErrorCode)
+	require.Equal(t, uint64(frameType), transportErr.FrameType)
+	require.Contains(t, transportErr.Error(), "EOF")
+}
+
+func TestParseStreamFrameSuccess(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	original := &StreamFrame{
+		StreamID:       0x1234,
+		Offset:         0x1000,
+		Fin:            true,
+		Data:           []byte("hello world"),
+		DataLenPresent: true,
+	}
+	b, err := original.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+
+	frameType, l, err := parser.ParseType(b, protocol.Encryption1RTT)
+	require.NoError(t, err)
+	require.True(t, frameType.IsStreamFrameType())
+	require.Equal(t, FrameType(0x0f), frameType) // STREAM | OFF | LEN | FIN
+
+	parsed, n, err := parser.ParseStreamFrame(frameType, b[l:], protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, parsed)
+	require.Equal(t, len(b)-l, n)
+
+	require.Equal(t, original.StreamID, parsed.StreamID)
+	require.Equal(t, original.Offset, parsed.Offset)
+	require.Equal(t, original.Fin, parsed.Fin)
+	require.Equal(t, original.DataLenPresent, parsed.DataLenPresent)
+	require.Equal(t, original.Data, parsed.Data)
+}
+
+func TestFrameParserFrames(t *testing.T) {
+	tests := []struct {
+		name      string
+		frameType FrameType
+		frame     Frame
+	}{
+		{
+			name:      "MAX_DATA",
+			frameType: FrameTypeMaxData,
+			frame:     &MaxDataFrame{MaximumData: 0xcafe},
+		},
+		{
+			name:      "MAX_STREAM_DATA",
+			frameType: FrameTypeMaxStreamData,
+			frame:     &MaxStreamDataFrame{StreamID: 0xdeadbeef, MaximumStreamData: 0xdecafbad},
+		},
+		{
+			name:      "RESET_STREAM",
+			frameType: FrameTypeResetStream,
+			frame: &ResetStreamFrame{
+				StreamID:  0xdeadbeef,
+				FinalSize: 0xdecafbad1234,
+				ErrorCode: 0x1337,
+			},
+		},
+		{
+			name:      "STOP_SENDING",
+			frameType: FrameTypeStopSending,
+			frame:     &StopSendingFrame{StreamID: 0x42},
+		},
+		{
+			name:      "CRYPTO",
+			frameType: FrameTypeCrypto,
+			frame:     &CryptoFrame{Offset: 0x1337, Data: []byte("lorem ipsum")},
+		},
+		{
+			name:      "NEW_TOKEN",
+			frameType: FrameTypeNewToken,
+			frame:     &NewTokenFrame{Token: []byte("foobar")},
+		},
+		{
+			name:      "MAX_STREAMS",
+			frameType: FrameTypeBidiMaxStreams,
+			frame:     &MaxStreamsFrame{Type: protocol.StreamTypeBidi, MaxStreamNum: 0x1337},
+		},
+		{
+			name:      "DATA_BLOCKED",
+			frameType: FrameTypeDataBlocked,
+			frame:     &DataBlockedFrame{MaximumData: 0x1234},
+		},
+		{
+			name:      "STREAM_DATA_BLOCKED",
+			frameType: FrameTypeStreamDataBlocked,
+			frame:     &StreamDataBlockedFrame{StreamID: 0xdeadbeef, MaximumStreamData: 0xdead},
+		},
+		{
+			name:      "STREAMS_BLOCKED",
+			frameType: FrameTypeBidiStreamBlocked,
+			frame:     &StreamsBlockedFrame{Type: protocol.StreamTypeBidi, StreamLimit: 0x1234567},
+		},
+		{
+			name:      "NEW_CONNECTION_ID",
+			frameType: FrameTypeNewConnectionID,
+			frame: &NewConnectionIDFrame{
+				SequenceNumber:      0x1337,
+				ConnectionID:        protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+				StatelessResetToken: protocol.StatelessResetToken{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15},
+			},
+		},
+		{
+			name:      "RETIRE_CONNECTION_ID",
+			frameType: FrameTypeRetireConnectionID,
+			frame:     &RetireConnectionIDFrame{SequenceNumber: 0x1337},
+		},
+		{
+			name:      "PATH_CHALLENGE",
+			frameType: FrameTypePathChallenge,
+			frame:     &PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}},
+		},
+		{
+			name:      "PATH_RESPONSE",
+			frameType: FrameTypePathResponse,
+			frame:     &PathResponseFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}},
+		},
+		{
+			name:      "CONNECTION_CLOSE",
+			frameType: FrameTypeConnectionClose,
+			frame:     &ConnectionCloseFrame{IsApplicationError: false, ReasonPhrase: "foobar"},
+		},
+		{
+			name:      "APPLICATION_CLOSE",
+			frameType: FrameTypeApplicationClose,
+			frame:     &ConnectionCloseFrame{IsApplicationError: true, ReasonPhrase: "foobar"},
+		},
+		{
+			name:      "HANDSHAKE_DONE",
+			frameType: FrameTypeHandshakeDone,
+			frame:     &HandshakeDoneFrame{},
+		},
+		{
+			name:      "RESET_STREAM_AT",
+			frameType: FrameTypeResetStreamAt,
+			frame:     &ResetStreamFrame{StreamID: 0x1337, ReliableSize: 0x42, FinalSize: 0xdeadbeef},
+		},
+		{
+			name:      "ACK_FREQUENCY",
+			frameType: FrameTypeAckFrequency,
+			frame: &AckFrequencyFrame{
+				SequenceNumber:        0x1337,
+				AckElicitingThreshold: 0x42,
+				RequestMaxAckDelay:    123 * time.Second,
+				ReorderingThreshold:   0xcafe,
+			},
+		},
+		{
+			name:      "IMMEDIATE_ACK",
+			frameType: FrameTypeImmediateAck,
+			frame:     &ImmediateAckFrame{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			parser := NewFrameParser(true, true, true)
+			b, err := test.frame.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+
+			frameType, l, err := parser.ParseType(b, protocol.Encryption1RTT)
+			require.NoError(t, err)
+			require.Equal(t, test.frameType, frameType)
+			require.Equal(t, quicvarint.Len(uint64(test.frameType)), l)
+
+			frame, l, err := parser.ParseLessCommonFrame(frameType, b[l:], protocol.Version1)
+			require.NoError(t, err)
+			require.Equal(t, test.frame, frame)
+			require.Equal(t, len(b)-quicvarint.Len(uint64(test.frameType)), l)
+		})
+	}
+}
+
+func TestFrameAllowedAtEncLevel(t *testing.T) {
+	type testCase struct {
+		name             string
+		frameType        FrameType
+		frame            Frame
+		allowedInitial   bool
+		allowedHandshake bool
+		allowedZeroRTT   bool
+		allowedOneRTT    bool
+	}
+
+	for _, tc := range []testCase{
+		{
+			name:             "CRYPTO_FRAME",
+			frameType:        FrameTypeCrypto,
+			frame:            &CryptoFrame{Offset: 0, Data: []byte("foo")},
+			allowedInitial:   true,
+			allowedHandshake: true,
+			allowedZeroRTT:   false,
+			allowedOneRTT:    true,
+		},
+		{
+			name:             "ACK_FRAME",
+			frameType:        FrameTypeAck,
+			frame:            &AckFrame{AckRanges: []AckRange{{Smallest: 1, Largest: 1}}},
+			allowedInitial:   true,
+			allowedHandshake: true,
+			allowedZeroRTT:   false,
+			allowedOneRTT:    true,
+		},
+		{
+			name:             "CONNECTION_CLOSE_FRAME",
+			frameType:        FrameTypeConnectionClose,
+			frame:            &ConnectionCloseFrame{IsApplicationError: false, ReasonPhrase: "err"},
+			allowedInitial:   true,
+			allowedHandshake: true,
+			allowedZeroRTT:   false,
+			allowedOneRTT:    true,
+		},
+		{
+			name:             "PING_FRAME",
+			frameType:        FrameTypePing,
+			frame:            &PingFrame{},
+			allowedInitial:   true,
+			allowedHandshake: true,
+			allowedZeroRTT:   true,
+			allowedOneRTT:    true,
+		},
+		{
+			name:             "NEW_TOKEN_FRAME",
+			frameType:        FrameTypeNewToken,
+			frame:            &NewTokenFrame{Token: []byte("tok")},
+			allowedInitial:   false,
+			allowedHandshake: false,
+			allowedZeroRTT:   false,
+			allowedOneRTT:    true,
+		},
+		{
+			name:             "PATH_RESPONSE_FRAME",
+			frameType:        FrameTypePathResponse,
+			frame:            &PathResponseFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}},
+			allowedInitial:   false,
+			allowedHandshake: false,
+			allowedZeroRTT:   false,
+			allowedOneRTT:    true,
+		},
+		{
+			name:             "RETIRE_CONNECTION_ID_FRAME",
+			frameType:        FrameTypeRetireConnectionID,
+			frame:            &RetireConnectionIDFrame{SequenceNumber: 1},
+			allowedInitial:   false,
+			allowedHandshake: false,
+			allowedZeroRTT:   false,
+			allowedOneRTT:    true,
+		},
+		{
+			name:             "MAX_DATA_FRAME",
+			frameType:        FrameTypeMaxData,
+			frame:            &MaxDataFrame{MaximumData: 1},
+			allowedInitial:   false,
+			allowedHandshake: false,
+			allowedZeroRTT:   true,
+			allowedOneRTT:    true,
+		},
+		{
+			name:             "STREAM_FRAME",
+			frameType:        FrameType(0x8),
+			frame:            &StreamFrame{StreamID: 1, Data: []byte("foobar")},
+			allowedInitial:   false,
+			allowedHandshake: false,
+			allowedZeroRTT:   true,
+			allowedOneRTT:    true,
+		},
+		{
+			name:             "RESET_STREAM_AT",
+			frameType:        FrameTypeResetStreamAt,
+			frame:            &ResetStreamFrame{StreamID: 1, FinalSize: 1, ReliableSize: 1},
+			allowedInitial:   false,
+			allowedHandshake: false,
+			allowedZeroRTT:   true,
+			allowedOneRTT:    true,
+		},
+	} {
+		for _, encLevel := range []protocol.EncryptionLevel{
+			protocol.EncryptionInitial,
+			protocol.EncryptionHandshake,
+			protocol.Encryption0RTT,
+			protocol.Encryption1RTT,
+		} {
+			t.Run(fmt.Sprintf("%s/%v", tc.name, encLevel), func(t *testing.T) {
+				var allowed bool
+				switch encLevel {
+				case protocol.EncryptionInitial:
+					allowed = tc.allowedInitial
+				case protocol.EncryptionHandshake:
+					allowed = tc.allowedHandshake
+				case protocol.Encryption0RTT:
+					allowed = tc.allowedZeroRTT
+				case protocol.Encryption1RTT:
+					allowed = tc.allowedOneRTT
+				}
+
+				parser := NewFrameParser(true, true, true)
+				b, err := tc.frame.Append(nil, protocol.Version1)
+				require.NoError(t, err)
+				frameType, _, err := parser.ParseType(b, encLevel)
+				if allowed {
+					require.NoError(t, err)
+					require.Equal(t, tc.frameType, frameType)
+				} else {
+					require.Error(t, err)
+					var transportErr *qerr.TransportError
+					require.ErrorAs(t, err, &transportErr)
+					require.Equal(t, qerr.FrameEncodingError, transportErr.ErrorCode)
+				}
+			})
+		}
+	}
+}
+
+func TestFrameParserDatagramFrame(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	f := &DatagramFrame{
+		Data: []byte("foobar"),
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	frameType, l, err := parser.ParseType(b, protocol.Encryption1RTT)
+	require.NoError(t, err)
+	require.Equal(t, FrameTypeDatagramNoLength, frameType)
+	require.Equal(t, 1, l)
+
+	// ParseLessCommonFrame should not be used to handle DATAGRAM frames
+	_, _, err = parser.ParseLessCommonFrame(frameType, b[l:], protocol.Version1)
+	require.Error(t, err)
+
+	// parseDatagramFrame should be used for this type
+	datagramFrame, l, err := parser.ParseDatagramFrame(frameType, b[l:], protocol.Version1)
+	require.NoError(t, err)
+	require.IsType(t, &DatagramFrame{}, datagramFrame)
+	require.Equal(t, 6, l)
+	require.Equal(t, f.Data, datagramFrame.Data)
+}
+
+func TestFrameParserDatagramUnsupported(t *testing.T) {
+	parser := NewFrameParser(false, true, true)
+	f := &DatagramFrame{Data: []byte("foobar")}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+
+	_, _, err = parser.ParseType(b, protocol.Encryption1RTT)
+	checkFrameUnsupported(t, err, 0x30)
+}
+
+func TestFrameParserResetStreamAtUnsupported(t *testing.T) {
+	parser := NewFrameParser(true, false, true)
+	f := &ResetStreamFrame{StreamID: 0x1337, ReliableSize: 0x42, FinalSize: 0xdeadbeef}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+
+	_, _, err = parser.ParseType(b, protocol.Encryption1RTT)
+	checkFrameUnsupported(t, err, uint64(FrameTypeResetStreamAt))
+}
+
+func TestFrameParserAckFrequencyUnsupported(t *testing.T) {
+	parser := NewFrameParser(true, true, false)
+
+	t.Run("ACK_FREQUENCY", func(t *testing.T) {
+		f := &AckFrequencyFrame{
+			SequenceNumber:        1337,
+			AckElicitingThreshold: 42,
+			RequestMaxAckDelay:    42 * time.Millisecond,
+			ReorderingThreshold:   1234,
+		}
+		b, err := f.Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		_, _, err = parser.ParseType(b, protocol.Encryption1RTT)
+		checkFrameUnsupported(t, err, uint64(FrameTypeAckFrequency))
+	})
+
+	t.Run("IMMEDIATE_ACK", func(t *testing.T) {
+		f := &ImmediateAckFrame{}
+		b, err := f.Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		_, _, err = parser.ParseType(b, protocol.Encryption1RTT)
+		checkFrameUnsupported(t, err, uint64(FrameTypeImmediateAck))
+	})
+}
+
+func TestFrameParserInvalidFrameType(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+
+	_, l, err := parser.ParseType(encodeVarInt(0x42), protocol.Encryption1RTT)
+
+	require.Equal(t, 2, l)
+
+	require.Error(t, err)
+	var transportErr *qerr.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, qerr.FrameEncodingError, transportErr.ErrorCode)
+}
+
+func TestFrameParsingErrorsOnInvalidFrames(t *testing.T) {
+	parser := NewFrameParser(true, true, true)
+	f := &MaxStreamDataFrame{
+		StreamID:          0x1337,
+		MaximumStreamData: 0xdeadbeef,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+
+	frameType, l, err := parser.ParseType(b[:len(b)-2], protocol.Encryption1RTT)
+	require.NoError(t, err)
+	require.Equal(t, FrameTypeMaxStreamData, frameType)
+	require.Equal(t, 1, l)
+
+	_, _, err = parser.ParseLessCommonFrame(frameType, b[1:len(b)-2], protocol.Version1)
+	require.Error(t, err)
+	var transportErr *qerr.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, qerr.FrameEncodingError, transportErr.ErrorCode)
+}
+
+func writeFrames(tb testing.TB, frames ...Frame) []byte {
+	var b []byte
+	for _, f := range frames {
+		var err error
+		b, err = f.Append(b, protocol.Version1)
+		require.NoError(tb, err)
+	}
+	return b
+}
+
+// This function is used in benchmarks, and also to ensure zero allocation for STREAM frame parsing.
+// We can therefore not use the require framework, as it allocates.
+func parseFrames(tb testing.TB, parser *FrameParser, data []byte, frames ...Frame) {
+	for _, expectedFrame := range frames {
+		frameType, l, err := parser.ParseType(data, protocol.Encryption1RTT)
+		if err != nil {
+			tb.Fatal(err)
+		}
+		data = data[l:]
+
+		if frameType.IsStreamFrameType() {
+			sf := expectedFrame.(*StreamFrame)
+			frame, l, err := ParseStreamFrame(data, frameType, protocol.Version1)
+			if err != nil {
+				tb.Fatal(err)
+			}
+			if sf.StreamID != frame.StreamID || sf.Offset != frame.Offset {
+				tb.Fatalf("STREAM frame does not match: %v vs %v", sf, frame)
+			}
+			frame.PutBack()
+			data = data[l:]
+			continue
+		}
+
+		if frameType.IsAckFrameType() {
+			af, ok := expectedFrame.(*AckFrame)
+			if !ok {
+				tb.Fatalf("expected ACK, but got %v", expectedFrame)
+			}
+
+			f, l, err := parser.ParseAckFrame(frameType, data, protocol.Encryption1RTT, protocol.Version1)
+			if f.DelayTime != af.DelayTime || f.ECNCE != af.ECNCE || f.ECT0 != af.ECT0 || f.ECT1 != af.ECT1 {
+				tb.Fatal(err)
+			}
+			if f.DelayTime != af.DelayTime {
+				tb.Fatalf("ACK frame does not match: %v vs %v", af, f)
+			}
+			if !slices.Equal(f.AckRanges, af.AckRanges) {
+				tb.Fatalf("ACK frame ACK ranges don't match: %v vs %v", af, f)
+			}
+			data = data[l:]
+			continue
+		}
+
+		if frameType.IsDatagramFrameType() {
+			df, ok := expectedFrame.(*DatagramFrame)
+			if !ok {
+				tb.Fatalf("expected DATAGRAM, but got %v", expectedFrame)
+			}
+
+			f, l, err := parser.ParseDatagramFrame(frameType, data, protocol.Version1)
+			if err != nil {
+				tb.Fatal(err)
+			}
+			if df.DataLenPresent != f.DataLenPresent || !bytes.Equal(df.Data, f.Data) {
+				tb.Fatalf("DATAGRAM frame does not match: %v vs %v", df, f)
+			}
+			data = data[l:]
+			continue
+		}
+
+		f, l, err := parser.ParseLessCommonFrame(frameType, data, protocol.Version1)
+		if err != nil {
+			tb.Fatal(err)
+		}
+		data = data[l:]
+
+		switch frameType {
+		case FrameTypeMaxData:
+			mdf, ok := expectedFrame.(*MaxDataFrame)
+			if !ok {
+				tb.Fatalf("expected MAX_DATA, but got %v", expectedFrame)
+			}
+			if *f.(*MaxDataFrame) != *mdf {
+				tb.Fatalf("MAX_DATA frame does not match: %v vs %v", f, mdf)
+			}
+		case FrameTypeUniMaxStreams:
+			msf, ok := expectedFrame.(*MaxStreamsFrame)
+			if !ok {
+				tb.Fatalf("expected MAX_STREAMS, but got %v", expectedFrame)
+			}
+			if *f.(*MaxStreamsFrame) != *msf {
+				tb.Fatalf("MAX_STREAMS frame does not match: %v vs %v", f, msf)
+			}
+		case FrameTypeMaxStreamData:
+			mdf, ok := expectedFrame.(*MaxStreamDataFrame)
+			if !ok {
+				tb.Fatalf("expected MAX_STREAM_DATA, but got %v", expectedFrame)
+			}
+			if *f.(*MaxStreamDataFrame) != *mdf {
+				tb.Fatalf("MAX_STREAM_DATA frame does not match: %v vs %v", f, mdf)
+			}
+		case FrameTypeCrypto:
+			cf, ok := expectedFrame.(*CryptoFrame)
+			if !ok {
+				tb.Fatalf("expected CRYPTO, but got %v", expectedFrame)
+			}
+			frame := f.(*CryptoFrame)
+			if frame.Offset != cf.Offset || !bytes.Equal(frame.Data, cf.Data) {
+				tb.Fatalf("CRYPTO frame does not match: %v vs %v", f, cf)
+			}
+		case FrameTypePing:
+			_ = f.(*PingFrame)
+		case FrameTypeResetStream:
+			rsf, ok := expectedFrame.(*ResetStreamFrame)
+			if !ok {
+				tb.Fatalf("expected RESET_STREAM, but got %v", expectedFrame)
+			}
+			if *f.(*ResetStreamFrame) != *rsf {
+				tb.Fatalf("RESET_STREAM frame does not match: %v vs %v", f, rsf)
+			}
+			continue
+		default:
+			tb.Fatalf("Frame type not supported in benchmark or should not occur: %v", frameType)
+		}
+	}
+}
+
+func TestFrameParserAllocs(t *testing.T) {
+	t.Run("STREAM", func(t *testing.T) {
+		var frames []Frame
+		for i := range 10 {
+			frames = append(frames, &StreamFrame{
+				StreamID:       protocol.StreamID(1337 + i),
+				Offset:         protocol.ByteCount(1e7 + i),
+				Data:           make([]byte, 200+i),
+				DataLenPresent: true,
+			})
+		}
+		require.Zero(t, testFrameParserAllocs(t, frames))
+	})
+
+	t.Run("ACK", func(t *testing.T) {
+		var frames []Frame
+		for i := range 10 {
+			frames = append(frames, &AckFrame{
+				AckRanges: []AckRange{
+					{Smallest: protocol.PacketNumber(5000 + i), Largest: protocol.PacketNumber(5200 + i)},
+					{Smallest: protocol.PacketNumber(1 + i), Largest: protocol.PacketNumber(4200 + i)},
+				},
+				DelayTime: time.Duration(int64(time.Millisecond) * int64(i)),
+				ECT0:      uint64(5000 + i),
+				ECT1:      uint64(i),
+				ECNCE:     uint64(10 + i),
+			})
+		}
+		require.Zero(t, testFrameParserAllocs(t, frames))
+	})
+}
+
+func testFrameParserAllocs(t *testing.T, frames []Frame) float64 {
+	buf := writeFrames(t, frames...)
+	parser := NewFrameParser(true, true, true)
+	parser.SetAckDelayExponent(3)
+
+	return testing.AllocsPerRun(100, func() {
+		parseFrames(t, parser, buf, frames...)
+	})
+}
+
+func BenchmarkParseOtherFrames(b *testing.B) {
+	frames := []Frame{
+		&MaxDataFrame{MaximumData: 123456},
+		&MaxStreamsFrame{MaxStreamNum: 10},
+		&MaxStreamDataFrame{StreamID: 1337, MaximumStreamData: 1e6},
+		&CryptoFrame{Offset: 1000, Data: make([]byte, 128)},
+		&PingFrame{},
+		&ResetStreamFrame{StreamID: 87654, ErrorCode: 1234, FinalSize: 1e8},
+	}
+	benchmarkFrames(b, frames...)
+}
+
+func BenchmarkParseAckFrame(b *testing.B) {
+	var frames []Frame
+	for i := range 10 {
+		frames = append(frames, &AckFrame{
+			AckRanges: []AckRange{
+				{Smallest: protocol.PacketNumber(5000 + i), Largest: protocol.PacketNumber(5200 + i)},
+				{Smallest: protocol.PacketNumber(1 + i), Largest: protocol.PacketNumber(4200 + i)},
+			},
+			DelayTime: time.Duration(int64(time.Millisecond) * int64(i)),
+			ECT0:      uint64(5000 + i),
+			ECT1:      uint64(i),
+			ECNCE:     uint64(10 + i),
+		})
+	}
+	benchmarkFrames(b, frames...)
+}
+
+func BenchmarkParseStreamFrame(b *testing.B) {
+	var frames []Frame
+	for i := range 10 {
+		data := make([]byte, 200+i)
+		rand.Read(data)
+		frames = append(frames, &StreamFrame{
+			StreamID:       protocol.StreamID(1337 + i),
+			Offset:         protocol.ByteCount(1e7 + i),
+			Data:           data,
+			DataLenPresent: true,
+		})
+	}
+	benchmarkFrames(b, frames...)
+}
+
+func BenchmarkParseDatagramFrame(b *testing.B) {
+	var frames []Frame
+	for i := range 10 {
+		data := make([]byte, 200+i)
+		rand.Read(data)
+		frames = append(frames, &DatagramFrame{
+			Data:           data,
+			DataLenPresent: true,
+		})
+	}
+	benchmarkFrames(b, frames...)
+}
+
+func benchmarkFrames(b *testing.B, frames ...Frame) {
+	b.ReportAllocs()
+
+	buf := writeFrames(b, frames...)
+	parser := NewFrameParser(true, true, true)
+	parser.SetAckDelayExponent(3)
+
+	for b.Loop() {
+		parseFrames(b, parser, buf, frames...)
+	}
+}
+
+func FuzzFrames(f *testing.F) {
+	corpus := ossfuzzseeds.New(f)
+
+	const version = protocol.Version1
+
+	for _, s := range []struct {
+		encLevel protocol.EncryptionLevel
+		frame    Frame
+	}{
+		{encLevel: protocol.EncryptionInitial, frame: &PingFrame{}},
+		{encLevel: protocol.EncryptionHandshake, frame: &PingFrame{}},
+		{encLevel: protocol.Encryption0RTT, frame: &PingFrame{}},
+		{encLevel: protocol.EncryptionInitial, frame: &CryptoFrame{Offset: 42, Data: []byte("initial crypto")}},
+		{encLevel: protocol.EncryptionHandshake, frame: &CryptoFrame{Offset: 123, Data: []byte("handshake crypto")}},
+		{encLevel: protocol.EncryptionInitial, frame: &AckFrame{AckRanges: []AckRange{{Smallest: 1, Largest: 10}}}},
+		{encLevel: protocol.EncryptionHandshake, frame: &AckFrame{AckRanges: []AckRange{{Smallest: 1, Largest: 10}}}},
+	} {
+		b, err := s.frame.Append(nil, version)
+		require.NoError(f, err)
+		corpus.Add(uint8(s.encLevel), uint16(protocol.MaxPacketBufferSize), b)
+	}
+
+	for _, fr := range []Frame{
+		&PingFrame{},
+		&StreamFrame{StreamID: 0x42, Fin: true},
+		&StreamFrame{StreamID: 0x42, Data: []byte("foobar"), Fin: true},
+		&StreamFrame{StreamID: 0x1337, Offset: 0xcafe, Data: []byte("foobar")},
+		&StreamFrame{Offset: quicvarint.Max, Data: []byte("foo")}, // exceeds maximum offset
+		&AckFrame{AckRanges: []AckRange{{Smallest: 1, Largest: 0x13}}},
+		&AckFrame{
+			AckRanges: []AckRange{{Smallest: 80, Largest: 100}, {Smallest: 1, Largest: 50}},
+			DelayTime: time.Millisecond,
+			ECT0:      42,
+			ECT1:      13,
+			ECNCE:     7,
+		},
+		&ResetStreamFrame{StreamID: 0x1337, ErrorCode: 0x42, FinalSize: 0xdead},
+		&StopSendingFrame{StreamID: 0x42, ErrorCode: 0x1337},
+		&CryptoFrame{Offset: 0x1337, Data: []byte("crypto data")},
+		&NewTokenFrame{Token: []byte("token")},
+		&MaxDataFrame{MaximumData: 0xcafe},
+		&MaxStreamDataFrame{StreamID: 0xdead, MaximumStreamData: 0xbeef},
+		&MaxStreamsFrame{Type: protocol.StreamTypeBidi, MaxStreamNum: 0x42},
+		&MaxStreamsFrame{Type: protocol.StreamTypeUni, MaxStreamNum: 0x42},
+		&DataBlockedFrame{MaximumData: 0x1234},
+		&StreamDataBlockedFrame{StreamID: 0xdead, MaximumStreamData: 0xbeef},
+		&StreamsBlockedFrame{Type: protocol.StreamTypeBidi, StreamLimit: 0x42},
+		&StreamsBlockedFrame{Type: protocol.StreamTypeUni, StreamLimit: 0x42},
+		&NewConnectionIDFrame{
+			SequenceNumber:      0x42,
+			ConnectionID:        protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+			StatelessResetToken: protocol.StatelessResetToken{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15},
+		},
+		&RetireConnectionIDFrame{SequenceNumber: 0x42},
+		&PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}},
+		&PathResponseFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}},
+		&ConnectionCloseFrame{ErrorCode: 0x42, ReasonPhrase: "foobar"},
+		&ConnectionCloseFrame{IsApplicationError: true, ErrorCode: 0x42, ReasonPhrase: "foobar"},
+		&HandshakeDoneFrame{},
+		&DatagramFrame{Data: []byte("datagram")},
+		&ResetStreamFrame{StreamID: 0x1337, ReliableSize: 0x42, FinalSize: 0xdead},
+		&AckFrequencyFrame{
+			SequenceNumber:        0x42,
+			AckElicitingThreshold: 10,
+			RequestMaxAckDelay:    25 * time.Millisecond,
+			ReorderingThreshold:   5,
+		},
+		&ImmediateAckFrame{},
+	} {
+		b, err := fr.Append(nil, version)
+		require.NoError(f, err)
+		maxSize := uint16(protocol.MaxPacketBufferSize)
+		switch fr.(type) {
+		case *StreamFrame, *DatagramFrame:
+			maxSize = 256
+		case *AckFrame:
+			maxSize = 128
+		}
+		corpus.Add(uint8(protocol.Encryption1RTT), maxSize, b)
+	}
+
+	f.Fuzz(func(t *testing.T, encLevelRaw uint8, maxSize uint16, data []byte) {
+		encLevel := protocol.EncryptionLevel(encLevelRaw)
+		if encLevel != protocol.EncryptionInitial && encLevel != protocol.EncryptionHandshake && encLevel != protocol.Encryption1RTT && encLevel != protocol.Encryption0RTT {
+			return
+		}
+		// maxSize is used to split off frames from the original frame (in the case of CRYPTO and STREAM frames),
+		// and to truncate ACK frames.
+		// This happens at the packet boundary, so values larger than the packet size are not interesting.
+		if maxSize > 10_000 {
+			return
+		}
+
+		parser := NewFrameParser(true, true, true)
+		parser.SetAckDelayExponent(protocol.DefaultAckDelayExponent)
+
+		var b []byte
+		for len(data) > 0 {
+			initialLen := len(data)
+			frameType, l, err := parser.ParseType(data, encLevel)
+			if err != nil {
+				return
+			}
+			data = data[l:]
+
+			var frame Frame
+			switch {
+			case frameType.IsStreamFrameType():
+				frame, l, err = parser.ParseStreamFrame(frameType, data, version)
+			case frameType.IsAckFrameType():
+				frame, l, err = parser.ParseAckFrame(frameType, data, encLevel, version)
+			case frameType == FrameTypeDatagramNoLength || frameType == FrameTypeDatagramWithLength:
+				frame, l, err = parser.ParseDatagramFrame(frameType, data, version)
+			default:
+				frame, l, err = parser.ParseLessCommonFrame(frameType, data, version)
+			}
+			if err != nil {
+				return
+			}
+			data = data[l:]
+			IsProbingFrame(frame)
+
+			if sf, ok := frame.(*StreamFrame); ok {
+				if sf.DataLen() == 0 {
+					sf.PutBack()
+					continue
+				}
+			}
+			checkFrameInvariants(t, frame)
+
+			startLen := len(b)
+			parsedLen := initialLen - len(data)
+			b, err = frame.Append(b, version)
+			require.NoError(t, err)
+			frameLen := protocol.ByteCount(len(b) - startLen)
+			require.Equal(t, frameLen, frame.Length(version), "re-serialized frame")
+			size := protocol.ByteCount(maxSize)
+			switch f := frame.(type) {
+			case *StreamFrame:
+				orig := slices.Clone(f.Data)
+				split, needsSplit := f.MaybeSplitOffFrame(size, version)
+				if split != nil {
+					require.LessOrEqual(t, split.Length(version), size, "split STREAM frame")
+					require.Equal(t, orig, append(slices.Clone(split.Data), f.Data...), "split STREAM frame data")
+					split.PutBack()
+				} else {
+					require.True(t, needsSplit || f.Length(version) <= size, "STREAM longer than maxSize but not split: len=%d maxSize=%d", f.Length(version), size)
+				}
+			case *CryptoFrame:
+				orig := slices.Clone(f.Data)
+				split, needsSplit := f.MaybeSplitOffFrame(size, version)
+				if split != nil {
+					require.LessOrEqual(t, split.Length(version), size, "split CRYPTO frame")
+					require.Equal(t, orig, append(slices.Clone(split.Data), f.Data...), "split CRYPTO frame data")
+				} else {
+					require.True(t, needsSplit || f.Length(version) <= size, "CRYPTO longer than maxSize but not split: len=%d maxSize=%d", f.Length(version), size)
+				}
+			case *AckFrame:
+				f.HasMissingRanges()
+				// Truncate requires maxSize to fit at least one ACK range;
+				// 64 bytes covers the worst case (8-byte varints, with ECN).
+				if size >= 64 {
+					f.Truncate(size, version)
+					require.LessOrEqual(t, f.Length(version), size, "truncated ACK")
+					checkFrameInvariants(t, f)
+				}
+			case *DatagramFrame:
+				if n := f.MaxDataLen(size, version); n > 0 && protocol.ByteCount(len(f.Data)) > n {
+					orig := f.Data
+					f.Data = f.Data[:n]
+					require.LessOrEqual(t, f.Length(version), size, "DATAGRAM with MaxDataLen")
+					f.Data = orig
+				}
+			}
+			if sf, ok := frame.(*StreamFrame); ok {
+				sf.PutBack()
+			}
+			require.LessOrEqual(t, frameLen, protocol.ByteCount(parsedLen), "serialized length vs parsed length")
+		}
+	})
+}
+
+func checkFrameInvariants(t *testing.T, frame Frame) {
+	t.Helper()
+
+	switch f := frame.(type) {
+	case *StreamFrame:
+		if protocol.ByteCount(len(f.Data)) != f.DataLen() {
+			t.Fatal("STREAM frame: inconsistent data length")
+		}
+	case *AckFrame:
+		if f.DelayTime < 0 {
+			t.Fatalf("invalid ACK delay_time: %s", f.DelayTime)
+		}
+		if f.LargestAcked() < f.LowestAcked() {
+			t.Fatal("ACK: largest acknowledged is smaller than lowest acknowledged")
+		}
+		for _, r := range f.AckRanges {
+			if r.Largest < 0 || r.Smallest < 0 {
+				t.Fatal("ACK range contains a negative packet number")
+			}
+		}
+		if !f.AcksPacket(f.LargestAcked()) {
+			t.Fatal("ACK frame claims that largest acknowledged is not acknowledged")
+		}
+		if !f.AcksPacket(f.LowestAcked()) {
+			t.Fatal("ACK frame claims that lowest acknowledged is not acknowledged")
+		}
+		_ = f.AcksPacket(100)
+		_ = f.AcksPacket((f.LargestAcked() + f.LowestAcked()) / 2)
+	case *NewConnectionIDFrame:
+		if f.ConnectionID.Len() < 1 || f.ConnectionID.Len() > 20 {
+			t.Fatalf("invalid NEW_CONNECTION_ID frame length: %s", f.ConnectionID)
+		}
+	case *NewTokenFrame:
+		if len(f.Token) == 0 {
+			t.Fatal("NEW_TOKEN frame with an empty token")
+		}
+	case *MaxStreamsFrame:
+		if f.MaxStreamNum > protocol.MaxStreamCount {
+			t.Fatal("MAX_STREAMS frame with an invalid Maximum Streams value")
+		}
+	case *StreamsBlockedFrame:
+		if f.StreamLimit > protocol.MaxStreamCount {
+			t.Fatal("STREAMS_BLOCKED frame with an invalid Maximum Streams value")
+		}
+	case *ConnectionCloseFrame:
+		if f.IsApplicationError && f.FrameType != 0 {
+			t.Fatal("CONNECTION_CLOSE for an application error containing a frame type")
+		}
+	case *ResetStreamFrame:
+		if f.FinalSize < f.ReliableSize {
+			t.Fatal("RESET_STREAM frame with a FinalSize smaller than the ReliableSize")
+		}
+	case *AckFrequencyFrame:
+		if f.RequestMaxAckDelay < 0 {
+			t.Fatal("ACK_FREQUENCY frame with a negative RequestMaxAckDelay")
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_test.go
new file mode 100644
index 000000000..5dbfba896
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_test.go
@@ -0,0 +1,42 @@
+package wire
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestProbingFrames(t *testing.T) {
+	testCases := map[Frame]bool{
+		&AckFrame{}:             false,
+		&ConnectionCloseFrame{}: false,
+		&DataBlockedFrame{}:     false,
+		&PingFrame{}:            false,
+		&ResetStreamFrame{}:     false,
+		&StreamFrame{}:          false,
+		&DatagramFrame{}:        false,
+		&MaxDataFrame{}:         false,
+		&MaxStreamDataFrame{}:   false,
+		&StopSendingFrame{}:     false,
+		&PathChallengeFrame{}:   true,
+		&PathResponseFrame{}:    true,
+		&NewConnectionIDFrame{}: true,
+	}
+
+	for f, expected := range testCases {
+		require.Equal(t, expected, IsProbingFrame(f))
+	}
+}
+
+func TestIsProbingFrameType(t *testing.T) {
+	tests := map[FrameType]bool{
+		FrameTypePathChallenge:   true,
+		FrameTypePathResponse:    true,
+		FrameTypeNewConnectionID: true,
+		FrameType(0x01):          false,
+		FrameType(0xFF):          false,
+	}
+	for ft, expected := range tests {
+		require.Equal(t, expected, IsProbingFrameType(ft))
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/frame_type.go b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_type.go
new file mode 100644
index 000000000..597523f6d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_type.go
@@ -0,0 +1,81 @@
+package wire
+
+import "github.com/quic-go/quic-go/internal/protocol"
+
+type FrameType uint64
+
+// These constants correspond to those defined in RFC 9000.
+// Stream frame types are not listed explicitly here; use FrameType.IsStreamFrameType() to identify them.
+const (
+	FrameTypePing        FrameType = 0x1
+	FrameTypeAck         FrameType = 0x2
+	FrameTypeAckECN      FrameType = 0x3
+	FrameTypeResetStream FrameType = 0x4
+	FrameTypeStopSending FrameType = 0x5
+	FrameTypeCrypto      FrameType = 0x6
+	FrameTypeNewToken    FrameType = 0x7
+
+	FrameTypeMaxData            FrameType = 0x10
+	FrameTypeMaxStreamData      FrameType = 0x11
+	FrameTypeBidiMaxStreams     FrameType = 0x12
+	FrameTypeUniMaxStreams      FrameType = 0x13
+	FrameTypeDataBlocked        FrameType = 0x14
+	FrameTypeStreamDataBlocked  FrameType = 0x15
+	FrameTypeBidiStreamBlocked  FrameType = 0x16
+	FrameTypeUniStreamBlocked   FrameType = 0x17
+	FrameTypeNewConnectionID    FrameType = 0x18
+	FrameTypeRetireConnectionID FrameType = 0x19
+	FrameTypePathChallenge      FrameType = 0x1a
+	FrameTypePathResponse       FrameType = 0x1b
+	FrameTypeConnectionClose    FrameType = 0x1c
+	FrameTypeApplicationClose   FrameType = 0x1d
+	FrameTypeHandshakeDone      FrameType = 0x1e
+	// https://datatracker.ietf.org/doc/draft-ietf-quic-reliable-stream-reset/09/
+	FrameTypeResetStreamAt FrameType = 0x24
+	// https://datatracker.ietf.org/doc/draft-ietf-quic-ack-frequency/11/
+	FrameTypeAckFrequency FrameType = 0xaf
+	FrameTypeImmediateAck FrameType = 0x1f
+
+	FrameTypeDatagramNoLength   FrameType = 0x30
+	FrameTypeDatagramWithLength FrameType = 0x31
+)
+
+func (t FrameType) IsStreamFrameType() bool {
+	return t >= 0x8 && t <= 0xf
+}
+
+func (t FrameType) isValidRFC9000() bool {
+	return t <= 0x1e
+}
+
+func (t FrameType) IsAckFrameType() bool {
+	return t == FrameTypeAck || t == FrameTypeAckECN
+}
+
+func (t FrameType) IsDatagramFrameType() bool {
+	return t == FrameTypeDatagramNoLength || t == FrameTypeDatagramWithLength
+}
+
+func (t FrameType) isAllowedAtEncLevel(encLevel protocol.EncryptionLevel) bool {
+	//nolint:exhaustive
+	switch encLevel {
+	case protocol.EncryptionInitial, protocol.EncryptionHandshake:
+		switch t {
+		case FrameTypeCrypto, FrameTypeAck, FrameTypeAckECN, FrameTypeConnectionClose, FrameTypePing:
+			return true
+		default:
+			return false
+		}
+	case protocol.Encryption0RTT:
+		switch t {
+		case FrameTypeCrypto, FrameTypeAck, FrameTypeAckECN, FrameTypeConnectionClose, FrameTypeNewToken, FrameTypePathResponse, FrameTypeRetireConnectionID:
+			return false
+		default:
+			return true
+		}
+	case protocol.Encryption1RTT:
+		return true
+	default:
+		panic("unknown encryption level")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/frame_type_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_type_test.go
new file mode 100644
index 000000000..2702af379
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/frame_type_test.go
@@ -0,0 +1,29 @@
+package wire
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsStreamFrameType(t *testing.T) {
+	for i := 0x08; i <= 0x0f; i++ {
+		require.Truef(t, FrameType(i).IsStreamFrameType(), "FrameType(0x%x).IsStreamFrameType() = false, want true", i)
+	}
+
+	require.False(t, FrameType(0x1).IsStreamFrameType())
+}
+
+func TestIsAckFrameType(t *testing.T) {
+	require.True(t, FrameTypeAck.IsAckFrameType(), "AckFrameType should be recognized as ACK")
+	require.True(t, FrameTypeAckECN.IsAckFrameType(), "AckECNFrameType should be recognized as ACK")
+	require.False(t, FrameTypePing.IsAckFrameType(), "PingFrameType should not be recognized as ACK")
+	require.False(t, FrameType(0x10).IsAckFrameType(), "MaxDataFrameType should not be recognized as ACK")
+}
+
+func TestIsDatagramFrameType(t *testing.T) {
+	require.True(t, FrameTypeDatagramNoLength.IsDatagramFrameType(), "DatagramNoLengthFrameType should be recognized as DATAGRAM")
+	require.True(t, FrameTypeDatagramWithLength.IsDatagramFrameType(), "DatagramWithLengthFrameType should be recognized as DATAGRAM")
+	require.False(t, FrameTypePing.IsDatagramFrameType(), "PingFrameType should not be recognized as DATAGRAM")
+	require.False(t, FrameType(0x1e).IsDatagramFrameType(), "HandshakeDoneFrameType should not be recognized as DATAGRAM")
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/handshake_done_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/handshake_done_frame.go
new file mode 100644
index 000000000..bf95f525b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/handshake_done_frame.go
@@ -0,0 +1,17 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// A HandshakeDoneFrame is a HANDSHAKE_DONE frame
+type HandshakeDoneFrame struct{}
+
+func (f *HandshakeDoneFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	return append(b, byte(FrameTypeHandshakeDone)), nil
+}
+
+// Length of a written frame
+func (f *HandshakeDoneFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return 1
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/handshake_done_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/handshake_done_frame_test.go
new file mode 100644
index 000000000..bec44ec97
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/handshake_done_frame_test.go
@@ -0,0 +1,16 @@
+package wire
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWriteHandshakeDoneSampleFrame(t *testing.T) {
+	frame := HandshakeDoneFrame{}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, []byte{byte(FrameTypeHandshakeDone)}, b)
+	require.Equal(t, protocol.ByteCount(1), frame.Length(protocol.Version1))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/header.go b/electron/native/private-transport/third_party/quic-go/internal/wire/header.go
new file mode 100644
index 000000000..678a04a24
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/header.go
@@ -0,0 +1,302 @@
+package wire
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// ParseConnectionID parses the destination connection ID of a packet.
+func ParseConnectionID(data []byte, shortHeaderConnIDLen int) (protocol.ConnectionID, error) {
+	if len(data) == 0 {
+		return protocol.ConnectionID{}, io.EOF
+	}
+	if !IsLongHeaderPacket(data[0]) {
+		if len(data) < shortHeaderConnIDLen+1 {
+			return protocol.ConnectionID{}, io.EOF
+		}
+		return protocol.ParseConnectionID(data[1 : 1+shortHeaderConnIDLen]), nil
+	}
+	if len(data) < 6 {
+		return protocol.ConnectionID{}, io.EOF
+	}
+	destConnIDLen := int(data[5])
+	if destConnIDLen > protocol.MaxConnIDLen {
+		return protocol.ConnectionID{}, protocol.ErrInvalidConnectionIDLen
+	}
+	if len(data) < 6+destConnIDLen {
+		return protocol.ConnectionID{}, io.EOF
+	}
+	return protocol.ParseConnectionID(data[6 : 6+destConnIDLen]), nil
+}
+
+// ParseArbitraryLenConnectionIDs parses the most general form of a Long Header packet,
+// using only the version-independent packet format as described in Section 5.1 of RFC 8999:
+// https://datatracker.ietf.org/doc/html/rfc8999#section-5.1.
+// This function should only be called on Long Header packets for which we don't support the version.
+func ParseArbitraryLenConnectionIDs(data []byte) (bytesParsed int, dest, src protocol.ArbitraryLenConnectionID, _ error) {
+	startLen := len(data)
+	if len(data) < 6 {
+		return 0, nil, nil, io.EOF
+	}
+	data = data[5:] // skip first byte and version field
+	destConnIDLen := data[0]
+	data = data[1:]
+	destConnID := make(protocol.ArbitraryLenConnectionID, destConnIDLen)
+	if len(data) < int(destConnIDLen)+1 {
+		return 0, nil, nil, io.EOF
+	}
+	copy(destConnID, data)
+	data = data[destConnIDLen:]
+	srcConnIDLen := data[0]
+	data = data[1:]
+	if len(data) < int(srcConnIDLen) {
+		return 0, nil, nil, io.EOF
+	}
+	srcConnID := make(protocol.ArbitraryLenConnectionID, srcConnIDLen)
+	copy(srcConnID, data)
+	return startLen - len(data) + int(srcConnIDLen), destConnID, srcConnID, nil
+}
+
+func IsPotentialQUICPacket(firstByte byte) bool {
+	return firstByte&0x40 > 0
+}
+
+// IsLongHeaderPacket says if this is a Long Header packet
+func IsLongHeaderPacket(firstByte byte) bool {
+	return firstByte&0x80 > 0
+}
+
+// ParseVersion parses the QUIC version.
+// It should only be called for Long Header packets (Short Header packets don't contain a version number).
+func ParseVersion(data []byte) (protocol.Version, error) {
+	if len(data) < 5 {
+		return 0, io.EOF
+	}
+	return protocol.Version(binary.BigEndian.Uint32(data[1:5])), nil
+}
+
+// IsVersionNegotiationPacket says if this is a version negotiation packet
+func IsVersionNegotiationPacket(b []byte) bool {
+	if len(b) < 5 {
+		return false
+	}
+	return IsLongHeaderPacket(b[0]) && b[1] == 0 && b[2] == 0 && b[3] == 0 && b[4] == 0
+}
+
+// Is0RTTPacket says if this is a 0-RTT packet.
+// A packet sent with a version we don't understand can never be a 0-RTT packet.
+func Is0RTTPacket(b []byte) bool {
+	if len(b) < 5 {
+		return false
+	}
+	if !IsLongHeaderPacket(b[0]) {
+		return false
+	}
+	version := protocol.Version(binary.BigEndian.Uint32(b[1:5]))
+	//nolint:exhaustive // We only need to test QUIC versions that we support.
+	switch version {
+	case protocol.Version1:
+		return b[0]>>4&0b11 == 0b01
+	case protocol.Version2:
+		return b[0]>>4&0b11 == 0b10
+	default:
+		return false
+	}
+}
+
+var ErrUnsupportedVersion = errors.New("unsupported version")
+
+// The Header is the version independent part of the header
+type Header struct {
+	typeByte byte
+	Type     protocol.PacketType
+
+	Version          protocol.Version
+	SrcConnectionID  protocol.ConnectionID
+	DestConnectionID protocol.ConnectionID
+
+	Length protocol.ByteCount
+
+	Token []byte
+
+	parsedLen protocol.ByteCount // how many bytes were read while parsing this header
+}
+
+// ParsePacket parses a long header packet.
+// The packet is cut according to the length field.
+// If we understand the version, the packet is parsed up unto the packet number.
+// Otherwise, only the invariant part of the header is parsed.
+func ParsePacket(data []byte) (*Header, []byte, []byte, error) {
+	if len(data) == 0 || !IsLongHeaderPacket(data[0]) {
+		return nil, nil, nil, errors.New("not a long header packet")
+	}
+	hdr, err := parseHeader(data)
+	if err != nil {
+		if errors.Is(err, ErrUnsupportedVersion) {
+			return hdr, nil, nil, err
+		}
+		return nil, nil, nil, err
+	}
+	if protocol.ByteCount(len(data)) < hdr.ParsedLen()+hdr.Length {
+		return nil, nil, nil, fmt.Errorf("packet length (%d bytes) is smaller than the expected length (%d bytes)", len(data)-int(hdr.ParsedLen()), hdr.Length)
+	}
+	packetLen := int(hdr.ParsedLen() + hdr.Length)
+	return hdr, data[:packetLen], data[packetLen:], nil
+}
+
+// ParseHeader parses the header:
+// * if we understand the version: up to the packet number
+// * if not, only the invariant part of the header
+func parseHeader(b []byte) (*Header, error) {
+	if len(b) == 0 {
+		return nil, io.EOF
+	}
+	typeByte := b[0]
+
+	h := &Header{typeByte: typeByte}
+	l, err := h.parseLongHeader(b[1:])
+	h.parsedLen = protocol.ByteCount(l) + 1
+	return h, err
+}
+
+func (h *Header) parseLongHeader(b []byte) (int, error) {
+	startLen := len(b)
+	if len(b) < 5 {
+		return 0, io.EOF
+	}
+	h.Version = protocol.Version(binary.BigEndian.Uint32(b[:4]))
+	if h.Version != 0 && h.typeByte&0x40 == 0 {
+		return startLen - len(b), errors.New("not a QUIC packet")
+	}
+	destConnIDLen := int(b[4])
+	if destConnIDLen > protocol.MaxConnIDLen {
+		return startLen - len(b), protocol.ErrInvalidConnectionIDLen
+	}
+	b = b[5:]
+	if len(b) < destConnIDLen+1 {
+		return startLen - len(b), io.EOF
+	}
+	h.DestConnectionID = protocol.ParseConnectionID(b[:destConnIDLen])
+	srcConnIDLen := int(b[destConnIDLen])
+	if srcConnIDLen > protocol.MaxConnIDLen {
+		return startLen - len(b), protocol.ErrInvalidConnectionIDLen
+	}
+	b = b[destConnIDLen+1:]
+	if len(b) < srcConnIDLen {
+		return startLen - len(b), io.EOF
+	}
+	h.SrcConnectionID = protocol.ParseConnectionID(b[:srcConnIDLen])
+	b = b[srcConnIDLen:]
+	if h.Version == 0 { // version negotiation packet
+		return startLen - len(b), nil
+	}
+	// If we don't understand the version, we have no idea how to interpret the rest of the bytes
+	if !protocol.IsSupportedVersion(protocol.SupportedVersions, h.Version) {
+		return startLen - len(b), ErrUnsupportedVersion
+	}
+
+	if h.Version == protocol.Version2 {
+		switch h.typeByte >> 4 & 0b11 {
+		case 0b00:
+			h.Type = protocol.PacketTypeRetry
+		case 0b01:
+			h.Type = protocol.PacketTypeInitial
+		case 0b10:
+			h.Type = protocol.PacketType0RTT
+		case 0b11:
+			h.Type = protocol.PacketTypeHandshake
+		}
+	} else {
+		switch h.typeByte >> 4 & 0b11 {
+		case 0b00:
+			h.Type = protocol.PacketTypeInitial
+		case 0b01:
+			h.Type = protocol.PacketType0RTT
+		case 0b10:
+			h.Type = protocol.PacketTypeHandshake
+		case 0b11:
+			h.Type = protocol.PacketTypeRetry
+		}
+	}
+
+	if h.Type == protocol.PacketTypeRetry {
+		tokenLen := len(b) - 16
+		if tokenLen <= 0 {
+			return startLen - len(b), io.EOF
+		}
+		h.Token = make([]byte, tokenLen)
+		copy(h.Token, b[:tokenLen])
+		return startLen - len(b) + tokenLen + 16, nil
+	}
+
+	if h.Type == protocol.PacketTypeInitial {
+		tokenLen, n, err := quicvarint.Parse(b)
+		if err != nil {
+			return startLen - len(b), err
+		}
+		b = b[n:]
+		if tokenLen > uint64(len(b)) {
+			return startLen - len(b), io.EOF
+		}
+		h.Token = make([]byte, tokenLen)
+		copy(h.Token, b[:tokenLen])
+		b = b[tokenLen:]
+	}
+
+	pl, n, err := quicvarint.Parse(b)
+	if err != nil {
+		return 0, err
+	}
+	h.Length = protocol.ByteCount(pl)
+	return startLen - len(b) + n, nil
+}
+
+// ParsedLen returns the number of bytes that were consumed when parsing the header
+func (h *Header) ParsedLen() protocol.ByteCount {
+	return h.parsedLen
+}
+
+// ParseExtended parses the version dependent part of the header.
+// The Reader has to be set such that it points to the first byte of the header.
+func (h *Header) ParseExtended(data []byte) (*ExtendedHeader, error) {
+	extHdr := h.toExtendedHeader()
+	reservedBitsValid, err := extHdr.parse(data)
+	if err != nil {
+		return nil, err
+	}
+	if !reservedBitsValid {
+		return extHdr, ErrInvalidReservedBits
+	}
+	return extHdr, nil
+}
+
+func (h *Header) toExtendedHeader() *ExtendedHeader {
+	return &ExtendedHeader{Header: *h}
+}
+
+// PacketType is the type of the packet, for logging purposes
+func (h *Header) PacketType() string {
+	return h.Type.String()
+}
+
+func readPacketNumber(data []byte, pnLen protocol.PacketNumberLen) (protocol.PacketNumber, error) {
+	var pn protocol.PacketNumber
+	switch pnLen {
+	case protocol.PacketNumberLen1:
+		pn = protocol.PacketNumber(data[0])
+	case protocol.PacketNumberLen2:
+		pn = protocol.PacketNumber(binary.BigEndian.Uint16(data[:2]))
+	case protocol.PacketNumberLen3:
+		pn = protocol.PacketNumber(uint32(data[2]) + uint32(data[1])<<8 + uint32(data[0])<<16)
+	case protocol.PacketNumberLen4:
+		pn = protocol.PacketNumber(binary.BigEndian.Uint32(data[:4]))
+	default:
+		return 0, fmt.Errorf("invalid packet number length: %d", pnLen)
+	}
+	return pn, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/header_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/header_test.go
new file mode 100644
index 000000000..21323f490
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/header_test.go
@@ -0,0 +1,793 @@
+package wire
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/binary"
+	"io"
+	mrand "math/rand/v2"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+
+	ossfuzzseeds "github.com/quic-go/go-ossfuzz-seeds"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseConnIDLongHeaderPacket(t *testing.T) {
+	b, err := (&ExtendedHeader{
+		Header: Header{
+			Type:             protocol.PacketTypeHandshake,
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6}),
+			Version:          protocol.Version1,
+		},
+		PacketNumberLen: 2,
+	}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	connID, err := ParseConnectionID(b, 8)
+	require.NoError(t, err)
+	require.Equal(t, protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}), connID)
+}
+
+func TestParseConnIDTooLong(t *testing.T) {
+	b := []byte{0x80, 0, 0, 0, 0}
+	binary.BigEndian.PutUint32(b[1:], uint32(protocol.Version1))
+	b = append(b, 21) // dest conn id len
+	b = append(b, make([]byte, 21)...)
+	_, err := ParseConnectionID(b, 4)
+	require.Error(t, err)
+	require.ErrorIs(t, err, protocol.ErrInvalidConnectionIDLen)
+}
+
+func TestParseConnIDEOFLongHeader(t *testing.T) {
+	b, err := (&ExtendedHeader{
+		Header: Header{
+			Type:             protocol.PacketTypeHandshake,
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad, 0x13, 0x37}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 8, 9}),
+			Version:          protocol.Version1,
+		},
+		PacketNumberLen: 2,
+	}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	data := b[:len(b)-2] // cut the packet number
+	_, err = ParseConnectionID(data, 8)
+	require.NoError(t, err)
+	for i := range 1 /* first byte */ + 4 /* version */ + 1 /* conn ID lengths */ + 6 {
+		b := make([]byte, i)
+		copy(b, data[:i])
+		_, err := ParseConnectionID(b, 8)
+		require.Error(t, err)
+		require.ErrorIs(t, err, io.EOF)
+	}
+}
+
+func TestIs0RTT(t *testing.T) {
+	t.Run("QUIC v1", func(t *testing.T) {
+		zeroRTTHeader := make([]byte, 5)
+		zeroRTTHeader[0] = 0x80 | 0b01<<4
+		binary.BigEndian.PutUint32(zeroRTTHeader[1:], uint32(protocol.Version1))
+
+		require.True(t, Is0RTTPacket(zeroRTTHeader))
+		require.False(t, Is0RTTPacket(zeroRTTHeader[:4]))                           // too short
+		require.False(t, Is0RTTPacket([]byte{zeroRTTHeader[0], 1, 2, 3, 4}))        // unknown version
+		require.False(t, Is0RTTPacket([]byte{zeroRTTHeader[0] | 0x80, 1, 2, 3, 4})) // short header
+		require.True(t, Is0RTTPacket(append(zeroRTTHeader, []byte("foobar")...)))
+	})
+
+	t.Run("QUIC v2", func(t *testing.T) {
+		zeroRTTHeader := make([]byte, 5)
+		zeroRTTHeader[0] = 0x80 | 0b10<<4
+		binary.BigEndian.PutUint32(zeroRTTHeader[1:], uint32(protocol.Version2))
+
+		require.True(t, Is0RTTPacket(zeroRTTHeader))
+		require.False(t, Is0RTTPacket(zeroRTTHeader[:4]))                           // too short
+		require.False(t, Is0RTTPacket([]byte{zeroRTTHeader[0], 1, 2, 3, 4}))        // unknown version
+		require.False(t, Is0RTTPacket([]byte{zeroRTTHeader[0] | 0x80, 1, 2, 3, 4})) // short header
+		require.True(t, Is0RTTPacket(append(zeroRTTHeader, []byte("foobar")...)))
+	})
+}
+
+func TestParseVersion(t *testing.T) {
+	b := []byte{0x80, 0xde, 0xad, 0xbe, 0xef}
+	v, err := ParseVersion(b)
+	require.NoError(t, err)
+	require.Equal(t, protocol.Version(0xdeadbeef), v)
+
+	for i := range b {
+		_, err := ParseVersion(b[:i])
+		require.ErrorIs(t, err, io.EOF)
+	}
+}
+
+func TestParseArbitraryLengthConnectionIDs(t *testing.T) {
+	generateConnID := func(l int) protocol.ArbitraryLenConnectionID {
+		c := make(protocol.ArbitraryLenConnectionID, l)
+		rand.Read(c)
+		return c
+	}
+
+	src := generateConnID(mrand.IntN(255) + 1)
+	dest := generateConnID(mrand.IntN(255) + 1)
+	b := []byte{0x80, 1, 2, 3, 4}
+	b = append(b, uint8(dest.Len()))
+	b = append(b, dest.Bytes()...)
+	b = append(b, uint8(src.Len()))
+	b = append(b, src.Bytes()...)
+	l := len(b)
+	b = append(b, []byte("foobar")...) // add some payload
+
+	parsed, d, s, err := ParseArbitraryLenConnectionIDs(b)
+	require.Equal(t, l, parsed)
+	require.NoError(t, err)
+	require.Equal(t, src, s)
+	require.Equal(t, dest, d)
+
+	for i := range b[:l] {
+		_, _, _, err := ParseArbitraryLenConnectionIDs(b[:i])
+		require.ErrorIs(t, err, io.EOF)
+	}
+}
+
+func TestIdentifyVersionNegotiationPackets(t *testing.T) {
+	require.True(t, IsVersionNegotiationPacket([]byte{0x80 | 0x56, 0, 0, 0, 0}))
+	require.False(t, IsVersionNegotiationPacket([]byte{0x56, 0, 0, 0, 0}))
+	require.False(t, IsVersionNegotiationPacket([]byte{0x80, 1, 0, 0, 0}))
+	require.False(t, IsVersionNegotiationPacket([]byte{0x80, 0, 1, 0, 0}))
+	require.False(t, IsVersionNegotiationPacket([]byte{0x80, 0, 0, 1, 0}))
+	require.False(t, IsVersionNegotiationPacket([]byte{0x80, 0, 0, 0, 1}))
+}
+
+func TestVersionNegotiationPacketEOF(t *testing.T) {
+	vnp := []byte{0x80, 0, 0, 0, 0}
+	for i := range vnp {
+		require.False(t, IsVersionNegotiationPacket(vnp[:i]))
+	}
+}
+
+func TestParseLongHeader(t *testing.T) {
+	destConnID := protocol.ParseConnectionID([]byte{9, 8, 7, 6, 5, 4, 3, 2, 1})
+	srcConnID := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef})
+	data := []byte{0xc0 ^ 0x3}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, 0x9) // dest conn id length
+	data = append(data, destConnID.Bytes()...)
+	data = append(data, 0x4) // src conn id length
+	data = append(data, srcConnID.Bytes()...)
+	data = append(data, encodeVarInt(6)...)  // token length
+	data = append(data, []byte("foobar")...) // token
+	data = append(data, encodeVarInt(10)...) // length
+	hdrLen := len(data)
+	data = append(data, []byte{0, 0, 0xbe, 0xef}...) // packet number
+	data = append(data, []byte("foobar")...)
+	require.False(t, IsVersionNegotiationPacket(data))
+
+	hdr, pdata, rest, err := ParsePacket(data)
+	require.NoError(t, err)
+	require.Equal(t, data, pdata)
+	require.Equal(t, destConnID, hdr.DestConnectionID)
+	require.Equal(t, srcConnID, hdr.SrcConnectionID)
+	require.Equal(t, protocol.PacketTypeInitial, hdr.Type)
+	require.Equal(t, []byte("foobar"), hdr.Token)
+	require.Equal(t, protocol.ByteCount(10), hdr.Length)
+	require.Equal(t, protocol.Version1, hdr.Version)
+	require.Empty(t, rest)
+	extHdr, err := hdr.ParseExtended(data)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketNumberLen4, extHdr.PacketNumberLen)
+	require.Equal(t, protocol.PacketNumber(0xbeef), extHdr.PacketNumber)
+	require.Equal(t, hdrLen, int(hdr.ParsedLen()))
+	require.Equal(t, hdr.ParsedLen()+4, extHdr.ParsedLen())
+}
+
+func TestErrorIfReservedBitNotSet(t *testing.T) {
+	data := []byte{
+		0x80 | 0x2<<4,
+		0x11,                   // connection ID lengths
+		0xde, 0xca, 0xfb, 0xad, // dest conn ID
+		0xde, 0xad, 0xbe, 0xef, // src conn ID
+	}
+	_, _, _, err := ParsePacket(data)
+	require.EqualError(t, err, "not a QUIC packet")
+}
+
+func TestStopParsingWhenEncounteringUnsupportedVersion(t *testing.T) {
+	data := []byte{
+		0xc0,
+		0xde, 0xad, 0xbe, 0xef,
+		0x8,                                    // dest conn ID len
+		0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, // dest conn ID
+		0x8,                                    // src conn ID len
+		0x8, 0x7, 0x6, 0x5, 0x4, 0x3, 0x2, 0x1, // src conn ID
+		'f', 'o', 'o', 'b', 'a', 'r', // unspecified bytes
+	}
+	hdr, _, rest, err := ParsePacket(data)
+	require.EqualError(t, err, ErrUnsupportedVersion.Error())
+	require.Equal(t, protocol.Version(0xdeadbeef), hdr.Version)
+	require.Equal(t, protocol.ParseConnectionID([]byte{0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8}), hdr.DestConnectionID)
+	require.Equal(t, protocol.ParseConnectionID([]byte{0x8, 0x7, 0x6, 0x5, 0x4, 0x3, 0x2, 0x1}), hdr.SrcConnectionID)
+	require.Empty(t, rest)
+}
+
+func TestParseLongHeaderWithoutDestinationConnectionID(t *testing.T) {
+	data := []byte{0xc0 ^ 0x1<<4}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, 0)                                 // dest conn ID len
+	data = append(data, 4)                                 // src conn ID len
+	data = append(data, []byte{0xde, 0xad, 0xbe, 0xef}...) // source connection ID
+	data = append(data, encodeVarInt(0)...)                // length
+	data = append(data, []byte{0xde, 0xca, 0xfb, 0xad}...)
+	hdr, _, _, err := ParsePacket(data)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketType0RTT, hdr.Type)
+	require.Equal(t, protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}), hdr.SrcConnectionID)
+	require.Zero(t, hdr.DestConnectionID)
+}
+
+func TestParseLongHeaderWithoutSourceConnectionID(t *testing.T) {
+	data := []byte{0xc0 ^ 0x2<<4}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, 10)                                       // dest conn ID len
+	data = append(data, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}...) // dest connection ID
+	data = append(data, 0)                                        // src conn ID len
+	data = append(data, encodeVarInt(0)...)                       // length
+	data = append(data, []byte{0xde, 0xca, 0xfb, 0xad}...)
+	hdr, _, _, err := ParsePacket(data)
+	require.NoError(t, err)
+	require.Zero(t, hdr.SrcConnectionID)
+	require.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}), hdr.DestConnectionID)
+}
+
+func TestErrorOnTooLongDestinationConnectionID(t *testing.T) {
+	data := []byte{0xc0 ^ 0x2<<4}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, 21)                                                                                   // dest conn ID len
+	data = append(data, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21}...) // dest connection ID
+	data = append(data, 0x0)                                                                                  // src conn ID len
+	data = append(data, encodeVarInt(0)...)                                                                   // length
+	data = append(data, []byte{0xde, 0xca, 0xfb, 0xad}...)
+	_, _, _, err := ParsePacket(data)
+	require.EqualError(t, err, protocol.ErrInvalidConnectionIDLen.Error())
+}
+
+func TestParseLongHeaderWith2BytePacketNumber(t *testing.T) {
+	data := []byte{0xc0 ^ 0x1}
+	data = appendVersion(data, protocol.Version1) // version number
+	data = append(data, []byte{0x0, 0x0}...)      // connection ID lengths
+	data = append(data, encodeVarInt(0)...)       // token length
+	data = append(data, encodeVarInt(0)...)       // length
+	data = append(data, []byte{0x1, 0x23}...)
+
+	hdr, _, _, err := ParsePacket(data)
+	require.NoError(t, err)
+	extHdr, err := hdr.ParseExtended(data)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketNumber(0x123), extHdr.PacketNumber)
+	require.Equal(t, protocol.PacketNumberLen2, extHdr.PacketNumberLen)
+	require.Equal(t, len(data), int(extHdr.ParsedLen()))
+}
+
+func TestParseRetryPacket(t *testing.T) {
+	for _, version := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		t.Run(version.String(), func(t *testing.T) {
+			var packetType byte
+			if version == protocol.Version1 {
+				packetType = 0b11 << 4
+			} else {
+				packetType = 0b00 << 4
+			}
+			data := []byte{0xc0 | packetType | (10 - 3) /* connection ID length */}
+			data = appendVersion(data, version)
+			data = append(data, []byte{6}...)                             // dest conn ID len
+			data = append(data, []byte{6, 5, 4, 3, 2, 1}...)              // dest conn ID
+			data = append(data, []byte{10}...)                            // src conn ID len
+			data = append(data, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}...) // source connection ID
+			data = append(data, []byte{'f', 'o', 'o', 'b', 'a', 'r'}...)  // token
+			data = append(data, []byte{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1}...)
+			hdr, pdata, rest, err := ParsePacket(data)
+			require.NoError(t, err)
+			require.Equal(t, protocol.PacketTypeRetry, hdr.Type)
+			require.Equal(t, version, hdr.Version)
+			require.Equal(t, protocol.ParseConnectionID([]byte{6, 5, 4, 3, 2, 1}), hdr.DestConnectionID)
+			require.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}), hdr.SrcConnectionID)
+			require.Equal(t, []byte("foobar"), hdr.Token)
+			require.Equal(t, data, pdata)
+			require.Empty(t, rest)
+		})
+	}
+}
+
+func TestRetryPacketTooShortForIntegrityTag(t *testing.T) {
+	data := []byte{0xc0 | 0x3<<4 | (10 - 3) /* connection ID length */}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, []byte{0, 0}...)                         // conn ID lens
+	data = append(data, []byte{'f', 'o', 'o', 'b', 'a', 'r'}...) // token
+	data = append(data, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}...)
+	// this results in a token length of 0
+	_, _, _, err := ParsePacket(data)
+	require.Equal(t, io.EOF, err)
+}
+
+func TestTokenLengthTooLarge(t *testing.T) {
+	data := []byte{0xc0 ^ 0x1}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, 0x0)                   // connection ID lengths
+	data = append(data, encodeVarInt(4)...)    // token length: 4 bytes (1 byte too long)
+	data = append(data, encodeVarInt(0x42)...) // length, 1 byte
+	data = append(data, []byte{0x12, 0x34}...) // packet number
+
+	_, _, _, err := ParsePacket(data)
+	require.Equal(t, io.EOF, err)
+}
+
+func TestErrorOn5thOr6thBitSet(t *testing.T) {
+	data := []byte{0xc0 | 0x2<<4 | 0x8 /* set the 5th bit */ | 0x1 /* 2 byte packet number */}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, []byte{0x0, 0x0}...)   // connection ID lengths
+	data = append(data, encodeVarInt(2)...)    // length
+	data = append(data, []byte{0x12, 0x34}...) // packet number
+	hdr, _, _, err := ParsePacket(data)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketTypeHandshake, hdr.Type)
+	extHdr, err := hdr.ParseExtended(data)
+	require.EqualError(t, err, ErrInvalidReservedBits.Error())
+	require.NotNil(t, extHdr)
+	require.Equal(t, protocol.PacketNumber(0x1234), extHdr.PacketNumber)
+}
+
+func TestHeaderEOF(t *testing.T) {
+	data := []byte{0xc0 ^ 0x2<<4}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, 0x8)                                                       // dest conn ID len
+	data = append(data, []byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0x13, 0x37}...) // dest conn ID
+	data = append(data, 0x8)                                                       // src conn ID len
+	data = append(data, []byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0x13, 0x37}...) // src conn ID
+	for i := 1; i < len(data); i++ {
+		_, _, _, err := ParsePacket(data[:i])
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestParseExtendedHeaderEOF(t *testing.T) {
+	data := []byte{0xc0 | 0x2<<4 | 0x3}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, []byte{0x0, 0x0}...) // connection ID lengths
+	data = append(data, encodeVarInt(0)...)  // length
+	hdrLen := len(data)
+	data = append(data, []byte{0xde, 0xad, 0xbe, 0xef}...) // packet number
+	for i := hdrLen; i < len(data); i++ {
+		b := data[:i]
+		hdr, _, _, err := ParsePacket(b)
+		require.NoError(t, err)
+		_, err = hdr.ParseExtended(b)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestParseRetryEOF(t *testing.T) {
+	data := []byte{0xc0 ^ 0x3<<4}
+	data = appendVersion(data, protocol.Version1)
+	data = append(data, []byte{0x0, 0x0}...)                      // connection ID lengths
+	data = append(data, 0xa)                                      // Orig Destination Connection ID length
+	data = append(data, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}...) // source connection ID
+	hdrLen := len(data)
+	for i := hdrLen; i < len(data); i++ {
+		data = data[:i]
+		hdr, _, _, err := ParsePacket(data)
+		require.NoError(t, err)
+		_, err = hdr.ParseExtended(data)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestCoalescedPacketParsing(t *testing.T) {
+	hdr := Header{
+		Type:             protocol.PacketTypeInitial,
+		DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		Length:           2 + 6,
+		Version:          protocol.Version1,
+	}
+	b, err := (&ExtendedHeader{
+		Header:          hdr,
+		PacketNumber:    0x1337,
+		PacketNumberLen: 2,
+	}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	hdrRaw := append([]byte{}, b...)
+	b = append(b, []byte("foobar")...) // payload of the first packet
+	b = append(b, []byte("raboof")...) // second packet
+	parsedHdr, data, rest, err := ParsePacket(b)
+	require.NoError(t, err)
+	require.Equal(t, hdr.Type, parsedHdr.Type)
+	require.Equal(t, hdr.DestConnectionID, parsedHdr.DestConnectionID)
+	require.Equal(t, append(hdrRaw, []byte("foobar")...), data)
+	require.Equal(t, []byte("raboof"), rest)
+}
+
+func TestCoalescedPacketErrorOnTooSmallPacketNumber(t *testing.T) {
+	b, err := (&ExtendedHeader{
+		Header: Header{
+			Type:             protocol.PacketTypeInitial,
+			DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+			Length:           3,
+			Version:          protocol.Version1,
+		},
+		PacketNumber:    0x1337,
+		PacketNumberLen: 2,
+	}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	_, _, _, err = ParsePacket(b)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "packet length (2 bytes) is smaller than the expected length (3 bytes)")
+}
+
+func TestCoalescedPacketErrorOnTooSmallPayload(t *testing.T) {
+	b, err := (&ExtendedHeader{
+		Header: Header{
+			Type:             protocol.PacketTypeInitial,
+			DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+			Length:           1000,
+			Version:          protocol.Version1,
+		},
+		PacketNumber:    0x1337,
+		PacketNumberLen: 2,
+	}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	b = append(b, make([]byte, 500-2 /* for packet number length */)...)
+	_, _, _, err = ParsePacket(b)
+	require.EqualError(t, err, "packet length (500 bytes) is smaller than the expected length (1000 bytes)")
+}
+
+func TestDistinguishesLongAndShortHeaderPackets(t *testing.T) {
+	require.False(t, IsLongHeaderPacket(0x40))
+	require.True(t, IsLongHeaderPacket(0x80^0x40^0x12))
+}
+
+func TestPacketTypeForLogging(t *testing.T) {
+	require.Equal(t, "Initial", (&Header{Type: protocol.PacketTypeInitial}).PacketType())
+	require.Equal(t, "Handshake", (&Header{Type: protocol.PacketTypeHandshake}).PacketType())
+}
+
+func BenchmarkIs0RTTPacket(b *testing.B) {
+	src := mrand.NewChaCha8([32]byte{'f', 'o', 'o', 'b', 'a', 'r'})
+	random := mrand.New(src)
+	packets := make([][]byte, 1024)
+	for i := range len(packets) {
+		packets[i] = make([]byte, random.IntN(256))
+		src.Read(packets[i])
+	}
+
+	var i int
+	for b.Loop() {
+		Is0RTTPacket(packets[i%len(packets)])
+		i++
+	}
+}
+
+func BenchmarkParseInitial(b *testing.B) {
+	b.Run("without token", func(b *testing.B) {
+		benchmarkInitialPacketParsing(b, nil)
+	})
+	b.Run("with token", func(b *testing.B) {
+		token := make([]byte, 32)
+		rand.Read(token)
+		benchmarkInitialPacketParsing(b, token)
+	})
+}
+
+func benchmarkInitialPacketParsing(b *testing.B, token []byte) {
+	b.ReportAllocs()
+
+	hdr := Header{
+		Type:             protocol.PacketTypeInitial,
+		DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}),
+		SrcConnectionID:  protocol.ParseConnectionID([]byte{8, 7, 6, 5, 4, 3, 2, 1}),
+		Length:           1000,
+		Token:            token,
+		Version:          protocol.Version1,
+	}
+	data, err := (&ExtendedHeader{
+		Header:          hdr,
+		PacketNumber:    0x1337,
+		PacketNumberLen: 4,
+	}).Append(nil, protocol.Version1)
+	if err != nil {
+		b.Fatal(err)
+	}
+	data = append(data, make([]byte, 1000)...)
+
+	for b.Loop() {
+		h, _, _, err := ParsePacket(data)
+		if err != nil {
+			b.Fatal(err)
+		}
+		if h.Type != hdr.Type || h.DestConnectionID != hdr.DestConnectionID || h.SrcConnectionID != hdr.SrcConnectionID ||
+			!bytes.Equal(h.Token, hdr.Token) {
+			b.Fatalf("headers don't match: %v vs %v", h, hdr)
+		}
+	}
+}
+
+func BenchmarkParseRetry(b *testing.B) {
+	b.ReportAllocs()
+
+	token := make([]byte, 64)
+	rand.Read(token)
+	hdr := &ExtendedHeader{
+		Header: Header{
+			Type:             protocol.PacketTypeRetry,
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}),
+			DestConnectionID: protocol.ParseConnectionID([]byte{8, 7, 6, 5, 4, 3, 2, 1}),
+			Token:            token,
+			Version:          protocol.Version1,
+		},
+	}
+	data, err := hdr.Append(nil, hdr.Version)
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	for b.Loop() {
+		h, _, _, err := ParsePacket(data)
+		if err != nil {
+			b.Fatal(err)
+		}
+		if h.Type != hdr.Type || h.DestConnectionID != hdr.DestConnectionID || h.SrcConnectionID != hdr.SrcConnectionID ||
+			!bytes.Equal(h.Token, hdr.Token[:len(hdr.Token)-16]) {
+			b.Fatalf("headers don't match: %#v vs %#v", h, hdr)
+		}
+	}
+}
+
+func BenchmarkArbitraryHeaderParsing(b *testing.B) {
+	b.Run("dest 8/ src 10", func(b *testing.B) { benchmarkArbitraryHeaderParsing(b, 8, 10) })
+	b.Run("dest 20 / src 20", func(b *testing.B) { benchmarkArbitraryHeaderParsing(b, 20, 20) })
+	b.Run("dest 100 / src 150", func(b *testing.B) { benchmarkArbitraryHeaderParsing(b, 100, 150) })
+}
+
+func benchmarkArbitraryHeaderParsing(b *testing.B, destLen, srcLen int) {
+	destConnID := make([]byte, destLen)
+	rand.Read(destConnID)
+	srcConnID := make([]byte, srcLen)
+	rand.Read(srcConnID)
+	buf := []byte{0x80, 1, 2, 3, 4}
+	buf = append(buf, uint8(destLen))
+	buf = append(buf, destConnID...)
+	buf = append(buf, uint8(srcLen))
+	buf = append(buf, srcConnID...)
+
+	b.ReportAllocs()
+	for b.Loop() {
+		parsed, d, s, err := ParseArbitraryLenConnectionIDs(buf)
+		if err != nil {
+			b.Fatal(err)
+		}
+		if parsed != len(buf) {
+			b.Fatal("expected to parse entire slice")
+		}
+		if !bytes.Equal(destConnID, d.Bytes()) {
+			b.Fatalf("destination connection IDs don't match: %v vs %v", destConnID, d.Bytes())
+		}
+		if !bytes.Equal(srcConnID, s.Bytes()) {
+			b.Fatalf("source connection IDs don't match: %v vs %v", srcConnID, s.Bytes())
+		}
+	}
+}
+
+type discardLogger struct{}
+
+func (discardLogger) SetLogLevel(utils.LogLevel)     {}
+func (discardLogger) SetLogTimeFormat(string)        {}
+func (discardLogger) WithPrefix(string) utils.Logger { return discardLogger{} }
+func (discardLogger) Debug() bool                    { return false }
+func (discardLogger) Errorf(string, ...any)          {}
+func (discardLogger) Infof(string, ...any)           {}
+func (discardLogger) Debugf(string, ...any)          {}
+
+func FuzzHeaderParser(f *testing.F) {
+	corpus := ossfuzzseeds.New(f)
+
+	addLongHeader := func(hdr *ExtendedHeader) {
+		b, err := hdr.Append(nil, hdr.Version)
+		require.NoError(f, err)
+		if hdr.Type == protocol.PacketTypeRetry {
+			b = append(b, make([]byte, 16)...) // Retry Integrity Tag
+		}
+		if hdr.Length > 0 {
+			b = append(b, make([]byte, hdr.Length)...)
+		}
+		corpus.Add(uint8(hdr.DestConnectionID.Len()), b)
+	}
+
+	for _, v := range []protocol.Version{protocol.Version1, protocol.Version2} {
+		// Initial without token
+		addLongHeader(&ExtendedHeader{
+			Header: Header{
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{1, 2, 3}),
+				DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+				Type:             protocol.PacketTypeInitial,
+				Length:           10,
+				Version:          v,
+			},
+			PacketNumberLen: protocol.PacketNumberLen2,
+			PacketNumber:    0x42,
+		})
+		// Initial without token, with zero-length src conn id
+		addLongHeader(&ExtendedHeader{
+			Header: Header{
+				DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+				Type:             protocol.PacketTypeInitial,
+				Length:           10,
+				Version:          v,
+			},
+			PacketNumberLen: protocol.PacketNumberLen2,
+			PacketNumber:    0x42,
+		})
+		// Initial with token
+		addLongHeader(&ExtendedHeader{
+			Header: Header{
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}),
+				DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19}),
+				Type:             protocol.PacketTypeInitial,
+				Length:           10,
+				Token:            []byte("this is a token"),
+				Version:          v,
+			},
+			PacketNumberLen: protocol.PacketNumberLen4,
+			PacketNumber:    0xdecafbad,
+		})
+		// Handshake packet
+		addLongHeader(&ExtendedHeader{
+			Header: Header{
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5}),
+				DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}),
+				Type:             protocol.PacketTypeHandshake,
+				Length:           10,
+				Version:          v,
+			},
+			PacketNumberLen: protocol.PacketNumberLen3,
+			PacketNumber:    0x1337,
+		})
+		// Handshake packet, with zero-length src conn id
+		addLongHeader(&ExtendedHeader{
+			Header: Header{
+				DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12}),
+				Type:             protocol.PacketTypeHandshake,
+				Length:           10,
+				Version:          v,
+			},
+			PacketNumberLen: protocol.PacketNumberLen1,
+			PacketNumber:    0x42,
+		})
+		// 0-RTT packet
+		addLongHeader(&ExtendedHeader{
+			Header: Header{
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+				DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9}),
+				Type:             protocol.PacketType0RTT,
+				Length:           10,
+				Version:          v,
+			},
+			PacketNumberLen: protocol.PacketNumberLen2,
+			PacketNumber:    0x42,
+		})
+		// Retry packet
+		addLongHeader(&ExtendedHeader{
+			Header: Header{
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+				DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9}),
+				Type:             protocol.PacketTypeRetry,
+				Token:            []byte("foobar"),
+				Version:          v,
+			},
+		})
+	}
+	// Short header
+	shortHdr, err := AppendShortHeader(nil, protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}), 0x1337, protocol.PacketNumberLen2, protocol.KeyPhaseOne)
+	require.NoError(f, err)
+	corpus.Add(uint8(8), shortHdr)
+	// Version Negotiation packets
+	corpus.Add(uint8(0), ComposeVersionNegotiation(
+		protocol.ArbitraryLenConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}),
+		protocol.ArbitraryLenConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+		[]protocol.Version{0x1234, 0x5678, 0x9abc, 0xdef0},
+	))
+	corpus.Add(uint8(0), ComposeVersionNegotiation(
+		protocol.ArbitraryLenConnectionID([]byte{1, 2, 3}),
+		protocol.ArbitraryLenConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19}),
+		[]protocol.Version{0xdeadbeef},
+	))
+
+	f.Fuzz(func(t *testing.T, connIDLenRaw uint8, data []byte) {
+		is0RTTPacket := Is0RTTPacket(data)
+
+		if IsVersionNegotiationPacket(data) {
+			dest, src, versions, err := ParseVersionNegotiationPacket(data)
+			if err != nil {
+				return
+			}
+			require.NotEmpty(t, versions, "no versions")
+			ComposeVersionNegotiation(dest, src, versions)
+			return
+		}
+
+		connIDLen := int(connIDLenRaw % 21)
+		// don't return early on error, we want to fuzz the length checks of other functions as well
+		connID, _ := ParseConnectionID(data, connIDLen)
+
+		if len(data) == 0 {
+			return
+		}
+
+		_ = IsPotentialQUICPacket(data[0])
+
+		if IsLongHeaderPacket(data[0]) {
+			ParseVersion(data)
+		} else {
+			_, _, _, err := ParsePacket(data)
+			require.EqualError(t, err, "not a long header packet")
+
+			ParseShortHeader(data, connIDLen)
+			return
+		}
+
+		hdr, _, _, err := ParsePacket(data)
+		if err != nil {
+			return
+		}
+		require.Equal(t, connID, hdr.DestConnectionID, "connection IDs don't match")
+		if (hdr.Type == protocol.PacketType0RTT) != is0RTTPacket {
+			t.Fatal("inconsistent 0-RTT packet detection")
+		}
+		_ = hdr.PacketType()
+
+		var extHdr *ExtendedHeader
+		if hdr.Type == protocol.PacketTypeRetry {
+			extHdr = &ExtendedHeader{Header: *hdr}
+		} else {
+			var err error
+			extHdr, err = hdr.ParseExtended(data)
+			if err != nil {
+				return
+			}
+			require.Equal(t, hdr.ParsedLen()+protocol.ByteCount(extHdr.PacketNumberLen), extHdr.ParsedLen())
+		}
+		extHdr.Log(discardLogger{})
+		// We always use a 2-byte encoding for the Length field in Long Header packets.
+		// Serializing the header will fail when using a higher value.
+		if hdr.Length > 16383 {
+			return
+		}
+		b, err := extHdr.Append(nil, hdr.Version)
+		if err != nil {
+			// We are able to parse packets with connection IDs longer than 20 bytes,
+			// but in QUIC version 1 and 2, we don't write headers with longer connection IDs.
+			if hdr.DestConnectionID.Len() <= protocol.MaxConnIDLen &&
+				hdr.SrcConnectionID.Len() <= protocol.MaxConnIDLen {
+				t.Fatalf("error writing header: %s", err)
+			}
+			return
+		}
+		// GetLength is not implemented for Retry packets
+		if hdr.Type != protocol.PacketTypeRetry {
+			if expLen := extHdr.GetLength(hdr.Version); expLen != protocol.ByteCount(len(b)) {
+				t.Fatalf("inconsistent header length: %#v. Expected %d, got %d", extHdr, expLen, len(b))
+			}
+			roundtripHdr, err := parseHeader(b)
+			require.NoError(t, err)
+			roundtripExtHdr, err := roundtripHdr.ParseExtended(b)
+			require.NoError(t, err)
+			require.Equal(t, extHdr.Type, roundtripExtHdr.Type)
+			require.Equal(t, extHdr.Version, roundtripExtHdr.Version)
+			require.Equal(t, extHdr.DestConnectionID, roundtripExtHdr.DestConnectionID)
+			require.Equal(t, extHdr.SrcConnectionID, roundtripExtHdr.SrcConnectionID)
+			require.Equal(t, extHdr.Length, roundtripExtHdr.Length)
+			require.Equal(t, extHdr.Token, roundtripExtHdr.Token)
+			require.Equal(t, extHdr.PacketNumberLen, roundtripExtHdr.PacketNumberLen)
+			require.Equal(t, extHdr.PacketNumber, roundtripExtHdr.PacketNumber)
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/immediate_ack_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/immediate_ack_frame.go
new file mode 100644
index 000000000..aeff71b4e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/immediate_ack_frame.go
@@ -0,0 +1,18 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// An ImmediateAckFrame is an IMMEDIATE_ACK frame
+type ImmediateAckFrame struct{}
+
+func (f *ImmediateAckFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	return quicvarint.Append(b, uint64(FrameTypeImmediateAck)), nil
+}
+
+// Length of a written frame
+func (f *ImmediateAckFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return protocol.ByteCount(quicvarint.Len(uint64(FrameTypeImmediateAck)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/immediate_ack_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/immediate_ack_frame_test.go
new file mode 100644
index 000000000..af045a863
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/immediate_ack_frame_test.go
@@ -0,0 +1,22 @@
+package wire
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+	"github.com/stretchr/testify/require"
+)
+
+func TestImmediateAckFrame(t *testing.T) {
+	frame := ImmediateAckFrame{}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+
+	val, l, err := quicvarint.Parse(b)
+	require.NoError(t, err)
+	require.Equal(t, uint64(FrameTypeImmediateAck), val)
+	require.Equal(t, len(b), l)
+
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/log.go b/electron/native/private-transport/third_party/quic-go/internal/wire/log.go
new file mode 100644
index 000000000..c8b28d924
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/log.go
@@ -0,0 +1,74 @@
+package wire
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+// LogFrame logs a frame, either sent or received
+func LogFrame(logger utils.Logger, frame Frame, sent bool) {
+	if !logger.Debug() {
+		return
+	}
+	dir := "<-"
+	if sent {
+		dir = "->"
+	}
+	switch f := frame.(type) {
+	case *CryptoFrame:
+		dataLen := protocol.ByteCount(len(f.Data))
+		logger.Debugf("\t%s &wire.CryptoFrame{Offset: %d, Data length: %d, Offset + Data length: %d}", dir, f.Offset, dataLen, f.Offset+dataLen)
+	case *StreamFrame:
+		logger.Debugf("\t%s &wire.StreamFrame{StreamID: %d, Fin: %t, Offset: %d, Data length: %d, Offset + Data length: %d}", dir, f.StreamID, f.Fin, f.Offset, f.DataLen(), f.Offset+f.DataLen())
+	case *ResetStreamFrame:
+		logger.Debugf("\t%s &wire.ResetStreamFrame{StreamID: %d, ErrorCode: %#x, FinalSize: %d}", dir, f.StreamID, f.ErrorCode, f.FinalSize)
+	case *AckFrame:
+		hasECN := f.ECT0 > 0 || f.ECT1 > 0 || f.ECNCE > 0
+		var ecn string
+		if hasECN {
+			ecn = fmt.Sprintf(", ECT0: %d, ECT1: %d, CE: %d", f.ECT0, f.ECT1, f.ECNCE)
+		}
+		if len(f.AckRanges) > 1 {
+			ackRanges := make([]string, len(f.AckRanges))
+			for i, r := range f.AckRanges {
+				ackRanges[i] = fmt.Sprintf("{Largest: %d, Smallest: %d}", r.Largest, r.Smallest)
+			}
+			logger.Debugf("\t%s &wire.AckFrame{LargestAcked: %d, LowestAcked: %d, AckRanges: {%s}, DelayTime: %s%s}", dir, f.LargestAcked(), f.LowestAcked(), strings.Join(ackRanges, ", "), f.DelayTime.String(), ecn)
+		} else {
+			logger.Debugf("\t%s &wire.AckFrame{LargestAcked: %d, LowestAcked: %d, DelayTime: %s%s}", dir, f.LargestAcked(), f.LowestAcked(), f.DelayTime.String(), ecn)
+		}
+	case *MaxDataFrame:
+		logger.Debugf("\t%s &wire.MaxDataFrame{MaximumData: %d}", dir, f.MaximumData)
+	case *MaxStreamDataFrame:
+		logger.Debugf("\t%s &wire.MaxStreamDataFrame{StreamID: %d, MaximumStreamData: %d}", dir, f.StreamID, f.MaximumStreamData)
+	case *DataBlockedFrame:
+		logger.Debugf("\t%s &wire.DataBlockedFrame{MaximumData: %d}", dir, f.MaximumData)
+	case *StreamDataBlockedFrame:
+		logger.Debugf("\t%s &wire.StreamDataBlockedFrame{StreamID: %d, MaximumStreamData: %d}", dir, f.StreamID, f.MaximumStreamData)
+	case *MaxStreamsFrame:
+		switch f.Type {
+		case protocol.StreamTypeUni:
+			logger.Debugf("\t%s &wire.MaxStreamsFrame{Type: uni, MaxStreamNum: %d}", dir, f.MaxStreamNum)
+		case protocol.StreamTypeBidi:
+			logger.Debugf("\t%s &wire.MaxStreamsFrame{Type: bidi, MaxStreamNum: %d}", dir, f.MaxStreamNum)
+		}
+	case *StreamsBlockedFrame:
+		switch f.Type {
+		case protocol.StreamTypeUni:
+			logger.Debugf("\t%s &wire.StreamsBlockedFrame{Type: uni, MaxStreams: %d}", dir, f.StreamLimit)
+		case protocol.StreamTypeBidi:
+			logger.Debugf("\t%s &wire.StreamsBlockedFrame{Type: bidi, MaxStreams: %d}", dir, f.StreamLimit)
+		}
+	case *NewConnectionIDFrame:
+		logger.Debugf("\t%s &wire.NewConnectionIDFrame{SequenceNumber: %d, RetirePriorTo: %d, ConnectionID: %s, StatelessResetToken: %#x}", dir, f.SequenceNumber, f.RetirePriorTo, f.ConnectionID, f.StatelessResetToken)
+	case *RetireConnectionIDFrame:
+		logger.Debugf("\t%s &wire.RetireConnectionIDFrame{SequenceNumber: %d}", dir, f.SequenceNumber)
+	case *NewTokenFrame:
+		logger.Debugf("\t%s &wire.NewTokenFrame{Token: %#x}", dir, f.Token)
+	default:
+		logger.Debugf("\t%s %#v", dir, frame)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/log_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/log_test.go
new file mode 100644
index 000000000..d16e579ad
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/log_test.go
@@ -0,0 +1,188 @@
+package wire
+
+import (
+	"bytes"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLogFrameNoDebug(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	logger.SetLogLevel(utils.LogLevelInfo)
+	LogFrame(logger, &ResetStreamFrame{}, true)
+	require.Zero(t, buf.Len())
+}
+
+func TestLogSentFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	LogFrame(logger, &ResetStreamFrame{}, true)
+	require.Contains(t, buf.String(), "\t-> &wire.ResetStreamFrame{StreamID: 0, ErrorCode: 0x0, FinalSize: 0}\n")
+}
+
+func TestLogReceivedFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	LogFrame(logger, &ResetStreamFrame{}, false)
+	require.Contains(t, buf.String(), "\t<- &wire.ResetStreamFrame{StreamID: 0, ErrorCode: 0x0, FinalSize: 0}\n")
+}
+
+func TestLogCryptoFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &CryptoFrame{
+		Offset: 42,
+		Data:   make([]byte, 123),
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.CryptoFrame{Offset: 42, Data length: 123, Offset + Data length: 165}\n")
+}
+
+func TestLogStreamFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &StreamFrame{
+		StreamID: 42,
+		Offset:   1337,
+		Data:     bytes.Repeat([]byte{'f'}, 100),
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.StreamFrame{StreamID: 42, Fin: false, Offset: 1337, Data length: 100, Offset + Data length: 1437}\n")
+}
+
+func TestLogAckFrameWithoutMissingPackets(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &AckFrame{
+		AckRanges: []AckRange{{Smallest: 42, Largest: 1337}},
+		DelayTime: 1 * time.Millisecond,
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.AckFrame{LargestAcked: 1337, LowestAcked: 42, DelayTime: 1ms}\n")
+}
+
+func TestLogAckFrameWithECN(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &AckFrame{
+		AckRanges: []AckRange{{Smallest: 42, Largest: 1337}},
+		DelayTime: 1 * time.Millisecond,
+		ECT0:      5,
+		ECT1:      66,
+		ECNCE:     777,
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.AckFrame{LargestAcked: 1337, LowestAcked: 42, DelayTime: 1ms, ECT0: 5, ECT1: 66, CE: 777}\n")
+}
+
+func TestLogAckFrameWithMissingPackets(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &AckFrame{
+		AckRanges: []AckRange{
+			{Smallest: 5, Largest: 8},
+			{Smallest: 2, Largest: 3},
+		},
+		DelayTime: 12 * time.Millisecond,
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.AckFrame{LargestAcked: 8, LowestAcked: 2, AckRanges: {{Largest: 8, Smallest: 5}, {Largest: 3, Smallest: 2}}, DelayTime: 12ms}\n")
+}
+
+func TestLogMaxStreamsFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &MaxStreamsFrame{
+		Type:         protocol.StreamTypeBidi,
+		MaxStreamNum: 42,
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.MaxStreamsFrame{Type: bidi, MaxStreamNum: 42}\n")
+}
+
+func TestLogMaxDataFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &MaxDataFrame{
+		MaximumData: 42,
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.MaxDataFrame{MaximumData: 42}\n")
+}
+
+func TestLogMaxStreamDataFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &MaxStreamDataFrame{
+		StreamID:          10,
+		MaximumStreamData: 42,
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.MaxStreamDataFrame{StreamID: 10, MaximumStreamData: 42}\n")
+}
+
+func TestLogDataBlockedFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &DataBlockedFrame{
+		MaximumData: 1000,
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.DataBlockedFrame{MaximumData: 1000}\n")
+}
+
+func TestLogStreamDataBlockedFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &StreamDataBlockedFrame{
+		StreamID:          42,
+		MaximumStreamData: 1000,
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.StreamDataBlockedFrame{StreamID: 42, MaximumStreamData: 1000}\n")
+}
+
+func TestLogStreamsBlockedFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	frame := &StreamsBlockedFrame{
+		Type:        protocol.StreamTypeBidi,
+		StreamLimit: 42,
+	}
+	LogFrame(logger, frame, false)
+	require.Contains(t, buf.String(), "\t<- &wire.StreamsBlockedFrame{Type: bidi, MaxStreams: 42}\n")
+}
+
+func TestLogNewConnectionIDFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	LogFrame(logger, &NewConnectionIDFrame{
+		SequenceNumber:      42,
+		RetirePriorTo:       24,
+		ConnectionID:        protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		StatelessResetToken: protocol.StatelessResetToken{0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf, 0x10},
+	}, false)
+	require.Contains(t, buf.String(), "\t<- &wire.NewConnectionIDFrame{SequenceNumber: 42, RetirePriorTo: 24, ConnectionID: deadbeef, StatelessResetToken: 0x0102030405060708090a0b0c0d0e0f10}")
+}
+
+func TestLogRetireConnectionIDFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	LogFrame(logger, &RetireConnectionIDFrame{SequenceNumber: 42}, false)
+	require.Contains(t, buf.String(), "\t<- &wire.RetireConnectionIDFrame{SequenceNumber: 42}")
+}
+
+func TestLogNewTokenFrame(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+	LogFrame(logger, &NewTokenFrame{
+		Token: []byte{0xde, 0xad, 0xbe, 0xef},
+	}, true)
+	require.Contains(t, buf.String(), "\t-> &wire.NewTokenFrame{Token: 0xdeadbeef")
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/max_data_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/max_data_frame.go
new file mode 100644
index 000000000..bfbdcba66
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/max_data_frame.go
@@ -0,0 +1,33 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A MaxDataFrame carries flow control information for the connection
+type MaxDataFrame struct {
+	MaximumData protocol.ByteCount
+}
+
+// parseMaxDataFrame parses a MAX_DATA frame
+func parseMaxDataFrame(b []byte, _ protocol.Version) (*MaxDataFrame, int, error) {
+	frame := &MaxDataFrame{}
+	byteOffset, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	frame.MaximumData = protocol.ByteCount(byteOffset)
+	return frame, l, nil
+}
+
+func (f *MaxDataFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypeMaxData))
+	b = quicvarint.Append(b, uint64(f.MaximumData))
+	return b, nil
+}
+
+// Length of a written frame
+func (f *MaxDataFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(uint64(f.MaximumData)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/max_data_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/max_data_frame_test.go
new file mode 100644
index 000000000..a6cb3d255
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/max_data_frame_test.go
@@ -0,0 +1,39 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseMaxDataFrame(t *testing.T) {
+	data := encodeVarInt(0xdecafbad123456) // byte offset
+	frame, l, err := parseMaxDataFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.ByteCount(0xdecafbad123456), frame.MaximumData)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseMaxDataErrorsOnEOFs(t *testing.T) {
+	data := encodeVarInt(0xdecafbad1234567) // byte offset
+	_, l, err := parseMaxDataFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseMaxDataFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteMaxDataFrame(t *testing.T) {
+	f := &MaxDataFrame{MaximumData: 0xdeadbeefcafe}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeMaxData)}
+	expected = append(expected, encodeVarInt(0xdeadbeefcafe)...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/max_stream_data_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/max_stream_data_frame.go
new file mode 100644
index 000000000..0966ea469
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/max_stream_data_frame.go
@@ -0,0 +1,43 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A MaxStreamDataFrame is a MAX_STREAM_DATA frame
+type MaxStreamDataFrame struct {
+	StreamID          protocol.StreamID
+	MaximumStreamData protocol.ByteCount
+}
+
+func parseMaxStreamDataFrame(b []byte, _ protocol.Version) (*MaxStreamDataFrame, int, error) {
+	startLen := len(b)
+	sid, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	offset, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+
+	return &MaxStreamDataFrame{
+		StreamID:          protocol.StreamID(sid),
+		MaximumStreamData: protocol.ByteCount(offset),
+	}, startLen - len(b), nil
+}
+
+func (f *MaxStreamDataFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypeMaxStreamData))
+	b = quicvarint.Append(b, uint64(f.StreamID))
+	b = quicvarint.Append(b, uint64(f.MaximumStreamData))
+	return b, nil
+}
+
+// Length of a written frame
+func (f *MaxStreamDataFrame) Length(protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(uint64(f.StreamID))+quicvarint.Len(uint64(f.MaximumStreamData)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/max_stream_data_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/max_stream_data_frame_test.go
new file mode 100644
index 000000000..f4757da5c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/max_stream_data_frame_test.go
@@ -0,0 +1,46 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseMaxStreamFrame(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)                 // Stream ID
+	data = append(data, encodeVarInt(0x12345678)...) // Offset
+	frame, l, err := parseMaxStreamDataFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0xdeadbeef), frame.StreamID)
+	require.Equal(t, protocol.ByteCount(0x12345678), frame.MaximumStreamData)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseMaxStreamDataErrorsOnEOFs(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)                 // Stream ID
+	data = append(data, encodeVarInt(0x12345678)...) // Offset
+	_, l, err := parseMaxStreamDataFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseMaxStreamDataFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteMaxStreamDataFrame(t *testing.T) {
+	f := &MaxStreamDataFrame{
+		StreamID:          0xdecafbad,
+		MaximumStreamData: 0xdeadbeefcafe42,
+	}
+	expected := []byte{byte(FrameTypeMaxStreamData)}
+	expected = append(expected, encodeVarInt(0xdecafbad)...)
+	expected = append(expected, encodeVarInt(0xdeadbeefcafe42)...)
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, expected, b)
+	require.Equal(t, len(b), int(f.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/max_streams_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/max_streams_frame.go
new file mode 100644
index 000000000..30612e23b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/max_streams_frame.go
@@ -0,0 +1,50 @@
+package wire
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A MaxStreamsFrame is a MAX_STREAMS frame
+type MaxStreamsFrame struct {
+	Type         protocol.StreamType
+	MaxStreamNum protocol.StreamNum
+}
+
+func parseMaxStreamsFrame(b []byte, typ FrameType, _ protocol.Version) (*MaxStreamsFrame, int, error) {
+	f := &MaxStreamsFrame{}
+	//nolint:exhaustive // Function will only be called with BidiMaxStreamsFrameType or UniMaxStreamsFrameType
+	switch typ {
+	case FrameTypeBidiMaxStreams:
+		f.Type = protocol.StreamTypeBidi
+	case FrameTypeUniMaxStreams:
+		f.Type = protocol.StreamTypeUni
+	}
+	streamID, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	f.MaxStreamNum = protocol.StreamNum(streamID)
+	if f.MaxStreamNum > protocol.MaxStreamCount {
+		return nil, 0, fmt.Errorf("%d exceeds the maximum stream count", f.MaxStreamNum)
+	}
+	return f, l, nil
+}
+
+func (f *MaxStreamsFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	switch f.Type {
+	case protocol.StreamTypeBidi:
+		b = append(b, byte(FrameTypeBidiMaxStreams))
+	case protocol.StreamTypeUni:
+		b = append(b, byte(FrameTypeUniMaxStreams))
+	}
+	b = quicvarint.Append(b, uint64(f.MaxStreamNum))
+	return b, nil
+}
+
+// Length of a written frame
+func (f *MaxStreamsFrame) Length(protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(uint64(f.MaxStreamNum)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/max_streams_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/max_streams_frame_test.go
new file mode 100644
index 000000000..7afbce2ff
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/max_streams_frame_test.go
@@ -0,0 +1,117 @@
+package wire
+
+import (
+	"fmt"
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseMaxStreamsFrameBidirectional(t *testing.T) {
+	data := encodeVarInt(0xdecaf)
+	f, l, err := parseMaxStreamsFrame(data, FrameTypeBidiMaxStreams, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamTypeBidi, f.Type)
+	require.EqualValues(t, 0xdecaf, f.MaxStreamNum)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseMaxStreamsFrameUnidirectional(t *testing.T) {
+	data := encodeVarInt(0xdecaf)
+	f, l, err := parseMaxStreamsFrame(data, FrameTypeUniMaxStreams, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamTypeUni, f.Type)
+	require.EqualValues(t, 0xdecaf, f.MaxStreamNum)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseMaxStreamsErrorsOnEOF(t *testing.T) {
+	const typ = 0x1d
+	data := encodeVarInt(0xdeadbeefcafe13)
+	_, l, err := parseMaxStreamsFrame(data, typ, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseMaxStreamsFrame(data[:i], typ, protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestParseMaxStreamsMaxValue(t *testing.T) {
+	for _, streamType := range []protocol.StreamType{protocol.StreamTypeUni, protocol.StreamTypeBidi} {
+		var streamTypeStr string
+		if streamType == protocol.StreamTypeUni {
+			streamTypeStr = "unidirectional"
+		} else {
+			streamTypeStr = "bidirectional"
+		}
+		t.Run(streamTypeStr, func(t *testing.T) {
+			f := &MaxStreamsFrame{
+				Type:         streamType,
+				MaxStreamNum: protocol.MaxStreamCount,
+			}
+			b, err := f.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			typ, l, err := quicvarint.Parse(b)
+			require.NoError(t, err)
+			b = b[l:]
+			frame, _, err := parseMaxStreamsFrame(b, FrameType(typ), protocol.Version1)
+			require.NoError(t, err)
+			require.Equal(t, f, frame)
+		})
+	}
+}
+
+func TestParseMaxStreamsErrorsOnTooLargeStreamCount(t *testing.T) {
+	for _, streamType := range []protocol.StreamType{protocol.StreamTypeUni, protocol.StreamTypeBidi} {
+		var streamTypeStr string
+		if streamType == protocol.StreamTypeUni {
+			streamTypeStr = "unidirectional"
+		} else {
+			streamTypeStr = "bidirectional"
+		}
+		t.Run(streamTypeStr, func(t *testing.T) {
+			f := &MaxStreamsFrame{
+				Type:         streamType,
+				MaxStreamNum: protocol.MaxStreamCount + 1,
+			}
+			b, err := f.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			typ, l, err := quicvarint.Parse(b)
+			require.NoError(t, err)
+			b = b[l:]
+			_, _, err = parseMaxStreamsFrame(b, FrameType(typ), protocol.Version1)
+			require.EqualError(t, err, fmt.Sprintf("%d exceeds the maximum stream count", protocol.MaxStreamCount+1))
+		})
+	}
+}
+
+func TestWriteMaxStreamsBidirectional(t *testing.T) {
+	f := &MaxStreamsFrame{
+		Type:         protocol.StreamTypeBidi,
+		MaxStreamNum: 0xdeadbeef,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeBidiMaxStreams)}
+	expected = append(expected, encodeVarInt(0xdeadbeef)...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+}
+
+func TestWriteMaxStreamsUnidirectional(t *testing.T) {
+	f := &MaxStreamsFrame{
+		Type:         protocol.StreamTypeUni,
+		MaxStreamNum: 0xdecafbad,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeUniMaxStreams)}
+	expected = append(expected, encodeVarInt(0xdecafbad)...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(f.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/new_connection_id_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/new_connection_id_frame.go
new file mode 100644
index 000000000..058319266
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/new_connection_id_frame.go
@@ -0,0 +1,80 @@
+package wire
+
+import (
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A NewConnectionIDFrame is a NEW_CONNECTION_ID frame
+type NewConnectionIDFrame struct {
+	SequenceNumber      uint64
+	RetirePriorTo       uint64
+	ConnectionID        protocol.ConnectionID
+	StatelessResetToken protocol.StatelessResetToken
+}
+
+func parseNewConnectionIDFrame(b []byte, _ protocol.Version) (*NewConnectionIDFrame, int, error) {
+	startLen := len(b)
+	seq, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	ret, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	if ret > seq {
+		//nolint:staticcheck // SA1021: Retire Prior To is the name of the field
+		return nil, 0, fmt.Errorf("Retire Prior To value (%d) larger than Sequence Number (%d)", ret, seq)
+	}
+	if len(b) == 0 {
+		return nil, 0, io.EOF
+	}
+	connIDLen := int(b[0])
+	b = b[1:]
+	if connIDLen == 0 {
+		return nil, 0, errors.New("invalid zero-length connection ID")
+	}
+	if connIDLen > protocol.MaxConnIDLen {
+		return nil, 0, protocol.ErrInvalidConnectionIDLen
+	}
+	if len(b) < connIDLen {
+		return nil, 0, io.EOF
+	}
+	frame := &NewConnectionIDFrame{
+		SequenceNumber: seq,
+		RetirePriorTo:  ret,
+		ConnectionID:   protocol.ParseConnectionID(b[:connIDLen]),
+	}
+	b = b[connIDLen:]
+	if len(b) < len(frame.StatelessResetToken) {
+		return nil, 0, io.EOF
+	}
+	copy(frame.StatelessResetToken[:], b)
+	return frame, startLen - len(b) + len(frame.StatelessResetToken), nil
+}
+
+func (f *NewConnectionIDFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypeNewConnectionID))
+	b = quicvarint.Append(b, f.SequenceNumber)
+	b = quicvarint.Append(b, f.RetirePriorTo)
+	connIDLen := f.ConnectionID.Len()
+	if connIDLen > protocol.MaxConnIDLen {
+		return nil, fmt.Errorf("invalid connection ID length: %d", connIDLen)
+	}
+	b = append(b, uint8(connIDLen))
+	b = append(b, f.ConnectionID.Bytes()...)
+	b = append(b, f.StatelessResetToken[:]...)
+	return b, nil
+}
+
+// Length of a written frame
+func (f *NewConnectionIDFrame) Length(protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(f.SequenceNumber)+quicvarint.Len(f.RetirePriorTo)+1 /* connection ID length */ +f.ConnectionID.Len()) + 16
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/new_connection_id_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/new_connection_id_frame_test.go
new file mode 100644
index 000000000..3292e0f3c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/new_connection_id_frame_test.go
@@ -0,0 +1,88 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseNewConnectionIDFrame(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)                              // sequence number
+	data = append(data, encodeVarInt(0xcafe)...)                  // retire prior to
+	data = append(data, 10)                                       // connection ID length
+	data = append(data, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}...) // connection ID
+	data = append(data, []byte("deadbeefdecafbad")...)            // stateless reset token
+	frame, l, err := parseNewConnectionIDFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, uint64(0xdeadbeef), frame.SequenceNumber)
+	require.Equal(t, uint64(0xcafe), frame.RetirePriorTo)
+	require.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}), frame.ConnectionID)
+	require.Equal(t, "deadbeefdecafbad", string(frame.StatelessResetToken[:]))
+	require.Equal(t, len(data), l)
+}
+
+func TestParseNewConnectionIDRetirePriorToLargerThanSequenceNumber(t *testing.T) {
+	data := encodeVarInt(1000)                 // sequence number
+	data = append(data, encodeVarInt(1001)...) // retire prior to
+	data = append(data, 3)
+	data = append(data, []byte{1, 2, 3}...)
+	data = append(data, []byte("deadbeefdecafbad")...) // stateless reset token
+	_, _, err := parseNewConnectionIDFrame(data, protocol.Version1)
+	require.EqualError(t, err, "Retire Prior To value (1001) larger than Sequence Number (1000)")
+}
+
+func TestParseNewConnectionIDZeroLengthConnID(t *testing.T) {
+	data := encodeVarInt(42)                 // sequence number
+	data = append(data, encodeVarInt(12)...) // retire prior to
+	data = append(data, 0)                   // connection ID length
+	_, _, err := parseNewConnectionIDFrame(data, protocol.Version1)
+	require.EqualError(t, err, "invalid zero-length connection ID")
+}
+
+func TestParseNewConnectionIDInvalidConnIDLength(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)                                                                          // sequence number
+	data = append(data, encodeVarInt(0xcafe)...)                                                              // retire prior to
+	data = append(data, 21)                                                                                   // connection ID length
+	data = append(data, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21}...) // connection ID
+	data = append(data, []byte("deadbeefdecafbad")...)                                                        // stateless reset token
+	_, _, err := parseNewConnectionIDFrame(data, protocol.Version1)
+	require.Equal(t, protocol.ErrInvalidConnectionIDLen, err)
+}
+
+func TestParseNewConnectionIDErrorsOnEOFs(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)                              // sequence number
+	data = append(data, encodeVarInt(0xcafe1234)...)              // retire prior to
+	data = append(data, 10)                                       // connection ID length
+	data = append(data, []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}...) // connection ID
+	data = append(data, []byte("deadbeefdecafbad")...)            // stateless reset token
+	_, l, err := parseNewConnectionIDFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseNewConnectionIDFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteNewConnectionIDFrame(t *testing.T) {
+	token := protocol.StatelessResetToken{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}
+	frame := &NewConnectionIDFrame{
+		SequenceNumber:      0x1337,
+		RetirePriorTo:       0x42,
+		ConnectionID:        protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6}),
+		StatelessResetToken: token,
+	}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeNewConnectionID)}
+	expected = append(expected, encodeVarInt(0x1337)...)
+	expected = append(expected, encodeVarInt(0x42)...)
+	expected = append(expected, 6)
+	expected = append(expected, []byte{1, 2, 3, 4, 5, 6}...)
+	expected = append(expected, token[:]...)
+	require.Equal(t, expected, b)
+	require.Equal(t, int(frame.Length(protocol.Version1)), len(b))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/new_token_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/new_token_frame.go
new file mode 100644
index 000000000..73d356b1a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/new_token_frame.go
@@ -0,0 +1,43 @@
+package wire
+
+import (
+	"errors"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A NewTokenFrame is a NEW_TOKEN frame
+type NewTokenFrame struct {
+	Token []byte
+}
+
+func parseNewTokenFrame(b []byte, _ protocol.Version) (*NewTokenFrame, int, error) {
+	tokenLen, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	if tokenLen == 0 {
+		return nil, 0, errors.New("token must not be empty")
+	}
+	if uint64(len(b)) < tokenLen {
+		return nil, 0, io.EOF
+	}
+	token := make([]byte, int(tokenLen))
+	copy(token, b)
+	return &NewTokenFrame{Token: token}, l + int(tokenLen), nil
+}
+
+func (f *NewTokenFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypeNewToken))
+	b = quicvarint.Append(b, uint64(len(f.Token)))
+	b = append(b, f.Token...)
+	return b, nil
+}
+
+// Length of a written frame
+func (f *NewTokenFrame) Length(protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(uint64(len(f.Token)))+len(f.Token))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/new_token_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/new_token_frame_test.go
new file mode 100644
index 000000000..cd2ae3daf
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/new_token_frame_test.go
@@ -0,0 +1,51 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseNewTokenFrame(t *testing.T) {
+	token := "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua."
+	data := encodeVarInt(uint64(len(token)))
+	data = append(data, token...)
+	f, l, err := parseNewTokenFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, token, string(f.Token))
+	require.Equal(t, len(data), l)
+}
+
+func TestParseNewTokenFrameRejectsEmptyTokens(t *testing.T) {
+	data := encodeVarInt(0)
+	_, _, err := parseNewTokenFrame(data, protocol.Version1)
+	require.EqualError(t, err, "token must not be empty")
+}
+
+func TestParseNewTokenFrameErrorsOnEOFs(t *testing.T) {
+	token := "Lorem ipsum dolor sit amet, consectetur adipiscing elit"
+	data := encodeVarInt(uint64(len(token)))
+	data = append(data, token...)
+	_, l, err := parseNewTokenFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseNewTokenFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteNewTokenFrame(t *testing.T) {
+	token := "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat."
+	f := &NewTokenFrame{Token: []byte(token)}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeNewToken)}
+	expected = append(expected, encodeVarInt(uint64(len(token)))...)
+	expected = append(expected, token...)
+	require.Equal(t, expected, b)
+	require.Equal(t, len(b), int(f.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/path_challenge_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/path_challenge_frame.go
new file mode 100644
index 000000000..7a4a767e5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/path_challenge_frame.go
@@ -0,0 +1,32 @@
+package wire
+
+import (
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// A PathChallengeFrame is a PATH_CHALLENGE frame
+type PathChallengeFrame struct {
+	Data [8]byte
+}
+
+func parsePathChallengeFrame(b []byte, _ protocol.Version) (*PathChallengeFrame, int, error) {
+	f := &PathChallengeFrame{}
+	if len(b) < 8 {
+		return nil, 0, io.EOF
+	}
+	copy(f.Data[:], b)
+	return f, 8, nil
+}
+
+func (f *PathChallengeFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypePathChallenge))
+	b = append(b, f.Data[:]...)
+	return b, nil
+}
+
+// Length of a written frame
+func (f *PathChallengeFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return 1 + 8
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/path_challenge_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/path_challenge_frame_test.go
new file mode 100644
index 000000000..f5e521aa5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/path_challenge_frame_test.go
@@ -0,0 +1,37 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParsePathChallenge(t *testing.T) {
+	b := []byte{1, 2, 3, 4, 5, 6, 7, 8}
+	f, l, err := parsePathChallengeFrame(b, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, [8]byte{1, 2, 3, 4, 5, 6, 7, 8}, f.Data)
+	require.Equal(t, len(b), l)
+}
+
+func TestParsePathChallengeErrorsOnEOFs(t *testing.T) {
+	data := []byte{1, 2, 3, 4, 5, 6, 7, 8}
+	_, l, err := parsePathChallengeFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parsePathChallengeFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWritePathChallenge(t *testing.T) {
+	frame := PathChallengeFrame{Data: [8]byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0x13, 0x37}}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, []byte{byte(FrameTypePathChallenge), 0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0x13, 0x37}, b)
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/path_response_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/path_response_frame.go
new file mode 100644
index 000000000..e76d037b1
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/path_response_frame.go
@@ -0,0 +1,32 @@
+package wire
+
+import (
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// A PathResponseFrame is a PATH_RESPONSE frame
+type PathResponseFrame struct {
+	Data [8]byte
+}
+
+func parsePathResponseFrame(b []byte, _ protocol.Version) (*PathResponseFrame, int, error) {
+	f := &PathResponseFrame{}
+	if len(b) < 8 {
+		return nil, 0, io.EOF
+	}
+	copy(f.Data[:], b)
+	return f, 8, nil
+}
+
+func (f *PathResponseFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypePathResponse))
+	b = append(b, f.Data[:]...)
+	return b, nil
+}
+
+// Length of a written frame
+func (f *PathResponseFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return 1 + 8
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/path_response_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/path_response_frame_test.go
new file mode 100644
index 000000000..884c407df
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/path_response_frame_test.go
@@ -0,0 +1,37 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParsePathResponse(t *testing.T) {
+	b := []byte{1, 2, 3, 4, 5, 6, 7, 8}
+	f, l, err := parsePathResponseFrame(b, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, [8]byte{1, 2, 3, 4, 5, 6, 7, 8}, f.Data)
+	require.Equal(t, len(b), l)
+}
+
+func TestParsePathResponseErrorsOnEOFs(t *testing.T) {
+	data := []byte{1, 2, 3, 4, 5, 6, 7, 8}
+	_, l, err := parsePathResponseFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parsePathResponseFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWritePathResponse(t *testing.T) {
+	frame := PathResponseFrame{Data: [8]byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0x13, 0x37}}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, []byte{byte(FrameTypePathResponse), 0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0x13, 0x37}, b)
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/ping_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/ping_frame.go
new file mode 100644
index 000000000..5d344d447
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/ping_frame.go
@@ -0,0 +1,17 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// A PingFrame is a PING frame
+type PingFrame struct{}
+
+func (f *PingFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	return append(b, byte(FrameTypePing)), nil
+}
+
+// Length of a written frame
+func (f *PingFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return 1
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/ping_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/ping_frame_test.go
new file mode 100644
index 000000000..fce535e61
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/ping_frame_test.go
@@ -0,0 +1,17 @@
+package wire
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWritePingFrame(t *testing.T) {
+	frame := PingFrame{}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, []byte{0x1}, b)
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/pool.go b/electron/native/private-transport/third_party/quic-go/internal/wire/pool.go
new file mode 100644
index 000000000..d656fad4b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/pool.go
@@ -0,0 +1,33 @@
+package wire
+
+import (
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+var pool sync.Pool
+
+func init() {
+	pool.New = func() any {
+		return &StreamFrame{
+			Data:     make([]byte, 0, protocol.MaxPacketBufferSize),
+			fromPool: true,
+		}
+	}
+}
+
+func GetStreamFrame() *StreamFrame {
+	f := pool.Get().(*StreamFrame)
+	return f
+}
+
+func putStreamFrame(f *StreamFrame) {
+	if !f.fromPool {
+		return
+	}
+	if protocol.ByteCount(cap(f.Data)) != protocol.MaxPacketBufferSize {
+		panic("wire.PutStreamFrame called with packet of wrong size!")
+	}
+	pool.Put(f)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/pool_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/pool_test.go
new file mode 100644
index 000000000..d67b46360
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/pool_test.go
@@ -0,0 +1,24 @@
+package wire
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetAndPutStreamFrames(t *testing.T) {
+	f := GetStreamFrame()
+	putStreamFrame(f)
+}
+
+func TestPanicOnPuttingStreamFrameWithWrongCapacity(t *testing.T) {
+	f := GetStreamFrame()
+	f.Data = []byte("foobar")
+	require.Panics(t, func() { putStreamFrame(f) })
+}
+
+func TestAcceptStreamFramesNotFromBuffer(t *testing.T) {
+	f := &StreamFrame{Data: []byte("foobar")}
+	putStreamFrame(f)
+	// No assertion needed as we're just checking it doesn't panic
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/reset_stream_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/reset_stream_frame.go
new file mode 100644
index 000000000..4101b76b2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/reset_stream_frame.go
@@ -0,0 +1,79 @@
+package wire
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A ResetStreamFrame is a RESET_STREAM or RESET_STREAM_AT frame in QUIC
+type ResetStreamFrame struct {
+	StreamID     protocol.StreamID
+	ErrorCode    qerr.StreamErrorCode
+	FinalSize    protocol.ByteCount
+	ReliableSize protocol.ByteCount
+}
+
+func parseResetStreamFrame(b []byte, isResetStreamAt bool, _ protocol.Version) (*ResetStreamFrame, int, error) {
+	startLen := len(b)
+	streamID, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	errorCode, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	finalSize, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+
+	var reliableSize uint64
+	if isResetStreamAt {
+		reliableSize, l, err = quicvarint.Parse(b)
+		if err != nil {
+			return nil, 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+	}
+	if reliableSize > finalSize {
+		return nil, 0, fmt.Errorf("RESET_STREAM_AT: reliable size can't be larger than final size (%d vs %d)", reliableSize, finalSize)
+	}
+
+	return &ResetStreamFrame{
+		StreamID:     protocol.StreamID(streamID),
+		ErrorCode:    qerr.StreamErrorCode(errorCode),
+		FinalSize:    protocol.ByteCount(finalSize),
+		ReliableSize: protocol.ByteCount(reliableSize),
+	}, startLen - len(b), nil
+}
+
+func (f *ResetStreamFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	if f.ReliableSize == 0 {
+		b = quicvarint.Append(b, uint64(FrameTypeResetStream))
+	} else {
+		b = quicvarint.Append(b, uint64(FrameTypeResetStreamAt))
+	}
+	b = quicvarint.Append(b, uint64(f.StreamID))
+	b = quicvarint.Append(b, uint64(f.ErrorCode))
+	b = quicvarint.Append(b, uint64(f.FinalSize))
+	if f.ReliableSize > 0 {
+		b = quicvarint.Append(b, uint64(f.ReliableSize))
+	}
+	return b, nil
+}
+
+// Length of a written frame
+func (f *ResetStreamFrame) Length(protocol.Version) protocol.ByteCount {
+	size := 1 // the frame type for both RESET_STREAM and RESET_STREAM_AT fits into 1 byte
+	if f.ReliableSize > 0 {
+		size += quicvarint.Len(uint64(f.ReliableSize))
+	}
+	return protocol.ByteCount(size + quicvarint.Len(uint64(f.StreamID)) + quicvarint.Len(uint64(f.ErrorCode)) + quicvarint.Len(uint64(f.FinalSize)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/reset_stream_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/reset_stream_frame_test.go
new file mode 100644
index 000000000..d85d616ba
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/reset_stream_frame_test.go
@@ -0,0 +1,104 @@
+package wire
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseResetStream(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)                  // stream ID
+	data = append(data, encodeVarInt(0x1337)...)      // error code
+	data = append(data, encodeVarInt(0x987654321)...) // byte offset
+	frame, l, err := parseResetStreamFrame(data, false, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0xdeadbeef), frame.StreamID)
+	require.Equal(t, protocol.ByteCount(0x987654321), frame.FinalSize)
+	require.Equal(t, qerr.StreamErrorCode(0x1337), frame.ErrorCode)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseResetStreamAt(t *testing.T) {
+	data := encodeVarInt(0xabcdef12)                  // stream ID
+	data = append(data, encodeVarInt(0x2468)...)      // error code
+	data = append(data, encodeVarInt(0x123456789)...) // byte offset
+	data = append(data, encodeVarInt(0x789abc)...)    // reliable size
+	frame, l, err := parseResetStreamFrame(data, true, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0xabcdef12), frame.StreamID)
+	require.Equal(t, protocol.ByteCount(0x123456789), frame.FinalSize)
+	require.Equal(t, qerr.StreamErrorCode(0x2468), frame.ErrorCode)
+	require.Equal(t, protocol.ByteCount(0x789abc), frame.ReliableSize)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseResetStreamAtSizeTooLarge(t *testing.T) {
+	data := encodeVarInt(0xabcdef12)             // stream ID
+	data = append(data, encodeVarInt(0x2468)...) // error code
+	data = append(data, encodeVarInt(1000)...)   // byte offset
+	data = append(data, encodeVarInt(1001)...)   // reliable size
+	_, _, err := parseResetStreamFrame(data, true, protocol.Version1)
+	require.EqualError(t, err, "RESET_STREAM_AT: reliable size can't be larger than final size (1001 vs 1000)")
+}
+
+func TestParseResetStreamErrorsOnEOFs(t *testing.T) {
+	t.Run("RESET_STREAM", func(t *testing.T) {
+		testParseResetStreamErrorsOnEOFs(t, false)
+	})
+	t.Run("RESET_STREAM_AT", func(t *testing.T) {
+		testParseResetStreamErrorsOnEOFs(t, true)
+	})
+}
+
+func testParseResetStreamErrorsOnEOFs(t *testing.T, isResetStreamAt bool) {
+	data := encodeVarInt(0xdeadbeef)                  // stream ID
+	data = append(data, encodeVarInt(0x1337)...)      // error code
+	data = append(data, encodeVarInt(0x987654321)...) // byte offset
+	if isResetStreamAt {
+		data = append(data, encodeVarInt(0x123456)...) // reliable size
+	}
+	_, l, err := parseResetStreamFrame(data, isResetStreamAt, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseResetStreamFrame(data[:i], isResetStreamAt, protocol.Version1)
+		require.Error(t, err)
+	}
+}
+
+func TestWriteResetStream(t *testing.T) {
+	frame := ResetStreamFrame{
+		StreamID:  0x1337,
+		FinalSize: 0x11223344decafbad,
+		ErrorCode: 0xcafe,
+	}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeResetStream)}
+	expected = append(expected, encodeVarInt(0x1337)...)
+	expected = append(expected, encodeVarInt(0xcafe)...)
+	expected = append(expected, encodeVarInt(0x11223344decafbad)...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
+
+func TestWriteResetStreamAt(t *testing.T) {
+	frame := ResetStreamFrame{
+		StreamID:     1337,
+		FinalSize:    42,
+		ErrorCode:    0xcafe,
+		ReliableSize: 12,
+	}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeResetStreamAt)}
+	expected = append(expected, encodeVarInt(1337)...)
+	expected = append(expected, encodeVarInt(0xcafe)...)
+	expected = append(expected, encodeVarInt(42)...)
+	expected = append(expected, encodeVarInt(12)...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/retire_connection_id_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/retire_connection_id_frame.go
new file mode 100644
index 000000000..1927f9dc0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/retire_connection_id_frame.go
@@ -0,0 +1,30 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A RetireConnectionIDFrame is a RETIRE_CONNECTION_ID frame
+type RetireConnectionIDFrame struct {
+	SequenceNumber uint64
+}
+
+func parseRetireConnectionIDFrame(b []byte, _ protocol.Version) (*RetireConnectionIDFrame, int, error) {
+	seq, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	return &RetireConnectionIDFrame{SequenceNumber: seq}, l, nil
+}
+
+func (f *RetireConnectionIDFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypeRetireConnectionID))
+	b = quicvarint.Append(b, f.SequenceNumber)
+	return b, nil
+}
+
+// Length of a written frame
+func (f *RetireConnectionIDFrame) Length(protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(f.SequenceNumber))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/retire_connection_id_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/retire_connection_id_frame_test.go
new file mode 100644
index 000000000..e1b64ccfd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/retire_connection_id_frame_test.go
@@ -0,0 +1,39 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseRetireConnectionID(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef) // sequence number
+	frame, l, err := parseRetireConnectionIDFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, uint64(0xdeadbeef), frame.SequenceNumber)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseRetireConnectionIDErrorsOnEOFs(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef) // sequence number
+	_, l, err := parseRetireConnectionIDFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseRetireConnectionIDFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteRetireConnectionID(t *testing.T) {
+	frame := &RetireConnectionIDFrame{SequenceNumber: 0x1337}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeRetireConnectionID)}
+	expected = append(expected, encodeVarInt(0x1337)...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/short_header.go b/electron/native/private-transport/third_party/quic-go/internal/wire/short_header.go
new file mode 100644
index 000000000..cf2889c58
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/short_header.go
@@ -0,0 +1,62 @@
+package wire
+
+import (
+	"errors"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+// ParseShortHeader parses a short header packet.
+// It must be called after header protection was removed.
+// Otherwise, the check for the reserved bits will (most likely) fail.
+func ParseShortHeader(data []byte, connIDLen int) (length int, _ protocol.PacketNumber, _ protocol.PacketNumberLen, _ protocol.KeyPhaseBit, _ error) {
+	if len(data) == 0 {
+		return 0, 0, 0, 0, io.EOF
+	}
+	if data[0]&0x80 > 0 {
+		return 0, 0, 0, 0, errors.New("not a short header packet")
+	}
+	if data[0]&0x40 == 0 {
+		return 0, 0, 0, 0, errors.New("not a QUIC packet")
+	}
+	pnLen := protocol.PacketNumberLen(data[0]&0b11) + 1
+	if len(data) < 1+int(pnLen)+connIDLen {
+		return 0, 0, 0, 0, io.EOF
+	}
+
+	pos := 1 + connIDLen
+	pn, err := readPacketNumber(data[pos:], pnLen)
+	if err != nil {
+		return 0, 0, 0, 0, err
+	}
+	kp := protocol.KeyPhaseZero
+	if data[0]&0b100 > 0 {
+		kp = protocol.KeyPhaseOne
+	}
+
+	if data[0]&0x18 != 0 {
+		err = ErrInvalidReservedBits
+	}
+	return 1 + connIDLen + int(pnLen), pn, pnLen, kp, err
+}
+
+// AppendShortHeader writes a short header.
+func AppendShortHeader(b []byte, connID protocol.ConnectionID, pn protocol.PacketNumber, pnLen protocol.PacketNumberLen, kp protocol.KeyPhaseBit) ([]byte, error) {
+	typeByte := 0x40 | uint8(pnLen-1)
+	if kp == protocol.KeyPhaseOne {
+		typeByte |= byte(1 << 2)
+	}
+	b = append(b, typeByte)
+	b = append(b, connID.Bytes()...)
+	return appendPacketNumber(b, pn, pnLen)
+}
+
+func ShortHeaderLen(dest protocol.ConnectionID, pnLen protocol.PacketNumberLen) protocol.ByteCount {
+	return 1 + protocol.ByteCount(dest.Len()) + protocol.ByteCount(pnLen)
+}
+
+func LogShortHeader(logger utils.Logger, dest protocol.ConnectionID, pn protocol.PacketNumber, pnLen protocol.PacketNumberLen, kp protocol.KeyPhaseBit) {
+	logger.Debugf("\tShort Header{DestConnectionID: %s, PacketNumber: %d, PacketNumberLen: %d, KeyPhase: %s}", dest, pn, pnLen, kp)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/short_header_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/short_header_test.go
new file mode 100644
index 000000000..00890eef7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/short_header_test.go
@@ -0,0 +1,106 @@
+package wire
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseShortHeader(t *testing.T) {
+	data := []byte{
+		0b01000110,
+		0xde, 0xad, 0xbe, 0xef,
+		0x13, 0x37, 0x99,
+	}
+	l, pn, pnLen, kp, err := ParseShortHeader(data, 4)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	require.Equal(t, protocol.KeyPhaseOne, kp)
+	require.Equal(t, protocol.PacketNumber(0x133799), pn)
+	require.Equal(t, protocol.PacketNumberLen3, pnLen)
+}
+
+func TestParseShortHeaderNoQUICBit(t *testing.T) {
+	data := []byte{
+		0b00000101,
+		0xde, 0xad, 0xbe, 0xef,
+		0x13, 0x37,
+	}
+	_, _, _, _, err := ParseShortHeader(data, 4)
+	require.EqualError(t, err, "not a QUIC packet")
+}
+
+func TestParseShortHeaderReservedBitsSet(t *testing.T) {
+	data := []byte{
+		0b01010101,
+		0xde, 0xad, 0xbe, 0xef,
+		0x13, 0x37,
+	}
+	_, pn, _, _, err := ParseShortHeader(data, 4)
+	require.EqualError(t, err, ErrInvalidReservedBits.Error())
+	require.Equal(t, protocol.PacketNumber(0x1337), pn)
+}
+
+func TestParseShortHeaderErrorsWhenPassedLongHeaderPacket(t *testing.T) {
+	_, _, _, _, err := ParseShortHeader([]byte{0x80}, 4)
+	require.EqualError(t, err, "not a short header packet")
+}
+
+func TestParseShortHeaderErrorsOnEOF(t *testing.T) {
+	data := []byte{
+		0b01000110,
+		0xde, 0xad, 0xbe, 0xef,
+		0x13, 0x37, 0x99,
+	}
+	_, _, _, _, err := ParseShortHeader(data, 4)
+	require.NoError(t, err)
+	for i := range data {
+		_, _, _, _, err := ParseShortHeader(data[:i], 4)
+		require.EqualError(t, err, io.EOF.Error())
+	}
+}
+
+func TestShortHeaderLen(t *testing.T) {
+	require.Equal(t, protocol.ByteCount(8), ShortHeaderLen(protocol.ParseConnectionID([]byte{1, 2, 3, 4}), protocol.PacketNumberLen3))
+	require.Equal(t, protocol.ByteCount(2), ShortHeaderLen(protocol.ParseConnectionID([]byte{}), protocol.PacketNumberLen1))
+}
+
+func TestWriteShortHeaderPacket(t *testing.T) {
+	connID := protocol.ParseConnectionID([]byte{1, 2, 3, 4})
+	b, err := AppendShortHeader(nil, connID, 1337, 4, protocol.KeyPhaseOne)
+	require.NoError(t, err)
+	l, pn, pnLen, kp, err := ParseShortHeader(b, 4)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketNumber(1337), pn)
+	require.Equal(t, protocol.PacketNumberLen4, pnLen)
+	require.Equal(t, protocol.KeyPhaseOne, kp)
+	require.Equal(t, len(b), l)
+}
+
+func TestLogShortHeaderWithConnectionID(t *testing.T) {
+	buf := &bytes.Buffer{}
+	logger := setupLogTest(t, buf)
+
+	connID := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0x13, 0x37})
+	LogShortHeader(logger, connID, 1337, protocol.PacketNumberLen4, protocol.KeyPhaseOne)
+	require.Contains(t, buf.String(), "Short Header{DestConnectionID: deadbeefcafe1337, PacketNumber: 1337, PacketNumberLen: 4, KeyPhase: 1}")
+}
+
+func BenchmarkWriteShortHeader(b *testing.B) {
+	b.ReportAllocs()
+	buf := make([]byte, 100)
+	connID := protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6})
+
+	for b.Loop() {
+		var err error
+		buf, err = AppendShortHeader(buf, connID, 1337, protocol.PacketNumberLen4, protocol.KeyPhaseOne)
+		if err != nil {
+			b.Fatalf("failed to write short header: %s", err)
+		}
+		buf = buf[:0]
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/stop_sending_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/stop_sending_frame.go
new file mode 100644
index 000000000..2b15c7109
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/stop_sending_frame.go
@@ -0,0 +1,45 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A StopSendingFrame is a STOP_SENDING frame
+type StopSendingFrame struct {
+	StreamID  protocol.StreamID
+	ErrorCode qerr.StreamErrorCode
+}
+
+// parseStopSendingFrame parses a STOP_SENDING frame
+func parseStopSendingFrame(b []byte, _ protocol.Version) (*StopSendingFrame, int, error) {
+	startLen := len(b)
+	streamID, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	errorCode, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+
+	return &StopSendingFrame{
+		StreamID:  protocol.StreamID(streamID),
+		ErrorCode: qerr.StreamErrorCode(errorCode),
+	}, startLen - len(b), nil
+}
+
+// Length of a written frame
+func (f *StopSendingFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(uint64(f.StreamID))+quicvarint.Len(uint64(f.ErrorCode)))
+}
+
+func (f *StopSendingFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, byte(FrameTypeStopSending))
+	b = quicvarint.Append(b, uint64(f.StreamID))
+	b = quicvarint.Append(b, uint64(f.ErrorCode))
+	return b, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/stop_sending_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/stop_sending_frame_test.go
new file mode 100644
index 000000000..90bc8a32e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/stop_sending_frame_test.go
@@ -0,0 +1,47 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseStopSending(t *testing.T) {
+	data := encodeVarInt(0xdecafbad)             // stream ID
+	data = append(data, encodeVarInt(0x1337)...) // error code
+	frame, l, err := parseStopSendingFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0xdecafbad), frame.StreamID)
+	require.Equal(t, qerr.StreamErrorCode(0x1337), frame.ErrorCode)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseStopSendingErrorsOnEOFs(t *testing.T) {
+	data := encodeVarInt(0xdecafbad)               // stream ID
+	data = append(data, encodeVarInt(0x123456)...) // error code
+	_, l, err := parseStopSendingFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseStopSendingFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteStopSendingFrame(t *testing.T) {
+	frame := &StopSendingFrame{
+		StreamID:  0xdeadbeefcafe,
+		ErrorCode: 0xdecafbad,
+	}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeStopSending)}
+	expected = append(expected, encodeVarInt(0xdeadbeefcafe)...)
+	expected = append(expected, encodeVarInt(0xdecafbad)...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/stream_data_blocked_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/stream_data_blocked_frame.go
new file mode 100644
index 000000000..3762ec76a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/stream_data_blocked_frame.go
@@ -0,0 +1,42 @@
+package wire
+
+import (
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A StreamDataBlockedFrame is a STREAM_DATA_BLOCKED frame
+type StreamDataBlockedFrame struct {
+	StreamID          protocol.StreamID
+	MaximumStreamData protocol.ByteCount
+}
+
+func parseStreamDataBlockedFrame(b []byte, _ protocol.Version) (*StreamDataBlockedFrame, int, error) {
+	startLen := len(b)
+	sid, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	offset, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+
+	return &StreamDataBlockedFrame{
+		StreamID:          protocol.StreamID(sid),
+		MaximumStreamData: protocol.ByteCount(offset),
+	}, startLen - len(b) + l, nil
+}
+
+func (f *StreamDataBlockedFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	b = append(b, 0x15)
+	b = quicvarint.Append(b, uint64(f.StreamID))
+	b = quicvarint.Append(b, uint64(f.MaximumStreamData))
+	return b, nil
+}
+
+// Length of a written frame
+func (f *StreamDataBlockedFrame) Length(protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(uint64(f.StreamID))+quicvarint.Len(uint64(f.MaximumStreamData)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/stream_data_blocked_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/stream_data_blocked_frame_test.go
new file mode 100644
index 000000000..325cb58fd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/stream_data_blocked_frame_test.go
@@ -0,0 +1,46 @@
+package wire
+
+import (
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseStreamDataBlocked(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)                 // stream ID
+	data = append(data, encodeVarInt(0xdecafbad)...) // offset
+	frame, l, err := parseStreamDataBlockedFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0xdeadbeef), frame.StreamID)
+	require.Equal(t, protocol.ByteCount(0xdecafbad), frame.MaximumStreamData)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseStreamDataBlockedErrorsOnEOFs(t *testing.T) {
+	data := encodeVarInt(0xdeadbeef)
+	data = append(data, encodeVarInt(0xc0010ff)...)
+	_, l, err := parseStreamDataBlockedFrame(data, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseStreamDataBlockedFrame(data[:i], protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestWriteStreamDataBlocked(t *testing.T) {
+	f := &StreamDataBlockedFrame{
+		StreamID:          0xdecafbad,
+		MaximumStreamData: 0x1337,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeStreamDataBlocked)}
+	expected = append(expected, encodeVarInt(uint64(f.StreamID))...)
+	expected = append(expected, encodeVarInt(uint64(f.MaximumStreamData))...)
+	require.Equal(t, expected, b)
+	require.Equal(t, int(f.Length(protocol.Version1)), len(b))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/stream_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/stream_frame.go
new file mode 100644
index 000000000..e53962b19
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/stream_frame.go
@@ -0,0 +1,191 @@
+package wire
+
+import (
+	"errors"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A StreamFrame of QUIC
+type StreamFrame struct {
+	StreamID       protocol.StreamID
+	Offset         protocol.ByteCount
+	Data           []byte
+	Fin            bool
+	DataLenPresent bool
+
+	fromPool bool
+}
+
+func ParseStreamFrame(b []byte, typ FrameType, _ protocol.Version) (*StreamFrame, int, error) {
+	startLen := len(b)
+	hasOffset := typ&0b100 > 0
+	fin := typ&0b1 > 0
+	hasDataLen := typ&0b10 > 0
+
+	streamID, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	b = b[l:]
+	var offset uint64
+	if hasOffset {
+		offset, l, err = quicvarint.Parse(b)
+		if err != nil {
+			return nil, 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+	}
+
+	var dataLen uint64
+	if hasDataLen {
+		var err error
+		var l int
+		dataLen, l, err = quicvarint.Parse(b)
+		if err != nil {
+			return nil, 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+		if dataLen > uint64(len(b)) {
+			return nil, 0, io.EOF
+		}
+	} else {
+		// The rest of the packet is data
+		dataLen = uint64(len(b))
+	}
+
+	var frame *StreamFrame
+	if dataLen < protocol.MinStreamFrameBufferSize {
+		frame = &StreamFrame{}
+		if dataLen > 0 {
+			frame.Data = make([]byte, dataLen)
+		}
+	} else {
+		frame = GetStreamFrame()
+		// The STREAM frame can't be larger than the StreamFrame we obtained from the buffer,
+		// since those StreamFrames have a buffer length of the maximum packet size.
+		if dataLen > uint64(cap(frame.Data)) {
+			return nil, 0, io.EOF
+		}
+		frame.Data = frame.Data[:dataLen]
+	}
+
+	frame.StreamID = protocol.StreamID(streamID)
+	frame.Offset = protocol.ByteCount(offset)
+	frame.Fin = fin
+	frame.DataLenPresent = hasDataLen
+
+	if dataLen > 0 {
+		copy(frame.Data, b)
+	}
+	if frame.Offset+frame.DataLen() > protocol.MaxByteCount {
+		return nil, 0, errors.New("stream data overflows maximum offset")
+	}
+	return frame, startLen - len(b) + int(dataLen), nil
+}
+
+func (f *StreamFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	if len(f.Data) == 0 && !f.Fin {
+		return nil, errors.New("StreamFrame: attempting to write empty frame without FIN")
+	}
+
+	typ := byte(0x8)
+	if f.Fin {
+		typ ^= 0b1
+	}
+	hasOffset := f.Offset != 0
+	if f.DataLenPresent {
+		typ ^= 0b10
+	}
+	if hasOffset {
+		typ ^= 0b100
+	}
+	b = append(b, typ)
+	b = quicvarint.Append(b, uint64(f.StreamID))
+	if hasOffset {
+		b = quicvarint.Append(b, uint64(f.Offset))
+	}
+	if f.DataLenPresent {
+		b = quicvarint.Append(b, uint64(f.DataLen()))
+	}
+	b = append(b, f.Data...)
+	return b, nil
+}
+
+// Length returns the total length of the STREAM frame
+func (f *StreamFrame) Length(protocol.Version) protocol.ByteCount {
+	length := 1 + quicvarint.Len(uint64(f.StreamID))
+	if f.Offset != 0 {
+		length += quicvarint.Len(uint64(f.Offset))
+	}
+	if f.DataLenPresent {
+		length += quicvarint.Len(uint64(f.DataLen()))
+	}
+	return protocol.ByteCount(length) + f.DataLen()
+}
+
+// DataLen gives the length of data in bytes
+func (f *StreamFrame) DataLen() protocol.ByteCount {
+	return protocol.ByteCount(len(f.Data))
+}
+
+// MaxDataLen returns the maximum data length
+// If 0 is returned, writing will fail (a STREAM frame must contain at least 1 byte of data).
+func (f *StreamFrame) MaxDataLen(maxSize protocol.ByteCount, _ protocol.Version) protocol.ByteCount {
+	headerLen := 1 + protocol.ByteCount(quicvarint.Len(uint64(f.StreamID)))
+	if f.Offset != 0 {
+		headerLen += protocol.ByteCount(quicvarint.Len(uint64(f.Offset)))
+	}
+	if f.DataLenPresent {
+		// Pretend that the data size will be 1 byte.
+		// If it turns out that varint encoding the length will consume 2 bytes, we need to adjust the data length afterward
+		headerLen++
+	}
+	if headerLen > maxSize {
+		return 0
+	}
+	maxDataLen := maxSize - headerLen
+	if f.DataLenPresent && quicvarint.Len(uint64(maxDataLen)) != 1 {
+		maxDataLen--
+	}
+	return maxDataLen
+}
+
+// MaybeSplitOffFrame splits a frame such that it is not bigger than n bytes.
+// It returns if the frame was actually split.
+// The frame might not be split if:
+// * the size is large enough to fit the whole frame
+// * the size is too small to fit even a 1-byte frame. In that case, the frame returned is nil.
+func (f *StreamFrame) MaybeSplitOffFrame(maxSize protocol.ByteCount, version protocol.Version) (*StreamFrame, bool /* was splitting required */) {
+	if maxSize >= f.Length(version) {
+		return nil, false
+	}
+
+	n := f.MaxDataLen(maxSize, version)
+	if n == 0 {
+		return nil, true
+	}
+
+	new := GetStreamFrame()
+	new.StreamID = f.StreamID
+	new.Offset = f.Offset
+	new.Fin = false
+	new.DataLenPresent = f.DataLenPresent
+
+	// swap the data slices
+	new.Data, f.Data = f.Data, new.Data
+	new.fromPool, f.fromPool = f.fromPool, new.fromPool
+
+	f.Data = f.Data[:protocol.ByteCount(len(new.Data))-n]
+	copy(f.Data, new.Data[n:])
+	new.Data = new.Data[:n]
+	f.Offset += n
+
+	return new, true
+}
+
+func (f *StreamFrame) PutBack() {
+	putStreamFrame(f)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/stream_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/stream_frame_test.go
new file mode 100644
index 000000000..61aa8d943
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/stream_frame_test.go
@@ -0,0 +1,379 @@
+package wire
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseStreamFrameWithOffBit(t *testing.T) {
+	data := encodeVarInt(0x12345)                    // stream ID
+	data = append(data, encodeVarInt(0xdecafbad)...) // offset
+	data = append(data, []byte("foobar")...)
+	frame, l, err := ParseStreamFrame(data, 0x8^0x4, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0x12345), frame.StreamID)
+	require.Equal(t, []byte("foobar"), frame.Data)
+	require.False(t, frame.Fin)
+	require.Equal(t, protocol.ByteCount(0xdecafbad), frame.Offset)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseStreamFrameRespectsLEN(t *testing.T) {
+	data := encodeVarInt(0x12345)           // stream ID
+	data = append(data, encodeVarInt(4)...) // data length
+	data = append(data, []byte("foobar")...)
+	frame, l, err := ParseStreamFrame(data, 0x8^0x2, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0x12345), frame.StreamID)
+	require.Equal(t, []byte("foob"), frame.Data)
+	require.False(t, frame.Fin)
+	require.Zero(t, frame.Offset)
+	require.Equal(t, len(data)-2, l)
+}
+
+func TestParseStreamFrameWithFINBit(t *testing.T) {
+	data := encodeVarInt(9) // stream ID
+	data = append(data, []byte("foobar")...)
+	frame, l, err := ParseStreamFrame(data, 0x8^0x1, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(9), frame.StreamID)
+	require.Equal(t, []byte("foobar"), frame.Data)
+	require.True(t, frame.Fin)
+	require.Zero(t, frame.Offset)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseStreamFrameAllowsEmpty(t *testing.T) {
+	data := encodeVarInt(0x1337)                  // stream ID
+	data = append(data, encodeVarInt(0x12345)...) // offset
+	f, l, err := ParseStreamFrame(data, 0x8^0x4, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0x1337), f.StreamID)
+	require.Equal(t, protocol.ByteCount(0x12345), f.Offset)
+	require.Nil(t, f.Data)
+	require.False(t, f.Fin)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseStreamFrameRejectsOverflow(t *testing.T) {
+	data := encodeVarInt(0x12345)                                         // stream ID
+	data = append(data, encodeVarInt(uint64(protocol.MaxByteCount-5))...) // offset
+	data = append(data, []byte("foobar")...)
+	_, _, err := ParseStreamFrame(data, 0x8^0x4, protocol.Version1)
+	require.EqualError(t, err, "stream data overflows maximum offset")
+}
+
+func TestParseStreamFrameRejectsLongFrames(t *testing.T) {
+	data := encodeVarInt(0x12345)                                                // stream ID
+	data = append(data, encodeVarInt(uint64(protocol.MaxPacketBufferSize)+1)...) // data length
+	data = append(data, make([]byte, protocol.MaxPacketBufferSize+1)...)
+	_, _, err := ParseStreamFrame(data, 0x8^0x2, protocol.Version1)
+	require.Equal(t, io.EOF, err)
+}
+
+func TestParseStreamFrameRejectsFramesExceedingRemainingSize(t *testing.T) {
+	data := encodeVarInt(0x12345)           // stream ID
+	data = append(data, encodeVarInt(7)...) // data length
+	data = append(data, []byte("foobar")...)
+	_, _, err := ParseStreamFrame(data, 0x8^0x2, protocol.Version1)
+	require.Equal(t, io.EOF, err)
+}
+
+func TestParseStreamFrameErrorsOnEOFs(t *testing.T) {
+	typ := uint64(0x8 ^ 0x4 ^ 0x2)
+	data := encodeVarInt(0x12345)                    // stream ID
+	data = append(data, encodeVarInt(0xdecafbad)...) // offset
+	data = append(data, encodeVarInt(6)...)          // data length
+	data = append(data, []byte("foobar")...)
+	_, _, err := ParseStreamFrame(data, FrameType(typ), protocol.Version1)
+	require.NoError(t, err)
+	for i := range data {
+		_, _, err = ParseStreamFrame(data[:i], FrameType(typ), protocol.Version1)
+		require.Error(t, err)
+	}
+}
+
+func TestParseStreamUsesBufferForLongFrames(t *testing.T) {
+	data := encodeVarInt(0x12345) // stream ID
+	data = append(data, bytes.Repeat([]byte{'f'}, protocol.MinStreamFrameBufferSize)...)
+	frame, l, err := ParseStreamFrame(data, 0x8, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0x12345), frame.StreamID)
+	require.Equal(t, bytes.Repeat([]byte{'f'}, protocol.MinStreamFrameBufferSize), frame.Data)
+	require.Equal(t, protocol.ByteCount(protocol.MinStreamFrameBufferSize), frame.DataLen())
+	require.False(t, frame.Fin)
+	require.True(t, frame.fromPool)
+	require.Equal(t, len(data), l)
+	require.NotPanics(t, frame.PutBack)
+}
+
+func TestParseStreamDoesNotUseBufferForShortFrames(t *testing.T) {
+	data := encodeVarInt(0x12345) // stream ID
+	data = append(data, bytes.Repeat([]byte{'f'}, protocol.MinStreamFrameBufferSize-1)...)
+	frame, l, err := ParseStreamFrame(data, 0x8, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0x12345), frame.StreamID)
+	require.Equal(t, bytes.Repeat([]byte{'f'}, protocol.MinStreamFrameBufferSize-1), frame.Data)
+	require.Equal(t, protocol.ByteCount(protocol.MinStreamFrameBufferSize-1), frame.DataLen())
+	require.False(t, frame.Fin)
+	require.False(t, frame.fromPool)
+	require.Equal(t, len(data), l)
+	require.NotPanics(t, frame.PutBack)
+}
+
+func TestWriteStreamFrameWithoutOffset(t *testing.T) {
+	f := &StreamFrame{
+		StreamID: 0x1337,
+		Data:     []byte("foobar"),
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{0x8}
+	expected = append(expected, encodeVarInt(0x1337)...) // stream ID
+	expected = append(expected, []byte("foobar")...)
+	require.Equal(t, expected, b)
+	require.Equal(t, int(f.Length(protocol.Version1)), len(b))
+}
+
+func TestWriteStreamFrameWithOffset(t *testing.T) {
+	f := &StreamFrame{
+		StreamID: 0x1337,
+		Offset:   0x123456,
+		Data:     []byte("foobar"),
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{0x8 ^ 0x4}
+	expected = append(expected, encodeVarInt(0x1337)...)   // stream ID
+	expected = append(expected, encodeVarInt(0x123456)...) // offset
+	expected = append(expected, []byte("foobar")...)
+	require.Equal(t, expected, b)
+	require.Equal(t, int(f.Length(protocol.Version1)), len(b))
+}
+
+func TestWriteStreamFrameWithFIN(t *testing.T) {
+	f := &StreamFrame{
+		StreamID: 0x1337,
+		Offset:   0x123456,
+		Fin:      true,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{0x8 ^ 0x4 ^ 0x1}
+	expected = append(expected, encodeVarInt(0x1337)...)   // stream ID
+	expected = append(expected, encodeVarInt(0x123456)...) // offset
+	require.Equal(t, expected, b)
+	require.Equal(t, int(f.Length(protocol.Version1)), len(b))
+}
+
+func TestWriteStreamFrameWithDataLength(t *testing.T) {
+	f := &StreamFrame{
+		StreamID:       0x1337,
+		Data:           []byte("foobar"),
+		DataLenPresent: true,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{0x8 ^ 0x2}
+	expected = append(expected, encodeVarInt(0x1337)...) // stream ID
+	expected = append(expected, encodeVarInt(6)...)      // data length
+	expected = append(expected, []byte("foobar")...)
+	require.Equal(t, expected, b)
+	require.Equal(t, int(f.Length(protocol.Version1)), len(b))
+}
+
+func TestWriteStreamFrameWithDataLengthAndOffset(t *testing.T) {
+	f := &StreamFrame{
+		StreamID:       0x1337,
+		Data:           []byte("foobar"),
+		DataLenPresent: true,
+		Offset:         0x123456,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{0x8 ^ 0x4 ^ 0x2}
+	expected = append(expected, encodeVarInt(0x1337)...)   // stream ID
+	expected = append(expected, encodeVarInt(0x123456)...) // offset
+	expected = append(expected, encodeVarInt(6)...)        // data length
+	expected = append(expected, []byte("foobar")...)
+	require.Equal(t, expected, b)
+	require.Equal(t, int(f.Length(protocol.Version1)), len(b))
+}
+
+func TestWriteStreamFrameEmptyFrameWithoutFIN(t *testing.T) {
+	f := &StreamFrame{
+		StreamID: 0x42,
+		Offset:   0x1337,
+	}
+	_, err := f.Append(nil, protocol.Version1)
+	require.EqualError(t, err, "StreamFrame: attempting to write empty frame without FIN")
+}
+
+func TestStreamMaxDataLength(t *testing.T) {
+	const maxSize = 3000
+	data := make([]byte, maxSize)
+	f := &StreamFrame{
+		StreamID: 0x1337,
+		Offset:   0xdeadbeef,
+	}
+	for i := 1; i < 3000; i++ {
+		f.Data = nil
+		maxDataLen := f.MaxDataLen(protocol.ByteCount(i), protocol.Version1)
+		if maxDataLen == 0 { // 0 means that no valid STREAM frame can be written
+			// check that writing a minimal size STREAM frame (i.e. with 1 byte data) is actually larger than the desired size
+			f.Data = []byte{0}
+			b, err := f.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			require.Greater(t, len(b), i)
+			continue
+		}
+		f.Data = data[:int(maxDataLen)]
+		b, err := f.Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		require.Equal(t, i, len(b))
+	}
+}
+
+func TestStreamMaxDataLengthWithDataLenPresent(t *testing.T) {
+	const maxSize = 3000
+	data := make([]byte, maxSize)
+	f := &StreamFrame{
+		StreamID:       0x1337,
+		Offset:         0xdeadbeef,
+		DataLenPresent: true,
+	}
+	var frameOneByteTooSmallCounter int
+	for i := 1; i < 3000; i++ {
+		f.Data = nil
+		maxDataLen := f.MaxDataLen(protocol.ByteCount(i), protocol.Version1)
+		if maxDataLen == 0 { // 0 means that no valid STREAM frame can be written
+			// check that writing a minimal size STREAM frame (i.e. with 1 byte data) is actually larger than the desired size
+			f.Data = []byte{0}
+			b, err := f.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			require.Greater(t, len(b), i)
+			continue
+		}
+		f.Data = data[:int(maxDataLen)]
+		b, err := f.Append(nil, protocol.Version1)
+		require.NoError(t, err)
+		// There's *one* pathological case, where a data length of x can be encoded into 1 byte
+		// but a data lengths of x+1 needs 2 bytes
+		// In that case, it's impossible to create a STREAM frame of the desired size
+		if len(b) == i-1 {
+			frameOneByteTooSmallCounter++
+			continue
+		}
+		require.Equal(t, i, len(b))
+	}
+	require.Equal(t, 1, frameOneByteTooSmallCounter)
+}
+
+func TestStreamSplitting(t *testing.T) {
+	f := &StreamFrame{
+		StreamID:       0x1337,
+		DataLenPresent: true,
+		Offset:         0x100,
+		Data:           []byte("foobar"),
+	}
+	frame, needsSplit := f.MaybeSplitOffFrame(f.Length(protocol.Version1)-3, protocol.Version1)
+	require.True(t, needsSplit)
+	require.NotNil(t, frame)
+	require.True(t, f.DataLenPresent)
+	require.True(t, frame.DataLenPresent)
+	require.Equal(t, protocol.ByteCount(0x100), frame.Offset)
+	require.Equal(t, []byte("foo"), frame.Data)
+	require.Equal(t, protocol.ByteCount(0x100+3), f.Offset)
+	require.Equal(t, []byte("bar"), f.Data)
+}
+
+func TestStreamSplittingNoSplitForShortFrame(t *testing.T) {
+	f := &StreamFrame{
+		StreamID:       0x1337,
+		DataLenPresent: true,
+		Offset:         0xdeadbeef,
+		Data:           make([]byte, 100),
+	}
+	frame, needsSplit := f.MaybeSplitOffFrame(f.Length(protocol.Version1), protocol.Version1)
+	require.False(t, needsSplit)
+	require.Nil(t, frame)
+	require.Equal(t, protocol.ByteCount(100), f.DataLen())
+	frame, needsSplit = f.MaybeSplitOffFrame(f.Length(protocol.Version1)-1, protocol.Version1)
+	require.True(t, needsSplit)
+	require.Equal(t, protocol.ByteCount(99), frame.DataLen())
+	f.PutBack()
+}
+
+func TestStreamSplittingPreservesFINBit(t *testing.T) {
+	f := &StreamFrame{
+		StreamID: 0x1337,
+		Fin:      true,
+		Offset:   0xdeadbeef,
+		Data:     make([]byte, 100),
+	}
+	frame, needsSplit := f.MaybeSplitOffFrame(50, protocol.Version1)
+	require.True(t, needsSplit)
+	require.NotNil(t, frame)
+	require.Less(t, frame.Offset, f.Offset)
+	require.True(t, f.Fin)
+	require.False(t, frame.Fin)
+}
+
+func TestStreamSplittingProducesCorrectLengthFramesWithoutDataLen(t *testing.T) {
+	const size = 1000
+	f := &StreamFrame{
+		StreamID: 0xdecafbad,
+		Offset:   0x1234,
+		Data:     []byte{0},
+	}
+	minFrameSize := f.Length(protocol.Version1)
+	for i := range minFrameSize {
+		frame, needsSplit := f.MaybeSplitOffFrame(i, protocol.Version1)
+		require.True(t, needsSplit)
+		require.Nil(t, frame)
+	}
+	for i := minFrameSize; i < size; i++ {
+		f.fromPool = false
+		f.Data = make([]byte, size)
+		frame, needsSplit := f.MaybeSplitOffFrame(i, protocol.Version1)
+		require.True(t, needsSplit)
+		require.Equal(t, i, frame.Length(protocol.Version1))
+	}
+}
+
+func TestStreamSplittingProducesCorrectLengthFramesWithDataLen(t *testing.T) {
+	const size = 1000
+	f := &StreamFrame{
+		StreamID:       0xdecafbad,
+		Offset:         0x1234,
+		DataLenPresent: true,
+		Data:           []byte{0},
+	}
+	minFrameSize := f.Length(protocol.Version1)
+	for i := range minFrameSize {
+		frame, needsSplit := f.MaybeSplitOffFrame(i, protocol.Version1)
+		require.True(t, needsSplit)
+		require.Nil(t, frame)
+	}
+	var frameOneByteTooSmallCounter int
+	for i := minFrameSize; i < size; i++ {
+		f.fromPool = false
+		f.Data = make([]byte, size)
+		newFrame, needsSplit := f.MaybeSplitOffFrame(i, protocol.Version1)
+		require.True(t, needsSplit)
+		// There's *one* pathological case, where a data length of x can be encoded into 1 byte
+		// but a data lengths of x+1 needs 2 bytes
+		// In that case, it's impossible to create a STREAM frame of the desired size
+		if newFrame.Length(protocol.Version1) == i-1 {
+			frameOneByteTooSmallCounter++
+			continue
+		}
+		require.Equal(t, i, newFrame.Length(protocol.Version1))
+	}
+	require.Equal(t, 1, frameOneByteTooSmallCounter)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/streams_blocked_frame.go b/electron/native/private-transport/third_party/quic-go/internal/wire/streams_blocked_frame.go
new file mode 100644
index 000000000..d98fde46c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/streams_blocked_frame.go
@@ -0,0 +1,50 @@
+package wire
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// A StreamsBlockedFrame is a STREAMS_BLOCKED frame
+type StreamsBlockedFrame struct {
+	Type        protocol.StreamType
+	StreamLimit protocol.StreamNum
+}
+
+func parseStreamsBlockedFrame(b []byte, typ FrameType, _ protocol.Version) (*StreamsBlockedFrame, int, error) {
+	f := &StreamsBlockedFrame{}
+	//nolint:exhaustive // This will only be called with a BidiStreamBlockedFrameType or a UniStreamBlockedFrameType.
+	switch typ {
+	case FrameTypeBidiStreamBlocked:
+		f.Type = protocol.StreamTypeBidi
+	case FrameTypeUniStreamBlocked:
+		f.Type = protocol.StreamTypeUni
+	}
+	streamLimit, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return nil, 0, replaceUnexpectedEOF(err)
+	}
+	f.StreamLimit = protocol.StreamNum(streamLimit)
+	if f.StreamLimit > protocol.MaxStreamCount {
+		return nil, 0, fmt.Errorf("%d exceeds the maximum stream count", f.StreamLimit)
+	}
+	return f, l, nil
+}
+
+func (f *StreamsBlockedFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
+	switch f.Type {
+	case protocol.StreamTypeBidi:
+		b = append(b, byte(FrameTypeBidiStreamBlocked))
+	case protocol.StreamTypeUni:
+		b = append(b, byte(FrameTypeUniStreamBlocked))
+	}
+	b = quicvarint.Append(b, uint64(f.StreamLimit))
+	return b, nil
+}
+
+// Length of a written frame
+func (f *StreamsBlockedFrame) Length(_ protocol.Version) protocol.ByteCount {
+	return 1 + protocol.ByteCount(quicvarint.Len(uint64(f.StreamLimit)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/streams_blocked_frame_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/streams_blocked_frame_test.go
new file mode 100644
index 000000000..e49a124d0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/streams_blocked_frame_test.go
@@ -0,0 +1,117 @@
+package wire
+
+import (
+	"fmt"
+	"io"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseStreamsBlockedFrameBidirectional(t *testing.T) {
+	data := encodeVarInt(0x1337)
+	f, l, err := parseStreamsBlockedFrame(data, FrameTypeBidiStreamBlocked, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamTypeBidi, f.Type)
+	require.EqualValues(t, 0x1337, f.StreamLimit)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseStreamsBlockedFrameUnidirectional(t *testing.T) {
+	data := encodeVarInt(0x7331)
+	f, l, err := parseStreamsBlockedFrame(data, FrameTypeUniStreamBlocked, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamTypeUni, f.Type)
+	require.EqualValues(t, 0x7331, f.StreamLimit)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseStreamsBlockedFrameErrorsOnEOFs(t *testing.T) {
+	data := encodeVarInt(0x12345678)
+	_, l, err := parseStreamsBlockedFrame(data, FrameTypeBidiStreamBlocked, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, len(data), l)
+	for i := range data {
+		_, _, err := parseStreamsBlockedFrame(data[:i], FrameTypeBidiStreamBlocked, protocol.Version1)
+		require.Equal(t, io.EOF, err)
+	}
+}
+
+func TestParseStreamsBlockedFrameMaxStreamCount(t *testing.T) {
+	for _, streamType := range []protocol.StreamType{protocol.StreamTypeUni, protocol.StreamTypeBidi} {
+		var streamTypeStr string
+		if streamType == protocol.StreamTypeUni {
+			streamTypeStr = "unidirectional"
+		} else {
+			streamTypeStr = "bidirectional"
+		}
+		t.Run(streamTypeStr, func(t *testing.T) {
+			f := &StreamsBlockedFrame{
+				Type:        streamType,
+				StreamLimit: protocol.MaxStreamCount,
+			}
+			b, err := f.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			typ, l, err := quicvarint.Parse(b)
+			require.NoError(t, err)
+			b = b[l:]
+			frame, l, err := parseStreamsBlockedFrame(b, FrameType(typ), protocol.Version1)
+			require.NoError(t, err)
+			require.Equal(t, f, frame)
+			require.Equal(t, len(b), l)
+		})
+	}
+}
+
+func TestParseStreamsBlockedFrameErrorOnTooLargeStreamCount(t *testing.T) {
+	for _, streamType := range []protocol.StreamType{protocol.StreamTypeUni, protocol.StreamTypeBidi} {
+		var streamTypeStr string
+		if streamType == protocol.StreamTypeUni {
+			streamTypeStr = "unidirectional"
+		} else {
+			streamTypeStr = "bidirectional"
+		}
+		t.Run(streamTypeStr, func(t *testing.T) {
+			f := &StreamsBlockedFrame{
+				Type:        streamType,
+				StreamLimit: protocol.MaxStreamCount + 1,
+			}
+			b, err := f.Append(nil, protocol.Version1)
+			require.NoError(t, err)
+			typ, l, err := quicvarint.Parse(b)
+			require.NoError(t, err)
+			b = b[l:]
+			_, _, err = parseStreamsBlockedFrame(b, FrameType(typ), protocol.Version1)
+			require.EqualError(t, err, fmt.Sprintf("%d exceeds the maximum stream count", protocol.MaxStreamCount+1))
+		})
+	}
+}
+
+func TestWriteStreamsBlockedFrameBidirectional(t *testing.T) {
+	f := StreamsBlockedFrame{
+		Type:        protocol.StreamTypeBidi,
+		StreamLimit: 0xdeadbeefcafe,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeBidiStreamBlocked)}
+	expected = append(expected, encodeVarInt(0xdeadbeefcafe)...)
+	require.Equal(t, expected, b)
+	require.Equal(t, int(f.Length(protocol.Version1)), len(b))
+}
+
+func TestWriteStreamsBlockedFrameUnidirectional(t *testing.T) {
+	f := StreamsBlockedFrame{
+		Type:        protocol.StreamTypeUni,
+		StreamLimit: 0xdeadbeefcafe,
+	}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{byte(FrameTypeUniStreamBlocked)}
+	expected = append(expected, encodeVarInt(0xdeadbeefcafe)...)
+	require.Equal(t, expected, b)
+	require.Equal(t, int(f.Length(protocol.Version1)), len(b))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/test_helpers_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/test_helpers_test.go
new file mode 100644
index 000000000..003e2d0dc
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/test_helpers_test.go
@@ -0,0 +1,32 @@
+package wire
+
+import (
+	"bytes"
+	"encoding/binary"
+	"log"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+func encodeVarInt(i uint64) []byte {
+	return quicvarint.Append(nil, i)
+}
+
+func appendVersion(data []byte, v protocol.Version) []byte {
+	offset := len(data)
+	data = append(data, []byte{0, 0, 0, 0}...)
+	binary.BigEndian.PutUint32(data[offset:], uint32(v))
+	return data
+}
+
+func setupLogTest(t *testing.T, buf *bytes.Buffer) utils.Logger {
+	logger := utils.DefaultLogger
+	logger.SetLogLevel(utils.LogLevelDebug)
+	originalOutput := log.Writer()
+	log.SetOutput(buf)
+	t.Cleanup(func() { log.SetOutput(originalOutput) })
+	return logger
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/transport_parameter_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/transport_parameter_test.go
new file mode 100644
index 000000000..22699fe22
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/transport_parameter_test.go
@@ -0,0 +1,1172 @@
+package wire
+
+import (
+	"bytes"
+	"crypto/rand"
+	"fmt"
+	"math"
+	mrand "math/rand/v2"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/quicvarint"
+
+	ossfuzzseeds "github.com/quic-go/go-ossfuzz-seeds"
+
+	"github.com/stretchr/testify/require"
+)
+
+func getRandomValueUpTo(max uint64) uint64 {
+	maxVals := []uint64{math.MaxUint8 / 4, math.MaxUint16 / 4, math.MaxUint32 / 4, math.MaxUint64 / 4}
+	return mrand.Uint64N(min(max, maxVals[mrand.IntN(4)]))
+}
+
+func getRandomValue() uint64 { return getRandomValueUpTo(quicvarint.Max) }
+
+func appendInitialSourceConnectionID(b []byte) []byte {
+	b = quicvarint.Append(b, uint64(initialSourceConnectionIDParameterID))
+	b = quicvarint.Append(b, 6)
+	return append(b, []byte("foobar")...)
+}
+
+func TestTransportParametersStringRepresentation(t *testing.T) {
+	rcid := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xc0, 0xde})
+	minAckDelay := 42 * time.Millisecond
+	p := &TransportParameters{
+		InitialMaxStreamDataBidiLocal:   1234,
+		InitialMaxStreamDataBidiRemote:  2345,
+		InitialMaxStreamDataUni:         3456,
+		InitialMaxData:                  4567,
+		MaxBidiStreamNum:                1337,
+		MaxUniStreamNum:                 7331,
+		MaxIdleTimeout:                  42 * time.Second,
+		OriginalDestinationConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		InitialSourceConnectionID:       protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}),
+		RetrySourceConnectionID:         &rcid,
+		AckDelayExponent:                14,
+		MaxAckDelay:                     37 * time.Millisecond,
+		StatelessResetToken:             &protocol.StatelessResetToken{0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00},
+		ActiveConnectionIDLimit:         123,
+		MaxDatagramFrameSize:            876,
+		EnableResetStreamAt:             true,
+		MinAckDelay:                     &minAckDelay,
+	}
+	expected := "&wire.TransportParameters{OriginalDestinationConnectionID: deadbeef, InitialSourceConnectionID: decafbad, RetrySourceConnectionID: deadc0de, InitialMaxStreamDataBidiLocal: 1234, InitialMaxStreamDataBidiRemote: 2345, InitialMaxStreamDataUni: 3456, InitialMaxData: 4567, MaxBidiStreamNum: 1337, MaxUniStreamNum: 7331, MaxIdleTimeout: 42s, AckDelayExponent: 14, MaxAckDelay: 37ms, ActiveConnectionIDLimit: 123, StatelessResetToken: 0x112233445566778899aabbccddeeff00, MaxDatagramFrameSize: 876, EnableResetStreamAt: true, MinAckDelay: 42ms}"
+	require.Equal(t, expected, p.String())
+}
+
+func TestTransportParametersStringRepresentationWithoutOptionalFields(t *testing.T) {
+	p := &TransportParameters{
+		InitialMaxStreamDataBidiLocal:   1234,
+		InitialMaxStreamDataBidiRemote:  2345,
+		InitialMaxStreamDataUni:         3456,
+		InitialMaxData:                  4567,
+		MaxBidiStreamNum:                1337,
+		MaxUniStreamNum:                 7331,
+		MaxIdleTimeout:                  42 * time.Second,
+		OriginalDestinationConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		InitialSourceConnectionID:       protocol.ParseConnectionID([]byte{}),
+		AckDelayExponent:                14,
+		MaxAckDelay:                     37 * time.Second,
+		ActiveConnectionIDLimit:         89,
+		MaxDatagramFrameSize:            protocol.InvalidByteCount,
+	}
+	expected := "&wire.TransportParameters{OriginalDestinationConnectionID: deadbeef, InitialSourceConnectionID: (empty), InitialMaxStreamDataBidiLocal: 1234, InitialMaxStreamDataBidiRemote: 2345, InitialMaxStreamDataUni: 3456, InitialMaxData: 4567, MaxBidiStreamNum: 1337, MaxUniStreamNum: 7331, MaxIdleTimeout: 42s, AckDelayExponent: 14, MaxAckDelay: 37s, ActiveConnectionIDLimit: 89, EnableResetStreamAt: false}"
+	require.Equal(t, expected, p.String())
+}
+
+func TestMarshalAndUnmarshalTransportParameters(t *testing.T) {
+	var token protocol.StatelessResetToken
+	rand.Read(token[:])
+	rcid := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xc0, 0xde})
+	minAckDelay := 42 * time.Millisecond
+	params := &TransportParameters{
+		InitialMaxStreamDataBidiLocal:   protocol.ByteCount(getRandomValue()),
+		InitialMaxStreamDataBidiRemote:  protocol.ByteCount(getRandomValue()),
+		InitialMaxStreamDataUni:         protocol.ByteCount(getRandomValue()),
+		InitialMaxData:                  protocol.ByteCount(getRandomValue()),
+		MaxIdleTimeout:                  0xcafe * time.Second,
+		MaxBidiStreamNum:                protocol.StreamNum(getRandomValueUpTo(uint64(protocol.MaxStreamCount))),
+		MaxUniStreamNum:                 protocol.StreamNum(getRandomValueUpTo(uint64(protocol.MaxStreamCount))),
+		DisableActiveMigration:          true,
+		StatelessResetToken:             &token,
+		OriginalDestinationConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		InitialSourceConnectionID:       protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}),
+		RetrySourceConnectionID:         &rcid,
+		AckDelayExponent:                13,
+		MaxAckDelay:                     42 * time.Millisecond,
+		ActiveConnectionIDLimit:         2 + getRandomValueUpTo(quicvarint.Max-2),
+		MaxUDPPayloadSize:               1200 + protocol.ByteCount(getRandomValueUpTo(quicvarint.Max-1200)),
+		MaxDatagramFrameSize:            protocol.ByteCount(getRandomValue()),
+		EnableResetStreamAt:             getRandomValue()%2 == 0,
+		MinAckDelay:                     &minAckDelay,
+	}
+	data := params.Marshal(protocol.PerspectiveServer)
+
+	p := &TransportParameters{}
+	require.NoError(t, p.Unmarshal(data, protocol.PerspectiveServer))
+	require.Equal(t, params.InitialMaxStreamDataBidiLocal, p.InitialMaxStreamDataBidiLocal)
+	require.Equal(t, params.InitialMaxStreamDataBidiRemote, p.InitialMaxStreamDataBidiRemote)
+	require.Equal(t, params.InitialMaxStreamDataUni, p.InitialMaxStreamDataUni)
+	require.Equal(t, params.InitialMaxData, p.InitialMaxData)
+	require.Equal(t, params.MaxUniStreamNum, p.MaxUniStreamNum)
+	require.Equal(t, params.MaxBidiStreamNum, p.MaxBidiStreamNum)
+	require.Equal(t, params.MaxIdleTimeout, p.MaxIdleTimeout)
+	require.Equal(t, params.DisableActiveMigration, p.DisableActiveMigration)
+	require.Equal(t, params.StatelessResetToken, p.StatelessResetToken)
+	require.Equal(t, protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}), p.OriginalDestinationConnectionID)
+	require.Equal(t, protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}), p.InitialSourceConnectionID)
+	require.Equal(t, &rcid, p.RetrySourceConnectionID)
+	require.Equal(t, uint8(13), p.AckDelayExponent)
+	require.Equal(t, 42*time.Millisecond, p.MaxAckDelay)
+	require.Equal(t, params.ActiveConnectionIDLimit, p.ActiveConnectionIDLimit)
+	require.Equal(t, params.MaxUDPPayloadSize, p.MaxUDPPayloadSize)
+	require.Equal(t, params.MaxDatagramFrameSize, p.MaxDatagramFrameSize)
+	require.Equal(t, params.EnableResetStreamAt, p.EnableResetStreamAt)
+	require.NotNil(t, p.MinAckDelay)
+	require.Equal(t, minAckDelay, *p.MinAckDelay)
+}
+
+func TestResetStreamAtTransportParameterCodepoints(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		ids  []transportParameterID
+	}{
+		{name: "current", ids: []transportParameterID{resetStreamAtParameterID}},
+		{name: "legacy", ids: []transportParameterID{legacyResetStreamAtParameterID}},
+		{name: "both", ids: []transportParameterID{resetStreamAtParameterID, legacyResetStreamAtParameterID}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var data []byte
+			for _, id := range tc.ids {
+				data = quicvarint.Append(data, uint64(id))
+				data = quicvarint.Append(data, 0)
+			}
+			data = appendInitialSourceConnectionID(data)
+
+			var p TransportParameters
+			require.NoError(t, p.Unmarshal(data, protocol.PerspectiveClient))
+			require.True(t, p.EnableResetStreamAt)
+		})
+	}
+}
+
+func TestMarshalAdditionalTransportParameters(t *testing.T) {
+	origAdditionalTransportParametersClient := AdditionalTransportParametersClient
+	t.Cleanup(func() {
+		AdditionalTransportParametersClient = origAdditionalTransportParametersClient
+	})
+	AdditionalTransportParametersClient = map[uint64][]byte{1337: []byte("foobar")}
+
+	result := quicvarint.Append([]byte{}, 1337)
+	result = quicvarint.Append(result, 6)
+	result = append(result, []byte("foobar")...)
+
+	params := &TransportParameters{}
+	require.True(t, bytes.Contains(params.Marshal(protocol.PerspectiveClient), result))
+	require.False(t, bytes.Contains(params.Marshal(protocol.PerspectiveServer), result))
+}
+
+func TestMarshalRetrySourceConnectionID(t *testing.T) {
+	// no retry source connection ID
+	data := (&TransportParameters{
+		StatelessResetToken:     &protocol.StatelessResetToken{},
+		ActiveConnectionIDLimit: 2,
+	}).Marshal(protocol.PerspectiveServer)
+	var p TransportParameters
+	require.NoError(t, p.Unmarshal(data, protocol.PerspectiveServer))
+	require.Nil(t, p.RetrySourceConnectionID)
+
+	// zero-length retry source connection ID
+	rcid := protocol.ParseConnectionID([]byte{})
+	data = (&TransportParameters{
+		RetrySourceConnectionID: &rcid,
+		StatelessResetToken:     &protocol.StatelessResetToken{},
+		ActiveConnectionIDLimit: 2,
+	}).Marshal(protocol.PerspectiveServer)
+	p = TransportParameters{}
+	require.NoError(t, p.Unmarshal(data, protocol.PerspectiveServer))
+	require.NotNil(t, p.RetrySourceConnectionID)
+	require.Zero(t, p.RetrySourceConnectionID.Len())
+}
+
+func TestTransportParameterNoMaxAckDelayIfDefault(t *testing.T) {
+	const num = 1000
+	var defaultLen, dataLen int
+	maxAckDelay := protocol.DefaultMaxAckDelay + time.Millisecond
+	for range num {
+		dataDefault := (&TransportParameters{
+			MaxAckDelay:         protocol.DefaultMaxAckDelay,
+			StatelessResetToken: &protocol.StatelessResetToken{},
+		}).Marshal(protocol.PerspectiveServer)
+		defaultLen += len(dataDefault)
+		data := (&TransportParameters{
+			MaxAckDelay:         maxAckDelay,
+			StatelessResetToken: &protocol.StatelessResetToken{},
+		}).Marshal(protocol.PerspectiveServer)
+		dataLen += len(data)
+	}
+	entryLen := quicvarint.Len(uint64(ackDelayExponentParameterID)) +
+		quicvarint.Len(uint64(quicvarint.Len(uint64(maxAckDelay.Milliseconds())))) +
+		quicvarint.Len(uint64(maxAckDelay.Milliseconds()))
+	require.InDelta(t, float32(defaultLen)/num+float32(entryLen), float32(dataLen)/num, 1)
+}
+
+func TestTransportParameterNoAckDelayExponentIfDefault(t *testing.T) {
+	const num = 1000
+	var defaultLen, dataLen int
+	for range num {
+		dataDefault := (&TransportParameters{
+			AckDelayExponent:    protocol.DefaultAckDelayExponent,
+			StatelessResetToken: &protocol.StatelessResetToken{},
+		}).Marshal(protocol.PerspectiveServer)
+		defaultLen += len(dataDefault)
+		data := (&TransportParameters{
+			AckDelayExponent:    protocol.DefaultAckDelayExponent + 1,
+			StatelessResetToken: &protocol.StatelessResetToken{},
+		}).Marshal(protocol.PerspectiveServer)
+		dataLen += len(data)
+	}
+	entryLen := quicvarint.Len(uint64(ackDelayExponentParameterID)) +
+		quicvarint.Len(uint64(quicvarint.Len(protocol.DefaultAckDelayExponent+1))) +
+		quicvarint.Len(protocol.DefaultAckDelayExponent+1)
+	require.InDelta(t, float32(defaultLen)/num+float32(entryLen), float32(dataLen)/num, 1)
+}
+
+func TestTransportParameterSetsDefaultValuesWhenNotSent(t *testing.T) {
+	data := (&TransportParameters{
+		AckDelayExponent:        protocol.DefaultAckDelayExponent,
+		StatelessResetToken:     &protocol.StatelessResetToken{},
+		ActiveConnectionIDLimit: protocol.DefaultActiveConnectionIDLimit,
+	}).Marshal(protocol.PerspectiveServer)
+	p := &TransportParameters{}
+	require.NoError(t, p.Unmarshal(data, protocol.PerspectiveServer))
+	require.EqualValues(t, protocol.DefaultAckDelayExponent, p.AckDelayExponent)
+	require.EqualValues(t, protocol.DefaultActiveConnectionIDLimit, p.ActiveConnectionIDLimit)
+}
+
+func TestTransportParameterErrors(t *testing.T) {
+	tests := []struct {
+		name           string
+		params         *TransportParameters
+		perspective    protocol.Perspective
+		data           []byte
+		expectedErrMsg string
+	}{
+		{
+			name: "invalid stateless reset token length",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(statelessResetTokenParameterID))
+				b = quicvarint.Append(b, 15)
+				return append(b, make([]byte, 15)...)
+			}(),
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "wrong length for stateless_reset_token: 15 (expected 16)",
+		},
+		{
+			name: "small max UDP payload size",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(maxUDPPayloadSizeParameterID))
+				b = quicvarint.Append(b, uint64(quicvarint.Len(1199)))
+				return quicvarint.Append(b, 1199)
+			}(),
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "invalid value for max_udp_payload_size: 1199 (minimum 1200)",
+		},
+		{
+			name: "active connection ID limit too small",
+			params: &TransportParameters{
+				ActiveConnectionIDLimit: 1,
+				StatelessResetToken:     &protocol.StatelessResetToken{},
+			},
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "invalid value for active_connection_id_limit: 1 (minimum 2)",
+		},
+		{
+			name: "ack delay exponent too large",
+			params: &TransportParameters{
+				AckDelayExponent:    21,
+				StatelessResetToken: &protocol.StatelessResetToken{},
+			},
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "invalid value for ack_delay_exponent: 21 (maximum 20)",
+		},
+		{
+			name: "disable active migration has content",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(disableActiveMigrationParameterID))
+				b = quicvarint.Append(b, 6)
+				return append(b, []byte("foobar")...)
+			}(),
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "wrong length for disable_active_migration: 6 (expected empty)",
+		},
+		{
+			name: "server doesn't set original destination connection ID",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(statelessResetTokenParameterID))
+				b = quicvarint.Append(b, 16)
+				b = append(b, make([]byte, 16)...)
+				return appendInitialSourceConnectionID(b)
+			}(),
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "missing original_destination_connection_id",
+		},
+		{
+			name:           "initial source connection ID is missing",
+			data:           []byte{},
+			perspective:    protocol.PerspectiveClient,
+			expectedErrMsg: "missing initial_source_connection_id",
+		},
+		{
+			name: "max ack delay is too large",
+			params: &TransportParameters{
+				MaxAckDelay:         1 << 14 * time.Millisecond,
+				StatelessResetToken: &protocol.StatelessResetToken{},
+			},
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "invalid value for max_ack_delay: 16384ms (maximum 16383ms)",
+		},
+		{
+			name: "varint value has wrong length",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(initialMaxStreamDataBidiLocalParameterID))
+				b = quicvarint.Append(b, 2)
+				val := uint64(0xdeadbeef)
+				b = quicvarint.Append(b, val)
+				return appendInitialSourceConnectionID(b)
+			}(),
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: fmt.Sprintf("inconsistent transport parameter length for transport parameter %#x", initialMaxStreamDataBidiLocalParameterID),
+		},
+		{
+			name: "initial max streams bidi is too large",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(initialMaxStreamsBidiParameterID))
+				b = quicvarint.Append(b, uint64(quicvarint.Len(uint64(protocol.MaxStreamCount+1))))
+				b = quicvarint.Append(b, uint64(protocol.MaxStreamCount+1))
+				return appendInitialSourceConnectionID(b)
+			}(),
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "initial_max_streams_bidi too large: 1152921504606846977 (maximum 1152921504606846976)",
+		},
+		{
+			name: "initial max streams uni is too large",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(initialMaxStreamsUniParameterID))
+				b = quicvarint.Append(b, uint64(quicvarint.Len(uint64(protocol.MaxStreamCount+1))))
+				b = quicvarint.Append(b, uint64(protocol.MaxStreamCount+1))
+				return appendInitialSourceConnectionID(b)
+			}(),
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "initial_max_streams_uni too large: 1152921504606846977 (maximum 1152921504606846976)",
+		},
+		{
+			name: "not enough data to read",
+			data: func() []byte {
+				b := quicvarint.Append(nil, 0x42)
+				b = quicvarint.Append(b, 7)
+				return append(b, []byte("foobar")...)
+			}(),
+			perspective:    protocol.PerspectiveServer,
+			expectedErrMsg: "remaining length (6) smaller than parameter length (7)",
+		},
+		{
+			name: "client sent stateless reset token",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(statelessResetTokenParameterID))
+				b = quicvarint.Append(b, uint64(quicvarint.Len(16)))
+				return append(b, make([]byte, 16)...)
+			}(),
+			perspective:    protocol.PerspectiveClient,
+			expectedErrMsg: "client sent a stateless_reset_token",
+		},
+		{
+			name: "client sent original destination connection ID",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(originalDestinationConnectionIDParameterID))
+				b = quicvarint.Append(b, 6)
+				return append(b, []byte("foobar")...)
+			}(),
+			perspective:    protocol.PerspectiveClient,
+			expectedErrMsg: "client sent an original_destination_connection_id",
+		},
+		{
+			name: "huge max ack delay value",
+			data: func() []byte {
+				val := uint64(math.MaxUint64) / 5
+				b := quicvarint.Append(nil, uint64(maxAckDelayParameterID))
+				b = quicvarint.Append(b, uint64(quicvarint.Len(val)))
+				b = quicvarint.Append(b, val)
+				return appendInitialSourceConnectionID(b)
+			}(),
+			perspective:    protocol.PerspectiveClient,
+			expectedErrMsg: "invalid value for max_ack_delay: 3689348814741910323ms (maximum 16383ms)",
+		},
+		{
+			name: "invalid value for reset_stream_at",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(resetStreamAtParameterID))
+				b = quicvarint.Append(b, 1)
+				b = quicvarint.Append(b, 1)
+				return appendInitialSourceConnectionID(b)
+			}(),
+			perspective:    protocol.PerspectiveClient,
+			expectedErrMsg: "wrong length for reset_stream_at: 1 (expected empty)",
+		},
+		{
+			name: "invalid value for legacy reset_stream_at",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(legacyResetStreamAtParameterID))
+				b = quicvarint.Append(b, 1)
+				b = quicvarint.Append(b, 1)
+				return appendInitialSourceConnectionID(b)
+			}(),
+			perspective:    protocol.PerspectiveClient,
+			expectedErrMsg: "wrong length for reset_stream_at: 1 (expected empty)",
+		},
+		{
+			name: "min ack delay is greater than max ack delay",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(minAckDelayParameterID))
+				b = quicvarint.Append(b, uint64(quicvarint.Len(42001)))
+				b = quicvarint.Append(b, 42001) // 42001 microseconds
+				b = quicvarint.Append(b, uint64(maxAckDelayParameterID))
+				b = quicvarint.Append(b, uint64(quicvarint.Len(42)))
+				b = quicvarint.Append(b, 42) // 42 microseconds
+				return appendInitialSourceConnectionID(b)
+			}(),
+			perspective:    protocol.PerspectiveClient,
+			expectedErrMsg: "min_ack_delay (42.001ms) is greater than max_ack_delay (42ms)",
+		},
+		{
+			name: "huge min ack delay value",
+			data: func() []byte {
+				b := quicvarint.Append(nil, uint64(minAckDelayParameterID))
+				b = quicvarint.Append(b, uint64(quicvarint.Len(quicvarint.Max)))
+				b = quicvarint.Append(b, quicvarint.Max)
+				b = quicvarint.Append(b, uint64(maxAckDelayParameterID))
+				b = quicvarint.Append(b, uint64(quicvarint.Len(42)))
+				b = quicvarint.Append(b, 42) // 42 microseconds
+				return appendInitialSourceConnectionID(b)
+			}(),
+			perspective:    protocol.PerspectiveClient,
+			expectedErrMsg: "min_ack_delay (2562047h47m16.854775807s) is greater than max_ack_delay (42ms)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var err error
+			if tt.params != nil {
+				data := tt.params.Marshal(tt.perspective)
+				err = (&TransportParameters{}).Unmarshal(data, tt.perspective)
+			} else {
+				err = (&TransportParameters{}).Unmarshal(tt.data, tt.perspective)
+			}
+			require.Error(t, err)
+			transportErr, ok := err.(*qerr.TransportError)
+			require.True(t, ok)
+			require.Equal(t, qerr.TransportParameterError, transportErr.ErrorCode)
+			require.Equal(t, tt.expectedErrMsg, transportErr.ErrorMessage)
+		})
+	}
+}
+
+func TestTransportParameterUnknownParameters(t *testing.T) {
+	// write a known parameter
+	b := quicvarint.Append(nil, uint64(initialMaxStreamDataBidiLocalParameterID))
+	b = quicvarint.Append(b, uint64(quicvarint.Len(0x1337)))
+	b = quicvarint.Append(b, 0x1337)
+	// write an unknown parameter
+	b = quicvarint.Append(b, 0x42)
+	b = quicvarint.Append(b, 6)
+	b = append(b, []byte("foobar")...)
+	// write a known parameter
+	b = quicvarint.Append(b, uint64(initialMaxStreamDataBidiRemoteParameterID))
+	b = quicvarint.Append(b, uint64(quicvarint.Len(0x42)))
+	b = quicvarint.Append(b, 0x42)
+	b = appendInitialSourceConnectionID(b)
+	p := &TransportParameters{}
+	err := p.Unmarshal(b, protocol.PerspectiveClient)
+	require.NoError(t, err)
+	require.Equal(t, protocol.ByteCount(0x1337), p.InitialMaxStreamDataBidiLocal)
+	require.Equal(t, protocol.ByteCount(0x42), p.InitialMaxStreamDataBidiRemote)
+}
+
+func TestSessionTicketTransportParameterRejectsUnknownParameter(t *testing.T) {
+	b := (&TransportParameters{
+		ActiveConnectionIDLimit: 2,
+		MaxDatagramFrameSize:    protocol.InvalidByteCount,
+	}).MarshalForSessionTicket(nil)
+	b = quicvarint.Append(b, 0x42)
+	b = quicvarint.Append(b, 6)
+	b = append(b, []byte("foobar")...)
+
+	var p TransportParameters
+	err := p.UnmarshalFromSessionTicket(b)
+	require.EqualError(t, err, "unknown transport parameter 0x42 in session ticket")
+}
+
+func TestTransportParameterRejectsDuplicateParameters(t *testing.T) {
+	// write first parameter
+	b := quicvarint.Append(nil, uint64(initialMaxStreamDataBidiLocalParameterID))
+	b = quicvarint.Append(b, uint64(quicvarint.Len(0x1337)))
+	b = quicvarint.Append(b, 0x1337)
+	// write a second parameter
+	b = quicvarint.Append(b, uint64(initialMaxStreamDataBidiRemoteParameterID))
+	b = quicvarint.Append(b, uint64(quicvarint.Len(0x42)))
+	b = quicvarint.Append(b, 0x42)
+	// write first parameter again
+	b = quicvarint.Append(b, uint64(initialMaxStreamDataBidiLocalParameterID))
+	b = quicvarint.Append(b, uint64(quicvarint.Len(0x1337)))
+	b = quicvarint.Append(b, 0x1337)
+	b = appendInitialSourceConnectionID(b)
+	err := (&TransportParameters{}).Unmarshal(b, protocol.PerspectiveClient)
+	require.Error(t, err)
+	transportErr, ok := err.(*qerr.TransportError)
+	require.True(t, ok)
+	require.Equal(t, qerr.TransportParameterError, transportErr.ErrorCode)
+	require.Equal(t, fmt.Sprintf("received duplicate transport parameter %#x", initialMaxStreamDataBidiLocalParameterID), transportErr.ErrorMessage)
+}
+
+func TestTransportParameterPreferredAddress(t *testing.T) {
+	testCases := []struct {
+		name    string
+		hasIPv4 bool
+		hasIPv6 bool
+	}{
+		{"IPv4 and IPv6", true, true},
+		{"IPv4 only", true, false},
+		{"IPv6 only", false, true},
+		{"neither IPv4 nor IPv6", false, false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			testTransportParameterPreferredAddress(t, tc.hasIPv4, tc.hasIPv6)
+		})
+	}
+}
+
+func testTransportParameterPreferredAddress(t *testing.T, hasIPv4, hasIPv6 bool) {
+	addr4 := netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), 42)
+	addr6 := netip.AddrPortFrom(netip.AddrFrom16([16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}), 13)
+	pa := &PreferredAddress{
+		ConnectionID:        protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		StatelessResetToken: protocol.StatelessResetToken{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1},
+	}
+	if hasIPv4 {
+		pa.IPv4 = addr4
+	}
+	if hasIPv6 {
+		pa.IPv6 = addr6
+	}
+
+	data := (&TransportParameters{
+		PreferredAddress:        pa,
+		StatelessResetToken:     &protocol.StatelessResetToken{},
+		ActiveConnectionIDLimit: 2,
+	}).Marshal(protocol.PerspectiveServer)
+	p := &TransportParameters{}
+	require.NoError(t, p.Unmarshal(data, protocol.PerspectiveServer))
+	if hasIPv4 {
+		require.True(t, p.PreferredAddress.IPv4.IsValid())
+		require.Equal(t, addr4, p.PreferredAddress.IPv4)
+	} else {
+		require.False(t, p.PreferredAddress.IPv4.IsValid())
+	}
+	if hasIPv6 {
+		require.True(t, p.PreferredAddress.IPv6.IsValid())
+		require.Equal(t, addr6, p.PreferredAddress.IPv6)
+	} else {
+		require.False(t, p.PreferredAddress.IPv6.IsValid())
+	}
+	require.Equal(t, pa.ConnectionID, p.PreferredAddress.ConnectionID)
+	require.Equal(t, pa.StatelessResetToken, p.PreferredAddress.StatelessResetToken)
+}
+
+func TestTransportParameterPreferredAddressFromClient(t *testing.T) {
+	b := quicvarint.Append(nil, uint64(preferredAddressParameterID))
+	b = quicvarint.Append(b, 6)
+	b = append(b, []byte("foobar")...)
+	p := &TransportParameters{}
+	err := p.Unmarshal(b, protocol.PerspectiveClient)
+	require.Error(t, err)
+	require.IsType(t, &qerr.TransportError{}, err)
+	transportErr := err.(*qerr.TransportError)
+	require.Equal(t, qerr.TransportParameterError, transportErr.ErrorCode)
+	require.Equal(t, "client sent a preferred_address", transportErr.ErrorMessage)
+}
+
+func TestTransportParameterPreferredAddressZeroLengthConnectionID(t *testing.T) {
+	pa := &PreferredAddress{
+		IPv4:                netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), 42),
+		IPv6:                netip.AddrPortFrom(netip.AddrFrom16([16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}), 13),
+		ConnectionID:        protocol.ParseConnectionID([]byte{}),
+		StatelessResetToken: protocol.StatelessResetToken{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1},
+	}
+	data := (&TransportParameters{
+		PreferredAddress:    pa,
+		StatelessResetToken: &protocol.StatelessResetToken{},
+	}).Marshal(protocol.PerspectiveServer)
+	p := &TransportParameters{}
+	err := p.Unmarshal(data, protocol.PerspectiveServer)
+	require.Error(t, err)
+	require.IsType(t, &qerr.TransportError{}, err)
+	transportErr := err.(*qerr.TransportError)
+	require.Equal(t, qerr.TransportParameterError, transportErr.ErrorCode)
+	require.Equal(t, "invalid connection ID length: 0", transportErr.ErrorMessage)
+}
+
+func TestPreferredAddressErrorOnEOF(t *testing.T) {
+	raw := []byte{
+		127, 0, 0, 1, // IPv4
+		0, 42, // IPv4 Port
+		1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, // IPv6
+		13, 37, // IPv6 Port,
+		4, // conn ID len
+		0xde, 0xad, 0xbe, 0xef,
+		16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, // stateless reset token
+	}
+	for i := 1; i < len(raw); i++ {
+		b := quicvarint.Append(nil, uint64(preferredAddressParameterID))
+		b = append(b, raw[:i]...)
+		p := &TransportParameters{}
+		err := p.Unmarshal(b, protocol.PerspectiveServer)
+		require.Error(t, err)
+	}
+}
+
+func TestTransportParametersFromSessionTicket(t *testing.T) {
+	params := &TransportParameters{
+		InitialMaxStreamDataBidiLocal:  protocol.ByteCount(getRandomValue()),
+		InitialMaxStreamDataBidiRemote: protocol.ByteCount(getRandomValue()),
+		InitialMaxStreamDataUni:        protocol.ByteCount(getRandomValue()),
+		InitialMaxData:                 protocol.ByteCount(getRandomValue()),
+		MaxBidiStreamNum:               protocol.StreamNum(getRandomValueUpTo(uint64(protocol.MaxStreamCount))),
+		MaxUniStreamNum:                protocol.StreamNum(getRandomValueUpTo(uint64(protocol.MaxStreamCount))),
+		ActiveConnectionIDLimit:        2 + getRandomValueUpTo(quicvarint.Max-2),
+		MaxDatagramFrameSize:           protocol.ByteCount(getRandomValueUpTo(uint64(MaxDatagramSize))),
+		EnableResetStreamAt:            getRandomValue()%2 == 0,
+	}
+	require.True(t, params.ValidFor0RTT(params))
+	b := params.MarshalForSessionTicket(nil)
+	var tp TransportParameters
+	require.NoError(t, tp.UnmarshalFromSessionTicket(b))
+	require.Equal(t, params.InitialMaxStreamDataBidiLocal, tp.InitialMaxStreamDataBidiLocal)
+	require.Equal(t, params.InitialMaxStreamDataBidiRemote, tp.InitialMaxStreamDataBidiRemote)
+	require.Equal(t, params.InitialMaxStreamDataUni, tp.InitialMaxStreamDataUni)
+	require.Equal(t, params.InitialMaxData, tp.InitialMaxData)
+	require.Equal(t, params.MaxBidiStreamNum, tp.MaxBidiStreamNum)
+	require.Equal(t, params.MaxUniStreamNum, tp.MaxUniStreamNum)
+	require.Equal(t, params.ActiveConnectionIDLimit, tp.ActiveConnectionIDLimit)
+	require.Equal(t, params.MaxDatagramFrameSize, tp.MaxDatagramFrameSize)
+	require.Equal(t, params.EnableResetStreamAt, tp.EnableResetStreamAt)
+}
+
+func TestSessionTicketInvalidTransportParameters(t *testing.T) {
+	var p TransportParameters
+	require.Error(t, p.UnmarshalFromSessionTicket([]byte("foobar")))
+}
+
+func TestSessionTicketLegacyResetStreamAtTransportParameter(t *testing.T) {
+	b := quicvarint.Append(nil, transportParameterMarshalingVersion)
+	b = quicvarint.Append(b, uint64(legacyResetStreamAtParameterID))
+	b = quicvarint.Append(b, 0)
+
+	var p TransportParameters
+	require.NoError(t, p.UnmarshalFromSessionTicket(b))
+	require.True(t, p.EnableResetStreamAt)
+}
+
+func TestSessionTicketTransportParameterVersionMismatch(t *testing.T) {
+	var p TransportParameters
+	data := p.MarshalForSessionTicket(nil)
+	b := quicvarint.Append(nil, transportParameterMarshalingVersion+1)
+	b = append(b, data[quicvarint.Len(transportParameterMarshalingVersion):]...)
+	err := p.UnmarshalFromSessionTicket(b)
+	require.EqualError(t, err, fmt.Sprintf("unknown transport parameter marshaling version: %d", transportParameterMarshalingVersion+1))
+}
+
+func TestTransportParametersValidFor0RTT(t *testing.T) {
+	saved := &TransportParameters{
+		InitialMaxStreamDataBidiLocal:  1,
+		InitialMaxStreamDataBidiRemote: 2,
+		InitialMaxStreamDataUni:        3,
+		InitialMaxData:                 4,
+		MaxBidiStreamNum:               5,
+		MaxUniStreamNum:                6,
+		ActiveConnectionIDLimit:        7,
+		MaxDatagramFrameSize:           1000,
+		EnableResetStreamAt:            true,
+	}
+
+	tests := []struct {
+		name   string
+		modify func(*TransportParameters)
+		valid  bool
+	}{
+		{
+			name:   "No Changes",
+			modify: func(p *TransportParameters) {},
+			valid:  true,
+		},
+		{
+			name:   "ResetStreamAt disabled",
+			modify: func(p *TransportParameters) { p.EnableResetStreamAt = false },
+			valid:  false,
+		},
+		{
+			name: "InitialMaxStreamDataBidiLocal reduced",
+			modify: func(p *TransportParameters) {
+				p.InitialMaxStreamDataBidiLocal = saved.InitialMaxStreamDataBidiLocal - 1
+			},
+			valid: false,
+		},
+		{
+			name: "InitialMaxStreamDataBidiLocal increased",
+			modify: func(p *TransportParameters) {
+				p.InitialMaxStreamDataBidiLocal = saved.InitialMaxStreamDataBidiLocal + 1
+			},
+			valid: true,
+		},
+		{
+			name: "InitialMaxStreamDataBidiRemote reduced",
+			modify: func(p *TransportParameters) {
+				p.InitialMaxStreamDataBidiRemote = saved.InitialMaxStreamDataBidiRemote - 1
+			},
+			valid: false,
+		},
+		{
+			name: "InitialMaxStreamDataBidiRemote increased",
+			modify: func(p *TransportParameters) {
+				p.InitialMaxStreamDataBidiRemote = saved.InitialMaxStreamDataBidiRemote + 1
+			},
+			valid: true,
+		},
+		{
+			name:   "InitialMaxStreamDataUni reduced",
+			modify: func(p *TransportParameters) { p.InitialMaxStreamDataUni = saved.InitialMaxStreamDataUni - 1 },
+			valid:  false,
+		},
+		{
+			name:   "InitialMaxStreamDataUni increased",
+			modify: func(p *TransportParameters) { p.InitialMaxStreamDataUni = saved.InitialMaxStreamDataUni + 1 },
+			valid:  true,
+		},
+		{
+			name:   "InitialMaxData reduced",
+			modify: func(p *TransportParameters) { p.InitialMaxData = saved.InitialMaxData - 1 },
+			valid:  false,
+		},
+		{
+			name:   "InitialMaxData increased",
+			modify: func(p *TransportParameters) { p.InitialMaxData = saved.InitialMaxData + 1 },
+			valid:  true,
+		},
+		{
+			name:   "MaxBidiStreamNum reduced",
+			modify: func(p *TransportParameters) { p.MaxBidiStreamNum = saved.MaxBidiStreamNum - 1 },
+			valid:  false,
+		},
+		{
+			name:   "MaxBidiStreamNum increased",
+			modify: func(p *TransportParameters) { p.MaxBidiStreamNum = saved.MaxBidiStreamNum + 1 },
+			valid:  true,
+		},
+		{
+			name:   "MaxUniStreamNum reduced",
+			modify: func(p *TransportParameters) { p.MaxUniStreamNum = saved.MaxUniStreamNum - 1 },
+			valid:  false,
+		},
+		{
+			name:   "MaxUniStreamNum increased",
+			modify: func(p *TransportParameters) { p.MaxUniStreamNum = saved.MaxUniStreamNum + 1 },
+			valid:  true,
+		},
+		{
+			name:   "ActiveConnectionIDLimit changed",
+			modify: func(p *TransportParameters) { p.ActiveConnectionIDLimit = 0 },
+			valid:  false,
+		},
+		{
+			name:   "MaxDatagramFrameSize increased",
+			modify: func(p *TransportParameters) { p.MaxDatagramFrameSize = saved.MaxDatagramFrameSize + 1 },
+			valid:  true,
+		},
+		{
+			name:   "MaxDatagramFrameSize reduced",
+			modify: func(p *TransportParameters) { p.MaxDatagramFrameSize = saved.MaxDatagramFrameSize - 1 },
+			valid:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p := *saved
+			tt.modify(&p)
+			require.Equal(t, tt.valid, p.ValidFor0RTT(saved))
+		})
+	}
+	t.Run("ResetStreamAt enabled", func(t *testing.T) {
+		p := *saved
+		withoutResetStreamAt := *saved
+		withoutResetStreamAt.EnableResetStreamAt = false
+		require.True(t, p.ValidFor0RTT(&withoutResetStreamAt))
+	})
+}
+
+func TestTransportParametersValidAfter0RTT(t *testing.T) {
+	saved := &TransportParameters{
+		InitialMaxStreamDataBidiLocal:  1,
+		InitialMaxStreamDataBidiRemote: 2,
+		InitialMaxStreamDataUni:        3,
+		InitialMaxData:                 4,
+		MaxBidiStreamNum:               5,
+		MaxUniStreamNum:                6,
+		ActiveConnectionIDLimit:        7,
+		MaxDatagramFrameSize:           1000,
+		EnableResetStreamAt:            true,
+	}
+
+	tests := []struct {
+		name   string
+		modify func(*TransportParameters)
+		reject bool
+	}{
+		{
+			name:   "no changes",
+			modify: func(p *TransportParameters) {},
+			reject: false,
+		},
+		{
+			name:   "ResetStreamAt disabled",
+			modify: func(p *TransportParameters) { p.EnableResetStreamAt = false },
+			reject: true,
+		},
+		{
+			name: "InitialMaxStreamDataBidiLocal reduced",
+			modify: func(p *TransportParameters) {
+				p.InitialMaxStreamDataBidiLocal = saved.InitialMaxStreamDataBidiLocal - 1
+			},
+			reject: true,
+		},
+		{
+			name: "InitialMaxStreamDataBidiLocal increased",
+			modify: func(p *TransportParameters) {
+				p.InitialMaxStreamDataBidiLocal = saved.InitialMaxStreamDataBidiLocal + 1
+			},
+			reject: false,
+		},
+		{
+			name: "InitialMaxStreamDataBidiRemote reduced",
+			modify: func(p *TransportParameters) {
+				p.InitialMaxStreamDataBidiRemote = saved.InitialMaxStreamDataBidiRemote - 1
+			},
+			reject: true,
+		},
+		{
+			name: "InitialMaxStreamDataBidiRemote increased",
+			modify: func(p *TransportParameters) {
+				p.InitialMaxStreamDataBidiRemote = saved.InitialMaxStreamDataBidiRemote + 1
+			},
+			reject: false,
+		},
+		{
+			name:   "InitialMaxStreamDataUni reduced",
+			modify: func(p *TransportParameters) { p.InitialMaxStreamDataUni = saved.InitialMaxStreamDataUni - 1 },
+			reject: true,
+		},
+		{
+			name:   "InitialMaxStreamDataUni increased",
+			modify: func(p *TransportParameters) { p.InitialMaxStreamDataUni = saved.InitialMaxStreamDataUni + 1 },
+			reject: false,
+		},
+		{
+			name:   "InitialMaxData reduced",
+			modify: func(p *TransportParameters) { p.InitialMaxData = saved.InitialMaxData - 1 },
+			reject: true,
+		},
+		{
+			name:   "InitialMaxData increased",
+			modify: func(p *TransportParameters) { p.InitialMaxData = saved.InitialMaxData + 1 },
+			reject: false,
+		},
+		{
+			name:   "MaxBidiStreamNum reduced",
+			modify: func(p *TransportParameters) { p.MaxBidiStreamNum = saved.MaxBidiStreamNum - 1 },
+			reject: true,
+		},
+		{
+			name:   "MaxBidiStreamNum increased",
+			modify: func(p *TransportParameters) { p.MaxBidiStreamNum = saved.MaxBidiStreamNum + 1 },
+			reject: false,
+		},
+		{
+			name:   "MaxUniStreamNum reduced",
+			modify: func(p *TransportParameters) { p.MaxUniStreamNum = saved.MaxUniStreamNum - 1 },
+			reject: true,
+		},
+		{
+			name:   "MaxUniStreamNum increased",
+			modify: func(p *TransportParameters) { p.MaxUniStreamNum = saved.MaxUniStreamNum + 1 },
+			reject: false,
+		},
+		{
+			name:   "ActiveConnectionIDLimit reduced",
+			modify: func(p *TransportParameters) { p.ActiveConnectionIDLimit = saved.ActiveConnectionIDLimit - 1 },
+			reject: true,
+		},
+		{
+			name:   "ActiveConnectionIDLimit increased",
+			modify: func(p *TransportParameters) { p.ActiveConnectionIDLimit = saved.ActiveConnectionIDLimit + 1 },
+			reject: false,
+		},
+		{
+			name:   "MaxDatagramFrameSize reduced",
+			modify: func(p *TransportParameters) { p.MaxDatagramFrameSize = saved.MaxDatagramFrameSize - 1 },
+			reject: true,
+		},
+		{
+			name:   "MaxDatagramFrameSize increased",
+			modify: func(p *TransportParameters) { p.MaxDatagramFrameSize = saved.MaxDatagramFrameSize + 1 },
+			reject: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p := *saved
+			tt.modify(&p)
+			if tt.reject {
+				require.False(t, p.ValidForUpdate(saved))
+			} else {
+				require.True(t, p.ValidForUpdate(saved))
+			}
+		})
+	}
+	t.Run("ResetStreamAt enabled", func(t *testing.T) {
+		p := *saved
+		withoutResetStreamAt := *saved
+		withoutResetStreamAt.EnableResetStreamAt = false
+		require.True(t, p.ValidForUpdate(&withoutResetStreamAt))
+	})
+}
+
+func BenchmarkTransportParameters(b *testing.B) {
+	b.Run("without preferred address", func(b *testing.B) { benchmarkTransportParameters(b, false) })
+	b.Run("with preferred address", func(b *testing.B) { benchmarkTransportParameters(b, true) })
+}
+
+func benchmarkTransportParameters(b *testing.B, withPreferredAddress bool) {
+	b.ReportAllocs()
+
+	var token protocol.StatelessResetToken
+	rand.Read(token[:])
+	rcid := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xc0, 0xde})
+	params := &TransportParameters{
+		InitialMaxStreamDataBidiLocal:   protocol.ByteCount(getRandomValue()),
+		InitialMaxStreamDataBidiRemote:  protocol.ByteCount(getRandomValue()),
+		InitialMaxStreamDataUni:         protocol.ByteCount(getRandomValue()),
+		InitialMaxData:                  protocol.ByteCount(getRandomValue()),
+		MaxIdleTimeout:                  0xcafe * time.Second,
+		MaxBidiStreamNum:                protocol.StreamNum(getRandomValueUpTo(uint64(protocol.MaxStreamCount))),
+		MaxUniStreamNum:                 protocol.StreamNum(getRandomValueUpTo(uint64(protocol.MaxStreamCount))),
+		DisableActiveMigration:          true,
+		StatelessResetToken:             &token,
+		OriginalDestinationConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		InitialSourceConnectionID:       protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}),
+		RetrySourceConnectionID:         &rcid,
+		AckDelayExponent:                13,
+		MaxAckDelay:                     42 * time.Millisecond,
+		ActiveConnectionIDLimit:         2 + getRandomValueUpTo(quicvarint.Max-2),
+		MaxDatagramFrameSize:            protocol.ByteCount(getRandomValue()),
+	}
+	var token2 protocol.StatelessResetToken
+	rand.Read(token2[:])
+	if withPreferredAddress {
+		var ip4 [4]byte
+		var ip6 [16]byte
+		rand.Read(ip4[:])
+		rand.Read(ip6[:])
+		params.PreferredAddress = &PreferredAddress{
+			IPv4:                netip.AddrPortFrom(netip.AddrFrom4(ip4), 1234),
+			IPv6:                netip.AddrPortFrom(netip.AddrFrom16(ip6), 4321),
+			ConnectionID:        protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+			StatelessResetToken: token2,
+		}
+	}
+	data := params.Marshal(protocol.PerspectiveServer)
+
+	var p TransportParameters
+	for b.Loop() {
+		if err := p.Unmarshal(data, protocol.PerspectiveServer); err != nil {
+			b.Fatal(err)
+		}
+		// check a few fields
+		if p.DisableActiveMigration != params.DisableActiveMigration ||
+			p.InitialMaxStreamDataBidiLocal != params.InitialMaxStreamDataBidiLocal ||
+			*p.StatelessResetToken != *params.StatelessResetToken ||
+			p.AckDelayExponent != params.AckDelayExponent {
+			b.Fatalf("params mismatch: %v vs %v", p, params)
+		}
+		if withPreferredAddress && *p.PreferredAddress != *params.PreferredAddress {
+			b.Fatalf("preferred address mismatch: %v vs %v", p.PreferredAddress, params.PreferredAddress)
+		}
+	}
+}
+
+func FuzzTransportParameters(f *testing.F) {
+	corpus := ossfuzzseeds.New(f)
+
+	savedParams := (&TransportParameters{
+		InitialMaxStreamDataBidiLocal:  1234,
+		InitialMaxStreamDataBidiRemote: 2345,
+		InitialMaxStreamDataUni:        3456,
+		InitialMaxData:                 4567,
+		MaxBidiStreamNum:               1337,
+		MaxUniStreamNum:                7331,
+		ActiveConnectionIDLimit:        7,
+		MaxDatagramFrameSize:           protocol.InvalidByteCount,
+	}).MarshalForSessionTicket(nil)
+	zeroRTTParams := (&TransportParameters{
+		StatelessResetToken:     &protocol.StatelessResetToken{},
+		ActiveConnectionIDLimit: 7,
+		MaxDatagramFrameSize:    1200,
+	}).Marshal(protocol.PerspectiveServer)
+
+	rcid := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xc0, 0xde})
+	minAckDelay := 42 * time.Millisecond
+	for _, seed := range []struct {
+		Data      []byte
+		SavedData []byte
+	}{
+		{(&TransportParameters{
+			StatelessResetToken:     &protocol.StatelessResetToken{},
+			ActiveConnectionIDLimit: 2,
+		}).Marshal(protocol.PerspectiveServer), savedParams},
+		{zeroRTTParams, savedParams},
+		{(&TransportParameters{
+			ActiveConnectionIDLimit: 2,
+			RetrySourceConnectionID: &rcid,
+		}).Marshal(protocol.PerspectiveClient), savedParams},
+		{(&TransportParameters{
+			EnableResetStreamAt:     true,
+			RetrySourceConnectionID: &rcid,
+			MinAckDelay:             &minAckDelay,
+		}).Marshal(protocol.PerspectiveClient), savedParams},
+		// session ticket
+		{savedParams, savedParams},
+		// with preferred address
+		{(&TransportParameters{
+			StatelessResetToken:     &protocol.StatelessResetToken{},
+			ActiveConnectionIDLimit: 2,
+			PreferredAddress: &PreferredAddress{
+				IPv4:                netip.AddrPortFrom(netip.AddrFrom4([4]byte{127, 0, 0, 1}), 42),
+				IPv6:                netip.AddrPortFrom(netip.AddrFrom16([16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}), 13),
+				ConnectionID:        protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+				StatelessResetToken: protocol.StatelessResetToken{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1},
+			},
+		}).Marshal(protocol.PerspectiveServer), savedParams},
+	} {
+		corpus.Add(seed.Data, seed.SavedData)
+	}
+
+	f.Fuzz(func(t *testing.T, data, savedData []byte) {
+		fuzzTransportParameters(t, data, protocol.PerspectiveClient)
+		fuzzTransportParameters(t, data, protocol.PerspectiveServer)
+		fuzzTransportParametersSessionTicket(t, data)
+		fuzzTransportParameters0RTT(t, data, savedData)
+	})
+}
+
+func fuzzTransportParameters(t *testing.T, data []byte, sentBy protocol.Perspective) {
+	t.Helper()
+
+	tp := &TransportParameters{}
+	if err := tp.Unmarshal(data, sentBy); err != nil {
+		return
+	}
+	_ = tp.String()
+	checkTransportParameterInvariants(t, tp, sentBy)
+
+	tp2 := &TransportParameters{}
+	if err := tp2.Unmarshal(tp.Marshal(sentBy), sentBy); err != nil {
+		t.Fatalf("error unmarshaling re-marshaled transport parameters: %s", err)
+	}
+	checkTransportParameterInvariants(t, tp2, sentBy)
+}
+
+func fuzzTransportParametersSessionTicket(t *testing.T, data []byte) {
+	t.Helper()
+
+	tp := &TransportParameters{}
+	if err := tp.UnmarshalFromSessionTicket(data); err != nil {
+		return
+	}
+	_ = tp.String()
+	b := tp.MarshalForSessionTicket(nil)
+	tp2 := &TransportParameters{}
+	if err := tp2.UnmarshalFromSessionTicket(b); err != nil {
+		t.Fatalf("error unmarshaling re-marshaled session ticket transport parameters: %s", err)
+	}
+}
+
+func fuzzTransportParameters0RTT(t *testing.T, data, savedData []byte) {
+	t.Helper()
+
+	tp := &TransportParameters{}
+	if err := tp.Unmarshal(data, protocol.PerspectiveServer); err != nil {
+		return
+	}
+	saved := &TransportParameters{}
+	if err := saved.UnmarshalFromSessionTicket(savedData); err != nil {
+		return
+	}
+	_ = tp.ValidFor0RTT(saved)
+	_ = tp.ValidForUpdate(saved)
+}
+
+func checkTransportParameterInvariants(t *testing.T, tp *TransportParameters, sentBy protocol.Perspective) {
+	t.Helper()
+
+	if sentBy == protocol.PerspectiveClient && tp.StatelessResetToken != nil {
+		t.Fatal("client's transport parameters contained stateless reset token")
+	}
+	if tp.MaxIdleTimeout < 0 {
+		t.Fatalf("negative max_idle_timeout: %s", tp.MaxIdleTimeout)
+	}
+	if tp.AckDelayExponent > 20 {
+		t.Fatalf("invalid ack_delay_exponent: %d", tp.AckDelayExponent)
+	}
+	if tp.MaxUDPPayloadSize < 1200 {
+		t.Fatalf("invalid max_udp_payload_size: %d", tp.MaxUDPPayloadSize)
+	}
+	if tp.ActiveConnectionIDLimit < 2 {
+		t.Fatalf("invalid active_connection_id_limit: %d", tp.ActiveConnectionIDLimit)
+	}
+	if tp.OriginalDestinationConnectionID.Len() > 20 {
+		t.Fatalf("invalid original_destination_connection_id length: %s", tp.OriginalDestinationConnectionID)
+	}
+	if tp.InitialSourceConnectionID.Len() > 20 {
+		t.Fatalf("invalid initial_source_connection_id length: %s", tp.InitialSourceConnectionID)
+	}
+	if tp.RetrySourceConnectionID != nil && tp.RetrySourceConnectionID.Len() > 20 {
+		t.Fatalf("invalid retry_source_connection_id length: %s", tp.RetrySourceConnectionID)
+	}
+	if tp.PreferredAddress != nil && tp.PreferredAddress.ConnectionID.Len() > 20 {
+		t.Fatalf("invalid preferred_address connection ID length: %s", tp.PreferredAddress.ConnectionID)
+	}
+	if tp.MinAckDelay != nil {
+		if *tp.MinAckDelay < 0 {
+			t.Fatalf("negative min_ack_delay: %s", *tp.MinAckDelay)
+		}
+		if *tp.MinAckDelay > tp.MaxAckDelay {
+			t.Fatalf("min_ack_delay (%s) is greater than max_ack_delay (%s)", *tp.MinAckDelay, tp.MaxAckDelay)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/transport_parameters.go b/electron/native/private-transport/third_party/quic-go/internal/wire/transport_parameters.go
new file mode 100644
index 000000000..8a32c1cdb
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/transport_parameters.go
@@ -0,0 +1,595 @@
+package wire
+
+import (
+	"crypto/rand"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net/netip"
+	"slices"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+// AdditionalTransportParametersClient are additional transport parameters that will be added
+// to the client's transport parameters.
+// This is not intended for production use, but _only_ to increase the size of the ClientHello beyond
+// the usual size of less than 1 MTU.
+var AdditionalTransportParametersClient map[uint64][]byte
+
+const transportParameterMarshalingVersion = 1
+
+type transportParameterID uint64
+
+const (
+	originalDestinationConnectionIDParameterID transportParameterID = 0x0
+	maxIdleTimeoutParameterID                  transportParameterID = 0x1
+	statelessResetTokenParameterID             transportParameterID = 0x2
+	maxUDPPayloadSizeParameterID               transportParameterID = 0x3
+	initialMaxDataParameterID                  transportParameterID = 0x4
+	initialMaxStreamDataBidiLocalParameterID   transportParameterID = 0x5
+	initialMaxStreamDataBidiRemoteParameterID  transportParameterID = 0x6
+	initialMaxStreamDataUniParameterID         transportParameterID = 0x7
+	initialMaxStreamsBidiParameterID           transportParameterID = 0x8
+	initialMaxStreamsUniParameterID            transportParameterID = 0x9
+	ackDelayExponentParameterID                transportParameterID = 0xa
+	maxAckDelayParameterID                     transportParameterID = 0xb
+	disableActiveMigrationParameterID          transportParameterID = 0xc
+	preferredAddressParameterID                transportParameterID = 0xd
+	activeConnectionIDLimitParameterID         transportParameterID = 0xe
+	initialSourceConnectionIDParameterID       transportParameterID = 0xf
+	retrySourceConnectionIDParameterID         transportParameterID = 0x10
+	// RFC 9221
+	maxDatagramFrameSizeParameterID transportParameterID = 0x20
+	// https://datatracker.ietf.org/doc/draft-ietf-quic-reliable-stream-reset/09/
+	resetStreamAtParameterID transportParameterID = 0x1d
+	// https://datatracker.ietf.org/doc/draft-ietf-quic-reliable-stream-reset/07/
+	// When removing support for this codepoint, increment transportParameterMarshalingVersion
+	// to prevent 0-RTT resumption with tickets that remember it.
+	legacyResetStreamAtParameterID transportParameterID = 0x17f7586d2cb571
+	// https://datatracker.ietf.org/doc/draft-ietf-quic-ack-frequency/11/
+	minAckDelayParameterID transportParameterID = 0xff04de1b
+)
+
+// PreferredAddress is the value encoding in the preferred_address transport parameter
+type PreferredAddress struct {
+	IPv4, IPv6          netip.AddrPort
+	ConnectionID        protocol.ConnectionID
+	StatelessResetToken protocol.StatelessResetToken
+}
+
+// TransportParameters are parameters sent to the peer during the handshake
+type TransportParameters struct {
+	InitialMaxStreamDataBidiLocal  protocol.ByteCount
+	InitialMaxStreamDataBidiRemote protocol.ByteCount
+	InitialMaxStreamDataUni        protocol.ByteCount
+	InitialMaxData                 protocol.ByteCount
+
+	MaxAckDelay      time.Duration
+	AckDelayExponent uint8
+
+	DisableActiveMigration bool
+
+	MaxUDPPayloadSize protocol.ByteCount
+
+	MaxUniStreamNum  protocol.StreamNum
+	MaxBidiStreamNum protocol.StreamNum
+
+	MaxIdleTimeout time.Duration
+
+	PreferredAddress *PreferredAddress
+
+	OriginalDestinationConnectionID protocol.ConnectionID
+	InitialSourceConnectionID       protocol.ConnectionID
+	RetrySourceConnectionID         *protocol.ConnectionID // use a pointer here to distinguish zero-length connection IDs from missing transport parameters
+
+	StatelessResetToken     *protocol.StatelessResetToken
+	ActiveConnectionIDLimit uint64
+
+	MaxDatagramFrameSize protocol.ByteCount // RFC 9221
+	EnableResetStreamAt  bool               // https://datatracker.ietf.org/doc/draft-ietf-quic-reliable-stream-reset/09/
+	MinAckDelay          *time.Duration
+}
+
+// Unmarshal the transport parameters
+func (p *TransportParameters) Unmarshal(data []byte, sentBy protocol.Perspective) error {
+	if err := p.unmarshal(data, sentBy, false); err != nil {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.TransportParameterError,
+			ErrorMessage: err.Error(),
+		}
+	}
+	return nil
+}
+
+func (p *TransportParameters) unmarshal(b []byte, sentBy protocol.Perspective, fromSessionTicket bool) error {
+	// needed to check that every parameter is only sent at most once
+	parameterIDs := make([]transportParameterID, 0, 32)
+
+	var (
+		readOriginalDestinationConnectionID bool
+		readInitialSourceConnectionID       bool
+	)
+
+	p.AckDelayExponent = protocol.DefaultAckDelayExponent
+	p.MaxAckDelay = protocol.DefaultMaxAckDelay
+	p.MaxDatagramFrameSize = protocol.InvalidByteCount
+	p.ActiveConnectionIDLimit = protocol.DefaultActiveConnectionIDLimit
+
+	for len(b) > 0 {
+		paramIDInt, l, err := quicvarint.Parse(b)
+		if err != nil {
+			return err
+		}
+		paramID := transportParameterID(paramIDInt)
+		b = b[l:]
+		paramLen, l, err := quicvarint.Parse(b)
+		if err != nil {
+			return err
+		}
+		b = b[l:]
+		if uint64(len(b)) < paramLen {
+			return fmt.Errorf("remaining length (%d) smaller than parameter length (%d)", len(b), paramLen)
+		}
+		parameterIDs = append(parameterIDs, paramID)
+		switch paramID {
+		case maxIdleTimeoutParameterID,
+			maxUDPPayloadSizeParameterID,
+			initialMaxDataParameterID,
+			initialMaxStreamDataBidiLocalParameterID,
+			initialMaxStreamDataBidiRemoteParameterID,
+			initialMaxStreamDataUniParameterID,
+			initialMaxStreamsBidiParameterID,
+			initialMaxStreamsUniParameterID,
+			maxAckDelayParameterID,
+			maxDatagramFrameSizeParameterID,
+			ackDelayExponentParameterID,
+			activeConnectionIDLimitParameterID,
+			minAckDelayParameterID:
+			if err := p.readNumericTransportParameter(b, paramID, int(paramLen)); err != nil {
+				return err
+			}
+			b = b[paramLen:]
+		case preferredAddressParameterID:
+			if sentBy == protocol.PerspectiveClient {
+				return errors.New("client sent a preferred_address")
+			}
+			if err := p.readPreferredAddress(b, int(paramLen)); err != nil {
+				return err
+			}
+			b = b[paramLen:]
+		case disableActiveMigrationParameterID:
+			if paramLen != 0 {
+				return fmt.Errorf("wrong length for disable_active_migration: %d (expected empty)", paramLen)
+			}
+			p.DisableActiveMigration = true
+		case statelessResetTokenParameterID:
+			if sentBy == protocol.PerspectiveClient {
+				return errors.New("client sent a stateless_reset_token")
+			}
+			if paramLen != 16 {
+				return fmt.Errorf("wrong length for stateless_reset_token: %d (expected 16)", paramLen)
+			}
+			var token protocol.StatelessResetToken
+			if len(b) < len(token) {
+				return io.EOF
+			}
+			copy(token[:], b)
+			b = b[len(token):]
+			p.StatelessResetToken = &token
+		case originalDestinationConnectionIDParameterID:
+			if sentBy == protocol.PerspectiveClient {
+				return errors.New("client sent an original_destination_connection_id")
+			}
+			if paramLen > protocol.MaxConnIDLen {
+				return protocol.ErrInvalidConnectionIDLen
+			}
+			p.OriginalDestinationConnectionID = protocol.ParseConnectionID(b[:paramLen])
+			b = b[paramLen:]
+			readOriginalDestinationConnectionID = true
+		case initialSourceConnectionIDParameterID:
+			if paramLen > protocol.MaxConnIDLen {
+				return protocol.ErrInvalidConnectionIDLen
+			}
+			p.InitialSourceConnectionID = protocol.ParseConnectionID(b[:paramLen])
+			b = b[paramLen:]
+			readInitialSourceConnectionID = true
+		case retrySourceConnectionIDParameterID:
+			if sentBy == protocol.PerspectiveClient {
+				return errors.New("client sent a retry_source_connection_id")
+			}
+			if paramLen > protocol.MaxConnIDLen {
+				return protocol.ErrInvalidConnectionIDLen
+			}
+			connID := protocol.ParseConnectionID(b[:paramLen])
+			b = b[paramLen:]
+			p.RetrySourceConnectionID = &connID
+		case resetStreamAtParameterID, legacyResetStreamAtParameterID:
+			if paramLen != 0 {
+				return fmt.Errorf("wrong length for reset_stream_at: %d (expected empty)", paramLen)
+			}
+			p.EnableResetStreamAt = true
+		default:
+			if fromSessionTicket {
+				// A ticket might contain a parameter for an extension supported by an older
+				// version of this endpoint. If we can't parse it, don't resume with it.
+				return fmt.Errorf("unknown transport parameter %#x in session ticket", paramID)
+			}
+			b = b[paramLen:]
+		}
+	}
+
+	// min_ack_delay must be less or equal to max_ack_delay
+	if p.MinAckDelay != nil && *p.MinAckDelay > p.MaxAckDelay {
+		return fmt.Errorf("min_ack_delay (%s) is greater than max_ack_delay (%s)", *p.MinAckDelay, p.MaxAckDelay)
+	}
+	if !fromSessionTicket {
+		if sentBy == protocol.PerspectiveServer && !readOriginalDestinationConnectionID {
+			return errors.New("missing original_destination_connection_id")
+		}
+		if p.MaxUDPPayloadSize == 0 {
+			p.MaxUDPPayloadSize = protocol.MaxByteCount
+		}
+		if !readInitialSourceConnectionID {
+			return errors.New("missing initial_source_connection_id")
+		}
+	}
+
+	// check that every transport parameter was sent at most once
+	slices.Sort(parameterIDs)
+	for i := range len(parameterIDs) - 1 {
+		if parameterIDs[i] == parameterIDs[i+1] {
+			return fmt.Errorf("received duplicate transport parameter %#x", parameterIDs[i])
+		}
+	}
+
+	return nil
+}
+
+func (p *TransportParameters) readPreferredAddress(b []byte, expectedLen int) error {
+	remainingLen := len(b)
+	pa := &PreferredAddress{}
+	if len(b) < 4+2+16+2+1 {
+		return io.EOF
+	}
+	var ipv4 [4]byte
+	copy(ipv4[:], b[:4])
+	port4 := binary.BigEndian.Uint16(b[4:])
+	b = b[4+2:]
+	if port4 != 0 && ipv4 != [4]byte{} {
+		pa.IPv4 = netip.AddrPortFrom(netip.AddrFrom4(ipv4), port4)
+	}
+	var ipv6 [16]byte
+	copy(ipv6[:], b[:16])
+	port6 := binary.BigEndian.Uint16(b[16:])
+	if port6 != 0 && ipv6 != [16]byte{} {
+		pa.IPv6 = netip.AddrPortFrom(netip.AddrFrom16(ipv6), port6)
+	}
+	b = b[16+2:]
+	connIDLen := int(b[0])
+	b = b[1:]
+	if connIDLen == 0 || connIDLen > protocol.MaxConnIDLen {
+		return fmt.Errorf("invalid connection ID length: %d", connIDLen)
+	}
+	if len(b) < connIDLen+len(pa.StatelessResetToken) {
+		return io.EOF
+	}
+	pa.ConnectionID = protocol.ParseConnectionID(b[:connIDLen])
+	b = b[connIDLen:]
+	copy(pa.StatelessResetToken[:], b)
+	b = b[len(pa.StatelessResetToken):]
+	if bytesRead := remainingLen - len(b); bytesRead != expectedLen {
+		return fmt.Errorf("expected preferred_address to be %d long, read %d bytes", expectedLen, bytesRead)
+	}
+	p.PreferredAddress = pa
+	return nil
+}
+
+func (p *TransportParameters) readNumericTransportParameter(b []byte, paramID transportParameterID, expectedLen int) error {
+	val, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return fmt.Errorf("error while reading transport parameter %d: %s", paramID, err)
+	}
+	if l != expectedLen {
+		return fmt.Errorf("inconsistent transport parameter length for transport parameter %#x", paramID)
+	}
+	//nolint:exhaustive // This only covers the numeric transport parameters.
+	switch paramID {
+	case initialMaxStreamDataBidiLocalParameterID:
+		p.InitialMaxStreamDataBidiLocal = protocol.ByteCount(val)
+	case initialMaxStreamDataBidiRemoteParameterID:
+		p.InitialMaxStreamDataBidiRemote = protocol.ByteCount(val)
+	case initialMaxStreamDataUniParameterID:
+		p.InitialMaxStreamDataUni = protocol.ByteCount(val)
+	case initialMaxDataParameterID:
+		p.InitialMaxData = protocol.ByteCount(val)
+	case initialMaxStreamsBidiParameterID:
+		p.MaxBidiStreamNum = protocol.StreamNum(val)
+		if p.MaxBidiStreamNum > protocol.MaxStreamCount {
+			return fmt.Errorf("initial_max_streams_bidi too large: %d (maximum %d)", p.MaxBidiStreamNum, protocol.MaxStreamCount)
+		}
+	case initialMaxStreamsUniParameterID:
+		p.MaxUniStreamNum = protocol.StreamNum(val)
+		if p.MaxUniStreamNum > protocol.MaxStreamCount {
+			return fmt.Errorf("initial_max_streams_uni too large: %d (maximum %d)", p.MaxUniStreamNum, protocol.MaxStreamCount)
+		}
+	case maxIdleTimeoutParameterID:
+		p.MaxIdleTimeout = max(protocol.MinRemoteIdleTimeout, time.Duration(val)*time.Millisecond)
+	case maxUDPPayloadSizeParameterID:
+		if val < 1200 {
+			return fmt.Errorf("invalid value for max_udp_payload_size: %d (minimum 1200)", val)
+		}
+		p.MaxUDPPayloadSize = protocol.ByteCount(val)
+	case ackDelayExponentParameterID:
+		if val > protocol.MaxAckDelayExponent {
+			return fmt.Errorf("invalid value for ack_delay_exponent: %d (maximum %d)", val, protocol.MaxAckDelayExponent)
+		}
+		p.AckDelayExponent = uint8(val)
+	case maxAckDelayParameterID:
+		if val > uint64(protocol.MaxMaxAckDelay/time.Millisecond) {
+			return fmt.Errorf("invalid value for max_ack_delay: %dms (maximum %dms)", val, protocol.MaxMaxAckDelay/time.Millisecond)
+		}
+		p.MaxAckDelay = time.Duration(val) * time.Millisecond
+	case activeConnectionIDLimitParameterID:
+		if val < 2 {
+			return fmt.Errorf("invalid value for active_connection_id_limit: %d (minimum 2)", val)
+		}
+		p.ActiveConnectionIDLimit = val
+	case maxDatagramFrameSizeParameterID:
+		p.MaxDatagramFrameSize = protocol.ByteCount(val)
+	case minAckDelayParameterID:
+		mad := time.Duration(val) * time.Microsecond
+		if mad < 0 {
+			mad = math.MaxInt64
+		}
+		p.MinAckDelay = &mad
+	default:
+		return fmt.Errorf("TransportParameter BUG: transport parameter %d not found", paramID)
+	}
+	return nil
+}
+
+// Marshal the transport parameters
+func (p *TransportParameters) Marshal(pers protocol.Perspective) []byte {
+	// Typical Transport Parameters consume around 110 bytes, depending on the exact values,
+	// especially the lengths of the Connection IDs.
+	// Allocate 256 bytes, so we won't have to grow the slice in any case.
+	b := make([]byte, 0, 256)
+
+	// add a greased value
+	random := make([]byte, 18)
+	rand.Read(random)
+	b = quicvarint.Append(b, 27+31*uint64(random[0]))
+	length := random[1] % 16
+	b = quicvarint.Append(b, uint64(length))
+	b = append(b, random[2:2+length]...)
+
+	// initial_max_stream_data_bidi_local
+	b = p.marshalVarintParam(b, initialMaxStreamDataBidiLocalParameterID, uint64(p.InitialMaxStreamDataBidiLocal))
+	// initial_max_stream_data_bidi_remote
+	b = p.marshalVarintParam(b, initialMaxStreamDataBidiRemoteParameterID, uint64(p.InitialMaxStreamDataBidiRemote))
+	// initial_max_stream_data_uni
+	b = p.marshalVarintParam(b, initialMaxStreamDataUniParameterID, uint64(p.InitialMaxStreamDataUni))
+	// initial_max_data
+	b = p.marshalVarintParam(b, initialMaxDataParameterID, uint64(p.InitialMaxData))
+	// initial_max_bidi_streams
+	b = p.marshalVarintParam(b, initialMaxStreamsBidiParameterID, uint64(p.MaxBidiStreamNum))
+	// initial_max_uni_streams
+	b = p.marshalVarintParam(b, initialMaxStreamsUniParameterID, uint64(p.MaxUniStreamNum))
+	// idle_timeout
+	b = p.marshalVarintParam(b, maxIdleTimeoutParameterID, uint64(p.MaxIdleTimeout/time.Millisecond))
+	// max_udp_payload_size
+	if p.MaxUDPPayloadSize > 0 {
+		b = p.marshalVarintParam(b, maxUDPPayloadSizeParameterID, uint64(p.MaxUDPPayloadSize))
+	}
+	// max_ack_delay
+	// Only send it if is different from the default value.
+	if p.MaxAckDelay != protocol.DefaultMaxAckDelay {
+		b = p.marshalVarintParam(b, maxAckDelayParameterID, uint64(p.MaxAckDelay/time.Millisecond))
+	}
+	// ack_delay_exponent
+	// Only send it if is different from the default value.
+	if p.AckDelayExponent != protocol.DefaultAckDelayExponent {
+		b = p.marshalVarintParam(b, ackDelayExponentParameterID, uint64(p.AckDelayExponent))
+	}
+	// disable_active_migration
+	if p.DisableActiveMigration {
+		b = quicvarint.Append(b, uint64(disableActiveMigrationParameterID))
+		b = quicvarint.Append(b, 0)
+	}
+	if pers == protocol.PerspectiveServer {
+		// stateless_reset_token
+		if p.StatelessResetToken != nil {
+			b = quicvarint.Append(b, uint64(statelessResetTokenParameterID))
+			b = quicvarint.Append(b, 16)
+			b = append(b, p.StatelessResetToken[:]...)
+		}
+		// original_destination_connection_id
+		b = quicvarint.Append(b, uint64(originalDestinationConnectionIDParameterID))
+		b = quicvarint.Append(b, uint64(p.OriginalDestinationConnectionID.Len()))
+		b = append(b, p.OriginalDestinationConnectionID.Bytes()...)
+		// preferred_address
+		if p.PreferredAddress != nil {
+			b = quicvarint.Append(b, uint64(preferredAddressParameterID))
+			b = quicvarint.Append(b, 4+2+16+2+1+uint64(p.PreferredAddress.ConnectionID.Len())+16)
+			if p.PreferredAddress.IPv4.IsValid() {
+				ipv4 := p.PreferredAddress.IPv4.Addr().As4()
+				b = append(b, ipv4[:]...)
+				b = binary.BigEndian.AppendUint16(b, p.PreferredAddress.IPv4.Port())
+			} else {
+				b = append(b, make([]byte, 6)...)
+			}
+			if p.PreferredAddress.IPv6.IsValid() {
+				ipv6 := p.PreferredAddress.IPv6.Addr().As16()
+				b = append(b, ipv6[:]...)
+				b = binary.BigEndian.AppendUint16(b, p.PreferredAddress.IPv6.Port())
+			} else {
+				b = append(b, make([]byte, 18)...)
+			}
+			b = append(b, uint8(p.PreferredAddress.ConnectionID.Len()))
+			b = append(b, p.PreferredAddress.ConnectionID.Bytes()...)
+			b = append(b, p.PreferredAddress.StatelessResetToken[:]...)
+		}
+	}
+	// active_connection_id_limit
+	if p.ActiveConnectionIDLimit != protocol.DefaultActiveConnectionIDLimit {
+		b = p.marshalVarintParam(b, activeConnectionIDLimitParameterID, p.ActiveConnectionIDLimit)
+	}
+	// initial_source_connection_id
+	b = quicvarint.Append(b, uint64(initialSourceConnectionIDParameterID))
+	b = quicvarint.Append(b, uint64(p.InitialSourceConnectionID.Len()))
+	b = append(b, p.InitialSourceConnectionID.Bytes()...)
+	// retry_source_connection_id
+	if pers == protocol.PerspectiveServer && p.RetrySourceConnectionID != nil {
+		b = quicvarint.Append(b, uint64(retrySourceConnectionIDParameterID))
+		b = quicvarint.Append(b, uint64(p.RetrySourceConnectionID.Len()))
+		b = append(b, p.RetrySourceConnectionID.Bytes()...)
+	}
+	// QUIC datagrams
+	if p.MaxDatagramFrameSize != protocol.InvalidByteCount {
+		b = p.marshalVarintParam(b, maxDatagramFrameSizeParameterID, uint64(p.MaxDatagramFrameSize))
+	}
+	// QUIC Stream Resets with Partial Delivery
+	if p.EnableResetStreamAt {
+		b = quicvarint.Append(b, uint64(resetStreamAtParameterID))
+		b = quicvarint.Append(b, 0)
+		b = quicvarint.Append(b, uint64(legacyResetStreamAtParameterID))
+		b = quicvarint.Append(b, 0)
+	}
+	if p.MinAckDelay != nil {
+		b = p.marshalVarintParam(b, minAckDelayParameterID, uint64(*p.MinAckDelay/time.Microsecond))
+	}
+
+	if pers == protocol.PerspectiveClient && len(AdditionalTransportParametersClient) > 0 {
+		for k, v := range AdditionalTransportParametersClient {
+			b = quicvarint.Append(b, k)
+			b = quicvarint.Append(b, uint64(len(v)))
+			b = append(b, v...)
+		}
+	}
+
+	return b
+}
+
+func (p *TransportParameters) marshalVarintParam(b []byte, id transportParameterID, val uint64) []byte {
+	b = quicvarint.Append(b, uint64(id))
+	b = quicvarint.Append(b, uint64(quicvarint.Len(val)))
+	return quicvarint.Append(b, val)
+}
+
+// MarshalForSessionTicket marshals the transport parameters we save in the session ticket.
+// When sending a 0-RTT enabled TLS session tickets, we need to save the transport parameters.
+// The client will remember the transport parameters used in the last session,
+// and apply those to the 0-RTT data it sends.
+// Saving the transport parameters in the ticket gives the server the option to reject 0-RTT
+// if the transport parameters changed.
+// Since the session ticket is encrypted, the serialization format is defined by the server.
+// For convenience, we use the same format that we also use for sending the transport parameters.
+func (p *TransportParameters) MarshalForSessionTicket(b []byte) []byte {
+	b = quicvarint.Append(b, transportParameterMarshalingVersion)
+
+	// initial_max_stream_data_bidi_local
+	b = p.marshalVarintParam(b, initialMaxStreamDataBidiLocalParameterID, uint64(p.InitialMaxStreamDataBidiLocal))
+	// initial_max_stream_data_bidi_remote
+	b = p.marshalVarintParam(b, initialMaxStreamDataBidiRemoteParameterID, uint64(p.InitialMaxStreamDataBidiRemote))
+	// initial_max_stream_data_uni
+	b = p.marshalVarintParam(b, initialMaxStreamDataUniParameterID, uint64(p.InitialMaxStreamDataUni))
+	// initial_max_data
+	b = p.marshalVarintParam(b, initialMaxDataParameterID, uint64(p.InitialMaxData))
+	// initial_max_bidi_streams
+	b = p.marshalVarintParam(b, initialMaxStreamsBidiParameterID, uint64(p.MaxBidiStreamNum))
+	// initial_max_uni_streams
+	b = p.marshalVarintParam(b, initialMaxStreamsUniParameterID, uint64(p.MaxUniStreamNum))
+	// active_connection_id_limit
+	b = p.marshalVarintParam(b, activeConnectionIDLimitParameterID, p.ActiveConnectionIDLimit)
+	// max_datagram_frame_size
+	if p.MaxDatagramFrameSize != protocol.InvalidByteCount {
+		b = p.marshalVarintParam(b, maxDatagramFrameSizeParameterID, uint64(p.MaxDatagramFrameSize))
+	}
+	// reset_stream_at
+	if p.EnableResetStreamAt {
+		b = quicvarint.Append(b, uint64(resetStreamAtParameterID))
+		b = quicvarint.Append(b, 0)
+	}
+	return b
+}
+
+// UnmarshalFromSessionTicket unmarshals transport parameters from a session ticket.
+func (p *TransportParameters) UnmarshalFromSessionTicket(b []byte) error {
+	version, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return err
+	}
+	if version != transportParameterMarshalingVersion {
+		return fmt.Errorf("unknown transport parameter marshaling version: %d", version)
+	}
+	return p.unmarshal(b[l:], protocol.PerspectiveServer, true)
+}
+
+// ValidFor0RTT checks if the transport parameters match those saved in the session ticket.
+func (p *TransportParameters) ValidFor0RTT(saved *TransportParameters) bool {
+	if saved.MaxDatagramFrameSize != protocol.InvalidByteCount && (p.MaxDatagramFrameSize == protocol.InvalidByteCount || p.MaxDatagramFrameSize < saved.MaxDatagramFrameSize) {
+		return false
+	}
+	if saved.EnableResetStreamAt && !p.EnableResetStreamAt {
+		return false
+	}
+	return p.InitialMaxStreamDataBidiLocal >= saved.InitialMaxStreamDataBidiLocal &&
+		p.InitialMaxStreamDataBidiRemote >= saved.InitialMaxStreamDataBidiRemote &&
+		p.InitialMaxStreamDataUni >= saved.InitialMaxStreamDataUni &&
+		p.InitialMaxData >= saved.InitialMaxData &&
+		p.MaxBidiStreamNum >= saved.MaxBidiStreamNum &&
+		p.MaxUniStreamNum >= saved.MaxUniStreamNum &&
+		p.ActiveConnectionIDLimit == saved.ActiveConnectionIDLimit
+}
+
+// ValidForUpdate checks that the new transport parameters don't reduce limits after resuming a 0-RTT connection.
+// It is only used on the client side.
+func (p *TransportParameters) ValidForUpdate(saved *TransportParameters) bool {
+	if saved.MaxDatagramFrameSize != protocol.InvalidByteCount && (p.MaxDatagramFrameSize == protocol.InvalidByteCount || p.MaxDatagramFrameSize < saved.MaxDatagramFrameSize) {
+		return false
+	}
+	if saved.EnableResetStreamAt && !p.EnableResetStreamAt {
+		return false
+	}
+	return p.ActiveConnectionIDLimit >= saved.ActiveConnectionIDLimit &&
+		p.InitialMaxData >= saved.InitialMaxData &&
+		p.InitialMaxStreamDataBidiLocal >= saved.InitialMaxStreamDataBidiLocal &&
+		p.InitialMaxStreamDataBidiRemote >= saved.InitialMaxStreamDataBidiRemote &&
+		p.InitialMaxStreamDataUni >= saved.InitialMaxStreamDataUni &&
+		p.MaxBidiStreamNum >= saved.MaxBidiStreamNum &&
+		p.MaxUniStreamNum >= saved.MaxUniStreamNum
+}
+
+// String returns a string representation, intended for logging.
+func (p *TransportParameters) String() string {
+	logString := "&wire.TransportParameters{OriginalDestinationConnectionID: %s, InitialSourceConnectionID: %s, "
+	logParams := []any{p.OriginalDestinationConnectionID, p.InitialSourceConnectionID}
+	if p.RetrySourceConnectionID != nil {
+		logString += "RetrySourceConnectionID: %s, "
+		logParams = append(logParams, p.RetrySourceConnectionID)
+	}
+	logString += "InitialMaxStreamDataBidiLocal: %d, InitialMaxStreamDataBidiRemote: %d, InitialMaxStreamDataUni: %d, InitialMaxData: %d, MaxBidiStreamNum: %d, MaxUniStreamNum: %d, MaxIdleTimeout: %s, AckDelayExponent: %d, MaxAckDelay: %s, ActiveConnectionIDLimit: %d"
+	logParams = append(logParams, []any{p.InitialMaxStreamDataBidiLocal, p.InitialMaxStreamDataBidiRemote, p.InitialMaxStreamDataUni, p.InitialMaxData, p.MaxBidiStreamNum, p.MaxUniStreamNum, p.MaxIdleTimeout, p.AckDelayExponent, p.MaxAckDelay, p.ActiveConnectionIDLimit}...)
+	if p.StatelessResetToken != nil { // the client never sends a stateless reset token
+		logString += ", StatelessResetToken: %#x"
+		logParams = append(logParams, *p.StatelessResetToken)
+	}
+	if p.MaxDatagramFrameSize != protocol.InvalidByteCount {
+		logString += ", MaxDatagramFrameSize: %d"
+		logParams = append(logParams, p.MaxDatagramFrameSize)
+	}
+	logString += ", EnableResetStreamAt: %t"
+	logParams = append(logParams, p.EnableResetStreamAt)
+	if p.MinAckDelay != nil {
+		logString += ", MinAckDelay: %s"
+		logParams = append(logParams, *p.MinAckDelay)
+	}
+	logString += "}"
+	return fmt.Sprintf(logString, logParams...)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/version_negotiation.go b/electron/native/private-transport/third_party/quic-go/internal/wire/version_negotiation.go
new file mode 100644
index 000000000..407cb629c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/version_negotiation.go
@@ -0,0 +1,53 @@
+package wire
+
+import (
+	"crypto/rand"
+	"encoding/binary"
+	"errors"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// ParseVersionNegotiationPacket parses a Version Negotiation packet.
+func ParseVersionNegotiationPacket(b []byte) (dest, src protocol.ArbitraryLenConnectionID, _ []protocol.Version, _ error) {
+	n, dest, src, err := ParseArbitraryLenConnectionIDs(b)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	b = b[n:]
+	if len(b) == 0 {
+		//nolint:staticcheck // SA1021: the packet is called Version Negotiation packet
+		return nil, nil, nil, errors.New("Version Negotiation packet has empty version list")
+	}
+	if len(b)%4 != 0 {
+		//nolint:staticcheck // SA1021: the packet is called Version Negotiation packet
+		return nil, nil, nil, errors.New("Version Negotiation packet has a version list with an invalid length")
+	}
+	versions := make([]protocol.Version, len(b)/4)
+	for i := 0; len(b) > 0; i++ {
+		versions[i] = protocol.Version(binary.BigEndian.Uint32(b[:4]))
+		b = b[4:]
+	}
+	return dest, src, versions, nil
+}
+
+// ComposeVersionNegotiation composes a Version Negotiation
+func ComposeVersionNegotiation(destConnID, srcConnID protocol.ArbitraryLenConnectionID, versions []protocol.Version) []byte {
+	greasedVersions := protocol.GetGreasedVersions(versions)
+	expectedLen := 1 /* type byte */ + 4 /* version field */ + 1 /* dest connection ID length field */ + destConnID.Len() + 1 /* src connection ID length field */ + srcConnID.Len() + len(greasedVersions)*4
+	buf := make([]byte, 1+4 /* type byte and version field */, expectedLen)
+	_, _ = rand.Read(buf[:1]) // ignore the error here. It is not critical to have perfect random here.
+	// Setting the "QUIC bit" (0x40) is not required by the RFC,
+	// but it allows clients to demultiplex QUIC with a long list of other protocols.
+	// See RFC 9443 and https://mailarchive.ietf.org/arch/msg/quic/oR4kxGKY6mjtPC1CZegY1ED4beg/ for details.
+	buf[0] |= 0xc0
+	// The next 4 bytes are left at 0 (version number).
+	buf = append(buf, uint8(destConnID.Len()))
+	buf = append(buf, destConnID.Bytes()...)
+	buf = append(buf, uint8(srcConnID.Len()))
+	buf = append(buf, srcConnID.Bytes()...)
+	for _, v := range greasedVersions {
+		buf = binary.BigEndian.AppendUint32(buf, uint32(v))
+	}
+	return buf
+}
diff --git a/electron/native/private-transport/third_party/quic-go/internal/wire/version_negotiation_test.go b/electron/native/private-transport/third_party/quic-go/internal/wire/version_negotiation_test.go
new file mode 100644
index 000000000..0fbffe5ba
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/internal/wire/version_negotiation_test.go
@@ -0,0 +1,103 @@
+package wire
+
+import (
+	"crypto/rand"
+	"encoding/binary"
+	mrand "math/rand/v2"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseVersionNegotiationPacket(t *testing.T) {
+	randConnID := func(l int) protocol.ArbitraryLenConnectionID {
+		b := make(protocol.ArbitraryLenConnectionID, l)
+		_, err := rand.Read(b)
+		require.NoError(t, err)
+		return b
+	}
+
+	srcConnID := randConnID(mrand.IntN(255) + 1)
+	destConnID := randConnID(mrand.IntN(255) + 1)
+	versions := []protocol.Version{0x22334455, 0x33445566}
+	data := []byte{0x80, 0, 0, 0, 0}
+	data = append(data, uint8(len(destConnID)))
+	data = append(data, destConnID...)
+	data = append(data, uint8(len(srcConnID)))
+	data = append(data, srcConnID...)
+	for _, v := range versions {
+		data = append(data, []byte{0, 0, 0, 0}...)
+		binary.BigEndian.PutUint32(data[len(data)-4:], uint32(v))
+	}
+	require.True(t, IsVersionNegotiationPacket(data))
+	dest, src, supportedVersions, err := ParseVersionNegotiationPacket(data)
+	require.NoError(t, err)
+	require.Equal(t, destConnID, dest)
+	require.Equal(t, srcConnID, src)
+	require.Equal(t, versions, supportedVersions)
+}
+
+func TestParseVersionNegotiationPacketWithInvalidLength(t *testing.T) {
+	connID := protocol.ArbitraryLenConnectionID{1, 2, 3, 4, 5, 6, 7, 8}
+	versions := []protocol.Version{0x22334455, 0x33445566}
+	data := ComposeVersionNegotiation(connID, connID, versions)
+	_, _, _, err := ParseVersionNegotiationPacket(data[:len(data)-2])
+	require.EqualError(t, err, "Version Negotiation packet has a version list with an invalid length")
+}
+
+func TestParseVersionNegotiationPacketEmptyVersions(t *testing.T) {
+	connID := protocol.ArbitraryLenConnectionID{1, 2, 3, 4, 5, 6, 7, 8}
+	versions := []protocol.Version{0x22334455}
+	data := ComposeVersionNegotiation(connID, connID, versions)
+	// remove 8 bytes (two versions), since ComposeVersionNegotiation also added a reserved version number
+	data = data[:len(data)-8]
+	_, _, _, err := ParseVersionNegotiationPacket(data)
+	require.EqualError(t, err, "Version Negotiation packet has empty version list")
+}
+
+func TestComposeVersionNegotiationWithReservedVersion(t *testing.T) {
+	srcConnID := protocol.ArbitraryLenConnectionID{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0x13, 0x37}
+	destConnID := protocol.ArbitraryLenConnectionID{1, 2, 3, 4, 5, 6, 7, 8}
+	versions := []protocol.Version{1001, 1003}
+	data := ComposeVersionNegotiation(destConnID, srcConnID, versions)
+	require.True(t, IsLongHeaderPacket(data[0]))
+	require.NotZero(t, data[0]&0x40)
+	v, err := ParseVersion(data)
+	require.NoError(t, err)
+	require.Zero(t, v)
+	dest, src, supportedVersions, err := ParseVersionNegotiationPacket(data)
+	require.NoError(t, err)
+	require.Equal(t, destConnID, dest)
+	require.Equal(t, srcConnID, src)
+	// the supported versions should include one reserved version number
+	require.Len(t, supportedVersions, len(versions)+1)
+	for _, v := range versions {
+		require.Contains(t, supportedVersions, v)
+	}
+	var reservedVersion protocol.Version
+versionLoop:
+	for _, ver := range supportedVersions {
+		for _, v := range versions {
+			if v == ver {
+				continue versionLoop
+			}
+		}
+		reservedVersion = ver
+	}
+	require.NotZero(t, reservedVersion)
+	require.True(t, reservedVersion&0x0f0f0f0f == 0x0a0a0a0a) // check that it's a greased version number
+}
+
+func BenchmarkComposeVersionNegotiationPacket(b *testing.B) {
+	b.ReportAllocs()
+
+	supportedVersions := []protocol.Version{protocol.Version2, protocol.Version1, 0x1337}
+	destConnID := protocol.ArbitraryLenConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 0xa, 0xb, 0xc, 0xd}
+	srcConnID := protocol.ArbitraryLenConnectionID{10, 9, 8, 7, 6, 5, 4, 3, 2, 1}
+
+	for b.Loop() {
+		ComposeVersionNegotiation(destConnID, srcConnID, supportedVersions)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/interop/Dockerfile b/electron/native/private-transport/third_party/quic-go/interop/Dockerfile
new file mode 100644
index 000000000..6b825dc9e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/interop/Dockerfile
@@ -0,0 +1,38 @@
+FROM martenseemann/quic-network-simulator-endpoint:latest AS builder
+
+ARG TARGETPLATFORM
+RUN echo "TARGETPLATFORM: ${TARGETPLATFORM}"
+
+RUN apt-get update && apt-get install -y wget tar git && rm -rf /var/lib/apt/lists/*
+
+ENV GOVERSION=1.27.0
+
+RUN platform=$(echo ${TARGETPLATFORM} | tr '/' '-') && \
+  filename="go${GOVERSION}.${platform}.tar.gz" && \
+  wget https://dl.google.com/go/${filename} && \
+  tar xfz ${filename} && \
+  rm ${filename}
+
+ENV PATH="/go/bin:${PATH}"
+
+# build with --build-arg CACHEBUST=$(date +%s)
+ARG CACHEBUST=1
+
+COPY . /quic-go
+WORKDIR /quic-go
+
+RUN git rev-parse HEAD | tee commit.txt
+RUN go build -o server -ldflags="-X github.com/quic-go/quic-go/qlog.quicGoVersion=$(git describe --always --long --dirty)" interop/server/main.go
+RUN go build -o client -ldflags="-X github.com/quic-go/quic-go/qlog.quicGoVersion=$(git describe --always --long --dirty)" interop/client/main.go
+
+
+FROM martenseemann/quic-network-simulator-endpoint:latest
+
+WORKDIR /quic-go
+
+COPY --from=builder /quic-go/commit.txt /quic-go/server /quic-go/client ./
+COPY --from=builder /quic-go/interop/run_endpoint.sh ./
+
+RUN chmod +x run_endpoint.sh
+
+ENTRYPOINT [ "./run_endpoint.sh" ]
diff --git a/electron/native/private-transport/third_party/quic-go/interop/client/main.go b/electron/native/private-transport/third_party/quic-go/interop/client/main.go
new file mode 100644
index 000000000..fcde0bf78
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/interop/client/main.go
@@ -0,0 +1,210 @@
+package main
+
+import (
+	"crypto/tls"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"golang.org/x/sync/errgroup"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qtls"
+	"github.com/quic-go/quic-go/interop/http09"
+	"github.com/quic-go/quic-go/interop/utils"
+)
+
+var errUnsupported = errors.New("unsupported test case")
+
+var tlsConf *tls.Config
+
+func main() {
+	logFile, err := os.Create("/logs/log.txt")
+	if err != nil {
+		fmt.Printf("Could not create log file: %s\n", err.Error())
+		os.Exit(1)
+	}
+	defer logFile.Close()
+	log.SetOutput(logFile)
+
+	keyLog, err := utils.GetSSLKeyLog()
+	if err != nil {
+		fmt.Printf("Could not create key log: %s\n", err.Error())
+		os.Exit(1)
+	}
+	if keyLog != nil {
+		defer keyLog.Close()
+	}
+
+	tlsConf = &tls.Config{
+		InsecureSkipVerify: true,
+		KeyLogWriter:       keyLog,
+	}
+	testcase := os.Getenv("TESTCASE")
+	if err := runTestcase(testcase); err != nil {
+		if err == errUnsupported {
+			fmt.Printf("unsupported test case: %s\n", testcase)
+			os.Exit(127)
+		}
+		fmt.Printf("Downloading files failed: %s\n", err.Error())
+		os.Exit(1)
+	}
+}
+
+func runTestcase(testcase string) error {
+	flag.Parse()
+	urls := flag.Args()
+
+	quicConf := &quic.Config{Tracer: utils.NewQLOGConnectionTracer}
+
+	if testcase == "http3" {
+		r := &http3.Transport{
+			TLSClientConfig: tlsConf,
+			QUICConfig:      quicConf,
+		}
+		defer r.Close()
+		return downloadFiles(r, urls, false)
+	}
+
+	r := &http09.RoundTripper{
+		TLSClientConfig: tlsConf,
+		QuicConfig:      quicConf,
+	}
+	defer r.Close()
+
+	switch testcase {
+	case "handshake", "transfer", "retry":
+	case "keyupdate":
+		handshake.FirstKeyUpdateInterval = 100
+	case "chacha20":
+		reset := qtls.SetCipherSuite(tls.TLS_CHACHA20_POLY1305_SHA256)
+		defer reset()
+	case "multiconnect":
+		return runMultiConnectTest(r, urls)
+	case "versionnegotiation":
+		return runVersionNegotiationTest(r, urls)
+	case "resumption":
+		return runResumptionTest(r, urls, false)
+	case "zerortt":
+		return runResumptionTest(r, urls, true)
+	default:
+		return errUnsupported
+	}
+
+	return downloadFiles(r, urls, false)
+}
+
+func runVersionNegotiationTest(r *http09.RoundTripper, urls []string) error {
+	if len(urls) != 1 {
+		return errors.New("expected at least 2 URLs")
+	}
+	protocol.SupportedVersions = []protocol.Version{0x1a2a3a4a}
+	err := downloadFile(r, urls[0], false)
+	if err == nil {
+		return errors.New("expected version negotiation to fail")
+	}
+	if !strings.Contains(err.Error(), "No compatible QUIC version found") {
+		return fmt.Errorf("expect version negotiation error, got: %s", err.Error())
+	}
+	return nil
+}
+
+func runMultiConnectTest(r *http09.RoundTripper, urls []string) error {
+	for _, url := range urls {
+		if err := downloadFile(r, url, false); err != nil {
+			return err
+		}
+		if err := r.Close(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+type sessionCache struct {
+	tls.ClientSessionCache
+	put chan<- struct{}
+}
+
+func newSessionCache(c tls.ClientSessionCache) (tls.ClientSessionCache, <-chan struct{}) {
+	put := make(chan struct{}, 100)
+	return &sessionCache{ClientSessionCache: c, put: put}, put
+}
+
+func (c *sessionCache) Put(key string, cs *tls.ClientSessionState) {
+	c.ClientSessionCache.Put(key, cs)
+	c.put <- struct{}{}
+}
+
+func runResumptionTest(r *http09.RoundTripper, urls []string, use0RTT bool) error {
+	if len(urls) < 2 {
+		return errors.New("expected at least 2 URLs")
+	}
+
+	var put <-chan struct{}
+	tlsConf.ClientSessionCache, put = newSessionCache(tls.NewLRUClientSessionCache(1))
+
+	// do the first transfer
+	if err := downloadFiles(r, urls[:1], false); err != nil {
+		return err
+	}
+
+	// wait for the session ticket to arrive
+	select {
+	case <-time.NewTimer(10 * time.Second).C:
+		return errors.New("expected to receive a session ticket within 10 seconds")
+	case <-put:
+	}
+
+	if err := r.Close(); err != nil {
+		return err
+	}
+
+	// reestablish the connection, using the session ticket that the server (hopefully provided)
+	defer r.Close()
+	return downloadFiles(r, urls[1:], use0RTT)
+}
+
+func downloadFiles(cl http.RoundTripper, urls []string, use0RTT bool) error {
+	var g errgroup.Group
+	for _, u := range urls {
+		url := u
+		g.Go(func() error {
+			return downloadFile(cl, url, use0RTT)
+		})
+	}
+	return g.Wait()
+}
+
+func downloadFile(cl http.RoundTripper, url string, use0RTT bool) error {
+	method := http.MethodGet
+	if use0RTT {
+		method = http09.MethodGet0RTT
+	}
+	req, err := http.NewRequest(method, url, nil)
+	if err != nil {
+		return err
+	}
+	rsp, err := cl.RoundTrip(req)
+	if err != nil {
+		return err
+	}
+	defer rsp.Body.Close()
+
+	file, err := os.Create("/downloads" + req.URL.Path)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	_, err = io.Copy(file, rsp.Body)
+	return err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/interop/http09/client.go b/electron/native/private-transport/third_party/quic-go/interop/http09/client.go
new file mode 100644
index 000000000..a0b65142e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/interop/http09/client.go
@@ -0,0 +1,159 @@
+package http09
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+
+	"golang.org/x/net/idna"
+
+	"github.com/quic-go/quic-go"
+)
+
+// MethodGet0RTT allows a GET request to be sent using 0-RTT.
+// Note that 0-RTT data doesn't provide replay protection.
+const MethodGet0RTT = "GET_0RTT"
+
+// RoundTripper performs HTTP/0.9 roundtrips over QUIC.
+type RoundTripper struct {
+	mutex sync.Mutex
+
+	TLSClientConfig *tls.Config
+	QuicConfig      *quic.Config
+
+	clients map[string]*client
+}
+
+var _ http.RoundTripper = &RoundTripper{}
+
+// RoundTrip performs a HTTP/0.9 request.
+// It only supports GET requests.
+func (r *RoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	if req.Method != http.MethodGet && req.Method != MethodGet0RTT {
+		return nil, errors.New("only GET requests supported")
+	}
+
+	log.Printf("Requesting %s.\n", req.URL)
+
+	r.mutex.Lock()
+	hostname := authorityAddr("https", hostnameFromRequest(req))
+	if r.clients == nil {
+		r.clients = make(map[string]*client)
+	}
+	c, ok := r.clients[hostname]
+	if !ok {
+		tlsConf := &tls.Config{}
+		if r.TLSClientConfig != nil {
+			tlsConf = r.TLSClientConfig.Clone()
+		}
+		tlsConf.NextProtos = []string{NextProto}
+		c = &client{
+			hostname: hostname,
+			tlsConf:  tlsConf,
+			quicConf: r.QuicConfig,
+		}
+		r.clients[hostname] = c
+	}
+	r.mutex.Unlock()
+	return c.RoundTrip(req)
+}
+
+// Close closes the roundtripper.
+func (r *RoundTripper) Close() error {
+	r.mutex.Lock()
+	defer r.mutex.Unlock()
+
+	for id, c := range r.clients {
+		if err := c.Close(); err != nil {
+			return err
+		}
+		delete(r.clients, id)
+	}
+	return nil
+}
+
+type client struct {
+	hostname string
+	tlsConf  *tls.Config
+	quicConf *quic.Config
+
+	once    sync.Once
+	conn    *quic.Conn
+	dialErr error
+}
+
+func (c *client) RoundTrip(req *http.Request) (*http.Response, error) {
+	c.once.Do(func() {
+		c.conn, c.dialErr = quic.DialAddrEarly(context.Background(), c.hostname, c.tlsConf, c.quicConf)
+	})
+	if c.dialErr != nil {
+		return nil, c.dialErr
+	}
+	if req.Method != MethodGet0RTT {
+		<-c.conn.HandshakeComplete()
+	}
+	return c.doRequest(req)
+}
+
+func (c *client) doRequest(req *http.Request) (*http.Response, error) {
+	str, err := c.conn.OpenStreamSync(context.Background())
+	if err != nil {
+		return nil, err
+	}
+	cmd := "GET " + req.URL.Path + "\r\n"
+	if _, err := str.Write([]byte(cmd)); err != nil {
+		return nil, err
+	}
+	if err := str.Close(); err != nil {
+		return nil, err
+	}
+	rsp := &http.Response{
+		Proto:      "HTTP/0.9",
+		ProtoMajor: 0,
+		ProtoMinor: 9,
+		Request:    req,
+		Body:       io.NopCloser(str),
+	}
+	return rsp, nil
+}
+
+func (c *client) Close() error {
+	if c.conn == nil {
+		return nil
+	}
+	return c.conn.CloseWithError(0, "")
+}
+
+func hostnameFromRequest(req *http.Request) string {
+	if req.URL != nil {
+		return req.URL.Host
+	}
+	return ""
+}
+
+// authorityAddr returns a given authority (a host/IP, or host:port / ip:port)
+// and returns a host:port. The port 443 is added if needed.
+func authorityAddr(scheme string, authority string) (addr string) {
+	host, port, err := net.SplitHostPort(authority)
+	if err != nil { // authority didn't have a port
+		port = "443"
+		if scheme == "http" {
+			port = "80"
+		}
+		host = authority
+	}
+	if a, err := idna.ToASCII(host); err == nil {
+		host = a
+	}
+	// IPv6 address literal, without a port:
+	if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
+		return host + ":" + port
+	}
+	return net.JoinHostPort(host, port)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/interop/http09/http_test.go b/electron/native/private-transport/third_party/quic-go/interop/http09/http_test.go
new file mode 100644
index 000000000..d1fbcd307
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/interop/http09/http_test.go
@@ -0,0 +1,77 @@
+package http09
+
+import (
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/internal/testdata"
+
+	"github.com/stretchr/testify/require"
+)
+
+func startServer(t *testing.T) net.Addr {
+	t.Helper()
+	server := &Server{}
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	tr := &quic.Transport{Conn: conn}
+	tlsConf := testdata.GetTLSConfig()
+	tlsConf.NextProtos = []string{NextProto}
+	ln, err := tr.ListenEarly(tlsConf, &quic.Config{})
+	require.NoError(t, err)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		_ = server.ServeListener(ln)
+	}()
+	t.Cleanup(func() {
+		require.NoError(t, ln.Close())
+		<-done
+	})
+	return ln.Addr()
+}
+
+func TestHTTPRequest(t *testing.T) {
+	http.HandleFunc("/helloworld", func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte("Hello World!"))
+	})
+
+	addr := startServer(t)
+
+	rt := &RoundTripper{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
+	t.Cleanup(func() { rt.Close() })
+
+	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("https://%s/helloworld", addr), nil)
+	rsp, err := rt.RoundTrip(req)
+	require.NoError(t, err)
+	data, err := io.ReadAll(rsp.Body)
+	require.NoError(t, err)
+	require.Equal(t, []byte("Hello World!"), data)
+}
+
+func TestHTTPHeaders(t *testing.T) {
+	http.HandleFunc("/headers", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("foo", "bar")
+		w.WriteHeader(1337)
+		_, _ = w.Write([]byte("done"))
+	})
+
+	addr := startServer(t)
+
+	rt := &RoundTripper{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
+	t.Cleanup(func() { rt.Close() })
+
+	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("https://%s/headers", addr), nil)
+	rsp, err := rt.RoundTrip(req)
+	require.NoError(t, err)
+	data, err := io.ReadAll(rsp.Body)
+	require.NoError(t, err)
+	require.Equal(t, []byte("done"), data)
+	// HTTP/0.9 doesn't support HTTP headers
+}
diff --git a/electron/native/private-transport/third_party/quic-go/interop/http09/server.go b/electron/native/private-transport/third_party/quic-go/interop/http09/server.go
new file mode 100644
index 000000000..b51157928
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/interop/http09/server.go
@@ -0,0 +1,121 @@
+package http09
+
+import (
+	"context"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"runtime"
+	"strings"
+
+	"github.com/quic-go/quic-go"
+)
+
+const NextProto = "hq-interop"
+
+type responseWriter struct {
+	io.Writer
+	headers http.Header
+}
+
+var _ http.ResponseWriter = &responseWriter{}
+
+func (w *responseWriter) Header() http.Header {
+	if w.headers == nil {
+		w.headers = make(http.Header)
+	}
+	return w.headers
+}
+
+func (w *responseWriter) WriteHeader(int) {}
+
+// Server is a HTTP/0.9 server listening for QUIC connections.
+type Server struct {
+	Handler *http.ServeMux
+}
+
+// ServeListener serves HTTP/0.9 on all connections accepted from a QUIC listener.
+func (s *Server) ServeListener(ln *quic.EarlyListener) error {
+	for {
+		conn, err := ln.Accept(context.Background())
+		if err != nil {
+			return err
+		}
+		go s.handleConn(conn)
+	}
+}
+
+func (s *Server) handleConn(conn *quic.Conn) {
+	for {
+		str, err := conn.AcceptStream(context.Background())
+		if err != nil {
+			log.Printf("Error accepting stream: %s\n", err.Error())
+			return
+		}
+		go func() {
+			if err := s.handleStream(str); err != nil {
+				log.Printf("Handling stream failed: %s\n", err.Error())
+			}
+		}()
+	}
+}
+
+func (s *Server) handleStream(str *quic.Stream) error {
+	reqBytes, err := io.ReadAll(str)
+	if err != nil {
+		return err
+	}
+	request := string(reqBytes)
+	request = strings.TrimRight(request, "\r\n")
+	request = strings.TrimRight(request, " ")
+
+	log.Printf("Received request: %s\n", request)
+
+	if request[:5] != "GET /" {
+		str.CancelWrite(42)
+		return nil
+	}
+
+	u, err := url.Parse(request[4:])
+	if err != nil {
+		return err
+	}
+	u.Scheme = "https"
+
+	req := &http.Request{
+		Method:     http.MethodGet,
+		Proto:      "HTTP/0.9",
+		ProtoMajor: 0,
+		ProtoMinor: 9,
+		Body:       str,
+		URL:        u,
+	}
+
+	handler := s.Handler
+	if handler == nil {
+		handler = http.DefaultServeMux
+	}
+
+	var panicked bool
+	func() {
+		defer func() {
+			if p := recover(); p != nil {
+				// Copied from net/http/server.go
+				const size = 64 << 10
+				buf := make([]byte, size)
+				buf = buf[:runtime.Stack(buf, false)]
+				log.Printf("http: panic serving: %v\n%s", p, buf)
+				panicked = true
+			}
+		}()
+		handler.ServeHTTP(&responseWriter{Writer: str}, req)
+	}()
+
+	if panicked {
+		if _, err := str.Write([]byte("500")); err != nil {
+			return err
+		}
+	}
+	return str.Close()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/interop/run_endpoint.sh b/electron/native/private-transport/third_party/quic-go/interop/run_endpoint.sh
new file mode 100644
index 000000000..9c3ee55a7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/interop/run_endpoint.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+set -e
+
+# Set up the routing needed for the simulation.
+/setup.sh
+
+echo "Using commit:" `cat commit.txt`
+
+if [ "$ROLE" == "client" ]; then
+    # Wait for the simulator to start up.
+    /wait-for-it.sh sim:57832 -s -t 10
+    echo "Starting QUIC client..."
+    echo "Client params: $CLIENT_PARAMS"
+    echo "Test case: $TESTCASE"
+    QUIC_GO_LOG_LEVEL=debug ./client $CLIENT_PARAMS $REQUESTS
+else
+    echo "Running QUIC server."
+    QUIC_GO_LOG_LEVEL=debug ./server "$@"
+fi
diff --git a/electron/native/private-transport/third_party/quic-go/interop/server/main.go b/electron/native/private-transport/third_party/quic-go/interop/server/main.go
new file mode 100644
index 000000000..a809186d6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/interop/server/main.go
@@ -0,0 +1,105 @@
+package main
+
+import (
+	"crypto/tls"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"os"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/internal/qtls"
+	"github.com/quic-go/quic-go/interop/http09"
+	"github.com/quic-go/quic-go/interop/utils"
+)
+
+func main() {
+	logFile, err := os.Create("/logs/log.txt")
+	if err != nil {
+		fmt.Printf("Could not create log file: %s\n", err.Error())
+		os.Exit(1)
+	}
+	defer logFile.Close()
+	log.SetOutput(logFile)
+
+	keyLog, err := utils.GetSSLKeyLog()
+	if err != nil {
+		fmt.Printf("Could not create key log: %s\n", err.Error())
+		os.Exit(1)
+	}
+	if keyLog != nil {
+		defer keyLog.Close()
+	}
+
+	testcase := os.Getenv("TESTCASE")
+
+	quicConf := &quic.Config{
+		Allow0RTT: testcase == "zerortt",
+		Tracer:    utils.NewQLOGConnectionTracer,
+	}
+	cert, err := tls.LoadX509KeyPair("/certs/cert.pem", "/certs/priv.key")
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+	tlsConf := &tls.Config{
+		Certificates: []tls.Certificate{cert},
+		KeyLogWriter: keyLog,
+		NextProtos:   []string{http09.NextProto},
+	}
+
+	switch testcase {
+	case "versionnegotiation", "handshake", "retry", "transfer", "resumption", "multiconnect", "zerortt":
+		err = runHTTP09Server(tlsConf, quicConf, testcase == "retry")
+	case "chacha20":
+		reset := qtls.SetCipherSuite(tls.TLS_CHACHA20_POLY1305_SHA256)
+		defer reset()
+		err = runHTTP09Server(tlsConf, quicConf, false)
+	case "http3":
+		tlsConf.NextProtos = []string{http3.NextProtoH3}
+		err = runHTTP3Server(tlsConf, quicConf)
+	default:
+		fmt.Printf("unsupported test case: %s\n", testcase)
+		os.Exit(127)
+	}
+
+	if err != nil {
+		fmt.Printf("Error running server: %s\n", err.Error())
+		os.Exit(1)
+	}
+}
+
+func runHTTP09Server(tlsConf *tls.Config, quicConf *quic.Config, forceRetry bool) error {
+	http.DefaultServeMux.Handle("/", http.FileServer(http.Dir("/www")))
+	server := http09.Server{}
+
+	udpAddr, err := net.ResolveUDPAddr("udp", ":443")
+	if err != nil {
+		return err
+	}
+	conn, err := net.ListenUDP("udp", udpAddr)
+	if err != nil {
+		return err
+	}
+	tr := &quic.Transport{
+		Conn:                conn,
+		VerifySourceAddress: func(net.Addr) bool { return forceRetry },
+	}
+	ln, err := tr.ListenEarly(tlsConf, quicConf)
+	if err != nil {
+		return err
+	}
+	return server.ServeListener(ln)
+}
+
+func runHTTP3Server(tlsConf *tls.Config, quicConf *quic.Config) error {
+	server := http3.Server{
+		Addr:       ":443",
+		TLSConfig:  tlsConf,
+		QUICConfig: quicConf,
+	}
+	http.DefaultServeMux.Handle("/", http.FileServer(http.Dir("/www")))
+	return server.ListenAndServe()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/interop/utils/logging.go b/electron/native/private-transport/third_party/quic-go/interop/utils/logging.go
new file mode 100644
index 000000000..baa77010a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/interop/utils/logging.go
@@ -0,0 +1,58 @@
+package utils
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"strings"
+
+	"github.com/quic-go/quic-go"
+	h3qlog "github.com/quic-go/quic-go/http3/qlog"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+// GetSSLKeyLog creates a file for the TLS key log
+func GetSSLKeyLog() (io.WriteCloser, error) {
+	filename := os.Getenv("SSLKEYLOGFILE")
+	if len(filename) == 0 {
+		return nil, nil
+	}
+	f, err := os.Create(filename)
+	if err != nil {
+		return nil, err
+	}
+	return f, nil
+}
+
+// NewQLOGConnectionTracer create a qlog file in QLOGDIR
+func NewQLOGConnectionTracer(_ context.Context, isClient bool, connID quic.ConnectionID) qlogwriter.Trace {
+	qlogDir := os.Getenv("QLOGDIR")
+	if len(qlogDir) == 0 {
+		return nil
+	}
+	if _, err := os.Stat(qlogDir); os.IsNotExist(err) {
+		if err := os.MkdirAll(qlogDir, 0o666); err != nil {
+			log.Fatalf("failed to create qlog dir %s: %v", qlogDir, err)
+		}
+	}
+	path := fmt.Sprintf("%s/%s.sqlog", strings.TrimRight(qlogDir, "/"), connID)
+	f, err := os.Create(path)
+	if err != nil {
+		log.Printf("Failed to create qlog file %s: %s", path, err.Error())
+		return nil
+	}
+	log.Printf("Created qlog file: %s\n", path)
+	fileSeq := qlogwriter.NewConnectionFileSeq(
+		utils.NewBufferedWriteCloser(bufio.NewWriter(f), f),
+		isClient,
+		connID,
+		[]string{qlog.EventSchema, h3qlog.EventSchema},
+	)
+	go fileSeq.Run()
+	return fileSeq
+}
diff --git a/electron/native/private-transport/third_party/quic-go/metrics/dashboards/README.md b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/README.md
new file mode 100644
index 000000000..ace507bd6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/README.md
@@ -0,0 +1,24 @@
+# quic-go Prometheus / Grafana Local Development Setup
+
+For local development and debugging, it can be useful to spin up a local Prometheus and Grafana instance.
+
+Please refer to the [documentation](https://quic-go.net/docs/quic/metrics/) for how to configure quic-go to expose Prometheus metrics.
+
+The configuration files in this directory assume that the application exposes the Prometheus endpoint at `http://localhost:5001/prometheus`:
+```go
+import "github.com/prometheus/client_golang/prometheus/promhttp"
+
+go func() {
+    http.Handle("/prometheus", promhttp.Handler())
+    log.Fatal(http.ListenAndServe("localhost:5001", nil))
+}()
+```
+
+Prometheus and Grafana can be started using Docker Compose:
+
+Running:
+```shell
+docker compose up
+```
+
+[quic-go.json](./quic-go.json) contains the JSON model of an example Grafana dashboard.
diff --git a/electron/native/private-transport/third_party/quic-go/metrics/dashboards/datasources.yml b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/datasources.yml
new file mode 100644
index 000000000..ed47ec11a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/datasources.yml
@@ -0,0 +1,13 @@
+apiVersion: 1
+
+deleteDatasources:
+  - name: Prometheus
+    orgId: 1
+
+datasources:
+  - name: Prometheus
+    orgId: 1
+    type: prometheus
+    access: proxy
+    url: http://prometheus:9090
+    editable: false
diff --git a/electron/native/private-transport/third_party/quic-go/metrics/dashboards/docker-compose.yml b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/docker-compose.yml
new file mode 100644
index 000000000..8e3a8a55c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/docker-compose.yml
@@ -0,0 +1,25 @@
+version: '3.8'
+
+volumes:
+  prometheus_data: {}
+  grafana_data: {}
+
+services:
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: prometheus
+    volumes:
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml
+      - prometheus_data:/prometheus
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+    expose:
+      - 9090
+  grafana:
+    image: grafana/grafana:latest
+    container_name: grafana
+    volumes:
+      - grafana_data:/var/lib/grafana
+      - ./datasources.yml:/etc/grafana/provisioning/datasources/prom.yml
+    ports:
+      - "3000:3000"
diff --git a/electron/native/private-transport/third_party/quic-go/metrics/dashboards/prometheus.yml b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/prometheus.yml
new file mode 100644
index 000000000..5018097ec
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/prometheus.yml
@@ -0,0 +1,9 @@
+global:
+  scrape_interval: 15s
+
+scrape_configs:
+  - job_name: 'quic-go'
+    scrape_interval: 15s
+    static_configs:
+      - targets: ['host.docker.internal:5001']
+    metrics_path: '/prometheus'
diff --git a/electron/native/private-transport/third_party/quic-go/metrics/dashboards/quic-go.json b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/quic-go.json
new file mode 100644
index 000000000..48c7fa51c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/metrics/dashboards/quic-go.json
@@ -0,0 +1,926 @@
+{
+  "__inputs": [
+    {
+      "name": "DS_PROMETHEUS",
+      "label": "Prometheus",
+      "description": "",
+      "type": "datasource",
+      "pluginId": "prometheus",
+      "pluginName": "Prometheus"
+    }
+  ],
+  "__elements": {},
+  "__requires": [
+    {
+      "type": "grafana",
+      "id": "grafana",
+      "name": "Grafana",
+      "version": "10.2.3"
+    },
+    {
+      "type": "datasource",
+      "id": "prometheus",
+      "name": "Prometheus",
+      "version": "1.0.0"
+    },
+    {
+      "type": "panel",
+      "id": "stat",
+      "name": "Stat",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "timeseries",
+      "name": "Time series",
+      "version": ""
+    }
+  ],
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": null,
+  "links": [],
+  "liveNow": false,
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 7,
+      "panels": [],
+      "title": "Transport",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 1
+      },
+      "id": 3,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(quicgo_server_received_packets_dropped_total{instance=~\"$instance\"}[$__rate_interval])) by (reason)",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Server Dropped Packets",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 1
+      },
+      "id": 12,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(quicgo_server_connections_rejected_total{instance=~\"$instance\"}[$__rate_interval])) by (reason)",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Rejected Connections",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 9
+      },
+      "id": 6,
+      "panels": [],
+      "title": "Connection",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 10
+      },
+      "id": 1,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "area",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showPercentChange": false,
+        "textMode": "auto",
+        "wideLayout": true
+      },
+      "pluginVersion": "10.2.3",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum (quicgo_connections_started_total{instance=~\"$instance\"}) by (dir) - sum (quicgo_connections_closed_total{instance=~\"$instance\"}) by (dir)",
+          "instant": false,
+          "legendFormat": "{{dir}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Currently Active Connections",
+      "type": "stat"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 10
+      },
+      "id": 5,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.5, sum(rate(quicgo_handshake_duration_seconds_bucket{instance=~\"$instance\"}[$__rate_interval])) by (le))",
+          "instant": false,
+          "legendFormat": "50th percentile",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.9, sum(rate(quicgo_handshake_duration_seconds_bucket{instance=~\"$instance\"}[$__rate_interval])) by (le))",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "90th percentile",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.95, sum(rate(quicgo_handshake_duration_seconds_bucket{instance=~\"$instance\"}[$__rate_interval])) by (le))",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "95th percentile",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Handshake Duration",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 18
+      },
+      "id": 11,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "sum(rate(quicgo_connections_closed_total{instance=~\"$instance\"}[$__rate_interval])) by (reason)",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Close Reason",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 18
+      },
+      "id": 2,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.5, sum(rate(quicgo_connection_duration_seconds_bucket{instance=~\"$instance\"}[$__rate_interval])) by (le))\n",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "50th percentile",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.9, sum(rate(quicgo_connection_duration_seconds_bucket{instance=~\"$instance\"}[$__rate_interval])) by (le))\n",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "90th percentile",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "expr": "histogram_quantile(0.95, sum(rate(quicgo_connection_duration_seconds_bucket{instance=~\"$instance\"}[$__rate_interval])) by (le))\n",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "95th percentile",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Connection Durations",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 26
+      },
+      "id": 13,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "sum(rate(quicgo_packets_received_total{instance=~\"$instance\"}[$__rate_interval])) by (type)",
+          "fullMetaSearch": false,
+          "includeNullMetadata": false,
+          "instant": false,
+          "legendFormat": "{{type}}",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "Packets Received",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${DS_PROMETHEUS}"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 26
+      },
+      "id": 15,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "sum(rate(quicgo_packets_sent_total{instance=~\"$instance\"}[$__rate_interval])) by (type)",
+          "fullMetaSearch": false,
+          "includeNullMetadata": false,
+          "instant": false,
+          "legendFormat": "{{type}}",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "Packets Sent",
+      "type": "timeseries"
+    }
+  ],
+  "refresh": "",
+  "schemaVersion": 39,
+  "tags": [],
+  "templating": {
+    "list": [
+      {
+        "current": {},
+        "datasource": {
+          "type": "prometheus",
+          "uid": "${DS_PROMETHEUS}"
+        },
+        "definition": "label_values(up,instance)",
+        "hide": 0,
+        "includeAll": true,
+        "multi": true,
+        "name": "instance",
+        "options": [],
+        "query": {
+          "qryType": 1,
+          "query": "label_values(up,instance)",
+          "refId": "PrometheusVariableQueryEditor-VariableQuery"
+        },
+        "refresh": 1,
+        "regex": "",
+        "skipUrlSync": false,
+        "sort": 0,
+        "type": "query"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-30m",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "quic-go",
+  "uid": "afd27180-618a-42ab-99fd-0508776d9c29",
+  "version": 17,
+  "weekStart": ""
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_ack_frame_source_test.go b/electron/native/private-transport/third_party/quic-go/mock_ack_frame_source_test.go
new file mode 100644
index 000000000..f2a06d8a9
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_ack_frame_source_test.go
@@ -0,0 +1,81 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: AckFrameSource)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_ack_frame_source_test.go github.com/quic-go/quic-go AckFrameSource
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+
+	monotime "github.com/quic-go/quic-go/internal/monotime"
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	wire "github.com/quic-go/quic-go/internal/wire"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockAckFrameSource is a mock of AckFrameSource interface.
+type MockAckFrameSource struct {
+	ctrl     *gomock.Controller
+	recorder *MockAckFrameSourceMockRecorder
+	isgomock struct{}
+}
+
+// MockAckFrameSourceMockRecorder is the mock recorder for MockAckFrameSource.
+type MockAckFrameSourceMockRecorder struct {
+	mock *MockAckFrameSource
+}
+
+// NewMockAckFrameSource creates a new mock instance.
+func NewMockAckFrameSource(ctrl *gomock.Controller) *MockAckFrameSource {
+	mock := &MockAckFrameSource{ctrl: ctrl}
+	mock.recorder = &MockAckFrameSourceMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockAckFrameSource) EXPECT() *MockAckFrameSourceMockRecorder {
+	return m.recorder
+}
+
+// GetAckFrame mocks base method.
+func (m *MockAckFrameSource) GetAckFrame(arg0 protocol.EncryptionLevel, now monotime.Time, onlyIfQueued bool) *wire.AckFrame {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAckFrame", arg0, now, onlyIfQueued)
+	ret0, _ := ret[0].(*wire.AckFrame)
+	return ret0
+}
+
+// GetAckFrame indicates an expected call of GetAckFrame.
+func (mr *MockAckFrameSourceMockRecorder) GetAckFrame(arg0, now, onlyIfQueued any) *MockAckFrameSourceGetAckFrameCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAckFrame", reflect.TypeOf((*MockAckFrameSource)(nil).GetAckFrame), arg0, now, onlyIfQueued)
+	return &MockAckFrameSourceGetAckFrameCall{Call: call}
+}
+
+// MockAckFrameSourceGetAckFrameCall wrap *gomock.Call
+type MockAckFrameSourceGetAckFrameCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockAckFrameSourceGetAckFrameCall) Return(arg0 *wire.AckFrame) *MockAckFrameSourceGetAckFrameCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockAckFrameSourceGetAckFrameCall) Do(f func(protocol.EncryptionLevel, monotime.Time, bool) *wire.AckFrame) *MockAckFrameSourceGetAckFrameCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockAckFrameSourceGetAckFrameCall) DoAndReturn(f func(protocol.EncryptionLevel, monotime.Time, bool) *wire.AckFrame) *MockAckFrameSourceGetAckFrameCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_conn_runner_test.go b/electron/native/private-transport/third_party/quic-go/mock_conn_runner_test.go
new file mode 100644
index 000000000..f2d68168a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_conn_runner_test.go
@@ -0,0 +1,224 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: ConnRunner)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_conn_runner_test.go github.com/quic-go/quic-go ConnRunner
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+	time "time"
+
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockConnRunner is a mock of ConnRunner interface.
+type MockConnRunner struct {
+	ctrl     *gomock.Controller
+	recorder *MockConnRunnerMockRecorder
+	isgomock struct{}
+}
+
+// MockConnRunnerMockRecorder is the mock recorder for MockConnRunner.
+type MockConnRunnerMockRecorder struct {
+	mock *MockConnRunner
+}
+
+// NewMockConnRunner creates a new mock instance.
+func NewMockConnRunner(ctrl *gomock.Controller) *MockConnRunner {
+	mock := &MockConnRunner{ctrl: ctrl}
+	mock.recorder = &MockConnRunnerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockConnRunner) EXPECT() *MockConnRunnerMockRecorder {
+	return m.recorder
+}
+
+// Add mocks base method.
+func (m *MockConnRunner) Add(arg0 protocol.ConnectionID, arg1 packetHandler) bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Add", arg0, arg1)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// Add indicates an expected call of Add.
+func (mr *MockConnRunnerMockRecorder) Add(arg0, arg1 any) *MockConnRunnerAddCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Add", reflect.TypeOf((*MockConnRunner)(nil).Add), arg0, arg1)
+	return &MockConnRunnerAddCall{Call: call}
+}
+
+// MockConnRunnerAddCall wrap *gomock.Call
+type MockConnRunnerAddCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnRunnerAddCall) Return(arg0 bool) *MockConnRunnerAddCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnRunnerAddCall) Do(f func(protocol.ConnectionID, packetHandler) bool) *MockConnRunnerAddCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnRunnerAddCall) DoAndReturn(f func(protocol.ConnectionID, packetHandler) bool) *MockConnRunnerAddCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// AddResetToken mocks base method.
+func (m *MockConnRunner) AddResetToken(arg0 protocol.StatelessResetToken, arg1 packetHandler) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "AddResetToken", arg0, arg1)
+}
+
+// AddResetToken indicates an expected call of AddResetToken.
+func (mr *MockConnRunnerMockRecorder) AddResetToken(arg0, arg1 any) *MockConnRunnerAddResetTokenCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddResetToken", reflect.TypeOf((*MockConnRunner)(nil).AddResetToken), arg0, arg1)
+	return &MockConnRunnerAddResetTokenCall{Call: call}
+}
+
+// MockConnRunnerAddResetTokenCall wrap *gomock.Call
+type MockConnRunnerAddResetTokenCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnRunnerAddResetTokenCall) Return() *MockConnRunnerAddResetTokenCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnRunnerAddResetTokenCall) Do(f func(protocol.StatelessResetToken, packetHandler)) *MockConnRunnerAddResetTokenCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnRunnerAddResetTokenCall) DoAndReturn(f func(protocol.StatelessResetToken, packetHandler)) *MockConnRunnerAddResetTokenCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Remove mocks base method.
+func (m *MockConnRunner) Remove(arg0 protocol.ConnectionID) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Remove", arg0)
+}
+
+// Remove indicates an expected call of Remove.
+func (mr *MockConnRunnerMockRecorder) Remove(arg0 any) *MockConnRunnerRemoveCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Remove", reflect.TypeOf((*MockConnRunner)(nil).Remove), arg0)
+	return &MockConnRunnerRemoveCall{Call: call}
+}
+
+// MockConnRunnerRemoveCall wrap *gomock.Call
+type MockConnRunnerRemoveCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnRunnerRemoveCall) Return() *MockConnRunnerRemoveCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnRunnerRemoveCall) Do(f func(protocol.ConnectionID)) *MockConnRunnerRemoveCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnRunnerRemoveCall) DoAndReturn(f func(protocol.ConnectionID)) *MockConnRunnerRemoveCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// RemoveResetToken mocks base method.
+func (m *MockConnRunner) RemoveResetToken(arg0 protocol.StatelessResetToken) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "RemoveResetToken", arg0)
+}
+
+// RemoveResetToken indicates an expected call of RemoveResetToken.
+func (mr *MockConnRunnerMockRecorder) RemoveResetToken(arg0 any) *MockConnRunnerRemoveResetTokenCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveResetToken", reflect.TypeOf((*MockConnRunner)(nil).RemoveResetToken), arg0)
+	return &MockConnRunnerRemoveResetTokenCall{Call: call}
+}
+
+// MockConnRunnerRemoveResetTokenCall wrap *gomock.Call
+type MockConnRunnerRemoveResetTokenCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnRunnerRemoveResetTokenCall) Return() *MockConnRunnerRemoveResetTokenCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnRunnerRemoveResetTokenCall) Do(f func(protocol.StatelessResetToken)) *MockConnRunnerRemoveResetTokenCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnRunnerRemoveResetTokenCall) DoAndReturn(f func(protocol.StatelessResetToken)) *MockConnRunnerRemoveResetTokenCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ReplaceWithClosed mocks base method.
+func (m *MockConnRunner) ReplaceWithClosed(arg0 []protocol.ConnectionID, arg1 []byte, arg2 time.Duration) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ReplaceWithClosed", arg0, arg1, arg2)
+}
+
+// ReplaceWithClosed indicates an expected call of ReplaceWithClosed.
+func (mr *MockConnRunnerMockRecorder) ReplaceWithClosed(arg0, arg1, arg2 any) *MockConnRunnerReplaceWithClosedCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReplaceWithClosed", reflect.TypeOf((*MockConnRunner)(nil).ReplaceWithClosed), arg0, arg1, arg2)
+	return &MockConnRunnerReplaceWithClosedCall{Call: call}
+}
+
+// MockConnRunnerReplaceWithClosedCall wrap *gomock.Call
+type MockConnRunnerReplaceWithClosedCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockConnRunnerReplaceWithClosedCall) Return() *MockConnRunnerReplaceWithClosedCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockConnRunnerReplaceWithClosedCall) Do(f func([]protocol.ConnectionID, []byte, time.Duration)) *MockConnRunnerReplaceWithClosedCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockConnRunnerReplaceWithClosedCall) DoAndReturn(f func([]protocol.ConnectionID, []byte, time.Duration)) *MockConnRunnerReplaceWithClosedCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_frame_source_test.go b/electron/native/private-transport/third_party/quic-go/mock_frame_source_test.go
new file mode 100644
index 000000000..1829ff88e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_frame_source_test.go
@@ -0,0 +1,121 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: FrameSource)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_frame_source_test.go github.com/quic-go/quic-go FrameSource
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+
+	ackhandler "github.com/quic-go/quic-go/internal/ackhandler"
+	monotime "github.com/quic-go/quic-go/internal/monotime"
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockFrameSource is a mock of FrameSource interface.
+type MockFrameSource struct {
+	ctrl     *gomock.Controller
+	recorder *MockFrameSourceMockRecorder
+	isgomock struct{}
+}
+
+// MockFrameSourceMockRecorder is the mock recorder for MockFrameSource.
+type MockFrameSourceMockRecorder struct {
+	mock *MockFrameSource
+}
+
+// NewMockFrameSource creates a new mock instance.
+func NewMockFrameSource(ctrl *gomock.Controller) *MockFrameSource {
+	mock := &MockFrameSource{ctrl: ctrl}
+	mock.recorder = &MockFrameSourceMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockFrameSource) EXPECT() *MockFrameSourceMockRecorder {
+	return m.recorder
+}
+
+// Append mocks base method.
+func (m *MockFrameSource) Append(arg0 []ackhandler.Frame, arg1 []ackhandler.StreamFrame, arg2 protocol.ByteCount, arg3 monotime.Time, arg4 protocol.Version) ([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Append", arg0, arg1, arg2, arg3, arg4)
+	ret0, _ := ret[0].([]ackhandler.Frame)
+	ret1, _ := ret[1].([]ackhandler.StreamFrame)
+	ret2, _ := ret[2].(protocol.ByteCount)
+	return ret0, ret1, ret2
+}
+
+// Append indicates an expected call of Append.
+func (mr *MockFrameSourceMockRecorder) Append(arg0, arg1, arg2, arg3, arg4 any) *MockFrameSourceAppendCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Append", reflect.TypeOf((*MockFrameSource)(nil).Append), arg0, arg1, arg2, arg3, arg4)
+	return &MockFrameSourceAppendCall{Call: call}
+}
+
+// MockFrameSourceAppendCall wrap *gomock.Call
+type MockFrameSourceAppendCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockFrameSourceAppendCall) Return(arg0 []ackhandler.Frame, arg1 []ackhandler.StreamFrame, arg2 protocol.ByteCount) *MockFrameSourceAppendCall {
+	c.Call = c.Call.Return(arg0, arg1, arg2)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockFrameSourceAppendCall) Do(f func([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount, monotime.Time, protocol.Version) ([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount)) *MockFrameSourceAppendCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockFrameSourceAppendCall) DoAndReturn(f func([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount, monotime.Time, protocol.Version) ([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount)) *MockFrameSourceAppendCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// HasData mocks base method.
+func (m *MockFrameSource) HasData() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HasData")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// HasData indicates an expected call of HasData.
+func (mr *MockFrameSourceMockRecorder) HasData() *MockFrameSourceHasDataCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HasData", reflect.TypeOf((*MockFrameSource)(nil).HasData))
+	return &MockFrameSourceHasDataCall{Call: call}
+}
+
+// MockFrameSourceHasDataCall wrap *gomock.Call
+type MockFrameSourceHasDataCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockFrameSourceHasDataCall) Return(arg0 bool) *MockFrameSourceHasDataCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockFrameSourceHasDataCall) Do(f func() bool) *MockFrameSourceHasDataCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockFrameSourceHasDataCall) DoAndReturn(f func() bool) *MockFrameSourceHasDataCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_packer_test.go b/electron/native/private-transport/third_party/quic-go/mock_packer_test.go
new file mode 100644
index 000000000..416f6b0dd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_packer_test.go
@@ -0,0 +1,395 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: Packer)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_packer_test.go github.com/quic-go/quic-go Packer
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+
+	ackhandler "github.com/quic-go/quic-go/internal/ackhandler"
+	monotime "github.com/quic-go/quic-go/internal/monotime"
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	qerr "github.com/quic-go/quic-go/internal/qerr"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockPacker is a mock of Packer interface.
+type MockPacker struct {
+	ctrl     *gomock.Controller
+	recorder *MockPackerMockRecorder
+	isgomock struct{}
+}
+
+// MockPackerMockRecorder is the mock recorder for MockPacker.
+type MockPackerMockRecorder struct {
+	mock *MockPacker
+}
+
+// NewMockPacker creates a new mock instance.
+func NewMockPacker(ctrl *gomock.Controller) *MockPacker {
+	mock := &MockPacker{ctrl: ctrl}
+	mock.recorder = &MockPackerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockPacker) EXPECT() *MockPackerMockRecorder {
+	return m.recorder
+}
+
+// AppendPacket mocks base method.
+func (m *MockPacker) AppendPacket(arg0 *packetBuffer, maxPacketSize protocol.ByteCount, now monotime.Time, v protocol.Version) (shortHeaderPacket, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AppendPacket", arg0, maxPacketSize, now, v)
+	ret0, _ := ret[0].(shortHeaderPacket)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AppendPacket indicates an expected call of AppendPacket.
+func (mr *MockPackerMockRecorder) AppendPacket(arg0, maxPacketSize, now, v any) *MockPackerAppendPacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AppendPacket", reflect.TypeOf((*MockPacker)(nil).AppendPacket), arg0, maxPacketSize, now, v)
+	return &MockPackerAppendPacketCall{Call: call}
+}
+
+// MockPackerAppendPacketCall wrap *gomock.Call
+type MockPackerAppendPacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPackerAppendPacketCall) Return(arg0 shortHeaderPacket, arg1 error) *MockPackerAppendPacketCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPackerAppendPacketCall) Do(f func(*packetBuffer, protocol.ByteCount, monotime.Time, protocol.Version) (shortHeaderPacket, error)) *MockPackerAppendPacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPackerAppendPacketCall) DoAndReturn(f func(*packetBuffer, protocol.ByteCount, monotime.Time, protocol.Version) (shortHeaderPacket, error)) *MockPackerAppendPacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// PackAckOnlyPacket mocks base method.
+func (m *MockPacker) PackAckOnlyPacket(maxPacketSize protocol.ByteCount, now monotime.Time, v protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PackAckOnlyPacket", maxPacketSize, now, v)
+	ret0, _ := ret[0].(shortHeaderPacket)
+	ret1, _ := ret[1].(*packetBuffer)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// PackAckOnlyPacket indicates an expected call of PackAckOnlyPacket.
+func (mr *MockPackerMockRecorder) PackAckOnlyPacket(maxPacketSize, now, v any) *MockPackerPackAckOnlyPacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PackAckOnlyPacket", reflect.TypeOf((*MockPacker)(nil).PackAckOnlyPacket), maxPacketSize, now, v)
+	return &MockPackerPackAckOnlyPacketCall{Call: call}
+}
+
+// MockPackerPackAckOnlyPacketCall wrap *gomock.Call
+type MockPackerPackAckOnlyPacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPackerPackAckOnlyPacketCall) Return(arg0 shortHeaderPacket, arg1 *packetBuffer, arg2 error) *MockPackerPackAckOnlyPacketCall {
+	c.Call = c.Call.Return(arg0, arg1, arg2)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPackerPackAckOnlyPacketCall) Do(f func(protocol.ByteCount, monotime.Time, protocol.Version) (shortHeaderPacket, *packetBuffer, error)) *MockPackerPackAckOnlyPacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPackerPackAckOnlyPacketCall) DoAndReturn(f func(protocol.ByteCount, monotime.Time, protocol.Version) (shortHeaderPacket, *packetBuffer, error)) *MockPackerPackAckOnlyPacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// PackApplicationClose mocks base method.
+func (m *MockPacker) PackApplicationClose(arg0 *qerr.ApplicationError, arg1 protocol.ByteCount, arg2 protocol.Version) (*coalescedPacket, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PackApplicationClose", arg0, arg1, arg2)
+	ret0, _ := ret[0].(*coalescedPacket)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// PackApplicationClose indicates an expected call of PackApplicationClose.
+func (mr *MockPackerMockRecorder) PackApplicationClose(arg0, arg1, arg2 any) *MockPackerPackApplicationCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PackApplicationClose", reflect.TypeOf((*MockPacker)(nil).PackApplicationClose), arg0, arg1, arg2)
+	return &MockPackerPackApplicationCloseCall{Call: call}
+}
+
+// MockPackerPackApplicationCloseCall wrap *gomock.Call
+type MockPackerPackApplicationCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPackerPackApplicationCloseCall) Return(arg0 *coalescedPacket, arg1 error) *MockPackerPackApplicationCloseCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPackerPackApplicationCloseCall) Do(f func(*qerr.ApplicationError, protocol.ByteCount, protocol.Version) (*coalescedPacket, error)) *MockPackerPackApplicationCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPackerPackApplicationCloseCall) DoAndReturn(f func(*qerr.ApplicationError, protocol.ByteCount, protocol.Version) (*coalescedPacket, error)) *MockPackerPackApplicationCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// PackCoalescedPacket mocks base method.
+func (m *MockPacker) PackCoalescedPacket(onlyAck bool, maxPacketSize protocol.ByteCount, now monotime.Time, v protocol.Version) (*coalescedPacket, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PackCoalescedPacket", onlyAck, maxPacketSize, now, v)
+	ret0, _ := ret[0].(*coalescedPacket)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// PackCoalescedPacket indicates an expected call of PackCoalescedPacket.
+func (mr *MockPackerMockRecorder) PackCoalescedPacket(onlyAck, maxPacketSize, now, v any) *MockPackerPackCoalescedPacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PackCoalescedPacket", reflect.TypeOf((*MockPacker)(nil).PackCoalescedPacket), onlyAck, maxPacketSize, now, v)
+	return &MockPackerPackCoalescedPacketCall{Call: call}
+}
+
+// MockPackerPackCoalescedPacketCall wrap *gomock.Call
+type MockPackerPackCoalescedPacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPackerPackCoalescedPacketCall) Return(arg0 *coalescedPacket, arg1 error) *MockPackerPackCoalescedPacketCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPackerPackCoalescedPacketCall) Do(f func(bool, protocol.ByteCount, monotime.Time, protocol.Version) (*coalescedPacket, error)) *MockPackerPackCoalescedPacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPackerPackCoalescedPacketCall) DoAndReturn(f func(bool, protocol.ByteCount, monotime.Time, protocol.Version) (*coalescedPacket, error)) *MockPackerPackCoalescedPacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// PackConnectionClose mocks base method.
+func (m *MockPacker) PackConnectionClose(arg0 *qerr.TransportError, arg1 protocol.ByteCount, arg2 protocol.Version) (*coalescedPacket, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PackConnectionClose", arg0, arg1, arg2)
+	ret0, _ := ret[0].(*coalescedPacket)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// PackConnectionClose indicates an expected call of PackConnectionClose.
+func (mr *MockPackerMockRecorder) PackConnectionClose(arg0, arg1, arg2 any) *MockPackerPackConnectionCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PackConnectionClose", reflect.TypeOf((*MockPacker)(nil).PackConnectionClose), arg0, arg1, arg2)
+	return &MockPackerPackConnectionCloseCall{Call: call}
+}
+
+// MockPackerPackConnectionCloseCall wrap *gomock.Call
+type MockPackerPackConnectionCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPackerPackConnectionCloseCall) Return(arg0 *coalescedPacket, arg1 error) *MockPackerPackConnectionCloseCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPackerPackConnectionCloseCall) Do(f func(*qerr.TransportError, protocol.ByteCount, protocol.Version) (*coalescedPacket, error)) *MockPackerPackConnectionCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPackerPackConnectionCloseCall) DoAndReturn(f func(*qerr.TransportError, protocol.ByteCount, protocol.Version) (*coalescedPacket, error)) *MockPackerPackConnectionCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// PackMTUProbePacket mocks base method.
+func (m *MockPacker) PackMTUProbePacket(ping ackhandler.Frame, size protocol.ByteCount, v protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PackMTUProbePacket", ping, size, v)
+	ret0, _ := ret[0].(shortHeaderPacket)
+	ret1, _ := ret[1].(*packetBuffer)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// PackMTUProbePacket indicates an expected call of PackMTUProbePacket.
+func (mr *MockPackerMockRecorder) PackMTUProbePacket(ping, size, v any) *MockPackerPackMTUProbePacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PackMTUProbePacket", reflect.TypeOf((*MockPacker)(nil).PackMTUProbePacket), ping, size, v)
+	return &MockPackerPackMTUProbePacketCall{Call: call}
+}
+
+// MockPackerPackMTUProbePacketCall wrap *gomock.Call
+type MockPackerPackMTUProbePacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPackerPackMTUProbePacketCall) Return(arg0 shortHeaderPacket, arg1 *packetBuffer, arg2 error) *MockPackerPackMTUProbePacketCall {
+	c.Call = c.Call.Return(arg0, arg1, arg2)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPackerPackMTUProbePacketCall) Do(f func(ackhandler.Frame, protocol.ByteCount, protocol.Version) (shortHeaderPacket, *packetBuffer, error)) *MockPackerPackMTUProbePacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPackerPackMTUProbePacketCall) DoAndReturn(f func(ackhandler.Frame, protocol.ByteCount, protocol.Version) (shortHeaderPacket, *packetBuffer, error)) *MockPackerPackMTUProbePacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// PackPTOProbePacket mocks base method.
+func (m *MockPacker) PackPTOProbePacket(arg0 protocol.EncryptionLevel, arg1 protocol.ByteCount, addPingIfEmpty bool, now monotime.Time, v protocol.Version) (*coalescedPacket, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PackPTOProbePacket", arg0, arg1, addPingIfEmpty, now, v)
+	ret0, _ := ret[0].(*coalescedPacket)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// PackPTOProbePacket indicates an expected call of PackPTOProbePacket.
+func (mr *MockPackerMockRecorder) PackPTOProbePacket(arg0, arg1, addPingIfEmpty, now, v any) *MockPackerPackPTOProbePacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PackPTOProbePacket", reflect.TypeOf((*MockPacker)(nil).PackPTOProbePacket), arg0, arg1, addPingIfEmpty, now, v)
+	return &MockPackerPackPTOProbePacketCall{Call: call}
+}
+
+// MockPackerPackPTOProbePacketCall wrap *gomock.Call
+type MockPackerPackPTOProbePacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPackerPackPTOProbePacketCall) Return(arg0 *coalescedPacket, arg1 error) *MockPackerPackPTOProbePacketCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPackerPackPTOProbePacketCall) Do(f func(protocol.EncryptionLevel, protocol.ByteCount, bool, monotime.Time, protocol.Version) (*coalescedPacket, error)) *MockPackerPackPTOProbePacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPackerPackPTOProbePacketCall) DoAndReturn(f func(protocol.EncryptionLevel, protocol.ByteCount, bool, monotime.Time, protocol.Version) (*coalescedPacket, error)) *MockPackerPackPTOProbePacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// PackPathProbePacket mocks base method.
+func (m *MockPacker) PackPathProbePacket(arg0 protocol.ConnectionID, arg1 []ackhandler.Frame, arg2 protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PackPathProbePacket", arg0, arg1, arg2)
+	ret0, _ := ret[0].(shortHeaderPacket)
+	ret1, _ := ret[1].(*packetBuffer)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// PackPathProbePacket indicates an expected call of PackPathProbePacket.
+func (mr *MockPackerMockRecorder) PackPathProbePacket(arg0, arg1, arg2 any) *MockPackerPackPathProbePacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PackPathProbePacket", reflect.TypeOf((*MockPacker)(nil).PackPathProbePacket), arg0, arg1, arg2)
+	return &MockPackerPackPathProbePacketCall{Call: call}
+}
+
+// MockPackerPackPathProbePacketCall wrap *gomock.Call
+type MockPackerPackPathProbePacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPackerPackPathProbePacketCall) Return(arg0 shortHeaderPacket, arg1 *packetBuffer, arg2 error) *MockPackerPackPathProbePacketCall {
+	c.Call = c.Call.Return(arg0, arg1, arg2)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPackerPackPathProbePacketCall) Do(f func(protocol.ConnectionID, []ackhandler.Frame, protocol.Version) (shortHeaderPacket, *packetBuffer, error)) *MockPackerPackPathProbePacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPackerPackPathProbePacketCall) DoAndReturn(f func(protocol.ConnectionID, []ackhandler.Frame, protocol.Version) (shortHeaderPacket, *packetBuffer, error)) *MockPackerPackPathProbePacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetToken mocks base method.
+func (m *MockPacker) SetToken(arg0 []byte) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetToken", arg0)
+}
+
+// SetToken indicates an expected call of SetToken.
+func (mr *MockPackerMockRecorder) SetToken(arg0 any) *MockPackerSetTokenCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetToken", reflect.TypeOf((*MockPacker)(nil).SetToken), arg0)
+	return &MockPackerSetTokenCall{Call: call}
+}
+
+// MockPackerSetTokenCall wrap *gomock.Call
+type MockPackerSetTokenCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPackerSetTokenCall) Return() *MockPackerSetTokenCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPackerSetTokenCall) Do(f func([]byte)) *MockPackerSetTokenCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPackerSetTokenCall) DoAndReturn(f func([]byte)) *MockPackerSetTokenCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_packet_handler_test.go b/electron/native/private-transport/third_party/quic-go/mock_packet_handler_test.go
new file mode 100644
index 000000000..f9bcbd127
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_packet_handler_test.go
@@ -0,0 +1,149 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: PacketHandler)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_packet_handler_test.go github.com/quic-go/quic-go PacketHandler
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+
+	qerr "github.com/quic-go/quic-go/internal/qerr"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockPacketHandler is a mock of PacketHandler interface.
+type MockPacketHandler struct {
+	ctrl     *gomock.Controller
+	recorder *MockPacketHandlerMockRecorder
+	isgomock struct{}
+}
+
+// MockPacketHandlerMockRecorder is the mock recorder for MockPacketHandler.
+type MockPacketHandlerMockRecorder struct {
+	mock *MockPacketHandler
+}
+
+// NewMockPacketHandler creates a new mock instance.
+func NewMockPacketHandler(ctrl *gomock.Controller) *MockPacketHandler {
+	mock := &MockPacketHandler{ctrl: ctrl}
+	mock.recorder = &MockPacketHandlerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockPacketHandler) EXPECT() *MockPacketHandlerMockRecorder {
+	return m.recorder
+}
+
+// closeWithTransportError mocks base method.
+func (m *MockPacketHandler) closeWithTransportError(arg0 qerr.TransportErrorCode) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "closeWithTransportError", arg0)
+}
+
+// closeWithTransportError indicates an expected call of closeWithTransportError.
+func (mr *MockPacketHandlerMockRecorder) closeWithTransportError(arg0 any) *MockPacketHandlercloseWithTransportErrorCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "closeWithTransportError", reflect.TypeOf((*MockPacketHandler)(nil).closeWithTransportError), arg0)
+	return &MockPacketHandlercloseWithTransportErrorCall{Call: call}
+}
+
+// MockPacketHandlercloseWithTransportErrorCall wrap *gomock.Call
+type MockPacketHandlercloseWithTransportErrorCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketHandlercloseWithTransportErrorCall) Return() *MockPacketHandlercloseWithTransportErrorCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketHandlercloseWithTransportErrorCall) Do(f func(qerr.TransportErrorCode)) *MockPacketHandlercloseWithTransportErrorCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketHandlercloseWithTransportErrorCall) DoAndReturn(f func(qerr.TransportErrorCode)) *MockPacketHandlercloseWithTransportErrorCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// destroy mocks base method.
+func (m *MockPacketHandler) destroy(arg0 error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "destroy", arg0)
+}
+
+// destroy indicates an expected call of destroy.
+func (mr *MockPacketHandlerMockRecorder) destroy(arg0 any) *MockPacketHandlerdestroyCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "destroy", reflect.TypeOf((*MockPacketHandler)(nil).destroy), arg0)
+	return &MockPacketHandlerdestroyCall{Call: call}
+}
+
+// MockPacketHandlerdestroyCall wrap *gomock.Call
+type MockPacketHandlerdestroyCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketHandlerdestroyCall) Return() *MockPacketHandlerdestroyCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketHandlerdestroyCall) Do(f func(error)) *MockPacketHandlerdestroyCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketHandlerdestroyCall) DoAndReturn(f func(error)) *MockPacketHandlerdestroyCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// handlePacket mocks base method.
+func (m *MockPacketHandler) handlePacket(arg0 receivedPacket) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "handlePacket", arg0)
+}
+
+// handlePacket indicates an expected call of handlePacket.
+func (mr *MockPacketHandlerMockRecorder) handlePacket(arg0 any) *MockPacketHandlerhandlePacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "handlePacket", reflect.TypeOf((*MockPacketHandler)(nil).handlePacket), arg0)
+	return &MockPacketHandlerhandlePacketCall{Call: call}
+}
+
+// MockPacketHandlerhandlePacketCall wrap *gomock.Call
+type MockPacketHandlerhandlePacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketHandlerhandlePacketCall) Return() *MockPacketHandlerhandlePacketCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketHandlerhandlePacketCall) Do(f func(receivedPacket)) *MockPacketHandlerhandlePacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketHandlerhandlePacketCall) DoAndReturn(f func(receivedPacket)) *MockPacketHandlerhandlePacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_packetconn_test.go b/electron/native/private-transport/third_party/quic-go/mock_packetconn_test.go
new file mode 100644
index 000000000..59617cdde
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_packetconn_test.go
@@ -0,0 +1,311 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: net (interfaces: PacketConn)
+//
+// Generated by this command:
+//
+//	mockgen -typed -package quic -self_package github.com/quic-go/quic-go -self_package github.com/quic-go/quic-go -destination mock_packetconn_test.go net PacketConn
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	net "net"
+	reflect "reflect"
+	time "time"
+
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockPacketConn is a mock of PacketConn interface.
+type MockPacketConn struct {
+	ctrl     *gomock.Controller
+	recorder *MockPacketConnMockRecorder
+	isgomock struct{}
+}
+
+// MockPacketConnMockRecorder is the mock recorder for MockPacketConn.
+type MockPacketConnMockRecorder struct {
+	mock *MockPacketConn
+}
+
+// NewMockPacketConn creates a new mock instance.
+func NewMockPacketConn(ctrl *gomock.Controller) *MockPacketConn {
+	mock := &MockPacketConn{ctrl: ctrl}
+	mock.recorder = &MockPacketConnMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockPacketConn) EXPECT() *MockPacketConnMockRecorder {
+	return m.recorder
+}
+
+// Close mocks base method.
+func (m *MockPacketConn) Close() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Close")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Close indicates an expected call of Close.
+func (mr *MockPacketConnMockRecorder) Close() *MockPacketConnCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockPacketConn)(nil).Close))
+	return &MockPacketConnCloseCall{Call: call}
+}
+
+// MockPacketConnCloseCall wrap *gomock.Call
+type MockPacketConnCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketConnCloseCall) Return(arg0 error) *MockPacketConnCloseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketConnCloseCall) Do(f func() error) *MockPacketConnCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketConnCloseCall) DoAndReturn(f func() error) *MockPacketConnCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// LocalAddr mocks base method.
+func (m *MockPacketConn) LocalAddr() net.Addr {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "LocalAddr")
+	ret0, _ := ret[0].(net.Addr)
+	return ret0
+}
+
+// LocalAddr indicates an expected call of LocalAddr.
+func (mr *MockPacketConnMockRecorder) LocalAddr() *MockPacketConnLocalAddrCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LocalAddr", reflect.TypeOf((*MockPacketConn)(nil).LocalAddr))
+	return &MockPacketConnLocalAddrCall{Call: call}
+}
+
+// MockPacketConnLocalAddrCall wrap *gomock.Call
+type MockPacketConnLocalAddrCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketConnLocalAddrCall) Return(arg0 net.Addr) *MockPacketConnLocalAddrCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketConnLocalAddrCall) Do(f func() net.Addr) *MockPacketConnLocalAddrCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketConnLocalAddrCall) DoAndReturn(f func() net.Addr) *MockPacketConnLocalAddrCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ReadFrom mocks base method.
+func (m *MockPacketConn) ReadFrom(p []byte) (int, net.Addr, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ReadFrom", p)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(net.Addr)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// ReadFrom indicates an expected call of ReadFrom.
+func (mr *MockPacketConnMockRecorder) ReadFrom(p any) *MockPacketConnReadFromCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReadFrom", reflect.TypeOf((*MockPacketConn)(nil).ReadFrom), p)
+	return &MockPacketConnReadFromCall{Call: call}
+}
+
+// MockPacketConnReadFromCall wrap *gomock.Call
+type MockPacketConnReadFromCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketConnReadFromCall) Return(n int, addr net.Addr, err error) *MockPacketConnReadFromCall {
+	c.Call = c.Call.Return(n, addr, err)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketConnReadFromCall) Do(f func([]byte) (int, net.Addr, error)) *MockPacketConnReadFromCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketConnReadFromCall) DoAndReturn(f func([]byte) (int, net.Addr, error)) *MockPacketConnReadFromCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetDeadline mocks base method.
+func (m *MockPacketConn) SetDeadline(t time.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetDeadline", t)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetDeadline indicates an expected call of SetDeadline.
+func (mr *MockPacketConnMockRecorder) SetDeadline(t any) *MockPacketConnSetDeadlineCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetDeadline", reflect.TypeOf((*MockPacketConn)(nil).SetDeadline), t)
+	return &MockPacketConnSetDeadlineCall{Call: call}
+}
+
+// MockPacketConnSetDeadlineCall wrap *gomock.Call
+type MockPacketConnSetDeadlineCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketConnSetDeadlineCall) Return(arg0 error) *MockPacketConnSetDeadlineCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketConnSetDeadlineCall) Do(f func(time.Time) error) *MockPacketConnSetDeadlineCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketConnSetDeadlineCall) DoAndReturn(f func(time.Time) error) *MockPacketConnSetDeadlineCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetReadDeadline mocks base method.
+func (m *MockPacketConn) SetReadDeadline(t time.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetReadDeadline", t)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetReadDeadline indicates an expected call of SetReadDeadline.
+func (mr *MockPacketConnMockRecorder) SetReadDeadline(t any) *MockPacketConnSetReadDeadlineCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetReadDeadline", reflect.TypeOf((*MockPacketConn)(nil).SetReadDeadline), t)
+	return &MockPacketConnSetReadDeadlineCall{Call: call}
+}
+
+// MockPacketConnSetReadDeadlineCall wrap *gomock.Call
+type MockPacketConnSetReadDeadlineCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketConnSetReadDeadlineCall) Return(arg0 error) *MockPacketConnSetReadDeadlineCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketConnSetReadDeadlineCall) Do(f func(time.Time) error) *MockPacketConnSetReadDeadlineCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketConnSetReadDeadlineCall) DoAndReturn(f func(time.Time) error) *MockPacketConnSetReadDeadlineCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetWriteDeadline mocks base method.
+func (m *MockPacketConn) SetWriteDeadline(t time.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetWriteDeadline", t)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetWriteDeadline indicates an expected call of SetWriteDeadline.
+func (mr *MockPacketConnMockRecorder) SetWriteDeadline(t any) *MockPacketConnSetWriteDeadlineCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetWriteDeadline", reflect.TypeOf((*MockPacketConn)(nil).SetWriteDeadline), t)
+	return &MockPacketConnSetWriteDeadlineCall{Call: call}
+}
+
+// MockPacketConnSetWriteDeadlineCall wrap *gomock.Call
+type MockPacketConnSetWriteDeadlineCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketConnSetWriteDeadlineCall) Return(arg0 error) *MockPacketConnSetWriteDeadlineCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketConnSetWriteDeadlineCall) Do(f func(time.Time) error) *MockPacketConnSetWriteDeadlineCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketConnSetWriteDeadlineCall) DoAndReturn(f func(time.Time) error) *MockPacketConnSetWriteDeadlineCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// WriteTo mocks base method.
+func (m *MockPacketConn) WriteTo(p []byte, addr net.Addr) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WriteTo", p, addr)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// WriteTo indicates an expected call of WriteTo.
+func (mr *MockPacketConnMockRecorder) WriteTo(p, addr any) *MockPacketConnWriteToCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WriteTo", reflect.TypeOf((*MockPacketConn)(nil).WriteTo), p, addr)
+	return &MockPacketConnWriteToCall{Call: call}
+}
+
+// MockPacketConnWriteToCall wrap *gomock.Call
+type MockPacketConnWriteToCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockPacketConnWriteToCall) Return(n int, err error) *MockPacketConnWriteToCall {
+	c.Call = c.Call.Return(n, err)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockPacketConnWriteToCall) Do(f func([]byte, net.Addr) (int, error)) *MockPacketConnWriteToCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockPacketConnWriteToCall) DoAndReturn(f func([]byte, net.Addr) (int, error)) *MockPacketConnWriteToCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_raw_conn_test.go b/electron/native/private-transport/third_party/quic-go/mock_raw_conn_test.go
new file mode 100644
index 000000000..ecffca1b4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_raw_conn_test.go
@@ -0,0 +1,273 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: RawConn)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_raw_conn_test.go github.com/quic-go/quic-go RawConn
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	net "net"
+	reflect "reflect"
+	time "time"
+
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockRawConn is a mock of RawConn interface.
+type MockRawConn struct {
+	ctrl     *gomock.Controller
+	recorder *MockRawConnMockRecorder
+	isgomock struct{}
+}
+
+// MockRawConnMockRecorder is the mock recorder for MockRawConn.
+type MockRawConnMockRecorder struct {
+	mock *MockRawConn
+}
+
+// NewMockRawConn creates a new mock instance.
+func NewMockRawConn(ctrl *gomock.Controller) *MockRawConn {
+	mock := &MockRawConn{ctrl: ctrl}
+	mock.recorder = &MockRawConnMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockRawConn) EXPECT() *MockRawConnMockRecorder {
+	return m.recorder
+}
+
+// Close mocks base method.
+func (m *MockRawConn) Close() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Close")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Close indicates an expected call of Close.
+func (mr *MockRawConnMockRecorder) Close() *MockRawConnCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockRawConn)(nil).Close))
+	return &MockRawConnCloseCall{Call: call}
+}
+
+// MockRawConnCloseCall wrap *gomock.Call
+type MockRawConnCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockRawConnCloseCall) Return(arg0 error) *MockRawConnCloseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockRawConnCloseCall) Do(f func() error) *MockRawConnCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockRawConnCloseCall) DoAndReturn(f func() error) *MockRawConnCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// LocalAddr mocks base method.
+func (m *MockRawConn) LocalAddr() net.Addr {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "LocalAddr")
+	ret0, _ := ret[0].(net.Addr)
+	return ret0
+}
+
+// LocalAddr indicates an expected call of LocalAddr.
+func (mr *MockRawConnMockRecorder) LocalAddr() *MockRawConnLocalAddrCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LocalAddr", reflect.TypeOf((*MockRawConn)(nil).LocalAddr))
+	return &MockRawConnLocalAddrCall{Call: call}
+}
+
+// MockRawConnLocalAddrCall wrap *gomock.Call
+type MockRawConnLocalAddrCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockRawConnLocalAddrCall) Return(arg0 net.Addr) *MockRawConnLocalAddrCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockRawConnLocalAddrCall) Do(f func() net.Addr) *MockRawConnLocalAddrCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockRawConnLocalAddrCall) DoAndReturn(f func() net.Addr) *MockRawConnLocalAddrCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ReadPacket mocks base method.
+func (m *MockRawConn) ReadPacket() (receivedPacket, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ReadPacket")
+	ret0, _ := ret[0].(receivedPacket)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ReadPacket indicates an expected call of ReadPacket.
+func (mr *MockRawConnMockRecorder) ReadPacket() *MockRawConnReadPacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReadPacket", reflect.TypeOf((*MockRawConn)(nil).ReadPacket))
+	return &MockRawConnReadPacketCall{Call: call}
+}
+
+// MockRawConnReadPacketCall wrap *gomock.Call
+type MockRawConnReadPacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockRawConnReadPacketCall) Return(arg0 receivedPacket, arg1 error) *MockRawConnReadPacketCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockRawConnReadPacketCall) Do(f func() (receivedPacket, error)) *MockRawConnReadPacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockRawConnReadPacketCall) DoAndReturn(f func() (receivedPacket, error)) *MockRawConnReadPacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SetReadDeadline mocks base method.
+func (m *MockRawConn) SetReadDeadline(arg0 time.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetReadDeadline", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetReadDeadline indicates an expected call of SetReadDeadline.
+func (mr *MockRawConnMockRecorder) SetReadDeadline(arg0 any) *MockRawConnSetReadDeadlineCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetReadDeadline", reflect.TypeOf((*MockRawConn)(nil).SetReadDeadline), arg0)
+	return &MockRawConnSetReadDeadlineCall{Call: call}
+}
+
+// MockRawConnSetReadDeadlineCall wrap *gomock.Call
+type MockRawConnSetReadDeadlineCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockRawConnSetReadDeadlineCall) Return(arg0 error) *MockRawConnSetReadDeadlineCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockRawConnSetReadDeadlineCall) Do(f func(time.Time) error) *MockRawConnSetReadDeadlineCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockRawConnSetReadDeadlineCall) DoAndReturn(f func(time.Time) error) *MockRawConnSetReadDeadlineCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// WritePacket mocks base method.
+func (m *MockRawConn) WritePacket(b []byte, addr net.Addr, packetInfoOOB []byte, gsoSize uint16, ecn protocol.ECN) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WritePacket", b, addr, packetInfoOOB, gsoSize, ecn)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// WritePacket indicates an expected call of WritePacket.
+func (mr *MockRawConnMockRecorder) WritePacket(b, addr, packetInfoOOB, gsoSize, ecn any) *MockRawConnWritePacketCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WritePacket", reflect.TypeOf((*MockRawConn)(nil).WritePacket), b, addr, packetInfoOOB, gsoSize, ecn)
+	return &MockRawConnWritePacketCall{Call: call}
+}
+
+// MockRawConnWritePacketCall wrap *gomock.Call
+type MockRawConnWritePacketCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockRawConnWritePacketCall) Return(arg0 int, arg1 error) *MockRawConnWritePacketCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockRawConnWritePacketCall) Do(f func([]byte, net.Addr, []byte, uint16, protocol.ECN) (int, error)) *MockRawConnWritePacketCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockRawConnWritePacketCall) DoAndReturn(f func([]byte, net.Addr, []byte, uint16, protocol.ECN) (int, error)) *MockRawConnWritePacketCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// capabilities mocks base method.
+func (m *MockRawConn) capabilities() connCapabilities {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "capabilities")
+	ret0, _ := ret[0].(connCapabilities)
+	return ret0
+}
+
+// capabilities indicates an expected call of capabilities.
+func (mr *MockRawConnMockRecorder) capabilities() *MockRawConncapabilitiesCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "capabilities", reflect.TypeOf((*MockRawConn)(nil).capabilities))
+	return &MockRawConncapabilitiesCall{Call: call}
+}
+
+// MockRawConncapabilitiesCall wrap *gomock.Call
+type MockRawConncapabilitiesCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockRawConncapabilitiesCall) Return(arg0 connCapabilities) *MockRawConncapabilitiesCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockRawConncapabilitiesCall) Do(f func() connCapabilities) *MockRawConncapabilitiesCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockRawConncapabilitiesCall) DoAndReturn(f func() connCapabilities) *MockRawConncapabilitiesCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_sealing_manager_test.go b/electron/native/private-transport/third_party/quic-go/mock_sealing_manager_test.go
new file mode 100644
index 000000000..23f91a65e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_sealing_manager_test.go
@@ -0,0 +1,197 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: SealingManager)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_sealing_manager_test.go github.com/quic-go/quic-go SealingManager
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+
+	handshake "github.com/quic-go/quic-go/internal/handshake"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockSealingManager is a mock of SealingManager interface.
+type MockSealingManager struct {
+	ctrl     *gomock.Controller
+	recorder *MockSealingManagerMockRecorder
+	isgomock struct{}
+}
+
+// MockSealingManagerMockRecorder is the mock recorder for MockSealingManager.
+type MockSealingManagerMockRecorder struct {
+	mock *MockSealingManager
+}
+
+// NewMockSealingManager creates a new mock instance.
+func NewMockSealingManager(ctrl *gomock.Controller) *MockSealingManager {
+	mock := &MockSealingManager{ctrl: ctrl}
+	mock.recorder = &MockSealingManagerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSealingManager) EXPECT() *MockSealingManagerMockRecorder {
+	return m.recorder
+}
+
+// Get0RTTSealer mocks base method.
+func (m *MockSealingManager) Get0RTTSealer() (handshake.LongHeaderSealer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Get0RTTSealer")
+	ret0, _ := ret[0].(handshake.LongHeaderSealer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Get0RTTSealer indicates an expected call of Get0RTTSealer.
+func (mr *MockSealingManagerMockRecorder) Get0RTTSealer() *MockSealingManagerGet0RTTSealerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get0RTTSealer", reflect.TypeOf((*MockSealingManager)(nil).Get0RTTSealer))
+	return &MockSealingManagerGet0RTTSealerCall{Call: call}
+}
+
+// MockSealingManagerGet0RTTSealerCall wrap *gomock.Call
+type MockSealingManagerGet0RTTSealerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSealingManagerGet0RTTSealerCall) Return(arg0 handshake.LongHeaderSealer, arg1 error) *MockSealingManagerGet0RTTSealerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSealingManagerGet0RTTSealerCall) Do(f func() (handshake.LongHeaderSealer, error)) *MockSealingManagerGet0RTTSealerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSealingManagerGet0RTTSealerCall) DoAndReturn(f func() (handshake.LongHeaderSealer, error)) *MockSealingManagerGet0RTTSealerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Get1RTTSealer mocks base method.
+func (m *MockSealingManager) Get1RTTSealer() (handshake.ShortHeaderSealer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Get1RTTSealer")
+	ret0, _ := ret[0].(handshake.ShortHeaderSealer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Get1RTTSealer indicates an expected call of Get1RTTSealer.
+func (mr *MockSealingManagerMockRecorder) Get1RTTSealer() *MockSealingManagerGet1RTTSealerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get1RTTSealer", reflect.TypeOf((*MockSealingManager)(nil).Get1RTTSealer))
+	return &MockSealingManagerGet1RTTSealerCall{Call: call}
+}
+
+// MockSealingManagerGet1RTTSealerCall wrap *gomock.Call
+type MockSealingManagerGet1RTTSealerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSealingManagerGet1RTTSealerCall) Return(arg0 handshake.ShortHeaderSealer, arg1 error) *MockSealingManagerGet1RTTSealerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSealingManagerGet1RTTSealerCall) Do(f func() (handshake.ShortHeaderSealer, error)) *MockSealingManagerGet1RTTSealerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSealingManagerGet1RTTSealerCall) DoAndReturn(f func() (handshake.ShortHeaderSealer, error)) *MockSealingManagerGet1RTTSealerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// GetHandshakeSealer mocks base method.
+func (m *MockSealingManager) GetHandshakeSealer() (handshake.LongHeaderSealer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetHandshakeSealer")
+	ret0, _ := ret[0].(handshake.LongHeaderSealer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetHandshakeSealer indicates an expected call of GetHandshakeSealer.
+func (mr *MockSealingManagerMockRecorder) GetHandshakeSealer() *MockSealingManagerGetHandshakeSealerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetHandshakeSealer", reflect.TypeOf((*MockSealingManager)(nil).GetHandshakeSealer))
+	return &MockSealingManagerGetHandshakeSealerCall{Call: call}
+}
+
+// MockSealingManagerGetHandshakeSealerCall wrap *gomock.Call
+type MockSealingManagerGetHandshakeSealerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSealingManagerGetHandshakeSealerCall) Return(arg0 handshake.LongHeaderSealer, arg1 error) *MockSealingManagerGetHandshakeSealerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSealingManagerGetHandshakeSealerCall) Do(f func() (handshake.LongHeaderSealer, error)) *MockSealingManagerGetHandshakeSealerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSealingManagerGetHandshakeSealerCall) DoAndReturn(f func() (handshake.LongHeaderSealer, error)) *MockSealingManagerGetHandshakeSealerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// GetInitialSealer mocks base method.
+func (m *MockSealingManager) GetInitialSealer() (handshake.LongHeaderSealer, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetInitialSealer")
+	ret0, _ := ret[0].(handshake.LongHeaderSealer)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetInitialSealer indicates an expected call of GetInitialSealer.
+func (mr *MockSealingManagerMockRecorder) GetInitialSealer() *MockSealingManagerGetInitialSealerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetInitialSealer", reflect.TypeOf((*MockSealingManager)(nil).GetInitialSealer))
+	return &MockSealingManagerGetInitialSealerCall{Call: call}
+}
+
+// MockSealingManagerGetInitialSealerCall wrap *gomock.Call
+type MockSealingManagerGetInitialSealerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSealingManagerGetInitialSealerCall) Return(arg0 handshake.LongHeaderSealer, arg1 error) *MockSealingManagerGetInitialSealerCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSealingManagerGetInitialSealerCall) Do(f func() (handshake.LongHeaderSealer, error)) *MockSealingManagerGetInitialSealerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSealingManagerGetInitialSealerCall) DoAndReturn(f func() (handshake.LongHeaderSealer, error)) *MockSealingManagerGetInitialSealerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_send_conn_test.go b/electron/native/private-transport/third_party/quic-go/mock_send_conn_test.go
new file mode 100644
index 000000000..91f3a1f6c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_send_conn_test.go
@@ -0,0 +1,306 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: SendConn)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_send_conn_test.go github.com/quic-go/quic-go SendConn
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	net "net"
+	reflect "reflect"
+
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockSendConn is a mock of SendConn interface.
+type MockSendConn struct {
+	ctrl     *gomock.Controller
+	recorder *MockSendConnMockRecorder
+	isgomock struct{}
+}
+
+// MockSendConnMockRecorder is the mock recorder for MockSendConn.
+type MockSendConnMockRecorder struct {
+	mock *MockSendConn
+}
+
+// NewMockSendConn creates a new mock instance.
+func NewMockSendConn(ctrl *gomock.Controller) *MockSendConn {
+	mock := &MockSendConn{ctrl: ctrl}
+	mock.recorder = &MockSendConnMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSendConn) EXPECT() *MockSendConnMockRecorder {
+	return m.recorder
+}
+
+// ChangeRemoteAddr mocks base method.
+func (m *MockSendConn) ChangeRemoteAddr(addr net.Addr, info packetInfo) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ChangeRemoteAddr", addr, info)
+}
+
+// ChangeRemoteAddr indicates an expected call of ChangeRemoteAddr.
+func (mr *MockSendConnMockRecorder) ChangeRemoteAddr(addr, info any) *MockSendConnChangeRemoteAddrCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ChangeRemoteAddr", reflect.TypeOf((*MockSendConn)(nil).ChangeRemoteAddr), addr, info)
+	return &MockSendConnChangeRemoteAddrCall{Call: call}
+}
+
+// MockSendConnChangeRemoteAddrCall wrap *gomock.Call
+type MockSendConnChangeRemoteAddrCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendConnChangeRemoteAddrCall) Return() *MockSendConnChangeRemoteAddrCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendConnChangeRemoteAddrCall) Do(f func(net.Addr, packetInfo)) *MockSendConnChangeRemoteAddrCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendConnChangeRemoteAddrCall) DoAndReturn(f func(net.Addr, packetInfo)) *MockSendConnChangeRemoteAddrCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Close mocks base method.
+func (m *MockSendConn) Close() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Close")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Close indicates an expected call of Close.
+func (mr *MockSendConnMockRecorder) Close() *MockSendConnCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockSendConn)(nil).Close))
+	return &MockSendConnCloseCall{Call: call}
+}
+
+// MockSendConnCloseCall wrap *gomock.Call
+type MockSendConnCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendConnCloseCall) Return(arg0 error) *MockSendConnCloseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendConnCloseCall) Do(f func() error) *MockSendConnCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendConnCloseCall) DoAndReturn(f func() error) *MockSendConnCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// LocalAddr mocks base method.
+func (m *MockSendConn) LocalAddr() net.Addr {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "LocalAddr")
+	ret0, _ := ret[0].(net.Addr)
+	return ret0
+}
+
+// LocalAddr indicates an expected call of LocalAddr.
+func (mr *MockSendConnMockRecorder) LocalAddr() *MockSendConnLocalAddrCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LocalAddr", reflect.TypeOf((*MockSendConn)(nil).LocalAddr))
+	return &MockSendConnLocalAddrCall{Call: call}
+}
+
+// MockSendConnLocalAddrCall wrap *gomock.Call
+type MockSendConnLocalAddrCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendConnLocalAddrCall) Return(arg0 net.Addr) *MockSendConnLocalAddrCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendConnLocalAddrCall) Do(f func() net.Addr) *MockSendConnLocalAddrCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendConnLocalAddrCall) DoAndReturn(f func() net.Addr) *MockSendConnLocalAddrCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// RemoteAddr mocks base method.
+func (m *MockSendConn) RemoteAddr() net.Addr {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RemoteAddr")
+	ret0, _ := ret[0].(net.Addr)
+	return ret0
+}
+
+// RemoteAddr indicates an expected call of RemoteAddr.
+func (mr *MockSendConnMockRecorder) RemoteAddr() *MockSendConnRemoteAddrCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoteAddr", reflect.TypeOf((*MockSendConn)(nil).RemoteAddr))
+	return &MockSendConnRemoteAddrCall{Call: call}
+}
+
+// MockSendConnRemoteAddrCall wrap *gomock.Call
+type MockSendConnRemoteAddrCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendConnRemoteAddrCall) Return(arg0 net.Addr) *MockSendConnRemoteAddrCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendConnRemoteAddrCall) Do(f func() net.Addr) *MockSendConnRemoteAddrCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendConnRemoteAddrCall) DoAndReturn(f func() net.Addr) *MockSendConnRemoteAddrCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Write mocks base method.
+func (m *MockSendConn) Write(b []byte, gsoSize uint16, ecn protocol.ECN) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Write", b, gsoSize, ecn)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Write indicates an expected call of Write.
+func (mr *MockSendConnMockRecorder) Write(b, gsoSize, ecn any) *MockSendConnWriteCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Write", reflect.TypeOf((*MockSendConn)(nil).Write), b, gsoSize, ecn)
+	return &MockSendConnWriteCall{Call: call}
+}
+
+// MockSendConnWriteCall wrap *gomock.Call
+type MockSendConnWriteCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendConnWriteCall) Return(arg0 error) *MockSendConnWriteCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendConnWriteCall) Do(f func([]byte, uint16, protocol.ECN) error) *MockSendConnWriteCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendConnWriteCall) DoAndReturn(f func([]byte, uint16, protocol.ECN) error) *MockSendConnWriteCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// WriteTo mocks base method.
+func (m *MockSendConn) WriteTo(arg0 []byte, arg1 net.Addr, arg2 packetInfo) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WriteTo", arg0, arg1, arg2)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// WriteTo indicates an expected call of WriteTo.
+func (mr *MockSendConnMockRecorder) WriteTo(arg0, arg1, arg2 any) *MockSendConnWriteToCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WriteTo", reflect.TypeOf((*MockSendConn)(nil).WriteTo), arg0, arg1, arg2)
+	return &MockSendConnWriteToCall{Call: call}
+}
+
+// MockSendConnWriteToCall wrap *gomock.Call
+type MockSendConnWriteToCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendConnWriteToCall) Return(arg0 error) *MockSendConnWriteToCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendConnWriteToCall) Do(f func([]byte, net.Addr, packetInfo) error) *MockSendConnWriteToCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendConnWriteToCall) DoAndReturn(f func([]byte, net.Addr, packetInfo) error) *MockSendConnWriteToCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// capabilities mocks base method.
+func (m *MockSendConn) capabilities() connCapabilities {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "capabilities")
+	ret0, _ := ret[0].(connCapabilities)
+	return ret0
+}
+
+// capabilities indicates an expected call of capabilities.
+func (mr *MockSendConnMockRecorder) capabilities() *MockSendConncapabilitiesCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "capabilities", reflect.TypeOf((*MockSendConn)(nil).capabilities))
+	return &MockSendConncapabilitiesCall{Call: call}
+}
+
+// MockSendConncapabilitiesCall wrap *gomock.Call
+type MockSendConncapabilitiesCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSendConncapabilitiesCall) Return(arg0 connCapabilities) *MockSendConncapabilitiesCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSendConncapabilitiesCall) Do(f func() connCapabilities) *MockSendConncapabilitiesCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSendConncapabilitiesCall) DoAndReturn(f func() connCapabilities) *MockSendConncapabilitiesCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_sender_test.go b/electron/native/private-transport/third_party/quic-go/mock_sender_test.go
new file mode 100644
index 000000000..65449aa83
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_sender_test.go
@@ -0,0 +1,264 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: Sender)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_sender_test.go github.com/quic-go/quic-go Sender
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	net "net"
+	reflect "reflect"
+
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockSender is a mock of Sender interface.
+type MockSender struct {
+	ctrl     *gomock.Controller
+	recorder *MockSenderMockRecorder
+	isgomock struct{}
+}
+
+// MockSenderMockRecorder is the mock recorder for MockSender.
+type MockSenderMockRecorder struct {
+	mock *MockSender
+}
+
+// NewMockSender creates a new mock instance.
+func NewMockSender(ctrl *gomock.Controller) *MockSender {
+	mock := &MockSender{ctrl: ctrl}
+	mock.recorder = &MockSenderMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSender) EXPECT() *MockSenderMockRecorder {
+	return m.recorder
+}
+
+// Available mocks base method.
+func (m *MockSender) Available() <-chan struct{} {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Available")
+	ret0, _ := ret[0].(<-chan struct{})
+	return ret0
+}
+
+// Available indicates an expected call of Available.
+func (mr *MockSenderMockRecorder) Available() *MockSenderAvailableCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Available", reflect.TypeOf((*MockSender)(nil).Available))
+	return &MockSenderAvailableCall{Call: call}
+}
+
+// MockSenderAvailableCall wrap *gomock.Call
+type MockSenderAvailableCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSenderAvailableCall) Return(arg0 <-chan struct{}) *MockSenderAvailableCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSenderAvailableCall) Do(f func() <-chan struct{}) *MockSenderAvailableCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSenderAvailableCall) DoAndReturn(f func() <-chan struct{}) *MockSenderAvailableCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Close mocks base method.
+func (m *MockSender) Close() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Close")
+}
+
+// Close indicates an expected call of Close.
+func (mr *MockSenderMockRecorder) Close() *MockSenderCloseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockSender)(nil).Close))
+	return &MockSenderCloseCall{Call: call}
+}
+
+// MockSenderCloseCall wrap *gomock.Call
+type MockSenderCloseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSenderCloseCall) Return() *MockSenderCloseCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSenderCloseCall) Do(f func()) *MockSenderCloseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSenderCloseCall) DoAndReturn(f func()) *MockSenderCloseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Run mocks base method.
+func (m *MockSender) Run() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Run")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Run indicates an expected call of Run.
+func (mr *MockSenderMockRecorder) Run() *MockSenderRunCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Run", reflect.TypeOf((*MockSender)(nil).Run))
+	return &MockSenderRunCall{Call: call}
+}
+
+// MockSenderRunCall wrap *gomock.Call
+type MockSenderRunCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSenderRunCall) Return(arg0 error) *MockSenderRunCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSenderRunCall) Do(f func() error) *MockSenderRunCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSenderRunCall) DoAndReturn(f func() error) *MockSenderRunCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Send mocks base method.
+func (m *MockSender) Send(p *packetBuffer, gsoSize uint16, ecn protocol.ECN) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Send", p, gsoSize, ecn)
+}
+
+// Send indicates an expected call of Send.
+func (mr *MockSenderMockRecorder) Send(p, gsoSize, ecn any) *MockSenderSendCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Send", reflect.TypeOf((*MockSender)(nil).Send), p, gsoSize, ecn)
+	return &MockSenderSendCall{Call: call}
+}
+
+// MockSenderSendCall wrap *gomock.Call
+type MockSenderSendCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSenderSendCall) Return() *MockSenderSendCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSenderSendCall) Do(f func(*packetBuffer, uint16, protocol.ECN)) *MockSenderSendCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSenderSendCall) DoAndReturn(f func(*packetBuffer, uint16, protocol.ECN)) *MockSenderSendCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// SendProbe mocks base method.
+func (m *MockSender) SendProbe(arg0 *packetBuffer, arg1 net.Addr, arg2 packetInfo) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SendProbe", arg0, arg1, arg2)
+}
+
+// SendProbe indicates an expected call of SendProbe.
+func (mr *MockSenderMockRecorder) SendProbe(arg0, arg1, arg2 any) *MockSenderSendProbeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SendProbe", reflect.TypeOf((*MockSender)(nil).SendProbe), arg0, arg1, arg2)
+	return &MockSenderSendProbeCall{Call: call}
+}
+
+// MockSenderSendProbeCall wrap *gomock.Call
+type MockSenderSendProbeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSenderSendProbeCall) Return() *MockSenderSendProbeCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSenderSendProbeCall) Do(f func(*packetBuffer, net.Addr, packetInfo)) *MockSenderSendProbeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSenderSendProbeCall) DoAndReturn(f func(*packetBuffer, net.Addr, packetInfo)) *MockSenderSendProbeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// WouldBlock mocks base method.
+func (m *MockSender) WouldBlock() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WouldBlock")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// WouldBlock indicates an expected call of WouldBlock.
+func (mr *MockSenderMockRecorder) WouldBlock() *MockSenderWouldBlockCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WouldBlock", reflect.TypeOf((*MockSender)(nil).WouldBlock))
+	return &MockSenderWouldBlockCall{Call: call}
+}
+
+// MockSenderWouldBlockCall wrap *gomock.Call
+type MockSenderWouldBlockCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSenderWouldBlockCall) Return(arg0 bool) *MockSenderWouldBlockCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSenderWouldBlockCall) Do(f func() bool) *MockSenderWouldBlockCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSenderWouldBlockCall) DoAndReturn(f func() bool) *MockSenderWouldBlockCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_stream_control_frame_getter_test.go b/electron/native/private-transport/third_party/quic-go/mock_stream_control_frame_getter_test.go
new file mode 100644
index 000000000..6f635018b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_stream_control_frame_getter_test.go
@@ -0,0 +1,82 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: StreamControlFrameGetter)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_stream_control_frame_getter_test.go github.com/quic-go/quic-go StreamControlFrameGetter
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+
+	ackhandler "github.com/quic-go/quic-go/internal/ackhandler"
+	monotime "github.com/quic-go/quic-go/internal/monotime"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockStreamControlFrameGetter is a mock of StreamControlFrameGetter interface.
+type MockStreamControlFrameGetter struct {
+	ctrl     *gomock.Controller
+	recorder *MockStreamControlFrameGetterMockRecorder
+	isgomock struct{}
+}
+
+// MockStreamControlFrameGetterMockRecorder is the mock recorder for MockStreamControlFrameGetter.
+type MockStreamControlFrameGetterMockRecorder struct {
+	mock *MockStreamControlFrameGetter
+}
+
+// NewMockStreamControlFrameGetter creates a new mock instance.
+func NewMockStreamControlFrameGetter(ctrl *gomock.Controller) *MockStreamControlFrameGetter {
+	mock := &MockStreamControlFrameGetter{ctrl: ctrl}
+	mock.recorder = &MockStreamControlFrameGetterMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockStreamControlFrameGetter) EXPECT() *MockStreamControlFrameGetterMockRecorder {
+	return m.recorder
+}
+
+// getControlFrame mocks base method.
+func (m *MockStreamControlFrameGetter) getControlFrame(arg0 monotime.Time) (ackhandler.Frame, bool, bool) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "getControlFrame", arg0)
+	ret0, _ := ret[0].(ackhandler.Frame)
+	ret1, _ := ret[1].(bool)
+	ret2, _ := ret[2].(bool)
+	return ret0, ret1, ret2
+}
+
+// getControlFrame indicates an expected call of getControlFrame.
+func (mr *MockStreamControlFrameGetterMockRecorder) getControlFrame(arg0 any) *MockStreamControlFrameGettergetControlFrameCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "getControlFrame", reflect.TypeOf((*MockStreamControlFrameGetter)(nil).getControlFrame), arg0)
+	return &MockStreamControlFrameGettergetControlFrameCall{Call: call}
+}
+
+// MockStreamControlFrameGettergetControlFrameCall wrap *gomock.Call
+type MockStreamControlFrameGettergetControlFrameCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamControlFrameGettergetControlFrameCall) Return(arg0 ackhandler.Frame, ok, hasMore bool) *MockStreamControlFrameGettergetControlFrameCall {
+	c.Call = c.Call.Return(arg0, ok, hasMore)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamControlFrameGettergetControlFrameCall) Do(f func(monotime.Time) (ackhandler.Frame, bool, bool)) *MockStreamControlFrameGettergetControlFrameCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamControlFrameGettergetControlFrameCall) DoAndReturn(f func(monotime.Time) (ackhandler.Frame, bool, bool)) *MockStreamControlFrameGettergetControlFrameCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_stream_frame_getter_test.go b/electron/native/private-transport/third_party/quic-go/mock_stream_frame_getter_test.go
new file mode 100644
index 000000000..1ac736e4f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_stream_frame_getter_test.go
@@ -0,0 +1,162 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: StreamFrameGetter)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_stream_frame_getter_test.go github.com/quic-go/quic-go StreamFrameGetter
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+
+	ackhandler "github.com/quic-go/quic-go/internal/ackhandler"
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	wire "github.com/quic-go/quic-go/internal/wire"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockStreamFrameGetter is a mock of StreamFrameGetter interface.
+type MockStreamFrameGetter struct {
+	ctrl     *gomock.Controller
+	recorder *MockStreamFrameGetterMockRecorder
+	isgomock struct{}
+}
+
+// MockStreamFrameGetterMockRecorder is the mock recorder for MockStreamFrameGetter.
+type MockStreamFrameGetterMockRecorder struct {
+	mock *MockStreamFrameGetter
+}
+
+// NewMockStreamFrameGetter creates a new mock instance.
+func NewMockStreamFrameGetter(ctrl *gomock.Controller) *MockStreamFrameGetter {
+	mock := &MockStreamFrameGetter{ctrl: ctrl}
+	mock.recorder = &MockStreamFrameGetterMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockStreamFrameGetter) EXPECT() *MockStreamFrameGetterMockRecorder {
+	return m.recorder
+}
+
+// popRetransmissionFrame mocks base method.
+func (m *MockStreamFrameGetter) popRetransmissionFrame(arg0 protocol.ByteCount, arg1 protocol.Version) (ackhandler.StreamFrame, bool) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "popRetransmissionFrame", arg0, arg1)
+	ret0, _ := ret[0].(ackhandler.StreamFrame)
+	ret1, _ := ret[1].(bool)
+	return ret0, ret1
+}
+
+// popRetransmissionFrame indicates an expected call of popRetransmissionFrame.
+func (mr *MockStreamFrameGetterMockRecorder) popRetransmissionFrame(arg0, arg1 any) *MockStreamFrameGetterpopRetransmissionFrameCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "popRetransmissionFrame", reflect.TypeOf((*MockStreamFrameGetter)(nil).popRetransmissionFrame), arg0, arg1)
+	return &MockStreamFrameGetterpopRetransmissionFrameCall{Call: call}
+}
+
+// MockStreamFrameGetterpopRetransmissionFrameCall wrap *gomock.Call
+type MockStreamFrameGetterpopRetransmissionFrameCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamFrameGetterpopRetransmissionFrameCall) Return(arg0 ackhandler.StreamFrame, arg1 bool) *MockStreamFrameGetterpopRetransmissionFrameCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamFrameGetterpopRetransmissionFrameCall) Do(f func(protocol.ByteCount, protocol.Version) (ackhandler.StreamFrame, bool)) *MockStreamFrameGetterpopRetransmissionFrameCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamFrameGetterpopRetransmissionFrameCall) DoAndReturn(f func(protocol.ByteCount, protocol.Version) (ackhandler.StreamFrame, bool)) *MockStreamFrameGetterpopRetransmissionFrameCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// popStreamFrame mocks base method.
+func (m *MockStreamFrameGetter) popStreamFrame(arg0 protocol.ByteCount, arg1 protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "popStreamFrame", arg0, arg1)
+	ret0, _ := ret[0].(ackhandler.StreamFrame)
+	ret1, _ := ret[1].(*wire.StreamDataBlockedFrame)
+	ret2, _ := ret[2].(bool)
+	return ret0, ret1, ret2
+}
+
+// popStreamFrame indicates an expected call of popStreamFrame.
+func (mr *MockStreamFrameGetterMockRecorder) popStreamFrame(arg0, arg1 any) *MockStreamFrameGetterpopStreamFrameCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "popStreamFrame", reflect.TypeOf((*MockStreamFrameGetter)(nil).popStreamFrame), arg0, arg1)
+	return &MockStreamFrameGetterpopStreamFrameCall{Call: call}
+}
+
+// MockStreamFrameGetterpopStreamFrameCall wrap *gomock.Call
+type MockStreamFrameGetterpopStreamFrameCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamFrameGetterpopStreamFrameCall) Return(arg0 ackhandler.StreamFrame, arg1 *wire.StreamDataBlockedFrame, hasMoreData bool) *MockStreamFrameGetterpopStreamFrameCall {
+	c.Call = c.Call.Return(arg0, arg1, hasMoreData)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamFrameGetterpopStreamFrameCall) Do(f func(protocol.ByteCount, protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool)) *MockStreamFrameGetterpopStreamFrameCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamFrameGetterpopStreamFrameCall) DoAndReturn(f func(protocol.ByteCount, protocol.Version) (ackhandler.StreamFrame, *wire.StreamDataBlockedFrame, bool)) *MockStreamFrameGetterpopStreamFrameCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// priority mocks base method.
+func (m *MockStreamFrameGetter) priority() (int8, bool, uint32) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "priority")
+	ret0, _ := ret[0].(int8)
+	ret1, _ := ret[1].(bool)
+	ret2, _ := ret[2].(uint32)
+	return ret0, ret1, ret2
+}
+
+// priority indicates an expected call of priority.
+func (mr *MockStreamFrameGetterMockRecorder) priority() *MockStreamFrameGetterpriorityCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "priority", reflect.TypeOf((*MockStreamFrameGetter)(nil).priority))
+	return &MockStreamFrameGetterpriorityCall{Call: call}
+}
+
+// MockStreamFrameGetterpriorityCall wrap *gomock.Call
+type MockStreamFrameGetterpriorityCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamFrameGetterpriorityCall) Return(urgency int8, incremental bool, generation uint32) *MockStreamFrameGetterpriorityCall {
+	c.Call = c.Call.Return(urgency, incremental, generation)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamFrameGetterpriorityCall) Do(f func() (int8, bool, uint32)) *MockStreamFrameGetterpriorityCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamFrameGetterpriorityCall) DoAndReturn(f func() (int8, bool, uint32)) *MockStreamFrameGetterpriorityCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_stream_sender_test.go b/electron/native/private-transport/third_party/quic-go/mock_stream_sender_test.go
new file mode 100644
index 000000000..d8610f456
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_stream_sender_test.go
@@ -0,0 +1,293 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: StreamSender)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_stream_sender_test.go github.com/quic-go/quic-go StreamSender
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockStreamSender is a mock of StreamSender interface.
+type MockStreamSender struct {
+	ctrl     *gomock.Controller
+	recorder *MockStreamSenderMockRecorder
+	isgomock struct{}
+}
+
+// MockStreamSenderMockRecorder is the mock recorder for MockStreamSender.
+type MockStreamSenderMockRecorder struct {
+	mock *MockStreamSender
+}
+
+// NewMockStreamSender creates a new mock instance.
+func NewMockStreamSender(ctrl *gomock.Controller) *MockStreamSender {
+	mock := &MockStreamSender{ctrl: ctrl}
+	mock.recorder = &MockStreamSenderMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockStreamSender) EXPECT() *MockStreamSenderMockRecorder {
+	return m.recorder
+}
+
+// onHasConnectionData mocks base method.
+func (m *MockStreamSender) onHasConnectionData() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "onHasConnectionData")
+}
+
+// onHasConnectionData indicates an expected call of onHasConnectionData.
+func (mr *MockStreamSenderMockRecorder) onHasConnectionData() *MockStreamSenderonHasConnectionDataCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "onHasConnectionData", reflect.TypeOf((*MockStreamSender)(nil).onHasConnectionData))
+	return &MockStreamSenderonHasConnectionDataCall{Call: call}
+}
+
+// MockStreamSenderonHasConnectionDataCall wrap *gomock.Call
+type MockStreamSenderonHasConnectionDataCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamSenderonHasConnectionDataCall) Return() *MockStreamSenderonHasConnectionDataCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamSenderonHasConnectionDataCall) Do(f func()) *MockStreamSenderonHasConnectionDataCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamSenderonHasConnectionDataCall) DoAndReturn(f func()) *MockStreamSenderonHasConnectionDataCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// onHasStreamControlFrame mocks base method.
+func (m *MockStreamSender) onHasStreamControlFrame(arg0 protocol.StreamID, arg1 streamControlFrameGetter) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "onHasStreamControlFrame", arg0, arg1)
+}
+
+// onHasStreamControlFrame indicates an expected call of onHasStreamControlFrame.
+func (mr *MockStreamSenderMockRecorder) onHasStreamControlFrame(arg0, arg1 any) *MockStreamSenderonHasStreamControlFrameCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "onHasStreamControlFrame", reflect.TypeOf((*MockStreamSender)(nil).onHasStreamControlFrame), arg0, arg1)
+	return &MockStreamSenderonHasStreamControlFrameCall{Call: call}
+}
+
+// MockStreamSenderonHasStreamControlFrameCall wrap *gomock.Call
+type MockStreamSenderonHasStreamControlFrameCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamSenderonHasStreamControlFrameCall) Return() *MockStreamSenderonHasStreamControlFrameCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamSenderonHasStreamControlFrameCall) Do(f func(protocol.StreamID, streamControlFrameGetter)) *MockStreamSenderonHasStreamControlFrameCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamSenderonHasStreamControlFrameCall) DoAndReturn(f func(protocol.StreamID, streamControlFrameGetter)) *MockStreamSenderonHasStreamControlFrameCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// onHasStreamData mocks base method.
+func (m *MockStreamSender) onHasStreamData(arg0 protocol.StreamID, arg1 *SendStream) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "onHasStreamData", arg0, arg1)
+}
+
+// onHasStreamData indicates an expected call of onHasStreamData.
+func (mr *MockStreamSenderMockRecorder) onHasStreamData(arg0, arg1 any) *MockStreamSenderonHasStreamDataCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "onHasStreamData", reflect.TypeOf((*MockStreamSender)(nil).onHasStreamData), arg0, arg1)
+	return &MockStreamSenderonHasStreamDataCall{Call: call}
+}
+
+// MockStreamSenderonHasStreamDataCall wrap *gomock.Call
+type MockStreamSenderonHasStreamDataCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamSenderonHasStreamDataCall) Return() *MockStreamSenderonHasStreamDataCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamSenderonHasStreamDataCall) Do(f func(protocol.StreamID, *SendStream)) *MockStreamSenderonHasStreamDataCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamSenderonHasStreamDataCall) DoAndReturn(f func(protocol.StreamID, *SendStream)) *MockStreamSenderonHasStreamDataCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// onHasStreamRetransmission mocks base method.
+func (m *MockStreamSender) onHasStreamRetransmission(arg0 protocol.StreamID, arg1 *SendStream) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "onHasStreamRetransmission", arg0, arg1)
+}
+
+// onHasStreamRetransmission indicates an expected call of onHasStreamRetransmission.
+func (mr *MockStreamSenderMockRecorder) onHasStreamRetransmission(arg0, arg1 any) *MockStreamSenderonHasStreamRetransmissionCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "onHasStreamRetransmission", reflect.TypeOf((*MockStreamSender)(nil).onHasStreamRetransmission), arg0, arg1)
+	return &MockStreamSenderonHasStreamRetransmissionCall{Call: call}
+}
+
+// MockStreamSenderonHasStreamRetransmissionCall wrap *gomock.Call
+type MockStreamSenderonHasStreamRetransmissionCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamSenderonHasStreamRetransmissionCall) Return() *MockStreamSenderonHasStreamRetransmissionCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamSenderonHasStreamRetransmissionCall) Do(f func(protocol.StreamID, *SendStream)) *MockStreamSenderonHasStreamRetransmissionCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamSenderonHasStreamRetransmissionCall) DoAndReturn(f func(protocol.StreamID, *SendStream)) *MockStreamSenderonHasStreamRetransmissionCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// onStreamCompleted mocks base method.
+func (m *MockStreamSender) onStreamCompleted(arg0 protocol.StreamID) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "onStreamCompleted", arg0)
+}
+
+// onStreamCompleted indicates an expected call of onStreamCompleted.
+func (mr *MockStreamSenderMockRecorder) onStreamCompleted(arg0 any) *MockStreamSenderonStreamCompletedCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "onStreamCompleted", reflect.TypeOf((*MockStreamSender)(nil).onStreamCompleted), arg0)
+	return &MockStreamSenderonStreamCompletedCall{Call: call}
+}
+
+// MockStreamSenderonStreamCompletedCall wrap *gomock.Call
+type MockStreamSenderonStreamCompletedCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamSenderonStreamCompletedCall) Return() *MockStreamSenderonStreamCompletedCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamSenderonStreamCompletedCall) Do(f func(protocol.StreamID)) *MockStreamSenderonStreamCompletedCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamSenderonStreamCompletedCall) DoAndReturn(f func(protocol.StreamID)) *MockStreamSenderonStreamCompletedCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// recordStreamPriorityUpdated mocks base method.
+func (m *MockStreamSender) recordStreamPriorityUpdated(arg0 protocol.StreamID, arg1 int8, arg2 bool) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "recordStreamPriorityUpdated", arg0, arg1, arg2)
+}
+
+// recordStreamPriorityUpdated indicates an expected call of recordStreamPriorityUpdated.
+func (mr *MockStreamSenderMockRecorder) recordStreamPriorityUpdated(arg0, arg1, arg2 any) *MockStreamSenderrecordStreamPriorityUpdatedCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "recordStreamPriorityUpdated", reflect.TypeOf((*MockStreamSender)(nil).recordStreamPriorityUpdated), arg0, arg1, arg2)
+	return &MockStreamSenderrecordStreamPriorityUpdatedCall{Call: call}
+}
+
+// MockStreamSenderrecordStreamPriorityUpdatedCall wrap *gomock.Call
+type MockStreamSenderrecordStreamPriorityUpdatedCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamSenderrecordStreamPriorityUpdatedCall) Return() *MockStreamSenderrecordStreamPriorityUpdatedCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamSenderrecordStreamPriorityUpdatedCall) Do(f func(protocol.StreamID, int8, bool)) *MockStreamSenderrecordStreamPriorityUpdatedCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamSenderrecordStreamPriorityUpdatedCall) DoAndReturn(f func(protocol.StreamID, int8, bool)) *MockStreamSenderrecordStreamPriorityUpdatedCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// updateStreamPriority mocks base method.
+func (m *MockStreamSender) updateStreamPriority(arg0 protocol.StreamID) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "updateStreamPriority", arg0)
+}
+
+// updateStreamPriority indicates an expected call of updateStreamPriority.
+func (mr *MockStreamSenderMockRecorder) updateStreamPriority(arg0 any) *MockStreamSenderupdateStreamPriorityCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "updateStreamPriority", reflect.TypeOf((*MockStreamSender)(nil).updateStreamPriority), arg0)
+	return &MockStreamSenderupdateStreamPriorityCall{Call: call}
+}
+
+// MockStreamSenderupdateStreamPriorityCall wrap *gomock.Call
+type MockStreamSenderupdateStreamPriorityCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStreamSenderupdateStreamPriorityCall) Return() *MockStreamSenderupdateStreamPriorityCall {
+	c.Call = c.Call.Return()
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStreamSenderupdateStreamPriorityCall) Do(f func(protocol.StreamID)) *MockStreamSenderupdateStreamPriorityCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStreamSenderupdateStreamPriorityCall) DoAndReturn(f func(protocol.StreamID)) *MockStreamSenderupdateStreamPriorityCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mock_unpacker_test.go b/electron/native/private-transport/third_party/quic-go/mock_unpacker_test.go
new file mode 100644
index 000000000..54ed4d3de
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mock_unpacker_test.go
@@ -0,0 +1,124 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/quic-go/quic-go (interfaces: Unpacker)
+//
+// Generated by this command:
+//
+//	mockgen -typed -build_flags=-tags=gomock -package quic -self_package github.com/quic-go/quic-go -destination mock_unpacker_test.go github.com/quic-go/quic-go Unpacker
+//
+
+// Package quic is a generated GoMock package.
+package quic
+
+import (
+	reflect "reflect"
+
+	monotime "github.com/quic-go/quic-go/internal/monotime"
+	protocol "github.com/quic-go/quic-go/internal/protocol"
+	wire "github.com/quic-go/quic-go/internal/wire"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockUnpacker is a mock of Unpacker interface.
+type MockUnpacker struct {
+	ctrl     *gomock.Controller
+	recorder *MockUnpackerMockRecorder
+	isgomock struct{}
+}
+
+// MockUnpackerMockRecorder is the mock recorder for MockUnpacker.
+type MockUnpackerMockRecorder struct {
+	mock *MockUnpacker
+}
+
+// NewMockUnpacker creates a new mock instance.
+func NewMockUnpacker(ctrl *gomock.Controller) *MockUnpacker {
+	mock := &MockUnpacker{ctrl: ctrl}
+	mock.recorder = &MockUnpackerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockUnpacker) EXPECT() *MockUnpackerMockRecorder {
+	return m.recorder
+}
+
+// UnpackLongHeader mocks base method.
+func (m *MockUnpacker) UnpackLongHeader(hdr *wire.Header, data []byte) (*unpackedPacket, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UnpackLongHeader", hdr, data)
+	ret0, _ := ret[0].(*unpackedPacket)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UnpackLongHeader indicates an expected call of UnpackLongHeader.
+func (mr *MockUnpackerMockRecorder) UnpackLongHeader(hdr, data any) *MockUnpackerUnpackLongHeaderCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UnpackLongHeader", reflect.TypeOf((*MockUnpacker)(nil).UnpackLongHeader), hdr, data)
+	return &MockUnpackerUnpackLongHeaderCall{Call: call}
+}
+
+// MockUnpackerUnpackLongHeaderCall wrap *gomock.Call
+type MockUnpackerUnpackLongHeaderCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockUnpackerUnpackLongHeaderCall) Return(arg0 *unpackedPacket, arg1 error) *MockUnpackerUnpackLongHeaderCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockUnpackerUnpackLongHeaderCall) Do(f func(*wire.Header, []byte) (*unpackedPacket, error)) *MockUnpackerUnpackLongHeaderCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockUnpackerUnpackLongHeaderCall) DoAndReturn(f func(*wire.Header, []byte) (*unpackedPacket, error)) *MockUnpackerUnpackLongHeaderCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// UnpackShortHeader mocks base method.
+func (m *MockUnpacker) UnpackShortHeader(rcvTime monotime.Time, data []byte) (protocol.PacketNumber, protocol.PacketNumberLen, protocol.KeyPhaseBit, []byte, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UnpackShortHeader", rcvTime, data)
+	ret0, _ := ret[0].(protocol.PacketNumber)
+	ret1, _ := ret[1].(protocol.PacketNumberLen)
+	ret2, _ := ret[2].(protocol.KeyPhaseBit)
+	ret3, _ := ret[3].([]byte)
+	ret4, _ := ret[4].(error)
+	return ret0, ret1, ret2, ret3, ret4
+}
+
+// UnpackShortHeader indicates an expected call of UnpackShortHeader.
+func (mr *MockUnpackerMockRecorder) UnpackShortHeader(rcvTime, data any) *MockUnpackerUnpackShortHeaderCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UnpackShortHeader", reflect.TypeOf((*MockUnpacker)(nil).UnpackShortHeader), rcvTime, data)
+	return &MockUnpackerUnpackShortHeaderCall{Call: call}
+}
+
+// MockUnpackerUnpackShortHeaderCall wrap *gomock.Call
+type MockUnpackerUnpackShortHeaderCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockUnpackerUnpackShortHeaderCall) Return(arg0 protocol.PacketNumber, arg1 protocol.PacketNumberLen, arg2 protocol.KeyPhaseBit, arg3 []byte, arg4 error) *MockUnpackerUnpackShortHeaderCall {
+	c.Call = c.Call.Return(arg0, arg1, arg2, arg3, arg4)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockUnpackerUnpackShortHeaderCall) Do(f func(monotime.Time, []byte) (protocol.PacketNumber, protocol.PacketNumberLen, protocol.KeyPhaseBit, []byte, error)) *MockUnpackerUnpackShortHeaderCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockUnpackerUnpackShortHeaderCall) DoAndReturn(f func(monotime.Time, []byte) (protocol.PacketNumber, protocol.PacketNumberLen, protocol.KeyPhaseBit, []byte, error)) *MockUnpackerUnpackShortHeaderCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mockgen.go b/electron/native/private-transport/third_party/quic-go/mockgen.go
new file mode 100644
index 000000000..f372489a9
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mockgen.go
@@ -0,0 +1,44 @@
+//go:build gomock || generate
+
+package quic
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_send_conn_test.go github.com/quic-go/quic-go SendConn"
+type SendConn = sendConn
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_raw_conn_test.go github.com/quic-go/quic-go RawConn"
+type RawConn = rawConn
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_sender_test.go github.com/quic-go/quic-go Sender"
+type Sender = sender
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_stream_sender_test.go github.com/quic-go/quic-go StreamSender"
+type StreamSender = streamSender
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_stream_control_frame_getter_test.go github.com/quic-go/quic-go StreamControlFrameGetter"
+type StreamControlFrameGetter = streamControlFrameGetter
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_stream_frame_getter_test.go github.com/quic-go/quic-go StreamFrameGetter"
+type StreamFrameGetter = streamFrameGetter
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_frame_source_test.go github.com/quic-go/quic-go FrameSource"
+type FrameSource = frameSource
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_ack_frame_source_test.go github.com/quic-go/quic-go AckFrameSource"
+type AckFrameSource = ackFrameSource
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_sealing_manager_test.go github.com/quic-go/quic-go SealingManager"
+type SealingManager = sealingManager
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_unpacker_test.go github.com/quic-go/quic-go Unpacker"
+type Unpacker = unpacker
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_packer_test.go github.com/quic-go/quic-go Packer"
+type Packer = packer
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_conn_runner_test.go github.com/quic-go/quic-go ConnRunner"
+type ConnRunner = connRunner
+
+//go:generate sh -c "go tool mockgen -typed -build_flags=\"-tags=gomock\" -package quic -self_package github.com/quic-go/quic-go -destination mock_packet_handler_test.go github.com/quic-go/quic-go PacketHandler"
+type PacketHandler = packetHandler
+
+//go:generate sh -c "go tool mockgen -typed -package quic -self_package github.com/quic-go/quic-go -self_package github.com/quic-go/quic-go -destination mock_packetconn_test.go net PacketConn"
diff --git a/electron/native/private-transport/third_party/quic-go/mtu_discoverer.go b/electron/native/private-transport/third_party/quic-go/mtu_discoverer.go
new file mode 100644
index 000000000..76b28e726
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mtu_discoverer.go
@@ -0,0 +1,241 @@
+package quic
+
+import (
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+const (
+	// At some point, we have to stop searching for a higher MTU.
+	// We're happy to send a packet that's 10 bytes smaller than the actual MTU.
+	maxMTUDiff protocol.ByteCount = 20
+	// send a probe packet every mtuProbeDelay RTTs
+	mtuProbeDelay = 5
+	// Once maxLostMTUProbes MTU probe packets larger than a certain size are lost,
+	// MTU discovery won't probe for larger MTUs than this size.
+	// The algorithm used here is resilient to packet loss of (maxLostMTUProbes - 1) packets.
+	maxLostMTUProbes = 3
+)
+
+// The Path MTU is found by sending a larger packet every now and then.
+// If the packet is acknowledged, we conclude that the path supports this larger packet size.
+// If the packet is lost, this can mean one of two things:
+//   1. The path doesn't support this larger packet size, or
+//   2. The packet was lost due to packet loss, independent of its size.
+// The algorithm used here is resilient to packet loss of (maxLostMTUProbes - 1) packets.
+// For simplicty, the following example use maxLostMTUProbes = 2.
+//
+// Initialization:
+//    |------------------------------------------------------------------------------|
+//   min                                                                            max
+//
+// The first MTU probe packet will have size (min+max)/2.
+// Assume that this packet is acknowledged. We can now move the min marker,
+// and continue the search in the resulting interval.
+//
+// If 1st probe packet acknowledged:
+//    |---------------------------------------|--------------------------------------|
+//                                           min                                    max
+//
+// If 1st probe packet lost:
+//    |---------------------------------------|--------------------------------------|
+//   min                                    lost[0]                                 max
+//
+// We can't conclude that the path doesn't support this packet size, since the loss of the probe
+// packet could have been unrelated to the packet size.  A larger probe packet will be sent later on.
+// After a loss, the next probe packet has size (min+lost[0])/2.
+// Now assume this probe packet is acknowledged:
+//
+// 2nd probe packet acknowledged:
+//    |------------------|--------------------|--------------------------------------|
+//                      min                lost[0]                                  max
+//
+// First of all, we conclude that the path supports at least this MTU. That's progress!
+// Second, we probe a bit more aggressively with the next probe packet:
+// After an acknowledgement, the next probe packet has size (min+max)/2.
+// This means we'll send a packet larger than the first probe packet (which was lost).
+//
+// If 3rd probe packet acknowledged:
+//    |-------------------------------------------------|----------------------------|
+//                                                     min                          max
+//
+// We can conclude that the loss of the 1st probe packet was not due to its size, and
+// continue searching in a much smaller interval now.
+//
+// If 3rd probe packet lost:
+//    |------------------|--------------------|---------|----------------------------|
+//                      min                lost[0]     max
+//
+// Since in our example numPTOProbes = 2, and we lost 2 packets smaller than max, we
+// conclude that this packet size is not supported on the path, and reduce the maximum
+// value of the search interval.
+//
+// MTU discovery concludes once the interval min and max has been narrowed down to maxMTUDiff.
+
+type mtuFinder struct {
+	lastProbeTime monotime.Time
+
+	rttStats *utils.RTTStats
+
+	inFlight protocol.ByteCount // the size of the probe packet currently in flight. InvalidByteCount if none is in flight
+	min      protocol.ByteCount
+
+	// on initialization, we treat the maximum size as the first "lost" packet
+	lost             [maxLostMTUProbes]protocol.ByteCount
+	lastProbeWasLost bool
+
+	// The generation is used to ignore ACKs / losses for probe packets sent before a reset.
+	// Resets happen when the connection is migrated to a new path.
+	// We're therefore not concerned about overflows of this counter.
+	generation uint8
+
+	qlogger qlogwriter.Recorder
+}
+
+func newMTUDiscoverer(
+	rttStats *utils.RTTStats,
+	start, max protocol.ByteCount,
+	qlogger qlogwriter.Recorder,
+) *mtuFinder {
+	f := &mtuFinder{
+		inFlight: protocol.InvalidByteCount,
+		rttStats: rttStats,
+		qlogger:  qlogger,
+	}
+	f.init(start, max)
+	return f
+}
+
+func (f *mtuFinder) init(start, max protocol.ByteCount) {
+	f.min = start
+	for i := range f.lost {
+		if i == 0 {
+			f.lost[i] = max
+			continue
+		}
+		f.lost[i] = protocol.InvalidByteCount
+	}
+}
+
+func (f *mtuFinder) done() bool {
+	return f.max()-f.min <= maxMTUDiff+1
+}
+
+func (f *mtuFinder) max() protocol.ByteCount {
+	for i, v := range f.lost {
+		if v == protocol.InvalidByteCount {
+			return f.lost[i-1]
+		}
+	}
+	return f.lost[len(f.lost)-1]
+}
+
+func (f *mtuFinder) Start(now monotime.Time) {
+	f.lastProbeTime = now // makes sure the first probe packet is not sent immediately
+}
+
+func (f *mtuFinder) ShouldSendProbe(now monotime.Time) bool {
+	if f.lastProbeTime.IsZero() {
+		return false
+	}
+	if f.inFlight != protocol.InvalidByteCount || f.done() {
+		return false
+	}
+	return !now.Before(f.lastProbeTime.Add(mtuProbeDelay * f.rttStats.SmoothedRTT()))
+}
+
+func (f *mtuFinder) GetPing(now monotime.Time) (ackhandler.Frame, protocol.ByteCount) {
+	var size protocol.ByteCount
+	if f.lastProbeWasLost {
+		size = (f.min + f.lost[0]) / 2
+	} else {
+		size = (f.min + f.max()) / 2
+	}
+	f.lastProbeTime = now
+	f.inFlight = size
+	return ackhandler.Frame{
+		Frame:   &wire.PingFrame{},
+		Handler: &mtuFinderAckHandler{mtuFinder: f, generation: f.generation},
+	}, size
+}
+
+func (f *mtuFinder) CurrentSize() protocol.ByteCount {
+	return f.min
+}
+
+func (f *mtuFinder) Reset(now monotime.Time, start, max protocol.ByteCount) {
+	f.generation++
+	f.lastProbeTime = now
+	f.lastProbeWasLost = false
+	f.inFlight = protocol.InvalidByteCount
+	f.init(start, max)
+}
+
+type mtuFinderAckHandler struct {
+	*mtuFinder
+	generation uint8
+}
+
+var _ ackhandler.FrameHandler = &mtuFinderAckHandler{}
+
+func (h *mtuFinderAckHandler) OnAcked(wire.Frame) {
+	if h.generation != h.mtuFinder.generation {
+		// ACK for probe sent before reset
+		return
+	}
+	size := h.inFlight
+	if size == protocol.InvalidByteCount {
+		panic("OnAcked callback called although there's no MTU probe packet in flight")
+	}
+	h.inFlight = protocol.InvalidByteCount
+	h.min = size
+	h.lastProbeWasLost = false
+	// remove all values smaller than size from the lost array
+	var j int
+	for i, v := range h.lost {
+		if size < v {
+			j = i
+			break
+		}
+	}
+	if j > 0 {
+		for i := range len(h.lost) {
+			if i+j < len(h.lost) {
+				h.lost[i] = h.lost[i+j]
+			} else {
+				h.lost[i] = protocol.InvalidByteCount
+			}
+		}
+	}
+	if h.qlogger != nil {
+		h.qlogger.RecordEvent(qlog.MTUUpdated{
+			Value: int(size),
+			Done:  h.done(),
+		})
+	}
+}
+
+func (h *mtuFinderAckHandler) OnLost(wire.Frame) {
+	if h.generation != h.mtuFinder.generation {
+		// probe sent before reset received
+		return
+	}
+	size := h.inFlight
+	if size == protocol.InvalidByteCount {
+		panic("OnLost callback called although there's no MTU probe packet in flight")
+	}
+	h.lastProbeWasLost = true
+	h.inFlight = protocol.InvalidByteCount
+	for i, v := range h.lost {
+		if size < v {
+			copy(h.lost[i+1:], h.lost[i:])
+			h.lost[i] = size
+			break
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/mtu_discoverer_test.go b/electron/native/private-transport/third_party/quic-go/mtu_discoverer_test.go
new file mode 100644
index 000000000..6a02df92b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/mtu_discoverer_test.go
@@ -0,0 +1,242 @@
+package quic
+
+import (
+	"fmt"
+	"math/rand/v2"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMTUDiscovererTiming(t *testing.T) {
+	const rtt = 100 * time.Millisecond
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(rtt, 0)
+	d := newMTUDiscoverer(rttStats, 1000, 2000, nil)
+
+	now := monotime.Now()
+	require.False(t, d.ShouldSendProbe(now))
+	d.Start(now)
+	require.False(t, d.ShouldSendProbe(now))
+	require.False(t, d.ShouldSendProbe(now.Add(rtt*9/2)))
+	now = now.Add(5 * rtt)
+	require.True(t, d.ShouldSendProbe(now))
+
+	// only a single outstanding probe packet is permitted
+	ping, _ := d.GetPing(now)
+	require.False(t, d.ShouldSendProbe(now))
+	now = now.Add(5 * rtt)
+	require.False(t, d.ShouldSendProbe(now))
+	ping.Handler.OnLost(ping.Frame)
+	require.True(t, d.ShouldSendProbe(now))
+}
+
+func TestMTUDiscovererAckAndLoss(t *testing.T) {
+	const rtt = 200 * time.Millisecond
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(rtt, 0)
+	d := newMTUDiscoverer(rttStats, 1000, 2000, nil)
+	now := monotime.Now()
+	ping, size := d.GetPing(now)
+	require.Equal(t, protocol.ByteCount(1500), size)
+	// the MTU is reduced if the frame is lost
+	ping.Handler.OnLost(ping.Frame)
+	require.Equal(t, protocol.ByteCount(1000), d.CurrentSize()) // no change to the MTU yet
+
+	now = now.Add(5 * rtt)
+	require.True(t, d.ShouldSendProbe(now))
+	ping, size = d.GetPing(now)
+	require.Equal(t, protocol.ByteCount(1250), size)
+	ping.Handler.OnAcked(ping.Frame)
+	require.Equal(t, protocol.ByteCount(1250), d.CurrentSize()) // the MTU is increased
+
+	// Even though the 1500 byte MTU probe packet was lost, we try again with a higher MTU.
+	// This protects against regular (non-MTU-related) packet loss.
+	now = now.Add(5 * rtt)
+	require.True(t, d.ShouldSendProbe(now))
+	ping, size = d.GetPing(now)
+	require.Greater(t, size, protocol.ByteCount(1500))
+	ping.Handler.OnAcked(ping.Frame)
+	require.Equal(t, size, d.CurrentSize())
+
+	// We continue probing until the MTU is close to the maximum.
+	var steps int
+	oldSize := size
+	now = now.Add(5 * rtt)
+	for d.ShouldSendProbe(now) {
+		ping, size = d.GetPing(now)
+		require.Greater(t, size, oldSize)
+		oldSize = size
+		ping.Handler.OnAcked(ping.Frame)
+		steps++
+		require.Less(t, steps, 10)
+		now = now.Add(5 * rtt)
+	}
+	require.Less(t, 2000-maxMTUDiff, size)
+}
+
+func TestMTUDiscovererMTUDiscovery(t *testing.T) {
+	for i := range 5 {
+		t.Run(fmt.Sprintf("test %d", i), func(t *testing.T) {
+			testMTUDiscovererMTUDiscovery(t)
+		})
+	}
+}
+
+func testMTUDiscovererMTUDiscovery(t *testing.T) {
+	const rtt = 100 * time.Millisecond
+	const startMTU protocol.ByteCount = 1000
+
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(rtt, 0)
+
+	maxMTU := protocol.ByteCount(rand.IntN(int(3000-startMTU))) + startMTU + 1
+	var eventRecorder events.Recorder
+	d := newMTUDiscoverer(rttStats, startMTU, maxMTU, &eventRecorder)
+	now := monotime.Now()
+	d.Start(now)
+	realMTU := protocol.ByteCount(rand.IntN(int(maxMTU-startMTU))) + startMTU
+	t.Logf("MTU: %d, max: %d", realMTU, maxMTU)
+	now = now.Add(mtuProbeDelay * rtt)
+	var probes []protocol.ByteCount
+	for d.ShouldSendProbe(now) {
+		require.Less(t, len(probes), 25, fmt.Sprintf("too many iterations: %v", probes))
+		ping, size := d.GetPing(now)
+		probes = append(probes, size)
+		if size <= realMTU {
+			ping.Handler.OnAcked(ping.Frame)
+		} else {
+			ping.Handler.OnLost(ping.Frame)
+		}
+		now = now.Add(mtuProbeDelay * rtt)
+	}
+	currentMTU := d.CurrentSize()
+	diff := realMTU - currentMTU
+	require.GreaterOrEqual(t, diff, protocol.ByteCount(0))
+	if maxMTU > currentMTU+maxMTU {
+		events := eventRecorder.Events(qlog.MTUUpdated{})
+		require.NotEmpty(t, events)
+		require.Equal(t, qlog.MTUUpdated{Value: int(currentMTU), Done: true}, events[0])
+	}
+	t.Logf("MTU discovered: %d (diff: %d)", currentMTU, diff)
+	t.Logf("probes sent (%d): %v", len(probes), probes)
+	require.LessOrEqual(t, diff, maxMTUDiff)
+}
+
+func TestMTUDiscovererWithRandomLoss(t *testing.T) {
+	for i := range 5 {
+		t.Run(fmt.Sprintf("test %d", i), func(t *testing.T) {
+			testMTUDiscovererWithRandomLoss(t)
+		})
+	}
+}
+
+func testMTUDiscovererWithRandomLoss(t *testing.T) {
+	const rtt = 100 * time.Millisecond
+	const startMTU protocol.ByteCount = 1000
+	const maxRandomLoss = maxLostMTUProbes - 1
+
+	rttStats := utils.NewRTTStats()
+	rttStats.SetInitialRTT(rtt)
+	require.Equal(t, rtt, rttStats.SmoothedRTT())
+
+	maxMTU := protocol.ByteCount(rand.IntN(int(3000-startMTU))) + startMTU + 1
+	var eventRecorder events.Recorder
+	d := newMTUDiscoverer(rttStats, startMTU, maxMTU, &eventRecorder)
+	d.Start(monotime.Now())
+	now := monotime.Now()
+	realMTU := protocol.ByteCount(rand.IntN(int(maxMTU-startMTU))) + startMTU
+	t.Logf("MTU: %d, max: %d", realMTU, maxMTU)
+	now = now.Add(mtuProbeDelay * rtt)
+	var probes, randomLosses []protocol.ByteCount
+
+	for d.ShouldSendProbe(now) {
+		require.Less(t, len(probes), 32, fmt.Sprintf("too many iterations: %v", probes))
+		ping, size := d.GetPing(now)
+		probes = append(probes, size)
+		packetFits := size <= realMTU
+		var acked bool
+		if packetFits {
+			randomLoss := rand.IntN(maxLostMTUProbes) == 0 && len(randomLosses) < maxRandomLoss
+			if randomLoss {
+				randomLosses = append(randomLosses, size)
+			} else {
+				ping.Handler.OnAcked(ping.Frame)
+				acked = true
+			}
+		}
+		if !acked {
+			ping.Handler.OnLost(ping.Frame)
+		}
+		now = now.Add(mtuProbeDelay * rtt)
+	}
+
+	currentMTU := d.CurrentSize()
+	diff := realMTU - currentMTU
+	require.GreaterOrEqual(t, diff, protocol.ByteCount(0))
+	if maxMTU > currentMTU+maxMTU {
+		events := eventRecorder.Events(qlog.MTUUpdated{})
+		require.NotEmpty(t, events)
+		require.Equal(t, qlog.MTUUpdated{Value: int(currentMTU), Done: true}, events[0])
+	}
+	t.Logf("MTU discovered with random losses %v: %d (diff: %d)", randomLosses, currentMTU, diff)
+	t.Logf("probes sent (%d): %v", len(probes), probes)
+	require.LessOrEqual(t, diff, maxMTUDiff)
+}
+
+func TestMTUDiscovererReset(t *testing.T) {
+	t.Run("probe on old path acknowledged", func(t *testing.T) {
+		testMTUDiscovererReset(t, true)
+	})
+	t.Run("probe on old path lost", func(t *testing.T) {
+		testMTUDiscovererReset(t, false)
+	})
+}
+
+func testMTUDiscovererReset(t *testing.T, ackLastProbe bool) {
+	const startMTU protocol.ByteCount = 1000
+	const maxMTU = 1400
+	const rtt = 100 * time.Millisecond
+
+	rttStats := utils.NewRTTStats()
+	rttStats.SetInitialRTT(rtt)
+
+	now := monotime.Now()
+	d := newMTUDiscoverer(rttStats, startMTU, maxMTU, nil)
+	d.Start(now)
+
+	ping, _ := d.GetPing(now.Add(5 * rtt))
+	ping.Handler.OnAcked(ping.Frame)
+	require.Greater(t, d.CurrentSize(), startMTU)
+	now = now.Add(5 * rtt)
+
+	// send another probe packet, but neither acknowledge nor lose it before resetting
+	ping, _ = d.GetPing(now.Add(5 * rtt))
+	now = now.Add(2 * rtt) // advance the timer by an arbitrary amount
+
+	const newStartMTU protocol.ByteCount = 900
+	const newMaxMTU = 1500
+	d.Reset(now, newStartMTU, newMaxMTU)
+	require.Equal(t, d.CurrentSize(), newStartMTU)
+
+	// Now acknowledge / lose the probe packet.
+	// This should be ignored, since it's on the old path.
+	if ackLastProbe {
+		ping.Handler.OnAcked(ping.Frame)
+	} else {
+		ping.Handler.OnLost(ping.Frame)
+	}
+
+	// the MTU should not have changed
+	require.Equal(t, d.CurrentSize(), newStartMTU)
+	// the next probe should be sent after 5 RTTs
+	require.False(t, d.ShouldSendProbe(now.Add(5*rtt).Add(-time.Microsecond)))
+	require.True(t, d.ShouldSendProbe(now.Add(5*rtt)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/oss-fuzz.sh b/electron/native/private-transport/third_party/quic-go/oss-fuzz.sh
new file mode 100644
index 000000000..45df15695
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/oss-fuzz.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+set -euo pipefail
+
+echo "Build date (UTC): $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
+
+go version
+go env
+
+# fuzz qpack
+cd $GOPATH/src/github.com/quic-go/qpack
+git log -1 --format='qpack revision: %H (%cI) %s'
+compile_native_go_fuzzer_v2 github.com/quic-go/qpack FuzzDecode qpack_decode_fuzzer
+
+# fuzz quic-go
+cd $GOPATH/src/github.com/quic-go/quic-go/
+git log -1 --format='quic-go revision: %H (%cI) %s'
+
+build_native_go_fuzzer() {
+	local pkg=$1
+	local fuzz=$2
+	local name=$3
+	local corpus_dir="${WORK:-/tmp}/quic-go-seed-corpus/$name"
+	local corpus_zip="$OUT/${name}_seed_corpus.zip"
+
+	# FUZZ_CORPUS_DIR makes go-ossfuzz-seeds write each f.Add seed as a raw
+	# libFuzzer corpus file. OSS-Fuzz picks up <fuzzer>_seed_corpus.zip from
+	# $OUT and unpacks it next to the fuzzer binary.
+	rm -rf "$corpus_dir"
+	mkdir -p "$corpus_dir"
+	FUZZ_CORPUS_DIR="$corpus_dir" go test "$pkg" -run "^${fuzz}$" -count=1 -v
+
+	rm -f "$corpus_zip"
+	corpus_files=$(find "$corpus_dir" -type f | wc -l)
+	echo "$name: generated $corpus_files corpus files"
+	if [[ "$corpus_files" -gt 0 ]]; then
+		(cd "$corpus_dir" && zip -q -r "$corpus_zip" .)
+	fi
+
+	compile_native_go_fuzzer_v2 "$pkg" "$fuzz" "$name"
+}
+
+build_native_go_fuzzer github.com/quic-go/quic-go/internal/wire FuzzFrames frame_fuzzer_v2
+build_native_go_fuzzer github.com/quic-go/quic-go/internal/wire FuzzTransportParameters transportparameter_fuzzer_v2
+build_native_go_fuzzer github.com/quic-go/quic-go/http3 FuzzFrameParser http3_frame_fuzzer
+build_native_go_fuzzer github.com/quic-go/quic-go/internal/wire FuzzHeaderParser header_fuzzer_v2
+build_native_go_fuzzer github.com/quic-go/quic-go/internal/handshake FuzzHandshake handshake_fuzzer_v2
+build_native_go_fuzzer github.com/quic-go/quic-go FuzzFrameSorter frame_sorter_fuzzer
+build_native_go_fuzzer github.com/quic-go/quic-go/http3 FuzzHeaderParsing http3_header_parsing_fuzzer
+
+# for debugging
+ls -al $OUT
diff --git a/electron/native/private-transport/third_party/quic-go/packet_packer.go b/electron/native/private-transport/third_party/quic-go/packet_packer.go
new file mode 100644
index 000000000..175d3c86d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/packet_packer.go
@@ -0,0 +1,1009 @@
+package quic
+
+import (
+	crand "crypto/rand"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"math/rand/v2"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+var errNothingToPack = errors.New("nothing to pack")
+
+type packer interface {
+	PackCoalescedPacket(onlyAck bool, maxPacketSize protocol.ByteCount, now monotime.Time, v protocol.Version) (*coalescedPacket, error)
+	PackAckOnlyPacket(maxPacketSize protocol.ByteCount, now monotime.Time, v protocol.Version) (shortHeaderPacket, *packetBuffer, error)
+	AppendPacket(_ *packetBuffer, maxPacketSize protocol.ByteCount, now monotime.Time, v protocol.Version) (shortHeaderPacket, error)
+	PackPTOProbePacket(_ protocol.EncryptionLevel, _ protocol.ByteCount, addPingIfEmpty bool, now monotime.Time, v protocol.Version) (*coalescedPacket, error)
+	PackConnectionClose(*qerr.TransportError, protocol.ByteCount, protocol.Version) (*coalescedPacket, error)
+	PackApplicationClose(*qerr.ApplicationError, protocol.ByteCount, protocol.Version) (*coalescedPacket, error)
+	PackPathProbePacket(protocol.ConnectionID, []ackhandler.Frame, protocol.Version) (shortHeaderPacket, *packetBuffer, error)
+	PackMTUProbePacket(ping ackhandler.Frame, size protocol.ByteCount, v protocol.Version) (shortHeaderPacket, *packetBuffer, error)
+
+	SetToken([]byte)
+}
+
+type sealer interface {
+	handshake.LongHeaderSealer
+}
+
+type payload struct {
+	streamFrames []ackhandler.StreamFrame
+	frames       []ackhandler.Frame
+	ack          *wire.AckFrame
+	length       protocol.ByteCount
+}
+
+type longHeaderPacket struct {
+	header       *wire.ExtendedHeader
+	ack          *wire.AckFrame
+	frames       []ackhandler.Frame
+	streamFrames []ackhandler.StreamFrame // only used for 0-RTT packets
+
+	length protocol.ByteCount
+}
+
+type shortHeaderPacket struct {
+	PacketNumber         protocol.PacketNumber
+	Frames               []ackhandler.Frame
+	StreamFrames         []ackhandler.StreamFrame
+	Ack                  *wire.AckFrame
+	Length               protocol.ByteCount
+	IsPathMTUProbePacket bool
+	IsPathProbePacket    bool
+
+	// used for logging
+	DestConnID      protocol.ConnectionID
+	PacketNumberLen protocol.PacketNumberLen
+	KeyPhase        protocol.KeyPhaseBit
+}
+
+func (p *shortHeaderPacket) IsAckEliciting() bool { return ackhandler.HasAckElicitingFrames(p.Frames) }
+
+type coalescedPacket struct {
+	buffer         *packetBuffer
+	longHdrPackets []*longHeaderPacket
+	shortHdrPacket *shortHeaderPacket
+}
+
+// IsOnlyShortHeaderPacket says if this packet only contains a short header packet (and no long header packets).
+func (p *coalescedPacket) IsOnlyShortHeaderPacket() bool {
+	return len(p.longHdrPackets) == 0 && p.shortHdrPacket != nil
+}
+
+func (p *longHeaderPacket) EncryptionLevel() protocol.EncryptionLevel {
+	//nolint:exhaustive // Will never be called for Retry packets (and they don't have encrypted data).
+	switch p.header.Type {
+	case protocol.PacketTypeInitial:
+		return protocol.EncryptionInitial
+	case protocol.PacketTypeHandshake:
+		return protocol.EncryptionHandshake
+	case protocol.PacketType0RTT:
+		return protocol.Encryption0RTT
+	default:
+		panic("can't determine encryption level")
+	}
+}
+
+func (p *longHeaderPacket) IsAckEliciting() bool { return ackhandler.HasAckElicitingFrames(p.frames) }
+
+type packetNumberManager interface {
+	PeekPacketNumber(protocol.EncryptionLevel) (protocol.PacketNumber, protocol.PacketNumberLen)
+	PopPacketNumber(protocol.EncryptionLevel) protocol.PacketNumber
+}
+
+type sealingManager interface {
+	GetInitialSealer() (handshake.LongHeaderSealer, error)
+	GetHandshakeSealer() (handshake.LongHeaderSealer, error)
+	Get0RTTSealer() (handshake.LongHeaderSealer, error)
+	Get1RTTSealer() (handshake.ShortHeaderSealer, error)
+}
+
+type frameSource interface {
+	HasData() bool
+	Append([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount, monotime.Time, protocol.Version) ([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount)
+}
+
+type ackFrameSource interface {
+	GetAckFrame(_ protocol.EncryptionLevel, now monotime.Time, onlyIfQueued bool) *wire.AckFrame
+}
+
+type packetPacker struct {
+	srcConnID     protocol.ConnectionID
+	getDestConnID func() protocol.ConnectionID
+
+	perspective protocol.Perspective
+	cryptoSetup sealingManager
+
+	initialStream   *initialCryptoStream
+	handshakeStream *cryptoStream
+
+	token []byte
+
+	pnManager           packetNumberManager
+	framer              frameSource
+	acks                ackFrameSource
+	datagramQueue       *datagramQueue
+	retransmissionQueue *retransmissionQueue
+	rand                rand.Rand
+
+	numNonAckElicitingAcks int
+}
+
+var _ packer = &packetPacker{}
+
+func newPacketPacker(
+	srcConnID protocol.ConnectionID,
+	getDestConnID func() protocol.ConnectionID,
+	initialStream *initialCryptoStream,
+	handshakeStream *cryptoStream,
+	packetNumberManager packetNumberManager,
+	retransmissionQueue *retransmissionQueue,
+	cryptoSetup sealingManager,
+	framer frameSource,
+	acks ackFrameSource,
+	datagramQueue *datagramQueue,
+	perspective protocol.Perspective,
+) *packetPacker {
+	var b [16]byte
+	_, _ = crand.Read(b[:])
+
+	return &packetPacker{
+		cryptoSetup:         cryptoSetup,
+		getDestConnID:       getDestConnID,
+		srcConnID:           srcConnID,
+		initialStream:       initialStream,
+		handshakeStream:     handshakeStream,
+		retransmissionQueue: retransmissionQueue,
+		datagramQueue:       datagramQueue,
+		perspective:         perspective,
+		framer:              framer,
+		acks:                acks,
+		rand:                *rand.New(rand.NewPCG(binary.BigEndian.Uint64(b[:8]), binary.BigEndian.Uint64(b[8:]))),
+		pnManager:           packetNumberManager,
+	}
+}
+
+// PackConnectionClose packs a packet that closes the connection with a transport error.
+func (p *packetPacker) PackConnectionClose(e *qerr.TransportError, maxPacketSize protocol.ByteCount, v protocol.Version) (*coalescedPacket, error) {
+	var reason string
+	// don't send details of crypto errors
+	if !e.ErrorCode.IsCryptoError() {
+		reason = e.ErrorMessage
+	}
+	return p.packConnectionClose(false, uint64(e.ErrorCode), e.FrameType, reason, maxPacketSize, v)
+}
+
+// PackApplicationClose packs a packet that closes the connection with an application error.
+func (p *packetPacker) PackApplicationClose(e *qerr.ApplicationError, maxPacketSize protocol.ByteCount, v protocol.Version) (*coalescedPacket, error) {
+	return p.packConnectionClose(true, uint64(e.ErrorCode), 0, e.ErrorMessage, maxPacketSize, v)
+}
+
+func (p *packetPacker) packConnectionClose(
+	isApplicationError bool,
+	errorCode uint64,
+	frameType uint64,
+	reason string,
+	maxPacketSize protocol.ByteCount,
+	v protocol.Version,
+) (*coalescedPacket, error) {
+	var sealers [4]sealer
+	var hdrs [3]*wire.ExtendedHeader
+	var payloads [4]payload
+	var size protocol.ByteCount
+	var connID protocol.ConnectionID
+	var oneRTTPacketNumber protocol.PacketNumber
+	var oneRTTPacketNumberLen protocol.PacketNumberLen
+	var keyPhase protocol.KeyPhaseBit // only set for 1-RTT
+	var numLongHdrPackets uint8
+	encLevels := [4]protocol.EncryptionLevel{protocol.EncryptionInitial, protocol.EncryptionHandshake, protocol.Encryption0RTT, protocol.Encryption1RTT}
+	for i, encLevel := range encLevels {
+		if p.perspective == protocol.PerspectiveServer && encLevel == protocol.Encryption0RTT {
+			continue
+		}
+		ccf := &wire.ConnectionCloseFrame{
+			IsApplicationError: isApplicationError,
+			ErrorCode:          errorCode,
+			FrameType:          frameType,
+			ReasonPhrase:       reason,
+		}
+		// don't send application errors in Initial or Handshake packets
+		if isApplicationError && (encLevel == protocol.EncryptionInitial || encLevel == protocol.EncryptionHandshake) {
+			ccf.IsApplicationError = false
+			ccf.ErrorCode = uint64(qerr.ApplicationErrorErrorCode)
+			ccf.ReasonPhrase = ""
+		}
+		pl := payload{
+			frames: []ackhandler.Frame{{Frame: ccf}},
+			length: ccf.Length(v),
+		}
+
+		var sealer sealer
+		var err error
+		switch encLevel {
+		case protocol.EncryptionInitial:
+			sealer, err = p.cryptoSetup.GetInitialSealer()
+		case protocol.EncryptionHandshake:
+			sealer, err = p.cryptoSetup.GetHandshakeSealer()
+		case protocol.Encryption0RTT:
+			sealer, err = p.cryptoSetup.Get0RTTSealer()
+		case protocol.Encryption1RTT:
+			var s handshake.ShortHeaderSealer
+			s, err = p.cryptoSetup.Get1RTTSealer()
+			if err == nil {
+				keyPhase = s.KeyPhase()
+			}
+			sealer = s
+		}
+		if err == handshake.ErrKeysNotYetAvailable || err == handshake.ErrKeysDropped {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		sealers[i] = sealer
+		var hdr *wire.ExtendedHeader
+		if encLevel == protocol.Encryption1RTT {
+			connID = p.getDestConnID()
+			oneRTTPacketNumber, oneRTTPacketNumberLen = p.pnManager.PeekPacketNumber(protocol.Encryption1RTT)
+			size += p.shortHeaderPacketLength(connID, oneRTTPacketNumberLen, pl)
+		} else {
+			hdr = p.getLongHeader(encLevel, v)
+			hdrs[i] = hdr
+			size += p.longHeaderPacketLength(hdr, pl, v) + protocol.ByteCount(sealer.Overhead())
+			numLongHdrPackets++
+		}
+		payloads[i] = pl
+	}
+	buffer := getPacketBuffer()
+	packet := &coalescedPacket{
+		buffer:         buffer,
+		longHdrPackets: make([]*longHeaderPacket, 0, numLongHdrPackets),
+	}
+	for i, encLevel := range encLevels {
+		if sealers[i] == nil {
+			continue
+		}
+		if encLevel == protocol.Encryption1RTT {
+			shp, err := p.appendShortHeaderPacket(buffer, connID, oneRTTPacketNumber, oneRTTPacketNumberLen, keyPhase, payloads[i], 0, maxPacketSize, sealers[i], false, v)
+			if err != nil {
+				return nil, err
+			}
+			packet.shortHdrPacket = &shp
+		} else {
+			var paddingLen protocol.ByteCount
+			if encLevel == protocol.EncryptionInitial {
+				paddingLen = p.initialPaddingLen(payloads[i].frames, size, maxPacketSize)
+			}
+			longHdrPacket, err := p.appendLongHeaderPacket(buffer, hdrs[i], payloads[i], paddingLen, encLevel, sealers[i], v)
+			if err != nil {
+				return nil, err
+			}
+			packet.longHdrPackets = append(packet.longHdrPackets, longHdrPacket)
+		}
+	}
+	return packet, nil
+}
+
+// longHeaderPacketLength calculates the length of a serialized long header packet.
+// It takes into account that packets that have a tiny payload need to be padded,
+// such that len(payload) + packet number len >= 4 + AEAD overhead
+func (p *packetPacker) longHeaderPacketLength(hdr *wire.ExtendedHeader, pl payload, v protocol.Version) protocol.ByteCount {
+	var paddingLen protocol.ByteCount
+	pnLen := protocol.ByteCount(hdr.PacketNumberLen)
+	if pl.length < 4-pnLen {
+		paddingLen = 4 - pnLen - pl.length
+	}
+	return hdr.GetLength(v) + pl.length + paddingLen
+}
+
+// shortHeaderPacketLength calculates the length of a serialized short header packet.
+// It takes into account that packets that have a tiny payload need to be padded,
+// such that len(payload) + packet number len >= 4 + AEAD overhead
+func (p *packetPacker) shortHeaderPacketLength(connID protocol.ConnectionID, pnLen protocol.PacketNumberLen, pl payload) protocol.ByteCount {
+	var paddingLen protocol.ByteCount
+	if pl.length < 4-protocol.ByteCount(pnLen) {
+		paddingLen = 4 - protocol.ByteCount(pnLen) - pl.length
+	}
+	return wire.ShortHeaderLen(connID, pnLen) + pl.length + paddingLen
+}
+
+// size is the expected size of the packet, if no padding was applied.
+func (p *packetPacker) initialPaddingLen(frames []ackhandler.Frame, currentSize, maxPacketSize protocol.ByteCount) protocol.ByteCount {
+	// For the server, only ack-eliciting Initial packets need to be padded.
+	if p.perspective == protocol.PerspectiveServer && !ackhandler.HasAckElicitingFrames(frames) {
+		return 0
+	}
+	if currentSize >= maxPacketSize {
+		return 0
+	}
+	return maxPacketSize - currentSize
+}
+
+// PackCoalescedPacket packs a new packet.
+// It packs an Initial / Handshake if there is data to send in these packet number spaces.
+// It should only be called before the handshake is confirmed.
+func (p *packetPacker) PackCoalescedPacket(onlyAck bool, maxSize protocol.ByteCount, now monotime.Time, v protocol.Version) (*coalescedPacket, error) {
+	var (
+		initialHdr, handshakeHdr, zeroRTTHdr                            *wire.ExtendedHeader
+		initialPayload, handshakePayload, zeroRTTPayload, oneRTTPayload payload
+		oneRTTPacketNumber                                              protocol.PacketNumber
+		oneRTTPacketNumberLen                                           protocol.PacketNumberLen
+	)
+	// Try packing an Initial packet.
+	initialSealer, err := p.cryptoSetup.GetInitialSealer()
+	if err != nil && err != handshake.ErrKeysDropped {
+		return nil, err
+	}
+	var size protocol.ByteCount
+	if initialSealer != nil {
+		initialHdr, initialPayload = p.maybeGetCryptoPacket(
+			maxSize-protocol.ByteCount(initialSealer.Overhead()),
+			protocol.EncryptionInitial,
+			now,
+			false,
+			onlyAck,
+			v,
+		)
+		if initialPayload.length > 0 {
+			size += p.longHeaderPacketLength(initialHdr, initialPayload, v) + protocol.ByteCount(initialSealer.Overhead())
+		}
+	}
+
+	// Add a Handshake packet.
+	var handshakeSealer sealer
+	if (onlyAck && size == 0) || (!onlyAck && size < maxSize-protocol.MinCoalescedPacketSize) {
+		var err error
+		handshakeSealer, err = p.cryptoSetup.GetHandshakeSealer()
+		if err != nil && err != handshake.ErrKeysDropped && err != handshake.ErrKeysNotYetAvailable {
+			return nil, err
+		}
+		if handshakeSealer != nil {
+			handshakeHdr, handshakePayload = p.maybeGetCryptoPacket(
+				maxSize-size-protocol.ByteCount(handshakeSealer.Overhead()),
+				protocol.EncryptionHandshake,
+				now,
+				false,
+				onlyAck,
+				v,
+			)
+			if handshakePayload.length > 0 {
+				s := p.longHeaderPacketLength(handshakeHdr, handshakePayload, v) + protocol.ByteCount(handshakeSealer.Overhead())
+				size += s
+			}
+		}
+	}
+
+	// Add a 0-RTT / 1-RTT packet.
+	var zeroRTTSealer sealer
+	var oneRTTSealer handshake.ShortHeaderSealer
+	var connID protocol.ConnectionID
+	var kp protocol.KeyPhaseBit
+	if (onlyAck && size == 0) || (!onlyAck && size < maxSize-protocol.MinCoalescedPacketSize) {
+		var err error
+		oneRTTSealer, err = p.cryptoSetup.Get1RTTSealer()
+		if err != nil && err != handshake.ErrKeysDropped && err != handshake.ErrKeysNotYetAvailable {
+			return nil, err
+		}
+		if err == nil { // 1-RTT
+			kp = oneRTTSealer.KeyPhase()
+			connID = p.getDestConnID()
+			oneRTTPacketNumber, oneRTTPacketNumberLen = p.pnManager.PeekPacketNumber(protocol.Encryption1RTT)
+			hdrLen := wire.ShortHeaderLen(connID, oneRTTPacketNumberLen)
+			oneRTTPayload = p.maybeGetShortHeaderPacket(oneRTTSealer, hdrLen, maxSize-size, onlyAck, now, v)
+			if oneRTTPayload.length > 0 {
+				size += p.shortHeaderPacketLength(connID, oneRTTPacketNumberLen, oneRTTPayload) + protocol.ByteCount(oneRTTSealer.Overhead())
+			}
+		} else if p.perspective == protocol.PerspectiveClient && !onlyAck { // 0-RTT packets can't contain ACK frames
+			var err error
+			zeroRTTSealer, err = p.cryptoSetup.Get0RTTSealer()
+			if err != nil && err != handshake.ErrKeysDropped && err != handshake.ErrKeysNotYetAvailable {
+				return nil, err
+			}
+			if zeroRTTSealer != nil {
+				zeroRTTHdr, zeroRTTPayload = p.maybeGetAppDataPacketFor0RTT(zeroRTTSealer, maxSize-size, now, v)
+				if zeroRTTPayload.length > 0 {
+					size += p.longHeaderPacketLength(zeroRTTHdr, zeroRTTPayload, v) + protocol.ByteCount(zeroRTTSealer.Overhead())
+				}
+			}
+		}
+	}
+
+	if initialPayload.length == 0 && handshakePayload.length == 0 && zeroRTTPayload.length == 0 && oneRTTPayload.length == 0 {
+		return nil, nil
+	}
+
+	buffer := getPacketBuffer()
+	packet := &coalescedPacket{
+		buffer:         buffer,
+		longHdrPackets: make([]*longHeaderPacket, 0, 3),
+	}
+	if initialPayload.length > 0 {
+		padding := p.initialPaddingLen(initialPayload.frames, size, maxSize)
+		cont, err := p.appendLongHeaderPacket(buffer, initialHdr, initialPayload, padding, protocol.EncryptionInitial, initialSealer, v)
+		if err != nil {
+			return nil, err
+		}
+		packet.longHdrPackets = append(packet.longHdrPackets, cont)
+	}
+	if handshakePayload.length > 0 {
+		cont, err := p.appendLongHeaderPacket(buffer, handshakeHdr, handshakePayload, 0, protocol.EncryptionHandshake, handshakeSealer, v)
+		if err != nil {
+			return nil, err
+		}
+		packet.longHdrPackets = append(packet.longHdrPackets, cont)
+	}
+	if zeroRTTPayload.length > 0 {
+		longHdrPacket, err := p.appendLongHeaderPacket(buffer, zeroRTTHdr, zeroRTTPayload, 0, protocol.Encryption0RTT, zeroRTTSealer, v)
+		if err != nil {
+			return nil, err
+		}
+		packet.longHdrPackets = append(packet.longHdrPackets, longHdrPacket)
+	} else if oneRTTPayload.length > 0 {
+		shp, err := p.appendShortHeaderPacket(buffer, connID, oneRTTPacketNumber, oneRTTPacketNumberLen, kp, oneRTTPayload, 0, maxSize, oneRTTSealer, false, v)
+		if err != nil {
+			return nil, err
+		}
+		packet.shortHdrPacket = &shp
+	}
+	return packet, nil
+}
+
+// PackAckOnlyPacket packs a packet containing only an ACK in the application data packet number space.
+// It should be called after the handshake is confirmed.
+func (p *packetPacker) PackAckOnlyPacket(maxSize protocol.ByteCount, now monotime.Time, v protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+	buf := getPacketBuffer()
+	packet, err := p.appendPacket(buf, true, maxSize, now, v)
+	return packet, buf, err
+}
+
+// AppendPacket packs a packet in the application data packet number space.
+// It should be called after the handshake is confirmed.
+func (p *packetPacker) AppendPacket(buf *packetBuffer, maxSize protocol.ByteCount, now monotime.Time, v protocol.Version) (shortHeaderPacket, error) {
+	return p.appendPacket(buf, false, maxSize, now, v)
+}
+
+func (p *packetPacker) appendPacket(
+	buf *packetBuffer,
+	onlyAck bool,
+	maxPacketSize protocol.ByteCount,
+	now monotime.Time,
+	v protocol.Version,
+) (shortHeaderPacket, error) {
+	sealer, err := p.cryptoSetup.Get1RTTSealer()
+	if err != nil {
+		return shortHeaderPacket{}, err
+	}
+	pn, pnLen := p.pnManager.PeekPacketNumber(protocol.Encryption1RTT)
+	connID := p.getDestConnID()
+	hdrLen := wire.ShortHeaderLen(connID, pnLen)
+	pl := p.maybeGetShortHeaderPacket(sealer, hdrLen, maxPacketSize, onlyAck, now, v)
+	if pl.length == 0 {
+		return shortHeaderPacket{}, errNothingToPack
+	}
+	kp := sealer.KeyPhase()
+
+	return p.appendShortHeaderPacket(buf, connID, pn, pnLen, kp, pl, 0, maxPacketSize, sealer, false, v)
+}
+
+func (p *packetPacker) maybeGetCryptoPacket(
+	maxPacketSize protocol.ByteCount,
+	encLevel protocol.EncryptionLevel,
+	now monotime.Time,
+	addPingIfEmpty bool,
+	onlyAck bool,
+	v protocol.Version,
+) (*wire.ExtendedHeader, payload) {
+	if onlyAck {
+		if ack := p.acks.GetAckFrame(encLevel, now, true); ack != nil {
+			hdr := p.getLongHeader(encLevel, v)
+			maxPacketSize -= hdr.GetLength(v)
+			ack.Truncate(maxPacketSize, v)
+			return hdr, payload{ack: ack, length: ack.Length(v)}
+		}
+		return nil, payload{length: 0}
+	}
+
+	var hasCryptoData func() bool
+	var popCryptoFrame func(maxLen protocol.ByteCount) *wire.CryptoFrame
+	//nolint:exhaustive // Initial and Handshake are the only two encryption levels here.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		hasCryptoData = p.initialStream.HasData
+		popCryptoFrame = p.initialStream.PopCryptoFrame
+	case protocol.EncryptionHandshake:
+		hasCryptoData = p.handshakeStream.HasData
+		popCryptoFrame = p.handshakeStream.PopCryptoFrame
+	}
+	handler := p.retransmissionQueue.AckHandler(encLevel)
+	hasRetransmission := p.retransmissionQueue.HasData(encLevel)
+
+	ack := p.acks.GetAckFrame(encLevel, now, !hasRetransmission && !hasCryptoData())
+	var pl payload
+	if !hasCryptoData() && !hasRetransmission && ack == nil {
+		if !addPingIfEmpty {
+			// nothing to send
+			return nil, payload{}
+		}
+		ping := &wire.PingFrame{}
+		pl.frames = append(pl.frames, ackhandler.Frame{Frame: ping, Handler: emptyHandler{}})
+		pl.length += ping.Length(v)
+	}
+
+	hdr := p.getLongHeader(encLevel, v)
+	maxPacketSize -= hdr.GetLength(v)
+
+	if ack != nil {
+		ack.Truncate(maxPacketSize, v)
+		pl.ack = ack
+		pl.length = ack.Length(v)
+		maxPacketSize -= pl.length
+	}
+	if hasRetransmission {
+		for {
+			frame := p.retransmissionQueue.GetFrame(encLevel, maxPacketSize, v)
+			if frame == nil {
+				break
+			}
+			pl.frames = append(pl.frames, ackhandler.Frame{
+				Frame:   frame,
+				Handler: p.retransmissionQueue.AckHandler(encLevel),
+			})
+			frameLen := frame.Length(v)
+			pl.length += frameLen
+			maxPacketSize -= frameLen
+		}
+		return hdr, pl
+	} else {
+		for hasCryptoData() {
+			cf := popCryptoFrame(maxPacketSize)
+			if cf == nil {
+				break
+			}
+			pl.frames = append(pl.frames, ackhandler.Frame{Frame: cf, Handler: handler})
+			pl.length += cf.Length(v)
+			maxPacketSize -= cf.Length(v)
+		}
+	}
+	return hdr, pl
+}
+
+func (p *packetPacker) maybeGetAppDataPacketFor0RTT(sealer sealer, maxSize protocol.ByteCount, now monotime.Time, v protocol.Version) (*wire.ExtendedHeader, payload) {
+	if p.perspective != protocol.PerspectiveClient {
+		return nil, payload{}
+	}
+
+	hdr := p.getLongHeader(protocol.Encryption0RTT, v)
+	maxPayloadSize := maxSize - hdr.GetLength(v) - protocol.ByteCount(sealer.Overhead())
+	return hdr, p.maybeGetAppDataPacket(maxPayloadSize, false, false, now, v)
+}
+
+func (p *packetPacker) maybeGetShortHeaderPacket(
+	sealer handshake.ShortHeaderSealer,
+	hdrLen, maxPacketSize protocol.ByteCount,
+	onlyAck bool,
+	now monotime.Time,
+	v protocol.Version,
+) payload {
+	maxPayloadSize := maxPacketSize - hdrLen - protocol.ByteCount(sealer.Overhead())
+	return p.maybeGetAppDataPacket(maxPayloadSize, onlyAck, true, now, v)
+}
+
+func (p *packetPacker) maybeGetAppDataPacket(
+	maxPayloadSize protocol.ByteCount,
+	onlyAck, ackAllowed bool,
+	now monotime.Time,
+	v protocol.Version,
+) payload {
+	pl := p.composeNextPacket(maxPayloadSize, onlyAck, ackAllowed, now, v)
+
+	// check if we have anything to send
+	if len(pl.frames) == 0 && len(pl.streamFrames) == 0 {
+		if pl.ack == nil {
+			return payload{}
+		}
+		// the packet only contains an ACK
+		if p.numNonAckElicitingAcks >= protocol.MaxNonAckElicitingAcks {
+			ping := &wire.PingFrame{}
+			pl.frames = append(pl.frames, ackhandler.Frame{Frame: ping})
+			pl.length += ping.Length(v)
+			p.numNonAckElicitingAcks = 0
+		} else {
+			p.numNonAckElicitingAcks++
+		}
+	} else {
+		p.numNonAckElicitingAcks = 0
+	}
+	return pl
+}
+
+func (p *packetPacker) composeNextPacket(
+	maxPayloadSize protocol.ByteCount,
+	onlyAck, ackAllowed bool,
+	now monotime.Time,
+	v protocol.Version,
+) payload {
+	if onlyAck {
+		if ack := p.acks.GetAckFrame(protocol.Encryption1RTT, now, true); ack != nil {
+			ack.Truncate(maxPayloadSize, v)
+			return payload{ack: ack, length: ack.Length(v)}
+		}
+		return payload{}
+	}
+
+	hasData := p.framer.HasData()
+	hasRetransmission := p.retransmissionQueue.HasData(protocol.Encryption1RTT)
+
+	var pl payload
+	if ackAllowed {
+		if ack := p.acks.GetAckFrame(protocol.Encryption1RTT, now, !hasRetransmission && !hasData); ack != nil {
+			ack.Truncate(maxPayloadSize, v)
+			pl.ack = ack
+			pl.length += ack.Length(v)
+		}
+	}
+
+	if p.datagramQueue != nil {
+		if f := p.datagramQueue.Peek(); f != nil {
+			size := f.Length(v)
+			if size <= maxPayloadSize-pl.length { // DATAGRAM frame fits
+				pl.frames = append(pl.frames, ackhandler.Frame{Frame: f})
+				pl.length += size
+				p.datagramQueue.Pop()
+			} else if pl.ack == nil {
+				// The DATAGRAM frame doesn't fit, and the packet doesn't contain an ACK.
+				// Discard this frame. There's no point in retrying this in the next packet,
+				// as it's unlikely that the available packet size will increase.
+				p.datagramQueue.Pop()
+			}
+			// If the DATAGRAM frame was too large and the packet contained an ACK, we'll try to send it out later.
+		}
+	}
+
+	if pl.ack != nil && !hasData && !hasRetransmission {
+		return pl
+	}
+
+	if hasRetransmission {
+		for {
+			remainingLen := maxPayloadSize - pl.length
+			if remainingLen < protocol.MinStreamFrameSize {
+				break
+			}
+			f := p.retransmissionQueue.GetFrame(protocol.Encryption1RTT, remainingLen, v)
+			if f == nil {
+				break
+			}
+			pl.frames = append(pl.frames, ackhandler.Frame{Frame: f, Handler: p.retransmissionQueue.AckHandler(protocol.Encryption1RTT)})
+			pl.length += f.Length(v)
+		}
+	}
+
+	if hasData {
+		var lengthAdded protocol.ByteCount
+		startLen := len(pl.frames)
+		pl.frames, pl.streamFrames, lengthAdded = p.framer.Append(pl.frames, pl.streamFrames, maxPayloadSize-pl.length, now, v)
+		pl.length += lengthAdded
+		// add handlers for the control frames that were added
+		for i := startLen; i < len(pl.frames); i++ {
+			if pl.frames[i].Handler != nil {
+				continue
+			}
+			switch pl.frames[i].Frame.(type) {
+			case *wire.PathChallengeFrame, *wire.PathResponseFrame:
+				// Path probing is currently not supported, therefore we don't need to set the OnAcked callback yet.
+				// PATH_CHALLENGE and PATH_RESPONSE are never retransmitted.
+			default:
+				// we might be packing a 0-RTT packet, but we need to use the 1-RTT ack handler anyway
+				pl.frames[i].Handler = p.retransmissionQueue.AckHandler(protocol.Encryption1RTT)
+			}
+		}
+	}
+	return pl
+}
+
+func (p *packetPacker) PackPTOProbePacket(
+	encLevel protocol.EncryptionLevel,
+	maxPacketSize protocol.ByteCount,
+	addPingIfEmpty bool,
+	now monotime.Time,
+	v protocol.Version,
+) (*coalescedPacket, error) {
+	if encLevel == protocol.Encryption1RTT {
+		return p.packPTOProbePacket1RTT(maxPacketSize, addPingIfEmpty, now, v)
+	}
+
+	var sealer handshake.LongHeaderSealer
+	//nolint:exhaustive // Probe packets are never sent for 0-RTT.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		var err error
+		sealer, err = p.cryptoSetup.GetInitialSealer()
+		if err != nil {
+			return nil, err
+		}
+	case protocol.EncryptionHandshake:
+		var err error
+		sealer, err = p.cryptoSetup.GetHandshakeSealer()
+		if err != nil {
+			return nil, err
+		}
+	default:
+		panic("unknown encryption level")
+	}
+	hdr, pl := p.maybeGetCryptoPacket(
+		maxPacketSize-protocol.ByteCount(sealer.Overhead()),
+		encLevel,
+		now,
+		addPingIfEmpty,
+		false,
+		v,
+	)
+	if pl.length == 0 {
+		return nil, nil
+	}
+	buffer := getPacketBuffer()
+	packet := &coalescedPacket{buffer: buffer}
+	size := p.longHeaderPacketLength(hdr, pl, v) + protocol.ByteCount(sealer.Overhead())
+	var padding protocol.ByteCount
+	if encLevel == protocol.EncryptionInitial {
+		padding = p.initialPaddingLen(pl.frames, size, maxPacketSize)
+	}
+
+	longHdrPacket, err := p.appendLongHeaderPacket(buffer, hdr, pl, padding, encLevel, sealer, v)
+	if err != nil {
+		return nil, err
+	}
+	packet.longHdrPackets = []*longHeaderPacket{longHdrPacket}
+	return packet, nil
+}
+
+func (p *packetPacker) packPTOProbePacket1RTT(maxPacketSize protocol.ByteCount, addPingIfEmpty bool, now monotime.Time, v protocol.Version) (*coalescedPacket, error) {
+	s, err := p.cryptoSetup.Get1RTTSealer()
+	if err != nil {
+		return nil, err
+	}
+	kp := s.KeyPhase()
+	connID := p.getDestConnID()
+	pn, pnLen := p.pnManager.PeekPacketNumber(protocol.Encryption1RTT)
+	hdrLen := wire.ShortHeaderLen(connID, pnLen)
+	pl := p.maybeGetAppDataPacket(maxPacketSize-protocol.ByteCount(s.Overhead())-hdrLen, false, true, now, v)
+	if pl.length == 0 {
+		if !addPingIfEmpty {
+			return nil, nil
+		}
+		ping := &wire.PingFrame{}
+		pl.frames = append(pl.frames, ackhandler.Frame{Frame: ping, Handler: emptyHandler{}})
+		pl.length += ping.Length(v)
+	}
+	buffer := getPacketBuffer()
+	packet := &coalescedPacket{buffer: buffer}
+	shp, err := p.appendShortHeaderPacket(buffer, connID, pn, pnLen, kp, pl, 0, maxPacketSize, s, false, v)
+	if err != nil {
+		return nil, err
+	}
+	packet.shortHdrPacket = &shp
+	return packet, nil
+}
+
+func (p *packetPacker) PackMTUProbePacket(ping ackhandler.Frame, size protocol.ByteCount, v protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+	pl := payload{
+		frames: []ackhandler.Frame{ping},
+		length: ping.Frame.Length(v),
+	}
+	buffer := getPacketBuffer()
+	s, err := p.cryptoSetup.Get1RTTSealer()
+	if err != nil {
+		return shortHeaderPacket{}, nil, err
+	}
+	connID := p.getDestConnID()
+	pn, pnLen := p.pnManager.PeekPacketNumber(protocol.Encryption1RTT)
+	padding := size - p.shortHeaderPacketLength(connID, pnLen, pl) - protocol.ByteCount(s.Overhead())
+	kp := s.KeyPhase()
+	packet, err := p.appendShortHeaderPacket(buffer, connID, pn, pnLen, kp, pl, padding, size, s, true, v)
+	return packet, buffer, err
+}
+
+func (p *packetPacker) PackPathProbePacket(connID protocol.ConnectionID, frames []ackhandler.Frame, v protocol.Version) (shortHeaderPacket, *packetBuffer, error) {
+	pn, pnLen := p.pnManager.PeekPacketNumber(protocol.Encryption1RTT)
+	buf := getPacketBuffer()
+	s, err := p.cryptoSetup.Get1RTTSealer()
+	if err != nil {
+		return shortHeaderPacket{}, nil, err
+	}
+	var l protocol.ByteCount
+	for _, f := range frames {
+		l += f.Frame.Length(v)
+	}
+	payload := payload{
+		frames: frames,
+		length: l,
+	}
+	padding := protocol.MinInitialPacketSize - p.shortHeaderPacketLength(connID, pnLen, payload) - protocol.ByteCount(s.Overhead())
+	packet, err := p.appendShortHeaderPacket(buf, connID, pn, pnLen, s.KeyPhase(), payload, padding, protocol.MinInitialPacketSize, s, false, v)
+	if err != nil {
+		return shortHeaderPacket{}, nil, err
+	}
+	packet.IsPathProbePacket = true
+	return packet, buf, err
+}
+
+func (p *packetPacker) getLongHeader(encLevel protocol.EncryptionLevel, v protocol.Version) *wire.ExtendedHeader {
+	pn, pnLen := p.pnManager.PeekPacketNumber(encLevel)
+	hdr := &wire.ExtendedHeader{
+		PacketNumber:    pn,
+		PacketNumberLen: pnLen,
+	}
+	hdr.Version = v
+	hdr.SrcConnectionID = p.srcConnID
+	hdr.DestConnectionID = p.getDestConnID()
+
+	//nolint:exhaustive // 1-RTT packets are not long header packets.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		hdr.Type = protocol.PacketTypeInitial
+		hdr.Token = p.token
+	case protocol.EncryptionHandshake:
+		hdr.Type = protocol.PacketTypeHandshake
+	case protocol.Encryption0RTT:
+		hdr.Type = protocol.PacketType0RTT
+	}
+	return hdr
+}
+
+func (p *packetPacker) appendLongHeaderPacket(buffer *packetBuffer, header *wire.ExtendedHeader, pl payload, padding protocol.ByteCount, encLevel protocol.EncryptionLevel, sealer sealer, v protocol.Version) (*longHeaderPacket, error) {
+	var paddingLen protocol.ByteCount
+	pnLen := protocol.ByteCount(header.PacketNumberLen)
+	if pl.length < 4-pnLen {
+		paddingLen = 4 - pnLen - pl.length
+	}
+	paddingLen += padding
+	header.Length = pnLen + protocol.ByteCount(sealer.Overhead()) + pl.length + paddingLen
+
+	startLen := len(buffer.Data)
+	raw := buffer.Data[startLen:]
+	raw, err := header.Append(raw, v)
+	if err != nil {
+		return nil, err
+	}
+	payloadOffset := protocol.ByteCount(len(raw))
+
+	raw, err = p.appendPacketPayload(raw, pl, paddingLen, v)
+	if err != nil {
+		return nil, err
+	}
+	raw = p.encryptPacket(raw, sealer, header.PacketNumber, payloadOffset, pnLen)
+	buffer.Data = buffer.Data[:len(buffer.Data)+len(raw)]
+
+	if pn := p.pnManager.PopPacketNumber(encLevel); pn != header.PacketNumber {
+		return nil, fmt.Errorf("packetPacker BUG: Peeked and Popped packet numbers do not match: expected %d, got %d", pn, header.PacketNumber)
+	}
+	return &longHeaderPacket{
+		header:       header,
+		ack:          pl.ack,
+		frames:       pl.frames,
+		streamFrames: pl.streamFrames,
+		length:       protocol.ByteCount(len(raw)),
+	}, nil
+}
+
+func (p *packetPacker) appendShortHeaderPacket(
+	buffer *packetBuffer,
+	connID protocol.ConnectionID,
+	pn protocol.PacketNumber,
+	pnLen protocol.PacketNumberLen,
+	kp protocol.KeyPhaseBit,
+	pl payload,
+	padding, maxPacketSize protocol.ByteCount,
+	sealer sealer,
+	isMTUProbePacket bool,
+	v protocol.Version,
+) (shortHeaderPacket, error) {
+	var paddingLen protocol.ByteCount
+	if pl.length < 4-protocol.ByteCount(pnLen) {
+		paddingLen = 4 - protocol.ByteCount(pnLen) - pl.length
+	}
+	paddingLen += padding
+
+	startLen := len(buffer.Data)
+	raw := buffer.Data[startLen:]
+	raw, err := wire.AppendShortHeader(raw, connID, pn, pnLen, kp)
+	if err != nil {
+		return shortHeaderPacket{}, err
+	}
+	payloadOffset := protocol.ByteCount(len(raw))
+
+	raw, err = p.appendPacketPayload(raw, pl, paddingLen, v)
+	if err != nil {
+		return shortHeaderPacket{}, err
+	}
+	if !isMTUProbePacket {
+		if size := protocol.ByteCount(len(raw) + sealer.Overhead()); size > maxPacketSize {
+			return shortHeaderPacket{}, fmt.Errorf("PacketPacker BUG: packet too large (%d bytes, allowed %d bytes)", size, maxPacketSize)
+		}
+	}
+	raw = p.encryptPacket(raw, sealer, pn, payloadOffset, protocol.ByteCount(pnLen))
+	buffer.Data = buffer.Data[:len(buffer.Data)+len(raw)]
+
+	if newPN := p.pnManager.PopPacketNumber(protocol.Encryption1RTT); newPN != pn {
+		return shortHeaderPacket{}, fmt.Errorf("packetPacker BUG: Peeked and Popped packet numbers do not match: expected %d, got %d", pn, newPN)
+	}
+	return shortHeaderPacket{
+		PacketNumber:         pn,
+		PacketNumberLen:      pnLen,
+		KeyPhase:             kp,
+		StreamFrames:         pl.streamFrames,
+		Frames:               pl.frames,
+		Ack:                  pl.ack,
+		Length:               protocol.ByteCount(len(raw)),
+		DestConnID:           connID,
+		IsPathMTUProbePacket: isMTUProbePacket,
+	}, nil
+}
+
+// appendPacketPayload serializes the payload of a packet into the raw byte slice.
+// It modifies the order of payload.frames.
+func (p *packetPacker) appendPacketPayload(raw []byte, pl payload, paddingLen protocol.ByteCount, v protocol.Version) ([]byte, error) {
+	payloadOffset := len(raw)
+	if pl.ack != nil {
+		var err error
+		raw, err = pl.ack.Append(raw, v)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if paddingLen > 0 {
+		raw = append(raw, make([]byte, paddingLen)...)
+	}
+	// Randomize the order of the control frames.
+	// This makes sure that the receiver doesn't rely on the order in which frames are packed.
+	if len(pl.frames) > 1 {
+		p.rand.Shuffle(len(pl.frames), func(i, j int) { pl.frames[i], pl.frames[j] = pl.frames[j], pl.frames[i] })
+	}
+	for _, f := range pl.frames {
+		var err error
+		raw, err = f.Frame.Append(raw, v)
+		if err != nil {
+			return nil, err
+		}
+	}
+	for _, f := range pl.streamFrames {
+		var err error
+		raw, err = f.Frame.Append(raw, v)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if payloadSize := protocol.ByteCount(len(raw)-payloadOffset) - paddingLen; payloadSize != pl.length {
+		return nil, fmt.Errorf("PacketPacker BUG: payload size inconsistent (expected %d, got %d bytes)", pl.length, payloadSize)
+	}
+	return raw, nil
+}
+
+func (p *packetPacker) encryptPacket(raw []byte, sealer sealer, pn protocol.PacketNumber, payloadOffset, pnLen protocol.ByteCount) []byte {
+	_ = sealer.Seal(raw[payloadOffset:payloadOffset], raw[payloadOffset:], pn, raw[:payloadOffset])
+	raw = raw[:len(raw)+sealer.Overhead()]
+	// apply header protection
+	pnOffset := payloadOffset - pnLen
+	sealer.EncryptHeader(raw[pnOffset+4:pnOffset+4+16], &raw[0], raw[pnOffset:payloadOffset])
+	return raw
+}
+
+func (p *packetPacker) SetToken(token []byte) {
+	p.token = token
+}
+
+type emptyHandler struct{}
+
+var _ ackhandler.FrameHandler = emptyHandler{}
+
+func (emptyHandler) OnAcked(wire.Frame) {}
+func (emptyHandler) OnLost(wire.Frame)  {}
diff --git a/electron/native/private-transport/third_party/quic-go/packet_packer_test.go b/electron/native/private-transport/third_party/quic-go/packet_packer_test.go
new file mode 100644
index 000000000..b74551d20
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/packet_packer_test.go
@@ -0,0 +1,1077 @@
+package quic
+
+import (
+	"bytes"
+	"crypto/rand"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/mocks"
+	mockackhandler "github.com/quic-go/quic-go/internal/mocks/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+const testPackerConnIDLen = 4
+
+type testPacketPacker struct {
+	packer              *packetPacker
+	initialStream       *initialCryptoStream
+	handshakeStream     *cryptoStream
+	datagramQueue       *datagramQueue
+	pnManager           *mockackhandler.MockSentPacketHandler
+	sealingManager      *MockSealingManager
+	framer              *MockFrameSource
+	ackFramer           *MockAckFrameSource
+	retransmissionQueue *retransmissionQueue
+}
+
+func newTestPacketPacker(t *testing.T, mockCtrl *gomock.Controller, pers protocol.Perspective) *testPacketPacker {
+	destConnID := protocol.ParseConnectionID([]byte{1, 2, 3, 4})
+	require.Equal(t, testPackerConnIDLen, destConnID.Len())
+	initialStream := newInitialCryptoStream(pers == protocol.PerspectiveClient)
+	handshakeStream := newCryptoStream()
+	pnManager := mockackhandler.NewMockSentPacketHandler(mockCtrl)
+	framer := NewMockFrameSource(mockCtrl)
+	ackFramer := NewMockAckFrameSource(mockCtrl)
+	sealingManager := NewMockSealingManager(mockCtrl)
+	datagramQueue := newDatagramQueue(func() {}, utils.DefaultLogger)
+	retransmissionQueue := newRetransmissionQueue()
+	return &testPacketPacker{
+		pnManager:           pnManager,
+		initialStream:       initialStream,
+		handshakeStream:     handshakeStream,
+		sealingManager:      sealingManager,
+		framer:              framer,
+		ackFramer:           ackFramer,
+		datagramQueue:       datagramQueue,
+		retransmissionQueue: retransmissionQueue,
+		packer: newPacketPacker(
+			protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+			func() protocol.ConnectionID { return destConnID },
+			initialStream,
+			handshakeStream,
+			pnManager,
+			retransmissionQueue,
+			sealingManager,
+			framer,
+			ackFramer,
+			datagramQueue,
+			pers,
+		),
+	}
+}
+
+// newMockShortHeaderSealer returns a mock short header sealer that seals a short header packet
+func newMockShortHeaderSealer(mockCtrl *gomock.Controller) *mocks.MockShortHeaderSealer {
+	sealer := mocks.NewMockShortHeaderSealer(mockCtrl)
+	sealer.EXPECT().KeyPhase().Return(protocol.KeyPhaseOne).AnyTimes()
+	sealer.EXPECT().Overhead().Return(7).AnyTimes()
+	sealer.EXPECT().EncryptHeader(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	sealer.EXPECT().Seal(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(func(dst, src []byte, pn protocol.PacketNumber, associatedData []byte) []byte {
+		return append(src, bytes.Repeat([]byte{'s'}, sealer.Overhead())...)
+	}).AnyTimes()
+	return sealer
+}
+
+func parsePacket(t *testing.T, data []byte) (hdrs []*wire.ExtendedHeader, more []byte) {
+	t.Helper()
+	for len(data) > 0 {
+		if !wire.IsLongHeaderPacket(data[0]) {
+			break
+		}
+		hdr, _, more, err := wire.ParsePacket(data)
+		require.NoError(t, err)
+		extHdr, err := hdr.ParseExtended(data)
+		require.NoError(t, err)
+		require.GreaterOrEqual(t, extHdr.Length+protocol.ByteCount(extHdr.PacketNumberLen), protocol.ByteCount(4))
+		data = more
+		hdrs = append(hdrs, extHdr)
+	}
+	return hdrs, data
+}
+
+func parseShortHeaderPacket(t *testing.T, data []byte, connIDLen int) {
+	t.Helper()
+	l, _, pnLen, _, err := wire.ParseShortHeader(data, connIDLen)
+	require.NoError(t, err)
+	require.GreaterOrEqual(t, len(data)-l+int(pnLen), 4)
+}
+
+func expectAppendFrames(framer *MockFrameSource, controlFrames []ackhandler.Frame, streamFrames []ackhandler.StreamFrame) {
+	framer.EXPECT().Append(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+		func(cf []ackhandler.Frame, sf []ackhandler.StreamFrame, maxSize protocol.ByteCount, _ monotime.Time, v protocol.Version) ([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount) {
+			var length protocol.ByteCount
+			for _, f := range controlFrames {
+				if length+f.Frame.Length(v) > maxSize {
+					break
+				}
+				length += f.Frame.Length(v)
+				cf = append(cf, f)
+			}
+			for _, f := range streamFrames {
+				if length+f.Frame.Length(v) > maxSize {
+					break
+				}
+				length += f.Frame.Length(v)
+				sf = append(sf, f)
+			}
+			return cf, sf, length
+		},
+	)
+}
+
+func generateLargeACKFrame(t *testing.T, minSize protocol.ByteCount) *wire.AckFrame {
+	t.Helper()
+
+	ack := &wire.AckFrame{
+		AckRanges: []wire.AckRange{{Smallest: 1, Largest: 1}},
+		DelayTime: 42 * time.Millisecond,
+	}
+	var counter int
+	for ack.Length(protocol.Version1) < minSize {
+		counter++
+		if counter > protocol.MaxNumAckRanges {
+			t.Fatalf("max number of ACK ranges reached, size: %d", ack.Length(protocol.Version1))
+		}
+		pn := protocol.PacketNumber(1000 * counter)
+		ack.AckRanges = append([]wire.AckRange{{Smallest: pn, Largest: pn + 100}}, ack.AckRanges...)
+	}
+	return ack
+}
+
+func TestPackLongHeaders(t *testing.T) {
+	skipIfDisableScramblingEnvSet(t)
+
+	t.Run("with Handshake ACK", func(t *testing.T) {
+		testPackLongHeaders(t, true)
+	})
+
+	t.Run("without Handshake ACK", func(t *testing.T) {
+		testPackLongHeaders(t, false)
+	})
+}
+
+func testPackLongHeaders(t *testing.T, includeACK bool) {
+	const maxPacketSize protocol.ByteCount = 1234
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveClient)
+	token := make([]byte, 20)
+	rand.Read(token)
+	tp.packer.SetToken(token)
+	now := monotime.Now()
+
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.EncryptionInitial).Return(protocol.PacketNumber(0x24), protocol.PacketNumberLen3)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.EncryptionInitial).Return(protocol.PacketNumber(0x24))
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen4)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionInitial, now, false)
+	var numRanges int
+	if includeACK {
+		ack := generateLargeACKFrame(t, maxPacketSize-1000)
+		numRanges = len(ack.AckRanges)
+		tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionHandshake, now, false).Return(ack)
+	} else {
+		tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionHandshake, now, false)
+		tp.sealingManager.EXPECT().Get0RTTSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+		tp.sealingManager.EXPECT().Get1RTTSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+	}
+	clientHello, err := getClientHello("quic-go.net")
+	require.NoError(t, err)
+	tp.initialStream.Write(clientHello)
+	tp.initialStream.Write(make([]byte, 900-len(clientHello))) // add some more data
+	tp.packer.retransmissionQueue.addHandshake(&wire.PingFrame{})
+
+	p, err := tp.packer.PackCoalescedPacket(false, maxPacketSize, now, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, maxPacketSize, p.buffer.Len())
+	require.Len(t, p.longHdrPackets, 2)
+	require.Nil(t, p.shortHdrPacket)
+	require.Equal(t, protocol.EncryptionInitial, p.longHdrPackets[0].EncryptionLevel())
+	// the ClientHello is split into multiple frames
+	require.GreaterOrEqual(t, len(p.longHdrPackets[0].frames), 3)
+	for _, f := range p.longHdrPackets[0].frames {
+		require.IsType(t, &wire.CryptoFrame{}, f.Frame)
+	}
+	require.Equal(t, protocol.EncryptionHandshake, p.longHdrPackets[1].EncryptionLevel())
+	require.Len(t, p.longHdrPackets[1].frames, 1)
+	require.IsType(t, &wire.PingFrame{}, p.longHdrPackets[1].frames[0].Frame)
+	if includeACK {
+		require.NotNil(t, p.longHdrPackets[1].ack)
+		// the ACK frame was truncated
+		require.Less(t, len(p.longHdrPackets[1].ack.AckRanges), numRanges)
+	} else {
+		require.Nil(t, p.longHdrPackets[1].ack)
+	}
+
+	hdrs, more := parsePacket(t, p.buffer.Data)
+	require.Len(t, hdrs, 2)
+	require.Equal(t, protocol.PacketTypeInitial, hdrs[0].Type)
+	require.Equal(t, token, hdrs[0].Token)
+	require.Equal(t, protocol.PacketNumber(0x24), hdrs[0].PacketNumber)
+	require.Equal(t, protocol.PacketNumberLen3, hdrs[0].PacketNumberLen)
+	require.Equal(t, protocol.PacketTypeHandshake, hdrs[1].Type)
+	require.Nil(t, hdrs[1].Token)
+	require.Equal(t, protocol.PacketNumber(0x42), hdrs[1].PacketNumber)
+	require.Equal(t, protocol.PacketNumberLen4, hdrs[1].PacketNumberLen)
+	require.Empty(t, more)
+}
+
+func TestPackCoalescedAckOnlyPacketNothingToSend(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveClient)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	// the packet number is not popped
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionInitial, gomock.Any(), true)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionHandshake, gomock.Any(), true)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), true)
+	p, err := tp.packer.PackCoalescedPacket(true, 1234, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Nil(t, p)
+}
+
+func TestPackInitialAckOnlyPacket(t *testing.T) {
+	t.Run("client", func(t *testing.T) { testPackInitialAckOnlyPacket(t, protocol.PerspectiveClient) })
+	t.Run("server", func(t *testing.T) { testPackInitialAckOnlyPacket(t, protocol.PerspectiveServer) })
+}
+
+func testPackInitialAckOnlyPacket(t *testing.T, pers protocol.Perspective) {
+	const maxPacketSize protocol.ByteCount = 1234
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, pers)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.EncryptionInitial).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.EncryptionInitial).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	ack := &wire.AckFrame{AckRanges: []wire.AckRange{{Smallest: 1, Largest: 10}}}
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionInitial, gomock.Any(), true).Return(ack)
+	p, err := tp.packer.PackCoalescedPacket(true, maxPacketSize, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, p)
+	require.Len(t, p.longHdrPackets, 1)
+	require.Equal(t, protocol.EncryptionInitial, p.longHdrPackets[0].EncryptionLevel())
+	require.Equal(t, ack, p.longHdrPackets[0].ack)
+	require.Empty(t, p.longHdrPackets[0].frames)
+	// only the client needs to pad Initial packets
+	switch pers {
+	case protocol.PerspectiveClient:
+		require.Equal(t, maxPacketSize, p.buffer.Len())
+	case protocol.PerspectiveServer:
+		require.Less(t, p.buffer.Len(), protocol.ByteCount(100))
+	}
+	hdrs, more := parsePacket(t, p.buffer.Data)
+	require.Empty(t, more)
+	require.Len(t, hdrs, 1)
+	require.Equal(t, protocol.PacketTypeInitial, hdrs[0].Type)
+}
+
+func TestPack1RTTAckOnlyPacket(t *testing.T) {
+	const maxPacketSize protocol.ByteCount = 1300
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveClient)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	ack := &wire.AckFrame{AckRanges: []wire.AckRange{{Smallest: 1, Largest: 10}}}
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), true).Return(ack)
+	p, buffer, err := tp.packer.PackAckOnlyPacket(maxPacketSize, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, ack, p.Ack)
+	require.Empty(t, p.Frames)
+	parsePacket(t, buffer.Data)
+}
+
+func TestPack0RTTPacket(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveClient)
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().Get0RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionInitial, gomock.Any(), true)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption0RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption0RTT).Return(protocol.PacketNumber(0x42))
+	cf := ackhandler.Frame{Frame: &wire.MaxDataFrame{MaximumData: 0x1337}}
+	tp.framer.EXPECT().HasData().Return(true)
+	// TODO: check sizes
+	tp.framer.EXPECT().Append(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
+		func(fs []ackhandler.Frame, sf []ackhandler.StreamFrame, _ protocol.ByteCount, _ monotime.Time, _ protocol.Version) ([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount) {
+			return append(fs, cf), sf, cf.Frame.Length(protocol.Version1)
+		},
+	)
+	p, err := tp.packer.PackCoalescedPacket(false, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, p)
+	require.Len(t, p.longHdrPackets, 1)
+	require.Equal(t, protocol.PacketType0RTT, p.longHdrPackets[0].header.Type)
+	require.Equal(t, protocol.Encryption0RTT, p.longHdrPackets[0].EncryptionLevel())
+	require.Len(t, p.longHdrPackets[0].frames, 1)
+	require.Equal(t, cf.Frame, p.longHdrPackets[0].frames[0].Frame)
+	require.NotNil(t, p.longHdrPackets[0].frames[0].Handler)
+}
+
+// ACK frames can't be sent in 0-RTT packets
+func TestPack0RTTPacketNoACK(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveClient)
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionInitial, gomock.Any(), true)
+	// no further calls to get an ACK frame
+	p, err := tp.packer.PackCoalescedPacket(true, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Nil(t, p)
+}
+
+func TestPackCoalescedAppData(t *testing.T) {
+	t.Run("with large ACK", func(t *testing.T) {
+		testPackCoalescedAppData(t, true)
+	})
+
+	t.Run("without ACK", func(t *testing.T) {
+		testPackCoalescedAppData(t, false)
+	})
+}
+
+func testPackCoalescedAppData(t *testing.T, withAck bool) {
+	const maxPacketSize protocol.ByteCount = 1234
+
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(0x24), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(0x24))
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(nil, handshake.ErrKeysDropped)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.framer.EXPECT().HasData().Return(true)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionHandshake, gomock.Any(), false)
+
+	var numRanges int
+	if withAck {
+		// The ACK is too large and needs to be truncated
+		ack := generateLargeACKFrame(t, maxPacketSize-1000)
+		numRanges = len(ack.AckRanges)
+		tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false).Return(ack)
+	} else {
+		tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false)
+	}
+
+	handshakeData := make([]byte, 1000)
+	rand.Read(handshakeData)
+	tp.handshakeStream.Write(handshakeData)
+	expectAppendFrames(tp.framer, nil, []ackhandler.StreamFrame{{Frame: &wire.StreamFrame{Data: []byte("foobar")}}})
+
+	p, err := tp.packer.PackCoalescedPacket(false, maxPacketSize, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, p.longHdrPackets, 1)
+	require.Equal(t, protocol.EncryptionHandshake, p.longHdrPackets[0].EncryptionLevel())
+	require.Len(t, p.longHdrPackets[0].frames, 1)
+	require.Equal(t, handshakeData, p.longHdrPackets[0].frames[0].Frame.(*wire.CryptoFrame).Data)
+	require.NotNil(t, p.shortHdrPacket)
+	require.Empty(t, p.shortHdrPacket.Frames)
+	if withAck {
+		require.NotNil(t, p.shortHdrPacket.Ack)
+		require.Less(t, len(p.shortHdrPacket.Ack.AckRanges), numRanges)
+		require.LessOrEqual(t, len(p.buffer.Data), int(maxPacketSize))
+		require.Empty(t, p.shortHdrPacket.StreamFrames)
+	} else {
+		require.Nil(t, p.shortHdrPacket.Ack)
+		require.Less(t, len(p.buffer.Data), int(maxPacketSize))
+		require.Len(t, p.shortHdrPacket.StreamFrames, 1)
+		require.Equal(t, []byte("foobar"), p.shortHdrPacket.StreamFrames[0].Frame.Data)
+	}
+
+	hdrs, more := parsePacket(t, p.buffer.Data)
+	require.Len(t, hdrs, 1)
+	require.Equal(t, protocol.PacketTypeHandshake, hdrs[0].Type)
+	require.NotEmpty(t, more)
+	parseShortHeaderPacket(t, more, testPackerConnIDLen)
+}
+
+func TestPackConnectionCloseCoalesced(t *testing.T) {
+	t.Run("client", func(t *testing.T) { testPackConnectionCloseCoalesced(t, protocol.PerspectiveClient) })
+	t.Run("server", func(t *testing.T) { testPackConnectionCloseCoalesced(t, protocol.PerspectiveServer) })
+}
+
+func testPackConnectionCloseCoalesced(t *testing.T, pers protocol.Perspective) {
+	const maxPacketSize protocol.ByteCount = 1234
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, pers)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.EncryptionInitial).Return(protocol.PacketNumber(1), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.EncryptionInitial).Return(protocol.PacketNumber(1))
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(2), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(2))
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	switch pers {
+	case protocol.PerspectiveClient:
+		tp.sealingManager.EXPECT().Get0RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+		tp.sealingManager.EXPECT().Get1RTTSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+		tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption0RTT).Return(protocol.PacketNumber(3), protocol.PacketNumberLen2)
+		tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption0RTT).Return(protocol.PacketNumber(3))
+	case protocol.PerspectiveServer:
+		tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+		tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(3), protocol.PacketNumberLen2)
+		tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(3))
+	}
+	p, err := tp.packer.PackApplicationClose(&qerr.ApplicationError{
+		ErrorCode:    0x1337,
+		ErrorMessage: "foobar",
+	}, maxPacketSize, protocol.Version1)
+	require.NoError(t, err)
+	switch pers {
+	case protocol.PerspectiveClient:
+		require.Len(t, p.longHdrPackets, 3)
+		require.Nil(t, p.shortHdrPacket)
+	case protocol.PerspectiveServer:
+		require.Len(t, p.longHdrPackets, 2)
+		require.NotNil(t, p.shortHdrPacket)
+	}
+	// for Initial packets, the error code is replace with a transport error of type APPLICATION_ERROR
+	require.Equal(t, protocol.PacketTypeInitial, p.longHdrPackets[0].header.Type)
+	require.Equal(t, protocol.PacketNumber(1), p.longHdrPackets[0].header.PacketNumber)
+	require.Len(t, p.longHdrPackets[0].frames, 1)
+	require.IsType(t, &wire.ConnectionCloseFrame{}, p.longHdrPackets[0].frames[0].Frame)
+	ccf := p.longHdrPackets[0].frames[0].Frame.(*wire.ConnectionCloseFrame)
+	require.False(t, ccf.IsApplicationError)
+	require.Equal(t, uint64(qerr.ApplicationErrorErrorCode), ccf.ErrorCode)
+	require.Empty(t, ccf.ReasonPhrase)
+	// for Handshake packets, the error code is replace with a transport error of type APPLICATION_ERROR
+	require.Equal(t, protocol.PacketTypeHandshake, p.longHdrPackets[1].header.Type)
+	require.Equal(t, protocol.PacketNumber(2), p.longHdrPackets[1].header.PacketNumber)
+	require.Len(t, p.longHdrPackets[1].frames, 1)
+	require.IsType(t, &wire.ConnectionCloseFrame{}, p.longHdrPackets[1].frames[0].Frame)
+	ccf = p.longHdrPackets[1].frames[0].Frame.(*wire.ConnectionCloseFrame)
+	require.False(t, ccf.IsApplicationError)
+	require.Equal(t, uint64(qerr.ApplicationErrorErrorCode), ccf.ErrorCode)
+	require.Empty(t, ccf.ReasonPhrase)
+
+	// for application-data packet number space (1-RTT for the server, 0-RTT for the client),
+	// the application-level error code is sent
+
+	switch pers {
+	case protocol.PerspectiveClient:
+		require.Equal(t, protocol.PacketNumber(3), p.longHdrPackets[2].header.PacketNumber)
+		require.Len(t, p.longHdrPackets[2].frames, 1)
+		require.IsType(t, &wire.ConnectionCloseFrame{}, p.longHdrPackets[2].frames[0].Frame)
+		ccf = p.longHdrPackets[2].frames[0].Frame.(*wire.ConnectionCloseFrame)
+	case protocol.PerspectiveServer:
+		require.Equal(t, protocol.PacketNumber(3), p.shortHdrPacket.PacketNumber)
+		require.Len(t, p.shortHdrPacket.Frames, 1)
+		require.IsType(t, &wire.ConnectionCloseFrame{}, p.shortHdrPacket.Frames[0].Frame)
+		ccf = p.shortHdrPacket.Frames[0].Frame.(*wire.ConnectionCloseFrame)
+	}
+	require.True(t, ccf.IsApplicationError)
+	require.Equal(t, uint64(0x1337), ccf.ErrorCode)
+	require.Equal(t, "foobar", ccf.ReasonPhrase)
+
+	// the client needs to pad this packet to the max packet size
+	switch pers {
+	case protocol.PerspectiveClient:
+		require.Equal(t, maxPacketSize, p.buffer.Len())
+	case protocol.PerspectiveServer:
+		require.Less(t, p.buffer.Len(), protocol.ByteCount(100))
+	}
+}
+
+func TestPackConnectionCloseCryptoError(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(nil, handshake.ErrKeysDropped)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+	quicErr := qerr.NewLocalCryptoError(0x42, errors.New("crypto error"))
+	quicErr.FrameType = 0x1234
+	p, err := tp.packer.PackConnectionClose(quicErr, protocol.MaxByteCount, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, p.longHdrPackets, 1)
+	require.Equal(t, protocol.PacketTypeHandshake, p.longHdrPackets[0].header.Type)
+	require.Len(t, p.longHdrPackets[0].frames, 1)
+	require.IsType(t, &wire.ConnectionCloseFrame{}, p.longHdrPackets[0].frames[0].Frame)
+	ccf := p.longHdrPackets[0].frames[0].Frame.(*wire.ConnectionCloseFrame)
+	require.False(t, ccf.IsApplicationError)
+	require.Equal(t, uint64(0x100+0x42), ccf.ErrorCode)
+	require.Equal(t, uint64(0x1234), ccf.FrameType)
+	// for crypto errors, the reason phrase is cleared
+	require.Empty(t, ccf.ReasonPhrase)
+}
+
+func TestPackConnectionClose1RTT(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(nil, handshake.ErrKeysDropped)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(nil, handshake.ErrKeysDropped)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	// expect no framer.PopStreamFrames
+	p, err := tp.packer.PackConnectionClose(&qerr.TransportError{
+		ErrorCode:    qerr.CryptoBufferExceeded,
+		ErrorMessage: "foo",
+	}, protocol.MaxByteCount, protocol.Version1)
+	require.NoError(t, err)
+	require.Empty(t, p.longHdrPackets)
+	require.Len(t, p.shortHdrPacket.Frames, 1)
+	require.IsType(t, &wire.ConnectionCloseFrame{}, p.shortHdrPacket.Frames[0].Frame)
+	ccf := p.shortHdrPacket.Frames[0].Frame.(*wire.ConnectionCloseFrame)
+	require.False(t, ccf.IsApplicationError)
+	require.Equal(t, uint64(qerr.CryptoBufferExceeded), ccf.ErrorCode)
+	require.Equal(t, "foo", ccf.ReasonPhrase)
+}
+
+func TestPack1RTTPacketNothingToSend(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	// don't expect any calls to PopPacketNumber
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), true)
+	tp.framer.EXPECT().HasData()
+	_, err := tp.packer.AppendPacket(getPacketBuffer(), protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.ErrorIs(t, err, errNothingToPack)
+}
+
+func TestPack1RTTPacketWithData(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.framer.EXPECT().HasData().Return(true)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false)
+	f := &wire.StreamFrame{
+		StreamID: 5,
+		Data:     []byte{0xde, 0xca, 0xfb, 0xad},
+	}
+	expectAppendFrames(
+		tp.framer,
+		[]ackhandler.Frame{
+			{Frame: &wire.ResetStreamFrame{}, Handler: &mtuFinderAckHandler{}}, // set any non-nil ackhandler.FrameHandler
+			{Frame: &wire.MaxDataFrame{}},
+		},
+		[]ackhandler.StreamFrame{{Frame: f}},
+	)
+	buffer := getPacketBuffer()
+	buffer.Data = append(buffer.Data, []byte("foobar")...)
+	p, err := tp.packer.AppendPacket(buffer, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, p.StreamFrames, 1)
+	var sawResetStream, sawMaxData bool
+	for _, frame := range p.Frames {
+		switch frame.Frame.(type) {
+		case *wire.ResetStreamFrame:
+			sawResetStream = true
+			require.Equal(t, frame.Handler, &mtuFinderAckHandler{})
+		case *wire.MaxDataFrame:
+			sawMaxData = true
+			require.NotNil(t, frame.Handler)
+			require.NotEqual(t, frame.Handler, &mtuFinderAckHandler{})
+		}
+	}
+	require.True(t, sawResetStream)
+	require.True(t, sawMaxData)
+	require.Equal(t, f.StreamID, p.StreamFrames[0].Frame.StreamID)
+	require.Equal(t, buffer.Data[:6], []byte("foobar")) // make sure the packet was actually appended
+	require.Contains(t, string(buffer.Data), string(b))
+}
+
+func TestPack1RTTPacketWithACK(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	ack := &wire.AckFrame{AckRanges: []wire.AckRange{{Largest: 42, Smallest: 1}}}
+	tp.framer.EXPECT().HasData()
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), true).Return(ack)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	p, err := tp.packer.AppendPacket(getPacketBuffer(), protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, ack, p.Ack)
+}
+
+func TestPackPathChallengeAndPathResponse(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.framer.EXPECT().HasData().Return(true)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false)
+	frames := []ackhandler.Frame{
+		{Frame: &wire.PathChallengeFrame{}},
+		{Frame: &wire.PathResponseFrame{}},
+		{Frame: &wire.DataBlockedFrame{}},
+	}
+	expectAppendFrames(tp.framer, frames, nil)
+	buffer := getPacketBuffer()
+	p, err := tp.packer.AppendPacket(buffer, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, p.Frames, 3)
+	var sawPathChallenge, sawPathResponse bool
+	for _, f := range p.Frames {
+		switch f.Frame.(type) {
+		case *wire.PathChallengeFrame:
+			sawPathChallenge = true
+			// this means that the frame won't be retransmitted.
+			require.Nil(t, f.Handler)
+		case *wire.PathResponseFrame:
+			sawPathResponse = true
+			// this means that the frame won't be retransmitted.
+			require.Nil(t, f.Handler)
+		default:
+			require.NotNil(t, f.Handler)
+		}
+	}
+	require.True(t, sawPathChallenge)
+	require.True(t, sawPathResponse)
+	require.NotZero(t, buffer.Len())
+}
+
+func TestPackDatagramFrames(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), true)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.datagramQueue.Add(&wire.DatagramFrame{
+		DataLenPresent: true,
+		Data:           []byte("foobar"),
+	})
+	tp.framer.EXPECT().HasData()
+	buffer := getPacketBuffer()
+	p, err := tp.packer.AppendPacket(buffer, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, p.Frames, 1)
+	require.IsType(t, &wire.DatagramFrame{}, p.Frames[0].Frame)
+	require.Equal(t, []byte("foobar"), p.Frames[0].Frame.(*wire.DatagramFrame).Data)
+	require.NotEmpty(t, buffer.Data)
+}
+
+func TestPackLargeDatagramFrame(t *testing.T) {
+	// If a packet contains an ACK, and doesn't have enough space for the DATAGRAM frame,
+	// it should be skipped. It will be packed in the next packet.
+	const maxPacketSize = 1000
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), true).Return(&wire.AckFrame{AckRanges: []wire.AckRange{{Largest: 100}}})
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	f := &wire.DatagramFrame{DataLenPresent: true, Data: make([]byte, maxPacketSize-10)}
+	tp.datagramQueue.Add(f)
+	tp.framer.EXPECT().HasData()
+	buffer := getPacketBuffer()
+	p, err := tp.packer.AppendPacket(buffer, maxPacketSize, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, p.Ack)
+	require.Empty(t, p.Frames)
+	require.NotEmpty(t, buffer.Data)
+	require.Equal(t, f, tp.datagramQueue.Peek()) // make sure the frame is still there
+
+	// Now try packing again, but with a smaller packet size.
+	// The DATAGRAM frame should now be dropped, as we can't expect to ever be able tosend it out.
+	const newMaxPacketSize = maxPacketSize - 10
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), true)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x43), protocol.PacketNumberLen2)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.framer.EXPECT().HasData()
+	buffer = getPacketBuffer()
+	p, err = tp.packer.AppendPacket(buffer, newMaxPacketSize, monotime.Now(), protocol.Version1)
+	require.ErrorIs(t, err, errNothingToPack)
+	require.Nil(t, tp.datagramQueue.Peek()) // make sure the frame is gone
+}
+
+func TestPackRetransmissions(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	f := &wire.CryptoFrame{Data: []byte("Initial")}
+	tp.retransmissionQueue.addInitial(f)
+	tp.retransmissionQueue.addHandshake(&wire.CryptoFrame{Data: []byte("Handshake")})
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.EncryptionInitial).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.EncryptionInitial).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionInitial, gomock.Any(), false)
+	p, err := tp.packer.PackCoalescedPacket(false, 1000, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, p.longHdrPackets, 1)
+	require.Equal(t, protocol.EncryptionInitial, p.longHdrPackets[0].EncryptionLevel())
+	require.Len(t, p.longHdrPackets[0].frames, 1)
+	require.Equal(t, f, p.longHdrPackets[0].frames[0].Frame)
+	require.NotNil(t, p.longHdrPackets[0].frames[0].Handler)
+}
+
+func packMaxNumNonAckElicitingAcks(t *testing.T, tp *testPacketPacker, mockCtrl *gomock.Controller, maxPacketSize protocol.ByteCount) {
+	t.Helper()
+	for range protocol.MaxNonAckElicitingAcks {
+		tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+		tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+		tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+		tp.framer.EXPECT().HasData().Return(true)
+		tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false).Return(
+			&wire.AckFrame{AckRanges: []wire.AckRange{{Smallest: 1, Largest: 1}}},
+		)
+		expectAppendFrames(tp.framer, nil, nil)
+		p, err := tp.packer.AppendPacket(getPacketBuffer(), maxPacketSize, monotime.Now(), protocol.Version1)
+		require.NoError(t, err)
+		require.NotNil(t, p.Ack)
+		require.Empty(t, p.Frames)
+	}
+}
+
+func TestPackEvery20thPacketAckEliciting(t *testing.T) {
+	const maxPacketSize = 1000
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+
+	// send the maximum number of non-ACK-eliciting packets
+	packMaxNumNonAckElicitingAcks(t, tp, mockCtrl, maxPacketSize)
+
+	// Now there's nothing to send, so we shouldn't generate a packet just to send a PING
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false)
+	tp.framer.EXPECT().HasData().Return(true)
+	expectAppendFrames(tp.framer, nil, nil)
+	_, err := tp.packer.AppendPacket(getPacketBuffer(), maxPacketSize, monotime.Now(), protocol.Version1)
+	require.ErrorIs(t, err, errNothingToPack)
+
+	// Now we have an ACK to send. We should bundle a PING to make the packet ack-eliciting.
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.framer.EXPECT().HasData().Return(true)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false).Return(
+		&wire.AckFrame{AckRanges: []wire.AckRange{{Smallest: 1, Largest: 1}}},
+	)
+	expectAppendFrames(tp.framer, nil, nil)
+	p, err := tp.packer.AppendPacket(getPacketBuffer(), maxPacketSize, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Len(t, p.Frames, 1)
+	require.Equal(t, &wire.PingFrame{}, p.Frames[0].Frame)
+	require.Nil(t, p.Frames[0].Handler) // make sure the PING is not retransmitted if lost
+
+	// make sure the next packet doesn't contain another PING
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.framer.EXPECT().HasData().Return(true)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false).Return(
+		&wire.AckFrame{AckRanges: []wire.AckRange{{Smallest: 1, Largest: 1}}},
+	)
+	expectAppendFrames(tp.framer, nil, nil)
+	p, err = tp.packer.AppendPacket(getPacketBuffer(), maxPacketSize, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, p.Ack)
+	require.Empty(t, p.Frames)
+}
+
+func TestPackLongHeaderPadToAtLeast4Bytes(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen1)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.EncryptionHandshake).Return(protocol.PacketNumber(0x42))
+
+	sealer := newMockShortHeaderSealer(mockCtrl)
+	tp.sealingManager.EXPECT().GetInitialSealer().Return(nil, handshake.ErrKeysDropped)
+	tp.sealingManager.EXPECT().GetHandshakeSealer().Return(sealer, nil)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(nil, handshake.ErrKeysNotYetAvailable)
+	tp.retransmissionQueue.addHandshake(&wire.PingFrame{})
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.EncryptionHandshake, gomock.Any(), false)
+
+	packet, err := tp.packer.PackCoalescedPacket(false, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, packet)
+	require.Len(t, packet.longHdrPackets, 1)
+	require.Nil(t, packet.shortHdrPacket)
+
+	hdr, _, _, err := wire.ParsePacket(packet.buffer.Data)
+	require.NoError(t, err)
+	data := packet.buffer.Data
+	extHdr, err := hdr.ParseExtended(data)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketNumberLen1, extHdr.PacketNumberLen)
+
+	data = data[extHdr.ParsedLen():]
+	require.Len(t, data, 4-1 /* packet number length */ +sealer.Overhead())
+	// first bytes should be 2 PADDING frames...
+	require.Equal(t, []byte{0, 0}, data[:2])
+	// ...followed by the PING frame
+	frameParser := wire.NewFrameParser(false, false, false)
+
+	frameType, lt, err := frameParser.ParseType(data[2:], protocol.EncryptionHandshake)
+	require.NoError(t, err)
+	require.Equal(t, 1, lt)
+	frame, l, err := frameParser.ParseLessCommonFrame(frameType, data[2+lt:], protocol.Version1)
+	require.NoError(t, err)
+	require.IsType(t, &wire.PingFrame{}, frame)
+	require.Zero(t, l)
+	require.Equal(t, sealer.Overhead(), len(data)-2-lt)
+}
+
+func TestPackShortHeaderPadToAtLeast4Bytes(t *testing.T) {
+	// small stream ID, such that only a single byte is consumed
+	f := &wire.StreamFrame{StreamID: 0x10, Fin: true}
+	require.Equal(t, protocol.ByteCount(2), f.Length(protocol.Version1))
+
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen1)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	sealer := newMockShortHeaderSealer(mockCtrl)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(sealer, nil)
+	tp.framer.EXPECT().HasData().Return(true)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false)
+	expectAppendFrames(tp.framer, nil, []ackhandler.StreamFrame{{Frame: f}})
+
+	buffer := getPacketBuffer()
+	_, err := tp.packer.AppendPacket(buffer, protocol.MaxByteCount, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	// cut off the tag that the mock sealer added
+	buffer.Data = buffer.Data[:buffer.Len()-protocol.ByteCount(sealer.Overhead())]
+	data := buffer.Data
+
+	l, _, pnLen, _, err := wire.ParseShortHeader(data, testPackerConnIDLen)
+	require.NoError(t, err)
+	payload := data[l:]
+	require.Equal(t, protocol.PacketNumberLen1, pnLen)
+	require.Equal(t, 4-1 /* packet number length */, len(payload))
+	// the first byte of the payload should be a PADDING frame...
+	require.Equal(t, byte(0), payload[0])
+
+	// ... followed by the STREAM frame
+	frameParser := wire.NewFrameParser(false, false, false)
+	frameType, l, err := frameParser.ParseType(payload[1:], protocol.Encryption1RTT)
+	require.NoError(t, err)
+	require.Equal(t, 1, l)
+	require.True(t, frameType.IsStreamFrameType())
+
+	frame, frameLen, err := wire.ParseStreamFrame(payload[1+l:], frameType, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, f, frame)
+	require.Equal(t, len(payload)-2, frameLen)
+}
+
+func TestPackInitialProbePacket(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		t.Setenv(disableClientHelloScramblingEnv, "true")
+		testPackProbePacket(t, protocol.EncryptionInitial, protocol.PerspectiveClient)
+	})
+	t.Run("server", func(t *testing.T) {
+		testPackProbePacket(t, protocol.EncryptionInitial, protocol.PerspectiveServer)
+	})
+}
+
+func TestPackHandshakeProbePacket(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testPackProbePacket(t, protocol.EncryptionHandshake, protocol.PerspectiveClient)
+	})
+	t.Run("server", func(t *testing.T) {
+		testPackProbePacket(t, protocol.EncryptionHandshake, protocol.PerspectiveServer)
+	})
+}
+
+func testPackProbePacket(t *testing.T, encLevel protocol.EncryptionLevel, perspective protocol.Perspective) {
+	const maxPacketSize protocol.ByteCount = 1234
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, perspective)
+
+	var cryptoData []byte
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		tp.sealingManager.EXPECT().GetInitialSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+		var err error
+		cryptoData, err = getClientHello("")
+		require.NoError(t, err)
+		tp.packer.initialStream.Write(cryptoData)
+	case protocol.EncryptionHandshake:
+		tp.sealingManager.EXPECT().GetHandshakeSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+		cryptoData = []byte("foobar")
+		tp.packer.handshakeStream.Write(cryptoData)
+	}
+	tp.ackFramer.EXPECT().GetAckFrame(encLevel, gomock.Any(), false)
+	tp.pnManager.EXPECT().PeekPacketNumber(encLevel).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(encLevel).Return(protocol.PacketNumber(0x42))
+
+	p, err := tp.packer.PackPTOProbePacket(encLevel, maxPacketSize, false, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, p)
+	require.Len(t, p.longHdrPackets, 1)
+	packet := p.longHdrPackets[0]
+	require.Equal(t, encLevel, packet.EncryptionLevel())
+	if encLevel == protocol.EncryptionInitial {
+		require.GreaterOrEqual(t, p.buffer.Len(), protocol.ByteCount(protocol.MinInitialPacketSize))
+		require.Equal(t, maxPacketSize, p.buffer.Len())
+	}
+	require.Len(t, packet.frames, 1)
+	require.Equal(t, cryptoData, packet.frames[0].Frame.(*wire.CryptoFrame).Data)
+	hdrs, more := parsePacket(t, p.buffer.Data)
+	require.Len(t, hdrs, 1)
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		require.Equal(t, protocol.PacketTypeInitial, hdrs[0].Type)
+	case protocol.EncryptionHandshake:
+		require.Equal(t, protocol.PacketTypeHandshake, hdrs[0].Type)
+	}
+	require.Empty(t, more)
+}
+
+func TestPack1RTTProbePacket(t *testing.T) {
+	const maxPacketSize protocol.ByteCount = 999
+
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.ackFramer.EXPECT().GetAckFrame(protocol.Encryption1RTT, gomock.Any(), false)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x42))
+	tp.framer.EXPECT().HasData().Return(true)
+	tp.framer.EXPECT().Append(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), protocol.Version1).DoAndReturn(
+		func(cf []ackhandler.Frame, sf []ackhandler.StreamFrame, size protocol.ByteCount, _ monotime.Time, v protocol.Version) ([]ackhandler.Frame, []ackhandler.StreamFrame, protocol.ByteCount) {
+			f, split := (&wire.StreamFrame{Data: make([]byte, 2*maxPacketSize)}).MaybeSplitOffFrame(size, v)
+			require.True(t, split)
+			return cf, append(sf, ackhandler.StreamFrame{Frame: f}), f.Length(v)
+		},
+	)
+
+	p, err := tp.packer.PackPTOProbePacket(protocol.Encryption1RTT, maxPacketSize, false, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, p)
+	require.True(t, p.IsOnlyShortHeaderPacket())
+	require.Empty(t, p.longHdrPackets)
+	require.NotNil(t, p.shortHdrPacket)
+	packet := p.shortHdrPacket
+	require.Empty(t, packet.Frames)
+	require.Len(t, packet.StreamFrames, 1)
+	require.Equal(t, maxPacketSize, packet.Length)
+}
+
+func TestPackPTOProbePacketNothingToPack(t *testing.T) {
+	t.Run("Initial", func(t *testing.T) {
+		testPackPTOProbePacketNothingToPack(t, protocol.EncryptionInitial)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testPackPTOProbePacketNothingToPack(t, protocol.EncryptionHandshake)
+	})
+	t.Run("1-RTT", func(t *testing.T) {
+		testPackPTOProbePacketNothingToPack(t, protocol.Encryption1RTT)
+	})
+}
+
+func testPackPTOProbePacketNothingToPack(t *testing.T, encLevel protocol.EncryptionLevel) {
+	const maxPacketSize protocol.ByteCount = 1234
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		tp.sealingManager.EXPECT().GetInitialSealer().Return(newMockShortHeaderSealer(mockCtrl), nil).Times(2)
+	case protocol.EncryptionHandshake:
+		tp.sealingManager.EXPECT().GetHandshakeSealer().Return(newMockShortHeaderSealer(mockCtrl), nil).Times(2)
+	case protocol.Encryption1RTT:
+		tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil).Times(2)
+		tp.framer.EXPECT().HasData().Times(2)
+	}
+	tp.pnManager.EXPECT().PeekPacketNumber(encLevel).Return(protocol.PacketNumber(0x42), protocol.PacketNumberLen2).MaxTimes(2)
+	tp.ackFramer.EXPECT().GetAckFrame(encLevel, gomock.Any(), true).Times(2)
+
+	// don't force a PING to be sent
+	packet, err := tp.packer.PackPTOProbePacket(encLevel, maxPacketSize, false, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.Nil(t, packet)
+
+	// now force a PING to be sent
+	tp.pnManager.EXPECT().PopPacketNumber(encLevel).Return(protocol.PacketNumber(0x42))
+	packet, err = tp.packer.PackPTOProbePacket(encLevel, maxPacketSize, true, monotime.Now(), protocol.Version1)
+	require.NoError(t, err)
+	require.NotNil(t, packet)
+	var frames []ackhandler.Frame
+	switch encLevel {
+	case protocol.EncryptionInitial, protocol.EncryptionHandshake:
+		require.Len(t, packet.longHdrPackets, 1)
+		require.Nil(t, packet.shortHdrPacket)
+		require.Equal(t, encLevel, packet.longHdrPackets[0].EncryptionLevel())
+		frames = packet.longHdrPackets[0].frames
+	case protocol.Encryption1RTT:
+		require.Empty(t, packet.longHdrPackets)
+		require.NotNil(t, packet.shortHdrPacket)
+		frames = packet.shortHdrPacket.Frames
+	}
+
+	require.Len(t, frames, 1)
+	require.Equal(t, &wire.PingFrame{}, frames[0].Frame)
+	require.Equal(t, emptyHandler{}, frames[0].Handler)
+}
+
+func TestPackMTUProbePacket(t *testing.T) {
+	const (
+		maxPacketSize   protocol.ByteCount = 1000
+		probePacketSize                    = maxPacketSize + 42
+	)
+
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveClient)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x43), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x43))
+	ping := ackhandler.Frame{Frame: &wire.PingFrame{}}
+	p, buffer, err := tp.packer.PackMTUProbePacket(ping, probePacketSize, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, probePacketSize, p.Length)
+	require.Equal(t, protocol.PacketNumber(0x43), p.PacketNumber)
+	require.Len(t, buffer.Data, int(probePacketSize))
+	require.True(t, p.IsPathMTUProbePacket)
+	require.False(t, p.IsPathProbePacket)
+}
+
+func TestPackPathProbePacket(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	tp := newTestPacketPacker(t, mockCtrl, protocol.PerspectiveServer)
+	tp.sealingManager.EXPECT().Get1RTTSealer().Return(newMockShortHeaderSealer(mockCtrl), nil)
+	tp.pnManager.EXPECT().PeekPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x43), protocol.PacketNumberLen2)
+	tp.pnManager.EXPECT().PopPacketNumber(protocol.Encryption1RTT).Return(protocol.PacketNumber(0x43))
+
+	p, buf, err := tp.packer.PackPathProbePacket(
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		[]ackhandler.Frame{
+			{Frame: &wire.PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}}},
+			{Frame: &wire.PathResponseFrame{Data: [8]byte{8, 7, 6, 5, 4, 3, 2, 1}}},
+		},
+		protocol.Version1,
+	)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketNumber(0x43), p.PacketNumber)
+	require.Nil(t, p.Ack)
+	require.Empty(t, p.StreamFrames)
+	require.Len(t, p.Frames, 2)
+	// the frame order is randomized
+	frames := []wire.Frame{p.Frames[0].Frame, p.Frames[1].Frame}
+	require.Contains(t, frames, &wire.PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}})
+	require.Contains(t, frames, &wire.PathResponseFrame{Data: [8]byte{8, 7, 6, 5, 4, 3, 2, 1}})
+	require.Len(t, buf.Data, protocol.MinInitialPacketSize)
+	require.True(t, p.IsPathProbePacket)
+	require.False(t, p.IsPathMTUProbePacket)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/packet_unpacker.go b/electron/native/private-transport/third_party/quic-go/packet_unpacker.go
new file mode 100644
index 000000000..0729636e2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/packet_unpacker.go
@@ -0,0 +1,222 @@
+package quic
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type headerDecryptor interface {
+	DecryptHeader(sample []byte, firstByte *byte, pnBytes []byte)
+}
+
+type headerParseError struct {
+	err error
+}
+
+func (e *headerParseError) Unwrap() error {
+	return e.err
+}
+
+func (e *headerParseError) Error() string {
+	return e.err.Error()
+}
+
+type unpackedPacket struct {
+	hdr             *wire.ExtendedHeader
+	encryptionLevel protocol.EncryptionLevel
+	data            []byte
+}
+
+// The packetUnpacker unpacks QUIC packets.
+type packetUnpacker struct {
+	cs handshake.CryptoSetup
+
+	shortHdrConnIDLen int
+}
+
+var _ unpacker = &packetUnpacker{}
+
+func newPacketUnpacker(cs handshake.CryptoSetup, shortHdrConnIDLen int) *packetUnpacker {
+	return &packetUnpacker{
+		cs:                cs,
+		shortHdrConnIDLen: shortHdrConnIDLen,
+	}
+}
+
+// UnpackLongHeader unpacks a Long Header packet.
+// If the reserved bits are invalid, the error is wire.ErrInvalidReservedBits.
+// If any other error occurred when parsing the header, the error is of type headerParseError.
+// If decrypting the payload fails for any reason, the error is the error returned by the AEAD.
+func (u *packetUnpacker) UnpackLongHeader(hdr *wire.Header, data []byte) (*unpackedPacket, error) {
+	var encLevel protocol.EncryptionLevel
+	var extHdr *wire.ExtendedHeader
+	var decrypted []byte
+	//nolint:exhaustive // Retry packets can't be unpacked.
+	switch hdr.Type {
+	case protocol.PacketTypeInitial:
+		encLevel = protocol.EncryptionInitial
+		opener, err := u.cs.GetInitialOpener()
+		if err != nil {
+			return nil, err
+		}
+		extHdr, decrypted, err = u.unpackLongHeaderPacket(opener, hdr, data)
+		if err != nil {
+			return nil, err
+		}
+	case protocol.PacketTypeHandshake:
+		encLevel = protocol.EncryptionHandshake
+		opener, err := u.cs.GetHandshakeOpener()
+		if err != nil {
+			return nil, err
+		}
+		extHdr, decrypted, err = u.unpackLongHeaderPacket(opener, hdr, data)
+		if err != nil {
+			return nil, err
+		}
+	case protocol.PacketType0RTT:
+		encLevel = protocol.Encryption0RTT
+		opener, err := u.cs.Get0RTTOpener()
+		if err != nil {
+			return nil, err
+		}
+		extHdr, decrypted, err = u.unpackLongHeaderPacket(opener, hdr, data)
+		if err != nil {
+			return nil, err
+		}
+	default:
+		return nil, fmt.Errorf("unknown packet type: %s", hdr.Type)
+	}
+
+	if len(decrypted) == 0 {
+		return nil, &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "empty packet",
+		}
+	}
+
+	return &unpackedPacket{
+		hdr:             extHdr,
+		encryptionLevel: encLevel,
+		data:            decrypted,
+	}, nil
+}
+
+func (u *packetUnpacker) UnpackShortHeader(rcvTime monotime.Time, data []byte) (protocol.PacketNumber, protocol.PacketNumberLen, protocol.KeyPhaseBit, []byte, error) {
+	opener, err := u.cs.Get1RTTOpener()
+	if err != nil {
+		return 0, 0, 0, nil, err
+	}
+	pn, pnLen, kp, decrypted, err := u.unpackShortHeaderPacket(opener, rcvTime, data)
+	if err != nil {
+		return 0, 0, 0, nil, err
+	}
+	if len(decrypted) == 0 {
+		return 0, 0, 0, nil, &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "empty packet",
+		}
+	}
+	return pn, pnLen, kp, decrypted, nil
+}
+
+func (u *packetUnpacker) unpackLongHeaderPacket(opener handshake.LongHeaderOpener, hdr *wire.Header, data []byte) (*wire.ExtendedHeader, []byte, error) {
+	extHdr, parseErr := u.unpackLongHeader(opener, hdr, data)
+	// If the reserved bits are set incorrectly, we still need to continue unpacking.
+	// This avoids a timing side-channel, which otherwise might allow an attacker
+	// to gain information about the header encryption.
+	if parseErr != nil && parseErr != wire.ErrInvalidReservedBits {
+		return nil, nil, parseErr
+	}
+	extHdrLen := extHdr.ParsedLen()
+	extHdr.PacketNumber = opener.DecodePacketNumber(extHdr.PacketNumber, extHdr.PacketNumberLen)
+	decrypted, err := opener.Open(data[extHdrLen:extHdrLen], data[extHdrLen:], extHdr.PacketNumber, data[:extHdrLen])
+	if err != nil {
+		return nil, nil, err
+	}
+	if parseErr != nil {
+		return nil, nil, parseErr
+	}
+	return extHdr, decrypted, nil
+}
+
+func (u *packetUnpacker) unpackShortHeaderPacket(opener handshake.ShortHeaderOpener, rcvTime monotime.Time, data []byte) (protocol.PacketNumber, protocol.PacketNumberLen, protocol.KeyPhaseBit, []byte, error) {
+	l, pn, pnLen, kp, parseErr := u.unpackShortHeader(opener, data)
+	// If the reserved bits are set incorrectly, we still need to continue unpacking.
+	// This avoids a timing side-channel, which otherwise might allow an attacker
+	// to gain information about the header encryption.
+	if parseErr != nil && parseErr != wire.ErrInvalidReservedBits {
+		return 0, 0, 0, nil, &headerParseError{parseErr}
+	}
+	pn = opener.DecodePacketNumber(pn, pnLen)
+	decrypted, err := opener.Open(data[l:l], data[l:], rcvTime, pn, kp, data[:l])
+	if err != nil {
+		return 0, 0, 0, nil, err
+	}
+	return pn, pnLen, kp, decrypted, parseErr
+}
+
+func (u *packetUnpacker) unpackShortHeader(hd headerDecryptor, data []byte) (int, protocol.PacketNumber, protocol.PacketNumberLen, protocol.KeyPhaseBit, error) {
+	hdrLen := 1 /* first header byte */ + u.shortHdrConnIDLen
+	if len(data) < hdrLen+4+16 {
+		return 0, 0, 0, 0, fmt.Errorf("packet too small, expected at least 20 bytes after the header, got %d", len(data)-hdrLen)
+	}
+	origPNBytes := make([]byte, 4)
+	copy(origPNBytes, data[hdrLen:hdrLen+4])
+	// 2. decrypt the header, assuming a 4 byte packet number
+	hd.DecryptHeader(
+		data[hdrLen+4:hdrLen+4+16],
+		&data[0],
+		data[hdrLen:hdrLen+4],
+	)
+	// 3. parse the header (and learn the actual length of the packet number)
+	l, pn, pnLen, kp, parseErr := wire.ParseShortHeader(data, u.shortHdrConnIDLen)
+	if parseErr != nil && parseErr != wire.ErrInvalidReservedBits {
+		return l, pn, pnLen, kp, parseErr
+	}
+	// 4. if the packet number is shorter than 4 bytes, replace the remaining bytes with the copy we saved earlier
+	if pnLen != protocol.PacketNumberLen4 {
+		copy(data[hdrLen+int(pnLen):hdrLen+4], origPNBytes[int(pnLen):])
+	}
+	return l, pn, pnLen, kp, parseErr
+}
+
+// The error is either nil, a wire.ErrInvalidReservedBits or of type headerParseError.
+func (u *packetUnpacker) unpackLongHeader(hd headerDecryptor, hdr *wire.Header, data []byte) (*wire.ExtendedHeader, error) {
+	extHdr, err := unpackLongHeader(hd, hdr, data)
+	if err != nil && err != wire.ErrInvalidReservedBits {
+		return nil, &headerParseError{err: err}
+	}
+	return extHdr, err
+}
+
+func unpackLongHeader(hd headerDecryptor, hdr *wire.Header, data []byte) (*wire.ExtendedHeader, error) {
+	hdrLen := hdr.ParsedLen()
+	if protocol.ByteCount(len(data)) < hdrLen+4+16 {
+		return nil, fmt.Errorf("packet too small, expected at least 20 bytes after the header, got %d", protocol.ByteCount(len(data))-hdrLen)
+	}
+	// The packet number can be up to 4 bytes long, but we won't know the length until we decrypt it.
+	// 1. save a copy of the 4 bytes
+	origPNBytes := make([]byte, 4)
+	copy(origPNBytes, data[hdrLen:hdrLen+4])
+	// 2. decrypt the header, assuming a 4 byte packet number
+	hd.DecryptHeader(
+		data[hdrLen+4:hdrLen+4+16],
+		&data[0],
+		data[hdrLen:hdrLen+4],
+	)
+	// 3. parse the header (and learn the actual length of the packet number)
+	extHdr, parseErr := hdr.ParseExtended(data)
+	if parseErr != nil && parseErr != wire.ErrInvalidReservedBits {
+		return nil, parseErr
+	}
+	// 4. if the packet number is shorter than 4 bytes, replace the remaining bytes with the copy we saved earlier
+	if extHdr.PacketNumberLen != protocol.PacketNumberLen4 {
+		copy(data[extHdr.ParsedLen():hdrLen+4], origPNBytes[int(extHdr.PacketNumberLen):])
+	}
+	return extHdr, parseErr
+}
diff --git a/electron/native/private-transport/third_party/quic-go/packet_unpacker_test.go b/electron/native/private-transport/third_party/quic-go/packet_unpacker_test.go
new file mode 100644
index 000000000..4fc234f13
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/packet_unpacker_test.go
@@ -0,0 +1,373 @@
+package quic
+
+import (
+	"crypto/rand"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/mocks"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+type decryptResult struct {
+	decrypted []byte
+	err       error
+}
+
+func TestUnpackLongHeaderPacket(t *testing.T) {
+	b := []byte("decrypted")
+
+	t.Run("Initial", func(t *testing.T) {
+		testUnpackLongHeaderPacket(t, protocol.EncryptionInitial, false, decryptResult{decrypted: b}, nil)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testUnpackLongHeaderPacket(t, protocol.EncryptionHandshake, false, decryptResult{decrypted: b}, nil)
+	})
+	t.Run("0-RTT", func(t *testing.T) {
+		testUnpackLongHeaderPacket(t, protocol.Encryption0RTT, false, decryptResult{decrypted: b}, nil)
+	})
+}
+
+func TestUnpackLongHeaderIncorrectReservedBits(t *testing.T) {
+	t.Run("decryption fails", func(t *testing.T) {
+		testUnpackLongHeaderIncorrectReservedBits(t, true)
+	})
+	t.Run("decryption succeeds", func(t *testing.T) {
+		testUnpackLongHeaderIncorrectReservedBits(t, false)
+	})
+}
+
+// Even if the reserved bits are wrong, we still need to continue processing the header.
+// This helps prevent a timing side-channel attack, see section 9.5 of RFC 9001.
+// We should only return a ErrInvalidReservedBits error if the decryption succeeds,
+// as this shows that the peer actually sent an invalid packet.
+// However, if decryption fails, this packet is likely injected by an attacker,
+// and we should treat it as any other undecryptable packet.
+func testUnpackLongHeaderIncorrectReservedBits(t *testing.T, decryptionSucceeds bool) {
+	decrypted := []byte("decrypted")
+	expectedErr := wire.ErrInvalidReservedBits
+	decryptResult := decryptResult{decrypted: decrypted}
+	if !decryptionSucceeds {
+		decryptResult.err = handshake.ErrDecryptionFailed
+		expectedErr = handshake.ErrDecryptionFailed
+	}
+
+	t.Run("Initial", func(t *testing.T) {
+		testUnpackLongHeaderPacket(t, protocol.EncryptionInitial, true, decryptResult, expectedErr)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testUnpackLongHeaderPacket(t, protocol.EncryptionHandshake, true, decryptResult, expectedErr)
+	})
+	t.Run("0-RTT", func(t *testing.T) {
+		testUnpackLongHeaderPacket(t, protocol.Encryption0RTT, true, decryptResult, expectedErr)
+	})
+}
+
+func TestUnpackLongHeaderEmptyPayload(t *testing.T) {
+	expectedErr := &qerr.TransportError{ErrorCode: qerr.ProtocolViolation}
+
+	t.Run("Initial", func(t *testing.T) {
+		testUnpackLongHeaderPacket(t, protocol.EncryptionInitial, false, decryptResult{}, expectedErr)
+	})
+
+	t.Run("Handshake", func(t *testing.T) {
+		testUnpackLongHeaderPacket(t, protocol.EncryptionHandshake, false, decryptResult{}, expectedErr)
+	})
+
+	t.Run("0-RTT", func(t *testing.T) {
+		testUnpackLongHeaderPacket(t, protocol.Encryption0RTT, false, decryptResult{}, expectedErr)
+	})
+}
+
+func testUnpackLongHeaderPacket(t *testing.T,
+	encLevel protocol.EncryptionLevel,
+	incorrectReservedBits bool,
+	decryptResult decryptResult,
+	expectedErr error,
+) {
+	mockCtrl := gomock.NewController(t)
+	cs := mocks.NewMockCryptoSetup(mockCtrl)
+	unpacker := newPacketUnpacker(cs, 4)
+
+	var packetType protocol.PacketType
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		packetType = protocol.PacketTypeInitial
+	case protocol.EncryptionHandshake:
+		packetType = protocol.PacketTypeHandshake
+	case protocol.Encryption0RTT:
+		packetType = protocol.PacketType0RTT
+	}
+
+	payload := []byte("Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.")
+	extHdr := &wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             packetType,
+			Length:           protocol.ByteCount(3 + len(payload)), // packet number len + payload
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+			Version:          protocol.Version1,
+		},
+		PacketNumber:    2,
+		PacketNumberLen: 3,
+	}
+	hdrRaw, err := extHdr.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	if incorrectReservedBits {
+		hdrRaw[0] |= 0xc
+	}
+	data := append(hdrRaw, payload...)
+	hdr, _, _, err := wire.ParsePacket(data)
+	require.NoError(t, err)
+
+	opener := mocks.NewMockLongHeaderOpener(mockCtrl)
+	var calls []any
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		calls = append(calls, cs.EXPECT().GetInitialOpener().Return(opener, nil))
+	case protocol.EncryptionHandshake:
+		calls = append(calls, cs.EXPECT().GetHandshakeOpener().Return(opener, nil))
+	case protocol.Encryption0RTT:
+		calls = append(calls, cs.EXPECT().Get0RTTOpener().Return(opener, nil))
+	}
+	calls = append(calls, []any{
+		opener.EXPECT().DecryptHeader(gomock.Any(), gomock.Any(), gomock.Any()),
+		opener.EXPECT().DecodePacketNumber(protocol.PacketNumber(2), protocol.PacketNumberLen3).Return(protocol.PacketNumber(1234)),
+		opener.EXPECT().Open(gomock.Any(), payload, protocol.PacketNumber(1234), hdrRaw).Return(
+			decryptResult.decrypted, decryptResult.err,
+		),
+	}...)
+	gomock.InOrder(calls...)
+
+	packet, err := unpacker.UnpackLongHeader(hdr, data)
+	if expectedErr != nil {
+		require.ErrorIs(t, err, expectedErr)
+		return
+	}
+	require.NoError(t, err)
+	require.Equal(t, encLevel, packet.encryptionLevel)
+	require.Equal(t, decryptResult.decrypted, packet.data)
+}
+
+func TestUnpackShortHeaderPacket(t *testing.T) {
+	testUnpackShortHeaderPacket(t, false, decryptResult{decrypted: []byte("decrypted")}, nil)
+}
+
+func TestUnpackShortHeaderEmptyPayload(t *testing.T) {
+	testUnpackShortHeaderPacket(t, false, decryptResult{}, &qerr.TransportError{ErrorCode: qerr.ProtocolViolation})
+}
+
+// Even if the reserved bits are wrong, we still need to continue processing the header.
+// This helps prevent a timing side-channel attack, see section 9.5 of RFC 9001.
+// We should only return a ErrInvalidReservedBits error if the decryption succeeds,
+// as this shows that the peer actually sent an invalid packet.
+// However, if decryption fails, this packet is likely injected by an attacker,
+// and we should treat it as any other undecryptable packet.
+func TestUnpackShortHeaderIncorrectReservedBits(t *testing.T) {
+	t.Run("decryption fails", func(t *testing.T) {
+		testUnpackShortHeaderPacket(t,
+			true,
+			decryptResult{err: handshake.ErrDecryptionFailed},
+			handshake.ErrDecryptionFailed,
+		)
+	})
+
+	t.Run("decryption succeeds", func(t *testing.T) {
+		testUnpackShortHeaderPacket(t,
+			true,
+			decryptResult{decrypted: []byte("decrypted")},
+			wire.ErrInvalidReservedBits,
+		)
+	})
+}
+
+func testUnpackShortHeaderPacket(t *testing.T, incorrectReservedBits bool, decryptResult decryptResult, expectedErr error) {
+	mockCtrl := gomock.NewController(t)
+	connID := protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5})
+	cs := mocks.NewMockCryptoSetup(mockCtrl)
+	unpacker := newPacketUnpacker(cs, connID.Len())
+	payload := []byte("Lorem ipsum dolor sit amet")
+
+	hdrRaw, err := wire.AppendShortHeader(
+		nil,
+		connID,
+		0x1337,
+		protocol.PacketNumberLen3,
+		protocol.KeyPhaseOne,
+	)
+	require.NoError(t, err)
+	if incorrectReservedBits {
+		hdrRaw[0] |= 0x18
+	}
+	opener := mocks.NewMockShortHeaderOpener(mockCtrl)
+	opener.EXPECT().DecryptHeader(gomock.Any(), gomock.Any(), gomock.Any())
+	cs.EXPECT().Get1RTTOpener().Return(opener, nil)
+	opener.EXPECT().DecodePacketNumber(gomock.Any(), gomock.Any()).Return(protocol.PacketNumber(1234))
+	opener.EXPECT().Open(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(
+		decryptResult.decrypted, decryptResult.err,
+	)
+	pn, pnLen, kp, data, err := unpacker.UnpackShortHeader(monotime.Now(), append(hdrRaw, payload...))
+	if expectedErr != nil {
+		require.ErrorIs(t, err, expectedErr)
+		return
+	}
+	require.NoError(t, err)
+	require.Equal(t, decryptResult.decrypted, data)
+	require.Equal(t, protocol.PacketNumber(1234), pn)
+	require.Equal(t, protocol.PacketNumberLen3, pnLen)
+	require.Equal(t, protocol.KeyPhaseOne, kp)
+}
+
+func TestUnpackHeaderSampleLongHeader(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cs := mocks.NewMockCryptoSetup(mockCtrl)
+	unpacker := newPacketUnpacker(cs, 4)
+
+	extHdr := &wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             protocol.PacketTypeHandshake,
+			DestConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+			Version:          protocol.Version1,
+		},
+		PacketNumber:    1337,
+		PacketNumberLen: protocol.PacketNumberLen2,
+	}
+	data, err := extHdr.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	b := make([]byte, 2+16) // 2 bytes to fill up the packet number, 16 bytes for the sample
+	rand.Read(b)
+	data = append(data, b...)
+	hdr, _, _, err := wire.ParsePacket(data)
+	require.NoError(t, err)
+
+	t.Run("too short", func(t *testing.T) {
+		cs.EXPECT().GetHandshakeOpener().Return(mocks.NewMockLongHeaderOpener(mockCtrl), nil)
+		_, err = unpacker.UnpackLongHeader(hdr, data[:len(data)-1])
+		require.IsType(t, &headerParseError{}, err)
+		require.ErrorContains(t, err, "packet too small, expected at least 20 bytes after the header, got 19")
+	})
+
+	t.Run("minimal size", func(t *testing.T) {
+		opener := mocks.NewMockLongHeaderOpener(mockCtrl)
+		cs.EXPECT().GetHandshakeOpener().Return(opener, nil)
+		opener.EXPECT().DecryptHeader(b[len(b)-16:], gomock.Any(), gomock.Any())
+		opener.EXPECT().DecodePacketNumber(gomock.Any(), gomock.Any()).Return(protocol.PacketNumber(1337))
+		opener.EXPECT().Open(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return([]byte("decrypted"), nil)
+		_, err = unpacker.UnpackLongHeader(hdr, data)
+		require.NoError(t, err)
+	})
+}
+
+func TestUnpackHeaderSampleShortHeader(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cs := mocks.NewMockCryptoSetup(mockCtrl)
+	unpacker := newPacketUnpacker(cs, 4)
+
+	data, err := wire.AppendShortHeader(
+		nil,
+		protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		1337,
+		protocol.PacketNumberLen2,
+		protocol.KeyPhaseOne,
+	)
+	require.NoError(t, err)
+	b := make([]byte, 2+16) // 2 bytes to fill up the packet number, 16 bytes for the sample
+	rand.Read(b)
+	data = append(data, b...)
+
+	t.Run("too short", func(t *testing.T) {
+		cs.EXPECT().Get1RTTOpener().Return(mocks.NewMockShortHeaderOpener(mockCtrl), nil)
+		_, _, _, _, err = unpacker.UnpackShortHeader(monotime.Now(), data[:len(data)-1])
+		require.IsType(t, &headerParseError{}, err)
+		require.ErrorContains(t, err, "packet too small, expected at least 20 bytes after the header, got 19")
+	})
+
+	t.Run("minimal size", func(t *testing.T) {
+		opener := mocks.NewMockShortHeaderOpener(mockCtrl)
+		cs.EXPECT().Get1RTTOpener().Return(opener, nil)
+		opener.EXPECT().DecryptHeader(data[len(data)-16:], gomock.Any(), gomock.Any())
+		opener.EXPECT().DecodePacketNumber(gomock.Any(), gomock.Any()).Return(protocol.PacketNumber(1337))
+		opener.EXPECT().Open(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return([]byte("decrypted"), nil)
+		_, _, _, _, err = unpacker.UnpackShortHeader(monotime.Now(), data)
+		require.NoError(t, err)
+	})
+}
+
+func TestUnpackErrors(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cs := mocks.NewMockCryptoSetup(mockCtrl)
+	unpacker := newPacketUnpacker(cs, 4)
+
+	// opener not available
+	cs.EXPECT().GetHandshakeOpener().Return(nil, handshake.ErrKeysNotYetAvailable)
+	_, err := unpacker.UnpackLongHeader(&wire.Header{Type: protocol.PacketTypeHandshake}, []byte("foobar"))
+	require.ErrorIs(t, err, handshake.ErrKeysNotYetAvailable)
+
+	// opener returns error
+	opener := mocks.NewMockLongHeaderOpener(mockCtrl)
+	cs.EXPECT().GetHandshakeOpener().Return(opener, nil)
+	opener.EXPECT().DecryptHeader(gomock.Any(), gomock.Any(), gomock.Any())
+	opener.EXPECT().DecodePacketNumber(gomock.Any(), gomock.Any()).Return(protocol.PacketNumber(1234))
+	opener.EXPECT().Open(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(nil, &qerr.TransportError{ErrorCode: qerr.CryptoBufferExceeded})
+	_, err = unpacker.UnpackLongHeader(&wire.Header{Type: protocol.PacketTypeHandshake}, make([]byte, 100))
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.CryptoBufferExceeded})
+}
+
+func TestUnpackHeaderDecryption(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	cs := mocks.NewMockCryptoSetup(mockCtrl)
+	unpacker := newPacketUnpacker(cs, 4)
+	connID := protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef})
+
+	extHdr := &wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             protocol.PacketTypeHandshake,
+			Length:           2, // packet number len
+			DestConnectionID: connID,
+			Version:          protocol.Version1,
+		},
+		PacketNumber:    0x1337,
+		PacketNumberLen: protocol.PacketNumberLen2,
+	}
+	hdrRaw, err := extHdr.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	hdr, _, _, err := wire.ParsePacket(hdrRaw)
+	require.NoError(t, err)
+
+	origHdrRaw := append([]byte{}, hdrRaw...) // save a copy of the header
+	firstHdrByte := hdrRaw[0]
+	hdrRaw[0] ^= 0xff             // invert the first byte
+	hdrRaw[len(hdrRaw)-2] ^= 0xff // invert the packet number
+	hdrRaw[len(hdrRaw)-1] ^= 0xff // invert the packet number
+	require.NotEqual(t, hdrRaw[0], firstHdrByte)
+
+	opener := mocks.NewMockLongHeaderOpener(mockCtrl)
+	cs.EXPECT().GetHandshakeOpener().Return(opener, nil)
+	gomock.InOrder(
+		// we're using a 2 byte packet number, so the sample starts at the 3rd payload byte
+		opener.EXPECT().DecryptHeader(
+			[]byte{3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18},
+			&hdrRaw[0],
+			append(hdrRaw[len(hdrRaw)-2:], []byte{1, 2}...)).Do(func(_ []byte, firstByte *byte, pnBytes []byte) {
+			*firstByte ^= 0xff // invert the first byte back
+			for i := range pnBytes {
+				pnBytes[i] ^= 0xff // invert the packet number bytes
+			}
+		}),
+		opener.EXPECT().DecodePacketNumber(protocol.PacketNumber(0x1337), protocol.PacketNumberLen2).Return(protocol.PacketNumber(0x7331)),
+		opener.EXPECT().Open(gomock.Any(), gomock.Any(), protocol.PacketNumber(0x7331), origHdrRaw).Return([]byte{0}, nil),
+	)
+
+	data := hdrRaw
+	for i := 1; i <= 100; i++ {
+		data = append(data, uint8(i))
+	}
+	packet, err := unpacker.UnpackLongHeader(hdr, data)
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketNumber(0x7331), packet.hdr.PacketNumber)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/path_manager.go b/electron/native/private-transport/third_party/quic-go/path_manager.go
new file mode 100644
index 000000000..dd188ea14
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/path_manager.go
@@ -0,0 +1,206 @@
+package quic
+
+import (
+	"crypto/rand"
+	"net"
+	"slices"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type pathID int64
+
+const invalidPathID pathID = -1
+
+// Maximum number of paths to keep track of.
+// If the peer probes another path (before the pathTimeout of an existing path expires),
+// this probing attempt is ignored.
+const maxPaths = 3
+
+// If no packet is received for a path for pathTimeout,
+// the path can be evicted when the peer probes another path.
+// This prevents an attacker from churning through paths by duplicating packets and
+// sending them with spoofed source addresses.
+const pathTimeout = 5 * time.Second
+
+type path struct {
+	id             pathID
+	addr           net.Addr
+	lastPacketTime monotime.Time
+	pathChallenge  [8]byte
+	validated      bool
+	rcvdNonProbing bool
+}
+
+type pathManager struct {
+	nextPathID pathID
+	// ordered by lastPacketTime, with the most recently used path at the end
+	paths []*path
+
+	getConnID    func(pathID) (_ protocol.ConnectionID, ok bool)
+	retireConnID func(pathID)
+
+	logger utils.Logger
+}
+
+func newPathManager(
+	getConnID func(pathID) (_ protocol.ConnectionID, ok bool),
+	retireConnID func(pathID),
+	logger utils.Logger,
+) *pathManager {
+	return &pathManager{
+		paths:        make([]*path, 0, maxPaths+1),
+		getConnID:    getConnID,
+		retireConnID: retireConnID,
+		logger:       logger,
+	}
+}
+
+// Returns a path challenge frame if one should be sent.
+// May return nil.
+func (pm *pathManager) HandlePacket(
+	remoteAddr net.Addr,
+	t monotime.Time,
+	pathChallenge *wire.PathChallengeFrame, // may be nil if the packet didn't contain a PATH_CHALLENGE
+	isNonProbing bool,
+) (_ protocol.ConnectionID, _ []ackhandler.Frame, shouldSwitch bool) {
+	var p *path
+	for i, path := range pm.paths {
+		if addrsEqual(path.addr, remoteAddr) {
+			p = path
+			p.lastPacketTime = t
+			// already sent a PATH_CHALLENGE for this path
+			if isNonProbing {
+				path.rcvdNonProbing = true
+			}
+			if pm.logger.Debug() {
+				pm.logger.Debugf("received packet for path %s that was already probed, validated: %t", remoteAddr, path.validated)
+			}
+			shouldSwitch = path.validated && path.rcvdNonProbing
+			if i != len(pm.paths)-1 {
+				// move the path to the end of the list
+				pm.paths = slices.Delete(pm.paths, i, i+1)
+				pm.paths = append(pm.paths, p)
+			}
+			if pathChallenge == nil {
+				return protocol.ConnectionID{}, nil, shouldSwitch
+			}
+		}
+	}
+
+	if len(pm.paths) >= maxPaths {
+		if pm.paths[0].lastPacketTime.Add(pathTimeout).After(t) {
+			if pm.logger.Debug() {
+				pm.logger.Debugf("received packet for previously unseen path %s, but already have %d paths", remoteAddr, len(pm.paths))
+			}
+			return protocol.ConnectionID{}, nil, shouldSwitch
+		}
+		// evict the oldest path, if the last packet was received more than pathTimeout ago
+		pm.retireConnID(pm.paths[0].id)
+		pm.paths = pm.paths[1:]
+	}
+
+	var pathID pathID
+	if p != nil {
+		pathID = p.id
+	} else {
+		pathID = pm.nextPathID
+	}
+
+	// previously unseen path, initiate path validation by sending a PATH_CHALLENGE
+	connID, ok := pm.getConnID(pathID)
+	if !ok {
+		pm.logger.Debugf("skipping validation of new path %s since no connection ID is available", remoteAddr)
+		return protocol.ConnectionID{}, nil, shouldSwitch
+	}
+
+	frames := make([]ackhandler.Frame, 0, 2)
+	if p == nil {
+		var pathChallengeData [8]byte
+		rand.Read(pathChallengeData[:])
+		p = &path{
+			id:             pm.nextPathID,
+			addr:           remoteAddr,
+			lastPacketTime: t,
+			rcvdNonProbing: isNonProbing,
+			pathChallenge:  pathChallengeData,
+		}
+		pm.nextPathID++
+		pm.paths = append(pm.paths, p)
+		frames = append(frames, ackhandler.Frame{
+			Frame:   &wire.PathChallengeFrame{Data: p.pathChallenge},
+			Handler: (*pathManagerAckHandler)(pm),
+		})
+		pm.logger.Debugf("enqueueing PATH_CHALLENGE for new path %s", remoteAddr)
+	}
+	if pathChallenge != nil {
+		frames = append(frames, ackhandler.Frame{
+			Frame:   &wire.PathResponseFrame{Data: pathChallenge.Data},
+			Handler: (*pathManagerAckHandler)(pm),
+		})
+	}
+	return connID, frames, shouldSwitch
+}
+
+func (pm *pathManager) HandlePathResponseFrame(f *wire.PathResponseFrame) {
+	for _, p := range pm.paths {
+		if f.Data == p.pathChallenge {
+			// path validated
+			p.validated = true
+			pm.logger.Debugf("path %s validated", p.addr)
+			break
+		}
+	}
+}
+
+// SwitchToPath is called when the connection switches to a new path
+func (pm *pathManager) SwitchToPath(addr net.Addr) {
+	// retire all other paths
+	for _, path := range pm.paths {
+		if addrsEqual(path.addr, addr) {
+			pm.logger.Debugf("switching to path %d (%s)", path.id, addr)
+			continue
+		}
+		pm.retireConnID(path.id)
+	}
+	clear(pm.paths)
+	pm.paths = pm.paths[:0]
+}
+
+type pathManagerAckHandler pathManager
+
+var _ ackhandler.FrameHandler = &pathManagerAckHandler{}
+
+// Acknowledging the frame doesn't validate the path, only receiving the PATH_RESPONSE does.
+func (pm *pathManagerAckHandler) OnAcked(f wire.Frame) {}
+
+func (pm *pathManagerAckHandler) OnLost(f wire.Frame) {
+	pc, ok := f.(*wire.PathChallengeFrame)
+	if !ok {
+		return
+	}
+	for i, path := range pm.paths {
+		if path.pathChallenge == pc.Data {
+			pm.paths = slices.Delete(pm.paths, i, i+1)
+			pm.retireConnID(path.id)
+			break
+		}
+	}
+}
+
+func addrsEqual(addr1, addr2 net.Addr) bool {
+	if addr1 == nil || addr2 == nil {
+		return false
+	}
+	a1, ok1 := addr1.(*net.UDPAddr)
+	a2, ok2 := addr2.(*net.UDPAddr)
+	if ok1 && ok2 {
+		return a1.IP.Equal(a2.IP) && a1.Port == a2.Port
+	}
+	return addr1.String() == addr2.String()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/path_manager_outgoing.go b/electron/native/private-transport/third_party/quic-go/path_manager_outgoing.go
new file mode 100644
index 000000000..e3775684a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/path_manager_outgoing.go
@@ -0,0 +1,311 @@
+package quic
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"slices"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+var (
+	// ErrPathClosed can be returned by [Path.Probe] or [Path.Switch] after the path has been closed.
+	ErrPathClosed = errors.New("path closed")
+	// ErrPathNotValidated is returned by [Path.Switch] when the path has not yet been validated.
+	ErrPathNotValidated = errors.New("path not yet validated")
+)
+
+var errPathDoesNotExist = errors.New("path does not exist")
+
+// Path is a network path.
+type Path struct {
+	id          pathID
+	pathManager *pathManagerOutgoing
+	tr          *Transport
+	initialRTT  time.Duration
+
+	enablePath func()
+	validated  atomic.Bool
+	abandon    chan struct{}
+}
+
+func (p *Path) Probe(ctx context.Context) error {
+	path := p.pathManager.addPath(p, p.enablePath)
+
+	p.pathManager.enqueueProbe(p)
+	nextProbeDur := p.initialRTT
+	var timer *time.Timer
+	var timerChan <-chan time.Time
+	for {
+		select {
+		case <-ctx.Done():
+			return context.Cause(ctx)
+		case <-path.Validated():
+			p.validated.Store(true)
+			return nil
+		case <-timerChan:
+			nextProbeDur *= 2 // exponential backoff
+			p.pathManager.enqueueProbe(p)
+		case <-path.ProbeSent():
+		case <-p.abandon:
+			return ErrPathClosed
+		}
+
+		if timer != nil {
+			timer.Stop()
+		}
+		timer = time.NewTimer(nextProbeDur)
+		timerChan = timer.C
+	}
+}
+
+// Switch switches the QUIC connection to this path.
+// It immediately stops sending on the old path, and sends on this new path.
+func (p *Path) Switch() error {
+	if err := p.pathManager.switchToPath(p.id); err != nil {
+		switch {
+		case errors.Is(err, ErrPathNotValidated):
+			return err
+		case errors.Is(err, errPathDoesNotExist) && !p.validated.Load():
+			select {
+			case <-p.abandon:
+				return ErrPathClosed
+			default:
+				return ErrPathNotValidated
+			}
+		default:
+			return ErrPathClosed
+		}
+	}
+	return nil
+}
+
+// Close abandons a path.
+// It is not possible to close the path that’s currently active.
+// After closing, the path cannot be successfully probed again with [Path.Probe].
+func (p *Path) Close() error {
+	select {
+	case <-p.abandon:
+		return nil
+	default:
+	}
+
+	if err := p.pathManager.removePath(p.id); err != nil {
+		return err
+	}
+	close(p.abandon)
+	return nil
+}
+
+type pathOutgoing struct {
+	pathChallenges [][8]byte // length is implicitly limited by exponential backoff
+	tr             *Transport
+	isValidated    bool
+	probeSent      chan struct{} // receives when a PATH_CHALLENGE is sent
+	validated      chan struct{} // closed when the path the corresponding PATH_RESPONSE is received
+	enablePath     func()
+}
+
+func (p *pathOutgoing) ProbeSent() <-chan struct{} { return p.probeSent }
+func (p *pathOutgoing) Validated() <-chan struct{} { return p.validated }
+
+type pathManagerOutgoing struct {
+	getConnID       func(pathID) (_ protocol.ConnectionID, ok bool)
+	retireConnID    func(pathID)
+	scheduleSending func()
+
+	mx             sync.Mutex
+	activePath     pathID
+	pathsToProbe   []pathID
+	paths          map[pathID]*pathOutgoing
+	nextPathID     pathID
+	pathToSwitchTo *pathOutgoing
+}
+
+// newPathManagerOutgoing creates a new pathManagerOutgoing object. This
+// function must be side-effect free as it may be called multiple times for a
+// single connection.
+func newPathManagerOutgoing(
+	getConnID func(pathID) (_ protocol.ConnectionID, ok bool),
+	retireConnID func(pathID),
+	scheduleSending func(),
+) *pathManagerOutgoing {
+	return &pathManagerOutgoing{
+		activePath:      0, // at initialization time, we're guaranteed to be using the handshake path
+		nextPathID:      1,
+		getConnID:       getConnID,
+		retireConnID:    retireConnID,
+		scheduleSending: scheduleSending,
+		paths:           make(map[pathID]*pathOutgoing, 4),
+	}
+}
+
+func (pm *pathManagerOutgoing) addPath(p *Path, enablePath func()) *pathOutgoing {
+	pm.mx.Lock()
+	defer pm.mx.Unlock()
+
+	// path might already exist, and just being re-probed
+	if existingPath, ok := pm.paths[p.id]; ok {
+		existingPath.validated = make(chan struct{})
+		return existingPath
+	}
+
+	path := &pathOutgoing{
+		tr:         p.tr,
+		probeSent:  make(chan struct{}, 1),
+		validated:  make(chan struct{}),
+		enablePath: enablePath,
+	}
+	pm.paths[p.id] = path
+	return path
+}
+
+func (pm *pathManagerOutgoing) enqueueProbe(p *Path) {
+	pm.mx.Lock()
+	pm.pathsToProbe = append(pm.pathsToProbe, p.id)
+	pm.mx.Unlock()
+	pm.scheduleSending()
+}
+
+func (pm *pathManagerOutgoing) removePath(id pathID) error {
+	if err := pm.removePathImpl(id); err != nil {
+		return err
+	}
+	pm.scheduleSending()
+	return nil
+}
+
+func (pm *pathManagerOutgoing) removePathImpl(id pathID) error {
+	pm.mx.Lock()
+	defer pm.mx.Unlock()
+
+	if id == pm.activePath {
+		return errors.New("cannot close active path")
+	}
+	if _, ok := pm.paths[id]; !ok {
+		return nil
+	}
+	pm.retireConnID(id)
+	delete(pm.paths, id)
+	return nil
+}
+
+func (pm *pathManagerOutgoing) switchToPath(id pathID) error {
+	pm.mx.Lock()
+	defer pm.mx.Unlock()
+
+	p, ok := pm.paths[id]
+	if !ok {
+		return errPathDoesNotExist
+	}
+	if !p.isValidated {
+		return ErrPathNotValidated
+	}
+	pm.pathToSwitchTo = p
+	pm.activePath = id
+	return nil
+}
+
+func (pm *pathManagerOutgoing) NewPath(t *Transport, initialRTT time.Duration, enablePath func()) *Path {
+	pm.mx.Lock()
+	defer pm.mx.Unlock()
+
+	id := pm.nextPathID
+	pm.nextPathID++
+	return &Path{
+		pathManager: pm,
+		id:          id,
+		tr:          t,
+		enablePath:  enablePath,
+		initialRTT:  initialRTT,
+		abandon:     make(chan struct{}),
+	}
+}
+
+func (pm *pathManagerOutgoing) NextPathToProbe() (_ protocol.ConnectionID, _ ackhandler.Frame, _ *Transport, hasPath bool) {
+	pm.mx.Lock()
+	defer pm.mx.Unlock()
+
+	var p *pathOutgoing
+	id := invalidPathID
+	for _, pID := range pm.pathsToProbe {
+		var ok bool
+		p, ok = pm.paths[pID]
+		if ok {
+			id = pID
+			break
+		}
+		// if the path doesn't exist in the map, it might have been abandoned
+		pm.pathsToProbe = pm.pathsToProbe[1:]
+	}
+	if id == invalidPathID {
+		return protocol.ConnectionID{}, ackhandler.Frame{}, nil, false
+	}
+
+	connID, ok := pm.getConnID(id)
+	if !ok {
+		return protocol.ConnectionID{}, ackhandler.Frame{}, nil, false
+	}
+
+	var b [8]byte
+	_, _ = rand.Read(b[:])
+	p.pathChallenges = append(p.pathChallenges, b)
+
+	pm.pathsToProbe = pm.pathsToProbe[1:]
+	p.enablePath()
+	select {
+	case p.probeSent <- struct{}{}:
+	default:
+	}
+	frame := ackhandler.Frame{
+		Frame:   &wire.PathChallengeFrame{Data: b},
+		Handler: (*pathManagerOutgoingAckHandler)(pm),
+	}
+	return connID, frame, p.tr, true
+}
+
+func (pm *pathManagerOutgoing) HandlePathResponseFrame(f *wire.PathResponseFrame) {
+	pm.mx.Lock()
+	defer pm.mx.Unlock()
+
+	for _, p := range pm.paths {
+		if slices.Contains(p.pathChallenges, f.Data) {
+			// path validated
+			if !p.isValidated {
+				// make sure that duplicate PATH_RESPONSE frames are ignored
+				p.isValidated = true
+				p.pathChallenges = nil
+				close(p.validated)
+			}
+			break
+		}
+	}
+}
+
+func (pm *pathManagerOutgoing) ShouldSwitchPath() (*Transport, bool) {
+	pm.mx.Lock()
+	defer pm.mx.Unlock()
+
+	if pm.pathToSwitchTo == nil {
+		return nil, false
+	}
+	p := pm.pathToSwitchTo
+	pm.pathToSwitchTo = nil
+	return p.tr, true
+}
+
+type pathManagerOutgoingAckHandler pathManagerOutgoing
+
+var _ ackhandler.FrameHandler = &pathManagerOutgoingAckHandler{}
+
+// OnAcked is called when the PATH_CHALLENGE is acked.
+// This doesn't validate the path, only receiving the PATH_RESPONSE does.
+func (pm *pathManagerOutgoingAckHandler) OnAcked(wire.Frame) {}
+
+func (pm *pathManagerOutgoingAckHandler) OnLost(wire.Frame) {}
diff --git a/electron/native/private-transport/third_party/quic-go/path_manager_outgoing_test.go b/electron/native/private-transport/third_party/quic-go/path_manager_outgoing_test.go
new file mode 100644
index 000000000..f09980b7c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/path_manager_outgoing_test.go
@@ -0,0 +1,330 @@
+package quic
+
+import (
+	"context"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPathManagerOutgoingPathProbing(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		connIDs := []protocol.ConnectionID{
+			protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+		}
+		pm := newPathManagerOutgoing(
+			func(id pathID) (protocol.ConnectionID, bool) {
+				connID := connIDs[0]
+				connIDs = connIDs[1:]
+				return connID, true
+			},
+			func(id pathID) { t.Fatal("didn't expect any connection ID to be retired") },
+			func() {},
+		)
+
+		_, _, _, ok := pm.NextPathToProbe()
+		require.False(t, ok)
+
+		tr1 := &Transport{}
+		var enabled bool
+		p := pm.NewPath(tr1, time.Second, func() { enabled = true })
+		require.ErrorIs(t, p.Switch(), ErrPathNotValidated)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- p.Probe(context.Background()) }()
+
+		// wait for the path to be queued for probing
+		synctest.Wait()
+
+		require.False(t, enabled)
+		connID, f, tr, ok := pm.NextPathToProbe()
+		require.True(t, ok)
+		require.Equal(t, tr1, tr)
+		require.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}), connID)
+		require.IsType(t, &wire.PathChallengeFrame{}, f.Frame)
+		pc := f.Frame.(*wire.PathChallengeFrame)
+		require.True(t, enabled)
+
+		_, _, _, ok = pm.NextPathToProbe()
+		require.False(t, ok)
+
+		select {
+		case <-errChan:
+			t.Fatal("should still be probing")
+		default:
+		}
+
+		// acking the frame doesn't complete path validation...
+		f.Handler.OnAcked(f.Frame)
+		select {
+		case <-errChan:
+			t.Fatal("should still be probing")
+		default:
+		}
+
+		require.ErrorIs(t, p.Switch(), ErrPathNotValidated)
+		_, ok = pm.ShouldSwitchPath()
+		require.False(t, ok)
+
+		// ... neither does receiving a random PATH_RESPONSE...
+		pm.HandlePathResponseFrame(&wire.PathResponseFrame{Data: [8]byte{'f', 'o', 'o', 'f', 'o', 'o'}})
+		f.Handler.OnAcked(f.Frame) // doesn't do anything
+		f.Handler.OnLost(f.Frame)  // doesn't do anything
+		select {
+		case <-errChan:
+			t.Fatal("should still be probing")
+		default:
+		}
+
+		// ... only receiving the corresponding PATH_RESPONSE does
+		pm.HandlePathResponseFrame(&wire.PathResponseFrame{Data: pc.Data})
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("timeout")
+		}
+
+		// receiving it multiple times is ok
+		pm.HandlePathResponseFrame(&wire.PathResponseFrame{Data: pc.Data})
+
+		// now switch to the other path
+		_, ok = pm.ShouldSwitchPath()
+		require.False(t, ok)
+		require.NoError(t, p.Switch())
+		// the active path can't be closed
+		require.EqualError(t, p.Close(), "cannot close active path")
+		switchToTransport, ok := pm.ShouldSwitchPath()
+		require.True(t, ok)
+		require.Equal(t, tr1, switchToTransport)
+	})
+}
+
+func TestPathManagerOutgoingRetransmissions(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		connIDs := []protocol.ConnectionID{
+			protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+			protocol.ParseConnectionID([]byte{2, 3, 4, 5, 6, 7, 8, 9}),
+		}
+		var retiredConnIDs []protocol.ConnectionID
+		scheduledSending := make(chan struct{}, 20)
+		pm := newPathManagerOutgoing(
+			func(id pathID) (protocol.ConnectionID, bool) { return connIDs[id], true },
+			func(id pathID) { retiredConnIDs = append(retiredConnIDs, connIDs[id]) },
+			func() { scheduledSending <- struct{}{} },
+		)
+
+		_, _, _, ok := pm.NextPathToProbe()
+		require.False(t, ok)
+
+		tr1 := &Transport{}
+		const initialRTT = 5 * time.Millisecond
+		p := pm.NewPath(tr1, initialRTT, func() {})
+
+		pathChallengeChan := make(chan [8]byte)
+		done := make(chan struct{})
+		defer close(done)
+		go func() {
+			for {
+				select {
+				case <-scheduledSending:
+				case <-done:
+					return
+				}
+				_, f, _, ok := pm.NextPathToProbe()
+				if !ok {
+					// should never happen
+					pathChallengeChan <- [8]byte{}
+					continue
+				}
+				pathChallengeChan <- f.Frame.(*wire.PathChallengeFrame).Data
+			}
+		}()
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- p.Probe(context.Background()) }()
+
+		start := time.Now()
+		type result struct {
+			pc   *[8]byte
+			took time.Duration
+		}
+		var results []result
+		for range 4 {
+			select {
+			case <-errChan:
+				t.Fatal("probing should not have completed")
+			case pc := <-pathChallengeChan:
+				results = append(results, result{pc: &pc, took: time.Since(start)})
+			case <-time.After(time.Second):
+				t.Fatal("timeout")
+			}
+		}
+
+		for i, r1 := range results {
+			require.NotNil(t, r1.pc)
+			if i > 0 {
+				took := r1.took - results[i-1].took
+				t.Log("took", took)
+				require.Equal(t, took, initialRTT<<(i-1))
+			}
+			for j, r2 := range results {
+				if i == j {
+					continue
+				}
+				require.NotEqual(t, r1.pc, r2.pc)
+			}
+		}
+
+		// receiving a PATH_RESPONSE for any of the PATH_CHALLENGES completes path validation
+		pm.HandlePathResponseFrame(&wire.PathResponseFrame{Data: *results[2].pc})
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("probing should have completed")
+		}
+
+		// It is valid to probe again
+		results = results[:0]
+		ctx, cancel := context.WithCancel(context.Background())
+		go func() { errChan <- p.Probe(ctx) }()
+
+		synctest.Wait()
+
+		for range 2 {
+			select {
+			case err := <-errChan:
+				require.NoError(t, err)
+			case pc := <-pathChallengeChan:
+				results = append(results, result{pc: &pc, took: time.Since(start)})
+			case <-time.After(time.Second):
+				t.Fatal("should have received a path challenge")
+			}
+		}
+		// this time, don't receive a PATH_RESPONSE
+		cancel()
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, context.Canceled)
+		default:
+			t.Fatal("should have received a context canceled error")
+		}
+	})
+}
+
+func TestPathManagerOutgoingAbandonPath(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		connIDs := []protocol.ConnectionID{
+			protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+		}
+		var retiredPaths []pathID
+		pm := newPathManagerOutgoing(
+			func(id pathID) (protocol.ConnectionID, bool) {
+				connID := connIDs[0]
+				connIDs = connIDs[1:]
+				return connID, true
+			},
+			func(id pathID) { retiredPaths = append(retiredPaths, id) },
+			func() {},
+		)
+
+		// path abandoned before the PATH_CHALLENGE is sent out
+		p1 := pm.NewPath(&Transport{}, time.Second, func() {})
+		errChan := make(chan error, 1)
+		go func() { errChan <- p1.Probe(context.Background()) }()
+
+		// wait for the path to be queued for probing
+		synctest.Wait()
+
+		require.NoError(t, p1.Close())
+		// closing the path multiple times is ok
+		require.NoError(t, p1.Close())
+		require.NoError(t, p1.Close())
+		_, _, _, ok := pm.NextPathToProbe()
+		require.False(t, ok)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, ErrPathClosed)
+		default:
+			t.Fatal("should have received a path closed error")
+		}
+		require.Equal(t, []pathID{p1.id}, retiredPaths)
+
+		p2 := pm.NewPath(&Transport{}, time.Second, func() {})
+		go func() { errChan <- p2.Probe(context.Background()) }()
+
+		// wait for the path to be queued for probing
+		synctest.Wait()
+
+		connID, f, _, ok := pm.NextPathToProbe()
+		require.True(t, ok)
+		require.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}), connID)
+
+		require.NoError(t, p2.Close())
+		require.Equal(t, []pathID{p1.id, p2.id}, retiredPaths)
+		pm.HandlePathResponseFrame(&wire.PathResponseFrame{Data: f.Frame.(*wire.PathChallengeFrame).Data})
+		_, _, _, ok = pm.NextPathToProbe()
+		require.False(t, ok)
+		// it's not possible to switch to an abandoned path
+		require.ErrorIs(t, p2.Switch(), ErrPathClosed)
+	})
+}
+
+// TestPathManagerOutgoingAbandonValidatedPath tests that closing a path that has
+// already been validated retires the connection ID allocated to it.
+// TestPathManagerOutgoingAbandonPath covers closing a path before validation,
+// which is a different case: pathChallenges is cleared once the path validates.
+func TestPathManagerOutgoingAbandonValidatedPath(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		connIDs := []protocol.ConnectionID{
+			protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+		}
+		var retiredPaths []pathID
+		pm := newPathManagerOutgoing(
+			func(id pathID) (protocol.ConnectionID, bool) {
+				if len(connIDs) == 0 {
+					return protocol.ConnectionID{}, false
+				}
+				connID := connIDs[0]
+				connIDs = connIDs[1:]
+				return connID, true
+			},
+			func(id pathID) { retiredPaths = append(retiredPaths, id) },
+			func() {},
+		)
+
+		p := pm.NewPath(&Transport{}, time.Second, func() {})
+		errChan := make(chan error, 1)
+		go func() { errChan <- p.Probe(context.Background()) }()
+		synctest.Wait()
+
+		_, f, _, ok := pm.NextPathToProbe()
+		require.True(t, ok)
+
+		// Validate the path before abandoning it. This is the ordering an
+		// application produces: probe, use the path, and abandon it later.
+		pm.HandlePathResponseFrame(&wire.PathResponseFrame{Data: f.Frame.(*wire.PathChallengeFrame).Data})
+		synctest.Wait()
+		require.NoError(t, <-errChan)
+
+		require.NoError(t, p.Close())
+		require.Equal(t, []pathID{p.id}, retiredPaths,
+			"the connection ID of a validated path must be retired when the path is abandoned")
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/path_manager_test.go b/electron/native/private-transport/third_party/quic-go/path_manager_test.go
new file mode 100644
index 000000000..ca84df1bb
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/path_manager_test.go
@@ -0,0 +1,356 @@
+package quic
+
+import (
+	"crypto/rand"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+// The path is established by receiving a non-probing packet.
+// The first non-probing packet is received after path validation has completed.
+// This is the typical scenario when the client initiates connection migration.
+func TestPathManagerIntentionalMigration(t *testing.T) {
+	connIDs := []protocol.ConnectionID{
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+		protocol.ParseConnectionID([]byte{2, 3, 4, 5, 6, 7, 8, 9}),
+		protocol.ParseConnectionID([]byte{3, 4, 5, 6, 7, 8, 9, 0}),
+	}
+	var retiredConnIDs []protocol.ConnectionID
+	pm := newPathManager(
+		func(id pathID) (protocol.ConnectionID, bool) { return connIDs[id], true },
+		func(id pathID) { retiredConnIDs = append(retiredConnIDs, connIDs[id]) },
+		utils.DefaultLogger,
+	)
+	now := monotime.Now()
+	connID, frames, shouldSwitch := pm.HandlePacket(
+		&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000},
+		now,
+		&wire.PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}},
+		false,
+	)
+	require.Equal(t, connIDs[0], connID)
+	require.Len(t, frames, 2)
+	require.IsType(t, &wire.PathChallengeFrame{}, frames[0].Frame)
+	pc1 := frames[0].Frame.(*wire.PathChallengeFrame)
+	require.NotZero(t, pc1.Data)
+	require.NotEqual(t, [8]byte{1, 2, 3, 4, 5, 6, 7, 8}, pc1.Data)
+	require.IsType(t, &wire.PathResponseFrame{}, frames[1].Frame)
+	require.Equal(t, [8]byte{1, 2, 3, 4, 5, 6, 7, 8}, frames[1].Frame.(*wire.PathResponseFrame).Data)
+	require.False(t, shouldSwitch)
+
+	// receiving another packet for the same path doesn't trigger another PATH_CHALLENGE
+	connID, frames, shouldSwitch = pm.HandlePacket(
+		&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000},
+		now,
+		nil,
+		false,
+	)
+	require.Zero(t, connID)
+	require.Len(t, frames, 0)
+	require.False(t, shouldSwitch)
+
+	// receiving a packet for a different path triggers another PATH_CHALLENGE
+	addr2 := &net.UDPAddr{IP: net.IPv4(5, 6, 7, 8), Port: 1000}
+	connID, frames, shouldSwitch = pm.HandlePacket(addr2, now, nil, false)
+	require.Equal(t, connIDs[1], connID)
+	require.Len(t, frames, 1)
+	require.IsType(t, &wire.PathChallengeFrame{}, frames[0].Frame)
+	pc2 := frames[0].Frame.(*wire.PathChallengeFrame)
+	require.NotEqual(t, pc1.Data, pc2.Data)
+	require.False(t, shouldSwitch)
+
+	// acknowledging the PATH_CHALLENGE doesn't confirm the path
+	for _, f := range frames {
+		f.Handler.OnAcked(f.Frame)
+	}
+	connID, frames, shouldSwitch = pm.HandlePacket(
+		&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000},
+		now,
+		nil,
+		false,
+	)
+	require.Zero(t, connID)
+	require.Empty(t, frames)
+	require.False(t, shouldSwitch)
+
+	// receiving a PATH_RESPONSE for the second path confirms the path
+	pm.HandlePathResponseFrame(&wire.PathResponseFrame{Data: pc2.Data})
+	connID, frames, shouldSwitch = pm.HandlePacket(addr2, now, nil, false)
+	require.Zero(t, connID)
+	require.Empty(t, frames)
+	require.False(t, shouldSwitch) // no non-probing packet received yet
+	require.Empty(t, retiredConnIDs)
+
+	// confirming the path doesn't remove other paths
+	connID, frames, shouldSwitch = pm.HandlePacket(
+		&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000},
+		now,
+		nil,
+		false,
+	)
+	require.Zero(t, connID)
+	require.Empty(t, frames)
+	require.False(t, shouldSwitch)
+
+	// now receive a non-probing packet for the new path
+	connID, frames, shouldSwitch = pm.HandlePacket(
+		&net.UDPAddr{IP: net.IPv4(5, 6, 7, 8), Port: 1000},
+		now,
+		nil,
+		true,
+	)
+	require.Zero(t, connID)
+	require.Empty(t, frames)
+	require.True(t, shouldSwitch)
+
+	// now switch to the new path
+	pm.SwitchToPath(&net.UDPAddr{IP: net.IPv4(5, 6, 7, 8), Port: 1000})
+
+	// switching to the path removes other paths
+	connID, frames, shouldSwitch = pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000}, now, nil, false)
+	require.Equal(t, connIDs[2], connID)
+	require.NotEmpty(t, frames)
+	require.NotEqual(t, frames[0].Frame.(*wire.PathChallengeFrame).Data, pc1.Data)
+	require.False(t, shouldSwitch)
+	require.Equal(t, []protocol.ConnectionID{connIDs[0]}, retiredConnIDs)
+}
+
+func TestPathManagerMultipleProbes(t *testing.T) {
+	connIDs := []protocol.ConnectionID{
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+	}
+	pm := newPathManager(
+		func(id pathID) (protocol.ConnectionID, bool) { return connIDs[id], true },
+		func(id pathID) {},
+		utils.DefaultLogger,
+	)
+	now := monotime.Now()
+	// first receive a packet without a PATH_CHALLENGE
+	connID, frames, shouldSwitch := pm.HandlePacket(
+		&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000},
+		now,
+		nil,
+		false,
+	)
+	require.Equal(t, connIDs[0], connID)
+	require.Len(t, frames, 1)
+	require.IsType(t, &wire.PathChallengeFrame{}, frames[0].Frame)
+	require.False(t, shouldSwitch)
+
+	// now receive a packet on the same path with a PATH_CHALLENGE
+	connID, frames, shouldSwitch = pm.HandlePacket(
+		&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000},
+		now,
+		&wire.PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}},
+		false,
+	)
+	require.Equal(t, connIDs[0], connID)
+	require.Len(t, frames, 1)
+	require.Equal(t, &wire.PathResponseFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}}, frames[0].Frame)
+	require.False(t, shouldSwitch)
+
+	// now receive another packet on the same path with a PATH_RESPONSE
+	connID, frames, shouldSwitch = pm.HandlePacket(
+		&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000},
+		now,
+		&wire.PathChallengeFrame{Data: [8]byte{8, 7, 6, 5, 4, 3, 2, 1}},
+		false,
+	)
+	require.Equal(t, connIDs[0], connID)
+	require.Len(t, frames, 1)
+	require.Equal(t, &wire.PathResponseFrame{Data: [8]byte{8, 7, 6, 5, 4, 3, 2, 1}}, frames[0].Frame)
+	require.False(t, shouldSwitch)
+
+	// lose the response packet
+	frames[0].Handler.OnLost(frames[0].Frame)
+}
+
+// The first packet received on the new path is already a non-probing packet.
+// We still need to validate the new path, but we can then switch over immediately.
+// This is the typical scenario when a NAT rebinding happens.
+func TestPathManagerNATRebinding(t *testing.T) {
+	connIDs := []protocol.ConnectionID{
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+	}
+	var retiredConnIDs []protocol.ConnectionID
+	pm := newPathManager(
+		func(id pathID) (protocol.ConnectionID, bool) { return connIDs[id], true },
+		func(id pathID) { retiredConnIDs = append(retiredConnIDs, connIDs[id]) },
+		utils.DefaultLogger,
+	)
+
+	now := monotime.Now()
+	connID, frames, shouldSwitch := pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000}, now, nil, true)
+	require.Equal(t, connIDs[0], connID)
+	require.Len(t, frames, 1)
+	require.IsType(t, &wire.PathChallengeFrame{}, frames[0].Frame)
+	pc1 := frames[0].Frame.(*wire.PathChallengeFrame)
+	require.NotZero(t, pc1.Data)
+	require.False(t, shouldSwitch)
+
+	// receiving a PATH_RESPONSE for the second path confirms the path
+	pm.HandlePathResponseFrame(&wire.PathResponseFrame{Data: pc1.Data})
+	// we now switch to the new path, as soon as the next packet on that path is received
+	connID, frames, shouldSwitch = pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000}, now, nil, false)
+	require.Zero(t, connID)
+	require.Empty(t, frames)
+	require.True(t, shouldSwitch)
+}
+
+func TestPathManagerLimits(t *testing.T) {
+	var connIDs []protocol.ConnectionID
+	for range 2*maxPaths + 2 {
+		b := make([]byte, 8)
+		rand.Read(b)
+		connIDs = append(connIDs, protocol.ParseConnectionID(b))
+	}
+	var retiredConnIDs []protocol.ConnectionID
+	pm := newPathManager(
+		func(id pathID) (protocol.ConnectionID, bool) { return connIDs[id], true },
+		func(id pathID) { retiredConnIDs = append(retiredConnIDs, connIDs[id]) },
+		utils.DefaultLogger,
+	)
+
+	now := monotime.Now()
+	firstPathTime := now
+	var firstPathConnID protocol.ConnectionID
+	require.Greater(t, pathTimeout, maxPaths*time.Second)
+	for i := range maxPaths {
+		connID, frames, _ := pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000 + i}, now, nil, true)
+		require.NotEmpty(t, frames)
+		require.Equal(t, connIDs[i], connID)
+		if i == 0 {
+			firstPathConnID = connID
+		}
+		now = now.Add(time.Second)
+	}
+	// the maximum number of paths is already being probed
+	now = firstPathTime.Add(pathTimeout).Add(-time.Nanosecond)
+	connID, frames, _ := pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 2000}, now, nil, true)
+	require.Zero(t, connID)
+	require.Empty(t, frames)
+
+	// receiving another packet after the pathTimeout of the first path evicts the first path
+	now = firstPathTime.Add(pathTimeout)
+	connIDIndex := maxPaths
+	connID, frames, _ = pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000 + maxPaths}, now, nil, true)
+	require.NotEmpty(t, frames)
+	require.Equal(t, connIDs[connIDIndex], connID)
+	require.Equal(t, []protocol.ConnectionID{firstPathConnID}, retiredConnIDs)
+	connIDIndex++
+
+	// switching to a new path frees is up all paths
+	var f1 []ackhandler.Frame
+	pm.SwitchToPath(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1000})
+	for i := range maxPaths {
+		connID, frames, _ := pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 3000 + i}, now, nil, true)
+		if i == 0 {
+			f1 = frames
+		}
+		require.NotEmpty(t, frames)
+		require.Equal(t, connIDs[connIDIndex], connID)
+		connIDIndex++
+	}
+	// again, the maximum number of paths is already being probed
+	connID, frames, _ = pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 2000}, now, nil, true)
+	require.Zero(t, connID)
+	require.Empty(t, frames)
+
+	// losing the frame removes this path
+	f1[0].Handler.OnLost(f1[0].Frame)
+
+	// we can open exactly one more path
+	connID, frames, _ = pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 4000}, now, nil, true)
+	require.NotEmpty(t, frames)
+	require.Equal(t, connIDs[connIDIndex], connID)
+	connID, frames, _ = pm.HandlePacket(&net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 4001}, now, nil, true)
+	require.Zero(t, connID)
+	require.Empty(t, frames)
+}
+
+type mockAddr struct {
+	str string
+}
+
+func (a *mockAddr) Network() string { return "mock" }
+func (a *mockAddr) String() string  { return a.str }
+
+func TestAddrsEqual(t *testing.T) {
+	tests := []struct {
+		name     string
+		addr1    net.Addr
+		addr2    net.Addr
+		expected bool
+	}{
+		{
+			name:     "nil addresses",
+			addr1:    nil,
+			addr2:    nil,
+			expected: false,
+		},
+		{
+			name:     "one nil address",
+			addr1:    &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1234},
+			addr2:    nil,
+			expected: false,
+		},
+		{
+			name:     "same IPv4 addresses",
+			addr1:    &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1234},
+			addr2:    &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1234},
+			expected: true,
+		},
+		{
+			name:     "different IPv4 addresses",
+			addr1:    &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1234},
+			addr2:    &net.UDPAddr{IP: net.IPv4(4, 3, 2, 1), Port: 1234},
+			expected: false,
+		},
+		{
+			name:     "different ports",
+			addr1:    &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1234},
+			addr2:    &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 4321},
+			expected: false,
+		},
+		{
+			name:     "same IPv6 addresses",
+			addr1:    &net.UDPAddr{IP: net.ParseIP("2001:db8::1"), Port: 1234},
+			addr2:    &net.UDPAddr{IP: net.ParseIP("2001:db8::1"), Port: 1234},
+			expected: true,
+		},
+		{
+			name:     "different IPv6 addresses",
+			addr1:    &net.UDPAddr{IP: net.ParseIP("2001:db8::1"), Port: 1234},
+			addr2:    &net.UDPAddr{IP: net.ParseIP("2001:db8::2"), Port: 1234},
+			expected: false,
+		},
+		{
+			name:     "non-UDP addresses with same string representation",
+			addr1:    &mockAddr{str: "192.0.2.1:1234"},
+			addr2:    &mockAddr{str: "192.0.2.1:1234"},
+			expected: true,
+		},
+		{
+			name:     "non-UDP addresses with different string representation",
+			addr1:    &mockAddr{str: "192.0.2.1:1234"},
+			addr2:    &mockAddr{str: "192.0.2.2:1234"},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := addrsEqual(tt.addr1, tt.addr2)
+			require.Equal(t, tt.expected, result)
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/benchmark_test.go b/electron/native/private-transport/third_party/quic-go/qlog/benchmark_test.go
new file mode 100644
index 000000000..1138fba98
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/benchmark_test.go
@@ -0,0 +1,86 @@
+package qlog
+
+import (
+	"io"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+type nopWriteCloserImpl struct{ io.Writer }
+
+func (nopWriteCloserImpl) Close() error { return nil }
+
+func nopWriteCloser(w io.Writer) io.WriteCloser {
+	return &nopWriteCloserImpl{Writer: w}
+}
+
+// BenchmarkConnectionTracing aims to benchmark a somewhat realistic connection that sends and receives packets.
+func BenchmarkConnectionTracing(b *testing.B) {
+	b.ReportAllocs()
+
+	srcConnID := protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad})
+	trace := qlogwriter.NewConnectionFileSeq(
+		nopWriteCloser(io.Discard),
+		false,
+		protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		[]string{EventSchema},
+	)
+	go trace.Run()
+	tracer := trace.AddProducer()
+	b.Cleanup(func() { tracer.Close() })
+
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(1337*time.Millisecond, 0)
+	rttStats.UpdateRTT(1000*time.Millisecond, 10*time.Millisecond)
+	rttStats.UpdateRTT(800*time.Millisecond, 100*time.Millisecond)
+
+	var i int
+	for b.Loop() {
+		i++
+		tracer.RecordEvent(&PacketSent{
+			Header: PacketHeader{
+				PacketType:       PacketType1RTT,
+				PacketNumber:     1234 + protocol.PacketNumber(i),
+				KeyPhaseBit:      KeyPhaseZero,
+				DestConnectionID: srcConnID,
+			},
+			Raw: RawInfo{Length: 1337},
+			ECN: ECT0,
+			Frames: []Frame{
+				{Frame: &AckFrame{AckRanges: []wire.AckRange{{Largest: 12345 + protocol.PacketNumber(2*i), Smallest: 1234 + protocol.PacketNumber(i)}}}},
+				{Frame: &MaxStreamDataFrame{StreamID: 42, MaximumStreamData: 987 + protocol.ByteCount(i)}},
+			},
+		})
+
+		tracer.RecordEvent(&MetricsUpdated{
+			MinRTT:           rttStats.MinRTT(),
+			SmoothedRTT:      rttStats.SmoothedRTT(),
+			LatestRTT:        rttStats.LatestRTT(),
+			RTTVariance:      rttStats.MeanDeviation(),
+			CongestionWindow: int(12345 + protocol.ByteCount(2*i)),
+			BytesInFlight:    int(12345 + protocol.ByteCount(i)),
+			PacketsInFlight:  i,
+		})
+
+		if i%2 == 0 {
+			tracer.RecordEvent(&PacketReceived{
+				Header: PacketHeader{
+					PacketType:       PacketType1RTT,
+					PacketNumber:     1337 + protocol.PacketNumber(i),
+					KeyPhaseBit:      KeyPhaseOne,
+					DestConnectionID: srcConnID,
+				},
+				Raw: RawInfo{Length: 1337},
+				ECN: ECT0,
+				Frames: []Frame{
+					{Frame: &StreamFrame{StreamID: 123, Offset: int64(1234 + protocol.ByteCount(100*i)), Length: 100, Fin: true}},
+				},
+			})
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/event.go b/electron/native/private-transport/third_party/quic-go/qlog/event.go
new file mode 100644
index 000000000..bbd1db647
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/event.go
@@ -0,0 +1,874 @@
+package qlog
+
+import (
+	"fmt"
+	"net/netip"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+)
+
+func milliseconds(dur time.Duration) float64 { return float64(dur.Nanoseconds()) / 1e6 }
+
+type encoderHelper struct {
+	enc *jsontext.Encoder
+	err error
+}
+
+func (h *encoderHelper) WriteToken(t jsontext.Token) {
+	if h.err != nil {
+		return
+	}
+	h.err = h.enc.WriteToken(t)
+}
+
+type versions []Version
+
+func (v versions) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginArray)
+	for _, e := range v {
+		h.WriteToken(jsontext.String(fmt.Sprintf("%x", uint32(e))))
+	}
+	h.WriteToken(jsontext.EndArray)
+	return h.err
+}
+
+type RawInfo struct {
+	Length        int // full packet length, including header and AEAD authentication tag
+	PayloadLength int // length of the packet payload, excluding AEAD tag
+}
+
+func (i RawInfo) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("length"))
+	h.WriteToken(jsontext.Uint(uint64(i.Length)))
+	if i.PayloadLength != 0 {
+		h.WriteToken(jsontext.String("payload_length"))
+		h.WriteToken(jsontext.Uint(uint64(i.PayloadLength)))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type PathEndpointInfo struct {
+	IPv4 netip.AddrPort
+	IPv6 netip.AddrPort
+}
+
+func (p PathEndpointInfo) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	if p.IPv4.IsValid() {
+		h.WriteToken(jsontext.String("ip_v4"))
+		h.WriteToken(jsontext.String(p.IPv4.Addr().String()))
+		h.WriteToken(jsontext.String("port_v4"))
+		h.WriteToken(jsontext.Int(int64(p.IPv4.Port())))
+	}
+	if p.IPv6.IsValid() {
+		h.WriteToken(jsontext.String("ip_v6"))
+		h.WriteToken(jsontext.String(p.IPv6.Addr().String()))
+		h.WriteToken(jsontext.String("port_v6"))
+		h.WriteToken(jsontext.Int(int64(p.IPv6.Port())))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type StartedConnection struct {
+	Local  PathEndpointInfo
+	Remote PathEndpointInfo
+}
+
+func (e StartedConnection) Name() string { return "transport:connection_started" }
+
+func (e StartedConnection) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("local"))
+	if err := e.Local.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.String("remote"))
+	if err := e.Remote.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type VersionInformation struct {
+	ClientVersions, ServerVersions []Version
+	ChosenVersion                  Version
+}
+
+func (e VersionInformation) Name() string { return "transport:version_information" }
+
+func (e VersionInformation) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	if len(e.ClientVersions) > 0 {
+		h.WriteToken(jsontext.String("client_versions"))
+		if err := versions(e.ClientVersions).encode(enc); err != nil {
+			return err
+		}
+	}
+	if len(e.ServerVersions) > 0 {
+		h.WriteToken(jsontext.String("server_versions"))
+		if err := versions(e.ServerVersions).encode(enc); err != nil {
+			return err
+		}
+	}
+	h.WriteToken(jsontext.String("chosen_version"))
+	h.WriteToken(jsontext.String(fmt.Sprintf("%x", uint32(e.ChosenVersion))))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type ConnectionClosed struct {
+	Initiator Initiator
+
+	ConnectionError  *TransportErrorCode
+	ApplicationError *ApplicationErrorCode
+
+	Reason string
+
+	Trigger ConnectionCloseTrigger
+}
+
+func (e ConnectionClosed) Name() string { return "transport:connection_closed" }
+
+func (e ConnectionClosed) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("initiator"))
+	h.WriteToken(jsontext.String(string(e.Initiator)))
+	if e.ConnectionError != nil {
+		h.WriteToken(jsontext.String("connection_error"))
+		if e.ConnectionError.IsCryptoError() {
+			h.WriteToken(jsontext.String(fmt.Sprintf("crypto_error_%#x", uint16(*e.ConnectionError))))
+		} else {
+			switch *e.ConnectionError {
+			case qerr.NoError:
+				h.WriteToken(jsontext.String("no_error"))
+			case qerr.InternalError:
+				h.WriteToken(jsontext.String("internal_error"))
+			case qerr.ConnectionRefused:
+				h.WriteToken(jsontext.String("connection_refused"))
+			case qerr.FlowControlError:
+				h.WriteToken(jsontext.String("flow_control_error"))
+			case qerr.StreamLimitError:
+				h.WriteToken(jsontext.String("stream_limit_error"))
+			case qerr.StreamStateError:
+				h.WriteToken(jsontext.String("stream_state_error"))
+			case qerr.FinalSizeError:
+				h.WriteToken(jsontext.String("final_size_error"))
+			case qerr.FrameEncodingError:
+				h.WriteToken(jsontext.String("frame_encoding_error"))
+			case qerr.TransportParameterError:
+				h.WriteToken(jsontext.String("transport_parameter_error"))
+			case qerr.ConnectionIDLimitError:
+				h.WriteToken(jsontext.String("connection_id_limit_error"))
+			case qerr.ProtocolViolation:
+				h.WriteToken(jsontext.String("protocol_violation"))
+			case qerr.InvalidToken:
+				h.WriteToken(jsontext.String("invalid_token"))
+			case qerr.ApplicationErrorErrorCode:
+				h.WriteToken(jsontext.String("application_error"))
+			case qerr.CryptoBufferExceeded:
+				h.WriteToken(jsontext.String("crypto_buffer_exceeded"))
+			case qerr.KeyUpdateError:
+				h.WriteToken(jsontext.String("key_update_error"))
+			case qerr.AEADLimitReached:
+				h.WriteToken(jsontext.String("aead_limit_reached"))
+			case qerr.NoViablePathError:
+				h.WriteToken(jsontext.String("no_viable_path"))
+			default:
+				h.WriteToken(jsontext.String("unknown"))
+				h.WriteToken(jsontext.String("error_code"))
+				h.WriteToken(jsontext.Uint(uint64(*e.ConnectionError)))
+			}
+		}
+	}
+	if e.ApplicationError != nil {
+		h.WriteToken(jsontext.String("application_error"))
+		h.WriteToken(jsontext.String("unknown"))
+		h.WriteToken(jsontext.String("error_code"))
+		h.WriteToken(jsontext.Uint(uint64(*e.ApplicationError)))
+	}
+	if e.ConnectionError != nil || e.ApplicationError != nil {
+		h.WriteToken(jsontext.String("reason"))
+		h.WriteToken(jsontext.String(e.Reason))
+	}
+	if e.Trigger != "" {
+		h.WriteToken(jsontext.String("trigger"))
+		h.WriteToken(jsontext.String(string(e.Trigger)))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type PacketSent struct {
+	Header                  PacketHeader
+	Raw                     RawInfo
+	DatagramPayloadChecksum DatagramPayloadChecksum
+	Frames                  []Frame
+	ECN                     ECN
+	IsCoalesced             bool
+	Trigger                 string
+	SupportedVersions       []Version
+}
+
+func (e PacketSent) Name() string { return "transport:packet_sent" }
+
+func (e PacketSent) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("header"))
+	if err := e.Header.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.String("raw"))
+	if err := e.Raw.encode(enc); err != nil {
+		return err
+	}
+	if e.DatagramPayloadChecksum != 0 {
+		h.WriteToken(jsontext.String("datagram_payload_checksum"))
+		h.WriteToken(jsontext.Uint(uint64(e.DatagramPayloadChecksum)))
+	}
+	if len(e.Frames) > 0 {
+		h.WriteToken(jsontext.String("frames"))
+		if err := frames(e.Frames).encode(enc); err != nil {
+			return err
+		}
+	}
+	if e.IsCoalesced {
+		h.WriteToken(jsontext.String("is_coalesced"))
+		h.WriteToken(jsontext.True)
+	}
+	if e.ECN != ECNUnsupported {
+		h.WriteToken(jsontext.String("ecn"))
+		h.WriteToken(jsontext.String(string(e.ECN)))
+	}
+	if e.Trigger != "" {
+		h.WriteToken(jsontext.String("trigger"))
+		h.WriteToken(jsontext.String(e.Trigger))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type PacketReceived struct {
+	Header                  PacketHeader
+	Raw                     RawInfo
+	DatagramPayloadChecksum DatagramPayloadChecksum
+	Frames                  []Frame
+	ECN                     ECN
+	IsCoalesced             bool
+	Trigger                 string
+}
+
+func (e PacketReceived) Name() string { return "transport:packet_received" }
+
+func (e PacketReceived) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("header"))
+	if err := e.Header.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.String("raw"))
+	if err := e.Raw.encode(enc); err != nil {
+		return err
+	}
+	if e.DatagramPayloadChecksum != 0 {
+		h.WriteToken(jsontext.String("datagram_payload_checksum"))
+		h.WriteToken(jsontext.Uint(uint64(e.DatagramPayloadChecksum)))
+	}
+	if len(e.Frames) > 0 {
+		h.WriteToken(jsontext.String("frames"))
+		if err := frames(e.Frames).encode(enc); err != nil {
+			return err
+		}
+	}
+	if e.IsCoalesced {
+		h.WriteToken(jsontext.String("is_coalesced"))
+		h.WriteToken(jsontext.True)
+	}
+	if e.ECN != ECNUnsupported {
+		h.WriteToken(jsontext.String("ecn"))
+		h.WriteToken(jsontext.String(string(e.ECN)))
+	}
+	if e.Trigger != "" {
+		h.WriteToken(jsontext.String("trigger"))
+		h.WriteToken(jsontext.String(e.Trigger))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type VersionNegotiationReceived struct {
+	Header            PacketHeaderVersionNegotiation
+	SupportedVersions []Version
+}
+
+func (e VersionNegotiationReceived) Name() string { return "transport:packet_received" }
+
+func (e VersionNegotiationReceived) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("header"))
+	if err := e.Header.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.String("supported_versions"))
+	if err := versions(e.SupportedVersions).encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type VersionNegotiationSent struct {
+	Header            PacketHeaderVersionNegotiation
+	SupportedVersions []Version
+}
+
+func (e VersionNegotiationSent) Name() string { return "transport:packet_sent" }
+
+func (e VersionNegotiationSent) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("header"))
+	if err := e.Header.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.String("supported_versions"))
+	if err := versions(e.SupportedVersions).encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type PacketBuffered struct {
+	Header                  PacketHeader
+	Raw                     RawInfo
+	DatagramPayloadChecksum DatagramPayloadChecksum
+}
+
+func (e PacketBuffered) Name() string { return "transport:packet_buffered" }
+
+func (e PacketBuffered) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("header"))
+	if err := e.Header.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.String("raw"))
+	if err := e.Raw.encode(enc); err != nil {
+		return err
+	}
+	if e.DatagramPayloadChecksum != 0 {
+		h.WriteToken(jsontext.String("datagram_payload_checksum"))
+		h.WriteToken(jsontext.Uint(uint64(e.DatagramPayloadChecksum)))
+	}
+	h.WriteToken(jsontext.String("trigger"))
+	h.WriteToken(jsontext.String("keys_unavailable"))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// PacketDropped is the transport:packet_dropped event.
+type PacketDropped struct {
+	Header                  PacketHeader
+	Raw                     RawInfo
+	DatagramPayloadChecksum DatagramPayloadChecksum
+	Trigger                 PacketDropReason
+}
+
+func (e PacketDropped) Name() string { return "transport:packet_dropped" }
+
+func (e PacketDropped) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("header"))
+	if err := e.Header.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.String("raw"))
+	if err := e.Raw.encode(enc); err != nil {
+		return err
+	}
+	if e.DatagramPayloadChecksum != 0 {
+		h.WriteToken(jsontext.String("datagram_payload_checksum"))
+		h.WriteToken(jsontext.Uint(uint64(e.DatagramPayloadChecksum)))
+	}
+	h.WriteToken(jsontext.String("trigger"))
+	h.WriteToken(jsontext.String(string(e.Trigger)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// StreamPriorityUpdated closely follows the http3:priority_updated event from
+// draft-ietf-quic-qlog-h3-events.
+type StreamPriorityUpdated struct {
+	StreamID    StreamID
+	Urgency     int8
+	Incremental bool
+}
+
+func (e StreamPriorityUpdated) Name() string { return "transport:priority_updated" }
+
+func (e StreamPriorityUpdated) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("stream_id"))
+	h.WriteToken(jsontext.Int(int64(e.StreamID)))
+	h.WriteToken(jsontext.String("new"))
+	newPriority := fmt.Sprintf("u=%d", e.Urgency)
+	if e.Incremental {
+		newPriority += ", i"
+	}
+	h.WriteToken(jsontext.String(newPriority))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type MTUUpdated struct {
+	Value int
+	Done  bool
+}
+
+func (e MTUUpdated) Name() string { return "recovery:mtu_updated" }
+
+func (e MTUUpdated) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("mtu"))
+	h.WriteToken(jsontext.Uint(uint64(e.Value)))
+	h.WriteToken(jsontext.String("done"))
+	h.WriteToken(jsontext.Bool(e.Done))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// MetricsUpdated logs RTT and congestion metrics as defined in the
+// recovery:metrics_updated event.
+// The PTO count is logged via [PTOCountUpdated].
+type MetricsUpdated struct {
+	MinRTT           time.Duration
+	SmoothedRTT      time.Duration
+	LatestRTT        time.Duration
+	RTTVariance      time.Duration
+	CongestionWindow int
+	BytesInFlight    int
+	PacketsInFlight  int
+}
+
+func (e MetricsUpdated) Name() string { return "recovery:metrics_updated" }
+
+func (e MetricsUpdated) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	if e.MinRTT != 0 {
+		h.WriteToken(jsontext.String("min_rtt"))
+		h.WriteToken(jsontext.Float(milliseconds(e.MinRTT)))
+	}
+	if e.SmoothedRTT != 0 {
+		h.WriteToken(jsontext.String("smoothed_rtt"))
+		h.WriteToken(jsontext.Float(milliseconds(e.SmoothedRTT)))
+	}
+	if e.LatestRTT != 0 {
+		h.WriteToken(jsontext.String("latest_rtt"))
+		h.WriteToken(jsontext.Float(milliseconds(e.LatestRTT)))
+	}
+	if e.RTTVariance != 0 {
+		h.WriteToken(jsontext.String("rtt_variance"))
+		h.WriteToken(jsontext.Float(milliseconds(e.RTTVariance)))
+	}
+	if e.CongestionWindow != 0 {
+		h.WriteToken(jsontext.String("congestion_window"))
+		h.WriteToken(jsontext.Uint(uint64(e.CongestionWindow)))
+	}
+	if e.BytesInFlight != 0 {
+		h.WriteToken(jsontext.String("bytes_in_flight"))
+		h.WriteToken(jsontext.Uint(uint64(e.BytesInFlight)))
+	}
+	if e.PacketsInFlight != 0 {
+		h.WriteToken(jsontext.String("packets_in_flight"))
+		h.WriteToken(jsontext.Uint(uint64(e.PacketsInFlight)))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// PTOCountUpdated logs the pto_count value of the
+// recovery:metrics_updated event.
+type PTOCountUpdated struct {
+	PTOCount uint32
+}
+
+func (e PTOCountUpdated) Name() string { return "recovery:metrics_updated" }
+
+func (e PTOCountUpdated) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("pto_count"))
+	h.WriteToken(jsontext.Uint(uint64(e.PTOCount)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type PacketLost struct {
+	Header  PacketHeader
+	Trigger PacketLossReason
+}
+
+func (e PacketLost) Name() string { return "recovery:packet_lost" }
+
+func (e PacketLost) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("header"))
+	if err := e.Header.encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.String("trigger"))
+	h.WriteToken(jsontext.String(string(e.Trigger)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type SpuriousLoss struct {
+	EncryptionLevel  protocol.EncryptionLevel
+	PacketNumber     protocol.PacketNumber
+	PacketReordering uint64
+	TimeReordering   time.Duration
+}
+
+func (e SpuriousLoss) Name() string { return "recovery:spurious_loss" }
+
+func (e SpuriousLoss) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("packet_number_space"))
+	h.WriteToken(jsontext.String(encLevelToPacketNumberSpace(e.EncryptionLevel)))
+	h.WriteToken(jsontext.String("packet_number"))
+	h.WriteToken(jsontext.Uint(uint64(e.PacketNumber)))
+	h.WriteToken(jsontext.String("reordering_packets"))
+	h.WriteToken(jsontext.Uint(e.PacketReordering))
+	h.WriteToken(jsontext.String("reordering_time"))
+	h.WriteToken(jsontext.Float(milliseconds(e.TimeReordering)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type KeyUpdated struct {
+	Trigger  KeyUpdateTrigger
+	KeyType  KeyType
+	KeyPhase KeyPhase // only set for 1-RTT keys
+	// we don't log the keys here, so we don't need `old` and `new`.
+}
+
+func (e KeyUpdated) Name() string { return "security:key_updated" }
+
+func (e KeyUpdated) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("trigger"))
+	h.WriteToken(jsontext.String(string(e.Trigger)))
+	h.WriteToken(jsontext.String("key_type"))
+	h.WriteToken(jsontext.String(string(e.KeyType)))
+	if e.KeyType == KeyTypeClient1RTT || e.KeyType == KeyTypeServer1RTT {
+		h.WriteToken(jsontext.String("key_phase"))
+		h.WriteToken(jsontext.Uint(uint64(e.KeyPhase)))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type KeyDiscarded struct {
+	KeyType  KeyType
+	KeyPhase KeyPhase // only set for 1-RTT keys
+}
+
+func (e KeyDiscarded) Name() string { return "security:key_discarded" }
+
+func (e KeyDiscarded) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	if e.KeyType != KeyTypeClient1RTT && e.KeyType != KeyTypeServer1RTT {
+		h.WriteToken(jsontext.String("trigger"))
+		h.WriteToken(jsontext.String("tls"))
+	}
+	h.WriteToken(jsontext.String("key_type"))
+	h.WriteToken(jsontext.String(string(e.KeyType)))
+	if e.KeyType == KeyTypeClient1RTT || e.KeyType == KeyTypeServer1RTT {
+		h.WriteToken(jsontext.String("key_phase"))
+		h.WriteToken(jsontext.Uint(uint64(e.KeyPhase)))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type ParametersSet struct {
+	Restore                         bool
+	Initiator                       Initiator
+	SentBy                          protocol.Perspective
+	OriginalDestinationConnectionID protocol.ConnectionID
+	InitialSourceConnectionID       protocol.ConnectionID
+	RetrySourceConnectionID         *protocol.ConnectionID
+	StatelessResetToken             *protocol.StatelessResetToken
+	DisableActiveMigration          bool
+	MaxIdleTimeout                  time.Duration
+	MaxUDPPayloadSize               protocol.ByteCount
+	AckDelayExponent                uint8
+	MaxAckDelay                     time.Duration
+	ActiveConnectionIDLimit         uint64
+	InitialMaxData                  protocol.ByteCount
+	InitialMaxStreamDataBidiLocal   protocol.ByteCount
+	InitialMaxStreamDataBidiRemote  protocol.ByteCount
+	InitialMaxStreamDataUni         protocol.ByteCount
+	InitialMaxStreamsBidi           int64
+	InitialMaxStreamsUni            int64
+	PreferredAddress                *PreferredAddress
+	MaxDatagramFrameSize            protocol.ByteCount
+	EnableResetStreamAt             bool
+}
+
+func (e ParametersSet) Name() string {
+	if e.Restore {
+		return "transport:parameters_restored"
+	}
+	return "transport:parameters_set"
+}
+
+func (e ParametersSet) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	if !e.Restore {
+		h.WriteToken(jsontext.String("initiator"))
+		h.WriteToken(jsontext.String(string(e.Initiator)))
+		if e.SentBy == protocol.PerspectiveServer {
+			h.WriteToken(jsontext.String("original_destination_connection_id"))
+			h.WriteToken(jsontext.String(e.OriginalDestinationConnectionID.String()))
+			if e.StatelessResetToken != nil {
+				h.WriteToken(jsontext.String("stateless_reset_token"))
+				h.WriteToken(jsontext.String(fmt.Sprintf("%x", e.StatelessResetToken[:])))
+			}
+			if e.RetrySourceConnectionID != nil {
+				h.WriteToken(jsontext.String("retry_source_connection_id"))
+				h.WriteToken(jsontext.String((*e.RetrySourceConnectionID).String()))
+			}
+		}
+		h.WriteToken(jsontext.String("initial_source_connection_id"))
+		h.WriteToken(jsontext.String(e.InitialSourceConnectionID.String()))
+	}
+	h.WriteToken(jsontext.String("disable_active_migration"))
+	h.WriteToken(jsontext.Bool(e.DisableActiveMigration))
+	if e.MaxIdleTimeout != 0 {
+		h.WriteToken(jsontext.String("max_idle_timeout"))
+		h.WriteToken(jsontext.Float(milliseconds(e.MaxIdleTimeout)))
+	}
+	if e.MaxUDPPayloadSize != 0 {
+		h.WriteToken(jsontext.String("max_udp_payload_size"))
+		h.WriteToken(jsontext.Int(int64(e.MaxUDPPayloadSize)))
+	}
+	if e.AckDelayExponent != 0 {
+		h.WriteToken(jsontext.String("ack_delay_exponent"))
+		h.WriteToken(jsontext.Uint(uint64(e.AckDelayExponent)))
+	}
+	if e.MaxAckDelay != 0 {
+		h.WriteToken(jsontext.String("max_ack_delay"))
+		h.WriteToken(jsontext.Float(milliseconds(e.MaxAckDelay)))
+	}
+	if e.ActiveConnectionIDLimit != 0 {
+		h.WriteToken(jsontext.String("active_connection_id_limit"))
+		h.WriteToken(jsontext.Uint(e.ActiveConnectionIDLimit))
+	}
+	if e.InitialMaxData != 0 {
+		h.WriteToken(jsontext.String("initial_max_data"))
+		h.WriteToken(jsontext.Int(int64(e.InitialMaxData)))
+	}
+	if e.InitialMaxStreamDataBidiLocal != 0 {
+		h.WriteToken(jsontext.String("initial_max_stream_data_bidi_local"))
+		h.WriteToken(jsontext.Int(int64(e.InitialMaxStreamDataBidiLocal)))
+	}
+	if e.InitialMaxStreamDataBidiRemote != 0 {
+		h.WriteToken(jsontext.String("initial_max_stream_data_bidi_remote"))
+		h.WriteToken(jsontext.Int(int64(e.InitialMaxStreamDataBidiRemote)))
+	}
+	if e.InitialMaxStreamDataUni != 0 {
+		h.WriteToken(jsontext.String("initial_max_stream_data_uni"))
+		h.WriteToken(jsontext.Int(int64(e.InitialMaxStreamDataUni)))
+	}
+	if e.InitialMaxStreamsBidi != 0 {
+		h.WriteToken(jsontext.String("initial_max_streams_bidi"))
+		h.WriteToken(jsontext.Int(e.InitialMaxStreamsBidi))
+	}
+	if e.InitialMaxStreamsUni != 0 {
+		h.WriteToken(jsontext.String("initial_max_streams_uni"))
+		h.WriteToken(jsontext.Int(e.InitialMaxStreamsUni))
+	}
+	if e.PreferredAddress != nil {
+		h.WriteToken(jsontext.String("preferred_address"))
+		if err := e.PreferredAddress.encode(enc); err != nil {
+			return err
+		}
+	}
+	if e.MaxDatagramFrameSize != protocol.InvalidByteCount {
+		h.WriteToken(jsontext.String("max_datagram_frame_size"))
+		h.WriteToken(jsontext.Int(int64(e.MaxDatagramFrameSize)))
+	}
+	if e.EnableResetStreamAt {
+		h.WriteToken(jsontext.String("reset_stream_at"))
+		h.WriteToken(jsontext.True)
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type PreferredAddress struct {
+	IPv4, IPv6          netip.AddrPort
+	ConnectionID        protocol.ConnectionID
+	StatelessResetToken protocol.StatelessResetToken
+}
+
+func (a PreferredAddress) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	if a.IPv4.IsValid() {
+		h.WriteToken(jsontext.String("ip_v4"))
+		h.WriteToken(jsontext.String(a.IPv4.Addr().String()))
+		h.WriteToken(jsontext.String("port_v4"))
+		h.WriteToken(jsontext.Uint(uint64(a.IPv4.Port())))
+	}
+	if a.IPv6.IsValid() {
+		h.WriteToken(jsontext.String("ip_v6"))
+		h.WriteToken(jsontext.String(a.IPv6.Addr().String()))
+		h.WriteToken(jsontext.String("port_v6"))
+		h.WriteToken(jsontext.Uint(uint64(a.IPv6.Port())))
+	}
+	h.WriteToken(jsontext.String("connection_id"))
+	h.WriteToken(jsontext.String(a.ConnectionID.String()))
+	h.WriteToken(jsontext.String("stateless_reset_token"))
+	h.WriteToken(jsontext.String(fmt.Sprintf("%x", a.StatelessResetToken)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type LossTimerUpdated struct {
+	Type      LossTimerUpdateType
+	TimerType TimerType
+	EncLevel  EncryptionLevel
+	Time      time.Time
+}
+
+func (e LossTimerUpdated) Name() string { return "recovery:loss_timer_updated" }
+
+func (e LossTimerUpdated) Encode(enc *jsontext.Encoder, t time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("event_type"))
+	h.WriteToken(jsontext.String(string(e.Type)))
+	h.WriteToken(jsontext.String("timer_type"))
+	h.WriteToken(jsontext.String(string(e.TimerType)))
+	h.WriteToken(jsontext.String("packet_number_space"))
+	h.WriteToken(jsontext.String(encLevelToPacketNumberSpace(e.EncLevel)))
+	if e.Type == LossTimerUpdateTypeSet {
+		h.WriteToken(jsontext.String("delta"))
+		h.WriteToken(jsontext.Float(milliseconds(e.Time.Sub(t))))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type eventLossTimerCanceled struct{}
+
+func (e eventLossTimerCanceled) Name() string { return "recovery:loss_timer_updated" }
+
+func (e eventLossTimerCanceled) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("event_type"))
+	h.WriteToken(jsontext.String("cancelled"))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type CongestionStateUpdated struct {
+	State CongestionState
+}
+
+func (e CongestionStateUpdated) Name() string { return "recovery:congestion_state_updated" }
+
+func (e CongestionStateUpdated) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("new"))
+	h.WriteToken(jsontext.String(e.State.String()))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type ECNStateUpdated struct {
+	State   ECNState
+	Trigger string
+}
+
+func (e ECNStateUpdated) Name() string { return "recovery:ecn_state_updated" }
+
+func (e ECNStateUpdated) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("new"))
+	h.WriteToken(jsontext.String(string(e.State)))
+	if e.Trigger != "" {
+		h.WriteToken(jsontext.String("trigger"))
+		h.WriteToken(jsontext.String(e.Trigger))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type ALPNInformation struct {
+	ChosenALPN string
+}
+
+func (e ALPNInformation) Name() string { return "transport:alpn_information" }
+
+func (e ALPNInformation) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("chosen_alpn"))
+	h.WriteToken(jsontext.String(e.ChosenALPN))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// DebugEvent is a generic event that can be used to log arbitrary messages.
+type DebugEvent struct {
+	EventName string
+	Message   string
+}
+
+func (e DebugEvent) Name() string {
+	if e.EventName == "" {
+		return "transport:debug"
+	}
+	return fmt.Sprintf("transport:%s", e.EventName)
+}
+
+func (e DebugEvent) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("message"))
+	h.WriteToken(jsontext.String(e.Message))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/event_test.go b/electron/native/private-transport/third_party/quic-go/qlog/event_test.go
new file mode 100644
index 000000000..a7990e668
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/event_test.go
@@ -0,0 +1,913 @@
+package qlog
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/netip"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlogwriter"
+
+	"github.com/stretchr/testify/require"
+)
+
+func testEventEncoding(t *testing.T, ev qlogwriter.Event) (string, map[string]any) {
+	t.Helper()
+	var buf bytes.Buffer
+
+	synctest.Test(t, func(t *testing.T) {
+		tr := qlogwriter.NewConnectionFileSeq(
+			nopWriteCloser(&buf),
+			true,
+			protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+			[]string{EventSchema},
+		)
+		go tr.Run()
+		producer := tr.AddProducer()
+
+		synctest.Wait()
+		time.Sleep(42 * time.Second)
+
+		producer.RecordEvent(ev)
+		producer.Close()
+	})
+
+	return decode(t, buf.String())
+}
+
+func decode(t *testing.T, data string) (string, map[string]any) {
+	t.Helper()
+
+	var result map[string]any
+
+	lines := bytes.Split([]byte(data), []byte{'\n'})
+	require.Len(t, lines, 3) // the first line is the trace header, the second line is the event, the third line is empty
+	require.Empty(t, lines[2])
+	require.Equal(t, qlogwriter.RecordSeparator, lines[1][0], "expected record separator at start of line")
+	require.NoError(t, json.Unmarshal(lines[1][1:], &result))
+	require.Equal(t, 42*time.Second, time.Duration(result["time"].(float64)*1e6)*time.Nanosecond)
+
+	return result["name"].(string), result["data"].(map[string]any)
+}
+
+func TestStartedConnection(t *testing.T) {
+	var localInfo, remoteInfo PathEndpointInfo
+	localInfo.IPv4 = netip.AddrPortFrom(netip.AddrFrom4([4]byte{192, 168, 13, 37}), 42)
+	ip, err := netip.ParseAddr("2001:db8::1")
+	require.NoError(t, err)
+	remoteInfo.IPv6 = netip.AddrPortFrom(ip, 24)
+
+	name, ev := testEventEncoding(t, &StartedConnection{
+		Local:  localInfo,
+		Remote: remoteInfo,
+	})
+
+	require.Equal(t, "transport:connection_started", name)
+
+	local, ok := ev["local"].(map[string]any)
+	require.True(t, ok)
+	require.Equal(t, "192.168.13.37", local["ip_v4"])
+	require.Equal(t, float64(42), local["port_v4"])
+
+	remote, ok := ev["remote"].(map[string]any)
+	require.True(t, ok)
+	require.Equal(t, "2001:db8::1", remote["ip_v6"])
+	require.Equal(t, float64(24), remote["port_v6"])
+}
+
+func TestVersionInformation(t *testing.T) {
+	name, ev := testEventEncoding(t, &VersionInformation{ChosenVersion: 0x1337})
+
+	require.Equal(t, "transport:version_information", name)
+	require.Len(t, ev, 1)
+	require.Equal(t, "1337", ev["chosen_version"])
+}
+
+func TestVersionInformationWithNegotiation(t *testing.T) {
+	name, ev := testEventEncoding(t, &VersionInformation{
+		ChosenVersion:  0x1337,
+		ClientVersions: []Version{1, 2, 3},
+		ServerVersions: []Version{4, 5, 6},
+	})
+
+	require.Equal(t, "transport:version_information", name)
+	require.Len(t, ev, 3)
+	require.Equal(t, "1337", ev["chosen_version"])
+	require.Equal(t, []any{"1", "2", "3"}, ev["client_versions"])
+	require.Equal(t, []any{"4", "5", "6"}, ev["server_versions"])
+}
+
+func TestStreamPriorityUpdated(t *testing.T) {
+	name, ev := testEventEncoding(t, &StreamPriorityUpdated{
+		StreamID:    42,
+		Urgency:     2,
+		Incremental: true,
+	})
+
+	require.Equal(t, "transport:priority_updated", name)
+	require.Equal(t, map[string]any{
+		"stream_id": float64(42),
+		"new":       "u=2, i",
+	}, ev)
+}
+
+func TestIdleTimeouts(t *testing.T) {
+	name, ev := testEventEncoding(t, &ConnectionClosed{
+		Initiator: InitiatorLocal,
+		Trigger:   ConnectionCloseTriggerIdleTimeout,
+	})
+
+	require.Equal(t, "transport:connection_closed", name)
+	require.Len(t, ev, 2)
+	require.Equal(t, "local", ev["initiator"])
+	require.Equal(t, "idle_timeout", ev["trigger"])
+}
+
+func TestReceivedStatelessResetPacket(t *testing.T) {
+	name, ev := testEventEncoding(t, &ConnectionClosed{
+		Initiator: InitiatorRemote,
+		Trigger:   ConnectionCloseTriggerStatelessReset,
+	})
+
+	require.Equal(t, "transport:connection_closed", name)
+	require.Len(t, ev, 2)
+	require.Equal(t, "remote", ev["initiator"])
+	require.Equal(t, "stateless_reset", ev["trigger"])
+}
+
+func TestVersionNegotiationFailure(t *testing.T) {
+	name, ev := testEventEncoding(t, &ConnectionClosed{
+		Initiator: InitiatorLocal,
+		Trigger:   ConnectionCloseTriggerVersionMismatch,
+	})
+
+	require.Equal(t, "transport:connection_closed", name)
+	require.Len(t, ev, 2)
+	require.Equal(t, "local", ev["initiator"])
+	require.Equal(t, "version_mismatch", ev["trigger"])
+}
+
+func TestApplicationErrors(t *testing.T) {
+	code := qerr.ApplicationErrorCode(1337)
+	name, ev := testEventEncoding(t, &ConnectionClosed{
+		Initiator:        InitiatorRemote,
+		ApplicationError: &code,
+		Reason:           "foobar",
+	})
+
+	require.Equal(t, "transport:connection_closed", name)
+	require.Len(t, ev, 4)
+	require.Equal(t, "remote", ev["initiator"])
+	require.Equal(t, "unknown", ev["application_error"])
+	require.Equal(t, float64(1337), ev["error_code"])
+	require.Equal(t, "foobar", ev["reason"])
+}
+
+func TestTransportErrors(t *testing.T) {
+	tests := []struct {
+		code qerr.TransportErrorCode
+		want string
+	}{
+		{qerr.NoError, "no_error"},
+		{qerr.InternalError, "internal_error"},
+		{qerr.ConnectionRefused, "connection_refused"},
+		{qerr.FlowControlError, "flow_control_error"},
+		{qerr.StreamLimitError, "stream_limit_error"},
+		{qerr.StreamStateError, "stream_state_error"},
+		{qerr.FinalSizeError, "final_size_error"},
+		{qerr.FrameEncodingError, "frame_encoding_error"},
+		{qerr.TransportParameterError, "transport_parameter_error"},
+		{qerr.ConnectionIDLimitError, "connection_id_limit_error"},
+		{qerr.ProtocolViolation, "protocol_violation"},
+		{qerr.InvalidToken, "invalid_token"},
+		{qerr.ApplicationErrorErrorCode, "application_error"},
+		{qerr.CryptoBufferExceeded, "crypto_buffer_exceeded"},
+		{qerr.KeyUpdateError, "key_update_error"},
+		{qerr.AEADLimitReached, "aead_limit_reached"},
+		{qerr.NoViablePathError, "no_viable_path"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.want, func(t *testing.T) {
+			code := tt.code
+			name, ev := testEventEncoding(t, &ConnectionClosed{
+				Initiator:       InitiatorLocal,
+				ConnectionError: &code,
+				Reason:          "foobar",
+			})
+
+			require.Equal(t, "transport:connection_closed", name)
+			require.Equal(t, "local", ev["initiator"])
+			require.Equal(t, tt.want, ev["connection_error"])
+			require.Equal(t, "foobar", ev["reason"])
+			require.NotContains(t, ev, "error_code")
+		})
+	}
+}
+
+func TestTransportCryptoError(t *testing.T) {
+	code := qerr.TransportErrorCode(0x100 + 0x2a)
+	name, ev := testEventEncoding(t, &ConnectionClosed{
+		Initiator:       InitiatorLocal,
+		ConnectionError: &code,
+		Reason:          "foobar",
+	})
+
+	require.Equal(t, "transport:connection_closed", name)
+	require.Equal(t, "local", ev["initiator"])
+	require.Equal(t, "crypto_error_0x12a", ev["connection_error"])
+	require.Equal(t, "foobar", ev["reason"])
+}
+
+func TestSentTransportParameters(t *testing.T) {
+	rcid := protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad})
+	name, ev := testEventEncoding(t, &ParametersSet{
+		Initiator:                       InitiatorLocal,
+		SentBy:                          protocol.PerspectiveServer,
+		OriginalDestinationConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xc0, 0xde}),
+		InitialSourceConnectionID:       protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+		RetrySourceConnectionID:         &rcid,
+		StatelessResetToken:             &protocol.StatelessResetToken{0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00},
+		DisableActiveMigration:          true,
+		MaxIdleTimeout:                  321 * time.Millisecond,
+		MaxUDPPayloadSize:               1234,
+		AckDelayExponent:                12,
+		MaxAckDelay:                     123 * time.Millisecond,
+		ActiveConnectionIDLimit:         7,
+		InitialMaxData:                  4000,
+		InitialMaxStreamDataBidiLocal:   1000,
+		InitialMaxStreamDataBidiRemote:  2000,
+		InitialMaxStreamDataUni:         3000,
+		InitialMaxStreamsBidi:           10,
+		InitialMaxStreamsUni:            20,
+		MaxDatagramFrameSize:            protocol.InvalidByteCount,
+		EnableResetStreamAt:             true,
+	})
+
+	require.Equal(t, "transport:parameters_set", name)
+	require.Equal(t, "local", ev["initiator"])
+	require.Equal(t, "deadc0de", ev["original_destination_connection_id"])
+	require.Equal(t, "deadbeef", ev["initial_source_connection_id"])
+	require.Equal(t, "decafbad", ev["retry_source_connection_id"])
+	require.Equal(t, "112233445566778899aabbccddeeff00", ev["stateless_reset_token"])
+	require.Equal(t, float64(321), ev["max_idle_timeout"])
+	require.Equal(t, float64(1234), ev["max_udp_payload_size"])
+	require.Equal(t, float64(12), ev["ack_delay_exponent"])
+	require.Equal(t, float64(7), ev["active_connection_id_limit"])
+	require.Equal(t, float64(4000), ev["initial_max_data"])
+	require.Equal(t, float64(1000), ev["initial_max_stream_data_bidi_local"])
+	require.Equal(t, float64(2000), ev["initial_max_stream_data_bidi_remote"])
+	require.Equal(t, float64(3000), ev["initial_max_stream_data_uni"])
+	require.Equal(t, float64(10), ev["initial_max_streams_bidi"])
+	require.Equal(t, float64(20), ev["initial_max_streams_uni"])
+	require.True(t, ev["reset_stream_at"].(bool))
+	require.NotContains(t, ev, "preferred_address")
+	require.NotContains(t, ev, "max_datagram_frame_size")
+}
+
+func TestServerTransportParametersWithoutStatelessResetToken(t *testing.T) {
+	name, ev := testEventEncoding(t, &ParametersSet{
+		Initiator:                       InitiatorLocal,
+		SentBy:                          protocol.PerspectiveServer,
+		OriginalDestinationConnectionID: protocol.ParseConnectionID([]byte{0xde, 0xad, 0xc0, 0xde}),
+		ActiveConnectionIDLimit:         7,
+	})
+
+	require.Equal(t, "transport:parameters_set", name)
+	require.NotContains(t, ev, "stateless_reset_token")
+}
+
+func TestTransportParametersWithoutRetrySourceConnectionID(t *testing.T) {
+	name, ev := testEventEncoding(t, &ParametersSet{
+		Initiator:           InitiatorLocal,
+		SentBy:              protocol.PerspectiveServer,
+		StatelessResetToken: &protocol.StatelessResetToken{0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00},
+	})
+
+	require.Equal(t, "transport:parameters_set", name)
+	require.Equal(t, "local", ev["initiator"])
+	require.NotContains(t, ev, "retry_source_connection_id")
+}
+
+func TestTransportParametersWithPreferredAddress(t *testing.T) {
+	t.Run("IPv4 and IPv6", func(t *testing.T) {
+		testTransportParametersWithPreferredAddress(t, true, true)
+	})
+	t.Run("IPv4 only", func(t *testing.T) {
+		testTransportParametersWithPreferredAddress(t, true, false)
+	})
+	t.Run("IPv6 only", func(t *testing.T) {
+		testTransportParametersWithPreferredAddress(t, false, true)
+	})
+}
+
+func testTransportParametersWithPreferredAddress(t *testing.T, hasIPv4, hasIPv6 bool) {
+	addr4 := netip.AddrPortFrom(netip.AddrFrom4([4]byte{12, 34, 56, 78}), 123)
+	addr6 := netip.AddrPortFrom(netip.AddrFrom16([16]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}), 456)
+	preferredAddress := &PreferredAddress{
+		ConnectionID:        protocol.ParseConnectionID([]byte{8, 7, 6, 5, 4, 3, 2, 1}),
+		StatelessResetToken: protocol.StatelessResetToken{15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0},
+	}
+	if hasIPv4 {
+		preferredAddress.IPv4 = addr4
+	}
+	if hasIPv6 {
+		preferredAddress.IPv6 = addr6
+	}
+	name, ev := testEventEncoding(t, &ParametersSet{
+		Initiator:        InitiatorLocal,
+		SentBy:           protocol.PerspectiveServer,
+		PreferredAddress: preferredAddress,
+	})
+
+	require.Equal(t, "transport:parameters_set", name)
+	require.Equal(t, "local", ev["initiator"])
+	require.Contains(t, ev, "preferred_address")
+	pa := ev["preferred_address"].(map[string]any)
+	if hasIPv4 {
+		require.Equal(t, "12.34.56.78", pa["ip_v4"])
+		require.Equal(t, float64(123), pa["port_v4"])
+	} else {
+		require.NotContains(t, pa, "ip_v4")
+		require.NotContains(t, pa, "port_v4")
+	}
+	if hasIPv6 {
+		require.Equal(t, "102:304:506:708:90a:b0c:d0e:f10", pa["ip_v6"])
+		require.Equal(t, float64(456), pa["port_v6"])
+	} else {
+		require.NotContains(t, pa, "ip_v6")
+		require.NotContains(t, pa, "port_v6")
+	}
+	require.Equal(t, "0807060504030201", pa["connection_id"])
+	require.Equal(t, "0f0e0d0c0b0a09080706050403020100", pa["stateless_reset_token"])
+}
+
+func TestTransportParametersWithDatagramExtension(t *testing.T) {
+	name, ev := testEventEncoding(t, &ParametersSet{
+		Initiator:            InitiatorLocal,
+		SentBy:               protocol.PerspectiveServer,
+		MaxDatagramFrameSize: 1337,
+	})
+
+	require.Equal(t, "transport:parameters_set", name)
+	require.Equal(t, float64(1337), ev["max_datagram_frame_size"])
+}
+
+func TestReceivedTransportParameters(t *testing.T) {
+	name, ev := testEventEncoding(t, &ParametersSet{
+		Initiator: InitiatorRemote,
+		SentBy:    protocol.PerspectiveClient,
+	})
+
+	require.Equal(t, "transport:parameters_set", name)
+	require.Equal(t, "remote", ev["initiator"])
+	require.NotContains(t, ev, "original_destination_connection_id")
+}
+
+func TestRestoredTransportParameters(t *testing.T) {
+	name, ev := testEventEncoding(t, &ParametersSet{
+		Restore:                        true,
+		InitialMaxStreamDataBidiLocal:  100,
+		InitialMaxStreamDataBidiRemote: 200,
+		InitialMaxStreamDataUni:        300,
+		InitialMaxData:                 400,
+		MaxIdleTimeout:                 123 * time.Millisecond,
+	})
+
+	require.Equal(t, "transport:parameters_restored", name)
+	require.NotContains(t, ev, "initiator")
+	require.NotContains(t, ev, "original_destination_connection_id")
+	require.NotContains(t, ev, "stateless_reset_token")
+	require.NotContains(t, ev, "retry_source_connection_id")
+	require.NotContains(t, ev, "initial_source_connection_id")
+	require.Equal(t, float64(123), ev["max_idle_timeout"])
+	require.Equal(t, float64(400), ev["initial_max_data"])
+	require.Equal(t, float64(100), ev["initial_max_stream_data_bidi_local"])
+	require.Equal(t, float64(200), ev["initial_max_stream_data_bidi_remote"])
+	require.Equal(t, float64(300), ev["initial_max_stream_data_uni"])
+}
+
+func TestPacketSent(t *testing.T) {
+	name, ev := testEventEncoding(t, &PacketSent{
+		Header: PacketHeader{
+			PacketType:       PacketTypeHandshake,
+			PacketNumber:     1337,
+			Version:          protocol.Version1,
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{4, 3, 2, 1}),
+			DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+		},
+		Raw: RawInfo{Length: 987, PayloadLength: 1337},
+		Frames: []Frame{
+			{Frame: &MaxStreamDataFrame{StreamID: 42, MaximumStreamData: 987}},
+			{Frame: &StreamFrame{StreamID: 123, Offset: 1234, Length: 6, Fin: true}},
+		},
+		ECN: ECNCE,
+	})
+
+	require.Equal(t, "transport:packet_sent", name)
+	require.Contains(t, ev, "raw")
+	raw := ev["raw"].(map[string]any)
+	require.NotContains(t, ev, "datagram_payload_checksum")
+	require.Equal(t, float64(987), raw["length"])
+	require.Equal(t, float64(1337), raw["payload_length"])
+	require.Contains(t, ev, "header")
+	hdr := ev["header"].(map[string]any)
+	require.Equal(t, "handshake", hdr["packet_type"])
+	require.Equal(t, float64(1337), hdr["packet_number"])
+	require.Equal(t, "04030201", hdr["scid"])
+	require.Contains(t, ev, "frames")
+	require.Equal(t, "CE", ev["ecn"])
+	frames := ev["frames"].([]any)
+	require.Len(t, frames, 2)
+	require.Equal(t, "max_stream_data", frames[0].(map[string]any)["frame_type"])
+	require.Equal(t, "stream", frames[1].(map[string]any)["frame_type"])
+}
+
+func TestPacketSent1RTT(t *testing.T) {
+	t.Run("with datagram payload checksum", func(t *testing.T) {
+		testPacketSent1RTT(t, 1337)
+	})
+
+	t.Run("without datagram payload checksum", func(t *testing.T) {
+		testPacketSent1RTT(t, 0)
+	})
+}
+
+func testPacketSent1RTT(t *testing.T, datagramPayloadChecksum DatagramPayloadChecksum) {
+	name, ev := testEventEncoding(t, &PacketSent{
+		Header: PacketHeader{
+			PacketType:       PacketType1RTT,
+			PacketNumber:     1337,
+			KeyPhaseBit:      KeyPhaseZero,
+			DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+		},
+		Raw: RawInfo{Length: 123},
+		Frames: []Frame{
+			{Frame: &AckFrame{AckRanges: []wire.AckRange{{Smallest: 1, Largest: 10}}}},
+			{Frame: &MaxDataFrame{MaximumData: 987}},
+		},
+		ECN:                     ECNUnsupported,
+		DatagramPayloadChecksum: datagramPayloadChecksum,
+	})
+
+	require.Equal(t, "transport:packet_sent", name)
+	raw := ev["raw"].(map[string]any)
+	require.Equal(t, float64(123), raw["length"])
+	require.NotContains(t, raw, "payload_length")
+	require.Contains(t, ev, "header")
+	require.NotContains(t, ev, "ecn")
+	hdr := ev["header"].(map[string]any)
+	require.Equal(t, "1RTT", hdr["packet_type"])
+	require.Equal(t, float64(1337), hdr["packet_number"])
+	require.Contains(t, ev, "frames")
+	frames := ev["frames"].([]any)
+	require.Len(t, frames, 2)
+	require.Equal(t, "ack", frames[0].(map[string]any)["frame_type"])
+	require.Equal(t, "max_data", frames[1].(map[string]any)["frame_type"])
+	if datagramPayloadChecksum != 0 {
+		require.Contains(t, ev, "datagram_payload_checksum")
+		require.Equal(t, float64(datagramPayloadChecksum), ev["datagram_payload_checksum"])
+	} else {
+		require.NotContains(t, ev, "datagram_payload_checksum")
+	}
+}
+
+func TestPacketReceived(t *testing.T) {
+	name, ev := testEventEncoding(t, &PacketReceived{
+		Header: PacketHeader{
+			PacketType:       PacketTypeInitial,
+			PacketNumber:     1337,
+			Version:          protocol.Version1,
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{4, 3, 2, 1}),
+			DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+			Token:            &Token{Raw: []byte{0xde, 0xad, 0xbe, 0xef}},
+		},
+		Raw: RawInfo{
+			Length:        789,
+			PayloadLength: 1234,
+		},
+		Frames: []Frame{
+			{Frame: &MaxStreamDataFrame{StreamID: 42, MaximumStreamData: 987}},
+			{Frame: &StreamFrame{StreamID: 123, Offset: 1234, Length: 6, Fin: true}},
+		},
+		ECN:                     ECT0,
+		DatagramPayloadChecksum: 42,
+	})
+
+	require.Equal(t, "transport:packet_received", name)
+	require.Contains(t, ev, "raw")
+	raw := ev["raw"].(map[string]any)
+	require.Equal(t, float64(789), raw["length"])
+	require.Equal(t, float64(1234), raw["payload_length"])
+	require.Equal(t, "ECT(0)", ev["ecn"])
+	require.Contains(t, ev, "header")
+	hdr := ev["header"].(map[string]any)
+	require.Equal(t, "initial", hdr["packet_type"])
+	require.Equal(t, float64(1337), hdr["packet_number"])
+	require.Equal(t, "04030201", hdr["scid"])
+	require.Contains(t, hdr, "token")
+	token := hdr["token"].(map[string]any)
+	require.Equal(t, "deadbeef", token["data"])
+	require.Contains(t, ev, "frames")
+	require.Len(t, ev["frames"].([]any), 2)
+	require.Contains(t, ev, "datagram_payload_checksum")
+	require.Equal(t, float64(42), ev["datagram_payload_checksum"])
+}
+
+func TestPacketReceived1RTT(t *testing.T) {
+	t.Run("with datagram payload checksum", func(t *testing.T) {
+		testPacketReceived1RTT(t, 1337)
+	})
+
+	t.Run("without datagram payload checksum", func(t *testing.T) {
+		testPacketReceived1RTT(t, 0)
+	})
+}
+
+func testPacketReceived1RTT(t *testing.T, datagramPayloadChecksum DatagramPayloadChecksum) {
+	name, ev := testEventEncoding(t, &PacketReceived{
+		Header: PacketHeader{
+			PacketType:       PacketType1RTT,
+			PacketNumber:     1337,
+			KeyPhaseBit:      KeyPhaseZero,
+			DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+		},
+		Raw: RawInfo{Length: 789, PayloadLength: 1234},
+		Frames: []Frame{
+			{Frame: &MaxStreamDataFrame{StreamID: 42, MaximumStreamData: 987}},
+			{Frame: &StreamFrame{StreamID: 123, Offset: 1234, Length: 6, Fin: true}},
+		},
+		ECN:                     ECT1,
+		DatagramPayloadChecksum: datagramPayloadChecksum,
+	})
+
+	require.Equal(t, "transport:packet_received", name)
+	require.Contains(t, ev, "raw")
+	raw := ev["raw"].(map[string]any)
+	require.Equal(t, float64(789), raw["length"])
+	require.Equal(t, float64(1234), raw["payload_length"])
+	require.Equal(t, "ECT(1)", ev["ecn"])
+	require.Contains(t, ev, "header")
+	hdr := ev["header"].(map[string]any)
+	require.Equal(t, "1RTT", hdr["packet_type"])
+	require.Equal(t, float64(1337), hdr["packet_number"])
+	require.Contains(t, ev, "frames")
+	require.Len(t, ev["frames"].([]any), 2)
+	if datagramPayloadChecksum != 0 {
+		require.Contains(t, ev, "datagram_payload_checksum")
+		require.Equal(t, float64(datagramPayloadChecksum), ev["datagram_payload_checksum"])
+	} else {
+		require.NotContains(t, ev, "datagram_payload_checksum")
+	}
+}
+
+func TestPacketReceivedRetry(t *testing.T) {
+	name, ev := testEventEncoding(t, &PacketReceived{
+		Header: PacketHeader{
+			PacketType:       PacketTypeRetry,
+			Version:          protocol.Version1,
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{4, 3, 2, 1}),
+			DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+			Token:            &Token{Raw: []byte{0xde, 0xad, 0xbe, 0xef}},
+		},
+		Raw: RawInfo{Length: 123},
+	})
+
+	require.Equal(t, "transport:packet_received", name)
+	require.Contains(t, ev, "raw")
+	raw := ev["raw"].(map[string]any)
+	require.Len(t, raw, 1)
+	require.Equal(t, float64(123), raw["length"])
+	require.Contains(t, ev, "header")
+	header := ev["header"].(map[string]any)
+	require.Equal(t, "retry", header["packet_type"])
+	require.NotContains(t, header, "packet_number")
+	require.Contains(t, header, "version")
+	require.Contains(t, header, "dcid")
+	require.Contains(t, header, "scid")
+	require.Contains(t, header, "token")
+	token := header["token"].(map[string]any)
+	require.Equal(t, "deadbeef", token["data"])
+	require.NotContains(t, ev, "frames")
+}
+
+func TestVersionNegotiationReceived(t *testing.T) {
+	name, ev := testEventEncoding(t, &VersionNegotiationReceived{
+		Header: PacketHeaderVersionNegotiation{
+			SrcConnectionID:  ArbitraryLenConnectionID{4, 3, 2, 1},
+			DestConnectionID: ArbitraryLenConnectionID{1, 2, 3, 4, 5, 6, 7, 8},
+		},
+		SupportedVersions: []Version{0xdeadbeef, 0xdecafbad},
+	})
+
+	require.Equal(t, "transport:packet_received", name)
+	require.Contains(t, ev, "header")
+	require.NotContains(t, ev, "frames")
+	require.Contains(t, ev, "supported_versions")
+	require.Equal(t, []any{"deadbeef", "decafbad"}, ev["supported_versions"])
+	header := ev["header"].(map[string]any)
+	require.Equal(t, "version_negotiation", header["packet_type"])
+	require.NotContains(t, header, "packet_number")
+	require.NotContains(t, header, "version")
+	require.Equal(t, "0102030405060708", header["dcid"])
+	require.Equal(t, "04030201", header["scid"])
+}
+
+func TestPacketBuffered(t *testing.T) {
+	name, ev := testEventEncoding(t, &PacketBuffered{
+		Header: PacketHeader{
+			PacketType:       PacketTypeHandshake,
+			PacketNumber:     protocol.InvalidPacketNumber,
+			DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{4, 3, 2, 1}),
+		},
+		Raw:                     RawInfo{Length: 1337},
+		DatagramPayloadChecksum: 42,
+	})
+
+	require.Equal(t, "transport:packet_buffered", name)
+	require.Contains(t, ev, "header")
+	require.Contains(t, ev, "raw")
+	require.Equal(t, float64(1337), ev["raw"].(map[string]any)["length"])
+	require.Equal(t, float64(42), ev["datagram_payload_checksum"])
+	require.Contains(t, ev, "trigger")
+	require.Equal(t, "keys_unavailable", ev["trigger"])
+}
+
+func TestPacketDropped(t *testing.T) {
+	name, ev := testEventEncoding(t, &PacketDropped{
+		Header:                  PacketHeader{PacketType: PacketTypeRetry},
+		Raw:                     RawInfo{Length: 1337},
+		DatagramPayloadChecksum: 42,
+		Trigger:                 PacketDropPayloadDecryptError,
+	})
+
+	require.Equal(t, "transport:packet_dropped", name)
+	require.Contains(t, ev, "raw")
+	require.Equal(t, float64(1337), ev["raw"].(map[string]any)["length"])
+	require.Equal(t, float64(42), ev["datagram_payload_checksum"])
+	require.Contains(t, ev, "header")
+	require.Equal(t, "payload_decrypt_error", ev["trigger"])
+}
+
+func TestMetricsUpdated(t *testing.T) {
+	rttStats := utils.NewRTTStats()
+	rttStats.UpdateRTT(15*time.Millisecond, 0)
+	rttStats.UpdateRTT(20*time.Millisecond, 0)
+	rttStats.UpdateRTT(25*time.Millisecond, 0)
+	name, ev := testEventEncoding(t, &MetricsUpdated{
+		MinRTT:           rttStats.MinRTT(),
+		SmoothedRTT:      rttStats.SmoothedRTT(),
+		LatestRTT:        rttStats.LatestRTT(),
+		RTTVariance:      rttStats.MeanDeviation(),
+		CongestionWindow: 4321,
+		BytesInFlight:    1234,
+		PacketsInFlight:  42,
+	})
+
+	require.Equal(t, "recovery:metrics_updated", name)
+	require.Equal(t, float64(15), ev["min_rtt"])
+	require.Equal(t, float64(25), ev["latest_rtt"])
+	require.Contains(t, ev, "smoothed_rtt")
+	require.InDelta(t, rttStats.SmoothedRTT().Milliseconds(), ev["smoothed_rtt"], float64(1))
+	require.Contains(t, ev, "rtt_variance")
+	require.InDelta(t, rttStats.MeanDeviation().Milliseconds(), ev["rtt_variance"], float64(1))
+	require.Equal(t, float64(4321), ev["congestion_window"])
+	require.Equal(t, float64(1234), ev["bytes_in_flight"])
+	require.Equal(t, float64(42), ev["packets_in_flight"])
+}
+
+func TestPacketLost(t *testing.T) {
+	name, ev := testEventEncoding(t, &PacketLost{
+		Header:  PacketHeader{PacketType: PacketTypeHandshake, PacketNumber: 42},
+		Trigger: PacketLossReorderingThreshold,
+	})
+
+	require.Equal(t, "recovery:packet_lost", name)
+	require.Contains(t, ev, "header")
+	require.Equal(t, "reordering_threshold", ev["trigger"])
+}
+
+func TestSpuriousLoss(t *testing.T) {
+	name, ev := testEventEncoding(t, &SpuriousLoss{
+		EncryptionLevel:  protocol.Encryption1RTT,
+		PacketNumber:     42,
+		PacketReordering: 1,
+		TimeReordering:   1337 * time.Millisecond,
+	})
+
+	require.Equal(t, "recovery:spurious_loss", name)
+	require.Contains(t, ev, "packet_number")
+	require.Equal(t, float64(42), ev["packet_number"])
+	require.Contains(t, ev, "reordering_packets")
+	require.Equal(t, float64(1), ev["reordering_packets"])
+	require.Contains(t, ev, "reordering_time")
+	require.InDelta(t, 1337, ev["reordering_time"], float64(1))
+}
+
+func TestMTUUpdated(t *testing.T) {
+	name, ev := testEventEncoding(t, &MTUUpdated{
+		Value: 1337,
+		Done:  true,
+	})
+
+	require.Equal(t, "recovery:mtu_updated", name)
+	require.Equal(t, float64(1337), ev["mtu"])
+	require.Equal(t, true, ev["done"])
+}
+
+func TestCongestionStateUpdated(t *testing.T) {
+	name, ev := testEventEncoding(t, &CongestionStateUpdated{
+		State: CongestionStateCongestionAvoidance,
+	})
+
+	require.Equal(t, "recovery:congestion_state_updated", name)
+	require.Equal(t, "congestion_avoidance", ev["new"])
+}
+
+func TestPTOCountUpdated(t *testing.T) {
+	name, ev := testEventEncoding(t, &PTOCountUpdated{PTOCount: 42})
+
+	require.Equal(t, "recovery:metrics_updated", name)
+	require.Equal(t, float64(42), ev["pto_count"])
+}
+
+func TestKeyUpdatedTLS(t *testing.T) {
+	name, ev := testEventEncoding(t, &KeyUpdated{
+		Trigger:  KeyUpdateTLS,
+		KeyType:  KeyTypeClientHandshake,
+		KeyPhase: 0,
+	})
+
+	require.Equal(t, "security:key_updated", name)
+	require.Equal(t, "client_handshake_secret", ev["key_type"])
+	require.Equal(t, "tls", ev["trigger"])
+	require.NotContains(t, ev, "key_phase")
+	require.NotContains(t, ev, "old")
+	require.NotContains(t, ev, "new")
+}
+
+func TestKeyUpdatedTLS1RTT(t *testing.T) {
+	name, ev := testEventEncoding(t, &KeyUpdated{
+		Trigger:  KeyUpdateTLS,
+		KeyType:  KeyTypeServer1RTT,
+		KeyPhase: 0,
+	})
+
+	require.Equal(t, "security:key_updated", name)
+	require.Equal(t, "server_1rtt_secret", ev["key_type"])
+	require.Equal(t, "tls", ev["trigger"])
+	require.Equal(t, float64(0), ev["key_phase"])
+	require.NotContains(t, ev, "old")
+	require.NotContains(t, ev, "new")
+}
+
+func TestKeyUpdated(t *testing.T) {
+	name, ev := testEventEncoding(t, &KeyUpdated{
+		Trigger:  KeyUpdateRemote,
+		KeyType:  KeyTypeClient1RTT,
+		KeyPhase: 1337,
+	})
+
+	require.Equal(t, "security:key_updated", name)
+	require.Equal(t, float64(1337), ev["key_phase"])
+	require.Equal(t, "remote_update", ev["trigger"])
+	require.Contains(t, ev, "key_type")
+	require.Equal(t, "client_1rtt_secret", ev["key_type"])
+}
+
+func TestKeyDiscarded0RTT(t *testing.T) {
+	name, ev := testEventEncoding(t, &KeyDiscarded{
+		KeyType:  KeyTypeServer0RTT,
+		KeyPhase: 0,
+	})
+
+	require.Equal(t, "security:key_discarded", name)
+	require.Equal(t, "tls", ev["trigger"])
+	require.Equal(t, "server_0rtt_secret", ev["key_type"])
+}
+
+func TestKeyDiscarded(t *testing.T) {
+	name, ev := testEventEncoding(t, &KeyDiscarded{
+		KeyType:  KeyTypeClient1RTT,
+		KeyPhase: 42,
+	})
+
+	require.Equal(t, "security:key_discarded", name)
+	require.Equal(t, float64(42), ev["key_phase"])
+	require.NotContains(t, ev, "trigger")
+	require.Contains(t, ev, "key_type")
+	require.Equal(t, "client_1rtt_secret", ev["key_type"])
+}
+
+func TestLossTimerUpdated(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		var buf bytes.Buffer
+		tr := qlogwriter.NewConnectionFileSeq(
+			nopWriteCloser(&buf),
+			true,
+			protocol.ParseConnectionID([]byte{1, 2, 3, 4}),
+			[]string{EventSchema},
+		)
+		go tr.Run()
+		producer := tr.AddProducer()
+
+		synctest.Wait()
+		time.Sleep(42 * time.Second)
+
+		producer.RecordEvent(&LossTimerUpdated{
+			Type:      LossTimerUpdateTypeSet,
+			TimerType: TimerTypePTO,
+			EncLevel:  protocol.EncryptionHandshake,
+			Time:      time.Now().Add(1337 * time.Second),
+		})
+		producer.Close()
+
+		name, ev := decode(t, buf.String())
+		require.Equal(t, "recovery:loss_timer_updated", name)
+		require.Len(t, ev, 4)
+		require.Equal(t, "set", ev["event_type"])
+		require.Equal(t, "pto", ev["timer_type"])
+		require.Equal(t, "handshake", ev["packet_number_space"])
+		require.Contains(t, ev, "delta")
+		delta := time.Duration(ev["delta"].(float64)*1e6) * time.Nanosecond
+		require.Equal(t, 1337*time.Second, delta)
+	})
+}
+
+func TestLossTimerUpdatedExpired(t *testing.T) {
+	name, ev := testEventEncoding(t, &LossTimerUpdated{
+		Type:      LossTimerUpdateTypeExpired,
+		TimerType: TimerTypeACK,
+		EncLevel:  protocol.Encryption1RTT,
+	})
+
+	require.Equal(t, "recovery:loss_timer_updated", name)
+	require.Len(t, ev, 3)
+	require.Equal(t, "expired", ev["event_type"])
+	require.Equal(t, "ack", ev["timer_type"])
+	require.Equal(t, "application_data", ev["packet_number_space"])
+}
+
+func TestLossTimerUpdatedCanceled(t *testing.T) {
+	name, ev := testEventEncoding(t, &eventLossTimerCanceled{})
+
+	require.Equal(t, "recovery:loss_timer_updated", name)
+	require.Len(t, ev, 1)
+	require.Equal(t, "cancelled", ev["event_type"])
+}
+
+func TestECNStateUpdated(t *testing.T) {
+	name, ev := testEventEncoding(t, &ECNStateUpdated{
+		State:   ECNStateUnknown,
+		Trigger: "",
+	})
+
+	require.Equal(t, "recovery:ecn_state_updated", name)
+	require.Len(t, ev, 1)
+	require.Equal(t, "unknown", ev["new"])
+}
+
+func TestECNStateUpdatedWithTrigger(t *testing.T) {
+	name, ev := testEventEncoding(t, &ECNStateUpdated{
+		State:   ECNStateFailed,
+		Trigger: "ACK doesn't contain ECN marks",
+	})
+
+	require.Equal(t, "recovery:ecn_state_updated", name)
+	require.Len(t, ev, 2)
+	require.Equal(t, "failed", ev["new"])
+	require.Equal(t, "ACK doesn't contain ECN marks", ev["trigger"])
+}
+
+func TestALPNInformation(t *testing.T) {
+	name, ev := testEventEncoding(t, &ALPNInformation{
+		ChosenALPN: "h3",
+	})
+
+	require.Equal(t, "transport:alpn_information", name)
+	require.Len(t, ev, 1)
+	require.Equal(t, "h3", ev["chosen_alpn"])
+}
+
+func TestDebugEvent(t *testing.T) {
+	t.Run("default name", func(t *testing.T) {
+		name, ev := testEventEncoding(t, &DebugEvent{Message: "hello world"})
+		require.Equal(t, "transport:debug", name)
+		require.Len(t, ev, 1)
+		require.Equal(t, "hello world", ev["message"])
+	})
+
+	t.Run("custom name", func(t *testing.T) {
+		name, ev := testEventEncoding(t, &DebugEvent{EventName: "foo", Message: "bar"})
+		require.Equal(t, "transport:foo", name)
+		require.Len(t, ev, 1)
+		require.Equal(t, "bar", ev["message"])
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/frame.go b/electron/native/private-transport/third_party/quic-go/qlog/frame.go
new file mode 100644
index 000000000..b66fedc95
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/frame.go
@@ -0,0 +1,481 @@
+package qlog
+
+import (
+	"encoding/hex"
+
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+)
+
+type Frame struct {
+	Frame any
+}
+
+type frames []Frame
+
+type (
+	// An AckFrame is an ACK frame.
+	AckFrame = wire.AckFrame
+	// A ConnectionCloseFrame is a CONNECTION_CLOSE frame.
+	ConnectionCloseFrame = wire.ConnectionCloseFrame
+	// A DataBlockedFrame is a DATA_BLOCKED frame.
+	DataBlockedFrame = wire.DataBlockedFrame
+	// A HandshakeDoneFrame is a HANDSHAKE_DONE frame.
+	HandshakeDoneFrame = wire.HandshakeDoneFrame
+	// A MaxDataFrame is a MAX_DATA frame.
+	MaxDataFrame = wire.MaxDataFrame
+	// A MaxStreamDataFrame is a MAX_STREAM_DATA frame.
+	MaxStreamDataFrame = wire.MaxStreamDataFrame
+	// A MaxStreamsFrame is a MAX_STREAMS_FRAME.
+	MaxStreamsFrame = wire.MaxStreamsFrame
+	// A NewConnectionIDFrame is a NEW_CONNECTION_ID frame.
+	NewConnectionIDFrame = wire.NewConnectionIDFrame
+	// A NewTokenFrame is a NEW_TOKEN frame.
+	NewTokenFrame = wire.NewTokenFrame
+	// A PathChallengeFrame is a PATH_CHALLENGE frame.
+	PathChallengeFrame = wire.PathChallengeFrame
+	// A PathResponseFrame is a PATH_RESPONSE frame.
+	PathResponseFrame = wire.PathResponseFrame
+	// A PingFrame is a PING frame.
+	PingFrame = wire.PingFrame
+	// A ResetStreamFrame is a RESET_STREAM frame.
+	ResetStreamFrame = wire.ResetStreamFrame
+	// A RetireConnectionIDFrame is a RETIRE_CONNECTION_ID frame.
+	RetireConnectionIDFrame = wire.RetireConnectionIDFrame
+	// A StopSendingFrame is a STOP_SENDING frame.
+	StopSendingFrame = wire.StopSendingFrame
+	// A StreamsBlockedFrame is a STREAMS_BLOCKED frame.
+	StreamsBlockedFrame = wire.StreamsBlockedFrame
+	// A StreamDataBlockedFrame is a STREAM_DATA_BLOCKED frame.
+	StreamDataBlockedFrame = wire.StreamDataBlockedFrame
+	// An AckFrequencyFrame is an ACK_FREQUENCY frame.
+	AckFrequencyFrame = wire.AckFrequencyFrame
+	// An ImmediateAckFrame is an IMMEDIATE_ACK frame.
+	ImmediateAckFrame = wire.ImmediateAckFrame
+)
+
+type AckRange = wire.AckRange
+
+// A CryptoFrame is a CRYPTO frame.
+type CryptoFrame struct {
+	Offset int64
+	Length int64
+}
+
+// A StreamFrame is a STREAM frame.
+type StreamFrame struct {
+	StreamID StreamID
+	Offset   int64
+	Length   int64
+	Fin      bool
+}
+
+// A DatagramFrame is a DATAGRAM frame.
+type DatagramFrame struct {
+	Length int64
+}
+
+func (fs frames) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginArray)
+	for _, f := range fs {
+		if err := f.Encode(enc); err != nil {
+			return err
+		}
+	}
+	h.WriteToken(jsontext.EndArray)
+	return h.err
+}
+
+func (f Frame) Encode(enc *jsontext.Encoder) error {
+	switch frame := f.Frame.(type) {
+	case *PingFrame:
+		return encodePingFrame(enc, frame)
+	case *AckFrame:
+		return encodeAckFrame(enc, frame)
+	case *ResetStreamFrame:
+		return encodeResetStreamFrame(enc, frame)
+	case *StopSendingFrame:
+		return encodeStopSendingFrame(enc, frame)
+	case *CryptoFrame:
+		return encodeCryptoFrame(enc, frame)
+	case *NewTokenFrame:
+		return encodeNewTokenFrame(enc, frame)
+	case *StreamFrame:
+		return encodeStreamFrame(enc, frame)
+	case *MaxDataFrame:
+		return encodeMaxDataFrame(enc, frame)
+	case *MaxStreamDataFrame:
+		return encodeMaxStreamDataFrame(enc, frame)
+	case *MaxStreamsFrame:
+		return encodeMaxStreamsFrame(enc, frame)
+	case *DataBlockedFrame:
+		return encodeDataBlockedFrame(enc, frame)
+	case *StreamDataBlockedFrame:
+		return encodeStreamDataBlockedFrame(enc, frame)
+	case *StreamsBlockedFrame:
+		return encodeStreamsBlockedFrame(enc, frame)
+	case *NewConnectionIDFrame:
+		return encodeNewConnectionIDFrame(enc, frame)
+	case *RetireConnectionIDFrame:
+		return encodeRetireConnectionIDFrame(enc, frame)
+	case *PathChallengeFrame:
+		return encodePathChallengeFrame(enc, frame)
+	case *PathResponseFrame:
+		return encodePathResponseFrame(enc, frame)
+	case *ConnectionCloseFrame:
+		return encodeConnectionCloseFrame(enc, frame)
+	case *HandshakeDoneFrame:
+		return encodeHandshakeDoneFrame(enc, frame)
+	case *DatagramFrame:
+		return encodeDatagramFrame(enc, frame)
+	case *AckFrequencyFrame:
+		return encodeAckFrequencyFrame(enc, frame)
+	case *ImmediateAckFrame:
+		return encodeImmediateAckFrame(enc, frame)
+	default:
+		panic("unknown frame type")
+	}
+}
+
+func encodePingFrame(enc *jsontext.Encoder, _ *PingFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("ping"))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type ackRanges []wire.AckRange
+
+func (ars ackRanges) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginArray)
+	for _, r := range ars {
+		if err := ackRange(r).encode(enc); err != nil {
+			return err
+		}
+	}
+	h.WriteToken(jsontext.EndArray)
+	return h.err
+}
+
+type ackRange wire.AckRange
+
+func (ar ackRange) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginArray)
+	h.WriteToken(jsontext.Int(int64(ar.Smallest)))
+	if ar.Smallest != ar.Largest {
+		h.WriteToken(jsontext.Int(int64(ar.Largest)))
+	}
+	h.WriteToken(jsontext.EndArray)
+	return h.err
+}
+
+func encodeAckFrame(enc *jsontext.Encoder, f *AckFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("ack"))
+	if f.DelayTime > 0 {
+		h.WriteToken(jsontext.String("ack_delay"))
+		h.WriteToken(jsontext.Float(milliseconds(f.DelayTime)))
+	}
+	h.WriteToken(jsontext.String("acked_ranges"))
+	if err := ackRanges(f.AckRanges).encode(enc); err != nil {
+		return err
+	}
+	hasECN := f.ECT0 > 0 || f.ECT1 > 0 || f.ECNCE > 0
+	if hasECN {
+		h.WriteToken(jsontext.String("ect0"))
+		h.WriteToken(jsontext.Uint(f.ECT0))
+		h.WriteToken(jsontext.String("ect1"))
+		h.WriteToken(jsontext.Uint(f.ECT1))
+		h.WriteToken(jsontext.String("ce"))
+		h.WriteToken(jsontext.Uint(f.ECNCE))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeResetStreamFrame(enc *jsontext.Encoder, f *ResetStreamFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	if f.ReliableSize > 0 {
+		h.WriteToken(jsontext.String("reset_stream_at"))
+	} else {
+		h.WriteToken(jsontext.String("reset_stream"))
+	}
+	h.WriteToken(jsontext.String("stream_id"))
+	h.WriteToken(jsontext.Int(int64(f.StreamID)))
+	h.WriteToken(jsontext.String("error_code"))
+	h.WriteToken(jsontext.Int(int64(f.ErrorCode)))
+	h.WriteToken(jsontext.String("final_size"))
+	h.WriteToken(jsontext.Int(int64(f.FinalSize)))
+	if f.ReliableSize > 0 {
+		h.WriteToken(jsontext.String("reliable_size"))
+		h.WriteToken(jsontext.Int(int64(f.ReliableSize)))
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeStopSendingFrame(enc *jsontext.Encoder, f *StopSendingFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("stop_sending"))
+	h.WriteToken(jsontext.String("stream_id"))
+	h.WriteToken(jsontext.Int(int64(f.StreamID)))
+	h.WriteToken(jsontext.String("error_code"))
+	h.WriteToken(jsontext.Int(int64(f.ErrorCode)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeCryptoFrame(enc *jsontext.Encoder, f *CryptoFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("crypto"))
+	h.WriteToken(jsontext.String("offset"))
+	h.WriteToken(jsontext.Int(f.Offset))
+	h.WriteToken(jsontext.String("length"))
+	h.WriteToken(jsontext.Int(f.Length))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeNewTokenFrame(enc *jsontext.Encoder, f *NewTokenFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("new_token"))
+	h.WriteToken(jsontext.String("token"))
+	if err := (Token{Raw: f.Token}).encode(enc); err != nil {
+		return err
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeStreamFrame(enc *jsontext.Encoder, f *StreamFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("stream"))
+	h.WriteToken(jsontext.String("stream_id"))
+	h.WriteToken(jsontext.Int(int64(f.StreamID)))
+	h.WriteToken(jsontext.String("offset"))
+	h.WriteToken(jsontext.Int(f.Offset))
+	h.WriteToken(jsontext.String("length"))
+	h.WriteToken(jsontext.Int(f.Length))
+	if f.Fin {
+		h.WriteToken(jsontext.String("fin"))
+		h.WriteToken(jsontext.True)
+	}
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeMaxDataFrame(enc *jsontext.Encoder, f *MaxDataFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("max_data"))
+	h.WriteToken(jsontext.String("maximum"))
+	h.WriteToken(jsontext.Int(int64(f.MaximumData)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeMaxStreamDataFrame(enc *jsontext.Encoder, f *MaxStreamDataFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("max_stream_data"))
+	h.WriteToken(jsontext.String("stream_id"))
+	h.WriteToken(jsontext.Int(int64(f.StreamID)))
+	h.WriteToken(jsontext.String("maximum"))
+	h.WriteToken(jsontext.Int(int64(f.MaximumStreamData)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeMaxStreamsFrame(enc *jsontext.Encoder, f *MaxStreamsFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("max_streams"))
+	h.WriteToken(jsontext.String("stream_type"))
+	h.WriteToken(jsontext.String(streamType(f.Type).String()))
+	h.WriteToken(jsontext.String("maximum"))
+	h.WriteToken(jsontext.Int(int64(f.MaxStreamNum)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeDataBlockedFrame(enc *jsontext.Encoder, f *DataBlockedFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("data_blocked"))
+	h.WriteToken(jsontext.String("limit"))
+	h.WriteToken(jsontext.Int(int64(f.MaximumData)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeStreamDataBlockedFrame(enc *jsontext.Encoder, f *StreamDataBlockedFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("stream_data_blocked"))
+	h.WriteToken(jsontext.String("stream_id"))
+	h.WriteToken(jsontext.Int(int64(f.StreamID)))
+	h.WriteToken(jsontext.String("limit"))
+	h.WriteToken(jsontext.Int(int64(f.MaximumStreamData)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeStreamsBlockedFrame(enc *jsontext.Encoder, f *StreamsBlockedFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("streams_blocked"))
+	h.WriteToken(jsontext.String("stream_type"))
+	h.WriteToken(jsontext.String(streamType(f.Type).String()))
+	h.WriteToken(jsontext.String("limit"))
+	h.WriteToken(jsontext.Int(int64(f.StreamLimit)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeNewConnectionIDFrame(enc *jsontext.Encoder, f *NewConnectionIDFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("new_connection_id"))
+	h.WriteToken(jsontext.String("sequence_number"))
+	h.WriteToken(jsontext.Uint(f.SequenceNumber))
+	h.WriteToken(jsontext.String("retire_prior_to"))
+	h.WriteToken(jsontext.Uint(f.RetirePriorTo))
+	h.WriteToken(jsontext.String("length"))
+	h.WriteToken(jsontext.Int(int64(f.ConnectionID.Len())))
+	h.WriteToken(jsontext.String("connection_id"))
+	h.WriteToken(jsontext.String(f.ConnectionID.String()))
+	h.WriteToken(jsontext.String("stateless_reset_token"))
+	h.WriteToken(jsontext.String(hex.EncodeToString(f.StatelessResetToken[:])))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeRetireConnectionIDFrame(enc *jsontext.Encoder, f *RetireConnectionIDFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("retire_connection_id"))
+	h.WriteToken(jsontext.String("sequence_number"))
+	h.WriteToken(jsontext.Uint(f.SequenceNumber))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodePathChallengeFrame(enc *jsontext.Encoder, f *PathChallengeFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("path_challenge"))
+	h.WriteToken(jsontext.String("data"))
+	h.WriteToken(jsontext.String(hex.EncodeToString(f.Data[:])))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodePathResponseFrame(enc *jsontext.Encoder, f *PathResponseFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("path_response"))
+	h.WriteToken(jsontext.String("data"))
+	h.WriteToken(jsontext.String(hex.EncodeToString(f.Data[:])))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeConnectionCloseFrame(enc *jsontext.Encoder, f *ConnectionCloseFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("connection_close"))
+	h.WriteToken(jsontext.String("error_space"))
+	errorSpace := "transport"
+	if f.IsApplicationError {
+		errorSpace = "application"
+	}
+	h.WriteToken(jsontext.String(errorSpace))
+	errName := transportError(f.ErrorCode).String()
+	if len(errName) > 0 {
+		h.WriteToken(jsontext.String("error_code"))
+		h.WriteToken(jsontext.String(errName))
+	} else {
+		h.WriteToken(jsontext.String("error_code"))
+		h.WriteToken(jsontext.Uint(f.ErrorCode))
+	}
+	h.WriteToken(jsontext.String("raw_error_code"))
+	h.WriteToken(jsontext.Uint(f.ErrorCode))
+	h.WriteToken(jsontext.String("reason"))
+	h.WriteToken(jsontext.String(f.ReasonPhrase))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeHandshakeDoneFrame(enc *jsontext.Encoder, _ *HandshakeDoneFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("handshake_done"))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeDatagramFrame(enc *jsontext.Encoder, f *DatagramFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("datagram"))
+	h.WriteToken(jsontext.String("length"))
+	h.WriteToken(jsontext.Int(f.Length))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeAckFrequencyFrame(enc *jsontext.Encoder, f *AckFrequencyFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("ack_frequency"))
+	h.WriteToken(jsontext.String("sequence_number"))
+	h.WriteToken(jsontext.Uint(f.SequenceNumber))
+	h.WriteToken(jsontext.String("ack_eliciting_threshold"))
+	h.WriteToken(jsontext.Uint(f.AckElicitingThreshold))
+	h.WriteToken(jsontext.String("request_max_ack_delay"))
+	h.WriteToken(jsontext.Float(milliseconds(f.RequestMaxAckDelay)))
+	h.WriteToken(jsontext.String("reordering_threshold"))
+	h.WriteToken(jsontext.Int(int64(f.ReorderingThreshold)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+func encodeImmediateAckFrame(enc *jsontext.Encoder, _ *ImmediateAckFrame) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("frame_type"))
+	h.WriteToken(jsontext.String("immediate_ack"))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/frame_test.go b/electron/native/private-transport/third_party/quic-go/qlog/frame_test.go
new file mode 100644
index 000000000..52c752ff6
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/frame_test.go
@@ -0,0 +1,421 @@
+package qlog
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+
+	"github.com/stretchr/testify/require"
+)
+
+func check(t *testing.T, f any, expected map[string]any) {
+	var buf bytes.Buffer
+	enc := jsontext.NewEncoder(&buf)
+	require.NoError(t, (Frame{Frame: f}).Encode(enc))
+	data := buf.Bytes()
+	require.True(t, json.Valid(data))
+	checkEncoding(t, data, expected)
+}
+
+func TestPingFrame(t *testing.T) {
+	check(t, &PingFrame{}, map[string]any{"frame_type": "ping"})
+}
+
+func TestAckFrame(t *testing.T) {
+	tests := []struct {
+		name     string
+		frame    *AckFrame
+		expected map[string]any
+	}{
+		{
+			name: "with delay and single packet range",
+			frame: &AckFrame{
+				DelayTime: 86 * time.Millisecond,
+				AckRanges: []AckRange{{Smallest: 120, Largest: 120}},
+			},
+			expected: map[string]any{
+				"frame_type":   "ack",
+				"ack_delay":    86,
+				"acked_ranges": [][]float64{{120}},
+			},
+		},
+		{
+			name: "without delay",
+			frame: &AckFrame{
+				AckRanges: []AckRange{{Smallest: 120, Largest: 120}},
+			},
+			expected: map[string]any{
+				"frame_type":   "ack",
+				"acked_ranges": [][]float64{{120}},
+			},
+		},
+		{
+			name: "with ECN counts",
+			frame: &AckFrame{
+				AckRanges: []AckRange{{Smallest: 120, Largest: 120}},
+				ECT0:      10,
+				ECT1:      100,
+				ECNCE:     1000,
+			},
+			expected: map[string]any{
+				"frame_type":   "ack",
+				"acked_ranges": [][]float64{{120}},
+				"ect0":         10,
+				"ect1":         100,
+				"ce":           1000,
+			},
+		},
+		{
+			name: "with multiple ranges",
+			frame: &AckFrame{
+				DelayTime: 86 * time.Millisecond,
+				AckRanges: []AckRange{
+					{Smallest: 5, Largest: 50},
+					{Smallest: 100, Largest: 120},
+				},
+			},
+			expected: map[string]any{
+				"frame_type": "ack",
+				"ack_delay":  86,
+				"acked_ranges": [][]float64{
+					{5, 50},
+					{100, 120},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check(t, tt.frame, tt.expected)
+		})
+	}
+}
+
+func TestResetStreamFrame(t *testing.T) {
+	check(t,
+		&ResetStreamFrame{
+			StreamID:  987,
+			FinalSize: 1234,
+			ErrorCode: 42,
+		},
+		map[string]any{
+			"frame_type": "reset_stream",
+			"stream_id":  987,
+			"error_code": 42,
+			"final_size": 1234,
+		},
+	)
+}
+
+func TestResetStreamAtFrame(t *testing.T) {
+	check(t,
+		&ResetStreamFrame{
+			StreamID:     987,
+			FinalSize:    1234,
+			ErrorCode:    42,
+			ReliableSize: 999,
+		},
+		map[string]any{
+			"frame_type":    "reset_stream_at",
+			"stream_id":     987,
+			"error_code":    42,
+			"final_size":    1234,
+			"reliable_size": 999,
+		},
+	)
+}
+
+func TestAckFrequencyFrame(t *testing.T) {
+	check(t,
+		&AckFrequencyFrame{
+			SequenceNumber:        1337,
+			AckElicitingThreshold: 123,
+			RequestMaxAckDelay:    42 * time.Millisecond,
+			ReorderingThreshold:   1234,
+		},
+		map[string]any{
+			"frame_type":              "ack_frequency",
+			"sequence_number":         1337,
+			"ack_eliciting_threshold": 123,
+			"request_max_ack_delay":   42,
+			"reordering_threshold":    1234,
+		},
+	)
+}
+
+func TestImmediateAckFrame(t *testing.T) {
+	check(t,
+		&ImmediateAckFrame{},
+		map[string]any{
+			"frame_type": "immediate_ack",
+		},
+	)
+}
+
+func TestStopSendingFrame(t *testing.T) {
+	check(t,
+		&StopSendingFrame{StreamID: 987, ErrorCode: 42},
+		map[string]any{
+			"frame_type": "stop_sending",
+			"stream_id":  987,
+			"error_code": 42,
+		},
+	)
+}
+
+func TestCryptoFrame(t *testing.T) {
+	check(t,
+		&CryptoFrame{Offset: 1337, Length: 6},
+		map[string]any{
+			"frame_type": "crypto",
+			"offset":     1337,
+			"length":     6,
+		},
+	)
+}
+
+func TestNewTokenFrame(t *testing.T) {
+	check(t,
+		&NewTokenFrame{Token: []byte{0xde, 0xad, 0xbe, 0xef}},
+		map[string]any{
+			"frame_type": "new_token",
+			"token":      map[string]any{"data": "deadbeef"},
+		},
+	)
+}
+
+func TestStreamFrame(t *testing.T) {
+	tests := []struct {
+		name     string
+		frame    *StreamFrame
+		expected map[string]any
+	}{
+		{
+			name: "with FIN",
+			frame: &StreamFrame{
+				StreamID: 42,
+				Offset:   1337,
+				Fin:      true,
+				Length:   9876,
+			},
+			expected: map[string]any{
+				"frame_type": "stream",
+				"stream_id":  42,
+				"offset":     1337,
+				"fin":        true,
+				"length":     9876,
+			},
+		},
+		{
+			name: "without FIN",
+			frame: &StreamFrame{
+				StreamID: 42,
+				Offset:   1337,
+				Length:   3,
+			},
+			expected: map[string]any{
+				"frame_type": "stream",
+				"stream_id":  42,
+				"offset":     1337,
+				"length":     3,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check(t, tt.frame, tt.expected)
+		})
+	}
+}
+
+func TestMaxDataFrame(t *testing.T) {
+	check(t,
+		&MaxDataFrame{MaximumData: 1337},
+		map[string]any{
+			"frame_type": "max_data",
+			"maximum":    1337,
+		},
+	)
+}
+
+func TestMaxStreamDataFrame(t *testing.T) {
+	check(t,
+		&MaxStreamDataFrame{StreamID: 1234, MaximumStreamData: 1337},
+		map[string]any{
+			"frame_type": "max_stream_data",
+			"stream_id":  1234,
+			"maximum":    1337,
+		},
+	)
+}
+
+func TestMaxStreamsFrame(t *testing.T) {
+	check(t,
+		&MaxStreamsFrame{
+			Type:         protocol.StreamTypeBidi,
+			MaxStreamNum: 42,
+		},
+		map[string]any{
+			"frame_type":  "max_streams",
+			"stream_type": "bidirectional",
+			"maximum":     42,
+		},
+	)
+}
+
+func TestDataBlockedFrame(t *testing.T) {
+	check(t,
+		&DataBlockedFrame{MaximumData: 1337},
+		map[string]any{
+			"frame_type": "data_blocked",
+			"limit":      1337,
+		},
+	)
+}
+
+func TestStreamDataBlockedFrame(t *testing.T) {
+	check(t,
+		&StreamDataBlockedFrame{
+			StreamID:          42,
+			MaximumStreamData: 1337,
+		},
+		map[string]any{
+			"frame_type": "stream_data_blocked",
+			"stream_id":  42,
+			"limit":      1337,
+		},
+	)
+}
+
+func TestStreamsBlockedFrame(t *testing.T) {
+	check(t,
+		&StreamsBlockedFrame{
+			Type:        protocol.StreamTypeUni,
+			StreamLimit: 123,
+		},
+		map[string]any{
+			"frame_type":  "streams_blocked",
+			"stream_type": "unidirectional",
+			"limit":       123,
+		},
+	)
+}
+
+func TestNewConnectionIDFrame(t *testing.T) {
+	check(t,
+		&NewConnectionIDFrame{
+			SequenceNumber:      42,
+			RetirePriorTo:       24,
+			ConnectionID:        protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+			StatelessResetToken: protocol.StatelessResetToken{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf},
+		},
+		map[string]any{
+			"frame_type":            "new_connection_id",
+			"sequence_number":       42,
+			"retire_prior_to":       24,
+			"length":                4,
+			"connection_id":         "deadbeef",
+			"stateless_reset_token": "000102030405060708090a0b0c0d0e0f",
+		},
+	)
+}
+
+func TestRetireConnectionIDFrame(t *testing.T) {
+	check(t,
+		&RetireConnectionIDFrame{SequenceNumber: 1337},
+		map[string]any{
+			"frame_type":      "retire_connection_id",
+			"sequence_number": 1337,
+		},
+	)
+}
+
+func TestPathChallengeFrame(t *testing.T) {
+	check(t,
+		&PathChallengeFrame{Data: [8]byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0xc0, 0x01}},
+		map[string]any{
+			"frame_type": "path_challenge",
+			"data":       "deadbeefcafec001",
+		},
+	)
+}
+
+func TestPathResponseFrame(t *testing.T) {
+	check(t,
+		&PathResponseFrame{Data: [8]byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0xc0, 0x01}},
+		map[string]any{
+			"frame_type": "path_response",
+			"data":       "deadbeefcafec001",
+		},
+	)
+}
+
+func TestConnectionCloseFrame(t *testing.T) {
+	tests := []struct {
+		name     string
+		frame    *ConnectionCloseFrame
+		expected map[string]any
+	}{
+		{
+			name: "application error code",
+			frame: &ConnectionCloseFrame{
+				IsApplicationError: true,
+				ErrorCode:          1337,
+				ReasonPhrase:       "lorem ipsum",
+			},
+			expected: map[string]any{
+				"frame_type":     "connection_close",
+				"error_space":    "application",
+				"error_code":     1337,
+				"raw_error_code": 1337,
+				"reason":         "lorem ipsum",
+			},
+		},
+		{
+			name: "transport error code",
+			frame: &ConnectionCloseFrame{
+				ErrorCode:    uint64(qerr.FlowControlError),
+				ReasonPhrase: "lorem ipsum",
+			},
+			expected: map[string]any{
+				"frame_type":     "connection_close",
+				"error_space":    "transport",
+				"error_code":     "flow_control_error",
+				"raw_error_code": int(qerr.FlowControlError),
+				"reason":         "lorem ipsum",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check(t, tt.frame, tt.expected)
+		})
+	}
+}
+
+func TestHandshakeDoneFrame(t *testing.T) {
+	check(t,
+		&HandshakeDoneFrame{},
+		map[string]any{
+			"frame_type": "handshake_done",
+		},
+	)
+}
+
+func TestDatagramFrame(t *testing.T) {
+	check(t,
+		&DatagramFrame{Length: 1337},
+		map[string]any{
+			"frame_type": "datagram",
+			"length":     1337,
+		},
+	)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/json_helper_test.go b/electron/native/private-transport/third_party/quic-go/qlog/json_helper_test.go
new file mode 100644
index 000000000..648c97d0e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/json_helper_test.go
@@ -0,0 +1,42 @@
+package qlog
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func checkEncoding(t *testing.T, data []byte, expected map[string]any) {
+	t.Helper()
+
+	m := make(map[string]any)
+	require.NoError(t, json.Unmarshal(data, &m))
+	require.Len(t, m, len(expected))
+
+	for key, value := range expected {
+		switch v := value.(type) {
+		case bool, string, map[string]any:
+			require.Equal(t, v, m[key])
+		case int:
+			require.Equal(t, float64(v), m[key])
+		case [][]float64: // used in the ACK frame
+			require.Contains(t, m, key)
+			outerSlice, ok := m[key].([]any)
+			require.True(t, ok)
+			require.Len(t, outerSlice, len(v))
+			for i, innerExpected := range v {
+				innerSlice, ok := outerSlice[i].([]any)
+				require.True(t, ok)
+				require.Len(t, innerSlice, len(innerExpected))
+				for j, expectedValue := range innerExpected {
+					v, ok := innerSlice[j].(float64)
+					require.True(t, ok)
+					require.Equal(t, expectedValue, v)
+				}
+			}
+		default:
+			t.Fatalf("unexpected type: %T", v)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/packet_header.go b/electron/native/private-transport/third_party/quic-go/qlog/packet_header.go
new file mode 100644
index 000000000..149ebcb6a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/packet_header.go
@@ -0,0 +1,96 @@
+package qlog
+
+import (
+	"encoding/hex"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+)
+
+type Token struct {
+	Raw []byte
+}
+
+func (t Token) encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("data"))
+	h.WriteToken(jsontext.String(hex.EncodeToString(t.Raw)))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+// PacketHeader is a QUIC packet header.
+type PacketHeader struct {
+	PacketType       PacketType
+	KeyPhaseBit      KeyPhaseBit
+	PacketNumber     PacketNumber
+	Version          Version
+	SrcConnectionID  ConnectionID
+	DestConnectionID ConnectionID
+	Token            *Token
+}
+
+func (h PacketHeader) encode(enc *jsontext.Encoder) error {
+	helper := encoderHelper{enc: enc}
+	helper.WriteToken(jsontext.BeginObject)
+	helper.WriteToken(jsontext.String("packet_type"))
+	helper.WriteToken(jsontext.String(string(h.PacketType)))
+	if h.PacketType != PacketTypeRetry && h.PacketType != PacketTypeVersionNegotiation && h.PacketType != "" &&
+		h.PacketNumber != protocol.InvalidPacketNumber {
+		helper.WriteToken(jsontext.String("packet_number"))
+		helper.WriteToken(jsontext.Int(int64(h.PacketNumber)))
+	}
+	if h.Version != 0 {
+		helper.WriteToken(jsontext.String("version"))
+		helper.WriteToken(jsontext.String(version(h.Version).String()))
+	}
+	if h.PacketType != PacketType1RTT {
+		helper.WriteToken(jsontext.String("scil"))
+		helper.WriteToken(jsontext.Int(int64(h.SrcConnectionID.Len())))
+		if h.SrcConnectionID.Len() > 0 {
+			helper.WriteToken(jsontext.String("scid"))
+			helper.WriteToken(jsontext.String(h.SrcConnectionID.String()))
+		}
+	}
+	helper.WriteToken(jsontext.String("dcil"))
+	helper.WriteToken(jsontext.Int(int64(h.DestConnectionID.Len())))
+	if h.DestConnectionID.Len() > 0 {
+		helper.WriteToken(jsontext.String("dcid"))
+		helper.WriteToken(jsontext.String(h.DestConnectionID.String()))
+	}
+	if h.KeyPhaseBit == KeyPhaseZero || h.KeyPhaseBit == KeyPhaseOne {
+		helper.WriteToken(jsontext.String("key_phase_bit"))
+		helper.WriteToken(jsontext.String(h.KeyPhaseBit.String()))
+	}
+	if h.Token != nil {
+		helper.WriteToken(jsontext.String("token"))
+		if err := h.Token.encode(enc); err != nil {
+			return err
+		}
+	}
+	helper.WriteToken(jsontext.EndObject)
+	return helper.err
+}
+
+type PacketHeaderVersionNegotiation struct {
+	SrcConnectionID  ArbitraryLenConnectionID
+	DestConnectionID ArbitraryLenConnectionID
+}
+
+func (h PacketHeaderVersionNegotiation) encode(enc *jsontext.Encoder) error {
+	helper := encoderHelper{enc: enc}
+	helper.WriteToken(jsontext.BeginObject)
+	helper.WriteToken(jsontext.String("packet_type"))
+	helper.WriteToken(jsontext.String("version_negotiation"))
+	helper.WriteToken(jsontext.String("scil"))
+	helper.WriteToken(jsontext.Int(int64(h.SrcConnectionID.Len())))
+	helper.WriteToken(jsontext.String("scid"))
+	helper.WriteToken(jsontext.String(h.SrcConnectionID.String()))
+	helper.WriteToken(jsontext.String("dcil"))
+	helper.WriteToken(jsontext.Int(int64(h.DestConnectionID.Len())))
+	helper.WriteToken(jsontext.String("dcid"))
+	helper.WriteToken(jsontext.String(h.DestConnectionID.String()))
+	helper.WriteToken(jsontext.EndObject)
+	return helper.err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/packet_header_test.go b/electron/native/private-transport/third_party/quic-go/qlog/packet_header_test.go
new file mode 100644
index 000000000..84ed18651
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/packet_header_test.go
@@ -0,0 +1,134 @@
+package qlog
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+
+	"github.com/stretchr/testify/require"
+)
+
+func checkHeader(t *testing.T, hdr *PacketHeader, expected map[string]any) {
+	t.Helper()
+
+	var buf bytes.Buffer
+	enc := jsontext.NewEncoder(&buf)
+	require.NoError(t, hdr.encode(enc))
+	data := buf.Bytes()
+	require.True(t, json.Valid(data))
+	checkEncoding(t, data, expected)
+}
+
+func TestHeaderInitial(t *testing.T) {
+	checkHeader(t,
+		&PacketHeader{
+			PacketType:   PacketTypeInitial,
+			PacketNumber: 42,
+			Version:      protocol.Version(0xdecafbad),
+		},
+		map[string]any{
+			"packet_type":   "initial",
+			"packet_number": 42,
+			"dcil":          0,
+			"scil":          0,
+			"version":       "decafbad",
+		},
+	)
+}
+
+func TestHeaderInitialWithToken(t *testing.T) {
+	checkHeader(t,
+		&PacketHeader{
+			PacketType:       PacketTypeInitial,
+			PacketNumber:     1337,
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{0x11, 0x22, 0x33, 0x44}),
+			DestConnectionID: protocol.ParseConnectionID([]byte{0x55, 0x66, 0x77, 0x88}),
+			Version:          protocol.Version(0xdecafbad),
+			Token:            &Token{Raw: []byte{0xde, 0xad, 0xbe, 0xef}},
+		},
+		map[string]any{
+			"packet_type":   "initial",
+			"packet_number": 1337,
+			"dcil":          4,
+			"dcid":          "55667788",
+			"scil":          4,
+			"scid":          "11223344",
+			"version":       "decafbad",
+			"token":         map[string]any{"data": "deadbeef"},
+		},
+	)
+}
+
+func TestHeaderLongPacketNumbers(t *testing.T) {
+	t.Run("packet 0", func(t *testing.T) {
+		testHeaderPacketNumbers(t, 0)
+	})
+
+	// This is used for events where the packet number is not yet known,
+	// e.g. the packet_buffered event.
+	t.Run("no packet number", func(t *testing.T) {
+		testHeaderPacketNumbers(t, 1)
+	})
+}
+
+func testHeaderPacketNumbers(t *testing.T, pn protocol.PacketNumber) {
+	expected := map[string]any{
+		"packet_type": "handshake",
+		"dcil":        0,
+		"scil":        0,
+		"version":     "1",
+	}
+	if pn != protocol.InvalidPacketNumber {
+		expected["packet_number"] = int(pn)
+	}
+	checkHeader(t,
+		&PacketHeader{
+			PacketType:   PacketTypeHandshake,
+			PacketNumber: pn,
+			Version:      protocol.Version1,
+		},
+		expected,
+	)
+}
+
+func TestHeaderRetry(t *testing.T) {
+	checkHeader(t,
+		&PacketHeader{
+			PacketType:       PacketTypeRetry,
+			SrcConnectionID:  protocol.ParseConnectionID([]byte{0x11, 0x22, 0x33, 0x44}),
+			DestConnectionID: protocol.ParseConnectionID([]byte{0x55, 0x66, 0x77, 0x88, 0x99}),
+			Version:          protocol.Version(0xdecafbad),
+			Token:            &Token{Raw: []byte{0xde, 0xad, 0xbe, 0xef}},
+		},
+		map[string]any{
+			"packet_type": "retry",
+			"dcil":        5,
+			"dcid":        "5566778899",
+			"scil":        4,
+			"scid":        "11223344",
+			"token":       map[string]any{"data": "deadbeef"},
+			"version":     "decafbad",
+		},
+	)
+}
+
+func TestHeader1RTT(t *testing.T) {
+	checkHeader(t,
+		&PacketHeader{
+			PacketType:       PacketType1RTT,
+			PacketNumber:     42,
+			DestConnectionID: protocol.ParseConnectionID([]byte{0x55, 0x66, 0x77, 0x88}),
+			KeyPhaseBit:      KeyPhaseZero,
+		},
+		map[string]any{
+			"packet_type":   "1RTT",
+			"packet_number": 42,
+			"dcil":          4,
+			"dcid":          "55667788",
+			"key_phase_bit": "0",
+		},
+	)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/qlog_dir.go b/electron/native/private-transport/third_party/quic-go/qlog/qlog_dir.go
new file mode 100644
index 000000000..83bb72b3f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/qlog_dir.go
@@ -0,0 +1,61 @@
+package qlog
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"slices"
+	"strings"
+
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+// EventSchema is the qlog event schema for QUIC
+const EventSchema = "urn:ietf:params:qlog:events:quic-12"
+
+// DefaultConnectionTracer creates a qlog file in the qlog directory specified by the QLOGDIR environment variable.
+// File names are <odcid>_<perspective>.sqlog.
+// Returns nil if QLOGDIR is not set.
+func DefaultConnectionTracer(_ context.Context, isClient bool, connID ConnectionID) qlogwriter.Trace {
+	return defaultConnectionTracerWithSchemas(isClient, connID, []string{EventSchema})
+}
+
+func DefaultConnectionTracerWithSchemas(_ context.Context, isClient bool, connID ConnectionID, eventSchemas []string) qlogwriter.Trace {
+	if !slices.Contains(eventSchemas, EventSchema) {
+		eventSchemas = append([]string{EventSchema}, eventSchemas...)
+	}
+	return defaultConnectionTracerWithSchemas(isClient, connID, eventSchemas)
+}
+
+func defaultConnectionTracerWithSchemas(isClient bool, connID ConnectionID, eventSchemas []string) qlogwriter.Trace {
+	qlogDir := os.Getenv("QLOGDIR")
+	if qlogDir == "" {
+		return nil
+	}
+	if _, err := os.Stat(qlogDir); os.IsNotExist(err) {
+		if err := os.MkdirAll(qlogDir, 0o755); err != nil {
+			log.Fatalf("failed to create qlog dir %s: %v", qlogDir, err)
+		}
+	}
+	label := "server"
+	if isClient {
+		label = "client"
+	}
+	path := fmt.Sprintf("%s/%s_%s.sqlog", strings.TrimRight(qlogDir, "/"), connID, label)
+	f, err := os.Create(path)
+	if err != nil {
+		log.Printf("Failed to create qlog file %s: %s", path, err.Error())
+		return nil
+	}
+	fileSeq := qlogwriter.NewConnectionFileSeq(
+		utils.NewBufferedWriteCloser(bufio.NewWriter(f), f),
+		isClient,
+		connID,
+		eventSchemas,
+	)
+	go fileSeq.Run()
+	return fileSeq
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/qlog_dir_test.go b/electron/native/private-transport/third_party/quic-go/qlog/qlog_dir_test.go
new file mode 100644
index 000000000..9a59d5fe7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/qlog_dir_test.go
@@ -0,0 +1,70 @@
+package qlog
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/stretchr/testify/require"
+)
+
+func TestQLOGDIRSet(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	connID, _ := protocol.GenerateConnectionIDForInitial()
+	qlogDir := filepath.Join(tmpDir, "qlogs")
+	t.Setenv("QLOGDIR", qlogDir)
+
+	t.Run("default connection tracer", func(t *testing.T) {
+		tracer := DefaultConnectionTracer(context.Background(), true, connID)
+		testQLOGDIRSet(t, qlogDir, tracer, []string{EventSchema})
+	})
+
+	t.Run("default connection tracer with schemas", func(t *testing.T) {
+		tracer := DefaultConnectionTracerWithSchemas(context.Background(), true, connID, []string{"urn:ietf:params:qlog:events:foobar"})
+		testQLOGDIRSet(t, qlogDir, tracer, []string{EventSchema, "urn:ietf:params:qlog:events:foobar"})
+	})
+}
+
+func testQLOGDIRSet(t *testing.T, qlogDir string, tracer qlogwriter.Trace, expectedEventSchemas []string) {
+	require.NotNil(t, tracer)
+
+	// adding and closing a producer makes the tracer close the file
+	recorder := tracer.AddProducer()
+	recorder.Close()
+
+	_, err := os.Stat(qlogDir)
+	qlogDirCreated := !os.IsNotExist(err)
+	require.True(t, qlogDirCreated)
+
+	entries, err := os.ReadDir(qlogDir)
+	require.NoError(t, err)
+	require.Len(t, entries, 1)
+
+	data, err := os.ReadFile(filepath.Join(qlogDir, entries[0].Name()))
+	require.NoError(t, err)
+
+	var obj map[string]any
+	require.NoError(t, json.Unmarshal([]byte(strings.Split(string(data), "\n")[0])[1:], &obj))
+	require.Contains(t, obj, "trace")
+	require.IsType(t, obj["trace"], map[string]any{})
+	require.Contains(t, obj["trace"], "event_schemas")
+	var eventSchemas []string
+	for _, v := range obj["trace"].(map[string]any)["event_schemas"].([]any) {
+		eventSchemas = append(eventSchemas, v.(string))
+	}
+	require.Equal(t, eventSchemas, expectedEventSchemas)
+}
+
+func TestQLOGDIRNotSet(t *testing.T) {
+	connID, _ := protocol.GenerateConnectionIDForInitial()
+	t.Setenv("QLOGDIR", "")
+
+	tracer := DefaultConnectionTracer(context.Background(), true, connID)
+	require.Nil(t, tracer)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/types.go b/electron/native/private-transport/third_party/quic-go/qlog/types.go
new file mode 100644
index 000000000..97c7febef
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/types.go
@@ -0,0 +1,305 @@
+package qlog
+
+import (
+	"fmt"
+	"hash/crc32"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+)
+
+type (
+	ConnectionID             = protocol.ConnectionID
+	ArbitraryLenConnectionID = protocol.ArbitraryLenConnectionID
+	Version                  = protocol.Version
+	PacketNumber             = protocol.PacketNumber
+	EncryptionLevel          = protocol.EncryptionLevel
+	KeyPhaseBit              = protocol.KeyPhaseBit
+	KeyPhase                 = protocol.KeyPhase
+	StreamID                 = protocol.StreamID
+	TransportErrorCode       = qerr.TransportErrorCode
+	ApplicationErrorCode     = qerr.ApplicationErrorCode
+)
+
+const (
+	// KeyPhaseZero is key phase bit 0
+	KeyPhaseZero = protocol.KeyPhaseZero
+	// KeyPhaseOne is key phase bit 1
+	KeyPhaseOne = protocol.KeyPhaseOne
+)
+
+// ECN represents the Explicit Congestion Notification value.
+type ECN string
+
+const (
+	// ECNUnsupported means that no ECN value was set / received
+	ECNUnsupported ECN = ""
+	// ECTNot is Not-ECT
+	ECTNot ECN = "Not-ECT"
+	// ECT0 is ECT(0)
+	ECT0 ECN = "ECT(0)"
+	// ECT1 is ECT(1)
+	ECT1 ECN = "ECT(1)"
+	// ECNCE is CE
+	ECNCE ECN = "CE"
+)
+
+type Initiator string
+
+const (
+	InitiatorLocal  Initiator = "local"
+	InitiatorRemote Initiator = "remote"
+)
+
+type streamType protocol.StreamType
+
+func (s streamType) String() string {
+	switch protocol.StreamType(s) {
+	case protocol.StreamTypeUni:
+		return "unidirectional"
+	case protocol.StreamTypeBidi:
+		return "bidirectional"
+	default:
+		return "unknown stream type"
+	}
+}
+
+type version protocol.Version
+
+func (v version) String() string {
+	return fmt.Sprintf("%x", uint32(v))
+}
+
+func encLevelToPacketNumberSpace(encLevel protocol.EncryptionLevel) string {
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return "initial"
+	case protocol.EncryptionHandshake:
+		return "handshake"
+	case protocol.Encryption0RTT, protocol.Encryption1RTT:
+		return "application_data"
+	default:
+		return "unknown encryption level"
+	}
+}
+
+// KeyType represents the type of cryptographic key used in QUIC connections.
+type KeyType string
+
+const (
+	// KeyTypeServerInitial represents the server's initial secret key.
+	KeyTypeServerInitial KeyType = "server_initial_secret"
+	// KeyTypeClientInitial represents the client's initial secret key.
+	KeyTypeClientInitial KeyType = "client_initial_secret"
+	// KeyTypeServerHandshake represents the server's handshake secret key.
+	KeyTypeServerHandshake KeyType = "server_handshake_secret"
+	// KeyTypeClientHandshake represents the client's handshake secret key.
+	KeyTypeClientHandshake KeyType = "client_handshake_secret"
+	// KeyTypeServer0RTT represents the server's 0-RTT secret key.
+	KeyTypeServer0RTT KeyType = "server_0rtt_secret"
+	// KeyTypeClient0RTT represents the client's 0-RTT secret key.
+	KeyTypeClient0RTT KeyType = "client_0rtt_secret"
+	// KeyTypeServer1RTT represents the server's 1-RTT secret key.
+	KeyTypeServer1RTT KeyType = "server_1rtt_secret"
+	// KeyTypeClient1RTT represents the client's 1-RTT secret key.
+	KeyTypeClient1RTT KeyType = "client_1rtt_secret"
+)
+
+// KeyUpdateTrigger describes what caused a key update event.
+type KeyUpdateTrigger string
+
+const (
+	// KeyUpdateTLS indicates the key update was triggered by TLS.
+	KeyUpdateTLS KeyUpdateTrigger = "tls"
+	// KeyUpdateRemote indicates the key update was triggered by the remote peer.
+	KeyUpdateRemote KeyUpdateTrigger = "remote_update"
+	// KeyUpdateLocal indicates the key update was triggered locally.
+	KeyUpdateLocal KeyUpdateTrigger = "local_update"
+)
+
+type transportError uint64
+
+func (e transportError) String() string {
+	switch qerr.TransportErrorCode(e) {
+	case qerr.NoError:
+		return "no_error"
+	case qerr.InternalError:
+		return "internal_error"
+	case qerr.ConnectionRefused:
+		return "connection_refused"
+	case qerr.FlowControlError:
+		return "flow_control_error"
+	case qerr.StreamLimitError:
+		return "stream_limit_error"
+	case qerr.StreamStateError:
+		return "stream_state_error"
+	case qerr.FinalSizeError:
+		return "final_size_error"
+	case qerr.FrameEncodingError:
+		return "frame_encoding_error"
+	case qerr.TransportParameterError:
+		return "transport_parameter_error"
+	case qerr.ConnectionIDLimitError:
+		return "connection_id_limit_error"
+	case qerr.ProtocolViolation:
+		return "protocol_violation"
+	case qerr.InvalidToken:
+		return "invalid_token"
+	case qerr.ApplicationErrorErrorCode:
+		return "application_error"
+	case qerr.CryptoBufferExceeded:
+		return "crypto_buffer_exceeded"
+	case qerr.KeyUpdateError:
+		return "key_update_error"
+	case qerr.AEADLimitReached:
+		return "aead_limit_reached"
+	case qerr.NoViablePathError:
+		return "no_viable_path"
+	default:
+		return ""
+	}
+}
+
+type PacketType string
+
+const (
+	// PacketTypeInitial represents an Initial packet
+	PacketTypeInitial PacketType = "initial"
+	// PacketTypeHandshake represents a Handshake packet
+	PacketTypeHandshake PacketType = "handshake"
+	// PacketTypeRetry represents a Retry packet
+	PacketTypeRetry PacketType = "retry"
+	// PacketType0RTT represents a 0-RTT packet
+	PacketType0RTT PacketType = "0RTT"
+	// PacketTypeVersionNegotiation represents a Version Negotiation packet
+	PacketTypeVersionNegotiation PacketType = "version_negotiation"
+	// PacketTypeStatelessReset represents a Stateless Reset packet
+	PacketTypeStatelessReset PacketType = "stateless_reset"
+	// PacketType1RTT represents a 1-RTT packet
+	PacketType1RTT PacketType = "1RTT"
+	// // PacketTypeNotDetermined represents a packet type that could not be determined
+	// PacketTypeNotDetermined packetType = ""
+)
+
+func EncryptionLevelToPacketType(l EncryptionLevel) PacketType {
+	switch l {
+	case protocol.EncryptionInitial:
+		return PacketTypeInitial
+	case protocol.EncryptionHandshake:
+		return PacketTypeHandshake
+	case protocol.Encryption0RTT:
+		return PacketType0RTT
+	case protocol.Encryption1RTT:
+		return PacketType1RTT
+	default:
+		panic(fmt.Sprintf("unknown encryption level: %d", l))
+	}
+}
+
+type PacketLossReason string
+
+const (
+	// PacketLossReorderingThreshold is used when a packet is declared lost due to reordering threshold
+	PacketLossReorderingThreshold PacketLossReason = "reordering_threshold"
+	// PacketLossTimeThreshold is used when a packet is declared lost due to time threshold
+	PacketLossTimeThreshold PacketLossReason = "time_threshold"
+)
+
+type PacketDropReason string
+
+const (
+	// PacketDropKeyUnavailable is used when a packet is dropped because keys are unavailable
+	PacketDropKeyUnavailable PacketDropReason = "key_unavailable"
+	// PacketDropUnknownConnectionID is used when a packet is dropped because the connection ID is unknown
+	PacketDropUnknownConnectionID PacketDropReason = "unknown_connection_id"
+	// PacketDropHeaderParseError is used when a packet is dropped because header parsing failed
+	PacketDropHeaderParseError PacketDropReason = "header_parse_error"
+	// PacketDropPayloadDecryptError is used when a packet is dropped because decrypting the payload failed
+	PacketDropPayloadDecryptError PacketDropReason = "payload_decrypt_error"
+	// PacketDropProtocolViolation is used when a packet is dropped due to a protocol violation
+	PacketDropProtocolViolation PacketDropReason = "protocol_violation"
+	// PacketDropDOSPrevention is used when a packet is dropped to mitigate a DoS attack
+	PacketDropDOSPrevention PacketDropReason = "dos_prevention"
+	// PacketDropUnsupportedVersion is used when a packet is dropped because the version is not supported
+	PacketDropUnsupportedVersion PacketDropReason = "unsupported_version"
+	// PacketDropUnexpectedPacket is used when an unexpected packet is received
+	PacketDropUnexpectedPacket PacketDropReason = "unexpected_packet"
+	// PacketDropUnexpectedSourceConnectionID is used when a packet with an unexpected source connection ID is received
+	PacketDropUnexpectedSourceConnectionID PacketDropReason = "unexpected_source_connection_id"
+	// PacketDropUnexpectedVersion is used when a packet with an unexpected version is received
+	PacketDropUnexpectedVersion PacketDropReason = "unexpected_version"
+	// PacketDropDuplicate is used when a duplicate packet is received
+	PacketDropDuplicate PacketDropReason = "duplicate"
+)
+
+type LossTimerUpdateType string
+
+const (
+	LossTimerUpdateTypeSet       LossTimerUpdateType = "set"
+	LossTimerUpdateTypeExpired   LossTimerUpdateType = "expired"
+	LossTimerUpdateTypeCancelled LossTimerUpdateType = "cancelled"
+)
+
+type TimerType string
+
+const (
+	// TimerTypeACK represents an ACK timer
+	TimerTypeACK TimerType = "ack"
+	// TimerTypePTO represents a PTO (Probe Timeout) timer
+	TimerTypePTO TimerType = "pto"
+	// TimerTypePathProbe represents a path probe timer
+	TimerTypePathProbe TimerType = "path_probe"
+)
+
+type CongestionState string
+
+const (
+	// CongestionStateSlowStart is the slow start phase of Reno / Cubic
+	CongestionStateSlowStart CongestionState = "slow_start"
+	// CongestionStateCongestionAvoidance is the congestion avoidance phase of Reno / Cubic
+	CongestionStateCongestionAvoidance CongestionState = "congestion_avoidance"
+	// CongestionStateRecovery is the recovery phase of Reno / Cubic
+	CongestionStateRecovery CongestionState = "recovery"
+	// CongestionStateApplicationLimited means that the congestion controller is application limited
+	CongestionStateApplicationLimited CongestionState = "application_limited"
+)
+
+func (s CongestionState) String() string {
+	return string(s)
+}
+
+// ECNState is the state of the ECN state machine (see Appendix A.4 of RFC 9000)
+type ECNState string
+
+const (
+	// ECNStateTesting is the testing state
+	ECNStateTesting ECNState = "testing"
+	// ECNStateUnknown is the unknown state
+	ECNStateUnknown ECNState = "unknown"
+	// ECNStateFailed is the failed state
+	ECNStateFailed ECNState = "failed"
+	// ECNStateCapable is the capable state
+	ECNStateCapable ECNState = "capable"
+)
+
+type ConnectionCloseTrigger string
+
+const (
+	// IdleTimeout indicates the connection was closed due to idle timeout
+	ConnectionCloseTriggerIdleTimeout ConnectionCloseTrigger = "idle_timeout"
+	// Application indicates the connection was closed by the application
+	ConnectionCloseTriggerApplication ConnectionCloseTrigger = "application"
+	// VersionMismatch indicates the connection was closed due to a QUIC version mismatch
+	ConnectionCloseTriggerVersionMismatch ConnectionCloseTrigger = "version_mismatch"
+	// StatelessReset indicates the connection was closed due to receiving a stateless reset from the peer
+	ConnectionCloseTriggerStatelessReset ConnectionCloseTrigger = "stateless_reset"
+)
+
+// DatagramPayloadChecksum is the CRC32c checksum of a UDP datagram payload.
+// ponytail: zero means absent; use an optional value if zero-valued checksums need to be logged.
+type DatagramPayloadChecksum uint32
+
+// CalculateDatagramPayloadChecksum computes the checksum of a UDP datagram payload.
+func CalculateDatagramPayloadChecksum(payload []byte) DatagramPayloadChecksum {
+	return DatagramPayloadChecksum(crc32.Checksum(payload, crc32.MakeTable(crc32.Castagnoli)))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlog/types_test.go b/electron/native/private-transport/third_party/quic-go/qlog/types_test.go
new file mode 100644
index 000000000..ba860179c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlog/types_test.go
@@ -0,0 +1,20 @@
+package qlog
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestEncryptionLevelToPacketType(t *testing.T) {
+	require.Equal(t, "initial", string(EncryptionLevelToPacketType(protocol.EncryptionInitial)))
+	require.Equal(t, "handshake", string(EncryptionLevelToPacketType(protocol.EncryptionHandshake)))
+	require.Equal(t, "0RTT", string(EncryptionLevelToPacketType(protocol.Encryption0RTT)))
+	require.Equal(t, "1RTT", string(EncryptionLevelToPacketType(protocol.Encryption1RTT)))
+}
+
+func TestCalculateDatagramPayloadChecksum(t *testing.T) {
+	require.Equal(t, DatagramPayloadChecksum(0xe3069283), CalculateDatagramPayloadChecksum([]byte("123456789")))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlogwriter/jsontext/encoder.go b/electron/native/private-transport/third_party/quic-go/qlogwriter/jsontext/encoder.go
new file mode 100644
index 000000000..4f715bbde
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlogwriter/jsontext/encoder.go
@@ -0,0 +1,324 @@
+// Package jsontext provides a fast JSON encoder providing only the necessary features
+// for qlog encoding. No efforts are made to add any features beyond qlog's requirements.
+//
+// The API aims to be compatible with the standard library's encoding/json/jsontext package.
+package jsontext
+
+import (
+	"fmt"
+	"io"
+	"strconv"
+	"unsafe"
+)
+
+type kind uint8
+
+const (
+	kindString kind = iota
+	kindInt
+	kindUint
+	kindFloat
+	kindBool
+	kindNull
+	kindObjectStart
+	kindObjectEnd
+	kindArrayStart
+	kindArrayEnd
+)
+
+// Token represents a JSON token.
+type Token struct {
+	kind kind
+	str  string
+	i64  int64
+	u64  uint64
+	f64  float64
+	b    bool
+}
+
+// String creates a string token.
+func String(s string) Token {
+	return Token{kind: kindString, str: s}
+}
+
+// Int creates an int token.
+func Int(i int64) Token {
+	return Token{kind: kindInt, i64: i}
+}
+
+// Uint creates a uint token.
+func Uint(u uint64) Token {
+	return Token{kind: kindUint, u64: u}
+}
+
+// Float creates a float token.
+func Float(f float64) Token {
+	return Token{kind: kindFloat, f64: f}
+}
+
+// Bool creates a bool token.
+func Bool(b bool) Token {
+	return Token{kind: kindBool, b: b}
+}
+
+// Null is a null token.
+var Null Token = Token{kind: kindNull}
+
+// BeginObject is the begin object token.
+var BeginObject Token = Token{kind: kindObjectStart}
+
+// EndObject is the end object token.
+var EndObject Token = Token{kind: kindObjectEnd}
+
+// BeginArray is the begin array token.
+var BeginArray Token = Token{kind: kindArrayStart}
+
+// EndArray is the end array token.
+var EndArray Token = Token{kind: kindArrayEnd}
+
+// True is a true token.
+var True Token = Bool(true)
+
+// False is a false token.
+var False Token = Bool(false)
+
+var hexDigits = [16]byte{'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'}
+
+var (
+	commaByte       = []byte(",")
+	quoteByte       = []byte(`"`)
+	colonByte       = []byte(":")
+	trueByte        = []byte("true")
+	falseByte       = []byte("false")
+	nullByte        = []byte("null")
+	openObjectByte  = []byte("{")
+	closeObjectByte = []byte("}")
+	openArrayByte   = []byte("[")
+	closeArrayByte  = []byte("]")
+	newlineByte     = []byte("\n")
+	escapeQuote     = []byte(`\"`)
+	escapeBackslash = []byte(`\\`)
+	escapeBackspace = []byte(`\b`)
+	escapeFormfeed  = []byte(`\f`)
+	escapeNewline   = []byte(`\n`)
+	escapeCarriage  = []byte(`\r`)
+	escapeTab       = []byte(`\t`)
+	escapeUnicode   = []byte(`\u00`)
+)
+
+type context struct {
+	isObject   bool
+	needsComma bool
+	expectKey  bool
+}
+
+// Encoder encodes JSON to an io.Writer.
+type Encoder struct {
+	w     io.Writer
+	buf   [64]byte // scratch buffer for number formatting
+	stack []context
+}
+
+// NewEncoder creates a new Encoder.
+func NewEncoder(w io.Writer) *Encoder {
+	stack := make([]context, 0, 8)
+	stack = append(stack, context{isObject: false, needsComma: false, expectKey: false})
+	return &Encoder{
+		w:     w,
+		stack: stack,
+	}
+}
+
+// WriteToken writes a token to the encoder.
+func (e *Encoder) WriteToken(t Token) error {
+	if len(e.stack) == 0 {
+		return fmt.Errorf("empty stack")
+	}
+	curr := &e.stack[len(e.stack)-1]
+	isClosing := t.kind == kindObjectEnd || t.kind == kindArrayEnd
+	if !isClosing && curr.needsComma {
+		if _, err := e.w.Write(commaByte); err != nil {
+			return err
+		}
+		curr.needsComma = false
+	}
+	var err error
+	switch t.kind {
+	case kindString:
+		data := stringToBytes(t.str)
+		needsEscape := false
+		for _, b := range data {
+			if b == '"' || b == '\\' || b < 0x20 {
+				needsEscape = true
+				break
+			}
+		}
+		if !needsEscape {
+			if _, err = e.w.Write(quoteByte); err != nil {
+				return err
+			}
+			if _, err = e.w.Write(data); err != nil {
+				return err
+			}
+			if _, err = e.w.Write(quoteByte); err != nil {
+				return err
+			}
+		} else {
+			if _, err = e.w.Write(quoteByte); err != nil {
+				return err
+			}
+			for i := 0; i < len(t.str); i++ {
+				c := t.str[i]
+				switch c {
+				case '"':
+					if _, err = e.w.Write(escapeQuote); err != nil {
+						return err
+					}
+				case '\\':
+					if _, err = e.w.Write(escapeBackslash); err != nil {
+						return err
+					}
+				case '\b':
+					if _, err = e.w.Write(escapeBackspace); err != nil {
+						return err
+					}
+				case '\f':
+					if _, err = e.w.Write(escapeFormfeed); err != nil {
+						return err
+					}
+				case '\n':
+					if _, err = e.w.Write(escapeNewline); err != nil {
+						return err
+					}
+				case '\r':
+					if _, err = e.w.Write(escapeCarriage); err != nil {
+						return err
+					}
+				case '\t':
+					if _, err = e.w.Write(escapeTab); err != nil {
+						return err
+					}
+				default:
+					if c < 0x20 {
+						if _, err = e.w.Write(escapeUnicode); err != nil {
+							return err
+						}
+						if _, err = e.w.Write([]byte{hexDigits[c>>4], hexDigits[c&0xf]}); err != nil {
+							return err
+						}
+					} else {
+						if _, err = e.w.Write([]byte{c}); err != nil {
+							return err
+						}
+					}
+				}
+			}
+			if _, err = e.w.Write(quoteByte); err != nil {
+				return err
+			}
+		}
+		if curr.isObject {
+			if curr.expectKey {
+				// key
+				if _, err = e.w.Write(colonByte); err != nil {
+					return err
+				}
+				curr.expectKey = false
+				return nil // do not call afterValue for keys
+			} else {
+				// value
+				e.afterValue()
+			}
+		} else {
+			e.afterValue()
+		}
+	case kindInt:
+		b := strconv.AppendInt(e.buf[:0], t.i64, 10)
+		if _, err = e.w.Write(b); err != nil {
+			return err
+		}
+		e.afterValue()
+	case kindUint:
+		b := strconv.AppendUint(e.buf[:0], t.u64, 10)
+		if _, err = e.w.Write(b); err != nil {
+			return err
+		}
+		e.afterValue()
+	case kindFloat:
+		b := strconv.AppendFloat(e.buf[:0], t.f64, 'g', -1, 64)
+		if _, err = e.w.Write(b); err != nil {
+			return err
+		}
+		e.afterValue()
+	case kindBool:
+		if t.b {
+			if _, err = e.w.Write(trueByte); err != nil {
+				return err
+			}
+		} else {
+			if _, err = e.w.Write(falseByte); err != nil {
+				return err
+			}
+		}
+		e.afterValue()
+	case kindNull:
+		if _, err = e.w.Write(nullByte); err != nil {
+			return err
+		}
+		e.afterValue()
+	case kindObjectStart:
+		if _, err = e.w.Write(openObjectByte); err != nil {
+			return err
+		}
+		e.stack = append(e.stack, context{isObject: true, needsComma: false, expectKey: true})
+		return nil
+	case kindObjectEnd:
+		if _, err = e.w.Write(closeObjectByte); err != nil {
+			return err
+		}
+		e.stack = e.stack[:len(e.stack)-1]
+		e.afterValue()
+		if len(e.stack) == 1 {
+			if _, err = e.w.Write(newlineByte); err != nil {
+				return err
+			}
+		}
+		return nil
+	case kindArrayStart:
+		if _, err = e.w.Write(openArrayByte); err != nil {
+			return err
+		}
+		e.stack = append(e.stack, context{isObject: false, needsComma: false, expectKey: false})
+		return nil
+	case kindArrayEnd:
+		if _, err = e.w.Write(closeArrayByte); err != nil {
+			return err
+		}
+		e.stack = e.stack[:len(e.stack)-1]
+		e.afterValue()
+		if len(e.stack) == 1 {
+			if _, err = e.w.Write(newlineByte); err != nil {
+				return err
+			}
+		}
+		return nil
+	default:
+		return fmt.Errorf("unknown token kind")
+	}
+	return err
+}
+
+// afterValue updates the state after encoding a value
+func (e *Encoder) afterValue() {
+	if len(e.stack) > 1 {
+		curr := &e.stack[len(e.stack)-1]
+		curr.needsComma = true
+		if curr.isObject {
+			curr.expectKey = true
+		}
+	}
+}
+
+func stringToBytes(s string) []byte {
+	return unsafe.Slice(unsafe.StringData(s), len(s))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlogwriter/jsontext/encoder_test.go b/electron/native/private-transport/third_party/quic-go/qlogwriter/jsontext/encoder_test.go
new file mode 100644
index 000000000..f580cfaa7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlogwriter/jsontext/encoder_test.go
@@ -0,0 +1,405 @@
+package jsontext_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEncoderSimpleObject(t *testing.T) {
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	enc.WriteToken(jsontext.BeginObject)
+	enc.WriteToken(jsontext.String("foo"))
+	enc.WriteToken(jsontext.String("bar"))
+	enc.WriteToken(jsontext.String("foo2"))
+	enc.WriteToken(jsontext.String("bar2"))
+	enc.WriteToken(jsontext.EndObject)
+	output := buf.String()
+
+	var got map[string]string
+	require.NoError(t, json.Unmarshal([]byte(output), &got))
+	require.Equal(t, map[string]string{"foo": "bar", "foo2": "bar2"}, got)
+}
+
+func TestEncoderArrayInts(t *testing.T) {
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	enc.WriteToken(jsontext.BeginArray)
+	enc.WriteToken(jsontext.Int(1))
+	enc.WriteToken(jsontext.Int(2))
+	enc.WriteToken(jsontext.Int(3))
+	enc.WriteToken(jsontext.EndArray)
+	output := buf.String()
+
+	var got []int
+	require.NoError(t, json.Unmarshal([]byte(output), &got))
+	require.Equal(t, []int{1, 2, 3}, got)
+}
+
+func TestEncoderArrayStrings(t *testing.T) {
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	enc.WriteToken(jsontext.BeginArray)
+	enc.WriteToken(jsontext.String("one"))
+	enc.WriteToken(jsontext.String("two"))
+	enc.WriteToken(jsontext.EndArray)
+	output := buf.String()
+
+	var got []string
+	err := json.Unmarshal([]byte(output), &got)
+	require.NoError(t, err)
+	require.Equal(t, []string{"one", "two"}, got)
+}
+
+func TestEncoderNestedObject(t *testing.T) {
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	enc.WriteToken(jsontext.BeginObject)
+	enc.WriteToken(jsontext.String("outer"))
+	enc.WriteToken(jsontext.BeginObject)
+	enc.WriteToken(jsontext.String("inner"))
+	enc.WriteToken(jsontext.String("value"))
+	enc.WriteToken(jsontext.EndObject)
+	enc.WriteToken(jsontext.EndObject)
+	output := buf.String()
+
+	var got map[string]map[string]string
+	require.NoError(t, json.Unmarshal([]byte(output), &got))
+	require.Equal(t, map[string]map[string]string{"outer": {"inner": "value"}}, got)
+}
+
+func TestEncoderNumbersAndBool(t *testing.T) {
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	enc.WriteToken(jsontext.BeginObject)
+	enc.WriteToken(jsontext.String("int"))
+	enc.WriteToken(jsontext.Int(42))
+	enc.WriteToken(jsontext.String("uint"))
+	enc.WriteToken(jsontext.Uint(100))
+	enc.WriteToken(jsontext.String("float"))
+	enc.WriteToken(jsontext.Float(3.14))
+	enc.WriteToken(jsontext.String("true"))
+	enc.WriteToken(jsontext.True)
+	enc.WriteToken(jsontext.String("false"))
+	enc.WriteToken(jsontext.False)
+	enc.WriteToken(jsontext.String("nullv"))
+	enc.WriteToken(jsontext.Null)
+	enc.WriteToken(jsontext.EndObject)
+	output := buf.String()
+
+	var got map[string]any
+	require.NoError(t, json.Unmarshal([]byte(output), &got))
+	require.Equal(t, map[string]any{
+		"int":   float64(42), // json.Unmarshal decodes numbers as float64
+		"uint":  float64(100),
+		"float": 3.14,
+		"true":  true,
+		"false": false,
+		"nullv": nil,
+	}, got)
+}
+
+func TestEncoderEmptyObject(t *testing.T) {
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	enc.WriteToken(jsontext.BeginObject)
+	enc.WriteToken(jsontext.EndObject)
+	output := buf.String()
+
+	var got map[string]any
+	require.NoError(t, json.Unmarshal([]byte(output), &got))
+	require.Equal(t, map[string]any{}, got)
+}
+
+func TestEncoderEmptyArray(t *testing.T) {
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	enc.WriteToken(jsontext.BeginArray)
+	enc.WriteToken(jsontext.EndArray)
+	output := buf.String()
+
+	var got []any
+	require.NoError(t, json.Unmarshal([]byte(output), &got))
+	require.Equal(t, []any{}, got)
+}
+
+func TestEncoderArrayWithNulls(t *testing.T) {
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	enc.WriteToken(jsontext.BeginArray)
+	enc.WriteToken(jsontext.Null)
+	enc.WriteToken(jsontext.String("x"))
+	enc.WriteToken(jsontext.Null)
+	enc.WriteToken(jsontext.EndArray)
+	output := buf.String()
+
+	var got []any
+	require.NoError(t, json.Unmarshal([]byte(output), &got))
+	require.Equal(t, []any{nil, "x", nil}, got)
+}
+
+func TestEncoderEscapedStrings(t *testing.T) {
+	t.Run("no escapes", func(t *testing.T) {
+		testEncoderEscapedStrings(t, "simplekey", "simplevalue")
+	})
+
+	t.Run("basic escapes", func(t *testing.T) {
+		key := `key"\/`
+		value := `value"\/`
+		testEncoderEscapedStrings(t, key, value)
+	})
+
+	t.Run("control characters", func(t *testing.T) {
+		key := "key\b\f\n\r\t"
+		value := "value\b\f\n\r\t"
+		testEncoderEscapedStrings(t, key, value)
+	})
+
+	t.Run("unicode low", func(t *testing.T) {
+		key := "key\u0007\u001f"
+		value := "value\u0007\u001f"
+		testEncoderEscapedStrings(t, key, value)
+	})
+
+	t.Run("mixed all", func(t *testing.T) {
+		key := `key"\\\/\b\f\n\r\t\u0007\u001f`
+		value := `value"\\\/\b\f\n\r\t\u0007\u001f`
+		testEncoderEscapedStrings(t, key, value)
+	})
+}
+
+func testEncoderEscapedStrings(t *testing.T, key, value string) {
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	enc.WriteToken(jsontext.BeginObject)
+	enc.WriteToken(jsontext.String(key))
+	enc.WriteToken(jsontext.String(value))
+	enc.WriteToken(jsontext.EndObject)
+	output := buf.String()
+
+	var got map[string]string
+	err := json.Unmarshal([]byte(output), &got)
+	require.NoError(t, err)
+	expected := map[string]string{key: value}
+	require.Equal(t, expected, got)
+}
+
+func encodeValue(t testing.TB, enc *jsontext.Encoder, v any) (isSupported bool) {
+	t.Helper()
+
+	switch val := v.(type) {
+	case map[string]any:
+		require.NoError(t, enc.WriteToken(jsontext.BeginObject))
+		for k, vv := range val {
+			require.NoError(t, enc.WriteToken(jsontext.String(k)))
+			if !encodeValue(t, enc, vv) {
+				return false
+			}
+		}
+		require.NoError(t, enc.WriteToken(jsontext.EndObject))
+		return true
+	case []any:
+		require.NoError(t, enc.WriteToken(jsontext.BeginArray))
+		for _, vv := range val {
+			if !encodeValue(t, enc, vv) {
+				return false // Propagate unsupported if any nested value fails
+			}
+		}
+		require.NoError(t, enc.WriteToken(jsontext.EndArray))
+		return true
+	case string:
+		require.NoError(t, enc.WriteToken(jsontext.String(val)))
+		return true
+	case int64:
+		require.NoError(t, enc.WriteToken(jsontext.Int(val)))
+		return true
+	case uint64:
+		require.NoError(t, enc.WriteToken(jsontext.Uint(val)))
+		return true
+	case float64:
+		require.NoError(t, enc.WriteToken(jsontext.Float(val)))
+		return true
+	case bool:
+		require.NoError(t, enc.WriteToken(jsontext.Bool(val)))
+		return true
+	case nil:
+		require.NoError(t, enc.WriteToken(jsontext.Null))
+		return true
+	default:
+		return false
+	}
+}
+
+type errorWriter struct {
+	N int
+}
+
+func (w *errorWriter) Write(p []byte) (int, error) {
+	n := min(len(p), w.N)
+	w.N -= n
+	if w.N <= 0 {
+		return n, assert.AnError
+	}
+	return n, nil
+}
+
+func TestEncoderComprehensive(t *testing.T) {
+	// encodes an object with all token types and nested structures
+	encode := func(enc *jsontext.Encoder) error {
+		if err := enc.WriteToken(jsontext.BeginObject); err != nil {
+			return err
+		}
+
+		if err := enc.WriteToken(jsontext.String("simple")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.String("value")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.String("escaped")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.String(`"quoted\"string"`)); err != nil {
+			return err
+		}
+
+		if err := enc.WriteToken(jsontext.String("int")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.Int(-42)); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.String("uint")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.Uint(100)); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.String("float")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.Float(3.14)); err != nil {
+			return err
+		}
+
+		if err := enc.WriteToken(jsontext.String("true")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.True); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.String("false")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.False); err != nil {
+			return err
+		}
+
+		if err := enc.WriteToken(jsontext.String("array")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.BeginArray); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.String("item1")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.Int(1)); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.EndArray); err != nil {
+			return err
+		}
+
+		if err := enc.WriteToken(jsontext.String("nested")); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.BeginObject); err != nil {
+			return err
+		}
+		if err := enc.WriteToken(jsontext.EndObject); err != nil {
+			return err
+		}
+
+		if err := enc.WriteToken(jsontext.EndObject); err != nil {
+			return err
+		}
+		return nil
+	}
+
+	buf := bytes.NewBuffer(nil)
+	enc := jsontext.NewEncoder(buf)
+	require.NoError(t, encode(enc))
+
+	for i := range buf.Len() {
+		enc := jsontext.NewEncoder(&errorWriter{N: i})
+		require.ErrorIs(t, encode(enc), assert.AnError)
+	}
+}
+
+func FuzzEncoder(f *testing.F) {
+	examples := []string{
+		`{"hello": "world"}`,
+		`{"foo": 123, "bar": [1, 2, 3]}`,
+		`{"nested": {"a": 1, "b": [true, false, "foobar", null]}}`,
+		`[{"x": 1}, {"y": "foo"}]`,
+		`["foo", "bar"]`,
+		`["a", {"b": [1, 2, {"c": "d"}]}, 3]`,
+		`{"emptyObj": {}, "emptyArr": []}`,
+		`{"mixed": [1, "two", {"three": 3}]}`,
+		`[null]`,
+	}
+	for _, tc := range examples {
+		// first test that
+		// 1. it's valid JSON
+		d := json.NewDecoder(bytes.NewReader([]byte(tc)))
+		var expected any
+		require.NoError(f, d.Decode(&expected), "corpus entry `%s` is not valid JSON", tc)
+		// 2. the jsontext encoder can handle
+		enc := jsontext.NewEncoder(&bytes.Buffer{})
+		require.True(f, encodeValue(f, enc, expected), "expected `%s` to be supported", tc)
+
+		f.Add([]byte(tc))
+	}
+
+	var stdlibBuf, ourBuf bytes.Buffer
+
+	f.Fuzz(func(t *testing.T, b []byte) {
+		stdlibBuf.Truncate(0)
+		ourBuf.Truncate(0)
+		stdlibBuf.Grow(len(b))
+		ourBuf.Grow(len(b))
+
+		d := json.NewDecoder(bytes.NewReader(b))
+		var expected any
+		if err := d.Decode(&expected); err != nil {
+			return // invalid JSON
+		}
+
+		// only attempt to handle inputs that the standard library can handle
+		stdlibEnc := json.NewEncoder(&stdlibBuf)
+		require.NoError(t, stdlibEnc.Encode(expected))
+		if !json.Valid(stdlibBuf.Bytes()) {
+			return
+		}
+
+		// then encode using the jsontext encoder
+		enc := jsontext.NewEncoder(&ourBuf)
+		if isSupported := encodeValue(t, enc, expected); !isSupported {
+			return
+		}
+
+		output := ourBuf.Bytes()
+		require.Truef(t, json.Valid(output), "produced invalid JSON: %s", output)
+
+		var got any
+		require.NoError(t, json.Unmarshal(output, &got))
+		require.JSONEq(t, ourBuf.String(), stdlibBuf.String())
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlogwriter/trace.go b/electron/native/private-transport/third_party/quic-go/qlogwriter/trace.go
new file mode 100644
index 000000000..eebcbaadc
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlogwriter/trace.go
@@ -0,0 +1,124 @@
+package qlogwriter
+
+import (
+	"runtime/debug"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+)
+
+type ConnectionID = protocol.ConnectionID
+
+// Setting of this only works when quic-go is used as a library.
+// When building a binary from this repository, the version can be set using the following go build flag:
+// -ldflags="-X github.com/quic-go/quic-go/qlogwriter.quicGoVersion=foobar"
+var quicGoVersion = "(devel)"
+
+func init() {
+	if quicGoVersion != "(devel)" { // variable set by ldflags
+		return
+	}
+	info, ok := debug.ReadBuildInfo()
+	if !ok { // no build info available. This happens when quic-go is not used as a library.
+		return
+	}
+	for _, d := range info.Deps {
+		if d.Path == "github.com/quic-go/quic-go" {
+			quicGoVersion = d.Version
+			if d.Replace != nil {
+				if len(d.Replace.Version) > 0 {
+					quicGoVersion = d.Version
+				} else {
+					quicGoVersion += " (replaced)"
+				}
+			}
+			break
+		}
+	}
+}
+
+type encoderHelper struct {
+	enc *jsontext.Encoder
+	err error
+}
+
+func (h *encoderHelper) WriteToken(t jsontext.Token) {
+	if h.err != nil {
+		return
+	}
+	h.err = h.enc.WriteToken(t)
+}
+
+type traceHeader struct {
+	VantagePointType string
+	GroupID          *ConnectionID
+	ReferenceTime    time.Time
+	EventSchemas     []string
+}
+
+func (l traceHeader) Encode(enc *jsontext.Encoder) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("file_schema"))
+	h.WriteToken(jsontext.String("urn:ietf:params:qlog:file:sequential"))
+	h.WriteToken(jsontext.String("serialization_format"))
+	h.WriteToken(jsontext.String("application/qlog+json-seq"))
+	h.WriteToken(jsontext.String("title"))
+	h.WriteToken(jsontext.String("quic-go qlog"))
+	h.WriteToken(jsontext.String("code_version"))
+	h.WriteToken(jsontext.String(quicGoVersion))
+
+	h.WriteToken(jsontext.String("trace"))
+	// trace
+	h.WriteToken(jsontext.BeginObject)
+	if len(l.EventSchemas) > 0 {
+		h.WriteToken(jsontext.String("event_schemas"))
+		h.WriteToken(jsontext.BeginArray)
+		for _, schema := range l.EventSchemas {
+			h.WriteToken(jsontext.String(schema))
+		}
+		h.WriteToken(jsontext.EndArray)
+	}
+
+	h.WriteToken(jsontext.String("vantage_point"))
+	// -- vantage_point
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("type"))
+	h.WriteToken(jsontext.String(l.VantagePointType))
+	// -- end vantage_point
+	h.WriteToken(jsontext.EndObject)
+
+	h.WriteToken(jsontext.String("common_fields"))
+	// -- common_fields
+	h.WriteToken(jsontext.BeginObject)
+	if l.GroupID != nil {
+		h.WriteToken(jsontext.String("group_id"))
+		h.WriteToken(jsontext.String(l.GroupID.String()))
+	}
+	h.WriteToken(jsontext.String("reference_time"))
+	// ---- reference_time
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("clock_type"))
+	h.WriteToken(jsontext.String("monotonic"))
+	h.WriteToken(jsontext.String("epoch"))
+	h.WriteToken(jsontext.String("unknown"))
+	h.WriteToken(jsontext.String("wall_clock_time"))
+	h.WriteToken(jsontext.String(l.ReferenceTime.Format(time.RFC3339Nano)))
+	// ---- end reference_time
+	h.WriteToken(jsontext.EndObject)
+	// -- end common_fields
+	h.WriteToken(jsontext.EndObject)
+	// end trace
+	h.WriteToken(jsontext.EndObject)
+
+	// The following fields are not required by the qlog draft anymore,
+	// but qvis still requires them to be present.
+	h.WriteToken(jsontext.String("qlog_format"))
+	h.WriteToken(jsontext.String("JSON-SEQ"))
+	h.WriteToken(jsontext.String("qlog_version"))
+	h.WriteToken(jsontext.String("0.3"))
+
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlogwriter/trace_test.go b/electron/native/private-transport/third_party/quic-go/qlogwriter/trace_test.go
new file mode 100644
index 000000000..c556e0f15
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlogwriter/trace_test.go
@@ -0,0 +1,115 @@
+package qlogwriter
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+type nopWriteCloserImpl struct{ io.Writer }
+
+func (nopWriteCloserImpl) Close() error { return nil }
+
+func nopWriteCloser(w io.Writer) io.WriteCloser {
+	return &nopWriteCloserImpl{Writer: w}
+}
+
+func unmarshal(data []byte, v any) error {
+	if bytes.Equal(data[:1], recordSeparator) {
+		data = data[1:]
+	}
+	return json.Unmarshal(data, v)
+}
+
+func TestTraceMetadata(t *testing.T) {
+	t.Run("non-connection trace", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			buf := &bytes.Buffer{}
+			trace := NewFileSeq(nopWriteCloser(buf))
+			go trace.Run()
+			producer := trace.AddProducer()
+			producer.Close()
+
+			testTraceMetadata(t, buf, "transport", "", []string{})
+		})
+	})
+
+	t.Run("connection trace", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			buf := &bytes.Buffer{}
+			trace := NewConnectionFileSeq(
+				nopWriteCloser(buf),
+				false,
+				protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
+				[]string{"urn:ietf:params:qlog:events:foo", "urn:ietf:params:qlog:events:bar"},
+			)
+
+			require.False(t, trace.SupportsSchemas("urn:ietf:params:qlog:events:baz"))
+			require.True(t, trace.SupportsSchemas("urn:ietf:params:qlog:events:foo"))
+			require.True(t, trace.SupportsSchemas("urn:ietf:params:qlog:events:bar"))
+
+			go trace.Run()
+			producer := trace.AddProducer()
+			producer.Close()
+
+			testTraceMetadata(t,
+				buf,
+				"server",
+				"deadbeef",
+				[]string{"urn:ietf:params:qlog:events:foo", "urn:ietf:params:qlog:events:bar"},
+			)
+		})
+	})
+}
+
+func testTraceMetadata(t *testing.T,
+	buf *bytes.Buffer,
+	expectedVantagePoint,
+	expectedGroupID string,
+	expectedEventSchemas []string,
+) {
+	var m map[string]any
+	require.NoError(t, unmarshal(buf.Bytes(), &m))
+	require.Equal(t, "0.3", m["qlog_version"])
+	require.Contains(t, m, "title")
+	require.Contains(t, m, "trace")
+	tr := m["trace"].(map[string]any)
+	require.Contains(t, tr, "common_fields")
+	commonFields := tr["common_fields"].(map[string]any)
+	if expectedGroupID != "" {
+		require.Contains(t, commonFields, "group_id")
+		require.Equal(t, expectedGroupID, commonFields["group_id"])
+	} else {
+		require.NotContains(t, commonFields, "group_id")
+	}
+	require.Contains(t, commonFields, "reference_time")
+	referenceTimeMap := commonFields["reference_time"].(map[string]any)
+	require.Contains(t, referenceTimeMap, "clock_type")
+	require.Equal(t, "monotonic", referenceTimeMap["clock_type"])
+	require.Contains(t, referenceTimeMap, "epoch")
+	require.Equal(t, "unknown", referenceTimeMap["epoch"])
+	require.Contains(t, referenceTimeMap, "wall_clock_time")
+	wallClockTimeStr := referenceTimeMap["wall_clock_time"].(string)
+	wallClockTime, err := time.Parse(time.RFC3339Nano, wallClockTimeStr)
+	require.NoError(t, err)
+	require.Equal(t, time.Now().UTC(), wallClockTime.UTC())
+	require.Contains(t, tr, "vantage_point")
+	vantagePoint := tr["vantage_point"].(map[string]any)
+	require.Equal(t, expectedVantagePoint, vantagePoint["type"])
+	if len(expectedEventSchemas) > 0 {
+		require.Contains(t, tr, "event_schemas")
+		eventSchemas := tr["event_schemas"].([]any)
+		for i, schema := range eventSchemas {
+			require.Equal(t, expectedEventSchemas[i], schema)
+		}
+	} else {
+		require.NotContains(t, tr, "event_schemas")
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlogwriter/writer.go b/electron/native/private-transport/third_party/quic-go/qlogwriter/writer.go
new file mode 100644
index 000000000..5365115df
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlogwriter/writer.go
@@ -0,0 +1,229 @@
+package qlogwriter
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"log"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+)
+
+// Trace represents a qlog trace that can have multiple event producers.
+// Each producer can record events to the trace independently.
+// When the last producer is closed, the underlying trace is closed as well.
+type Trace interface {
+	// AddProducer creates a new Recorder for this trace.
+	// Each Recorder can record events independently.
+	AddProducer() Recorder
+
+	// SupportsSchemas returns true if the trace supports the given schema.
+	SupportsSchemas(schema string) bool
+}
+
+// Recorder is used to record events to a qlog trace.
+// It is safe for concurrent use by multiple goroutines.
+type Recorder interface {
+	// RecordEvent records a single Event to the trace.
+	// It must not be called after the recorder has been closed.
+	RecordEvent(Event)
+	// Close signals that this producer is done recording events.
+	// When all producers are closed, the underlying trace is closed.
+	// It must not be called concurrently with [Recorder.RecordEvent].
+	io.Closer
+}
+
+// Event represents a qlog event that can be encoded to JSON.
+// Each event must implement [Event.Name] and [Event.Encode].
+type Event interface {
+	// Name returns the name of the event, as it should appear in the qlog output
+	Name() string
+	// Encode writes the event's data to the provided jsontext.Encoder
+	Encode(encoder *jsontext.Encoder, eventTime time.Time) error
+}
+
+// RecordSeparator is the record separator byte for the JSON-SEQ format
+const RecordSeparator byte = 0x1e
+
+var recordSeparator = []byte{RecordSeparator}
+
+type event struct {
+	Time  time.Time
+	Event Event
+}
+
+const eventChanSize = 50
+
+// FileSeq represents a qlog trace using the JSON-SEQ format,
+// https://www.ietf.org/archive/id/draft-ietf-quic-qlog-main-schema-12.html#section-5
+// qlog event producers can be created by calling [FileSeq.AddProducer].
+// The underlying io.WriteCloser is closed when the last producer is removed.
+type FileSeq struct {
+	w             io.WriteCloser
+	enc           *jsontext.Encoder
+	referenceTime time.Time
+
+	runStopped chan struct{}
+	encodeErr  error
+	events     chan event
+	done       chan struct{}
+
+	mx        sync.Mutex
+	producers int
+	closed    bool
+
+	eventSchemas []string
+}
+
+var _ Trace = &FileSeq{}
+
+// NewFileSeq creates a new JSON-SEQ qlog trace to log transport events.
+func NewFileSeq(w io.WriteCloser) *FileSeq {
+	return newFileSeq(w, "transport", nil, nil)
+}
+
+// NewConnectionFileSeq creates a new qlog trace to log connection events.
+func NewConnectionFileSeq(w io.WriteCloser, isClient bool, odcid ConnectionID, eventSchemas []string) *FileSeq {
+	pers := "server"
+	if isClient {
+		pers = "client"
+	}
+	return newFileSeq(w, pers, &odcid, eventSchemas)
+}
+
+func newFileSeq(w io.WriteCloser, pers string, odcid *ConnectionID, eventSchemas []string) *FileSeq {
+	now := time.Now()
+	buf := &bytes.Buffer{}
+	enc := jsontext.NewEncoder(buf)
+	if _, err := buf.Write(recordSeparator); err != nil {
+		panic(fmt.Sprintf("qlog encoding into a bytes.Buffer failed: %s", err))
+	}
+	if err := (&traceHeader{
+		VantagePointType: pers,
+		GroupID:          odcid,
+		ReferenceTime:    now,
+		EventSchemas:     eventSchemas,
+	}).Encode(enc); err != nil {
+		panic(fmt.Sprintf("qlog encoding into a bytes.Buffer failed: %s", err))
+	}
+	_, encodeErr := w.Write(buf.Bytes())
+
+	return &FileSeq{
+		w:             w,
+		referenceTime: now,
+		enc:           jsontext.NewEncoder(w),
+		runStopped:    make(chan struct{}),
+		encodeErr:     encodeErr,
+		events:        make(chan event, eventChanSize),
+		done:          make(chan struct{}),
+		eventSchemas:  eventSchemas,
+	}
+}
+
+func (t *FileSeq) SupportsSchemas(schema string) bool {
+	return slices.Contains(t.eventSchemas, schema)
+}
+
+func (t *FileSeq) AddProducer() Recorder {
+	t.mx.Lock()
+	defer t.mx.Unlock()
+	if t.closed {
+		return nil
+	}
+
+	t.producers++
+
+	return &Writer{t: t}
+}
+
+func (t *FileSeq) record(eventTime time.Time, details Event) {
+	t.mx.Lock()
+
+	if t.closed {
+		t.mx.Unlock()
+		return
+	}
+	t.mx.Unlock()
+
+	t.events <- event{Time: eventTime, Event: details}
+}
+
+func (t *FileSeq) Run() {
+	defer close(t.runStopped)
+
+	for {
+		select {
+		case <-t.done:
+			for {
+				select {
+				case e := <-t.events:
+					t.encodeEvent(e)
+				default:
+					if t.encodeErr != nil {
+						log.Printf("exporting qlog failed: %s\n", t.encodeErr)
+					}
+					return
+				}
+			}
+		case e := <-t.events:
+			t.encodeEvent(e)
+		}
+	}
+}
+
+func (t *FileSeq) encodeEvent(e event) {
+	if t.encodeErr != nil {
+		return
+	}
+	if _, err := t.w.Write(recordSeparator); err != nil {
+		t.encodeErr = err
+		return
+	}
+	h := encoderHelper{enc: t.enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("time"))
+	h.WriteToken(jsontext.Float(float64(e.Time.Sub(t.referenceTime).Nanoseconds()) / 1e6))
+	h.WriteToken(jsontext.String("name"))
+	h.WriteToken(jsontext.String(e.Event.Name()))
+	h.WriteToken(jsontext.String("data"))
+	if err := e.Event.Encode(t.enc, e.Time); err != nil {
+		t.encodeErr = err
+		return
+	}
+	h.WriteToken(jsontext.EndObject)
+	if h.err != nil {
+		t.encodeErr = h.err
+	}
+}
+
+func (t *FileSeq) removeProducer() {
+	t.mx.Lock()
+	t.producers--
+	last := t.producers == 0
+	if last {
+		t.closed = true
+	}
+	t.mx.Unlock()
+
+	if last {
+		close(t.done)
+		<-t.runStopped // wait for Run to drain and exit
+		_ = t.w.Close()
+	}
+}
+
+type Writer struct {
+	t *FileSeq
+}
+
+func (w *Writer) Close() error {
+	w.t.removeProducer()
+	return nil
+}
+
+func (w *Writer) RecordEvent(ev Event) {
+	w.t.record(time.Now(), ev)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/qlogwriter/writer_test.go b/electron/native/private-transport/third_party/quic-go/qlogwriter/writer_test.go
new file mode 100644
index 000000000..8634e833b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/qlogwriter/writer_test.go
@@ -0,0 +1,116 @@
+package qlogwriter
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/qlogwriter/jsontext"
+
+	"github.com/stretchr/testify/require"
+)
+
+type testEvent struct {
+	message string
+}
+
+func (e testEvent) Name() string {
+	return "transport:test_event"
+}
+
+func (e testEvent) Encode(enc *jsontext.Encoder, _ time.Time) error {
+	h := encoderHelper{enc: enc}
+	h.WriteToken(jsontext.BeginObject)
+	h.WriteToken(jsontext.String("message"))
+	h.WriteToken(jsontext.String(e.message))
+	h.WriteToken(jsontext.EndObject)
+	return h.err
+}
+
+type limitedWriter struct {
+	io.WriteCloser
+	N       int
+	written int
+}
+
+func (w *limitedWriter) Write(p []byte) (int, error) {
+	if w.written+len(p) > w.N {
+		return 0, errors.New("writer full")
+	}
+	n, err := w.WriteCloser.Write(p)
+	w.written += n
+	return n, err
+}
+
+func TestWritingStopping(t *testing.T) {
+	buf := &bytes.Buffer{}
+	fileSeq := NewFileSeq(&limitedWriter{WriteCloser: nopWriteCloser(buf), N: 250})
+	writer := fileSeq.AddProducer()
+	go fileSeq.Run()
+
+	for i := range 1000 {
+		writer.RecordEvent(testEvent{message: fmt.Sprintf("test message %d", i)})
+	}
+
+	var logBuf bytes.Buffer
+	log.SetOutput(&logBuf)
+	defer log.SetOutput(os.Stdout)
+
+	writer.Close()
+
+	require.Contains(t, logBuf.String(), "writer full")
+
+	// events after closing are ignored
+	logBuf.Reset()
+	writer.RecordEvent(testEvent{message: "foobar"})
+	require.Empty(t, logBuf.String())
+}
+
+type blockingWriter struct {
+	bytes.Buffer
+	block   bool
+	unblock chan struct{}
+}
+
+func (w *blockingWriter) Write(b []byte) (int, error) {
+	if w.block {
+		<-w.unblock
+	}
+	return w.Buffer.Write(b)
+}
+
+// TestRecordCloseRace triggers a race between record and Close.
+func TestRecordCloseRace(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		w := &blockingWriter{unblock: make(chan struct{})}
+		trace := NewFileSeq(nopWriteCloser(w))
+		go trace.Run()
+		synctest.Wait() // Run is blocked waiting for events
+
+		producer := trace.AddProducer()
+		require.NotNil(t, producer)
+
+		w.block = true
+		const numEvents = eventChanSize + 1
+		for i := range numEvents {
+			producer.RecordEvent(testEvent{message: fmt.Sprintf("event %d", i)})
+		}
+
+		go producer.RecordEvent(testEvent{message: "last event"})
+		synctest.Wait() // goroutine is blocked on full channel
+
+		close(w.unblock) // let Run() finish
+		producer.Close()
+
+		for i := range numEvents {
+			require.Contains(t, w.String(), fmt.Sprintf(`"message":"event %d"`, i))
+		}
+		require.Contains(t, w.String(), `"message":"last event"`)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/quic_linux_test.go b/electron/native/private-transport/third_party/quic-go/quic_linux_test.go
new file mode 100644
index 000000000..ec5c69f78
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/quic_linux_test.go
@@ -0,0 +1,12 @@
+//go:build linux
+
+package quic
+
+import (
+	"fmt"
+)
+
+func init() {
+	major, minor := kernelVersion()
+	fmt.Printf("Kernel Version: %d.%d\n\n", major, minor)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/quic_test.go b/electron/native/private-transport/third_party/quic-go/quic_test.go
new file mode 100644
index 000000000..7dbe9be99
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/quic_test.go
@@ -0,0 +1,87 @@
+package quic
+
+import (
+	"bytes"
+	"fmt"
+	"net"
+	"os"
+	"runtime/pprof"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+// in the tests for the stream deadlines we set a deadline
+// and wait to make an assertion when Read / Write was unblocked
+// on the CIs, the timing is a lot less precise, so scale every duration by this factor
+func scaleDuration(t time.Duration) time.Duration {
+	scaleFactor := 1
+	if f, err := strconv.Atoi(os.Getenv("TIMESCALE_FACTOR")); err == nil { // parsing "" errors, so this works fine if the env is not set
+		scaleFactor = f
+	}
+	if scaleFactor == 0 {
+		panic("TIMESCALE_FACTOR is 0")
+	}
+	return time.Duration(scaleFactor) * t
+}
+
+func newUDPConnLocalhost(t testing.TB) *net.UDPConn {
+	t.Helper()
+	conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.Close() })
+	return conn
+}
+
+func getPacket(t *testing.T, connID protocol.ConnectionID) []byte {
+	return getPacketWithPacketType(t, connID, protocol.PacketTypeHandshake, 2)
+}
+
+func getPacketWithPacketType(t *testing.T, connID protocol.ConnectionID, typ protocol.PacketType, length protocol.ByteCount) []byte {
+	t.Helper()
+	b, err := (&wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             typ,
+			DestConnectionID: connID,
+			Length:           length,
+			Version:          protocol.Version1,
+		},
+		PacketNumberLen: protocol.PacketNumberLen2,
+	}).Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	return append(b, bytes.Repeat([]byte{42}, int(length)-2)...)
+}
+
+func areConnsRunning() bool {
+	var b bytes.Buffer
+	pprof.Lookup("goroutine").WriteTo(&b, 1)
+	return strings.Contains(b.String(), "quic-go.(*connection).run")
+}
+
+func areTransportsRunning() bool {
+	var b bytes.Buffer
+	pprof.Lookup("goroutine").WriteTo(&b, 1)
+	return strings.Contains(b.String(), "quic-go.(*Transport).listen")
+}
+
+func TestMain(m *testing.M) {
+	status := m.Run()
+	if status != 0 {
+		os.Exit(status)
+	}
+	if areConnsRunning() {
+		fmt.Println("stray connection goroutines found")
+		os.Exit(1)
+	}
+	if areTransportsRunning() {
+		fmt.Println("stray transport goroutines found")
+		os.Exit(1)
+	}
+	os.Exit(status)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/quicvarint/io.go b/electron/native/private-transport/third_party/quic-go/quicvarint/io.go
new file mode 100644
index 000000000..8ea10acda
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/quicvarint/io.go
@@ -0,0 +1,98 @@
+package quicvarint
+
+import (
+	"bytes"
+	"io"
+)
+
+// Reader implements both the io.ByteReader and io.Reader interfaces.
+type Reader interface {
+	io.ByteReader
+	io.Reader
+}
+
+var _ Reader = &bytes.Reader{}
+
+// A Peeker can peek bytes without consuming them.
+type Peeker interface {
+	Peek(b []byte) (int, error)
+}
+
+// Peek reads a number in the QUIC varint format without consuming bytes.
+func Peek(p Peeker) (uint64, error) {
+	var b [8]byte
+
+	// first peek 1 byte to determine the varint length
+	if _, err := p.Peek(b[:1]); err != nil {
+		return 0, err
+	}
+
+	l := 1 << (b[0] >> 6) // 1, 2, 4, or 8 bytes
+	if l == 1 {
+		return uint64(b[0] & 0b00111111), nil
+	}
+	if _, err := p.Peek(b[:l]); err != nil {
+		return 0, err
+	}
+	val, _, err := Parse(b[:l])
+	return val, err
+}
+
+type byteReader struct {
+	io.Reader
+}
+
+var _ Reader = &byteReader{}
+
+// NewReader returns a Reader for r.
+// If r already implements both io.ByteReader and io.Reader, NewReader returns r.
+// Otherwise, r is wrapped to add the missing interfaces.
+func NewReader(r io.Reader) Reader {
+	if r, ok := r.(Reader); ok {
+		return r
+	}
+	return &byteReader{r}
+}
+
+func (r *byteReader) ReadByte() (byte, error) {
+	var b [1]byte
+	var n int
+	var err error
+	for n == 0 && err == nil {
+		n, err = r.Read(b[:])
+	}
+
+	if n == 1 && err == io.EOF {
+		err = nil
+	}
+	return b[0], err
+}
+
+// Writer implements both the io.ByteWriter and io.Writer interfaces.
+type Writer interface {
+	io.ByteWriter
+	io.Writer
+}
+
+var _ Writer = &bytes.Buffer{}
+
+type byteWriter struct {
+	io.Writer
+}
+
+var _ Writer = &byteWriter{}
+
+// NewWriter returns a Writer for w.
+// If w already implements both io.ByteWriter and io.Writer, NewWriter returns w.
+// Otherwise, w is wrapped to add the missing interfaces.
+func NewWriter(w io.Writer) Writer {
+	if w, ok := w.(Writer); ok {
+		return w
+	}
+	return &byteWriter{w}
+}
+
+func (w *byteWriter) WriteByte(c byte) error {
+	_, err := w.Write([]byte{c})
+	return err
+}
diff --git a/electron/native/private-transport/third_party/quic-go/quicvarint/io_test.go b/electron/native/private-transport/third_party/quic-go/quicvarint/io_test.go
new file mode 100644
index 000000000..9b58773e0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/quicvarint/io_test.go
@@ -0,0 +1,162 @@
+package quicvarint
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+type nopReader struct{}
+
+func (r *nopReader) Read(_ []byte) (int, error) {
+	return 0, io.ErrUnexpectedEOF
+}
+
+var _ io.Reader = &nopReader{}
+
+type nopWriter struct{}
+
+func (r *nopWriter) Write(_ []byte) (int, error) {
+	return 0, io.ErrShortBuffer
+}
+
+// eofReader is a reader that returns data and the io.EOF at the same time in the last Read call
+type eofReader struct {
+	Data []byte
+	pos  int
+}
+
+func (r *eofReader) Read(b []byte) (int, error) {
+	n := copy(b, r.Data[r.pos:])
+	r.pos += n
+	if r.pos >= len(r.Data) {
+		return n, io.EOF
+	}
+	return n, nil
+}
+
+var _ io.Writer = &nopWriter{}
+
+func TestReaderPassesThroughUnchanged(t *testing.T) {
+	b := bytes.NewReader([]byte{0})
+	r := NewReader(b)
+	require.Equal(t, b, r)
+}
+
+func TestReaderWrapsIOReader(t *testing.T) {
+	n := &nopReader{}
+	r := NewReader(n)
+	require.NotEqual(t, n, r)
+}
+
+func TestReaderFailure(t *testing.T) {
+	r := NewReader(&nopReader{})
+	val, err := r.ReadByte()
+	require.Equal(t, io.ErrUnexpectedEOF, err)
+	require.Equal(t, byte(0), val)
+}
+
+func TestReaderHandlesEOF(t *testing.T) {
+	// test that the eofReader behaves as we expect
+	r := &eofReader{Data: []byte("foobar")}
+	b := make([]byte, 3)
+	n, err := r.Read(b)
+	require.Equal(t, 3, n)
+	require.NoError(t, err)
+	require.Equal(t, "foo", string(b))
+	n, err = r.Read(b)
+	require.Equal(t, 3, n)
+	require.Equal(t, io.EOF, err)
+	require.Equal(t, "bar", string(b))
+	n, err = r.Read(b)
+	require.Equal(t, io.EOF, err)
+	require.Zero(t, n)
+
+	// now test using it to read varints
+	reader := NewReader(&eofReader{Data: Append(nil, 1337)})
+	n2, err := Read(reader)
+	require.NoError(t, err)
+	require.EqualValues(t, 1337, n2)
+}
+
+// Regression test: empty reads were being converted to successful
+// reads of a zero value.
+func TestReaderHandlesEmptyRead(t *testing.T) {
+	r, w := io.Pipe()
+
+	go func() {
+		// io.Pipe turns empty writes into empty reads.
+		w.Write(nil)
+		w.Close()
+	}()
+
+	br := NewReader(r)
+	_, err := Read(br)
+	require.ErrorIs(t, err, io.EOF)
+}
+
+func TestWriterPassesThroughUnchanged(t *testing.T) {
+	b := &bytes.Buffer{}
+	w := NewWriter(b)
+	require.Equal(t, b, w)
+}
+
+func TestWriterWrapsIOWriter(t *testing.T) {
+	n := &nopWriter{}
+	w := NewWriter(n)
+	require.NotEqual(t, n, w)
+}
+
+func TestWriterFailure(t *testing.T) {
+	w := NewWriter(&nopWriter{})
+	err := w.WriteByte(0)
+	require.Equal(t, io.ErrShortBuffer, err)
+}
+
+type bufPeeker []byte
+
+func (p bufPeeker) Peek(b []byte) (int, error) {
+	if len(p) < len(b) {
+		return copy(b, p), io.ErrUnexpectedEOF
+	}
+	return copy(b, p), nil
+}
+
+func TestPeek(t *testing.T) {
+	for _, c := range []bufPeeker{
+		{0b00011001},                   // 1-byte
+		{0b01111011, 0xbd},             // 2-byte
+		{0b10011101, 0x7f, 0x3e, 0x7d}, // 4-byte
+		{0xc2, 0x19, 0x7c, 0x5e, 0xff, 0x14, 0xe8, 0x8c}, // 8-byte
+	} {
+		t.Run(fmt.Sprintf("%d bytes", len(c)), func(t *testing.T) {
+			peekVal, err := Peek(append(c, []byte("foobar")...)) // append some data, which doesn't matter
+			require.NoError(t, err)
+			parseVal, _, err := Parse(c)
+			require.NoError(t, err)
+			require.Equal(t, parseVal, peekVal)
+		})
+	}
+}
+
+func TestPeekErrors(t *testing.T) {
+	errorCases := []struct {
+		name  string
+		input bufPeeker
+	}{
+		{"empty input", bufPeeker{}},
+		{"2-byte, missing 1", bufPeeker{0b01000001}},
+		{"4-byte, missing 1", bufPeeker{0b10000000, 0, 0}},
+		{"8-byte, missing 1", bufPeeker{0b11000000, 0, 0, 0, 0, 0, 0}},
+	}
+
+	for _, tc := range errorCases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := Peek(tc.input)
+			require.ErrorIs(t, err, io.ErrUnexpectedEOF)
+		})
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/quicvarint/varint.go b/electron/native/private-transport/third_party/quic-go/quicvarint/varint.go
new file mode 100644
index 000000000..52fb153c7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/quicvarint/varint.go
@@ -0,0 +1,180 @@
+package quicvarint
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+)
+
+// taken from the QUIC draft
+const (
+	// Min is the minimum value allowed for a QUIC varint.
+	Min = 0
+
+	// Max is the maximum allowed value for a QUIC varint (2^62-1).
+	Max = maxVarInt8
+
+	maxVarInt1 = 63
+	maxVarInt2 = 16383
+	maxVarInt4 = 1073741823
+	maxVarInt8 = 4611686018427387903
+)
+
+type varintLengthError struct {
+	Num uint64
+}
+
+func (e *varintLengthError) Error() string {
+	return fmt.Sprintf("value doesn't fit into 62 bits: %d", e.Num)
+}
+
+// Read reads a number in the QUIC varint format from r.
+func Read(r io.ByteReader) (uint64, error) {
+	firstByte, err := r.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	// the first two bits of the first byte encode the length
+	l := 1 << ((firstByte & 0xc0) >> 6)
+	b1 := firstByte & (0xff - 0xc0)
+	if l == 1 {
+		return uint64(b1), nil
+	}
+	b2, err := r.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	if l == 2 {
+		return uint64(b2) + uint64(b1)<<8, nil
+	}
+	b3, err := r.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	b4, err := r.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	if l == 4 {
+		return uint64(b4) + uint64(b3)<<8 + uint64(b2)<<16 + uint64(b1)<<24, nil
+	}
+	b5, err := r.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	b6, err := r.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	b7, err := r.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	b8, err := r.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	return uint64(b8) + uint64(b7)<<8 + uint64(b6)<<16 + uint64(b5)<<24 + uint64(b4)<<32 + uint64(b3)<<40 + uint64(b2)<<48 + uint64(b1)<<56, nil
+}
+
+// Parse reads a number in the QUIC varint format.
+// It returns the number of bytes consumed.
+func Parse(b []byte) (uint64 /* value */, int /* bytes consumed */, error) {
+	if len(b) == 0 {
+		return 0, 0, io.EOF
+	}
+
+	first := b[0]
+	switch first >> 6 {
+	case 0: // 1-byte encoding: 00xxxxxx
+		return uint64(first & 0b00111111), 1, nil
+	case 1: // 2-byte encoding: 01xxxxxx
+		if len(b) < 2 {
+			return 0, 0, io.ErrUnexpectedEOF
+		}
+		return uint64(b[1]) | uint64(first&0b00111111)<<8, 2, nil
+	case 2: // 4-byte encoding: 10xxxxxx
+		if len(b) < 4 {
+			return 0, 0, io.ErrUnexpectedEOF
+		}
+		return uint64(b[3]) | uint64(b[2])<<8 | uint64(b[1])<<16 | uint64(first&0b00111111)<<24, 4, nil
+	case 3: // 8-byte encoding: 00xxxxxx
+		if len(b) < 8 {
+			return 0, 0, io.ErrUnexpectedEOF
+		}
+		// binary.BigEndian.Uint64 only reads the first 8 bytes. Passing the full slice avoids slicing overhead.
+		return binary.BigEndian.Uint64(b) & 0x3fffffffffffffff, 8, nil
+	}
+
+	panic("unreachable")
+}
+
+// Append appends i in the QUIC varint format.
+func Append(b []byte, i uint64) []byte {
+	if i <= maxVarInt1 {
+		return append(b, uint8(i))
+	}
+	if i <= maxVarInt2 {
+		return append(b, []byte{uint8(i>>8) | 0x40, uint8(i)}...)
+	}
+	if i <= maxVarInt4 {
+		return append(b, []byte{uint8(i>>24) | 0x80, uint8(i >> 16), uint8(i >> 8), uint8(i)}...)
+	}
+	if i <= maxVarInt8 {
+		return append(b, []byte{
+			uint8(i>>56) | 0xc0, uint8(i >> 48), uint8(i >> 40), uint8(i >> 32),
+			uint8(i >> 24), uint8(i >> 16), uint8(i >> 8), uint8(i),
+		}...)
+	}
+	panic(&varintLengthError{Num: i})
+}
+
+// AppendWithLen append i in the QUIC varint format with the desired length.
+func AppendWithLen(b []byte, i uint64, length int) []byte {
+	if length != 1 && length != 2 && length != 4 && length != 8 {
+		panic("invalid varint length")
+	}
+	l := Len(i)
+	if l == length {
+		return Append(b, i)
+	}
+	if l > length {
+		panic(fmt.Sprintf("cannot encode %d in %d bytes", i, length))
+	}
+	switch length {
+	case 2:
+		b = append(b, 0b01000000)
+	case 4:
+		b = append(b, 0b10000000)
+	case 8:
+		b = append(b, 0b11000000)
+	}
+	for range length - l - 1 {
+		b = append(b, 0)
+	}
+	for j := range l {
+		b = append(b, uint8(i>>(8*(l-1-j))))
+	}
+	return b
+}
+
+// Len determines the number of bytes that will be needed to write the number i.
+//
+//gcassert:inline
+func Len(i uint64) int {
+	if i <= maxVarInt1 {
+		return 1
+	}
+	if i <= maxVarInt2 {
+		return 2
+	}
+	if i <= maxVarInt4 {
+		return 4
+	}
+	if i <= maxVarInt8 {
+		return 8
+	}
+	// Don't use a fmt.Sprintf here to format the error message.
+	// The function would then exceed the inlining budget.
+	panic(&varintLengthError{Num: i})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/quicvarint/varint_test.go b/electron/native/private-transport/third_party/quic-go/quicvarint/varint_test.go
new file mode 100644
index 000000000..7c0116eed
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/quicvarint/varint_test.go
@@ -0,0 +1,350 @@
+package quicvarint
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"math/rand/v2"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLimits(t *testing.T) {
+	require.Equal(t, 0, Min)
+	require.Equal(t, uint64(1<<62-1), uint64(Max))
+}
+
+func TestRead(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    []byte
+		expected uint64
+	}{
+		{"1 byte", []byte{0b00011001}, 25},
+		{"2 byte", []byte{0b01111011, 0xbd}, 15293},
+		{"4 byte", []byte{0b10011101, 0x7f, 0x3e, 0x7d}, 494878333},
+		{"8 byte", []byte{0b11000010, 0x19, 0x7c, 0x5e, 0xff, 0x14, 0xe8, 0x8c}, 151288809941952652},
+		{"too long", []byte{0b01000000, 0x25}, 37},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := bytes.NewReader(tt.input)
+			val, err := Read(b)
+			require.NoError(t, err)
+			require.Equal(t, tt.expected, val)
+			require.Zero(t, b.Len())
+		})
+	}
+}
+
+func TestParse(t *testing.T) {
+	tests := []struct {
+		name          string
+		input         []byte
+		expectedValue uint64
+		expectedLen   int
+	}{
+		{"1 byte", []byte{0b00011001}, 25, 1},
+		{"2 byte", []byte{0b01111011, 0xbd}, 15293, 2},
+		{"4 byte", []byte{0b10011101, 0x7f, 0x3e, 0x7d}, 494878333, 4},
+		{"8 byte", []byte{0b11000010, 0x19, 0x7c, 0x5e, 0xff, 0x14, 0xe8, 0x8c}, 151288809941952652, 8},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			value, l, err := Parse(tt.input)
+			require.Equal(t, tt.expectedValue, value)
+			require.Equal(t, tt.expectedLen, l)
+			require.Nil(t, err)
+		})
+	}
+}
+
+func TestParsingFailures(t *testing.T) {
+	tests := []struct {
+		name        string
+		input       []byte
+		expectedErr error
+	}{
+		{
+			name:        "empty slice",
+			input:       []byte{},
+			expectedErr: io.EOF,
+		},
+		{
+			name:        "2-byte encoding: not enough bytes",
+			input:       []byte{0b01000001},
+			expectedErr: io.ErrUnexpectedEOF,
+		},
+		{
+			name:        "4-byte encoding: not enough bytes",
+			input:       []byte{0b10000000, 0x0, 0x0},
+			expectedErr: io.ErrUnexpectedEOF,
+		},
+		{
+			name:        "8-byte encoding: not enough bytes",
+			input:       []byte{0b11000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
+			expectedErr: io.ErrUnexpectedEOF,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			value, l, err := Parse(tt.input)
+			require.Equal(t, uint64(0), value)
+			require.Equal(t, 0, l)
+			require.Equal(t, tt.expectedErr, err)
+		})
+	}
+}
+
+func TestVarintEncoding(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    uint64
+		expected []byte
+	}{
+		{"1 byte number", 37, []byte{0x25}},
+		{"maximum 1 byte number", maxVarInt1, []byte{0b00111111}},
+		{"minimum 2 byte number", maxVarInt1 + 1, []byte{0x40, maxVarInt1 + 1}},
+		{"2 byte number", 15293, []byte{0b01000000 ^ 0x3b, 0xbd}},
+		{"maximum 2 byte number", maxVarInt2, []byte{0b01111111, 0xff}},
+		{"minimum 4 byte number", maxVarInt2 + 1, []byte{0b10000000, 0, 0x40, 0}},
+		{"4 byte number", 494878333, []byte{0b10000000 ^ 0x1d, 0x7f, 0x3e, 0x7d}},
+		{"maximum 4 byte number", maxVarInt4, []byte{0b10111111, 0xff, 0xff, 0xff}},
+		{"minimum 8 byte number", maxVarInt4 + 1, []byte{0b11000000, 0, 0, 0, 0x40, 0, 0, 0}},
+		{"8 byte number", 151288809941952652, []byte{0xc2, 0x19, 0x7c, 0x5e, 0xff, 0x14, 0xe8, 0x8c}},
+		{"maximum 8 byte number", maxVarInt8, []byte{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.expected, Append(nil, tt.value))
+		})
+	}
+
+	t.Run("panics when given a too large number (> 62 bit)", func(t *testing.T) {
+		require.PanicsWithError(t,
+			fmt.Sprintf("value doesn't fit into 62 bits: %d", maxVarInt8+1),
+			func() { Append(nil, maxVarInt8+1) },
+		)
+	})
+}
+
+func TestAppendWithLen(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    uint64
+		length   int
+		expected []byte
+	}{
+		{"1-byte number in minimal encoding", 37, 1, []byte{0x25}},
+		{"1-byte number in 2 bytes", 37, 2, []byte{0b01000000, 0x25}},
+		{"1-byte number in 4 bytes", 37, 4, []byte{0b10000000, 0, 0, 0x25}},
+		{"1-byte number in 8 bytes", 37, 8, []byte{0b11000000, 0, 0, 0, 0, 0, 0, 0x25}},
+		{"2-byte number in 4 bytes", 15293, 4, []byte{0b10000000, 0, 0x3b, 0xbd}},
+		{"4-byte number in 8 bytes", 494878333, 8, []byte{0b11000000, 0, 0, 0, 0x1d, 0x7f, 0x3e, 0x7d}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := AppendWithLen(nil, tt.value, tt.length)
+			require.Equal(t, tt.expected, b)
+
+			if tt.length > 1 {
+				v, n, err := Parse(b)
+				require.NoError(t, err)
+				require.Equal(t, tt.length, n)
+				require.Equal(t, tt.value, v)
+			}
+		})
+	}
+}
+
+func TestAppendWithLenFailures(t *testing.T) {
+	tests := []struct {
+		name   string
+		value  uint64
+		length int
+	}{
+		{"invalid length", 25, 3},
+		{"too short for 2 bytes", maxVarInt1 + 1, 1},
+		{"too short for 4 bytes", maxVarInt2 + 1, 2},
+		{"too short for 8 bytes", maxVarInt4 + 1, 4},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Panics(t, func() {
+				AppendWithLen(nil, tt.value, tt.length)
+			})
+		})
+	}
+}
+
+func TestLen(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    uint64
+		expected int
+	}{
+		{"zero", 0, 1},
+		{"max 1 byte", maxVarInt1, 1},
+		{"min 2 bytes", maxVarInt1 + 1, 2},
+		{"max 2 bytes", maxVarInt2, 2},
+		{"min 4 bytes", maxVarInt2 + 1, 4},
+		{"max 4 bytes", maxVarInt4, 4},
+		{"min 8 bytes", maxVarInt4 + 1, 8},
+		{"max 8 bytes", maxVarInt8, 8},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.expected, Len(tt.input))
+		})
+	}
+
+	t.Run("panics on too large number", func(t *testing.T) {
+		require.PanicsWithError(t,
+			fmt.Sprintf("value doesn't fit into 62 bits: %d", maxVarInt8+1),
+			func() { Len(maxVarInt8 + 1) },
+		)
+	})
+}
+
+type benchmarkValue struct {
+	b []byte
+	v uint64
+}
+
+func randomValues(maxValue uint64) []benchmarkValue {
+	r := rand.New(rand.NewPCG(13, 37))
+
+	const num = 1025
+	bv := make([]benchmarkValue, num)
+	for i := range num {
+		v := r.Uint64() % maxValue
+		bv[i].v = v
+		bv[i].b = Append([]byte{}, v)
+	}
+	return bv
+}
+
+// using a reader that is also an io.ByteReader
+func BenchmarkReadBytesReader(b *testing.B) {
+	b.Run("1-byte", func(b *testing.B) { benchmarkRead(b, randomValues(maxVarInt1), false) })
+	b.Run("2-byte", func(b *testing.B) { benchmarkRead(b, randomValues(maxVarInt2), false) })
+	b.Run("4-byte", func(b *testing.B) { benchmarkRead(b, randomValues(maxVarInt4), false) })
+	b.Run("8-byte", func(b *testing.B) { benchmarkRead(b, randomValues(maxVarInt8), false) })
+}
+
+// using a reader that is not an io.ByteReader
+func BenchmarkReadSimpleReader(b *testing.B) {
+	b.Run("1-byte", func(b *testing.B) { benchmarkRead(b, randomValues(maxVarInt1), true) })
+	b.Run("2-byte", func(b *testing.B) { benchmarkRead(b, randomValues(maxVarInt2), true) })
+	b.Run("4-byte", func(b *testing.B) { benchmarkRead(b, randomValues(maxVarInt4), true) })
+	b.Run("8-byte", func(b *testing.B) { benchmarkRead(b, randomValues(maxVarInt8), true) })
+}
+
+// simpleReader satisfies io.Reader, but not io.ByteReader
+// This means that NewReader will need to wrap the reader.
+type simpleReader struct {
+	io.Reader
+}
+
+func benchmarkRead(b *testing.B, inputs []benchmarkValue, wrapBytesReader bool) {
+	r := bytes.NewReader([]byte{})
+	var vr Reader
+	if wrapBytesReader {
+		vr = NewReader(&simpleReader{r})
+	} else {
+		vr = NewReader(r)
+	}
+
+	var i int
+	for b.Loop() {
+		index := i % len(inputs)
+		i++
+		r.Reset(inputs[index].b)
+		val, err := Read(vr)
+		if err != nil {
+			b.Fatal(err)
+		}
+		if val != inputs[index].v {
+			b.Fatalf("expected %d, got %d", inputs[index].v, val)
+		}
+	}
+}
+
+func BenchmarkParse(b *testing.B) {
+	b.Run("1-byte", func(b *testing.B) { benchmarkParse(b, randomValues(maxVarInt1)) })
+	b.Run("2-byte", func(b *testing.B) { benchmarkParse(b, randomValues(maxVarInt2)) })
+	b.Run("4-byte", func(b *testing.B) { benchmarkParse(b, randomValues(maxVarInt4)) })
+	b.Run("8-byte", func(b *testing.B) { benchmarkParse(b, randomValues(maxVarInt8)) })
+}
+
+func benchmarkParse(b *testing.B, inputs []benchmarkValue) {
+	var i int
+	for b.Loop() {
+		index := i % len(inputs)
+		i++
+		val, n, err := Parse(inputs[index].b)
+		if err != nil {
+			b.Fatal(err)
+		}
+		if n != len(inputs[index].b) {
+			b.Fatalf("expected to consume %d bytes, consumed %d", len(inputs[i].b), n)
+		}
+		if val != inputs[index].v {
+			b.Fatalf("expected %d, got %d", inputs[index].v, val)
+		}
+	}
+}
+
+func BenchmarkAppend(b *testing.B) {
+	b.Run("1-byte", func(b *testing.B) { benchmarkAppend(b, randomValues(maxVarInt1)) })
+	b.Run("2-byte", func(b *testing.B) { benchmarkAppend(b, randomValues(maxVarInt2)) })
+	b.Run("4-byte", func(b *testing.B) { benchmarkAppend(b, randomValues(maxVarInt4)) })
+	b.Run("8-byte", func(b *testing.B) { benchmarkAppend(b, randomValues(maxVarInt8)) })
+}
+
+func benchmarkAppend(b *testing.B, inputs []benchmarkValue) {
+	buf := make([]byte, 8)
+
+	var i int
+	for b.Loop() {
+		buf = buf[:0]
+		index := i % len(inputs)
+		i++
+		buf = Append(buf, inputs[index].v)
+
+		if !bytes.Equal(buf, inputs[index].b) {
+			b.Fatalf("expected to write %v, wrote %v", inputs[index].b, buf)
+		}
+	}
+}
+
+func BenchmarkAppendWithLen(b *testing.B) {
+	b.Run("1-byte", func(b *testing.B) { benchmarkAppendWithLen(b, randomValues(maxVarInt1)) })
+	b.Run("2-byte", func(b *testing.B) { benchmarkAppendWithLen(b, randomValues(maxVarInt2)) })
+	b.Run("4-byte", func(b *testing.B) { benchmarkAppendWithLen(b, randomValues(maxVarInt4)) })
+	b.Run("8-byte", func(b *testing.B) { benchmarkAppendWithLen(b, randomValues(maxVarInt8)) })
+}
+
+func benchmarkAppendWithLen(b *testing.B, inputs []benchmarkValue) {
+	buf := make([]byte, 8)
+
+	var i int
+	for b.Loop() {
+		buf = buf[:0]
+		index := i % len(inputs)
+		i++
+		buf = AppendWithLen(buf, inputs[index].v, len(inputs[index].b))
+
+		if !bytes.Equal(buf, inputs[index].b) {
+			b.Fatalf("expected to write %v, wrote %v", inputs[index].b, buf)
+		}
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/receive_stream.go b/electron/native/private-transport/third_party/quic-go/receive_stream.go
new file mode 100644
index 000000000..c9d0f8ca8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/receive_stream.go
@@ -0,0 +1,578 @@
+package quic
+
+import (
+	"fmt"
+	"io"
+	"sync"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+// A ReceiveStream is a unidirectional Receive Stream.
+type ReceiveStream struct {
+	mutex sync.Mutex
+
+	streamID protocol.StreamID
+
+	sender streamSender
+
+	frameQueue               *frameSorter
+	finalOffset              protocol.ByteCount
+	receiveFinalSizeCallback func(int64)
+
+	currentFrame       []byte
+	currentFrameDone   func()
+	readPosInFrame     int
+	currentFrameIsLast bool // is the currentFrame the last frame on this stream
+
+	queuedStopSending   bool
+	queuedMaxStreamData bool
+
+	// Set once we read the io.EOF or the cancellation error.
+	// Note that for local cancellations, this doesn't necessarily mean that we know the final offset yet.
+	errorRead           bool
+	completed           bool // set once we've called streamSender.onStreamCompleted
+	cancelledRemotely   bool
+	cancelledLocally    bool
+	cancelErr           *StreamError
+	closeForShutdownErr error
+
+	readPos      protocol.ByteCount
+	reliableSize protocol.ByteCount
+
+	readChan chan struct{}
+	readOnce chan struct{} // cap: 1, to protect against concurrent use of Read
+	deadline monotime.Time
+
+	flowController *streamFlowController
+}
+
+var (
+	_ streamControlFrameGetter  = &ReceiveStream{}
+	_ receiveStreamFrameHandler = &ReceiveStream{}
+)
+
+func newReceiveStream(
+	streamID protocol.StreamID,
+	sender streamSender,
+	flowController *streamFlowController,
+) *ReceiveStream {
+	return &ReceiveStream{
+		streamID:       streamID,
+		sender:         sender,
+		flowController: flowController,
+		frameQueue:     newFrameSorter(),
+		readChan:       make(chan struct{}, 1),
+		readOnce:       make(chan struct{}, 1),
+		finalOffset:    protocol.MaxByteCount,
+	}
+}
+
+// StreamID returns the stream ID.
+func (s *ReceiveStream) StreamID() StreamID {
+	return s.streamID
+}
+
+// SetReceiveFinalSizeCallback sets a callback that is called when the receive stream's final size is known.
+// The final size is learned from a FIN or RESET_STREAM frame.
+// Most applications don't need this. It is mainly useful for protocol layers
+// that need exact stream final sizes, such as WebTransport flow control accounting.
+// If the final size is already known, the callback is called before this method returns.
+// When the final size is learned later, the callback is called from the connection's event loop and must not block.
+// The callback is not called if the connection is closed before the final size is known.
+// Setting a nil callback removes it if the final size is not yet known.
+func (s *ReceiveStream) SetReceiveFinalSizeCallback(callback func(int64)) {
+	s.mutex.Lock()
+	size := s.finalOffset
+
+	// final size is already known
+	if size != protocol.MaxByteCount {
+		s.mutex.Unlock()
+		if callback != nil {
+			callback(int64(size))
+		}
+		return
+	}
+
+	if s.closeForShutdownErr != nil {
+		s.mutex.Unlock()
+		return
+	}
+	s.receiveFinalSizeCallback = callback
+	s.mutex.Unlock()
+}
+
+// Read reads data from the stream.
+// Read can be made to time out using [ReceiveStream.SetReadDeadline].
+// If the stream was canceled, the error is a [StreamError].
+func (s *ReceiveStream) Read(p []byte) (int, error) {
+	// Concurrent use of Read is not permitted (and doesn't make any sense),
+	// but sometimes people do it anyway.
+	// Make sure that we only execute one call at any given time to avoid hard to debug failures.
+	s.readOnce <- struct{}{}
+	defer func() { <-s.readOnce }()
+
+	s.mutex.Lock()
+	queuedStreamWindowUpdate, queuedConnWindowUpdate, n, err := s.readImpl(p)
+	completed := s.isNewlyCompleted()
+	s.mutex.Unlock()
+
+	if completed {
+		s.sender.onStreamCompleted(s.streamID)
+	}
+	if queuedStreamWindowUpdate {
+		s.sender.onHasStreamControlFrame(s.streamID, s)
+	}
+	if queuedConnWindowUpdate {
+		s.sender.onHasConnectionData()
+	}
+	return n, err
+}
+
+func (s *ReceiveStream) isNewlyCompleted() bool {
+	if s.completed {
+		return false
+	}
+	// We need to know the final offset (either via FIN or RESET_STREAM) for flow control accounting.
+	if s.finalOffset == protocol.MaxByteCount {
+		return false
+	}
+	// We're done with the stream if it was cancelled locally...
+	if s.cancelledLocally {
+		s.completed = true
+		return true
+	}
+	// ... or if the error (either io.EOF or the reset error) was read
+	if s.errorRead {
+		s.completed = true
+		return true
+	}
+	return false
+}
+
+func (s *ReceiveStream) readImpl(p []byte) (hasStreamWindowUpdate bool, hasConnWindowUpdate bool, _ int, _ error) {
+	if s.currentFrameIsLast && s.currentFrame == nil {
+		s.errorRead = true
+		return false, false, 0, io.EOF
+	}
+	if s.cancelledLocally || s.isRemoteCancellationEffective() {
+		s.errorRead = true
+		return false, false, 0, s.cancelErr
+	}
+	if s.closeForShutdownErr != nil {
+		return false, false, 0, s.closeForShutdownErr
+	}
+
+	var bytesRead int
+	var deadlineTimer *time.Timer
+	for bytesRead < len(p) {
+		if s.currentFrame == nil || s.readPosInFrame >= len(s.currentFrame) {
+			s.dequeueNextFrame()
+		}
+		if s.currentFrame == nil && bytesRead > 0 {
+			return hasStreamWindowUpdate, hasConnWindowUpdate, bytesRead, s.closeForShutdownErr
+		}
+
+		for {
+			// Stop waiting on errors
+			if s.closeForShutdownErr != nil {
+				return hasStreamWindowUpdate, hasConnWindowUpdate, bytesRead, s.closeForShutdownErr
+			}
+			if s.cancelledLocally || s.isRemoteCancellationEffective() {
+				s.errorRead = true
+				return hasStreamWindowUpdate, hasConnWindowUpdate, bytesRead, s.cancelErr
+			}
+
+			deadline := s.deadline
+			if !deadline.IsZero() && !monotime.Now().Before(deadline) {
+				return hasStreamWindowUpdate, hasConnWindowUpdate, bytesRead, errDeadline
+			}
+
+			if s.currentFrame != nil || s.currentFrameIsLast {
+				break
+			}
+
+			s.mutex.Unlock()
+			if deadline.IsZero() {
+				<-s.readChan
+			} else {
+				if deadlineTimer == nil {
+					deadlineTimer = time.NewTimer(monotime.Until(deadline))
+					defer deadlineTimer.Stop()
+				} else {
+					deadlineTimer.Reset(monotime.Until(deadline))
+				}
+				select {
+				case <-s.readChan:
+				case <-deadlineTimer.C:
+				}
+			}
+			s.mutex.Lock()
+			s.dequeueNextFrame()
+		}
+
+		if bytesRead > len(p) {
+			return hasStreamWindowUpdate, hasConnWindowUpdate, bytesRead, fmt.Errorf("BUG: bytesRead (%d) > len(p) (%d) in stream.Read", bytesRead, len(p))
+		}
+		if s.readPosInFrame > len(s.currentFrame) {
+			return hasStreamWindowUpdate, hasConnWindowUpdate, bytesRead, fmt.Errorf("BUG: readPosInFrame (%d) > frame.DataLen (%d) in stream.Read", s.readPosInFrame, len(s.currentFrame))
+		}
+		m := copy(p[bytesRead:], s.currentFrame[s.readPosInFrame:])
+
+		// when a RESET_STREAM was received, the flow controller was already
+		// informed about the final offset for this stream
+		if !s.isRemoteCancellationEffective() {
+			hasStream, hasConn := s.flowController.AddBytesRead(protocol.ByteCount(m))
+			if hasStream {
+				s.queuedMaxStreamData = true
+				hasStreamWindowUpdate = true
+			}
+			if hasConn {
+				hasConnWindowUpdate = true
+			}
+		}
+
+		s.readPosInFrame += m
+		s.readPos += protocol.ByteCount(m)
+		bytesRead += m
+
+		if s.isRemoteCancellationEffective() {
+			s.flowController.Abandon()
+		}
+
+		if s.readPosInFrame >= len(s.currentFrame) && s.currentFrameIsLast {
+			s.currentFrame = nil
+			if s.currentFrameDone != nil {
+				s.currentFrameDone()
+			}
+			s.errorRead = true
+			return hasStreamWindowUpdate, hasConnWindowUpdate, bytesRead, io.EOF
+		}
+	}
+	if s.isRemoteCancellationEffective() {
+		s.errorRead = true
+		return hasStreamWindowUpdate, hasConnWindowUpdate, bytesRead, s.cancelErr
+	}
+	return hasStreamWindowUpdate, hasConnWindowUpdate, bytesRead, nil
+}
+
+// isRemoteCancellationEffective returns whether the stream was cancelled remotely
+// and all reliable data has been read.
+func (s *ReceiveStream) isRemoteCancellationEffective() bool {
+	return s.cancelledRemotely && s.readPos >= s.reliableSize
+}
+
+// Peek fills b with stream data, without consuming the stream data.
+// It blocks until len(b) bytes are available, or an error occurs.
+// It respects the stream deadline set by [ReceiveStream.SetReadDeadline].
+// If the stream ends before len(b) bytes are available,
+// it returns the number of bytes peeked along with [io.EOF].
+func (s *ReceiveStream) Peek(b []byte) (int, error) {
+	if len(b) == 0 {
+		return 0, nil
+	}
+
+	// prevent concurrent use with Read
+	s.readOnce <- struct{}{}
+	defer func() { <-s.readOnce }()
+
+	return s.peekImpl(b)
+}
+
+func (s *ReceiveStream) peekImpl(b []byte) (int, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	var deadlineTimer *time.Timer
+
+	for {
+		if s.currentFrameIsLast && s.currentFrame == nil {
+			return 0, io.EOF
+		}
+		if s.cancelledLocally || s.isRemoteCancellationEffective() {
+			return 0, s.cancelErr
+		}
+		if s.closeForShutdownErr != nil {
+			return 0, s.closeForShutdownErr
+		}
+
+		deadline := s.deadline
+		if !deadline.IsZero() && !monotime.Now().Before(deadline) {
+			return 0, errDeadline
+		}
+
+		if s.currentFrame == nil || s.readPosInFrame >= len(s.currentFrame) {
+			s.dequeueNextFrame()
+		}
+
+		if s.currentFrame != nil && s.readPosInFrame < len(s.currentFrame) {
+			availableInCurrentFrame := len(s.currentFrame) - s.readPosInFrame
+
+			if availableInCurrentFrame >= len(b) {
+				copy(b, s.currentFrame[s.readPosInFrame:])
+				return len(b), nil
+			}
+
+			offset := s.readPos + protocol.ByteCount(availableInCurrentFrame)
+			// First peek, then copy.
+			// This avoids copying data if there's not enough data in the queue.
+			if err := s.frameQueue.Peek(offset, b[availableInCurrentFrame:]); err == nil {
+				copy(b[:availableInCurrentFrame], s.currentFrame[s.readPosInFrame:])
+				return len(b), nil
+			}
+
+			if s.currentFrameIsLast {
+				copy(b[:availableInCurrentFrame], s.currentFrame[s.readPosInFrame:])
+				return availableInCurrentFrame, io.EOF
+			}
+
+			// If the stream was remotely cancelled and the request extends beyond the reliable size,
+			// return the data available with the cancel error (once it's all received).
+			if s.cancelledRemotely && s.readPos+protocol.ByteCount(len(b)) > s.reliableSize {
+				total := int(s.reliableSize - s.readPos)
+				needed := total - availableInCurrentFrame
+				// only return once all available data is contiguous
+				if needed <= 0 || s.frameQueue.Peek(offset, b[availableInCurrentFrame:total]) == nil {
+					copy(b[:availableInCurrentFrame], s.currentFrame[s.readPosInFrame:])
+					return total, s.cancelErr
+				}
+			}
+
+			// If the request extends beyond the stream's final offset,
+			// return the data available with EOF (once it's all received).
+			if s.readPos+protocol.ByteCount(len(b)) > s.finalOffset {
+				total := int(s.finalOffset - s.readPos)
+				needed := total - availableInCurrentFrame
+				// only return once all available data is contiguous
+				if needed <= 0 || s.frameQueue.Peek(offset, b[availableInCurrentFrame:total]) == nil {
+					copy(b[:availableInCurrentFrame], s.currentFrame[s.readPosInFrame:])
+					return total, io.EOF
+				}
+			}
+		}
+
+		if s.currentFrameIsLast || s.readPos >= s.finalOffset {
+			return 0, io.EOF
+		}
+
+		s.mutex.Unlock()
+		if deadline.IsZero() {
+			<-s.readChan
+		} else {
+			if deadlineTimer == nil {
+				deadlineTimer = time.NewTimer(monotime.Until(deadline))
+				defer deadlineTimer.Stop()
+			} else {
+				deadlineTimer.Reset(monotime.Until(deadline))
+			}
+			select {
+			case <-s.readChan:
+			case <-deadlineTimer.C:
+			}
+		}
+		s.mutex.Lock()
+		if s.currentFrame == nil || s.readPosInFrame >= len(s.currentFrame) {
+			s.dequeueNextFrame()
+		}
+	}
+}
+
+func (s *ReceiveStream) dequeueNextFrame() {
+	var offset protocol.ByteCount
+	// We're done with the last frame. Release the buffer.
+	if s.currentFrameDone != nil {
+		s.currentFrameDone()
+	}
+	offset, s.currentFrame, s.currentFrameDone = s.frameQueue.Pop()
+	s.currentFrameIsLast = offset+protocol.ByteCount(len(s.currentFrame)) >= s.finalOffset && !s.cancelledRemotely
+	s.readPosInFrame = 0
+}
+
+// CancelRead aborts receiving on this stream.
+// It instructs the peer to stop transmitting stream data.
+// [ReceiveStream.Read] will unblock immediately, and future calls to it will fail.
+// When called multiple times or after [ReceiveStream.Read] returns [io.EOF], it is a no-op.
+func (s *ReceiveStream) CancelRead(errorCode StreamErrorCode) {
+	s.mutex.Lock()
+	queuedNewControlFrame := s.cancelReadImpl(errorCode)
+	completed := s.isNewlyCompleted()
+	s.mutex.Unlock()
+
+	if queuedNewControlFrame {
+		s.sender.onHasStreamControlFrame(s.streamID, s)
+	}
+	if completed {
+		s.flowController.Abandon()
+		s.sender.onStreamCompleted(s.streamID)
+	}
+}
+
+func (s *ReceiveStream) cancelReadImpl(errorCode qerr.StreamErrorCode) (queuedNewControlFrame bool) {
+	if s.cancelledLocally { // duplicate call to CancelRead
+		return false
+	}
+	if s.closeForShutdownErr != nil {
+		return false
+	}
+	s.cancelledLocally = true
+	if s.errorRead || s.cancelledRemotely {
+		return false
+	}
+	s.queuedStopSending = true
+	s.cancelErr = &StreamError{StreamID: s.streamID, ErrorCode: errorCode, Remote: false}
+	s.signalRead()
+	return true
+}
+
+func (s *ReceiveStream) handleStreamFrame(frame *wire.StreamFrame, now monotime.Time) error {
+	s.mutex.Lock()
+	err := s.handleStreamFrameImpl(frame, now)
+	completed := s.isNewlyCompleted()
+	size, callback := s.takeReceiveFinalSizeCallback()
+	s.mutex.Unlock()
+
+	if completed {
+		s.flowController.Abandon()
+		s.sender.onStreamCompleted(s.streamID)
+	}
+	if callback != nil {
+		callback(size)
+	}
+	return err
+}
+
+func (s *ReceiveStream) handleStreamFrameImpl(frame *wire.StreamFrame, now monotime.Time) error {
+	if s.closeForShutdownErr != nil {
+		return nil
+	}
+	maxOffset := frame.Offset + frame.DataLen()
+	if err := s.flowController.UpdateHighestReceived(maxOffset, frame.Fin, now); err != nil {
+		return err
+	}
+	if frame.Fin {
+		s.finalOffset = maxOffset
+	}
+	if s.cancelledLocally {
+		return nil
+	}
+	if err := s.frameQueue.Push(frame.Data, frame.Offset, frame.PutBack); err != nil {
+		return err
+	}
+	s.signalRead()
+	return nil
+}
+
+func (s *ReceiveStream) handleResetStreamFrame(frame *wire.ResetStreamFrame, now monotime.Time) error {
+	s.mutex.Lock()
+	err := s.handleResetStreamFrameImpl(frame, now)
+	completed := s.isNewlyCompleted()
+	size, callback := s.takeReceiveFinalSizeCallback()
+	s.mutex.Unlock()
+
+	if completed {
+		s.sender.onStreamCompleted(s.streamID)
+	}
+	if callback != nil {
+		callback(size)
+	}
+	return err
+}
+
+func (s *ReceiveStream) handleResetStreamFrameImpl(frame *wire.ResetStreamFrame, now monotime.Time) error {
+	if s.closeForShutdownErr != nil {
+		return nil
+	}
+	if err := s.flowController.UpdateHighestReceived(frame.FinalSize, true, now); err != nil {
+		return err
+	}
+	s.finalOffset = frame.FinalSize
+
+	// senders are allowed to reduce the reliable size, but frames might have been reordered
+	if (!s.cancelledRemotely && s.reliableSize == 0) || frame.ReliableSize < s.reliableSize {
+		s.reliableSize = frame.ReliableSize
+	}
+	if s.readPos >= s.reliableSize {
+		// calling Abandon multiple times is a no-op
+		s.flowController.Abandon()
+	}
+	// ignore duplicate RESET_STREAM frames for this stream (after checking their final offset)
+	if s.cancelledRemotely {
+		return nil
+	}
+
+	// don't save the error if the RESET_STREAM frames was received after CancelRead was called
+	if s.cancelledLocally {
+		return nil
+	}
+	s.cancelledRemotely = true
+	s.cancelErr = &StreamError{StreamID: s.streamID, ErrorCode: frame.ErrorCode, Remote: true}
+	s.signalRead()
+	return nil
+}
+
+func (s *ReceiveStream) takeReceiveFinalSizeCallback() (int64, func(int64)) {
+	if s.finalOffset == protocol.MaxByteCount {
+		return 0, nil
+	}
+	callback := s.receiveFinalSizeCallback
+	s.receiveFinalSizeCallback = nil
+	return int64(s.finalOffset), callback
+}
+
+func (s *ReceiveStream) getControlFrame(now monotime.Time) (_ ackhandler.Frame, ok, hasMore bool) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	if !s.queuedStopSending && !s.queuedMaxStreamData {
+		return ackhandler.Frame{}, false, false
+	}
+	if s.queuedStopSending {
+		s.queuedStopSending = false
+		return ackhandler.Frame{
+			Frame: &wire.StopSendingFrame{StreamID: s.streamID, ErrorCode: s.cancelErr.ErrorCode},
+		}, true, s.queuedMaxStreamData
+	}
+
+	s.queuedMaxStreamData = false
+	return ackhandler.Frame{
+		Frame: &wire.MaxStreamDataFrame{
+			StreamID:          s.streamID,
+			MaximumStreamData: s.flowController.GetWindowUpdate(now),
+		},
+	}, true, false
+}
+
+// SetReadDeadline sets the deadline for future [ReceiveStream.Read] calls and
+// any currently blocked call.
+// A zero value for t means [ReceiveStream.Read] will not time out.
+func (s *ReceiveStream) SetReadDeadline(t time.Time) error {
+	s.mutex.Lock()
+	s.deadline = monotime.FromTime(t)
+	s.mutex.Unlock()
+	s.signalRead()
+	return nil
+}
+
+// CloseForShutdown closes a stream abruptly.
+// It makes Read unblock (and return the error) immediately.
+// The peer will NOT be informed about this: the stream is closed without sending a FIN or RESET.
+func (s *ReceiveStream) closeForShutdown(err error) {
+	s.mutex.Lock()
+	s.closeForShutdownErr = err
+	s.receiveFinalSizeCallback = nil
+	s.mutex.Unlock()
+	s.signalRead()
+}
+
+// signalRead performs a non-blocking send on the readChan
+func (s *ReceiveStream) signalRead() {
+	select {
+	case s.readChan <- struct{}{}:
+	default:
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/receive_stream_test.go b/electron/native/private-transport/third_party/quic-go/receive_stream_test.go
new file mode 100644
index 000000000..eae4e025b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/receive_stream_test.go
@@ -0,0 +1,1140 @@
+package quic
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+type readerWithTimeout struct {
+	io.Reader
+	Timeout time.Duration
+}
+
+func (r *readerWithTimeout) Read(p []byte) (n int, err error) {
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		n, err = r.Reader.Read(p)
+	}()
+
+	select {
+	case <-done:
+		return n, err
+	case <-time.After(r.Timeout):
+		return 0, fmt.Errorf("read timeout after %s", r.Timeout)
+	}
+}
+
+type peeker interface {
+	Peek(b []byte) (int, error)
+}
+
+type peekerWithTimeout struct {
+	Peeker  peeker
+	Timeout time.Duration
+}
+
+func (p *peekerWithTimeout) Peek(b []byte) (n int, err error) {
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		n, err = p.Peeker.Peek(b)
+	}()
+
+	select {
+	case <-done:
+		return n, err
+	case <-time.After(p.Timeout):
+		return 0, fmt.Errorf("peek timeout after %s", p.Timeout)
+	}
+}
+
+func TestReceiveStreamReadData(t *testing.T) {
+	mockFC := newTestStreamFlowController(42)
+	str := newReceiveStream(42, nil, mockFC)
+
+	// read an entire frame
+	now := monotime.Now()
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte{0xde, 0xad, 0xbe, 0xef}}, now))
+	b := make([]byte, 4)
+	n, err := (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 4, n)
+	require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, b)
+
+	// split a frame across multiple reads
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Offset: 4, Data: []byte{0xca, 0xfe, 0xba, 0xbe}}, now))
+	b = make([]byte, 2)
+	n, err = (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+	require.Equal(t, []byte{0xca, 0xfe}, b)
+	n, err = (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+	require.Equal(t, []byte{0xba, 0xbe}, b)
+
+	// combine two frames
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Offset: 8, Data: []byte{'f', 'o', 'o'}}, now))
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Offset: 11, Data: []byte{'b', 'a', 'r'}}, now))
+	b = make([]byte, 6)
+	n, err = (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 6, n)
+	require.Equal(t, []byte{'f', 'o', 'o', 'b', 'a', 'r'}, b)
+
+	// reordered frames
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Offset: 17, Data: []byte{'b', 'a', 'z'}}, now))
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Offset: 14, Data: []byte{'f', 'o', 'o'}}, now))
+	b = make([]byte, 6)
+	n, err = (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 6, n)
+	require.Equal(t, []byte{'f', 'o', 'o', 'b', 'a', 'z'}, b)
+}
+
+func TestReceiveStreamPeekData(t *testing.T) {
+	mockFC := newTestStreamFlowController(42)
+	str := newReceiveStream(42, nil, mockFC)
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foo")}, monotime.Now()))
+	b := make([]byte, 2)
+	n, err := (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek(b)
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+	require.Equal(t, []byte("fo"), b)
+
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("bar"), Offset: 3}, monotime.Now()))
+	b = make([]byte, 6)
+	n, err = (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek(b)
+	require.NoError(t, err)
+	require.Equal(t, 6, n)
+	require.Equal(t, []byte("foobar"), b)
+
+	_, err = str.Read([]byte{0, 0})
+	require.NoError(t, err)
+
+	b = make([]byte, 2)
+	n, err = (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek(b)
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+	require.Equal(t, []byte("ob"), b)
+	b = make([]byte, 4)
+	n, err = (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek(b)
+	require.NoError(t, err)
+	require.Equal(t, 4, n)
+	require.Equal(t, []byte("obar"), b)
+}
+
+func TestReceiveStreamBlockRead(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowController(42)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newReceiveStream(42, mockSender, mockFC)
+
+		errChan := make(chan error, 1)
+		start := monotime.Now()
+		go func() {
+			frame := &wire.StreamFrame{Data: []byte{0xde, 0xad}}
+			time.Sleep(time.Hour)
+			errChan <- str.handleStreamFrame(frame, monotime.Now())
+		}()
+
+		n, err := (&readerWithTimeout{Reader: str, Timeout: 2 * time.Hour}).Read(make([]byte, 2))
+		require.NoError(t, err)
+		require.Equal(t, 2, n)
+		require.Equal(t, time.Hour, monotime.Since(start))
+		require.NoError(t, <-errChan)
+	})
+}
+
+func TestReceiveStreamBlockPeek(t *testing.T) {
+	t.Run("single STREAM frame", func(t *testing.T) {
+		testReceiveStreamBlockPeek(t, false)
+	})
+
+	t.Run("multiple STREAM frames", func(t *testing.T) {
+		testReceiveStreamBlockPeek(t, true)
+	})
+}
+
+func testReceiveStreamBlockPeek(t *testing.T, smallWrites bool) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowController(42)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newReceiveStream(42, mockSender, mockFC)
+
+		errChan := make(chan error, 2)
+		start := monotime.Now()
+		go func() {
+			if smallWrites {
+				time.Sleep(30 * time.Minute)
+				errChan <- str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foo")}, monotime.Now())
+				time.Sleep(30 * time.Minute)
+				errChan <- str.handleStreamFrame(&wire.StreamFrame{Offset: 3, Data: []byte("bar")}, monotime.Now())
+			} else {
+				time.Sleep(time.Hour)
+				errChan <- str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar")}, monotime.Now())
+			}
+		}()
+
+		b := make([]byte, 6)
+		n, err := (&peekerWithTimeout{Peeker: str, Timeout: 2 * time.Hour}).Peek(b)
+		require.NoError(t, err)
+		require.Equal(t, 6, n)
+		require.Equal(t, []byte("foobar"), b)
+		require.Equal(t, time.Hour, monotime.Since(start))
+		require.NoError(t, <-errChan)
+		if smallWrites {
+			require.NoError(t, <-errChan)
+		}
+	})
+}
+
+func TestReceiveStreamReadOverlappingData(t *testing.T) {
+	mockFC := newTestStreamFlowController(42)
+	str := newReceiveStream(42, nil, mockFC)
+
+	// receive the same frame multiple times
+	now := monotime.Now()
+	for range 3 {
+		require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte{0xde, 0xad, 0xbe, 0xef}}, now))
+	}
+	b := make([]byte, 4)
+	n, err := (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 4, n)
+	require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, b)
+
+	// receive overlapping data
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Offset: 4, Data: []byte("foob")}, now))
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Offset: 6, Data: []byte("obar")}, now))
+	b = make([]byte, 6)
+	n, err = (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 6, n)
+	require.Equal(t, []byte("foobar"), b)
+}
+
+func TestReceiveStreamFlowControlUpdates(t *testing.T) {
+	t.Run("stream", func(t *testing.T) {
+		testReceiveStreamFlowControlUpdates(t, true, false)
+	})
+
+	t.Run("connection", func(t *testing.T) {
+		testReceiveStreamFlowControlUpdates(t, false, true)
+	})
+}
+
+func testReceiveStreamFlowControlUpdates(t *testing.T, hasStreamWindowUpdate, hasConnWindowUpdate bool) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	streamReceiveWindow := protocol.MaxByteCount
+	connReceiveWindow := protocol.MaxByteCount
+	if hasStreamWindowUpdate {
+		streamReceiveWindow = 4
+	}
+	if hasConnWindowUpdate {
+		connReceiveWindow = 4
+	}
+	mockFC := newTestStreamFlowControllerWithWindows(42, 0, streamReceiveWindow, connReceiveWindow)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(streamID, mockSender, mockFC)
+
+	now := monotime.Now()
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte{0xde, 0xad, 0xbe, 0xef}}, now))
+
+	if hasStreamWindowUpdate {
+		mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+	}
+	if hasConnWindowUpdate {
+		mockSender.EXPECT().onHasConnectionData()
+	}
+	n, err := (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(make([]byte, 3))
+	require.NoError(t, err)
+	require.Equal(t, 3, n)
+	require.True(t, mockCtrl.Satisfied())
+
+	if hasStreamWindowUpdate {
+		now = now.Add(time.Second)
+		f, ok, hasMore := str.getControlFrame(now)
+		require.True(t, ok)
+		require.Equal(t, &wire.MaxStreamDataFrame{StreamID: streamID, MaximumStreamData: protocol.ByteCount(n) + streamReceiveWindow}, f.Frame)
+		require.False(t, hasMore)
+	}
+	if hasConnWindowUpdate {
+		_, ok, hasMore := str.getControlFrame(now)
+		require.False(t, ok)
+		require.False(t, hasMore)
+	}
+}
+
+func TestReceiveStreamDeadlineInThePast(t *testing.T) {
+	t.Run("read", func(t *testing.T) {
+		testReceiveStreamDeadlineInThePast(t, true, func(str *ReceiveStream, b []byte) (int, error) {
+			return str.Read(b)
+		})
+	})
+	t.Run("peek", func(t *testing.T) {
+		testReceiveStreamDeadlineInThePast(t, false, func(str *ReceiveStream, b []byte) (int, error) {
+			return str.Peek(b)
+		})
+	})
+}
+
+func testReceiveStreamDeadlineInThePast(t *testing.T, consumesBytes bool, op func(*ReceiveStream, []byte) (int, error)) {
+	mockFC := newTestStreamFlowController(42)
+	str := newReceiveStream(42, nil, mockFC)
+
+	// no data is read when the deadline is in the past
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar")}, monotime.Now()))
+	require.NoError(t, str.SetReadDeadline(time.Now().Add(-time.Second)))
+	b := make([]byte, 6)
+	n, err := op(str, b)
+	require.Error(t, err)
+	require.Zero(t, n)
+	require.ErrorIs(t, err, errDeadline)
+
+	// data is read when the deadline is in the future
+	require.NoError(t, str.SetReadDeadline(time.Now().Add(time.Second)))
+	n, err = op(str, b)
+	require.NoError(t, err)
+	require.Equal(t, 6, n)
+}
+
+func TestReceiveStreamDeadlineRemoval(t *testing.T) {
+	t.Run("read", func(t *testing.T) {
+		testReceiveStreamDeadlineRemoval(t, func(str *ReceiveStream) error {
+			_, err := str.Read([]byte{0})
+			return err
+		})
+	})
+	t.Run("peek", func(t *testing.T) {
+		testReceiveStreamDeadlineRemoval(t, func(str *ReceiveStream) error {
+			_, err := str.Peek([]byte{0})
+			return err
+		})
+	})
+}
+
+func testReceiveStreamDeadlineRemoval(t *testing.T, op func(*ReceiveStream) error) {
+	synctest.Test(t, func(t *testing.T) {
+		mockFC := newTestStreamFlowController(42)
+		str := newReceiveStream(42, nil, mockFC)
+
+		const deadline = time.Minute
+		require.NoError(t, str.SetReadDeadline(time.Now().Add(deadline)))
+		errChan := make(chan error, 1)
+		go func() {
+			errChan <- op(str)
+		}()
+		select {
+		case err := <-errChan:
+			t.Fatalf("should not have returned yet: %v", err)
+		case <-time.After(deadline / 2):
+		}
+
+		// remove the deadline after a while (but before it expires)
+		require.NoError(t, str.SetReadDeadline(time.Time{}))
+
+		// no deadline set: should not return at all
+		select {
+		case err := <-errChan:
+			t.Fatalf("should not have returned yet: %v", err)
+		case <-time.After(2 * deadline):
+		}
+
+		// now set the deadline to the past to make it return immediately
+		require.NoError(t, str.SetReadDeadline(time.Now().Add(-time.Second)))
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+		default:
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestReceiveStreamDeadlineExtension(t *testing.T) {
+	t.Run("read", func(t *testing.T) {
+		testReceiveStreamDeadlineExtension(t, func(str *ReceiveStream) error {
+			_, err := str.Read([]byte{0})
+			return err
+		})
+	})
+	t.Run("peek", func(t *testing.T) {
+		testReceiveStreamDeadlineExtension(t, func(str *ReceiveStream) error {
+			_, err := str.Peek([]byte{0})
+			return err
+		})
+	})
+}
+
+func testReceiveStreamDeadlineExtension(t *testing.T, op func(*ReceiveStream) error) {
+	synctest.Test(t, func(t *testing.T) {
+		mockFC := newTestStreamFlowController(42)
+		str := newReceiveStream(42, nil, mockFC)
+
+		start := monotime.Now()
+		deadline := 5 * time.Second
+		require.NoError(t, str.SetReadDeadline(time.Now().Add(deadline)))
+		errChan := make(chan error, 1)
+		go func() {
+			errChan <- op(str)
+		}()
+		select {
+		case err := <-errChan:
+			t.Fatalf("should not have returned yet: %v", err)
+		case <-time.After(deadline / 2):
+		}
+
+		// extend the deadline
+		require.NoError(t, str.SetReadDeadline(time.Now().Add(deadline)))
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+			require.Equal(t, start.Add(deadline*3/2), monotime.Now())
+		case <-time.After(deadline + time.Nanosecond):
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestReceiveStreamEOFWithData(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowController(42)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(42, mockSender, mockFC)
+
+	now := monotime.Now()
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Offset: 2, Data: []byte{0xbe, 0xef}, Fin: true}, now))
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte{0xde, 0xad}}, now))
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+
+	// peeking doesn't return an EOF
+	b := make([]byte, 4)
+	n, err := (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek(b)
+	require.NoError(t, err)
+	require.Equal(t, 4, n)
+	require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, b)
+
+	// peeking returns the EOF, if more data is being peeked
+	b = make([]byte, 6)
+	n, err = (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek(b)
+	require.ErrorIs(t, err, io.EOF)
+	require.Equal(t, 4, n)
+	require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, b[:n])
+
+	// reading returns the EOF
+	strWithTimeout := &readerWithTimeout{Reader: str, Timeout: time.Second}
+	b = make([]byte, 6)
+	n, err = strWithTimeout.Read(b)
+	require.ErrorIs(t, err, io.EOF)
+	require.Equal(t, 4, n)
+	require.Equal(t, []byte{0xde, 0xad, 0xbe, 0xef}, b[:n])
+	n, err = strWithTimeout.Read(b)
+	require.Zero(t, n)
+	require.ErrorIs(t, err, io.EOF)
+}
+
+func TestReceiveStreamPeekEOF(t *testing.T) {
+	t.Run("long peek", func(t *testing.T) {
+		testReceiveStreamPeekEOF(t, true)
+	})
+	t.Run("exact peek", func(t *testing.T) {
+		testReceiveStreamPeekEOF(t, false)
+	})
+}
+
+func testReceiveStreamPeekEOF(t *testing.T, longPeek bool) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowController(42)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newReceiveStream(42, mockSender, mockFC)
+
+		require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Offset: 3, Data: []byte("bar"), Fin: true}, monotime.Now()))
+
+		type result struct {
+			err  error
+			data []byte
+		}
+		resultChan := make(chan result, 1)
+		go func() {
+			b := make([]byte, 6)
+			if longPeek {
+				b = make([]byte, 8)
+			}
+			n, err := (&peekerWithTimeout{Peeker: str, Timeout: time.Hour}).Peek(b)
+			resultChan <- result{err: err, data: b[:n]}
+		}()
+
+		synctest.Wait()
+
+		select {
+		case result := <-resultChan:
+			t.Fatalf("peek should not have returned yet: %v", result.err)
+		default:
+		}
+
+		require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("f")}, monotime.Now()))
+
+		synctest.Wait()
+
+		select {
+		case result := <-resultChan:
+			t.Fatalf("peek should not have returned yet: %v", result.err)
+		default:
+		}
+
+		require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("oo"), Offset: 1}, monotime.Now()))
+
+		synctest.Wait()
+
+		select {
+		case result := <-resultChan:
+			if longPeek {
+				assert.ErrorIs(t, result.err, io.EOF)
+			} else {
+				assert.NoError(t, result.err)
+			}
+			require.Equal(t, []byte("foobar"), result.data)
+		default:
+			t.Fatal("peek should have returned")
+		}
+	})
+}
+
+func TestReceiveStreamImmediateFINs(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowController(42)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(42, mockSender, mockFC)
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Fin: true}, monotime.Now()))
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+
+	// peeking returns the EOF
+	n, err := (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek(make([]byte, 4))
+	require.ErrorIs(t, err, io.EOF)
+	require.Equal(t, 0, n)
+
+	// and so does reading
+	n, err = (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(make([]byte, 4))
+	require.Zero(t, n)
+	require.ErrorIs(t, err, io.EOF)
+}
+
+func TestReceiveStreamFinalSizeCallbackAfterFIN(t *testing.T) {
+	fc := newTestStreamFlowController(42)
+	str := newReceiveStream(42, nil, fc)
+
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar"), Fin: true}, monotime.Now()))
+
+	var size int64
+	str.SetReceiveFinalSizeCallback(func(s int64) { size = s })
+	require.EqualValues(t, 6, size)
+
+	str.closeForShutdown(assert.AnError)
+	str.SetReceiveFinalSizeCallback(func(s int64) { size = s })
+	require.EqualValues(t, 6, size)
+}
+
+func TestReceiveStreamFinalSizeCallbackAfterCancelRead(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	fc := newTestStreamFlowController(42)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(42, mockSender, fc)
+
+	var size int64
+	var called bool
+	str.SetReceiveFinalSizeCallback(func(s int64) {
+		size, called = s, true
+	})
+	require.False(t, called)
+
+	mockSender.EXPECT().onHasStreamControlFrame(str.StreamID(), str)
+	str.CancelRead(1234)
+	require.False(t, called)
+
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+	require.NoError(t, str.handleResetStreamFrame(
+		&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 4321, FinalSize: 42},
+		monotime.Now(),
+	))
+
+	require.True(t, called)
+	require.EqualValues(t, 42, size)
+}
+
+func TestReceiveStreamFinalSizeCallbackRemoved(t *testing.T) {
+	str := newReceiveStream(42, nil, newTestStreamFlowController(42))
+	str.SetReceiveFinalSizeCallback(func(int64) { t.Fatal("callback called") })
+	str.SetReceiveFinalSizeCallback(nil)
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Fin: true}, monotime.Now()))
+}
+
+func TestReceiveStreamCloseForShutdown(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowController(42)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newReceiveStream(42, mockSender, mockFC)
+		strWithTimeout := &readerWithTimeout{Reader: str, Timeout: time.Minute}
+
+		// Test immediate return of reads
+		readErrChan := make(chan error, 1)
+		peekErrChan := make(chan error, 1)
+		go func() {
+			_, err := strWithTimeout.Read([]byte{0})
+			readErrChan <- err
+		}()
+		go func() {
+			_, err := (&peekerWithTimeout{Peeker: str, Timeout: time.Minute}).Peek([]byte{0})
+			peekErrChan <- err
+		}()
+
+		synctest.Wait()
+
+		select {
+		case err := <-readErrChan:
+			t.Fatalf("read returned before closeForShutdown: %v", err)
+		case err := <-peekErrChan:
+			t.Fatalf("peek returned before closeForShutdown: %v", err)
+		default:
+		}
+
+		str.closeForShutdown(assert.AnError)
+		synctest.Wait()
+
+		require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Fin: true}, monotime.Now()))
+		str.SetReceiveFinalSizeCallback(func(int64) { t.Fatal("callback called") })
+
+		select {
+		case err := <-readErrChan:
+			require.ErrorIs(t, err, assert.AnError)
+		default:
+			t.Fatal("read should have returned")
+		}
+		select {
+		case err := <-peekErrChan:
+			require.ErrorIs(t, err, assert.AnError)
+		default:
+			t.Fatal("peek should have returned")
+		}
+
+		// following calls to Peek should return the error
+		n, err := (&peekerWithTimeout{Peeker: str, Timeout: time.Minute}).Peek([]byte{0})
+		require.Zero(t, n)
+		require.ErrorIs(t, err, assert.AnError)
+
+		// following calls to Read should return the error
+		n, err = strWithTimeout.Read([]byte{0})
+		require.Zero(t, n)
+		require.ErrorIs(t, err, assert.AnError)
+
+		// receiving a RESET_STREAM frame after closeForShutdown does nothing
+		require.NoError(t, str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1234, FinalSize: 42}, monotime.Now()))
+		n, err = strWithTimeout.Read([]byte{0})
+		require.Zero(t, n)
+		require.ErrorIs(t, err, assert.AnError)
+
+		// calling CancelRead after closeForShutdown does nothing
+		str.CancelRead(1234)
+		n, err = strWithTimeout.Read([]byte{0})
+		require.Zero(t, n)
+		require.ErrorIs(t, err, assert.AnError)
+	})
+}
+
+func TestReceiveStreamCancellation(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowController(42)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newReceiveStream(42, mockSender, mockFC)
+		strWithTimeout := &readerWithTimeout{Reader: str, Timeout: 2 * time.Second}
+
+		mockSender.EXPECT().onHasStreamControlFrame(str.StreamID(), gomock.Any())
+		readErrChan := make(chan error, 1)
+		peekErrChan := make(chan error, 1)
+		go func() {
+			_, err := strWithTimeout.Read([]byte{0})
+			readErrChan <- err
+		}()
+		go func() {
+			_, err := (&peekerWithTimeout{Peeker: str, Timeout: 2 * time.Second}).Peek([]byte{0})
+			peekErrChan <- err
+		}()
+
+		synctest.Wait()
+
+		str.CancelRead(1234)
+		// this queues a STOP_SENDING frame
+		f, ok, hasMore := str.getControlFrame(monotime.Now())
+		require.True(t, ok)
+		require.Equal(t, &wire.StopSendingFrame{StreamID: 42, ErrorCode: 1234}, f.Frame)
+		require.False(t, hasMore)
+		require.True(t, mockCtrl.Satisfied())
+
+		synctest.Wait()
+
+		select {
+		case err := <-readErrChan:
+			require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: false})
+		default:
+			t.Fatal("Read was not unblocked")
+		}
+		select {
+		case err := <-peekErrChan:
+			require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: false})
+		default:
+			t.Fatal("Peek was not unblocked")
+		}
+
+		// further calls to Peek return the error
+		n, err := (&peekerWithTimeout{Peeker: str, Timeout: 2 * time.Second}).Peek([]byte{0})
+		require.Zero(t, n)
+		require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: false})
+
+		// further Read calls return the error
+		n, err = strWithTimeout.Read([]byte{0})
+		require.Zero(t, n)
+		require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: false})
+
+		// calling CancelRead again does nothing
+		// especially:
+		// 1. no more calls to onHasStreamControlFrame
+		// 2. no changes of the error code returned by Read
+		str.CancelRead(1234)
+		str.CancelRead(4321)
+		n, err = strWithTimeout.Read([]byte{0})
+		require.Zero(t, n)
+		// error code unchanged
+		require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: false})
+		require.True(t, mockCtrl.Satisfied())
+
+		// receiving the FIN bit has no effect
+		mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+		// receive two of them, to make sure onStreamCompleted is not called twice
+		require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar"), Fin: true}, monotime.Now()))
+		require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar"), Fin: true}, monotime.Now()))
+		require.True(t, mockCtrl.Satisfied())
+
+		// receiving a RESET_STREAM frame after CancelRead has no effect
+		require.NoError(t, str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 4321, FinalSize: 6}, monotime.Now()))
+		n, err = strWithTimeout.Read([]byte{0})
+		require.Zero(t, n)
+		require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: false})
+	})
+}
+
+func TestReceiveStreamCancelReadAbandonsUnreadData(t *testing.T) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	connFC := newConnectionFlowController(6, protocol.MaxByteCount, nil, utils.NewRTTStats(), utils.DefaultLogger)
+	fc := newStreamFlowController(
+		streamID,
+		connFC,
+		protocol.MaxByteCount,
+		protocol.MaxByteCount,
+		0,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(streamID, mockSender, fc)
+
+	now := monotime.Now()
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar"), Fin: true}, now))
+	require.Zero(t, connFC.GetWindowUpdate(now))
+
+	mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+	mockSender.EXPECT().onStreamCompleted(streamID)
+	str.CancelRead(1337)
+	require.True(t, mockCtrl.Satisfied())
+
+	// CancelRead completes the receive side once the final offset is known.
+	// Completion abandons the unread stream data, which returns connection-level
+	// flow-control credit and makes a connection window update available.
+	require.NotZero(t, connFC.GetWindowUpdate(now))
+}
+
+func TestReceiveStreamCancelReadAfterFIN(t *testing.T) {
+	t.Run("FIN not read", func(t *testing.T) {
+		testReceiveStreamCancelReadAfterFIN(t, false)
+	})
+	t.Run("FIN read", func(t *testing.T) {
+		testReceiveStreamCancelReadAfterFIN(t, true)
+	})
+}
+
+func testReceiveStreamCancelReadAfterFIN(t *testing.T, finRead bool) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowController(42)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(42, mockSender, mockFC)
+
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar"), Fin: true}, monotime.Now()))
+	if finRead {
+		n, err := str.Read(make([]byte, 10))
+		require.ErrorIs(t, err, io.EOF)
+		require.Equal(t, 6, n)
+	}
+
+	// if the FIN was received, but not read yet, a STOP_SENDING frame is queued
+	if !finRead {
+		mockSender.EXPECT().onHasStreamControlFrame(str.StreamID(), str)
+	}
+	str.CancelRead(1337)
+	f, ok, hasMore := str.getControlFrame(monotime.Now())
+	// if the EOF was already read, no STOP_SENDING frame is queued
+	if finRead {
+		require.False(t, ok)
+		require.False(t, hasMore)
+	} else {
+		require.True(t, ok)
+		require.Equal(t, &wire.StopSendingFrame{StreamID: 42, ErrorCode: 1337}, f.Frame)
+		require.False(t, hasMore)
+	}
+
+	// Read returns the error...
+	n, err := str.Read([]byte{0})
+	require.Zero(t, n)
+	// ... and Peek returns the same error
+	n, peekErr := (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek([]byte{0})
+	require.Zero(t, n)
+	if finRead {
+		assert.ErrorIs(t, err, io.EOF)
+		assert.ErrorIs(t, peekErr, io.EOF)
+	} else {
+		assert.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1337, Remote: false})
+		assert.ErrorIs(t, peekErr, &StreamError{StreamID: 42, ErrorCode: 1337, Remote: false})
+	}
+}
+
+func TestReceiveStreamResetAbandonsUnreadData(t *testing.T) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	connFC := newConnectionFlowController(6, protocol.MaxByteCount, nil, utils.NewRTTStats(), utils.DefaultLogger)
+	fc := newStreamFlowController(
+		streamID,
+		connFC,
+		protocol.MaxByteCount,
+		protocol.MaxByteCount,
+		0,
+		utils.NewRTTStats(),
+		utils.DefaultLogger,
+	)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(streamID, mockSender, fc)
+
+	now := monotime.Now()
+	require.Zero(t, connFC.GetWindowUpdate(now))
+	require.NoError(t, str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: streamID, ErrorCode: 1234, FinalSize: 6}, now))
+
+	// A RESET_STREAM with no reliable data abandons the unread final size.
+	// That returns connection-level flow-control credit and makes a connection
+	// window update available.
+	require.NotZero(t, connFC.GetWindowUpdate(now))
+}
+
+func TestReceiveStreamReset(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowController(42)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newReceiveStream(42, mockSender, mockFC)
+		strWithTimeout := &readerWithTimeout{Reader: str, Timeout: 2 * time.Second}
+
+		readErrChan := make(chan error, 1)
+		peekErrChan := make(chan error, 1)
+		go func() {
+			_, err := strWithTimeout.Read([]byte{0})
+			readErrChan <- err
+		}()
+		go func() {
+			_, err := (&peekerWithTimeout{Peeker: str, Timeout: 2 * time.Second}).Peek([]byte{0})
+			peekErrChan <- err
+		}()
+
+		synctest.Wait()
+
+		mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+		require.NoError(t, str.handleResetStreamFrame(
+			&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1234, FinalSize: 42},
+			monotime.Now(),
+		))
+
+		synctest.Wait()
+
+		select {
+		case err := <-readErrChan:
+			require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: true})
+		default:
+			t.Fatal("Read was not unblocked")
+		}
+		select {
+		case err := <-peekErrChan:
+			require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: true})
+		default:
+			t.Fatal("Peek was not unblocked")
+		}
+
+		// further calls to Peek return the error
+		n, err := (&peekerWithTimeout{Peeker: str, Timeout: 2 * time.Second}).Peek([]byte{0})
+		require.Zero(t, n)
+		require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: true})
+
+		// further calls to Read return the error
+		_, err = strWithTimeout.Read([]byte{0})
+		require.Equal(t, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: true}, err)
+
+		// further RESET_STREAM frames have no effect
+		require.NoError(t, str.handleResetStreamFrame(
+			&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 4321, FinalSize: 42},
+			monotime.Now(),
+		))
+
+		n, err = str.Read([]byte{0})
+		require.Zero(t, n)
+		// error code unchanged
+		require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: true})
+
+		// CancelRead after a RESET_STREAM frame has no effect
+		str.CancelRead(100)
+		n, err = str.Read([]byte{0})
+		require.Zero(t, n)
+		// error code and remote flag unchanged
+		require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1234, Remote: true})
+	})
+}
+
+func TestReceiveStreamResetAfterFINRead(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowController(42)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(42, mockSender, mockFC)
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+	require.NoError(t, str.handleStreamFrame(
+		&wire.StreamFrame{StreamID: 42, Data: []byte("foobar"), Fin: true},
+		monotime.Now(),
+	))
+	n, err := str.Read(make([]byte, 6))
+	require.Equal(t, 6, n)
+	require.ErrorIs(t, err, io.EOF)
+	// make sure that onStreamCompleted was called due to the EOF
+	require.True(t, mockCtrl.Satisfied())
+
+	// Now receive a RESET_STREAM frame.
+	// We don't expect any more calls to onStreamCompleted.
+	require.NoError(t, str.handleResetStreamFrame(
+		&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1234, FinalSize: 6},
+		monotime.Now(),
+	))
+	// now read the error
+	n, err = str.Read([]byte{0})
+	require.Error(t, err)
+	require.Zero(t, n)
+}
+
+// Calling Read concurrently doesn't make any sense (and is forbidden),
+// but we still want to make sure that we don't complete the stream more than once
+// if the user misuses our API.
+// This would lead to an INTERNAL_ERROR ("tried to delete unknown outgoing stream"),
+// which can be hard to debug.
+// Note that even without the protection built into the receiveStream, this test
+// is very timing-dependent, and would need to run a few hundred times to trigger the failure.
+func TestReceiveStreamConcurrentReads(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowController(42)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newReceiveStream(42, mockSender, mockFC)
+
+		var numCompleted atomic.Int32
+		mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42)).Do(func(protocol.StreamID) {
+			numCompleted.Add(1)
+		}).AnyTimes()
+
+		const num = 3
+		resultChan := make(chan struct {
+			n   int
+			err error
+		}, num)
+		for range num {
+			go func() {
+				n, err := str.Read(make([]byte, 8))
+				resultChan <- struct {
+					n   int
+					err error
+				}{n: n, err: err}
+			}()
+		}
+		require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar"), Fin: true}, monotime.Now()))
+		synctest.Wait()
+
+		var bytesRead int
+		for range num {
+			select {
+			case res := <-resultChan:
+				bytesRead += res.n
+				require.ErrorIs(t, res.err, io.EOF)
+			default:
+				t.Fatal("read should have returned")
+			}
+		}
+		require.Equal(t, 6, bytesRead)
+		require.Equal(t, int32(1), numCompleted.Load())
+	})
+}
+
+func TestReceiveStreamResetStreamAtBeforeReadOffset(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowController(42)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(42, mockSender, mockFC)
+
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar")}, monotime.Now()))
+	b := make([]byte, 3)
+	n, err := str.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 3, n)
+	require.Equal(t, []byte("foo"), b)
+
+	str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1337, FinalSize: 10, ReliableSize: 3}, monotime.Now())
+	require.True(t, mockCtrl.Satisfied())
+
+	// Peek returns the error
+	n, err = str.Peek([]byte{0})
+	require.Zero(t, n)
+	require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1337, Remote: true})
+
+	// Read returns the error
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+	n, err = str.Read([]byte{0})
+	require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1337, Remote: true})
+	require.Zero(t, n)
+}
+
+func TestReceiveStreamResetStreamAtAfterReadOffset(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowController(42)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(42, mockSender, mockFC)
+
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar")}, monotime.Now()))
+	b := make([]byte, 2)
+	n, err := str.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+	require.Equal(t, []byte("fo"), b)
+
+	str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1337, FinalSize: 10, ReliableSize: 6}, monotime.Now())
+	require.True(t, mockCtrl.Satisfied())
+
+	// Peek returns no error when peeking up to the reliable size...
+	b = make([]byte, 4)
+	n, err = (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek(b)
+	require.NoError(t, err)
+	require.Equal(t, 4, n)
+	require.Equal(t, []byte("obar"), b)
+
+	// ... but returns the error when peeking beyond the reliable size
+	b = make([]byte, 5)
+	n, err = (&peekerWithTimeout{Peeker: str, Timeout: time.Second}).Peek(b)
+	require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1337, Remote: true})
+	require.Equal(t, 4, n)
+	require.Equal(t, []byte("obar"), b[:n])
+
+	// Read returns the error after reading up to the reliable size
+	b = make([]byte, 2)
+	n, err = str.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+	require.Equal(t, []byte("ob"), b)
+	require.True(t, mockCtrl.Satisfied())
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+	n, err = str.Read(b)
+	require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1337, Remote: true})
+	require.Equal(t, 2, n)
+	require.Equal(t, []byte("ar"), b)
+}
+
+func TestReceiveStreamMultipleResetStreamAt(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowController(42)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(42, mockSender, mockFC)
+
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar")}, monotime.Now()))
+
+	b := make([]byte, 3)
+	n, err := str.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 3, n)
+	require.Equal(t, []byte("foo"), b)
+	require.True(t, mockCtrl.Satisfied())
+
+	str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1337, FinalSize: 10, ReliableSize: 6}, monotime.Now())
+	require.True(t, mockCtrl.Satisfied())
+
+	// receiving a reordered RESET_STREAM_AT frame has no effect
+	str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1337, FinalSize: 10, ReliableSize: 8}, monotime.Now())
+	require.True(t, mockCtrl.Satisfied())
+
+	// receiving a RESET_STREAM_AT frame with a smaller reliable size is valid
+	str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1337, FinalSize: 10, ReliableSize: 3}, monotime.Now())
+
+	// Read returns the error
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+	n, err = str.Read(b)
+	require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1337, Remote: true})
+	require.Zero(t, n)
+}
+
+func TestReceiveStreamResetStreamAtAfterResetStream(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowController(42)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newReceiveStream(42, mockSender, mockFC)
+
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar")}, monotime.Now()))
+
+	b := make([]byte, 3)
+	n, err := str.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, 3, n)
+	require.Equal(t, []byte("foo"), b)
+	require.True(t, mockCtrl.Satisfied())
+
+	str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1337, FinalSize: 10}, monotime.Now())
+	require.True(t, mockCtrl.Satisfied())
+
+	// receiving a reordered RESET_STREAM_AT frame has no effect
+	str.handleResetStreamFrame(&wire.ResetStreamFrame{StreamID: 42, ErrorCode: 1337, FinalSize: 10, ReliableSize: 8}, monotime.Now())
+	require.True(t, mockCtrl.Satisfied())
+
+	// Read returns the error
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(42))
+	n, err = str.Read(b)
+	require.ErrorIs(t, err, &StreamError{StreamID: 42, ErrorCode: 1337, Remote: true})
+	require.Zero(t, n)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/retransmission_queue.go b/electron/native/private-transport/third_party/quic-go/retransmission_queue.go
new file mode 100644
index 000000000..323af5b0c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/retransmission_queue.go
@@ -0,0 +1,158 @@
+package quic
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type framesToRetransmit struct {
+	crypto []*wire.CryptoFrame
+	other  []wire.Frame
+}
+
+type retransmissionQueue struct {
+	initial   *framesToRetransmit
+	handshake *framesToRetransmit
+	appData   framesToRetransmit
+}
+
+func newRetransmissionQueue() *retransmissionQueue {
+	return &retransmissionQueue{
+		initial:   &framesToRetransmit{},
+		handshake: &framesToRetransmit{},
+	}
+}
+
+func (q *retransmissionQueue) addInitial(f wire.Frame) {
+	if q.initial == nil {
+		return
+	}
+	if cf, ok := f.(*wire.CryptoFrame); ok {
+		q.initial.crypto = append(q.initial.crypto, cf)
+		return
+	}
+	q.initial.other = append(q.initial.other, f)
+}
+
+func (q *retransmissionQueue) addHandshake(f wire.Frame) {
+	if q.handshake == nil {
+		return
+	}
+	if cf, ok := f.(*wire.CryptoFrame); ok {
+		q.handshake.crypto = append(q.handshake.crypto, cf)
+		return
+	}
+	q.handshake.other = append(q.handshake.other, f)
+}
+
+func (q *retransmissionQueue) addAppData(f wire.Frame) {
+	switch f := f.(type) {
+	case *wire.StreamFrame:
+		panic("STREAM frames are handled with their respective streams.")
+	case *wire.CryptoFrame:
+		q.appData.crypto = append(q.appData.crypto, f)
+	default:
+		q.appData.other = append(q.appData.other, f)
+	}
+}
+
+func (q *retransmissionQueue) HasData(encLevel protocol.EncryptionLevel) bool {
+	//nolint:exhaustive // 0-RTT data is retransmitted in 1-RTT packets.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return q.initial != nil &&
+			(len(q.initial.crypto) > 0 || len(q.initial.other) > 0)
+	case protocol.EncryptionHandshake:
+		return q.handshake != nil &&
+			(len(q.handshake.crypto) > 0 || len(q.handshake.other) > 0)
+	case protocol.Encryption1RTT:
+		return len(q.appData.crypto) > 0 || len(q.appData.other) > 0
+	}
+	return false
+}
+
+func (q *retransmissionQueue) GetFrame(encLevel protocol.EncryptionLevel, maxLen protocol.ByteCount, v protocol.Version) wire.Frame {
+	var r *framesToRetransmit
+	//nolint:exhaustive // 0-RTT data is retransmitted in 1-RTT packets.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		r = q.initial
+	case protocol.EncryptionHandshake:
+		r = q.handshake
+	case protocol.Encryption1RTT:
+		r = &q.appData
+	}
+	if r == nil {
+		return nil
+	}
+
+	if len(r.crypto) > 0 {
+		f := r.crypto[0]
+		newFrame, needsSplit := f.MaybeSplitOffFrame(maxLen, v)
+		if newFrame == nil && !needsSplit { // the whole frame fits
+			r.crypto = r.crypto[1:]
+			return f
+		}
+		if newFrame != nil { // frame was split. Leave the original frame in the queue.
+			return newFrame
+		}
+	}
+	if len(r.other) == 0 {
+		return nil
+	}
+	f := r.other[0]
+	if f.Length(v) > maxLen {
+		return nil
+	}
+	r.other = r.other[1:]
+	return f
+}
+
+func (q *retransmissionQueue) DropPackets(encLevel protocol.EncryptionLevel) {
+	//nolint:exhaustive // Can only drop Initial and Handshake packet number space.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		q.initial = nil
+	case protocol.EncryptionHandshake:
+		q.handshake = nil
+	default:
+		panic(fmt.Sprintf("unexpected encryption level: %s", encLevel))
+	}
+}
+
+func (q *retransmissionQueue) AckHandler(encLevel protocol.EncryptionLevel) ackhandler.FrameHandler {
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		return (*retransmissionQueueInitialAckHandler)(q)
+	case protocol.EncryptionHandshake:
+		return (*retransmissionQueueHandshakeAckHandler)(q)
+	case protocol.Encryption0RTT, protocol.Encryption1RTT:
+		return (*retransmissionQueueAppDataAckHandler)(q)
+	}
+	return nil
+}
+
+type retransmissionQueueInitialAckHandler retransmissionQueue
+
+func (q *retransmissionQueueInitialAckHandler) OnAcked(wire.Frame) {}
+func (q *retransmissionQueueInitialAckHandler) OnLost(f wire.Frame) {
+	(*retransmissionQueue)(q).addInitial(f)
+}
+
+type retransmissionQueueHandshakeAckHandler retransmissionQueue
+
+func (q *retransmissionQueueHandshakeAckHandler) OnAcked(wire.Frame) {}
+func (q *retransmissionQueueHandshakeAckHandler) OnLost(f wire.Frame) {
+	(*retransmissionQueue)(q).addHandshake(f)
+}
+
+type retransmissionQueueAppDataAckHandler retransmissionQueue
+
+func (q *retransmissionQueueAppDataAckHandler) OnAcked(wire.Frame) {}
+func (q *retransmissionQueueAppDataAckHandler) OnLost(f wire.Frame) {
+	(*retransmissionQueue)(q).addAppData(f)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/retransmission_queue_test.go b/electron/native/private-transport/third_party/quic-go/retransmission_queue_test.go
new file mode 100644
index 000000000..0dd12a3f3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/retransmission_queue_test.go
@@ -0,0 +1,131 @@
+package quic
+
+import (
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRetransmissionQueueFrames(t *testing.T) {
+	t.Run("Initial", func(t *testing.T) {
+		testRetransmissionQueueFrames(t, protocol.EncryptionInitial)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testRetransmissionQueueFrames(t, protocol.EncryptionHandshake)
+	})
+	t.Run("1-RTT", func(t *testing.T) {
+		testRetransmissionQueueFrames(t, protocol.Encryption1RTT)
+	})
+}
+
+func testRetransmissionQueueFrames(t *testing.T, encLevel protocol.EncryptionLevel) {
+	q := newRetransmissionQueue()
+
+	require.False(t, q.HasData(encLevel))
+	require.Nil(t, q.GetFrame(encLevel, protocol.MaxByteCount, protocol.Version1))
+
+	ah := q.AckHandler(encLevel)
+	require.NotNil(t, ah)
+	ah.OnLost(&wire.PingFrame{})
+	require.True(t, q.HasData(encLevel))
+	require.Equal(t, &wire.PingFrame{}, q.GetFrame(encLevel, protocol.MaxByteCount, protocol.Version1))
+	require.False(t, q.HasData(encLevel))
+	require.Nil(t, q.GetFrame(encLevel, protocol.MaxByteCount, protocol.Version1))
+
+	f := &wire.PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}}
+	ah.OnLost(f)
+	require.True(t, q.HasData(encLevel))
+	require.Nil(t, q.GetFrame(encLevel, f.Length(protocol.Version1)-1, protocol.Version1))
+	require.Equal(t, f, q.GetFrame(encLevel, f.Length(protocol.Version1), protocol.Version1))
+	require.False(t, q.HasData(encLevel))
+
+	if encLevel == protocol.Encryption1RTT {
+		require.Panics(t, func() { ah.OnLost(&wire.StreamFrame{}) })
+	}
+}
+
+func TestRetransmissionQueueCryptoFrames(t *testing.T) {
+	t.Run("Initial", func(t *testing.T) {
+		testRetransmissionQueueCryptoFrames(t, protocol.EncryptionInitial)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testRetransmissionQueueCryptoFrames(t, protocol.EncryptionHandshake)
+	})
+	t.Run("1-RTT", func(t *testing.T) {
+		testRetransmissionQueueCryptoFrames(t, protocol.Encryption1RTT)
+	})
+}
+
+func testRetransmissionQueueCryptoFrames(t *testing.T, encLevel protocol.EncryptionLevel) {
+	q := newRetransmissionQueue()
+
+	var otherEncLevel protocol.EncryptionLevel
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		otherEncLevel = protocol.EncryptionHandshake
+	case protocol.EncryptionHandshake:
+		otherEncLevel = protocol.Encryption1RTT
+	case protocol.Encryption1RTT:
+		otherEncLevel = protocol.EncryptionInitial
+	}
+
+	ah := q.AckHandler(encLevel)
+	require.NotNil(t, ah)
+	ah.OnLost(&wire.CryptoFrame{Data: []byte("foobar")})
+	require.True(t, q.HasData(encLevel))
+	require.False(t, q.HasData(otherEncLevel))
+	require.Equal(t, &wire.CryptoFrame{Data: []byte("foobar")}, q.GetFrame(encLevel, protocol.MaxByteCount, protocol.Version1))
+	require.False(t, q.HasData(encLevel))
+	require.Nil(t, q.GetFrame(encLevel, protocol.MaxByteCount, protocol.Version1))
+
+	f := &wire.CryptoFrame{Offset: 100, Data: []byte("foobar")}
+	ah.OnLost(f)
+	ah.OnLost(&wire.PingFrame{})
+	require.True(t, q.HasData(encLevel))
+	require.False(t, q.HasData(otherEncLevel))
+	// the CRYPTO frame wouldn't fit, not even if it was split
+	require.IsType(t, &wire.PingFrame{}, q.GetFrame(encLevel, 2, protocol.Version1))
+
+	f1 := q.GetFrame(encLevel, f.Length(protocol.Version1)-3, protocol.Version1)
+	require.NotNil(t, f1)
+	require.IsType(t, &wire.CryptoFrame{}, f1)
+	require.Equal(t, &wire.CryptoFrame{Offset: 100, Data: []byte("foo")}, f1)
+	f2 := q.GetFrame(encLevel, protocol.MaxByteCount, protocol.Version1)
+	require.NotNil(t, f2)
+	require.IsType(t, &wire.CryptoFrame{}, f2)
+	require.Equal(t, &wire.CryptoFrame{Offset: 103, Data: []byte("bar")}, f2)
+}
+
+func TestRetransmissionQueueDropEncLevel(t *testing.T) {
+	q := newRetransmissionQueue()
+	require.Panics(t, func() { q.DropPackets(protocol.Encryption0RTT) })
+	require.Panics(t, func() { q.DropPackets(protocol.Encryption1RTT) })
+
+	t.Run("Initial", func(t *testing.T) {
+		testRetransmissionQueueDropEncLevel(t, protocol.EncryptionInitial)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testRetransmissionQueueDropEncLevel(t, protocol.EncryptionHandshake)
+	})
+}
+
+func testRetransmissionQueueDropEncLevel(t *testing.T, encLevel protocol.EncryptionLevel) {
+	q := newRetransmissionQueue()
+
+	ah := q.AckHandler(encLevel)
+	require.NotNil(t, ah)
+	ah.OnLost(&wire.PingFrame{})
+	ah.OnLost(&wire.CryptoFrame{Data: []byte("foobar")})
+	require.True(t, q.HasData(encLevel))
+	q.DropPackets(encLevel)
+	require.False(t, q.HasData(encLevel))
+	require.Nil(t, q.GetFrame(encLevel, protocol.MaxByteCount, protocol.Version1))
+
+	// losing more frame is a no-op
+	ah.OnLost(&wire.CryptoFrame{Data: []byte("foobar")})
+	ah.OnLost(&wire.PingFrame{})
+	require.False(t, q.HasData(encLevel))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/send_conn.go b/electron/native/private-transport/third_party/quic-go/send_conn.go
new file mode 100644
index 000000000..4cbffc71b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/send_conn.go
@@ -0,0 +1,124 @@
+package quic
+
+import (
+	"net"
+	"sync/atomic"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+// A sendConn allows sending using a simple Write() on a non-connected packet conn.
+type sendConn interface {
+	Write(b []byte, gsoSize uint16, ecn protocol.ECN) error
+	WriteTo([]byte, net.Addr, packetInfo) error
+	Close() error
+	LocalAddr() net.Addr
+	RemoteAddr() net.Addr
+	ChangeRemoteAddr(addr net.Addr, info packetInfo)
+
+	capabilities() connCapabilities
+}
+
+type remoteAddrInfo struct {
+	addr net.Addr
+	oob  []byte
+}
+
+type sconn struct {
+	rawConn
+
+	localAddr net.Addr
+
+	remoteAddrInfo atomic.Pointer[remoteAddrInfo]
+
+	logger utils.Logger
+
+	// If GSO enabled, and we receive a GSO error for this remote address, GSO is disabled.
+	gotGSOError bool
+	// Used to catch the error sometimes returned by the first sendmsg call on Linux,
+	// see https://github.com/golang/go/issues/63322.
+	wroteFirstPacket bool
+}
+
+var _ sendConn = &sconn{}
+
+func newSendConn(c rawConn, remote net.Addr, info packetInfo, logger utils.Logger) *sconn {
+	localAddr := c.LocalAddr()
+	if info.addr.IsValid() {
+		if udpAddr, ok := localAddr.(*net.UDPAddr); ok {
+			addrCopy := *udpAddr
+			addrCopy.IP = info.addr.AsSlice()
+			localAddr = &addrCopy
+		}
+	}
+
+	oob := info.OOB()
+	// increase oob slice capacity, so we can add the UDP_SEGMENT and ECN control messages without allocating
+	l := len(oob)
+	oob = append(oob, make([]byte, 64)...)[:l]
+	sc := &sconn{
+		rawConn:   c,
+		localAddr: localAddr,
+		logger:    logger,
+	}
+	sc.remoteAddrInfo.Store(&remoteAddrInfo{
+		addr: remote,
+		oob:  oob,
+	})
+	return sc
+}
+
+func (c *sconn) Write(p []byte, gsoSize uint16, ecn protocol.ECN) error {
+	ai := c.remoteAddrInfo.Load()
+	err := c.writePacket(p, ai.addr, ai.oob, gsoSize, ecn)
+	if err != nil && isGSOError(err) {
+		// disable GSO for future calls
+		c.gotGSOError = true
+		if c.logger.Debug() {
+			c.logger.Debugf("GSO failed when sending to %s", ai.addr)
+		}
+		// send out the packets one by one
+		for len(p) > 0 {
+			l := min(len(p), int(gsoSize))
+			if err := c.writePacket(p[:l], ai.addr, ai.oob, 0, ecn); err != nil {
+				return err
+			}
+			p = p[l:]
+		}
+		return nil
+	}
+	return err
+}
+
+func (c *sconn) writePacket(p []byte, addr net.Addr, oob []byte, gsoSize uint16, ecn protocol.ECN) error {
+	_, err := c.WritePacket(p, addr, oob, gsoSize, ecn)
+	if err != nil && !c.wroteFirstPacket && isPermissionError(err) {
+		_, err = c.WritePacket(p, addr, oob, gsoSize, ecn)
+	}
+	c.wroteFirstPacket = true
+	return err
+}
+
+func (c *sconn) WriteTo(b []byte, addr net.Addr, info packetInfo) error {
+	_, err := c.WritePacket(b, addr, info.OOB(), 0, protocol.ECNUnsupported)
+	return err
+}
+
+func (c *sconn) capabilities() connCapabilities {
+	capabilities := c.rawConn.capabilities()
+	if capabilities.GSO {
+		capabilities.GSO = !c.gotGSOError
+	}
+	return capabilities
+}
+
+func (c *sconn) ChangeRemoteAddr(addr net.Addr, info packetInfo) {
+	c.remoteAddrInfo.Store(&remoteAddrInfo{
+		addr: addr,
+		oob:  info.OOB(),
+	})
+}
+
+func (c *sconn) RemoteAddr() net.Addr { return c.remoteAddrInfo.Load().addr }
+func (c *sconn) LocalAddr() net.Addr  { return c.localAddr }
diff --git a/electron/native/private-transport/third_party/quic-go/send_conn_test.go b/electron/native/private-transport/third_party/quic-go/send_conn_test.go
new file mode 100644
index 000000000..ab686f3b0
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/send_conn_test.go
@@ -0,0 +1,135 @@
+package quic
+
+import (
+	"net"
+	"net/netip"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+// Only if appendUDPSegmentSizeMsg actually appends a message (and isn't only a stub implementation),
+// GSO is actually supported on this platform.
+var platformSupportsGSO = len(appendUDPSegmentSizeMsg([]byte{}, 1337)) > 0
+
+func TestSendConnLocalAndRemoteAddress(t *testing.T) {
+	remoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 100, 200), Port: 1337}
+	rawConn := NewMockRawConn(gomock.NewController(t))
+	rawConn.EXPECT().LocalAddr().Return(&net.UDPAddr{IP: net.IPv4(10, 11, 12, 13), Port: 14}).Times(2)
+	c := newSendConn(
+		rawConn,
+		remoteAddr,
+		packetInfo{addr: netip.AddrFrom4([4]byte{127, 0, 0, 42})},
+		utils.DefaultLogger,
+	)
+	require.Equal(t, "127.0.0.42:14", c.LocalAddr().String())
+	require.Equal(t, remoteAddr, c.RemoteAddr())
+
+	// the local raw conn's local address is only used if we don't an address from the packet info
+	c = newSendConn(rawConn, remoteAddr, packetInfo{}, utils.DefaultLogger)
+	require.Equal(t, "10.11.12.13:14", c.LocalAddr().String())
+}
+
+func TestSendConnOOB(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("we don't OOB conn on windows, and no packet info will be available")
+	}
+
+	remoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 100, 200), Port: 1337}
+	rawConn := NewMockRawConn(gomock.NewController(t))
+	rawConn.EXPECT().LocalAddr()
+	rawConn.EXPECT().capabilities().AnyTimes()
+	pi := packetInfo{addr: netip.IPv6Loopback()}
+	rawConn.EXPECT().WritePacket([]byte("foobar"), remoteAddr, pi.OOB(), uint16(0), protocol.ECT1)
+	require.NotEmpty(t, pi.OOB())
+	c := newSendConn(rawConn, remoteAddr, pi, utils.DefaultLogger)
+	require.NoError(t, c.Write([]byte("foobar"), 0, protocol.ECT1))
+}
+
+func TestSendConnDetectGSOFailure(t *testing.T) {
+	if !platformSupportsGSO {
+		t.Skip("GSO is not supported on this platform")
+	}
+
+	remoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 100, 200), Port: 1337}
+	rawConn := NewMockRawConn(gomock.NewController(t))
+	rawConn.EXPECT().LocalAddr()
+	rawConn.EXPECT().capabilities().Return(connCapabilities{GSO: true}).MinTimes(1)
+	c := newSendConn(rawConn, remoteAddr, packetInfo{}, utils.DefaultLogger)
+	gomock.InOrder(
+		rawConn.EXPECT().WritePacket([]byte("foobar"), remoteAddr, gomock.Any(), uint16(4), protocol.ECNCE).Return(0, errGSO),
+		rawConn.EXPECT().WritePacket([]byte("foob"), remoteAddr, gomock.Any(), uint16(0), protocol.ECNCE).Return(4, nil),
+		rawConn.EXPECT().WritePacket([]byte("ar"), remoteAddr, gomock.Any(), uint16(0), protocol.ECNCE).Return(2, nil),
+	)
+	require.NoError(t, c.Write([]byte("foobar"), 4, protocol.ECNCE))
+	require.False(t, c.capabilities().GSO)
+}
+
+func TestSendConnSendmsgFailures(t *testing.T) {
+	if runtime.GOOS != "linux" {
+		t.Skip("only Linux exhibits this bug, we don't need to work around it on other platforms")
+	}
+
+	remoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 100, 200), Port: 1337}
+
+	t.Run("first call to sendmsg fails", func(t *testing.T) {
+		rawConn := NewMockRawConn(gomock.NewController(t))
+		rawConn.EXPECT().LocalAddr()
+		rawConn.EXPECT().capabilities().AnyTimes()
+		c := newSendConn(rawConn, remoteAddr, packetInfo{}, utils.DefaultLogger)
+		gomock.InOrder(
+			rawConn.EXPECT().WritePacket([]byte("foobar"), remoteAddr, gomock.Any(), gomock.Any(), protocol.ECNCE).Return(0, errNotPermitted),
+			rawConn.EXPECT().WritePacket([]byte("foobar"), remoteAddr, gomock.Any(), uint16(0), protocol.ECNCE).Return(6, nil),
+		)
+		require.NoError(t, c.Write([]byte("foobar"), 0, protocol.ECNCE))
+	})
+
+	t.Run("later call to sendmsg fails", func(t *testing.T) {
+		rawConn := NewMockRawConn(gomock.NewController(t))
+		rawConn.EXPECT().LocalAddr()
+		rawConn.EXPECT().capabilities().AnyTimes()
+		c := newSendConn(rawConn, remoteAddr, packetInfo{}, utils.DefaultLogger)
+		rawConn.EXPECT().WritePacket([]byte("foobar"), remoteAddr, gomock.Any(), gomock.Any(), protocol.ECNCE).Return(0, errNotPermitted).Times(2)
+		require.Error(t, c.Write([]byte("foobar"), 0, protocol.ECNCE))
+	})
+}
+
+func TestSendConnRemoteAddrChange(t *testing.T) {
+	ln1 := newUDPConnLocalhost(t)
+	ln2 := newUDPConnLocalhost(t)
+
+	c := newSendConn(
+		&basicConn{PacketConn: newUDPConnLocalhost(t)},
+		ln1.LocalAddr(),
+		packetInfo{},
+		utils.DefaultLogger,
+	)
+
+	require.NoError(t, c.Write([]byte("foobar"), 0, protocol.ECNUnsupported))
+	ln1.SetReadDeadline(time.Now().Add(time.Second))
+	b := make([]byte, 1024)
+	n, err := ln1.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, "foobar", string(b[:n]))
+
+	require.NoError(t, c.WriteTo([]byte("foobaz"), ln2.LocalAddr(), packetInfo{}))
+	ln2.SetReadDeadline(time.Now().Add(time.Second))
+	b = make([]byte, 1024)
+	n, err = ln2.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, "foobaz", string(b[:n]))
+
+	c.ChangeRemoteAddr(ln2.LocalAddr(), packetInfo{})
+	require.NoError(t, c.Write([]byte("lorem ipsum"), 0, protocol.ECNUnsupported))
+	ln2.SetReadDeadline(time.Now().Add(time.Second))
+	b = make([]byte, 1024)
+	n, err = ln2.Read(b)
+	require.NoError(t, err)
+	require.Equal(t, "lorem ipsum", string(b[:n]))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/send_queue.go b/electron/native/private-transport/third_party/quic-go/send_queue.go
new file mode 100644
index 000000000..c8060cb3e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/send_queue.go
@@ -0,0 +1,112 @@
+package quic
+
+import (
+	"net"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+type sender interface {
+	Send(p *packetBuffer, gsoSize uint16, ecn protocol.ECN)
+	SendProbe(*packetBuffer, net.Addr, packetInfo)
+	Run() error
+	WouldBlock() bool
+	Available() <-chan struct{}
+	Close()
+}
+
+type queueEntry struct {
+	buf     *packetBuffer
+	gsoSize uint16
+	ecn     protocol.ECN
+}
+
+type sendQueue struct {
+	queue       chan queueEntry
+	closeCalled chan struct{} // runStopped when Close() is called
+	runStopped  chan struct{} // runStopped when the run loop returns
+	available   chan struct{}
+	conn        sendConn
+}
+
+var _ sender = &sendQueue{}
+
+const sendQueueCapacity = 8
+
+func newSendQueue(conn sendConn) sender {
+	return &sendQueue{
+		conn:        conn,
+		runStopped:  make(chan struct{}),
+		closeCalled: make(chan struct{}),
+		available:   make(chan struct{}, 1),
+		queue:       make(chan queueEntry, sendQueueCapacity),
+	}
+}
+
+// Send sends out a packet. It's guaranteed to not block.
+// Callers need to make sure that there's actually space in the send queue by calling WouldBlock.
+// Otherwise Send will panic.
+func (h *sendQueue) Send(p *packetBuffer, gsoSize uint16, ecn protocol.ECN) {
+	select {
+	case h.queue <- queueEntry{buf: p, gsoSize: gsoSize, ecn: ecn}:
+		// clear available channel if we've reached capacity
+		if len(h.queue) == sendQueueCapacity {
+			select {
+			case <-h.available:
+			default:
+			}
+		}
+	case <-h.runStopped:
+	default:
+		panic("sendQueue.Send would have blocked")
+	}
+}
+
+func (h *sendQueue) SendProbe(p *packetBuffer, addr net.Addr, info packetInfo) {
+	h.conn.WriteTo(p.Data, addr, info)
+}
+
+func (h *sendQueue) WouldBlock() bool {
+	return len(h.queue) == sendQueueCapacity
+}
+
+func (h *sendQueue) Available() <-chan struct{} {
+	return h.available
+}
+
+func (h *sendQueue) Run() error {
+	defer close(h.runStopped)
+	var shouldClose bool
+	for {
+		if shouldClose && len(h.queue) == 0 {
+			return nil
+		}
+		select {
+		case <-h.closeCalled:
+			h.closeCalled = nil // prevent this case from being selected again
+			// make sure that all queued packets are actually sent out
+			shouldClose = true
+		case e := <-h.queue:
+			if err := h.conn.Write(e.buf.Data, e.gsoSize, e.ecn); err != nil {
+				// This additional check enables:
+				// 1. Checking for "datagram too large" message from the kernel, as such,
+				// 2. Path MTU discovery,and
+				// 3. Eventual detection of loss PingFrame.
+				if !isSendMsgSizeErr(err) {
+					return err
+				}
+			}
+			e.buf.Release()
+			select {
+			case h.available <- struct{}{}:
+			default:
+			}
+		}
+	}
+}
+
+func (h *sendQueue) Close() {
+	close(h.closeCalled)
+	// wait until the run loop returned
+	<-h.runStopped
+}
diff --git a/electron/native/private-transport/third_party/quic-go/send_queue_test.go b/electron/native/private-transport/third_party/quic-go/send_queue_test.go
new file mode 100644
index 000000000..6d1894402
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/send_queue_test.go
@@ -0,0 +1,207 @@
+package quic
+
+import (
+	"net"
+	"net/netip"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func getPacketWithContents(b []byte) *packetBuffer {
+	buf := getPacketBuffer()
+	buf.Data = buf.Data[:len(b)]
+	copy(buf.Data, b)
+	return buf
+}
+
+func TestSendQueueSendOnePacket(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		c := NewMockSendConn(mockCtrl)
+		q := newSendQueue(c)
+
+		written := make(chan struct{})
+		c.EXPECT().Write([]byte("foobar"), uint16(10), protocol.ECT1).Do(
+			func([]byte, uint16, protocol.ECN) error { close(written); return nil },
+		)
+
+		done := make(chan struct{})
+		go func() {
+			q.Run()
+			close(done)
+		}()
+
+		q.Send(getPacketWithContents([]byte("foobar")), 10, protocol.ECT1)
+		synctest.Wait()
+
+		select {
+		case <-written:
+		default:
+			t.Fatal("write should have returned")
+		}
+
+		q.Close()
+		synctest.Wait()
+
+		select {
+		case <-done:
+		default:
+			t.Fatal("Run should have returned")
+		}
+	})
+}
+
+func TestSendQueueBlocking(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		c := NewMockSendConn(mockCtrl)
+		q := newSendQueue(c)
+
+		blockWrite := make(chan struct{})
+		written := make(chan struct{}, 1)
+		c.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any()).Do(
+			func([]byte, uint16, protocol.ECN) error {
+				select {
+				case written <- struct{}{}:
+				default:
+				}
+				<-blockWrite
+				return nil
+			},
+		).AnyTimes()
+
+		done := make(chan struct{})
+		go func() {
+			q.Run()
+			close(done)
+		}()
+
+		// +1, since one packet will be queued in the Write call
+		for i := range sendQueueCapacity + 1 {
+			require.False(t, q.WouldBlock())
+			q.Send(getPacketWithContents([]byte("foobar")), 10, protocol.ECT1)
+			// make sure that the first packet is actually enqueued in the Write call
+			if i == 0 {
+				select {
+				case <-written:
+				case <-time.After(time.Second):
+					t.Fatal("timeout")
+				}
+			}
+		}
+		require.True(t, q.WouldBlock())
+		select {
+		case <-q.Available():
+			t.Fatal("should not be available")
+		default:
+		}
+		require.Panics(t, func() { q.Send(getPacketWithContents([]byte("foobar")), 10, protocol.ECT1) })
+
+		// allow one packet to be sent
+		blockWrite <- struct{}{}
+		select {
+		case <-written:
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+		select {
+		case <-q.Available():
+			require.False(t, q.WouldBlock())
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+
+		// when calling Close, all packets are first sent out
+		closed := make(chan struct{})
+		go func() {
+			q.Close()
+			close(closed)
+		}()
+
+		synctest.Wait()
+
+		select {
+		case <-closed:
+			t.Fatal("Close should have blocked")
+		default:
+		}
+
+		for range sendQueueCapacity {
+			blockWrite <- struct{}{}
+		}
+		synctest.Wait()
+
+		select {
+		case <-closed:
+		default:
+			t.Fatal("Close should have returned")
+		}
+		select {
+		case <-done:
+		default:
+			t.Fatal("Run should have returned")
+		}
+	})
+}
+
+func TestSendQueueWriteError(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		c := NewMockSendConn(mockCtrl)
+		q := newSendQueue(c)
+
+		c.EXPECT().Write(gomock.Any(), gomock.Any(), gomock.Any()).Return(assert.AnError)
+		q.Send(getPacketWithContents([]byte("foobar")), 6, protocol.ECNNon)
+
+		errChan := make(chan error, 1)
+		go func() { errChan <- q.Run() }()
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, assert.AnError)
+		default:
+			t.Fatal("Run should have returned")
+		}
+
+		// further calls to Send should not block
+		sent := make(chan struct{})
+		go func() {
+			defer close(sent)
+			for range 2 * sendQueueCapacity {
+				q.Send(getPacketWithContents([]byte("raboof")), 6, protocol.ECNNon)
+			}
+		}()
+
+		synctest.Wait()
+
+		select {
+		case <-sent:
+		default:
+			t.Fatal("Send should have returned")
+		}
+	})
+}
+
+func TestSendQueueSendProbe(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	c := NewMockSendConn(mockCtrl)
+	q := newSendQueue(c)
+
+	addr := &net.UDPAddr{IP: net.IPv4(42, 42, 42, 42), Port: 42}
+	localAddr := netip.MustParseAddr("43.43.43.43")
+	c.EXPECT().WriteTo([]byte("foobar"), addr, packetInfo{
+		addr: localAddr,
+	})
+	q.SendProbe(getPacketWithContents([]byte("foobar")), addr, packetInfo{
+		addr: localAddr,
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/send_stream.go b/electron/native/private-transport/third_party/quic-go/send_stream.go
new file mode 100644
index 000000000..0cd8a6e03
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/send_stream.go
@@ -0,0 +1,983 @@
+package quic
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+const defaultUrgency = 3
+
+func encodeStreamPriority(urgency int8, incremental bool, generation uint32) uint64 {
+	priorityValue := uint64(uint8(urgency)) | uint64(generation)<<32
+	if incremental {
+		priorityValue |= 1 << 8
+	}
+	return priorityValue
+}
+
+func decodeStreamPriority(priorityValue uint64) (urgency int8, incremental bool, generation uint32) {
+	return int8(priorityValue), uint8(priorityValue>>8) != 0, uint32(priorityValue >> 32)
+}
+
+// A SendStream is a unidirectional Send Stream.
+type SendStream struct {
+	mutex sync.Mutex
+
+	numOutstandingFrames int64 // outstanding STREAM and RESET_STREAM frames
+	retransmissionQueue  []*wire.StreamFrame
+
+	ctx       context.Context
+	ctxCancel context.CancelCauseFunc
+
+	streamID protocol.StreamID
+	sender   streamSender
+
+	// reliableSize is the portion of the stream that needs to be transmitted reliably,
+	// even if the stream is cancelled.
+	// This requires the peer to support RESET_STREAM_AT.
+	// This value should not be accessed directly, but only through the reliableOffset method.
+	// This method returns 0 if the peer doesn't support the RESET_STREAM_AT extension.
+	reliableSize protocol.ByteCount
+	writeOffset  protocol.ByteCount
+
+	shutdownErr            error
+	resetErr               *StreamError
+	queuedResetStreamFrame *wire.ResetStreamFrame
+
+	dataForWriting []byte // during a Write() call, this slice is the part of p that still needs to be sent out
+
+	writeLimiter func(int) int
+	// Set by the packetizer when writeLimiter reduces the allowed byte count. It makes the blocked
+	// WriteWithLimit return ErrWriteLimitReached and prevents another dequeue before it wakes up.
+	writeLimited bool
+
+	nextFrame *wire.StreamFrame
+	// set if flow control credit for nextFrame was already consumed
+	nextFrameReserved bool
+
+	supportsResetStreamAt bool
+	finishedWriting       bool // set once Close() is called
+	finSent               bool // set when a STREAM_FRAME with FIN bit has been sent
+	// Set when the application knows about the cancellation.
+	// This can happen because the application called CancelWrite,
+	// or because Write returned the error (for remote cancellations).
+	cancellationFlagged bool
+	completed           bool // set when this stream no longer needs to be scheduled
+
+	priorityValue atomic.Uint64
+
+	writeChan chan struct{}
+	writeOnce chan struct{}
+	deadline  monotime.Time
+
+	flowController *streamFlowController
+}
+
+var (
+	_ streamControlFrameGetter = &SendStream{}
+	_ outgoingStream           = &SendStream{}
+	_ sendStreamFrameHandler   = &SendStream{}
+)
+
+func newSendStream(
+	ctx context.Context,
+	streamID protocol.StreamID,
+	sender streamSender,
+	flowController *streamFlowController,
+	supportsResetStreamAt bool,
+) *SendStream {
+	s := &SendStream{
+		streamID:              streamID,
+		sender:                sender,
+		flowController:        flowController,
+		writeChan:             make(chan struct{}, 1),
+		writeOnce:             make(chan struct{}, 1), // cap: 1, to protect against concurrent use of Write
+		supportsResetStreamAt: supportsResetStreamAt,
+	}
+	s.priorityValue.Store(encodeStreamPriority(defaultUrgency, true, 0))
+	s.ctx, s.ctxCancel = context.WithCancelCause(ctx)
+	return s
+}
+
+// StreamID returns the stream ID.
+func (s *SendStream) StreamID() StreamID {
+	return s.streamID // same for receiveStream and sendStream
+}
+
+// Write writes data to the stream.
+// Write can be made to time out using [SendStream.SetWriteDeadline].
+// If the stream was canceled, the error is a [StreamError].
+func (s *SendStream) Write(p []byte) (int, error) {
+	return s.WriteWithLimit(p, nil)
+}
+
+// WriteWithLimit writes data to the stream, subject to an additional send limit.
+// During packetization, limiter receives the bytes allowed for the next STREAM frame after
+// QUIC flow control and returns how many may be sent. Returning n in [0, maxBytes] commits
+// n bytes of limiter credit; the limiter is not called again when those bytes are retransmitted.
+// Values outside [0, maxBytes] are clamped.
+// A short result returns the accepted prefix and [ErrWriteLimitReached]; the caller can wait
+// for external credit and retry the suffix. QUIC blocking behaves like [SendStream.Write].
+// limiter can run multiple times on another goroutine while QUIC send flow-control accounting
+// is locked. It must be concurrency-safe and must not block or call QUIC methods.
+// A nil limiter behaves like [SendStream.Write].
+func (s *SendStream) WriteWithLimit(p []byte, limiter func(maxBytes int) int) (int, error) {
+	// Concurrent use of Write is not permitted (and doesn't make any sense),
+	// but sometimes people do it anyway.
+	// Make sure that we only execute one call at any given time to avoid hard to debug failures.
+	s.writeOnce <- struct{}{}
+	defer func() { <-s.writeOnce }()
+
+	isNewlyCompleted, n, err := s.write(p, limiter)
+	if isNewlyCompleted {
+		s.sender.onStreamCompleted(s.streamID)
+	}
+	return n, err
+}
+
+// TryWriteAll writes data to the stream if it can be queued immediately.
+// It doesn't block for flow control credit and doesn't respect the write deadline.
+// If the entire slice can't be queued immediately, it queues nothing and returns [ErrWouldBlock].
+func (s *SendStream) TryWriteAll(p []byte) error {
+	select {
+	case s.writeOnce <- struct{}{}:
+		defer func() { <-s.writeOnce }()
+	default:
+		return ErrWouldBlock
+	}
+
+	isNewlyCompleted, hasData, err := s.tryWriteAll(p)
+	if isNewlyCompleted {
+		s.sender.onStreamCompleted(s.streamID)
+	}
+	if hasData {
+		s.sender.onHasStreamData(s.streamID, s)
+	}
+	return err
+}
+
+func (s *SendStream) tryWriteAll(p []byte) (bool /* is newly completed */, bool /* has data */, error) {
+	// This might wait briefly while a packet is dequeuing stream data.
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	if s.resetErr != nil {
+		s.cancellationFlagged = true
+		return s.isNewlyCompleted(), false, s.resetErr
+	}
+	if s.shutdownErr != nil {
+		return false, false, s.shutdownErr
+	}
+	if s.finishedWriting {
+		return false, false, fmt.Errorf("write on closed stream %d", s.streamID)
+	}
+	if len(p) == 0 {
+		return false, false, nil
+	}
+
+	bytesToReserve := protocol.ByteCount(len(p))
+	if s.nextFrame != nil && !s.nextFrameReserved {
+		bytesToReserve += s.nextFrame.DataLen()
+	}
+	if !s.flowController.TryAddBytesSent(bytesToReserve) {
+		return false, false, ErrWouldBlock
+	}
+
+	if s.nextFrame == nil {
+		s.nextFrame = wire.GetStreamFrame()
+		s.nextFrame.Offset = s.writeOffset
+		s.nextFrame.StreamID = s.streamID
+		s.nextFrame.DataLenPresent = true
+		s.nextFrame.Data = s.nextFrame.Data[:0]
+	}
+	l := len(s.nextFrame.Data)
+	if l+len(p) > cap(s.nextFrame.Data) {
+		// Pooled STREAM frames must keep their packet-sized buffer.
+		// Use a non-pooled frame when the queued data grows beyond that.
+		nextFrame := &wire.StreamFrame{
+			StreamID:       s.streamID,
+			Offset:         s.nextFrame.Offset,
+			DataLenPresent: true,
+			Data:           make([]byte, l+len(p)),
+		}
+		copy(nextFrame.Data, s.nextFrame.Data)
+		s.nextFrame.PutBack()
+		s.nextFrame = nextFrame
+	} else {
+		s.nextFrame.Data = s.nextFrame.Data[:l+len(p)]
+	}
+	copy(s.nextFrame.Data[l:], p)
+	s.nextFrameReserved = true
+	return false, true, nil
+}
+
+func (s *SendStream) write(p []byte, limiter func(int) int) (bool /* is newly completed */, int, error) {
+	s.mutex.Lock()
+	s.writeLimiter = limiter
+	s.writeLimited = false
+	defer func() {
+		s.writeLimiter = nil
+		s.writeLimited = false
+		s.mutex.Unlock()
+	}()
+
+	if s.resetErr != nil {
+		s.cancellationFlagged = true
+		return s.isNewlyCompleted(), 0, s.resetErr
+	}
+	if s.shutdownErr != nil {
+		return false, 0, s.shutdownErr
+	}
+	if s.finishedWriting {
+		return false, 0, fmt.Errorf("write on closed stream %d", s.streamID)
+	}
+	if !s.deadline.IsZero() && !monotime.Now().Before(s.deadline) {
+		return false, 0, errDeadline
+	}
+	if len(p) == 0 {
+		return false, 0, nil
+	}
+
+	s.dataForWriting = p
+
+	var (
+		deadlineTimer  *time.Timer
+		bytesWritten   int
+		notifiedSender bool
+	)
+	for {
+		if s.writeLimited {
+			bytesWritten = len(p) - len(s.dataForWriting)
+			s.dataForWriting = nil
+			break
+		}
+		var copied bool
+		var deadline monotime.Time
+		// As soon as dataForWriting becomes smaller than a certain size x, we copy all the data to a STREAM frame (s.nextFrame),
+		// which can then be popped the next time we assemble a packet.
+		// This allows us to return Write() when all data but x bytes have been sent out.
+		// When the user now calls Close(), this is much more likely to happen before we popped that last STREAM frame,
+		// allowing us to set the FIN bit on that frame (instead of sending an empty STREAM frame with FIN).
+		if s.canBufferStreamFrame() && len(s.dataForWriting) > 0 {
+			if s.nextFrame == nil {
+				f := wire.GetStreamFrame()
+				f.Offset = s.writeOffset
+				f.StreamID = s.streamID
+				f.DataLenPresent = true
+				f.Data = f.Data[:len(s.dataForWriting)]
+				copy(f.Data, s.dataForWriting)
+				s.nextFrame = f
+			} else {
+				l := len(s.nextFrame.Data)
+				s.nextFrame.Data = s.nextFrame.Data[:l+len(s.dataForWriting)]
+				copy(s.nextFrame.Data[l:], s.dataForWriting)
+			}
+			s.dataForWriting = nil
+			bytesWritten = len(p)
+			copied = true
+		} else {
+			bytesWritten = len(p) - len(s.dataForWriting)
+			deadline = s.deadline
+			if !deadline.IsZero() {
+				if !monotime.Now().Before(deadline) {
+					s.dataForWriting = nil
+					return false, bytesWritten, errDeadline
+				}
+				if deadlineTimer == nil {
+					deadlineTimer = time.NewTimer(monotime.Until(deadline))
+					defer deadlineTimer.Stop()
+				} else {
+					deadlineTimer.Reset(monotime.Until(deadline))
+				}
+			}
+			if s.dataForWriting == nil || s.shutdownErr != nil || s.resetErr != nil {
+				break
+			}
+		}
+
+		s.mutex.Unlock()
+		if !notifiedSender {
+			s.sender.onHasStreamData(s.streamID, s) // must be called without holding the mutex
+			notifiedSender = true
+		}
+		if copied {
+			s.mutex.Lock()
+			break
+		}
+		if deadline.IsZero() {
+			<-s.writeChan
+		} else {
+			select {
+			case <-s.writeChan:
+			case <-deadlineTimer.C:
+			}
+		}
+		s.mutex.Lock()
+	}
+
+	if bytesWritten == len(p) {
+		return false, bytesWritten, nil
+	}
+	if s.shutdownErr != nil {
+		return false, bytesWritten, s.shutdownErr
+	}
+	if s.resetErr != nil {
+		s.cancellationFlagged = true
+		return s.isNewlyCompleted(), bytesWritten, s.resetErr
+	}
+	if s.writeLimited {
+		return false, bytesWritten, ErrWriteLimitReached
+	}
+	return false, bytesWritten, nil
+}
+
+func (s *SendStream) canBufferStreamFrame() bool {
+	if s.writeLimiter != nil || s.nextFrameReserved {
+		return false
+	}
+	var l protocol.ByteCount
+	if s.nextFrame != nil {
+		l = s.nextFrame.DataLen()
+	}
+	return l+protocol.ByteCount(len(s.dataForWriting)) <= protocol.MaxPacketBufferSize
+}
+
+// popStreamFrame returns the next STREAM frame that is supposed to be sent on this stream
+// maxBytes is the maximum length this frame (including frame header) will have.
+// hasMoreData says if more data can be sent after this call without first
+// receiving a MAX_STREAM_DATA frame.
+func (s *SendStream) popStreamFrame(maxBytes protocol.ByteCount, v protocol.Version) (_ ackhandler.StreamFrame, _ *wire.StreamDataBlockedFrame, hasMoreData bool) {
+	s.mutex.Lock()
+	f, blocked, hasMoreData := s.popNewStreamFrameForPacket(maxBytes, v)
+	if f != nil {
+		s.numOutstandingFrames++
+	}
+	s.mutex.Unlock()
+	if blocked != nil {
+		hasMoreData = false
+	}
+
+	if f == nil {
+		return ackhandler.StreamFrame{}, blocked, hasMoreData
+	}
+	return ackhandler.StreamFrame{
+		Frame:   f,
+		Handler: (*sendStreamAckHandler)(s),
+	}, blocked, hasMoreData
+}
+
+func (s *SendStream) popNewStreamFrameForPacket(maxBytes protocol.ByteCount, v protocol.Version) (_ *wire.StreamFrame, _ *wire.StreamDataBlockedFrame, hasMoreData bool) {
+	if s.shutdownErr != nil {
+		return nil, nil, false
+	}
+	if s.resetErr != nil {
+		reliableOffset := s.reliableOffset()
+		if reliableOffset == 0 || s.writeOffset >= reliableOffset {
+			return nil, nil, false
+		}
+	}
+
+	if s.writeLimited {
+		return nil, nil, false
+	}
+
+	if len(s.dataForWriting) == 0 && s.nextFrame == nil {
+		if s.finishedWriting && !s.finSent {
+			s.finSent = true
+			return &wire.StreamFrame{
+				StreamID:       s.streamID,
+				Offset:         s.writeOffset,
+				DataLenPresent: true,
+				Fin:            true,
+			}, nil, false
+		}
+		return nil, nil, false
+	}
+
+	// if the stream is canceled, only data up to the reliable size needs to be sent
+	reliableOffset := s.reliableOffset()
+	limitedWrite := s.writeLimiter != nil && s.nextFrame == nil
+	var maxDataLen protocol.ByteCount
+	if s.nextFrameReserved {
+		maxDataLen = s.nextFrame.DataLen()
+	} else {
+		maxDataLen = s.flowController.SendWindowSize()
+	}
+	if s.resetErr != nil && reliableOffset > 0 {
+		maxDataLen = min(maxDataLen, reliableOffset-s.writeOffset)
+	}
+	if s.nextFrame != nil {
+		maxDataLen = min(maxDataLen, s.nextFrame.MaxDataLen(maxBytes, v), s.nextFrame.DataLen())
+	} else {
+		f := wire.StreamFrame{
+			StreamID:       s.streamID,
+			Offset:         s.writeOffset,
+			DataLenPresent: true,
+		}
+		maxDataLen = min(maxDataLen, f.MaxDataLen(maxBytes, v), protocol.ByteCount(len(s.dataForWriting)))
+	}
+	if maxDataLen == 0 {
+		return nil, nil, true
+	}
+	if limitedWrite {
+		added, limited := s.flowController.AddBytesSentWithLimiter(maxDataLen, s.writeLimiter)
+		if limited {
+			s.writeLimited = true
+			s.signalWrite()
+		}
+		maxDataLen = added
+		if maxDataLen == 0 {
+			return nil, nil, !limited
+		}
+	} else if !s.nextFrameReserved && !s.flowController.TryAddBytesSent(maxDataLen) {
+		return nil, nil, true
+	}
+	f, hasMoreData := s.popNewStreamFrame(maxDataLen)
+	if f.DataLen() > 0 {
+		s.writeOffset += f.DataLen()
+	}
+	if s.resetErr != nil && s.writeOffset >= reliableOffset {
+		hasMoreData = false
+	}
+	if s.writeLimited {
+		hasMoreData = false
+	}
+	var blocked *wire.StreamDataBlockedFrame
+	// Flow control for a reserved frame was consumed when it was queued. Don't
+	// report the stream blocked while reserved bytes can still be sent.
+	if f.DataLen() > 0 && !s.nextFrameReserved {
+		if isBlocked, offset := s.flowController.isNewlyBlocked(); isBlocked {
+			blocked = &wire.StreamDataBlockedFrame{StreamID: s.streamID, MaximumStreamData: offset}
+		}
+	}
+	f.Fin = s.finishedWriting && s.dataForWriting == nil && s.nextFrame == nil && !s.finSent
+	if f.Fin {
+		s.finSent = true
+	}
+	return f, blocked, hasMoreData
+}
+
+// popNewStreamFrame returns a new STREAM frame to send for this stream
+// hasMoreData says if there's more data to send, *not* taking into account the reliable size
+func (s *SendStream) popNewStreamFrame(maxDataLen protocol.ByteCount) (_ *wire.StreamFrame, hasMoreData bool) {
+	if s.nextFrame != nil {
+		nextFrame := s.nextFrame
+		nextFrameReserved := s.nextFrameReserved
+		s.nextFrame = nil
+		s.nextFrameReserved = false
+		if nextFrame.DataLen() > maxDataLen {
+			if nextFrame.DataLen()-maxDataLen > protocol.MaxPacketBufferSize {
+				s.nextFrame = &wire.StreamFrame{
+					Data: make([]byte, nextFrame.DataLen()-maxDataLen),
+				}
+			} else {
+				s.nextFrame = wire.GetStreamFrame()
+				s.nextFrame.Data = s.nextFrame.Data[:nextFrame.DataLen()-maxDataLen]
+			}
+			s.nextFrame.StreamID = s.streamID
+			s.nextFrame.Offset = s.writeOffset + maxDataLen
+			s.nextFrame.DataLenPresent = true
+			copy(s.nextFrame.Data, nextFrame.Data[maxDataLen:])
+			nextFrame.Data = nextFrame.Data[:maxDataLen]
+			s.nextFrameReserved = nextFrameReserved
+		} else {
+			s.signalWrite()
+		}
+		return nextFrame, s.nextFrame != nil || s.dataForWriting != nil
+	}
+
+	f := wire.GetStreamFrame()
+	f.Fin = false
+	f.StreamID = s.streamID
+	f.Offset = s.writeOffset
+	f.DataLenPresent = true
+	f.Data = f.Data[:0]
+
+	s.getDataForWriting(f, maxDataLen)
+	return f, s.dataForWriting != nil || s.nextFrame != nil || s.finishedWriting
+}
+
+func (s *SendStream) popRetransmissionFrame(maxBytes protocol.ByteCount, v protocol.Version) (_ ackhandler.StreamFrame, hasMore bool) {
+	s.mutex.Lock()
+	if s.shutdownErr != nil || len(s.retransmissionQueue) == 0 {
+		s.mutex.Unlock()
+		return ackhandler.StreamFrame{}, false
+	}
+	f := s.retransmissionQueue[0]
+	newFrame, needsSplit := f.MaybeSplitOffFrame(maxBytes, v)
+	if needsSplit {
+		f = newFrame
+		hasMore = true
+	} else {
+		s.retransmissionQueue = s.retransmissionQueue[1:]
+		hasMore = len(s.retransmissionQueue) > 0
+	}
+	if f != nil {
+		s.numOutstandingFrames++
+	}
+	s.mutex.Unlock()
+
+	if f == nil {
+		return ackhandler.StreamFrame{}, hasMore
+	}
+	return ackhandler.StreamFrame{Frame: f, Handler: (*sendStreamAckHandler)(s)}, hasMore
+}
+
+func (s *SendStream) getDataForWriting(f *wire.StreamFrame, maxBytes protocol.ByteCount) {
+	if protocol.ByteCount(len(s.dataForWriting)) <= maxBytes {
+		f.Data = f.Data[:len(s.dataForWriting)]
+		copy(f.Data, s.dataForWriting)
+		s.dataForWriting = nil
+		s.signalWrite()
+		return
+	}
+	f.Data = f.Data[:maxBytes]
+	copy(f.Data, s.dataForWriting)
+	s.dataForWriting = s.dataForWriting[maxBytes:]
+	if s.canBufferStreamFrame() {
+		s.signalWrite()
+	}
+}
+
+func (s *SendStream) isNewlyCompleted() bool {
+	if s.completed {
+		return false
+	}
+	if s.nextFrame != nil && s.nextFrame.DataLen() > 0 {
+		return false
+	}
+	// We need to keep the stream around until all frames have been sent and acknowledged.
+	if s.numOutstandingFrames > 0 || len(s.retransmissionQueue) > 0 || s.queuedResetStreamFrame != nil {
+		return false
+	}
+	// The stream is completed if we sent the FIN.
+	if s.finSent {
+		s.completed = true
+		return true
+	}
+	// The stream is also completed if:
+	// 1. the application called CancelWrite, or
+	// 2. we received a STOP_SENDING, and
+	// 		* the application consumed the error via Write, or
+	//		* the application called Close
+	if s.resetErr != nil && (s.cancellationFlagged || s.finishedWriting) {
+		s.completed = true
+		return true
+	}
+	return false
+}
+
+// Close closes the write-direction of the stream.
+// Future calls to [SendStream.Write] are not permitted after calling Close.
+// It must not be called concurrently with [SendStream.Write].
+// It must not be called after calling [SendStream.CancelWrite].
+func (s *SendStream) Close() error {
+	s.mutex.Lock()
+	if s.shutdownErr != nil || s.finishedWriting {
+		s.mutex.Unlock()
+		return nil
+	}
+	s.finishedWriting = true
+	cancelled := s.resetErr != nil
+	if cancelled {
+		s.cancellationFlagged = true
+	}
+	completed := s.isNewlyCompleted()
+	s.mutex.Unlock()
+
+	if completed {
+		s.sender.onStreamCompleted(s.streamID)
+	}
+	if cancelled {
+		return fmt.Errorf("close called for canceled stream %d", s.streamID)
+	}
+	s.sender.onHasStreamData(s.streamID, s) // need to send the FIN, must be called without holding the mutex
+
+	s.ctxCancel(nil)
+	return nil
+}
+
+// SetReliableBoundary marks the data written to this stream so far as reliable.
+// It is valid to call this function multiple times, thereby increasing the reliable size.
+// It only has an effect if the peer enabled support for the RESET_STREAM_AT extension,
+// otherwise, it is a no-op.
+func (s *SendStream) SetReliableBoundary() {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	if s.nextFrame != nil {
+		s.reliableSize = max(s.reliableSize, s.writeOffset+s.nextFrame.DataLen())
+	} else {
+		s.reliableSize = max(s.reliableSize, s.writeOffset)
+	}
+}
+
+// returnFramesToPool returns all queued frames to the sync.Pool
+func (s *SendStream) returnFramesToPool() {
+	for _, f := range s.retransmissionQueue {
+		f.PutBack()
+	}
+	clear(s.retransmissionQueue)
+	s.retransmissionQueue = nil
+	if s.nextFrame != nil {
+		s.nextFrame.PutBack()
+		s.nextFrame = nil
+	}
+	s.nextFrameReserved = false
+}
+
+// CancelWrite aborts sending on this stream.
+// Data already written, but not yet delivered to the peer is not guaranteed to be delivered reliably.
+// [SendStream.Write] will unblock immediately, and future calls to it will fail.
+// When called multiple times it is a no-op.
+// When called after [SendStream.Close], it aborts reliable delivery of outstanding stream data.
+// Note that there is no guarantee if the peer will receive the FIN or the cancellation error first.
+func (s *SendStream) CancelWrite(errorCode StreamErrorCode) {
+	s.mutex.Lock()
+	if s.shutdownErr != nil {
+		s.mutex.Unlock()
+		return
+	}
+
+	s.cancellationFlagged = true
+
+	if s.resetErr != nil {
+		completed := s.isNewlyCompleted()
+		s.mutex.Unlock()
+		// The user has called CancelWrite. If the previous cancellation was because of a
+		// STOP_SENDING, we don't need to flag the error to the user anymore.
+		if completed {
+			s.sender.onStreamCompleted(s.streamID)
+		}
+		return
+	}
+	s.resetErr = &StreamError{StreamID: s.streamID, ErrorCode: errorCode, Remote: false}
+	s.ctxCancel(s.resetErr)
+
+	reliableOffset := s.reliableOffset()
+	finalSize := max(s.writeOffset, reliableOffset)
+	if s.nextFrameReserved && s.nextFrame != nil {
+		finalSize = max(finalSize, s.nextFrame.Offset+s.nextFrame.DataLen())
+	}
+	if reliableOffset == 0 {
+		s.numOutstandingFrames = 0
+		s.returnFramesToPool()
+	}
+	s.queuedResetStreamFrame = &wire.ResetStreamFrame{
+		StreamID:  s.streamID,
+		FinalSize: finalSize,
+		ErrorCode: errorCode,
+		// if the peer doesn't support the extension, the reliable offset will always be 0
+		ReliableSize: reliableOffset,
+	}
+	if reliableOffset > 0 {
+		if s.nextFrame != nil {
+			if s.nextFrame.Offset >= reliableOffset {
+				s.nextFrame.PutBack()
+				s.nextFrame = nil
+				s.nextFrameReserved = false
+			} else if s.nextFrame.Offset+s.nextFrame.DataLen() > reliableOffset {
+				s.nextFrame.Data = s.nextFrame.Data[:reliableOffset-s.nextFrame.Offset]
+			}
+		}
+		if len(s.retransmissionQueue) > 0 {
+			retransmissionQueue := make([]*wire.StreamFrame, 0, len(s.retransmissionQueue))
+			for _, f := range s.retransmissionQueue {
+				if f.Offset >= reliableOffset {
+					f.PutBack()
+					continue
+				}
+				if f.Offset+f.DataLen() <= reliableOffset {
+					retransmissionQueue = append(retransmissionQueue, f)
+				} else {
+					f.Data = f.Data[:reliableOffset-f.Offset]
+					retransmissionQueue = append(retransmissionQueue, f)
+				}
+			}
+			s.retransmissionQueue = retransmissionQueue
+		}
+	}
+	s.mutex.Unlock()
+
+	s.signalWrite()
+	s.sender.onHasStreamControlFrame(s.streamID, s)
+}
+
+func (s *SendStream) enableResetStreamAt() {
+	s.mutex.Lock()
+	s.supportsResetStreamAt = true
+	s.mutex.Unlock()
+}
+
+func (s *SendStream) updateSendWindow(limit protocol.ByteCount) {
+	s.mutex.Lock()
+	updated := s.flowController.UpdateSendWindow(limit)
+	if !updated { // duplicate or reordered MAX_STREAM_DATA frame
+		s.mutex.Unlock()
+		return
+	}
+	hasStreamData := s.dataForWriting != nil || s.nextFrame != nil
+	s.mutex.Unlock()
+	if hasStreamData {
+		s.sender.onHasStreamData(s.streamID, s)
+	}
+}
+
+func (s *SendStream) handleStopSendingFrame(f *wire.StopSendingFrame) {
+	s.mutex.Lock()
+	if s.shutdownErr != nil {
+		s.mutex.Unlock()
+		return
+	}
+
+	// If the stream was already cancelled (either locally, or due to a previous STOP_SENDING frame),
+	// there's nothing else to do.
+	if s.resetErr != nil && s.reliableOffset() == 0 {
+		s.mutex.Unlock()
+		return
+	}
+	// if the peer stopped reading from the stream, there's no need to transmit any data reliably
+	s.reliableSize = 0
+	s.numOutstandingFrames = 0
+	finalSize := s.writeOffset
+	if s.nextFrameReserved && s.nextFrame != nil {
+		finalSize = max(finalSize, s.nextFrame.Offset+s.nextFrame.DataLen())
+	}
+	s.returnFramesToPool()
+	if s.resetErr == nil {
+		s.resetErr = &StreamError{StreamID: s.streamID, ErrorCode: f.ErrorCode, Remote: true}
+		s.ctxCancel(s.resetErr)
+	}
+	s.queuedResetStreamFrame = &wire.ResetStreamFrame{
+		StreamID:  s.streamID,
+		FinalSize: finalSize,
+		ErrorCode: s.resetErr.ErrorCode,
+	}
+	s.mutex.Unlock()
+
+	s.signalWrite()
+	s.sender.onHasStreamControlFrame(s.streamID, s)
+}
+
+func (s *SendStream) getControlFrame(monotime.Time) (_ ackhandler.Frame, ok, hasMore bool) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	if s.queuedResetStreamFrame == nil {
+		return ackhandler.Frame{}, false, false
+	}
+	s.numOutstandingFrames++
+	f := ackhandler.Frame{
+		Frame:   s.queuedResetStreamFrame,
+		Handler: (*sendStreamResetStreamHandler)(s),
+	}
+	s.queuedResetStreamFrame = nil
+	return f, true, false
+}
+
+func (s *SendStream) reliableOffset() protocol.ByteCount {
+	if !s.supportsResetStreamAt {
+		return 0
+	}
+	return s.reliableSize
+}
+
+// SetPriority sets the scheduling priority for data sent on the stream.
+// It uses the urgency and incremental parameters defined by [RFC 9218].
+// Urgency is clipped to the range 0 through 7, with lower values taking priority.
+// Within an urgency level, incremental streams are scheduled round-robin,
+// while non-incremental streams are scheduled by stream ID.
+//
+// The default priority is urgency 3 with incremental set to true. RFC 9218
+// instead defaults incremental to false.
+//
+// [RFC 9218]: https://www.rfc-editor.org/rfc/rfc9218.html
+func (s *SendStream) SetPriority(urgency int8, incremental bool) {
+	urgency = max(0, min(urgency, 7)) // urgency must be between 0 and 7
+	s.mutex.Lock()
+	if s.completed {
+		s.mutex.Unlock()
+		return
+	}
+	oldUrgency, oldIncremental, generation := decodeStreamPriority(s.priorityValue.Load())
+	if oldUrgency == urgency && oldIncremental == incremental {
+		s.mutex.Unlock()
+		return
+	}
+	s.priorityValue.Store(encodeStreamPriority(urgency, incremental, generation+1))
+	// Keep qlogging under the lock so shutdown can't close the qlogger concurrently.
+	s.sender.recordStreamPriorityUpdated(s.streamID, urgency, incremental)
+	s.mutex.Unlock()
+	// The framer calls back into the stream while holding its lock.
+	s.sender.updateStreamPriority(s.streamID)
+}
+
+// The Context is canceled as soon as the write-side of the stream is closed.
+// This happens when [SendStream.Close] or [SendStream.CancelWrite] is called, or when the peer
+// cancels the read-side of their stream.
+// The cancellation cause is set to the error that caused the stream to
+// close, or [context.Canceled] in case the stream is closed without error.
+func (s *SendStream) Context() context.Context {
+	return s.ctx
+}
+
+// SetWriteDeadline sets the deadline for future [SendStream.Write] calls
+// and any currently blocked call.
+// Even if write times out, it may return n > 0, indicating that
+// some data was successfully written.
+// A zero value for t means [SendStream.Write] will not time out.
+func (s *SendStream) SetWriteDeadline(t time.Time) error {
+	s.mutex.Lock()
+	s.deadline = monotime.FromTime(t)
+	s.mutex.Unlock()
+	s.signalWrite()
+	return nil
+}
+
+// CloseForShutdown closes a stream abruptly.
+// It makes Write unblock (and return the error) immediately.
+// The peer will NOT be informed about this: the stream is closed without sending a FIN or RST.
+func (s *SendStream) closeForShutdown(err error) {
+	s.mutex.Lock()
+	s.completed = true
+	if s.shutdownErr == nil && !s.finishedWriting {
+		s.shutdownErr = err
+		s.returnFramesToPool()
+	}
+	s.mutex.Unlock()
+	s.ctxCancel(err)
+	s.signalWrite()
+}
+
+// signalWrite performs a non-blocking send on the writeChan
+func (s *SendStream) signalWrite() {
+	select {
+	case s.writeChan <- struct{}{}:
+	default:
+	}
+}
+
+func (s *SendStream) priority() (urgency int8, incremental bool, generation uint32) {
+	return decodeStreamPriority(s.priorityValue.Load())
+}
+
+type sendStreamAckHandler SendStream
+
+var _ ackhandler.FrameHandler = &sendStreamAckHandler{}
+
+func (s *sendStreamAckHandler) OnAcked(f wire.Frame) {
+	sf := f.(*wire.StreamFrame)
+	sf.PutBack()
+
+	s.mutex.Lock()
+	if s.resetErr != nil && (*SendStream)(s).reliableOffset() == 0 {
+		s.mutex.Unlock()
+		return
+	}
+	s.numOutstandingFrames--
+	if s.numOutstandingFrames < 0 {
+		panic("numOutStandingFrames negative")
+	}
+	completed := (*SendStream)(s).isNewlyCompleted()
+	s.mutex.Unlock()
+
+	if completed {
+		s.sender.onStreamCompleted(s.streamID)
+	}
+}
+
+func (s *sendStreamAckHandler) OnLost(f wire.Frame) {
+	sf := f.(*wire.StreamFrame)
+	s.mutex.Lock()
+	// If the reliable size was 0 when the stream was cancelled,
+	// the number of outstanding frames was immediately set to 0, and the retransmission queue was dropped.
+	if s.resetErr != nil && (*SendStream)(s).reliableOffset() == 0 {
+		// Return the frame to pool since it won't be retransmitted
+		sf.PutBack()
+		s.mutex.Unlock()
+		return
+	}
+	s.numOutstandingFrames--
+	if s.numOutstandingFrames < 0 {
+		panic("numOutStandingFrames negative")
+	}
+
+	if s.resetErr != nil && (*SendStream)(s).reliableOffset() > 0 {
+		// If the stream was reset, and this frame is beyond the reliable offset,
+		// it doesn't need to be retransmitted.
+		if sf.Offset >= (*SendStream)(s).reliableOffset() {
+			sf.PutBack()
+			// If this frame was the last one tracked, losing it might cause the stream to be completed.
+			completed := (*SendStream)(s).isNewlyCompleted()
+			s.mutex.Unlock()
+			if completed {
+				s.sender.onStreamCompleted(s.streamID)
+			}
+			return
+		}
+		// If the payload of the frame extends beyond the reliable size,
+		// truncate the frame to the reliable size.
+		if sf.Offset+sf.DataLen() > (*SendStream)(s).reliableOffset() {
+			sf.Data = sf.Data[:(*SendStream)(s).reliableOffset()-sf.Offset]
+		}
+	}
+
+	sf.DataLenPresent = true
+	wasEmpty := len(s.retransmissionQueue) == 0
+	s.retransmissionQueue = append(s.retransmissionQueue, sf)
+	s.mutex.Unlock()
+
+	if wasEmpty {
+		s.sender.onHasStreamRetransmission(s.streamID, (*SendStream)(s))
+	}
+}
+
+type sendStreamResetStreamHandler SendStream
+
+var _ ackhandler.FrameHandler = &sendStreamResetStreamHandler{}
+
+func (s *sendStreamResetStreamHandler) OnAcked(f wire.Frame) {
+	rsf := f.(*wire.ResetStreamFrame)
+	s.mutex.Lock()
+	// If the peer sent a STOP_SENDING after we sent a RESET_STREAM_AT frame,
+	// we sent 1. reduced the reliable size to 0 and 2. sent a RESET_STREAM frame.
+	// In this case, we don't care about the acknowledgment of this frame.
+	if rsf.ReliableSize != (*SendStream)(s).reliableOffset() {
+		s.mutex.Unlock()
+		return
+	}
+	s.numOutstandingFrames--
+	if s.numOutstandingFrames < 0 {
+		panic("numOutStandingFrames negative")
+	}
+	completed := (*SendStream)(s).isNewlyCompleted()
+	s.mutex.Unlock()
+
+	if completed {
+		s.sender.onStreamCompleted(s.streamID)
+	}
+}
+
+func (s *sendStreamResetStreamHandler) OnLost(f wire.Frame) {
+	rsf := f.(*wire.ResetStreamFrame)
+	s.mutex.Lock()
+	// If the peer sent a STOP_SENDING after we sent a RESET_STREAM_AT frame,
+	// we sent 1. reduced the reliable size to 0 and 2. sent a RESET_STREAM frame.
+	// In this case, the loss of the RESET_STREAM_AT frame can be ignored.
+	if rsf.ReliableSize != (*SendStream)(s).reliableOffset() {
+		s.mutex.Unlock()
+		return
+	}
+	s.queuedResetStreamFrame = rsf
+	s.numOutstandingFrames--
+	s.mutex.Unlock()
+	s.sender.onHasStreamControlFrame(s.streamID, (*SendStream)(s))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/send_stream_test.go b/electron/native/private-transport/third_party/quic-go/send_stream_test.go
new file mode 100644
index 000000000..dd34d658a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/send_stream_test.go
@@ -0,0 +1,1930 @@
+package quic
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"io"
+	mrand "math/rand/v2"
+	"net"
+	"os"
+	"runtime"
+	"slices"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+type writerWithTimeout struct {
+	io.Writer
+	Timeout time.Duration
+}
+
+func (w *writerWithTimeout) Write(p []byte) (n int, err error) {
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		n, err = w.Writer.Write(p)
+	}()
+
+	select {
+	case <-done:
+		return n, err
+	case <-time.After(w.Timeout):
+		return 0, fmt.Errorf("write timeout after %s", w.Timeout)
+	}
+}
+
+func expectedFrameHeaderLen(strID protocol.StreamID, offset protocol.ByteCount) protocol.ByteCount {
+	return (&wire.StreamFrame{StreamID: strID, Offset: offset, DataLenPresent: true}).Length(protocol.Version1)
+}
+
+func TestSendStreamSetup(t *testing.T) {
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	ctx := context.WithValue(context.Background(), "foo", "bar")
+	str := newSendStream(ctx, 1337, nil, mockFC, false)
+	require.NotNil(t, str.Context())
+	require.Equal(t, "bar", str.Context().Value("foo"))
+	require.Equal(t, protocol.StreamID(1337), str.StreamID())
+}
+
+func TestSendStreamPriorityGeneration(t *testing.T) {
+	const streamID = protocol.StreamID(42)
+	mockSender := NewMockStreamSender(gomock.NewController(t))
+	str := newSendStream(context.Background(), streamID, mockSender, newTestStreamFlowControllerWithSendWindow(streamID, protocol.MaxByteCount), false)
+
+	str.SetPriority(defaultUrgency, true)
+	urgency, incremental, generation := str.priority()
+	require.Equal(t, int8(defaultUrgency), urgency)
+	require.True(t, incremental)
+	require.Zero(t, generation)
+
+	mockSender.EXPECT().updateStreamPriority(streamID).Times(3)
+	mockSender.EXPECT().recordStreamPriorityUpdated(streamID, int8(2), false)
+	mockSender.EXPECT().recordStreamPriorityUpdated(streamID, int8(2), true)
+	mockSender.EXPECT().recordStreamPriorityUpdated(streamID, int8(1), false)
+	str.SetPriority(2, false)
+	str.SetPriority(2, false)
+	urgency, incremental, generation = str.priority()
+	require.Equal(t, int8(2), urgency)
+	require.False(t, incremental)
+	require.Equal(t, uint32(1), generation)
+
+	str.SetPriority(2, true)
+	urgency, incremental, generation = str.priority()
+	require.Equal(t, int8(2), urgency)
+	require.True(t, incremental)
+	require.Equal(t, uint32(2), generation)
+
+	str.SetPriority(1, false)
+	urgency, incremental, generation = str.priority()
+	require.Equal(t, int8(1), urgency)
+	require.False(t, incremental)
+	require.Equal(t, uint32(3), generation)
+
+	str.closeForShutdown(assert.AnError)
+	str.SetPriority(0, true)
+	urgency, incremental, generation = str.priority()
+	require.Equal(t, int8(1), urgency)
+	require.False(t, incremental)
+	require.Equal(t, uint32(3), generation)
+}
+
+func TestSendStreamWriteData(t *testing.T) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+	strWithTimeout := &writerWithTimeout{Writer: str, Timeout: time.Second}
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	n, err := strWithTimeout.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.Equal(t, 6, n)
+
+	frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.False(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Data: []byte("foobar"), DataLenPresent: true},
+		frame.Frame,
+	)
+	require.True(t, mockCtrl.Satisfied())
+
+	// nothing more to send at this point
+	_, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// nil writes don't do anything
+	n, err = strWithTimeout.Write(nil)
+	require.NoError(t, err)
+	require.Zero(t, n)
+	require.True(t, mockCtrl.Satisfied())
+
+	// empty slices writes don't do anything
+	n, err = strWithTimeout.Write([]byte{})
+	require.NoError(t, err)
+	require.Zero(t, n)
+	require.True(t, mockCtrl.Satisfied())
+
+	// multiple writes are bundled into a single frame
+	mockSender.EXPECT().onHasStreamData(streamID, str).Times(2)
+	n, err = strWithTimeout.Write([]byte{0xde, 0xad})
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+	n, err = strWithTimeout.Write([]byte{0xbe, 0xef})
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+
+	frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.False(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 42, Offset: 6, Data: []byte{0xde, 0xad, 0xbe, 0xef}, DataLenPresent: true},
+		frame.Frame,
+	)
+
+	// a single write is split up into smaller frames
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	n, err = strWithTimeout.Write([]byte("foobaz"))
+	require.NoError(t, err)
+	require.Equal(t, 6, n)
+	frame, _, hasMore = str.popStreamFrame(expectedFrameHeaderLen(streamID, 10), protocol.Version1)
+	require.Nil(t, frame.Frame)
+	require.True(t, hasMore)
+	frame, _, hasMore = str.popStreamFrame(expectedFrameHeaderLen(streamID, 10)+3, protocol.Version1)
+	require.True(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Offset: 10, Data: []byte("foo"), DataLenPresent: true},
+		frame.Frame,
+	)
+	frame, _, hasMore = str.popStreamFrame(expectedFrameHeaderLen(streamID, 13)+3, protocol.Version1)
+	require.False(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Offset: 13, Data: []byte("baz"), DataLenPresent: true},
+		frame.Frame,
+	)
+}
+
+func TestSendStreamWriteWithLimit(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const streamID protocol.StreamID = 42
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(streamID, 56)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+		mockSender.EXPECT().onHasStreamData(streamID, str).Times(4)
+		_, err := str.Write([]byte("header"))
+		require.NoError(t, err)
+
+		type result struct {
+			n   int
+			err error
+		}
+		results := make(chan result, 1)
+		data := make([]byte, 51)
+		calls := 0
+		go func() {
+			n, err := str.WriteWithLimit(data, func(maxBytes int) int {
+				calls++
+				return min(maxBytes, 25)
+			})
+			results <- result{n: n, err: err}
+		}()
+
+		synctest.Wait()
+		frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.True(t, hasMore)
+		require.Equal(t, []byte("header"), frame.Frame.Data)
+		require.Zero(t, calls)
+
+		frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.False(t, hasMore)
+		require.Equal(t, data[:25], frame.Frame.Data)
+		synctest.Wait()
+		writeResult := <-results
+		require.Equal(t, 25, writeResult.n)
+		require.ErrorIs(t, writeResult.err, ErrWriteLimitReached)
+		require.Equal(t, 1, calls)
+
+		go func() {
+			n, err := str.WriteWithLimit(data[25:], func(maxBytes int) int {
+				calls++
+				return maxBytes
+			})
+			results <- result{n: n, err: err}
+		}()
+		synctest.Wait()
+
+		frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.False(t, hasMore)
+		require.Equal(t, data[25:50], frame.Frame.Data)
+		require.Equal(t, 2, calls)
+
+		frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.Nil(t, frame.Frame)
+		require.True(t, hasMore)
+		require.Equal(t, 2, calls)
+
+		str.updateSendWindow(57)
+		frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.False(t, hasMore)
+		require.Equal(t, data[50:], frame.Frame.Data)
+		synctest.Wait()
+		writeResult = <-results
+		require.Equal(t, 26, writeResult.n)
+		require.NoError(t, writeResult.err)
+		require.Equal(t, 3, calls)
+	})
+}
+
+func TestSendStreamTryWriteAll(t *testing.T) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(streamID, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	require.NoError(t, str.TryWriteAll(nil))
+	require.NoError(t, str.TryWriteAll([]byte{}))
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	data := []byte("foobar")
+	require.NoError(t, str.TryWriteAll(data))
+	data[0] = 'x' // make sure the data was copied
+
+	frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.False(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Data: []byte("foobar"), DataLenPresent: true},
+		frame.Frame,
+	)
+}
+
+func TestSendStreamTryWriteAllFlowControlBlocked(t *testing.T) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(streamID, 3)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	require.ErrorIs(t, str.TryWriteAll([]byte("foobar")), ErrWouldBlock)
+	require.Equal(t, protocol.ByteCount(3), mockFC.SendWindowSize())
+
+	frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, frame.Frame)
+	require.False(t, hasMore)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	require.NoError(t, str.TryWriteAll([]byte("foo")))
+	frame, blocked, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.False(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Data: []byte("foo"), DataLenPresent: true},
+		frame.Frame,
+	)
+	require.Equal(t, &wire.StreamDataBlockedFrame{StreamID: streamID, MaximumStreamData: 3}, blocked)
+}
+
+func TestSendStreamTryWriteAllAfterBufferedWrite(t *testing.T) {
+	const streamID protocol.StreamID = 42
+
+	t.Run("enough credit", func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(streamID, 6)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+		mockSender.EXPECT().onHasStreamData(streamID, str).Times(2)
+		n, err := str.Write([]byte("foo"))
+		require.NoError(t, err)
+		require.Equal(t, 3, n)
+		require.NoError(t, str.TryWriteAll([]byte("bar")))
+
+		frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.False(t, hasMore)
+		require.EqualExportedValues(t,
+			&wire.StreamFrame{StreamID: streamID, Data: []byte("foobar"), DataLenPresent: true},
+			frame.Frame,
+		)
+		require.Zero(t, mockFC.SendWindowSize())
+	})
+
+	t.Run("not enough credit", func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(streamID, 5)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+		mockSender.EXPECT().onHasStreamData(streamID, str)
+		n, err := str.Write([]byte("foo"))
+		require.NoError(t, err)
+		require.Equal(t, 3, n)
+		require.ErrorIs(t, str.TryWriteAll([]byte("bar")), ErrWouldBlock)
+
+		frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.False(t, hasMore)
+		require.EqualExportedValues(t,
+			&wire.StreamFrame{StreamID: streamID, Data: []byte("foo"), DataLenPresent: true},
+			frame.Frame,
+		)
+		require.Equal(t, protocol.ByteCount(2), mockFC.SendWindowSize())
+	})
+}
+
+func TestSendStreamWriteAfterTryWriteAll(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const streamID protocol.StreamID = 42
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(streamID, protocol.MaxByteCount)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+		mockSender.EXPECT().onHasStreamData(streamID, str).Times(2)
+		require.NoError(t, str.TryWriteAll([]byte("foo")))
+
+		errChan := make(chan error, 1)
+		go func() {
+			n, err := str.Write([]byte("bar"))
+			if n != 3 {
+				errChan <- fmt.Errorf("expected to write 3 bytes, wrote %d", n)
+				return
+			}
+			errChan <- err
+		}()
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			t.Fatalf("Write should not have returned yet: %v", err)
+		default:
+		}
+
+		frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.True(t, hasMore)
+		require.EqualExportedValues(t,
+			&wire.StreamFrame{StreamID: streamID, Data: []byte("foo"), DataLenPresent: true},
+			frame.Frame,
+		)
+
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("Write should have returned")
+		}
+
+		frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.False(t, hasMore)
+		require.EqualExportedValues(t,
+			&wire.StreamFrame{StreamID: streamID, Offset: 3, Data: []byte("bar"), DataLenPresent: true},
+			frame.Frame,
+		)
+	})
+}
+
+func TestSendStreamLargeTryWriteAll(t *testing.T) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(streamID, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	data := make([]byte, 10*protocol.MaxPacketBufferSize)
+	for i := range data {
+		data[i] = byte(i)
+	}
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	require.NoError(t, str.TryWriteAll(data))
+
+	var offset protocol.ByteCount
+	for offset < protocol.ByteCount(len(data)) {
+		frame, _, hasMore := str.popStreamFrame(expectedFrameHeaderLen(streamID, offset)+40, protocol.Version1)
+		require.NotNil(t, frame.Frame)
+		require.Equal(t, offset, frame.Frame.Offset)
+		require.Equal(t, data[offset:offset+40], frame.Frame.Data)
+		offset += 40
+		require.Equal(t, offset < protocol.ByteCount(len(data)), hasMore)
+	}
+}
+
+func TestSendStreamResetFinalSizeIncludesReservedData(t *testing.T) {
+	const streamID protocol.StreamID = 42
+
+	for _, tc := range []struct {
+		name  string
+		reset func(*SendStream)
+	}{
+		{
+			name:  "CancelWrite",
+			reset: func(str *SendStream) { str.CancelWrite(42) },
+		},
+		{
+			name: "STOP_SENDING",
+			reset: func(str *SendStream) {
+				str.handleStopSendingFrame(&wire.StopSendingFrame{StreamID: streamID, ErrorCode: 42})
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			mockCtrl := gomock.NewController(t)
+			mockFC := newTestStreamFlowControllerWithSendWindow(streamID, 100)
+			mockSender := NewMockStreamSender(mockCtrl)
+			str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+			mockSender.EXPECT().onHasStreamData(streamID, str)
+			require.NoError(t, str.TryWriteAll(make([]byte, 100)))
+
+			frame, _, hasMore := str.popStreamFrame(expectedFrameHeaderLen(streamID, 0)+40, protocol.Version1)
+			require.True(t, hasMore)
+			require.Equal(t, protocol.ByteCount(40), frame.Frame.DataLen())
+
+			mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+			tc.reset(str)
+			cf, ok, hasMore := str.getControlFrame(monotime.Now())
+			require.True(t, ok)
+			require.False(t, hasMore)
+			require.Equal(t, &wire.ResetStreamFrame{StreamID: streamID, FinalSize: 100, ErrorCode: 42}, cf.Frame)
+		})
+	}
+}
+
+func TestSendStreamSetReliableBoundaryAfterTryWriteAll(t *testing.T) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(streamID, 100)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, true)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	require.NoError(t, str.TryWriteAll(make([]byte, 100)))
+
+	frame, _, hasMore := str.popStreamFrame(expectedFrameHeaderLen(streamID, 0)+40, protocol.Version1)
+	require.True(t, hasMore)
+	require.Equal(t, protocol.ByteCount(40), frame.Frame.DataLen())
+
+	str.SetReliableBoundary()
+
+	mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+	str.CancelWrite(42)
+	cf, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.False(t, hasMore)
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: streamID, FinalSize: 100, ErrorCode: 42, ReliableSize: 100}, cf.Frame)
+
+	frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.False(t, hasMore)
+	require.Equal(t, protocol.ByteCount(40), frame.Frame.Offset)
+	require.Equal(t, protocol.ByteCount(60), frame.Frame.DataLen())
+}
+
+func TestSendStreamLargeWrites(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const streamID protocol.StreamID = 1337
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+		mockSender.EXPECT().onHasStreamData(streamID, str)
+		data := make([]byte, 5000)
+		rand.Read(data)
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write(data)
+			str.Close()
+			errChan <- err
+		}()
+
+		synctest.Wait()
+
+		var offset protocol.ByteCount
+		const size = 40
+		for offset+size < protocol.ByteCount(len(data))-protocol.MaxPacketBufferSize {
+			frame, _, hasMore := str.popStreamFrame(size+expectedFrameHeaderLen(streamID, offset), protocol.Version1)
+			require.NotNil(t, frame.Frame)
+			require.True(t, hasMore)
+			require.Equal(t, offset, frame.Frame.Offset)
+			require.Equal(t, data[offset:offset+size], frame.Frame.Data)
+			offset += size
+			require.True(t, mockCtrl.Satisfied())
+		}
+
+		// Write should still be blocked, since there's more than protocol.MaxPacketBufferSize left to send
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+		}
+
+		// empty frames are not sent
+		frame, _, hasMore := str.popStreamFrame(expectedFrameHeaderLen(streamID, offset), protocol.Version1)
+		require.Nil(t, frame.Frame)
+		require.True(t, hasMore)
+
+		mockSender.EXPECT().onHasStreamData(streamID, str) // from the Close call
+		frame, _, hasMore = str.popStreamFrame(size+expectedFrameHeaderLen(streamID, offset), protocol.Version1)
+		require.NotNil(t, frame.Frame)
+		require.True(t, hasMore)
+		require.Equal(t, data[offset:offset+size], frame.Frame.Data)
+		require.Equal(t, offset, frame.Frame.Offset)
+		offset += size
+
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("write should have returned")
+		}
+
+		frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.NotNil(t, frame.Frame)
+		require.False(t, hasMore)
+		require.Equal(t, data[offset:], frame.Frame.Data)
+		require.True(t, frame.Frame.Fin)
+	})
+}
+
+func TestSendStreamLargeWriteBlocking(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const streamID protocol.StreamID = 1337
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+		mockSender.EXPECT().onHasStreamData(streamID, str).Times(2)
+		_, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+		require.NoError(t, err)
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write(make([]byte, protocol.MaxPacketBufferSize))
+			errChan <- err
+		}()
+
+		synctest.Wait()
+
+		frame, _, hasMoreData := str.popStreamFrame(expectedFrameHeaderLen(streamID, 0)+3, protocol.Version1)
+		require.NotNil(t, frame.Frame)
+		require.True(t, hasMoreData)
+		require.Equal(t, []byte("foo"), frame.Frame.Data)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			t.Fatalf("write should not have returned yet: %v", err)
+		default:
+		}
+
+		frame, _, hasMoreData = str.popStreamFrame(expectedFrameHeaderLen(streamID, 3)+3, protocol.Version1)
+		require.NotNil(t, frame.Frame)
+		require.True(t, hasMoreData)
+		require.Equal(t, []byte("bar"), frame.Frame.Data)
+
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestSendStreamCopyData(t *testing.T) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+	strWithTimeout := &writerWithTimeout{Writer: str, Timeout: time.Second}
+
+	// for small writes
+	data := []byte("foobar")
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	_, err := strWithTimeout.Write(data)
+	require.NoError(t, err)
+	frame, _, _ := str.popStreamFrame(protocol.MaxPacketBufferSize, protocol.Version1)
+	data[1] = 'e' // modify the data after it has been written
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Data: []byte("foobar"), DataLenPresent: true},
+		frame.Frame,
+	)
+}
+
+func TestSendStreamDeadlineInThePast(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), 42, mockSender, mockFC, false)
+
+	// no data is written when the deadline is in the past
+	require.NoError(t, str.SetWriteDeadline(time.Now().Add(-time.Second)))
+	n, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+	require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+	require.Zero(t, n)
+	var nerr net.Error
+	require.ErrorAs(t, err, &nerr)
+	require.True(t, nerr.Timeout())
+
+	// data is written when the deadline is in the future
+	mockSender.EXPECT().onHasStreamData(gomock.Any(), str)
+	require.NoError(t, str.SetWriteDeadline(time.Now().Add(time.Second)))
+	n, err = (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.Equal(t, 6, n)
+}
+
+func TestSendStreamDeadlineRemoval(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), 42, mockSender, mockFC, false)
+
+		deadline := time.Second
+		require.NoError(t, str.SetWriteDeadline(time.Now().Add(deadline)))
+		mockSender.EXPECT().onHasStreamData(gomock.Any(), str).Times(2)
+
+		// small writes are written immediately
+		_, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+		require.NoError(t, err)
+
+		// large writes might block, and therefore subject to the deadline
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := (&writerWithTimeout{Writer: str, Timeout: 5 * time.Second}).Write(make([]byte, 2000))
+			errChan <- err
+		}()
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			t.Fatalf("write should not have returned yet: %v", err)
+		case <-time.After(deadline / 2):
+		}
+
+		// remove the deadline after a while (but before it expires)
+		require.NoError(t, str.SetWriteDeadline(time.Time{}))
+
+		select {
+		case err := <-errChan:
+			t.Fatalf("write should not have returned yet: %v", err)
+		case <-time.After(deadline):
+		}
+
+		// now set the deadline to the past to make Write return immediately
+		require.NoError(t, str.SetWriteDeadline(time.Now().Add(-time.Second)))
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+		default:
+		}
+
+		frame, _, hasMoreData := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.NotNil(t, frame.Frame)
+		require.False(t, hasMoreData)
+		require.Equal(t, []byte("foobar"), frame.Frame.Data)
+	})
+}
+
+func TestSendStreamDeadlineExtension(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), 42, mockSender, mockFC, false)
+
+		deadline := time.Minute
+		require.NoError(t, str.SetWriteDeadline(time.Now().Add(deadline)))
+
+		mockSender.EXPECT().onHasStreamData(gomock.Any(), str)
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := str.Write(make([]byte, 2000))
+			errChan <- err
+		}()
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			t.Fatalf("write should not have returned yet: %v", err)
+		case <-time.After(deadline / 2):
+		}
+
+		// extend the deadline
+		start := time.Now()
+		require.NoError(t, str.SetWriteDeadline(start.Add(deadline)))
+
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+			require.Equal(t, deadline, time.Since(start))
+		case <-time.After(deadline + time.Nanosecond):
+			t.Fatal("timeout")
+		}
+
+		frame, _, hasMoreData := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.Nil(t, frame.Frame)
+		require.False(t, hasMoreData)
+	})
+}
+
+func TestSendStreamClose(t *testing.T) {
+	const streamID protocol.StreamID = 1234
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+	strWithTimeout := &writerWithTimeout{Writer: str, Timeout: time.Second}
+
+	mockSender.EXPECT().onHasStreamData(streamID, str).Times(2)
+	_, err := strWithTimeout.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+
+	select {
+	case <-str.Context().Done():
+	default:
+		t.Fatal("stream context should have been canceled")
+	}
+
+	frame, _, hasMore := str.popStreamFrame(expectedFrameHeaderLen(streamID, 0)+3, protocol.Version1)
+	require.NotNil(t, frame.Frame)
+	require.True(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Offset: 0, Data: []byte("foo"), DataLenPresent: true}, // no FIN yet
+		frame.Frame,
+	)
+	frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.False(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Offset: 3, Fin: true, Data: []byte("bar"), DataLenPresent: true},
+		frame.Frame,
+	)
+	require.True(t, mockCtrl.Satisfied())
+
+	// further calls to Write return an error
+	_, err = strWithTimeout.Write([]byte("foobar"))
+	require.ErrorContains(t, err, "write on closed stream 1234")
+	require.ErrorContains(t, str.TryWriteAll([]byte("foobar")), "write on closed stream 1234")
+	frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, frame.Frame)
+	require.False(t, hasMore)
+
+	// further calls to Close don't do anything
+	require.NoError(t, str.Close())
+	frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, frame.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// shutting down has no effect
+	str.closeForShutdown(errors.New("goodbye"))
+	_, err = strWithTimeout.Write([]byte("foobar"))
+	require.ErrorContains(t, err, "write on closed stream 1234")
+}
+
+func TestSendStreamImmediateClose(t *testing.T) {
+	const streamID protocol.StreamID = 1337
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	require.NoError(t, str.Close())
+	frame, _, hasMore := str.popStreamFrame(expectedFrameHeaderLen(streamID, 13)+3, protocol.Version1)
+	require.False(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Fin: true, DataLenPresent: true},
+		frame.Frame,
+	)
+}
+
+func TestSendStreamFlowControlBlocked(t *testing.T) {
+	const streamID protocol.StreamID = 42
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, 3)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	_, err := str.Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	frame, blocked, hasMoreData := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.False(t, hasMoreData)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Data: []byte("foo"), DataLenPresent: true},
+		frame.Frame,
+	)
+	require.Equal(t, &wire.StreamDataBlockedFrame{StreamID: streamID, MaximumStreamData: 3}, blocked)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	str.updateSendWindow(10)
+	frame, blocked, hasMoreData = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Offset: 3, Data: []byte("bar"), DataLenPresent: true},
+		frame.Frame,
+	)
+	require.Nil(t, blocked)
+	require.False(t, hasMoreData)
+
+	_, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.False(t, ok)
+	require.False(t, hasMore)
+}
+
+func TestSendStreamCloseForShutdown(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const streamID protocol.StreamID = 1337
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+		strWithTimeout := &writerWithTimeout{Writer: str, Timeout: time.Second}
+
+		mockSender.EXPECT().onHasStreamData(streamID, str)
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := strWithTimeout.Write(bytes.Repeat([]byte("foobar"), 1000))
+			errChan <- err
+		}()
+
+		synctest.Wait()
+		str.closeForShutdown(assert.AnError)
+
+		synctest.Wait()
+		require.True(t, mockCtrl.Satisfied())
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, assert.AnError)
+		default:
+		}
+
+		select {
+		case <-str.Context().Done():
+			require.ErrorIs(t, context.Cause(str.Context()), assert.AnError)
+		default:
+			t.Fatal("context should be cancelled after closeForShutdown")
+		}
+
+		// STOP_SENDING frames are ignored
+		str.handleStopSendingFrame(&wire.StopSendingFrame{StreamID: streamID, ErrorCode: 1337})
+		_, ok, hasMore := str.getControlFrame(monotime.Now())
+		require.False(t, ok)
+		require.False(t, hasMore)
+
+		// future calls to Write should return the error
+		_, err := strWithTimeout.Write([]byte("foobar"))
+		require.ErrorIs(t, err, assert.AnError)
+
+		// closing the stream doesn't do anything
+		require.NoError(t, str.Close())
+
+		// no STREAM frames popped
+		frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.Nil(t, frame.Frame)
+		require.False(t, hasMore)
+
+		// canceling the stream doesn't do anything
+		str.CancelWrite(1234)
+		_, err = strWithTimeout.Write([]byte("foobar"))
+		require.ErrorIs(t, err, assert.AnError) // error unchanged
+	})
+}
+
+func TestSendStreamUpdateSendWindow(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, 41)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), 42, mockSender, mockFC, false)
+
+	mockSender.EXPECT().onHasStreamData(gomock.Any(), str)
+	_, err := str.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.True(t, mockCtrl.Satisfied())
+
+	// no calls to onHasStreamData if the window size wasn't increased
+	str.updateSendWindow(41)
+
+	mockSender.EXPECT().onHasStreamData(protocol.StreamID(42), str)
+	str.updateSendWindow(123)
+}
+
+func TestSendStreamCancellation(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const streamID protocol.StreamID = 42
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+		strWithTimeout := &writerWithTimeout{Writer: str, Timeout: time.Second}
+
+		mockSender.EXPECT().onHasStreamData(streamID, str)
+		_, err := strWithTimeout.Write([]byte("foobar"))
+		require.NoError(t, err)
+		frame, _, hasMore := str.popStreamFrame(3+expectedFrameHeaderLen(streamID, 0), protocol.Version1)
+		require.NotNil(t, frame.Frame)
+		require.True(t, hasMore)
+		require.Equal(t, []byte("foo"), frame.Frame.Data)
+		require.True(t, mockCtrl.Satisfied())
+
+		// The stream doesn't support RESET_STREAM_AT.
+		// Setting the reliable boundary has no effect.
+		str.SetReliableBoundary()
+
+		wrote := make(chan struct{})
+		mockSender.EXPECT().onHasStreamData(streamID, str).Do(func(protocol.StreamID, *SendStream) { close(wrote) })
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := strWithTimeout.Write(make([]byte, 2000))
+			errChan <- err
+		}()
+
+		synctest.Wait()
+
+		// cancel the stream
+		mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+		str.CancelWrite(1234)
+		require.True(t, mockCtrl.Satisfied())
+
+		cf, ok, hasMore := str.getControlFrame(monotime.Now())
+		require.True(t, ok)
+		// only the "foo" was sent out, so the final size is 3
+		require.Equal(t, &wire.ResetStreamFrame{StreamID: streamID, FinalSize: 3, ErrorCode: 1234}, cf.Frame)
+		require.False(t, hasMore)
+
+		// the context was canceled
+		select {
+		case <-str.Context().Done():
+		default:
+			t.Fatal("stream context should have been canceled")
+		}
+		require.ErrorIs(t, context.Cause(str.Context()), &StreamError{StreamID: streamID, ErrorCode: 1234, Remote: false})
+
+		// duplicate calls to CancelWrite don't do anything
+		str.CancelWrite(1234)
+		_, ok, _ = str.getControlFrame(monotime.Now())
+		require.False(t, ok)
+
+		synctest.Wait()
+
+		// the Write call should return an error
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1234, Remote: false})
+		default:
+			t.Fatal("write should have returned")
+		}
+
+		// no data to send
+		frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.Nil(t, frame.Frame)
+		require.False(t, hasMore)
+
+		// future calls to Write should return an error
+		_, err = strWithTimeout.Write([]byte("foo"))
+		require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1234, Remote: false})
+		err = str.TryWriteAll([]byte("foo"))
+		require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1234, Remote: false})
+		frame, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.Nil(t, frame.Frame)
+		require.False(t, hasMore)
+
+		// Close has no effect
+		require.ErrorContains(t, str.Close(), "close called for canceled stream")
+		frame, _, _ = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.Nil(t, frame.Frame)
+		_, err = strWithTimeout.Write([]byte("foobar"))
+		require.Error(t, err)
+		require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1234, Remote: false})
+
+		// shutting down has no effect
+		str.closeForShutdown(errors.New("goodbyte"))
+		_, err = strWithTimeout.Write([]byte("foobar"))
+		require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1234, Remote: false})
+	})
+}
+
+// It is possible to cancel a stream after it has been closed.
+// This is useful if the applications wants to prevent the retransmission of outstanding stream data.
+func TestSendStreamCancellationAfterClose(t *testing.T) {
+	const streamID protocol.StreamID = 1234
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+	strWithTimeout := &writerWithTimeout{Writer: str, Timeout: time.Second}
+
+	mockSender.EXPECT().onHasStreamData(streamID, str).Times(2)
+	_, err := strWithTimeout.Write([]byte("foobar"))
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+
+	mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+	str.CancelWrite(1337)
+
+	frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, frame.Frame)
+	require.False(t, hasMore)
+
+	cf, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: streamID, FinalSize: 0, ErrorCode: 1337}, cf.Frame)
+	require.False(t, hasMore)
+
+	_, err = strWithTimeout.Write([]byte("foobar"))
+	require.Error(t, err)
+	require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1337, Remote: false})
+}
+
+func TestSendStreamCancellationStreamRetransmission(t *testing.T) {
+	t.Run("local", func(t *testing.T) {
+		testSendStreamCancellationStreamRetransmission(t, false)
+	})
+	t.Run("remote", func(t *testing.T) {
+		testSendStreamCancellationStreamRetransmission(t, true)
+	})
+}
+
+func testSendStreamCancellationStreamRetransmission(t *testing.T, remote bool) {
+	const streamID protocol.StreamID = 1000
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	_, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	f1, _, hasMore := str.popStreamFrame(3+expectedFrameHeaderLen(streamID, 0), protocol.Version1)
+	require.NotNil(t, f1.Frame)
+	require.True(t, hasMore)
+	f2, _, hasMore := str.popStreamFrame(3+expectedFrameHeaderLen(streamID, 3), protocol.Version1)
+	require.NotNil(t, f2.Frame)
+	require.False(t, hasMore)
+
+	mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+	if remote {
+		str.handleStopSendingFrame(&wire.StopSendingFrame{StreamID: streamID, ErrorCode: 1337})
+	} else {
+		str.CancelWrite(1337)
+	}
+	cf, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.IsType(t, &wire.ResetStreamFrame{}, cf.Frame)
+	require.False(t, hasMore)
+
+	// it doesn't matter if the STREAM frames are acked or lost
+	f1.Handler.OnAcked(f1.Frame)
+	f2.Handler.OnLost(f2.Frame)
+	frame, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, frame.Frame)
+	require.False(t, hasMore)
+	// if CancelWrite was called, the stream is completed as soon as the RESET_STREAM frame is acked
+	if !remote {
+		mockSender.EXPECT().onStreamCompleted(streamID)
+	}
+	cf.Handler.OnAcked(cf.Frame)
+
+	// but if it's a remote cancellation, the application has to consume the error first
+	if remote {
+		mockSender.EXPECT().onStreamCompleted(streamID)
+		_, err := str.Write([]byte("foobar"))
+		require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1337, Remote: true})
+	}
+}
+
+func TestSendStreamCancellationResetStreamRetransmission(t *testing.T) {
+	const streamID protocol.StreamID = 1000
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+	str.CancelWrite(1337)
+
+	f1, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: streamID, FinalSize: 0, ErrorCode: 1337}, f1.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// lose the RESET_STREAM frame
+	mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+	f1.Handler.OnLost(f1.Frame)
+	// get the retransmission
+	f2, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: streamID, FinalSize: 0, ErrorCode: 1337}, f2.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// acknowledging the RESET_STREAM frame completes the stream
+	mockSender.EXPECT().onStreamCompleted(streamID)
+	f2.Handler.OnAcked(f2.Frame)
+}
+
+func TestSendStreamStopSendingAfterWrite(t *testing.T) {
+	t.Run("complete by Write", func(t *testing.T) {
+		testSendStreamStopSendingAfterWrite(t, "write")
+	})
+	t.Run("complete by Close", func(t *testing.T) {
+		testSendStreamStopSendingAfterWrite(t, "close")
+	})
+	t.Run("complete by CancelWrite", func(t *testing.T) {
+		testSendStreamStopSendingAfterWrite(t, "cancelwrite")
+	})
+}
+
+func testSendStreamStopSendingAfterWrite(t *testing.T, completeBy string) {
+	const streamID protocol.StreamID = 1000
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str).MaxTimes(2)
+	_, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+	require.NoError(t, err)
+	frame, _, _ := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.NotNil(t, frame.Frame)
+	require.True(t, mockCtrl.Satisfied())
+
+	mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+	str.handleStopSendingFrame(&wire.StopSendingFrame{StreamID: streamID, ErrorCode: 1337})
+
+	cf, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: streamID, FinalSize: 6, ErrorCode: 1337}, cf.Frame)
+	require.False(t, hasMore)
+
+	// acknowledging the RESET_STREAM frame doesn't complete the stream,
+	// since it was neither cancelled nor closed
+	cf.Handler.OnAcked(cf.Frame)
+	require.True(t, mockCtrl.Satisfied())
+
+	mockSender.EXPECT().onStreamCompleted(streamID)
+	switch completeBy {
+	case "write":
+		// calls to Write should return an error
+		_, err = (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+		require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1337, Remote: true})
+	case "close":
+		require.ErrorContains(t, str.Close(), "close called for canceled stream")
+	case "cancelwrite":
+		str.CancelWrite(1234)
+	}
+	// error code and remote flag are unchanged
+	_, err = (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+	require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1337, Remote: true})
+	frame, _, _ = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, frame.Frame)
+	_, ok, _ = str.getControlFrame(monotime.Now())
+	require.False(t, ok)
+}
+
+func TestSendStreamStopSendingDuringWrite(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const streamID protocol.StreamID = 1000
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+		mockSender.EXPECT().onHasStreamData(streamID, str).MaxTimes(2)
+		_, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+		require.NoError(t, err)
+		frame, _, _ := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.NotNil(t, frame.Frame)
+		require.True(t, mockCtrl.Satisfied())
+
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := str.Write(make([]byte, 2000))
+			errChan <- err
+		}()
+
+		mockSender.EXPECT().onHasStreamControlFrame(streamID, str)
+		str.handleStopSendingFrame(&wire.StopSendingFrame{StreamID: streamID, ErrorCode: 1337})
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1337, Remote: true})
+		default:
+			t.Fatal("write should have returned")
+		}
+
+		cf, ok, hasMore := str.getControlFrame(monotime.Now())
+		require.True(t, ok)
+		require.Equal(t, &wire.ResetStreamFrame{StreamID: streamID, FinalSize: 6, ErrorCode: 1337}, cf.Frame)
+		require.False(t, hasMore)
+
+		// receiving another STOP_SENDING frame has no effect
+		str.handleStopSendingFrame(&wire.StopSendingFrame{StreamID: streamID, ErrorCode: 1234})
+		_, ok, hasMore = str.getControlFrame(monotime.Now())
+		require.False(t, ok)
+		require.False(t, hasMore)
+
+		// acknowledging the RESET_STREAM frame completes the stream
+		mockSender.EXPECT().onStreamCompleted(streamID)
+		cf.Handler.OnAcked(cf.Frame)
+		require.True(t, mockCtrl.Satisfied())
+
+		// calls to Write should return an error
+		_, err = (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+		require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1337, Remote: true})
+		frame, _, _ = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.Nil(t, frame.Frame)
+
+		// calls to CancelWrite have no effect
+		str.CancelWrite(1234)
+		_, err = (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+		// error code and remote flag are unchanged
+		require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1337, Remote: true})
+		_, ok, _ = str.getControlFrame(monotime.Now())
+		require.False(t, ok)
+
+		// Close has no effect
+		require.ErrorContains(t, str.Close(), "close called for canceled stream")
+		frame, _, _ = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.Nil(t, frame.Frame)
+		_, err = (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+		require.Error(t, err)
+		require.ErrorIs(t, err, &StreamError{StreamID: streamID, ErrorCode: 1337, Remote: true})
+	})
+}
+
+// This test is inherently racy, as it tests a concurrent call to Write() and CancelRead().
+// A single successful run of this test therefore doesn't mean a lot,
+// for reliable results it has to be run many times.
+func TestSendStreamConcurrentWriteAndCancel(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const streamID protocol.StreamID = 1000
+		mockCtrl := gomock.NewController(t)
+		mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+		mockSender := NewMockStreamSender(mockCtrl)
+		str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+		mockSender.EXPECT().onHasStreamControlFrame(gomock.Any(), gomock.Any()).MaxTimes(1)
+		mockSender.EXPECT().onHasStreamData(streamID, str).MaxTimes(1)
+		mockSender.EXPECT().onStreamCompleted(streamID).MaxTimes(1)
+
+		errChan := make(chan error, 1)
+		go func() {
+			n, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write(make([]byte, 100))
+			if n == 0 {
+				errChan <- nil
+				return
+			}
+			errChan <- err
+		}()
+
+		done := make(chan struct{}, 2)
+		go func() {
+			str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+			done <- struct{}{}
+		}()
+		go func() {
+			str.CancelWrite(1234)
+			done <- struct{}{}
+		}()
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("write should have returned")
+		}
+
+		for range 2 {
+			select {
+			case <-done:
+			default:
+				t.Fatal("timeout waiting for cancel to complete")
+			}
+		}
+	})
+}
+
+func TestSendStreamRetransmissions(t *testing.T) {
+	const streamID protocol.StreamID = 1000
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	_, err := str.Write([]byte("foo"))
+	require.NoError(t, err)
+
+	f1, _, _ := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Data: []byte("foo"), DataLenPresent: true},
+		f1.Frame,
+	)
+	require.True(t, mockCtrl.Satisfied())
+
+	// write some more data
+	mockSender.EXPECT().onHasStreamData(streamID, str).Times(2)
+	_, err = (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("bar"))
+	require.NoError(t, err)
+	require.NoError(t, str.Close())
+	require.True(t, mockCtrl.Satisfied())
+
+	// lose the frame
+	mockSender.EXPECT().onHasStreamRetransmission(streamID, str)
+	f1.Handler.OnLost(f1.Frame)
+	require.True(t, mockCtrl.Satisfied())
+
+	// popping new data doesn't take queued retransmissions into account
+	f2, _, hasMoreData := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t, &wire.StreamFrame{StreamID: streamID, Offset: 3, Fin: true, Data: []byte("bar"), DataLenPresent: true}, f2.Frame)
+	require.False(t, hasMoreData)
+	require.True(t, mockCtrl.Satisfied())
+
+	// the retransmission queue independently returns the lost data
+	f3, hasMoreRetransmissions := str.popRetransmissionFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t, &wire.StreamFrame{StreamID: streamID, Data: []byte("foo"), DataLenPresent: true}, f3.Frame)
+	require.False(t, hasMoreRetransmissions)
+	require.True(t, mockCtrl.Satisfied())
+
+	// acknowledge the retransmission...
+	f3.Handler.OnAcked(f3.Frame)
+	// ... and the last frame, which concludes this stream
+	mockSender.EXPECT().onStreamCompleted(streamID)
+	f2.Handler.OnAcked(f2.Frame)
+}
+
+func TestSendStreamRetransmissionFraming(t *testing.T) {
+	const streamID protocol.StreamID = 1000
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str)
+	_, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	f, _, _ := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.NotNil(t, f.Frame)
+
+	// lose the frame
+	mockSender.EXPECT().onHasStreamRetransmission(streamID, str)
+	f.Handler.OnLost(f.Frame)
+
+	// retransmission doesn't fit
+	f, hasMore := str.popRetransmissionFrame(expectedFrameHeaderLen(streamID, 0), protocol.Version1)
+	require.Nil(t, f.Frame)
+	require.True(t, hasMore)
+
+	// split the retransmission
+	r1, hasMore := str.popRetransmissionFrame(expectedFrameHeaderLen(streamID, 0)+3, protocol.Version1)
+	require.True(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Data: []byte("foo"), DataLenPresent: true},
+		r1.Frame,
+	)
+	r2, hasMore := str.popRetransmissionFrame(expectedFrameHeaderLen(streamID, 3)+3, protocol.Version1)
+	require.False(t, hasMore)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: streamID, Offset: 3, Data: []byte("bar"), DataLenPresent: true},
+		r2.Frame,
+	)
+	_, hasMore = str.popRetransmissionFrame(expectedFrameHeaderLen(streamID, 3)+3, protocol.Version1)
+	require.False(t, hasMore)
+}
+
+// This test is kind of an integration test.
+// It writes 4 MB of data, and pops STREAM frames that sometimes are and sometimes aren't limited by flow control.
+// Half of these STREAM frames are then received and their content saved, while the other half is reported lost
+// and has to be retransmitted.
+func TestSendStreamRetransmitDataUntilAcknowledged(t *testing.T) {
+	const streamID protocol.StreamID = 123456
+	const dataLen = 1 << 22 // 4 MB
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	mockFC := newTestStreamFlowControllerWithSendWindow(streamID, protocol.MaxByteCount)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, false)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str).AnyTimes()
+	mockSender.EXPECT().onHasStreamRetransmission(streamID, str).AnyTimes()
+
+	data := make([]byte, dataLen)
+	_, err := rand.Read(data)
+	require.NoError(t, err)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		_, err := str.Write(data)
+		require.NoError(t, err)
+		str.Close()
+	}()
+
+	var completed bool
+	mockSender.EXPECT().onStreamCompleted(streamID).Do(func(protocol.StreamID) { completed = true })
+
+	received := make([]byte, dataLen)
+	var counter int
+	frameQueue := make([]ackhandler.StreamFrame, 0, 32)
+	for !completed || len(frameQueue) > 0 {
+		counter++
+		if counter > 1e6 {
+			t.Fatal("stream should have completed")
+		}
+		maxSize := protocol.ByteCount(mrand.IntN(300) + 100)
+		f, hasMoreRetransmissions := str.popRetransmissionFrame(maxSize, protocol.Version1)
+		if f.Frame == nil && !hasMoreRetransmissions {
+			f, _, _ = str.popStreamFrame(maxSize, protocol.Version1)
+		}
+		var dequeuedFrame bool
+		if f.Frame != nil {
+			frameQueue = append(frameQueue, f)
+			dequeuedFrame = true
+		}
+
+		// Process one of the queued frames at random.
+		// This simulates potential reordering.
+		if len(frameQueue) > 0 && (!dequeuedFrame || len(frameQueue) == cap(frameQueue)) {
+			idx := mrand.IntN(len(frameQueue))
+			f := frameQueue[idx]
+			// 50%: acknowledge the frame and save the data
+			// 50%: lose the frame
+			if mrand.Int()%2 == 0 {
+				copy(received[f.Frame.Offset:f.Frame.Offset+f.Frame.DataLen()], f.Frame.Data)
+				f.Handler.OnAcked(f.Frame)
+			} else {
+				f.Handler.OnLost(f.Frame)
+			}
+			frameQueue = slices.Delete(frameQueue, idx, idx+1)
+		}
+		runtime.Gosched()
+	}
+	require.Equal(t, data, received)
+}
+
+func TestSendStreamResetStreamAtCancelBeforeSend(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), 1337, mockSender, mockFC, true)
+
+	mockSender.EXPECT().onHasStreamData(protocol.StreamID(1337), str).Times(2)
+	_, err := str.Write([]byte("foobar"))
+	require.NoError(t, err)
+	str.SetReliableBoundary()
+	_, err = str.Write([]byte("baz"))
+	require.NoError(t, err)
+
+	mockSender.EXPECT().onHasStreamControlFrame(protocol.StreamID(1337), str)
+	str.CancelWrite(1337)
+	cf, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: 1337, FinalSize: 6, ErrorCode: 1337, ReliableSize: 6}, cf.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	f, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Data: []byte("foobar"), DataLenPresent: true},
+		f.Frame,
+	)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// Lose the frame.
+	// Since it's before the reliable size, we should get a retransmission.
+	mockSender.EXPECT().onHasStreamRetransmission(protocol.StreamID(1337), str)
+	f.Handler.OnLost(f.Frame)
+	require.True(t, mockCtrl.Satisfied())
+
+	retransmission, hasMore := str.popRetransmissionFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Data: []byte("foobar"), DataLenPresent: true},
+		retransmission.Frame,
+	)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+	f, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, f.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// acknowledging the RESET_STREAM_AT and the retransmission completes the stream
+	cf.Handler.OnAcked(cf.Frame)
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(1337))
+	retransmission.Handler.OnAcked(retransmission.Frame)
+}
+
+func TestSendStreamResetStreamAtCancelAfterSend(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), 1337, mockSender, mockFC, true)
+
+	mockSender.EXPECT().onHasStreamData(protocol.StreamID(1337), str).Times(2)
+	_, err := str.Write([]byte("foobar"))
+	require.NoError(t, err)
+	str.SetReliableBoundary()
+	_, err = str.Write([]byte("baz"))
+	require.NoError(t, err)
+
+	f, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Data: []byte("foobarbaz"), DataLenPresent: true},
+		f.Frame,
+	)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	mockSender.EXPECT().onHasStreamControlFrame(protocol.StreamID(1337), str)
+	str.CancelWrite(42)
+	cf, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: 1337, FinalSize: 9, ErrorCode: 42, ReliableSize: 6}, cf.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	cf.Handler.OnAcked(cf.Frame)
+	// lose the STREAM frame
+	mockSender.EXPECT().onHasStreamRetransmission(protocol.StreamID(1337), str)
+	f.Handler.OnLost(f.Frame)
+	// only the first 6 bytes need to be retransmitted
+	retransmission1, hasMore := str.popRetransmissionFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Data: []byte("foobar"), DataLenPresent: true},
+		retransmission1.Frame,
+	)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+	f, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, f.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// lose the retransmission as well
+	mockSender.EXPECT().onHasStreamRetransmission(protocol.StreamID(1337), str)
+	retransmission1.Handler.OnLost(retransmission1.Frame)
+	retransmission2, hasMore := str.popRetransmissionFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Data: []byte("foobar"), DataLenPresent: true},
+		retransmission2.Frame,
+	)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+	f, _, hasMore = str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, f.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// acknowledge the 2nd retransmission
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(1337))
+	retransmission2.Handler.OnAcked(retransmission2.Frame)
+}
+
+func TestSendStreamResetStreamAtRetransmissions(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), 1337, mockSender, mockFC, true)
+
+	// f1: lorem
+	// f2: ipsumdolor (reliable offset: right after the "ipsum")
+	// f3: sit
+	// f4: amet
+	// sitting in the write buffer: consectetur (but not popped)
+	mockSender.EXPECT().onHasStreamData(protocol.StreamID(1337), str).AnyTimes()
+	mockSender.EXPECT().onHasStreamRetransmission(protocol.StreamID(1337), str)
+	_, err := str.Write([]byte("lorem"))
+	require.NoError(t, err)
+	f1, _, _ := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Data: []byte("lorem"), DataLenPresent: true},
+		f1.Frame,
+	)
+	_, err = str.Write([]byte("ipsum"))
+	require.NoError(t, err)
+	str.SetReliableBoundary()
+	_, err = str.Write([]byte("dolor"))
+	require.NoError(t, err)
+	f2, _, _ := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Offset: 5, Data: []byte("ipsumdolor"), DataLenPresent: true},
+		f2.Frame,
+	)
+	_, err = str.Write([]byte("sit"))
+	require.NoError(t, err)
+	f3, _, _ := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Offset: 15, Data: []byte("sit"), DataLenPresent: true},
+		f3.Frame,
+	)
+	_, err = str.Write([]byte("amet"))
+	require.NoError(t, err)
+	f4, _, _ := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Offset: 18, Data: []byte("amet"), DataLenPresent: true},
+		f4.Frame,
+	)
+	_, err = str.Write([]byte("consectetur"))
+	require.NoError(t, err)
+
+	// lose the frames, in no particular order
+	f2.Handler.OnLost(f2.Frame)
+	f1.Handler.OnLost(f1.Frame)
+	f3.Handler.OnLost(f3.Frame)
+	// f4 is lost at a later point
+
+	// Now cancel the stream.
+	// We expect f1 and the first half of f2 to be retransmitted,
+	// but f3 and the data in the buffer should not.
+	mockSender.EXPECT().onHasStreamControlFrame(protocol.StreamID(1337), str)
+	str.CancelWrite(42)
+	cf, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: 1337, FinalSize: 22, ErrorCode: 42, ReliableSize: 10}, cf.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+	cf.Handler.OnAcked(cf.Frame)
+
+	// // the retransmission of f1 should be truncated to 6 bytes
+	r1, hasMore := str.popRetransmissionFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Offset: 5, Data: []byte("ipsum"), DataLenPresent: true},
+		r1.Frame,
+	)
+	require.True(t, hasMore)
+	r2, hasMore := str.popRetransmissionFrame(protocol.MaxByteCount, protocol.Version1)
+	require.EqualExportedValues(t,
+		&wire.StreamFrame{StreamID: 1337, Data: []byte("lorem"), DataLenPresent: true},
+		r2.Frame,
+	)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+	r3, hasMore := str.popRetransmissionFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Nil(t, r3.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	r1.Handler.OnAcked(r1.Frame)
+	r2.Handler.OnAcked(r2.Frame)
+	require.True(t, mockCtrl.Satisfied())
+
+	// the stream is only completed once f4 is lost
+	// it's beyond the reliable size, so it's not retransmitted
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(1337))
+	f4.Handler.OnLost(f4.Frame)
+}
+
+func TestSendStreamResetStreamAtStopSendingBeforeCancelation(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), 1337, mockSender, mockFC, true)
+
+	mockSender.EXPECT().onHasStreamData(protocol.StreamID(1337), str).Times(2)
+	_, err := str.Write([]byte("foobar"))
+	require.NoError(t, err)
+	str.SetReliableBoundary()
+	_, err = str.Write([]byte("baz"))
+	require.NoError(t, err)
+
+	// send out a STREAM frame with all the data written so far
+	f, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Equal(t, protocol.ByteCount(9), f.Frame.DataLen())
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	mockSender.EXPECT().onHasStreamControlFrame(protocol.StreamID(1337), str)
+	str.handleStopSendingFrame(&wire.StopSendingFrame{StreamID: 1337, ErrorCode: 42})
+	cf, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	// Since the peer reset the stream, the resulting RESET_STREAM frame has a reliable size of 0
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: 1337, FinalSize: 9, ErrorCode: 42, ReliableSize: 0}, cf.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// calling CancelWrite doesn't cause any more frames to be enqueued
+	str.CancelWrite(1234)
+
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(1337))
+	cf.Handler.OnAcked(cf.Frame)
+}
+
+func TestSendStreamResetStreamAtStopSendingAfterCancelation(t *testing.T) {
+	t.Run("RESET_STREAM_AT lost", func(t *testing.T) {
+		testSendStreamResetStreamAtStopSendingAfterCancelation(t, true)
+	})
+	t.Run("RESET_STREAM_AT acknowledged", func(t *testing.T) {
+		testSendStreamResetStreamAtStopSendingAfterCancelation(t, false)
+	})
+}
+
+func testSendStreamResetStreamAtStopSendingAfterCancelation(t *testing.T, loseResetStreamAt bool) {
+	mockCtrl := gomock.NewController(t)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	mockSender := NewMockStreamSender(mockCtrl)
+	str := newSendStream(context.Background(), 1337, mockSender, mockFC, true)
+
+	mockSender.EXPECT().onHasStreamData(protocol.StreamID(1337), str).Times(2)
+	_, err := str.Write([]byte("foobar"))
+	require.NoError(t, err)
+	str.SetReliableBoundary()
+	_, err = str.Write([]byte("baz"))
+	require.NoError(t, err)
+
+	// send out a STREAM frame with all the data written so far
+	f, _, hasMore := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+	require.Equal(t, protocol.ByteCount(9), f.Frame.DataLen())
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	// Canceling the stream results in a RESET_STREAM_AT frame.
+	mockSender.EXPECT().onHasStreamControlFrame(protocol.StreamID(1337), str)
+	str.CancelWrite(42)
+	cf1, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: 1337, FinalSize: 9, ErrorCode: 42, ReliableSize: 6}, cf1.Frame)
+	require.False(t, hasMore)
+
+	// Receiving a STOP_SENDING frame results in a RESET_STREAM frame,
+	// effectively reducing the reliable size to 0.
+	mockSender.EXPECT().onHasStreamControlFrame(protocol.StreamID(1337), str)
+	str.handleStopSendingFrame(&wire.StopSendingFrame{StreamID: 1337, ErrorCode: 1234})
+	cf2, ok, hasMore := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	// Since the peer reset the stream, the resulting RESET_STREAM frame has a reliable size of 0.
+	// The error code is still the one used for the CancelWrite call.
+	require.Equal(t, &wire.ResetStreamFrame{StreamID: 1337, FinalSize: 9, ErrorCode: 42, ReliableSize: 0}, cf2.Frame)
+	require.False(t, hasMore)
+	require.True(t, mockCtrl.Satisfied())
+
+	if loseResetStreamAt {
+		// losing the RESET_STREAM_AT frame does nothing
+		cf1.Handler.OnLost(cf1.Frame)
+	} else {
+		// receiving an acknowledgment for the RESET_STREAM_AT frame does nothing either:
+		// the RESET_STREAM frame still needs to be transmitted reliably
+		cf1.Handler.OnAcked(cf1.Frame)
+	}
+	_, ok, _ = str.getControlFrame(monotime.Now())
+	require.False(t, ok)
+
+	// but when the RESET_STREAM frame is lost, it needs to be retransmitted
+	mockSender.EXPECT().onHasStreamControlFrame(protocol.StreamID(1337), str)
+	cf2.Handler.OnLost(cf2.Frame)
+	cf3, ok, _ := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	require.Equal(t, cf2, cf3)
+
+	mockSender.EXPECT().onStreamCompleted(protocol.StreamID(1337))
+	cf3.Handler.OnAcked(cf3.Frame)
+}
+
+func TestSendStreamResetStreamAtRandomized(t *testing.T) {
+	const streamID protocol.StreamID = 123456
+	const dataLen = 8 << 10
+	reliableOffset := 1 + mrand.IntN(dataLen*3/4)
+	t.Logf("reliable offset: %d", reliableOffset)
+
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	mockFC := newTestStreamFlowControllerWithSendWindow(42, protocol.MaxByteCount)
+	str := newSendStream(context.Background(), streamID, mockSender, mockFC, true)
+
+	mockSender.EXPECT().onHasStreamData(streamID, str).AnyTimes()
+	mockSender.EXPECT().onHasStreamRetransmission(streamID, str).AnyTimes()
+	mockSender.EXPECT().onHasStreamControlFrame(streamID, str).AnyTimes()
+
+	data := make([]byte, dataLen)
+	_, err := rand.Read(data)
+	require.NoError(t, err)
+	errChan := make(chan error, 1)
+	go func() {
+		b := data
+		var offset int
+		for len(b) > 0 {
+			m := mrand.IntN(1024)
+			if offset < reliableOffset {
+				m = min(m, reliableOffset-offset)
+			}
+			n, err := str.Write(b[:min(m, len(b))])
+			if err != nil {
+				errChan <- err
+				return
+			}
+			offset += n
+			if offset <= reliableOffset {
+				str.SetReliableBoundary()
+			}
+			b = b[n:]
+		}
+		str.CancelWrite(1234)
+		errChan <- nil
+	}()
+
+	var completed bool
+	mockSender.EXPECT().onStreamCompleted(streamID).Do(func(protocol.StreamID) { completed = true })
+
+	received := make([]byte, dataLen)
+	var highestOffset int
+	var receivedResetStreamAt bool
+	var counter int
+	frameQueue := make([]any, 0, 10)
+	for !completed || len(frameQueue) > 0 {
+		counter++
+		if counter > 1e6 {
+			t.Fatal("stream should have completed")
+		}
+		var dequeuedFrame bool
+		cf, ok, _ := str.getControlFrame(monotime.Now())
+		if ok {
+			dequeuedFrame = true
+			frameQueue = append(frameQueue, cf)
+			receivedResetStreamAt = true
+			require.Equal(t, protocol.ByteCount(reliableOffset), cf.Frame.(*wire.ResetStreamFrame).ReliableSize)
+		} else {
+			maxSize := protocol.ByteCount(mrand.IntN(300) + 100)
+			f, hasMoreRetransmissions := str.popRetransmissionFrame(maxSize, protocol.Version1)
+			if f.Frame == nil && !hasMoreRetransmissions {
+				f, _, _ = str.popStreamFrame(maxSize, protocol.Version1)
+			}
+			if f.Frame != nil {
+				// make sure that only retransmissions are sent once the RESET_STREAM_AT frame is sent
+				if receivedResetStreamAt {
+					require.LessOrEqualf(t,
+						f.Frame.Offset+f.Frame.DataLen(),
+						protocol.ByteCount(reliableOffset),
+						"STREAM frame past reliable offset after RESET_STREAM_AT (offset: %d, data length: %d)",
+						f.Frame.Offset, f.Frame.DataLen(),
+					)
+				}
+				dequeuedFrame = true
+				frameQueue = append(frameQueue, f)
+			}
+		}
+
+		if len(frameQueue) > 0 && (!dequeuedFrame || len(frameQueue) == cap(frameQueue)) {
+			idx := mrand.IntN(len(frameQueue))
+			switch f := frameQueue[idx].(type) {
+			case ackhandler.Frame:
+				// 50%: acknowledge the frame
+				// 50%: lose the frame
+				if mrand.Int()%2 == 0 {
+					f.Handler.OnLost(f.Frame)
+				} else {
+					f.Handler.OnAcked(f.Frame)
+				}
+			case ackhandler.StreamFrame:
+				sf := f.Frame
+				// 50%: acknowledge the frame and save the data
+				// 50%: lose the frame
+				if mrand.Int()%2 == 0 {
+					f.Handler.OnLost(f.Frame)
+				} else {
+					highestOffset = max(highestOffset, int(sf.Offset+sf.DataLen()))
+					copy(received[sf.Offset:sf.Offset+sf.DataLen()], sf.Data)
+					f.Handler.OnAcked(f.Frame)
+				}
+			default:
+				t.Fatalf("unexpected frame type: %T", f)
+			}
+			frameQueue = slices.Delete(frameQueue, idx, idx+1)
+		}
+		runtime.Gosched()
+	}
+
+	t.Logf("highest received offset: %d", highestOffset)
+	require.GreaterOrEqual(t, highestOffset, reliableOffset)
+	require.Equal(t, data[:reliableOffset], received[:reliableOffset])
+}
diff --git a/electron/native/private-transport/third_party/quic-go/server.go b/electron/native/private-transport/third_party/quic-go/server.go
new file mode 100644
index 000000000..4a4dde250
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/server.go
@@ -0,0 +1,1120 @@
+package quic
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+// ErrServerClosed is returned by [Listener.Accept] or [EarlyListener.Accept]
+// after [Listener.Close] or [EarlyListener.Close] is called, respectively.
+var ErrServerClosed = errServerClosed{}
+
+type errServerClosed struct{}
+
+func (errServerClosed) Error() string { return "quic: server closed" }
+func (errServerClosed) Unwrap() error { return net.ErrClosed }
+
+// packetHandler handles packets
+type packetHandler interface {
+	handlePacket(receivedPacket)
+	destroy(error)
+	closeWithTransportError(qerr.TransportErrorCode)
+}
+
+type zeroRTTQueue struct {
+	packets    []receivedPacket
+	expiration monotime.Time
+}
+
+type rejectedPacket struct {
+	receivedPacket
+	hdr *wire.Header
+}
+
+// A Listener of QUIC
+type baseServer struct {
+	tr                        *packetHandlerMap
+	disableVersionNegotiation bool
+	acceptEarlyConns          bool
+
+	tlsConf *tls.Config
+	config  *Config
+
+	conn rawConn
+
+	tokenGenerator *handshake.TokenGenerator
+	maxTokenAge    time.Duration
+
+	connIDGenerator   ConnectionIDGenerator
+	statelessResetter *statelessResetter
+	onClose           func()
+
+	receivedPackets chan receivedPacket
+
+	nextZeroRTTCleanup monotime.Time
+	zeroRTTQueues      map[protocol.ConnectionID]*zeroRTTQueue // only initialized if acceptEarlyConns == true
+
+	connContext func(context.Context, *ClientInfo) (context.Context, error)
+
+	// set as a member, so they can be set in the tests
+	newConn func(
+		context.Context,
+		context.CancelCauseFunc,
+		sendConn,
+		connRunner,
+		protocol.ConnectionID, /* original dest connection ID */
+		*protocol.ConnectionID, /* retry src connection ID */
+		protocol.ConnectionID, /* client dest connection ID */
+		protocol.ConnectionID, /* destination connection ID */
+		protocol.ConnectionID, /* source connection ID */
+		ConnectionIDGenerator,
+		*statelessResetter,
+		*Config,
+		*tls.Config,
+		*handshake.TokenGenerator,
+		bool, /* client address validated by an address validation token */
+		time.Duration,
+		qlogwriter.Trace,
+		utils.Logger,
+		protocol.Version,
+	) *wrappedConn
+
+	closeMx sync.Mutex
+	// errorChan is closed when Close is called. This has two effects:
+	// 1. it cancels handshakes that are still in flight (using CONNECTION_REFUSED) errors
+	// 2. it stops handling of packets passed to this server
+	errorChan chan struct{}
+	// acceptChan is closed when Close returns.
+	// This only happens once all handshake in flight have either completed and canceled.
+	// Calls to Accept will first drain the queue of connections that have completed the handshake,
+	// and then return ErrServerClosed.
+	stopAccepting chan struct{}
+	closeErr      error
+	running       chan struct{} // closed as soon as run() returns
+
+	versionNegotiationQueue chan receivedPacket
+	invalidTokenQueue       chan rejectedPacket
+	connectionRefusedQueue  chan rejectedPacket
+	retryQueue              chan rejectedPacket
+	handshakingCount        sync.WaitGroup
+
+	verifySourceAddress func(net.Addr) bool
+
+	connQueue chan *Conn
+
+	qlogger qlogwriter.Recorder
+
+	logger utils.Logger
+}
+
+// A Listener listens for incoming QUIC connections.
+// It returns connections once the handshake has completed.
+type Listener struct {
+	baseServer *baseServer
+}
+
+// Accept returns new connections. It should be called in a loop.
+func (l *Listener) Accept(ctx context.Context) (*Conn, error) {
+	return l.baseServer.Accept(ctx)
+}
+
+// Close closes the listener.
+// [Listener.Accept] will return [ErrServerClosed] as soon as all connections in the accept queue have been accepted.
+// QUIC handshakes that are still in flight will be rejected with a CONNECTION_REFUSED error.
+// Already established (accepted) connections will be unaffected.
+func (l *Listener) Close() error {
+	return l.baseServer.Close()
+}
+
+// Addr returns the local network address that the server is listening on.
+func (l *Listener) Addr() net.Addr {
+	return l.baseServer.Addr()
+}
+
+// An EarlyListener listens for incoming QUIC connections, and returns them before the handshake completes.
+// For connections that don't use 0-RTT, this allows the server to send 0.5-RTT data.
+// This data is encrypted with forward-secure keys, however, the client's identity has not yet been verified.
+// For connection using 0-RTT, this allows the server to accept and respond to streams that the client opened in the
+// 0-RTT data it sent. Note that at this point during the handshake, the live-ness of the
+// client has not yet been confirmed, and the 0-RTT data could have been replayed by an attacker.
+type EarlyListener struct {
+	baseServer *baseServer
+}
+
+// Accept returns a new connections. It should be called in a loop.
+func (l *EarlyListener) Accept(ctx context.Context) (*Conn, error) {
+	conn, err := l.baseServer.accept(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return conn, nil
+}
+
+// Close closes the listener.
+// [EarlyListener.Accept] will return [ErrServerClosed] as soon as all connections in the accept queue have been accepted.
+// Early connections that are still in flight will be rejected with a CONNECTION_REFUSED error.
+// Already established (accepted) connections will be unaffected.
+func (l *EarlyListener) Close() error {
+	return l.baseServer.Close()
+}
+
+// Addr returns the local network addr that the server is listening on.
+func (l *EarlyListener) Addr() net.Addr {
+	return l.baseServer.Addr()
+}
+
+// ListenAddr creates a QUIC server listening on a given address.
+// See [Listen] for more details.
+func ListenAddr(addr string, tlsConf *tls.Config, config *Config) (*Listener, error) {
+	conn, err := listenUDP(addr)
+	if err != nil {
+		return nil, err
+	}
+	return (&Transport{
+		Conn:        conn,
+		createdConn: true,
+		isSingleUse: true,
+	}).Listen(tlsConf, config)
+}
+
+// ListenAddrEarly works like [ListenAddr], but it returns connections before the handshake completes.
+func ListenAddrEarly(addr string, tlsConf *tls.Config, config *Config) (*EarlyListener, error) {
+	conn, err := listenUDP(addr)
+	if err != nil {
+		return nil, err
+	}
+	return (&Transport{
+		Conn:        conn,
+		createdConn: true,
+		isSingleUse: true,
+	}).ListenEarly(tlsConf, config)
+}
+
+func listenUDP(addr string) (*net.UDPConn, error) {
+	udpAddr, err := net.ResolveUDPAddr("udp", addr)
+	if err != nil {
+		return nil, err
+	}
+	return net.ListenUDP("udp", udpAddr)
+}
+
+// Listen listens for QUIC connections on a given [net.PacketConn].
+// If the PacketConn satisfies the [OOBCapablePacketConn] interface (as a [net.UDPConn] does),
+// ECN and packet info support will be enabled. In this case, packets will be read in batches,
+// and [OOBCapablePacketConn.WriteMsgUDP] will be used instead of [net.PacketConn.WriteTo].
+// A single [net.PacketConn] can only be used for a single call to Listen.
+//
+// The [tls.Config] must not be nil and must contain a certificate configuration.
+// Furthermore, it must define an application protocol using [tls.Config.NextProtos].
+// The [Config] may be nil, in which case the default values will be used.
+//
+// This is a convenience function. More advanced use cases should instantiate a [Transport],
+// which offers configuration options for a more fine-grained control of the connection establishment,
+// including reusing the underlying UDP socket for outgoing QUIC connections.
+// When closing a listener created with Listen, all established QUIC connections will be closed immediately.
+func Listen(conn net.PacketConn, tlsConf *tls.Config, config *Config) (*Listener, error) {
+	tr := &Transport{Conn: conn, isSingleUse: true}
+	return tr.Listen(tlsConf, config)
+}
+
+// ListenEarly works like [Listen], but it returns connections before the handshake completes.
+func ListenEarly(conn net.PacketConn, tlsConf *tls.Config, config *Config) (*EarlyListener, error) {
+	tr := &Transport{Conn: conn, isSingleUse: true}
+	return tr.ListenEarly(tlsConf, config)
+}
+
+func newServer(
+	conn rawConn,
+	tr *packetHandlerMap,
+	connIDGenerator ConnectionIDGenerator,
+	statelessResetter *statelessResetter,
+	connContext func(context.Context, *ClientInfo) (context.Context, error),
+	tlsConf *tls.Config,
+	config *Config,
+	qlogger qlogwriter.Recorder,
+	onClose func(),
+	tokenGeneratorKey TokenGeneratorKey,
+	maxTokenAge time.Duration,
+	verifySourceAddress func(net.Addr) bool,
+	disableVersionNegotiation bool,
+	acceptEarly bool,
+) *baseServer {
+	s := &baseServer{
+		conn:                      conn,
+		connContext:               connContext,
+		tr:                        tr,
+		tlsConf:                   tlsConf,
+		config:                    config,
+		tokenGenerator:            handshake.NewTokenGenerator(tokenGeneratorKey),
+		maxTokenAge:               maxTokenAge,
+		verifySourceAddress:       verifySourceAddress,
+		connIDGenerator:           connIDGenerator,
+		statelessResetter:         statelessResetter,
+		connQueue:                 make(chan *Conn, protocol.MaxAcceptQueueSize),
+		errorChan:                 make(chan struct{}),
+		stopAccepting:             make(chan struct{}),
+		running:                   make(chan struct{}),
+		receivedPackets:           make(chan receivedPacket, protocol.MaxServerUnprocessedPackets),
+		versionNegotiationQueue:   make(chan receivedPacket, 4),
+		invalidTokenQueue:         make(chan rejectedPacket, 4),
+		connectionRefusedQueue:    make(chan rejectedPacket, 4),
+		retryQueue:                make(chan rejectedPacket, 8),
+		newConn:                   newConnection,
+		qlogger:                   qlogger,
+		logger:                    utils.DefaultLogger.WithPrefix("server"),
+		acceptEarlyConns:          acceptEarly,
+		disableVersionNegotiation: disableVersionNegotiation,
+		onClose:                   onClose,
+	}
+	if acceptEarly {
+		s.zeroRTTQueues = map[protocol.ConnectionID]*zeroRTTQueue{}
+	}
+	go s.run()
+	go s.runSendQueue()
+	s.logger.Debugf("Listening for %s connections on %s", conn.LocalAddr().Network(), conn.LocalAddr().String())
+	return s
+}
+
+func (s *baseServer) run() {
+	defer close(s.running)
+	for {
+		select {
+		case <-s.errorChan:
+			return
+		default:
+		}
+		select {
+		case <-s.errorChan:
+			return
+		case p := <-s.receivedPackets:
+			if bufferStillInUse := s.handlePacketImpl(p); !bufferStillInUse {
+				p.buffer.Release()
+			}
+		}
+	}
+}
+
+func (s *baseServer) runSendQueue() {
+	for {
+		select {
+		case <-s.running:
+			return
+		case p := <-s.versionNegotiationQueue:
+			s.maybeSendVersionNegotiationPacket(p)
+		case p := <-s.invalidTokenQueue:
+			s.maybeSendInvalidToken(p)
+		case p := <-s.connectionRefusedQueue:
+			s.sendConnectionRefused(p)
+		case p := <-s.retryQueue:
+			s.sendRetry(p)
+		}
+	}
+}
+
+// Accept returns connections that already completed the handshake.
+// It is only valid if acceptEarlyConns is false.
+func (s *baseServer) Accept(ctx context.Context) (*Conn, error) {
+	return s.accept(ctx)
+}
+
+func (s *baseServer) accept(ctx context.Context) (*Conn, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case conn := <-s.connQueue:
+		return conn, nil
+	case <-s.stopAccepting:
+		// first drain the queue
+		select {
+		case conn := <-s.connQueue:
+			return conn, nil
+		default:
+		}
+		return nil, s.closeErr
+	}
+}
+
+func (s *baseServer) Close() error {
+	s.close(ErrServerClosed, false)
+	return nil
+}
+
+// close closes the server. The Transport mutex must not be held while calling this method.
+// This method closes any handshaking connections which requires the tranpsort mutex.
+func (s *baseServer) close(e error, transportClose bool) {
+	s.closeMx.Lock()
+	if s.closeErr != nil {
+		s.closeMx.Unlock()
+		return
+	}
+	s.closeErr = e
+	close(s.errorChan)
+	<-s.running
+	s.closeMx.Unlock()
+
+	if !transportClose {
+		s.onClose()
+	}
+
+	// wait until all handshakes in flight have terminated
+	s.handshakingCount.Wait()
+	close(s.stopAccepting)
+
+	if transportClose {
+		// if the transport is closing, drain the connQueue. All connections in the queue
+		// will be closed by the transport.
+		for {
+			select {
+			case <-s.connQueue:
+			default:
+				return
+			}
+		}
+	}
+}
+
+// Addr returns the server's network address
+func (s *baseServer) Addr() net.Addr {
+	return s.conn.LocalAddr()
+}
+
+func (s *baseServer) handlePacket(p receivedPacket) {
+	select {
+	case s.receivedPackets <- p:
+	case <-s.errorChan:
+		return
+	default:
+		s.logger.Debugf("Dropping packet from %s (%d bytes). Server receive queue full.", p.remoteAddr, p.Size())
+		if s.qlogger != nil {
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropDOSPrevention,
+			})
+		}
+	}
+}
+
+func (s *baseServer) handlePacketImpl(p receivedPacket) bool /* is the buffer still in use? */ {
+	if !s.nextZeroRTTCleanup.IsZero() && p.rcvTime.After(s.nextZeroRTTCleanup) {
+		defer s.cleanupZeroRTTQueues(p.rcvTime)
+	}
+
+	if wire.IsVersionNegotiationPacket(p.data) {
+		s.logger.Debugf("Dropping Version Negotiation packet.")
+		if s.qlogger != nil {
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Header:  qlog.PacketHeader{PacketType: qlog.PacketTypeVersionNegotiation},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		return false
+	}
+	// Short header packets should never end up here in the first place
+	if !wire.IsLongHeaderPacket(p.data[0]) {
+		panic(fmt.Sprintf("misrouted packet: %#v", p.data))
+	}
+	v, err := wire.ParseVersion(p.data)
+	// drop the packet if we failed to parse the protocol version
+	if err != nil {
+		s.logger.Debugf("Dropping a packet with an unknown version")
+		if s.qlogger != nil {
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		return false
+	}
+	// send a Version Negotiation Packet if the client is speaking a different protocol version
+	if !protocol.IsSupportedVersion(s.config.Versions, v) {
+		if s.disableVersionNegotiation {
+			if s.qlogger != nil {
+				s.qlogger.RecordEvent(qlog.PacketDropped{
+					Header:  qlog.PacketHeader{Version: v},
+					Raw:     qlog.RawInfo{Length: int(p.Size())},
+					Trigger: qlog.PacketDropUnexpectedVersion,
+				})
+			}
+			return false
+		}
+
+		if p.Size() < protocol.MinUnknownVersionPacketSize {
+			s.logger.Debugf("Dropping a packet with an unsupported version number %d that is too small (%d bytes)", v, p.Size())
+			if s.qlogger != nil {
+				s.qlogger.RecordEvent(qlog.PacketDropped{
+					Header:  qlog.PacketHeader{Version: v},
+					Raw:     qlog.RawInfo{Length: int(p.Size())},
+					Trigger: qlog.PacketDropUnexpectedPacket,
+				})
+			}
+			return false
+		}
+		return s.enqueueVersionNegotiationPacket(p)
+	}
+
+	if wire.Is0RTTPacket(p.data) {
+		if !s.acceptEarlyConns {
+			if s.qlogger != nil {
+				s.qlogger.RecordEvent(qlog.PacketDropped{
+					Header: qlog.PacketHeader{
+						PacketType:   qlog.PacketType0RTT,
+						PacketNumber: protocol.InvalidPacketNumber,
+					},
+					Raw:     qlog.RawInfo{Length: int(p.Size())},
+					Trigger: qlog.PacketDropUnexpectedPacket,
+				})
+			}
+			return false
+		}
+		return s.handle0RTTPacket(p)
+	}
+
+	// If we're creating a new connection, the packet will be passed to the connection.
+	// The header will then be parsed again.
+	hdr, _, _, err := wire.ParsePacket(p.data)
+	if err != nil {
+		if s.qlogger != nil {
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropHeaderParseError,
+			})
+		}
+		s.logger.Debugf("Error parsing packet: %s", err)
+		return false
+	}
+	if hdr.Type == protocol.PacketTypeInitial && p.Size() < protocol.MinInitialPacketSize {
+		s.logger.Debugf("Dropping a packet that is too small to be a valid Initial (%d bytes)", p.Size())
+		if s.qlogger != nil {
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketTypeInitial,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      v,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		return false
+	}
+
+	if hdr.Type != protocol.PacketTypeInitial {
+		// Drop long header packets.
+		// There's little point in sending a Stateless Reset, since the client
+		// might not have received the token yet.
+		s.logger.Debugf("Dropping long header packet of type %s (%d bytes)", hdr.Type, len(p.data))
+		if s.qlogger != nil {
+			var pt qlog.PacketType
+			switch hdr.Type {
+			case protocol.PacketTypeInitial:
+				pt = qlog.PacketTypeInitial
+			case protocol.PacketTypeHandshake:
+				pt = qlog.PacketTypeHandshake
+			case protocol.PacketType0RTT:
+				pt = qlog.PacketType0RTT
+			case protocol.PacketTypeRetry:
+				pt = qlog.PacketTypeRetry
+			}
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   pt,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      v,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		return false
+	}
+
+	s.logger.Debugf("<- Received Initial packet.")
+
+	if err := s.handleInitialImpl(p, hdr); err != nil {
+		s.logger.Errorf("Error occurred handling initial packet: %s", err)
+	}
+	// Don't put the packet buffer back.
+	// handleInitialImpl deals with the buffer.
+	return true
+}
+
+func (s *baseServer) handle0RTTPacket(p receivedPacket) bool {
+	connID, err := wire.ParseConnectionID(p.data, 0)
+	if err != nil {
+		if s.qlogger != nil {
+			v, _ := wire.ParseVersion(p.data)
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketType0RTT,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      v,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropHeaderParseError,
+			})
+		}
+		return false
+	}
+
+	// check again if we might have a connection now
+	if handler, ok := s.tr.Get(connID); ok {
+		handler.handlePacket(p)
+		return true
+	}
+
+	if q, ok := s.zeroRTTQueues[connID]; ok {
+		if len(q.packets) >= protocol.Max0RTTQueueLen {
+			if s.qlogger != nil {
+				v, _ := wire.ParseVersion(p.data)
+				s.qlogger.RecordEvent(qlog.PacketDropped{
+					Header: qlog.PacketHeader{
+						PacketType:   qlog.PacketType0RTT,
+						PacketNumber: protocol.InvalidPacketNumber,
+						Version:      v,
+					},
+					Raw:     qlog.RawInfo{Length: int(p.Size())},
+					Trigger: qlog.PacketDropDOSPrevention,
+				})
+			}
+			return false
+		}
+		q.packets = append(q.packets, p)
+		return true
+	}
+
+	if len(s.zeroRTTQueues) >= protocol.Max0RTTQueues {
+		if s.qlogger != nil {
+			v, _ := wire.ParseVersion(p.data)
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketType0RTT,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      v,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropDOSPrevention,
+			})
+		}
+		return false
+	}
+	queue := &zeroRTTQueue{packets: make([]receivedPacket, 1, 8)}
+	queue.packets[0] = p
+	expiration := p.rcvTime.Add(protocol.Max0RTTQueueingDuration)
+	queue.expiration = expiration
+	if s.nextZeroRTTCleanup.IsZero() || s.nextZeroRTTCleanup.After(expiration) {
+		s.nextZeroRTTCleanup = expiration
+	}
+	s.zeroRTTQueues[connID] = queue
+	return true
+}
+
+func (s *baseServer) cleanupZeroRTTQueues(now monotime.Time) {
+	// Iterate over all queues to find those that are expired.
+	// This is ok since we're placing a pretty low limit on the number of queues.
+	var nextCleanup monotime.Time
+	for connID, q := range s.zeroRTTQueues {
+		if q.expiration.After(now) {
+			if nextCleanup.IsZero() || nextCleanup.After(q.expiration) {
+				nextCleanup = q.expiration
+			}
+			continue
+		}
+		for _, p := range q.packets {
+			if s.qlogger != nil {
+				v, _ := wire.ParseVersion(p.data)
+				s.qlogger.RecordEvent(qlog.PacketDropped{
+					Header: qlog.PacketHeader{
+						PacketType:   qlog.PacketType0RTT,
+						PacketNumber: protocol.InvalidPacketNumber,
+						Version:      v,
+					},
+					Raw:     qlog.RawInfo{Length: int(p.Size())},
+					Trigger: qlog.PacketDropDOSPrevention,
+				})
+			}
+			p.buffer.Release()
+		}
+		delete(s.zeroRTTQueues, connID)
+		if s.logger.Debug() {
+			s.logger.Debugf("Removing 0-RTT queue for %s.", connID)
+		}
+	}
+	s.nextZeroRTTCleanup = nextCleanup
+}
+
+// validateToken returns false if:
+//   - address is invalid
+//   - token is expired
+//   - token is null
+func (s *baseServer) validateToken(token *handshake.Token, addr net.Addr) bool {
+	if token == nil {
+		return false
+	}
+	if !token.ValidateRemoteAddr(addr) {
+		return false
+	}
+	if !token.IsRetryToken && time.Since(token.SentTime) > s.maxTokenAge {
+		return false
+	}
+	if token.IsRetryToken && time.Since(token.SentTime) > s.config.maxRetryTokenAge() {
+		return false
+	}
+	return true
+}
+
+func (s *baseServer) handleInitialImpl(p receivedPacket, hdr *wire.Header) error {
+	if len(hdr.Token) == 0 && hdr.DestConnectionID.Len() < protocol.MinConnectionIDLenInitial {
+		if s.qlogger != nil {
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketTypeInitial,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      hdr.Version,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		p.buffer.Release()
+		return errors.New("too short connection ID")
+	}
+
+	// The server queues packets for a while, and we might already have established a connection by now.
+	// This results in a second check in the connection map.
+	// That's ok since it's not the hot path (it's only taken by some Initial and 0-RTT packets).
+	if handler, ok := s.tr.Get(hdr.DestConnectionID); ok {
+		handler.handlePacket(p)
+		return nil
+	}
+
+	var (
+		token              *handshake.Token
+		retrySrcConnID     *protocol.ConnectionID
+		clientAddrVerified bool
+	)
+	origDestConnID := hdr.DestConnectionID
+	if len(hdr.Token) > 0 {
+		tok, err := s.tokenGenerator.DecodeToken(hdr.Token)
+		if err == nil {
+			if tok.IsRetryToken {
+				origDestConnID = tok.OriginalDestConnectionID
+				retrySrcConnID = &tok.RetrySrcConnectionID
+			}
+			token = tok
+		}
+	}
+	if token != nil {
+		clientAddrVerified = s.validateToken(token, p.remoteAddr)
+		if !clientAddrVerified {
+			// For invalid and expired non-retry tokens, we don't send an INVALID_TOKEN error.
+			// We just ignore them, and act as if there was no token on this packet at all.
+			// This also means we might send a Retry later.
+			if !token.IsRetryToken {
+				token = nil
+			} else {
+				// For Retry tokens, we send an INVALID_ERROR if
+				// * the token is too old, or
+				// * the token is invalid, in case of a retry token.
+				select {
+				case s.invalidTokenQueue <- rejectedPacket{receivedPacket: p, hdr: hdr}:
+				default:
+					// drop packet if we can't send out the  INVALID_TOKEN packets fast enough
+					p.buffer.Release()
+				}
+				return nil
+			}
+		}
+	}
+
+	if token == nil && s.verifySourceAddress != nil && s.verifySourceAddress(p.remoteAddr) {
+		// Retry invalidates all 0-RTT packets sent.
+		delete(s.zeroRTTQueues, hdr.DestConnectionID)
+		select {
+		case s.retryQueue <- rejectedPacket{receivedPacket: p, hdr: hdr}:
+		default:
+			// drop packet if we can't send out Retry packets fast enough
+			p.buffer.Release()
+		}
+		return nil
+	}
+
+	// restore RTT from token
+	var rtt time.Duration
+	if token != nil && !token.IsRetryToken {
+		rtt = token.RTT
+	}
+
+	config := s.config
+	clientInfo := &ClientInfo{
+		RemoteAddr:   p.remoteAddr,
+		AddrVerified: clientAddrVerified,
+	}
+	if s.config.GetConfigForClient != nil {
+		conf, err := s.config.GetConfigForClient(clientInfo)
+		if err != nil {
+			s.logger.Debugf("Rejecting new connection due to GetConfigForClient callback")
+			s.refuseNewConn(p, hdr)
+			return nil
+		}
+		config = populateConfig(conf)
+	}
+
+	var conn *wrappedConn
+	var cancel context.CancelCauseFunc
+	ctx, cancel1 := context.WithCancelCause(context.Background())
+	if s.connContext != nil {
+		var err error
+		ctx, err = s.connContext(ctx, clientInfo)
+		if err != nil {
+			cancel1(err)
+			s.logger.Debugf("Rejecting new connection due to ConnContext callback: %s", err)
+			s.refuseNewConn(p, hdr)
+			return nil
+		}
+		if ctx == nil {
+			panic("quic: ConnContext returned nil")
+		}
+		// There's no guarantee that the application returns a context
+		// that's derived from the context we passed into ConnContext.
+		// We need to make sure that both contexts are cancelled.
+		var cancel2 context.CancelCauseFunc
+		ctx, cancel2 = context.WithCancelCause(ctx)
+		cancel = func(cause error) {
+			cancel1(cause)
+			cancel2(cause)
+		}
+	} else {
+		cancel = cancel1
+	}
+	var qlogTrace qlogwriter.Trace
+	if config.Tracer != nil {
+		// Use the same connection ID that is passed to the client's GetLogWriter callback.
+		connID := hdr.DestConnectionID
+		if origDestConnID.Len() > 0 {
+			connID = origDestConnID
+		}
+		qlogTrace = config.Tracer(ctx, false, connID)
+	}
+	connID, err := s.connIDGenerator.GenerateConnectionID()
+	if err != nil {
+		return err
+	}
+	s.logger.Debugf("Changing connection ID to %s.", connID)
+	conn = s.newConn(
+		ctx,
+		cancel,
+		newSendConn(s.conn, p.remoteAddr, p.info, s.logger),
+		s.tr,
+		origDestConnID,
+		retrySrcConnID,
+		hdr.DestConnectionID,
+		hdr.SrcConnectionID,
+		connID,
+		s.connIDGenerator,
+		s.statelessResetter,
+		config,
+		s.tlsConf,
+		s.tokenGenerator,
+		clientAddrVerified,
+		rtt,
+		qlogTrace,
+		s.logger,
+		hdr.Version,
+	)
+	conn.handlePacket(p)
+	// Adding the connection will fail if the client's chosen Destination Connection ID is already in use.
+	// This is very unlikely: Even if an attacker chooses a connection ID that's already in use,
+	// under normal circumstances the packet would just be routed to that connection.
+	// The only time this collision will occur if we receive the two Initial packets at the same time.
+	if added := s.tr.AddWithConnID(hdr.DestConnectionID, connID, conn); !added {
+		delete(s.zeroRTTQueues, hdr.DestConnectionID)
+		conn.closeWithTransportError(ConnectionRefused)
+		return nil
+	}
+	// Pass queued 0-RTT to the newly established connection.
+	if q, ok := s.zeroRTTQueues[hdr.DestConnectionID]; ok {
+		for _, p := range q.packets {
+			conn.handlePacket(p)
+		}
+		delete(s.zeroRTTQueues, hdr.DestConnectionID)
+	}
+
+	s.handshakingCount.Go(func() { s.handleNewConn(conn) })
+	go conn.run()
+	return nil
+}
+
+func (s *baseServer) refuseNewConn(p receivedPacket, hdr *wire.Header) {
+	delete(s.zeroRTTQueues, hdr.DestConnectionID)
+	select {
+	case s.connectionRefusedQueue <- rejectedPacket{receivedPacket: p, hdr: hdr}:
+	default:
+		// drop packet if we can't send out the CONNECTION_REFUSED fast enough
+		p.buffer.Release()
+	}
+}
+
+func (s *baseServer) handleNewConn(conn *wrappedConn) {
+	if s.acceptEarlyConns {
+		// wait until the early connection is ready, the handshake fails, or the server is closed
+		select {
+		case <-s.errorChan:
+			conn.closeWithTransportError(ConnectionRefused)
+			return
+		case <-conn.Context().Done():
+			return
+		case <-conn.earlyConnReady():
+		}
+	} else {
+		// wait until the handshake completes, fails, or the server is closed
+		select {
+		case <-s.errorChan:
+			conn.closeWithTransportError(ConnectionRefused)
+			return
+		case <-conn.Context().Done():
+			return
+		case <-conn.HandshakeComplete():
+		}
+	}
+
+	select {
+	case s.connQueue <- conn.Conn:
+	default:
+		conn.closeWithTransportError(ConnectionRefused)
+	}
+}
+
+func (s *baseServer) sendRetry(p rejectedPacket) {
+	if err := s.sendRetryPacket(p); err != nil {
+		s.logger.Debugf("Error sending Retry packet: %s", err)
+	}
+}
+
+func (s *baseServer) sendRetryPacket(p rejectedPacket) error {
+	hdr := p.hdr
+	// Log the Initial packet now.
+	// If no Retry is sent, the packet will be logged by the connection.
+	(&wire.ExtendedHeader{Header: *hdr}).Log(s.logger)
+	srcConnID, err := s.connIDGenerator.GenerateConnectionID()
+	if err != nil {
+		return err
+	}
+	token, err := s.tokenGenerator.NewRetryToken(p.remoteAddr, hdr.DestConnectionID, srcConnID)
+	if err != nil {
+		return err
+	}
+	replyHdr := &wire.ExtendedHeader{}
+	replyHdr.Type = protocol.PacketTypeRetry
+	replyHdr.Version = hdr.Version
+	replyHdr.SrcConnectionID = srcConnID
+	replyHdr.DestConnectionID = hdr.SrcConnectionID
+	replyHdr.Token = token
+	if s.logger.Debug() {
+		s.logger.Debugf("Changing connection ID to %s.", srcConnID)
+		s.logger.Debugf("-> Sending Retry")
+		replyHdr.Log(s.logger)
+	}
+
+	buf := getPacketBuffer()
+	defer buf.Release()
+	buf.Data, err = replyHdr.Append(buf.Data, hdr.Version)
+	if err != nil {
+		return err
+	}
+	// append the Retry integrity tag
+	tag := handshake.GetRetryIntegrityTag(buf.Data, hdr.DestConnectionID, hdr.Version)
+	buf.Data = append(buf.Data, tag[:]...)
+	if s.qlogger != nil {
+		s.qlogger.RecordEvent(qlog.PacketSent{
+			Header: qlog.PacketHeader{
+				PacketType:       qlog.PacketTypeRetry,
+				SrcConnectionID:  replyHdr.SrcConnectionID,
+				DestConnectionID: replyHdr.DestConnectionID,
+				Version:          replyHdr.Version,
+				Token:            &qlog.Token{Raw: token},
+			},
+			Raw: qlog.RawInfo{
+				Length:        len(buf.Data),
+				PayloadLength: int(replyHdr.Length),
+			},
+		})
+	}
+	_, err = s.conn.WritePacket(buf.Data, p.remoteAddr, p.info.OOB(), 0, protocol.ECNUnsupported)
+	return err
+}
+
+func (s *baseServer) maybeSendInvalidToken(p rejectedPacket) {
+	defer p.buffer.Release()
+
+	// Only send INVALID_TOKEN if we can unprotect the packet.
+	// This makes sure that we won't send it for packets that were corrupted.
+	hdr := p.hdr
+	sealer, opener := handshake.NewInitialAEAD(hdr.DestConnectionID, protocol.PerspectiveServer, hdr.Version)
+	data := p.data[:hdr.ParsedLen()+hdr.Length]
+	extHdr, err := unpackLongHeader(opener, hdr, data)
+	// Only send INVALID_TOKEN if we can unprotect the packet.
+	// This makes sure that we won't send it for packets that were corrupted.
+	if err != nil {
+		if s.qlogger != nil {
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketTypeInitial,
+					PacketNumber: protocol.InvalidPacketNumber,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropHeaderParseError,
+			})
+		}
+		return
+	}
+	hdrLen := extHdr.ParsedLen()
+	if _, err := opener.Open(data[hdrLen:hdrLen], data[hdrLen:], extHdr.PacketNumber, data[:hdrLen]); err != nil {
+		if s.qlogger != nil {
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketTypeInitial,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      hdr.Version,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropPayloadDecryptError,
+			})
+		}
+		return
+	}
+	if s.logger.Debug() {
+		s.logger.Debugf("Client sent an invalid retry token. Sending INVALID_TOKEN to %s.", p.remoteAddr)
+	}
+	if err := s.sendError(p.remoteAddr, hdr, sealer, InvalidToken, p.info); err != nil {
+		s.logger.Debugf("Error sending INVALID_TOKEN error: %s", err)
+	}
+}
+
+func (s *baseServer) sendConnectionRefused(p rejectedPacket) {
+	defer p.buffer.Release()
+	sealer, _ := handshake.NewInitialAEAD(p.hdr.DestConnectionID, protocol.PerspectiveServer, p.hdr.Version)
+	if err := s.sendError(p.remoteAddr, p.hdr, sealer, ConnectionRefused, p.info); err != nil {
+		s.logger.Debugf("Error sending CONNECTION_REFUSED error: %s", err)
+	}
+}
+
+// sendError sends the error as a response to the packet received with header hdr
+func (s *baseServer) sendError(remoteAddr net.Addr, hdr *wire.Header, sealer handshake.LongHeaderSealer, errorCode qerr.TransportErrorCode, info packetInfo) error {
+	b := getPacketBuffer()
+	defer b.Release()
+
+	ccf := &wire.ConnectionCloseFrame{ErrorCode: uint64(errorCode)}
+
+	replyHdr := &wire.ExtendedHeader{}
+	replyHdr.Type = protocol.PacketTypeInitial
+	replyHdr.Version = hdr.Version
+	replyHdr.SrcConnectionID = hdr.DestConnectionID
+	replyHdr.DestConnectionID = hdr.SrcConnectionID
+	replyHdr.PacketNumberLen = protocol.PacketNumberLen4
+	replyHdr.Length = 4 /* packet number len */ + ccf.Length(hdr.Version) + protocol.ByteCount(sealer.Overhead())
+	var err error
+	b.Data, err = replyHdr.Append(b.Data, hdr.Version)
+	if err != nil {
+		return err
+	}
+	payloadOffset := len(b.Data)
+
+	b.Data, err = ccf.Append(b.Data, hdr.Version)
+	if err != nil {
+		return err
+	}
+
+	_ = sealer.Seal(b.Data[payloadOffset:payloadOffset], b.Data[payloadOffset:], replyHdr.PacketNumber, b.Data[:payloadOffset])
+	b.Data = b.Data[0 : len(b.Data)+sealer.Overhead()]
+
+	pnOffset := payloadOffset - int(replyHdr.PacketNumberLen)
+	sealer.EncryptHeader(
+		b.Data[pnOffset+4:pnOffset+4+16],
+		&b.Data[0],
+		b.Data[pnOffset:payloadOffset],
+	)
+
+	replyHdr.Log(s.logger)
+	wire.LogFrame(s.logger, ccf, true)
+	if s.qlogger != nil {
+		s.qlogger.RecordEvent(qlog.PacketSent{
+			Header: qlog.PacketHeader{
+				PacketType:       qlog.PacketTypeInitial,
+				SrcConnectionID:  replyHdr.SrcConnectionID,
+				DestConnectionID: replyHdr.DestConnectionID,
+				PacketNumber:     replyHdr.PacketNumber,
+				Version:          replyHdr.Version,
+			},
+			Raw: qlog.RawInfo{
+				Length:        len(b.Data),
+				PayloadLength: int(replyHdr.Length),
+			},
+			Frames: []qlog.Frame{{Frame: ccf}},
+		})
+	}
+	_, err = s.conn.WritePacket(b.Data, remoteAddr, info.OOB(), 0, protocol.ECNUnsupported)
+	return err
+}
+
+func (s *baseServer) enqueueVersionNegotiationPacket(p receivedPacket) (bufferInUse bool) {
+	select {
+	case s.versionNegotiationQueue <- p:
+		return true
+	default:
+		// it's fine to not send version negotiation packets when we are busy
+	}
+	return false
+}
+
+func (s *baseServer) maybeSendVersionNegotiationPacket(p receivedPacket) {
+	defer p.buffer.Release()
+
+	v, err := wire.ParseVersion(p.data)
+	if err != nil {
+		s.logger.Debugf("failed to parse version for sending version negotiation packet: %s", err)
+		return
+	}
+
+	_, src, dest, err := wire.ParseArbitraryLenConnectionIDs(p.data)
+	if err != nil { // should never happen
+		s.logger.Debugf("Dropping a packet with an unknown version for which we failed to parse connection IDs")
+		if s.qlogger != nil {
+			s.qlogger.RecordEvent(qlog.PacketDropped{
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			})
+		}
+		return
+	}
+
+	s.logger.Debugf("Client offered version %s, sending Version Negotiation", v)
+
+	data := wire.ComposeVersionNegotiation(dest, src, s.config.Versions)
+	if s.qlogger != nil {
+		s.qlogger.RecordEvent(qlog.VersionNegotiationSent{
+			Header: qlog.PacketHeaderVersionNegotiation{
+				SrcConnectionID:  src,
+				DestConnectionID: dest,
+			},
+			SupportedVersions: s.config.Versions,
+		})
+	}
+	if _, err := s.conn.WritePacket(data, p.remoteAddr, p.info.OOB(), 0, protocol.ECNUnsupported); err != nil {
+		s.logger.Debugf("Error sending Version Negotiation: %s", err)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/server_test.go b/electron/native/private-transport/third_party/quic-go/server_test.go
new file mode 100644
index 000000000..d88edddc4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/server_test.go
@@ -0,0 +1,1387 @@
+package quic
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/tls"
+	"errors"
+	"net"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type testServer struct{ *baseServer }
+
+type serverOpts struct {
+	eventRecorder             *events.Recorder
+	config                    *Config
+	tokenGeneratorKey         TokenGeneratorKey
+	maxTokenAge               time.Duration
+	useRetry                  bool
+	disableVersionNegotiation bool
+	acceptEarly               bool
+	newConn                   func(
+		context.Context,
+		context.CancelCauseFunc,
+		sendConn,
+		connRunner,
+		protocol.ConnectionID, // original dest connection ID
+		*protocol.ConnectionID, // retry src connection ID
+		protocol.ConnectionID, // client dest connection ID
+		protocol.ConnectionID, // destination connection ID
+		protocol.ConnectionID, // source connection ID
+		ConnectionIDGenerator,
+		*statelessResetter,
+		*Config,
+		*tls.Config,
+		*handshake.TokenGenerator,
+		bool, /* client address validated by an address validation token */
+		time.Duration,
+		qlogwriter.Trace,
+		utils.Logger,
+		protocol.Version,
+	) *wrappedConn
+}
+
+func newTestServer(t *testing.T, serverOpts *serverOpts) *testServer {
+	t.Helper()
+	c, err := wrapConn(newUDPConnLocalhost(t))
+	require.NoError(t, err)
+	verifySourceAddress := func(net.Addr) bool { return serverOpts.useRetry }
+	config := populateConfig(serverOpts.config)
+	tr := &Transport{Conn: newUDPConnLocalhost(t)}
+	tr.init(true)
+	s := newServer(
+		c,
+		(*packetHandlerMap)(tr),
+		&protocol.DefaultConnectionIDGenerator{},
+		&statelessResetter{},
+		func(ctx context.Context, _ *ClientInfo) (context.Context, error) { return ctx, nil },
+		&tls.Config{},
+		config,
+		serverOpts.eventRecorder,
+		func() {},
+		serverOpts.tokenGeneratorKey,
+		serverOpts.maxTokenAge,
+		verifySourceAddress,
+		serverOpts.disableVersionNegotiation,
+		serverOpts.acceptEarly,
+	)
+	s.newConn = serverOpts.newConn
+	t.Cleanup(func() { s.Close() })
+	return &testServer{s}
+}
+
+func getLongHeaderPacketEncrypted(t *testing.T, remoteAddr net.Addr, extHdr *wire.ExtendedHeader, data []byte) receivedPacket {
+	t.Helper()
+	hdr := extHdr.Header
+	if hdr.Type != protocol.PacketTypeInitial {
+		t.Fatal("can only encrypt Initial packets")
+	}
+	p := getLongHeaderPacket(t, remoteAddr, extHdr, data)
+	sealer, _ := handshake.NewInitialAEAD(hdr.DestConnectionID, protocol.PerspectiveClient, hdr.Version)
+	n := len(p.data) - len(data) // length of the header
+	p.data = slices.Grow(p.data, 16)
+	_ = sealer.Seal(p.data[n:n], p.data[n:], extHdr.PacketNumber, p.data[:n])
+	p.data = p.data[:len(p.data)+16]
+	sealer.EncryptHeader(p.data[n:n+16], &p.data[0], p.data[n-int(extHdr.PacketNumberLen):n])
+	return p
+}
+
+func randConnID(l int) protocol.ConnectionID {
+	b := make([]byte, l)
+	rand.Read(b)
+	return protocol.ParseConnectionID(b)
+}
+
+func getValidInitialPacket(t *testing.T, raddr net.Addr, srcConnID, destConnID protocol.ConnectionID) receivedPacket {
+	t.Helper()
+	return getLongHeaderPacket(t,
+		raddr,
+		&wire.ExtendedHeader{
+			Header: wire.Header{
+				Type:             protocol.PacketTypeInitial,
+				SrcConnectionID:  srcConnID,
+				DestConnectionID: destConnID,
+				Length:           protocol.MinInitialPacketSize,
+				Version:          protocol.Version1,
+			},
+			PacketNumberLen: protocol.PacketNumberLen4,
+		},
+		make([]byte, protocol.MinInitialPacketSize),
+	)
+}
+
+// checkConnectionClose checks
+//  1. the arguments of the SentPacket tracer call, and
+//  2. reads and parses the packet sent by the server
+func checkConnectionClose(
+	t *testing.T,
+	conn *net.UDPConn,
+	eventRecorder *events.Recorder,
+	expectedSrcConnID protocol.ConnectionID,
+	expectedDestConnID protocol.ConnectionID,
+	expectedErrorCode qerr.TransportErrorCode,
+) {
+	t.Helper()
+
+	conn.SetReadDeadline(time.Now().Add(time.Second))
+	b := make([]byte, 1500)
+	n, _, err := conn.ReadFromUDP(b)
+	require.NoError(t, err)
+	parsedHdr, _, _, err := wire.ParsePacket(b[:n])
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketTypeInitial, parsedHdr.Type)
+	require.Equal(t, expectedSrcConnID, parsedHdr.SrcConnectionID)
+	require.Equal(t, expectedDestConnID, parsedHdr.DestConnectionID)
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketSent{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeInitial,
+					SrcConnectionID:  expectedSrcConnID,
+					DestConnectionID: expectedDestConnID,
+					Version:          protocol.Version1,
+				},
+				Raw: qlog.RawInfo{Length: n, PayloadLength: int(parsedHdr.Length)},
+				Frames: []qlog.Frame{
+					{Frame: &qlog.ConnectionCloseFrame{ErrorCode: uint64(expectedErrorCode)}},
+				},
+			},
+		},
+		eventRecorder.Events(qlog.PacketSent{}),
+	)
+}
+
+func checkRetry(t *testing.T,
+	conn *net.UDPConn,
+	eventRecorder *events.Recorder,
+	expectedDestConnID protocol.ConnectionID,
+) {
+	t.Helper()
+
+	conn.SetReadDeadline(time.Now().Add(time.Second))
+	b := make([]byte, 1500)
+	n, _, err := conn.ReadFromUDP(b)
+	require.NoError(t, err)
+	parsedHdr, _, _, err := wire.ParsePacket(b[:n])
+	require.NoError(t, err)
+	require.Equal(t, protocol.PacketTypeRetry, parsedHdr.Type)
+	require.Equal(t, expectedDestConnID, parsedHdr.DestConnectionID)
+	require.NotNil(t, parsedHdr.Token)
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketSent{
+				Header: qlog.PacketHeader{
+					PacketType:       qlog.PacketTypeRetry,
+					DestConnectionID: expectedDestConnID,
+					SrcConnectionID:  parsedHdr.SrcConnectionID,
+					Version:          parsedHdr.Version,
+					Token:            &qlog.Token{Raw: parsedHdr.Token},
+				},
+				Raw: qlog.RawInfo{Length: n},
+			},
+		},
+		eventRecorder.Events(qlog.PacketSent{}),
+	)
+}
+
+func TestListen(t *testing.T) {
+	_, err := ListenAddr("localhost:0", nil, nil)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "quic: tls.Config not set")
+
+	_, err = Listen(nil, &tls.Config{}, &Config{Versions: []protocol.Version{0x1234}})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "invalid QUIC version: 0x1234")
+}
+
+func TestListenAddr(t *testing.T) {
+	_, err := ListenAddr("127.0.0.1", &tls.Config{}, &Config{})
+	require.Error(t, err)
+	require.IsType(t, &net.AddrError{}, err)
+
+	_, err = ListenAddr("1.1.1.1:1111", &tls.Config{}, &Config{})
+	require.Error(t, err)
+	require.IsType(t, &net.OpError{}, err)
+
+	ln, err := ListenAddr("127.0.0.1:0", &tls.Config{}, &Config{})
+	require.NoError(t, err)
+	defer ln.Close()
+}
+
+func TestServerPacketDropping(t *testing.T) {
+	t.Run("destination connection ID too short", func(t *testing.T) {
+		conn := newUDPConnLocalhost(t)
+		testServerDroppedPacket(t,
+			conn,
+			getValidInitialPacket(t, conn.LocalAddr(), randConnID(5), randConnID(7)),
+			protocol.Version1,
+			qlog.PacketTypeInitial,
+			qlog.PacketDropUnexpectedPacket,
+		)
+	})
+
+	t.Run("Initial packet too small", func(t *testing.T) {
+		conn := newUDPConnLocalhost(t)
+		p := getLongHeaderPacket(t,
+			conn.LocalAddr(),
+			&wire.ExtendedHeader{
+				Header: wire.Header{
+					Type:             protocol.PacketTypeInitial,
+					DestConnectionID: randConnID(8),
+					Version:          protocol.Version1,
+				},
+				PacketNumberLen: 2,
+			},
+			make([]byte, protocol.MinInitialPacketSize-100),
+		)
+		require.Greater(t, len(p.data), protocol.MinInitialPacketSize-100)
+		require.Less(t, len(p.data), protocol.MinInitialPacketSize)
+		testServerDroppedPacket(t,
+			conn,
+			p,
+			protocol.Version1,
+			qlog.PacketTypeInitial,
+			qlog.PacketDropUnexpectedPacket,
+		)
+	})
+
+	// we should not send a Version Negotiation packet if the packet is smaller than 1200 bytes
+	t.Run("packet of unknown version, too small", func(t *testing.T) {
+		conn := newUDPConnLocalhost(t)
+		p := getLongHeaderPacket(t,
+			conn.LocalAddr(),
+			&wire.ExtendedHeader{
+				Header: wire.Header{
+					Type:             protocol.PacketTypeInitial,
+					DestConnectionID: randConnID(8),
+					Version:          0x42,
+				},
+				PacketNumberLen: 2,
+			},
+			make([]byte, protocol.MinUnknownVersionPacketSize-100),
+		)
+		require.Greater(t, len(p.data), protocol.MinUnknownVersionPacketSize-100)
+		require.Less(t, len(p.data), protocol.MinUnknownVersionPacketSize)
+		testServerDroppedPacket(t,
+			conn,
+			p,
+			0x42,
+			"",
+			qlog.PacketDropUnexpectedPacket,
+		)
+	})
+
+	t.Run("not an Initial packet", func(t *testing.T) {
+		conn := newUDPConnLocalhost(t)
+		testServerDroppedPacket(t,
+			conn,
+			getLongHeaderPacket(t,
+				conn.LocalAddr(),
+				&wire.ExtendedHeader{
+					Header: wire.Header{
+						Type:             protocol.PacketTypeHandshake,
+						DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+						Version:          protocol.Version1,
+					},
+					PacketNumberLen: 2,
+				},
+				nil,
+			),
+			protocol.Version1,
+			qlog.PacketTypeHandshake,
+			qlog.PacketDropUnexpectedPacket,
+		)
+	})
+
+	// as a server, we should never receive a Version Negotiation packet
+	t.Run("Version Negotiation packet", func(t *testing.T) {
+		conn := newUDPConnLocalhost(t)
+		data := wire.ComposeVersionNegotiation(
+			protocol.ArbitraryLenConnectionID{1, 2, 3, 4},
+			protocol.ArbitraryLenConnectionID{4, 3, 2, 1},
+			[]protocol.Version{1, 2, 3},
+		)
+		testServerDroppedPacket(t,
+			conn,
+			receivedPacket{
+				remoteAddr: conn.LocalAddr(),
+				data:       data,
+				buffer:     getPacketBuffer(),
+			},
+			0, // version negotiation packets don't have a version
+			qlog.PacketTypeVersionNegotiation,
+			qlog.PacketDropUnexpectedPacket,
+		)
+	})
+}
+
+func testServerDroppedPacket(t *testing.T,
+	conn *net.UDPConn,
+	p receivedPacket,
+	expectedVersion qlog.Version,
+	expectedPacketType qlog.PacketType,
+	expectedDropReason qlog.PacketDropReason,
+) {
+	readChan := make(chan struct{})
+	go func() {
+		defer close(readChan)
+		conn.ReadFrom(make([]byte, 1000))
+	}()
+	var eventRecorder events.Recorder
+	server := newTestServer(t, &serverOpts{eventRecorder: &eventRecorder})
+
+	server.handlePacket(p)
+
+	select {
+	case <-readChan:
+		t.Fatal("didn't expect to receive a packet")
+	case <-time.After(scaleDuration(5 * time.Millisecond)):
+	}
+
+	var expectedPacketNumber protocol.PacketNumber
+	if expectedPacketType != qlog.PacketTypeVersionNegotiation && expectedPacketType != "" {
+		expectedPacketNumber = protocol.InvalidPacketNumber
+	}
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   expectedPacketType,
+					PacketNumber: expectedPacketNumber,
+					Version:      expectedVersion,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: expectedDropReason,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+}
+
+func TestServerVersionNegotiation(t *testing.T) {
+	t.Run("enabled", func(t *testing.T) {
+		testServerVersionNegotiation(t, true)
+	})
+	t.Run("disabled", func(t *testing.T) {
+		testServerVersionNegotiation(t, false)
+	})
+}
+
+func testServerVersionNegotiation(t *testing.T, enabled bool) {
+	conn := newUDPConnLocalhost(t)
+	var eventRecorder events.Recorder
+	server := newTestServer(t, &serverOpts{
+		eventRecorder:             &eventRecorder,
+		disableVersionNegotiation: !enabled,
+	})
+
+	srcConnID := protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5})
+	destConnID := protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6})
+	packet := getLongHeaderPacket(t, conn.LocalAddr(),
+		&wire.ExtendedHeader{
+			Header: wire.Header{
+				Type:             protocol.PacketTypeHandshake,
+				SrcConnectionID:  srcConnID,
+				DestConnectionID: destConnID,
+				Version:          0x42,
+			},
+			PacketNumberLen: protocol.PacketNumberLen4,
+		},
+		make([]byte, protocol.MinUnknownVersionPacketSize),
+	)
+
+	written := make(chan []byte, 1)
+	go func() {
+		b := make([]byte, 1500)
+		n, _, _ := conn.ReadFrom(b)
+		written <- b[:n]
+	}()
+	server.handlePacket(packet)
+
+	switch enabled {
+	case true:
+		select {
+		case b := <-written:
+			require.True(t, wire.IsVersionNegotiationPacket(b))
+			dest, src, versions, err := wire.ParseVersionNegotiationPacket(b)
+			require.NoError(t, err)
+			require.Equal(t, protocol.ArbitraryLenConnectionID(srcConnID.Bytes()), dest)
+			require.Equal(t, protocol.ArbitraryLenConnectionID(destConnID.Bytes()), src)
+			require.NotContains(t, versions, protocol.Version(0x42))
+
+			require.Equal(t,
+				[]qlogwriter.Event{
+					qlog.VersionNegotiationSent{
+						Header: qlog.PacketHeaderVersionNegotiation{
+							SrcConnectionID:  src,
+							DestConnectionID: dest,
+						},
+						SupportedVersions: server.config.Versions,
+					},
+				},
+				eventRecorder.Events(qlog.VersionNegotiationSent{}),
+			)
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	case false:
+		select {
+		case <-written:
+			t.Fatal("expected no version negotiation packet")
+		case <-time.After(scaleDuration(10 * time.Millisecond)):
+			require.Equal(t,
+				[]qlogwriter.Event{
+					qlog.PacketDropped{
+						Header:  qlog.PacketHeader{Version: 0x42},
+						Raw:     qlog.RawInfo{Length: int(packet.Size())},
+						Trigger: qlog.PacketDropUnexpectedVersion,
+					},
+				},
+				eventRecorder.Events(qlog.PacketDropped{}),
+			)
+		}
+	}
+}
+
+func TestServerRetry(t *testing.T) {
+	var eventRecorder events.Recorder
+	server := newTestServer(t, &serverOpts{eventRecorder: &eventRecorder, useRetry: true})
+	conn := newUDPConnLocalhost(t)
+
+	packet := getLongHeaderPacket(t, conn.LocalAddr(),
+		&wire.ExtendedHeader{
+			Header: wire.Header{
+				Type:             protocol.PacketTypeInitial,
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5}),
+				DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+				Version:          protocol.Version1,
+			},
+			PacketNumberLen: protocol.PacketNumberLen4,
+		},
+		make([]byte, protocol.MinUnknownVersionPacketSize),
+	)
+
+	server.handlePacket(packet)
+	checkRetry(t, conn, &eventRecorder, protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5}))
+}
+
+func TestServerTokenValidation(t *testing.T) {
+	var tokenGeneratorKey handshake.TokenProtectorKey
+	rand.Read(tokenGeneratorKey[:])
+	tg := handshake.NewTokenGenerator(tokenGeneratorKey)
+
+	t.Run("retry token with invalid address", func(t *testing.T) {
+		token, err := tg.NewRetryToken(
+			&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1337},
+			protocol.ConnectionID{},
+			protocol.ConnectionID{},
+		)
+		require.NoError(t, err)
+		var eventRecorder events.Recorder
+		server := newTestServer(t, &serverOpts{
+			useRetry:          true,
+			eventRecorder:     &eventRecorder,
+			tokenGeneratorKey: tokenGeneratorKey,
+		})
+
+		testServerTokenValidation(t, server, &eventRecorder, newUDPConnLocalhost(t), token, false, true, false)
+	})
+
+	t.Run("expired retry token", func(t *testing.T) {
+		conn := newUDPConnLocalhost(t)
+		var eventRecorder events.Recorder
+		server := newTestServer(t, &serverOpts{
+			useRetry:          true,
+			eventRecorder:     &eventRecorder,
+			config:            &Config{HandshakeIdleTimeout: time.Millisecond / 2},
+			tokenGeneratorKey: tokenGeneratorKey,
+		})
+
+		token, err := tg.NewRetryToken(conn.LocalAddr(), protocol.ConnectionID{}, protocol.ConnectionID{})
+		require.NoError(t, err)
+		// the maximum retry token age is equivalent to the handshake timeout
+		time.Sleep(time.Millisecond) // make sure the token is expired
+		testServerTokenValidation(t, server, &eventRecorder, conn, token, false, true, false)
+	})
+
+	// if the packet is corrupted, it will just be dropped (no INVALID_TOKEN nor Retry is sent)
+	t.Run("corrupted packet", func(t *testing.T) {
+		var eventRecorder events.Recorder
+		server := newTestServer(t, &serverOpts{
+			useRetry:          true,
+			eventRecorder:     &eventRecorder,
+			config:            &Config{HandshakeIdleTimeout: time.Millisecond / 2},
+			tokenGeneratorKey: tokenGeneratorKey,
+		})
+
+		conn := newUDPConnLocalhost(t)
+		token, err := tg.NewRetryToken(conn.LocalAddr(), protocol.ConnectionID{}, protocol.ConnectionID{})
+		require.NoError(t, err)
+		time.Sleep(time.Millisecond) // make sure the token is expired
+		testServerTokenValidation(t, server, &eventRecorder, conn, token, true, false, true)
+	})
+
+	t.Run("invalid non-retry token", func(t *testing.T) {
+		var tokenGeneratorKey2 handshake.TokenProtectorKey
+		rand.Read(tokenGeneratorKey2[:])
+		var eventRecorder events.Recorder
+		server := newTestServer(t, &serverOpts{
+			tokenGeneratorKey: tokenGeneratorKey2, // use a different key
+			useRetry:          true,
+			eventRecorder:     &eventRecorder,
+			maxTokenAge:       time.Millisecond,
+		})
+
+		conn := newUDPConnLocalhost(t)
+		token, err := tg.NewToken(conn.LocalAddr(), 10*time.Millisecond)
+		require.NoError(t, err)
+		time.Sleep(3 * time.Millisecond) // make sure the token is expired
+		testServerTokenValidation(t, server, &eventRecorder, conn, token, false, false, true)
+	})
+
+	t.Run("expired non-retry token", func(t *testing.T) {
+		var eventRecorder events.Recorder
+		server := newTestServer(t, &serverOpts{
+			tokenGeneratorKey: tokenGeneratorKey,
+			useRetry:          true,
+			eventRecorder:     &eventRecorder,
+			maxTokenAge:       time.Millisecond,
+		})
+
+		conn := newUDPConnLocalhost(t)
+		token, err := tg.NewToken(conn.LocalAddr(), 100*time.Millisecond)
+		require.NoError(t, err)
+		time.Sleep(3 * time.Millisecond) // make sure the token is expired
+		testServerTokenValidation(t, server, &eventRecorder, conn, token, false, false, true)
+	})
+}
+
+func testServerTokenValidation(
+	t *testing.T,
+	server *testServer,
+	eventRecorder *events.Recorder,
+	conn *net.UDPConn,
+	token []byte,
+	corruptedPacket bool,
+	expectInvalidTokenConnectionClose bool,
+	expectRetry bool,
+) {
+	hdr := wire.Header{
+		Type:             protocol.PacketTypeInitial,
+		SrcConnectionID:  protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}),
+		DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}),
+		Token:            token,
+		Length:           protocol.MinInitialPacketSize + protocol.ByteCount(protocol.PacketNumberLen4) + 16,
+		Version:          protocol.Version1,
+	}
+	packet := getLongHeaderPacketEncrypted(t,
+		conn.LocalAddr(),
+		&wire.ExtendedHeader{Header: hdr, PacketNumberLen: protocol.PacketNumberLen4},
+		make([]byte, protocol.MinInitialPacketSize),
+	)
+	if corruptedPacket {
+		packet.data[len(packet.data)-10] ^= 0xff // corrupt the packet
+		server.handlePacket(packet)
+
+		require.Eventually(t,
+			func() bool { return len(eventRecorder.Events(qlog.PacketDropped{})) > 0 },
+			time.Second,
+			10*time.Millisecond,
+		)
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Header: qlog.PacketHeader{
+						PacketType:   qlog.PacketTypeInitial,
+						PacketNumber: protocol.InvalidPacketNumber,
+						Version:      hdr.Version,
+					},
+					Raw:     qlog.RawInfo{Length: int(packet.Size())},
+					Trigger: qlog.PacketDropPayloadDecryptError,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+		return
+	}
+
+	server.handlePacket(packet)
+
+	if expectInvalidTokenConnectionClose {
+		checkConnectionClose(t, conn, eventRecorder, hdr.DestConnectionID, hdr.SrcConnectionID, qerr.InvalidToken)
+	}
+	if expectRetry {
+		checkRetry(t, conn, eventRecorder, hdr.SrcConnectionID)
+	}
+}
+
+type connConstructorArgs struct {
+	ctx              context.Context
+	connRunner       connRunner
+	config           *Config
+	origDestConnID   protocol.ConnectionID
+	retrySrcConnID   *protocol.ConnectionID
+	clientDestConnID protocol.ConnectionID
+	destConnID       protocol.ConnectionID
+	srcConnID        protocol.ConnectionID
+}
+
+type connConstructorRecorder struct {
+	ch chan connConstructorArgs
+
+	hooks []*connTestHooks
+}
+
+func newConnConstructorRecorder(hooks ...*connTestHooks) *connConstructorRecorder {
+	return &connConstructorRecorder{
+		ch:    make(chan connConstructorArgs, len(hooks)),
+		hooks: hooks,
+	}
+}
+
+func (r *connConstructorRecorder) Args() <-chan connConstructorArgs { return r.ch }
+
+func (r *connConstructorRecorder) NewConn(
+	ctx context.Context,
+	_ context.CancelCauseFunc,
+	_ sendConn,
+	connRunner connRunner,
+	origDestConnID protocol.ConnectionID,
+	retrySrcConnID *protocol.ConnectionID,
+	clientDestConnID protocol.ConnectionID,
+	destConnID protocol.ConnectionID,
+	srcConnID protocol.ConnectionID,
+	_ ConnectionIDGenerator,
+	_ *statelessResetter,
+	config *Config,
+	_ *tls.Config,
+	_ *handshake.TokenGenerator,
+	_ bool,
+	_ time.Duration,
+	_ qlogwriter.Trace,
+	_ utils.Logger,
+	_ protocol.Version,
+) *wrappedConn {
+	r.ch <- connConstructorArgs{
+		ctx:              ctx,
+		connRunner:       connRunner,
+		config:           config,
+		origDestConnID:   origDestConnID,
+		retrySrcConnID:   retrySrcConnID,
+		clientDestConnID: clientDestConnID,
+		destConnID:       destConnID,
+		srcConnID:        srcConnID,
+	}
+	hooks := r.hooks[0]
+	r.hooks = r.hooks[1:]
+	return &wrappedConn{testHooks: hooks}
+}
+
+func TestServerCreateConnection(t *testing.T) {
+	t.Run("without retry", func(t *testing.T) {
+		testServerCreateConnection(t, false)
+	})
+	t.Run("with retry", func(t *testing.T) {
+		testServerCreateConnection(t, true)
+	})
+}
+
+func testServerCreateConnection(t *testing.T, useRetry bool) {
+	tokenGeneratorKey := TokenGeneratorKey{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}
+	tg := handshake.NewTokenGenerator(tokenGeneratorKey)
+
+	server := newTestServer(t, &serverOpts{
+		useRetry:          useRetry,
+		tokenGeneratorKey: tokenGeneratorKey,
+	})
+
+	done := make(chan struct{}, 3)
+	handledPackets := make(chan receivedPacket, 1)
+	recorder := newConnConstructorRecorder(&connTestHooks{
+		run:               func() error { done <- struct{}{}; return nil },
+		context:           func() context.Context { done <- struct{}{}; return context.Background() },
+		handshakeComplete: func() <-chan struct{} { done <- struct{}{}; return make(chan struct{}) },
+		handlePacket:      func(p receivedPacket) { handledPackets <- p },
+	})
+	server.newConn = recorder.NewConn
+
+	conn := newUDPConnLocalhost(t)
+	var token []byte
+	if useRetry {
+		var err error
+		token, err = tg.NewRetryToken(
+			conn.LocalAddr(),
+			protocol.ParseConnectionID([]byte{0xde, 0xad, 0xc0, 0xde}),
+			protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}),
+		)
+		require.NoError(t, err)
+	}
+	hdr := wire.Header{
+		Type:             protocol.PacketTypeInitial,
+		SrcConnectionID:  protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}),
+		DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}),
+		Length:           protocol.MinInitialPacketSize + protocol.ByteCount(protocol.PacketNumberLen4) + 16,
+		Token:            token,
+		Version:          protocol.Version1,
+	}
+	packet := getLongHeaderPacketEncrypted(t,
+		conn.LocalAddr(),
+		&wire.ExtendedHeader{Header: hdr, PacketNumberLen: protocol.PacketNumberLen4},
+		make([]byte, protocol.MinInitialPacketSize),
+	)
+
+	server.handlePacket(packet)
+
+	select {
+	case p := <-handledPackets:
+		require.Equal(t, packet, p)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	var args connConstructorArgs
+	select {
+	case args = <-recorder.Args():
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	assert.Equal(t, protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}), args.destConnID)
+	assert.NotEqual(t, args.origDestConnID, args.srcConnID)
+	if useRetry {
+		assert.Equal(t, protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}), args.destConnID)
+		assert.Equal(t, protocol.ParseConnectionID([]byte{0xde, 0xad, 0xc0, 0xde}), args.origDestConnID)
+		assert.Equal(t, protocol.ParseConnectionID([]byte{0xde, 0xca, 0xfb, 0xad}), *args.retrySrcConnID)
+	} else {
+		assert.Equal(t, protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}), args.origDestConnID)
+		assert.Zero(t, args.retrySrcConnID)
+	}
+
+	for range 3 {
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	}
+}
+
+func TestServerClose(t *testing.T) {
+	var hooks []*connTestHooks
+	const numConns = 3
+	done := make(chan struct{}, numConns)
+	for range numConns {
+		hooks = append(hooks, &connTestHooks{
+			closeWithTransportError: func(TransportErrorCode) { done <- struct{}{} },
+		})
+	}
+	recorder := newConnConstructorRecorder(hooks...)
+	server := newTestServer(t, &serverOpts{newConn: recorder.NewConn})
+
+	for range numConns {
+		b := make([]byte, 10)
+		rand.Read(b)
+		connID := protocol.ParseConnectionID(b)
+		server.handlePacket(getValidInitialPacket(t,
+			&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+			randConnID(6),
+			connID,
+		))
+		select {
+		case <-recorder.Args():
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	}
+
+	server.Close()
+	// closing closes all handshaking connections with CONNECTION_REFUSED
+	for range numConns {
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	}
+
+	// Accept returns ErrServerClosed after closing
+	for range 5 {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		_, err := server.Accept(ctx)
+		require.ErrorIs(t, err, ErrServerClosed)
+		require.ErrorIs(t, err, net.ErrClosed)
+	}
+}
+
+func TestServerGetConfigForClientAccept(t *testing.T) {
+	recorder := newConnConstructorRecorder(&connTestHooks{})
+	server := newTestServer(t, &serverOpts{
+		config: &Config{
+			GetConfigForClient: func(*ClientInfo) (*Config, error) {
+				return &Config{MaxIncomingStreams: 1234}, nil
+			},
+		},
+		newConn: recorder.NewConn,
+	})
+
+	conn := newUDPConnLocalhost(t)
+	packet := getValidInitialPacket(t,
+		conn.LocalAddr(),
+		protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}),
+		protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+	)
+
+	server.handlePacket(packet)
+
+	var args connConstructorArgs
+	select {
+	case args = <-recorder.Args():
+		require.EqualValues(t, 1234, args.config.MaxIncomingStreams)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	assert.Equal(t, protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}), args.destConnID)
+	assert.NotEqual(t, args.origDestConnID, args.srcConnID)
+}
+
+func TestServerGetConfigForClientReject(t *testing.T) {
+	var eventRecorder events.Recorder
+	server := newTestServer(t, &serverOpts{
+		eventRecorder: &eventRecorder,
+		config: &Config{
+			GetConfigForClient: func(*ClientInfo) (*Config, error) {
+				return nil, errors.New("rejected")
+			},
+		},
+	})
+
+	conn := newUDPConnLocalhost(t)
+	srcConnID := randConnID(6)
+	destConnID := randConnID(8)
+	server.handlePacket(getValidInitialPacket(t, conn.LocalAddr(), srcConnID, destConnID))
+
+	checkConnectionClose(t, conn, &eventRecorder, destConnID, srcConnID, qerr.ConnectionRefused)
+}
+
+func TestServerReceiveQueue(t *testing.T) {
+	var eventRecorder events.Recorder
+	acceptConn := make(chan struct{})
+	defer close(acceptConn)
+	newConnChan := make(chan struct{}, protocol.MaxServerUnprocessedPackets+2)
+	server := newTestServer(t, &serverOpts{
+		eventRecorder: &eventRecorder,
+		newConn: func(
+			_ context.Context,
+			_ context.CancelCauseFunc,
+			_ sendConn,
+			_ connRunner,
+			_ protocol.ConnectionID,
+			_ *protocol.ConnectionID,
+			_ protocol.ConnectionID,
+			_ protocol.ConnectionID,
+			_ protocol.ConnectionID,
+			_ ConnectionIDGenerator,
+			_ *statelessResetter,
+			_ *Config,
+			_ *tls.Config,
+			_ *handshake.TokenGenerator,
+			_ bool,
+			_ time.Duration,
+			_ qlogwriter.Trace,
+			_ utils.Logger,
+			_ protocol.Version,
+		) *wrappedConn {
+			newConnChan <- struct{}{}
+			<-acceptConn
+			return &wrappedConn{testHooks: &connTestHooks{handlePacket: func(receivedPacket) {}}}
+		},
+	})
+
+	conn := newUDPConnLocalhost(t)
+	for i := range protocol.MaxServerUnprocessedPackets + 1 {
+		server.handlePacket(getValidInitialPacket(t, conn.LocalAddr(), randConnID(6), randConnID(8)))
+		// newConn blocks on the acceptConn channel, so this blocks the server's run loop
+		if i == 0 {
+			select {
+			case <-newConnChan:
+			case <-time.After(time.Second):
+				t.Fatal("timeout")
+			}
+		}
+	}
+
+	p := getValidInitialPacket(t, conn.LocalAddr(), randConnID(6), randConnID(8))
+	server.handlePacket(p)
+
+	require.Eventually(t,
+		func() bool { return len(eventRecorder.Events(qlog.PacketDropped{})) > 0 },
+		time.Second,
+		10*time.Millisecond,
+	)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropDOSPrevention,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+}
+
+func TestServerAccept(t *testing.T) {
+	t.Run("without accept early", func(t *testing.T) {
+		testServerAccept(t, false)
+	})
+	t.Run("with accept early", func(t *testing.T) {
+		testServerAccept(t, true)
+	})
+}
+
+func testServerAccept(t *testing.T, acceptEarly bool) {
+	ready := make(chan struct{})
+	hooks := &connTestHooks{}
+	if acceptEarly {
+		hooks.earlyConnReady = func() <-chan struct{} { return ready }
+	} else {
+		hooks.handshakeComplete = func() <-chan struct{} { return ready }
+	}
+	recorder := newConnConstructorRecorder(hooks)
+	server := newTestServer(t, &serverOpts{
+		acceptEarly: acceptEarly,
+		newConn:     recorder.NewConn,
+	})
+
+	// Accept should respect the context
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	_, err := server.Accept(ctx)
+	require.ErrorIs(t, err, context.Canceled)
+
+	// establish a new connection, which then starts handshaking
+	server.handlePacket(getValidInitialPacket(t,
+		&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+		randConnID(6),
+		randConnID(8),
+	))
+
+	accepted := make(chan error, 1)
+	go func() {
+		_, err := server.Accept(context.Background())
+		accepted <- err
+	}()
+
+	select {
+	case <-accepted:
+		t.Fatal("server accepted the connection too early")
+	case <-time.After(scaleDuration(5 * time.Millisecond)):
+	}
+	// now complete the handshake
+	close(ready)
+
+	select {
+	case err := <-accepted:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestServerAcceptHandshakeFailure(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	recorder := newConnConstructorRecorder(&connTestHooks{
+		context:           func() context.Context { return ctx },
+		handshakeComplete: func() <-chan struct{} { return make(chan struct{}) },
+	})
+	server := newTestServer(t, &serverOpts{newConn: recorder.NewConn})
+
+	// establish a new connection, which then starts handshaking
+	server.handlePacket(getValidInitialPacket(t,
+		&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+		randConnID(6),
+		randConnID(8),
+	))
+
+	accepted := make(chan error, 1)
+	go func() {
+		_, err := server.Accept(context.Background())
+		accepted <- err
+	}()
+
+	cancel()
+	select {
+	case <-accepted:
+		t.Fatal("server should not have accepted the connection")
+	case <-time.After(scaleDuration(5 * time.Millisecond)):
+	}
+}
+
+func TestServerAcceptQueue(t *testing.T) {
+	var conns []*connTestHooks
+	rejectedCloseError := make(chan TransportErrorCode, 1)
+	for i := range protocol.MaxAcceptQueueSize + 2 {
+		conn := &connTestHooks{
+			handshakeComplete: func() <-chan struct{} {
+				c := make(chan struct{})
+				close(c)
+				return c
+			},
+		}
+		conns = append(conns, conn)
+		if i == protocol.MaxAcceptQueueSize {
+			conn.closeWithTransportError = func(code TransportErrorCode) { rejectedCloseError <- code }
+			continue
+		}
+	}
+	recorder := newConnConstructorRecorder(conns...)
+	server := newTestServer(t, &serverOpts{newConn: recorder.NewConn})
+
+	for range protocol.MaxAcceptQueueSize {
+		b := make([]byte, 16)
+		rand.Read(b)
+		connID := protocol.ParseConnectionID(b)
+		server.handlePacket(
+			getValidInitialPacket(t, &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42}, randConnID(6), connID),
+		)
+		select {
+		case args := <-recorder.Args():
+			require.Equal(t, connID, args.origDestConnID)
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	}
+	// wait for the connection to be enqueued
+	time.Sleep(scaleDuration(10 * time.Millisecond))
+
+	server.handlePacket(
+		getValidInitialPacket(t, &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42}, randConnID(6), randConnID(8)),
+	)
+	select {
+	case <-recorder.Args():
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	select {
+	case code := <-rejectedCloseError:
+		require.Equal(t, ConnectionRefused, code)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+
+	// accept one connection, freeing up one slot in the accept queue
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	_, err := server.Accept(ctx)
+	require.NoError(t, err)
+
+	// it's now possible to enqueue a new connection
+	server.handlePacket(
+		getValidInitialPacket(t,
+			&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+			randConnID(6),
+			protocol.ParseConnectionID([]byte{8, 7, 6, 5, 4, 3, 2, 1}),
+		),
+	)
+	select {
+	case args := <-recorder.Args():
+		require.Equal(t, protocol.ParseConnectionID([]byte{8, 7, 6, 5, 4, 3, 2, 1}), args.origDestConnID)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestServer0RTTReordering(t *testing.T) {
+	var eventRecorder events.Recorder
+	packets := make(chan receivedPacket, protocol.Max0RTTQueueLen+1)
+	done := make(chan struct{})
+	recorder := newConnConstructorRecorder(&connTestHooks{
+		handlePacket:   func(p receivedPacket) { packets <- p },
+		earlyConnReady: func() <-chan struct{} { return make(chan struct{}) },
+		run:            func() error { close(done); return nil },
+	})
+	server := newTestServer(t, &serverOpts{
+		acceptEarly:   true,
+		eventRecorder: &eventRecorder,
+		newConn:       recorder.NewConn,
+	})
+
+	connID := protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8})
+
+	var zeroRTTPackets []receivedPacket
+
+	for range protocol.Max0RTTQueueLen {
+		p := getLongHeaderPacket(t,
+			&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+			&wire.ExtendedHeader{
+				Header: wire.Header{
+					Type:             protocol.PacketType0RTT,
+					SrcConnectionID:  protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}),
+					DestConnectionID: connID,
+					Length:           100,
+					Version:          protocol.Version1,
+				},
+				PacketNumberLen: protocol.PacketNumberLen4,
+			},
+			make([]byte, 100),
+		)
+		server.handlePacket(p)
+		zeroRTTPackets = append(zeroRTTPackets, p)
+	}
+
+	// send one more packet, this one should be dropped
+	p := getLongHeaderPacket(t,
+		&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+		&wire.ExtendedHeader{
+			Header: wire.Header{
+				Type:             protocol.PacketType0RTT,
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}),
+				DestConnectionID: connID,
+				Length:           100,
+				Version:          protocol.Version1,
+			},
+			PacketNumberLen: protocol.PacketNumberLen4,
+		},
+		make([]byte, 100),
+	)
+	server.handlePacket(p)
+
+	require.Eventually(t,
+		func() bool { return len(eventRecorder.Events(qlog.PacketDropped{})) > 0 },
+		time.Second,
+		10*time.Millisecond,
+	)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketType0RTT,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      protocol.Version1,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropDOSPrevention,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+
+	// now receive the Initial
+	initial := getValidInitialPacket(t, &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42}, randConnID(5), connID)
+	server.handlePacket(initial)
+
+	for i := range protocol.Max0RTTQueueLen + 1 {
+		select {
+		case p := <-packets:
+			if i == 0 {
+				require.Equal(t, initial.data, p.data)
+			} else {
+				require.Equal(t, zeroRTTPackets[i-1], p)
+			}
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+	}
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestServer0RTTQueueing(t *testing.T) {
+	var eventRecorder events.Recorder
+	server := newTestServer(t, &serverOpts{
+		acceptEarly:   true,
+		eventRecorder: &eventRecorder,
+	})
+
+	firstRcvTime := monotime.Now()
+	otherRcvTime := firstRcvTime.Add(protocol.Max0RTTQueueingDuration / 2)
+	var sizes []protocol.ByteCount
+	for i := range protocol.Max0RTTQueues {
+		b := make([]byte, 16)
+		rand.Read(b)
+		connID := protocol.ParseConnectionID(b)
+		size := protocol.ByteCount(500 + i)
+		p := getLongHeaderPacket(t,
+			&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+			&wire.ExtendedHeader{
+				Header: wire.Header{
+					Type:             protocol.PacketType0RTT,
+					SrcConnectionID:  protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}),
+					DestConnectionID: connID,
+					Length:           size,
+					Version:          protocol.Version1,
+				},
+				PacketNumberLen: protocol.PacketNumberLen4,
+			},
+			make([]byte, size),
+		)
+		if i == 0 {
+			p.rcvTime = firstRcvTime
+		} else {
+			p.rcvTime = otherRcvTime
+		}
+		sizes = append(sizes, p.Size())
+		server.handlePacket(p)
+	}
+
+	// maximum number of 0-RTT queues is reached, further packets are dropped
+	p := getLongHeaderPacket(t,
+		&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+		&wire.ExtendedHeader{
+			Header: wire.Header{
+				Type:             protocol.PacketType0RTT,
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}),
+				DestConnectionID: protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8}),
+				Length:           123,
+				Version:          protocol.Version1,
+			},
+			PacketNumberLen: protocol.PacketNumberLen4,
+		},
+		make([]byte, 123),
+	)
+	server.handlePacket(p)
+	require.Eventually(t,
+		func() bool { return len(eventRecorder.Events(qlog.PacketDropped{})) > 0 },
+		time.Second,
+		10*time.Millisecond,
+	)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketType0RTT,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      protocol.Version1,
+				},
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropDOSPrevention,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+	eventRecorder.Clear()
+
+	// There's no cleanup Go routine.
+	// Cleanup is triggered when new packets are received.
+	// 1. Receive one handshake packet, which triggers the cleanup of the first 0-RTT queue
+	triggerPacket := getLongHeaderPacket(t,
+		&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+		&wire.ExtendedHeader{
+			Header: wire.Header{
+				Type:             protocol.PacketTypeHandshake,
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}),
+				DestConnectionID: protocol.ParseConnectionID([]byte{8, 7, 6, 5, 4, 3, 2, 1}),
+				Length:           123,
+				Version:          protocol.Version1,
+			},
+			PacketNumberLen: protocol.PacketNumberLen4,
+		},
+		make([]byte, 123),
+	)
+	triggerPacket.rcvTime = firstRcvTime.Add(protocol.Max0RTTQueueingDuration + time.Nanosecond)
+	server.handlePacket(triggerPacket)
+	require.Eventually(t,
+		func() bool { return len(eventRecorder.Events(qlog.PacketDropped{})) == 2 },
+		time.Second,
+		10*time.Millisecond,
+	)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketTypeHandshake,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      protocol.Version1,
+				},
+				Raw:     qlog.RawInfo{Length: int(triggerPacket.Size())},
+				Trigger: qlog.PacketDropUnexpectedPacket,
+			},
+			qlog.PacketDropped{
+				Header: qlog.PacketHeader{
+					PacketType:   qlog.PacketType0RTT,
+					PacketNumber: protocol.InvalidPacketNumber,
+					Version:      protocol.Version1,
+				},
+				Raw:     qlog.RawInfo{Length: int(sizes[0])},
+				Trigger: qlog.PacketDropDOSPrevention,
+			},
+		},
+		eventRecorder.Events(qlog.PacketDropped{}),
+	)
+	eventRecorder.Clear()
+
+	// 2. Receive another handshake packet, which triggers the cleanup of the other 0-RTT queues
+	triggerPacket = getLongHeaderPacket(t,
+		&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 42},
+		&wire.ExtendedHeader{
+			Header: wire.Header{
+				Type:             protocol.PacketTypeHandshake,
+				SrcConnectionID:  protocol.ParseConnectionID([]byte{5, 4, 3, 2, 1}),
+				DestConnectionID: protocol.ParseConnectionID([]byte{8, 7, 6, 5, 4, 3, 2, 1}),
+				Length:           124,
+				Version:          protocol.Version1,
+			},
+			PacketNumberLen: protocol.PacketNumberLen4,
+		},
+		make([]byte, 124),
+	)
+	triggerPacket.rcvTime = otherRcvTime.Add(protocol.Max0RTTQueueingDuration + time.Nanosecond)
+	server.handlePacket(triggerPacket)
+
+	expectedEvents := []qlogwriter.Event{
+		qlog.PacketDropped{
+			Header: qlog.PacketHeader{
+				PacketType:   qlog.PacketTypeHandshake,
+				PacketNumber: protocol.InvalidPacketNumber,
+				Version:      protocol.Version1,
+			},
+			Raw:     qlog.RawInfo{Length: int(triggerPacket.Size())},
+			Trigger: qlog.PacketDropUnexpectedPacket,
+		},
+	}
+	for i := range protocol.Max0RTTQueues - 1 {
+		expectedEvents = append(expectedEvents, qlog.PacketDropped{
+			Header: qlog.PacketHeader{
+				PacketType:   qlog.PacketType0RTT,
+				PacketNumber: protocol.InvalidPacketNumber,
+				Version:      protocol.Version1,
+			},
+			Raw:     qlog.RawInfo{Length: int(sizes[i+1])},
+			Trigger: qlog.PacketDropDOSPrevention,
+		})
+	}
+	require.Eventually(t,
+		func() bool { return len(eventRecorder.Events(qlog.PacketDropped{})) == len(expectedEvents) },
+		time.Second,
+		10*time.Millisecond,
+	)
+
+	// queues are dropped in random order
+	for _, event := range expectedEvents {
+		require.Contains(t, eventRecorder.Events(qlog.PacketDropped{}), event)
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sni.go b/electron/native/private-transport/third_party/quic-go/sni.go
new file mode 100644
index 000000000..f63023f97
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sni.go
@@ -0,0 +1,136 @@
+package quic
+
+import (
+	"encoding/binary"
+	"errors"
+	"io"
+)
+
+const (
+	extTypeSNI = 0
+	extTypeECH = 0xfe0d
+)
+
+// findSNIAndECH parses the given byte slice as a ClientHello, and locates:
+// - the position and length of the Server Name Indication (SNI) extension,
+// - the position of the Encrypted Client Hello (ECH) extension.
+// If no SNI extension is found, it returns -1 for the SNI position.
+// If no ECH extension is found, it returns -1 for the ECH position.
+func findSNIAndECH(data []byte) (sniPos, sniLen, echPos int, err error) {
+	if len(data) < 4 {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	if data[0] != 1 {
+		return 0, 0, 0, errors.New("not a ClientHello")
+	}
+	handshakeLen := int(data[1])<<16 | int(data[2])<<8 | int(data[3])
+	if len(data) != 4+handshakeLen {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+
+	parsePos := 4
+	// Skip protocol version (2 bytes)
+	if parsePos+2 > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	parsePos += 2
+	// skip random (32 bytes)
+	if parsePos+32 > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	parsePos += 32
+	// session ID
+	if parsePos+1 > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	sessionIDLen := int(data[parsePos])
+	parsePos++
+	if parsePos+sessionIDLen > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	parsePos += sessionIDLen
+	// cipher suites
+	if parsePos+2 > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	cipherSuitesLen := int(binary.BigEndian.Uint16(data[parsePos:]))
+	parsePos += 2
+	if parsePos+cipherSuitesLen > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	parsePos += cipherSuitesLen
+	// compression methods
+	if parsePos+1 > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	compressionMethodsLen := int(data[parsePos])
+	parsePos++
+	if parsePos+compressionMethodsLen > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	parsePos += compressionMethodsLen
+
+	// extensions
+	if parsePos+2 > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	extensionsLen := int(binary.BigEndian.Uint16(data[parsePos:]))
+	parsePos += 2
+	if parsePos+extensionsLen > len(data) {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	extensionsStart := parsePos
+	extensions := data[extensionsStart : extensionsStart+extensionsLen]
+
+	// parse extensions
+	var extPos int
+	sniPos = -1
+	echPos = -1
+	for extPos+4 <= extensionsLen {
+		extType := binary.BigEndian.Uint16(extensions[extPos:])
+		extLen := int(binary.BigEndian.Uint16(extensions[extPos+2:]))
+		if extPos+4+extLen > extensionsLen {
+			return 0, 0, 0, io.ErrUnexpectedEOF
+		}
+		switch extType {
+		case extTypeSNI:
+			if sniPos != -1 {
+				return 0, 0, 0, errors.New("multiple SNI extensions")
+			}
+			sniData := extensions[extPos+4 : extPos+4+extLen]
+			if len(sniData) < 2 {
+				return 0, 0, 0, io.ErrUnexpectedEOF
+			}
+			nameListLen := int(binary.BigEndian.Uint16(sniData))
+			if len(sniData) != 2+nameListLen {
+				return 0, 0, 0, io.ErrUnexpectedEOF
+			}
+			listPos := 2
+			for listPos+3 <= nameListLen+2 {
+				nameType := sniData[listPos]
+				sniLen = int(binary.BigEndian.Uint16(sniData[listPos+1:]))
+				if listPos+3+sniLen > len(sniData) {
+					return 0, 0, 0, io.ErrUnexpectedEOF
+				}
+				if nameType == 0 { // host_name
+					sniPos = extensionsStart + extPos + 4 + listPos + 3
+					break // stop after first host_name
+				}
+				listPos += 3 + sniLen
+			}
+			if sniPos == 0 {
+				return 0, 0, 0, errors.New("SNI host_name not found")
+			}
+		case extTypeECH:
+			if echPos != -1 {
+				return 0, 0, 0, errors.New("multiple ECH extensions")
+			}
+			echPos = extensionsStart + extPos
+		}
+		extPos += 4 + extLen
+		if sniPos != -1 && echPos != -1 {
+			break
+		}
+	}
+	return sniPos, sniLen, echPos, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sni_test.go b/electron/native/private-transport/third_party/quic-go/sni_test.go
new file mode 100644
index 000000000..bf3d3eb96
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sni_test.go
@@ -0,0 +1,301 @@
+package quic
+
+import (
+	"context"
+	"crypto/ecdh"
+	"crypto/rand"
+	"crypto/tls"
+	"encoding/binary"
+	"fmt"
+	"io"
+	mrand "math/rand/v2"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/testdata"
+	"golang.org/x/crypto/cryptobyte"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func checkClientHello(clientHello []byte) error {
+	conn := tls.QUICServer(&tls.QUICConfig{
+		TLSConfig: testdata.GetTLSConfig(),
+	})
+	if err := conn.Start(context.Background()); err != nil {
+		return err
+	}
+	defer conn.Close()
+	return conn.HandleData(tls.QUICEncryptionLevelInitial, clientHello)
+}
+
+func getClientHello(serverName string) ([]byte, error) {
+	c := tls.QUICClient(&tls.QUICConfig{
+		TLSConfig: &tls.Config{
+			ServerName:         serverName,
+			MinVersion:         tls.VersionTLS13,
+			InsecureSkipVerify: serverName == "",
+			// disable post-quantum curves
+			CurvePreferences: []tls.CurveID{tls.CurveP256},
+		},
+	})
+	b := make([]byte, mrand.IntN(200))
+	rand.Read(b)
+	c.SetTransportParameters(b)
+	if err := c.Start(context.Background()); err != nil {
+		return nil, err
+	}
+
+	ev := c.NextEvent()
+	if ev.Kind != tls.QUICWriteData {
+		return nil, fmt.Errorf("expected QUICWriteData event, got %v", ev.Kind)
+	}
+	if err := checkClientHello(ev.Data); err != nil {
+		return nil, err
+	}
+	return ev.Data, nil
+}
+
+func getClientHelloWithECH(serverName string) ([]byte, error) {
+	// various constants from the standard library's (internal) hpke package
+	const (
+		DHKEM_X25519_HKDF_SHA256 = 0x20
+		KDF_HKDF_SHA256          = 1
+		AEAD_AES_128_GCM         = 1
+	)
+
+	marshalECHConfig := func(id uint8, pubKey []byte, publicName string, maxNameLen uint8) []byte {
+		builder := cryptobyte.NewBuilder(nil)
+		builder.AddUint16(extTypeECH)
+		builder.AddUint16LengthPrefixed(func(builder *cryptobyte.Builder) {
+			builder.AddUint8(id)
+			builder.AddUint16(DHKEM_X25519_HKDF_SHA256)
+			builder.AddUint16LengthPrefixed(func(builder *cryptobyte.Builder) { builder.AddBytes(pubKey) })
+			builder.AddUint16LengthPrefixed(func(builder *cryptobyte.Builder) {
+				builder.AddUint16(KDF_HKDF_SHA256)
+				builder.AddUint16(AEAD_AES_128_GCM)
+			})
+			builder.AddUint8(maxNameLen)
+			builder.AddUint8LengthPrefixed(func(builder *cryptobyte.Builder) {
+				builder.AddBytes([]byte(publicName))
+			})
+			builder.AddUint16(0) // extensions
+		})
+
+		return builder.BytesOrPanic()
+	}
+
+	echKey, _ := ecdh.X25519().GenerateKey(rand.Reader)
+	echConfig := marshalECHConfig(42, echKey.PublicKey().Bytes(), serverName, 32)
+
+	builder := cryptobyte.NewBuilder(nil)
+	builder.AddUint16LengthPrefixed(func(builder *cryptobyte.Builder) { builder.AddBytes(echConfig) })
+
+	c := tls.QUICClient(&tls.QUICConfig{
+		TLSConfig: &tls.Config{
+			ServerName:                     serverName,
+			MinVersion:                     tls.VersionTLS13,
+			EncryptedClientHelloConfigList: builder.BytesOrPanic(),
+			InsecureSkipVerify:             serverName == "",
+			// disable post-quantum curves
+			CurvePreferences: []tls.CurveID{tls.CurveP256},
+		},
+	})
+	b := make([]byte, mrand.IntN(200))
+	rand.Read(b)
+	c.SetTransportParameters(b)
+	if err := c.Start(context.Background()); err != nil {
+		return nil, err
+	}
+
+	ev := c.NextEvent()
+	if ev.Kind != tls.QUICWriteData {
+		return nil, fmt.Errorf("expected QUICWriteData event, got %v", ev.Kind)
+	}
+	if err := checkClientHello(ev.Data); err != nil {
+		return nil, err
+	}
+	return ev.Data, nil
+}
+
+// shuffleClientHelloExtensions takes a TLS 1.3 ClientHello message (without the record layer)
+// and returns a new ClientHello with its extensions shuffled. Returns nil if the input is invalid.
+func shuffleClientHelloExtensions(t testing.TB, clientHello []byte) []byte {
+	t.Helper()
+
+	// Basic validation: ensure minimum length and correct handshake type (0x01 for ClientHello)
+	if len(clientHello) < 4 || clientHello[0] != 0x01 {
+		t.Fatalf("not a ClientHello")
+	}
+
+	// Extract the 3-byte length (24-bit integer) and validate total length
+	length := uint32(clientHello[1])<<16 | uint32(clientHello[2])<<8 | uint32(clientHello[3])
+	require.Equal(t, 4+int(length), len(clientHello))
+
+	// Body is everything after type and length
+	body := clientHello[4 : 4+length]
+	var pos int
+	// Parse fixed and variable-length fields to reach extensions
+	require.Greater(t, len(body), pos+2) // protocol version: 2 bytes
+	pos += 2
+	require.Greater(t, len(body), pos+32) // random: 32 bytes
+	pos += 32
+	require.Greater(t, len(body), pos+1) // session ID length: 1 byte
+	sessionIDLen := int(body[pos])
+	pos += 1
+	require.Greater(t, len(body), pos+sessionIDLen) // session ID data
+	pos += sessionIDLen
+	require.Greater(t, len(body), pos+2) // cipher suites length: 2 bytes
+	cipherSuitesLen := int(body[pos])<<8 | int(body[pos+1])
+	pos += 2
+	require.Greater(t, len(body), pos+cipherSuitesLen) // cipher suites data
+	pos += cipherSuitesLen
+	require.Greater(t, len(body), pos+1) // compression methods length: 1 byte
+	compressionMethodsLen := int(body[pos])
+	pos += 1
+	require.Greater(t, len(body), pos+compressionMethodsLen) // compression methods data
+	pos += compressionMethodsLen
+
+	// Extensions: 2 bytes total length + data (may be absent)
+	if pos+2 > len(body) {
+		// No extensions present; return original
+		return clientHello
+	}
+	extensionsLen := int(body[pos])<<8 | int(body[pos+1])
+	pos += 2
+	require.Equal(t, pos+extensionsLen, len(body)) // extensions length doesn't match remaining data
+	extensionsData := body[pos : pos+extensionsLen]
+
+	// parse extensions into a slice of byte slices
+	var extensions [][]byte
+	var extPos int
+	for extPos < extensionsLen {
+		require.Greater(t, extensionsLen, extPos+4) // type and length
+		extLen := int(extensionsData[extPos+2])<<8 | int(extensionsData[extPos+3])
+		require.LessOrEqual(t, extPos+4+extLen, extensionsLen) // extension exceeds total length
+		// extract entire extension (type: 2 bytes, length: 2 bytes, data)
+		extData := extensionsData[extPos : extPos+4+extLen]
+		extensions = append(extensions, extData)
+		extPos += 4 + extLen
+	}
+
+	// shuffle extensions using a proper random source
+	mrand.Shuffle(len(extensions), func(i, j int) {
+		extensions[i], extensions[j] = extensions[j], extensions[i]
+	})
+
+	// reconstruct extensions data
+	var newExtensionsData []byte
+	for _, ext := range extensions {
+		newExtensionsData = append(newExtensionsData, ext...)
+	}
+
+	// reconstruct body: prefix (up to and including extensions length) + shuffled extensions
+	prefix := body[:pos]
+	newBody := append(prefix, newExtensionsData...)
+	// reconstruct ClientHello: type (0x01) + original length + new body
+	newClientHello := []byte{0x01}
+	lengthBytes := clientHello[1:4] // length unchanged since only extensions are shuffled
+	newClientHello = append(newClientHello, lengthBytes...)
+	newClientHello = append(newClientHello, newBody...)
+	// check that it's actually valid
+	if err := checkClientHello(newClientHello); err != nil {
+		t.Fatalf("invalid ClientHello: %v", err)
+	}
+	return newClientHello
+}
+
+func TestFindSNI(t *testing.T) {
+	t.Run("without SNI", func(t *testing.T) {
+		testFindSNI(t, "")
+	})
+	t.Run("without subdomain", func(t *testing.T) {
+		testFindSNI(t, "quic-go.net")
+	})
+	t.Run("with subdomain", func(t *testing.T) {
+		testFindSNI(t, "sub.do.ma.in.quic-go.net")
+	})
+}
+
+func testFindSNI(t *testing.T, serverName string) {
+	clientHello, err := getClientHello(serverName)
+	require.NoError(t, err)
+	sniPos, sniLen, echPos, err := findSNIAndECH(clientHello)
+	require.NoError(t, err)
+	assert.Equal(t, -1, echPos)
+	if serverName == "" {
+		require.Equal(t, -1, sniPos)
+		return
+	}
+	assert.Equal(t, len(serverName), sniLen)
+	require.NotEqual(t, -1, sniPos)
+	require.Equal(t, serverName, string(clientHello[sniPos:sniPos+sniLen]))
+
+	// incomplete ClientHellos result in an io.ErrUnexpectedEOF
+	for i := range clientHello {
+		_, _, _, err := findSNIAndECH(clientHello[:i])
+		require.ErrorIs(t, err, io.ErrUnexpectedEOF)
+	}
+}
+
+func TestFindSNIWithECH(t *testing.T) {
+	const serverName = "public.example"
+	clientHello, err := getClientHelloWithECH(serverName)
+	require.NoError(t, err)
+	clientHello = shuffleClientHelloExtensions(t, clientHello)
+	sniPos, sniLen, echPos, err := findSNIAndECH(clientHello)
+	require.NoError(t, err)
+	require.NotEqual(t, -1, echPos)
+	require.Equal(t, uint16(extTypeECH), binary.BigEndian.Uint16(clientHello[echPos:echPos+2]))
+	assert.Equal(t, len(serverName), sniLen)
+	require.NotEqual(t, -1, sniPos)
+	require.Equal(t, serverName, string(clientHello[sniPos:sniPos+sniLen]))
+
+	for i := range clientHello {
+		_, _, _, err := findSNIAndECH(clientHello[:i])
+		require.ErrorIs(t, err, io.ErrUnexpectedEOF)
+	}
+}
+
+// findSNI is never run with attacker-controlled inputs (other than the session ticket),
+// so this is not a high-value target to begin with,
+// and doesn't need to be run in ClusterFuzz.
+// It's still useful to find potential corner cases in the parser.
+func FuzzFindSNI(f *testing.F) {
+	addSeed := func(serverName string, maxSize int) {
+		ch, err := getClientHello(serverName)
+		require.NoError(f, err)
+		f.Add(ch, maxSize)
+	}
+	addSeedWithECH := func(serverName string, maxSize int) {
+		ch, err := getClientHelloWithECH(serverName)
+		require.NoError(f, err)
+		f.Add(ch, maxSize)
+	}
+
+	addSeed("", 10)
+	addSeed("google.com", 20)
+	addSeed("sub.do.ma.in.quic-go.net", 30)
+	addSeedWithECH("quic-go.net", 40)
+
+	f.Fuzz(func(t *testing.T, data []byte, maxSize int) {
+		cs := newInitialCryptoStream(true)
+		if _, err := cs.Write(data); err != nil {
+			return
+		}
+		segments := make(map[protocol.ByteCount][]byte)
+		if !cs.HasData() { // incomplete ClientHello
+			return
+		}
+		for cs.HasData() {
+			f := cs.PopCryptoFrame(5 + protocol.ByteCount(maxSize))
+			if f == nil {
+				return
+			}
+			segments[f.Offset] = f.Data
+		}
+		reassembled := reassembleCryptoData(t, segments)
+		require.Equal(t, data, reassembled)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/stateless_reset.go b/electron/native/private-transport/third_party/quic-go/stateless_reset.go
new file mode 100644
index 000000000..cd0059a53
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/stateless_reset.go
@@ -0,0 +1,42 @@
+package quic
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"hash"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+type statelessResetter struct {
+	mx sync.Mutex
+	h  hash.Hash
+}
+
+// newStatelessRetter creates a new stateless reset generator.
+// It is valid to use a nil key. In that case, a random key will be used.
+// This makes is impossible for on-path attackers to shut down established connections.
+func newStatelessResetter(key *StatelessResetKey) *statelessResetter {
+	var h hash.Hash
+	if key != nil {
+		h = hmac.New(sha256.New, key[:])
+	} else {
+		b := make([]byte, 32)
+		_, _ = rand.Read(b)
+		h = hmac.New(sha256.New, b)
+	}
+	return &statelessResetter{h: h}
+}
+
+func (r *statelessResetter) GetStatelessResetToken(connID protocol.ConnectionID) protocol.StatelessResetToken {
+	r.mx.Lock()
+	defer r.mx.Unlock()
+
+	var token protocol.StatelessResetToken
+	r.h.Write(connID.Bytes())
+	copy(token[:], r.h.Sum(nil))
+	r.h.Reset()
+	return token
+}
diff --git a/electron/native/private-transport/third_party/quic-go/stateless_reset_test.go b/electron/native/private-transport/third_party/quic-go/stateless_reset_test.go
new file mode 100644
index 000000000..7f0aa6327
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/stateless_reset_test.go
@@ -0,0 +1,42 @@
+package quic
+
+import (
+	"crypto/rand"
+	"testing"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStatelessResetter(t *testing.T) {
+	t.Run("no key", func(t *testing.T) {
+		r1 := newStatelessResetter(nil)
+		r2 := newStatelessResetter(nil)
+		for range 100 {
+			b := make([]byte, 15)
+			rand.Read(b)
+			connID := protocol.ParseConnectionID(b)
+			t1 := r1.GetStatelessResetToken(connID)
+			t2 := r2.GetStatelessResetToken(connID)
+			require.NotZero(t, t1)
+			require.NotZero(t, t2)
+			require.NotEqual(t, t1, t2)
+		}
+	})
+
+	t.Run("with key", func(t *testing.T) {
+		var key StatelessResetKey
+		rand.Read(key[:])
+		m := newStatelessResetter(&key)
+		b := make([]byte, 8)
+		rand.Read(b)
+		connID := protocol.ParseConnectionID(b)
+		token := m.GetStatelessResetToken(connID)
+		require.NotZero(t, token)
+		require.Equal(t, token, m.GetStatelessResetToken(connID))
+		// generate a new connection ID
+		rand.Read(b)
+		connID2 := protocol.ParseConnectionID(b)
+		require.NotEqual(t, token, m.GetStatelessResetToken(connID2))
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/stream.go b/electron/native/private-transport/third_party/quic-go/stream.go
new file mode 100644
index 000000000..9365a08a2
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/stream.go
@@ -0,0 +1,262 @@
+package quic
+
+import (
+	"context"
+	"net"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/ackhandler"
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type deadlineError struct{}
+
+func (deadlineError) Error() string   { return "deadline exceeded" }
+func (deadlineError) Temporary() bool { return true }
+func (deadlineError) Timeout() bool   { return true }
+func (deadlineError) Unwrap() error   { return os.ErrDeadlineExceeded }
+
+var errDeadline net.Error = &deadlineError{}
+
+// The streamSender is notified by the stream about various events.
+type streamSender interface {
+	onHasConnectionData()
+	onHasStreamData(protocol.StreamID, *SendStream)
+	onHasStreamRetransmission(protocol.StreamID, *SendStream)
+	onHasStreamControlFrame(protocol.StreamID, streamControlFrameGetter)
+	updateStreamPriority(protocol.StreamID)
+	recordStreamPriorityUpdated(protocol.StreamID, int8, bool)
+	// must be called without holding the mutex that is acquired by closeForShutdown
+	onStreamCompleted(protocol.StreamID)
+}
+
+// Each of the both stream halves gets its own uniStreamSender.
+// This is necessary in order to keep track when both halves have been completed.
+type uniStreamSender struct {
+	streamSender
+	onStreamCompletedImpl       func()
+	onHasStreamControlFrameImpl func(protocol.StreamID, streamControlFrameGetter)
+}
+
+func (s *uniStreamSender) onHasStreamData(id protocol.StreamID, str *SendStream) {
+	s.streamSender.onHasStreamData(id, str)
+}
+func (s *uniStreamSender) onStreamCompleted(protocol.StreamID) { s.onStreamCompletedImpl() }
+func (s *uniStreamSender) onHasStreamControlFrame(id protocol.StreamID, str streamControlFrameGetter) {
+	s.onHasStreamControlFrameImpl(id, str)
+}
+
+var _ streamSender = &uniStreamSender{}
+
+type Stream struct {
+	receiveStr *ReceiveStream
+	sendStr    *SendStream
+
+	completedMutex         sync.Mutex
+	sender                 streamSender
+	receiveStreamCompleted bool
+	sendStreamCompleted    bool
+}
+
+var (
+	_ outgoingStream            = &Stream{}
+	_ sendStreamFrameHandler    = &Stream{}
+	_ receiveStreamFrameHandler = &Stream{}
+)
+
+// newStream creates a new Stream
+func newStream(
+	ctx context.Context,
+	streamID protocol.StreamID,
+	sender streamSender,
+	flowController *streamFlowController,
+	supportsResetStreamAt bool,
+) *Stream {
+	s := &Stream{sender: sender}
+	senderForSendStream := &uniStreamSender{
+		streamSender: sender,
+		onStreamCompletedImpl: func() {
+			s.completedMutex.Lock()
+			s.sendStreamCompleted = true
+			s.checkIfCompleted()
+			s.completedMutex.Unlock()
+		},
+		onHasStreamControlFrameImpl: func(id protocol.StreamID, str streamControlFrameGetter) {
+			sender.onHasStreamControlFrame(streamID, s)
+		},
+	}
+	s.sendStr = newSendStream(ctx, streamID, senderForSendStream, flowController, supportsResetStreamAt)
+	senderForReceiveStream := &uniStreamSender{
+		streamSender: sender,
+		onStreamCompletedImpl: func() {
+			s.completedMutex.Lock()
+			s.receiveStreamCompleted = true
+			s.checkIfCompleted()
+			s.completedMutex.Unlock()
+		},
+		onHasStreamControlFrameImpl: func(id protocol.StreamID, str streamControlFrameGetter) {
+			sender.onHasStreamControlFrame(streamID, s)
+		},
+	}
+	s.receiveStr = newReceiveStream(streamID, senderForReceiveStream, flowController)
+	return s
+}
+
+// StreamID returns the stream ID.
+func (s *Stream) StreamID() StreamID {
+	// the result is same for receiveStream and sendStream
+	return s.sendStr.StreamID()
+}
+
+// SetPriority sets the scheduling priority for data sent on the stream.
+// See [SendStream.SetPriority] for details.
+func (s *Stream) SetPriority(urgency int8, incremental bool) {
+	s.sendStr.SetPriority(urgency, incremental)
+}
+
+// Read reads data from the stream.
+// Read can be made to time out using [Stream.SetReadDeadline] and [Stream.SetDeadline].
+// If the stream was canceled, the error is a [StreamError].
+func (s *Stream) Read(p []byte) (int, error) {
+	return s.receiveStr.Read(p)
+}
+
+// Peek fills b with stream data, without consuming the stream data.
+// It blocks until len(b) bytes are available, or an error occurs.
+// It respects the stream deadline set by [Stream.SetReadDeadline].
+// If the stream ends before len(b) bytes are available,
+// it returns the number of bytes peeked along with [io.EOF].
+func (s *Stream) Peek(b []byte) (int, error) {
+	return s.receiveStr.Peek(b)
+}
+
+// Write writes data to the stream.
+// Write can be made to time out using [Stream.SetWriteDeadline] or [Stream.SetDeadline].
+// If the stream was canceled, the error is a [StreamError].
+func (s *Stream) Write(p []byte) (int, error) {
+	return s.sendStr.Write(p)
+}
+
+// WriteWithLimit writes data to the stream, subject to an additional send limit.
+// See [SendStream.WriteWithLimit] for more details.
+func (s *Stream) WriteWithLimit(p []byte, limiter func(maxBytes int) int) (int, error) {
+	return s.sendStr.WriteWithLimit(p, limiter)
+}
+
+// TryWriteAll writes data to the stream if it can be queued immediately.
+// See [SendStream.TryWriteAll] for more details.
+func (s *Stream) TryWriteAll(p []byte) error {
+	return s.sendStr.TryWriteAll(p)
+}
+
+// SetReliableBoundary marks the data written to this stream so far as reliable.
+// It is valid to call this function multiple times, thereby increasing the reliable size.
+// It only has an effect if the peer enabled support for the RESET_STREAM_AT extension,
+// otherwise, it is a no-op.
+func (s *Stream) SetReliableBoundary() {
+	s.sendStr.SetReliableBoundary()
+}
+
+// CancelWrite aborts sending on this stream.
+// See [SendStream.CancelWrite] for more details.
+func (s *Stream) CancelWrite(errorCode StreamErrorCode) {
+	s.sendStr.CancelWrite(errorCode)
+}
+
+// CancelRead aborts receiving on this stream.
+// See [ReceiveStream.CancelRead] for more details.
+func (s *Stream) CancelRead(errorCode StreamErrorCode) {
+	s.receiveStr.CancelRead(errorCode)
+}
+
+// SetReceiveFinalSizeCallback sets a callback that is called when the receive side's final size is known.
+// See [ReceiveStream.SetReceiveFinalSizeCallback] for more details.
+// Most applications don't need this. It is mainly useful for protocol layers
+// that need exact stream final sizes, such as WebTransport flow control accounting.
+func (s *Stream) SetReceiveFinalSizeCallback(callback func(int64)) {
+	s.receiveStr.SetReceiveFinalSizeCallback(callback)
+}
+
+// The Context is canceled as soon as the write-side of the stream is closed.
+// See [SendStream.Context] for more details.
+func (s *Stream) Context() context.Context {
+	return s.sendStr.Context()
+}
+
+// Close closes the send-direction of the stream.
+// It does not close the receive-direction of the stream.
+func (s *Stream) Close() error {
+	return s.sendStr.Close()
+}
+
+func (s *Stream) handleResetStreamFrame(frame *wire.ResetStreamFrame, rcvTime monotime.Time) error {
+	return s.receiveStr.handleResetStreamFrame(frame, rcvTime)
+}
+
+func (s *Stream) handleStreamFrame(frame *wire.StreamFrame, rcvTime monotime.Time) error {
+	return s.receiveStr.handleStreamFrame(frame, rcvTime)
+}
+
+func (s *Stream) handleStopSendingFrame(frame *wire.StopSendingFrame) {
+	s.sendStr.handleStopSendingFrame(frame)
+}
+
+func (s *Stream) updateSendWindow(limit protocol.ByteCount) {
+	s.sendStr.updateSendWindow(limit)
+}
+
+func (s *Stream) enableResetStreamAt() {
+	s.sendStr.enableResetStreamAt()
+}
+
+func (s *Stream) popStreamFrame(maxBytes protocol.ByteCount, v protocol.Version) (_ ackhandler.StreamFrame, _ *wire.StreamDataBlockedFrame, hasMore bool) {
+	return s.sendStr.popStreamFrame(maxBytes, v)
+}
+
+func (s *Stream) getControlFrame(now monotime.Time) (_ ackhandler.Frame, ok, hasMore bool) {
+	f, ok, _ := s.sendStr.getControlFrame(now)
+	if ok {
+		return f, true, true
+	}
+	return s.receiveStr.getControlFrame(now)
+}
+
+// SetReadDeadline sets the deadline for future [Stream.Read] calls.
+// See [ReceiveStream.SetReadDeadline] for more details.
+func (s *Stream) SetReadDeadline(t time.Time) error {
+	return s.receiveStr.SetReadDeadline(t)
+}
+
+// SetWriteDeadline sets the deadline for future [Stream.Write] calls.
+// See [SendStream.SetWriteDeadline] for more details.
+func (s *Stream) SetWriteDeadline(t time.Time) error {
+	return s.sendStr.SetWriteDeadline(t)
+}
+
+// SetDeadline sets the read and write deadlines associated with the stream.
+// It is equivalent to calling both [Stream.SetReadDeadline] and [Stream.SetWriteDeadline].
+func (s *Stream) SetDeadline(t time.Time) error {
+	_ = s.receiveStr.SetReadDeadline(t) // SetReadDeadline never errors
+	_ = s.sendStr.SetWriteDeadline(t)   // SetWriteDeadline never errors
+	return nil
+}
+
+// CloseForShutdown closes a stream abruptly.
+// It makes Read and Write unblock (and return the error) immediately.
+// The peer will NOT be informed about this: the stream is closed without sending a FIN or RST.
+func (s *Stream) closeForShutdown(err error) {
+	s.sendStr.closeForShutdown(err)
+	s.receiveStr.closeForShutdown(err)
+}
+
+// checkIfCompleted is called from the uniStreamSender, when one of the stream halves is completed.
+// It makes sure that the onStreamCompleted callback is only called if both receive and send side have completed.
+func (s *Stream) checkIfCompleted() {
+	if s.sendStreamCompleted && s.receiveStreamCompleted {
+		s.sender.onStreamCompleted(s.StreamID())
+	}
+}
diff --git a/electron/native/private-transport/third_party/quic-go/stream_test.go b/electron/native/private-transport/third_party/quic-go/stream_test.go
new file mode 100644
index 000000000..4d0bdcac1
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/stream_test.go
@@ -0,0 +1,109 @@
+package quic
+
+import (
+	"context"
+	"io"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func TestStreamDeadlines(t *testing.T) {
+	const streamID protocol.StreamID = 1337
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	fc := newTestStreamFlowControllerWithSendWindow(streamID, protocol.MaxByteCount)
+	str := newStream(context.Background(), streamID, mockSender, fc, false)
+
+	// SetDeadline sets both read and write deadlines
+	str.SetDeadline(time.Now().Add(-time.Second))
+	n, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+	require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+	require.Zero(t, n)
+
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar")}, monotime.Now()))
+	n, err = (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(make([]byte, 6))
+	require.ErrorIs(t, err, os.ErrDeadlineExceeded)
+	require.Zero(t, n)
+}
+
+func TestStreamReceiveFinalSizeCallback(t *testing.T) {
+	const streamID protocol.StreamID = 1337
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	fc := newTestStreamFlowControllerWithSendWindow(streamID, protocol.MaxByteCount)
+	str := newStream(context.Background(), streamID, mockSender, fc, false)
+
+	require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{Data: []byte("foobar"), Fin: true}, monotime.Now()))
+
+	var size int64
+	str.SetReceiveFinalSizeCallback(func(s int64) { size = s })
+	require.EqualValues(t, 6, size)
+}
+
+func TestStreamCompletion(t *testing.T) {
+	completeReadSide := func(
+		t *testing.T,
+		str *Stream,
+		mockCtrl *gomock.Controller,
+	) {
+		t.Helper()
+		require.NoError(t, str.handleStreamFrame(&wire.StreamFrame{
+			StreamID: str.StreamID(),
+			Data:     []byte("foobar"),
+			Fin:      true,
+		}, monotime.Now()))
+		_, err := (&readerWithTimeout{Reader: str, Timeout: time.Second}).Read(make([]byte, 6))
+		require.ErrorIs(t, err, io.EOF)
+		require.True(t, mockCtrl.Satisfied())
+	}
+
+	completeWriteSide := func(
+		t *testing.T,
+		str *Stream,
+		mockCtrl *gomock.Controller,
+		mockSender *MockStreamSender,
+	) {
+		t.Helper()
+		mockSender.EXPECT().onHasStreamData(str.StreamID(), gomock.Any()).Times(2)
+		_, err := (&writerWithTimeout{Writer: str, Timeout: time.Second}).Write([]byte("foobar"))
+		require.NoError(t, err)
+		require.NoError(t, str.Close())
+		f, _, _ := str.popStreamFrame(protocol.MaxByteCount, protocol.Version1)
+		require.NotNil(t, f.Frame)
+		require.True(t, f.Frame.Fin)
+		f.Handler.OnAcked(f.Frame)
+		require.True(t, mockCtrl.Satisfied())
+	}
+
+	const streamID protocol.StreamID = 1337
+
+	t.Run("first read, then write", func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockSender := NewMockStreamSender(mockCtrl)
+		fc := newTestStreamFlowControllerWithSendWindow(streamID, protocol.MaxByteCount)
+		str := newStream(context.Background(), streamID, mockSender, fc, false)
+
+		completeReadSide(t, str, mockCtrl)
+		mockSender.EXPECT().onStreamCompleted(streamID)
+		completeWriteSide(t, str, mockCtrl, mockSender)
+	})
+
+	t.Run("first write, then read", func(t *testing.T) {
+		mockCtrl := gomock.NewController(t)
+		mockSender := NewMockStreamSender(mockCtrl)
+		fc := newTestStreamFlowControllerWithSendWindow(streamID, protocol.MaxByteCount)
+		str := newStream(context.Background(), streamID, mockSender, fc, false)
+
+		completeWriteSide(t, str, mockCtrl, mockSender)
+		mockSender.EXPECT().onStreamCompleted(streamID)
+		completeReadSide(t, str, mockCtrl)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/streams_map.go b/electron/native/private-transport/third_party/quic-go/streams_map.go
new file mode 100644
index 000000000..6441b6a4e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/streams_map.go
@@ -0,0 +1,356 @@
+package quic
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+// StreamLimitReachedError is returned from [Conn.OpenStream] and [Conn.OpenUniStream]
+// when it is not possible to open a new stream because the number of open streams has reached
+// the peer's stream limit.
+type StreamLimitReachedError struct{}
+
+func (e StreamLimitReachedError) Error() string { return "too many open streams" }
+
+type streamsMap struct {
+	ctx         context.Context // not used for cancellations, but carries the values associated with the connection
+	perspective protocol.Perspective
+
+	maxIncomingBidiStreams uint64
+	maxIncomingUniStreams  uint64
+
+	sender            streamSender
+	queueControlFrame func(wire.Frame)
+	newFlowController func(protocol.StreamID) *streamFlowController
+
+	mutex                 sync.Mutex
+	outgoingBidiStreams   *outgoingStreamsMap[*Stream]
+	outgoingUniStreams    *outgoingStreamsMap[*SendStream]
+	incomingBidiStreams   *incomingStreamsMap[*Stream]
+	incomingUniStreams    *incomingStreamsMap[*ReceiveStream]
+	reset                 bool
+	supportsResetStreamAt bool
+}
+
+func newStreamsMap(
+	ctx context.Context,
+	sender streamSender,
+	queueControlFrame func(wire.Frame),
+	newFlowController func(protocol.StreamID) *streamFlowController,
+	maxIncomingBidiStreams uint64,
+	maxIncomingUniStreams uint64,
+	perspective protocol.Perspective,
+) *streamsMap {
+	m := &streamsMap{
+		ctx:                    ctx,
+		perspective:            perspective,
+		queueControlFrame:      queueControlFrame,
+		newFlowController:      newFlowController,
+		maxIncomingBidiStreams: maxIncomingBidiStreams,
+		maxIncomingUniStreams:  maxIncomingUniStreams,
+		sender:                 sender,
+	}
+	m.initMaps()
+	return m
+}
+
+func (m *streamsMap) initMaps() {
+	m.outgoingBidiStreams = newOutgoingStreamsMap(
+		protocol.StreamTypeBidi,
+		func(id protocol.StreamID) *Stream {
+			return newStream(m.ctx, id, m.sender, m.newFlowController(id), m.supportsResetStreamAt)
+		},
+		m.queueControlFrame,
+		m.perspective,
+	)
+	m.incomingBidiStreams = newIncomingStreamsMap(
+		protocol.StreamTypeBidi,
+		func(id protocol.StreamID) *Stream {
+			return newStream(m.ctx, id, m.sender, m.newFlowController(id), m.supportsResetStreamAt)
+		},
+		m.maxIncomingBidiStreams,
+		m.queueControlFrame,
+		m.perspective,
+	)
+	m.outgoingUniStreams = newOutgoingStreamsMap(
+		protocol.StreamTypeUni,
+		func(id protocol.StreamID) *SendStream {
+			return newSendStream(m.ctx, id, m.sender, m.newFlowController(id), m.supportsResetStreamAt)
+		},
+		m.queueControlFrame,
+		m.perspective,
+	)
+	m.incomingUniStreams = newIncomingStreamsMap(
+		protocol.StreamTypeUni,
+		func(id protocol.StreamID) *ReceiveStream {
+			return newReceiveStream(id, m.sender, m.newFlowController(id))
+		},
+		m.maxIncomingUniStreams,
+		m.queueControlFrame,
+		m.perspective,
+	)
+}
+
+func (m *streamsMap) OpenStream() (*Stream, error) {
+	m.mutex.Lock()
+	reset := m.reset
+	mm := m.outgoingBidiStreams
+	m.mutex.Unlock()
+	if reset {
+		return nil, Err0RTTRejected
+	}
+	return mm.OpenStream()
+}
+
+func (m *streamsMap) OpenStreamSync(ctx context.Context) (*Stream, error) {
+	m.mutex.Lock()
+	reset := m.reset
+	mm := m.outgoingBidiStreams
+	m.mutex.Unlock()
+	if reset {
+		return nil, Err0RTTRejected
+	}
+	return mm.OpenStreamSync(ctx)
+}
+
+func (m *streamsMap) OpenUniStream() (*SendStream, error) {
+	m.mutex.Lock()
+	reset := m.reset
+	mm := m.outgoingUniStreams
+	m.mutex.Unlock()
+	if reset {
+		return nil, Err0RTTRejected
+	}
+	return mm.OpenStream()
+}
+
+func (m *streamsMap) OpenUniStreamSync(ctx context.Context) (*SendStream, error) {
+	m.mutex.Lock()
+	reset := m.reset
+	mm := m.outgoingUniStreams
+	m.mutex.Unlock()
+	if reset {
+		return nil, Err0RTTRejected
+	}
+	return mm.OpenStreamSync(ctx)
+}
+
+func (m *streamsMap) AcceptStream(ctx context.Context) (*Stream, error) {
+	m.mutex.Lock()
+	reset := m.reset
+	mm := m.incomingBidiStreams
+	m.mutex.Unlock()
+	if reset {
+		return nil, Err0RTTRejected
+	}
+	return mm.AcceptStream(ctx)
+}
+
+func (m *streamsMap) AcceptUniStream(ctx context.Context) (*ReceiveStream, error) {
+	m.mutex.Lock()
+	reset := m.reset
+	mm := m.incomingUniStreams
+	m.mutex.Unlock()
+	if reset {
+		return nil, Err0RTTRejected
+	}
+	return mm.AcceptStream(ctx)
+}
+
+func (m *streamsMap) DeleteStream(id protocol.StreamID) error {
+	switch protocol.StreamTypeOf(id) {
+	case protocol.StreamTypeUni:
+		if protocol.StreamInitiator(id) == m.perspective {
+			return m.outgoingUniStreams.DeleteStream(id)
+		}
+		return m.incomingUniStreams.DeleteStream(id)
+	case protocol.StreamTypeBidi:
+		if protocol.StreamInitiator(id) == m.perspective {
+			return m.outgoingBidiStreams.DeleteStream(id)
+		}
+		return m.incomingBidiStreams.DeleteStream(id)
+	}
+	panic("")
+}
+
+func (m *streamsMap) HandleMaxStreamsFrame(f *wire.MaxStreamsFrame) {
+	switch f.Type {
+	case protocol.StreamTypeUni:
+		m.outgoingUniStreams.SetMaxStream(f.MaxStreamNum.StreamID(protocol.StreamTypeUni, m.perspective))
+	case protocol.StreamTypeBidi:
+		m.outgoingBidiStreams.SetMaxStream(f.MaxStreamNum.StreamID(protocol.StreamTypeBidi, m.perspective))
+	}
+}
+
+type sendStreamFrameHandler interface {
+	updateSendWindow(protocol.ByteCount)
+	handleStopSendingFrame(*wire.StopSendingFrame)
+}
+
+func (m *streamsMap) getSendStream(id protocol.StreamID) (sendStreamFrameHandler, error) {
+	switch protocol.StreamTypeOf(id) {
+	case protocol.StreamTypeUni:
+		if protocol.StreamInitiator(id) != m.perspective {
+			// an outgoing unidirectional stream is a send stream, not a receive stream
+			return nil, &qerr.TransportError{
+				ErrorCode:    qerr.StreamStateError,
+				ErrorMessage: fmt.Sprintf("invalid frame for send stream %d", id),
+			}
+		}
+		str, err := m.outgoingUniStreams.GetStream(id)
+		if str == nil || err != nil {
+			return nil, err
+		}
+		return str, nil
+	case protocol.StreamTypeBidi:
+		if protocol.StreamInitiator(id) == m.perspective {
+			str, err := m.outgoingBidiStreams.GetStream(id)
+			if str == nil || err != nil {
+				return nil, err
+			}
+			return str, nil
+		}
+		str, err := m.incomingBidiStreams.GetOrOpenStream(id)
+		if str == nil || err != nil {
+			return nil, err
+		}
+		return str, nil
+	}
+	panic("unreachable")
+}
+
+func (m *streamsMap) HandleMaxStreamDataFrame(f *wire.MaxStreamDataFrame) error {
+	str, err := m.getSendStream(f.StreamID)
+	if err != nil {
+		return err
+	}
+	if str == nil { // stream already deleted
+		return nil
+	}
+	str.updateSendWindow(f.MaximumStreamData)
+	return nil
+}
+
+func (m *streamsMap) HandleStopSendingFrame(f *wire.StopSendingFrame) error {
+	str, err := m.getSendStream(f.StreamID)
+	if err != nil {
+		return err
+	}
+	if str == nil { // stream already deleted
+		return nil
+	}
+	str.handleStopSendingFrame(f)
+	return nil
+}
+
+type receiveStreamFrameHandler interface {
+	handleResetStreamFrame(*wire.ResetStreamFrame, monotime.Time) error
+	handleStreamFrame(*wire.StreamFrame, monotime.Time) error
+}
+
+func (m *streamsMap) getReceiveStream(id protocol.StreamID) (receiveStreamFrameHandler, error) {
+	switch protocol.StreamTypeOf(id) {
+	case protocol.StreamTypeUni:
+		// an outgoing unidirectional stream is a send stream, not a receive stream
+		if protocol.StreamInitiator(id) == m.perspective {
+			return nil, &qerr.TransportError{
+				ErrorCode:    qerr.StreamStateError,
+				ErrorMessage: fmt.Sprintf("invalid frame for receive stream %d", id),
+			}
+		}
+		str, err := m.incomingUniStreams.GetOrOpenStream(id)
+		if err != nil || str == nil {
+			return nil, err
+		}
+		return str, nil
+	case protocol.StreamTypeBidi:
+		var str *Stream
+		var err error
+		if protocol.StreamInitiator(id) == m.perspective {
+			str, err = m.outgoingBidiStreams.GetStream(id)
+		} else {
+			str, err = m.incomingBidiStreams.GetOrOpenStream(id)
+		}
+		if str == nil || err != nil {
+			return nil, err
+		}
+		return str, nil
+	}
+	panic("unreachable")
+}
+
+func (m *streamsMap) HandleStreamDataBlockedFrame(f *wire.StreamDataBlockedFrame) error {
+	if _, err := m.getReceiveStream(f.StreamID); err != nil {
+		return err
+	}
+	// We don't need to do anything in response to a STREAM_DATA_BLOCKED frame,
+	// but we need to make sure that the stream ID is valid.
+	return nil // we don't need to do anything in response to a STREAM_DATA_BLOCKED frame
+}
+
+func (m *streamsMap) HandleResetStreamFrame(f *wire.ResetStreamFrame, rcvTime monotime.Time) error {
+	str, err := m.getReceiveStream(f.StreamID)
+	if err != nil {
+		return err
+	}
+	if str == nil { // stream already deleted
+		return nil
+	}
+	return str.handleResetStreamFrame(f, rcvTime)
+}
+
+func (m *streamsMap) HandleStreamFrame(f *wire.StreamFrame, rcvTime monotime.Time) error {
+	str, err := m.getReceiveStream(f.StreamID)
+	if err != nil {
+		return err
+	}
+	if str == nil { // stream already deleted
+		return nil
+	}
+	return str.handleStreamFrame(f, rcvTime)
+}
+
+func (m *streamsMap) HandleTransportParameters(p *wire.TransportParameters) {
+	m.supportsResetStreamAt = p.EnableResetStreamAt
+	if p.EnableResetStreamAt {
+		m.outgoingBidiStreams.EnableResetStreamAt()
+		m.outgoingUniStreams.EnableResetStreamAt()
+	}
+	m.outgoingBidiStreams.UpdateSendWindow(p.InitialMaxStreamDataBidiRemote)
+	m.outgoingBidiStreams.SetMaxStream(p.MaxBidiStreamNum.StreamID(protocol.StreamTypeBidi, m.perspective))
+	m.outgoingUniStreams.UpdateSendWindow(p.InitialMaxStreamDataUni)
+	m.outgoingUniStreams.SetMaxStream(p.MaxUniStreamNum.StreamID(protocol.StreamTypeUni, m.perspective))
+}
+
+func (m *streamsMap) CloseWithError(err error) {
+	m.outgoingBidiStreams.CloseWithError(err)
+	m.outgoingUniStreams.CloseWithError(err)
+	m.incomingBidiStreams.CloseWithError(err)
+	m.incomingUniStreams.CloseWithError(err)
+}
+
+// ResetFor0RTT resets is used when 0-RTT is rejected. In that case, the streams maps are
+// 1. closed with an Err0RTTRejected, making calls to Open{Uni}Stream{Sync} / Accept{Uni}Stream return that error.
+// 2. reset to their initial state, such that we can immediately process new incoming stream data.
+// Afterwards, calls to Open{Uni}Stream{Sync} / Accept{Uni}Stream will continue to return the error,
+// until UseResetMaps() has been called.
+func (m *streamsMap) ResetFor0RTT() {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+	m.reset = true
+	m.CloseWithError(Err0RTTRejected)
+	m.supportsResetStreamAt = false
+	m.initMaps()
+}
+
+func (m *streamsMap) UseResetMaps() {
+	m.mutex.Lock()
+	m.reset = false
+	m.mutex.Unlock()
+}
diff --git a/electron/native/private-transport/third_party/quic-go/streams_map_incoming.go b/electron/native/private-transport/third_party/quic-go/streams_map_incoming.go
new file mode 100644
index 000000000..c714eaf10
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/streams_map_incoming.go
@@ -0,0 +1,209 @@
+package quic
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type incomingStream interface {
+	closeForShutdown(error)
+}
+
+// When a stream is deleted before it was accepted, we can't delete it from the map immediately.
+// We need to wait until the application accepts it, and delete it then.
+type incomingStreamEntry[T incomingStream] struct {
+	stream       T
+	shouldDelete bool
+}
+
+type incomingStreamsMap[T incomingStream] struct {
+	mutex         sync.RWMutex
+	newStreamChan chan struct{}
+
+	streamType protocol.StreamType
+	streams    map[protocol.StreamID]incomingStreamEntry[T]
+
+	nextStreamToAccept protocol.StreamID // the next stream that will be returned by AcceptStream()
+	nextStreamToOpen   protocol.StreamID // the highest stream that the peer opened
+	maxStream          protocol.StreamID // the highest stream that the peer is allowed to open
+	maxNumStreams      uint64            // maximum number of streams
+
+	newStream        func(protocol.StreamID) T
+	queueMaxStreamID func(*wire.MaxStreamsFrame)
+
+	closeErr error
+}
+
+func newIncomingStreamsMap[T incomingStream](
+	streamType protocol.StreamType,
+	newStream func(protocol.StreamID) T,
+	maxStreams uint64,
+	queueControlFrame func(wire.Frame),
+	pers protocol.Perspective,
+) *incomingStreamsMap[T] {
+	var nextStreamToAccept protocol.StreamID
+	switch {
+	case streamType == protocol.StreamTypeBidi && pers == protocol.PerspectiveServer:
+		nextStreamToAccept = protocol.FirstIncomingBidiStreamServer
+	case streamType == protocol.StreamTypeBidi && pers == protocol.PerspectiveClient:
+		nextStreamToAccept = protocol.FirstIncomingBidiStreamClient
+	case streamType == protocol.StreamTypeUni && pers == protocol.PerspectiveServer:
+		nextStreamToAccept = protocol.FirstIncomingUniStreamServer
+	case streamType == protocol.StreamTypeUni && pers == protocol.PerspectiveClient:
+		nextStreamToAccept = protocol.FirstIncomingUniStreamClient
+	}
+	return &incomingStreamsMap[T]{
+		newStreamChan:      make(chan struct{}, 1),
+		streamType:         streamType,
+		streams:            make(map[protocol.StreamID]incomingStreamEntry[T]),
+		maxStream:          protocol.StreamNum(maxStreams).StreamID(streamType, pers.Opposite()),
+		maxNumStreams:      maxStreams,
+		newStream:          newStream,
+		nextStreamToOpen:   nextStreamToAccept,
+		nextStreamToAccept: nextStreamToAccept,
+		queueMaxStreamID:   func(f *wire.MaxStreamsFrame) { queueControlFrame(f) },
+	}
+}
+
+func (m *incomingStreamsMap[T]) AcceptStream(ctx context.Context) (T, error) {
+	// drain the newStreamChan, so we don't check the map twice if the stream doesn't exist
+	select {
+	case <-m.newStreamChan:
+	default:
+	}
+
+	m.mutex.Lock()
+
+	var id protocol.StreamID
+	var entry incomingStreamEntry[T]
+	for {
+		id = m.nextStreamToAccept
+		if m.closeErr != nil {
+			m.mutex.Unlock()
+			return *new(T), m.closeErr
+		}
+		var ok bool
+		entry, ok = m.streams[id]
+		if ok {
+			break
+		}
+		m.mutex.Unlock()
+		select {
+		case <-ctx.Done():
+			return *new(T), ctx.Err()
+		case <-m.newStreamChan:
+		}
+		m.mutex.Lock()
+	}
+	m.nextStreamToAccept += 4
+	// If this stream was completed before being accepted, we can delete it now.
+	if entry.shouldDelete {
+		if err := m.deleteStream(id); err != nil {
+			m.mutex.Unlock()
+			return *new(T), err
+		}
+	}
+	m.mutex.Unlock()
+	return entry.stream, nil
+}
+
+func (m *incomingStreamsMap[T]) GetOrOpenStream(id protocol.StreamID) (T, error) {
+	m.mutex.RLock()
+	if id > m.maxStream {
+		m.mutex.RUnlock()
+		return *new(T), &qerr.TransportError{
+			ErrorCode:    qerr.StreamLimitError,
+			ErrorMessage: fmt.Sprintf("peer tried to open stream %d (current limit: %d)", id, m.maxStream),
+		}
+	}
+	// if the num is smaller than the highest we accepted
+	// * this stream exists in the map, and we can return it, or
+	// * this stream was already closed, then we can return the nil
+	if id < m.nextStreamToOpen {
+		var s T
+		// If the stream was already queued for deletion, and is just waiting to be accepted, don't return it.
+		if entry, ok := m.streams[id]; ok && !entry.shouldDelete {
+			s = entry.stream
+		}
+		m.mutex.RUnlock()
+		return s, nil
+	}
+	m.mutex.RUnlock()
+
+	m.mutex.Lock()
+	// no need to check the two error conditions from above again
+	// * maxStream can only increase, so if the id was valid before, it definitely is valid now
+	// * highestStream is only modified by this function
+	for newNum := m.nextStreamToOpen; newNum <= id; newNum += 4 {
+		m.streams[newNum] = incomingStreamEntry[T]{stream: m.newStream(newNum)}
+		select {
+		case m.newStreamChan <- struct{}{}:
+		default:
+		}
+	}
+	m.nextStreamToOpen = id + 4
+	entry := m.streams[id]
+	m.mutex.Unlock()
+	return entry.stream, nil
+}
+
+func (m *incomingStreamsMap[T]) DeleteStream(id protocol.StreamID) error {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+
+	if err := m.deleteStream(id); err != nil {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.StreamStateError,
+			ErrorMessage: err.Error(),
+		}
+	}
+	return nil
+}
+
+func (m *incomingStreamsMap[T]) deleteStream(id protocol.StreamID) error {
+	if _, ok := m.streams[id]; !ok {
+		return fmt.Errorf("tried to delete unknown incoming stream %d", id)
+	}
+
+	// Don't delete this stream yet, if it was not yet accepted.
+	// Just save it to streamsToDelete map, to make sure it is deleted as soon as it gets accepted.
+	if id >= m.nextStreamToAccept {
+		entry, ok := m.streams[id]
+		if ok && entry.shouldDelete {
+			return fmt.Errorf("tried to delete incoming stream %d multiple times", id)
+		}
+		entry.shouldDelete = true
+		m.streams[id] = entry // can't assign to struct in map, so we need to reassign
+		return nil
+	}
+
+	delete(m.streams, id)
+	// queue a MAX_STREAM_ID frame, giving the peer the option to open a new stream
+	if m.maxNumStreams > uint64(len(m.streams)) {
+		maxStream := m.nextStreamToOpen + 4*protocol.StreamID(m.maxNumStreams-uint64(len(m.streams))-1)
+		// never send a value larger than the maximum value for a stream number
+		if maxStream <= protocol.MaxStreamID {
+			m.maxStream = maxStream
+			m.queueMaxStreamID(&wire.MaxStreamsFrame{
+				Type:         m.streamType,
+				MaxStreamNum: m.maxStream.StreamNum(),
+			})
+		}
+	}
+	return nil
+}
+
+func (m *incomingStreamsMap[T]) CloseWithError(err error) {
+	m.mutex.Lock()
+	m.closeErr = err
+	for _, entry := range m.streams {
+		entry.stream.closeForShutdown(err)
+	}
+	m.mutex.Unlock()
+	close(m.newStreamChan)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/streams_map_incoming_test.go b/electron/native/private-transport/third_party/quic-go/streams_map_incoming_test.go
new file mode 100644
index 000000000..fe00f5ae3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/streams_map_incoming_test.go
@@ -0,0 +1,364 @@
+package quic
+
+import (
+	"context"
+	"math/rand/v2"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type mockStream struct {
+	id protocol.StreamID
+
+	closed                bool
+	closeErr              error
+	sendWindow            protocol.ByteCount
+	supportsResetStreamAt bool
+}
+
+func (s *mockStream) closeForShutdown(err error) {
+	s.closed = true
+	s.closeErr = err
+}
+
+func (s *mockStream) updateSendWindow(limit protocol.ByteCount) {
+	s.sendWindow = limit
+}
+
+func (s *mockStream) enableResetStreamAt() {
+	s.supportsResetStreamAt = true
+}
+
+func TestStreamsMapIncomingGettingStreams(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testStreamsMapIncomingGettingStreams(t, protocol.PerspectiveClient, protocol.FirstIncomingUniStreamClient)
+	})
+	t.Run("server", func(t *testing.T) {
+		testStreamsMapIncomingGettingStreams(t, protocol.PerspectiveServer, protocol.FirstIncomingUniStreamServer)
+	})
+}
+
+func testStreamsMapIncomingGettingStreams(t *testing.T, perspective protocol.Perspective, firstStream protocol.StreamID) {
+	var newStreamCounter int
+	const maxNumStreams = 10
+	m := newIncomingStreamsMap(
+		protocol.StreamTypeUni,
+		func(id protocol.StreamID) *mockStream {
+			newStreamCounter++
+			return &mockStream{id: id}
+		},
+		maxNumStreams,
+		func(f wire.Frame) {},
+		perspective,
+	)
+
+	// all streams up to the id on GetOrOpenStream are opened
+	str, err := m.GetOrOpenStream(firstStream + 4)
+	require.NoError(t, err)
+	require.NotNil(t, str)
+	require.Equal(t, 2, newStreamCounter)
+	require.Equal(t, firstStream+4, str.id)
+	// accept one of the streams
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err = m.AcceptStream(ctx)
+	require.NoError(t, err)
+	require.Equal(t, firstStream, str.id)
+	// open some more streams
+	str, err = m.GetOrOpenStream(firstStream + 16)
+	require.NoError(t, err)
+	require.Equal(t, 5, newStreamCounter)
+	require.Equal(t, firstStream+16, str.id)
+	// and accept all of them
+	for i := 1; i < 5; i++ {
+		str, err := m.AcceptStream(ctx)
+		require.NoError(t, err)
+		require.Equal(t, firstStream+4*protocol.StreamID(i), str.id)
+	}
+
+	_, err = m.GetOrOpenStream(firstStream + 4*maxNumStreams - 4)
+	require.NoError(t, err)
+	_, err = m.GetOrOpenStream(firstStream + 4*maxNumStreams)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamLimitError})
+	require.ErrorContains(t, err, "peer tried to open stream")
+	require.Equal(t, maxNumStreams, newStreamCounter)
+}
+
+func TestStreamsMapIncomingAcceptingStreams(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		m := newIncomingStreamsMap(
+			protocol.StreamTypeUni,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			5,
+			func(f wire.Frame) {},
+			protocol.PerspectiveClient,
+		)
+
+		// AcceptStream should respect the context
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := m.AcceptStream(ctx)
+			errChan <- err
+		}()
+
+		synctest.Wait()
+
+		select {
+		case <-errChan:
+			t.Fatal("AcceptStream should not return")
+		default:
+		}
+
+		cancel()
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.Equal(t, context.Canceled, err)
+		default:
+			t.Fatal("timeout")
+		}
+
+		// AcceptStream should block if there are no streams available
+		go func() {
+			_, err := m.AcceptStream(context.Background())
+			errChan <- err
+		}()
+
+		synctest.Wait()
+
+		select {
+		case <-errChan:
+			t.Fatal("AcceptStream should block")
+		default:
+		}
+
+		_, err := m.GetOrOpenStream(protocol.FirstIncomingUniStreamClient)
+		require.NoError(t, err)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestStreamsMapIncomingDeletingStreams(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testStreamsMapIncomingDeletingStreams(t, protocol.PerspectiveClient, protocol.FirstIncomingUniStreamClient)
+	})
+	t.Run("server", func(t *testing.T) {
+		testStreamsMapIncomingDeletingStreams(t, protocol.PerspectiveServer, protocol.FirstIncomingUniStreamServer)
+	})
+}
+
+func testStreamsMapIncomingDeletingStreams(t *testing.T, perspective protocol.Perspective, firstStream protocol.StreamID) {
+	var frameQueue []wire.Frame
+	m := newIncomingStreamsMap(
+		protocol.StreamTypeUni,
+		func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+		5,
+		func(f wire.Frame) { frameQueue = append(frameQueue, f) },
+		perspective,
+	)
+	err := m.DeleteStream(firstStream + 1337*4)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, "tried to delete unknown incoming stream")
+
+	s, err := m.GetOrOpenStream(firstStream + 4)
+	require.NoError(t, err)
+	require.NotNil(t, s)
+	// delete the stream
+	require.NoError(t, m.DeleteStream(firstStream+4))
+	require.Empty(t, frameQueue)
+	// it's not returned by GetOrOpenStream anymore
+	s, err = m.GetOrOpenStream(firstStream + 4)
+	require.NoError(t, err)
+	require.Nil(t, s)
+
+	// AcceptStream still returns this stream
+	str, err := m.AcceptStream(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, firstStream, str.id)
+	require.Empty(t, frameQueue)
+
+	str, err = m.AcceptStream(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, firstStream+4, str.id)
+	// now the stream is deleted and new stream credit is issued
+	require.Len(t, frameQueue, 1)
+	require.Equal(t, &wire.MaxStreamsFrame{Type: protocol.StreamTypeUni, MaxStreamNum: 6}, frameQueue[0])
+	frameQueue = frameQueue[:0]
+
+	require.NoError(t, m.DeleteStream(firstStream))
+	require.Len(t, frameQueue, 1)
+	require.Equal(t, &wire.MaxStreamsFrame{Type: protocol.StreamTypeUni, MaxStreamNum: 7}, frameQueue[0])
+}
+
+// There's a maximum number that can be encoded in a MAX_STREAMS frame.
+// Since the stream limit is configurable by the user, we can't rely on this number
+// being high enough that it will never be reached in practice.
+func TestStreamsMapIncomingDeletingStreamsWithHighLimits(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testStreamsMapIncomingDeletingStreamsWithHighLimits(t, protocol.PerspectiveClient, protocol.FirstIncomingUniStreamClient)
+	})
+	t.Run("server", func(t *testing.T) {
+		testStreamsMapIncomingDeletingStreamsWithHighLimits(t, protocol.PerspectiveServer, protocol.FirstIncomingUniStreamServer)
+	})
+}
+
+func testStreamsMapIncomingDeletingStreamsWithHighLimits(t *testing.T, pers protocol.Perspective, firstStream protocol.StreamID) {
+	var frameQueue []wire.Frame
+	m := newIncomingStreamsMap(
+		protocol.StreamTypeUni,
+		func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+		uint64(protocol.MaxStreamCount-2),
+		func(f wire.Frame) { frameQueue = append(frameQueue, f) },
+		pers,
+	)
+
+	// open a bunch of streams
+	_, err := m.GetOrOpenStream(firstStream + 16)
+	require.NoError(t, err)
+	// accept all streams
+	for range 5 {
+		_, err := m.AcceptStream(context.Background())
+		require.NoError(t, err)
+	}
+	require.Empty(t, frameQueue)
+	require.NoError(t, m.DeleteStream(firstStream+12))
+	require.Len(t, frameQueue, 1)
+	require.Equal(t,
+		&wire.MaxStreamsFrame{Type: protocol.StreamTypeUni, MaxStreamNum: protocol.MaxStreamCount - 1},
+		frameQueue[0],
+	)
+	require.NoError(t, m.DeleteStream(firstStream+8))
+	require.Len(t, frameQueue, 2)
+	require.Equal(t,
+		&wire.MaxStreamsFrame{Type: protocol.StreamTypeUni, MaxStreamNum: protocol.MaxStreamCount},
+		frameQueue[1],
+	)
+	// at this point, we can't increase the stream limit any further, so no more MAX_STREAMS frames will be sent
+	require.NoError(t, m.DeleteStream(firstStream+4))
+	require.NoError(t, m.DeleteStream(firstStream))
+	require.Len(t, frameQueue, 2)
+}
+
+func TestStreamsMapIncomingClosing(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		m := newIncomingStreamsMap(
+			protocol.StreamTypeUni,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			5,
+			func(f wire.Frame) {},
+			protocol.PerspectiveServer,
+		)
+
+		var streams []*mockStream
+		_, err := m.GetOrOpenStream(protocol.FirstIncomingUniStreamServer + 8)
+		require.NoError(t, err)
+		for range 3 {
+			str, err := m.AcceptStream(context.Background())
+			require.NoError(t, err)
+			streams = append(streams, str)
+		}
+
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := m.AcceptStream(context.Background())
+			errChan <- err
+		}()
+
+		m.CloseWithError(assert.AnError)
+		synctest.Wait()
+
+		// accepted streams should be closed
+		for _, str := range streams {
+			require.True(t, str.closed)
+			require.ErrorIs(t, str.closeErr, assert.AnError)
+		}
+		// AcceptStream should return the error
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, assert.AnError)
+		default:
+			t.Fatal("timeout")
+		}
+	})
+}
+
+func TestStreamsMapIncomingRandomized(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const num = 1000
+
+		streamType := []protocol.StreamType{protocol.StreamTypeUni, protocol.StreamTypeBidi}[rand.IntN(2)]
+		firstStream := protocol.FirstIncomingUniStreamServer
+		if streamType == protocol.StreamTypeBidi {
+			firstStream = protocol.FirstIncomingBidiStreamServer
+		}
+
+		m := newIncomingStreamsMap(
+			streamType,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			num,
+			func(f wire.Frame) {},
+			protocol.PerspectiveServer,
+		)
+
+		ids := make([]protocol.StreamID, num)
+		for i := range num {
+			ids[i] = firstStream + 4*protocol.StreamID(i)
+		}
+		rand.Shuffle(len(ids), func(i, j int) { ids[i], ids[j] = ids[j], ids[i] })
+
+		errChan1 := make(chan error, 1)
+		go func() {
+			for range num {
+				if _, err := m.AcceptStream(context.Background()); err != nil {
+					errChan1 <- err
+					return
+				}
+			}
+			close(errChan1)
+		}()
+
+		errChan2 := make(chan error, 1)
+		go func() {
+			for i := range num {
+				if _, err := m.GetOrOpenStream(ids[i]); err != nil {
+					errChan2 <- err
+					return
+				}
+			}
+			close(errChan2)
+		}()
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan1:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have accepted all streams")
+		}
+		select {
+		case err := <-errChan2:
+			require.NoError(t, err)
+		default:
+			t.Fatal("should have opened all streams")
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/streams_map_outgoing.go b/electron/native/private-transport/third_party/quic-go/streams_map_outgoing.go
new file mode 100644
index 000000000..14e087c60
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/streams_map_outgoing.go
@@ -0,0 +1,253 @@
+package quic
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+type outgoingStream interface {
+	updateSendWindow(protocol.ByteCount)
+	enableResetStreamAt()
+	closeForShutdown(error)
+}
+
+type outgoingStreamsMap[T outgoingStream] struct {
+	mutex sync.RWMutex
+
+	streamType protocol.StreamType
+	streams    map[protocol.StreamID]T
+
+	openQueue []chan struct{}
+
+	nextStream  protocol.StreamID // stream ID of the stream returned by OpenStream(Sync)
+	maxStream   protocol.StreamID // the maximum stream ID we're allowed to open
+	blockedSent bool              // was a STREAMS_BLOCKED sent for the current maxStream
+
+	newStream            func(protocol.StreamID) T
+	queueStreamIDBlocked func(*wire.StreamsBlockedFrame)
+
+	closeErr error
+}
+
+func newOutgoingStreamsMap[T outgoingStream](
+	streamType protocol.StreamType,
+	newStream func(protocol.StreamID) T,
+	queueControlFrame func(wire.Frame),
+	pers protocol.Perspective,
+) *outgoingStreamsMap[T] {
+	var nextStream protocol.StreamID
+	switch {
+	case streamType == protocol.StreamTypeBidi && pers == protocol.PerspectiveServer:
+		nextStream = protocol.FirstOutgoingBidiStreamServer
+	case streamType == protocol.StreamTypeBidi && pers == protocol.PerspectiveClient:
+		nextStream = protocol.FirstOutgoingBidiStreamClient
+	case streamType == protocol.StreamTypeUni && pers == protocol.PerspectiveServer:
+		nextStream = protocol.FirstOutgoingUniStreamServer
+	case streamType == protocol.StreamTypeUni && pers == protocol.PerspectiveClient:
+		nextStream = protocol.FirstOutgoingUniStreamClient
+	}
+	return &outgoingStreamsMap[T]{
+		streamType:           streamType,
+		streams:              make(map[protocol.StreamID]T),
+		maxStream:            protocol.InvalidStreamNum,
+		nextStream:           nextStream,
+		newStream:            newStream,
+		queueStreamIDBlocked: func(f *wire.StreamsBlockedFrame) { queueControlFrame(f) },
+	}
+}
+
+func (m *outgoingStreamsMap[T]) OpenStream() (T, error) {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+
+	if m.closeErr != nil {
+		return *new(T), m.closeErr
+	}
+
+	// if there are OpenStreamSync calls waiting, return an error here
+	if len(m.openQueue) > 0 || m.nextStream > m.maxStream {
+		m.maybeSendBlockedFrame()
+		return *new(T), &StreamLimitReachedError{}
+	}
+	return m.openStream(), nil
+}
+
+func (m *outgoingStreamsMap[T]) OpenStreamSync(ctx context.Context) (T, error) {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+
+	if m.closeErr != nil {
+		return *new(T), m.closeErr
+	}
+	if err := ctx.Err(); err != nil {
+		return *new(T), err
+	}
+	if len(m.openQueue) == 0 && m.nextStream <= m.maxStream {
+		return m.openStream(), nil
+	}
+
+	waitChan := make(chan struct{}, 1)
+	m.openQueue = append(m.openQueue, waitChan)
+	m.maybeSendBlockedFrame()
+
+	for {
+		m.mutex.Unlock()
+		select {
+		case <-ctx.Done():
+			m.mutex.Lock()
+			m.openQueue = slices.DeleteFunc(m.openQueue, func(c chan struct{}) bool {
+				return c == waitChan
+			})
+			// If we just received a MAX_STREAMS frame, this might have been the next stream
+			// that could be opened. Make sure we unblock the next OpenStreamSync call.
+			m.maybeUnblockOpenSync()
+			return *new(T), ctx.Err()
+		case <-waitChan:
+		}
+
+		m.mutex.Lock()
+		if m.closeErr != nil {
+			return *new(T), m.closeErr
+		}
+		if err := ctx.Err(); err != nil {
+			m.openQueue = slices.DeleteFunc(m.openQueue, func(c chan struct{}) bool {
+				return c == waitChan
+			})
+			m.maybeUnblockOpenSync()
+			return *new(T), err
+		}
+		if m.nextStream > m.maxStream {
+			// no stream available. Continue waiting
+			continue
+		}
+		str := m.openStream()
+		m.openQueue = m.openQueue[1:]
+		m.maybeUnblockOpenSync()
+		return str, nil
+	}
+}
+
+func (m *outgoingStreamsMap[T]) openStream() T {
+	s := m.newStream(m.nextStream)
+	m.streams[m.nextStream] = s
+	m.nextStream += 4
+	return s
+}
+
+// maybeSendBlockedFrame queues a STREAMS_BLOCKED frame for the current stream offset,
+// if we haven't sent one for this offset yet
+func (m *outgoingStreamsMap[T]) maybeSendBlockedFrame() {
+	if m.blockedSent {
+		return
+	}
+
+	var streamLimit protocol.StreamNum
+	if m.maxStream != protocol.InvalidStreamID {
+		streamLimit = m.maxStream.StreamNum()
+	}
+	m.queueStreamIDBlocked(&wire.StreamsBlockedFrame{
+		Type:        m.streamType,
+		StreamLimit: streamLimit,
+	})
+	m.blockedSent = true
+}
+
+func (m *outgoingStreamsMap[T]) GetStream(id protocol.StreamID) (T, error) {
+	m.mutex.RLock()
+	if id >= m.nextStream {
+		m.mutex.RUnlock()
+		return *new(T), &qerr.TransportError{
+			ErrorCode:    qerr.StreamStateError,
+			ErrorMessage: fmt.Sprintf("peer attempted to open stream %d", id),
+		}
+	}
+	s := m.streams[id]
+	m.mutex.RUnlock()
+	return s, nil
+}
+
+func (m *outgoingStreamsMap[T]) DeleteStream(id protocol.StreamID) error {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+
+	if _, ok := m.streams[id]; !ok {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.StreamStateError,
+			ErrorMessage: fmt.Sprintf("tried to delete unknown outgoing stream %d", id),
+		}
+	}
+	delete(m.streams, id)
+	return nil
+}
+
+func (m *outgoingStreamsMap[T]) SetMaxStream(id protocol.StreamID) {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+
+	if id <= m.maxStream {
+		return
+	}
+	m.maxStream = id
+	m.blockedSent = false
+	if m.maxStream < m.nextStream-4+4*protocol.StreamID(len(m.openQueue)) {
+		m.maybeSendBlockedFrame()
+	}
+	m.maybeUnblockOpenSync()
+}
+
+// UpdateSendWindow is called when the peer's transport parameters are received.
+// Only in the case of a 0-RTT handshake will we have open streams at this point.
+// We might need to update the send window, in case the server increased it.
+func (m *outgoingStreamsMap[T]) UpdateSendWindow(limit protocol.ByteCount) {
+	m.mutex.Lock()
+	for _, str := range m.streams {
+		str.updateSendWindow(limit)
+	}
+	m.mutex.Unlock()
+}
+
+func (m *outgoingStreamsMap[T]) EnableResetStreamAt() {
+	m.mutex.Lock()
+	for _, str := range m.streams {
+		str.enableResetStreamAt()
+	}
+	m.mutex.Unlock()
+}
+
+// unblockOpenSync unblocks the next OpenStreamSync go-routine to open a new stream
+func (m *outgoingStreamsMap[T]) maybeUnblockOpenSync() {
+	if len(m.openQueue) == 0 {
+		return
+	}
+	if m.nextStream > m.maxStream {
+		return
+	}
+	// unblockOpenSync is called both from OpenStreamSync and from SetMaxStream.
+	// It's sufficient to only unblock OpenStreamSync once.
+	select {
+	case m.openQueue[0] <- struct{}{}:
+	default:
+	}
+}
+
+func (m *outgoingStreamsMap[T]) CloseWithError(err error) {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+
+	m.closeErr = err
+	for _, str := range m.streams {
+		str.closeForShutdown(err)
+	}
+	for _, c := range m.openQueue {
+		if c != nil {
+			close(c)
+		}
+	}
+	m.openQueue = nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/streams_map_outgoing_test.go b/electron/native/private-transport/third_party/quic-go/streams_map_outgoing_test.go
new file mode 100644
index 000000000..79f115b07
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/streams_map_outgoing_test.go
@@ -0,0 +1,621 @@
+package quic
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math/rand/v2"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStreamsMapOutgoingOpenAndDelete(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testStreamsMapOutgoingOpenAndDelete(t, protocol.PerspectiveClient, protocol.FirstOutgoingBidiStreamClient)
+	})
+	t.Run("server", func(t *testing.T) {
+		testStreamsMapOutgoingOpenAndDelete(t, protocol.PerspectiveServer, protocol.FirstOutgoingBidiStreamServer)
+	})
+}
+
+func testStreamsMapOutgoingOpenAndDelete(t *testing.T, perspective protocol.Perspective, firstStream protocol.StreamID) {
+	m := newOutgoingStreamsMap(
+		protocol.StreamTypeBidi,
+		func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+		func(f wire.Frame) {},
+		perspective,
+	)
+	m.SetMaxStream(protocol.MaxStreamID)
+
+	_, err := m.GetStream(firstStream)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("peer attempted to open stream %d", firstStream))
+
+	str1, err := m.OpenStream()
+	require.NoError(t, err)
+	require.Equal(t, firstStream, str1.id)
+	s, err := m.GetStream(firstStream)
+	require.NoError(t, err)
+	require.Equal(t, s, str1)
+
+	str2, err := m.OpenStream()
+	require.NoError(t, err)
+	require.Equal(t, firstStream+4, str2.id)
+
+	// update send window
+	m.UpdateSendWindow(1000)
+	require.Equal(t, protocol.ByteCount(1000), str1.sendWindow)
+	require.Equal(t, protocol.ByteCount(1000), str2.sendWindow)
+
+	// enable reset stream at
+	m.EnableResetStreamAt()
+	require.True(t, str1.supportsResetStreamAt)
+	require.True(t, str2.supportsResetStreamAt)
+
+	err = m.DeleteStream(firstStream + 1337*4)
+	require.Error(t, err)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, "tried to delete unknown outgoing stream")
+
+	require.NoError(t, m.DeleteStream(firstStream))
+	// deleting the same stream twice will fail
+	err = m.DeleteStream(firstStream)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, "tried to delete unknown outgoing stream")
+	// after deleting the stream it's not available anymore
+	str, err := m.GetStream(firstStream)
+	require.NoError(t, err)
+	require.Nil(t, str)
+}
+
+func TestStreamsMapOutgoingLimits(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testStreamsMapOutgoingLimits(t, protocol.PerspectiveClient, protocol.FirstOutgoingUniStreamClient)
+	})
+	t.Run("server", func(t *testing.T) {
+		testStreamsMapOutgoingLimits(t, protocol.PerspectiveServer, protocol.FirstOutgoingUniStreamServer)
+	})
+}
+
+func testStreamsMapOutgoingLimits(t *testing.T, perspective protocol.Perspective, firstStream protocol.StreamID) {
+	synctest.Test(t, func(t *testing.T) {
+		m := newOutgoingStreamsMap(
+			protocol.StreamTypeUni,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			func(f wire.Frame) {},
+			perspective,
+		)
+		m.SetMaxStream(firstStream)
+
+		str, err := m.OpenStream()
+		require.NoError(t, err)
+		require.Equal(t, firstStream, str.id)
+
+		// We've now reached the limit. OpenStream returns an error
+		_, err = m.OpenStream()
+		require.ErrorIs(t, err, &StreamLimitReachedError{})
+
+		// OpenStreamSync with a canceled context will return an error immediately
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		_, err = m.OpenStreamSync(ctx)
+		require.ErrorIs(t, err, context.Canceled)
+
+		// OpenStreamSync blocks until the context is canceled...
+		ctx, cancel = context.WithCancel(context.Background())
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := m.OpenStreamSync(ctx)
+			errChan <- err
+		}()
+
+		synctest.Wait()
+		select {
+		case <-errChan:
+			t.Fatal("didn't expect OpenStreamSync to return")
+		default:
+		}
+		// OpenStream still returns an error
+		_, err = m.OpenStream()
+		require.ErrorIs(t, err, &StreamLimitReachedError{})
+		// cancelling the context unblocks OpenStreamSync
+		cancel()
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, context.Canceled)
+		default:
+			t.Fatal("OpenStreamSync did not return after the context was canceled")
+		}
+
+		// ... or until it's possible to open a new stream
+		var openedStream *mockStream
+		go func() {
+			str, err := m.OpenStreamSync(context.Background())
+			openedStream = str
+			errChan <- err
+		}()
+		m.SetMaxStream(firstStream + 4)
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+			require.Equal(t, firstStream+4, openedStream.id)
+		default:
+			t.Fatal("OpenStreamSync did not return after the stream limit was increased")
+		}
+	})
+}
+
+// This test checks that OpenStreamSync returns the context error when the context is canceled
+// at the same time that the stream limit is increased (see https://github.com/quic-go/quic-go/issues/5659).
+// The race is inherently hard to trigger: even without the fix, this test only fails intermittently.
+// To gain confidence in the fix, run it many times (e.g. 10000 times) with the race detector enabled.
+func TestStreamsMapOutgoingOpenStreamSyncCancel(t *testing.T) {
+	queued := make(chan struct{}, 1)
+	m := newOutgoingStreamsMap(
+		protocol.StreamTypeUni,
+		func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+		func(f wire.Frame) { queued <- struct{}{} },
+		protocol.PerspectiveClient,
+	)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	type result struct {
+		str *mockStream
+		err error
+	}
+	resultChan := make(chan result, 1)
+	go func() {
+		str, err := m.OpenStreamSync(ctx)
+		resultChan <- result{str: str, err: err}
+	}()
+
+	select {
+	case <-queued:
+	case <-time.After(time.Second):
+		t.Fatal("OpenStreamSync did not queue")
+	}
+
+	cancel()
+	m.SetMaxStream(protocol.FirstOutgoingUniStreamClient)
+
+	select {
+	case res := <-resultChan:
+		require.ErrorIs(t, res.err, context.Canceled)
+		require.Nil(t, res.str)
+	case <-time.After(time.Second):
+		t.Fatal("OpenStreamSync did not return after the context was canceled")
+	}
+
+	str, err := m.OpenStream()
+	require.NoError(t, err)
+	require.Equal(t, protocol.FirstOutgoingUniStreamClient, str.id)
+}
+
+func TestStreamsMapOutgoingConcurrentOpenStreamSync(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		m := newOutgoingStreamsMap(
+			protocol.StreamTypeUni,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			func(f wire.Frame) {},
+			protocol.PerspectiveClient,
+		)
+
+		type result struct {
+			index  int
+			stream *mockStream
+			err    error
+		}
+		results := make(chan result, 3)
+		for i := range 3 {
+			go func(i int) {
+				str, err := m.OpenStreamSync(context.Background())
+				results <- result{index: i, stream: str, err: err}
+			}(i)
+			time.Sleep(time.Minute)
+		}
+
+		m.SetMaxStream(protocol.FirstOutgoingUniStreamClient + 4)
+		synctest.Wait()
+		received := make(map[protocol.StreamID]struct{})
+		for range 2 {
+			select {
+			case res := <-results:
+				require.NoError(t, res.err)
+				require.Equal(t, protocol.FirstOutgoingUniStreamClient+4*protocol.StreamID(res.index), res.stream.id)
+				received[res.stream.id] = struct{}{}
+			default:
+				t.Fatal("OpenStreamSync did not return after the stream limit was increased")
+			}
+		}
+		require.Contains(t, received, protocol.FirstOutgoingUniStreamClient)
+		require.Contains(t, received, protocol.FirstOutgoingUniStreamClient+4)
+
+		// the call to stream 3 is still blocked
+		select {
+		case <-results:
+			t.Fatal("expected OpenStreamSync to be blocked")
+		default:
+		}
+		m.SetMaxStream(protocol.FirstOutgoingUniStreamClient + 8)
+		synctest.Wait()
+		select {
+		case res := <-results:
+			require.NoError(t, res.err)
+			require.Equal(t, protocol.FirstOutgoingUniStreamClient+8, res.stream.id)
+		default:
+			t.Fatal("OpenStreamSync did not return after the stream limit was increased")
+		}
+	})
+}
+
+func TestStreamsMapOutgoingClosing(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		m := newOutgoingStreamsMap(
+			protocol.StreamTypeUni,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			func(f wire.Frame) {},
+			protocol.PerspectiveServer,
+		)
+
+		m.SetMaxStream(protocol.FirstOutgoingUniStreamServer + 4)
+		str1, err := m.OpenStream()
+		require.NoError(t, err)
+		str2, err := m.OpenStream()
+		require.NoError(t, err)
+
+		errChan := make(chan error, 1)
+		go func() {
+			_, err := m.OpenStreamSync(context.Background())
+			errChan <- err
+		}()
+
+		m.CloseWithError(assert.AnError)
+
+		synctest.Wait()
+
+		// both stream should be closed
+		assert.True(t, str1.closed)
+		assert.Equal(t, assert.AnError, str1.closeErr)
+		assert.True(t, str2.closed)
+		assert.Equal(t, assert.AnError, str2.closeErr)
+
+		select {
+		case err := <-errChan:
+			require.Error(t, err)
+		default:
+			t.Fatal("OpenStreamSync did not return after the stream was closed")
+		}
+	})
+}
+
+func TestStreamsMapOutgoingBlockedFrames(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		var frameQueue []wire.Frame
+		m := newOutgoingStreamsMap(
+			protocol.StreamTypeBidi,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			func(f wire.Frame) { frameQueue = append(frameQueue, f) },
+			protocol.PerspectiveClient,
+		)
+
+		m.SetMaxStream(protocol.FirstOutgoingBidiStreamClient + 8)
+		for range 3 {
+			_, err := m.OpenStream()
+			require.NoError(t, err)
+		}
+		require.Empty(t, frameQueue)
+
+		_, err := m.OpenStream()
+		require.ErrorIs(t, err, &StreamLimitReachedError{})
+		require.Equal(t, []wire.Frame{
+			&wire.StreamsBlockedFrame{Type: protocol.StreamTypeBidi, StreamLimit: 3},
+		}, frameQueue)
+		frameQueue = frameQueue[:0]
+
+		// only a single STREAMS_BLOCKED frame is queued per offset
+		for range 5 {
+			_, err = m.OpenStream()
+			require.ErrorIs(t, err, &StreamLimitReachedError{})
+			require.Empty(t, frameQueue)
+		}
+
+		errChan := make(chan error, 3)
+		for range 3 {
+			go func() {
+				_, err := m.OpenStreamSync(context.Background())
+				errChan <- err
+			}()
+		}
+		synctest.Wait()
+
+		// allow 2 more streams
+		m.SetMaxStream(protocol.FirstOutgoingBidiStreamClient + 16)
+		synctest.Wait()
+
+		for range 2 {
+			select {
+			case err := <-errChan:
+				require.NoError(t, err)
+			default:
+				t.Fatal("OpenStreamSync did not return after the stream limit was increased")
+			}
+		}
+		require.Equal(t, []wire.Frame{
+			&wire.StreamsBlockedFrame{Type: protocol.StreamTypeBidi, StreamLimit: 5},
+		}, frameQueue)
+		frameQueue = frameQueue[:0]
+
+		// now accept the last stream
+		m.SetMaxStream(protocol.FirstOutgoingBidiStreamClient + 20)
+		synctest.Wait()
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+			t.Fatal("OpenStreamSync did not return after the stream limit was increased")
+		}
+		require.Empty(t, frameQueue)
+	})
+}
+
+func TestStreamsMapOutgoingRandomizedOpenStreamSync(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		streamType := []protocol.StreamType{protocol.StreamTypeUni, protocol.StreamTypeBidi}[rand.IntN(2)]
+		firstStream := protocol.FirstOutgoingUniStreamServer
+		if streamType == protocol.StreamTypeBidi {
+			firstStream = protocol.FirstOutgoingBidiStreamServer
+		}
+
+		const n = 100
+
+		frameQueue := make(chan wire.Frame, n)
+		m := newOutgoingStreamsMap(
+			streamType,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			func(f wire.Frame) { frameQueue <- f },
+			protocol.PerspectiveServer,
+		)
+
+		type result struct {
+			id  protocol.StreamID
+			err error
+		}
+		resultChan := make(chan result, n)
+		for range n {
+			go func() {
+				str, err := m.OpenStreamSync(context.Background())
+				resultChan <- result{id: str.id, err: err}
+			}()
+		}
+		synctest.Wait()
+
+		select {
+		case f := <-frameQueue:
+			require.IsType(t, &wire.StreamsBlockedFrame{}, f)
+			require.Zero(t, f.(*wire.StreamsBlockedFrame).StreamLimit)
+		default:
+			t.Fatal("timed out waiting for STREAMS_BLOCKED frame")
+		}
+
+		limit := firstStream - 4
+		var limits []protocol.StreamID
+		seen := make(map[protocol.StreamID]struct{})
+		maxStream := firstStream + 4*(n-1)
+		for limit < maxStream {
+			add := 4 * protocol.StreamID(rand.IntN(n/5)+1)
+			limit += add
+			if limit <= maxStream {
+				limits = append(limits, limit)
+			}
+			t.Logf("setting stream limit to %d", limit)
+			m.SetMaxStream(limit)
+			synctest.Wait()
+
+		loop:
+			for {
+				select {
+				case res := <-resultChan:
+					require.NoError(t, res.err)
+					require.NotContains(t, seen, res.id)
+					require.LessOrEqual(t, res.id, limit)
+					seen[res.id] = struct{}{}
+					if len(seen) == int(limit.StreamNum()) || len(seen) == n {
+						break loop
+					}
+				default:
+					t.Fatalf("timed out waiting for stream to open")
+				}
+			}
+
+			str, err := m.OpenStream()
+			if limit <= maxStream {
+				require.ErrorIs(t, err, &StreamLimitReachedError{})
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, maxStream+4, str.id)
+			}
+		}
+		require.Len(t, seen, n)
+
+		close(frameQueue)
+		var blockedAt []protocol.StreamID
+		for f := range frameQueue {
+			if l := f.(*wire.StreamsBlockedFrame).StreamLimit; l <= n {
+				blockedAt = append(blockedAt, l.StreamID(streamType, protocol.PerspectiveServer))
+			}
+		}
+		require.Equal(t, limits, blockedAt)
+	})
+}
+
+func TestStreamsMapOutgoingRandomizedWithCancellation(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const n = 100
+
+		streamType := []protocol.StreamType{protocol.StreamTypeUni, protocol.StreamTypeBidi}[rand.IntN(2)]
+		firstStream := protocol.FirstOutgoingUniStreamClient
+		if streamType == protocol.StreamTypeBidi {
+			firstStream = protocol.FirstOutgoingBidiStreamClient
+		}
+
+		frameQueue := make(chan wire.Frame, n)
+		m := newOutgoingStreamsMap(
+			streamType,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			func(f wire.Frame) { frameQueue <- f },
+			protocol.PerspectiveClient,
+		)
+
+		type result struct {
+			str *mockStream
+			err error
+		}
+
+		ctx, cancel := context.WithCancel(context.Background())
+		resultChan := make(chan result, 10*n)
+		var count int
+		var numCancelled int
+		for count < n {
+			shouldCancel := rand.IntN(n)%5 == 0
+			if shouldCancel {
+				numCancelled++
+			} else {
+				count++
+			}
+			go func() {
+				var str *mockStream
+				var err error
+				if shouldCancel {
+					str, err = m.OpenStreamSync(ctx)
+				} else {
+					str, err = m.OpenStreamSync(context.Background())
+				}
+				resultChan <- result{str: str, err: err}
+			}()
+		}
+
+		synctest.Wait()
+
+		select {
+		case f := <-frameQueue:
+			require.IsType(t, &wire.StreamsBlockedFrame{}, f)
+			require.Zero(t, f.(*wire.StreamsBlockedFrame).StreamLimit)
+		default:
+			t.Fatal("timed out waiting for STREAMS_BLOCKED frame")
+		}
+
+		synctest.Wait()
+		cancel()
+
+		limit := firstStream - 4
+		maxStream := firstStream + 4*(n-1)
+		var limits []protocol.StreamID
+		seen := make(map[protocol.StreamID]struct{})
+		var numCancelledSeen int
+		for limit < maxStream {
+			add := 4 * protocol.StreamID(rand.IntN(n/5)+1)
+			limit += add
+			if limit < maxStream {
+				limits = append(limits, limit)
+			}
+			t.Logf("setting stream limit to %d", limit)
+			m.SetMaxStream(limit)
+
+			expectedOpened := int((min(maxStream, limit)-firstStream)/4) + 1
+			for len(seen) < expectedOpened {
+				select {
+				case res := <-resultChan:
+					if errors.Is(res.err, context.Canceled) {
+						numCancelledSeen++
+					} else {
+						require.NoError(t, res.err)
+						require.NotContains(t, seen, res.str.id)
+						require.LessOrEqual(t, res.str.id, min(maxStream, limit))
+						seen[res.str.id] = struct{}{}
+					}
+				case <-time.After(time.Second):
+					t.Fatalf("timed out waiting for stream to open")
+				}
+			}
+		}
+		require.Len(t, seen, n)
+		for numCancelledSeen < numCancelled {
+			select {
+			case res := <-resultChan:
+				require.ErrorIs(t, res.err, context.Canceled)
+				numCancelledSeen++
+			case <-time.After(time.Second):
+				t.Fatalf("timed out waiting for stream opening to be canceled")
+			}
+		}
+		t.Logf("saw %d streams, %d cancelled", len(seen), numCancelledSeen)
+		require.Equal(t, numCancelled, numCancelledSeen)
+
+		close(frameQueue)
+		var blockedAt []protocol.StreamID
+		for f := range frameQueue {
+			sbf := f.(*wire.StreamsBlockedFrame)
+			require.Equal(t, streamType, sbf.Type)
+			blockedAt = append(blockedAt, sbf.StreamLimit.StreamID(streamType, protocol.PerspectiveClient))
+		}
+		require.Equal(t, limits, blockedAt)
+	})
+}
+
+func TestStreamsMapConcurrent(t *testing.T) {
+	for i := range 5 {
+		t.Run(fmt.Sprintf("iteration %d", i+1), func(t *testing.T) {
+			testStreamsMapConcurrent(t)
+		})
+	}
+}
+
+func testStreamsMapConcurrent(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		m := newOutgoingStreamsMap(
+			protocol.StreamTypeBidi,
+			func(id protocol.StreamID) *mockStream { return &mockStream{id: id} },
+			func(f wire.Frame) {},
+			protocol.PerspectiveClient,
+		)
+
+		const num = 100
+
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+		errChan := make(chan error, num)
+		for range num {
+			go func() {
+				_, err := m.OpenStreamSync(ctx)
+				errChan <- err
+			}()
+		}
+
+		go m.CloseWithError(assert.AnError)
+		go cancel()
+		go m.SetMaxStream(protocol.FirstOutgoingBidiStreamClient + 4*num/2)
+
+		synctest.Wait()
+
+		for range num {
+			select {
+			case err := <-errChan:
+				if err != nil {
+					require.True(t, errors.Is(err, assert.AnError) || errors.Is(err, context.Canceled))
+				}
+			default:
+				t.Fatal("OpenStreamSync should have returned")
+			}
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/streams_map_test.go b/electron/native/private-transport/third_party/quic-go/streams_map_test.go
new file mode 100644
index 000000000..89b35226f
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/streams_map_test.go
@@ -0,0 +1,682 @@
+package quic
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/wire"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func TestStreamsMapCreatingStreams(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testStreamsMapCreatingStreams(t, protocol.PerspectiveClient,
+			protocol.FirstIncomingBidiStreamClient,
+			protocol.FirstOutgoingBidiStreamClient,
+			protocol.FirstIncomingUniStreamClient,
+			protocol.FirstOutgoingUniStreamClient,
+		)
+	})
+	t.Run("server", func(t *testing.T) {
+		testStreamsMapCreatingStreams(t, protocol.PerspectiveServer,
+			protocol.FirstIncomingBidiStreamServer,
+			protocol.FirstOutgoingBidiStreamServer,
+			protocol.FirstIncomingUniStreamServer,
+			protocol.FirstOutgoingUniStreamServer,
+		)
+	})
+}
+
+func testStreamsMapCreatingStreams(t *testing.T,
+	perspective protocol.Perspective,
+	firstIncomingBidiStream protocol.StreamID,
+	firstOutgoingBidiStream protocol.StreamID,
+	firstIncomingUniStream protocol.StreamID,
+	firstOutgoingUniStream protocol.StreamID,
+) {
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	m := newStreamsMap(
+		context.Background(),
+		mockSender,
+		func(wire.Frame) {},
+		newTestStreamFlowController,
+		1,
+		1,
+		perspective,
+	)
+
+	m.HandleTransportParameters(&wire.TransportParameters{
+		MaxBidiStreamNum: protocol.MaxStreamCount,
+		MaxUniStreamNum:  protocol.MaxStreamCount,
+	})
+
+	// opening streams
+	str1, err := m.OpenStream()
+	require.NoError(t, err)
+	str2, err := m.OpenStream()
+	require.NoError(t, err)
+	ustr1, err := m.OpenUniStream()
+	require.NoError(t, err)
+	ustr2, err := m.OpenUniStream()
+	require.NoError(t, err)
+
+	assert.Equal(t, str1.StreamID(), firstOutgoingBidiStream)
+	assert.Equal(t, str2.StreamID(), firstOutgoingBidiStream+4)
+	assert.Equal(t, ustr1.StreamID(), firstOutgoingUniStream)
+	assert.Equal(t, ustr2.StreamID(), firstOutgoingUniStream+4)
+
+	// accepting streams is triggered by receiving a frame referencing this stream
+	require.NoError(t, m.HandleStreamFrame(&wire.StreamFrame{StreamID: firstIncomingBidiStream}, monotime.Now()))
+	require.NoError(t, m.HandleStreamFrame(&wire.StreamFrame{StreamID: firstIncomingUniStream}, monotime.Now()))
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	str, err := m.AcceptStream(ctx)
+	require.NoError(t, err)
+	ustr, err := m.AcceptUniStream(ctx)
+	require.NoError(t, err)
+
+	assert.Equal(t, str.StreamID(), firstIncomingBidiStream)
+	assert.Equal(t, ustr.StreamID(), firstIncomingUniStream)
+}
+
+func TestStreamsMapDeletingStreams(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testStreamsMapDeletingStreams(t, protocol.PerspectiveClient,
+			protocol.FirstIncomingBidiStreamClient,
+			protocol.FirstOutgoingBidiStreamClient,
+			protocol.FirstIncomingUniStreamClient,
+			protocol.FirstOutgoingUniStreamClient,
+		)
+	})
+	t.Run("server", func(t *testing.T) {
+		testStreamsMapDeletingStreams(t, protocol.PerspectiveServer,
+			protocol.FirstIncomingBidiStreamServer,
+			protocol.FirstOutgoingBidiStreamServer,
+			protocol.FirstIncomingUniStreamServer,
+			protocol.FirstOutgoingUniStreamServer,
+		)
+	})
+}
+
+func testStreamsMapDeletingStreams(t *testing.T,
+	perspective protocol.Perspective,
+	firstIncomingBidiStream protocol.StreamID,
+	firstOutgoingBidiStream protocol.StreamID,
+	firstIncomingUniStream protocol.StreamID,
+	firstOutgoingUniStream protocol.StreamID,
+) {
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	var frameQueue []wire.Frame
+	m := newStreamsMap(
+		context.Background(),
+		mockSender,
+		func(frame wire.Frame) { frameQueue = append(frameQueue, frame) },
+		newTestStreamFlowController,
+		100,
+		100,
+		perspective,
+	)
+
+	m.HandleTransportParameters(&wire.TransportParameters{
+		MaxBidiStreamNum: 10,
+		MaxUniStreamNum:  10,
+	})
+
+	_, err := m.OpenStream()
+	require.NoError(t, err)
+	require.NoError(t, m.DeleteStream(firstOutgoingBidiStream))
+	err = m.DeleteStream(firstOutgoingBidiStream + 400)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("tried to delete unknown outgoing stream %d", firstOutgoingBidiStream+400))
+
+	_, err = m.OpenUniStream()
+	require.NoError(t, err)
+	require.NoError(t, m.DeleteStream(firstOutgoingUniStream))
+	err = m.DeleteStream(firstOutgoingUniStream + 400)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("tried to delete unknown outgoing stream %d", firstOutgoingUniStream+400))
+
+	require.Empty(t, frameQueue)
+	// deleting incoming bidirectional streams
+	require.NoError(t, m.HandleStreamFrame(&wire.StreamFrame{StreamID: firstIncomingBidiStream}, monotime.Now()))
+	require.NoError(t, m.DeleteStream(firstIncomingBidiStream))
+	err = m.DeleteStream(firstIncomingBidiStream + 400)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("tried to delete unknown incoming stream %d", firstIncomingBidiStream+400))
+
+	// the MAX_STREAMS frame is only queued once the stream is accepted
+	require.Empty(t, frameQueue)
+	_, err = m.AcceptStream(context.Background())
+	require.NoError(t, err)
+
+	require.Equal(t, frameQueue, []wire.Frame{
+		&wire.MaxStreamsFrame{
+			Type:         protocol.StreamTypeBidi,
+			MaxStreamNum: 101,
+		},
+	})
+	frameQueue = frameQueue[:0]
+
+	// deleting incoming unidirectional streams
+	require.NoError(t, m.HandleStreamFrame(&wire.StreamFrame{StreamID: firstIncomingUniStream}, monotime.Now()))
+	require.NoError(t, m.DeleteStream(firstIncomingUniStream))
+	err = m.DeleteStream(firstIncomingUniStream + 400)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("tried to delete unknown incoming stream %d", firstIncomingUniStream+400))
+
+	// the MAX_STREAMS frame is only queued once the stream is accepted
+	require.Empty(t, frameQueue)
+	_, err = m.AcceptUniStream(context.Background())
+	require.NoError(t, err)
+
+	require.Equal(t, frameQueue, []wire.Frame{
+		&wire.MaxStreamsFrame{
+			Type:         protocol.StreamTypeUni,
+			MaxStreamNum: 101,
+		},
+	})
+	frameQueue = frameQueue[:0]
+}
+
+func TestStreamsMapStreamLimits(t *testing.T) {
+	t.Run("client", func(t *testing.T) {
+		testStreamsMapStreamLimits(t, protocol.PerspectiveClient)
+	})
+	t.Run("server", func(t *testing.T) {
+		testStreamsMapStreamLimits(t, protocol.PerspectiveServer)
+	})
+}
+
+func testStreamsMapStreamLimits(t *testing.T, perspective protocol.Perspective) {
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	var frameQueue []wire.Frame
+	m := newStreamsMap(
+		context.Background(),
+		mockSender,
+		func(frame wire.Frame) { frameQueue = append(frameQueue, frame) },
+		newTestStreamFlowController,
+		100,
+		100,
+		perspective,
+	)
+
+	// increase via transport parameters
+	_, err := m.OpenStream()
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+	require.ErrorContains(t, err, "too many open streams")
+	m.HandleTransportParameters(&wire.TransportParameters{MaxBidiStreamNum: 1})
+	_, err = m.OpenStream()
+	require.NoError(t, err)
+	_, err = m.OpenStream()
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+
+	_, err = m.OpenUniStream()
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+	m.HandleTransportParameters(&wire.TransportParameters{MaxUniStreamNum: 1})
+	_, err = m.OpenUniStream()
+	require.NoError(t, err)
+	_, err = m.OpenUniStream()
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+
+	// increase via MAX_STREAMS frames
+	m.HandleMaxStreamsFrame(&wire.MaxStreamsFrame{
+		Type:         protocol.StreamTypeBidi,
+		MaxStreamNum: 2,
+	})
+	_, err = m.OpenStream()
+	require.NoError(t, err)
+	_, err = m.OpenStream()
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+
+	m.HandleMaxStreamsFrame(&wire.MaxStreamsFrame{
+		Type:         protocol.StreamTypeUni,
+		MaxStreamNum: 2,
+	})
+	_, err = m.OpenUniStream()
+	require.NoError(t, err)
+	_, err = m.OpenUniStream()
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+
+	// decrease via transport parameters
+	m.HandleTransportParameters(&wire.TransportParameters{MaxBidiStreamNum: 0})
+	_, err = m.OpenStream()
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+}
+
+func TestStreamsMapHandleReceiveStreamFrames(t *testing.T) {
+	for _, pers := range []protocol.Perspective{protocol.PerspectiveClient, protocol.PerspectiveServer} {
+		t.Run(pers.String(), func(t *testing.T) {
+			t.Run("STREAM frame", func(t *testing.T) {
+				testStreamsMapHandleReceiveStreamFrames(t,
+					pers,
+					func(m *streamsMap, id protocol.StreamID) error {
+						return m.HandleStreamFrame(&wire.StreamFrame{StreamID: id}, monotime.Now())
+					},
+				)
+			})
+
+			t.Run("STREAM_DATA_BLOCKED frame", func(t *testing.T) {
+				testStreamsMapHandleReceiveStreamFrames(t,
+					pers,
+					func(m *streamsMap, id protocol.StreamID) error {
+						return m.HandleStreamDataBlockedFrame(&wire.StreamDataBlockedFrame{StreamID: id})
+					},
+				)
+			})
+
+			t.Run("RESET_STREAM frame", func(t *testing.T) {
+				testStreamsMapHandleReceiveStreamFrames(t,
+					pers,
+					func(m *streamsMap, id protocol.StreamID) error {
+						return m.HandleResetStreamFrame(&wire.ResetStreamFrame{StreamID: id}, monotime.Now())
+					},
+				)
+			})
+		})
+	}
+}
+
+func testStreamsMapHandleReceiveStreamFrames(t *testing.T, pers protocol.Perspective, handleFrame func(*streamsMap, protocol.StreamID) error) {
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	var streamsCreated []protocol.StreamID
+	m := newStreamsMap(
+		context.Background(),
+		mockSender,
+		func(frame wire.Frame) {},
+		func(id protocol.StreamID) *streamFlowController {
+			streamsCreated = append(streamsCreated, id)
+			return newTestStreamFlowController(id)
+		},
+		100,
+		100,
+		pers,
+	)
+
+	m.HandleMaxStreamsFrame(&wire.MaxStreamsFrame{Type: protocol.StreamTypeBidi, MaxStreamNum: protocol.MaxStreamCount})
+	m.HandleMaxStreamsFrame(&wire.MaxStreamsFrame{Type: protocol.StreamTypeUni, MaxStreamNum: protocol.MaxStreamCount})
+
+	var firstOutgoingUniStream, firstOutgoingBidiStream, firstIncomingUniStream, firstIncomingBidiStream protocol.StreamID
+	if pers == protocol.PerspectiveClient {
+		firstOutgoingBidiStream = protocol.FirstOutgoingBidiStreamClient
+		firstOutgoingUniStream = protocol.FirstOutgoingUniStreamClient
+		firstIncomingUniStream = protocol.FirstIncomingUniStreamClient
+		firstIncomingBidiStream = protocol.FirstIncomingBidiStreamClient
+	} else {
+		firstOutgoingBidiStream = protocol.FirstOutgoingBidiStreamServer
+		firstOutgoingUniStream = protocol.FirstOutgoingUniStreamServer
+		firstIncomingUniStream = protocol.FirstIncomingUniStreamServer
+		firstIncomingBidiStream = protocol.FirstIncomingBidiStreamServer
+	}
+
+	// 1. The peer can't open a unidirectional send stream...
+	err := handleFrame(m, firstOutgoingUniStream)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("invalid frame for receive stream %d", firstOutgoingUniStream))
+	require.Empty(t, streamsCreated)
+	// ... and a STREAM frame for a unidirectional send stream is invalid even if the stream is open.
+	_, err = m.OpenUniStream()
+	require.NoError(t, err)
+	err = handleFrame(m, firstOutgoingUniStream)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("invalid frame for receive stream %d", firstOutgoingUniStream))
+	streamsCreated = streamsCreated[:0]
+
+	// 2. The peer can't open a bidirectional stream initiated by us...
+	err = handleFrame(m, firstOutgoingBidiStream)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("peer attempted to open stream %d", firstOutgoingBidiStream))
+	require.Empty(t, streamsCreated)
+	// ... but it's valid once we have opened the stream.
+	_, err = m.OpenStream()
+	require.NoError(t, err)
+	require.NoError(t, handleFrame(m, firstOutgoingBidiStream))
+	streamsCreated = streamsCreated[:0]
+	// Delayed frames for deleted streams are absorbed.
+	require.NoError(t, m.DeleteStream(firstOutgoingBidiStream))
+	require.NoError(t, handleFrame(m, firstOutgoingBidiStream))
+	require.Empty(t, streamsCreated)
+
+	// 3. The peer can send STREAM frames for unidirectional receive streams,
+	// as long as they're below the stream limit.
+	require.ErrorIs(t,
+		handleFrame(m, firstIncomingUniStream+400),
+		&qerr.TransportError{ErrorCode: qerr.StreamLimitError},
+	)
+	require.Empty(t, streamsCreated)
+	require.NoError(t, handleFrame(m, firstIncomingUniStream))
+	require.Equal(t, streamsCreated, []protocol.StreamID{firstIncomingUniStream})
+	streamsCreated = streamsCreated[:0]
+	// Delayed frames for deleted streams are absorbed.
+	require.NoError(t, m.DeleteStream(firstIncomingUniStream))
+	require.NoError(t, handleFrame(m, firstIncomingUniStream))
+	require.Empty(t, streamsCreated)
+
+	// 4. The peer can send STREAM frames for bidirectional receive streams,
+	// as long as they're below the stream limit.
+	require.ErrorIs(t,
+		handleFrame(m, firstIncomingBidiStream+400),
+		&qerr.TransportError{ErrorCode: qerr.StreamLimitError},
+	)
+	require.Empty(t, streamsCreated)
+	require.NoError(t, handleFrame(m, firstIncomingBidiStream))
+	require.Equal(t, streamsCreated, []protocol.StreamID{firstIncomingBidiStream})
+}
+
+func TestStreamsMapHandleSendStreamFrames(t *testing.T) {
+	for _, pers := range []protocol.Perspective{protocol.PerspectiveClient, protocol.PerspectiveServer} {
+		t.Run(pers.String(), func(t *testing.T) {
+			t.Run("STOP_SENDING frame", func(t *testing.T) {
+				testStreamsMapHandleSendStreamFrames(t,
+					pers,
+					func(m *streamsMap, id protocol.StreamID) error {
+						return m.HandleStopSendingFrame(&wire.StopSendingFrame{StreamID: id})
+					},
+				)
+			})
+
+			t.Run("MAX_STREAM_DATA frame", func(t *testing.T) {
+				testStreamsMapHandleSendStreamFrames(t,
+					pers,
+					func(m *streamsMap, id protocol.StreamID) error {
+						return m.HandleMaxStreamDataFrame(&wire.MaxStreamDataFrame{StreamID: id, MaximumStreamData: 1000})
+					},
+				)
+			})
+		})
+	}
+}
+
+func testStreamsMapHandleSendStreamFrames(t *testing.T, pers protocol.Perspective, handleFrame func(m *streamsMap, id protocol.StreamID) error) {
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	mockSender.EXPECT().onHasStreamControlFrame(gomock.Any(), gomock.Any()).AnyTimes()
+	var streamsCreated []protocol.StreamID
+	m := newStreamsMap(
+		context.Background(),
+		mockSender,
+		func(frame wire.Frame) {},
+		func(id protocol.StreamID) *streamFlowController {
+			streamsCreated = append(streamsCreated, id)
+			return newTestStreamFlowController(id)
+		},
+		100,
+		100,
+		pers,
+	)
+
+	m.HandleMaxStreamsFrame(&wire.MaxStreamsFrame{Type: protocol.StreamTypeBidi, MaxStreamNum: protocol.MaxStreamCount})
+	m.HandleMaxStreamsFrame(&wire.MaxStreamsFrame{Type: protocol.StreamTypeUni, MaxStreamNum: protocol.MaxStreamCount})
+
+	var firstOutgoingUniStream, firstOutgoingBidiStream, firstIncomingUniStream, firstIncomingBidiStream protocol.StreamID
+	if pers == protocol.PerspectiveClient {
+		firstOutgoingBidiStream = protocol.FirstOutgoingBidiStreamClient
+		firstOutgoingUniStream = protocol.FirstOutgoingUniStreamClient
+		firstIncomingUniStream = protocol.FirstIncomingUniStreamClient
+		firstIncomingBidiStream = protocol.FirstIncomingBidiStreamClient
+	} else {
+		firstOutgoingBidiStream = protocol.FirstOutgoingBidiStreamServer
+		firstOutgoingUniStream = protocol.FirstOutgoingUniStreamServer
+		firstIncomingUniStream = protocol.FirstIncomingUniStreamServer
+		firstIncomingBidiStream = protocol.FirstIncomingBidiStreamServer
+	}
+
+	// 1. The peer can't open a unidirectional send stream...
+	err := handleFrame(m, firstOutgoingUniStream)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("peer attempted to open stream %d", firstOutgoingUniStream))
+	require.Empty(t, streamsCreated)
+	// ... but once we have opened the stream, it's valid.
+	_, err = m.OpenUniStream()
+	require.NoError(t, err)
+	require.NoError(t, handleFrame(m, firstOutgoingUniStream))
+	streamsCreated = streamsCreated[:0]
+	// Delayed frames for deleted streams are absorbed.
+	require.NoError(t, m.DeleteStream(firstOutgoingUniStream))
+	require.NoError(t, handleFrame(m, firstOutgoingUniStream))
+	require.Empty(t, streamsCreated)
+
+	// 2. The peer can't open a bidirectional stream initiated by us...
+	err = handleFrame(m, firstOutgoingBidiStream)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("peer attempted to open stream %d", firstOutgoingBidiStream))
+	require.Empty(t, streamsCreated)
+	// ... but once we have opened the stream, it's valid.
+	_, err = m.OpenStream()
+	require.NoError(t, err)
+	require.NoError(t, handleFrame(m, firstOutgoingBidiStream))
+	streamsCreated = streamsCreated[:0]
+	// Delayed frames for deleted streams are absorbed.
+	require.NoError(t, m.DeleteStream(firstOutgoingBidiStream))
+	require.NoError(t, handleFrame(m, firstOutgoingBidiStream))
+	require.Empty(t, streamsCreated)
+
+	// 3. The peer can't send STOP_SENDING frames for unidirectional send streams
+	err = handleFrame(m, firstIncomingUniStream)
+	require.ErrorIs(t, err, &qerr.TransportError{ErrorCode: qerr.StreamStateError})
+	require.ErrorContains(t, err, fmt.Sprintf("invalid frame for send stream %d", firstIncomingUniStream))
+	require.Empty(t, streamsCreated)
+
+	// 4. The peer can send STOP_SENDING frames for bidirectional receive streams iniated by itself,
+	// as long as they're below the stream limit.
+	require.ErrorIs(t,
+		handleFrame(m, firstIncomingBidiStream+400),
+		&qerr.TransportError{ErrorCode: qerr.StreamLimitError},
+	)
+	require.Empty(t, streamsCreated)
+	require.NoError(t, handleFrame(m, firstIncomingBidiStream))
+	require.Equal(t, streamsCreated, []protocol.StreamID{firstIncomingBidiStream})
+	streamsCreated = streamsCreated[:0]
+	// Delayed frames for deleted streams are absorbed.
+	require.NoError(t, m.DeleteStream(firstIncomingBidiStream))
+	require.NoError(t, handleFrame(m, firstIncomingBidiStream))
+	require.Empty(t, streamsCreated)
+}
+
+func TestStreamsMapClosing(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	m := newStreamsMap(
+		context.Background(),
+		mockSender,
+		func(wire.Frame) {},
+		newTestStreamFlowController,
+		1,
+		1,
+		protocol.PerspectiveClient,
+	)
+
+	m.CloseWithError(assert.AnError)
+	_, err := m.OpenStream()
+	require.ErrorIs(t, err, assert.AnError)
+	_, err = m.OpenUniStream()
+	require.ErrorIs(t, err, assert.AnError)
+	_, err = m.AcceptStream(context.Background())
+	require.ErrorIs(t, err, assert.AnError)
+	_, err = m.AcceptUniStream(context.Background())
+	require.ErrorIs(t, err, assert.AnError)
+}
+
+func TestStreamsMap0RTT(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	var fcs []*streamFlowController
+	m := newStreamsMap(
+		context.Background(),
+		mockSender,
+		func(wire.Frame) {},
+		func(id protocol.StreamID) *streamFlowController {
+			fc := newTestStreamFlowController(id)
+			fcs = append(fcs, fc)
+			return fc
+		},
+		1,
+		1,
+		protocol.PerspectiveClient,
+	)
+
+	// restored transport parameters
+	m.HandleTransportParameters(&wire.TransportParameters{
+		MaxBidiStreamNum: 1,
+		MaxUniStreamNum:  1,
+	})
+	_, err := m.OpenStream()
+	require.NoError(t, err)
+	_, err = m.OpenUniStream()
+	require.NoError(t, err)
+
+	// new transport parameters
+	m.HandleTransportParameters(&wire.TransportParameters{
+		MaxBidiStreamNum:               1000,
+		InitialMaxStreamDataBidiRemote: 1234,
+		MaxUniStreamNum:                1000,
+		InitialMaxStreamDataUni:        4321,
+	})
+	require.Len(t, fcs, 2)
+	require.Equal(t, protocol.ByteCount(1234), fcs[0].SendWindowSize())
+	require.Equal(t, protocol.ByteCount(4321), fcs[1].SendWindowSize())
+}
+
+func TestStreamsMap0RTTResetStreamAt(t *testing.T) {
+	for _, enabled := range []bool{false, true} {
+		t.Run(fmt.Sprintf("enabled: %t", enabled), func(t *testing.T) {
+			mockSender := NewMockStreamSender(gomock.NewController(t))
+			mockSender.EXPECT().onHasStreamData(gomock.Any(), gomock.Any()).AnyTimes()
+			mockSender.EXPECT().onHasStreamControlFrame(gomock.Any(), gomock.Any()).AnyTimes()
+			m := newStreamsMap(
+				context.Background(),
+				mockSender,
+				func(wire.Frame) {},
+				func(id protocol.StreamID) *streamFlowController {
+					return newTestStreamFlowControllerWithSendWindow(id, 1)
+				},
+				1,
+				1,
+				protocol.PerspectiveClient,
+			)
+
+			m.HandleTransportParameters(&wire.TransportParameters{MaxBidiStreamNum: 1, MaxUniStreamNum: 1})
+			str, err := m.OpenStream()
+			require.NoError(t, err)
+			uniStr, err := m.OpenUniStream()
+			require.NoError(t, err)
+
+			m.HandleTransportParameters(&wire.TransportParameters{EnableResetStreamAt: enabled})
+			require.Equal(t, enabled, supportsResetStreamAt(t, str))
+			require.Equal(t, enabled, sendStreamSupportsResetStreamAt(t, uniStr))
+		})
+	}
+}
+
+func TestStreamsMap0RTTRejection(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+	mockSender := NewMockStreamSender(mockCtrl)
+	m := newStreamsMap(
+		context.Background(),
+		mockSender,
+		func(wire.Frame) {},
+		newTestStreamFlowController,
+		1,
+		1,
+		protocol.PerspectiveClient,
+	)
+
+	m.ResetFor0RTT()
+	_, err := m.OpenStream()
+	require.ErrorIs(t, err, Err0RTTRejected)
+	_, err = m.OpenUniStream()
+	require.ErrorIs(t, err, Err0RTTRejected)
+	_, err = m.AcceptStream(context.Background())
+	require.ErrorIs(t, err, Err0RTTRejected)
+	_, err = m.AcceptUniStream(context.Background())
+	require.ErrorIs(t, err, Err0RTTRejected)
+
+	// make sure that we can still get new streams, as the server might be sending us data
+	require.NoError(t, m.HandleStreamFrame(&wire.StreamFrame{StreamID: 3}, monotime.Now()))
+
+	// now switch to using the new streams map
+	m.UseResetMaps()
+	_, err = m.OpenStream()
+	require.Error(t, err)
+	require.ErrorIs(t, err, &StreamLimitReachedError{})
+}
+
+func TestStreamsMap0RTTRejectionResetStreamAt(t *testing.T) {
+	for _, enabled := range []bool{false, true} {
+		t.Run(fmt.Sprintf("enabled: %t", enabled), func(t *testing.T) {
+			testStreamsMap0RTTRejectionResetStreamAt(t, enabled)
+		})
+	}
+}
+
+func testStreamsMap0RTTRejectionResetStreamAt(t *testing.T, enabled bool) {
+	mockSender := NewMockStreamSender(gomock.NewController(t))
+	mockSender.EXPECT().onHasStreamData(gomock.Any(), gomock.Any()).AnyTimes()
+	mockSender.EXPECT().onHasStreamControlFrame(gomock.Any(), gomock.Any()).AnyTimes()
+	m := newStreamsMap(
+		context.Background(),
+		mockSender,
+		func(wire.Frame) {},
+		func(id protocol.StreamID) *streamFlowController {
+			return newTestStreamFlowControllerWithSendWindow(id, 1)
+		},
+		2,
+		1,
+		protocol.PerspectiveClient,
+	)
+
+	m.HandleTransportParameters(&wire.TransportParameters{EnableResetStreamAt: true})
+	m.ResetFor0RTT()
+
+	// The server can send 0.5-RTT data before the handshake completes.
+	require.NoError(t, m.HandleStreamFrame(&wire.StreamFrame{StreamID: 1}, monotime.Now()))
+	m.UseResetMaps()
+
+	str, err := m.AcceptStream(context.Background())
+	require.NoError(t, err)
+	require.False(t, supportsResetStreamAt(t, str))
+
+	m.HandleTransportParameters(&wire.TransportParameters{EnableResetStreamAt: enabled})
+	require.NoError(t, m.HandleStreamFrame(&wire.StreamFrame{StreamID: 5}, monotime.Now()))
+	str, err = m.AcceptStream(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, enabled, supportsResetStreamAt(t, str))
+}
+
+func supportsResetStreamAt(t *testing.T, str *Stream) bool {
+	t.Helper()
+	_, err := str.Write([]byte{0})
+	require.NoError(t, err)
+	str.SetReliableBoundary()
+	str.CancelWrite(0)
+	frame, ok, _ := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	reset, ok := frame.Frame.(*wire.ResetStreamFrame)
+	require.True(t, ok)
+	return reset.ReliableSize > 0
+}
+
+func sendStreamSupportsResetStreamAt(t *testing.T, str *SendStream) bool {
+	t.Helper()
+	_, err := str.Write([]byte{0})
+	require.NoError(t, err)
+	str.SetReliableBoundary()
+	str.CancelWrite(0)
+	frame, ok, _ := str.getControlFrame(monotime.Now())
+	require.True(t, ok)
+	reset, ok := frame.Frame.(*wire.ResetStreamFrame)
+	require.True(t, ok)
+	return reset.ReliableSize > 0
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn.go b/electron/native/private-transport/third_party/quic-go/sys_conn.go
new file mode 100644
index 000000000..70350d9ab
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn.go
@@ -0,0 +1,144 @@
+package quic
+
+import (
+	"io"
+	"log"
+	"net"
+	"os"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+type connCapabilities struct {
+	// This connection has the Don't Fragment (DF) bit set.
+	// This means it makes to run DPLPMTUD.
+	DF bool
+	// GSO (Generic Segmentation Offload) supported
+	GSO bool
+	// ECN (Explicit Congestion Notifications) supported
+	ECN bool
+}
+
+// rawConn is a connection that allow reading of a receivedPackeh.
+type rawConn interface {
+	ReadPacket() (receivedPacket, error)
+	// WritePacket writes a packet on the wire.
+	// gsoSize is the size of a single packet, or 0 to disable GSO.
+	// It is invalid to set gsoSize if capabilities.GSO is not set.
+	WritePacket(b []byte, addr net.Addr, packetInfoOOB []byte, gsoSize uint16, ecn protocol.ECN) (int, error)
+	LocalAddr() net.Addr
+	SetReadDeadline(time.Time) error
+	io.Closer
+
+	capabilities() connCapabilities
+}
+
+// OOBCapablePacketConn is a connection that allows the reading of ECN bits from the IP header.
+// If the PacketConn passed to the [Transport] satisfies this interface, quic-go will use it.
+// In this case, packets will be read in batches, and [OOBCapablePacketConn.WriteMsgUDP]
+// will be used instead of [net.PacketConn.WriteTo] to write packets.
+type OOBCapablePacketConn interface {
+	net.PacketConn
+	SyscallConn() (syscall.RawConn, error)
+	SetReadBuffer(int) error
+	ReadMsgUDP(b, oob []byte) (n, oobn, flags int, addr *net.UDPAddr, err error)
+	WriteMsgUDP(b, oob []byte, addr *net.UDPAddr) (n, oobn int, err error)
+}
+
+var _ OOBCapablePacketConn = &net.UDPConn{}
+
+func wrapConn(pc net.PacketConn) (rawConn, error) {
+	if err := setReceiveBuffer(pc); err != nil {
+		if !strings.Contains(err.Error(), "use of closed network connection") {
+			setBufferWarningOnce.Do(func() {
+				if disable, _ := strconv.ParseBool(os.Getenv("QUIC_GO_DISABLE_RECEIVE_BUFFER_WARNING")); disable {
+					return
+				}
+				log.Printf("%s. See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.", err)
+			})
+		}
+	}
+	if err := setSendBuffer(pc); err != nil {
+		if !strings.Contains(err.Error(), "use of closed network connection") {
+			setBufferWarningOnce.Do(func() {
+				if disable, _ := strconv.ParseBool(os.Getenv("QUIC_GO_DISABLE_RECEIVE_BUFFER_WARNING")); disable {
+					return
+				}
+				log.Printf("%s. See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.", err)
+			})
+		}
+	}
+
+	conn, ok := pc.(interface {
+		SyscallConn() (syscall.RawConn, error)
+	})
+	var supportsDF bool
+	if ok {
+		rawConn, err := conn.SyscallConn()
+		if err != nil {
+			return nil, err
+		}
+
+		// only set DF on UDP sockets
+		if _, ok := pc.LocalAddr().(*net.UDPAddr); ok {
+			var err error
+			supportsDF, err = setDF(rawConn)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	c, ok := pc.(OOBCapablePacketConn)
+	if !ok {
+		utils.DefaultLogger.Infof("PacketConn is not a net.UDPConn. Disabling optimizations possible on UDP connections.")
+		return &basicConn{PacketConn: pc, supportsDF: supportsDF}, nil
+	}
+	return newConn(c, supportsDF)
+}
+
+// The basicConn is the most trivial implementation of a rawConn.
+// It reads a single packet from the underlying net.PacketConn.
+// It is used when
+// * the net.PacketConn is not a OOBCapablePacketConn, and
+// * when the OS doesn't support OOB.
+type basicConn struct {
+	net.PacketConn
+	supportsDF bool
+}
+
+var _ rawConn = &basicConn{}
+
+func (c *basicConn) ReadPacket() (receivedPacket, error) {
+	buffer := getPacketBuffer()
+	// The packet size should not exceed protocol.MaxPacketBufferSize bytes
+	// If it does, we only read a truncated packet, which will then end up undecryptable
+	buffer.Data = buffer.Data[:protocol.MaxPacketBufferSize]
+	n, addr, err := c.ReadFrom(buffer.Data)
+	if err != nil {
+		return receivedPacket{}, err
+	}
+	return receivedPacket{
+		remoteAddr: addr,
+		rcvTime:    monotime.Now(),
+		data:       buffer.Data[:n],
+		buffer:     buffer,
+	}, nil
+}
+
+func (c *basicConn) WritePacket(b []byte, addr net.Addr, _ []byte, gsoSize uint16, ecn protocol.ECN) (n int, err error) {
+	if gsoSize != 0 {
+		panic("cannot use GSO with a basicConn")
+	}
+	if ecn != protocol.ECNUnsupported {
+		panic("cannot use ECN with a basicConn")
+	}
+	return c.WriteTo(b, addr)
+}
+
+func (c *basicConn) capabilities() connCapabilities { return connCapabilities{DF: c.supportsDF} }
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_buffers.go b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers.go
new file mode 100644
index 000000000..851c534f1
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers.go
@@ -0,0 +1,67 @@
+package quic
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"syscall"
+
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+//go:generate sh -c "echo '// Code generated by go generate. DO NOT EDIT.\n// Source: sys_conn_buffers.go\n' > sys_conn_buffers_write.go && sed -e 's/SetReadBuffer/SetWriteBuffer/g' -e 's/setReceiveBuffer/setSendBuffer/g' -e 's/inspectReadBuffer/inspectWriteBuffer/g' -e 's/forceSetReceiveBuffer/forceSetSendBuffer/g' -e 's/receive buffer/send buffer/g' sys_conn_buffers.go | sed '/^\\/\\/go:generate/d' >> sys_conn_buffers_write.go"
+func setReceiveBuffer(c net.PacketConn) error {
+	conn, ok := c.(interface{ SetReadBuffer(int) error })
+	if !ok {
+		return errors.New("connection doesn't allow setting of receive buffer size. Not a *net.UDPConn?")
+	}
+
+	var syscallConn syscall.RawConn
+	if sc, ok := c.(interface {
+		SyscallConn() (syscall.RawConn, error)
+	}); ok {
+		var err error
+		syscallConn, err = sc.SyscallConn()
+		if err != nil {
+			syscallConn = nil
+		}
+	}
+	// The connection has a SetReadBuffer method, but we couldn't obtain a syscall.RawConn.
+	// This shouldn't happen for a net.UDPConn, but is possible if the connection just implements the
+	// net.PacketConn interface and the SetReadBuffer method.
+	// We have no way of checking if increasing the buffer size actually worked.
+	if syscallConn == nil {
+		return conn.SetReadBuffer(desiredBufferSize)
+	}
+
+	size, err := inspectReadBuffer(syscallConn)
+	if err != nil {
+		return fmt.Errorf("failed to determine receive buffer size: %w", err)
+	}
+	if size >= desiredBufferSize {
+		utils.DefaultLogger.Debugf("Conn has receive buffer of %d kiB (wanted: at least %d kiB)", size/1024, desiredBufferSize/1024)
+		return nil
+	}
+	// Ignore the error. We check if we succeeded by querying the buffer size afterward.
+	_ = conn.SetReadBuffer(desiredBufferSize)
+	newSize, err := inspectReadBuffer(syscallConn)
+	if newSize < desiredBufferSize {
+		// Try again with RCVBUFFORCE on Linux
+		_ = forceSetReceiveBuffer(syscallConn, desiredBufferSize)
+		newSize, err = inspectReadBuffer(syscallConn)
+		if err != nil {
+			return fmt.Errorf("failed to determine receive buffer size: %w", err)
+		}
+	}
+	if err != nil {
+		return fmt.Errorf("failed to determine receive buffer size: %w", err)
+	}
+	if newSize < desiredBufferSize {
+		if newSize == size {
+			return fmt.Errorf("failed to increase receive buffer size (wanted: %d kiB, got %d kiB)", desiredBufferSize/1024, newSize/1024)
+		}
+		return fmt.Errorf("failed to sufficiently increase receive buffer size (was: %d kiB, wanted: %d kiB, got: %d kiB)", size/1024, desiredBufferSize/1024, newSize/1024)
+	}
+	utils.DefaultLogger.Debugf("Increased receive buffer size to %d kiB", newSize/1024)
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_inspect.go b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_inspect.go
new file mode 100644
index 000000000..64c225bde
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_inspect.go
@@ -0,0 +1,31 @@
+//go:build darwin || freebsd || linux || openbsd
+
+package quic
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func inspectReadBuffer(c syscall.RawConn) (int, error) {
+	var size int
+	var serr error
+	if err := c.Control(func(fd uintptr) {
+		size, serr = unix.GetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_RCVBUF)
+	}); err != nil {
+		return 0, err
+	}
+	return size, serr
+}
+
+func inspectWriteBuffer(c syscall.RawConn) (int, error) {
+	var size int
+	var serr error
+	if err := c.Control(func(fd uintptr) {
+		size, serr = unix.GetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_SNDBUF)
+	}); err != nil {
+		return 0, err
+	}
+	return size, serr
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_inspect_stub.go b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_inspect_stub.go
new file mode 100644
index 000000000..e11d2c004
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_inspect_stub.go
@@ -0,0 +1,6 @@
+//go:build !darwin && !freebsd && !linux && !openbsd && !windows
+
+package quic
+
+func inspectReadBuffer(any) (int, error)  { return 0, nil }
+func inspectWriteBuffer(any) (int, error) { return 0, nil }
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_nonopenbsd.go b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_nonopenbsd.go
new file mode 100644
index 000000000..27a01f5c4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_nonopenbsd.go
@@ -0,0 +1,5 @@
+//go:build !openbsd
+
+package quic
+
+const desiredBufferSize = 7 << 20 // 7 MiB
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_openbsd.go b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_openbsd.go
new file mode 100644
index 000000000..36aa7f3cf
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_openbsd.go
@@ -0,0 +1,8 @@
+//go:build openbsd
+
+package quic
+
+// The OpenBSD kernel rejects socket buffer sizes larger than SB_MAX (2 MB, see sys/sys/socketvar.h)
+// instead of clamping them. This limit is not queryable at runtime; changing it requires a custom
+// kernel (sb_max is a patchable kernel variable, not a sysctl).
+const desiredBufferSize = 2 << 20 // 2 MiB
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_write.go b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_write.go
new file mode 100644
index 000000000..705427e87
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_buffers_write.go
@@ -0,0 +1,69 @@
+// Code generated by go generate. DO NOT EDIT.
+// Source: sys_conn_buffers.go
+
+package quic
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"syscall"
+
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+func setSendBuffer(c net.PacketConn) error {
+	conn, ok := c.(interface{ SetWriteBuffer(int) error })
+	if !ok {
+		return errors.New("connection doesn't allow setting of send buffer size. Not a *net.UDPConn?")
+	}
+
+	var syscallConn syscall.RawConn
+	if sc, ok := c.(interface {
+		SyscallConn() (syscall.RawConn, error)
+	}); ok {
+		var err error
+		syscallConn, err = sc.SyscallConn()
+		if err != nil {
+			syscallConn = nil
+		}
+	}
+	// The connection has a SetWriteBuffer method, but we couldn't obtain a syscall.RawConn.
+	// This shouldn't happen for a net.UDPConn, but is possible if the connection just implements the
+	// net.PacketConn interface and the SetWriteBuffer method.
+	// We have no way of checking if increasing the buffer size actually worked.
+	if syscallConn == nil {
+		return conn.SetWriteBuffer(desiredBufferSize)
+	}
+
+	size, err := inspectWriteBuffer(syscallConn)
+	if err != nil {
+		return fmt.Errorf("failed to determine send buffer size: %w", err)
+	}
+	if size >= desiredBufferSize {
+		utils.DefaultLogger.Debugf("Conn has send buffer of %d kiB (wanted: at least %d kiB)", size/1024, desiredBufferSize/1024)
+		return nil
+	}
+	// Ignore the error. We check if we succeeded by querying the buffer size afterward.
+	_ = conn.SetWriteBuffer(desiredBufferSize)
+	newSize, err := inspectWriteBuffer(syscallConn)
+	if newSize < desiredBufferSize {
+		// Try again with RCVBUFFORCE on Linux
+		_ = forceSetSendBuffer(syscallConn, desiredBufferSize)
+		newSize, err = inspectWriteBuffer(syscallConn)
+		if err != nil {
+			return fmt.Errorf("failed to determine send buffer size: %w", err)
+		}
+	}
+	if err != nil {
+		return fmt.Errorf("failed to determine send buffer size: %w", err)
+	}
+	if newSize < desiredBufferSize {
+		if newSize == size {
+			return fmt.Errorf("failed to increase send buffer size (wanted: %d kiB, got %d kiB)", desiredBufferSize/1024, newSize/1024)
+		}
+		return fmt.Errorf("failed to sufficiently increase send buffer size (was: %d kiB, wanted: %d kiB, got: %d kiB)", size/1024, desiredBufferSize/1024, newSize/1024)
+	}
+	utils.DefaultLogger.Debugf("Increased send buffer size to %d kiB", newSize/1024)
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_df.go b/electron/native/private-transport/third_party/quic-go/sys_conn_df.go
new file mode 100644
index 000000000..0db61509d
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_df.go
@@ -0,0 +1,22 @@
+//go:build !linux && !windows && !darwin
+
+package quic
+
+import (
+	"syscall"
+)
+
+func setDF(syscall.RawConn) (bool, error) {
+	// no-op on unsupported platforms
+	return false, nil
+}
+
+func isSendMsgSizeErr(err error) bool {
+	// to be implemented for more specific platforms
+	return false
+}
+
+func isRecvMsgSizeErr(err error) bool {
+	// to be implemented for more specific platforms
+	return false
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_df_darwin.go b/electron/native/private-transport/third_party/quic-go/sys_conn_df_darwin.go
new file mode 100644
index 000000000..afaa68414
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_df_darwin.go
@@ -0,0 +1,90 @@
+//go:build darwin
+
+package quic
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// for macOS versions, see https://en.wikipedia.org/wiki/Darwin_(operating_system)#Darwin_20_onwards
+const (
+	macOSVersion11 = 20
+	macOSVersion15 = 24
+)
+
+func setDF(rawConn syscall.RawConn) (bool, error) {
+	// Setting DF bit is only supported from macOS 11.
+	// https://github.com/chromium/chromium/blob/117.0.5881.2/net/socket/udp_socket_posix.cc#L555
+	version, err := getMacOSVersion()
+	if err != nil || version < macOSVersion11 {
+		return false, err
+	}
+
+	var controlErr error
+	var disableDF bool
+	if err := rawConn.Control(func(fd uintptr) {
+		addr, err := unix.Getsockname(int(fd))
+		if err != nil {
+			controlErr = fmt.Errorf("getsockname: %w", err)
+			return
+		}
+
+		// Dual-stack sockets are effectively IPv6 sockets (with IPV6_ONLY set to 0).
+		// On macOS, the DF bit on dual-stack sockets is controlled by the IPV6_DONTFRAG option.
+		// See https://datatracker.ietf.org/doc/draft-seemann-tsvwg-udp-fragmentation/ for details.
+		switch addr.(type) {
+		case *unix.SockaddrInet4:
+			controlErr = unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_DONTFRAG, 1)
+		case *unix.SockaddrInet6:
+			controlErr = unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_DONTFRAG, 1)
+
+			// Setting the DF bit on dual-stack sockets works since macOS Sequoia.
+			// Disable DF on dual-stack sockets before Sequoia.
+			if version < macOSVersion15 {
+				// check if this is a dual-stack socket by reading the IPV6_V6ONLY flag
+				v6only, err := unix.GetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_V6ONLY)
+				if err != nil {
+					controlErr = fmt.Errorf("getting IPV6_V6ONLY: %w", err)
+					return
+				}
+				disableDF = v6only == 0
+			}
+		default:
+			controlErr = fmt.Errorf("unknown address type: %T", addr)
+		}
+	}); err != nil {
+		return false, err
+	}
+	if controlErr != nil {
+		return false, controlErr
+	}
+	return !disableDF, nil
+}
+
+func isSendMsgSizeErr(err error) bool {
+	return errors.Is(err, unix.EMSGSIZE)
+}
+
+func isRecvMsgSizeErr(error) bool { return false }
+
+func getMacOSVersion() (int, error) {
+	uname := &unix.Utsname{}
+	if err := unix.Uname(uname); err != nil {
+		return 0, err
+	}
+	before, _, ok := strings.Cut(string(uname.Release[:]), ".")
+	if !ok {
+		return 0, nil
+	}
+	version, err := strconv.Atoi(before)
+	if err != nil {
+		return 0, err
+	}
+	return version, nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_df_darwin_test.go b/electron/native/private-transport/third_party/quic-go/sys_conn_df_darwin_test.go
new file mode 100644
index 000000000..57c5a0532
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_df_darwin_test.go
@@ -0,0 +1,101 @@
+//go:build darwin
+
+package quic
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestIPFragmentation(t *testing.T) {
+	sink, err := net.ListenUDP("udp", &net.UDPAddr{Port: 0})
+	require.NoError(t, err)
+	t.Cleanup(func() { sink.Close() })
+	sinkPort := sink.LocalAddr().(*net.UDPAddr).Port
+
+	canSendIPv4 := func(conn *net.UDPConn) bool {
+		_, err := conn.WriteTo([]byte("hello"), &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: sinkPort})
+		return err == nil
+	}
+
+	canSendIPv6 := func(conn *net.UDPConn) bool {
+		_, err := conn.WriteTo([]byte("hello"), &net.UDPAddr{IP: net.IPv6loopback, Port: sinkPort})
+		return err == nil
+	}
+
+	t.Run("udp4", func(t *testing.T) {
+		conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+		require.NoError(t, err)
+		defer conn.Close()
+
+		require.True(t, canSendIPv4(conn))
+		require.False(t, canSendIPv6(conn))
+
+		raw, err := conn.SyscallConn()
+		require.NoError(t, err)
+		canDF, _ := setDF(raw)
+		require.True(t, canDF)
+	})
+
+	t.Run("udp6", func(t *testing.T) {
+		conn, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6loopback, Port: 0})
+		require.NoError(t, err)
+		defer conn.Close()
+
+		require.False(t, canSendIPv4(conn))
+		require.True(t, canSendIPv6(conn))
+
+		raw, err := conn.SyscallConn()
+		require.NoError(t, err)
+		canDF, _ := setDF(raw)
+		require.True(t, canDF)
+	})
+
+	t.Run("udp, dual-stack", func(t *testing.T) {
+		if version, err := getMacOSVersion(); err != nil || version < macOSVersion15 {
+			t.Skipf("skipping on darwin %d", version-9)
+		}
+
+		conn, err := net.ListenUDP("udp", &net.UDPAddr{Port: 0})
+		require.NoError(t, err)
+		defer conn.Close()
+
+		require.True(t, canSendIPv4(conn))
+		require.True(t, canSendIPv6(conn))
+
+		raw, err := conn.SyscallConn()
+		require.NoError(t, err)
+		canDF, _ := setDF(raw)
+		require.True(t, canDF)
+	})
+
+	t.Run("udp, listening on IPv4", func(t *testing.T) {
+		conn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+		require.NoError(t, err)
+		defer conn.Close()
+
+		require.True(t, canSendIPv4(conn))
+		require.False(t, canSendIPv6(conn))
+
+		raw, err := conn.SyscallConn()
+		require.NoError(t, err)
+		canDF, _ := setDF(raw)
+		require.True(t, canDF)
+	})
+
+	t.Run("udp, listening on IPv6", func(t *testing.T) {
+		conn, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6loopback, Port: 0})
+		require.NoError(t, err)
+		defer conn.Close()
+
+		require.False(t, canSendIPv4(conn))
+		require.True(t, canSendIPv6(conn))
+
+		raw, err := conn.SyscallConn()
+		require.NoError(t, err)
+		canDF, _ := setDF(raw)
+		require.True(t, canDF)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_df_linux.go b/electron/native/private-transport/third_party/quic-go/sys_conn_df_linux.go
new file mode 100644
index 000000000..b09a2394e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_df_linux.go
@@ -0,0 +1,42 @@
+//go:build linux
+
+package quic
+
+import (
+	"errors"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+func setDF(rawConn syscall.RawConn) (bool, error) {
+	// Enabling IP_MTU_DISCOVER will force the kernel to return "sendto: message too long"
+	// and the datagram will not be fragmented
+	var errDFIPv4, errDFIPv6 error
+	if err := rawConn.Control(func(fd uintptr) {
+		errDFIPv4 = unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_MTU_DISCOVER, unix.IP_PMTUDISC_PROBE)
+		errDFIPv6 = unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_MTU_DISCOVER, unix.IPV6_PMTUDISC_PROBE)
+	}); err != nil {
+		return false, err
+	}
+	switch {
+	case errDFIPv4 == nil && errDFIPv6 == nil:
+		utils.DefaultLogger.Debugf("Setting DF for IPv4 and IPv6.")
+	case errDFIPv4 == nil && errDFIPv6 != nil:
+		utils.DefaultLogger.Debugf("Setting DF for IPv4.")
+	case errDFIPv4 != nil && errDFIPv6 == nil:
+		utils.DefaultLogger.Debugf("Setting DF for IPv6.")
+	case errDFIPv4 != nil && errDFIPv6 != nil:
+		return false, errors.New("setting DF failed for both IPv4 and IPv6")
+	}
+	return true, nil
+}
+
+func isSendMsgSizeErr(err error) bool {
+	// https://man7.org/linux/man-pages/man7/udp.7.html
+	return errors.Is(err, unix.EMSGSIZE)
+}
+
+func isRecvMsgSizeErr(error) bool { return false }
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_df_windows.go b/electron/native/private-transport/third_party/quic-go/sys_conn_df_windows.go
new file mode 100644
index 000000000..4c140f001
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_df_windows.go
@@ -0,0 +1,52 @@
+//go:build windows
+
+package quic
+
+import (
+	"errors"
+	"syscall"
+
+	"golang.org/x/sys/windows"
+
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+const (
+	// https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinSock/constant.IP_DONTFRAGMENT.html
+	//nolint:stylecheck
+	IP_DONTFRAGMENT = 14
+	// https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/Networking/WinSock/constant.IPV6_DONTFRAG.html
+	//nolint:stylecheck
+	IPV6_DONTFRAG = 14
+)
+
+func setDF(rawConn syscall.RawConn) (bool, error) {
+	var errDFIPv4, errDFIPv6 error
+	if err := rawConn.Control(func(fd uintptr) {
+		errDFIPv4 = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, IP_DONTFRAGMENT, 1)
+		errDFIPv6 = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, IPV6_DONTFRAG, 1)
+	}); err != nil {
+		return false, err
+	}
+	switch {
+	case errDFIPv4 == nil && errDFIPv6 == nil:
+		utils.DefaultLogger.Debugf("Setting DF for IPv4 and IPv6.")
+	case errDFIPv4 == nil && errDFIPv6 != nil:
+		utils.DefaultLogger.Debugf("Setting DF for IPv4.")
+	case errDFIPv4 != nil && errDFIPv6 == nil:
+		utils.DefaultLogger.Debugf("Setting DF for IPv6.")
+	case errDFIPv4 != nil && errDFIPv6 != nil:
+		return false, errors.New("setting DF failed for both IPv4 and IPv6")
+	}
+	return true, nil
+}
+
+func isSendMsgSizeErr(err error) bool {
+	// https://docs.microsoft.com/en-us/windows/win32/winsock/windows-sockets-error-codes-2
+	return errors.Is(err, windows.WSAEMSGSIZE)
+}
+
+func isRecvMsgSizeErr(err error) bool {
+	// https://docs.microsoft.com/en-us/windows/win32/winsock/windows-sockets-error-codes-2
+	return errors.Is(err, windows.WSAEMSGSIZE)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_helper_darwin.go b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_darwin.go
new file mode 100644
index 000000000..a04bfb3ce
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_darwin.go
@@ -0,0 +1,38 @@
+//go:build darwin
+
+package quic
+
+import (
+	"encoding/binary"
+	"net/netip"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+const (
+	msgTypeIPTOS = unix.IP_RECVTOS
+	ipv4PKTINFO  = unix.IP_RECVPKTINFO
+)
+
+const ecnIPv4DataLen = 4
+
+// ReadBatch only returns a single packet on OSX,
+// see https://godoc.org/golang.org/x/net/ipv4#PacketConn.ReadBatch.
+const batchSize = 1
+
+func parseIPv4PktInfo(body []byte) (ip netip.Addr, ifIndex uint32, ok bool) {
+	// struct in_pktinfo {
+	// 	unsigned int   ipi_ifindex;  /* Interface index */
+	// 	struct in_addr ipi_spec_dst; /* Local address */
+	// 	struct in_addr ipi_addr;     /* Header Destination address */
+	// };
+	if len(body) != 12 {
+		return netip.Addr{}, 0, false
+	}
+	return netip.AddrFrom4(*(*[4]byte)(body[8:12])), binary.NativeEndian.Uint32(body), true
+}
+
+func isGSOEnabled(syscall.RawConn) bool { return false }
+
+func isECNEnabled() bool { return !isECNDisabledUsingEnv() }
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_helper_freebsd.go b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_freebsd.go
new file mode 100644
index 000000000..521f80d46
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_freebsd.go
@@ -0,0 +1,33 @@
+//go:build freebsd
+
+package quic
+
+import (
+	"net/netip"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+const (
+	msgTypeIPTOS = unix.IP_RECVTOS
+	ipv4PKTINFO  = 0x7
+)
+
+const ecnIPv4DataLen = 1
+
+const batchSize = 8
+
+func parseIPv4PktInfo(body []byte) (ip netip.Addr, _ uint32, ok bool) {
+	// struct in_pktinfo {
+	// 	struct in_addr ipi_addr;     /* Header Destination address */
+	// };
+	if len(body) != 4 {
+		return netip.Addr{}, 0, false
+	}
+	return netip.AddrFrom4(*(*[4]byte)(body)), 0, true
+}
+
+func isGSOEnabled(syscall.RawConn) bool { return false }
+
+func isECNEnabled() bool { return !isECNDisabledUsingEnv() }
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_helper_linux.go b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_linux.go
new file mode 100644
index 000000000..f5cb762e7
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_linux.go
@@ -0,0 +1,154 @@
+//go:build linux
+
+package quic
+
+import (
+	"encoding/binary"
+	"errors"
+	"net/netip"
+	"os"
+	"strconv"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+const (
+	msgTypeIPTOS = unix.IP_TOS
+	ipv4PKTINFO  = unix.IP_PKTINFO
+)
+
+const ecnIPv4DataLen = 1
+
+const batchSize = 8 // needs to smaller than MaxUint8 (otherwise the type of oobConn.readPos has to be changed)
+
+var kernelVersionMajor int
+
+func init() {
+	kernelVersionMajor, _ = kernelVersion()
+}
+
+func forceSetReceiveBuffer(c syscall.RawConn, bytes int) error {
+	var serr error
+	if err := c.Control(func(fd uintptr) {
+		serr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_RCVBUFFORCE, bytes)
+	}); err != nil {
+		return err
+	}
+	return serr
+}
+
+func forceSetSendBuffer(c syscall.RawConn, bytes int) error {
+	var serr error
+	if err := c.Control(func(fd uintptr) {
+		serr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_SNDBUFFORCE, bytes)
+	}); err != nil {
+		return err
+	}
+	return serr
+}
+
+func parseIPv4PktInfo(body []byte) (ip netip.Addr, ifIndex uint32, ok bool) {
+	// struct in_pktinfo {
+	// 	unsigned int   ipi_ifindex;  /* Interface index */
+	// 	struct in_addr ipi_spec_dst; /* Local address */
+	// 	struct in_addr ipi_addr;     /* Header Destination address */
+	// };
+	if len(body) != 12 {
+		return netip.Addr{}, 0, false
+	}
+	return netip.AddrFrom4(*(*[4]byte)(body[8:12])), binary.NativeEndian.Uint32(body), true
+}
+
+// isGSOEnabled tests if the kernel supports GSO.
+// Sending with GSO might still fail later on, if the interface doesn't support it (see isGSOError).
+func isGSOEnabled(conn syscall.RawConn) bool {
+	if kernelVersionMajor < 5 {
+		return false
+	}
+	disabled, err := strconv.ParseBool(os.Getenv("QUIC_GO_DISABLE_GSO"))
+	if err == nil && disabled {
+		return false
+	}
+	var serr error
+	if err := conn.Control(func(fd uintptr) {
+		_, serr = unix.GetsockoptInt(int(fd), unix.IPPROTO_UDP, unix.UDP_SEGMENT)
+	}); err != nil {
+		return false
+	}
+	return serr == nil
+}
+
+func appendUDPSegmentSizeMsg(b []byte, size uint16) []byte {
+	startLen := len(b)
+	const dataLen = 2 // payload is a uint16
+	b = append(b, make([]byte, unix.CmsgSpace(dataLen))...)
+	h := (*unix.Cmsghdr)(unsafe.Pointer(&b[startLen]))
+	h.Level = syscall.IPPROTO_UDP
+	h.Type = unix.UDP_SEGMENT
+	h.SetLen(unix.CmsgLen(dataLen))
+
+	// UnixRights uses the private `data` method, but I *think* this achieves the same goal.
+	offset := startLen + unix.CmsgSpace(0)
+	*(*uint16)(unsafe.Pointer(&b[offset])) = size
+	return b
+}
+
+func isGSOError(err error) bool {
+	if serr, ok := errors.AsType[*os.SyscallError](err); ok {
+		// EIO is returned by udp_send_skb() if the device driver does not have tx checksums enabled,
+		// which is a hard requirement of UDP_SEGMENT. See:
+		// https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man7/udp.7?id=806eabd74910447f21005160e90957bde4db0183#n228
+		// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv4/udp.c?h=v6.2&id=c9c3395d5e3dcc6daee66c6908354d47bf98cb0c#n942
+		return serr.Err == unix.EIO
+	}
+	return false
+}
+
+// The first sendmsg call on a new UDP socket sometimes errors on Linux.
+// It's not clear why this happens.
+// See https://github.com/golang/go/issues/63322.
+func isPermissionError(err error) bool {
+	if serr, ok := errors.AsType[*os.SyscallError](err); ok {
+		return serr.Syscall == "sendmsg" && serr.Err == unix.EPERM
+	}
+	return false
+}
+
+func isECNEnabled() bool {
+	return kernelVersionMajor >= 5 && !isECNDisabledUsingEnv()
+}
+
+// kernelVersion returns major and minor kernel version numbers, parsed from
+// the syscall.Uname's Release field, or 0, 0 if the version can't be obtained
+// or parsed.
+//
+// copied from the standard library's internal/syscall/unix/kernel_version_linux.go
+func kernelVersion() (major, minor int) {
+	var uname syscall.Utsname
+	if err := syscall.Uname(&uname); err != nil {
+		return
+	}
+
+	var (
+		values    [2]int
+		value, vi int
+	)
+	for _, c := range uname.Release {
+		if '0' <= c && c <= '9' {
+			value = (value * 10) + int(c-'0')
+		} else {
+			// Note that we're assuming N.N.N here.
+			// If we see anything else, we are likely to mis-parse it.
+			values[vi] = value
+			vi++
+			if vi >= len(values) {
+				break
+			}
+			value = 0
+		}
+	}
+
+	return values[0], values[1]
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_helper_linux_test.go b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_linux_test.go
new file mode 100644
index 000000000..547d320bd
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_linux_test.go
@@ -0,0 +1,79 @@
+//go:build linux
+
+package quic
+
+import (
+	"errors"
+	"net"
+	"os"
+	"testing"
+
+	"golang.org/x/sys/unix"
+
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	errGSO          = &os.SyscallError{Err: unix.EIO}
+	errNotPermitted = &os.SyscallError{Syscall: "sendmsg", Err: unix.EPERM}
+)
+
+func TestForcingReceiveBufferSize(t *testing.T) {
+	if os.Getuid() != 0 {
+		t.Skip("Must be root to force change the receive buffer size")
+	}
+
+	c, err := net.ListenPacket("udp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer c.Close()
+	syscallConn, err := c.(*net.UDPConn).SyscallConn()
+	require.NoError(t, err)
+
+	const small = 256 << 10 // 256 KB
+	require.NoError(t, forceSetReceiveBuffer(syscallConn, small))
+
+	size, err := inspectReadBuffer(syscallConn)
+	require.NoError(t, err)
+	// the kernel doubles this value (to allow space for bookkeeping overhead)
+	require.Equal(t, 2*small, size)
+
+	const large = 32 << 20 // 32 MB
+	require.NoError(t, forceSetReceiveBuffer(syscallConn, large))
+	size, err = inspectReadBuffer(syscallConn)
+	require.NoError(t, err)
+	// the kernel doubles this value (to allow space for bookkeeping overhead)
+	require.Equal(t, 2*large, size)
+}
+
+func TestForcingSendBufferSize(t *testing.T) {
+	if os.Getuid() != 0 {
+		t.Skip("Must be root to force change the send buffer size")
+	}
+
+	c, err := net.ListenPacket("udp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer c.Close()
+	syscallConn, err := c.(*net.UDPConn).SyscallConn()
+	require.NoError(t, err)
+
+	const small = 256 << 10 // 256 KB
+	require.NoError(t, forceSetSendBuffer(syscallConn, small))
+
+	size, err := inspectWriteBuffer(syscallConn)
+	require.NoError(t, err)
+	// the kernel doubles this value (to allow space for bookkeeping overhead)
+	require.Equal(t, 2*small, size)
+
+	const large = 32 << 20 // 32 MB
+	require.NoError(t, forceSetSendBuffer(syscallConn, large))
+	size, err = inspectWriteBuffer(syscallConn)
+	require.NoError(t, err)
+	// the kernel doubles this value (to allow space for bookkeeping overhead)
+	require.Equal(t, 2*large, size)
+}
+
+func TestGSOError(t *testing.T) {
+	require.True(t, isGSOError(errGSO))
+	require.False(t, isGSOError(nil))
+	require.False(t, isGSOError(errors.New("test")))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_helper_nonlinux.go b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_nonlinux.go
new file mode 100644
index 000000000..f8d69803b
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_nonlinux.go
@@ -0,0 +1,10 @@
+//go:build !linux
+
+package quic
+
+func forceSetReceiveBuffer(c any, bytes int) error { return nil }
+func forceSetSendBuffer(c any, bytes int) error    { return nil }
+
+func appendUDPSegmentSizeMsg([]byte, uint16) []byte { return nil }
+func isGSOError(error) bool                         { return false }
+func isPermissionError(err error) bool              { return false }
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_helper_nonlinux_test.go b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_nonlinux_test.go
new file mode 100644
index 000000000..096712418
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_helper_nonlinux_test.go
@@ -0,0 +1,10 @@
+//go:build !linux
+
+package quic
+
+import "errors"
+
+var (
+	errGSO          = errors.New("fake GSO error")
+	errNotPermitted = errors.New("fake not permitted error")
+)
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_no_oob.go b/electron/native/private-transport/third_party/quic-go/sys_conn_no_oob.go
new file mode 100644
index 000000000..813309d58
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_no_oob.go
@@ -0,0 +1,18 @@
+//go:build !darwin && !linux && !freebsd && !windows
+
+package quic
+
+import (
+	"net"
+	"net/netip"
+)
+
+func newConn(c net.PacketConn, supportsDF bool) (*basicConn, error) {
+	return &basicConn{PacketConn: c, supportsDF: supportsDF}, nil
+}
+
+type packetInfo struct {
+	addr netip.Addr
+}
+
+func (i *packetInfo) OOB() []byte { return nil }
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_oob.go b/electron/native/private-transport/third_party/quic-go/sys_conn_oob.go
new file mode 100644
index 000000000..7e160bd45
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_oob.go
@@ -0,0 +1,319 @@
+//go:build darwin || linux || freebsd
+
+package quic
+
+import (
+	"encoding/binary"
+	"errors"
+	"log"
+	"net"
+	"net/netip"
+	"os"
+	"strconv"
+	"sync"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
+	"golang.org/x/sys/unix"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+)
+
+const (
+	ecnMask       = 0x3
+	oobBufferSize = 128
+)
+
+// Contrary to what the naming suggests, the ipv{4,6}.Message is not dependent on the IP version.
+// They're both just aliases for x/net/internal/socket.Message.
+// This means we can use this struct to read from a socket that receives both IPv4 and IPv6 messages.
+var _ ipv4.Message = ipv6.Message{}
+
+type batchConn interface {
+	ReadBatch(ms []ipv4.Message, flags int) (int, error)
+}
+
+func isECNDisabledUsingEnv() bool {
+	disabled, err := strconv.ParseBool(os.Getenv("QUIC_GO_DISABLE_ECN"))
+	return err == nil && disabled
+}
+
+type oobConn struct {
+	OOBCapablePacketConn
+	batchConn batchConn
+
+	readPos uint8
+	// Packets received from the kernel, but not yet returned by ReadPacket().
+	messages []ipv4.Message
+	buffers  [batchSize]*packetBuffer
+
+	cap connCapabilities
+}
+
+var _ rawConn = &oobConn{}
+
+func newConn(c OOBCapablePacketConn, supportsDF bool) (*oobConn, error) {
+	rawConn, err := c.SyscallConn()
+	if err != nil {
+		return nil, err
+	}
+	var needsPacketInfo bool
+	if udpAddr, ok := c.LocalAddr().(*net.UDPAddr); ok && udpAddr.IP.IsUnspecified() {
+		needsPacketInfo = true
+	}
+	// We don't know if this a IPv4-only, IPv6-only or a IPv4-and-IPv6 connection.
+	// Try enabling receiving of ECN and packet info for both IP versions.
+	// We expect at least one of those syscalls to succeed.
+	var errECNIPv4, errECNIPv6, errPIIPv4, errPIIPv6 error
+	if err := rawConn.Control(func(fd uintptr) {
+		errECNIPv4 = unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_RECVTOS, 1)
+		errECNIPv6 = unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_RECVTCLASS, 1)
+
+		if needsPacketInfo {
+			errPIIPv4 = unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, ipv4PKTINFO, 1)
+			errPIIPv6 = unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_RECVPKTINFO, 1)
+		}
+	}); err != nil {
+		return nil, err
+	}
+	switch {
+	case errECNIPv4 == nil && errECNIPv6 == nil:
+		utils.DefaultLogger.Debugf("Activating reading of ECN bits for IPv4 and IPv6.")
+	case errECNIPv4 == nil && errECNIPv6 != nil:
+		utils.DefaultLogger.Debugf("Activating reading of ECN bits for IPv4.")
+	case errECNIPv4 != nil && errECNIPv6 == nil:
+		utils.DefaultLogger.Debugf("Activating reading of ECN bits for IPv6.")
+	case errECNIPv4 != nil && errECNIPv6 != nil:
+		return nil, errors.New("activating ECN failed for both IPv4 and IPv6")
+	}
+	if needsPacketInfo {
+		switch {
+		case errPIIPv4 == nil && errPIIPv6 == nil:
+			utils.DefaultLogger.Debugf("Activating reading of packet info for IPv4 and IPv6.")
+		case errPIIPv4 == nil && errPIIPv6 != nil:
+			utils.DefaultLogger.Debugf("Activating reading of packet info bits for IPv4.")
+		case errPIIPv4 != nil && errPIIPv6 == nil:
+			utils.DefaultLogger.Debugf("Activating reading of packet info bits for IPv6.")
+		case errPIIPv4 != nil && errPIIPv6 != nil:
+			return nil, errors.New("activating packet info failed for both IPv4 and IPv6")
+		}
+	}
+
+	// Allows callers to pass in a connection that already satisfies batchConn interface
+	// to make use of the optimisation. Otherwise, ipv4.NewPacketConn would unwrap the file descriptor
+	// via SyscallConn(), and read it that way, which might not be what the caller wants.
+	var bc batchConn
+	if ibc, ok := c.(batchConn); ok {
+		bc = ibc
+	} else {
+		if _, ok := c.(net.Conn); !ok {
+			return nil, errors.New("quic: OOBCapablePacketConn must implement net.Conn or ReadBatch")
+		}
+		bc = ipv4.NewPacketConn(c)
+	}
+
+	msgs := make([]ipv4.Message, batchSize)
+	for i := range msgs {
+		// preallocate the [][]byte
+		msgs[i].Buffers = make([][]byte, 1)
+	}
+	oobConn := &oobConn{
+		OOBCapablePacketConn: c,
+		batchConn:            bc,
+		messages:             msgs,
+		readPos:              batchSize,
+		cap: connCapabilities{
+			DF:  supportsDF,
+			GSO: isGSOEnabled(rawConn),
+			ECN: isECNEnabled(),
+		},
+	}
+	for i := range batchSize {
+		oobConn.messages[i].OOB = make([]byte, oobBufferSize)
+	}
+	return oobConn, nil
+}
+
+var invalidCmsgOnceV4, invalidCmsgOnceV6 sync.Once
+
+func (c *oobConn) ReadPacket() (receivedPacket, error) {
+	if len(c.messages) == int(c.readPos) { // all messages read. Read the next batch of messages.
+		c.messages = c.messages[:batchSize]
+		// replace buffers data buffers up to the packet that has been consumed during the last ReadBatch call
+		for i := uint8(0); i < c.readPos; i++ {
+			buffer := getPacketBuffer()
+			buffer.Data = buffer.Data[:protocol.MaxPacketBufferSize]
+			c.buffers[i] = buffer
+			c.messages[i].Buffers[0] = c.buffers[i].Data
+		}
+		c.readPos = 0
+
+		n, err := c.batchConn.ReadBatch(c.messages, 0)
+		if n == 0 || err != nil {
+			return receivedPacket{}, err
+		}
+		c.messages = c.messages[:n]
+	}
+
+	msg := c.messages[c.readPos]
+	buffer := c.buffers[c.readPos]
+	c.readPos++
+
+	data := msg.OOB[:msg.NN]
+	p := receivedPacket{
+		remoteAddr: msg.Addr,
+		rcvTime:    monotime.Now(),
+		data:       msg.Buffers[0][:msg.N],
+		buffer:     buffer,
+	}
+	for len(data) > 0 {
+		hdr, body, remainder, err := unix.ParseOneSocketControlMessage(data)
+		if err != nil {
+			return receivedPacket{}, err
+		}
+		if hdr.Level == unix.IPPROTO_IP {
+			switch hdr.Type {
+			case msgTypeIPTOS:
+				if len(body) != 1 {
+					return receivedPacket{}, errors.New("invalid IPTOS size")
+				}
+				p.ecn = protocol.ParseECNHeaderBits(body[0] & ecnMask)
+			case ipv4PKTINFO:
+				ip, ifIndex, ok := parseIPv4PktInfo(body)
+				if ok {
+					p.info.addr = ip
+					p.info.ifIndex = ifIndex
+				} else {
+					invalidCmsgOnceV4.Do(func() {
+						log.Printf("Received invalid IPv4 packet info control message: %+x. "+
+							"This should never occur, please open a new issue and include details about the architecture.", body)
+					})
+				}
+			}
+		}
+		if hdr.Level == unix.IPPROTO_IPV6 {
+			switch hdr.Type {
+			case unix.IPV6_TCLASS:
+				if len(body) != 4 {
+					return receivedPacket{}, errors.New("invalid IPV6_TCLASS size")
+				}
+				bits := uint8(binary.NativeEndian.Uint32(body)) & ecnMask
+				p.ecn = protocol.ParseECNHeaderBits(bits)
+			case unix.IPV6_PKTINFO:
+				// struct in6_pktinfo {
+				// 	struct in6_addr ipi6_addr;    /* src/dst IPv6 address */
+				// 	unsigned int    ipi6_ifindex; /* send/recv interface index */
+				// };
+				if len(body) == 20 {
+					p.info.addr = netip.AddrFrom16(*(*[16]byte)(body[:16])).Unmap()
+					p.info.ifIndex = binary.NativeEndian.Uint32(body[16:])
+				} else {
+					invalidCmsgOnceV6.Do(func() {
+						log.Printf("Received invalid IPv6 packet info control message: %+x. "+
+							"This should never occur, please open a new issue and include details about the architecture.", body)
+					})
+				}
+			}
+		}
+		data = remainder
+	}
+	return p, nil
+}
+
+// WritePacket writes a new packet.
+func (c *oobConn) WritePacket(b []byte, addr net.Addr, packetInfoOOB []byte, gsoSize uint16, ecn protocol.ECN) (int, error) {
+	oob := packetInfoOOB
+	if gsoSize > 0 {
+		if !c.capabilities().GSO {
+			panic("GSO disabled")
+		}
+		oob = appendUDPSegmentSizeMsg(oob, gsoSize)
+	}
+	if ecn != protocol.ECNUnsupported {
+		if !c.capabilities().ECN {
+			panic("tried to send an ECN-marked packet although ECN is disabled")
+		}
+		if remoteUDPAddr, ok := addr.(*net.UDPAddr); ok {
+			if remoteUDPAddr.IP.To4() != nil {
+				oob = appendIPv4ECNMsg(oob, ecn)
+			} else {
+				oob = appendIPv6ECNMsg(oob, ecn)
+			}
+		}
+	}
+	n, _, err := c.WriteMsgUDP(b, oob, addr.(*net.UDPAddr))
+	return n, err
+}
+
+func (c *oobConn) capabilities() connCapabilities {
+	return c.cap
+}
+
+type packetInfo struct {
+	addr    netip.Addr
+	ifIndex uint32
+}
+
+func (info *packetInfo) OOB() []byte {
+	if info == nil {
+		return nil
+	}
+	if info.addr.Is4() {
+		ip := info.addr.As4()
+		// struct in_pktinfo {
+		// 	unsigned int   ipi_ifindex;  /* Interface index */
+		// 	struct in_addr ipi_spec_dst; /* Local address */
+		// 	struct in_addr ipi_addr;     /* Header Destination address */
+		// };
+		cm := ipv4.ControlMessage{
+			Src:     ip[:],
+			IfIndex: int(info.ifIndex),
+		}
+		return cm.Marshal()
+	} else if info.addr.Is6() {
+		ip := info.addr.As16()
+		// struct in6_pktinfo {
+		// 	struct in6_addr ipi6_addr;    /* src/dst IPv6 address */
+		// 	unsigned int    ipi6_ifindex; /* send/recv interface index */
+		// };
+		cm := ipv6.ControlMessage{
+			Src:     ip[:],
+			IfIndex: int(info.ifIndex),
+		}
+		return cm.Marshal()
+	}
+	return nil
+}
+
+func appendIPv4ECNMsg(b []byte, val protocol.ECN) []byte {
+	startLen := len(b)
+	b = append(b, make([]byte, unix.CmsgSpace(ecnIPv4DataLen))...)
+	h := (*unix.Cmsghdr)(unsafe.Pointer(&b[startLen]))
+	h.Level = syscall.IPPROTO_IP
+	h.Type = unix.IP_TOS
+	h.SetLen(unix.CmsgLen(ecnIPv4DataLen))
+
+	// UnixRights uses the private `data` method, but I *think* this achieves the same goal.
+	offset := startLen + unix.CmsgSpace(0)
+	b[offset] = val.ToHeaderBits()
+	return b
+}
+
+func appendIPv6ECNMsg(b []byte, val protocol.ECN) []byte {
+	startLen := len(b)
+	const dataLen = 4
+	b = append(b, make([]byte, unix.CmsgSpace(dataLen))...)
+	h := (*unix.Cmsghdr)(unsafe.Pointer(&b[startLen]))
+	h.Level = syscall.IPPROTO_IPV6
+	h.Type = unix.IPV6_TCLASS
+	h.SetLen(unix.CmsgLen(dataLen))
+
+	// UnixRights uses the private `data` method, but I *think* this achieves the same goal.
+	offset := startLen + unix.CmsgSpace(0)
+	binary.NativeEndian.PutUint32(b[offset:offset+dataLen], uint32(val.ToHeaderBits()))
+	return b
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_oob_test.go b/electron/native/private-transport/third_party/quic-go/sys_conn_oob_test.go
new file mode 100644
index 000000000..2f9d4ff06
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_oob_test.go
@@ -0,0 +1,342 @@
+//go:build darwin || linux || freebsd
+
+package quic
+
+import (
+	"fmt"
+	"net"
+	"testing"
+	"time"
+
+	"golang.org/x/net/ipv4"
+	"golang.org/x/sys/unix"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+)
+
+func isIPv4(ip net.IP) bool { return ip.To4() != nil }
+
+func runSysConnServer(t *testing.T, network string, addr *net.UDPAddr) (*net.UDPAddr, <-chan receivedPacket) {
+	t.Helper()
+	udpConn, err := net.ListenUDP(network, addr)
+	require.NoError(t, err)
+	t.Cleanup(func() { udpConn.Close() })
+
+	oobConn, err := newConn(udpConn, true)
+	require.NoError(t, err)
+	require.True(t, oobConn.capabilities().DF)
+
+	packetChan := make(chan receivedPacket, 1)
+	go func() {
+		for {
+			p, err := oobConn.ReadPacket()
+			if err != nil {
+				return
+			}
+			packetChan <- p
+		}
+	}()
+	return udpConn.LocalAddr().(*net.UDPAddr), packetChan
+}
+
+// sendUDPPacketWithECN opens a new UDP socket and sends one packet with the ECN set.
+// It returns the local address of the socket.
+func sendUDPPacketWithECN(t *testing.T, network string, addr *net.UDPAddr, setECN func(uintptr)) net.Addr {
+	conn, err := net.DialUDP(network, nil, addr)
+	require.NoError(t, err)
+	t.Cleanup(func() { conn.Close() })
+
+	rawConn, err := conn.SyscallConn()
+	require.NoError(t, err)
+	require.NoError(t, rawConn.Control(func(fd uintptr) { setECN(fd) }))
+	_, err = conn.Write([]byte("foobar"))
+	require.NoError(t, err)
+	return conn.LocalAddr()
+}
+
+func TestReadECNFlagsIPv4(t *testing.T) {
+	addr, packetChan := runSysConnServer(t, "udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+
+	sentFrom := sendUDPPacketWithECN(t,
+		"udp4",
+		addr,
+		func(fd uintptr) {
+			require.NoError(t, unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_TOS, 2))
+		},
+	)
+
+	select {
+	case p := <-packetChan:
+		require.WithinDuration(t, time.Now(), p.rcvTime.ToTime(), scaleDuration(20*time.Millisecond))
+		require.Equal(t, []byte("foobar"), p.data)
+		require.Equal(t, sentFrom, p.remoteAddr)
+		require.Equal(t, protocol.ECT0, p.ecn)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for packet")
+	}
+}
+
+func TestReadECNFlagsIPv6(t *testing.T) {
+	addr, packetChan := runSysConnServer(t, "udp6", &net.UDPAddr{IP: net.IPv6loopback, Port: 0})
+
+	sentFrom := sendUDPPacketWithECN(t,
+		"udp6",
+		addr,
+		func(fd uintptr) {
+			require.NoError(t, unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_TCLASS, 3))
+		},
+	)
+
+	select {
+	case p := <-packetChan:
+		require.WithinDuration(t, time.Now(), p.rcvTime.ToTime(), scaleDuration(20*time.Millisecond))
+		require.Equal(t, []byte("foobar"), p.data)
+		require.Equal(t, sentFrom, p.remoteAddr)
+		require.Equal(t, protocol.ECNCE, p.ecn)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for packet")
+	}
+}
+
+func TestReadECNFlagsDualStack(t *testing.T) {
+	addr, packetChan := runSysConnServer(t, "udp", &net.UDPAddr{IP: net.IPv4(0, 0, 0, 0), Port: 0})
+
+	// IPv4
+	sentFrom := sendUDPPacketWithECN(t,
+		"udp4",
+		&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: addr.Port},
+		func(fd uintptr) {
+			require.NoError(t, unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_TOS, 3))
+		},
+	)
+
+	select {
+	case p := <-packetChan:
+		require.True(t, isIPv4(p.remoteAddr.(*net.UDPAddr).IP))
+		require.Equal(t, sentFrom.String(), p.remoteAddr.String())
+		require.Equal(t, protocol.ECNCE, p.ecn)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for packet")
+	}
+
+	// IPv6
+	sentFrom = sendUDPPacketWithECN(t,
+		"udp6",
+		&net.UDPAddr{IP: net.IPv6loopback, Port: addr.Port},
+		func(fd uintptr) {
+			require.NoError(t, unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_TCLASS, 1))
+		},
+	)
+
+	select {
+	case p := <-packetChan:
+		require.Equal(t, sentFrom, p.remoteAddr)
+		require.False(t, isIPv4(p.remoteAddr.(*net.UDPAddr).IP))
+		require.Equal(t, protocol.ECT1, p.ecn)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for packet")
+	}
+}
+
+func TestSendPacketsWithECNOnIPv4(t *testing.T) {
+	addr, packetChan := runSysConnServer(t, "udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+
+	c, err := net.ListenUDP("udp4", nil)
+	require.NoError(t, err)
+	defer c.Close()
+
+	for _, val := range []protocol.ECN{protocol.ECNNon, protocol.ECT1, protocol.ECT0, protocol.ECNCE} {
+		_, _, err = c.WriteMsgUDP([]byte("foobar"), appendIPv4ECNMsg([]byte{}, val), addr)
+		require.NoError(t, err)
+		select {
+		case p := <-packetChan:
+			require.Equal(t, []byte("foobar"), p.data)
+			require.Equal(t, val, p.ecn)
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for packet")
+		}
+	}
+}
+
+func TestSendPacketsWithECNOnIPv6(t *testing.T) {
+	addr, packetChan := runSysConnServer(t, "udp6", &net.UDPAddr{IP: net.IPv6loopback, Port: 0})
+
+	c, err := net.ListenUDP("udp6", nil)
+	require.NoError(t, err)
+	defer c.Close()
+
+	for _, val := range []protocol.ECN{protocol.ECNNon, protocol.ECT1, protocol.ECT0, protocol.ECNCE} {
+		_, _, err = c.WriteMsgUDP([]byte("foobar"), appendIPv6ECNMsg([]byte{}, val), addr)
+		require.NoError(t, err)
+		select {
+		case p := <-packetChan:
+			require.Equal(t, []byte("foobar"), p.data)
+			require.Equal(t, val, p.ecn)
+		case <-time.After(time.Second):
+			t.Fatal("timeout waiting for packet")
+		}
+	}
+}
+
+func TestSysConnPacketInfoIPv4(t *testing.T) {
+	// need to listen on 0.0.0.0, otherwise we won't get the packet info
+	addr, packetChan := runSysConnServer(t, "udp4", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
+
+	conn, err := net.DialUDP("udp4", nil, addr)
+	require.NoError(t, err)
+	defer conn.Close()
+	_, err = conn.Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	select {
+	case p := <-packetChan:
+		require.WithinDuration(t, time.Now(), p.rcvTime.ToTime(), scaleDuration(50*time.Millisecond))
+		require.Equal(t, []byte("foobar"), p.data)
+		require.Equal(t, conn.LocalAddr(), p.remoteAddr)
+		require.True(t, p.info.addr.IsValid())
+		require.True(t, isIPv4(p.info.addr.AsSlice()))
+		require.Equal(t, net.IPv4(127, 0, 0, 1).String(), p.info.addr.String())
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for packet")
+	}
+}
+
+func TestSysConnPacketInfoIPv6(t *testing.T) {
+	// need to listen on ::, otherwise we won't get the packet info
+	addr, packetChan := runSysConnServer(t, "udp6", &net.UDPAddr{IP: net.IPv6zero, Port: 0})
+
+	conn, err := net.DialUDP("udp6", nil, addr)
+	require.NoError(t, err)
+	defer conn.Close()
+	_, err = conn.Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	select {
+	case p := <-packetChan:
+		require.WithinDuration(t, time.Now(), p.rcvTime.ToTime(), scaleDuration(20*time.Millisecond))
+		require.Equal(t, []byte("foobar"), p.data)
+		require.Equal(t, conn.LocalAddr(), p.remoteAddr)
+		require.NotNil(t, p.info)
+		require.Equal(t, net.IPv6loopback, net.IP(p.info.addr.AsSlice()))
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for packet")
+	}
+}
+
+func TestSysConnPacketInfoDualStack(t *testing.T) {
+	addr, packetChan := runSysConnServer(t, "udp", &net.UDPAddr{})
+
+	// IPv4
+	conn4, err := net.DialUDP("udp4", nil, &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: addr.Port})
+	require.NoError(t, err)
+	defer conn4.Close()
+	_, err = conn4.Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	select {
+	case p := <-packetChan:
+		require.True(t, isIPv4(p.remoteAddr.(*net.UDPAddr).IP))
+		require.NotNil(t, p.info)
+		require.True(t, p.info.addr.Is4())
+		require.Equal(t, net.IPv4(127, 0, 0, 1).String(), p.info.addr.String())
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for IPv4 packet")
+	}
+
+	// IPv6
+	conn6, err := net.DialUDP("udp6", nil, addr)
+	require.NoError(t, err)
+	defer conn6.Close()
+	_, err = conn6.Write([]byte("foobar"))
+	require.NoError(t, err)
+
+	select {
+	case p := <-packetChan:
+		require.False(t, isIPv4(p.remoteAddr.(*net.UDPAddr).IP))
+		require.NotNil(t, p.info)
+		require.Equal(t, net.IPv6loopback.String(), p.info.addr.String())
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for IPv6 packet")
+	}
+}
+
+type oobRecordingConn struct {
+	*net.UDPConn
+	oobs [][]byte
+}
+
+func (c *oobRecordingConn) WriteMsgUDP(b, oob []byte, addr *net.UDPAddr) (n, oobn int, err error) {
+	c.oobs = append(c.oobs, oob)
+	return c.UDPConn.WriteMsgUDP(b, oob, addr)
+}
+
+type mockBatchConn struct {
+	t          *testing.T
+	numMsgRead int
+
+	callCounter int
+}
+
+var _ batchConn = &mockBatchConn{}
+
+func (c *mockBatchConn) ReadBatch(ms []ipv4.Message, _ int) (int, error) {
+	require.Len(c.t, ms, batchSize)
+	for i := 0; i < c.numMsgRead; i++ {
+		require.Len(c.t, ms[i].Buffers, 1)
+		require.Len(c.t, ms[i].Buffers[0], protocol.MaxPacketBufferSize)
+		data := fmt.Appendf(nil, "message %d", c.callCounter*c.numMsgRead+i)
+		ms[i].Buffers[0] = data
+		ms[i].N = len(data)
+	}
+	c.callCounter++
+	return c.numMsgRead, nil
+}
+
+func TestReadsMultipleMessagesInOneBatch(t *testing.T) {
+	bc := &mockBatchConn{t: t, numMsgRead: batchSize/2 + 1}
+
+	udpConn := newUDPConnLocalhost(t)
+	oobConn, err := newConn(udpConn, true)
+	require.NoError(t, err)
+	oobConn.batchConn = bc
+
+	for i := range batchSize + 1 {
+		p, err := oobConn.ReadPacket()
+		require.NoError(t, err)
+		require.Equal(t, fmt.Sprintf("message %d", i), string(p.data))
+	}
+	require.Equal(t, 2, bc.callCounter)
+}
+
+func TestNewConnWithoutNetConn(t *testing.T) {
+	udpConn := newUDPConnLocalhost(t)
+	conn := struct{ OOBCapablePacketConn }{udpConn}
+
+	_, err := newConn(conn, true)
+	require.EqualError(t, err, "quic: OOBCapablePacketConn must implement net.Conn or ReadBatch")
+}
+
+func TestSysConnSendGSO(t *testing.T) {
+	if !platformSupportsGSO {
+		t.Skip("GSO not supported on this platform")
+	}
+
+	udpConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+	require.NoError(t, err)
+	c := &oobRecordingConn{UDPConn: udpConn}
+	oobConn, err := newConn(c, true)
+	require.NoError(t, err)
+	require.True(t, oobConn.capabilities().GSO)
+
+	oob := make([]byte, 0, 123)
+	oobConn.WritePacket([]byte("foobar"), udpConn.LocalAddr(), oob, 3, protocol.ECNCE)
+	require.Len(t, c.oobs, 1)
+	oobMsg := c.oobs[0]
+	require.NotEmpty(t, oobMsg)
+	require.Equal(t, cap(oob), cap(oobMsg)) // check that it appended to oob
+	expected := appendUDPSegmentSizeMsg([]byte{}, 3)
+	// Check that the first control message is the OOB control message.
+	require.Equal(t, expected, oobMsg[:len(expected)])
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_test.go b/electron/native/private-transport/third_party/quic-go/sys_conn_test.go
new file mode 100644
index 000000000..a75d34f99
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_test.go
@@ -0,0 +1,32 @@
+package quic
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func TestBasicConn(t *testing.T) {
+	mockCtrl := gomock.NewController(t)
+
+	c := NewMockPacketConn(mockCtrl)
+	addr := &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1234}
+	c.EXPECT().ReadFrom(gomock.Any()).DoAndReturn(func(b []byte) (int, net.Addr, error) {
+		data := []byte("foobar")
+		require.Equal(t, protocol.MaxPacketBufferSize, len(b))
+		return copy(b, data), addr, nil
+	})
+
+	conn, err := wrapConn(c)
+	require.NoError(t, err)
+	p, err := conn.ReadPacket()
+	require.NoError(t, err)
+	require.Equal(t, []byte("foobar"), p.data)
+	require.WithinDuration(t, time.Now(), p.rcvTime.ToTime(), scaleDuration(100*time.Millisecond))
+	require.Equal(t, addr, p.remoteAddr)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_windows.go b/electron/native/private-transport/third_party/quic-go/sys_conn_windows.go
new file mode 100644
index 000000000..b9c1cbc86
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_windows.go
@@ -0,0 +1,42 @@
+//go:build windows
+
+package quic
+
+import (
+	"net/netip"
+	"syscall"
+
+	"golang.org/x/sys/windows"
+)
+
+func newConn(c OOBCapablePacketConn, supportsDF bool) (*basicConn, error) {
+	return &basicConn{PacketConn: c, supportsDF: supportsDF}, nil
+}
+
+func inspectReadBuffer(c syscall.RawConn) (int, error) {
+	var size int
+	var serr error
+	if err := c.Control(func(fd uintptr) {
+		size, serr = windows.GetsockoptInt(windows.Handle(fd), windows.SOL_SOCKET, windows.SO_RCVBUF)
+	}); err != nil {
+		return 0, err
+	}
+	return size, serr
+}
+
+func inspectWriteBuffer(c syscall.RawConn) (int, error) {
+	var size int
+	var serr error
+	if err := c.Control(func(fd uintptr) {
+		size, serr = windows.GetsockoptInt(windows.Handle(fd), windows.SOL_SOCKET, windows.SO_SNDBUF)
+	}); err != nil {
+		return 0, err
+	}
+	return size, serr
+}
+
+type packetInfo struct {
+	addr netip.Addr
+}
+
+func (i *packetInfo) OOB() []byte { return nil }
diff --git a/electron/native/private-transport/third_party/quic-go/sys_conn_windows_test.go b/electron/native/private-transport/third_party/quic-go/sys_conn_windows_test.go
new file mode 100644
index 000000000..9376627f3
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/sys_conn_windows_test.go
@@ -0,0 +1,30 @@
+//go:build windows
+
+package quic
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWindowsConn(t *testing.T) {
+	t.Run("IPv4", func(t *testing.T) {
+		udpConn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
+		require.NoError(t, err)
+		conn, err := newConn(udpConn, true)
+		require.NoError(t, err)
+		require.NoError(t, conn.Close())
+		require.True(t, conn.capabilities().DF)
+	})
+
+	t.Run("IPv6", func(t *testing.T) {
+		udpConn, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6loopback, Port: 0})
+		require.NoError(t, err)
+		conn, err := newConn(udpConn, false)
+		require.NoError(t, err)
+		require.NoError(t, conn.Close())
+		require.False(t, conn.capabilities().DF)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/events/event_recorder.go b/electron/native/private-transport/third_party/quic-go/testutils/events/event_recorder.go
new file mode 100644
index 000000000..01f047607
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/events/event_recorder.go
@@ -0,0 +1,94 @@
+package events
+
+import (
+	"reflect"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+// Event is a recorded event with the event time.
+type Event struct {
+	Time  time.Time
+	Event qlogwriter.Event
+}
+
+// Trace is a qlog.Trace that returns a qlog recorder.
+type Trace struct {
+	Recorder qlogwriter.Recorder
+}
+
+var _ qlogwriter.Trace = &Trace{}
+
+func (t *Trace) AddProducer() qlogwriter.Recorder {
+	return t.Recorder
+}
+
+func (t *Trace) SupportsSchemas(string) bool {
+	return true
+}
+
+// Recorder is a qlog.Recorder that records events.
+// Events can be retrieved using the Events method.
+type Recorder struct {
+	mx     sync.Mutex
+	events []Event
+}
+
+var _ qlogwriter.Recorder = &Recorder{}
+
+// Events returns all recorded events.
+// If filter is provided, only events of the given type(s) are returned.
+func (r *Recorder) RecordEvent(ev qlogwriter.Event) {
+	r.mx.Lock()
+	r.events = append(r.events, Event{Time: time.Now(), Event: ev})
+	r.mx.Unlock()
+}
+
+// Events returns all recorded events, including the event time.
+// If filter is provided, only events of the given type(s) are returned.
+func (r *Recorder) Events(filter ...qlogwriter.Event) []qlogwriter.Event {
+	eventsWithTime := r.EventsWithTime(filter...)
+	events := make([]qlogwriter.Event, 0, len(eventsWithTime))
+	for _, ev := range eventsWithTime {
+		events = append(events, ev.Event)
+	}
+	return events
+}
+
+func (r *Recorder) EventsWithTime(filter ...qlogwriter.Event) []Event {
+	r.mx.Lock()
+	events := r.events
+	r.mx.Unlock()
+
+	if len(filter) == 0 {
+		return events
+	}
+
+	// Some events have the same name when serialized, but use different structs.
+	// We therefore need to filter by type, and can't use the event name.
+	filterTypes := make([]reflect.Type, 0, len(filter))
+	for _, f := range filter {
+		filterTypes = append(filterTypes, reflect.TypeOf(f))
+	}
+
+	var filtered []Event
+	for _, ev := range events {
+		eventType := reflect.TypeOf(ev.Event)
+		if slices.Contains(filterTypes, eventType) {
+			filtered = append(filtered, ev)
+		}
+	}
+	return filtered
+}
+
+// Clear clears the recorded events.
+func (r *Recorder) Clear() {
+	r.mx.Lock()
+	r.events = nil
+	r.mx.Unlock()
+}
+
+func (r *Recorder) Close() error { return nil }
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/events/event_recorder_test.go b/electron/native/private-transport/third_party/quic-go/testutils/events/event_recorder_test.go
new file mode 100644
index 000000000..6f2173443
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/events/event_recorder_test.go
@@ -0,0 +1,101 @@
+package events
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRecorder(t *testing.T) {
+	recorder := &Recorder{}
+	defer recorder.Close()
+
+	recorder.RecordEvent(qlog.MTUUpdated{Value: 1000})
+	recorder.RecordEvent(qlog.ALPNInformation{ChosenALPN: "foobar"})
+	recorder.RecordEvent(qlog.ECNStateUpdated{State: qlog.ECNStateCapable})
+	recorder.RecordEvent(qlog.MTUUpdated{Value: 1200})
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.MTUUpdated{Value: 1000},
+			qlog.ALPNInformation{ChosenALPN: "foobar"},
+			qlog.ECNStateUpdated{State: qlog.ECNStateCapable},
+			qlog.MTUUpdated{Value: 1200},
+		},
+		recorder.Events(),
+	)
+
+	require.Empty(t, recorder.Events(qlog.PacketBuffered{}))
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.MTUUpdated{Value: 1000},
+			qlog.MTUUpdated{Value: 1200},
+		},
+		recorder.Events(qlog.MTUUpdated{}),
+	)
+
+	recorder.Clear()
+	require.Empty(t, recorder.Events())
+	require.Empty(t, recorder.Events(qlog.MTUUpdated{}))
+}
+
+func TestRecorderFilterEventsSameName(t *testing.T) {
+	// some events have the same name when serialized, but use different structs
+	require.Equal(t,
+		qlog.PacketReceived{}.Name(),
+		qlog.VersionNegotiationReceived{}.Name(),
+	)
+
+	recorder := &Recorder{}
+	defer recorder.Close()
+
+	recorder.RecordEvent(qlog.PacketReceived{
+		Header: qlog.PacketHeader{PacketType: qlog.PacketTypeHandshake},
+	})
+	recorder.RecordEvent(qlog.VersionNegotiationReceived{
+		Header:            qlog.PacketHeaderVersionNegotiation{},
+		SupportedVersions: []qlog.Version{0xdeadbeef, 0xdecafbad},
+	})
+
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.PacketReceived{
+				Header: qlog.PacketHeader{PacketType: qlog.PacketTypeHandshake},
+			},
+		},
+		recorder.Events(qlog.PacketReceived{}),
+	)
+	require.Equal(t,
+		[]qlogwriter.Event{
+			qlog.VersionNegotiationReceived{
+				Header:            qlog.PacketHeaderVersionNegotiation{},
+				SupportedVersions: []qlog.Version{0xdeadbeef, 0xdecafbad},
+			},
+		},
+		recorder.Events(qlog.VersionNegotiationReceived{}),
+	)
+}
+
+func TestRecorderEventsWithTime(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		recorder := &Recorder{}
+		start := time.Now()
+		recorder.RecordEvent(qlog.MTUUpdated{Value: 1000})
+		time.Sleep(time.Minute)
+		recorder.RecordEvent(qlog.ECNStateUpdated{State: qlog.ECNStateCapable})
+		time.Sleep(time.Minute)
+		recorder.RecordEvent(qlog.MTUUpdated{Value: 1200})
+
+		require.Equal(t,
+			[]Event{
+				{Time: start, Event: qlog.MTUUpdated{Value: 1000}},
+				{Time: start.Add(2 * time.Minute), Event: qlog.MTUUpdated{Value: 1200}},
+			},
+			recorder.EventsWithTime(qlog.MTUUpdated{}),
+		)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/frames.go b/electron/native/private-transport/third_party/quic-go/testutils/frames.go
new file mode 100644
index 000000000..41787668e
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/frames.go
@@ -0,0 +1,26 @@
+package testutils
+
+import "github.com/quic-go/quic-go/internal/wire"
+
+type (
+	Frame                   = wire.Frame
+	AckFrame                = wire.AckFrame
+	ConnectionCloseFrame    = wire.ConnectionCloseFrame
+	CryptoFrame             = wire.CryptoFrame
+	DataBlockedFrame        = wire.DataBlockedFrame
+	HandshakeDoneFrame      = wire.HandshakeDoneFrame
+	MaxDataFrame            = wire.MaxDataFrame
+	MaxStreamDataFrame      = wire.MaxStreamDataFrame
+	MaxStreamsFrame         = wire.MaxStreamsFrame
+	NewConnectionIDFrame    = wire.NewConnectionIDFrame
+	NewTokenFrame           = wire.NewTokenFrame
+	PathChallengeFrame      = wire.PathChallengeFrame
+	PathResponseFrame       = wire.PathResponseFrame
+	PingFrame               = wire.PingFrame
+	ResetStreamFrame        = wire.ResetStreamFrame
+	RetireConnectionIDFrame = wire.RetireConnectionIDFrame
+	StopSendingFrame        = wire.StopSendingFrame
+	StreamDataBlockedFrame  = wire.StreamDataBlockedFrame
+	StreamFrame             = wire.StreamFrame
+	StreamsBlockedFrame     = wire.StreamsBlockedFrame
+)
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/README.md b/electron/native/private-transport/third_party/quic-go/testutils/simnet/README.md
new file mode 100644
index 000000000..fbec15e85
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/README.md
@@ -0,0 +1,16 @@
+# simnet
+
+This package is based on @MarcoPolo's [simnet](https://github.com/marcopolo/simnet) package.
+
+A small Go library for simulating packet networks in-process. It provides
+drop-in `net.PacketConn` endpoints connected through configurable virtual links
+with latency and MTU constraints. Useful for testing networking code
+without sockets or root privileges.
+
+- **Drop-in API**: implements `net.PacketConn`
+- **Realistic links**: per-direction latency and MTU
+- **Packet queuing**: priority queue for scheduled packet delivery
+- **Routers**: perfect delivery, fixed-latency, simple firewall/NAT-like routing
+- **Deterministic testing**: opt-in `synctest`-based tests for time control
+
+
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/queue.go b/electron/native/private-transport/third_party/quic-go/testutils/simnet/queue.go
new file mode 100644
index 000000000..e23196d63
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/queue.go
@@ -0,0 +1,134 @@
+package simnet
+
+import (
+	"container/heap"
+	"sync"
+	"time"
+)
+
+// queue is a priority queue that delivers packets at their scheduled delivery time
+type queue struct {
+	mu        sync.Mutex
+	packets   packetHeap
+	newPacket chan struct{}
+	closed    bool
+	pushCount int
+}
+
+func newQueue() *queue {
+	q := &queue{
+		newPacket: make(chan struct{}, 1),
+	}
+	heap.Init(&q.packets)
+	return q
+}
+
+// Enqueue adds a packet to the queue
+func (q *queue) Enqueue(p *packetWithDeliveryTime) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	if q.closed {
+		return
+	}
+	q.pushCount++
+	heap.Push(&q.packets, packetWithDeliveryTimeAndOrder{packetWithDeliveryTime: p, count: q.pushCount})
+
+	// Signal that a new packet arrived (non-blocking)
+	select {
+	case q.newPacket <- struct{}{}:
+	default:
+	}
+}
+
+// Dequeue removes and returns the next packet when it's ready for delivery
+// This blocks until a packet is available AND its delivery time has been reached
+// Uses a timer that can be reset if a packet with earlier delivery time arrives
+func (q *queue) Dequeue() (*packetWithDeliveryTime, bool) {
+	timer := time.NewTimer(time.Hour)
+	timer.Stop()
+
+	for {
+		q.mu.Lock()
+
+		if q.closed {
+			q.mu.Unlock()
+			timer.Stop()
+			return nil, false
+		}
+
+		if len(q.packets) == 0 {
+			// no packets, wait for one to arrive
+			q.mu.Unlock()
+			<-q.newPacket
+			timer.Stop()
+			continue
+		}
+
+		earliest := q.packets[0]
+		earliestTime := earliest.DeliveryTime
+
+		now := time.Now()
+		if now.Before(earliestTime) {
+			// not ready yet, wait until delivery time or new packet
+			waitDuration := earliestTime.Sub(now)
+			timer.Reset(waitDuration)
+			q.mu.Unlock()
+
+			select {
+			case <-timer.C:
+				continue
+			case <-q.newPacket:
+				// new packet arrived, might have earlier delivery time
+				timer.Stop()
+				continue
+			}
+		}
+
+		// Packet is ready, remove from queue and return it
+		po := heap.Pop(&q.packets).(packetWithDeliveryTimeAndOrder)
+		p := po.packetWithDeliveryTime
+
+		q.mu.Unlock()
+
+		return p, true
+	}
+}
+
+// Close closes the queue
+func (q *queue) Close() {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	q.closed = true
+	close(q.newPacket)
+}
+
+type packetWithDeliveryTimeAndOrder struct {
+	count int
+	*packetWithDeliveryTime
+}
+
+// packetHeap implements heap.Interface ordered by packet delivery time.
+type packetHeap []packetWithDeliveryTimeAndOrder
+
+func (h packetHeap) Len() int { return len(h) }
+
+func (h packetHeap) Less(i, j int) bool {
+	return (h[i].DeliveryTime.Before(h[j].DeliveryTime) || h[i].DeliveryTime.Equal(h[j].DeliveryTime) && h[i].count < h[j].count)
+}
+
+func (h packetHeap) Swap(i, j int) {
+	h[i], h[j] = h[j], h[i]
+}
+
+func (h *packetHeap) Push(x any) {
+	*h = append(*h, x.(packetWithDeliveryTimeAndOrder))
+}
+
+func (h *packetHeap) Pop() any {
+	old := *h
+	n := len(old)
+	item := old[n-1]
+	*h = old[:n-1]
+	return item
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/queue_test.go b/electron/native/private-transport/third_party/quic-go/testutils/simnet/queue_test.go
new file mode 100644
index 000000000..ece78e29c
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/queue_test.go
@@ -0,0 +1,83 @@
+package simnet
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestQueue(t *testing.T) {
+	q := newQueue()
+	baseTime := time.Now()
+
+	// Enqueue 5 packets with different delivery times
+	// Two packets scheduled for the same time (t2)
+	p1 := &packetWithDeliveryTime{
+		Packet:       Packet{Data: []byte("packet1")},
+		DeliveryTime: baseTime.Add(10 * time.Millisecond),
+	}
+	p2 := &packetWithDeliveryTime{
+		Packet:       Packet{Data: []byte("packet2")},
+		DeliveryTime: baseTime.Add(20 * time.Millisecond),
+	}
+	p3 := &packetWithDeliveryTime{
+		Packet:       Packet{Data: []byte("packet3")},
+		DeliveryTime: baseTime.Add(20 * time.Millisecond), // Same time as p2
+	}
+	p4 := &packetWithDeliveryTime{
+		Packet:       Packet{Data: []byte("packet4")},
+		DeliveryTime: baseTime.Add(30 * time.Millisecond),
+	}
+	p5 := &packetWithDeliveryTime{
+		Packet:       Packet{Data: []byte("packet5")},
+		DeliveryTime: baseTime.Add(5 * time.Millisecond),
+	}
+
+	// Enqueue in non-chronological order
+	q.Enqueue(p1)
+	q.Enqueue(p2)
+	q.Enqueue(p3)
+	q.Enqueue(p4)
+	q.Enqueue(p5)
+
+	// Dequeue should return packets in order: p5, p1, p2, p3, p4
+	// p2 and p3 have same time, but p2 was enqueued first
+	received, ok := q.Dequeue()
+	require.True(t, ok)
+	require.Equal(t, "packet5", string(received.Data))
+
+	received, ok = q.Dequeue()
+	require.True(t, ok)
+	require.Equal(t, "packet1", string(received.Data))
+
+	received, ok = q.Dequeue()
+	require.True(t, ok)
+	require.Equal(t, "packet2", string(received.Data))
+
+	received, ok = q.Dequeue()
+	require.True(t, ok)
+	require.Equal(t, "packet3", string(received.Data))
+
+	received, ok = q.Dequeue()
+	require.True(t, ok)
+	require.Equal(t, "packet4", string(received.Data))
+}
+
+func TestQueueClose(t *testing.T) {
+	q := newQueue()
+	q.Close()
+
+	_, ok := q.Dequeue()
+	require.False(t, ok)
+
+	// enqueue after close should be ignored
+	p := &packetWithDeliveryTime{
+		Packet:       Packet{Data: []byte("packet")},
+		DeliveryTime: time.Now(),
+	}
+	q.Enqueue(p)
+	// dequeue should still return false
+	_, ok = q.Dequeue()
+	require.False(t, ok)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/router.go b/electron/native/private-transport/third_party/quic-go/testutils/simnet/router.go
new file mode 100644
index 000000000..a8034d0c4
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/router.go
@@ -0,0 +1,149 @@
+package simnet
+
+import (
+	"errors"
+	"net"
+	"net/netip"
+	"sync"
+	"time"
+)
+
+type ipPortKey struct {
+	ip    string
+	port  uint16
+	isUDP bool
+}
+
+func (k *ipPortKey) FromNetAddr(addr net.Addr) error {
+	switch addr := addr.(type) {
+	case *net.UDPAddr:
+		*k = ipPortKey{
+			ip:    string(addr.IP),
+			port:  uint16(addr.Port),
+			isUDP: true,
+		}
+		return nil
+	case *net.TCPAddr:
+		*k = ipPortKey{
+			ip:    string(addr.IP),
+			port:  uint16(addr.Port),
+			isUDP: false,
+		}
+		return nil
+	default:
+		ip, err := netip.ParseAddrPort(addr.String())
+		if err != nil {
+			return err
+		}
+		*k = ipPortKey{
+			ip:    string(ip.Addr().AsSlice()),
+			port:  ip.Port(),
+			isUDP: addr.Network() == "udp",
+		}
+		return nil
+	}
+}
+
+type addrMap[V any] struct {
+	mu    sync.Mutex
+	nodes map[ipPortKey]V
+}
+
+func (m *addrMap[V]) Get(addr net.Addr) (V, bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	var v V
+	if len(m.nodes) == 0 {
+		return v, false
+	}
+	var k ipPortKey
+	if err := k.FromNetAddr(addr); err != nil {
+		return v, false
+	}
+	v, ok := m.nodes[k]
+	return v, ok
+}
+
+func (m *addrMap[V]) Set(addr net.Addr, v V) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.nodes == nil {
+		m.nodes = make(map[ipPortKey]V)
+	}
+
+	var k ipPortKey
+	if err := k.FromNetAddr(addr); err != nil {
+		return err
+	}
+	m.nodes[k] = v
+	return nil
+}
+
+func (m *addrMap[V]) Delete(addr net.Addr) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.nodes == nil {
+		m.nodes = make(map[ipPortKey]V)
+	}
+
+	var k ipPortKey
+	if err := k.FromNetAddr(addr); err != nil {
+		return err
+	}
+	delete(m.nodes, k)
+	return nil
+}
+
+// PerfectRouter is a router that has no latency or jitter and can route to
+// every node
+type PerfectRouter struct {
+	nodes addrMap[PacketReceiver]
+}
+
+// SendPacket implements Router.
+func (r *PerfectRouter) SendPacket(p Packet) error {
+	conn, ok := r.nodes.Get(p.To)
+	if !ok {
+		return errors.New("unknown destination")
+	}
+
+	conn.RecvPacket(p)
+	return nil
+}
+
+func (r *PerfectRouter) AddNode(addr net.Addr, conn PacketReceiver) {
+	r.nodes.Set(addr, conn)
+}
+
+func (r *PerfectRouter) RemoveNode(addr net.Addr) {
+	r.nodes.Delete(addr)
+}
+
+var _ Router = &PerfectRouter{}
+
+type DelayedPacketReceiver struct {
+	inner PacketReceiver
+	delay time.Duration
+}
+
+func (r *DelayedPacketReceiver) RecvPacket(p Packet) {
+	time.AfterFunc(r.delay, func() { r.inner.RecvPacket(p) })
+}
+
+type FixedLatencyRouter struct {
+	PerfectRouter
+	latency time.Duration
+}
+
+func (r *FixedLatencyRouter) SendPacket(p Packet) error {
+	return r.PerfectRouter.SendPacket(p)
+}
+
+func (r *FixedLatencyRouter) AddNode(addr net.Addr, conn PacketReceiver) {
+	r.PerfectRouter.AddNode(addr, &DelayedPacketReceiver{
+		inner: conn,
+		delay: r.latency,
+	})
+}
+
+var _ Router = &FixedLatencyRouter{}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/simconn.go b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simconn.go
new file mode 100644
index 000000000..9144a25f5
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simconn.go
@@ -0,0 +1,250 @@
+package simnet
+
+import (
+	"errors"
+	"net"
+	"slices"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+var ErrDeadlineExceeded = errors.New("deadline exceeded")
+
+type PacketReceiver interface {
+	RecvPacket(p Packet)
+}
+
+// Router handles routing of packets between simulated connections.
+// Implementations are responsible for delivering packets to their destinations.
+type Router interface {
+	SendPacket(p Packet) error
+	AddNode(addr net.Addr, receiver PacketReceiver)
+}
+
+type Packet struct {
+	To   net.Addr
+	From net.Addr
+
+	Data []byte
+}
+
+// SimConn is a simulated network connection that implements net.PacketConn.
+// It provides packet-based communication through a Router for testing and
+// simulation purposes. All send/recv operations are handled through the
+// Router's packet delivery mechanism.
+type SimConn struct {
+	mu              sync.Mutex
+	closed          bool
+	closedChan      chan struct{}
+	deadlineUpdated chan struct{}
+
+	packetsSent atomic.Uint64
+	packetsRcvd atomic.Uint64
+	bytesSent   atomic.Int64
+	bytesRcvd   atomic.Int64
+
+	router Router
+
+	myAddr        *net.UDPAddr
+	myLocalAddr   net.Addr
+	packetsToRead chan Packet
+
+	// Controls whether to block when receiving packets if our buffer is full.
+	// If false, drops packets.
+	recvBackPressure bool
+
+	readDeadline  time.Time
+	writeDeadline time.Time
+}
+
+var _ net.PacketConn = &SimConn{}
+
+// NewSimConn creates a new simulated connection that drops packets if the
+// receive buffer is full.
+func NewSimConn(addr *net.UDPAddr, rtr Router) *SimConn {
+	return newSimConn(addr, rtr, false)
+}
+
+// NewBlockingSimConn creates a new simulated connection that blocks if the
+// receive buffer is full. Does not drop packets.
+func NewBlockingSimConn(addr *net.UDPAddr, rtr Router) *SimConn {
+	return newSimConn(addr, rtr, true)
+}
+
+func newSimConn(addr *net.UDPAddr, rtr Router, block bool) *SimConn {
+	c := &SimConn{
+		recvBackPressure: block,
+		router:           rtr,
+		myAddr:           addr,
+		packetsToRead:    make(chan Packet, 32),
+		closedChan:       make(chan struct{}),
+		deadlineUpdated:  make(chan struct{}, 1),
+	}
+	rtr.AddNode(addr, c)
+	return c
+}
+
+type ConnStats struct {
+	BytesSent   int
+	BytesRcvd   int
+	PacketsSent int
+	PacketsRcvd int
+}
+
+func (c *SimConn) Stats() ConnStats {
+	return ConnStats{
+		BytesSent:   int(c.bytesSent.Load()),
+		BytesRcvd:   int(c.bytesRcvd.Load()),
+		PacketsSent: int(c.packetsSent.Load()),
+		PacketsRcvd: int(c.packetsRcvd.Load()),
+	}
+}
+
+// SetReadBuffer only exists to quell the warning message from quic-go
+func (c *SimConn) SetReadBuffer(n int) error {
+	return nil
+}
+
+// SetWriteBuffer only exists to quell the warning message from quic-go
+func (c *SimConn) SetWriteBuffer(n int) error {
+	return nil
+}
+
+func (c *SimConn) RecvPacket(p Packet) {
+	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return
+	}
+	c.mu.Unlock()
+	c.packetsRcvd.Add(1)
+	c.bytesRcvd.Add(int64(len(p.Data)))
+
+	if c.recvBackPressure {
+		select {
+		case c.packetsToRead <- p:
+		case <-c.closedChan:
+			// if the connection is closed, drop the packet
+			return
+		}
+	} else {
+		select {
+		case c.packetsToRead <- p:
+		default:
+			// drop the packet if the channel is full
+		}
+	}
+}
+
+func (c *SimConn) Close() error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.closed {
+		return nil
+	}
+	c.closed = true
+	close(c.closedChan)
+	return nil
+}
+
+func (c *SimConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
+	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return 0, nil, net.ErrClosed
+	}
+	deadline := c.readDeadline
+	c.mu.Unlock()
+
+	if !deadline.IsZero() && !time.Now().Before(deadline) {
+		return 0, nil, ErrDeadlineExceeded
+	}
+
+	var pkt Packet
+	var deadlineTimer <-chan time.Time
+	if !deadline.IsZero() {
+		deadlineTimer = time.After(time.Until(deadline))
+	}
+
+	select {
+	case pkt = <-c.packetsToRead:
+	case <-c.closedChan:
+		return 0, nil, net.ErrClosed
+	case <-c.deadlineUpdated:
+		return c.ReadFrom(p)
+	case <-deadlineTimer:
+		return 0, nil, ErrDeadlineExceeded
+	}
+
+	n = copy(p, pkt.Data)
+	// if the provided buffer is not enough to read the whole packet, we drop
+	// the rest of the data. this is similar to what `recvfrom` does on Linux
+	// and macOS.
+	return n, pkt.From, nil
+}
+
+func (c *SimConn) WriteTo(p []byte, addr net.Addr) (n int, err error) {
+	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return 0, net.ErrClosed
+	}
+	deadline := c.writeDeadline
+	c.mu.Unlock()
+
+	if !deadline.IsZero() && !time.Now().Before(deadline) {
+		return 0, ErrDeadlineExceeded
+	}
+
+	c.packetsSent.Add(1)
+	c.bytesSent.Add(int64(len(p)))
+
+	pkt := Packet{
+		From: c.myAddr,
+		To:   addr,
+		Data: slices.Clone(p),
+	}
+	return len(p), c.router.SendPacket(pkt)
+}
+
+func (c *SimConn) UnicastAddr() net.Addr {
+	return c.myAddr
+}
+
+func (c *SimConn) LocalAddr() net.Addr {
+	if c.myLocalAddr != nil {
+		return c.myLocalAddr
+	}
+	return c.myAddr
+}
+
+func (c *SimConn) SetDeadline(t time.Time) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.readDeadline = t
+	c.writeDeadline = t
+	select {
+	case c.deadlineUpdated <- struct{}{}:
+	default:
+	}
+	return nil
+}
+
+func (c *SimConn) SetReadDeadline(t time.Time) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.readDeadline = t
+	select {
+	case c.deadlineUpdated <- struct{}{}:
+	default:
+	}
+	return nil
+}
+
+func (c *SimConn) SetWriteDeadline(t time.Time) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.writeDeadline = t
+	return nil
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/simconn_test.go b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simconn_test.go
new file mode 100644
index 000000000..6886fb9ee
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simconn_test.go
@@ -0,0 +1,187 @@
+package simnet
+
+import (
+	"crypto/rand"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func randomPublicIPv4() net.IP {
+start:
+	ip := make([]byte, 4)
+	rand.Read(ip[:])
+	if net.IP(ip).IsPrivate() || net.IP(ip).IsLoopback() || net.IP(ip).IsLinkLocalUnicast() {
+		goto start
+	}
+	return ip
+}
+
+func TestSimConnBasicConnectivity(t *testing.T) {
+	router := &PerfectRouter{}
+
+	// Create two endpoints
+	addr1 := &net.UDPAddr{IP: randomPublicIPv4(), Port: 1234}
+	addr2 := &net.UDPAddr{IP: randomPublicIPv4(), Port: 1234}
+
+	conn1 := NewSimConn(addr1, router)
+	conn2 := NewSimConn(addr2, router)
+
+	// Test sending data from conn1 to conn2
+	testData := []byte("hello world")
+	n, err := conn1.WriteTo(testData, addr2)
+	require.NoError(t, err)
+	require.Equal(t, len(testData), n)
+
+	// Read data from conn2
+	buf := make([]byte, 1024)
+	n, addr, err := conn2.ReadFrom(buf)
+	require.NoError(t, err)
+	require.Equal(t, testData, buf[:n])
+	require.Equal(t, addr1, addr)
+
+	// Check stats
+	stats1 := conn1.Stats()
+	require.Equal(t, len(testData), stats1.BytesSent)
+	require.Equal(t, 1, stats1.PacketsSent)
+
+	stats2 := conn2.Stats()
+	require.Equal(t, len(testData), stats2.BytesRcvd)
+	require.Equal(t, 1, stats2.PacketsRcvd)
+}
+
+func TestSimConnDeadlines(t *testing.T) {
+	router := &PerfectRouter{}
+
+	addr1 := &net.UDPAddr{IP: randomPublicIPv4(), Port: 1234}
+	conn := NewSimConn(addr1, router)
+
+	t.Run("read deadline", func(t *testing.T) {
+		deadline := time.Now().Add(10 * time.Millisecond)
+		err := conn.SetReadDeadline(deadline)
+		require.NoError(t, err)
+
+		buf := make([]byte, 1024)
+		_, _, err = conn.ReadFrom(buf)
+		require.ErrorIs(t, err, ErrDeadlineExceeded)
+	})
+
+	t.Run("write deadline", func(t *testing.T) {
+		deadline := time.Now().Add(-time.Second) // Already expired
+		err := conn.SetWriteDeadline(deadline)
+		require.NoError(t, err)
+
+		_, err = conn.WriteTo([]byte("test"), &net.UDPAddr{})
+		require.ErrorIs(t, err, ErrDeadlineExceeded)
+	})
+}
+
+func TestSimConnClose(t *testing.T) {
+	router := &PerfectRouter{}
+
+	addr1 := &net.UDPAddr{IP: randomPublicIPv4(), Port: 1234}
+	conn := NewSimConn(addr1, router)
+
+	err := conn.Close()
+	require.NoError(t, err)
+
+	// Verify operations fail after close
+	_, err = conn.WriteTo([]byte("test"), addr1)
+	require.ErrorIs(t, err, net.ErrClosed)
+
+	buf := make([]byte, 1024)
+	_, _, err = conn.ReadFrom(buf)
+	require.ErrorIs(t, err, net.ErrClosed)
+
+	// Second close should not error
+	err = conn.Close()
+	require.NoError(t, err)
+}
+
+func TestSimConnDeadlinesWithLatency(t *testing.T) {
+	router := &FixedLatencyRouter{
+		PerfectRouter: PerfectRouter{},
+		latency:       100 * time.Millisecond,
+	}
+
+	addr1 := &net.UDPAddr{IP: randomPublicIPv4(), Port: 1234}
+	addr2 := &net.UDPAddr{IP: randomPublicIPv4(), Port: 1234}
+
+	conn1 := NewSimConn(addr1, router)
+	conn2 := NewSimConn(addr2, router)
+
+	reset := func() {
+		router.RemoveNode(addr1)
+		router.RemoveNode(addr2)
+
+		conn1 = NewSimConn(addr1, router)
+		conn2 = NewSimConn(addr2, router)
+	}
+
+	t.Run("write succeeds within deadline", func(t *testing.T) {
+		deadline := time.Now().Add(200 * time.Millisecond)
+		err := conn1.SetWriteDeadline(deadline)
+		require.NoError(t, err)
+
+		n, err := conn1.WriteTo([]byte("test"), addr2)
+		require.NoError(t, err)
+		require.Equal(t, 4, n)
+		reset()
+	})
+
+	t.Run("write fails after past deadline", func(t *testing.T) {
+		deadline := time.Now().Add(-time.Second) // Already expired
+		err := conn1.SetWriteDeadline(deadline)
+		require.NoError(t, err)
+
+		_, err = conn1.WriteTo([]byte("test"), addr2)
+		require.ErrorIs(t, err, ErrDeadlineExceeded)
+		reset()
+	})
+
+	t.Run("read succeeds within deadline", func(t *testing.T) {
+		// Reset deadline and send a message
+		conn2.SetReadDeadline(time.Time{})
+		testData := []byte("hello")
+		deadline := time.Now().Add(200 * time.Millisecond)
+		conn1.SetWriteDeadline(deadline)
+		_, err := conn1.WriteTo(testData, addr2)
+		require.NoError(t, err)
+
+		// Set read deadline and try to read
+		deadline = time.Now().Add(200 * time.Millisecond)
+		err = conn2.SetReadDeadline(deadline)
+		require.NoError(t, err)
+
+		buf := make([]byte, 1024)
+		n, addr, err := conn2.ReadFrom(buf)
+		require.NoError(t, err)
+		require.Equal(t, addr1, addr)
+		require.Equal(t, testData, buf[:n])
+		reset()
+	})
+
+	t.Run("read fails after deadline", func(t *testing.T) {
+		defer reset()
+		// Set a short deadline
+		deadline := time.Now().Add(50 * time.Millisecond) // Less than router latency
+		err := conn2.SetReadDeadline(deadline)
+		require.NoError(t, err)
+
+		var wg sync.WaitGroup
+		defer wg.Wait()
+		wg.Go(func() {
+			// Send data after setting deadline
+			_, err := conn1.WriteTo([]byte("test"), addr2)
+			require.NoError(t, err)
+		})
+
+		// Read should fail due to deadline
+		buf := make([]byte, 1024)
+		_, _, err = conn2.ReadFrom(buf)
+		require.ErrorIs(t, err, ErrDeadlineExceeded)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/simlink.go b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simlink.go
new file mode 100644
index 000000000..3730d9543
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simlink.go
@@ -0,0 +1,145 @@
+package simnet
+
+import (
+	"net"
+	"sync"
+	"time"
+)
+
+// packetWithDeliveryTime holds a packet along with its scheduled delivery time
+type packetWithDeliveryTime struct {
+	Packet
+	DeliveryTime time.Time
+}
+
+// LinkSettings defines the network characteristics for a simulated link direction
+type LinkSettings struct {
+	// MTU (Maximum Transmission Unit) specifies the maximum packet size in bytes
+	MTU int
+}
+
+// SimulatedLink simulates a bidirectional network link with variable latency and MTU constraints
+type SimulatedLink struct {
+	// Internal state for lifecycle management
+	wg sync.WaitGroup
+
+	// Queues for packet delivery timing
+	downstreamQueue *queue
+	upstreamQueue   *queue
+
+	// Configuration for link characteristics
+	UplinkSettings   LinkSettings
+	DownlinkSettings LinkSettings
+
+	// Latency specifies a fixed network delay for downlink packets
+	// If both Latency and LatencyFunc are set, LatencyFunc takes precedence
+	Latency time.Duration
+
+	// LatencyFunc computes the network delay for each downlink packet
+	// This allows variable latency based on packet source/destination
+	// If nil, Latency field is used instead
+	LatencyFunc func(Packet) time.Duration
+
+	// Packet routing interfaces
+	UploadPacket   Router
+	downloadPacket PacketReceiver
+}
+
+func (l *SimulatedLink) AddNode(addr net.Addr, receiver PacketReceiver) {
+	l.downloadPacket = receiver
+}
+
+func (l *SimulatedLink) Start() {
+	if l.downloadPacket == nil {
+		panic("SimulatedLink.Start() called without having added a packet receiver")
+	}
+
+	// Sane defaults
+	if l.DownlinkSettings.MTU == 0 {
+		l.DownlinkSettings.MTU = 1400
+	}
+	if l.UplinkSettings.MTU == 0 {
+		l.UplinkSettings.MTU = 1400
+	}
+
+	l.downstreamQueue = newQueue()
+	l.upstreamQueue = newQueue()
+
+	l.wg.Go(func() { l.backgroundDownlink() })
+	l.wg.Go(func() { l.backgroundUplink() })
+}
+
+func (l *SimulatedLink) Close() error {
+	l.downstreamQueue.Close()
+	l.upstreamQueue.Close()
+	l.wg.Wait()
+	return nil
+}
+
+func (l *SimulatedLink) backgroundDownlink() {
+	for {
+		// Dequeue a packet (this will block until packet is ready for delivery)
+		// Dequeue() returns false when the queue is closed
+		p, ok := l.downstreamQueue.Dequeue()
+		if !ok {
+			return
+		}
+
+		// Deliver the packet
+		l.downloadPacket.RecvPacket(p.Packet)
+	}
+}
+
+func (l *SimulatedLink) backgroundUplink() {
+	for {
+		// Dequeue a packet (this will block until packet is ready for delivery)
+		// Dequeue() returns false when the queue is closed
+		p, ok := l.upstreamQueue.Dequeue()
+		if !ok {
+			return
+		}
+
+		// Deliver the packet
+		_ = l.UploadPacket.SendPacket(p.Packet)
+	}
+}
+
+func (l *SimulatedLink) SendPacket(p Packet) error {
+	if len(p.Data) > l.UplinkSettings.MTU {
+		// Drop packet if it's too large
+		return nil
+	}
+
+	// Uplink has no latency - packets are delivered immediately
+	deliveryTime := time.Now()
+
+	// Enqueue packet with delivery time
+	l.upstreamQueue.Enqueue(&packetWithDeliveryTime{
+		Packet:       p,
+		DeliveryTime: deliveryTime,
+	})
+
+	return nil
+}
+
+func (l *SimulatedLink) RecvPacket(p Packet) {
+	if len(p.Data) > l.DownlinkSettings.MTU {
+		// Drop packet if it's too large
+		return
+	}
+
+	// Calculate delivery time based on downlink latency
+	var latency time.Duration
+	if l.LatencyFunc != nil {
+		latency = l.LatencyFunc(p)
+	} else {
+		latency = l.Latency
+	}
+	deliveryTime := time.Now().Add(latency)
+
+	// Enqueue packet with delivery time
+	l.downstreamQueue.Enqueue(&packetWithDeliveryTime{
+		Packet:       p,
+		DeliveryTime: deliveryTime,
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/simlink_test.go b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simlink_test.go
new file mode 100644
index 000000000..f44bb0d61
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simlink_test.go
@@ -0,0 +1,153 @@
+package simnet
+
+import (
+	"fmt"
+	"math"
+	"net"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+type testRouter struct {
+	onSend func(p Packet)
+	onRecv func(p Packet)
+}
+
+func (r *testRouter) SendPacket(p Packet) error {
+	r.onSend(p)
+	return nil
+}
+
+func (r *testRouter) RecvPacket(p Packet) {
+	r.onRecv(p)
+}
+
+func (r *testRouter) AddNode(addr net.Addr, receiver PacketReceiver) {
+	r.onRecv = receiver.RecvPacket
+}
+
+func TestLatency(t *testing.T) {
+	for _, testUpload := range []bool{true, false} {
+		t.Run(fmt.Sprintf("testing upload=%t", testUpload), func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				const downlinkLatency = 10 * time.Millisecond
+				const MTU = 1400
+				linkSettings := LinkSettings{
+					MTU: MTU,
+				}
+
+				recvStartTimeChan := make(chan time.Time, 1)
+				recvStarted := false
+				packetHandler := func(p Packet) {
+					if !recvStarted {
+						recvStarted = true
+						recvStartTimeChan <- time.Now()
+					}
+				}
+
+				router := &testRouter{}
+				if testUpload {
+					router.onSend = packetHandler
+				} else {
+					router.onRecv = packetHandler
+				}
+				link := SimulatedLink{
+					UplinkSettings:   linkSettings,
+					DownlinkSettings: linkSettings,
+					LatencyFunc:      func(p Packet) time.Duration { return downlinkLatency },
+					UploadPacket:     router,
+					downloadPacket:   router,
+				}
+
+				link.Start()
+
+				chunk := make([]byte, MTU)
+				sendStartTime := time.Now()
+				if testUpload {
+					_ = link.SendPacket(Packet{Data: chunk})
+				} else {
+					link.RecvPacket(Packet{Data: chunk})
+				}
+
+				// Wait for delayed packets to be sent
+				time.Sleep(40 * time.Millisecond)
+
+				link.Close()
+				recvStartTime := <-recvStartTimeChan
+
+				observedLatency := recvStartTime.Sub(sendStartTime)
+				// Uplink is now instant (no latency), only downlink has latency
+				var expectedLatency time.Duration
+				if testUpload {
+					// Uplink test: expect near-zero latency
+					expectedLatency = 0
+					t.Logf("observed latency: %s (uplink is instant)", observedLatency)
+					if observedLatency > 5*time.Millisecond {
+						t.Fatalf("observed latency %s is too high for instant uplink", observedLatency)
+					}
+				} else {
+					// Downlink test: expect configured latency
+					expectedLatency = downlinkLatency
+					percentErrorLatency := math.Abs(observedLatency.Seconds()-expectedLatency.Seconds()) / expectedLatency.Seconds()
+					t.Logf("observed latency: %s, expected latency: %s, percent error: %f", observedLatency, expectedLatency, percentErrorLatency)
+					if percentErrorLatency > 0.20 {
+						t.Fatalf("observed latency %s is wrong", observedLatency)
+					}
+				}
+			})
+		})
+	}
+}
+
+func TestMTUEnforcement(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const MTU = 1400
+		linkSettings := LinkSettings{
+			MTU: MTU,
+		}
+
+		var packetsReceived atomic.Uint32
+		router := &testRouter{
+			onSend: func(p Packet) { packetsReceived.Add(1) },
+			onRecv: func(p Packet) { packetsReceived.Add(1) },
+		}
+		link := SimulatedLink{
+			UplinkSettings:   linkSettings,
+			DownlinkSettings: linkSettings,
+			UploadPacket:     router,
+			downloadPacket:   router,
+		}
+
+		link.Start()
+
+		// Send a packet that fits within MTU - should be delivered
+		smallPacket := make([]byte, MTU)
+		err := link.SendPacket(Packet{Data: smallPacket})
+		require.NoError(t, err)
+
+		// Send a packet that exceeds MTU - should be dropped
+		largePacket := make([]byte, MTU+1)
+		err = link.SendPacket(Packet{Data: largePacket})
+		require.NoError(t, err) // SendPacket returns nil even when dropping
+
+		// Receive a packet that fits within MTU - should be delivered
+		link.RecvPacket(Packet{Data: smallPacket})
+
+		// Receive a packet that exceeds MTU - should be dropped
+		link.RecvPacket(Packet{Data: largePacket})
+
+		// Wait for packets to be processed
+		time.Sleep(10 * time.Millisecond)
+
+		link.Close()
+
+		// Only packets within MTU should be received (2 packets: 1 from SendPacket, 1 from RecvPacket)
+		if packetsReceived.Load() != 2 {
+			t.Fatalf("expected 2 packets to be received, got %d", packetsReceived.Load())
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/simnet.go b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simnet.go
new file mode 100644
index 000000000..adf675412
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simnet.go
@@ -0,0 +1,71 @@
+package simnet
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"time"
+)
+
+// Simnet is a simulated network that manages connections between nodes
+// with configurable network conditions.
+type Simnet struct {
+	Router Router
+
+	links []*SimulatedLink
+}
+
+// NodeBiDiLinkSettings defines the bidirectional link settings for a network node.
+// It specifies separate configurations for downlink (incoming) and uplink (outgoing)
+// traffic, allowing asymmetric network conditions to be simulated.
+type NodeBiDiLinkSettings struct {
+	// Downlink configures the settings for incoming traffic to this node
+	Downlink LinkSettings
+	// Uplink configures the settings for outgoing traffic from this node
+	Uplink LinkSettings
+
+	// Latency specifies a fixed network delay for downlink packets only
+	// If both Latency and LatencyFunc are set, LatencyFunc takes precedence
+	Latency time.Duration
+
+	// LatencyFunc computes the network delay for each downlink packet
+	// This allows variable latency based on packet source/destination
+	// If nil, Latency field is used instead
+	LatencyFunc func(Packet) time.Duration
+}
+
+func (n *Simnet) Start() error {
+	for _, link := range n.links {
+		link.Start()
+	}
+	return nil
+}
+
+func (n *Simnet) Close() error {
+	var errs error
+	for _, link := range n.links {
+		err := link.Close()
+		if err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if errs != nil {
+		return fmt.Errorf("failed to close some links: %w", errs)
+	}
+	return nil
+}
+
+func (n *Simnet) NewEndpoint(addr *net.UDPAddr, linkSettings NodeBiDiLinkSettings) *SimConn {
+	link := &SimulatedLink{
+		DownlinkSettings: linkSettings.Downlink,
+		UplinkSettings:   linkSettings.Uplink,
+		Latency:          linkSettings.Latency,
+		LatencyFunc:      linkSettings.LatencyFunc,
+		UploadPacket:     n.Router,
+	}
+	c := NewBlockingSimConn(addr, link)
+
+	n.links = append(n.links, link)
+	n.Router.AddNode(addr, link)
+	return c
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/simnet/simnet_synctest_test.go b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simnet_synctest_test.go
new file mode 100644
index 000000000..58482223a
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/simnet/simnet_synctest_test.go
@@ -0,0 +1,59 @@
+package simnet
+
+import (
+	"math"
+	"net"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func newConn(simnet *Simnet, address *net.UDPAddr, linkSettings NodeBiDiLinkSettings) *SimConn {
+	return simnet.NewEndpoint(address, linkSettings)
+}
+
+func TestSimpleSimNet(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		router := &Simnet{Router: &PerfectRouter{}}
+
+		const latency = 10 * time.Millisecond
+		linkSettings := NodeBiDiLinkSettings{
+			Downlink: LinkSettings{},
+			Uplink:   LinkSettings{},
+			Latency:  latency,
+		}
+
+		addressA := net.UDPAddr{
+			IP:   net.ParseIP("1.0.0.1"),
+			Port: 8000,
+		}
+		connA := newConn(router, &addressA, linkSettings)
+		addressB := net.UDPAddr{
+			IP:   net.ParseIP("1.0.0.2"),
+			Port: 8000,
+		}
+		connB := newConn(router, &addressB, linkSettings)
+
+		router.Start()
+		defer router.Close()
+
+		start := time.Now()
+		connA.WriteTo([]byte("hello"), &addressB)
+		buf := make([]byte, 1024)
+		n, from, err := connB.ReadFrom(buf)
+		require.NoError(t, err)
+		require.Equal(t, "hello", string(buf[:n]))
+		require.Equal(t, addressA.String(), from.String())
+		observedLatency := time.Since(start)
+
+		// Only downlink has latency now (uplink is instant)
+		expectedLatency := latency
+		percentDiff := math.Abs(float64(observedLatency-expectedLatency) / float64(expectedLatency))
+		t.Logf("observed latency: %v, expected latency: %v, percent diff: %v", observedLatency, expectedLatency, percentDiff)
+		if percentDiff > 0.30 {
+			t.Fatalf("latency is wrong: %v. percent off: %v", observedLatency, percentDiff)
+		}
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/testutils/testutils.go b/electron/native/private-transport/third_party/quic-go/testutils/testutils.go
new file mode 100644
index 000000000..efeb90455
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/testutils/testutils.go
@@ -0,0 +1,108 @@
+// Package testutils contains utilities for simulating packet injection and man-in-the-middle (MITM) attacker tests.
+// It is not supposed to be used for non-testing purposes.
+// The API is not guaranteed to be stable.
+package testutils
+
+import (
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/handshake"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+// writePacket returns a new raw packet with the specified header and payload
+func writePacket(hdr *wire.ExtendedHeader, data []byte) []byte {
+	b, err := hdr.Append(nil, hdr.Version)
+	if err != nil {
+		panic(fmt.Sprintf("failed to write header: %s", err))
+	}
+	return append(b, data...)
+}
+
+// packRawPayload returns a new raw payload containing given frames
+func packRawPayload(version protocol.Version, frames []wire.Frame) []byte {
+	var b []byte
+	for _, cf := range frames {
+		var err error
+		b, err = cf.Append(b, version)
+		if err != nil {
+			panic(err)
+		}
+	}
+	return b
+}
+
+// ComposeInitialPacket returns an Initial packet encrypted under key (the original destination connection ID)
+// containing specified frames.
+func ComposeInitialPacket(
+	srcConnID, destConnID, key protocol.ConnectionID,
+	token []byte,
+	frames []wire.Frame,
+	sentBy protocol.Perspective,
+	version protocol.Version,
+) []byte {
+	sealer, _ := handshake.NewInitialAEAD(key, sentBy, version)
+
+	// compose payload
+	var payload []byte
+	if len(frames) == 0 {
+		payload = make([]byte, protocol.MinInitialPacketSize)
+	} else {
+		payload = packRawPayload(version, frames)
+	}
+
+	// compose Initial header
+	payloadSize := len(payload)
+	const pnLength = protocol.PacketNumberLen4
+	length := payloadSize + int(pnLength) + sealer.Overhead()
+	hdr := &wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             protocol.PacketTypeInitial,
+			Token:            token,
+			SrcConnectionID:  srcConnID,
+			DestConnectionID: destConnID,
+			Length:           protocol.ByteCount(length),
+			Version:          version,
+		},
+		PacketNumberLen: pnLength,
+		PacketNumber:    0x0,
+	}
+
+	raw := writePacket(hdr, payload)
+
+	// encrypt payload and header
+	payloadOffset := len(raw) - payloadSize
+	var encrypted []byte
+	encrypted = sealer.Seal(encrypted, payload, hdr.PacketNumber, raw[:payloadOffset])
+	hdrBytes := raw[0:payloadOffset]
+	encrypted = append(hdrBytes, encrypted...)
+	pnOffset := payloadOffset - int(pnLength) // packet number offset
+	sealer.EncryptHeader(
+		encrypted[payloadOffset:payloadOffset+16], // first 16 bytes of payload (sample)
+		&encrypted[0],                     // first byte of header
+		encrypted[pnOffset:payloadOffset], // packet number bytes
+	)
+	return encrypted
+}
+
+// ComposeRetryPacket returns a new raw Retry Packet
+func ComposeRetryPacket(
+	srcConnID protocol.ConnectionID,
+	destConnID protocol.ConnectionID,
+	origDestConnID protocol.ConnectionID,
+	token []byte,
+	version protocol.Version,
+) []byte {
+	hdr := &wire.ExtendedHeader{
+		Header: wire.Header{
+			Type:             protocol.PacketTypeRetry,
+			SrcConnectionID:  srcConnID,
+			DestConnectionID: destConnID,
+			Token:            token,
+			Version:          version,
+		},
+	}
+	data := writePacket(hdr, nil)
+	return append(data, handshake.GetRetryIntegrityTag(data, origDestConnID, version)[:]...)
+}
diff --git a/electron/native/private-transport/third_party/quic-go/token_store.go b/electron/native/private-transport/third_party/quic-go/token_store.go
new file mode 100644
index 000000000..a5c1c1852
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/token_store.go
@@ -0,0 +1,116 @@
+package quic
+
+import (
+	"sync"
+
+	list "github.com/quic-go/quic-go/internal/utils/linkedlist"
+)
+
+type singleOriginTokenStore struct {
+	tokens []*ClientToken
+	len    int
+	p      int
+}
+
+func newSingleOriginTokenStore(size int) *singleOriginTokenStore {
+	return &singleOriginTokenStore{tokens: make([]*ClientToken, size)}
+}
+
+func (s *singleOriginTokenStore) Add(token *ClientToken) {
+	s.tokens[s.p] = token
+	s.p = s.index(s.p + 1)
+	s.len = min(s.len+1, len(s.tokens))
+}
+
+func (s *singleOriginTokenStore) Pop() *ClientToken {
+	s.p = s.index(s.p - 1)
+	token := s.tokens[s.p]
+	s.tokens[s.p] = nil
+	s.len = max(s.len-1, 0)
+	return token
+}
+
+func (s *singleOriginTokenStore) Len() int {
+	return s.len
+}
+
+func (s *singleOriginTokenStore) index(i int) int {
+	mod := len(s.tokens)
+	return (i + mod) % mod
+}
+
+type lruTokenStoreEntry struct {
+	key   string
+	cache *singleOriginTokenStore
+}
+
+type lruTokenStore struct {
+	mutex sync.Mutex
+
+	m                map[string]*list.Element[*lruTokenStoreEntry]
+	q                *list.List[*lruTokenStoreEntry]
+	capacity         int
+	singleOriginSize int
+}
+
+var _ TokenStore = &lruTokenStore{}
+
+// NewLRUTokenStore creates a new LRU cache for tokens received by the client.
+// maxOrigins specifies how many origins this cache is saving tokens for.
+// tokensPerOrigin specifies the maximum number of tokens per origin.
+func NewLRUTokenStore(maxOrigins, tokensPerOrigin int) TokenStore {
+	return &lruTokenStore{
+		m:                make(map[string]*list.Element[*lruTokenStoreEntry]),
+		q:                list.New[*lruTokenStoreEntry](),
+		capacity:         maxOrigins,
+		singleOriginSize: tokensPerOrigin,
+	}
+}
+
+func (s *lruTokenStore) Put(key string, token *ClientToken) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	if el, ok := s.m[key]; ok {
+		entry := el.Value
+		entry.cache.Add(token)
+		s.q.MoveToFront(el)
+		return
+	}
+
+	if s.q.Len() < s.capacity {
+		entry := &lruTokenStoreEntry{
+			key:   key,
+			cache: newSingleOriginTokenStore(s.singleOriginSize),
+		}
+		entry.cache.Add(token)
+		s.m[key] = s.q.PushFront(entry)
+		return
+	}
+
+	elem := s.q.Back()
+	entry := elem.Value
+	delete(s.m, entry.key)
+	entry.key = key
+	entry.cache = newSingleOriginTokenStore(s.singleOriginSize)
+	entry.cache.Add(token)
+	s.q.MoveToFront(elem)
+	s.m[key] = elem
+}
+
+func (s *lruTokenStore) Pop(key string) *ClientToken {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	var token *ClientToken
+	if el, ok := s.m[key]; ok {
+		s.q.MoveToFront(el)
+		cache := el.Value.cache
+		token = cache.Pop()
+		if cache.Len() == 0 {
+			s.q.Remove(el)
+			delete(s.m, key)
+		}
+	}
+	return token
+}
diff --git a/electron/native/private-transport/third_party/quic-go/token_store_test.go b/electron/native/private-transport/third_party/quic-go/token_store_test.go
new file mode 100644
index 000000000..0c7f90e42
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/token_store_test.go
@@ -0,0 +1,79 @@
+package quic
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func mockToken(num int) *ClientToken {
+	return &ClientToken{data: fmt.Appendf(nil, "%d", num), rtt: 1337 * time.Millisecond}
+}
+
+func TestTokenStoreSingleOrigin(t *testing.T) {
+	const origin = "localhost"
+
+	s := NewLRUTokenStore(1, 3)
+	s.Put(origin, mockToken(1))
+	s.Put(origin, mockToken(2))
+	require.Equal(t, mockToken(2), s.Pop(origin))
+	require.Equal(t, mockToken(1), s.Pop(origin))
+	require.Nil(t, s.Pop(origin))
+
+	// now add more tokens than the cache size
+	s.Put(origin, mockToken(1))
+	s.Put(origin, mockToken(2))
+	s.Put(origin, mockToken(3))
+	require.Equal(t, mockToken(3), s.Pop(origin))
+	s.Put(origin, mockToken(4))
+	s.Put(origin, mockToken(5))
+	require.Equal(t, mockToken(5), s.Pop(origin))
+	require.Equal(t, mockToken(4), s.Pop(origin))
+	require.Equal(t, mockToken(2), s.Pop(origin))
+	require.Nil(t, s.Pop(origin))
+}
+
+func TestTokenStoreMultipleOrigins(t *testing.T) {
+	s := NewLRUTokenStore(3, 4)
+
+	s.Put("host1", mockToken(1))
+	s.Put("host2", mockToken(2))
+	s.Put("host3", mockToken(3))
+	s.Put("host4", mockToken(4))
+	require.Nil(t, s.Pop("host1"))
+	require.Equal(t, mockToken(2), s.Pop("host2"))
+	require.Equal(t, mockToken(3), s.Pop("host3"))
+	require.Equal(t, mockToken(4), s.Pop("host4"))
+}
+
+func TestTokenStoreUpdates(t *testing.T) {
+	s := NewLRUTokenStore(3, 4)
+	s.Put("host1", mockToken(1))
+	s.Put("host2", mockToken(2))
+	s.Put("host3", mockToken(3))
+	s.Put("host1", mockToken(11))
+	// make sure one is evicted
+	s.Put("host4", mockToken(4))
+	require.Nil(t, s.Pop("host2"))
+	require.Equal(t, mockToken(11), s.Pop("host1"))
+	require.Equal(t, mockToken(1), s.Pop("host1"))
+	require.Equal(t, mockToken(3), s.Pop("host3"))
+	require.Equal(t, mockToken(4), s.Pop("host4"))
+}
+
+func TestTokenStoreEviction(t *testing.T) {
+	s := NewLRUTokenStore(3, 4)
+
+	s.Put("host1", mockToken(1))
+	s.Put("host2", mockToken(2))
+	s.Put("host3", mockToken(3))
+	require.Equal(t, mockToken(2), s.Pop("host2"))
+	require.Nil(t, s.Pop("host2"))
+	// host2 is now empty and should have been deleted, making space for host4
+	s.Put("host4", mockToken(4))
+	require.Equal(t, mockToken(1), s.Pop("host1"))
+	require.Equal(t, mockToken(3), s.Pop("host3"))
+	require.Equal(t, mockToken(4), s.Pop("host4"))
+}
diff --git a/electron/native/private-transport/third_party/quic-go/transport.go b/electron/native/private-transport/third_party/quic-go/transport.go
new file mode 100644
index 000000000..270c35de8
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/transport.go
@@ -0,0 +1,850 @@
+package quic
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+)
+
+// ErrTransportClosed is returned by [Transport.Listen], [Transport.ListenEarly], [Transport.Dial],
+// or [Transport.DialEarly] after [Transport.Close] is called.
+var ErrTransportClosed = &errTransportClosed{}
+
+type errTransportClosed struct {
+	err error
+}
+
+func (e *errTransportClosed) Unwrap() []error { return []error{net.ErrClosed, e.err} }
+
+func (e *errTransportClosed) Error() string {
+	if e.err == nil {
+		return "quic: transport closed"
+	}
+	return fmt.Sprintf("quic: transport closed: %s", e.err)
+}
+
+func (e *errTransportClosed) Is(target error) bool {
+	_, ok := target.(*errTransportClosed)
+	return ok
+}
+
+var errListenerAlreadySet = errors.New("listener already set")
+
+type closePacket struct {
+	payload []byte
+	addr    net.Addr
+	info    packetInfo
+}
+
+// The Transport is the central point to manage incoming and outgoing QUIC connections.
+// QUIC demultiplexes connections based on their QUIC Connection IDs, not based on the 4-tuple.
+// This means that a single UDP socket can be used for listening for incoming connections, as well as
+// for dialing an arbitrary number of outgoing connections.
+// A Transport handles a single [net.PacketConn], and offers a range of configuration options
+// compared to the simple helper functions like [Listen] and [Dial] that this package provides.
+type Transport struct {
+	// A single [net.PacketConn] can only be handled by one Transport.
+	// Bad things will happen if passed to multiple Transports.
+	//
+	// A number of optimizations will be enabled if the connection implements [OOBCapablePacketConn],
+	// as a [net.UDPConn] does.
+	// 1. It enables the Don't Fragment (DF) bit on the IP header.
+	//    This is required to run DPLPMTUD (Path MTU Discovery, RFC 8899).
+	// 2. It enables reading of the ECN bits from the IP header.
+	//    This allows the remote node to speed up its loss detection and recovery.
+	// 3. It uses batched syscalls (recvmmsg) to more efficiently receive packets from the socket.
+	// 4. It uses Generic Segmentation Offload (GSO) to efficiently send batches of packets (on Linux).
+	//
+	// After passing the connection to the Transport, it's invalid to call [net.PacketConn.ReadFrom],
+	// [net.PacketConn.WriteTo], [OOBCapablePacketConn.ReadMsgUDP], or
+	// [OOBCapablePacketConn.WriteMsgUDP] on the connection.
+	Conn net.PacketConn
+
+	// The length of the connection ID in bytes.
+	// It can be any value between 1 and 20.
+	// Due to the increased risk of collisions, it is not recommended to use connection IDs shorter than 4 bytes.
+	// If unset, a 4 byte connection ID will be used.
+	ConnectionIDLength int
+
+	// Use for generating new connection IDs.
+	// This allows the application to control of the connection IDs used,
+	// which allows routing / load balancing based on connection IDs.
+	// All Connection IDs returned by the ConnectionIDGenerator MUST
+	// have the same length.
+	ConnectionIDGenerator ConnectionIDGenerator
+
+	// The StatelessResetKey is used to generate stateless reset tokens.
+	// If no key is configured, sending of stateless resets is disabled.
+	// It is highly recommended to configure a stateless reset key, as stateless resets
+	// allow the peer to quickly recover from crashes and reboots of this node.
+	// See section 10.3 of RFC 9000 for details.
+	StatelessResetKey *StatelessResetKey
+
+	// The TokenGeneratorKey is used to encrypt session resumption tokens.
+	// If no key is configured, a random key will be generated.
+	// If multiple servers are authoritative for the same domain, they should use the same key,
+	// see section 8.1.3 of RFC 9000 for details.
+	TokenGeneratorKey *TokenGeneratorKey
+
+	// MaxTokenAge is the maximum age of the resumption token presented during the handshake.
+	// These tokens allow skipping address resumption when resuming a QUIC connection,
+	// and are especially useful when using 0-RTT.
+	// If not set, it defaults to 24 hours.
+	// See section 8.1.3 of RFC 9000 for details.
+	MaxTokenAge time.Duration
+
+	// DisableVersionNegotiationPackets disables the sending of Version Negotiation packets.
+	// This can be useful if version information is exchanged out-of-band.
+	// It has no effect for clients.
+	DisableVersionNegotiationPackets bool
+
+	// VerifySourceAddress decides if a connection attempt originating from unvalidated source
+	// addresses first needs to go through source address validation using QUIC's Retry mechanism,
+	// as described in RFC 9000 section 8.1.2.
+	// Note that the address passed to this callback is unvalidated, and might be spoofed in case
+	// of an attack.
+	// Validating the source address adds one additional network roundtrip to the handshake,
+	// and should therefore only be used if a suspiciously high number of incoming connection is recorded.
+	// For most use cases, wrapping the Allow function of a rate.Limiter will be a reasonable
+	// implementation of this callback (negating its return value).
+	VerifySourceAddress func(net.Addr) bool
+
+	// ConnContext is called when the server accepts a new connection. To reject a connection return
+	// a non-nil error.
+	// The context is closed when the connection is closed, or when the handshake fails for any reason.
+	// The context returned from the callback is used to derive every other context used during the
+	// lifetime of the connection:
+	// * the context passed to crypto/tls (and used on the [tls.ClientHelloInfo])
+	// * the context used by [Config.Tracer]
+	// * the context returned from [Conn.Context]
+	// * the context returned from [SendStream.Context]
+	// It is not used for dialed connections.
+	ConnContext func(context.Context, *ClientInfo) (context.Context, error)
+
+	// A Tracer traces events that don't belong to a single QUIC connection.
+	// The [qlogwriter.Recorder] is closed when the transport is closed.
+	Tracer qlogwriter.Recorder
+
+	mutex       sync.Mutex
+	handlers    map[protocol.ConnectionID]packetHandler
+	resetTokens map[protocol.StatelessResetToken]packetHandler
+
+	initOnce sync.Once
+	initErr  error
+
+	// If no ConnectionIDGenerator is set, this is the ConnectionIDLength.
+	connIDLen int
+	// Set in init.
+	// If no ConnectionIDGenerator is set, this is set to a default.
+	connIDGenerator   ConnectionIDGenerator
+	statelessResetter *statelessResetter
+
+	server *baseServer
+
+	conn rawConn
+
+	closeQueue          chan closePacket
+	statelessResetQueue chan receivedPacket
+
+	listening   chan struct{} // is closed when listen returns
+	closeErr    error
+	createdConn bool
+	isSingleUse bool // was created for a single server or client, i.e. by calling quic.Listen or quic.Dial
+
+	readingNonQUICPackets atomic.Bool
+	nonQUICPackets        chan receivedPacket
+
+	logger utils.Logger
+}
+
+// Listen starts listening for incoming QUIC connections.
+// There can only be a single listener on any net.PacketConn.
+// Listen may only be called again after the current listener was closed.
+func (t *Transport) Listen(tlsConf *tls.Config, conf *Config) (*Listener, error) {
+	s, err := t.createServer(tlsConf, conf, false)
+	if err != nil {
+		return nil, err
+	}
+	return &Listener{baseServer: s}, nil
+}
+
+// ListenEarly starts listening for incoming QUIC connections.
+// There can only be a single listener on any net.PacketConn.
+// ListenEarly may only be called again after the current listener was closed.
+func (t *Transport) ListenEarly(tlsConf *tls.Config, conf *Config) (*EarlyListener, error) {
+	s, err := t.createServer(tlsConf, conf, true)
+	if err != nil {
+		return nil, err
+	}
+	return &EarlyListener{baseServer: s}, nil
+}
+
+func (t *Transport) createServer(tlsConf *tls.Config, conf *Config, allow0RTT bool) (*baseServer, error) {
+	if tlsConf == nil {
+		return nil, errors.New("quic: tls.Config not set")
+	}
+	if err := validateConfig(conf); err != nil {
+		return nil, err
+	}
+
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	if t.closeErr != nil {
+		return nil, t.closeErr
+	}
+	if t.server != nil {
+		return nil, errListenerAlreadySet
+	}
+	conf = populateConfig(conf)
+	if err := t.init(false); err != nil {
+		return nil, err
+	}
+	maxTokenAge := t.MaxTokenAge
+	if maxTokenAge == 0 {
+		maxTokenAge = 24 * time.Hour
+	}
+	s := newServer(
+		t.conn,
+		(*packetHandlerMap)(t),
+		t.connIDGenerator,
+		t.statelessResetter,
+		t.ConnContext,
+		tlsConf,
+		conf,
+		t.Tracer,
+		t.closeServer,
+		*t.TokenGeneratorKey,
+		maxTokenAge,
+		t.VerifySourceAddress,
+		t.DisableVersionNegotiationPackets,
+		allow0RTT,
+	)
+	t.server = s
+	return s, nil
+}
+
+// Dial dials a new connection to a remote host (not using 0-RTT).
+func (t *Transport) Dial(ctx context.Context, addr net.Addr, tlsConf *tls.Config, conf *Config) (*Conn, error) {
+	return t.dial(ctx, addr, "", tlsConf, conf, false)
+}
+
+// DialEarly dials a new connection, attempting to use 0-RTT if possible.
+func (t *Transport) DialEarly(ctx context.Context, addr net.Addr, tlsConf *tls.Config, conf *Config) (*Conn, error) {
+	return t.dial(ctx, addr, "", tlsConf, conf, true)
+}
+
+func (t *Transport) dial(ctx context.Context, addr net.Addr, host string, tlsConf *tls.Config, conf *Config, use0RTT bool) (*Conn, error) {
+	if err := t.init(t.isSingleUse); err != nil {
+		return nil, err
+	}
+	if err := validateConfig(conf); err != nil {
+		return nil, err
+	}
+	conf = populateConfig(conf)
+	tlsConf = tlsConf.Clone()
+	setTLSConfigServerName(tlsConf, addr, host)
+	return t.doDial(ctx,
+		newSendConn(t.conn, addr, packetInfo{}, utils.DefaultLogger),
+		tlsConf,
+		conf,
+		0,
+		false,
+		use0RTT,
+		conf.Versions[0],
+	)
+}
+
+func (t *Transport) doDial(
+	ctx context.Context,
+	sendConn sendConn,
+	tlsConf *tls.Config,
+	config *Config,
+	initialPacketNumber protocol.PacketNumber,
+	hasNegotiatedVersion bool,
+	use0RTT bool,
+	version protocol.Version,
+) (*Conn, error) {
+	srcConnID, err := t.connIDGenerator.GenerateConnectionID()
+	if err != nil {
+		return nil, err
+	}
+	destConnID, err := generateConnectionIDForInitial()
+	if err != nil {
+		return nil, err
+	}
+
+	t.mutex.Lock()
+	if t.closeErr != nil {
+		t.mutex.Unlock()
+		return nil, t.closeErr
+	}
+
+	var qlogTrace qlogwriter.Trace
+	if config.Tracer != nil {
+		qlogTrace = config.Tracer(ctx, true, destConnID)
+	}
+
+	logger := utils.DefaultLogger.WithPrefix("client")
+	logger.Infof("Starting new connection to %s (%s -> %s), source connection ID %s, destination connection ID %s, version %s", tlsConf.ServerName, sendConn.LocalAddr(), sendConn.RemoteAddr(), srcConnID, destConnID, version)
+
+	conn := newClientConnection(
+		context.WithoutCancel(ctx),
+		sendConn,
+		(*packetHandlerMap)(t),
+		destConnID,
+		srcConnID,
+		t.connIDGenerator,
+		t.statelessResetter,
+		config,
+		tlsConf,
+		initialPacketNumber,
+		use0RTT,
+		hasNegotiatedVersion,
+		qlogTrace,
+		logger,
+		version,
+	)
+	t.handlers[srcConnID] = conn
+	t.mutex.Unlock()
+
+	// The error channel needs to be buffered, as the run loop will continue running
+	// after doDial returns (if the handshake is successful).
+	// Similarly, the recreateChan needs to be buffered; in case a different case is selected.
+	errChan := make(chan error, 1)
+	recreateChan := make(chan errCloseForRecreating, 1)
+	go func() {
+		err := conn.run()
+		if recreateErr, ok := errors.AsType[*errCloseForRecreating](err); ok {
+			recreateChan <- *recreateErr
+			return
+		}
+		if t.isSingleUse {
+			t.Close()
+		}
+		errChan <- err
+	}()
+
+	// Only set when we're using 0-RTT.
+	// Otherwise, earlyConnChan will be nil. Receiving from a nil chan blocks forever.
+	var earlyConnChan <-chan struct{}
+	if use0RTT {
+		earlyConnChan = conn.earlyConnReady()
+	}
+
+	select {
+	case <-ctx.Done():
+		conn.destroy(nil)
+		// wait until the Go routine that called Conn.run() returns
+		select {
+		case <-errChan:
+		case <-recreateChan:
+		}
+		return nil, context.Cause(ctx)
+	case params := <-recreateChan:
+		return t.doDial(ctx,
+			sendConn,
+			tlsConf,
+			config,
+			params.nextPacketNumber,
+			true,
+			use0RTT,
+			params.nextVersion,
+		)
+	case err := <-errChan:
+		return nil, err
+	case <-earlyConnChan:
+		// ready to send 0-RTT data
+		return conn.Conn, nil
+	case <-conn.HandshakeComplete():
+		// handshake successfully completed
+		return conn.Conn, nil
+	}
+}
+
+func (t *Transport) init(allowZeroLengthConnIDs bool) error {
+	t.initOnce.Do(func() {
+		var conn rawConn
+		if c, ok := t.Conn.(rawConn); ok {
+			conn = c
+		} else {
+			var err error
+			conn, err = wrapConn(t.Conn)
+			if err != nil {
+				t.initErr = err
+				return
+			}
+		}
+
+		t.logger = utils.DefaultLogger // TODO: make this configurable
+		t.conn = conn
+		t.handlers = make(map[protocol.ConnectionID]packetHandler)
+		t.resetTokens = make(map[protocol.StatelessResetToken]packetHandler)
+		t.listening = make(chan struct{})
+
+		t.closeQueue = make(chan closePacket, 4)
+		t.statelessResetQueue = make(chan receivedPacket, 4)
+		if t.TokenGeneratorKey == nil {
+			var key TokenGeneratorKey
+			if _, err := rand.Read(key[:]); err != nil {
+				t.initErr = err
+				return
+			}
+			t.TokenGeneratorKey = &key
+		}
+
+		if t.ConnectionIDGenerator != nil {
+			t.connIDGenerator = t.ConnectionIDGenerator
+			t.connIDLen = t.ConnectionIDGenerator.ConnectionIDLen()
+		} else {
+			connIDLen := t.ConnectionIDLength
+			if t.ConnectionIDLength == 0 && !allowZeroLengthConnIDs {
+				connIDLen = protocol.DefaultConnectionIDLength
+			}
+			t.connIDLen = connIDLen
+			t.connIDGenerator = &protocol.DefaultConnectionIDGenerator{ConnLen: t.connIDLen}
+		}
+		t.statelessResetter = newStatelessResetter(t.StatelessResetKey)
+
+		go func() {
+			defer close(t.listening)
+			t.listen(conn)
+
+			if t.createdConn {
+				conn.Close()
+			}
+		}()
+		go t.runSendQueue()
+	})
+	return t.initErr
+}
+
+// WriteTo sends a packet on the underlying connection.
+func (t *Transport) WriteTo(b []byte, addr net.Addr) (int, error) {
+	if err := t.init(false); err != nil {
+		return 0, err
+	}
+	return t.conn.WritePacket(b, addr, nil, 0, protocol.ECNUnsupported)
+}
+
+func (t *Transport) runSendQueue() {
+	for {
+		select {
+		case <-t.listening:
+			return
+		case p := <-t.closeQueue:
+			t.conn.WritePacket(p.payload, p.addr, p.info.OOB(), 0, protocol.ECNUnsupported)
+		case p := <-t.statelessResetQueue:
+			t.sendStatelessReset(p)
+		}
+	}
+}
+
+// Close stops listening for UDP datagrams on [Transport.Conn].
+// It abruptly terminates all existing connections, without sending a CONNECTION_CLOSE
+// to the peers. It is the application's responsibility to cleanly terminate existing
+// connections prior to calling Close.
+//
+// If a server was started, it will be closed as well.
+// It is not possible to start any new server or dial new connections after that.
+func (t *Transport) Close() error {
+	// avoid race condition if the transport is currently being initialized
+	t.init(false)
+
+	t.close(nil)
+	if t.createdConn {
+		if err := t.Conn.Close(); err != nil {
+			return err
+		}
+	} else if t.conn != nil {
+		t.conn.SetReadDeadline(time.Now())
+		defer func() { t.conn.SetReadDeadline(time.Time{}) }()
+	}
+	if t.listening != nil {
+		<-t.listening // wait until listening returns
+	}
+	return nil
+}
+
+func (t *Transport) closeServer() {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	t.server = nil
+	if t.isSingleUse {
+		t.closeErr = ErrServerClosed
+	}
+
+	if len(t.handlers) == 0 {
+		t.maybeStopListening()
+	}
+}
+
+func (t *Transport) close(e error) {
+	t.mutex.Lock()
+
+	if t.closeErr != nil {
+		t.mutex.Unlock()
+		return
+	}
+
+	e = &errTransportClosed{err: e}
+	t.closeErr = e
+	server := t.server
+	t.server = nil
+	if server != nil {
+		t.mutex.Unlock()
+		server.close(e, true)
+		t.mutex.Lock()
+	}
+
+	// Close existing connections
+	var wg sync.WaitGroup
+	for _, handler := range t.handlers {
+		wg.Go(func() { handler.destroy(e) })
+	}
+	t.mutex.Unlock() // closing connections requires releasing transport mutex
+	wg.Wait()
+
+	if t.Tracer != nil {
+		t.Tracer.Close()
+	}
+}
+
+// only print warnings about the UDP receive buffer size once
+var setBufferWarningOnce sync.Once
+
+func (t *Transport) listen(conn rawConn) {
+	for {
+		p, err := conn.ReadPacket()
+		//nolint:staticcheck // SA1019 ignore this!
+		// TODO: This code is used to ignore wsa errors on Windows.
+		// Since net.Error.Temporary is deprecated as of Go 1.18, we should find a better solution.
+		// See https://github.com/quic-go/quic-go/issues/1737 for details.
+		if nerr, ok := err.(net.Error); ok && nerr.Temporary() {
+			t.mutex.Lock()
+			closed := t.closeErr != nil
+			t.mutex.Unlock()
+			if closed {
+				return
+			}
+			t.logger.Debugf("Temporary error reading from conn: %w", err)
+			continue
+		}
+		if err != nil {
+			// Windows returns an error when receiving a UDP datagram that doesn't fit into the provided buffer.
+			if isRecvMsgSizeErr(err) {
+				continue
+			}
+			t.close(err)
+			return
+		}
+		t.handlePacket(p)
+	}
+}
+
+func (t *Transport) maybeStopListening() {
+	if t.isSingleUse && t.closeErr != nil {
+		t.conn.SetReadDeadline(time.Now())
+	}
+}
+
+func (t *Transport) handlePacket(p receivedPacket) {
+	if len(p.data) == 0 {
+		return
+	}
+	if !wire.IsPotentialQUICPacket(p.data[0]) && !wire.IsLongHeaderPacket(p.data[0]) {
+		t.handleNonQUICPacket(p)
+		return
+	}
+	connID, err := wire.ParseConnectionID(p.data, t.connIDLen)
+	if err != nil {
+		t.logger.Debugf("error parsing connection ID on packet from %s: %s", p.remoteAddr, err)
+		if t.Tracer != nil {
+			t.Tracer.RecordEvent(qlog.PacketDropped{
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropHeaderParseError,
+			})
+		}
+		p.buffer.MaybeRelease()
+		return
+	}
+
+	// If there's a connection associated with the connection ID, pass the packet there.
+	if handler, ok := (*packetHandlerMap)(t).Get(connID); ok {
+		handler.handlePacket(p)
+		return
+	}
+	// RFC 9000 section 10.3.1 requires that the stateless reset detection logic is run for both
+	// packets that cannot be associated with any connections, and for packets that can't be decrypted.
+	// We deviate from the RFC and ignore the latter: If a packet's connection ID is associated with an
+	// existing connection, it is dropped there if if it can't be decrypted.
+	// Stateless resets use random connection IDs, and at reasonable connection ID lengths collisions are
+	// exceedingly rare. In the unlikely event that a stateless reset is misrouted to an existing connection,
+	// it is to be expected that the next stateless reset will be correctly detected.
+	if isStatelessReset := t.maybeHandleStatelessReset(p.data); isStatelessReset {
+		return
+	}
+	if !wire.IsLongHeaderPacket(p.data[0]) {
+		if statelessResetQueued := t.maybeSendStatelessReset(p); !statelessResetQueued {
+			if t.Tracer != nil {
+				t.Tracer.RecordEvent(qlog.PacketDropped{
+					Header:  qlog.PacketHeader{PacketType: qlog.PacketType1RTT},
+					Raw:     qlog.RawInfo{Length: int(p.Size())},
+					Trigger: qlog.PacketDropUnknownConnectionID,
+				})
+			}
+			p.buffer.Release()
+		}
+		return
+	}
+
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+	if t.server == nil { // no server set
+		t.logger.Debugf("received a packet with an unexpected connection ID %s", connID)
+		if t.Tracer != nil {
+			t.Tracer.RecordEvent(qlog.PacketDropped{
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropUnknownConnectionID,
+			})
+		}
+		p.buffer.MaybeRelease()
+		return
+	}
+	t.server.handlePacket(p)
+}
+
+func (t *Transport) maybeSendStatelessReset(p receivedPacket) (statelessResetQueued bool) {
+	if t.StatelessResetKey == nil {
+		return false
+	}
+
+	// Don't send a stateless reset in response to very small packets.
+	// This includes packets that could be stateless resets.
+	if len(p.data) <= protocol.MinStatelessResetSize {
+		return false
+	}
+
+	select {
+	case t.statelessResetQueue <- p:
+		return true
+	default:
+		// it's fine to not send a stateless reset when we're busy
+		return false
+	}
+}
+
+func (t *Transport) sendStatelessReset(p receivedPacket) {
+	defer p.buffer.Release()
+
+	connID, err := wire.ParseConnectionID(p.data, t.connIDLen)
+	if err != nil {
+		t.logger.Errorf("error parsing connection ID on packet from %s: %s", p.remoteAddr, err)
+		return
+	}
+	token := t.statelessResetter.GetStatelessResetToken(connID)
+	t.logger.Debugf("Sending stateless reset to %s (connection ID: %s). Token: %#x", p.remoteAddr, connID, token)
+	data := make([]byte, protocol.MinStatelessResetSize-16, protocol.MinStatelessResetSize)
+	rand.Read(data)
+	data[0] = (data[0] & 0x7f) | 0x40
+	data = append(data, token[:]...)
+	if _, err := t.conn.WritePacket(data, p.remoteAddr, p.info.OOB(), 0, protocol.ECNUnsupported); err != nil {
+		t.logger.Debugf("Error sending Stateless Reset to %s: %s", p.remoteAddr, err)
+	}
+}
+
+func (t *Transport) maybeHandleStatelessReset(data []byte) bool {
+	// stateless resets are always short header packets
+	if wire.IsLongHeaderPacket(data[0]) {
+		return false
+	}
+	if len(data) < 17 /* type byte + 16 bytes for the reset token */ {
+		return false
+	}
+
+	token := protocol.StatelessResetToken(data[len(data)-16:])
+	t.mutex.Lock()
+	conn, ok := t.resetTokens[token]
+	t.mutex.Unlock()
+
+	if ok {
+		t.logger.Debugf("Received a stateless reset with token %#x. Closing connection.", token)
+		go conn.destroy(&StatelessResetError{})
+		return true
+	}
+	return false
+}
+
+func (t *Transport) handleNonQUICPacket(p receivedPacket) {
+	// Strictly speaking, this is racy,
+	// but we only care about receiving packets at some point after ReadNonQUICPacket has been called.
+	if !t.readingNonQUICPackets.Load() {
+		return
+	}
+	select {
+	case t.nonQUICPackets <- p:
+	default:
+		if t.Tracer != nil {
+			t.Tracer.RecordEvent(qlog.PacketDropped{
+				Raw:     qlog.RawInfo{Length: int(p.Size())},
+				Trigger: qlog.PacketDropDOSPrevention,
+			})
+		}
+	}
+}
+
+const maxQueuedNonQUICPackets = 32
+
+// ReadNonQUICPacket reads non-QUIC packets received on the underlying connection.
+// The detection logic is very simple: Any packet that has the first and second bit of the packet set to 0.
+// Note that this is stricter than the detection logic defined in RFC 9443.
+func (t *Transport) ReadNonQUICPacket(ctx context.Context, b []byte) (int, net.Addr, error) {
+	if err := t.init(false); err != nil {
+		return 0, nil, err
+	}
+	if !t.readingNonQUICPackets.Load() {
+		t.nonQUICPackets = make(chan receivedPacket, maxQueuedNonQUICPackets)
+		t.readingNonQUICPackets.Store(true)
+	}
+	select {
+	case <-ctx.Done():
+		return 0, nil, ctx.Err()
+	case p := <-t.nonQUICPackets:
+		n := copy(b, p.data)
+		return n, p.remoteAddr, nil
+	case <-t.listening:
+		return 0, nil, errors.New("closed")
+	}
+}
+
+func setTLSConfigServerName(tlsConf *tls.Config, addr net.Addr, host string) {
+	// If no ServerName is set, infer the ServerName from the host we're connecting to.
+	if tlsConf.ServerName != "" {
+		return
+	}
+	if host == "" {
+		if udpAddr, ok := addr.(*net.UDPAddr); ok {
+			tlsConf.ServerName = udpAddr.IP.String()
+			return
+		}
+	}
+	h, _, err := net.SplitHostPort(host)
+	if err != nil { // This happens if the host doesn't contain a port number.
+		tlsConf.ServerName = host
+		return
+	}
+	tlsConf.ServerName = h
+}
+
+type packetHandlerMap Transport
+
+var _ connRunner = &packetHandlerMap{}
+
+func (h *packetHandlerMap) Add(id protocol.ConnectionID, handler packetHandler) bool /* was added */ {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+
+	if _, ok := h.handlers[id]; ok {
+		h.logger.Debugf("Not adding connection ID %s, as it already exists.", id)
+		return false
+	}
+	h.handlers[id] = handler
+	h.logger.Debugf("Adding connection ID %s.", id)
+	return true
+}
+
+func (h *packetHandlerMap) Get(connID protocol.ConnectionID) (packetHandler, bool) {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+	handler, ok := h.handlers[connID]
+	return handler, ok
+}
+
+func (h *packetHandlerMap) AddResetToken(token protocol.StatelessResetToken, handler packetHandler) {
+	h.mutex.Lock()
+	h.resetTokens[token] = handler
+	h.mutex.Unlock()
+}
+
+func (h *packetHandlerMap) RemoveResetToken(token protocol.StatelessResetToken) {
+	h.mutex.Lock()
+	delete(h.resetTokens, token)
+	h.mutex.Unlock()
+}
+
+func (h *packetHandlerMap) AddWithConnID(clientDestConnID, newConnID protocol.ConnectionID, handler packetHandler) bool {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+
+	if _, ok := h.handlers[clientDestConnID]; ok {
+		h.logger.Debugf("Not adding connection ID %s for a new connection, as it already exists.", clientDestConnID)
+		return false
+	}
+	h.handlers[clientDestConnID] = handler
+	h.handlers[newConnID] = handler
+	h.logger.Debugf("Adding connection IDs %s and %s for a new connection.", clientDestConnID, newConnID)
+	return true
+}
+
+func (h *packetHandlerMap) Remove(id protocol.ConnectionID) {
+	h.mutex.Lock()
+	delete(h.handlers, id)
+	h.mutex.Unlock()
+	h.logger.Debugf("Removing connection ID %s.", id)
+}
+
+// ReplaceWithClosed is called when a connection is closed.
+// Depending on which side closed the connection, we need to:
+// * remote close: absorb delayed packets
+// * local close: retransmit the CONNECTION_CLOSE packet, in case it was lost
+func (h *packetHandlerMap) ReplaceWithClosed(ids []protocol.ConnectionID, connClosePacket []byte, expiry time.Duration) {
+	var handler packetHandler
+	if connClosePacket != nil {
+		handler = newClosedLocalConn(
+			func(addr net.Addr, info packetInfo) {
+				select {
+				case h.closeQueue <- closePacket{payload: connClosePacket, addr: addr, info: info}:
+				default:
+					// We're backlogged.
+					// Just drop the packet, sending CONNECTION_CLOSE copies is best effort anyway.
+				}
+			},
+			h.logger,
+		)
+	} else {
+		handler = newClosedRemoteConn()
+	}
+
+	h.mutex.Lock()
+	for _, id := range ids {
+		h.handlers[id] = handler
+	}
+	h.mutex.Unlock()
+	h.logger.Debugf("Replacing connection for connection IDs %s with a closed connection.", ids)
+
+	time.AfterFunc(expiry, func() {
+		h.mutex.Lock()
+		for _, id := range ids {
+			delete(h.handlers, id)
+		}
+		if len(h.handlers) == 0 {
+			t := (*Transport)(h)
+			t.maybeStopListening()
+		}
+		h.mutex.Unlock()
+		h.logger.Debugf("Removing connection IDs %s for a closed connection after it has been retired.", ids)
+	})
+}
diff --git a/electron/native/private-transport/third_party/quic-go/transport_test.go b/electron/native/private-transport/third_party/quic-go/transport_test.go
new file mode 100644
index 000000000..03f3491ac
--- /dev/null
+++ b/electron/native/private-transport/third_party/quic-go/transport_test.go
@@ -0,0 +1,739 @@
+package quic
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"math"
+	"net"
+	"sync/atomic"
+	"syscall"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/qerr"
+	"github.com/quic-go/quic-go/internal/utils"
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/quic-go/quic-go/qlogwriter"
+	"github.com/quic-go/quic-go/testutils/events"
+	"github.com/quic-go/quic-go/testutils/simnet"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type mockPacketConn struct {
+	localAddr net.Addr
+	readErrs  chan error
+}
+
+func (c *mockPacketConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
+	err, ok := <-c.readErrs
+	if !ok {
+		return 0, nil, net.ErrClosed
+	}
+	return 0, nil, err
+}
+
+func (c *mockPacketConn) WriteTo(p []byte, addr net.Addr) (n int, err error) { panic("implement me") }
+func (c *mockPacketConn) LocalAddr() net.Addr                                { return c.localAddr }
+func (c *mockPacketConn) Close() error                                       { close(c.readErrs); return nil }
+func (c *mockPacketConn) SetDeadline(t time.Time) error                      { return nil }
+func (c *mockPacketConn) SetReadDeadline(t time.Time) error                  { return nil }
+func (c *mockPacketConn) SetWriteDeadline(t time.Time) error                 { return nil }
+
+type mockPacketHandler struct {
+	packets     chan<- receivedPacket
+	destruction chan<- error
+}
+
+func (h *mockPacketHandler) handlePacket(p receivedPacket) {
+	h.packets <- p
+}
+
+func (h *mockPacketHandler) destroy(err error) {
+	if h.destruction != nil {
+		h.destruction <- err
+	}
+}
+
+func (h *mockPacketHandler) closeWithTransportError(code qerr.TransportErrorCode) {}
+
+func newSimnetLink(t *testing.T, rtt time.Duration) (client, server net.PacketConn, close func()) {
+	t.Helper()
+
+	n := &simnet.Simnet{Router: &simnet.PerfectRouter{}}
+	settings := simnet.NodeBiDiLinkSettings{Latency: rtt / 2}
+
+	client = n.NewEndpoint(&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 9001}, settings)
+	server = n.NewEndpoint(&net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 9002}, settings)
+	require.NoError(t, n.Start())
+	return client, server, func() {
+		require.NoError(t, n.Close())
+	}
+}
+
+func TestTransportPacketHandling(t *testing.T) {
+	tr := &Transport{Conn: newUDPConnLocalhost(t)}
+	tr.init(true)
+	defer tr.Close()
+
+	connID1 := protocol.ParseConnectionID([]byte{1, 2, 3, 4, 5, 6, 7, 8})
+	connID2 := protocol.ParseConnectionID([]byte{8, 7, 6, 5, 4, 3, 2, 1})
+
+	connChan1 := make(chan receivedPacket, 1)
+	conn1 := &mockPacketHandler{packets: connChan1}
+	(*packetHandlerMap)(tr).Add(connID1, conn1)
+	connChan2 := make(chan receivedPacket, 1)
+	conn2 := &mockPacketHandler{packets: connChan2}
+	(*packetHandlerMap)(tr).Add(connID2, conn2)
+
+	conn := newUDPConnLocalhost(t)
+	_, err := conn.WriteTo(getPacket(t, connID1), tr.Conn.LocalAddr())
+	require.NoError(t, err)
+	_, err = conn.WriteTo(getPacket(t, connID2), tr.Conn.LocalAddr())
+	require.NoError(t, err)
+
+	select {
+	case p := <-connChan1:
+		require.Equal(t, conn.LocalAddr(), p.remoteAddr)
+		connID, err := wire.ParseConnectionID(p.data, 0)
+		require.NoError(t, err)
+		require.Equal(t, connID1, connID)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	select {
+	case p := <-connChan2:
+		require.Equal(t, conn.LocalAddr(), p.remoteAddr)
+		connID, err := wire.ParseConnectionID(p.data, 0)
+		require.NoError(t, err)
+		require.Equal(t, connID2, connID)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestTransportAndListenerConcurrentClose(t *testing.T) {
+	tr := &Transport{Conn: newUDPConnLocalhost(t)}
+	ln, err := tr.Listen(&tls.Config{}, nil)
+	require.NoError(t, err)
+	// close transport and listener concurrently
+	lnErrChan := make(chan error, 1)
+	go func() { lnErrChan <- ln.Close() }()
+	require.NoError(t, tr.Close())
+	select {
+	case err := <-lnErrChan:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestTransportAndDialConcurrentClose(t *testing.T) {
+	server := newUDPConnLocalhost(t)
+
+	tr := &Transport{Conn: newUDPConnLocalhost(t)}
+	// close transport and dial concurrently
+	errChan := make(chan error, 1)
+	go func() { errChan <- tr.Close() }()
+	ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond)
+	defer cancel()
+	_, err := tr.Dial(ctx, server.LocalAddr(), &tls.Config{}, nil)
+	require.Error(t, err)
+	require.ErrorIs(t, err, ErrTransportClosed)
+	require.NotErrorIs(t, err, context.DeadlineExceeded)
+
+	select {
+	case <-errChan:
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestTransportErrFromConn(t *testing.T) {
+	t.Setenv("QUIC_GO_DISABLE_RECEIVE_BUFFER_WARNING", "true")
+
+	synctest.Test(t, func(t *testing.T) {
+		readErrChan := make(chan error, 2)
+		tr := Transport{
+			Conn: &mockPacketConn{
+				readErrs:  readErrChan,
+				localAddr: &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 1234},
+			},
+		}
+		defer tr.Close()
+		tr.init(true)
+
+		errChan := make(chan error, 1)
+		ph := &mockPacketHandler{destruction: errChan}
+		(*packetHandlerMap)(&tr).Add(protocol.ParseConnectionID([]byte{1, 2, 3, 4}), ph)
+
+		// temporary errors don't lead to a shutdown...
+		var tempErr deadlineError
+		require.True(t, tempErr.Temporary())
+		readErrChan <- tempErr
+		// don't expect any calls to phm.Close
+		synctest.Wait()
+
+		// ...but non-temporary errors do
+		readErrChan <- errors.New("read failed")
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.ErrorIs(t, err, ErrTransportClosed)
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+
+		_, err := tr.Listen(&tls.Config{}, nil)
+		require.ErrorIs(t, err, ErrTransportClosed)
+	})
+}
+
+func TestTransportStatelessResetReceiving(t *testing.T) {
+	tr := &Transport{
+		Conn:               newUDPConnLocalhost(t),
+		ConnectionIDLength: 4,
+	}
+	tr.init(true)
+	defer tr.Close()
+
+	connID := protocol.ParseConnectionID([]byte{9, 10, 11, 12})
+	// now send a packet with a connection ID that doesn't exist
+	token := protocol.StatelessResetToken{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
+	b, err := wire.AppendShortHeader(nil, connID, 1337, 2, protocol.KeyPhaseOne)
+	require.NoError(t, err)
+	b = append(b, token[:]...)
+
+	destroyChan := make(chan error, 1)
+	conn1 := &mockPacketHandler{destruction: destroyChan}
+	(*packetHandlerMap)(tr).AddResetToken(token, conn1)
+
+	conn := newUDPConnLocalhost(t)
+	_, err = conn.WriteTo(b, tr.Conn.LocalAddr())
+	require.NoError(t, err)
+
+	select {
+	case err := <-destroyChan:
+		require.ErrorIs(t, err, &qerr.StatelessResetError{})
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestTransportStatelessResetSending(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 10 * time.Millisecond
+		clientConn, serverConn, closeFn := newSimnetLink(t, rtt)
+		defer closeFn()
+
+		var eventRecorder events.Recorder
+		tr := &Transport{
+			Conn:               serverConn,
+			ConnectionIDLength: 4,
+			StatelessResetKey:  &StatelessResetKey{1, 2, 3, 4},
+			Tracer:             &eventRecorder,
+		}
+		tr.init(true)
+		defer tr.Close()
+
+		connID := protocol.ParseConnectionID([]byte{9, 10, 11, 12})
+
+		// now send a packet with a connection ID that doesn't exist
+		b, err := wire.AppendShortHeader(nil, connID, 1337, 2, protocol.KeyPhaseOne)
+		require.NoError(t, err)
+
+		// no stateless reset sent for packets smaller than MinStatelessResetSize
+		smallPacket := append(b, make([]byte, protocol.MinStatelessResetSize-len(b))...)
+		_, err = clientConn.WriteTo(smallPacket, tr.Conn.LocalAddr())
+		require.NoError(t, err)
+
+		time.Sleep(rtt) // so that the packet arrives at the server
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Header:  qlog.PacketHeader{PacketType: qlog.PacketType1RTT},
+					Raw:     qlog.RawInfo{Length: len(smallPacket)},
+					Trigger: qlog.PacketDropUnknownConnectionID,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+
+		// but a stateless reset is sent for packets larger than MinStatelessResetSize
+		_, err = clientConn.WriteTo(append(b, make([]byte, protocol.MinStatelessResetSize-len(b)+1)...), tr.Conn.LocalAddr())
+		require.NoError(t, err)
+		clientConn.SetReadDeadline(time.Now().Add(time.Second))
+		p := make([]byte, 1024)
+		n, addr, err := clientConn.ReadFrom(p)
+		require.NoError(t, err)
+		require.Equal(t, addr, tr.Conn.LocalAddr())
+		srt := newStatelessResetter(tr.StatelessResetKey).GetStatelessResetToken(connID)
+		require.Contains(t, string(p[:n]), string(srt[:]))
+	})
+}
+
+func TestTransportUnparseableQUICPackets(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 10 * time.Millisecond
+		clientConn, serverConn, closeFn := newSimnetLink(t, rtt)
+		defer closeFn()
+
+		var eventRecorder events.Recorder
+		tr := &Transport{
+			Conn:               serverConn,
+			ConnectionIDLength: 10,
+			Tracer:             &eventRecorder,
+		}
+		require.NoError(t, tr.init(true))
+		defer tr.Close()
+
+		_, err := clientConn.WriteTo([]byte{0x40 /* set the QUIC bit */, 1, 2, 3}, tr.Conn.LocalAddr())
+		require.NoError(t, err)
+
+		time.Sleep(rtt) // so that the packet arrives at the server
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Raw:     qlog.RawInfo{Length: 4},
+					Trigger: qlog.PacketDropHeaderParseError,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+	})
+}
+
+func TestTransportListening(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 10 * time.Millisecond
+		clientConn, serverConn, closeFn := newSimnetLink(t, rtt)
+		defer closeFn()
+
+		var eventRecorder events.Recorder
+		tr := &Transport{
+			Conn:               serverConn,
+			ConnectionIDLength: 5,
+			Tracer:             &eventRecorder,
+		}
+		require.NoError(t, tr.init(true))
+		defer tr.Close()
+
+		data := wire.ComposeVersionNegotiation([]byte{1, 2, 3, 4, 5}, []byte{6, 7, 8, 9, 10}, []protocol.Version{protocol.Version1})
+
+		_, err := clientConn.WriteTo(data, tr.Conn.LocalAddr())
+		require.NoError(t, err)
+
+		time.Sleep(rtt) // so that the packet arrives at the server
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Raw:     qlog.RawInfo{Length: len(data)},
+					Trigger: qlog.PacketDropUnknownConnectionID,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+		eventRecorder.Clear()
+
+		ln, err := tr.Listen(&tls.Config{}, nil)
+		require.NoError(t, err)
+
+		_, err = clientConn.WriteTo(data, tr.Conn.LocalAddr())
+		require.NoError(t, err)
+		time.Sleep(rtt) // so that the packet arrives at the server
+
+		require.Equal(t,
+			[]qlogwriter.Event{
+				qlog.PacketDropped{
+					Header:  qlog.PacketHeader{PacketType: qlog.PacketTypeVersionNegotiation},
+					Raw:     qlog.RawInfo{Length: len(data)},
+					Trigger: qlog.PacketDropUnexpectedPacket,
+				},
+			},
+			eventRecorder.Events(qlog.PacketDropped{}),
+		)
+
+		// only a single listener can be set
+		_, err = tr.Listen(&tls.Config{}, nil)
+		require.Error(t, err)
+		require.ErrorIs(t, err, errListenerAlreadySet)
+
+		require.NoError(t, ln.Close())
+		// now it's possible to add a new listener
+		ln, err = tr.Listen(&tls.Config{}, nil)
+		require.NoError(t, err)
+		defer ln.Close()
+	})
+}
+
+func TestTransportNonQUICPackets(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		const rtt = 10 * time.Millisecond
+		clientConn, serverConn, closeFn := newSimnetLink(t, rtt)
+		defer closeFn()
+
+		tr := &Transport{Conn: serverConn}
+		defer tr.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond)
+		defer cancel()
+		_, _, err := tr.ReadNonQUICPacket(ctx, make([]byte, 1024))
+		require.Error(t, err)
+		require.ErrorIs(t, err, context.DeadlineExceeded)
+
+		data := []byte{0 /* don't set the QUIC bit */, 1, 2, 3}
+		_, err = clientConn.WriteTo(data, tr.Conn.LocalAddr())
+		require.NoError(t, err)
+		_, err = clientConn.WriteTo(data, tr.Conn.LocalAddr())
+		require.NoError(t, err)
+
+		ctx, cancel = context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		b := make([]byte, 1024)
+		n, addr, err := tr.ReadNonQUICPacket(ctx, b)
+		require.NoError(t, err)
+		require.Equal(t, data, b[:n])
+		require.Equal(t, addr, clientConn.LocalAddr())
+
+		// now send a lot of packets without reading them
+		for i := range 2 * maxQueuedNonQUICPackets {
+			data := append([]byte{0 /* don't set the QUIC bit */, uint8(i)}, bytes.Repeat([]byte{uint8(i)}, 1000)...)
+			_, err = clientConn.WriteTo(data, tr.Conn.LocalAddr())
+			require.NoError(t, err)
+		}
+
+		time.Sleep(rtt) // so that all packets arrive at the server
+
+		var received int
+		for {
+			ctx, cancel = context.WithTimeout(context.Background(), 20*time.Millisecond)
+			defer cancel()
+			_, _, err := tr.ReadNonQUICPacket(ctx, b)
+			if errors.Is(err, context.DeadlineExceeded) {
+				break
+			}
+			require.NoError(t, err)
+			received++
+		}
+		require.Equal(t, received, maxQueuedNonQUICPackets)
+	})
+}
+
+type faultySyscallConn struct{ net.PacketConn }
+
+func (c *faultySyscallConn) SyscallConn() (syscall.RawConn, error) { return nil, assert.AnError }
+
+func TestTransportFaultySyscallConn(t *testing.T) {
+	syscallconn := &faultySyscallConn{PacketConn: newUDPConnLocalhost(t)}
+
+	tr := &Transport{Conn: syscallconn}
+	_, err := tr.Listen(&tls.Config{}, nil)
+	require.Error(t, err)
+	require.ErrorIs(t, err, assert.AnError)
+}
+
+func TestTransportSetTLSConfigServerName(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		expected string
+		conf     *tls.Config
+		host     string
+	}{
+		{
+			name:     "uses the value from the config",
+			expected: "foo.bar",
+			conf:     &tls.Config{ServerName: "foo.bar"},
+			host:     "baz.foo",
+		},
+		{
+			name:     "uses the hostname",
+			expected: "golang.org",
+			conf:     &tls.Config{},
+			host:     "golang.org",
+		},
+		{
+			name:     "removes the port from the hostname",
+			expected: "golang.org",
+			conf:     &tls.Config{},
+			host:     "golang.org:1234",
+		},
+		{
+			name:     "uses the IP",
+			expected: "1.3.5.7",
+			conf:     &tls.Config{},
+			host:     "",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			setTLSConfigServerName(tt.conf, &net.UDPAddr{IP: net.IPv4(1, 3, 5, 7), Port: 1234}, tt.host)
+			require.Equal(t, tt.expected, tt.conf.ServerName)
+		})
+	}
+}
+
+func TestTransportDial(t *testing.T) {
+	t.Run("regular", func(t *testing.T) {
+		testTransportDial(t, false)
+	})
+
+	t.Run("early", func(t *testing.T) {
+		testTransportDial(t, true)
+	})
+}
+
+func testTransportDial(t *testing.T, early bool) {
+	originalClientConnConstructor := newClientConnection
+	t.Cleanup(func() { newClientConnection = originalClientConnConstructor })
+
+	synctest.Test(t, func(t *testing.T) {
+		_, serverConn, closeFn := newSimnetLink(t, 10*time.Millisecond)
+		defer closeFn()
+
+		var conn *connTestHooks
+		handshakeChan := make(chan struct{})
+		blockRun := make(chan struct{})
+		if early {
+			conn = &connTestHooks{
+				earlyConnReady:    func() <-chan struct{} { return handshakeChan },
+				handshakeComplete: func() <-chan struct{} { return make(chan struct{}) },
+			}
+		} else {
+			conn = &connTestHooks{
+				handshakeComplete: func() <-chan struct{} { return handshakeChan },
+			}
+		}
+		conn.run = func() error { <-blockRun; return errors.New("done") }
+		defer close(blockRun)
+
+		newClientConnection = func(
+			_ context.Context,
+			_ sendConn,
+			_ connRunner,
+			_ protocol.ConnectionID,
+			_ protocol.ConnectionID,
+			_ ConnectionIDGenerator,
+			_ *statelessResetter,
+			_ *Config,
+			_ *tls.Config,
+			_ protocol.PacketNumber,
+			_ bool,
+			_ bool,
+			_ qlogwriter.Trace,
+			_ utils.Logger,
+			_ protocol.Version,
+		) *wrappedConn {
+			return &wrappedConn{testHooks: conn}
+		}
+
+		tr := &Transport{Conn: serverConn}
+		tr.init(true)
+		defer tr.Close()
+
+		errChan := make(chan error, 1)
+		go func() {
+			var err error
+			if early {
+				_, err = tr.DialEarly(context.Background(), nil, &tls.Config{}, nil)
+			} else {
+				_, err = tr.Dial(context.Background(), nil, &tls.Config{}, nil)
+			}
+			errChan <- err
+		}()
+
+		synctest.Wait()
+
+		select {
+		case <-errChan:
+			t.Fatal("Dial shouldn't have returned")
+		default:
+		}
+
+		close(handshakeChan)
+
+		synctest.Wait()
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		default:
+		}
+	})
+}
+
+func TestTransportDialingVersionNegotiation(t *testing.T) {
+	originalClientConnConstructor := newClientConnection
+	t.Cleanup(func() { newClientConnection = originalClientConnConstructor })
+
+	conn := &connTestHooks{
+		handshakeComplete: func() <-chan struct{} { return make(chan struct{}) },
+		run:               func() error { return &errCloseForRecreating{nextPacketNumber: 109, nextVersion: 789} },
+	}
+	conn2 := &connTestHooks{
+		handshakeComplete: func() <-chan struct{} { return make(chan struct{}) },
+		run:               func() error { return assert.AnError },
+	}
+
+	type connParams struct {
+		pn                   protocol.PacketNumber
+		hasNegotiatedVersion bool
+		version              protocol.Version
+	}
+
+	connChan := make(chan connParams, 2)
+	var counter int
+	newClientConnection = func(
+		_ context.Context,
+		_ sendConn,
+		_ connRunner,
+		_ protocol.ConnectionID,
+		_ protocol.ConnectionID,
+		_ ConnectionIDGenerator,
+		_ *statelessResetter,
+		_ *Config,
+		_ *tls.Config,
+		pn protocol.PacketNumber,
+		_ bool,
+		hasNegotiatedVersion bool,
+		_ qlogwriter.Trace,
+		_ utils.Logger,
+		v protocol.Version,
+	) *wrappedConn {
+		connChan <- connParams{pn: pn, hasNegotiatedVersion: hasNegotiatedVersion, version: v}
+		if counter == 0 {
+			counter++
+			return &wrappedConn{testHooks: conn}
+		}
+		return &wrappedConn{testHooks: conn2}
+	}
+
+	tr := &Transport{Conn: newUDPConnLocalhost(t)}
+	tr.init(true)
+	defer tr.Close()
+
+	_, err := tr.Dial(context.Background(), nil, &tls.Config{}, nil)
+	require.ErrorIs(t, err, assert.AnError)
+
+	select {
+	case params := <-connChan:
+		require.Zero(t, params.pn)
+		require.False(t, params.hasNegotiatedVersion)
+		require.Equal(t, protocol.Version1, params.version)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+	select {
+	case params := <-connChan:
+		require.Equal(t, protocol.PacketNumber(109), params.pn)
+		require.True(t, params.hasNegotiatedVersion)
+		require.Equal(t, protocol.Version(789), params.version)
+	case <-time.After(time.Second):
+		t.Fatal("timeout")
+	}
+}
+
+func TestTransportReplaceWithClosed(t *testing.T) {
+	t.Run("local", func(t *testing.T) {
+		testTransportReplaceWithClosed(t, true)
+	})
+	t.Run("remote", func(t *testing.T) {
+		testTransportReplaceWithClosed(t, false)
+	})
+}
+
+func testTransportReplaceWithClosed(t *testing.T, local bool) {
+	synctest.Test(t, func(t *testing.T) {
+		clientConn, serverConn, closeFn := newSimnetLink(t, 10*time.Millisecond)
+		defer closeFn()
+
+		srk := StatelessResetKey{1, 2, 3, 4}
+		tr := &Transport{
+			Conn:               serverConn,
+			ConnectionIDLength: 4,
+			StatelessResetKey:  &srk,
+		}
+		tr.init(true)
+		defer tr.Close()
+
+		var closePacket []byte
+		if local {
+			closePacket = []byte("foobar")
+		}
+
+		const expiry = 50 * time.Millisecond
+		handler := &mockPacketHandler{}
+		connID := protocol.ParseConnectionID([]byte{4, 3, 2, 1})
+		m := (*packetHandlerMap)(tr)
+		require.True(t, m.Add(connID, handler))
+		m.ReplaceWithClosed([]protocol.ConnectionID{connID}, closePacket, expiry)
+
+		p := make([]byte, 100)
+		p[0] = 0x40 // QUIC bit
+		copy(p[1:], connID.Bytes())
+
+		var sent atomic.Int64
+		errChan := make(chan error, 1)
+		stopSending := make(chan struct{})
+		go func() {
+			defer close(errChan)
+			ticker := time.NewTicker(expiry / 200)
+			timeout := time.NewTimer(time.Second)
+			for {
+				select {
+				case <-stopSending:
+					return
+				case <-timeout.C:
+					errChan <- errors.New("timeout")
+					return
+				case <-ticker.C:
+				}
+				if _, err := clientConn.WriteTo(p, tr.Conn.LocalAddr()); err != nil {
+					errChan <- err
+					return
+				}
+				sent.Add(1)
+			}
+		}()
+
+		// For locally closed connections, CONNECTION_CLOSE packets are sent with an exponential backoff
+		var received int
+		clientConn.SetReadDeadline(time.Now().Add(time.Hour))
+		for {
+			b := make([]byte, 100)
+			n, _, err := clientConn.ReadFrom(b)
+			require.NoError(t, err)
+			// at some point, the connection is cleaned up, and we'll receive a stateless reset
+			if !bytes.Equal(b[:n], []byte("foobar")) {
+				require.GreaterOrEqual(t, n, protocol.MinStatelessResetSize)
+				close(stopSending) // stop sending packets
+				break
+			}
+			received++
+		}
+
+		select {
+		case err := <-errChan:
+			require.NoError(t, err)
+		case <-time.After(time.Second):
+			t.Fatal("timeout")
+		}
+
+		numSent := sent.Load()
+		if !local {
+			require.Zero(t, received)
+			t.Logf("sent %d packets", numSent)
+			return
+		}
+		t.Logf("sent %d packets, received %d CONNECTION_CLOSE copies", numSent, received)
+		require.Equal(t, int(math.Ceil(math.Log2(float64(numSent)))), received)
+	})
+}
diff --git a/electron/package-lock.json b/electron/package-lock.json
index b1b212938..cfbb801f8 100644
--- a/electron/package-lock.json
+++ b/electron/package-lock.json
@@ -11,13 +11,13 @@
       "dependencies": {
         "@capacitor-community/electron": "^5.0.0",
         "@silentbot1/nat-api": "^0.4.9",
-        "adm-zip": "^0.5.16",
-        "better-sqlite3": "^12.8.0",
+        "adm-zip": "^0.6.0",
+        "better-sqlite3": "^13.0.3",
         "chokidar": "^4.0.3",
         "electron-is-dev": "~2.0.0",
         "electron-serve": "~1.1.0",
         "electron-unhandled": "~4.0.1",
-        "electron-updater": "^6.6.2",
+        "electron-updater": "^6.8.9",
         "electron-window-state": "^5.0.3",
         "extract-zip": "^2.0.1",
         "moment-timezone": "^0.5.48",
@@ -28,13 +28,16 @@
       },
       "devDependencies": {
         "@electron/notarize": "^2.5.0",
-        "@electron/rebuild": "^3.7.2",
+        "@electron/rebuild": "^4.2.0",
         "@types/better-sqlite3": "^7.6.13",
         "@types/write-file-atomic": "^4.0.3",
-        "electron": "^32.3.1",
-        "electron-builder": "^25.1.8",
+        "electron": "^44.1.1",
+        "electron-builder": "^26.15.3",
         "shelljs": "^0.8.5",
         "typescript": "^5.0.4"
+      },
+      "engines": {
+        "node": ">=22.12.0"
       }
     },
     "node_modules/@capacitor-community/electron": {
@@ -96,28 +99,20 @@
         "tslib": "^2.1.0"
       }
     },
-    "node_modules/@develar/schema-utils": {
-      "version": "2.6.5",
-      "resolved": "https://registry.npmjs.org/@develar/schema-utils/-/schema-utils-2.6.5.tgz",
-      "integrity": "sha512-0cp4PsWQ/9avqTVMCtZ+GirikIA36ikvjtHweU4/j8yLtgObI0+JUPhYFScgwlteveGB1rt3Cm8UhN04XayDig==",
+    "node_modules/@electron-internal/extract-zip": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@electron-internal/extract-zip/-/extract-zip-1.0.5.tgz",
+      "integrity": "sha512-+bqFCP98pLI0Tt0XQo1TmlXtwjWchISndDOxCkEcIuUgXWpBnLyRI+2DU+mesvnMMX6L1XDqYNA0lXNDHd/yiA==",
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^6.12.0",
-        "ajv-keywords": "^3.4.1"
-      },
+      "license": "BSD-2-Clause",
       "engines": {
-        "node": ">= 8.9.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/webpack"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/@electron/asar": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/@electron/asar/-/asar-3.3.1.tgz",
-      "integrity": "sha512-WtpC/+34p0skWZiarRjLAyqaAX78DofhDxnREy/V5XHfu1XEXbFCSSMcDQ6hNCPJFaPy8/NnUgYuf9uiCkvKPg==",
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/@electron/asar/-/asar-3.4.1.tgz",
+      "integrity": "sha512-i4/rNPRS84t0vSRa2HorerGRXWyF4vThfHesw0dmcWHp+cspK743UanA0suA5Q5y8kzY2y6YKrvbIUn69BCAiA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -142,108 +137,82 @@
         "node": ">= 6"
       }
     },
-    "node_modules/@electron/asar/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
+    "node_modules/@electron/fuses": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@electron/fuses/-/fuses-1.8.0.tgz",
+      "integrity": "sha512-zx0EIq78WlY/lBb1uXlziZmDZI4ubcCXIMJ4uGjXzZW0nS19TjSPeXPAjzzTmKQlJUZm0SbmZhPKP7tuQ1SsEw==",
       "dev": true,
-      "license": "ISC",
+      "license": "MIT",
       "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
+        "chalk": "^4.1.1",
+        "fs-extra": "^9.0.1",
+        "minimist": "^1.2.5"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+      "bin": {
+        "electron-fuses": "dist/bin.js"
       }
     },
-    "node_modules/@electron/get": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@electron/get/-/get-2.0.3.tgz",
-      "integrity": "sha512-Qkzpg2s9GnVV2I2BjRksUi43U5e6+zaQMcjoJy0C+C5oxaKl+fmckGDQFtRpZpZV0NQekuZZ+tGz7EA9TVnQtQ==",
+    "node_modules/@electron/fuses/node_modules/fs-extra": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
+      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "debug": "^4.1.1",
-        "env-paths": "^2.2.0",
-        "fs-extra": "^8.1.0",
-        "got": "^11.8.5",
-        "progress": "^2.0.3",
-        "semver": "^6.2.0",
-        "sumchecker": "^3.0.1"
+        "at-least-node": "^1.0.0",
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
       },
       "engines": {
-        "node": ">=12"
-      },
-      "optionalDependencies": {
-        "global-agent": "^3.0.0"
+        "node": ">=10"
       }
     },
-    "node_modules/@electron/get/node_modules/fs-extra": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-8.1.0.tgz",
-      "integrity": "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==",
+    "node_modules/@electron/fuses/node_modules/jsonfile": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^4.0.0",
-        "universalify": "^0.1.0"
+        "universalify": "^2.0.0"
       },
-      "engines": {
-        "node": ">=6 <7 || >=8"
-      }
-    },
-    "node_modules/@electron/get/node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
       }
     },
-    "node_modules/@electron/get/node_modules/universalify": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz",
-      "integrity": "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==",
+    "node_modules/@electron/get": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@electron/get/-/get-5.1.0.tgz",
+      "integrity": "sha512-3kSBtG8ObcTVfXanm5vVJ6UnBLEVmVsRk1M+vGqCuMBV+XLCbJYuWQful+yIy0GQDsSlK0kHEriEHn7SPk4EnA==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "debug": "^4.1.1",
+        "env-paths": "^3.0.0",
+        "graceful-fs": "^4.2.11",
+        "progress": "^2.0.3",
+        "semver": "^7.6.3",
+        "sumchecker": "^3.0.1"
+      },
       "engines": {
-        "node": ">= 4.0.0"
+        "node": ">=22.12.0"
+      },
+      "optionalDependencies": {
+        "undici": "^7.24.4"
       }
     },
-    "node_modules/@electron/node-gyp": {
-      "version": "10.2.0-electron.1",
-      "resolved": "git+ssh://git@github.com/electron/node-gyp.git#06b29aafb7708acef8b3669835c8a7857ebc92d2",
-      "integrity": "sha512-CrYo6TntjpoMO1SHjl5Pa/JoUsECNqNdB7Kx49WLQpWzPw53eEITJ2Hs9fh/ryUYDn4pxZz11StaBYBrLFJdqg==",
+    "node_modules/@electron/get/node_modules/env-paths": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz",
+      "integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "env-paths": "^2.2.0",
-        "exponential-backoff": "^3.1.1",
-        "glob": "^8.1.0",
-        "graceful-fs": "^4.2.6",
-        "make-fetch-happen": "^10.2.1",
-        "nopt": "^6.0.0",
-        "proc-log": "^2.0.1",
-        "semver": "^7.3.5",
-        "tar": "^6.2.1",
-        "which": "^2.0.2"
-      },
-      "bin": {
-        "node-gyp": "bin/node-gyp.js"
-      },
       "engines": {
-        "node": ">=12.13.0"
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/@electron/notarize": {
@@ -291,9 +260,9 @@
       }
     },
     "node_modules/@electron/osx-sign": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@electron/osx-sign/-/osx-sign-1.3.1.tgz",
-      "integrity": "sha512-BAfviURMHpmb1Yb50YbCxnOY0wfwaLXH5KJ4+80zS0gUkzDX3ec23naTlEqKsN+PwYn+a1cCzM7BJ4Wcd3sGzw==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@electron/osx-sign/-/osx-sign-1.3.3.tgz",
+      "integrity": "sha512-KZ8mhXvWv2rIEgMbWZ4y33bDHyUKMXnx4M0sTyPNK/vcB81ImdeY9Ggdqy0SWbMDgmbqyQ+phgejh6V3R2QuSg==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -341,9 +310,9 @@
       }
     },
     "node_modules/@electron/osx-sign/node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -354,70 +323,47 @@
       }
     },
     "node_modules/@electron/rebuild": {
-      "version": "3.7.2",
-      "resolved": "https://registry.npmjs.org/@electron/rebuild/-/rebuild-3.7.2.tgz",
-      "integrity": "sha512-19/KbIR/DAxbsCkiaGMXIdPnMCJLkcf8AvGnduJtWBs/CBwiAjY1apCqOLVxrXg+rtXFCngbXhBanWjxLUt1Mg==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@electron/rebuild/-/rebuild-4.2.0.tgz",
+      "integrity": "sha512-RKL/O+jGoXJMxrx/5771y1n0xTKmFuOYGO3gMmwypBM6rsH0kou0mswwdXA2JrhIkE4xyC7v9vGk0n6NPzgOxQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@electron/node-gyp": "git+https://github.com/electron/node-gyp.git#06b29aafb7708acef8b3669835c8a7857ebc92d2",
         "@malept/cross-spawn-promise": "^2.0.0",
-        "chalk": "^4.0.0",
         "debug": "^4.1.1",
-        "detect-libc": "^2.0.1",
-        "fs-extra": "^10.0.0",
-        "got": "^11.7.0",
-        "node-abi": "^3.45.0",
-        "node-api-version": "^0.2.0",
-        "ora": "^5.1.0",
-        "read-binary-file-arch": "^1.0.6",
-        "semver": "^7.3.5",
-        "tar": "^6.0.5",
-        "yargs": "^17.0.1"
+        "node-abi": "^4.2.0",
+        "node-api-version": "^0.2.1",
+        "node-gyp": "^12.2.0",
+        "read-binary-file-arch": "^1.0.6"
       },
       "bin": {
         "electron-rebuild": "lib/cli.js"
       },
       "engines": {
-        "node": ">=12.13.0"
+        "node": ">=22.12.0"
       }
     },
-    "node_modules/@electron/rebuild/node_modules/fs-extra": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
-      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
+    "node_modules/@electron/rebuild/node_modules/node-abi": {
+      "version": "4.35.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-4.35.0.tgz",
+      "integrity": "sha512-ymk4aIzxdPopw2giv8Fs1Ec6vybGkjmyxUwVqhkI4MCy2tVfXdkOGGWieWVjL0THgH+7a8lRdevyupoYj3Js/Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
+        "semver": "^7.6.3"
       },
       "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@electron/rebuild/node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/@electron/universal": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@electron/universal/-/universal-2.0.1.tgz",
-      "integrity": "sha512-fKpv9kg4SPmt+hY7SVBnIYULE9QJl8L3sCfcBsnqbJwwBwAeTLokJ9TRt9y7bK0JAzIW2y78TVVjvnQEms/yyA==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@electron/universal/-/universal-2.0.3.tgz",
+      "integrity": "sha512-Wn9sPYIVFRFl5HmwMJkARCCf7rqK/EurkfQ/rJZ14mHP3iYTjZSIOSVonEAnhWeAXwtw7zOekGRlc6yTtZ0t+g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@electron/asar": "^3.2.7",
+        "@electron/asar": "^3.3.1",
         "@malept/cross-spawn-promise": "^2.0.0",
         "debug": "^4.3.1",
         "dir-compare": "^4.2.0",
@@ -430,9 +376,9 @@
       }
     },
     "node_modules/@electron/universal/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -440,13 +386,13 @@
       }
     },
     "node_modules/@electron/universal/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -455,6 +401,28 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/@electron/windows-sign": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@electron/windows-sign/-/windows-sign-1.2.2.tgz",
+      "integrity": "sha512-dfZeox66AvdPtb2lD8OsIIQh12Tp0GNCRUDfBHIKGpbmopZto2/A8nSpYYLoedPIHpqkeblZ/k8OV0Gy7PYuyQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "cross-dirname": "^0.1.0",
+        "debug": "^4.3.4",
+        "fs-extra": "^11.1.1",
+        "minimist": "^1.2.8",
+        "postject": "^1.0.0-alpha.6"
+      },
+      "bin": {
+        "electron-windows-sign": "bin/electron-windows-sign.js"
+      },
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
     "node_modules/@emnapi/runtime": {
       "version": "1.11.2",
       "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
@@ -465,13 +433,6 @@
         "tslib": "^2.4.0"
       }
     },
-    "node_modules/@gar/promisify": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@gar/promisify/-/promisify-1.1.3.tgz",
-      "integrity": "sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@img/colour": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
@@ -1170,107 +1131,27 @@
         "node": ">=16.0.0"
       }
     },
-    "node_modules/@isaacs/cliui": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+    "node_modules/@isaacs/fs-minipass": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "string-width": "^5.1.2",
-        "string-width-cjs": "npm:string-width@^4.2.0",
-        "strip-ansi": "^7.0.1",
-        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
-        "wrap-ansi": "^8.1.0",
-        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/ansi-regex": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.1.0.tgz",
-      "integrity": "sha512-7HSX4QQb4CspciLpVFwyRe79O3xsIZDDLER21kERQ71oaPodF8jL725AgJMFAYbooIqolJoRLuM81SpeUkpkvA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/ansi-styles": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
-      "integrity": "sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@isaacs/cliui/node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/strip-ansi": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz",
-      "integrity": "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "minipass": "^7.0.4"
       },
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+        "node": ">=18.0.0"
       }
     },
-    "node_modules/@isaacs/cliui/node_modules/wrap-ansi": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+    "node_modules/@isaacs/fs-minipass/node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.1.0",
-        "string-width": "^5.0.1",
-        "strip-ansi": "^7.0.1"
-      },
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+        "node": ">=16 || 14 >=14.17"
       }
     },
     "node_modules/@malept/cross-spawn-promise": {
@@ -1329,9 +1210,9 @@
       }
     },
     "node_modules/@malept/flatpak-bundler/node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1353,117 +1234,36 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
-    "node_modules/@npmcli/fs": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-2.1.2.tgz",
-      "integrity": "sha512-yOJKRvohFOaLqipNtwYB9WugyZKhC/DZC4VYPmpaCzDBrA8YpK3qHZ8/HGscMnE4GqbkLNuVcCnxkeQEdGt6LQ==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/@peculiar/asn1-cms": {
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.6.1.tgz",
+      "integrity": "sha512-vdG4fBF6Lkirkcl53q6eOdn3XYKt+kJTG59edgRZORlg/3atWWEReRCx5rYE1ZzTTX6vLK5zDMjHh7vbrcXGtw==",
+      "license": "MIT",
       "dependencies": {
-        "@gar/promisify": "^1.1.3",
-        "semver": "^7.3.5"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+        "@peculiar/asn1-schema": "^2.6.0",
+        "@peculiar/asn1-x509": "^2.6.1",
+        "@peculiar/asn1-x509-attr": "^2.6.1",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
       }
     },
-    "node_modules/@npmcli/move-file": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@npmcli/move-file/-/move-file-2.0.1.tgz",
-      "integrity": "sha512-mJd2Z5TjYWq/ttPLLGqArdtnC74J6bOzg4rMDnN+p1xTacZ2yPRCk2y0oSWQtygLR9YVQXgOcONrwtnk3JupxQ==",
-      "deprecated": "This functionality has been moved to @npmcli/fs",
-      "dev": true,
+    "node_modules/@peculiar/asn1-csr": {
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.6.1.tgz",
+      "integrity": "sha512-WRWnKfIocHyzFYQTka8O/tXCiBquAPSrRjXbOkHbO4qdmS6loffCEGs+rby6WxxGdJCuunnhS2duHURhjyio6w==",
       "license": "MIT",
       "dependencies": {
-        "mkdirp": "^1.0.4",
-        "rimraf": "^3.0.2"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+        "@peculiar/asn1-schema": "^2.6.0",
+        "@peculiar/asn1-x509": "^2.6.1",
+        "asn1js": "^3.0.6",
+        "tslib": "^2.8.1"
       }
     },
-    "node_modules/@npmcli/move-file/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/@npmcli/move-file/node_modules/mkdirp": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "mkdirp": "bin/cmd.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@npmcli/move-file/node_modules/rimraf": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
-      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
-      "deprecated": "Rimraf versions prior to v4 are no longer supported",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "glob": "^7.1.3"
-      },
-      "bin": {
-        "rimraf": "bin.js"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/@peculiar/asn1-cms": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.6.1.tgz",
-      "integrity": "sha512-vdG4fBF6Lkirkcl53q6eOdn3XYKt+kJTG59edgRZORlg/3atWWEReRCx5rYE1ZzTTX6vLK5zDMjHh7vbrcXGtw==",
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-schema": "^2.6.0",
-        "@peculiar/asn1-x509": "^2.6.1",
-        "@peculiar/asn1-x509-attr": "^2.6.1",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-csr": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.6.1.tgz",
-      "integrity": "sha512-WRWnKfIocHyzFYQTka8O/tXCiBquAPSrRjXbOkHbO4qdmS6loffCEGs+rby6WxxGdJCuunnhS2duHURhjyio6w==",
-      "license": "MIT",
-      "dependencies": {
-        "@peculiar/asn1-schema": "^2.6.0",
-        "@peculiar/asn1-x509": "^2.6.1",
-        "asn1js": "^3.0.6",
-        "tslib": "^2.8.1"
-      }
-    },
-    "node_modules/@peculiar/asn1-ecc": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.6.1.tgz",
-      "integrity": "sha512-+Vqw8WFxrtDIN5ehUdvlN2m73exS2JVG0UAyfVB31gIfor3zWEAQPD+K9ydCxaj3MLen9k0JhKpu9LqviuCE1g==",
-      "license": "MIT",
+    "node_modules/@peculiar/asn1-ecc": {
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.6.1.tgz",
+      "integrity": "sha512-+Vqw8WFxrtDIN5ehUdvlN2m73exS2JVG0UAyfVB31gIfor3zWEAQPD+K9ydCxaj3MLen9k0JhKpu9LqviuCE1g==",
+      "license": "MIT",
       "dependencies": {
         "@peculiar/asn1-schema": "^2.6.0",
         "@peculiar/asn1-x509": "^2.6.1",
@@ -1526,14 +1326,17 @@
       }
     },
     "node_modules/@peculiar/asn1-schema": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.6.0.tgz",
-      "integrity": "sha512-xNLYLBFTBKkCzEZIw842BxytQQATQv+lDTCEMZ8C196iJcJJMBUZxrhSTxLaohMyKK8QlzRNTRkUmanucnDSqg==",
+      "version": "2.9.4",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.9.4.tgz",
+      "integrity": "sha512-GjzePcT9Iw8NzeOPf73iNS9xM+TBhd/FilAfP+RQGkTMQJTVWtytN3JHJACCjf/ABNau5S7mS3g+DcuxmRgYEg==",
       "license": "MIT",
       "dependencies": {
-        "asn1js": "^3.0.6",
-        "pvtsutils": "^1.3.6",
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
         "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
       }
     },
     "node_modules/@peculiar/asn1-x509": {
@@ -1560,6 +1363,45 @@
         "tslib": "^2.8.1"
       }
     },
+    "node_modules/@peculiar/json-schema": {
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/@peculiar/json-schema/-/json-schema-1.1.12.tgz",
+      "integrity": "sha512-coUfuoMeIB7B8/NMekxaDzLhaYmp0HZNPEjYRm9goRou8UZIC3z21s0sL9AWoCw4EG876QyO3kYrc61WNF9B/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@peculiar/utils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
+      "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/webcrypto": {
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/@peculiar/webcrypto/-/webcrypto-1.7.1.tgz",
+      "integrity": "sha512-ODOov0sGMJMf3jPonOkgGqPknTsu+DdQ7kD++gz8aI+aFMOMHFbWAA2taqXXVTdP+OTOQR/znGvSpmkeI0WTYQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/json-schema": "^1.1.12",
+        "@peculiar/utils": "^2.0.2",
+        "tslib": "^2.8.1",
+        "webcrypto-core": "^1.9.2"
+      },
+      "engines": {
+        "node": ">=14.18.0"
+      }
+    },
     "node_modules/@peculiar/x509": {
       "version": "1.14.3",
       "resolved": "https://registry.npmjs.org/@peculiar/x509/-/x509-1.14.3.tgz",
@@ -1582,17 +1424,6 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@pkgjs/parseargs": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=14"
-      }
-    },
     "node_modules/@silentbot1/nat-api": {
       "version": "0.4.9",
       "resolved": "https://registry.npmjs.org/@silentbot1/nat-api/-/nat-api-0.4.9.tgz",
@@ -1658,16 +1489,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/@tootallnate/once": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-2.0.0.tgz",
-      "integrity": "sha512-XCuKFP5PS55gnMVu3dty8KPatLqUoy/ZYzDzAGCQ8JNFCkLXzmI7vNHCR+XpbZaMWQK/vQubr7PkYq8g470J/A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10"
-      }
-    },
     "node_modules/@types/better-sqlite3": {
       "version": "7.6.13",
       "resolved": "https://registry.npmjs.org/@types/better-sqlite3/-/better-sqlite3-7.6.13.tgz",
@@ -1692,9 +1513,9 @@
       }
     },
     "node_modules/@types/debug": {
-      "version": "4.1.12",
-      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
-      "integrity": "sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==",
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1711,9 +1532,9 @@
       }
     },
     "node_modules/@types/http-cache-semantics": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/@types/http-cache-semantics/-/http-cache-semantics-4.0.4.tgz",
-      "integrity": "sha512-1m0bIFVc7eJWyve9S0RnuRgcQqF/Xd5QsUZAZeQFr1Q3/p9JWoQQEqmVy+DPTNpGXwhgIetAoYF8JSc33q29QA==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@types/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
+      "integrity": "sha512-L3LgimLHXtGkWikKnsPg0/VFx9OGZaC+eN1u4r+OB1XRqH3meBIAVC2zr1WdMH+RHmnRkqliQAOHNJ/E0j/e0Q==",
       "dev": true,
       "license": "MIT"
     },
@@ -1735,24 +1556,12 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "22.10.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.10.2.tgz",
-      "integrity": "sha512-Xxr6BBRCAOQixvonOye19wnzyDiUtTeqldOOmj3CkeblonbccA12PFwlufvRdrpjXxqnmUaeiU5EOA+7s5diUQ==",
+      "version": "24.13.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
+      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~6.20.0"
-      }
-    },
-    "node_modules/@types/plist": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/@types/plist/-/plist-3.0.5.tgz",
-      "integrity": "sha512-E6OCaRmAe4WDmWNsL/9RMqdkkzDCY1etutkflWk4c+AcjDU07Pcz1fQwTX0TQz+Pxqn9i4L1TU3UFpjnrcDgxA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@types/node": "*",
-        "xmlbuilder": ">=11.0.1"
+        "undici-types": "~7.18.0"
       }
     },
     "node_modules/@types/responselike": {
@@ -1771,14 +1580,6 @@
       "integrity": "sha512-+OpjSaq85gvlZAYINyzKpLeiFkSC4EsC6IIiT6v6TLSU5k5U83fHGj9Lel8oKEXM0HqgrMVCjXPDPVICtxF7EQ==",
       "license": "MIT"
     },
-    "node_modules/@types/verror": {
-      "version": "1.10.10",
-      "resolved": "https://registry.npmjs.org/@types/verror/-/verror-1.10.10.tgz",
-      "integrity": "sha512-l4MM0Jppn18hb9xmM6wwD1uTdShpf9Pn80aXTStnK1C94gtPvJcV2FrDmbOQUAQfJ1cKZHktkQUDwEqaAKXMMg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/@types/write-file-atomic": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/@types/write-file-atomic/-/write-file-atomic-4.0.3.tgz",
@@ -1808,19 +1609,15 @@
         "node": ">=10.0.0"
       }
     },
-    "node_modules/7zip-bin": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/7zip-bin/-/7zip-bin-5.2.0.tgz",
-      "integrity": "sha512-ukTPVhqG4jNzMro2qA9HSCSSVJN3aN7tlb+hfqYCt3ER0yWroeA2VR38MNrOHLQ/cVj+DaIMad0kFCtWWowh/A==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/abbrev": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
-      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-4.0.0.tgz",
+      "integrity": "sha512-a1wflyaL0tHtJSmLSOVybYhy22vRih4eduhhrkcjgrWGnRfrZtovJ2FRjxuTtkkj47O/baf0R86QU5OuYpz8fA==",
       "dev": true,
-      "license": "ISC"
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
     },
     "node_modules/abort-controller": {
       "version": "3.0.0",
@@ -1835,81 +1632,41 @@
       }
     },
     "node_modules/adm-zip": {
-      "version": "0.5.16",
-      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.16.tgz",
-      "integrity": "sha512-TGw5yVi4saajsSEgz25grObGHEUaDrniwvA2qwSC060KfqGPdglhvPMA2lPIoxs3PQIItj2iag35fONcQqgUaQ==",
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
+      "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
       "license": "MIT",
       "engines": {
-        "node": ">=12.0"
+        "node": ">=14.0"
       }
     },
     "node_modules/agent-base": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
-      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 6.0.0"
-      }
-    },
-    "node_modules/agentkeepalive": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.5.0.tgz",
-      "integrity": "sha512-5GG/5IbQQpC9FpkRGsSvZI5QYeSCzlJHdpBQntCsuTOxhKD8lqKhrleg2Yi7yvMIf82Ycmmqln9U8V9qwEiJew==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "humanize-ms": "^1.2.1"
-      },
-      "engines": {
-        "node": ">= 8.0.0"
-      }
-    },
-    "node_modules/aggregate-error": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz",
-      "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "clean-stack": "^2.0.0",
-        "indent-string": "^4.0.0"
-      },
       "engines": {
-        "node": ">=8"
+        "node": ">= 14"
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
       },
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/ajv-keywords": {
-      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
-      "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "ajv": "^6.9.1"
-      }
-    },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
@@ -1934,88 +1691,131 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/app-builder-bin": {
-      "version": "5.0.0-alpha.10",
-      "resolved": "https://registry.npmjs.org/app-builder-bin/-/app-builder-bin-5.0.0-alpha.10.tgz",
-      "integrity": "sha512-Ev4jj3D7Bo+O0GPD2NMvJl+PGiBAfS7pUGawntBNpCbxtpncfUixqFj9z9Jme7V7s3LBGqsWZZP54fxBX3JKJw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/app-builder-lib": {
-      "version": "25.1.8",
-      "resolved": "https://registry.npmjs.org/app-builder-lib/-/app-builder-lib-25.1.8.tgz",
-      "integrity": "sha512-pCqe7dfsQFBABC1jeKZXQWhGcCPF3rPCXDdfqVKjIeWBcXzyC1iOWZdfFhGl+S9MyE/k//DFmC6FzuGAUudNDg==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/app-builder-lib/-/app-builder-lib-26.15.3.tgz",
+      "integrity": "sha512-2VnyWkqsP5v5XbBhL3tD5Syx8iNPBYsoU7kY4S2fz7wg8Rj/nztWKCUzGKaFRTv0Xwf3/H058CR1Kvtd/3lRow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@develar/schema-utils": "~2.6.5",
+        "@electron/asar": "3.4.1",
+        "@electron/fuses": "^1.8.0",
+        "@electron/get": "^3.0.0",
         "@electron/notarize": "2.5.0",
-        "@electron/osx-sign": "1.3.1",
-        "@electron/rebuild": "3.6.1",
-        "@electron/universal": "2.0.1",
+        "@electron/osx-sign": "1.3.3",
+        "@electron/rebuild": "^4.0.4",
+        "@electron/universal": "2.0.3",
         "@malept/flatpak-bundler": "^0.4.0",
+        "@noble/hashes": "^2.2.0",
+        "@peculiar/webcrypto": "^1.7.1",
         "@types/fs-extra": "9.0.13",
+        "ajv": "^8.18.0",
+        "asn1js": "^3.0.10",
         "async-exit-hook": "^2.0.1",
-        "bluebird-lst": "^1.0.9",
-        "builder-util": "25.1.7",
-        "builder-util-runtime": "9.2.10",
+        "builder-util": "26.15.3",
+        "builder-util-runtime": "9.7.0",
         "chromium-pickle-js": "^0.2.0",
-        "config-file-ts": "0.2.8-rc1",
+        "ci-info": "4.3.1",
         "debug": "^4.3.4",
         "dotenv": "^16.4.5",
         "dotenv-expand": "^11.0.6",
         "ejs": "^3.1.8",
-        "electron-publish": "25.1.7",
-        "form-data": "^4.0.0",
+        "electron-publish": "26.15.3",
         "fs-extra": "^10.1.0",
         "hosted-git-info": "^4.1.0",
-        "is-ci": "^3.0.0",
         "isbinaryfile": "^5.0.0",
+        "jiti": "^2.4.2",
         "js-yaml": "^4.1.0",
         "json5": "^2.2.3",
         "lazy-val": "^1.0.5",
-        "minimatch": "^10.0.0",
+        "minimatch": "^10.2.5",
+        "pkijs": "^3.4.0",
+        "plist": "3.1.0",
+        "proper-lockfile": "^4.1.2",
         "resedit": "^1.7.0",
-        "sanitize-filename": "^1.6.3",
-        "semver": "^7.3.8",
-        "tar": "^6.1.12",
-        "temp-file": "^3.4.0"
+        "semver": "~7.7.3",
+        "tar": "^7.5.7",
+        "temp-file": "^3.4.0",
+        "tiny-async-pool": "1.3.0",
+        "unzipper": "^0.12.3",
+        "which": "^5.0.0"
       },
       "engines": {
         "node": ">=14.0.0"
       },
       "peerDependencies": {
-        "dmg-builder": "25.1.8",
-        "electron-builder-squirrel-windows": "25.1.8"
+        "dmg-builder": "26.15.3",
+        "electron-builder-squirrel-windows": "26.15.3"
       }
     },
-    "node_modules/app-builder-lib/node_modules/@electron/rebuild": {
-      "version": "3.6.1",
-      "resolved": "https://registry.npmjs.org/@electron/rebuild/-/rebuild-3.6.1.tgz",
-      "integrity": "sha512-f6596ZHpEq/YskUd8emYvOUne89ij8mQgjYFA5ru25QwbrRO+t1SImofdDv7kKOuWCmVOuU5tvfkbgGxIl3E/w==",
+    "node_modules/app-builder-lib/node_modules/@electron/get": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@electron/get/-/get-3.1.0.tgz",
+      "integrity": "sha512-F+nKc0xW+kVbBRhFzaMgPy3KwmuNTYX1fx6+FxxoSnNgwYX6LD7AKBTWkU0MQ6IBoe7dz069CNkR673sPAgkCQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@malept/cross-spawn-promise": "^2.0.0",
-        "chalk": "^4.0.0",
         "debug": "^4.1.1",
-        "detect-libc": "^2.0.1",
-        "fs-extra": "^10.0.0",
-        "got": "^11.7.0",
-        "node-abi": "^3.45.0",
-        "node-api-version": "^0.2.0",
-        "node-gyp": "^9.0.0",
-        "ora": "^5.1.0",
-        "read-binary-file-arch": "^1.0.6",
-        "semver": "^7.3.5",
-        "tar": "^6.0.5",
-        "yargs": "^17.0.1"
+        "env-paths": "^2.2.0",
+        "fs-extra": "^8.1.0",
+        "got": "^11.8.5",
+        "progress": "^2.0.3",
+        "semver": "^6.2.0",
+        "sumchecker": "^3.0.1"
       },
-      "bin": {
-        "electron-rebuild": "lib/cli.js"
+      "engines": {
+        "node": ">=14"
+      },
+      "optionalDependencies": {
+        "global-agent": "^3.0.0"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@electron/get/node_modules/fs-extra": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-8.1.0.tgz",
+      "integrity": "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^4.0.0",
+        "universalify": "^0.1.0"
       },
       "engines": {
-        "node": ">=12.13.0"
+        "node": ">=6 <7 || >=8"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@electron/get/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@electron/get/node_modules/universalify": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz",
+      "integrity": "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4.0.0"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@noble/hashes": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz",
+      "integrity": "sha512-X5XaVWZIBCT7HHZGm5I7ZQXDwLG+bGXuSrMQAW+7Zvl87h1kmc1ZB1VSRJcpUfoUrGQp4Fkoxm5kZ+Ms+aW+eA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/app-builder-lib/node_modules/@types/fs-extra": {
@@ -2028,28 +1828,53 @@
         "@types/node": "*"
       }
     },
-    "node_modules/app-builder-lib/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+    "node_modules/app-builder-lib/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
-    "node_modules/app-builder-lib/node_modules/builder-util-runtime": {
-      "version": "9.2.10",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.2.10.tgz",
-      "integrity": "sha512-6p/gfG1RJSQeIbz8TK5aPNkoztgY1q5TgmGFMAXcY8itsGW6Y2ld1ALsZ5UJn8rog7hKF3zHx5iQbNQ8uLcRlw==",
+    "node_modules/app-builder-lib/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "debug": "^4.3.4",
-        "sax": "^1.2.4"
+        "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": ">=12.0.0"
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/chownr": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/ci-info": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
+      "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
       }
     },
     "node_modules/app-builder-lib/node_modules/fs-extra": {
@@ -2067,10 +1892,10 @@
         "node": ">=12"
       }
     },
-    "node_modules/app-builder-lib/node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+    "node_modules/app-builder-lib/node_modules/fs-extra/node_modules/jsonfile": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2080,144 +1905,109 @@
         "graceful-fs": "^4.1.6"
       }
     },
+    "node_modules/app-builder-lib/node_modules/isexe": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
+      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/app-builder-lib/node_modules/minimatch": {
-      "version": "10.0.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.0.1.tgz",
-      "integrity": "sha512-ethXTt3SGGR+95gudmqJ1eNhRO7eGEGIgYA9vnPatK4/etz2MEVDno5GMCibdMTuBMyElzIlgxMna3K94XDIDQ==",
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^5.0.8"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/aproba": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/aproba/-/aproba-2.0.0.tgz",
-      "integrity": "sha512-lYe4Gx7QT+MKGbDsA+Z+he/Wtef0BiwDOlK/XkBrdfsh9J/jPPXbX0tE9x9cl27Tmu5gg3QUbUrQYa/y+KOHPQ==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/archiver": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/archiver/-/archiver-5.3.2.tgz",
-      "integrity": "sha512-+25nxyyznAXF7Nef3y0EbBeqmGZgeN/BxHX29Rs39djAfaFalmQ89SE6CWyDCHzGL0yt/ycBtNOmGTW0FyGWNw==",
+    "node_modules/app-builder-lib/node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
       "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "archiver-utils": "^2.1.0",
-        "async": "^3.2.4",
-        "buffer-crc32": "^0.2.1",
-        "readable-stream": "^3.6.0",
-        "readdir-glob": "^1.1.2",
-        "tar-stream": "^2.2.0",
-        "zip-stream": "^4.1.0"
-      },
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">= 10"
+        "node": ">=16 || 14 >=14.17"
       }
     },
-    "node_modules/archiver-utils": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-2.1.0.tgz",
-      "integrity": "sha512-bEL/yUb/fNNiNTuUz979Z0Yg5L+LzLxGJz8x79lYmR54fmTIb6ob/hNQgkQnIUDWIFjZVQwl9Xs356I6BAMHfw==",
+    "node_modules/app-builder-lib/node_modules/minizlib": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "glob": "^7.1.4",
-        "graceful-fs": "^4.2.0",
-        "lazystream": "^1.0.0",
-        "lodash.defaults": "^4.2.0",
-        "lodash.difference": "^4.5.0",
-        "lodash.flatten": "^4.4.0",
-        "lodash.isplainobject": "^4.0.6",
-        "lodash.union": "^4.6.0",
-        "normalize-path": "^3.0.0",
-        "readable-stream": "^2.0.0"
+        "minipass": "^7.1.2"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">= 18"
       }
     },
-    "node_modules/archiver-utils/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
+    "node_modules/app-builder-lib/node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "dev": true,
       "license": "ISC",
-      "peer": true,
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+      "bin": {
+        "semver": "bin/semver.js"
       },
       "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+        "node": ">=10"
       }
     },
-    "node_modules/archiver-utils/node_modules/readable-stream": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+    "node_modules/app-builder-lib/node_modules/tar": {
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "dev": true,
-      "license": "MIT",
-      "peer": true,
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "core-util-is": "~1.0.0",
-        "inherits": "~2.0.3",
-        "isarray": "~1.0.0",
-        "process-nextick-args": "~2.0.0",
-        "safe-buffer": "~5.1.1",
-        "string_decoder": "~1.1.1",
-        "util-deprecate": "~1.0.1"
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/archiver-utils/node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/archiver-utils/node_modules/string_decoder": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+    "node_modules/app-builder-lib/node_modules/which": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
+      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
       "dev": true,
-      "license": "MIT",
-      "peer": true,
+      "license": "ISC",
       "dependencies": {
-        "safe-buffer": "~5.1.0"
+        "isexe": "^3.1.1"
+      },
+      "bin": {
+        "node-which": "bin/which.js"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/are-we-there-yet": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/are-we-there-yet/-/are-we-there-yet-3.0.1.tgz",
-      "integrity": "sha512-QZW4EDmGwlYur0Yyf/b2uGucHQMa8aFUP7eu9ddR73vvhFyt4V0Vl3QHPcTNJ8l6qYOBdxgXdnBXQrHilfRQBg==",
-      "deprecated": "This package is no longer supported.",
+    "node_modules/app-builder-lib/node_modules/yallist": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
       "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "delegates": "^1.0.0",
-        "readable-stream": "^3.6.0"
-      },
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+        "node": ">=18"
       }
     },
     "node_modules/argparse": {
@@ -2227,30 +2017,19 @@
       "license": "Python-2.0"
     },
     "node_modules/asn1js": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.7.tgz",
-      "integrity": "sha512-uLvq6KJu04qoQM6gvBfKFjlh6Gl0vOKQuR5cJMDHQkmwfMOQeN3F3SHCv9SNYSL+CRoHvOGFfllDlVz03GQjvQ==",
+      "version": "3.0.10",
+      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
+      "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "pvtsutils": "^1.3.6",
-        "pvutils": "^1.1.3",
+        "pvutils": "^1.1.5",
         "tslib": "^2.8.1"
       },
       "engines": {
         "node": ">=12.0.0"
       }
     },
-    "node_modules/assert-plus": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz",
-      "integrity": "sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
     "node_modules/astral-regex": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/astral-regex/-/astral-regex-2.0.0.tgz",
@@ -2293,6 +2072,13 @@
         "node": ">= 4.0.0"
       }
     },
+    "node_modules/aws4": {
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/aws4/-/aws4-1.13.2.tgz",
+      "integrity": "sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -2320,17 +2106,15 @@
       "license": "MIT"
     },
     "node_modules/better-sqlite3": {
-      "version": "12.8.0",
-      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.8.0.tgz",
-      "integrity": "sha512-RxD2Vd96sQDjQr20kdP+F+dK/1OUNiVOl200vKBZY8u0vTwysfolF6Hq+3ZK2+h8My9YvZhHsF+RSGZW2VYrPQ==",
-      "hasInstallScript": true,
+      "version": "13.0.3",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-13.0.3.tgz",
+      "integrity": "sha512-RbOBxmLBG8uvFUc15X9+9SFemKcQ0WBuISBVkpuiaUB2qblC8UWlHEjdWVoZ8AdhSwmoEgsiXKfopX0CQxaACQ==",
       "license": "MIT",
       "dependencies": {
-        "bindings": "^1.5.0",
-        "prebuild-install": "^7.1.1"
+        "node-addon-api": "^8.0.0"
       },
       "engines": {
-        "node": "20.x || 22.x || 23.x || 24.x || 25.x"
+        "node": ">=22"
       }
     },
     "node_modules/big-integer": {
@@ -2342,15 +2126,6 @@
         "node": ">=0.6"
       }
     },
-    "node_modules/bindings": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
-      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
-      "license": "MIT",
-      "dependencies": {
-        "file-uri-to-path": "1.0.0"
-      }
-    },
     "node_modules/bl": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
@@ -2369,16 +2144,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/bluebird-lst": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/bluebird-lst/-/bluebird-lst-1.0.9.tgz",
-      "integrity": "sha512-7B1Rtx82hjnSD4PGLAjVWeYH3tHAcVUmChh85a3lltKQm6FresXh9ErQo6oAv6CqxttczC3/kEg8SY5NluPuUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "bluebird": "^3.5.5"
-      }
-    },
     "node_modules/boolean": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/boolean/-/boolean-3.2.0.tgz",
@@ -2452,114 +2217,63 @@
       "license": "MIT"
     },
     "node_modules/builder-util": {
-      "version": "25.1.7",
-      "resolved": "https://registry.npmjs.org/builder-util/-/builder-util-25.1.7.tgz",
-      "integrity": "sha512-7jPjzBwEGRbwNcep0gGNpLXG9P94VA3CPAZQCzxkFXiV2GMQKlziMbY//rXPI7WKfhsvGgFXjTcXdBEwgXw9ww==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/builder-util/-/builder-util-26.15.3.tgz",
+      "integrity": "sha512-q2hn7Mbo2nFNkVekPiHFx6Nfo3hURmES3tfBn+k5Pqxl2RkmP3QGqZUhH/q9Pch/4G05NRhPjDlVj1O8q4Txvw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/debug": "^4.1.6",
-        "7zip-bin": "~5.2.0",
-        "app-builder-bin": "5.0.0-alpha.10",
-        "bluebird-lst": "^1.0.9",
-        "builder-util-runtime": "9.2.10",
+        "builder-util-runtime": "9.7.0",
         "chalk": "^4.1.2",
-        "cross-spawn": "^7.0.3",
+        "cross-spawn": "^7.0.6",
         "debug": "^4.3.4",
         "fs-extra": "^10.1.0",
         "http-proxy-agent": "^7.0.0",
         "https-proxy-agent": "^7.0.0",
-        "is-ci": "^3.0.0",
         "js-yaml": "^4.1.0",
+        "sanitize-filename": "^1.6.3",
         "source-map-support": "^0.5.19",
         "stat-mode": "^1.0.0",
-        "temp-file": "^3.4.0"
-      }
-    },
-    "node_modules/builder-util-runtime": {
-      "version": "9.3.1",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.3.1.tgz",
-      "integrity": "sha512-2/egrNDDnRaxVwK3A+cJq6UOlqOdedGA7JPqCeJjN2Zjk1/QB/6QUi3b714ScIGS7HafFXTyzJEOr5b44I3kvQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "sax": "^1.2.4"
+        "temp-file": "^3.4.0",
+        "tiny-async-pool": "1.3.0"
       },
       "engines": {
-        "node": ">=12.0.0"
-      }
-    },
-    "node_modules/builder-util/node_modules/agent-base": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.3.tgz",
-      "integrity": "sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 14"
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/builder-util/node_modules/builder-util-runtime": {
-      "version": "9.2.10",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.2.10.tgz",
-      "integrity": "sha512-6p/gfG1RJSQeIbz8TK5aPNkoztgY1q5TgmGFMAXcY8itsGW6Y2ld1ALsZ5UJn8rog7hKF3zHx5iQbNQ8uLcRlw==",
-      "dev": true,
+    "node_modules/builder-util-runtime": {
+      "version": "9.7.0",
+      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.7.0.tgz",
+      "integrity": "sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==",
       "license": "MIT",
       "dependencies": {
         "debug": "^4.3.4",
-        "sax": "^1.2.4"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
-    "node_modules/builder-util/node_modules/fs-extra": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
-      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/builder-util/node_modules/http-proxy-agent": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.0",
-        "debug": "^4.3.4"
+        "sax": "^1.2.4"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">=12.0.0"
       }
     },
-    "node_modules/builder-util/node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+    "node_modules/builder-util/node_modules/fs-extra": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
+      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "4"
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">=12"
       }
     },
     "node_modules/builder-util/node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2578,98 +2292,6 @@
         "node": ">=6.0.0"
       }
     },
-    "node_modules/cacache": {
-      "version": "16.1.3",
-      "resolved": "https://registry.npmjs.org/cacache/-/cacache-16.1.3.tgz",
-      "integrity": "sha512-/+Emcj9DAXxX4cwlLmRI9c166RuL3w30zp4R7Joiv2cQTtTtA+jeuCAjH3ZlGnYS3tKENSrKhAzVVP9GVyzeYQ==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "@npmcli/fs": "^2.1.0",
-        "@npmcli/move-file": "^2.0.0",
-        "chownr": "^2.0.0",
-        "fs-minipass": "^2.1.0",
-        "glob": "^8.0.1",
-        "infer-owner": "^1.0.4",
-        "lru-cache": "^7.7.1",
-        "minipass": "^3.1.6",
-        "minipass-collect": "^1.0.2",
-        "minipass-flush": "^1.0.5",
-        "minipass-pipeline": "^1.2.4",
-        "mkdirp": "^1.0.4",
-        "p-map": "^4.0.0",
-        "promise-inflight": "^1.0.1",
-        "rimraf": "^3.0.2",
-        "ssri": "^9.0.0",
-        "tar": "^6.1.11",
-        "unique-filename": "^2.0.0"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
-    },
-    "node_modules/cacache/node_modules/lru-cache": {
-      "version": "7.18.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-7.18.3.tgz",
-      "integrity": "sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/cacache/node_modules/mkdirp": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "mkdirp": "bin/cmd.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/cacache/node_modules/rimraf": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
-      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
-      "deprecated": "Rimraf versions prior to v4 are no longer supported",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "glob": "^7.1.3"
-      },
-      "bin": {
-        "rimraf": "bin.js"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/cacache/node_modules/rimraf/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/cacheable-lookup": {
       "version": "5.0.4",
       "resolved": "https://registry.npmjs.org/cacheable-lookup/-/cacheable-lookup-5.0.4.tgz",
@@ -2785,9 +2407,9 @@
       "license": "MIT"
     },
     "node_modules/ci-info": {
-      "version": "3.9.0",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
-      "integrity": "sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==",
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.4.0.tgz",
+      "integrity": "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==",
       "dev": true,
       "funding": [
         {
@@ -2833,40 +2455,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/cli-truncate": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-2.1.0.tgz",
-      "integrity": "sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "slice-ansi": "^3.0.0",
-        "string-width": "^4.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/cli-truncate/node_modules/slice-ansi": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-3.0.0.tgz",
-      "integrity": "sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "astral-regex": "^2.0.0",
-        "is-fullwidth-code-point": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/cliui": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
@@ -2922,16 +2510,6 @@
       "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "license": "MIT"
     },
-    "node_modules/color-support": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/color-support/-/color-support-1.1.3.tgz",
-      "integrity": "sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "color-support": "bin.js"
-      }
-    },
     "node_modules/combined-stream": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
@@ -2964,23 +2542,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/compress-commons": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-4.1.2.tgz",
-      "integrity": "sha512-D3uMHtGc/fcO1Gt1/L7i1e33VOvD4A9hfQLP+6ewd+BvG/gQ84Yh4oftEhAdjSMgBgwGL+jsppT7JYNpo6MHHg==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "buffer-crc32": "^0.2.13",
-        "crc32-stream": "^4.0.2",
-        "normalize-path": "^3.0.0",
-        "readable-stream": "^3.6.0"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
     "node_modules/concat-map": {
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
@@ -2988,127 +2549,21 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/config-file-ts": {
-      "version": "0.2.8-rc1",
-      "resolved": "https://registry.npmjs.org/config-file-ts/-/config-file-ts-0.2.8-rc1.tgz",
-      "integrity": "sha512-GtNECbVI82bT4RiDIzBSVuTKoSHufnU7Ce7/42bkWZJZFLjmDF2WBpVsvRkhKCfKBnTBb3qZrBwPpFBU/Myvhg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "glob": "^10.3.12",
-        "typescript": "^5.4.3"
-      }
-    },
-    "node_modules/config-file-ts/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/config-file-ts/node_modules/glob": {
-      "version": "10.4.5",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.4.5.tgz",
-      "integrity": "sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "foreground-child": "^3.1.0",
-        "jackspeak": "^3.1.2",
-        "minimatch": "^9.0.4",
-        "minipass": "^7.1.2",
-        "package-json-from-dist": "^1.0.0",
-        "path-scurry": "^1.11.1"
-      },
-      "bin": {
-        "glob": "dist/esm/bin.mjs"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/config-file-ts/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/config-file-ts/node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
-    "node_modules/console-control-strings": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/console-control-strings/-/console-control-strings-1.1.0.tgz",
-      "integrity": "sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/core-util-is": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
-      "integrity": "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/crc": {
-      "version": "3.8.0",
-      "resolved": "https://registry.npmjs.org/crc/-/crc-3.8.0.tgz",
-      "integrity": "sha512-iX3mfgcTMIq3ZKLIsVFAbv7+Mc10kxabAGQb8HvjA1o3T1PIYprbakQ65d3I+2HGHt6nSKkM9PYjgoJO2KcFBQ==",
+    "node_modules/cross-dirname": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/cross-dirname/-/cross-dirname-0.1.0.tgz",
+      "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "buffer": "^5.1.0"
-      }
-    },
-    "node_modules/crc-32": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/crc-32/-/crc-32-1.2.2.tgz",
-      "integrity": "sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "peer": true,
-      "bin": {
-        "crc32": "bin/crc32.njs"
-      },
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
-    "node_modules/crc32-stream": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/crc32-stream/-/crc32-stream-4.0.3.tgz",
-      "integrity": "sha512-NT7w2JVU7DFroFdYkeq8cywxrgjPHWkdX1wjpRQXPX5Asews3tA+Ght6lddQO5Mkumffp3X7GEqku3epj2toIw==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "crc-32": "^1.2.0",
-        "readable-stream": "^3.4.0"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
+      "peer": true
     },
     "node_modules/cross-fetch-ponyfill": {
       "version": "1.0.3",
@@ -3164,6 +2619,7 @@
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
       "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "mimic-response": "^3.1.0"
@@ -3179,6 +2635,7 @@
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
       "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -3187,15 +2644,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/deep-extend": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
-      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
     "node_modules/default-gateway": {
       "version": "7.2.2",
       "resolved": "https://registry.npmjs.org/default-gateway/-/default-gateway-7.2.2.tgz",
@@ -3287,13 +2735,6 @@
         "node": ">=0.4.0"
       }
     },
-    "node_modules/delegates": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz",
-      "integrity": "sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/detect-libc": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -3323,35 +2764,16 @@
       }
     },
     "node_modules/dmg-builder": {
-      "version": "25.1.8",
-      "resolved": "https://registry.npmjs.org/dmg-builder/-/dmg-builder-25.1.8.tgz",
-      "integrity": "sha512-NoXo6Liy2heSklTI5OIZbCgXC1RzrDQsZkeEwXhdOro3FT1VBOvbubvscdPnjVuQ4AMwwv61oaH96AbiYg9EnQ==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/dmg-builder/-/dmg-builder-26.15.3.tgz",
+      "integrity": "sha512-O3zJUFUYHJKgzPqioHxfxzBzlSC1eXCSr79gMSBKBP5AgjjpmrydMsMLotEg9fAJF36vdUncb+4ndRNxoPdlSQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "app-builder-lib": "25.1.8",
-        "builder-util": "25.1.7",
-        "builder-util-runtime": "9.2.10",
+        "app-builder-lib": "26.15.3",
+        "builder-util": "26.15.3",
         "fs-extra": "^10.1.0",
-        "iconv-lite": "^0.6.2",
         "js-yaml": "^4.1.0"
-      },
-      "optionalDependencies": {
-        "dmg-license": "^1.0.11"
-      }
-    },
-    "node_modules/dmg-builder/node_modules/builder-util-runtime": {
-      "version": "9.2.10",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.2.10.tgz",
-      "integrity": "sha512-6p/gfG1RJSQeIbz8TK5aPNkoztgY1q5TgmGFMAXcY8itsGW6Y2ld1ALsZ5UJn8rog7hKF3zHx5iQbNQ8uLcRlw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "sax": "^1.2.4"
-      },
-      "engines": {
-        "node": ">=12.0.0"
       }
     },
     "node_modules/dmg-builder/node_modules/fs-extra": {
@@ -3370,9 +2792,9 @@
       }
     },
     "node_modules/dmg-builder/node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3382,37 +2804,10 @@
         "graceful-fs": "^4.1.6"
       }
     },
-    "node_modules/dmg-license": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/dmg-license/-/dmg-license-1.0.11.tgz",
-      "integrity": "sha512-ZdzmqwKmECOWJpqefloC5OJy1+WZBBse5+MR88z9g9Zn4VY+WYUkAyojmhzJckH5YbbZGcYIuGAkY5/Ys5OM2Q==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "dependencies": {
-        "@types/plist": "^3.0.1",
-        "@types/verror": "^1.10.3",
-        "ajv": "^6.10.0",
-        "crc": "^3.8.0",
-        "iconv-corefoundation": "^1.1.7",
-        "plist": "^3.0.4",
-        "smart-buffer": "^4.0.2",
-        "verror": "^1.10.0"
-      },
-      "bin": {
-        "dmg-license": "bin/dmg-license.js"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/dotenv": {
-      "version": "16.4.7",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.4.7.tgz",
-      "integrity": "sha512-47qPchRCykZC03FhkYAhrvwU4xDBFIj1QPqaarj6mdM/hgUzfPHcpkHJOn3mJAufFeeAxAzeGsr5X0M4k6fLZQ==",
+      "version": "16.6.1",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
+      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -3445,21 +2840,57 @@
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "call-bind-apply-helpers": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "gopd": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/duplexer2": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/duplexer2/-/duplexer2-0.1.4.tgz",
+      "integrity": "sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "readable-stream": "^2.0.2"
+      }
+    },
+    "node_modules/duplexer2/node_modules/readable-stream": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
       }
     },
-    "node_modules/eastasianwidth": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+    "node_modules/duplexer2/node_modules/safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/duplexer2/node_modules/string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
     "node_modules/ejs": {
       "version": "3.1.10",
       "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
@@ -3477,37 +2908,38 @@
       }
     },
     "node_modules/electron": {
-      "version": "32.3.1",
-      "resolved": "https://registry.npmjs.org/electron/-/electron-32.3.1.tgz",
-      "integrity": "sha512-gjHN9NagNajvllKrTZVwGuCqX1hPF7OI6hkCDFRCbqT5Zr05d17qjDhjyTNBmTca2DpvZIYQMRbqieNCcglVYQ==",
+      "version": "44.1.1",
+      "resolved": "https://registry.npmjs.org/electron/-/electron-44.1.1.tgz",
+      "integrity": "sha512-N2WCq2sbOkqQgvXJYx2lS6UiO8bF+Yr67trDnS6JKa2WxTCRQsAjGl57SUtdW9h6r5PlduBFjIhxhgd3dzv1hg==",
       "dev": true,
-      "hasInstallScript": true,
+      "license": "MIT",
       "dependencies": {
-        "@electron/get": "^2.0.0",
-        "@types/node": "^20.9.0",
-        "extract-zip": "^2.0.1"
+        "@electron-internal/extract-zip": "^1.0.1",
+        "@electron/get": "^5.0.0",
+        "@types/node": "^24.9.0"
       },
       "bin": {
-        "electron": "cli.js"
+        "electron": "cli.js",
+        "install-electron": "install.js"
       },
       "engines": {
-        "node": ">= 12.20.55"
+        "node": ">= 22.12.0"
       }
     },
     "node_modules/electron-builder": {
-      "version": "25.1.8",
-      "resolved": "https://registry.npmjs.org/electron-builder/-/electron-builder-25.1.8.tgz",
-      "integrity": "sha512-poRgAtUHHOnlzZnc9PK4nzG53xh74wj2Jy7jkTrqZ0MWPoHGh1M2+C//hGeYdA+4K8w4yiVCNYoLXF7ySj2Wig==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/electron-builder/-/electron-builder-26.15.3.tgz",
+      "integrity": "sha512-a1KM5heqS3gQCZzizXEI8RjJy3QVogULPdeSknt76uLDpBIW/HDGsMg/XgP0riP6PI9COsRvFITKKGDqA8fJxA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "app-builder-lib": "25.1.8",
-        "builder-util": "25.1.7",
-        "builder-util-runtime": "9.2.10",
+        "app-builder-lib": "26.15.3",
+        "builder-util": "26.15.3",
+        "builder-util-runtime": "9.7.0",
         "chalk": "^4.1.2",
-        "dmg-builder": "25.1.8",
+        "ci-info": "^4.2.0",
+        "dmg-builder": "26.15.3",
         "fs-extra": "^10.1.0",
-        "is-ci": "^3.0.0",
         "lazy-val": "^1.0.5",
         "simple-update-notifier": "2.0.0",
         "yargs": "^17.6.2"
@@ -3521,61 +2953,16 @@
       }
     },
     "node_modules/electron-builder-squirrel-windows": {
-      "version": "25.1.8",
-      "resolved": "https://registry.npmjs.org/electron-builder-squirrel-windows/-/electron-builder-squirrel-windows-25.1.8.tgz",
-      "integrity": "sha512-2ntkJ+9+0GFP6nAISiMabKt6eqBB0kX1QqHNWFWAXgi0VULKGisM46luRFpIBiU3u/TDmhZMM8tzvo2Abn3ayg==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "app-builder-lib": "25.1.8",
-        "archiver": "^5.3.1",
-        "builder-util": "25.1.7",
-        "fs-extra": "^10.1.0"
-      }
-    },
-    "node_modules/electron-builder-squirrel-windows/node_modules/fs-extra": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
-      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/electron-builder-squirrel-windows/node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/electron-builder-squirrel-windows/-/electron-builder-squirrel-windows-26.15.3.tgz",
+      "integrity": "sha512-Jc19XPV9y9+2bAdZPkXuVNGNIEFBq9poHC61l8Kv6FdK7DRG3+Ic0rerC0DXOaeHNz8yW0fg/JnF8GQROOF5MA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
       "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
-      }
-    },
-    "node_modules/electron-builder/node_modules/builder-util-runtime": {
-      "version": "9.2.10",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.2.10.tgz",
-      "integrity": "sha512-6p/gfG1RJSQeIbz8TK5aPNkoztgY1q5TgmGFMAXcY8itsGW6Y2ld1ALsZ5UJn8rog7hKF3zHx5iQbNQ8uLcRlw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "sax": "^1.2.4"
-      },
-      "engines": {
-        "node": ">=12.0.0"
+        "app-builder-lib": "26.15.3",
+        "builder-util": "26.15.3",
+        "electron-winstaller": "5.4.0"
       }
     },
     "node_modules/electron-builder/node_modules/fs-extra": {
@@ -3616,16 +3003,18 @@
       }
     },
     "node_modules/electron-publish": {
-      "version": "25.1.7",
-      "resolved": "https://registry.npmjs.org/electron-publish/-/electron-publish-25.1.7.tgz",
-      "integrity": "sha512-+jbTkR9m39eDBMP4gfbqglDd6UvBC7RLh5Y0MhFSsc6UkGHj9Vj9TWobxevHYMMqmoujL11ZLjfPpMX+Pt6YEg==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/electron-publish/-/electron-publish-26.15.3.tgz",
+      "integrity": "sha512-g/2bn8YTavY4cuS5F+jOS7zmZbXXBV8KZ8yHKfJjFPoKtzBqrpCdNPxBd3tqdBwP7BVd0lGzf7Bk2s0KesWZ4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/fs-extra": "^9.0.11",
-        "builder-util": "25.1.7",
-        "builder-util-runtime": "9.2.10",
+        "aws4": "^1.13.2",
+        "builder-util": "26.15.3",
+        "builder-util-runtime": "9.7.0",
         "chalk": "^4.1.2",
+        "form-data": "^4.0.5",
         "fs-extra": "^10.1.0",
         "lazy-val": "^1.0.5",
         "mime": "^2.5.2"
@@ -3641,20 +3030,6 @@
         "@types/node": "*"
       }
     },
-    "node_modules/electron-publish/node_modules/builder-util-runtime": {
-      "version": "9.2.10",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.2.10.tgz",
-      "integrity": "sha512-6p/gfG1RJSQeIbz8TK5aPNkoztgY1q5TgmGFMAXcY8itsGW6Y2ld1ALsZ5UJn8rog7hKF3zHx5iQbNQ8uLcRlw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "sax": "^1.2.4"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
     "node_modules/electron-publish/node_modules/fs-extra": {
       "version": "10.1.0",
       "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
@@ -3671,9 +3046,9 @@
       }
     },
     "node_modules/electron-publish/node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3706,18 +3081,18 @@
       }
     },
     "node_modules/electron-updater": {
-      "version": "6.6.2",
-      "resolved": "https://registry.npmjs.org/electron-updater/-/electron-updater-6.6.2.tgz",
-      "integrity": "sha512-Cr4GDOkbAUqRHP5/oeOmH/L2Bn6+FQPxVLZtPbcmKZC63a1F3uu5EefYOssgZXG3u/zBlubbJ5PJdITdMVggbw==",
+      "version": "6.8.9",
+      "resolved": "https://registry.npmjs.org/electron-updater/-/electron-updater-6.8.9.tgz",
+      "integrity": "sha512-ZhVxM9iGONUpZGI1FxdMRgJjUFXi7AYGVa5PwKlO1tV1/4zDxQmfKpXOHVztKrd6L9rLcFjERvi1Mf2vxyTkig==",
       "license": "MIT",
       "dependencies": {
-        "builder-util-runtime": "9.3.1",
+        "builder-util-runtime": "9.7.0",
         "fs-extra": "^10.1.0",
         "js-yaml": "^4.1.0",
         "lazy-val": "^1.0.5",
         "lodash.escaperegexp": "^4.1.2",
         "lodash.isequal": "^4.5.0",
-        "semver": "^7.6.3",
+        "semver": "~7.7.3",
         "tiny-typed-emitter": "^2.1.0"
       }
     },
@@ -3747,6 +3122,18 @@
         "graceful-fs": "^4.1.6"
       }
     },
+    "node_modules/electron-updater/node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/electron-window-state": {
       "version": "5.0.3",
       "resolved": "https://registry.npmjs.org/electron-window-state/-/electron-window-state-5.0.3.tgz",
@@ -3760,20 +3147,54 @@
         "node": ">=8.0.0"
       }
     },
-    "node_modules/electron/node_modules/@types/node": {
-      "version": "20.17.19",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.17.19.tgz",
-      "integrity": "sha512-LEwC7o1ifqg/6r2gn9Dns0f1rhK+fPFDoMiceTJ6kWmVk6bgXBI/9IOWfVan4WiAavK9pIVWdX0/e3J+eEUh5A==",
+    "node_modules/electron-winstaller": {
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/electron-winstaller/-/electron-winstaller-5.4.0.tgz",
+      "integrity": "sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "@electron/asar": "^3.2.1",
+        "debug": "^4.1.1",
+        "fs-extra": "^7.0.1",
+        "lodash": "^4.17.21",
+        "temp": "^0.9.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      },
+      "optionalDependencies": {
+        "@electron/windows-sign": "^1.1.2"
+      }
+    },
+    "node_modules/electron-winstaller/node_modules/fs-extra": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-7.0.1.tgz",
+      "integrity": "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==",
       "dev": true,
+      "license": "MIT",
+      "peer": true,
       "dependencies": {
-        "undici-types": "~6.19.2"
+        "graceful-fs": "^4.1.2",
+        "jsonfile": "^4.0.0",
+        "universalify": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=6 <7 || >=8"
       }
     },
-    "node_modules/electron/node_modules/undici-types": {
-      "version": "6.19.8",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz",
-      "integrity": "sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw==",
-      "dev": true
+    "node_modules/electron-winstaller/node_modules/universalify": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz",
+      "integrity": "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">= 4.0.0"
+      }
     },
     "node_modules/elementtree": {
       "version": "0.1.7",
@@ -3799,17 +3220,6 @@
       "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "license": "MIT"
     },
-    "node_modules/encoding": {
-      "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
-      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "iconv-lite": "^0.6.2"
-      }
-    },
     "node_modules/end-of-stream": {
       "version": "1.4.4",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
@@ -3865,9 +3275,9 @@
       }
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4005,19 +3415,10 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/expand-template": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
-      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
-      "license": "(MIT OR WTFPL)",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/exponential-backoff": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.1.tgz",
-      "integrity": "sha512-dX7e/LHVJ6W3DE1MHWi9S1EYzDESENfLrYohG2G++ovZrYOkm4Knwa0mc1cn84xJOR4KEU0WSchhLbd0UklbHw==",
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
+      "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==",
       "dev": true,
       "license": "Apache-2.0"
     },
@@ -4041,17 +3442,6 @@
         "@types/yauzl": "^2.9.1"
       }
     },
-    "node_modules/extsprintf": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/extsprintf/-/extsprintf-1.4.1.tgz",
-      "integrity": "sha512-Wrk35e8ydCKDj/ArClo1VrPVmN8zph5V4AtHwIuHhvMXsKf73UT3BOD+azBIW+3wOJ4FhEH7zyaJCFvChjYvMA==",
-      "dev": true,
-      "engines": [
-        "node >=0.6.0"
-      ],
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -4059,12 +3449,22 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/fast-json-stable-stringify": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+    "node_modules/fast-uri": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "dev": true,
-      "license": "MIT"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
     },
     "node_modules/fd-slicer": {
       "version": "1.1.0",
@@ -4075,6 +3475,24 @@
         "pend": "~1.2.0"
       }
     },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/fetch-blob": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/fetch-blob/-/fetch-blob-3.2.0.tgz",
@@ -4098,16 +3516,10 @@
         "node": "^12.20 || >= 14.13"
       }
     },
-    "node_modules/file-uri-to-path": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
-      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
-      "license": "MIT"
-    },
     "node_modules/filelist": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.4.tgz",
-      "integrity": "sha512-w1cEuf3S+DrLCQL7ET6kz+gmlJdbq9J7yXCSjK/OZCPA+qEN1WyF4ZAf0YYJa4/shHJra2t/d/r8SV4Ji+x+8Q==",
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.6.tgz",
+      "integrity": "sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -4115,9 +3527,9 @@
       }
     },
     "node_modules/filelist/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4125,9 +3537,9 @@
       }
     },
     "node_modules/filelist/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -4137,48 +3549,18 @@
         "node": ">=10"
       }
     },
-    "node_modules/foreground-child": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.0.tgz",
-      "integrity": "sha512-Ld2g8rrAyMYFXBhEqMz8ZAHBi4J4uS1i/CxGMDnjyFWddMXLVcDp051DZfu+t7+ab7Wv6SMqpWmyFIj5UbfFvg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "cross-spawn": "^7.0.0",
-        "signal-exit": "^4.0.1"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/foreground-child/node_modules/signal-exit": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/form-data": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
-      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -4196,12 +3578,6 @@
         "node": ">=12.20.0"
       }
     },
-    "node_modules/fs-constants": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
-      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
-      "license": "MIT"
-    },
     "node_modules/fs-extra": {
       "version": "11.1.1",
       "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.1.1.tgz",
@@ -4256,27 +3632,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/gauge": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/gauge/-/gauge-4.0.4.tgz",
-      "integrity": "sha512-f9m+BEN5jkg6a0fZjleidjN51VE1X+mPFQ2DJ0uv1V39oCLCbsGe6yjbBnp7eK7z/+GAon99a3nHuqbuuthyPg==",
-      "deprecated": "This package is no longer supported.",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "aproba": "^1.0.3 || ^2.0.0",
-        "color-support": "^1.1.3",
-        "console-control-strings": "^1.1.0",
-        "has-unicode": "^2.0.1",
-        "signal-exit": "^3.0.7",
-        "string-width": "^4.2.3",
-        "strip-ansi": "^6.0.1",
-        "wide-align": "^1.1.5"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
-    },
     "node_modules/get-caller-file": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
@@ -4341,56 +3696,28 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/github-from-package": {
-      "version": "0.0.0",
-      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
-      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
-      "license": "MIT"
-    },
     "node_modules/glob": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
-      "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
         "fs.realpath": "^1.0.0",
         "inflight": "^1.0.4",
         "inherits": "2",
-        "minimatch": "^5.0.1",
-        "once": "^1.3.0"
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
       },
       "engines": {
-        "node": ">=12"
+        "node": "*"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/glob/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/global-agent": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/global-agent/-/global-agent-3.0.0.tgz",
@@ -4556,17 +3883,10 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/has-unicode": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/has-unicode/-/has-unicode-2.0.1.tgz",
-      "integrity": "sha512-8Rf9Y83NBReMnx0gFzA8JImQACstCYWUplepDa9xprwwtmgEZUF0h/i5xSA625zB/I37EtrswSST6OXxwaaIJQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4590,25 +3910,24 @@
       }
     },
     "node_modules/http-cache-semantics": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz",
-      "integrity": "sha512-er295DKPVsV82j5kw1Gjt+ADA/XYHsajl82cGNQG2eyoPkvgUhX+nDIyelzhIWbbsXP39EHcI6l5tYs2FYqYXQ==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
+      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
       "dev": true,
       "license": "BSD-2-Clause"
     },
     "node_modules/http-proxy-agent": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-5.0.0.tgz",
-      "integrity": "sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@tootallnate/once": "2",
-        "agent-base": "6",
-        "debug": "4"
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">= 14"
       }
     },
     "node_modules/http2-wrapper": {
@@ -4626,17 +3945,17 @@
       }
     },
     "node_modules/https-proxy-agent": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
-      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "agent-base": "6",
+        "agent-base": "^7.1.2",
         "debug": "4"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">= 14"
       }
     },
     "node_modules/human-signals": {
@@ -4648,47 +3967,6 @@
         "node": ">=14.18.0"
       }
     },
-    "node_modules/humanize-ms": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz",
-      "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.0.0"
-      }
-    },
-    "node_modules/iconv-corefoundation": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/iconv-corefoundation/-/iconv-corefoundation-1.1.7.tgz",
-      "integrity": "sha512-T10qvkw0zz4wnm560lOEg0PovVqUXuOFhhHAkixw8/sycy7TJt7v/RrkEKEQnAw2viPSJu6iAkErxnzR0g8PpQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "dependencies": {
-        "cli-truncate": "^2.1.0",
-        "node-addon-api": "^1.6.3"
-      },
-      "engines": {
-        "node": "^8.11.2 || >=10"
-      }
-    },
-    "node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/ieee754": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
@@ -4709,33 +3987,6 @@
       ],
       "license": "BSD-3-Clause"
     },
-    "node_modules/imurmurhash": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.19"
-      }
-    },
-    "node_modules/indent-string": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
-      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/infer-owner": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/infer-owner/-/infer-owner-1.0.4.tgz",
-      "integrity": "sha512-IClj+Xz94+d7irH5qRyfJonOdfTzuDaifE6ZPWfx0N0+/ATZCbuTPq2prFl526urkQd90WyUKIh1DfBQ2hMz9A==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/inflight": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
@@ -4773,33 +4024,6 @@
         "node": ">= 0.10"
       }
     },
-    "node_modules/ip-address": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-9.0.5.tgz",
-      "integrity": "sha512-zHtQzGojZXTwZTHQqra+ETKd4Sn3vgi7uBmlPoXVWZqYvuKmtI0l/VZTjqGmJY9x88GGOaZ9+G9ES8hC4T4X8g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "jsbn": "1.1.0",
-        "sprintf-js": "^1.1.3"
-      },
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/is-ci": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/is-ci/-/is-ci-3.0.1.tgz",
-      "integrity": "sha512-ZYvCgrefwqoQ6yTyYUbQu64HsITZ3NfKX1lzaEYdkTDcfKzzCI/wthRRYKkdjHKFVgNiXKAKm65Zo1pk2as/QQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ci-info": "^3.2.0"
-      },
-      "bin": {
-        "is-ci": "bin.js"
-      }
-    },
     "node_modules/is-core-module": {
       "version": "2.16.1",
       "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
@@ -4849,13 +4073,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/is-lambda": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/is-lambda/-/is-lambda-1.0.1.tgz",
-      "integrity": "sha512-z7CMFGNrENq5iFB9Bqo64Xk6Y9sg+epq1myIcdHaGnbMTYOxvzsEtdYqQUylB7LxfkvgrrjP32T6Ywciio9UIQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/is-stream": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-3.0.0.tgz",
@@ -4897,13 +4114,12 @@
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
       "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/isbinaryfile": {
-      "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/isbinaryfile/-/isbinaryfile-5.0.4.tgz",
-      "integrity": "sha512-YKBKVkKhty7s8rxddb40oOkuP0NbaeXrQvLin6QMHL7Ypiy2RW9LwOVrVgZRyOrhQlayMd9t+D8yDy8MKFTSDQ==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/isbinaryfile/-/isbinaryfile-5.0.7.tgz",
+      "integrity": "sha512-gnWD14Jh3FzS3CPhF0AxNOJ8CxqeblPTADzI38r0wt8ZyQl5edpy75myt08EG2oKvpyiqSqsx+Wkz9vtkbTqYQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4919,33 +4135,16 @@
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
       "license": "ISC"
     },
-    "node_modules/jackspeak": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/cliui": "^8.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "optionalDependencies": {
-        "@pkgjs/parseargs": "^0.11.0"
-      }
-    },
     "node_modules/jake": {
-      "version": "10.9.2",
-      "resolved": "https://registry.npmjs.org/jake/-/jake-10.9.2.tgz",
-      "integrity": "sha512-2P4SQ0HrLQ+fw6llpLnOaGAvN2Zu6778SJMrCUwns4fOoG9ayrTiZk3VV8sCPkVZF8ab0zksVpS8FDY5pRCNBA==",
+      "version": "10.9.4",
+      "resolved": "https://registry.npmjs.org/jake/-/jake-10.9.4.tgz",
+      "integrity": "sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "async": "^3.2.3",
-        "chalk": "^4.0.2",
+        "async": "^3.2.6",
         "filelist": "^1.0.4",
-        "minimatch": "^3.1.2"
+        "picocolors": "^1.1.1"
       },
       "bin": {
         "jake": "bin/cli.js"
@@ -4954,6 +4153,16 @@
         "node": ">=10"
       }
     },
+    "node_modules/jiti": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jiti": "lib/jiti-cli.mjs"
+      }
+    },
     "node_modules/js-yaml": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
@@ -4966,13 +4175,6 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
-    "node_modules/jsbn": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/jsbn/-/jsbn-1.1.0.tgz",
-      "integrity": "sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/json-buffer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
@@ -4980,9 +4182,9 @@
       "license": "MIT"
     },
     "node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
       "dev": true,
       "license": "MIT"
     },
@@ -5040,60 +4242,10 @@
       "integrity": "sha512-0/BnGCCfyUMkBpeDgWihanIAF9JmZhHBgUhEqzvf+adhNGLoP6TaiI5oF8oyb3I45P+PcnrqihSf01M0l0G5+Q==",
       "license": "MIT"
     },
-    "node_modules/lazystream": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/lazystream/-/lazystream-1.0.1.tgz",
-      "integrity": "sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "readable-stream": "^2.0.5"
-      },
-      "engines": {
-        "node": ">= 0.6.3"
-      }
-    },
-    "node_modules/lazystream/node_modules/readable-stream": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "core-util-is": "~1.0.0",
-        "inherits": "~2.0.3",
-        "isarray": "~1.0.0",
-        "process-nextick-args": "~2.0.0",
-        "safe-buffer": "~5.1.1",
-        "string_decoder": "~1.1.1",
-        "util-deprecate": "~1.0.1"
-      }
-    },
-    "node_modules/lazystream/node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/lazystream/node_modules/string_decoder": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "safe-buffer": "~5.1.0"
-      }
-    },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "dev": true,
       "license": "MIT"
     },
@@ -5103,58 +4255,18 @@
       "integrity": "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==",
       "license": "MIT"
     },
-    "node_modules/lodash.defaults": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/lodash.defaults/-/lodash.defaults-4.2.0.tgz",
-      "integrity": "sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/lodash.difference": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.difference/-/lodash.difference-4.5.0.tgz",
-      "integrity": "sha512-dS2j+W26TQ7taQBGN8Lbbq04ssV3emRw4NY58WErlTO29pIqS0HmoT5aJ9+TUQ1N3G+JOZSji4eugsWwGp9yPA==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/lodash.escaperegexp": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/lodash.escaperegexp/-/lodash.escaperegexp-4.1.2.tgz",
       "integrity": "sha512-TM9YBvyC84ZxE3rgfefxUWiQKLilstD6k7PTGt6wfbtXF8ixIJLOL3VYyV/z+ZiPLsVxAsKAFVwWlWeb2Y8Yyw==",
       "license": "MIT"
     },
-    "node_modules/lodash.flatten": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/lodash.flatten/-/lodash.flatten-4.4.0.tgz",
-      "integrity": "sha512-C5N2Z3DgnnKr0LOpv/hKCgKdb7ZZwafIrsesve6lmzvZIRZRGaZ/l6Q8+2W7NaT+ZwO3fFlSCzCzrDCFdJfZ4g==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/lodash.isequal": {
       "version": "4.5.0",
       "resolved": "https://registry.npmjs.org/lodash.isequal/-/lodash.isequal-4.5.0.tgz",
       "integrity": "sha512-pDo3lu8Jhfjqls6GkMgpahsF9kCyayhgykjyLMNFTKWrpVdAQtYyB4muAMWozBB4ig/dtWAmsMxLEI8wuz+DYQ==",
       "license": "MIT"
     },
-    "node_modules/lodash.isplainobject": {
-      "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
-      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/lodash.union": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/lodash.union/-/lodash.union-4.6.0.tgz",
-      "integrity": "sha512-c4pB2CdGrGdjMKYLA+XiRDO7Y0PRQbm/Gzg8qMj+QH+pFVAoTp5sBpO0odL3FjoPCGjK96p6qsP+yQoiLoOBcw==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/log-symbols": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
@@ -5194,44 +4306,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/make-fetch-happen": {
-      "version": "10.2.1",
-      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-10.2.1.tgz",
-      "integrity": "sha512-NgOPbRiaQM10DYXvN3/hhGVI2M5MtITFryzBGxHM5p4wnFxsVCbxkrBrDsk+EZ5OB4jEOT7AjDxtdF+KVEFT7w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "agentkeepalive": "^4.2.1",
-        "cacache": "^16.1.0",
-        "http-cache-semantics": "^4.1.0",
-        "http-proxy-agent": "^5.0.0",
-        "https-proxy-agent": "^5.0.0",
-        "is-lambda": "^1.0.1",
-        "lru-cache": "^7.7.1",
-        "minipass": "^3.1.6",
-        "minipass-collect": "^1.0.2",
-        "minipass-fetch": "^2.0.3",
-        "minipass-flush": "^1.0.5",
-        "minipass-pipeline": "^1.2.4",
-        "negotiator": "^0.6.3",
-        "promise-retry": "^2.0.1",
-        "socks-proxy-agent": "^7.0.0",
-        "ssri": "^9.0.0"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
-    },
-    "node_modules/make-fetch-happen/node_modules/lru-cache": {
-      "version": "7.18.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-7.18.3.tgz",
-      "integrity": "sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
     "node_modules/matcher": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/matcher/-/matcher-3.0.0.tgz",
@@ -5349,76 +4423,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/minipass-collect": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-1.0.2.tgz",
-      "integrity": "sha512-6T6lH0H8OG9kITm/Jm6tdooIbogG9e0tLgpY6mphXSm/A9u8Nq1ryBG+Qspiub9LjWlBPsPS3tWQ/Botq4FdxA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/minipass-fetch": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-2.1.2.tgz",
-      "integrity": "sha512-LT49Zi2/WMROHYoqGgdlQIZh8mLPZmOrN2NdJjMXxYe4nkN6FUyuPuOAOedNJDrx0IRGg9+4guZewtp8hE6TxA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "minipass": "^3.1.6",
-        "minipass-sized": "^1.0.3",
-        "minizlib": "^2.1.2"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      },
-      "optionalDependencies": {
-        "encoding": "^0.1.13"
-      }
-    },
-    "node_modules/minipass-flush": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
-      "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/minipass-pipeline": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
-      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/minipass-sized": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
-      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/minizlib": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
@@ -5444,12 +4448,6 @@
         "mkdirp": "bin/cmd.js"
       }
     },
-    "node_modules/mkdirp-classic": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
-      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
-      "license": "MIT"
-    },
     "node_modules/moment": {
       "version": "2.30.1",
       "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
@@ -5477,12 +4475,6 @@
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
-    "node_modules/napi-build-utils": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
-      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
-      "license": "MIT"
-    },
     "node_modules/native-run": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/native-run/-/native-run-2.0.1.tgz",
@@ -5508,40 +4500,19 @@
         "node": ">=16.0.0"
       }
     },
-    "node_modules/negotiator": {
-      "version": "0.6.4",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.4.tgz",
-      "integrity": "sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/node-abi": {
-      "version": "3.71.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.71.0.tgz",
-      "integrity": "sha512-SZ40vRiy/+wRTf21hxkkEjPJZpARzUMVcJoQse2EF8qkUWbbO2z7vd5oA/H6bVH6SZQ5STGcu0KRDS7biNRfxw==",
+    "node_modules/node-addon-api": {
+      "version": "8.9.2",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.9.2.tgz",
+      "integrity": "sha512-VijLXbi3UACN69I0JVXJsX4tjACjNoQDgv2gTF6sx2wWEi8tkSg2eX8p5gSIFi8z2+DL3oHmY6OyKce38SDolg==",
       "license": "MIT",
-      "dependencies": {
-        "semver": "^7.3.5"
-      },
       "engines": {
-        "node": ">=10"
+        "node": "^18 || ^20 || >= 21"
       }
     },
-    "node_modules/node-addon-api": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-1.7.2.tgz",
-      "integrity": "sha512-ibPK3iA+vaY1eEjESkQkM0BbCqFOaZMiXRTtdB0u7b4djtY6JnsjvPdUHVMg6xQt3B8fpTTWHI9A+ADjM9frzg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/node-api-version": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/node-api-version/-/node-api-version-0.2.0.tgz",
-      "integrity": "sha512-fthTTsi8CxaBXMaBAD7ST2uylwvsnYxh2PfaScwpMhos6KlSFajXQPcM4ogNE1q2s3Lbz9GCGqeIHC+C6OZnKg==",
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/node-api-version/-/node-api-version-0.2.1.tgz",
+      "integrity": "sha512-2xP/IGGMmmSQpI1+O/k72jF/ykvZ89JeuKX3TLJAYPDVLUalrshrLHkeVcCCZqG/eEa635cr8IBYzgnDvM2O8Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5587,95 +4558,147 @@
       }
     },
     "node_modules/node-gyp": {
-      "version": "9.4.1",
-      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-9.4.1.tgz",
-      "integrity": "sha512-OQkWKbjQKbGkMf/xqI1jjy3oCTgMKJac58G2+bjZb3fza6gW2YrCSdMQYaoTb70crvE//Gngr4f0AgVHmqHvBQ==",
+      "version": "12.4.0",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-12.4.0.tgz",
+      "integrity": "sha512-OMcPNvqTCFUnNaBlmdgq+lfNqY7gTiSmNRDjY3uAXRyudeKZEZxu3CLtjMQrx4zZxCX2b/mpNqTtwuCJgXhHkw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "env-paths": "^2.2.0",
         "exponential-backoff": "^3.1.1",
-        "glob": "^7.1.4",
         "graceful-fs": "^4.2.6",
-        "make-fetch-happen": "^10.0.3",
-        "nopt": "^6.0.0",
-        "npmlog": "^6.0.0",
-        "rimraf": "^3.0.2",
+        "nopt": "^9.0.0",
+        "proc-log": "^6.0.0",
         "semver": "^7.3.5",
-        "tar": "^6.1.2",
-        "which": "^2.0.2"
+        "tar": "^7.5.4",
+        "tinyglobby": "^0.2.12",
+        "undici": "^6.25.0",
+        "which": "^6.0.0"
       },
       "bin": {
         "node-gyp": "bin/node-gyp.js"
       },
       "engines": {
-        "node": "^12.13 || ^14.13 || >=16"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/node-gyp/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
+    "node_modules/node-gyp/node_modules/chownr": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/node-gyp/node_modules/isexe": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz",
+      "integrity": "sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/node-gyp/node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/node-gyp/node_modules/minizlib": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+        "minipass": "^7.1.2"
       },
       "engines": {
-        "node": "*"
+        "node": ">= 18"
+      }
+    },
+    "node_modules/node-gyp/node_modules/tar": {
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/node-gyp/node_modules/rimraf": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
-      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
-      "deprecated": "Rimraf versions prior to v4 are no longer supported",
+    "node_modules/node-gyp/node_modules/undici": {
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
+    "node_modules/node-gyp/node_modules/which": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/which/-/which-6.0.1.tgz",
+      "integrity": "sha512-oGLe46MIrCRqX7ytPUf66EAYvdeMIZYn3WaocqqKZAxrBpkqHfL/qvTyJ/bTk5+AqHCjXmrv3CEWgy368zhRUg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "glob": "^7.1.3"
+        "isexe": "^4.0.0"
       },
       "bin": {
-        "rimraf": "bin.js"
+        "node-which": "bin/which.js"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/node-gyp/node_modules/yallist": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
       }
     },
+    "node_modules/node-int64": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
+      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/nopt": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/nopt/-/nopt-6.0.0.tgz",
-      "integrity": "sha512-ZwLpbTgdhuZUnZzjd7nb1ZV+4DoiC6/sfiVKok72ym/4Tlf+DFdlHYmT2JPmcNNWV6Pi3SDf1kT+A4r9RTuT9g==",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-9.0.0.tgz",
+      "integrity": "sha512-Zhq3a+yFKrYwSBluL4H9XP3m3y5uvQkB/09CwDruCiRmR/UJYnn9W4R48ry0uGC70aeTPKLynBtscP9efFFcPw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "abbrev": "^1.0.0"
+        "abbrev": "^4.0.0"
       },
       "bin": {
         "nopt": "bin/nopt.js"
       },
       "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
-    },
-    "node_modules/normalize-path": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
-      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/normalize-url": {
@@ -5718,23 +4741,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/npmlog": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/npmlog/-/npmlog-6.0.2.tgz",
-      "integrity": "sha512-/vBvz5Jfr9dT/aFWd0FIRf+T/Q2WBsLENygUaFUqstqsycmZAP/t5BvFJTK0viFmSUxiUKTUplWy5vt+rvKIxg==",
-      "deprecated": "This package is no longer supported.",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "are-we-there-yet": "^3.0.0",
-        "console-control-strings": "^1.1.0",
-        "gauge": "^4.0.3",
-        "set-blocking": "^2.0.0"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
-    },
     "node_modules/object-keys": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
@@ -5836,29 +4842,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/p-map": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/p-map/-/p-map-4.0.0.tgz",
-      "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "aggregate-error": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/package-json-from-dist": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0"
-    },
     "node_modules/path-is-absolute": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
@@ -5937,6 +4920,26 @@
       "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
       "license": "MIT"
     },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/pkijs": {
       "version": "3.4.0",
       "resolved": "https://registry.npmjs.org/pkijs/-/pkijs-3.4.0.tgz",
@@ -5968,41 +4971,32 @@
         "node": ">=10.4.0"
       }
     },
-    "node_modules/prebuild-install": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
-      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
-      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
-      "license": "MIT",
-      "dependencies": {
-        "detect-libc": "^2.0.0",
-        "expand-template": "^2.0.3",
-        "github-from-package": "0.0.0",
-        "minimist": "^1.2.3",
-        "mkdirp-classic": "^0.5.3",
-        "napi-build-utils": "^2.0.0",
-        "node-abi": "^3.3.0",
-        "pump": "^3.0.0",
-        "rc": "^1.2.7",
-        "simple-get": "^4.0.0",
-        "tar-fs": "^2.0.0",
-        "tunnel-agent": "^0.6.0"
+    "node_modules/postject": {
+      "version": "1.0.0-alpha.6",
+      "resolved": "https://registry.npmjs.org/postject/-/postject-1.0.0-alpha.6.tgz",
+      "integrity": "sha512-b9Eb8h2eVqNE8edvKdwqkrY6O7kAwmI8kcnBv1NScolYJbo59XUF0noFq+lxbC1yN20bmC0WBEbDC5H/7ASb0A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "commander": "^9.4.0"
       },
       "bin": {
-        "prebuild-install": "bin.js"
+        "postject": "dist/cli.js"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=14.0.0"
       }
     },
     "node_modules/proc-log": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-2.0.1.tgz",
-      "integrity": "sha512-Kcmo2FhfDTXdcbfDH76N7uBYHINxc/8GW7UAVuVP9I+Va3uHSerrnKV6dLooga/gh7GlgzuCCr/eoldnL1muGw==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-6.1.0.tgz",
+      "integrity": "sha512-iG+GYldRf2BQ0UDUAd6JQ/RwzaQy6mXmsk/IzlYyal4A4SNFw54MeH4/tLkF4I5WoWG9SQwuqWzS99jaFQHBuQ==",
       "dev": true,
       "license": "ISC",
       "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/process-nextick-args": {
@@ -6010,8 +5004,7 @@
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
       "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/progress": {
       "version": "2.0.3",
@@ -6023,13 +5016,6 @@
         "node": ">=0.4.0"
       }
     },
-    "node_modules/promise-inflight": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/promise-inflight/-/promise-inflight-1.0.1.tgz",
-      "integrity": "sha512-6zWPyEOFaQBJYcGMHBKTKJ3u6TBsnMFOIZSa6ce1e/ZrrsOlnHRHbabMjLiBYKp+n44X9eUI6VUPaukCXHuG4g==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/promise-retry": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
@@ -6066,6 +5052,18 @@
         "node": ">=6"
       }
     },
+    "node_modules/proper-lockfile": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
+      "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "retry": "^0.12.0",
+        "signal-exit": "^3.0.2"
+      }
+    },
     "node_modules/pump": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.2.tgz",
@@ -6076,16 +5074,6 @@
         "once": "^1.3.1"
       }
     },
-    "node_modules/punycode": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/pvtsutils": {
       "version": "1.3.6",
       "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
@@ -6117,27 +5105,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/rc": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
-      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
-      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
-      "dependencies": {
-        "deep-extend": "^0.6.0",
-        "ini": "~1.3.0",
-        "minimist": "^1.2.0",
-        "strip-json-comments": "~2.0.1"
-      },
-      "bin": {
-        "rc": "cli.js"
-      }
-    },
-    "node_modules/rc/node_modules/ini": {
-      "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
-      "license": "ISC"
-    },
     "node_modules/read-binary-file-arch": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/read-binary-file-arch/-/read-binary-file-arch-1.0.6.tgz",
@@ -6165,42 +5132,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/readdir-glob": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/readdir-glob/-/readdir-glob-1.1.3.tgz",
-      "integrity": "sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "minimatch": "^5.1.0"
-      }
-    },
-    "node_modules/readdir-glob/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/readdir-glob/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
-      "dev": true,
-      "license": "ISC",
-      "peer": true,
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/readdirp": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
@@ -6242,6 +5173,16 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/resedit": {
       "version": "1.7.2",
       "resolved": "https://registry.npmjs.org/resedit/-/resedit-1.7.2.tgz",
@@ -6452,17 +5393,10 @@
       ],
       "license": "MIT"
     },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/sanitize-filename": {
-      "version": "1.6.3",
-      "resolved": "https://registry.npmjs.org/sanitize-filename/-/sanitize-filename-1.6.3.tgz",
-      "integrity": "sha512-y/52Mcy7aw3gRm7IrcGDFx/bCk4AhRh2eI9luHOQM86nZsqwiRkkq2GekHXBBD+SmPidc8i2PqtYZl+pWJ8Oeg==",
+      "version": "1.6.4",
+      "resolved": "https://registry.npmjs.org/sanitize-filename/-/sanitize-filename-1.6.4.tgz",
+      "integrity": "sha512-9ZyI08PsvdQl2r/bBIGubpVdR3RR9sY6RDiWFPreA21C/EFlQhmgo20UZlNjZMMZNubusLhAQozkA0Od5J21Eg==",
       "dev": true,
       "license": "WTFPL OR ISC",
       "dependencies": {
@@ -6523,13 +5457,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/set-blocking": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
-      "integrity": "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/sharp": {
       "version": "0.34.5",
       "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
@@ -6613,78 +5540,11 @@
         "node": ">=4"
       }
     },
-    "node_modules/shelljs/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/signal-exit": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
-      "license": "ISC"
-    },
-    "node_modules/simple-concat": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
-      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/simple-get": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
-      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "decompress-response": "^6.0.0",
-        "once": "^1.3.1",
-        "simple-concat": "^1.0.0"
-      }
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "license": "ISC"
     },
     "node_modules/simple-update-notifier": {
       "version": "2.0.0",
@@ -6722,47 +5582,6 @@
         "url": "https://github.com/chalk/slice-ansi?sponsor=1"
       }
     },
-    "node_modules/smart-buffer": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 6.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks": {
-      "version": "2.8.3",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.3.tgz",
-      "integrity": "sha512-l5x7VUUWbjVFbafGLxPWkYsHIhEvmF85tbIeFZWc8ZPtoMyybuEhL7Jye/ooC4/d48FgOjSJXgsF/AJPYCW8Zw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ip-address": "^9.0.5",
-        "smart-buffer": "^4.2.0"
-      },
-      "engines": {
-        "node": ">= 10.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks-proxy-agent": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-7.0.0.tgz",
-      "integrity": "sha512-Fgl0YPZ902wEsAyiQ+idGd1A7rSFx/ayC1CQVMw5P+EQx2V0SgpGtf6OKFhVjPflPUl9YMmEOnmfjCdMUsygww==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^6.0.2",
-        "debug": "^4.3.3",
-        "socks": "^2.6.2"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
     "node_modules/source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -6798,20 +5617,8 @@
       "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
       "integrity": "sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==",
       "dev": true,
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/ssri": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/ssri/-/ssri-9.0.1.tgz",
-      "integrity": "sha512-o57Wcn66jMQvfHG1FlYbWeZWW/dHZhJXjpIcTfXldXEk5nz5lStPo3mK0OJQfGR3RbZUlbISexbljkJzuEj/8Q==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.1.1"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/stat-mode": {
       "version": "1.0.0",
@@ -6846,22 +5653,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/string-width-cjs": {
-      "name": "string-width",
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
@@ -6874,20 +5665,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/strip-ansi-cjs": {
-      "name": "strip-ansi",
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/strip-final-newline": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-3.0.0.tgz",
@@ -6900,15 +5677,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/strip-json-comments": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
-      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/sumchecker": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/sumchecker/-/sumchecker-3.0.1.tgz",
@@ -6964,40 +5732,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/tar-fs": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
-      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
-      "license": "MIT",
-      "dependencies": {
-        "chownr": "^1.1.1",
-        "mkdirp-classic": "^0.5.2",
-        "pump": "^3.0.0",
-        "tar-stream": "^2.1.4"
-      }
-    },
-    "node_modules/tar-fs/node_modules/chownr": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
-      "license": "ISC"
-    },
-    "node_modules/tar-stream": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
-      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
-      "license": "MIT",
-      "dependencies": {
-        "bl": "^4.0.3",
-        "end-of-stream": "^1.4.1",
-        "fs-constants": "^1.0.0",
-        "inherits": "^2.0.3",
-        "readable-stream": "^3.1.1"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/tar/node_modules/minipass": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz",
@@ -7019,6 +5753,21 @@
         "node": ">=10"
       }
     },
+    "node_modules/temp": {
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/temp/-/temp-0.9.4.tgz",
+      "integrity": "sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "mkdirp": "^0.5.1",
+        "rimraf": "~2.6.2"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/temp-file": {
       "version": "3.4.0",
       "resolved": "https://registry.npmjs.org/temp-file/-/temp-file-3.4.0.tgz",
@@ -7046,9 +5795,9 @@
       }
     },
     "node_modules/temp-file/node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7058,6 +5807,21 @@
         "graceful-fs": "^4.1.6"
       }
     },
+    "node_modules/temp/node_modules/rimraf": {
+      "version": "2.6.3",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.6.3.tgz",
+      "integrity": "sha512-mwqeW5XsA2qAejG46gYdENaxXjx9onRNCfn7L0duuP4hCuTIi/QO7PDK07KJfp1d+izWPrzEJDcSqBa0OZQriA==",
+      "deprecated": "Rimraf versions prior to v4 are no longer supported",
+      "dev": true,
+      "license": "ISC",
+      "peer": true,
+      "dependencies": {
+        "glob": "^7.1.3"
+      },
+      "bin": {
+        "rimraf": "bin.js"
+      }
+    },
     "node_modules/through2": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/through2/-/through2-4.0.2.tgz",
@@ -7067,16 +5831,53 @@
         "readable-stream": "3"
       }
     },
+    "node_modules/tiny-async-pool": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/tiny-async-pool/-/tiny-async-pool-1.3.0.tgz",
+      "integrity": "sha512-01EAw5EDrcVrdgyCLgoSPvqznC0sVxDSVeiOz09FUpjh71G79VCqneOr+xvt7T1r76CF6ZZfPjHorN2+d+3mqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^5.5.0"
+      }
+    },
+    "node_modules/tiny-async-pool/node_modules/semver": {
+      "version": "5.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver"
+      }
+    },
     "node_modules/tiny-typed-emitter": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/tiny-typed-emitter/-/tiny-typed-emitter-2.1.0.tgz",
       "integrity": "sha512-qVtvMxeXbVej0cQWKqVSSAHmKZEHAvxdF8HEUBFWts8h+xEo5m/lEiPakuyZ3BnCBjOD8i24kzNOiOLLgsSxhA==",
       "license": "MIT"
     },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
     "node_modules/tmp": {
-      "version": "0.2.3",
-      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.3.tgz",
-      "integrity": "sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==",
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz",
+      "integrity": "sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7136,18 +5937,6 @@
       "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
       "license": "0BSD"
     },
-    "node_modules/tunnel-agent": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "safe-buffer": "^5.0.1"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/tweetnacl": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/tweetnacl/-/tweetnacl-1.0.3.tgz",
@@ -7180,37 +5969,22 @@
         "node": ">=14.17"
       }
     },
-    "node_modules/undici-types": {
-      "version": "6.20.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.20.0.tgz",
-      "integrity": "sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==",
-      "license": "MIT"
-    },
-    "node_modules/unique-filename": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-2.0.1.tgz",
-      "integrity": "sha512-ODWHtkkdx3IAR+veKxFV+VBkUMcN+FaqzUUd7IZzt+0zhDZFPFxhlqwPF3YQvMHx1TD0tdgYl+kuPnJ8E6ql7A==",
+    "node_modules/undici": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
       "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "unique-slug": "^3.0.0"
-      },
+      "license": "MIT",
+      "optional": true,
       "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+        "node": ">=20.18.1"
       }
     },
-    "node_modules/unique-slug": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-3.0.0.tgz",
-      "integrity": "sha512-8EyMynh679x/0gqE9fT9oilG+qEt+ibFyqjuVTsZn1+CMxH+XLlpvr2UZx4nVcCwTpx81nICr2JQFkM+HPLq4w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "imurmurhash": "^0.1.4"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
+    "node_modules/undici-types": {
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
+      "license": "MIT"
     },
     "node_modules/universalify": {
       "version": "2.0.1",
@@ -7236,14 +6010,46 @@
         "node": ">=8"
       }
     },
-    "node_modules/uri-js": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+    "node_modules/unzipper": {
+      "version": "0.12.5",
+      "resolved": "https://registry.npmjs.org/unzipper/-/unzipper-0.12.5.tgz",
+      "integrity": "sha512-tXYOi9R57Uj/2Z25SOs5RRSzq886MBQj2gY8dPL+xl/kv6s6SvByoKfAtvfVeEuhntWDgjd2o9p2lb4TVPAz0A==",
       "dev": true,
-      "license": "BSD-2-Clause",
+      "license": "MIT",
+      "dependencies": {
+        "bluebird": "~3.7.2",
+        "duplexer2": "~0.1.4",
+        "fs-extra": "11.3.1",
+        "graceful-fs": "^4.2.2",
+        "node-int64": "^0.4.0"
+      }
+    },
+    "node_modules/unzipper/node_modules/fs-extra": {
+      "version": "11.3.1",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.1.tgz",
+      "integrity": "sha512-eXvGGwZ5CL17ZSwHWd3bbgk7UUpF6IFHtP57NYYakPvHOs8GDgDe5KJI36jIJzDkJ6eJjuzRA8eBQb6SkKue0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
+    "node_modules/unzipper/node_modules/jsonfile": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "punycode": "^2.1.0"
+        "universalify": "^2.0.0"
+      },
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
       }
     },
     "node_modules/utf8-byte-length": {
@@ -7259,22 +6065,6 @@
       "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "license": "MIT"
     },
-    "node_modules/verror": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.1.tgz",
-      "integrity": "sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "assert-plus": "^1.0.0",
-        "core-util-is": "1.0.2",
-        "extsprintf": "^1.2.0"
-      },
-      "engines": {
-        "node": ">=0.6.0"
-      }
-    },
     "node_modules/wcwidth": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
@@ -7293,6 +6083,20 @@
         "node": ">= 8"
       }
     },
+    "node_modules/webcrypto-core": {
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/webcrypto-core/-/webcrypto-core-1.9.2.tgz",
+      "integrity": "sha512-gsXecm82UQNlTBURJGuqOWy1Ww08S3kZUcr3aOJS02Pk0xLtkfeUAVC0u0xhgdonFme80edSJUIJyuvL/7250Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/json-schema": "^1.1.12",
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -7308,16 +6112,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/wide-align": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/wide-align/-/wide-align-1.1.5.tgz",
-      "integrity": "sha512-eDMORYaPNZ4sQIuuYPDHdQvf4gyCF9rEEV/yPxGfwPkRodwEgiMUUXTx/dex+Me0wxx53S+NgUHaP7y3MGlDmg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^1.0.2 || 2 || 3 || 4"
-      }
-    },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
@@ -7335,25 +6129,6 @@
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
       }
     },
-    "node_modules/wrap-ansi-cjs": {
-      "name": "wrap-ansi",
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
@@ -7432,9 +6207,9 @@
       "license": "ISC"
     },
     "node_modules/yargs": {
-      "version": "17.7.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
-      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
+      "version": "17.7.3",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
+      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7482,68 +6257,6 @@
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
-    },
-    "node_modules/zip-stream": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-4.1.1.tgz",
-      "integrity": "sha512-9qv4rlDiopXg4E69k+vMHjNN63YFMe9sZMrdlvKnCjlCRWeCBswPPMPUfx+ipsAWq1LXHe70RcbaHdJJpS6hyQ==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "archiver-utils": "^3.0.4",
-        "compress-commons": "^4.1.2",
-        "readable-stream": "^3.6.0"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/zip-stream/node_modules/archiver-utils": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-3.0.4.tgz",
-      "integrity": "sha512-KVgf4XQVrTjhyWmx6cte4RxonPLR9onExufI1jhvw/MQ4BB6IsZD5gT8Lq+u/+pRkWna/6JoHpiQioaqFP5Rzw==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "glob": "^7.2.3",
-        "graceful-fs": "^4.2.0",
-        "lazystream": "^1.0.0",
-        "lodash.defaults": "^4.2.0",
-        "lodash.difference": "^4.5.0",
-        "lodash.flatten": "^4.4.0",
-        "lodash.isplainobject": "^4.0.6",
-        "lodash.union": "^4.6.0",
-        "normalize-path": "^3.0.0",
-        "readable-stream": "^3.6.0"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/zip-stream/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
-      "dev": true,
-      "license": "ISC",
-      "peer": true,
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
     }
   }
 }
diff --git a/electron/package.json b/electron/package.json
index 6c0e17bfa..16a7e56e0 100644
--- a/electron/package.json
+++ b/electron/package.json
@@ -22,12 +22,15 @@
     ]
   },
   "license": "GPL-3.0",
+  "engines": {
+    "node": ">=22.12.0"
+  },
   "main": "build/src/index.js",
   "scripts": {
-    "build": "tsc && electron-rebuild",
+    "build": "npm run build:wallet && tsc && electron-rebuild",
     "test:reticulum-chat-worker": "npm run build && electron ./scripts/test-reticulum-chat-worker.cjs",
     "electron:start-live": "node ./live-runner.js",
-    "electron:start": "npm run build && electron --inspect=5858 ./",
+    "electron:start": "npm run build:private-transport && npm run build && electron --inspect=5858 ./",
     "electron:pack": "node ./scripts/run-electron-package.mjs pack",
     "electron:make": "node ./scripts/run-electron-package.mjs local",
     "electron:make-local": "node ./scripts/run-electron-package.mjs local",
@@ -44,18 +47,20 @@
     "electron:make-all": "node ./scripts/run-electron-package.mjs all",
     "bundle:reticulum": "node ./scripts/run-build-rnsd-frozen.mjs",
     "bundle:reticulum-venv": "node ./scripts/bundle-reticulum-runtime.mjs",
-    "generate:mesh-network-identity": "python3 -c \"import RNS; RNS.Identity().to_file('resources/mesh-network.identity')\""
+    "build:private-transport": "node ./scripts/build-private-transport.mjs",
+    "generate:mesh-network-identity": "python3 -c \"import RNS; RNS.Identity().to_file('resources/mesh-network.identity')\"",
+    "build:wallet": "node ./scripts/build-wallet-engine.mjs"
   },
   "dependencies": {
     "@capacitor-community/electron": "^5.0.0",
     "@silentbot1/nat-api": "^0.4.9",
-    "adm-zip": "^0.5.16",
-    "better-sqlite3": "^12.8.0",
+    "adm-zip": "^0.6.0",
+    "better-sqlite3": "^13.0.3",
     "chokidar": "^4.0.3",
     "electron-is-dev": "~2.0.0",
     "electron-serve": "~1.1.0",
     "electron-unhandled": "~4.0.1",
-    "electron-updater": "^6.6.2",
+    "electron-updater": "^6.8.9",
     "electron-window-state": "^5.0.3",
     "extract-zip": "^2.0.1",
     "moment-timezone": "^0.5.48",
@@ -66,11 +71,11 @@
   },
   "devDependencies": {
     "@electron/notarize": "^2.5.0",
-    "@electron/rebuild": "^3.7.2",
+    "@electron/rebuild": "^4.2.0",
     "@types/better-sqlite3": "^7.6.13",
     "@types/write-file-atomic": "^4.0.3",
-    "electron": "^32.3.1",
-    "electron-builder": "^25.1.8",
+    "electron": "^44.1.1",
+    "electron-builder": "^26.15.3",
     "shelljs": "^0.8.5",
     "typescript": "^5.0.4"
   },
diff --git a/electron/resources/masque_discovery_codec.py b/electron/resources/masque_discovery_codec.py
new file mode 100644
index 000000000..43e4e043f
--- /dev/null
+++ b/electron/resources/masque_discovery_codec.py
@@ -0,0 +1,84 @@
+"""Bounded, signed MASQUE discovery wire format, shared with Hub."""
+import ipaddress
+import struct
+import time
+import RNS
+
+DOMAIN = b"Qortal-MASQUE-Discovery-v2\x00"
+MAX_PAYLOAD = 316
+
+def encode(identity, host, port, name, pin, expiry, mode, groups, ticket_key=None):
+    address = ipaddress.ip_address(host)
+    groups = sorted(groups)
+    if mode not in ("public", "groups") or len(groups) > 16 or len(set(groups)) != len(groups):
+        raise ValueError("invalid relay access policy")
+    if (mode == "groups") != bool(groups) or any(type(g) is not int or not 0 < g < 2**31 for g in groups):
+        raise ValueError("invalid relay group IDs")
+    label = name.encode("ascii")
+    if not 1 <= len(label) <= 128 or any(ch not in "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-" for ch in name):
+        raise ValueError("invalid relay name")
+    if not 0 < port <= 65535 or len(bytes.fromhex(pin)) != 32:
+        raise ValueError("invalid relay endpoint")
+    packed_groups = bytearray()
+    for group in groups:
+        while group >= 128:
+            packed_groups.append((group & 127) | 128)
+            group >>= 7
+        packed_groups.append(group)
+    version = 3 if ticket_key is not None else 2
+    header = bytes([3, (len(label)-1) | (128 if address.version == 6 else 0), len(groups)]) if version == 3 else bytes([2, address.version, len(label), len(groups)])
+    data = header + address.packed
+    data += struct.pack(">HI", port, expiry) + bytes.fromhex(pin) + label + bytes(packed_groups)
+    if version == 3:
+        if len(bytes.fromhex(ticket_key)) != 32: raise ValueError("invalid ticket key")
+        data += identity.get_public_key() + bytes.fromhex(ticket_key)
+    else:
+        data += identity.get_public_key()[32:]
+    domain = b"Qortal-MASQUE-Discovery-v3\x00" if version == 3 else DOMAIN
+    result = data + identity.sign(domain + data)
+    if len(result) > MAX_PAYLOAD:
+        raise ValueError("relay announcement exceeds Reticulum packet budget; shorten server name or group list")
+    return result
+
+def decode(raw):
+    if not 108 <= len(raw) <= MAX_PAYLOAD or raw[0] not in (2, 3) or (raw[0] == 2 and raw[1] not in (4, 6)):
+        raise ValueError("invalid relay advertisement")
+    version = raw[0]
+    if version == 3:
+        family, name_len, count = (6 if raw[1] & 128 else 4), (raw[1] & 127)+1, raw[2]
+    else:
+        _, family, name_len, count = raw[:4]
+    if not 1 <= name_len <= 128 or count > 16:
+        raise ValueError("invalid relay advertisement")
+    tail = 160 if version == 3 else 96
+    identity = raw[-160:-96] if version == 3 else None
+    key = identity[32:] if identity else raw[-96:-64]
+    domain = b"Qortal-MASQUE-Discovery-v3\x00" if version == 3 else DOMAIN
+    RNS.Cryptography.Ed25519PublicKey.from_public_bytes(key).verify(raw[-64:], domain + raw[:-64])
+    offset = 3 if version == 3 else 4
+    length = 4 if family == 4 else 16
+    host = str(ipaddress.ip_address(raw[offset:offset + length])); offset += length
+    port, expiry = struct.unpack(">HI", raw[offset:offset + 6]); offset += 6
+    pin = raw[offset:offset + 32].hex(); offset += 32
+    name = raw[offset:offset + name_len].decode("ascii"); offset += name_len
+    groups = []
+    for _ in range(count):
+        value = 0
+        for shift in range(0, 35, 7):
+            if offset >= len(raw) - tail: raise ValueError("truncated group ID")
+            byte = raw[offset]; offset += 1; value |= (byte & 127) << shift
+            if byte < 128:
+                if shift and byte == 0: raise ValueError("non-canonical group ID")
+                break
+        else: raise ValueError("invalid group ID")
+        if not 0 < value < 2**31: raise ValueError("invalid group ID")
+        groups.append(value)
+    if offset != len(raw) - tail or groups != sorted(set(groups)):
+        raise ValueError("invalid group list")
+    if expiry <= int(time.time()) or expiry > int(time.time()) + 3600:
+        raise ValueError("expired relay advertisement")
+    return {"v": version, "h": host, "p": port, "s": name, "c": pin, "x": expiry,
+            "ticketIdentity": identity.hex() if identity else None,
+            "ticketKeyId": raw[-96:-64].hex() if identity else None,
+            "relayIdentity": key.hex(), "accessMode": "groups" if groups else "public",
+            "allowedGroupIds": groups}
diff --git a/electron/resources/presence_bridge.py b/electron/resources/presence_bridge.py
index e93d647c9..162b175a2 100644
--- a/electron/resources/presence_bridge.py
+++ b/electron/resources/presence_bridge.py
@@ -15,6 +15,7 @@
 import shutil
 import socket
 import statistics
+import struct
 import sys
 import threading
 import time
@@ -38,6 +39,7 @@
         pass
 
 import RNS
+from RNS.Buffer import RawChannelWriter
 from RNS.vendor import umsgpack
 
 _BRIDGE_RESOURCE_DIR = os.path.dirname(os.path.abspath(__file__))
@@ -58,6 +60,8 @@
 )
 COMMUNITY_STUN_IDENTITY_MAX_AGE_SECONDS = 24 * 60 * 60
 COMMUNITY_STUN_PORT = 47321
+COMMUNITY_MASQUE_ASPECT = "community-masque-relay"
+COMMUNITY_MASQUE_VERSION = "v1"
 disable_bootstrap = False
 _developer_logs_filtered = (
     str(os.environ.get("QORTAL_FILTER_DEVELOPER_LOGS", "1")).strip().lower()
@@ -100,6 +104,13 @@ def _parse_test_blocked_overlay_peers(raw_value: str) -> Set[str]:
 _community_stun_local_hashes: "deque[bytes]" = deque(maxlen=8)
 _community_stun_local_endpoint: Optional[Dict[str, Any]] = None
 _community_stun_last_query_response_at = 0.0
+_community_masque_identity = None
+_community_masque_destination = None
+_community_masque_announce_handler = None
+_community_masque_seen_endpoints: Dict[str, float] = {}
+_community_masque_recent_endpoints: Dict[str, Dict[str, Any]] = {}
+_community_masque_event_times: "deque[float]" = deque()
+_community_masque_local_hashes: "deque[bytes]" = deque(maxlen=8)
 _reticulum_config_dir = ""
 # A shared-instance client does not own the authoritative Transport.path_table.
 # Keep a very short cache for the uncommon local-miss/RPC-fallback path so
@@ -872,6 +883,9 @@ def _qchat_file_should_bridge_chunk_resource(resource_type: str, stream_mode: bo
 _SCHEDULER_LAND_STATE_SHARDS = 4
 _SCHEDULER_RESOURCE_OPEN_SHARDS = 4
 _SCHEDULER_OVERLAY_MIGRATION_SHARDS = 2
+_SCHEDULER_QAPP_RPC_SHARDS = 4
+_SCHEDULER_QAPP_REALTIME_SHARDS = 4
+_SCHEDULER_QAPP_LIFECYCLE_SHARDS = 2
 _SCHEDULER_RNS_OVERLAY_CALLBACK_SHARDS = 4
 _SCHEDULER_RNS_REALTIME_CALLBACK_SHARDS = 4
 _SCHEDULER_RNS_RESOURCE_CALLBACK_SHARDS = 4
@@ -903,6 +917,12 @@ def _qchat_file_should_bridge_chunk_resource(resource_type: str, stream_mode: bo
     _SCHEDULER_QUEUE_MAX_BY_LANE[f"resource-open-{_resource_open_shard}"] = 32
 for _overlay_migration_shard in range(_SCHEDULER_OVERLAY_MIGRATION_SHARDS):
     _SCHEDULER_QUEUE_MAX_BY_LANE[f"overlay-migration-{_overlay_migration_shard}"] = 2
+for _qapp_rpc_shard in range(_SCHEDULER_QAPP_RPC_SHARDS):
+    _SCHEDULER_QUEUE_MAX_BY_LANE[f"qapp-rpc-{_qapp_rpc_shard}"] = 32
+for _qapp_realtime_shard in range(_SCHEDULER_QAPP_REALTIME_SHARDS):
+    _SCHEDULER_QUEUE_MAX_BY_LANE[f"qapp-realtime-{_qapp_realtime_shard}"] = 64
+for _qapp_lifecycle_shard in range(_SCHEDULER_QAPP_LIFECYCLE_SHARDS):
+    _SCHEDULER_QUEUE_MAX_BY_LANE[f"qapp-lifecycle-{_qapp_lifecycle_shard}"] = 16
 for _callback_shard in range(_SCHEDULER_RNS_OVERLAY_CALLBACK_SHARDS):
     _SCHEDULER_QUEUE_MAX_BY_LANE[f"rns-overlay-callback-{_callback_shard}"] = 1024
 for _callback_shard in range(_SCHEDULER_RNS_REALTIME_CALLBACK_SHARDS):
@@ -1127,6 +1147,9 @@ def stop(self, timeout_seconds: float = 5.0) -> None:
 _REALTIME_PACKET_SEND_WORKERS = 4
 _REALTIME_PACKET_SEND_MAX_PENDING = 128
 _REALTIME_PACKET_SEND_MAX_QUEUE_WAIT_SECONDS = 0.05
+_QAPP_CLOSE_WRITE_WORKERS = 4
+_QAPP_CLOSE_WRITE_MAX_PENDING = 64
+_QAPP_CLOSE_WRITE_MAX_QUEUE_WAIT_SECONDS = 0.25
 _control_packet_send_dispatcher = _BoundedKeyedSendDispatcher(
     "control-packet",
     _CONTROL_PACKET_SEND_WORKERS,
@@ -1139,6 +1162,18 @@ def stop(self, timeout_seconds: float = 5.0) -> None:
     _REALTIME_PACKET_SEND_MAX_PENDING,
     _REALTIME_PACKET_SEND_MAX_QUEUE_WAIT_SECONDS,
 )
+_qapp_close_write_dispatcher = _BoundedKeyedSendDispatcher(
+    "qapp-close",
+    _QAPP_CLOSE_WRITE_WORKERS,
+    _QAPP_CLOSE_WRITE_MAX_PENDING,
+    _QAPP_CLOSE_WRITE_MAX_QUEUE_WAIT_SECONDS,
+)
+_qapp_close_coordinator_slots = threading.BoundedSemaphore(
+    _QAPP_CLOSE_WRITE_MAX_PENDING
+)
+_qapp_stream_write_dispatcher = _BoundedKeyedSendDispatcher(
+    "qapp-stream", 8, 64, 0.25
+)
 _rns_overlay_callback_pending_keys: set[str] = set()
 _rns_packet_dispatcher_missing_logged = False
 _latest_land_state_lock = threading.Lock()
@@ -2209,16 +2244,21 @@ def _start_scheduler_workers() -> None:
 def _start_packet_send_dispatchers() -> None:
     _control_packet_send_dispatcher.start()
     _realtime_packet_send_dispatcher.start()
+    _qapp_close_write_dispatcher.start()
+    _qapp_stream_write_dispatcher.start()
     log(
         "[presence_bridge] target=reticulum-packet-send-dispatcher started "
         f"control_workers={_CONTROL_PACKET_SEND_WORKERS} "
-        f"realtime_workers={_REALTIME_PACKET_SEND_WORKERS}"
+        f"realtime_workers={_REALTIME_PACKET_SEND_WORKERS} "
+        f"qapp_close_workers={_QAPP_CLOSE_WRITE_WORKERS}"
     )
 
 
 def _stop_packet_send_dispatchers() -> None:
     _control_packet_send_dispatcher.stop()
     _realtime_packet_send_dispatcher.stop()
+    _qapp_close_write_dispatcher.stop()
+    _qapp_stream_write_dispatcher.stop()
 
 
 def _stop_scheduler_workers() -> None:
@@ -5506,6 +5546,20 @@ def _resource_open_scheduler_lane(peer_hash: str) -> str:
     return f"resource-open-{shard}"
 
 
+def _qapp_scheduler_lane(prefix: str, message: Optional[Dict[str, Any]], shards: int) -> str:
+    payload = message.get("payload") if isinstance(message, dict) else None
+    route_key = "unknown"
+    if isinstance(payload, dict):
+        route_key = str(
+            payload.get("managerKey")
+            or payload.get("destination")
+            or payload.get("connectionId")
+            or "unknown"
+        )
+    digest = hashlib.blake2s(route_key.encode("utf-8"), digest_size=2).digest()
+    return f"{prefix}-{int.from_bytes(digest, 'big') % max(1, shards)}"
+
+
 def _rns_callback_lane(kind: str, link_id: str) -> str:
     normalized_kind = str(kind or "overlay").strip().lower()
     route_key = str(link_id or "unknown")
@@ -5736,6 +5790,16 @@ def _scheduler_lane_for_command(
     message: Optional[Dict[str, Any]] = None,
 ) -> str:
     action_name = str(action or "")
+    if action_name == "qapp_rns_request":
+        return _qapp_scheduler_lane("qapp-rpc", message, _SCHEDULER_QAPP_RPC_SHARDS)
+    if action_name == "qapp_rns_send":
+        return _qapp_scheduler_lane(
+            "qapp-realtime", message, _SCHEDULER_QAPP_REALTIME_SHARDS
+        )
+    if action_name in {"qapp_rns_connect", "qapp_rns_close"}:
+        return _qapp_scheduler_lane(
+            "qapp-lifecycle", message, _SCHEDULER_QAPP_LIFECYCLE_SHARDS
+        )
     if action_name in {"clear_group_audio_diagnostics"}:
         return "control-send"
     if action_name == "send_group_audio_link_control":
@@ -9280,6 +9344,201 @@ def handle_get_community_stun_endpoints(req_id: str) -> None:
     emit_resp(req_id, True, payload={"endpoints": endpoints})
 
 
+def _community_masque_host_allowed(host: str) -> bool:
+    try:
+        address = ipaddress.ip_address(host)
+    except ValueError:
+        return False
+    if not isinstance(address, (ipaddress.IPv4Address, ipaddress.IPv6Address)):
+        return False
+    if address.is_global:
+        return True
+    return (
+        str(os.environ.get("QORTAL_PRIVATE_TRANSPORT_ALLOW_LOCAL_RELAY", ""))
+        .strip()
+        .lower()
+        in {"1", "true", "yes", "on"}
+        and address.is_loopback
+    )
+
+
+class CommunityMasqueRelayAnnounceHandler:
+    """Receive anonymous, short-lived MASQUE relay advertisements.
+
+    The Reticulum announce authenticates the advertised metadata as one
+    internally consistent lease. The relay's advertised TLS leaf pin then
+    authenticates the QUIC endpoint without HTTPS, DNS, or public Web PKI.
+    """
+
+    def __init__(self):
+        self.aspect_filter = (
+            f"{APP_NAMESPACE}.{COMMUNITY_MASQUE_ASPECT}.{COMMUNITY_MASQUE_VERSION}"
+        )
+
+    def received_announce(self, destination_hash, announced_identity, app_data):
+        if destination_hash in _community_masque_local_hashes:
+            return
+        self.received_payload(app_data)
+
+    def received_packet(self, data, packet):
+        self.received_payload(data)
+
+    def received_payload(self, app_data):
+        try:
+            raw = bytes(app_data or b"")
+            if not raw or len(raw) > 512:
+                return
+            if raw[0] in (2, 3):
+                from masque_discovery_codec import decode
+                value = decode(raw)
+            else:
+                value = json.loads(raw.decode("utf-8"))
+                # V2 is accepted only through the signature-verifying codec.
+                if not isinstance(value, dict) or value.get("v") != 1:
+                    return
+            if not isinstance(value, dict) or int(value.get("v") or 0) not in (1, 2, 3):
+                return
+            if value.get("q") is True:
+                return
+            host = str(value.get("h") or "").strip()
+            port = int(value.get("p") or 0)
+            server_name = str(value.get("s") or "").strip()
+            cert_sha256 = str(value.get("c") or "").strip().lower()
+            expires_at = int(value.get("x") or 0)
+            now = int(time.time())
+            if (
+                not _community_masque_host_allowed(host)
+                or port < 1
+                or port > 65535
+                or not server_name
+                or len(server_name) > 128
+                or any(ch not in "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-" for ch in server_name)
+                or len(cert_sha256) != 64
+                or any(ch not in "0123456789abcdef" for ch in cert_sha256)
+                or expires_at <= now
+                or expires_at > now + 60 * 60
+            ):
+                return
+            endpoint_key = f"{host}:{port}:{cert_sha256}"
+            received_at = time.time()
+            with _state_lock:
+                while (
+                    _community_masque_event_times
+                    and received_at - _community_masque_event_times[0] >= 60.0
+                ):
+                    _community_masque_event_times.popleft()
+                if len(_community_masque_event_times) >= 60:
+                    return
+                seen_at = _community_masque_seen_endpoints.get(endpoint_key, 0.0)
+                previous = _community_masque_recent_endpoints.get(endpoint_key)
+                if previous and previous.get("protocolVersion", 1) >= 2:
+                    if value.get("v", 1) < previous.get("protocolVersion") or value.get("relayIdentity") != previous.get("relayIdentity"):
+                        return
+                    if value.get("v") == previous.get("protocolVersion") and expires_at * 1000 <= previous.get("expiresAt", 0):
+                        return
+                policy_changed = previous and (
+                    previous.get("protocolVersion") != value.get("v") or
+                    previous.get("ticketKeyId") != value.get("ticketKeyId") or
+                    previous.get("accessMode") != value.get("accessMode", "public") or
+                    previous.get("allowedGroupIds") != value.get("allowedGroupIds", [])
+                )
+                if received_at - seen_at < 30.0 and not policy_changed:
+                    return
+                endpoint = {
+                    "host": host,
+                    "port": port,
+                    "serverName": server_name,
+                    "certSha256": cert_sha256,
+                    "expiresAt": expires_at * 1000,
+                    "protocolVersion": value.get("v", 1),
+                    "relayIdentity": value.get("relayIdentity"),
+                    "ticketIdentity": value.get("ticketIdentity"),
+                    "ticketKeyId": value.get("ticketKeyId"),
+                    "accessMode": value.get("accessMode", "public"),
+                    "allowedGroupIds": value.get("allowedGroupIds", []),
+                }
+                _community_masque_seen_endpoints[endpoint_key] = received_at
+                _community_masque_recent_endpoints[endpoint_key] = endpoint
+                _community_masque_event_times.append(received_at)
+                if len(_community_masque_seen_endpoints) > 256:
+                    oldest = sorted(
+                        _community_masque_seen_endpoints.items(),
+                        key=lambda item: item[1],
+                    )[:64]
+                    for key, _ in oldest:
+                        _community_masque_seen_endpoints.pop(key, None)
+                        _community_masque_recent_endpoints.pop(key, None)
+            emit_event("community_masque_relay", endpoint)
+        except Exception:
+            return
+
+
+def _replace_community_masque_destination() -> None:
+    global _community_masque_identity, _community_masque_destination
+    previous_destination = _community_masque_destination
+    identity = RNS.Identity()
+    destination = RNS.Destination(
+        identity,
+        RNS.Destination.IN,
+        RNS.Destination.SINGLE,
+        APP_NAMESPACE,
+        COMMUNITY_MASQUE_ASPECT,
+        COMMUNITY_MASQUE_VERSION,
+    )
+    destination.set_packet_callback(
+        _community_masque_announce_handler.received_packet
+    )
+    _community_masque_identity = identity
+    _community_masque_destination = destination
+    _community_masque_local_hashes.append(destination.hash)
+    if previous_destination is not None:
+        try:
+            RNS.Transport.deregister_destination(previous_destination)
+        except Exception:
+            pass
+
+
+def _ensure_community_masque_discovery(config_dir: str) -> None:
+    global _community_masque_identity, _community_masque_destination
+    global _community_masque_announce_handler
+    if _community_masque_announce_handler is None:
+        _community_masque_announce_handler = CommunityMasqueRelayAnnounceHandler()
+        RNS.Transport.register_announce_handler(_community_masque_announce_handler)
+    if _community_masque_destination is None:
+        _replace_community_masque_destination()
+
+
+def handle_get_community_masque_relays(
+    req_id: str, payload: Dict[str, Any]
+) -> None:
+    now_ms = int(time.time() * 1000)
+    with _state_lock:
+        expired = [
+            key
+            for key, value in _community_masque_recent_endpoints.items()
+            if int(value.get("expiresAt") or 0) <= now_ms
+        ]
+        for key in expired:
+            _community_masque_recent_endpoints.pop(key, None)
+            _community_masque_seen_endpoints.pop(key, None)
+        endpoints = list(_community_masque_recent_endpoints.values())[:128]
+    try:
+        _ensure_community_masque_discovery(_reticulum_config_dir)
+        if payload.get("announce") is True:
+            # Each bounded discovery operation gets one fresh anonymous return
+            # destination. Reusing a prior destination causes Reticulum nodes
+            # to suppress the query as a repeated announce.
+            _replace_community_masque_destination()
+            query_data = json.dumps(
+                {"v": 1, "q": True}, separators=(",", ":")
+            ).encode("utf-8")
+            _community_masque_destination.announce(app_data=query_data)
+            log("MASQUE relay discovery query announced")
+    except Exception:
+        pass
+    emit_resp(req_id, True, payload={"relays": endpoints})
+
+
 def handle_configure_developer_log_filter(
     req_id: str,
     payload: Dict[str, Any],
@@ -21503,6 +21762,7 @@ def ensure_started(config_dir: str):
         _announce_handler = PresenceAnnounceHandler(_destination.hash)
         RNS.Transport.register_announce_handler(_announce_handler)
         _ensure_community_stun_discovery(config_dir)
+        _ensure_community_masque_discovery(config_dir)
         ensure_transport_monitor_started()
         ensure_rns_callback_scheduler_monitor_started()
         ensure_audio_rtt_monitor_started()
@@ -26743,6 +27003,780 @@ def handle_send_group_audio_link_heartbeat(req_id: str, payload: Dict[str, Any])
         )
 
 
+_QAPP_RNS_VERSION = 1
+_QAPP_RNS_DATA = 1
+_QAPP_RNS_ACK = 2
+_QAPP_RNS_CONTROL = 3
+_QAPP_RNS_HEADER = struct.Struct(">BBQI")
+_QAPP_RNS_STREAM_ID = 7
+_QAPP_RNS_MAX_FRAME = int(os.environ.get("QORTAL_QAPP_RNS_MAX_FRAME_BYTES", 256 * 1024))
+_QAPP_RNS_MAX_QUEUE = int(os.environ.get("QORTAL_QAPP_RNS_MAX_UNACKED", 64))
+_QAPP_RNS_MAX_QUEUE_BYTES = int(os.environ.get("QORTAL_QAPP_RNS_MAX_QUEUE_BYTES", 2 * 1024 * 1024))
+_QAPP_RNS_IDLE_SECONDS = float(os.environ.get("QORTAL_QAPP_RNS_IDLE_SECONDS", 300))
+_QAPP_RNS_ACK_TIMEOUT_SECONDS = float(os.environ.get("QORTAL_QAPP_RNS_ACK_TIMEOUT_SECONDS", 120))
+_QAPP_RNS_WRITE_TIMEOUT_SECONDS = 10.0
+_QAPP_RNS_CLOSE_WRITE_TIMEOUT_SECONDS = max(
+    0.1,
+    float(os.environ.get("QORTAL_QAPP_RNS_CLOSE_WRITE_TIMEOUT_SECONDS", 10.0)),
+)
+_QAPP_RNS_KEEPALIVE_SECONDS = max(
+    15.0,
+    float(os.environ.get("QORTAL_QAPP_RNS_KEEPALIVE_SECONDS", 60)),
+)
+_qapp_rns_entries: Dict[str, Dict[str, Any]] = {}
+
+
+def _qapp_rns_error(req_id: str, code: str) -> None:
+    emit_resp(req_id, False, payload={"code": code}, error=code)
+
+
+def _qapp_rns_frame(frame_type: int, message_id: int, payload: bytes = b"") -> bytes:
+    if len(payload) > _QAPP_RNS_MAX_FRAME:
+        raise ValueError("RNS_MESSAGE_TOO_LARGE")
+    return _QAPP_RNS_HEADER.pack(_QAPP_RNS_VERSION, frame_type, message_id, len(payload)) + payload
+
+
+def _qapp_rns_write(entry: Dict[str, Any], frame: bytes, *, expected_link: Any = None) -> bool:
+    # Capture the physical stream before dispatch. A delayed old write must
+    # never acquire the writer (or lock) of a replacement Link.
+    with _state_lock:
+        writer = entry.get("writer")
+        link = entry.get("link")
+        if expected_link is not None and link is not expected_link:
+            return False
+        generation = entry.get("generation")
+        write_lock = entry.get("write_lock")
+        if writer is None or entry.get("established") is not True:
+            return False
+    cancelled = threading.Event()
+
+    def current() -> bool:
+        return (
+            not cancelled.is_set()
+            and entry.get("writer") is writer
+            and entry.get("generation") == generation
+            and entry.get("established") is True
+        )
+
+    def write() -> bool:
+        deadline = time.monotonic() + _QAPP_RNS_WRITE_TIMEOUT_SECONDS
+        if not write_lock.acquire(timeout=_QAPP_RNS_WRITE_TIMEOUT_SECONDS):
+            return False
+        try:
+            offset = 0
+            while offset < len(frame):
+                if not current() or time.monotonic() >= deadline:
+                    return False
+                written = int(writer.write(frame[offset:]) or 0)
+                if written <= 0:
+                    cancelled.wait(0.01)
+                    continue
+                offset += written
+            if not current():
+                return False
+            # RawChannelWriter has no buffered bytes: flush is a no-op. The
+            # outer deadline also bounds unexpected blocking in RNS itself.
+            writer.flush()
+            return current()
+        finally:
+            write_lock.release()
+
+    status, result, error = _qapp_stream_write_dispatcher.submit_and_wait(
+        f"{id(entry)}:{id(writer)}:{generation}",
+        _QAPP_RNS_WRITE_TIMEOUT_SECONDS,
+        write,
+    )
+    cancelled.set()
+    if status == "completed" and result is True and not error:
+        entry["last_used"] = time.time()
+        return True
+    log(
+        "[presence_bridge] target=qapp-rns stream_write_failed "
+        f"destination={entry.get('destination')} reason={status}"
+    )
+    # No bytes were attempted for a rejected queued job. Do not reset a
+    # healthy connection merely because the bounded pool is busy.
+    if status in ("completed", "exception", "send_timeout"):
+        with _state_lock:
+            if entry.get("writer") is writer and entry.get("generation") == generation:
+                if link is not None and entry.get("link") is link:
+                    _qapp_rns_closed(entry["managerKey"], generation, link)
+        if link is not None:
+            _teardown_reticulum_link_bounded(link, "target=qapp-rns stream_write_failed")
+    return False
+
+
+def _qapp_rns_teardown_failed_close(
+    entry: Dict[str, Any],
+    link: Any,
+    reason: str,
+) -> None:
+    if link is None:
+        return
+    with _state_lock:
+        if entry.get("link") is not link:
+            return
+    _teardown_reticulum_link_bounded(
+        link,
+        f"target=qapp-rns close_write_failed reason={reason}",
+    )
+
+
+def _qapp_rns_schedule_close_write(entry: Dict[str, Any], frame: bytes) -> None:
+    manager_key = str(entry.get("managerKey") or "unknown")
+    link = entry.get("link")
+    if link is None:
+        return
+    if not _qapp_close_coordinator_slots.acquire(blocking=False):
+        log(
+            "[presence_bridge] target=qapp-rns close_write_rejected "
+            f"manager={manager_key} reason=coordinator_full"
+        )
+        _qapp_rns_teardown_failed_close(entry, link, "coordinator_full")
+        return
+
+    def coordinate() -> None:
+        try:
+            status, result, error = _qapp_close_write_dispatcher.submit_and_wait(
+                manager_key,
+                _QAPP_RNS_CLOSE_WRITE_TIMEOUT_SECONDS,
+                lambda: _qapp_rns_write(entry, frame, expected_link=link),
+            )
+            if status == "completed" and result is True and not error:
+                return
+            log(
+                "[presence_bridge] target=qapp-rns close_write_failed "
+                f"manager={manager_key} reason={status} "
+                f"timeout_ms={int(_QAPP_RNS_CLOSE_WRITE_TIMEOUT_SECONDS * 1000)}"
+                f"{f' err={error}' if error else ''}"
+            )
+            _qapp_rns_teardown_failed_close(entry, link, status)
+        finally:
+            _qapp_close_coordinator_slots.release()
+
+    thread = threading.Thread(
+        target=coordinate,
+        name=f"qapp-rns-close-{manager_key[-12:]}",
+        daemon=True,
+    )
+    try:
+        thread.start()
+    except Exception:
+        _qapp_close_coordinator_slots.release()
+        _qapp_rns_teardown_failed_close(
+            entry,
+            link,
+            "coordinator_start_failed",
+        )
+
+
+def _qapp_rns_emit_state(entry: Dict[str, Any], state: str, reason: str = "") -> None:
+    for connection_id in list(entry.get("connections") or []):
+        emit_event("qapp_rns", {
+            "managerKey": entry["managerKey"],
+            "connectionId": connection_id,
+            "kind": "state",
+            "state": state,
+            **({"reason": reason} if reason else {}),
+        })
+
+
+def _qapp_rns_cancel_keepalive(entry: Dict[str, Any]) -> None:
+    with _state_lock:
+        entry["keepalive_generation"] = int(entry.get("keepalive_generation") or 0) + 1
+        timer = entry.get("keepalive_timer")
+        entry["keepalive_timer"] = None
+    if timer is not None:
+        timer.cancel()
+
+
+def _qapp_rns_schedule_keepalive(entry: Dict[str, Any]) -> None:
+    """Keep an actively-owned realtime Link alive without involving the Q-App."""
+    with _state_lock:
+        previous_timer = entry.get("keepalive_timer")
+        if previous_timer is not None:
+            previous_timer.cancel()
+        generation = int(entry.get("keepalive_generation") or 0) + 1
+        entry["keepalive_generation"] = generation
+        entry["keepalive_timer"] = None
+        if entry.get("established") is not True or not entry.get("connections"):
+            return
+
+        def keepalive() -> None:
+            with _state_lock:
+                current = _qapp_rns_entries.get(entry["managerKey"])
+                if (
+                    current is not entry
+                    or entry.get("keepalive_generation") != generation
+                    or entry.get("established") is not True
+                    or not entry.get("connections")
+                ):
+                    return
+                entry["keepalive_timer"] = None
+                message_id = int(entry["next_message_id"])
+                entry["next_message_id"] = (message_id + 1) & 0xffffffffffffffff
+            payload = json.dumps({"type": "PING"}, separators=(",", ":")).encode("utf-8")
+            _qapp_rns_write(
+                entry,
+                _qapp_rns_frame(_QAPP_RNS_CONTROL, message_id, payload),
+            )
+            # A busy pool can reject a keepalive before any bytes are sent.
+            # Retry at the next interval if the Link is still established.
+            _qapp_rns_schedule_keepalive(entry)
+
+        timer = threading.Timer(_QAPP_RNS_KEEPALIVE_SECONDS, keepalive)
+        timer.daemon = True
+        entry["keepalive_timer"] = timer
+    try:
+        timer.start()
+    except Exception as exc:
+        with _state_lock:
+            if entry.get("keepalive_timer") is timer:
+                entry["keepalive_timer"] = None
+        log(
+            "[presence_bridge] target=qapp-rns keepalive_timer_start_failed "
+            f"destination={entry.get('destination')} error={type(exc).__name__}"
+        )
+
+
+def _qapp_rns_handle_frame(entry: Dict[str, Any], frame_type: int, message_id: int, payload: bytes) -> None:
+    if frame_type == _QAPP_RNS_ACK:
+        if payload:
+            raise ValueError("ACK payload must be empty")
+        with _state_lock:
+            removed = entry["unacked"].pop(message_id, None)
+            if removed is not None:
+                timer = removed.get("timer")
+                if timer is not None:
+                    timer.cancel()
+                entry["queued_bytes"] = max(
+                    0, int(entry.get("queued_bytes") or 0) - len(removed["frame"])
+                )
+                _qapp_rns_schedule_idle(entry)
+        return
+    if frame_type == _QAPP_RNS_CONTROL:
+        control = json.loads(payload.decode("utf-8"))
+        if not isinstance(control, dict) or set(control) != {"type"}:
+            raise ValueError("invalid control frame")
+        control_type = control.get("type")
+        if control_type == "PING":
+            response = json.dumps({"type": "PONG"}, separators=(",", ":")).encode("utf-8")
+            _qapp_rns_write(entry, _qapp_rns_frame(_QAPP_RNS_CONTROL, message_id, response))
+            return
+        if control_type == "PONG":
+            return
+        raise ValueError("unsupported control frame")
+    if frame_type != _QAPP_RNS_DATA:
+        raise ValueError("unsupported frame type")
+    duplicate = False
+    with _state_lock:
+        duplicate = message_id in entry["received_set"]
+        if not duplicate:
+            if len(entry["received_ids"]) >= 512:
+                expired = entry["received_ids"].popleft()
+                entry["received_set"].discard(expired)
+            entry["received_ids"].append(message_id)
+            entry["received_set"].add(message_id)
+    _qapp_rns_write(entry, _qapp_rns_frame(_QAPP_RNS_ACK, message_id))
+    if duplicate:
+        return
+    envelope = json.loads(payload.decode("utf-8"))
+    connection_id = str(envelope.get("connectionId") or "")
+    if connection_id not in entry.get("connections", set()):
+        return
+    emit_event("qapp_rns", {
+        "managerKey": entry["managerKey"],
+        "connectionId": connection_id,
+        "kind": "message",
+        "payloadBase64": str(envelope.get("payloadBase64") or ""),
+        "encoding": "base64" if envelope.get("encoding") == "base64" else "json",
+    })
+
+
+def _qapp_rns_reader(entry: Dict[str, Any], generation: int) -> None:
+    reader = entry.get("reader")
+    link = entry.get("link")
+    buffered = bytearray()
+    try:
+        while entry.get("generation") == generation and entry.get("established") is True:
+            chunk = reader.read(64 * 1024)
+            if chunk is None:
+                time.sleep(0.01)
+                continue
+            if chunk == b"":
+                return
+            buffered.extend(chunk)
+            if len(buffered) > _QAPP_RNS_MAX_FRAME * 2:
+                raise ValueError("receive buffer exceeded")
+            while len(buffered) >= _QAPP_RNS_HEADER.size:
+                if entry.get("generation") != generation or entry.get("reader") is not reader:
+                    return
+                version, frame_type, message_id, payload_len = _QAPP_RNS_HEADER.unpack_from(buffered)
+                if (
+                    version != _QAPP_RNS_VERSION
+                    or frame_type not in (_QAPP_RNS_DATA, _QAPP_RNS_ACK, _QAPP_RNS_CONTROL)
+                    or payload_len > _QAPP_RNS_MAX_FRAME
+                ):
+                    raise ValueError("invalid frame header")
+                total = _QAPP_RNS_HEADER.size + payload_len
+                if len(buffered) < total:
+                    break
+                payload = bytes(buffered[_QAPP_RNS_HEADER.size:total])
+                del buffered[:total]
+                _qapp_rns_handle_frame(entry, frame_type, message_id, payload)
+    except Exception as exc:
+        log(f"[presence_bridge] target=qapp-rns protocol_error destination={entry.get('destination')} error={type(exc).__name__}")
+        if link is not None:
+            _teardown_reticulum_link_bounded(link, "target=qapp-rns reader_failed")
+
+
+def _qapp_rns_established(manager_key: str, generation: int, link) -> None:
+    with _state_lock:
+        entry = _qapp_rns_entries.get(manager_key)
+        if entry is None or entry.get("generation") != generation or entry.get("link") is not link:
+            try:
+                link.teardown()
+            except Exception:
+                pass
+            return
+        entry["established"] = True
+        entry["establishing"] = False
+        entry["reconnect_attempt"] = 0
+        channel = link.get_channel()
+        # BufferedWriter.flush spins indefinitely when RawChannelWriter.write
+        # returns zero for a full RNS channel window. Drive raw partial writes
+        # ourselves so congestion and failures remain bounded.
+        entry["writer"] = RawChannelWriter(_QAPP_RNS_STREAM_ID, channel)
+        entry["write_lock"] = threading.Lock()
+        entry["reader"] = RNS.Buffer.create_reader(_QAPP_RNS_STREAM_ID, channel)
+        entry["established_event"].set()
+        unacked = [value["frame"] for _, value in sorted(entry["unacked"].items())]
+    threading.Thread(target=_qapp_rns_reader, args=(entry, generation), daemon=True, name="qapp-rns-reader").start()
+    _qapp_rns_schedule_keepalive(entry)
+    for frame in unacked:
+        if not _qapp_rns_write(entry, frame, expected_link=link):
+            return
+    with _state_lock:
+        if entry.get("link") is link and entry.get("generation") == generation and entry.get("established") is True:
+            _qapp_rns_emit_state(entry, "CONNECTED")
+
+
+def _qapp_rns_schedule_reconnect(entry: Dict[str, Any]) -> None:
+    if not entry.get("connections"):
+        return
+    attempt = int(entry.get("reconnect_attempt") or 0) + 1
+    entry["reconnect_attempt"] = attempt
+    delay = min(30.0, 0.5 * (2 ** min(attempt - 1, 6))) * (0.8 + secrets.randbelow(41) / 100.0)
+
+    def reconnect() -> None:
+        with _state_lock:
+            current = _qapp_rns_entries.get(entry["managerKey"])
+            if current is not entry or not entry.get("connections") or entry.get("established") is True:
+                return
+        _qapp_rns_open_link(entry, wait=False)
+
+    timer = threading.Timer(delay, reconnect)
+    timer.daemon = True
+    entry["reconnect_timer"] = timer
+    timer.start()
+
+
+def _qapp_rns_schedule_idle(entry: Dict[str, Any]) -> None:
+    def cleanup() -> None:
+        link = None
+        with _state_lock:
+            current = _qapp_rns_entries.get(entry["managerKey"])
+            if (
+                current is not entry
+                or entry.get("idle_generation") != generation
+                or entry.get("connections")
+                or int(entry.get("active_requests") or 0) > 0
+                or entry.get("unacked")
+                or time.time() - float(entry.get("last_used") or 0) < _QAPP_RNS_IDLE_SECONDS
+            ):
+                return
+            entry["idle_timer"] = None
+            _qapp_rns_entries.pop(entry["managerKey"], None)
+            link = entry.get("link")
+            entry["generation"] = int(entry.get("generation") or 0) + 1
+        if link is not None:
+            try:
+                link.teardown()
+            except Exception:
+                pass
+        log(f"[presence_bridge] target=qapp-rns idle_teardown destination={entry.get('destination')}")
+
+    with _state_lock:
+        previous_timer = entry.get("idle_timer")
+        if previous_timer is not None:
+            previous_timer.cancel()
+        generation = int(entry.get("idle_generation") or 0) + 1
+        entry["idle_generation"] = generation
+        timer = threading.Timer(_QAPP_RNS_IDLE_SECONDS, cleanup)
+        timer.daemon = True
+        entry["idle_timer"] = timer
+        try:
+            timer.start()
+        except Exception as exc:
+            entry["idle_timer"] = None
+            log(
+                "[presence_bridge] target=qapp-rns idle_timer_start_failed "
+                f"destination={entry.get('destination')} error={type(exc).__name__}"
+            )
+
+
+def _qapp_rns_closed(manager_key: str, generation: int, link) -> None:
+    with _state_lock:
+        entry = _qapp_rns_entries.get(manager_key)
+        if entry is None or entry.get("generation") != generation or entry.get("link") is not link:
+            return
+        entry["established"] = False
+        entry["establishing"] = False
+        entry["link"] = None
+        entry["writer"] = None
+        entry["reader"] = None
+        has_connections = bool(entry.get("connections"))
+    _qapp_rns_cancel_keepalive(entry)
+    _qapp_rns_emit_state(entry, "RECONNECTING" if has_connections else "DISCONNECTED")
+    if has_connections:
+        _qapp_rns_schedule_reconnect(entry)
+
+
+def _qapp_rns_open_link(entry: Dict[str, Any], wait: bool = True) -> bool:
+    with _state_lock:
+        if entry.get("established") is True:
+            return True
+        pending = entry.get("establishing") is True or entry.get("link") is not None
+        established_event = entry["established_event"]
+        if not pending:
+            entry["establishing"] = True
+            established_event.clear()
+            entry["generation"] = int(entry.get("generation") or 0) + 1
+            generation = entry["generation"]
+    if pending:
+        return established_event.wait(20.0) if wait else False
+    destination = entry["destination"]
+    try:
+        destination_hash = bytes.fromhex(destination)
+        if not _reticulum_local_has_path(destination_hash):
+            _request_and_await_destination_path(destination_hash, 12.0, log_context=f"qapp-rns destination={destination}")
+        identity = RNS.Identity.recall(destination_hash)
+        if identity is None:
+            raise RuntimeError("identity unavailable")
+        outbound = RNS.Destination(
+            identity,
+            RNS.Destination.OUT,
+            RNS.Destination.SINGLE,
+            APP_NAMESPACE,
+            "qapp-backend",
+            "v1",
+        )
+        if destination_hash_hex(outbound.hash) != destination:
+            raise RuntimeError("destination identity mismatch")
+        link = RNS.Link(
+            outbound,
+            established_callback=lambda value: _qapp_rns_established(entry["managerKey"], generation, value),
+            closed_callback=lambda value: _qapp_rns_closed(entry["managerKey"], generation, value),
+        )
+        with _state_lock:
+            if entry.get("generation") != generation:
+                link.teardown()
+                return False
+            entry["link"] = link
+    except Exception:
+        with _state_lock:
+            entry["link"] = None
+            entry["establishing"] = False
+        if entry.get("connections"):
+            _qapp_rns_schedule_reconnect(entry)
+        return False
+    return established_event.wait(20.0) if wait else False
+
+
+def _qapp_rns_entry(manager_key: str, destination: str) -> Dict[str, Any]:
+    with _state_lock:
+        entry = _qapp_rns_entries.get(manager_key)
+        if entry is not None:
+            if entry.get("destination") != destination:
+                raise ValueError("RNS_PERMISSION_DENIED")
+            return entry
+        entry = {
+            "managerKey": manager_key,
+            "destination": destination,
+            "link": None,
+            "writer": None,
+            "reader": None,
+            "established": False,
+            "establishing": False,
+            "established_event": threading.Event(),
+            "generation": 0,
+            "connections": set(),
+            "active_requests": 0,
+            "unacked": {},
+            "queued_bytes": 0,
+            "next_message_id": secrets.randbits(63) or 1,
+            "received_ids": deque(),
+            "received_set": set(),
+            "write_lock": threading.Lock(),
+            "last_used": time.time(),
+            "reconnect_attempt": 0,
+            "idle_generation": 0,
+            "idle_timer": None,
+            "keepalive_generation": 0,
+            "keepalive_timer": None,
+        }
+        _qapp_rns_entries[manager_key] = entry
+        return entry
+
+
+def handle_qapp_rns_connect(req_id: str, payload: Dict[str, Any]) -> None:
+    try:
+        manager_key = str(payload.get("managerKey") or "")
+        destination = str(payload.get("destination") or "").lower()
+        connection_id = str(payload.get("connectionId") or "")
+        if not manager_key or not connection_id or len(destination) != 32:
+            return _qapp_rns_error(req_id, "RNS_DESTINATION_UNREACHABLE")
+        entry = _qapp_rns_entry(manager_key, destination)
+        with _state_lock:
+            entry["connections"].add(connection_id)
+        if not _qapp_rns_open_link(entry):
+            with _state_lock:
+                entry["connections"].discard(connection_id)
+            _qapp_rns_schedule_idle(entry)
+            return _qapp_rns_error(req_id, "RNS_LINK_TIMEOUT")
+        _qapp_rns_schedule_keepalive(entry)
+        emit_resp(req_id, True, payload={"state": "CONNECTED"})
+    except Exception:
+        _qapp_rns_error(req_id, "RNS_DESTINATION_UNREACHABLE")
+
+
+def handle_qapp_rns_send(req_id: str, payload: Dict[str, Any]) -> None:
+    manager_key = str(payload.get("managerKey") or "")
+    connection_id = str(payload.get("connectionId") or "")
+    with _state_lock:
+        entry = _qapp_rns_entries.get(manager_key)
+        if entry is None or connection_id not in entry.get("connections", set()):
+            return _qapp_rns_error(req_id, "RNS_INVALID_CONNECTION")
+        raw = str(payload.get("payloadBase64") or "")
+        envelope = json.dumps({
+            "connectionId": connection_id,
+            "payloadBase64": raw,
+            "encoding": "base64" if payload.get("encoding") == "base64" else "json",
+        }, separators=(",", ":")).encode("utf-8")
+        if len(envelope) > _QAPP_RNS_MAX_FRAME:
+            return _qapp_rns_error(req_id, "RNS_MESSAGE_TOO_LARGE")
+        message_id = int(entry["next_message_id"])
+        entry["next_message_id"] = (message_id + 1) & 0xffffffffffffffff
+        frame = _qapp_rns_frame(_QAPP_RNS_DATA, message_id, envelope)
+        if len(entry["unacked"]) >= _QAPP_RNS_MAX_QUEUE or entry["queued_bytes"] + len(frame) > _QAPP_RNS_MAX_QUEUE_BYTES:
+            return _qapp_rns_error(req_id, "RNS_SEND_QUEUE_FULL")
+        def expire_unacked() -> None:
+            expired = None
+            with _state_lock:
+                expired = entry["unacked"].pop(message_id, None)
+                if expired is not None:
+                    entry["queued_bytes"] = max(0, int(entry.get("queued_bytes") or 0) - len(frame))
+            if expired is not None:
+                emit_event("qapp_rns", {
+                    "managerKey": manager_key,
+                    "connectionId": connection_id,
+                    "kind": "state",
+                    "state": "ERROR",
+                    "reason": "RNS_REQUEST_TIMEOUT",
+                })
+
+        timer = threading.Timer(_QAPP_RNS_ACK_TIMEOUT_SECONDS, expire_unacked)
+        timer.daemon = True
+        entry["unacked"][message_id] = {"frame": frame, "created": time.time(), "timer": timer}
+        entry["queued_bytes"] += len(frame)
+        timer.start()
+    if not _qapp_rns_write(entry, frame):
+        with _state_lock:
+            removed = entry["unacked"].pop(message_id, None)
+            if removed is not None:
+                removed["timer"].cancel()
+                entry["queued_bytes"] = max(0, entry["queued_bytes"] - len(frame))
+        return _qapp_rns_error(req_id, "RNS_SEND_QUEUE_FULL")
+    emit_resp(req_id, True, payload={"messageId": str(message_id)})
+
+
+def handle_qapp_rns_close(req_id: str, payload: Dict[str, Any]) -> None:
+    manager_key = str(payload.get("managerKey") or "")
+    connection_id = str(payload.get("connectionId") or "")
+    entry = None
+    close_frame = None
+    with _state_lock:
+        entry = _qapp_rns_entries.get(manager_key)
+        if entry is not None and connection_id in entry.get("connections", set()):
+            message_id = int(entry["next_message_id"])
+            entry["next_message_id"] = (message_id + 1) & 0xffffffffffffffff
+            control = json.dumps({
+                "type": "CLOSE",
+                "connectionId": connection_id,
+            }, separators=(",", ":")).encode("utf-8")
+            close_frame = _qapp_rns_frame(_QAPP_RNS_CONTROL, message_id, control)
+    with _state_lock:
+        current = _qapp_rns_entries.get(manager_key)
+        if current is entry and entry is not None:
+            entry["connections"].discard(connection_id)
+            entry["last_used"] = time.time()
+            if not entry["connections"]:
+                _qapp_rns_cancel_keepalive(entry)
+            _qapp_rns_schedule_idle(entry)
+    try:
+        emit_resp(req_id, True, payload={"state": "CLOSED"})
+    finally:
+        if close_frame is not None and entry is not None:
+            # Local ownership is already closed. Deliver the remote CLOSE in a
+            # bounded worker so a wedged Reticulum stream can never hold the
+            # lifecycle scheduler. Failure tears down only the same physical
+            # Link; a replacement Link created meanwhile is left untouched.
+            _qapp_rns_schedule_close_write(entry, close_frame)
+
+
+def handle_qapp_rns_request(req_id: str, payload: Dict[str, Any]) -> None:
+    try:
+        manager_key = str(payload.get("managerKey") or "")
+        destination = str(payload.get("destination") or "").lower()
+        entry = _qapp_rns_entry(manager_key, destination)
+        logical_connection_id = str(payload.get("logicalConnectionId") or "")
+        if logical_connection_id:
+            with _state_lock:
+                if logical_connection_id not in entry.get("connections", set()):
+                    return _qapp_rns_error(req_id, "RNS_INVALID_CONNECTION")
+        if not _qapp_rns_open_link(entry):
+            return _qapp_rns_error(req_id, "RNS_LINK_TIMEOUT")
+        timeout = min(120.0, max(1.0, float(payload.get("timeoutMs") or 30000) / 1000.0))
+        max_response = min(1024 * 1024, max(1, int(payload.get("maxResponseBytes") or 1024 * 1024)))
+
+        with _state_lock:
+            if int(entry.get("active_requests") or 0) >= 16:
+                return _qapp_rns_error(req_id, "RNS_SEND_QUEUE_FULL")
+            entry["active_requests"] += 1
+
+        completion_lock = threading.Lock()
+        completed = False
+        timeout_timer: Optional[threading.Timer] = None
+
+        def finish(
+            response_payload: Optional[Dict[str, Any]] = None,
+            code: str = "",
+        ) -> None:
+            nonlocal completed
+            with completion_lock:
+                if completed:
+                    return
+                completed = True
+            if timeout_timer is not None:
+                timeout_timer.cancel()
+            with _state_lock:
+                entry["active_requests"] = max(
+                    0, int(entry.get("active_requests") or 0) - 1
+                )
+                entry["last_used"] = time.time()
+                _qapp_rns_schedule_idle(entry)
+            if response_payload is not None:
+                emit_resp(req_id, True, payload=response_payload)
+            else:
+                _qapp_rns_error(req_id, code or "RNS_REQUEST_TIMEOUT")
+
+        def response_received(receipt) -> None:
+            try:
+                value = receipt.get_response()
+                if isinstance(value, bytes):
+                    response_bytes = value
+                    encoding = "base64"
+                else:
+                    response_bytes = json.dumps(value, separators=(",", ":")).encode("utf-8")
+                    encoding = "json"
+                if len(response_bytes) > max_response:
+                    finish(code="RNS_RESPONSE_TOO_LARGE")
+                else:
+                    finish(
+                        {
+                            "payloadBase64": base64.b64encode(response_bytes).decode("ascii"),
+                            "encoding": encoding,
+                        }
+                    )
+            except Exception:
+                finish(code="RNS_PROTOCOL_ERROR")
+
+        def request_failed(_value=None) -> None:
+            finish(code="RNS_REQUEST_TIMEOUT")
+
+        request_data = {
+            "version": 1,
+            "requestId": str(payload.get("requestId") or ""),
+            "encoding": "base64" if payload.get("encoding") == "base64" else "json",
+            "payloadBase64": str(payload.get("payloadBase64") or ""),
+        }
+        if logical_connection_id:
+            request_data["logicalConnectionId"] = logical_connection_id
+        try:
+            timeout_timer = threading.Timer(timeout + 1.0, request_failed)
+            timeout_timer.daemon = True
+            timeout_timer.start()
+            receipt = entry["link"].request(
+                str(payload.get("path") or "/"),
+                data=request_data,
+                response_callback=response_received,
+                failed_callback=request_failed,
+                timeout=timeout,
+            )
+            if receipt is False:
+                request_failed()
+        except Exception:
+            finish(code="RNS_REQUEST_TIMEOUT")
+    except Exception:
+        _qapp_rns_error(req_id, "RNS_REQUEST_TIMEOUT")
+
+
+_relay_ticket_slots = threading.BoundedSemaphore(4)
+
+def handle_relay_ticket_request(req_id, payload):
+    # Dedicated bounded worker: never block QApp/media or control schedulers.
+    if not _relay_ticket_slots.acquire(blocking=False):
+        emit_resp(req_id, False, error="RELAY_BUSY")
+        return
+    def run():
+        link = None
+        try:
+            key = bytes.fromhex(str(payload.get("identity") or ""))
+            path = payload.get("path")
+            data = json.dumps(payload.get("data"), separators=(",", ":")).encode()
+            if len(key) != 64 or path not in ("/catalog", "/challenge", "/issue") or len(data) > 8192:
+                raise ValueError("RELAY_PROOF_INVALID")
+            identity = RNS.Identity(create_keys=False)
+            identity.load_public_key(key)
+            destination = RNS.Destination(identity, RNS.Destination.OUT, RNS.Destination.SINGLE, APP_NAMESPACE, COMMUNITY_MASQUE_ASPECT, COMMUNITY_MASQUE_VERSION)
+            deadline = time.monotonic() + 15
+            if not RNS.Transport.has_path(destination.hash):
+                RNS.Transport.request_path(destination.hash)
+                while not RNS.Transport.has_path(destination.hash) and time.monotonic() < deadline:
+                    time.sleep(0.05)
+            established = threading.Event()
+            link = RNS.Link(destination, established_callback=lambda _: established.set())
+            if not established.wait(max(0, deadline-time.monotonic())):
+                raise ValueError("RELAY_AUTH_UNAVAILABLE")
+            done = threading.Event()
+            result = []
+            def response(receipt):
+                result.append(receipt.get_response())
+                done.set()
+            link.request(path, data=data, response_callback=response, failed_callback=lambda _: done.set(), timeout=10, max_response_size=8192)
+            if not done.wait(11) or not result or not isinstance(result[0], dict) or len(json.dumps(result[0])) > 8192:
+                raise ValueError("RELAY_AUTH_UNAVAILABLE")
+            emit_resp(req_id, True, payload=result[0])
+        except Exception as exc:
+            code = str(exc)
+            emit_resp(req_id, False, error=code if code.startswith("RELAY_") else "RELAY_AUTH_UNAVAILABLE")
+        finally:
+            if link is not None:
+                try: link.teardown()
+                except Exception: pass
+            _relay_ticket_slots.release()
+    threading.Thread(target=run, daemon=True, name="relay-ticket").start()
+
 def handle_command(message: Dict[str, Any]) -> None:
     req_id = str(message.get("id") or "")
     action = message.get("action")
@@ -26760,6 +27794,8 @@ def handle_command(message: Dict[str, Any]) -> None:
 
     if action == "start":
         handle_start(req_id, payload)
+    elif action == "relay_ticket_request":
+        handle_relay_ticket_request(req_id, payload)
     elif action == "publish_presence":
         handle_publish_presence(req_id, payload)
     elif action == "clear_presence_cache":
@@ -26776,6 +27812,8 @@ def handle_command(message: Dict[str, Any]) -> None:
         handle_configure_community_stun(req_id, payload)
     elif action == "get_community_stun_endpoints":
         handle_get_community_stun_endpoints(req_id)
+    elif action == "get_community_masque_relays":
+        handle_get_community_masque_relays(req_id, payload)
     elif action == "configure_developer_log_filter":
         handle_configure_developer_log_filter(req_id, payload)
     elif action == "stop":
@@ -26882,6 +27920,14 @@ def handle_command(message: Dict[str, Any]) -> None:
         handle_ensure_peer_identity(req_id, payload)
     elif action == "register_peer_identity":
         handle_register_peer_identity(req_id, payload)
+    elif action == "qapp_rns_request":
+        handle_qapp_rns_request(req_id, payload)
+    elif action == "qapp_rns_connect":
+        handle_qapp_rns_connect(req_id, payload)
+    elif action == "qapp_rns_send":
+        handle_qapp_rns_send(req_id, payload)
+    elif action == "qapp_rns_close":
+        handle_qapp_rns_close(req_id, payload)
     else:
         emit_resp(req_id, False, error=f"Unknown action: {action}")
 
diff --git a/electron/resources/presence_bridge_test.py b/electron/resources/presence_bridge_test.py
index 7308cb093..58d76910c 100644
--- a/electron/resources/presence_bridge_test.py
+++ b/electron/resources/presence_bridge_test.py
@@ -38,6 +38,686 @@ def load_bridge():
     return module
 
 
+class QAppReticulumV1CompatibilityTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.bridge = load_bridge()
+        vector_path = Path(__file__).parents[2] / "protocol-v1-vectors.json"
+        cls.vectors = json.loads(vector_path.read_text(encoding="utf-8"))
+
+    def test_frozen_frame_vectors(self):
+        for key in ("data_frame", "ack_frame", "control_frame"):
+            vector = self.vectors[key]
+            encoded = self.bridge._qapp_rns_frame(
+                int(vector["type"]),
+                int(vector["message_id_hex"], 16),
+                bytes.fromhex(vector["payload_hex"]),
+            )
+            self.assertEqual(encoded.hex(), vector["frame_hex"])
+
+    def test_ping_control_returns_pong_with_same_message_id(self):
+        writes = []
+
+        class Writer:
+            def write(self, data):
+                writes.append(bytes(data))
+                return len(data)
+
+            def flush(self):
+                return None
+
+        entry = {
+            "writer": Writer(),
+            "established": True,
+            "write_lock": threading.Lock(),
+            "last_used": 0,
+        }
+        vector = self.vectors["control_frame"]
+        self.bridge._qapp_rns_handle_frame(
+            entry,
+            self.bridge._QAPP_RNS_CONTROL,
+            int(vector["message_id_hex"], 16),
+            bytes.fromhex(vector["payload_hex"]),
+        )
+        _version, frame_type, message_id, length = self.bridge._QAPP_RNS_HEADER.unpack_from(writes[0])
+        self.assertEqual(frame_type, self.bridge._QAPP_RNS_CONTROL)
+        self.assertEqual(message_id, int(vector["message_id_hex"], 16))
+        self.assertEqual(writes[0][self.bridge._QAPP_RNS_HEADER.size:], b'{"type":"PONG"}')
+        self.assertEqual(length, len(b'{"type":"PONG"}'))
+
+    def test_buffer_write_retries_partial_writes_and_flushes(self):
+        output = bytearray()
+
+        class PartialWriter:
+            flushed = False
+
+            def write(self, data):
+                amount = min(2, len(data))
+                output.extend(data[:amount])
+                return amount
+
+            def flush(self):
+                self.flushed = True
+
+        writer = PartialWriter()
+        entry = {
+            "writer": writer,
+            "established": True,
+            "write_lock": threading.Lock(),
+            "last_used": 0,
+        }
+        self.assertTrue(self.bridge._qapp_rns_write(entry, b"0123456789"))
+        self.assertEqual(bytes(output), b"0123456789")
+        self.assertTrue(writer.flushed)
+        self.assertEqual(self.bridge._QAPP_RNS_STREAM_ID, 7)
+
+    def test_full_channel_window_expires_without_blocking_later_writes(self):
+        entry = {
+            "writer": mock.Mock(write=mock.Mock(return_value=0)),
+            "established": True, "write_lock": threading.Lock(),
+        }
+        with mock.patch.object(self.bridge, "_QAPP_RNS_WRITE_TIMEOUT_SECONDS", 0.05):
+            started = time.monotonic()
+            self.assertFalse(self.bridge._qapp_rns_write(entry, b"auth"))
+            self.assertLess(time.monotonic() - started, 0.5)
+        entry["writer"] = mock.Mock(write=mock.Mock(side_effect=lambda data: len(data)))
+        self.assertTrue(self.bridge._qapp_rns_write(entry, b"next"))
+
+    def test_blocked_stream_is_detached_and_replacement_uses_its_own_lock(self):
+        started = threading.Event()
+        release = threading.Event()
+        completed = threading.Event()
+        def blocked(_data):
+            started.set()
+            release.wait(2)
+            completed.set()
+            return 1
+        old_link = mock.Mock()
+        entry = self.bridge._qapp_rns_entry("blocked-stream-test", "00" * 16)
+        entry.update(writer=mock.Mock(write=blocked), established=True,
+                     link=old_link, generation=1, connections={"logical"})
+        try:
+            with mock.patch.object(self.bridge, "_QAPP_RNS_WRITE_TIMEOUT_SECONDS", 0.05), mock.patch.object(
+                self.bridge, "_qapp_rns_schedule_reconnect"
+            ) as reconnect, mock.patch.object(self.bridge, "emit_event"):
+                before = time.monotonic()
+                self.assertFalse(self.bridge._qapp_rns_write(entry, b"old"))
+                self.assertTrue(started.is_set())
+                self.assertLess(time.monotonic() - before, 0.5)
+                self.assertIsNone(entry["link"])
+                self.assertFalse(entry["established"])
+                reconnect.assert_called_once_with(entry)
+            new_link = mock.Mock()
+            new_writer = mock.Mock(write=mock.Mock(side_effect=lambda data: len(data)))
+            entry.update(writer=new_writer, write_lock=threading.Lock(),
+                         link=new_link, generation=2, established=True)
+            self.assertTrue(self.bridge._qapp_rns_write(entry, b"new"))
+            release.set()
+            self.assertTrue(completed.wait(0.5))
+            new_writer.write.assert_called_once_with(b"new")
+            new_link.teardown.assert_not_called()
+            old_link.teardown.assert_called_once()
+        finally:
+            release.set()
+            self.bridge._qapp_rns_entries.pop("blocked-stream-test", None)
+
+    def test_waiting_for_stream_lock_has_a_deadline(self):
+        lock = threading.Lock()
+        lock.acquire()
+        entry = {"writer": mock.Mock(), "established": True, "write_lock": lock}
+        try:
+            with mock.patch.object(self.bridge, "_QAPP_RNS_WRITE_TIMEOUT_SECONDS", 0.05):
+                before = time.monotonic()
+                self.assertFalse(self.bridge._qapp_rns_write(entry, b"auth"))
+                self.assertLess(time.monotonic() - before, 0.5)
+            entry["writer"].write.assert_not_called()
+        finally:
+            lock.release()
+
+    def test_active_realtime_connection_sends_internal_keepalive(self):
+        timers = []
+        writes = []
+
+        class Timer:
+            def __init__(self, delay, callback):
+                self.delay = delay
+                self.callback = callback
+                self.cancelled = False
+                self.daemon = False
+                timers.append(self)
+
+            def start(self):
+                return None
+
+            def cancel(self):
+                self.cancelled = True
+
+        entry = {
+            "managerKey": "keepalive-test",
+            "destination": "00" * 16,
+            "connections": {"rns-test"},
+            "established": True,
+            "generation": 1,
+            "next_message_id": 7,
+            "keepalive_generation": 0,
+            "keepalive_timer": None,
+        }
+        self.bridge._qapp_rns_entries[entry["managerKey"]] = entry
+        try:
+            with mock.patch.object(self.bridge.threading, "Timer", Timer), mock.patch.object(
+                self.bridge,
+                "_qapp_rns_write",
+                side_effect=lambda _entry, frame: writes.append(frame) or True,
+            ):
+                self.bridge._qapp_rns_schedule_keepalive(entry)
+                self.assertEqual(timers[0].delay, self.bridge._QAPP_RNS_KEEPALIVE_SECONDS)
+                timers[0].callback()
+
+            self.assertEqual(len(writes), 1)
+            _version, frame_type, message_id, length = self.bridge._QAPP_RNS_HEADER.unpack_from(writes[0])
+            self.assertEqual(frame_type, self.bridge._QAPP_RNS_CONTROL)
+            self.assertEqual(message_id, 7)
+            self.assertEqual(writes[0][self.bridge._QAPP_RNS_HEADER.size:], b'{"type":"PING"}')
+            self.assertEqual(length, len(b'{"type":"PING"}'))
+            self.assertEqual(entry["next_message_id"], 8)
+            self.assertEqual(len(timers), 2)
+        finally:
+            timer = entry.get("keepalive_timer")
+            if timer is not None:
+                timer.cancel()
+            self.bridge._qapp_rns_entries.pop(entry["managerKey"], None)
+
+    def test_keepalive_stops_without_logical_connections(self):
+        timer = mock.Mock()
+        entry = {
+            "keepalive_generation": 2,
+            "keepalive_timer": timer,
+        }
+
+        self.bridge._qapp_rns_cancel_keepalive(entry)
+
+        timer.cancel.assert_called_once_with()
+        self.assertIsNone(entry["keepalive_timer"])
+        self.assertEqual(entry["keepalive_generation"], 3)
+
+    def test_close_sends_logical_control_without_closing_other_connections(self):
+        writes = []
+        flushed = threading.Event()
+
+        class Writer:
+            def write(self, data):
+                writes.append(bytes(data))
+                return len(data)
+
+            def flush(self):
+                flushed.set()
+                return None
+
+        entry = {
+            "managerKey": "logical-close-test",
+            "destination": "00" * 16,
+            "connections": {"rns-one", "rns-two"},
+            "established": True,
+            "writer": Writer(),
+            "write_lock": threading.Lock(),
+            "last_used": 0,
+            "next_message_id": 41,
+            "keepalive_generation": 0,
+            "keepalive_timer": None,
+            "idle_generation": 0,
+            "idle_timer": None,
+            "link": mock.Mock(),
+        }
+        self.bridge._qapp_rns_entries[entry["managerKey"]] = entry
+        try:
+            with mock.patch.object(self.bridge, "emit_resp") as emit_resp, mock.patch.object(
+                self.bridge, "_qapp_rns_schedule_idle"
+            ):
+                self.bridge.handle_qapp_rns_close("request-1", {
+                    "managerKey": entry["managerKey"],
+                    "connectionId": "rns-one",
+                })
+
+            self.assertTrue(flushed.wait(0.5))
+            self.assertEqual(entry["connections"], {"rns-two"})
+            self.assertEqual(entry["next_message_id"], 42)
+            self.assertEqual(len(writes), 1)
+            _version, frame_type, message_id, _length = (
+                self.bridge._QAPP_RNS_HEADER.unpack_from(writes[0])
+            )
+            self.assertEqual(frame_type, self.bridge._QAPP_RNS_CONTROL)
+            self.assertEqual(message_id, 41)
+            self.assertEqual(
+                json.loads(writes[0][self.bridge._QAPP_RNS_HEADER.size:]),
+                {"type": "CLOSE", "connectionId": "rns-one"},
+            )
+            entry["link"].teardown.assert_not_called()
+            emit_resp.assert_called_once_with(
+                "request-1", True, payload={"state": "CLOSED"}
+            )
+        finally:
+            timer = entry.get("idle_timer")
+            if timer is not None:
+                timer.cancel()
+            self.bridge._qapp_rns_entries.pop(entry["managerKey"], None)
+
+    def test_close_tears_down_failed_link_when_control_cannot_be_written(self):
+        class FailingWriter:
+            def write(self, _data):
+                raise RuntimeError("link failed")
+
+            def flush(self):
+                return None
+
+        entry = {
+            "managerKey": "logical-close-failure-test",
+            "destination": "00" * 16,
+            "connections": {"rns-one"},
+            "established": True,
+            "writer": FailingWriter(),
+            "write_lock": threading.Lock(),
+            "last_used": 0,
+            "next_message_id": 51,
+            "keepalive_generation": 0,
+            "keepalive_timer": None,
+            "idle_generation": 0,
+            "idle_timer": None,
+            "link": mock.Mock(),
+        }
+        self.bridge._qapp_rns_entries[entry["managerKey"]] = entry
+        original_link = entry["link"]
+        try:
+            teardown_called = threading.Event()
+            with mock.patch.object(self.bridge, "emit_resp"), mock.patch.object(
+                self.bridge, "_qapp_rns_schedule_idle"
+            ), mock.patch.object(
+                self.bridge,
+                "_qapp_rns_teardown_failed_close",
+                side_effect=lambda *_args: teardown_called.set(),
+            ) as teardown:
+                self.bridge.handle_qapp_rns_close("request-2", {
+                    "managerKey": entry["managerKey"],
+                    "connectionId": "rns-one",
+                })
+
+                self.assertEqual(entry["connections"], set())
+                self.assertTrue(teardown_called.wait(0.5))
+                teardown.assert_called_once_with(entry, original_link, "completed")
+                original_link.teardown.assert_called_once()
+                self.assertFalse(entry["established"])
+        finally:
+            self.bridge._qapp_rns_entries.pop(entry["managerKey"], None)
+
+    def test_close_releases_lifecycle_lane_when_control_write_stalls(self):
+        write_started = threading.Event()
+        release_write = threading.Event()
+
+        def stalled_write(_entry, _frame, **_kwargs):
+            write_started.set()
+            release_write.wait(1.0)
+            return True
+
+        entry = {
+            "managerKey": "logical-close-stalled-test",
+            "destination": "00" * 16,
+            "connections": {"rns-one"},
+            "established": True,
+            "writer": mock.Mock(),
+            "write_lock": threading.Lock(),
+            "last_used": 0,
+            "next_message_id": 61,
+            "keepalive_generation": 0,
+            "keepalive_timer": None,
+            "idle_generation": 0,
+            "idle_timer": None,
+            "link": mock.Mock(),
+        }
+        self.bridge._qapp_rns_entries[entry["managerKey"]] = entry
+        try:
+            teardown_called = threading.Event()
+            started_at = time.monotonic()
+            with mock.patch.object(
+                self.bridge, "_qapp_rns_write", side_effect=stalled_write
+            ), mock.patch.object(
+                self.bridge, "_QAPP_RNS_CLOSE_WRITE_TIMEOUT_SECONDS", 0.05
+            ), mock.patch.object(
+                self.bridge, "emit_resp"
+            ) as emit_resp, mock.patch.object(
+                self.bridge, "_qapp_rns_schedule_idle"
+            ), mock.patch.object(
+                self.bridge,
+                "_qapp_rns_teardown_failed_close",
+                side_effect=lambda *_args: teardown_called.set(),
+            ) as teardown:
+                self.bridge.handle_qapp_rns_close("request-stalled", {
+                    "managerKey": entry["managerKey"],
+                    "connectionId": "rns-one",
+                })
+                elapsed = time.monotonic() - started_at
+
+                self.assertLess(elapsed, 0.1)
+                self.assertEqual(entry["connections"], set())
+                emit_resp.assert_called_once_with(
+                    "request-stalled", True, payload={"state": "CLOSED"}
+                )
+                self.assertTrue(write_started.wait(0.5))
+                self.assertTrue(teardown_called.wait(0.5))
+                teardown.assert_called_once_with(
+                    entry,
+                    entry["link"],
+                    "send_timeout",
+                )
+        finally:
+            release_write.set()
+            self.bridge._qapp_rns_entries.pop(entry["managerKey"], None)
+
+    def test_failed_close_does_not_teardown_a_replacement_link(self):
+        stale_link = mock.Mock()
+        current_link = mock.Mock()
+        entry = {"link": current_link}
+
+        with mock.patch.object(
+            self.bridge, "_teardown_reticulum_link_bounded"
+        ) as teardown:
+            self.bridge._qapp_rns_teardown_failed_close(
+                entry,
+                stale_link,
+                "send_timeout",
+            )
+
+        teardown.assert_not_called()
+
+    def test_delayed_close_cannot_write_to_replacement_stream(self):
+        old_link = mock.Mock()
+        new_link = mock.Mock()
+        writer = mock.Mock()
+        entry = {"writer": writer, "link": new_link, "established": True,
+                 "generation": 2, "write_lock": threading.Lock()}
+        self.assertFalse(self.bridge._qapp_rns_write(entry, b"old-close", expected_link=old_link))
+        writer.write.assert_not_called()
+        new_link.teardown.assert_not_called()
+
+    def test_rpc_response_callback_extracts_request_receipt_response(self):
+        emitted = []
+
+        class Receipt:
+            def get_response(self):
+                return {
+                    "protocol": "qortal-example",
+                    "version": 1,
+                    "items": [],
+                }
+
+        class Link:
+            def request(self, _path, **options):
+                options["response_callback"](Receipt())
+                return object()
+
+        entry = {"link": Link(), "active_requests": 0, "last_used": 0}
+        payload = {
+            "managerKey": "rpc-receipt-test",
+            "destination": "00" * 16,
+            "path": "/example/status",
+            "requestId": "status-test",
+            "encoding": "json",
+            "payloadBase64": base64.b64encode(b"{}").decode("ascii"),
+        }
+
+        with mock.patch.object(self.bridge, "_qapp_rns_entry", return_value=entry), mock.patch.object(
+            self.bridge, "_qapp_rns_open_link", return_value=True
+        ), mock.patch.object(self.bridge, "_qapp_rns_schedule_idle"), mock.patch.object(
+            self.bridge,
+            "emit_resp",
+            side_effect=lambda request_id, ok, payload=None: emitted.append((request_id, ok, payload)),
+        ):
+            self.bridge.handle_qapp_rns_request("bridge-request", payload)
+
+        self.assertEqual(len(emitted), 1)
+        request_id, ok, response = emitted[0]
+        self.assertEqual(request_id, "bridge-request")
+        self.assertTrue(ok)
+        self.assertEqual(response["encoding"], "json")
+        decoded = json.loads(base64.b64decode(response["payloadBase64"]))
+        self.assertEqual(
+            decoded,
+            {"protocol": "qortal-example", "version": 1, "items": []},
+        )
+
+    def test_rpc_response_wait_does_not_block_scheduler_worker(self):
+        emitted = []
+        callbacks = {}
+
+        class Receipt:
+            def get_response(self):
+                return {"ok": True}
+
+        class Link:
+            def request(self, _path, **options):
+                callbacks.update(options)
+                return object()
+
+        entry = {"link": Link(), "active_requests": 0, "last_used": 0}
+        payload = {
+            "managerKey": "rpc-async-test",
+            "destination": "00" * 16,
+            "path": "/example/status",
+            "requestId": "status-test",
+            "encoding": "json",
+            "payloadBase64": base64.b64encode(b"{}").decode("ascii"),
+        }
+
+        with mock.patch.object(
+            self.bridge, "_qapp_rns_entry", return_value=entry
+        ), mock.patch.object(
+            self.bridge, "_qapp_rns_open_link", return_value=True
+        ), mock.patch.object(
+            self.bridge, "_qapp_rns_schedule_idle"
+        ), mock.patch.object(
+            self.bridge,
+            "emit_resp",
+            side_effect=lambda request_id, ok, payload=None: emitted.append(
+                (request_id, ok, payload)
+            ),
+        ):
+            started = time.monotonic()
+            self.bridge.handle_qapp_rns_request("bridge-request", payload)
+            elapsed = time.monotonic() - started
+
+            self.assertLess(elapsed, 0.1)
+            self.assertEqual(emitted, [])
+            self.assertEqual(entry["active_requests"], 1)
+
+            callbacks["response_callback"](Receipt())
+            self.assertEqual(len(emitted), 1)
+            self.assertEqual(entry["active_requests"], 0)
+
+    def test_rpc_timeout_and_late_callback_complete_only_once(self):
+        emitted = []
+        callbacks = {}
+        timers = []
+
+        class Timer:
+            def __init__(self, _delay, callback):
+                self.callback = callback
+                self.cancelled = False
+                self.daemon = False
+                timers.append(self)
+
+            def start(self):
+                return None
+
+            def cancel(self):
+                self.cancelled = True
+
+        class Receipt:
+            def get_response(self):
+                return {"late": True}
+
+        class Link:
+            def request(self, _path, **options):
+                callbacks.update(options)
+                return object()
+
+        entry = {"link": Link(), "active_requests": 0, "last_used": 0}
+        payload = {
+            "managerKey": "rpc-timeout-test",
+            "destination": "00" * 16,
+            "path": "/example/status",
+            "requestId": "timeout-test",
+        }
+
+        with mock.patch.object(
+            self.bridge, "_qapp_rns_entry", return_value=entry
+        ), mock.patch.object(
+            self.bridge, "_qapp_rns_open_link", return_value=True
+        ), mock.patch.object(
+            self.bridge, "_qapp_rns_schedule_idle"
+        ), mock.patch.object(
+            self.bridge.threading, "Timer", Timer
+        ), mock.patch.object(
+            self.bridge,
+            "emit_resp",
+            side_effect=lambda request_id, ok, payload=None, error=None: emitted.append(
+                (request_id, ok, payload, error)
+            ),
+        ):
+            self.bridge.handle_qapp_rns_request("bridge-request", payload)
+            timers[0].callback()
+            callbacks["response_callback"](Receipt())
+
+        self.assertEqual(len(emitted), 1)
+        self.assertFalse(emitted[0][1])
+        self.assertEqual(entry["active_requests"], 0)
+
+    def test_rpc_timer_start_failure_releases_active_request(self):
+        emitted = []
+
+        class Timer:
+            daemon = False
+
+            def __init__(self, _delay, _callback):
+                pass
+
+            def start(self):
+                raise RuntimeError("thread unavailable")
+
+            def cancel(self):
+                pass
+
+        entry = {"link": object(), "active_requests": 0, "last_used": 0}
+        payload = {
+            "managerKey": "rpc-timer-failure-test",
+            "destination": "00" * 16,
+            "path": "/example/status",
+            "requestId": "timer-failure-test",
+        }
+
+        with mock.patch.object(
+            self.bridge, "_qapp_rns_entry", return_value=entry
+        ), mock.patch.object(
+            self.bridge, "_qapp_rns_open_link", return_value=True
+        ), mock.patch.object(
+            self.bridge, "_qapp_rns_schedule_idle"
+        ), mock.patch.object(
+            self.bridge.threading, "Timer", Timer
+        ), mock.patch.object(
+            self.bridge,
+            "emit_resp",
+            side_effect=lambda request_id, ok, payload=None, error=None: emitted.append(
+                (request_id, ok, payload, error)
+            ),
+        ):
+            self.bridge.handle_qapp_rns_request("bridge-request", payload)
+
+        self.assertEqual(len(emitted), 1)
+        self.assertFalse(emitted[0][1])
+        self.assertEqual(entry["active_requests"], 0)
+
+    def test_idle_reschedule_replaces_previous_timer(self):
+        timers = []
+
+        class Timer:
+            def __init__(self, _delay, callback):
+                self.callback = callback
+                self.cancelled = False
+                self.daemon = False
+                timers.append(self)
+
+            def start(self):
+                return None
+
+            def cancel(self):
+                self.cancelled = True
+
+        entry = {
+            "managerKey": "idle-timer-test",
+            "destination": "00" * 16,
+            "idle_generation": 0,
+            "idle_timer": None,
+        }
+
+        with mock.patch.object(self.bridge.threading, "Timer", Timer):
+            self.bridge._qapp_rns_schedule_idle(entry)
+            self.bridge._qapp_rns_schedule_idle(entry)
+
+        self.assertEqual(len(timers), 2)
+        self.assertTrue(timers[0].cancelled)
+        self.assertFalse(timers[1].cancelled)
+        self.assertIs(entry["idle_timer"], timers[1])
+        self.assertEqual(entry["idle_generation"], 2)
+
+    def test_idle_timer_start_failure_is_best_effort(self):
+        class Timer:
+            daemon = False
+
+            def __init__(self, _delay, _callback):
+                pass
+
+            def start(self):
+                raise RuntimeError("thread unavailable")
+
+            def cancel(self):
+                pass
+
+        entry = {
+            "managerKey": "idle-timer-failure-test",
+            "destination": "00" * 16,
+            "idle_generation": 0,
+            "idle_timer": None,
+        }
+
+        with mock.patch.object(self.bridge.threading, "Timer", Timer), mock.patch.object(
+            self.bridge, "log"
+        ) as log:
+            self.bridge._qapp_rns_schedule_idle(entry)
+
+        self.assertIsNone(entry["idle_timer"])
+        log.assert_called_once()
+
+    def test_close_while_reconnecting_does_not_resurrect_link(self):
+        entry = {
+            "managerKey": "close-race-test",
+            "connections": {"rns-test"},
+            "established": False,
+            "reconnect_attempt": 0,
+        }
+        self.bridge._qapp_rns_entries[entry["managerKey"]] = entry
+        opened = mock.Mock()
+        try:
+            with mock.patch.object(self.bridge, "_qapp_rns_open_link", opened), mock.patch.object(
+                self.bridge.secrets, "randbelow", return_value=20
+            ):
+                self.bridge._qapp_rns_schedule_reconnect(entry)
+                entry["connections"].clear()
+                time.sleep(0.65)
+            opened.assert_not_called()
+        finally:
+            timer = entry.get("reconnect_timer")
+            if timer is not None:
+                timer.cancel()
+            self.bridge._qapp_rns_entries.pop(entry["managerKey"], None)
+
+
 class PresenceBridgePacketSendDispatcherTest(unittest.TestCase):
     def setUp(self):
         self.bridge = load_bridge()
@@ -4315,6 +4995,62 @@ def test_resource_commands_use_fast_control_lane(self):
                     "resource-control",
                 )
 
+    def test_qapp_commands_are_isolated_by_work_class_and_owner(self):
+        first = {"payload": {"managerKey": "owner-a"}}
+        same_owner = {"payload": {"managerKey": "owner-a"}}
+        second = {"payload": {"managerKey": "owner-b"}}
+
+        rpc_lane = self.bridge._scheduler_lane_for_command(
+            "qapp_rns_request", first
+        )
+        self.assertEqual(
+            rpc_lane,
+            self.bridge._scheduler_lane_for_command(
+                "qapp_rns_request", same_owner
+            ),
+        )
+        self.assertTrue(rpc_lane.startswith("qapp-rpc-"))
+        self.assertTrue(
+            self.bridge._scheduler_lane_for_command(
+                "qapp_rns_send", first
+            ).startswith("qapp-realtime-")
+        )
+        self.assertTrue(
+            self.bridge._scheduler_lane_for_command(
+                "qapp_rns_connect", second
+            ).startswith("qapp-lifecycle-")
+        )
+        self.assertEqual(
+            self.bridge._scheduler_lane_for_command("publish_presence"),
+            "control-send",
+        )
+        self.assertIn(rpc_lane, self.bridge._SCHEDULER_QUEUE_MAX_BY_LANE)
+
+    def test_full_qapp_rpc_lane_does_not_consume_control_capacity(self):
+        message = {"payload": {"managerKey": "owner-a"}}
+        rpc_lane = self.bridge._scheduler_lane_for_command(
+            "qapp_rns_request", message
+        )
+        previous = dict(self.bridge._scheduler_queues)
+        try:
+            self.bridge._scheduler_queues[rpc_lane] = queue.Queue(maxsize=1)
+            self.bridge._scheduler_queues["control-send"] = queue.Queue(maxsize=1)
+            self.bridge._scheduler_queues[rpc_lane].put_nowait(object())
+
+            self.assertFalse(
+                self.bridge._enqueue_scheduler_task(
+                    rpc_lane, "blocked-rpc", lambda: None
+                )
+            )
+            self.assertTrue(
+                self.bridge._enqueue_scheduler_task(
+                    "control-send", "healthy-control", lambda: None
+                )
+            )
+        finally:
+            self.bridge._scheduler_queues.clear()
+            self.bridge._scheduler_queues.update(previous)
+
     def test_resource_open_shard_is_stable_for_a_peer(self):
         lane = self.bridge._resource_open_scheduler_lane(self.peer_hash)
         self.assertEqual(
@@ -9131,5 +9867,51 @@ def test_call_pinned_inbound_peer_uses_reserved_capacity(self):
         )
 
 
+class MasqueSignedDiscoveryTest(unittest.TestCase):
+    def setUp(self):
+        self.bridge = load_bridge()
+        self.handler = self.bridge.CommunityMasqueRelayAnnounceHandler()
+
+    def test_unsigned_json_cannot_claim_v2(self):
+        value = {"v": 2, "h": "8.8.8.8", "p": 47322, "s": "relay.test", "c": "ab" * 32,
+                 "x": int(time.time()) + 600, "relayIdentity": "cd" * 32,
+                 "accessMode": "groups", "allowedGroupIds": [1144]}
+        self.handler.received_payload(json.dumps(value).encode())
+        self.assertEqual(self.bridge._community_masque_recent_endpoints, {})
+
+    def test_v3_preserves_service_identity_and_key_and_rejects_downgrade(self):
+        from masque_discovery_codec import encode
+        identity = RNS.Identity()
+        expiry = int(time.time()) + 600
+        def packet(key=None):
+            return encode(identity, "8.8.8.8", 47322, "relay.test", "ab"*32, expiry, "groups", [1144], key)
+        with mock.patch.object(self.bridge, "emit_event"):
+            self.handler.received_payload(packet("cd"*32))
+            value=list(self.bridge._community_masque_recent_endpoints.values())[0]
+            self.assertEqual(value["protocolVersion"],3)
+            self.assertEqual(value["ticketIdentity"],identity.get_public_key().hex())
+            self.assertEqual(value["ticketKeyId"],"cd"*32)
+            self.handler.received_payload(packet())
+            self.assertEqual(list(self.bridge._community_masque_recent_endpoints.values())[0]["protocolVersion"],3)
+            # A new key commitment must not be lost to endpoint debouncing.
+            expiry += 1
+            self.handler.received_payload(packet("ef"*32))
+            self.assertEqual(list(self.bridge._community_masque_recent_endpoints.values())[0]["ticketKeyId"],"ef"*32)
+
+    def test_signed_direct_response_is_verified_and_not_downgraded(self):
+        from masque_discovery_codec import encode
+        identity = RNS.Identity()
+        expiry = int(time.time()) + 600
+        packet = encode(identity, "8.8.8.8", 47322, "relay.test", "ab" * 32, expiry, "groups", [1144])
+        with mock.patch.object(self.bridge, "emit_event"):
+            self.handler.received_packet(packet, None)
+            values = list(self.bridge._community_masque_recent_endpoints.values())
+            self.assertEqual(len(values), 1)
+            self.assertEqual(values[0]["allowedGroupIds"], [1144])
+            self.handler.received_payload(json.dumps({"v": 1, "h": "8.8.8.8", "p": 47322,
+                "s": "relay.test", "c": "ab" * 32, "x": expiry + 1}).encode())
+            self.assertEqual(list(self.bridge._community_masque_recent_endpoints.values())[0]["protocolVersion"], 2)
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/electron/resources/private-transport/README.md b/electron/resources/private-transport/README.md
new file mode 100644
index 000000000..471da9d62
--- /dev/null
+++ b/electron/resources/private-transport/README.md
@@ -0,0 +1,19 @@
+# Private transport sidecar binaries
+
+`npm run build:private-transport --prefix electron` writes the current-platform
+binary here using this layout:
+
+```
+private-transport/
+  linux-x64/qortal-private-transport
+  linux-arm64/qortal-private-transport
+  darwin-x64/qortal-private-transport
+  darwin-arm64/qortal-private-transport
+  windows-x64/qortal-private-transport.exe
+  windows-arm64/qortal-private-transport.exe
+```
+
+The binaries are generated artifacts and are not committed. Release jobs must
+build the target artifact before invoking electron-builder. The Go program is
+CGO-free, but signing/notarization of packaged macOS and Windows binaries remains
+a release-pipeline responsibility.
diff --git a/electron/scripts/afterPack.js b/electron/scripts/afterPack.js
index c95e84d43..ecb1f026a 100644
--- a/electron/scripts/afterPack.js
+++ b/electron/scripts/afterPack.js
@@ -32,6 +32,27 @@ module.exports = async function afterPack(context) {
         warn(`⚠️ chmod reticulum/${name} failed:`, e.message);
       }
     }
+    const privateTransportDir = path.join(
+      appOutDir,
+      'resources',
+      'private-transport'
+    );
+    if (fs.existsSync(privateTransportDir)) {
+      for (const archDir of fs.readdirSync(privateTransportDir)) {
+        const sidecarPath = path.join(
+          privateTransportDir,
+          archDir,
+          'qortal-private-transport'
+        );
+        if (!fs.existsSync(sidecarPath)) continue;
+        try {
+          fs.chmodSync(sidecarPath, 0o755);
+          log(`✅ private-transport/${archDir} permissions set.`);
+        } catch (e) {
+          warn(`⚠️ chmod private-transport/${archDir} failed:`, e.message);
+        }
+      }
+    }
   }
 
   if (!plat.includes('linux')) return;
diff --git a/electron/scripts/build-private-transport.mjs b/electron/scripts/build-private-transport.mjs
new file mode 100644
index 000000000..d8c8efd34
--- /dev/null
+++ b/electron/scripts/build-private-transport.mjs
@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const electronRoot = path.resolve(scriptDir, '..');
+const moduleRoot = path.join(electronRoot, 'native', 'private-transport');
+const go = process.env.QORTAL_GO_BINARY || 'go';
+const goos =
+  process.env.QORTAL_PRIVATE_TRANSPORT_GOOS ||
+  (process.platform === 'win32'
+    ? 'windows'
+    : process.platform === 'darwin'
+      ? 'darwin'
+      : 'linux');
+const goarch =
+  process.env.QORTAL_PRIVATE_TRANSPORT_GOARCH ||
+  (process.arch === 'arm64' ? 'arm64' : 'amd64');
+const packageArch = goarch === 'amd64' ? 'x64' : goarch;
+const outputDir = path.join(
+  electronRoot,
+  'resources',
+  'private-transport',
+  `${goos}-${packageArch}`
+);
+const output = path.join(
+  outputDir,
+  `qortal-private-transport${goos === 'windows' ? '.exe' : ''}`
+);
+
+fs.mkdirSync(outputDir, { recursive: true });
+const buildArguments = [
+  'build',
+  '-trimpath',
+  '-ldflags=-s -w',
+  '-o',
+  output,
+  './cmd/qortal-private-transport',
+];
+let result = spawnSync(go, buildArguments, {
+  cwd: moduleRoot,
+  stdio: 'inherit',
+  windowsHide: true,
+  env: { ...process.env, GOOS: goos, GOARCH: goarch, CGO_ENABLED: '0' },
+});
+if (result.error?.code === 'ENOENT' && go === 'go') {
+  console.log(
+    'Go is not installed; building the private transport with Docker.'
+  );
+  const dockerArguments = ['run', '--rm'];
+  if (process.platform !== 'win32' && process.getuid && process.getgid) {
+    dockerArguments.push('--user', `${process.getuid()}:${process.getgid()}`);
+  }
+  dockerArguments.push(
+    '-e',
+    `GOOS=${goos}`,
+    '-e',
+    `GOARCH=${goarch}`,
+    '-e',
+    'CGO_ENABLED=0',
+    '-e',
+    'GOCACHE=/tmp/go-cache',
+    '-e',
+    'GOMODCACHE=/tmp/go-mod',
+    '-v',
+    `${moduleRoot}:/src`,
+    '-v',
+    `${outputDir}:/out`,
+    '-w',
+    '/src',
+    'golang:1.26-bookworm',
+    'go',
+    'build',
+    '-trimpath',
+    '-ldflags=-s -w',
+    '-o',
+    `/out/${path.basename(output)}`,
+    './cmd/qortal-private-transport'
+  );
+  result = spawnSync('docker', dockerArguments, {
+    stdio: 'inherit',
+    windowsHide: true,
+  });
+  if (result.error?.code === 'ENOENT') {
+    console.error(
+      'Unable to build private transport: install Go 1.26+ or Docker.'
+    );
+    process.exit(1);
+  }
+}
+if (result.error) {
+  console.error('Unable to build private transport:', result.error.message);
+  process.exit(1);
+}
+if (result.status !== 0) process.exit(result.status ?? 1);
+if (goos !== 'windows') fs.chmodSync(output, 0o755);
+console.log(`Built ${output}`);
diff --git a/electron/scripts/build-rnsd-frozen.py b/electron/scripts/build-rnsd-frozen.py
index 54ca1594e..e44df3310 100644
--- a/electron/scripts/build-rnsd-frozen.py
+++ b/electron/scripts/build-rnsd-frozen.py
@@ -278,6 +278,8 @@ def freeze_target(
         "qortalland_proximity",
         "--hidden-import",
         "qortal_python_diagnostics",
+        "--hidden-import",
+        "masque_discovery_codec",
         "--paths",
         str(electron_root / "resources"),
         "--runtime-hook",
@@ -319,6 +321,7 @@ def copy_runtime_sources(electron_root: Path, output_dir: Path) -> None:
     if not source_sitecustomize.is_file():
         sys.exit(f"Missing Python diagnostics startup hook: {source_sitecustomize}")
     shutil.copy2(source_bridge, output_dir / "presence_bridge.py")
+    shutil.copy2(electron_root / "resources" / "masque_discovery_codec.py", output_dir / "masque_discovery_codec.py")
     shutil.copy2(source_games, output_dir / "qortalland_games.py")
     shutil.copy2(source_proximity, output_dir / "qortalland_proximity.py")
     shutil.copy2(source_diagnostics, output_dir / "qortal_python_diagnostics.py")
diff --git a/electron/scripts/build-wallet-engine.mjs b/electron/scripts/build-wallet-engine.mjs
new file mode 100644
index 000000000..5c6db99a2
--- /dev/null
+++ b/electron/scripts/build-wallet-engine.mjs
@@ -0,0 +1,45 @@
+import { build } from '../../node_modules/esbuild/lib/main.js';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+const root = fileURLToPath(new URL('../../', import.meta.url));
+const outfile = path.join(root, 'electron/build/foreign-wallet-engine.cjs');
+const result = await build({
+  absWorkingDir: root,
+  entryPoints: [path.join(root, 'src/lib/foreign-wallet/desktop-engine.ts')],
+  outfile,
+  bundle: true,
+  platform: 'node',
+  format: 'cjs',
+  target: 'node22',
+  sourcemap: false,
+  legalComments: 'eof',
+  metafile: true,
+});
+// Preserve the licenses of bundled dependencies on every supported platform.
+const packages = new Set();
+for (const input of Object.keys(result.metafile.inputs)) {
+  const match = input.match(/^(.*node_modules\/(?:@[^/]+\/)?[^/]+)\//);
+  if (match) packages.add(match[1]);
+}
+const notices = [];
+for (const pkg of [...packages].sort()) {
+  const metadata = JSON.parse(
+    await fs.readFile(path.join(root, pkg, 'package.json'), 'utf8')
+  );
+  const names = await fs.readdir(path.join(root, pkg));
+  const license = names.find((name) =>
+    /^licen[sc]e(?:\.(?:md|txt))?$/i.test(name)
+  );
+  if (!license) throw new Error(`Missing dependency license: ${metadata.name}`);
+  notices.push(
+    `${metadata.name} ${metadata.version}\n${await fs.readFile(path.join(root, pkg, license), 'utf8')}`
+  );
+}
+const text = notices.join('\n\n');
+await fs.appendFile(outfile, `\n/*\n${text.replaceAll('*/', '* /')}\n*/\n`);
+await fs.mkdir(path.join(root, 'public'), { recursive: true });
+await fs.writeFile(
+  path.join(root, 'public/wallet-dependency-licenses.txt'),
+  text
+);
diff --git a/electron/scripts/linux-docker-entry.sh b/electron/scripts/linux-docker-entry.sh
index 8bc8b2005..f46068361 100755
--- a/electron/scripts/linux-docker-entry.sh
+++ b/electron/scripts/linux-docker-entry.sh
@@ -4,6 +4,36 @@ set -euo pipefail
 
 BUILD_ARCH="${QORTAL_LINUX_DOCKER_ARCH:-x64}"
 BUILD_PROFILE="${QORTAL_LINUX_DOCKER_PROFILE:-full}"
+WORKSPACE_OWNER_UID="$(stat -c %u /workspace)"
+WORKSPACE_OWNER_GID="$(stat -c %g /workspace)"
+
+restore_host_ownership() {
+  if [[ ! "${WORKSPACE_OWNER_UID}" =~ ^[0-9]+$ || ! "${WORKSPACE_OWNER_GID}" =~ ^[0-9]+$ ]]; then
+    echo "Skipping ownership restoration: workspace owner is invalid." >&2
+    return
+  fi
+
+  local generated_paths=(
+    /workspace/dist
+    /workspace/electron/build
+    /workspace/electron/dist
+    /workspace/electron/resources/__pycache__
+    /workspace/electron/resources/private-transport
+    /workspace/electron/resources/reticulum
+  )
+  local existing_paths=()
+  local generated_path
+  for generated_path in "${generated_paths[@]}"; do
+    [[ -e "${generated_path}" ]] && existing_paths+=("${generated_path}")
+  done
+  if (( ${#existing_paths[@]} > 0 )); then
+    chown -R "${WORKSPACE_OWNER_UID}:${WORKSPACE_OWNER_GID}" "${existing_paths[@]}"
+  fi
+}
+
+# The repository is a host bind mount while this container runs as root.
+# Always return generated files to the invoking user, including after failures.
+trap restore_host_ownership EXIT
 
 case "${BUILD_ARCH}:${BUILD_PROFILE}" in
   x64:full)
@@ -40,6 +70,68 @@ cd electron
 npm ci
 
 npm run build
+
+# better-sqlite3 13 ships platform prebuilds and loads them before its normal
+# build/Release output. Those upstream Linux binaries may be linked against a
+# newer glibc than this Debian 11 compatibility container. Force a real source
+# build for Electron, then replace the preferred platform prebuild with it.
+echo "Rebuilding better-sqlite3 from source for Linux ${BUILD_ARCH}…"
+npm_config_force_build=1 npx electron-rebuild \
+  --force \
+  --build-from-source \
+  --which-module better-sqlite3 \
+  --arch "${BUILD_ARCH}"
+
+BETTER_SQLITE3_BUILD="node_modules/better-sqlite3/build/Release/better_sqlite3.node"
+BETTER_SQLITE3_PREBUILD="node_modules/better-sqlite3/prebuilds/linux-${BUILD_ARCH}.node"
+
+if [[ ! -f "${BETTER_SQLITE3_BUILD}" ]]; then
+  echo "Forced better-sqlite3 build did not produce ${BETTER_SQLITE3_BUILD}" >&2
+  exit 1
+fi
+
+install -m 0644 "${BETTER_SQLITE3_BUILD}" "${BETTER_SQLITE3_PREBUILD}"
+
+verify_glibc_baseline() {
+  local binary_path="$1"
+  local artifact_label="$2"
+
+  python3 - "${binary_path}" "${artifact_label}" <<'PY'
+import re
+import subprocess
+import sys
+
+binary_path, artifact_label = sys.argv[1:]
+output = subprocess.check_output(
+    ["readelf", "--version-info", binary_path],
+    text=True,
+    stderr=subprocess.STDOUT,
+)
+versions = sorted(
+    {(int(major), int(minor)) for major, minor in re.findall(r"GLIBC_(\d+)\.(\d+)", output)}
+)
+newer = [version for version in versions if version > (2, 31)]
+display = ", ".join(f"GLIBC_{major}.{minor}" for major, minor in versions) or "none"
+print(f"{artifact_label} glibc symbols: {display}")
+if newer:
+    required = ", ".join(f"GLIBC_{major}.{minor}" for major, minor in newer)
+    raise SystemExit(
+        f"{artifact_label} exceeds the Debian 11 glibc 2.31 baseline: {required}"
+    )
+PY
+}
+
+verify_glibc_baseline "${BETTER_SQLITE3_PREBUILD}" "Rebuilt better-sqlite3"
+
+# Exercise the same prebuild path that better-sqlite3 selects at runtime.
+node - <<'NODE'
+const Database = require('better-sqlite3');
+const database = new Database(':memory:');
+const result = database.prepare('SELECT 1 AS ok').get();
+database.close();
+if (result?.ok !== 1) throw new Error('better-sqlite3 smoke test failed');
+NODE
+
 npm run bundle:reticulum
 
 # Snap/rpm are painful inside Docker; AppImage + deb cover most sharing.
@@ -52,4 +144,20 @@ npx electron-builder build \
   --publish=never \
   "${BUILDER_TARGETS[@]}"
 
+case "${BUILD_ARCH}" in
+  x64)
+    UNPACKED_DIR="dist/linux-unpacked"
+    ;;
+  arm64)
+    UNPACKED_DIR="dist/linux-arm64-unpacked"
+    ;;
+esac
+
+PACKAGED_BETTER_SQLITE3="${UNPACKED_DIR}/resources/app.asar.unpacked/${BETTER_SQLITE3_PREBUILD}"
+if [[ ! -f "${PACKAGED_BETTER_SQLITE3}" ]]; then
+  echo "Packaged better-sqlite3 binary was not found at ${PACKAGED_BETTER_SQLITE3}" >&2
+  exit 1
+fi
+verify_glibc_baseline "${PACKAGED_BETTER_SQLITE3}" "Packaged better-sqlite3"
+
 echo "Artifacts: electron/dist/ (installers + latest-linux.yml + *.blockmap for auto-update)"
diff --git a/electron/scripts/qapp-guest-smoke.cjs b/electron/scripts/qapp-guest-smoke.cjs
new file mode 100644
index 000000000..68216dc31
--- /dev/null
+++ b/electron/scripts/qapp-guest-smoke.cjs
@@ -0,0 +1,199 @@
+const { app, BrowserWindow, ipcMain, session } = require('electron');
+const { join } = require('path');
+const { pathToFileURL } = require('url');
+const http = require('http');
+const { restrictQAppGuestWebRtc } = require('../build/src/qapp-guest-network-policy.js');
+
+const preload = join(__dirname, '..', 'build', 'src', 'qapp-guest-preload.js');
+const preloadUrl = `${pathToFileURL(preload)}?authorization=smoke`;
+const partitionOne = `qapp-smoke-one-${process.pid}`;
+const partitionTwo = `qapp-smoke-two-${process.pid}`;
+
+app.whenReady().then(async () => {
+  const server = http.createServer((req, res) => {
+    res.setHeader('Content-Type', 'text/html');
+    if (process.env.QAPP_HEADER_POLICY_PROBE === '1' && req.url?.endsWith('/two'))
+      res.setHeader('Connection-Allowlist', '(response-origin);webrtc=block');
+    res.end(req.url?.endsWith('/one')
+      ? `<body>QApp<script>
+          // Probe before DOM-ready: the guest policy must already be active.
+          const earlyPc = new RTCPeerConnection({ iceServers: [] });
+          earlyPc.createDataChannel('early-probe');
+          let earlyCandidates = 0;
+          earlyPc.onicecandidate = (event) => { if (event.candidate) earlyCandidates++; };
+          earlyPc.createOffer().then((offer) => earlyPc.setLocalDescription(offer));
+          setTimeout(() => {
+            document.body.dataset.earlyCandidates = String(earlyCandidates);
+            earlyPc.close();
+          }, 1000);
+        </script><script type="module">
+          await new Promise((resolve) => {
+            const channel = new MessageChannel();
+            channel.port1.onmessage = (event) => {
+              document.body.dataset.earlyReply = JSON.stringify(event.data);
+              resolve();
+            };
+            window.parent.postMessage({ requestedHandler: 'UI', action: 'EARLY_REQUEST' }, '*', [channel.port2]);
+          });
+        </script></body>`
+      : req.url?.endsWith('/iframe-probe')
+        ? `<script>
+            const pc = new RTCPeerConnection({ iceServers: [] });
+            const candidates = [];
+            pc.onicecandidate = (event) => { if (event.candidate) candidates.push(event.candidate.candidate); };
+            pc.createDataChannel('probe');
+            pc.createOffer().then((offer) => pc.setLocalDescription(offer));
+            setTimeout(() => { parent.postMessage({ iframeCandidateCount: candidates.length }, '*'); pc.close(); }, 1200);
+          </script>`
+        : '<body>QApp</body>');
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const appOrigin = `http://127.0.0.1:${server.address().port}`;
+  const win = new BrowserWindow({
+    show: false,
+    webPreferences: { nodeIntegration: true, contextIsolation: false, webviewTag: true },
+  });
+  const attachedPartitions = new Map();
+  const pendingPartitions = [];
+  ipcMain.handle('qappGuest:hello', (event, token) => {
+    if (event.sender.getType() !== 'webview' ||
+        attachedPartitions.get(event.sender.id) !== token)
+      throw new Error('Guest identity mismatch');
+    return true;
+  });
+  let sent = false;
+  win.webContents.on('will-attach-webview', (_event, prefs, params) => {
+    pendingPartitions.push(params.partition);
+    prefs.preload = preload;
+    prefs.nodeIntegration = false;
+    prefs.contextIsolation = true;
+    prefs.sandbox = true;
+    prefs.additionalArguments = [`--qapp-guest-token=${params.partition}`];
+  });
+  win.webContents.on('did-attach-webview', (_event, guest) => {
+    attachedPartitions.set(guest.id, pendingPartitions.shift());
+    if (attachedPartitions.get(guest.id) === partitionOne)
+      restrictQAppGuestWebRtc(guest);
+    guest.on('preload-error', (_event, _path, error) => { throw error; });
+    guest.on('dom-ready', async () => {
+      if (sent || !guest.getURL().endsWith('/render/APP/one')) return;
+      sent = true;
+      await guest.executeJavaScript("window.addEventListener('message', event => { if (event.data?.action === 'PERFORMING_NON_MANUAL') document.body.dataset.navigationMarker = String(event.data.requestedHandler); })");
+      guest.send('qapp:event', { action: 'MOQ_OBJECT', payload: new Uint8Array([1, 2, 3]) });
+      guest.send('qapp:event', { action: 'PERFORMING_NON_MANUAL', currentIndex: 0 });
+      guest.executeJavaScript(`(() => { const channel = new MessageChannel(); channel.port1.onmessage = e => { document.body.dataset.reply = JSON.stringify(e.data); }; window.parent.postMessage({requestedHandler:'UI',action:'WHICH_UI'},'*',[channel.port2]); })()`);
+      guest.executeJavaScript("window.parent.postMessage({action:'NAVIGATION_SUCCESS',path:'/previous'},'*')");
+    });
+  });
+  const hostHtml = `<webview id="guest" style="display:flex;width:400px;height:300px" partition="${partitionOne}" preload="${preloadUrl}"></webview>
+    <webview id="guest2" style="display:flex;width:400px;height:300px" partition="${partitionTwo}" preload="${preloadUrl}"></webview>
+    <script>document.getElementById('guest').addEventListener('ipc-message', e => {
+      if (e.channel === 'qapp:hello') {
+        document.getElementById('guest').send('qapp:ready', e.args[0].documentId);
+        return;
+      }
+      document.body.dataset.count = String(Number(document.body.dataset.count || 0) + 1);
+      if (e.channel === 'qapp:request' && e.args[0].data?.action === 'NAVIGATION_SUCCESS')
+        document.body.dataset.navigationSuccess = e.args[0].data.path;
+      if(e.channel==='qapp:request') document.getElementById('guest').send('qapp:response', {documentId:e.args[0].documentId,requestId:e.args[0].requestId,result:{result:'success',error:null}});
+    }); document.getElementById('guest').setAttribute('src','${appOrigin}/render/APP/one');
+    document.getElementById('guest2').setAttribute('src','${appOrigin}/render/APP/two');</script>`;
+  await win.loadURL(`data:text/html,${encodeURIComponent(hostHtml)}`);
+  await new Promise((resolve) => setTimeout(resolve, 1500));
+  const webview = win.webContents;
+  const state = await webview.executeJavaScript(`(() => { const guest = document.getElementById('guest'); return {id:guest?.getWebContentsId?.(),id2:document.getElementById('guest2')?.getWebContentsId?.(),hostHeight:guest?.getBoundingClientRect().height,requestCount:document.body.dataset.count,navigationSuccess:document.body.dataset.navigationSuccess}; })()`);
+  const guest = require('electron').webContents.fromId(state.id);
+  state.guestHeight = await guest.executeJavaScript('window.innerHeight');
+  state.guestReply = await guest.executeJavaScript('document.body.dataset.reply');
+  state.earlyReply = await guest.executeJavaScript('document.body.dataset.earlyReply');
+  state.navigationMarker = await guest.executeJavaScript('document.body.dataset.navigationMarker');
+  state.earlyCandidates = await guest.executeJavaScript('document.body.dataset.earlyCandidates');
+  const guest2 = require('electron').webContents.fromId(state.id2);
+  await guest.executeJavaScript("localStorage.setItem('qapp-secret','one-only')");
+  state.isolation = await guest2.executeJavaScript("({sameOrigin:location.origin, otherSecret:localStorage.getItem('qapp-secret'), topIsSelf:top===window, frameCount:top.frames.length, opener:window.opener, innerHeight:window.innerHeight})");
+  const gather = `new Promise(async resolve => { const pc = new RTCPeerConnection({iceServers:[]}); const candidates=[]; pc.onicecandidate=e => { if(e.candidate) candidates.push(e.candidate.candidate) }; pc.createDataChannel('probe'); await pc.setLocalDescription(await pc.createOffer()); setTimeout(() => { pc.close(); resolve(candidates); }, 1200); })`;
+  const [blockedCandidates, controlCandidates] = await Promise.all([
+    guest.executeJavaScript(gather), guest2.executeJavaScript(gather),
+  ]);
+  if (guest.getWebRTCIPHandlingPolicy() !== 'disable_non_proxied_udp' ||
+      state.earlyCandidates !== '0' ||
+      blockedCandidates.length !== 0 || controlCandidates.length === 0)
+    throw new Error('Q-App guest WebRTC direct-network restriction failed');
+  process.stdout.write(
+    `WebRTC direct-candidate test: qapp early=${state.earlyCandidates}, ` +
+    `qapp=${blockedCandidates.length}, unrestricted-control=${controlCandidates.length}\n`
+  );
+  if (process.env.QAPP_HEADER_POLICY_PROBE === '1') {
+    const controlHeader = await guest2.executeJavaScript(
+      "fetch(location.href).then((response) => response.headers.get('connection-allowlist'))"
+    );
+    process.stdout.write(
+      `Header-only probe: header=${controlHeader}, direct-candidates=${controlCandidates.length}\n`
+    );
+    if (controlHeader !== '(response-origin);webrtc=block' || controlCandidates.length === 0)
+      throw new Error('Connection-Allowlist header probe did not run');
+  }
+  const iframeProbeWindow = new BrowserWindow({
+    show: false,
+    webPreferences: { contextIsolation: true, nodeIntegration: false },
+  });
+  const iframeProbeUrl = `${appOrigin}/render/APP/iframe-probe`;
+  session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
+    if (details.resourceType !== 'subFrame' || details.url !== iframeProbeUrl)
+      return callback({ responseHeaders: details.responseHeaders });
+    callback({
+      responseHeaders: {
+        ...details.responseHeaders,
+        'Connection-Allowlist': ['(response-origin);webrtc=block'],
+      },
+    });
+  });
+  await iframeProbeWindow.loadURL(`data:text/html,${encodeURIComponent(`
+    <script>
+      addEventListener('message', (event) => document.body.dataset.candidates = String(event.data?.iframeCandidateCount));
+    </script><iframe src="${iframeProbeUrl}"></iframe>
+  `)}`);
+  await new Promise((resolve) => setTimeout(resolve, 1500));
+  const oldIframeCandidates = await iframeProbeWindow.webContents.executeJavaScript(
+    'document.body.dataset.candidates'
+  );
+  iframeProbeWindow.destroy();
+  process.stdout.write(`Old iframe header-path test: direct-candidates=${oldIframeCandidates}\n`);
+  if (Number(oldIframeCandidates) === 0)
+    throw new Error('Old iframe WebRTC header unexpectedly blocked direct candidates');
+  if (state.requestCount !== '3' ||
+      state.navigationSuccess !== '/previous' ||
+      state.navigationMarker !== 'undefined' ||
+      state.guestHeight !== state.hostHeight ||
+      state.isolation.innerHeight !== state.hostHeight ||
+      JSON.parse(state.guestReply).result !== 'success' ||
+      JSON.parse(state.earlyReply).result !== 'success' ||
+      state.isolation.otherSecret !== null ||
+      state.isolation.topIsSelf !== true ||
+      state.isolation.frameCount !== 0 ||
+      state.isolation.opener !== null) {
+    throw new Error('Q-App guest bridge or isolation smoke test failed');
+  }
+  const nested = await webview.executeJavaScript(`(() => {
+    const wrapper = document.createElement('iframe');
+    document.body.appendChild(wrapper);
+    const guest = wrapper.contentDocument.createElement('webview');
+    guest.setAttribute('partition', '${partitionOne}');
+    guest.setAttribute('preload', '${preloadUrl}');
+    guest.setAttribute('src', 'data:text/html,%3Cbody%3ENested%3C/body%3E');
+    guest.style.cssText = 'width:100px;height:100px';
+    wrapper.contentDocument.body.appendChild(guest);
+    return Boolean(guest);
+  })()`);
+  await new Promise((resolve) => setTimeout(resolve, 500));
+  const viewCount = require('electron').webContents.getAllWebContents().filter(w=>w.getType()==='webview').length;
+  if (viewCount !== 2) throw new Error('A nested guest unexpectedly attached');
+  process.stdout.write('Q-App guest isolation, early request, layout, and direct WebRTC policy smoke test passed\n');
+  win.destroy();
+  server.close();
+  app.quit();
+}).catch((error) => {
+  process.stderr.write(`${error.stack || error}\n`);
+  app.exit(1);
+});
+setTimeout(() => app.exit(1), 8000).unref();
diff --git a/electron/scripts/run-electron-package.mjs b/electron/scripts/run-electron-package.mjs
index 8661ff2d6..8fb817f87 100644
--- a/electron/scripts/run-electron-package.mjs
+++ b/electron/scripts/run-electron-package.mjs
@@ -180,6 +180,14 @@ const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 
 run(npmCmd, ['run', 'build']);
 if (cfg.universal) {
+  runWithEnv(npmCmd, ['run', 'build:private-transport'], {
+    QORTAL_PRIVATE_TRANSPORT_GOOS: 'darwin',
+    QORTAL_PRIVATE_TRANSPORT_GOARCH: 'arm64',
+  });
+  runWithEnv(npmCmd, ['run', 'build:private-transport'], {
+    QORTAL_PRIVATE_TRANSPORT_GOOS: 'darwin',
+    QORTAL_PRIVATE_TRANSPORT_GOARCH: 'amd64',
+  });
   runWithEnv(npmCmd, ['run', 'bundle:reticulum'], {
     QORTAL_RETICULUM_OUTPUT_DIR: 'resources/reticulum/darwin-arm64',
   });
@@ -188,6 +196,7 @@ if (cfg.universal) {
     QORTAL_RETICULUM_OUTPUT_DIR: 'resources/reticulum/darwin-x64',
   });
 } else {
+  run(npmCmd, ['run', 'build:private-transport']);
   run(npmCmd, ['run', 'bundle:reticulum']);
 }
 
diff --git a/electron/setup.js b/electron/setup.js
index 3650f7e44..f60ecdfa6 100644
--- a/electron/setup.js
+++ b/electron/setup.js
@@ -154,7 +154,6 @@ const defaultDomains = [
     'https://apinode2.qortalnodes.live',
     'https://apinode3.qortalnodes.live',
     'https://apinode4.qortalnodes.live',
-    'https://www.qort.trade',
 ];
 // let allowedDomains: string[] = [...defaultDomains]
 const domainHolder = {
diff --git a/electron/src/display-media-picker.test.ts b/electron/src/display-media-picker.test.ts
new file mode 100644
index 000000000..9442e1e96
--- /dev/null
+++ b/electron/src/display-media-picker.test.ts
@@ -0,0 +1,173 @@
+import { afterEach, expect, it, vi } from 'vitest';
+import { EventEmitter } from 'events';
+import { desktopCapturer, ipcMain, systemPreferences } from 'electron';
+import { installDisplayMediaPicker } from './display-media-picker';
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.useRealTimers();
+});
+function fixture(
+  platform: NodeJS.Platform = 'linux',
+  guest = false,
+  authorized = true
+) {
+  const bus = new EventEmitter();
+  vi.spyOn(ipcMain, 'on').mockImplementation(((...args: any[]) =>
+    bus.on(args[0], args[1])) as any);
+  vi.spyOn(ipcMain, 'removeListener').mockImplementation(((...args: any[]) =>
+    bus.removeListener(args[0], args[1])) as any);
+  const getSources = vi.spyOn(desktopCapturer, 'getSources').mockResolvedValue([
+    {
+      id: 'screen:1',
+      name: 'Screen',
+      thumbnail: { toDataURL: () => 'data:image/png;base64,AA==' },
+    },
+  ] as any);
+  let handler: any;
+  const root = {};
+  const guestRoot = {};
+  const frame = {
+    detached: false,
+    top: guest ? guestRoot : root,
+    url: 'https://app.test',
+    executeJavaScript: vi.fn().mockResolvedValue(undefined),
+  };
+  const webContents = {
+    mainFrame: root,
+    send: vi.fn(),
+    session: {
+      setDisplayMediaRequestHandler: (fn: any) => {
+        handler = fn;
+      },
+    },
+  };
+  const window = { webContents, isDestroyed: () => false, once: vi.fn() };
+  const guestContents = {
+    mainFrame: guestRoot,
+    session: webContents.session,
+    getType: () => 'webview',
+    isDestroyed: () => false,
+    send: vi.fn(),
+  };
+  installDisplayMediaPicker(
+    window as any,
+    platform,
+    webContents.session as any,
+    () => authorized,
+    () => guestContents as any
+  );
+  const callback = vi.fn();
+  const request = {
+    frame,
+    userGesture: true,
+    videoRequested: true,
+    securityOrigin: 'https://app.test',
+  };
+  handler(request, callback);
+  const requestId = webContents.send.mock.calls[0]?.[1]?.requestId;
+  const send = (channel: string, payload: object, trusted = true) =>
+    bus.emit(
+      channel,
+      { sender: trusted ? webContents : {}, senderFrame: root },
+      { requestId, ...payload }
+    );
+  return {
+    frame,
+    callback,
+    send,
+    getSources,
+    handler,
+    request,
+    webContents,
+    guestContents,
+    bus,
+  };
+}
+
+it('reports missing macOS screen permission before denying capture', async () => {
+  vi.spyOn(systemPreferences, 'getMediaAccessStatus').mockReturnValue('denied');
+  const f = fixture('darwin');
+  f.send('display-media:authorize', { accepted: true });
+  await vi.waitFor(() => expect(f.callback).toHaveBeenCalledWith({}));
+  expect(f.getSources).not.toHaveBeenCalled();
+  expect(f.frame.executeJavaScript.mock.calls[0][0]).toContain(
+    'SCREEN_OS_PERMISSION_REQUIRED'
+  );
+});
+
+it('allows an owned guest capture and denies an unowned guest', async () => {
+  const owned = fixture('linux', true);
+  owned.send('display-media:authorize', { accepted: true });
+  await vi.waitFor(() => expect(owned.guestContents.send).toHaveBeenCalled());
+  owned.send('display-media:select', { sourceId: 'screen:1' });
+  expect(owned.callback).toHaveBeenCalledWith({
+    video: expect.objectContaining({ id: 'screen:1' }),
+  });
+
+  const unowned = fixture('linux', true, false);
+  expect(unowned.callback).toHaveBeenCalledWith({});
+  expect(unowned.webContents.send).not.toHaveBeenCalled();
+});
+
+it('does not enumerate before approval and grants only the selected one-use source', async () => {
+  const f = fixture();
+  expect(f.getSources).not.toHaveBeenCalled();
+  f.send('display-media:select', { sourceId: 'screen:1' });
+  f.send('display-media:authorize', { accepted: true }, false);
+  expect(f.callback).not.toHaveBeenCalled();
+  expect(f.getSources).not.toHaveBeenCalled();
+  f.send('display-media:authorize', { accepted: true });
+  await vi.waitFor(() => expect(f.frame.executeJavaScript).toHaveBeenCalled());
+  expect(f.frame.executeJavaScript.mock.calls[0][0]).toContain(
+    'QAPP_SCREEN_CAPTURE_SOURCES'
+  );
+  f.send('display-media:select', { sourceId: 'screen:1', requestId: 'wrong' });
+  expect(f.callback).not.toHaveBeenCalled();
+  f.send('display-media:select', { sourceId: 'screen:1' });
+  expect(f.callback).toHaveBeenCalledWith({
+    video: expect.objectContaining({ id: 'screen:1' }),
+  });
+  f.send('display-media:select', { sourceId: 'screen:1' });
+  expect(f.callback).toHaveBeenCalledTimes(1);
+  expect(f.bus.listenerCount('display-media:authorize')).toBe(0);
+  for (const [script] of f.frame.executeJavaScript.mock.calls)
+    expect(script).toContain('"requestedHandler":"UI"');
+});
+
+it('denies rejection without disclosing thumbnails', () => {
+  const f = fixture();
+  f.send('display-media:authorize', { accepted: false });
+  expect(f.callback).toHaveBeenCalledWith({});
+  expect(f.getSources).not.toHaveBeenCalled();
+});
+
+it.each(['navigation', 'detached', 'unknown-source'])(
+  'denies %s after approval',
+  async (failure) => {
+    const f = fixture();
+    f.send('display-media:authorize', { accepted: true });
+    await vi.waitFor(() =>
+      expect(f.frame.executeJavaScript).toHaveBeenCalled()
+    );
+    if (failure === 'navigation') f.frame.url = 'https://elsewhere.test';
+    if (failure === 'detached') f.frame.detached = true;
+    f.send('display-media:select', {
+      sourceId: failure === 'unknown-source' ? 'window:99' : 'screen:1',
+    });
+    expect(f.callback).toHaveBeenCalledWith({});
+  }
+);
+
+it('times out and denies concurrent requests and missing gestures', () => {
+  vi.useFakeTimers();
+  const f = fixture();
+  const second = vi.fn();
+  f.handler(f.request, second);
+  expect(second).toHaveBeenCalledWith({});
+  vi.advanceTimersByTime(60_000);
+  expect(f.callback).toHaveBeenCalledWith({});
+  const third = vi.fn();
+  f.handler({ ...f.request, userGesture: false }, third);
+  expect(third).toHaveBeenCalledWith({});
+});
diff --git a/electron/src/display-media-picker.ts b/electron/src/display-media-picker.ts
new file mode 100644
index 000000000..0230d2764
--- /dev/null
+++ b/electron/src/display-media-picker.ts
@@ -0,0 +1,180 @@
+import {
+  desktopCapturer,
+  ipcMain,
+  systemPreferences,
+  type BrowserWindow,
+  type DesktopCapturerSource,
+  type Session,
+  webContents,
+} from 'electron';
+import { randomUUID } from 'crypto';
+
+const pendingCaptureByWindow = new WeakMap<BrowserWindow, () => void>();
+
+/** Permission-controlled OS bridge. Source selection UI lives in the requesting app. */
+export function installDisplayMediaPicker(
+  window: BrowserWindow,
+  platform: NodeJS.Platform = process.platform,
+  targetSession: Session = window.webContents.session,
+  isAuthorizedGuest: (contents: Electron.WebContents) => boolean = () => false,
+  resolveContents: (
+    frame: Electron.WebFrameMain
+  ) => Electron.WebContents | undefined = (frame) =>
+    webContents.fromFrame(frame)
+): void {
+  targetSession.setDisplayMediaRequestHandler((request, callback) => {
+    const frame = request.frame;
+    const isShellFrame = frame?.top === window.webContents.mainFrame;
+    const contents =
+      frame && !isShellFrame ? resolveContents(frame) : undefined;
+    const isGuestFrame =
+      contents?.getType() === 'webview' &&
+      frame?.top === contents.mainFrame &&
+      contents.session === targetSession &&
+      isAuthorizedGuest(contents);
+    if (
+      !frame ||
+      frame.detached ||
+      !request.userGesture ||
+      !request.videoRequested ||
+      (!isShellFrame && !isGuestFrame) ||
+      window.isDestroyed()
+    ) {
+      callback({});
+      return;
+    }
+    // One chooser at a time; a new request cannot replace another app's prompt.
+    if (pendingCaptureByWindow.has(window)) {
+      callback({});
+      return;
+    }
+    const requestId = randomUUID();
+    const originalUrl = frame.url;
+    let sources: DesktopCapturerSource[] = [];
+    let settled = false;
+    let authorized = false;
+    const deliver = (payload: unknown) => {
+      const message = { ...(payload as object), requestedHandler: 'UI' };
+      if (isGuestFrame && contents && !contents.isDestroyed()) {
+        contents.send('qapp:event', message);
+        return Promise.resolve();
+      }
+      return frame
+        .executeJavaScript(
+          // Core's q-apps.js treats unmarked messages as RPC requests and
+          // tries to transfer a nonexistent reply port. These are UI events.
+          `window.dispatchEvent(new MessageEvent('message', { data: ${JSON.stringify(message)}, origin: window.location.origin, source: window }));`
+        )
+        .catch(() => undefined);
+    };
+    const finish = (sourceId?: string) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      ipcMain.removeListener('display-media:select', selected);
+      ipcMain.removeListener('display-media:authorize', authorize);
+      pendingCaptureByWindow.delete(window);
+      const source = sources.find((value) => value.id === sourceId);
+      const valid =
+        !window.isDestroyed() &&
+        !frame.detached &&
+        frame.url === originalUrl &&
+        (frame.top === window.webContents.mainFrame ||
+          (contents &&
+            frame.top === contents.mainFrame &&
+            isAuthorizedGuest(contents)));
+      callback(valid && source ? { video: source } : {});
+      if (!frame.detached)
+        void deliver({ action: 'QAPP_SCREEN_CAPTURE_CANCEL', requestId });
+      if (!window.isDestroyed())
+        window.webContents.send('display-media:cancel', requestId);
+    };
+    const selected = (
+      event: Electron.IpcMainEvent,
+      payload: { requestId?: string; sourceId?: string }
+    ) => {
+      if (
+        event.sender !== window.webContents ||
+        event.senderFrame !== window.webContents.mainFrame ||
+        payload?.requestId !== requestId
+      )
+        return;
+      if (!authorized) return;
+      finish(payload.sourceId);
+    };
+    const authorize = (
+      event: Electron.IpcMainEvent,
+      payload: { requestId?: string; accepted?: boolean }
+    ) => {
+      if (
+        event.sender !== window.webContents ||
+        event.senderFrame !== window.webContents.mainFrame ||
+        payload?.requestId !== requestId ||
+        authorized
+      )
+        return;
+      if (payload.accepted !== true) {
+        finish();
+        return;
+      }
+      authorized = true;
+      void enumerate().catch(() => finish());
+    };
+    const timer = setTimeout(() => finish(), 60_000);
+    pendingCaptureByWindow.set(window, () => finish());
+    ipcMain.on('display-media:select', selected);
+    ipcMain.on('display-media:authorize', authorize);
+    const enumerate = async () => {
+      if (platform === 'darwin') {
+        const status = systemPreferences.getMediaAccessStatus('screen');
+        if (status === 'denied' || status === 'restricted') {
+          await deliver({
+            action: 'QAPP_SCREEN_CAPTURE_ERROR',
+            requestId,
+            code: 'SCREEN_OS_PERMISSION_REQUIRED',
+          });
+          finish();
+          return;
+        }
+      }
+      return desktopCapturer
+        .getSources({
+          types: ['screen', 'window'],
+          thumbnailSize: { width: 240, height: 135 },
+        })
+        .then((available) => {
+          if (settled) return;
+          if (
+            window.isDestroyed() ||
+            frame.detached ||
+            frame.url !== originalUrl
+          ) {
+            finish();
+            return;
+          }
+          sources = available.slice(0, 60);
+          if (!sources.length) {
+            finish();
+            return;
+          }
+          return deliver({
+            action: 'QAPP_SCREEN_CAPTURE_SOURCES',
+            requestId,
+            sources: sources.map((source) => ({
+              id: source.id,
+              name: source.name.slice(0, 160),
+              thumbnail: source.thumbnail.toDataURL(),
+            })),
+          });
+        })
+        .catch(() => finish());
+    };
+    // The random, one-use request ID is disclosed only to the requesting frame
+    // after permission. Other Q-Apps cannot select a source for this request.
+    window.webContents.send('display-media:request', {
+      requestId,
+      origin: request.securityOrigin,
+    });
+  });
+  window.once('closed', () => pendingCaptureByWindow.get(window)?.());
+}
diff --git a/electron/src/embedded-frame-network-policy.test.ts b/electron/src/embedded-frame-network-policy.test.ts
new file mode 100644
index 000000000..f7cffb6af
--- /dev/null
+++ b/electron/src/embedded-frame-network-policy.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest';
+import {
+  EMBEDDED_FRAME_CONNECTION_ALLOWLIST,
+  withEmbeddedFrameWebRtcBlocked,
+} from './embedded-frame-network-policy';
+
+describe('embedded frame network policy', () => {
+  it('blocks WebRTC only on subframe document responses', () => {
+    expect(
+      withEmbeddedFrameWebRtcBlocked(
+        { Existing: ['value'] },
+        { resourceType: 'subFrame' }
+      )
+    ).toEqual({
+      Existing: ['value'],
+      'Connection-Allowlist': [EMBEDDED_FRAME_CONNECTION_ALLOWLIST],
+    });
+  });
+
+  it('does not restrict the Hub main frame', () => {
+    expect(
+      withEmbeddedFrameWebRtcBlocked(
+        { Existing: ['value'] },
+        { resourceType: 'mainFrame' }
+      )
+    ).toEqual({ Existing: ['value'] });
+  });
+
+  it('replaces a frame-provided allowlist case-insensitively', () => {
+    expect(
+      withEmbeddedFrameWebRtcBlocked(
+        { 'connection-allowlist': ['("https://example.com");webrtc=allow'] },
+        { resourceType: 'subFrame' }
+      )
+    ).toEqual({
+      'Connection-Allowlist': [EMBEDDED_FRAME_CONNECTION_ALLOWLIST],
+    });
+  });
+});
diff --git a/electron/src/embedded-frame-network-policy.ts b/electron/src/embedded-frame-network-policy.ts
new file mode 100644
index 000000000..4e4da3473
--- /dev/null
+++ b/electron/src/embedded-frame-network-policy.ts
@@ -0,0 +1,28 @@
+type HeaderRequestDetails = {
+  resourceType?: string;
+};
+
+/**
+ * Keep ordinary frame networking available while preventing embedded content
+ * from establishing WebRTC peer connections or DataChannels. The Hub document
+ * is a mainFrame and therefore does not receive this policy.
+ */
+export const EMBEDDED_FRAME_CONNECTION_ALLOWLIST =
+  '("*://*:*/*");redirects=allow;webrtc=block';
+
+export function withEmbeddedFrameWebRtcBlocked(
+  responseHeaders: Record<string, string | string[]>,
+  details?: HeaderRequestDetails
+): Record<string, string | string[]> {
+  if (details?.resourceType !== 'subFrame') {
+    return { ...responseHeaders };
+  }
+
+  const next = Object.fromEntries(
+    Object.entries(responseHeaders).filter(
+      ([name]) => name.toLowerCase() !== 'connection-allowlist'
+    )
+  );
+  next['Connection-Allowlist'] = [EMBEDDED_FRAME_CONNECTION_ALLOWLIST];
+  return next;
+}
diff --git a/electron/src/foreign-wallet-journal.test.ts b/electron/src/foreign-wallet-journal.test.ts
new file mode 100644
index 000000000..20dfdcb3c
--- /dev/null
+++ b/electron/src/foreign-wallet-journal.test.ts
@@ -0,0 +1,52 @@
+import { afterEach, expect, it } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { createForeignWalletJournal } from './foreign-wallet-journal';
+const directories: string[] = [];
+afterEach(async () => {
+  await Promise.all(
+    directories
+      .splice(0)
+      .map((dir) => fs.rm(dir, { recursive: true, force: true }))
+  );
+});
+it('persists reservations across restarts and refuses concurrent reservations', async () => {
+  const directory = await fs.mkdtemp(
+    path.join(os.tmpdir(), 'foreign-wallet-test-')
+  );
+  directories.push(directory);
+  const key = `foreign-send-v1:LTC:${'a'.repeat(64)}`;
+  const raw = JSON.stringify({
+    txId: 'b'.repeat(64),
+    outpoints: [`${'c'.repeat(64)}:0`],
+  });
+  const first = createForeignWalletJournal(directory);
+  const second = createForeignWalletJournal(directory);
+  const results = await Promise.allSettled([
+    first.set(key, raw),
+    second.set(key, raw),
+  ]);
+  expect(
+    results.filter((result) => result.status === 'fulfilled')
+  ).toHaveLength(1);
+  expect(await createForeignWalletJournal(directory).get(key)).toBe(raw);
+  await expect(first.delete(key, 'd'.repeat(64))).rejects.toThrow();
+  await first.delete(key, 'b'.repeat(64));
+  expect(await second.get(key)).toBeNull();
+});
+it('refuses corrupt journals and path traversal instead of reporting no pending send', async () => {
+  const directory = await fs.mkdtemp(
+    path.join(os.tmpdir(), 'foreign-wallet-test-')
+  );
+  directories.push(directory);
+  const key = `foreign-send-v1:BTC:${'a'.repeat(64)}`;
+  const journal = createForeignWalletJournal(directory);
+  await fs.writeFile(
+    path.join(directory, key.replace(/:/g, '-') + '.json'),
+    '{'
+  );
+  await expect(journal.get(key)).rejects.toThrow();
+  await expect(journal.get('../wallet')).rejects.toThrow();
+  await expect(journal.set(key, '{}')).rejects.toThrow();
+});
diff --git a/electron/src/foreign-wallet-journal.ts b/electron/src/foreign-wallet-journal.ts
new file mode 100644
index 000000000..7c2054c09
--- /dev/null
+++ b/electron/src/foreign-wallet-journal.ts
@@ -0,0 +1,98 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+/** Immutable per-wallet reservations. Corruption and disk errors fail closed. */
+export function createForeignWalletJournal(directory: string) {
+  const fileFor = (key: string) => {
+    if (
+      typeof key !== 'string' ||
+      !/^foreign-send-v1:(BTC|LTC|DOGE|DGB|RVN):[a-f0-9]{64}$/.test(key)
+    )
+      throw new Error('Invalid journal key');
+    return path.join(directory, key.replace(/:/g, '-') + '.json');
+  };
+  const validate = (raw: string) => {
+    if (typeof raw !== 'string' || raw.length > 500000)
+      throw new Error('Invalid journal');
+    const entry = JSON.parse(raw);
+    if (
+      !entry ||
+      !/^[a-f0-9]{64}$/.test(entry.txId) ||
+      !Array.isArray(entry.outpoints) ||
+      entry.outpoints.length < 1 ||
+      entry.outpoints.length > 1000 ||
+      (entry.rawTransactionHex !== undefined &&
+        (typeof entry.rawTransactionHex !== 'string' ||
+          entry.rawTransactionHex.length > 400000 ||
+          !/^(?:[a-f0-9]{2})+$/.test(entry.rawTransactionHex))) ||
+      (entry.broadcastBefore !== undefined &&
+        (!Number.isSafeInteger(entry.broadcastBefore) ||
+          entry.broadcastBefore <= 0)) ||
+      entry.outpoints.some(
+        (point: unknown) =>
+          typeof point !== 'string' || !/^[a-f0-9]{64}:[0-9]{1,10}$/.test(point)
+      )
+    )
+      throw new Error('Invalid journal');
+    return raw;
+  };
+  const read = async (key: string): Promise<string | null> => {
+    try {
+      return validate(await fs.readFile(fileFor(key), 'utf8'));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+      throw error;
+    }
+  };
+  const syncDirectory = async () => {
+    // Windows does not support opening directories for fsync via Node.
+    if (process.platform === 'win32') return;
+    const handle = await fs.open(directory, 'r');
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+  };
+  const mutate = async <T>(
+    key: string,
+    operation: () => Promise<T>
+  ): Promise<T> => {
+    await fs.mkdir(directory, { recursive: true });
+    const lock = fileFor(key) + '.lock';
+    await fs.mkdir(lock);
+    try {
+      return await operation();
+    } finally {
+      await fs.rmdir(lock);
+    }
+  };
+  return {
+    get: read,
+    set: (key: string, raw: string) =>
+      mutate(key, async () => {
+        const filename = fileFor(key);
+        validate(raw);
+        await fs.mkdir(directory, { recursive: true });
+        // O_EXCL also arbitrates independent Electron instances. A partially written
+        // reservation is deliberately retained on failure and blocks further sends.
+        const handle = await fs.open(filename, 'wx', 0o600);
+        try {
+          await handle.writeFile(raw, 'utf8');
+          await handle.sync();
+        } finally {
+          await handle.close();
+        }
+        await syncDirectory();
+      }),
+    delete: (key: string, expectedTxId: string) =>
+      mutate(key, async () => {
+        const current = await read(key);
+        if (!current || JSON.parse(current).txId !== expectedTxId)
+          throw new Error('Journal changed before reconciliation');
+        // Only the host's reconciliation path calls this after observing the spend.
+        await fs.unlink(fileFor(key));
+        await syncDirectory();
+      }),
+  };
+}
diff --git a/electron/src/foreign-wallet-signer.ts b/electron/src/foreign-wallet-signer.ts
new file mode 100644
index 000000000..37bc5e157
--- /dev/null
+++ b/electron/src/foreign-wallet-signer.ts
@@ -0,0 +1,36 @@
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+// The bundle is produced from the same implementation used by browser/Android,
+// with its dependencies included; Electron never resolves renderer node_modules.
+let engine: any;
+let signer: any;
+function getEngine() {
+  return (engine ??= createRequire(__filename)(
+    path.join(__dirname, '..', 'foreign-wallet-engine.cjs')
+  ));
+}
+function getSigner() {
+  return (signer ??= getEngine().createDesktopWalletSigner());
+}
+export const clearForeignWalletSigner = () => signer?.clear();
+export const importForeignWalletKeys = (keys: Record<string, unknown>) =>
+  getSigner().importKeys(keys);
+export const foreignWalletPublicKey = (coin: string) =>
+  getSigner().publicKey(coin);
+export async function signForeignWalletPayment(request: unknown) {
+  try {
+    // Hub has already obtained permission and revalidated the approved payment.
+    // Keep the signer's validation/session checks without a second desktop prompt.
+    const signed = await getSigner().sign(request, async () => true);
+    return { signed };
+  } catch (error) {
+    // Never forward native errors or key material to renderer error reporting.
+    const code = (error as { code?: string })?.code;
+    return {
+      error: ['invalid', 'changed', 'declined', 'pending'].includes(code)
+        ? code
+        : 'invalid',
+    };
+  }
+}
diff --git a/electron/src/index.ts b/electron/src/index.ts
index 941a8c1c9..f27566738 100644
--- a/electron/src/index.ts
+++ b/electron/src/index.ts
@@ -47,6 +47,7 @@ import {
   setLastP2POptions,
   startDecentralizedStunAfterP2P,
 } from './setup';
+import { shutdownPrivateTransportSidecar } from './private-transport-runtime';
 import {
   startP2PNetwork,
   DEFAULT_P2P_PORT,
@@ -118,6 +119,20 @@ app.commandLine.appendSwitch(
   'BlockInsecurePrivateNetworkRequests'
 );
 
+// Chromium exposes AudioContext.setSinkId but gates the delegable permission
+// behind SpeakerSelection. Without it, cross-origin Q-Apps cannot select an
+// output even with allow="speaker-selection". Enable only this API feature;
+// normal frame policy and device permissions still apply.
+app.commandLine.appendSwitch(
+  'enable-blink-features',
+  Array.from(
+    new Set([
+      ...app.commandLine.getSwitchValue('enable-blink-features').split(',').filter(Boolean),
+      'SpeakerSelection',
+    ])
+  ).join(',')
+);
+
 // app.commandLine.appendSwitch('ignore-certificate-errors');
 
 // Graceful handling of unhandled errors. Route electron-unhandled logging
@@ -290,6 +305,11 @@ function performAppShutdown(reason: string): Promise<void> {
     } catch (error) {
       loggerError('[Reticulum] Manager shutdown failed:', error);
     }
+    try {
+      await shutdownPrivateTransportSidecar();
+    } catch (error) {
+      loggerError('[PrivateTransport] Sidecar shutdown failed:', error);
+    }
     try {
       // Do not let Electron disappear after merely sending SIGTERM. Waiting
       // here gives the bridge a bounded graceful exit and stopAndWait applies
diff --git a/electron/src/masque-relay-discovery.test.ts b/electron/src/masque-relay-discovery.test.ts
new file mode 100644
index 000000000..1ff961f77
--- /dev/null
+++ b/electron/src/masque-relay-discovery.test.ts
@@ -0,0 +1,111 @@
+import { EventEmitter } from 'events';
+import { describe, expect, it, vi } from 'vitest';
+import {
+  discoverCommunityMasqueRelay,
+  validateCommunityMasqueRelay,
+} from './masque-relay-discovery';
+
+class BridgeStub extends EventEmitter {
+  getCommunityMasqueRelays = vi.fn(async (_announce = false) => []);
+}
+
+const relay = {
+  host: '8.8.8.8',
+  port: 47322,
+  serverName: 'relay.example',
+  certSha256: 'ab'.repeat(32),
+  expiresAt: 1_500_000,
+};
+
+describe('community MASQUE relay discovery', () => {
+  it('validates v3 service identities and ticket key commitments', () => {
+    const value={...relay,protocolVersion:3,relayIdentity:'cd'.repeat(32),ticketIdentity:'ef'.repeat(32)+'cd'.repeat(32),ticketKeyId:'12'.repeat(32),accessMode:'groups',allowedGroupIds:[1144]};
+    expect(validateCommunityMasqueRelay(value,{now:()=>1_000_000})).toEqual(value);
+    for(const invalid of [{...value,ticketKeyId:'bad'},{...value,ticketIdentity:'ab'.repeat(64)},{...value,allowedGroupIds:[]}])expect(validateCommunityMasqueRelay(invalid,{now:()=>1_000_000})).toBeNull();
+  });
+  it('validates a pinned literal endpoint with a bounded lease', () => {
+    expect(
+      validateCommunityMasqueRelay(relay, { now: () => 1_000_000 })
+    ).toEqual(relay);
+  });
+
+  it('rejects DNS endpoints, bad pins, and loopback by default', () => {
+    const options = { now: () => 1_000_000 };
+    expect(
+      validateCommunityMasqueRelay({ ...relay, host: 'relay.example' }, options)
+    ).toBeNull();
+    expect(
+      validateCommunityMasqueRelay({ ...relay, certSha256: 'bad' }, options)
+    ).toBeNull();
+    expect(
+      validateCommunityMasqueRelay({ ...relay, host: '127.0.0.1' }, options)
+    ).toBeNull();
+  });
+
+  it('uses a cached relay without waiting', async () => {
+    const bridge = new BridgeStub();
+    bridge.getCommunityMasqueRelays.mockResolvedValueOnce([relay]);
+    await expect(
+      discoverCommunityMasqueRelay(bridge as never, {
+        now: () => 1_000_000,
+        random: () => 0,
+      })
+    ).resolves.toEqual({
+      relayAddress: '8.8.8.8:47322',
+      relayServerName: 'relay.example',
+      relayCertSha256: 'ab'.repeat(32),
+      localFallbackAddress: '127.0.0.1:47322',
+    });
+  });
+
+  it('accepts a query response event', async () => {
+    const bridge = new BridgeStub();
+    const pending = discoverCommunityMasqueRelay(bridge as never, {
+      now: () => 1_000_000,
+      timeoutMs: 500,
+    });
+    await new Promise((resolve) => setImmediate(resolve));
+    bridge.emit('community-masque-relay', relay);
+    await expect(pending).resolves.toMatchObject({
+      relayAddress: '8.8.8.8:47322',
+    });
+  });
+
+  it('excludes a failed endpoint when selecting a replacement relay', async () => {
+    const bridge = new BridgeStub();
+    bridge.getCommunityMasqueRelays.mockResolvedValueOnce([
+      relay,
+      { ...relay, host: '1.1.1.1', certSha256: 'cd'.repeat(32) },
+    ]);
+    await expect(
+      discoverCommunityMasqueRelay(bridge as never, {
+        now: () => 1_000_000,
+        random: () => 0,
+        excludeRelayAddresses: new Set(['8.8.8.8:47322']),
+      })
+    ).resolves.toMatchObject({ relayAddress: '1.1.1.1:47322' });
+  });
+
+  it('uses one fresh query and only polls the cache while waiting', async () => {
+    const bridge = new BridgeStub();
+    await expect(
+      discoverCommunityMasqueRelay(bridge as never, {
+        now: () => 1_000_000,
+        timeoutMs: 100,
+      })
+    ).rejects.toThrow('MASQUE_RELAY_UNAVAILABLE');
+    expect(bridge.getCommunityMasqueRelays).toHaveBeenCalledTimes(3);
+    expect(bridge.getCommunityMasqueRelays).toHaveBeenNthCalledWith(1, false);
+    expect(bridge.getCommunityMasqueRelays).toHaveBeenNthCalledWith(2, true);
+    expect(bridge.getCommunityMasqueRelays).toHaveBeenNthCalledWith(3, false);
+  });
+
+  it('allows loopback only for an explicit development override', () => {
+    expect(
+      validateCommunityMasqueRelay(
+        { ...relay, host: '127.0.0.1' },
+        { now: () => 1_000_000, allowLoopback: true }
+      )
+    ).not.toBeNull();
+  });
+});
diff --git a/electron/src/masque-relay-discovery.ts b/electron/src/masque-relay-discovery.ts
new file mode 100644
index 000000000..e838f4054
--- /dev/null
+++ b/electron/src/masque-relay-discovery.ts
@@ -0,0 +1,210 @@
+import net from 'net';
+import type { ReticulumBridge } from './reticulum-bridge';
+import type { TrustedRelayConfig } from './quic-masque-transport';
+
+export const MASQUE_RELAY_DISCOVERY_TIMEOUT_MS = 15_000;
+const MASQUE_RELAY_QUERY_INTERVAL_MS = 3_000;
+const MAX_LEASE_AHEAD_MS = 60 * 60_000;
+const MIN_REMAINING_LEASE_MS = 5_000;
+
+export type CommunityMasqueRelay = {
+  protocolVersion?: number;
+  relayIdentity?: string;
+  ticketIdentity?: string;
+  ticketKeyId?: string;
+  accessMode?: 'public' | 'groups';
+  allowedGroupIds?: number[];
+  host: string;
+  port: number;
+  serverName: string;
+  certSha256: string;
+  expiresAt: number;
+};
+
+export type MasqueRelayDiscoveryOptions = {
+  timeoutMs?: number;
+  allowLoopback?: boolean;
+  /** Relay endpoints already known to have failed for this logical session. */
+  excludeRelayAddresses?: ReadonlySet<string>;
+  now?: () => number;
+  random?: () => number;
+};
+
+export function validateCommunityMasqueRelay(
+  value: unknown,
+  options: MasqueRelayDiscoveryOptions = {}
+): CommunityMasqueRelay | null {
+  if (!value || typeof value !== 'object') return null;
+  const candidate = value as Partial<CommunityMasqueRelay>;
+  const host = String(candidate.host ?? '').trim();
+  const port = Number(candidate.port);
+  const serverName = String(candidate.serverName ?? '').trim();
+  const certSha256 = String(candidate.certSha256 ?? '')
+    .trim()
+    .toLowerCase();
+  const expiresAt = Number(candidate.expiresAt);
+  const now = (options.now ?? Date.now)();
+  const ipFamily = net.isIP(host);
+  const loopback = host === '127.0.0.1' || host === '::1';
+  if (
+    ipFamily === 0 ||
+    (!isPublicRelayHost(host) &&
+      !(loopback && options.allowLoopback === true)) ||
+    !Number.isInteger(port) ||
+    port < 1 ||
+    port > 65535 ||
+    !/^[a-zA-Z0-9.-]{1,128}$/.test(serverName) ||
+    !/^[a-f0-9]{64}$/.test(certSha256) ||
+    !Number.isFinite(expiresAt) ||
+    expiresAt < now + MIN_REMAINING_LEASE_MS ||
+    expiresAt > now + MAX_LEASE_AHEAD_MS
+  ) {
+    return null;
+  }
+  if (candidate.protocolVersion === 2 || candidate.protocolVersion === 3) {
+    if (
+      candidate.protocolVersion === 3 &&
+      (!/^[a-f0-9]{128}$/.test(candidate.ticketIdentity ?? '') ||
+        !/^[a-f0-9]{64}$/.test(candidate.ticketKeyId ?? '') ||
+        candidate.ticketIdentity?.slice(64) !== candidate.relayIdentity)
+    )
+      return null;
+    if (
+      !/^[a-f0-9]{64}$/.test(candidate.relayIdentity ?? '') ||
+      !['public', 'groups'].includes(candidate.accessMode ?? '') ||
+      !Array.isArray(candidate.allowedGroupIds) ||
+      candidate.allowedGroupIds.length > 16 ||
+      candidate.allowedGroupIds.some(
+        (id) => !Number.isInteger(id) || id <= 0 || id > 2147483647
+      ) ||
+      new Set(candidate.allowedGroupIds).size !==
+        candidate.allowedGroupIds.length ||
+      (candidate.accessMode === 'groups') !==
+        candidate.allowedGroupIds.length > 0
+    )
+      return null;
+    return {
+      host,
+      port,
+      serverName,
+      certSha256,
+      expiresAt,
+      protocolVersion: candidate.protocolVersion,
+      ticketIdentity: candidate.ticketIdentity,
+      ticketKeyId: candidate.ticketKeyId,
+      relayIdentity: candidate.relayIdentity,
+      accessMode: candidate.accessMode,
+      allowedGroupIds: candidate.allowedGroupIds,
+    };
+  }
+  if (
+    candidate.protocolVersion !== undefined &&
+    candidate.protocolVersion !== 1
+  )
+    return null;
+  return { host, port, serverName, certSha256, expiresAt };
+}
+
+function isPublicRelayHost(host: string): boolean {
+  if (net.isIP(host) === 4) {
+    const [a, b, c] = host.split('.').map(Number);
+    if (a === 0 || a === 10 || a === 127 || a >= 224) return false;
+    if (a === 100 && b >= 64 && b <= 127) return false;
+    if (a === 169 && b === 254) return false;
+    if (a === 172 && b >= 16 && b <= 31) return false;
+    if (a === 192 && b === 168) return false;
+    if (a === 192 && b === 0 && (c === 0 || c === 2)) return false;
+    if (a === 198 && (b === 18 || b === 19)) return false;
+    if (a === 198 && b === 51 && c === 100) return false;
+    if (a === 203 && b === 0 && c === 113) return false;
+    return true;
+  }
+  if (net.isIP(host) !== 6) return false;
+  const normalized = host.toLowerCase();
+  return !(
+    normalized === '::' ||
+    normalized === '::1' ||
+    normalized.startsWith('fc') ||
+    normalized.startsWith('fd') ||
+    /^fe[89ab]/.test(normalized) ||
+    normalized.startsWith('ff') ||
+    normalized === '2001:db8::' ||
+    normalized.startsWith('2001:db8:') ||
+    normalized.startsWith('::ffff:')
+  );
+}
+
+export async function discoverCommunityMasqueRelay(
+  bridge: ReticulumBridge,
+  options: MasqueRelayDiscoveryOptions = {}
+): Promise<TrustedRelayConfig> {
+  const candidates = new Map<string, CommunityMasqueRelay>();
+  let wake: (() => void) | null = null;
+  const accept = (value: unknown) => {
+    const relay = validateCommunityMasqueRelay(value, options);
+    if (!relay) return;
+    const host = net.isIP(relay.host) === 6 ? `[${relay.host}]` : relay.host;
+    if (options.excludeRelayAddresses?.has(`${host}:${relay.port}`)) return;
+    candidates.set(`${relay.host}:${relay.port}:${relay.certSha256}`, relay);
+    wake?.();
+  };
+  const onRelay = (value: unknown) => accept(value);
+  bridge.on('community-masque-relay', onRelay);
+  try {
+    const timeoutMs = Math.max(
+      100,
+      options.timeoutMs ?? MASQUE_RELAY_DISCOVERY_TIMEOUT_MS
+    );
+    const deadline = Date.now() + timeoutMs;
+    let queryAnnounced = false;
+    while (candidates.size === 0) {
+      const cached = await bridge.getCommunityMasqueRelays(false);
+      for (const relay of cached) accept(relay);
+      if (candidates.size > 0) break;
+      if (!queryAnnounced) {
+        queryAnnounced = true;
+        const discovered = await bridge.getCommunityMasqueRelays(true);
+        for (const relay of discovered) accept(relay);
+        if (candidates.size > 0) break;
+      }
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0) break;
+      await new Promise<void>((resolve) => {
+        const timer = setTimeout(
+          () => {
+            wake = null;
+            resolve();
+          },
+          Math.min(MASQUE_RELAY_QUERY_INTERVAL_MS, remainingMs)
+        );
+        timer.unref?.();
+        wake = () => {
+          clearTimeout(timer);
+          wake = null;
+          resolve();
+        };
+      });
+    }
+  } finally {
+    bridge.off('community-masque-relay', onRelay);
+  }
+  const relays = [...candidates.values()];
+  if (relays.length === 0) throw new Error('MASQUE_RELAY_UNAVAILABLE');
+  const random = options.random ?? Math.random;
+  const selected =
+    relays[Math.min(relays.length - 1, Math.floor(random() * relays.length))];
+  const host =
+    net.isIP(selected.host) === 6 ? `[${selected.host}]` : selected.host;
+  return {
+    protocolVersion: selected.protocolVersion,
+    ticketIdentity: selected.ticketIdentity,
+    ticketKeyId: selected.ticketKeyId,
+    relayIdentity: selected.relayIdentity,
+    accessMode: selected.accessMode,
+    allowedGroupIds: selected.allowedGroupIds,
+    relayAddress: `${host}:${selected.port}`,
+    relayServerName: selected.serverName,
+    relayCertSha256: selected.certSha256,
+    localFallbackAddress: `127.0.0.1:${selected.port}`,
+  };
+}
diff --git a/electron/src/moq-masque-transport.test.ts b/electron/src/moq-masque-transport.test.ts
new file mode 100644
index 000000000..d97ec5495
--- /dev/null
+++ b/electron/src/moq-masque-transport.test.ts
@@ -0,0 +1,315 @@
+import { EventEmitter } from 'events';
+import { describe, expect, it, vi } from 'vitest';
+import {
+  MoqMasqueTransport,
+  type MoqTransportEvent,
+} from './moq-masque-transport';
+import type {
+  PrivateBootstrapDescriptor,
+  PrivateChannelBootstrapProvider,
+} from './private-channel-bootstrap';
+import {
+  PrivateTransportSidecar,
+  PrivateTransportSidecarError,
+} from './private-transport-sidecar';
+
+const descriptor: PrivateBootstrapDescriptor = {
+  version: 1,
+  transport: 'quic-masque-inner-v1',
+  logicalSessionId: 'logical-session',
+  backendRnsDestination: 'ab'.repeat(16),
+  backendTransportEndpoint: '127.0.0.1:4446',
+  backendTransportServerName: 'application-private-backend',
+  backendTransportCertSha256: 'cd'.repeat(32),
+  attachToken: 'one-time-transport-token',
+  expiresAt: Date.now() + 30_000,
+  nonce: 'n'.repeat(32),
+  ownerBindingHash: 'ef'.repeat(32),
+  applicationProtocol: 'moqt-18',
+  supportedFeatures: {
+    reliable: true,
+    datagrams: true,
+    moqt: true,
+    moqtReliableGroups: true,
+  },
+};
+
+class FakeSidecar extends EventEmitter {
+  private opened = 0;
+  openMoqSession = vi.fn(async (config) => ({
+    moqSessionId: `moq-session${++this.opened === 1 ? '' : `-${this.opened}`}`,
+    logicalSessionId: config.logicalSessionId,
+    publicationNamespace: config.publicationNamespace,
+    publicationTrack: config.publicationTrack,
+    applicationProtocol: 'moqt-18' as const,
+  }));
+  subscribeMoqTrack = vi.fn(async () => undefined);
+  publishMoqObject = vi.fn(async () => undefined);
+  moqSessionMetrics = vi.fn(async () => ({ objectsSent: 1 }));
+  closeMoqSession = vi.fn(async () => undefined);
+}
+
+function setup(overrides: Partial<PrivateBootstrapDescriptor> = {}) {
+  const sidecar = new FakeSidecar();
+  const provider: PrivateChannelBootstrapProvider = {
+    getBootstrap: vi.fn(async () => ({ ...descriptor, ...overrides })),
+  };
+  const events: MoqTransportEvent[] = [];
+  const transport = new MoqMasqueTransport(
+    (event) => events.push(event),
+    sidecar as unknown as PrivateTransportSidecar,
+    {
+      relayAddress: '192.0.2.1:47322',
+      relayServerName: 'qortal-masque-relay',
+      relayCertSha256: '12'.repeat(32),
+    },
+    provider
+  );
+  return { sidecar, provider, events, transport };
+}
+
+const context = {
+  owner: { tabId: 'tab-1', name: 'sample-app', service: 'APP' },
+  rnsConnectionId: 'rns-connection',
+  publicationNamespace: ['qortal', 'apps', 'sample', 'publisher-123'],
+  publicationTrack: 'realtime-data',
+};
+
+describe('generic trusted MOQT transport', () => {
+  it.each(['MOQ_QUEUE_LIMIT', 'MOQ_OBJECT_EXPIRED'])(
+    'does not reconnect for expected delivery pressure: %s',
+    async (code) => {
+      const { transport, sidecar } = setup();
+      await transport.open(context);
+      sidecar.publishMoqObject.mockRejectedValueOnce(
+        new PrivateTransportSidecarError(code)
+      );
+      await expect(
+        transport.publish(
+          new Uint8Array([1]),
+          'realtime-data',
+          [new Uint8Array([1])],
+          { priority: 0, maxQueueAgeMillis: 120 }
+        )
+      ).rejects.toMatchObject({ code });
+      expect(sidecar.openMoqSession).toHaveBeenCalledTimes(1);
+      await transport.close();
+    }
+  );
+  it.each([
+    ['RELAY_ACCESS_DENIED', true],
+    ['RELAY_MEMBERSHIP_UNAVAILABLE', true],
+    ['ATTACH_TOKEN_REJECTED', false],
+    ['MOQ_ATTACH_FAILED', false],
+    ['BACKEND_IDENTITY_MISMATCH', false],
+  ] as const)(
+    'distinguishes %s from backend authentication rejection',
+    async (code, retry) => {
+      const { sidecar, transport } = setup();
+      sidecar.openMoqSession.mockRejectedValueOnce(
+        new PrivateTransportSidecarError(code)
+      );
+      if (retry) await transport.open(context);
+      else
+        await expect(transport.open(context)).rejects.toMatchObject({ code });
+      expect(sidecar.openMoqSession).toHaveBeenCalledTimes(retry ? 2 : 1);
+      await transport.close();
+    }
+  );
+  it('refreshes credentials that almost expired while relay discovery ran', async () => {
+    const { sidecar, provider, transport } = setup();
+    vi.mocked(provider.getBootstrap)
+      .mockResolvedValueOnce({
+        ...descriptor,
+        expiresAt: Date.now() + 1_000,
+        attachToken: 'old',
+      })
+      .mockResolvedValueOnce({
+        ...descriptor,
+        expiresAt: Date.now() + 30_000,
+        attachToken: 'fresh',
+      });
+    await transport.open(context);
+    expect(provider.getBootstrap).toHaveBeenCalledTimes(2);
+    expect(sidecar.openMoqSession).toHaveBeenCalledWith(
+      expect.objectContaining({ attachToken: 'fresh' })
+    );
+    await transport.close();
+  });
+  it('uses an authenticated realtime bootstrap and transports opaque objects', async () => {
+    const { sidecar, provider, transport } = setup();
+    await transport.open(context);
+    expect(provider.getBootstrap).toHaveBeenCalledWith(
+      expect.objectContaining({
+        channelId: 'trusted-moq-transport',
+        rnsConnectionId: context.rnsConnectionId,
+        purpose: 'realtime',
+        owner: context.owner,
+      })
+    );
+    expect(sidecar.openMoqSession).toHaveBeenCalledWith({
+      relayAddress: '192.0.2.1:47322',
+      relayServerName: 'qortal-masque-relay',
+      relayCertSha256: '12'.repeat(32),
+      backendAddress: '127.0.0.1:4446',
+      backendServerName: 'application-private-backend',
+      backendCertSha256: 'cd'.repeat(32),
+      logicalSessionId: 'logical-session',
+      attachToken: 'one-time-transport-token',
+      publicationNamespace: context.publicationNamespace,
+      publicationTrack: 'realtime-data',
+    });
+    await transport.subscribe(
+      'subscription-1',
+      ['qortal', 'apps', 'sample', 'peer-456'],
+      'events'
+    );
+    const opaquePayload = new Uint8Array([1, 2, 3]);
+    await transport.publish(opaquePayload);
+    expect(sidecar.subscribeMoqTrack).toHaveBeenCalledWith(
+      'moq-session',
+      'subscription-1',
+      ['qortal', 'apps', 'sample', 'peer-456'],
+      'events'
+    );
+    expect(sidecar.publishMoqObject).toHaveBeenCalledWith(
+      'moq-session',
+      opaquePayload
+    );
+  });
+
+  it('rejects a descriptor that does not explicitly advertise MOQT', async () => {
+    const { sidecar, transport } = setup({ applicationProtocol: undefined });
+    await expect(transport.open(context)).rejects.toMatchObject({
+      code: 'UNSUPPORTED_MOQ_TRANSPORT',
+    });
+    expect(sidecar.openMoqSession).not.toHaveBeenCalled();
+  });
+
+  it('delivers only bounded generic objects belonging to its native session', async () => {
+    const { sidecar, transport, events } = setup();
+    await transport.open(context);
+    sidecar.emit('event', {
+      event: 'object',
+      sessionId: 'another-session',
+      subscriptionId: 'subscription-1',
+      namespace: ['qortal', 'apps'],
+      trackName: 'events',
+      groupId: 0,
+      objectId: 1,
+      data: Buffer.from([9]),
+    });
+    sidecar.emit('event', {
+      event: 'object',
+      sessionId: 'moq-session',
+      subscriptionId: 'subscription-1',
+      namespace: ['qortal', 'apps'],
+      trackName: 'events',
+      groupId: 0,
+      objectId: 1,
+      data: Buffer.from([7, 8]),
+    });
+    expect(events).toEqual([
+      {
+        kind: 'object',
+        subscriptionId: 'subscription-1',
+        namespace: ['qortal', 'apps'],
+        trackName: 'events',
+        groupId: 0,
+        objectId: 1,
+        payload: new Uint8Array([7, 8]),
+      },
+    ]);
+    await transport.close();
+    expect(sidecar.closeMoqSession).toHaveBeenCalledWith('moq-session');
+  });
+
+  it('does not reconnect the media connection when one reliable object expires', async () => {
+    const { sidecar, transport } = setup();
+    await transport.open(context);
+    sidecar.publishMoqObject.mockRejectedValueOnce(
+      new PrivateTransportSidecarError('MOQ_OBJECT_EXPIRED')
+    );
+    const payload = new Uint8Array(2000);
+    await expect(
+      transport.publish(payload, 'events', [payload], {
+        priority: 1,
+        maxQueueAgeMillis: 1500,
+        groupId: 1,
+        objectId: 1,
+      })
+    ).rejects.toMatchObject({ code: 'MOQ_OBJECT_EXPIRED' });
+    expect(sidecar.openMoqSession).toHaveBeenCalledTimes(1);
+    await transport.close();
+  });
+
+  it('does not retry an attach failure as a direct connection', async () => {
+    const { sidecar, transport } = setup();
+    sidecar.openMoqSession.mockRejectedValueOnce(
+      new PrivateTransportSidecarError('MOQ_ATTACH_FAILED')
+    );
+    await expect(transport.open(context)).rejects.toMatchObject({
+      code: 'MOQ_ATTACH_FAILED',
+    });
+    expect(sidecar.openMoqSession).toHaveBeenCalledTimes(1);
+  });
+
+  it('moves to another relay with a fresh token and restores subscriptions', async () => {
+    const sidecar = new FakeSidecar();
+    let bootstrapNumber = 0;
+    const provider: PrivateChannelBootstrapProvider = {
+      getBootstrap: vi.fn(async () => ({
+        ...descriptor,
+        logicalSessionId: `logical-${++bootstrapNumber}`,
+        attachToken: `one-time-token-${bootstrapNumber}`,
+      })),
+    };
+    const relayProvider = vi.fn(async (excluded?: ReadonlySet<string>) => ({
+      relayAddress: excluded?.has('8.8.8.8:47322')
+        ? '1.1.1.1:47322'
+        : '8.8.8.8:47322',
+      relayServerName: 'relay.test',
+      relayCertSha256: '12'.repeat(32),
+    }));
+    const events: MoqTransportEvent[] = [];
+    const transport = new MoqMasqueTransport(
+      (event) => events.push(event),
+      sidecar as never,
+      relayProvider,
+      provider
+    );
+    await transport.open(context);
+    await transport.subscribe(
+      'subscription-1',
+      ['qortal', 'apps', 'sample', 'peer-456'],
+      'events'
+    );
+
+    sidecar.emit('event', {
+      event: 'error',
+      sessionId: 'moq-session',
+      code: 'MOQ_READ_FAILED',
+      subscriptionId: 'subscription-1',
+      data: Buffer.alloc(0),
+    });
+    await transport.publish(new Uint8Array([9]));
+
+    expect(
+      sidecar.openMoqSession.mock.calls.map(([config]) => config.relayAddress)
+    ).toEqual(['8.8.8.8:47322', '1.1.1.1:47322']);
+    expect(
+      sidecar.openMoqSession.mock.calls.map(([config]) => config.attachToken)
+    ).toEqual(['one-time-token-1', 'one-time-token-2']);
+    expect(sidecar.subscribeMoqTrack).toHaveBeenLastCalledWith(
+      'moq-session-2',
+      'subscription-1',
+      ['qortal', 'apps', 'sample', 'peer-456'],
+      'events'
+    );
+    expect(sidecar.publishMoqObject).toHaveBeenCalledWith(
+      'moq-session-2',
+      new Uint8Array([9])
+    );
+    expect(events).toEqual([]);
+  });
+});
diff --git a/electron/src/moq-masque-transport.ts b/electron/src/moq-masque-transport.ts
new file mode 100644
index 000000000..1e921c9de
--- /dev/null
+++ b/electron/src/moq-masque-transport.ts
@@ -0,0 +1,457 @@
+import type { PrivateChannelBootstrapProvider } from './private-channel-bootstrap';
+import type { PrivateTransportContext } from './private-channel-manager';
+import {
+  MAX_MOQ_OBJECT_BYTES,
+  MAX_MOQ_RELIABLE_OBJECT_BYTES,
+  PrivateTransportSidecar,
+  PrivateTransportSidecarError,
+  type PrivateTransportSidecarEvent,
+} from './private-transport-sidecar';
+import type {
+  TrustedRelayConfig,
+  TrustedRelayProvider,
+} from './quic-masque-transport';
+import type { QAppReticulumOwner } from './qapp-reticulum-manager';
+
+const MOQ_NAME = /^[A-Za-z0-9._-]{1,128}$/;
+const RECOVERY_DELAYS_MS = [0, 500, 2_000] as const;
+const FAILED_RELAY_COOLDOWN_MS = 60_000;
+
+function validNamespace(namespace: readonly string[]): boolean {
+  return (
+    namespace.length >= 1 &&
+    namespace.length <= 8 &&
+    namespace.every((component) => MOQ_NAME.test(component)) &&
+    namespace.reduce((total, component) => total + component.length, 0) <= 512
+  );
+}
+
+export type MoqOpenContext = Readonly<{
+  owner: QAppReticulumOwner;
+  rnsConnectionId: string;
+  publicationNamespace: readonly string[];
+  publicationTrack: string | readonly string[];
+}>;
+
+export type MoqTransportEvent =
+  | Readonly<{
+      kind: 'object';
+      subscriptionId: string;
+      namespace: readonly string[];
+      trackName: string;
+      groupId: number;
+      objectId: number;
+      payload: Uint8Array;
+    }>
+  | Readonly<{ kind: 'error'; code: string; subscriptionId?: string }>;
+
+/**
+ * Main-process-only generic MOQT transport. Payload meaning and protection are
+ * deliberately outside this layer; endpoints and sockets remain private.
+ */
+export class MoqMasqueTransport {
+  private moqSessionId: string | null = null;
+  private context: MoqOpenContext | null = null;
+  private activeRelayAddress: string | null = null;
+  private lastAttemptedRelayAddress: string | null = null;
+  private recoveryPromise: Promise<string> | null = null;
+  private readonly failedRelayAddresses = new Map<string, number>();
+  private readonly subscriptions = new Map<
+    string,
+    { namespace: readonly string[]; trackName: string }
+  >();
+  private closed = false;
+  private readonly onSidecarEvent = (event: PrivateTransportSidecarEvent) =>
+    this.handleSidecarEvent(event);
+  private readonly onSidecarDeath = () => {
+    if (!this.closed && this.moqSessionId) {
+      void this.recover('MOQ_TRANSPORT_CLOSED');
+    }
+  };
+
+  constructor(
+    private readonly emit: (event: MoqTransportEvent) => void,
+    private readonly sidecar: PrivateTransportSidecar,
+    private readonly relay: TrustedRelayConfig | TrustedRelayProvider,
+    private readonly bootstrapProvider: PrivateChannelBootstrapProvider
+  ) {
+    sidecar.on('event', this.onSidecarEvent);
+    sidecar.on('death', this.onSidecarDeath);
+  }
+
+  async open(context: MoqOpenContext): Promise<void> {
+    if (this.closed || this.moqSessionId) {
+      throw new PrivateTransportSidecarError('MOQ_SESSION_CLOSED');
+    }
+    if (
+      !validNamespace(context.publicationNamespace) ||
+      !(
+        typeof context.publicationTrack === 'string'
+          ? [context.publicationTrack]
+          : context.publicationTrack
+      ).every((track) => MOQ_NAME.test(track))
+    ) {
+      throw new PrivateTransportSidecarError('INVALID_MOQ_CONFIG');
+    }
+    this.context = context;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        await this.connect(context);
+        break;
+      } catch (error) {
+        if (
+          attempt >= 2 ||
+          !this.lastAttemptedRelayAddress ||
+          !isRecoverableMoqError(error) ||
+          this.closed
+        )
+          throw error;
+        if (this.lastAttemptedRelayAddress)
+          this.failedRelayAddresses.set(
+            this.lastAttemptedRelayAddress,
+            Date.now()
+          );
+      }
+    }
+  }
+
+  private async connect(context: MoqOpenContext): Promise<void> {
+    this.lastAttemptedRelayAddress = null;
+    const relayPromise = this.resolveRelay();
+    const bootstrapContext: PrivateTransportContext = {
+      channelId: 'trusted-moq-transport',
+      rnsConnectionId: context.rnsConnectionId,
+      purpose: 'realtime',
+      generation: 1,
+      owner: context.owner,
+    };
+    let [relay, bootstrap] = await Promise.all([
+      relayPromise,
+      this.bootstrapProvider.getBootstrap(bootstrapContext),
+    ]);
+    if (bootstrap.expiresAt < Date.now() + 5_000)
+      bootstrap = await this.bootstrapProvider.getBootstrap(bootstrapContext);
+    if (
+      bootstrap.applicationProtocol !== 'moqt-18' ||
+      bootstrap.supportedFeatures.moqt !== true ||
+      bootstrap.supportedFeatures.moqtReliableGroups !== true
+    ) {
+      throw new PrivateTransportSidecarError('UNSUPPORTED_MOQ_TRANSPORT');
+    }
+    this.lastAttemptedRelayAddress = relay.relayAddress;
+    const openAt = (relayAddress: string) =>
+      this.sidecar.openMoqSession({
+        preparedRelay: relay.preparedRelay,
+        relayAddress,
+        relayServerName: relay.relayServerName,
+        relayCertSha256: relay.relayCertSha256,
+        backendAddress: bootstrap.backendTransportEndpoint,
+        backendServerName: bootstrap.backendTransportServerName,
+        backendCertSha256: bootstrap.backendTransportCertSha256,
+        logicalSessionId: bootstrap.logicalSessionId,
+        attachToken: bootstrap.attachToken,
+        publicationNamespace: context.publicationNamespace,
+        publicationTrack: context.publicationTrack,
+      });
+    let opened;
+    try {
+      opened = await openAt(relay.relayAddress);
+    } catch (error) {
+      if (
+        !(error instanceof PrivateTransportSidecarError) ||
+        error.code !== 'MASQUE_TUNNEL_FAILED' ||
+        !relay.localFallbackAddress ||
+        relay.localFallbackAddress === relay.relayAddress
+      ) {
+        throw error;
+      }
+      opened = await openAt(relay.localFallbackAddress);
+    }
+    if (this.closed) {
+      await this.sidecar
+        .closeMoqSession(opened.moqSessionId)
+        .catch(() => undefined);
+      throw new PrivateTransportSidecarError('MOQ_SESSION_CLOSED');
+    }
+    this.moqSessionId = opened.moqSessionId;
+    this.activeRelayAddress = relay.relayAddress;
+    try {
+      for (const [subscriptionId, subscription] of this.subscriptions) {
+        await this.sidecar.subscribeMoqTrack(
+          opened.moqSessionId,
+          subscriptionId,
+          subscription.namespace,
+          subscription.trackName
+        );
+      }
+    } catch (error) {
+      this.moqSessionId = null;
+      this.activeRelayAddress = null;
+      await this.sidecar
+        .closeMoqSession(opened.moqSessionId)
+        .catch(() => undefined);
+      throw error;
+    }
+  }
+
+  async subscribe(
+    subscriptionId: string,
+    namespace: readonly string[],
+    trackName: string
+  ): Promise<void> {
+    if (
+      !MOQ_NAME.test(subscriptionId) ||
+      !validNamespace(namespace) ||
+      !MOQ_NAME.test(trackName)
+    ) {
+      throw new PrivateTransportSidecarError('INVALID_MOQ_SUBSCRIPTION');
+    }
+    const subscription = { namespace: [...namespace], trackName };
+    this.subscriptions.set(subscriptionId, subscription);
+    try {
+      const sessionId = await this.requireSession();
+      await this.sidecar.subscribeMoqTrack(
+        sessionId,
+        subscriptionId,
+        namespace,
+        trackName
+      );
+    } catch (error) {
+      if (isRecoverableMoqError(error)) {
+        try {
+          // Recovery restores the subscription recorded above.
+          await this.recover(errorCode(error));
+          return;
+        } catch (recoveryError) {
+          this.subscriptions.delete(subscriptionId);
+          throw recoveryError;
+        }
+      }
+      this.subscriptions.delete(subscriptionId);
+      throw error;
+    }
+  }
+
+  async publish(
+    payload: Uint8Array,
+    trackName?: string,
+    batch?: readonly Uint8Array[],
+    delivery?: {
+      priority: number;
+      maxQueueAgeMillis: number;
+      groupId?: number;
+      objectId?: number;
+    }
+  ): Promise<void> {
+    const limit =
+      delivery?.groupId !== undefined
+        ? MAX_MOQ_RELIABLE_OBJECT_BYTES
+        : MAX_MOQ_OBJECT_BYTES;
+    if (payload.byteLength < 1 || payload.byteLength > limit) {
+      throw new PrivateTransportSidecarError('MOQ_OBJECT_TOO_LARGE');
+    }
+    try {
+      const sessionId = await this.requireSession();
+      if (batch)
+        await this.sidecar.publishMoqObject(
+          sessionId,
+          payload,
+          trackName,
+          batch,
+          delivery
+        );
+      else await this.sidecar.publishMoqObject(sessionId, payload);
+    } catch (error) {
+      if (isRecoverableMoqError(error)) {
+        // A media object is stale by the time a replacement path opens. Drop
+        // this object after recovery instead of creating an audible late frame.
+        await this.recover(errorCode(error));
+        throw new PrivateTransportSidecarError('MOQ_SEND_FAILED');
+      }
+      throw error;
+    }
+  }
+
+  async metrics(): Promise<Record<string, number>> {
+    try {
+      return await this.sidecar.moqSessionMetrics(await this.requireSession());
+    } catch (error) {
+      if (isRecoverableMoqError(error)) {
+        const replacementSessionId = await this.recover(errorCode(error));
+        return this.sidecar.moqSessionMetrics(replacementSessionId);
+      }
+      throw error;
+    }
+  }
+
+  async close(): Promise<void> {
+    if (this.closed) return;
+    this.closed = true;
+    this.context = null;
+    this.recoveryPromise = null;
+    this.subscriptions.clear();
+    const moqSessionId = this.moqSessionId;
+    this.moqSessionId = null;
+    this.sidecar.off('event', this.onSidecarEvent);
+    this.sidecar.off('death', this.onSidecarDeath);
+    if (moqSessionId) {
+      await this.sidecar.closeMoqSession(moqSessionId).catch(() => undefined);
+    }
+  }
+
+  private async resolveRelay(): Promise<TrustedRelayConfig> {
+    const now = Date.now();
+    for (const [address, failedAt] of this.failedRelayAddresses) {
+      if (now - failedAt >= FAILED_RELAY_COOLDOWN_MS)
+        this.failedRelayAddresses.delete(address);
+    }
+    const excluded = new Set(this.failedRelayAddresses.keys());
+    return typeof this.relay === 'function' ? this.relay(excluded) : this.relay;
+  }
+
+  private async requireSession(): Promise<string> {
+    if (this.recoveryPromise) await this.recoveryPromise;
+    if (this.closed || !this.moqSessionId) {
+      throw new PrivateTransportSidecarError('MOQ_SESSION_CLOSED');
+    }
+    return this.moqSessionId;
+  }
+
+  private handleSidecarEvent(event: PrivateTransportSidecarEvent): void {
+    if (event.sessionId !== this.moqSessionId || this.closed) return;
+    if (event.event === 'error') {
+      if (isRecoverableMoqCode(event.code)) {
+        void this.recover(event.code ?? 'MOQ_TRANSPORT_CLOSED');
+        return;
+      }
+      this.emit({
+        kind: 'error',
+        code: event.code ?? 'MOQ_TRANSPORT_ERROR',
+        subscriptionId: event.subscriptionId,
+      });
+      return;
+    }
+    if (
+      event.event !== 'object' ||
+      !event.subscriptionId ||
+      !event.namespace ||
+      !validNamespace(event.namespace) ||
+      !event.trackName ||
+      !MOQ_NAME.test(event.trackName) ||
+      typeof event.groupId !== 'number' ||
+      typeof event.objectId !== 'number' ||
+      !Number.isSafeInteger(event.groupId) ||
+      !Number.isSafeInteger(event.objectId) ||
+      event.data.length < 1 ||
+      event.data.length > MAX_MOQ_RELIABLE_OBJECT_BYTES
+    ) {
+      this.emit({ kind: 'error', code: 'MOQ_PROTOCOL_MISMATCH' });
+      return;
+    }
+    this.emit({
+      kind: 'object',
+      subscriptionId: event.subscriptionId,
+      namespace: [...event.namespace],
+      trackName: event.trackName,
+      groupId: event.groupId,
+      objectId: event.objectId,
+      payload: new Uint8Array(event.data),
+    });
+  }
+
+  private recover(_reason: string): Promise<string> {
+    if (this.closed)
+      return Promise.reject(
+        new PrivateTransportSidecarError('MOQ_SESSION_CLOSED')
+      );
+    if (this.recoveryPromise) return this.recoveryPromise;
+    const context = this.context;
+    if (!context)
+      return Promise.reject(
+        new PrivateTransportSidecarError('MOQ_SESSION_CLOSED')
+      );
+    if (this.activeRelayAddress)
+      this.failedRelayAddresses.set(this.activeRelayAddress, Date.now());
+    const oldSessionId = this.moqSessionId;
+    this.moqSessionId = null;
+    this.activeRelayAddress = null;
+    if (oldSessionId)
+      void this.sidecar.closeMoqSession(oldSessionId).catch(() => undefined);
+    const recovery = (async (): Promise<string> => {
+      let lastError: unknown = new PrivateTransportSidecarError(
+        'MOQ_TRANSPORT_CLOSED'
+      );
+      for (const delayMs of RECOVERY_DELAYS_MS) {
+        if (delayMs) await delay(delayMs);
+        if (this.closed)
+          throw new PrivateTransportSidecarError('MOQ_SESSION_CLOSED');
+        try {
+          await this.connect(context);
+          if (!this.moqSessionId)
+            throw new PrivateTransportSidecarError('MOQ_SESSION_CLOSED');
+          return this.moqSessionId;
+        } catch (error) {
+          lastError = error;
+          if (this.lastAttemptedRelayAddress)
+            this.failedRelayAddresses.set(
+              this.lastAttemptedRelayAddress,
+              Date.now()
+            );
+          this.moqSessionId = null;
+          this.activeRelayAddress = null;
+          if (!isRecoverableMoqError(error)) break;
+        }
+      }
+      throw lastError;
+    })();
+    this.recoveryPromise = recovery;
+    void recovery
+      .catch((error) => {
+        if (!this.closed) this.emit({ kind: 'error', code: errorCode(error) });
+      })
+      .finally(() => {
+        if (this.recoveryPromise === recovery) this.recoveryPromise = null;
+      });
+    return recovery;
+  }
+}
+
+function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function errorCode(error: unknown): string {
+  return error instanceof PrivateTransportSidecarError
+    ? error.code
+    : error instanceof Error && /^[A-Z0-9_]{3,64}$/.test(error.message)
+      ? error.message
+      : 'MOQ_TRANSPORT_ERROR';
+}
+
+function isRecoverableMoqCode(code: string | undefined): boolean {
+  return (
+    code === 'RELAY_CONNECT_FAILED' ||
+    code === 'RELAY_CONNECTION_CLOSED' ||
+    code === 'RELAY_TARGET_DENIED' ||
+    code === 'RELAY_FULL' ||
+    code === 'RELAY_AUTH_REQUIRED' ||
+    code === 'RELAY_ACCESS_DENIED' ||
+    code === 'RELAY_MEMBERSHIP_UNAVAILABLE' ||
+    code === 'MOQ_TRANSPORT_CLOSED' ||
+    code === 'MOQ_QUIC_FAILED' ||
+    code === 'MOQ_SESSION_CLOSED' ||
+    code === 'MOQ_READ_FAILED' ||
+    code === 'MOQ_SEND_FAILED' ||
+    code === 'MASQUE_TUNNEL_FAILED' ||
+    code === 'MASQUE_RELAY_UNAVAILABLE' ||
+    code === 'SIDECAR_EXITED' ||
+    code === 'SIDECAR_NOT_RUNNING' ||
+    code === 'SIDECAR_REQUEST_TIMEOUT' ||
+    code === 'SIDECAR_WRITE_FAILED' ||
+    code === 'BOOTSTRAP_FAILED'
+  );
+}
+
+function isRecoverableMoqError(error: unknown): boolean {
+  return isRecoverableMoqCode(errorCode(error));
+}
diff --git a/electron/src/moq-transport-manager.test.ts b/electron/src/moq-transport-manager.test.ts
new file mode 100644
index 000000000..55ccc5fe1
--- /dev/null
+++ b/electron/src/moq-transport-manager.test.ts
@@ -0,0 +1,332 @@
+import { describe, expect, it, vi } from 'vitest';
+import {
+  QAppMoqTransportManager,
+  type ManagedMoqTransport,
+} from './moq-transport-manager';
+import type { MoqTransportEvent } from './moq-masque-transport';
+
+const owner = { tabId: 'tab-1', name: 'call-app', service: 'APP' };
+
+class FakeTransport implements ManagedMoqTransport {
+  open = vi.fn(async () => undefined);
+  subscribe = vi.fn(async () => undefined);
+  publish = vi.fn(async () => undefined);
+  metrics = vi.fn(async () => ({ objectsSent: 1 }));
+  close = vi.fn(async () => undefined);
+
+  constructor(readonly emit: (event: MoqTransportEvent) => void) {}
+}
+
+function setup(ownership: 'owned' | 'missing' | 'not-owned' = 'owned') {
+  const transports: FakeTransport[] = [];
+  const manager = new QAppMoqTransportManager(
+    () => ownership,
+    (emit) => {
+      const transport = new FakeTransport(emit);
+      transports.push(transport);
+      return transport;
+    }
+  );
+  const events: unknown[] = [];
+  manager.on('event', (event) => events.push(event));
+  return { manager, transports, events };
+}
+
+async function open(manager: QAppMoqTransportManager) {
+  return manager.open(
+    owner,
+    'rns-1',
+    ['qortal', 'call', 'room-123', 'QAlice123'],
+    'audio'
+  );
+}
+
+describe('Q-App generic MOQT manager', () => {
+  it.each([1025, 128 * 1024, 1024 * 1024])(
+    'delivers a %i-byte incoming object without closing other tracks',
+    async (size) => {
+      const { manager, transports, events } = setup();
+      const opened = await open(manager);
+      await manager.subscribe(
+        owner,
+        opened.sessionId,
+        'peer',
+        ['opaque'],
+        'objects'
+      );
+      const payload = new Uint8Array(size).fill(7);
+      transports[0].emit({
+        kind: 'object',
+        subscriptionId: 'peer',
+        namespace: ['opaque'],
+        trackName: 'objects',
+        groupId: 1,
+        objectId: 1,
+        payload,
+      });
+      expect(events).toContainEqual(
+        expect.objectContaining({
+          action: 'MOQ_OBJECT',
+          sessionId: opened.sessionId,
+          payload,
+        })
+      );
+      expect(transports[0].close).not.toHaveBeenCalled();
+      await expect(
+        manager.publish(owner, opened.sessionId, new Uint8Array([1]))
+      ).resolves.toMatchObject({ accepted: true });
+      manager.destroy();
+    }
+  );
+
+  it('rejects incoming objects above the reliable object limit', async () => {
+    const { manager, transports, events } = setup();
+    const opened = await open(manager);
+    await manager.subscribe(
+      owner,
+      opened.sessionId,
+      'peer',
+      ['opaque'],
+      'objects'
+    );
+    transports[0].emit({
+      kind: 'object',
+      subscriptionId: 'peer',
+      namespace: ['opaque'],
+      trackName: 'objects',
+      groupId: 1,
+      objectId: 1,
+      payload: new Uint8Array(1024 * 1024 + 1),
+    });
+    expect(events).toContainEqual(
+      expect.objectContaining({
+        action: 'MOQ_ERROR',
+        code: 'MOQ_PROTOCOL_MISMATCH',
+      })
+    );
+    expect(transports[0].close).toHaveBeenCalledOnce();
+    manager.destroy();
+  });
+
+  it('admits bounded reliable objects without relaxing datagram limits', async () => {
+    const { manager, transports } = setup();
+    const opened = await manager.open(
+      owner,
+      'rns-1',
+      ['opaque'],
+      ['objects', 'urgent']
+    );
+    const objects = [new Uint8Array(128 * 1024)];
+    const delivery = {
+      priority: 1,
+      maxQueueAgeMillis: 1500,
+      groupId: 7,
+      objectId: 1,
+    };
+    await expect(
+      manager.publish(owner, opened.sessionId, {
+        trackName: 'objects',
+        objects,
+        delivery,
+      })
+    ).resolves.toMatchObject({ accepted: true });
+    expect(transports[0].publish).toHaveBeenCalledWith(
+      objects[0],
+      'objects',
+      objects,
+      delivery
+    );
+    await expect(
+      manager.publish(owner, opened.sessionId, {
+        trackName: 'objects',
+        objects,
+      })
+    ).rejects.toMatchObject({ code: 'MOQ_OBJECT_TOO_LARGE' });
+    for (const bad of [
+      { ...delivery, groupId: -1 },
+      { ...delivery, objectId: undefined },
+      { ...delivery, groupId: Infinity },
+    ]) {
+      await expect(
+        manager.publish(owner, opened.sessionId, {
+          trackName: 'objects',
+          objects,
+          delivery: bad,
+        })
+      ).rejects.toMatchObject({ code: 'INVALID_MOQ_CONFIG' });
+    }
+    await expect(
+      manager.publish(owner, opened.sessionId, {
+        trackName: 'objects',
+        objects: [new Uint8Array(1024 * 1024 + 1)],
+        delivery,
+      })
+    ).rejects.toMatchObject({ code: 'MOQ_OBJECT_TOO_LARGE' });
+  });
+  it('validates opaque delivery policy before admission and forwards it unchanged', async () => {
+    const { manager, transports } = setup();
+    const opened = await manager.open(owner, 'rns-1', ['opaque'], ['live']);
+    const objects = [new Uint8Array([1])];
+    for (const delivery of [
+      null,
+      {},
+      { priority: -1, maxQueueAgeMillis: 100 },
+      { priority: 3, maxQueueAgeMillis: 100 },
+      { priority: 0, maxQueueAgeMillis: Infinity },
+      { priority: 0, maxQueueAgeMillis: 2001 },
+    ]) {
+      await expect(
+        manager.publish(owner, opened.sessionId, {
+          trackName: 'live',
+          objects,
+          delivery,
+        })
+      ).rejects.toMatchObject({ code: 'INVALID_MOQ_CONFIG' });
+    }
+    expect(transports[0].publish).not.toHaveBeenCalled();
+    const delivery = { priority: 0, maxQueueAgeMillis: 120 };
+    await manager.publish(owner, opened.sessionId, {
+      trackName: 'live',
+      objects,
+      delivery,
+    });
+    expect(transports[0].publish).toHaveBeenCalledWith(
+      objects[0],
+      'live',
+      objects,
+      delivery
+    );
+  });
+  it('isolates bounded publication batches by track and rejects undeclared tracks', async () => {
+    const { manager, transports } = setup();
+    const opened = await manager.open(
+      owner,
+      'rns-1',
+      ['example'],
+      ['fast', 'bulk']
+    );
+    const objects = [new Uint8Array([1]), new Uint8Array([2])];
+    await manager.publish(owner, opened.sessionId, {
+      trackName: 'bulk',
+      objects,
+    });
+    expect(transports[0].publish).toHaveBeenCalledWith(
+      objects[0],
+      'bulk',
+      objects,
+      undefined
+    );
+    await expect(
+      manager.publish(owner, opened.sessionId, {
+        trackName: 'undeclared',
+        objects,
+      })
+    ).rejects.toMatchObject({ code: 'INVALID_MOQ_CONFIG' });
+    await expect(
+      manager.publish(owner, opened.sessionId, {
+        trackName: 'bulk',
+        objects: Array(9).fill(objects[0]),
+      })
+    ).rejects.toMatchObject({ code: 'MOQ_OBJECT_TOO_LARGE' });
+    await expect(
+      manager.open(owner, 'rns-1', ['example'], ['same', 'same'])
+    ).rejects.toMatchObject({ code: 'INVALID_MOQ_CONFIG' });
+  });
+  it('reserves independent queue capacity when a bulk track is blocked', async () => {
+    const { manager, transports } = setup();
+    const opened = await manager.open(
+      owner,
+      'rns-1',
+      ['example'],
+      ['fast', 'bulk']
+    );
+    let release!: () => void;
+    const blocked = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    transports[0].publish.mockImplementation(() => blocked);
+    const request = {
+      trackName: 'bulk',
+      objects: Array.from({ length: 8 }, () => new Uint8Array(1024)),
+    };
+    const one = manager.publish(owner, opened.sessionId, request);
+    const two = manager.publish(owner, opened.sessionId, request);
+    await expect(
+      manager.publish(owner, opened.sessionId, request)
+    ).rejects.toMatchObject({ code: 'MOQ_QUEUE_LIMIT' });
+    transports[0].publish.mockImplementation(async () => undefined);
+    await expect(
+      manager.publish(owner, opened.sessionId, {
+        trackName: 'fast',
+        objects: [new Uint8Array([1])],
+      })
+    ).resolves.toMatchObject({ accepted: true });
+    release();
+    await Promise.all([one, two]);
+  });
+  it('binds a session to the Q-App-owned Reticulum connection', async () => {
+    const { manager, transports } = setup();
+    const opened = await open(manager);
+    expect(opened.state).toBe('OPEN');
+    expect(transports[0].open).toHaveBeenCalledWith({
+      owner,
+      rnsConnectionId: 'rns-1',
+      publicationNamespace: ['qortal', 'call', 'room-123', 'QAlice123'],
+      publicationTrack: 'audio',
+    });
+
+    const missing = setup('missing');
+    await expect(open(missing.manager)).rejects.toMatchObject({
+      code: 'INVALID_RNS_CONNECTION',
+    });
+  });
+
+  it('subscribes and carries only bounded opaque binary objects', async () => {
+    const { manager, transports, events } = setup();
+    const opened = await open(manager);
+    await manager.subscribe(
+      owner,
+      opened.sessionId,
+      'peer-QBob456',
+      ['qortal', 'call', 'room-123', 'QBob456'],
+      'audio'
+    );
+    await manager.publish(owner, opened.sessionId, new Uint8Array([1, 2, 3]));
+    expect(transports[0].publish).toHaveBeenCalledWith(
+      new Uint8Array([1, 2, 3])
+    );
+
+    transports[0].emit({
+      kind: 'object',
+      subscriptionId: 'peer-QBob456',
+      namespace: ['qortal', 'call', 'room-123', 'QBob456'],
+      trackName: 'audio',
+      groupId: 0,
+      objectId: 1,
+      payload: new Uint8Array([7, 8]),
+    });
+    expect(events).toContainEqual(
+      expect.objectContaining({
+        action: 'MOQ_OBJECT',
+        sessionId: opened.sessionId,
+        payload: new Uint8Array([7, 8]),
+      })
+    );
+    await expect(
+      manager.publish(owner, opened.sessionId, new Uint8Array(1025))
+    ).rejects.toMatchObject({ code: 'MOQ_OBJECT_TOO_LARGE' });
+  });
+
+  it('isolates owners and closes sessions with their Reticulum connection', async () => {
+    const { manager, transports } = setup();
+    const opened = await open(manager);
+    await expect(
+      manager.metrics({ ...owner, tabId: 'other-tab' }, opened.sessionId)
+    ).rejects.toMatchObject({ code: 'MOQ_SESSION_NOT_OWNED' });
+    await manager.cleanupRnsConnection(owner, 'rns-1');
+    expect(transports[0].close).toHaveBeenCalledOnce();
+    await expect(
+      manager.metrics(owner, opened.sessionId)
+    ).rejects.toMatchObject({ code: 'MOQ_SESSION_CLOSED' });
+  });
+});
diff --git a/electron/src/moq-transport-manager.ts b/electron/src/moq-transport-manager.ts
new file mode 100644
index 000000000..10c249796
--- /dev/null
+++ b/electron/src/moq-transport-manager.ts
@@ -0,0 +1,533 @@
+import { EventEmitter } from 'events';
+import { randomUUID } from 'crypto';
+import type {
+  QAppReticulumConnectionOwnership,
+  QAppReticulumOwner,
+} from './qapp-reticulum-manager';
+import { privateChannelOwnerKey } from './private-channel-manager';
+import type { MoqOpenContext, MoqTransportEvent } from './moq-masque-transport';
+
+export const QAPP_MOQ_LIMITS = Object.freeze({
+  maxSessionsPerOwner: 2,
+  maxSessionsGlobal: 16,
+  maxSubscriptionsPerSession: 128,
+  maxPublicationTracks: 8,
+  maxBatchObjects: 8,
+  maxQueuedBytesPerTrack: 16 * 1024,
+  maxObjectBytes: 1024,
+  maxReliableObjectBytes: 1024 * 1024,
+  maxQueuedBytesPerSession: 2 * 1024 * 1024 + 64 * 1024,
+});
+
+const MOQ_NAME = /^[A-Za-z0-9._-]{1,128}$/;
+
+export class QAppMoqError extends Error {
+  constructor(
+    public readonly code: string,
+    message = code
+  ) {
+    super(message);
+  }
+}
+
+export type MoqDeliveryPolicy = Readonly<{
+  priority: number;
+  maxQueueAgeMillis: number;
+  groupId?: number;
+  objectId?: number;
+}>;
+
+export interface ManagedMoqTransport {
+  open(context: MoqOpenContext): Promise<void>;
+  subscribe(
+    subscriptionId: string,
+    namespace: readonly string[],
+    trackName: string
+  ): Promise<void>;
+  publish(
+    payload: Uint8Array,
+    trackName?: string,
+    batch?: readonly Uint8Array[],
+    delivery?: MoqDeliveryPolicy
+  ): Promise<void>;
+  metrics(): Promise<Record<string, number>>;
+  close(): Promise<void>;
+}
+
+export type ManagedMoqTransportFactory = (
+  emit: (event: MoqTransportEvent) => void
+) => ManagedMoqTransport;
+
+type SessionRecord = {
+  sessionId: string;
+  ownerKey: string;
+  owner: QAppReticulumOwner;
+  rnsConnectionId: string;
+  state: 'OPENING' | 'OPEN' | 'CLOSED';
+  transport: ManagedMoqTransport;
+  subscriptions: Set<string>;
+  queuedBytes: number;
+  publicationTracks: readonly string[];
+  queuedByTrack: Map<string, number>;
+  generation: number;
+};
+
+export class QAppMoqTransportManager extends EventEmitter {
+  private readonly sessions = new Map<string, SessionRecord>();
+  private readonly sessionsByOwner = new Map<string, Set<string>>();
+
+  constructor(
+    private readonly getRnsConnectionOwnership: (
+      owner: QAppReticulumOwner,
+      connectionId: string
+    ) => QAppReticulumConnectionOwnership,
+    private readonly transportFactory: ManagedMoqTransportFactory
+  ) {
+    super();
+  }
+
+  async open(
+    owner: QAppReticulumOwner,
+    rnsConnectionIdValue: unknown,
+    publicationNamespaceValue: unknown,
+    publicationTrackValue: unknown
+  ) {
+    const ownerKey = validatedOwnerKey(owner);
+    const rnsConnectionId = requireNonemptyString(
+      rnsConnectionIdValue,
+      'INVALID_RNS_CONNECTION'
+    );
+    const ownership = this.getRnsConnectionOwnership(owner, rnsConnectionId);
+    if (ownership === 'missing')
+      throw new QAppMoqError('INVALID_RNS_CONNECTION');
+    if (ownership !== 'owned')
+      throw new QAppMoqError('RNS_CONNECTION_NOT_OWNED');
+    const publicationNamespace = requireNamespace(
+      publicationNamespaceValue,
+      'INVALID_MOQ_CONFIG'
+    );
+    const trackValues = Array.isArray(publicationTrackValue)
+      ? publicationTrackValue
+      : [publicationTrackValue];
+    if (
+      !trackValues.length ||
+      trackValues.length > QAPP_MOQ_LIMITS.maxPublicationTracks
+    )
+      throw new QAppMoqError('INVALID_MOQ_CONFIG');
+    const publicationTracks = trackValues.map((value) =>
+      requireName(value, 'INVALID_MOQ_CONFIG')
+    );
+    if (new Set(publicationTracks).size !== publicationTracks.length)
+      throw new QAppMoqError('INVALID_MOQ_CONFIG');
+    const publicationTrack = Array.isArray(publicationTrackValue)
+      ? publicationTracks
+      : publicationTracks[0];
+    if (
+      (this.sessionsByOwner.get(ownerKey)?.size ?? 0) >=
+        QAPP_MOQ_LIMITS.maxSessionsPerOwner ||
+      this.sessions.size >= QAPP_MOQ_LIMITS.maxSessionsGlobal
+    ) {
+      throw new QAppMoqError('MOQ_SESSION_LIMIT');
+    }
+
+    const sessionId = `qapp-moq-${randomUUID()}`;
+    const generation = 1;
+    const transport = this.transportFactory((event) =>
+      this.handleTransportEvent(sessionId, generation, event)
+    );
+    const session: SessionRecord = {
+      sessionId,
+      ownerKey,
+      owner,
+      rnsConnectionId,
+      state: 'OPENING',
+      transport,
+      subscriptions: new Set(),
+      queuedBytes: 0,
+      publicationTracks,
+      queuedByTrack: new Map(),
+      generation,
+    };
+    this.sessions.set(sessionId, session);
+    const owned = this.sessionsByOwner.get(ownerKey) ?? new Set<string>();
+    owned.add(sessionId);
+    this.sessionsByOwner.set(ownerKey, owned);
+    try {
+      await transport.open({
+        owner,
+        rnsConnectionId,
+        publicationNamespace,
+        publicationTrack,
+      });
+      if (this.sessions.get(sessionId) !== session)
+        throw new QAppMoqError('MOQ_SESSION_CLOSED');
+      session.state = 'OPEN';
+      this.emitState(session, 'OPEN');
+      return {
+        sessionId,
+        state: 'OPEN' as const,
+        publicationNamespace,
+        publicationTrack,
+        limits: QAPP_MOQ_LIMITS,
+      };
+    } catch (error) {
+      this.remove(session);
+      void transport.close().catch(() => undefined);
+      throw normalizeError(error, 'MOQ_SESSION_OPEN_FAILED');
+    }
+  }
+
+  async subscribe(
+    owner: QAppReticulumOwner,
+    sessionIdValue: unknown,
+    subscriptionIdValue: unknown,
+    namespaceValue: unknown,
+    trackNameValue: unknown
+  ) {
+    const session = this.requireOwned(owner, sessionIdValue);
+    const subscriptionId = requireName(
+      subscriptionIdValue,
+      'INVALID_MOQ_SUBSCRIPTION'
+    );
+    const namespace = requireNamespace(
+      namespaceValue,
+      'INVALID_MOQ_SUBSCRIPTION'
+    );
+    const trackName = requireName(trackNameValue, 'INVALID_MOQ_SUBSCRIPTION');
+    if (
+      !session.subscriptions.has(subscriptionId) &&
+      session.subscriptions.size >= QAPP_MOQ_LIMITS.maxSubscriptionsPerSession
+    ) {
+      throw new QAppMoqError('MOQ_SUBSCRIPTION_LIMIT');
+    }
+    try {
+      await session.transport.subscribe(subscriptionId, namespace, trackName);
+      session.subscriptions.add(subscriptionId);
+      return { sessionId: session.sessionId, subscriptionId, subscribed: true };
+    } catch (error) {
+      throw normalizeError(error, 'MOQ_SUBSCRIBE_FAILED');
+    }
+  }
+
+  async publish(
+    owner: QAppReticulumOwner,
+    sessionIdValue: unknown,
+    payloadValue: unknown
+  ) {
+    const session = this.requireOwned(owner, sessionIdValue);
+    const batchRequest =
+      payloadValue &&
+      typeof payloadValue === 'object' &&
+      'objects' in payloadValue
+        ? (payloadValue as {
+            objects: unknown;
+            trackName: unknown;
+            delivery?: unknown;
+          })
+        : null;
+    const track = batchRequest
+      ? requireName(batchRequest.trackName, 'INVALID_MOQ_CONFIG')
+      : session.publicationTracks[0];
+    if (!session.publicationTracks.includes(track))
+      throw new QAppMoqError('INVALID_MOQ_CONFIG');
+    if (
+      batchRequest &&
+      (!Array.isArray(batchRequest.objects) ||
+        !batchRequest.objects.length ||
+        batchRequest.objects.length > QAPP_MOQ_LIMITS.maxBatchObjects)
+    )
+      throw new QAppMoqError('MOQ_OBJECT_TOO_LARGE');
+    const delivery = batchRequest?.delivery as MoqDeliveryPolicy | undefined;
+    const reliable =
+      delivery?.groupId !== undefined || delivery?.objectId !== undefined;
+    if (
+      reliable &&
+      (!Number.isSafeInteger(delivery?.groupId) ||
+        delivery!.groupId! < 0 ||
+        !Number.isSafeInteger(delivery?.objectId) ||
+        delivery!.objectId! < 0 ||
+        !Array.isArray(batchRequest?.objects) ||
+        batchRequest.objects.length !== 1)
+    )
+      throw new QAppMoqError('INVALID_MOQ_CONFIG');
+    const limit = reliable
+      ? QAPP_MOQ_LIMITS.maxReliableObjectBytes
+      : QAPP_MOQ_LIMITS.maxObjectBytes;
+    const objects = batchRequest
+      ? (batchRequest.objects as unknown[]).map((value) =>
+          requirePayload(value, limit)
+        )
+      : [requirePayload(payloadValue)];
+    if (
+      delivery !== undefined &&
+      (!delivery ||
+        typeof delivery !== 'object' ||
+        !Number.isInteger(delivery.priority) ||
+        delivery.priority < 0 ||
+        delivery.priority > 2 ||
+        !Number.isInteger(delivery.maxQueueAgeMillis) ||
+        delivery.maxQueueAgeMillis < 10 ||
+        delivery.maxQueueAgeMillis > 2000)
+    )
+      throw new QAppMoqError('INVALID_MOQ_CONFIG');
+    const bytes = objects.reduce((sum, payload) => sum + payload.byteLength, 0);
+    if (
+      session.queuedBytes + bytes > QAPP_MOQ_LIMITS.maxQueuedBytesPerSession ||
+      (session.queuedByTrack.get(track) ?? 0) + bytes >
+        (reliable
+          ? QAPP_MOQ_LIMITS.maxReliableObjectBytes
+          : QAPP_MOQ_LIMITS.maxQueuedBytesPerTrack)
+    ) {
+      throw new QAppMoqError('MOQ_QUEUE_LIMIT');
+    }
+    session.queuedBytes += bytes;
+    session.queuedByTrack.set(
+      track,
+      (session.queuedByTrack.get(track) ?? 0) + bytes
+    );
+    try {
+      if (batchRequest)
+        await session.transport.publish(objects[0], track, objects, delivery);
+      else await session.transport.publish(objects[0]);
+      return {
+        sessionId: session.sessionId,
+        accepted: true as const,
+        bytes,
+      };
+    } catch (error) {
+      throw normalizeError(error, 'MOQ_SEND_FAILED');
+    } finally {
+      session.queuedBytes = Math.max(0, session.queuedBytes - bytes);
+      session.queuedByTrack.set(
+        track,
+        Math.max(0, (session.queuedByTrack.get(track) ?? 0) - bytes)
+      );
+    }
+  }
+
+  async metrics(owner: QAppReticulumOwner, sessionIdValue: unknown) {
+    const session = this.requireOwned(owner, sessionIdValue);
+    try {
+      return await session.transport.metrics();
+    } catch (error) {
+      throw normalizeError(error, 'MOQ_METRICS_FAILED');
+    }
+  }
+
+  async close(owner: QAppReticulumOwner, sessionIdValue: unknown) {
+    const session = this.requireOwned(owner, sessionIdValue);
+    this.remove(session);
+    try {
+      await session.transport.close();
+    } catch {
+      // The Q-App handle is closed even if native teardown has already happened.
+    }
+    this.emitState(session, 'CLOSED');
+    return { sessionId: session.sessionId, state: 'CLOSED' as const };
+  }
+
+  async cleanupOwner(owner: QAppReticulumOwner): Promise<void> {
+    const ownerKey = validatedOwnerKey(owner);
+    const sessions = [...(this.sessionsByOwner.get(ownerKey) ?? [])]
+      .map((id) => this.sessions.get(id))
+      .filter((session): session is SessionRecord => Boolean(session));
+    await Promise.allSettled(
+      sessions.map((session) => this.terminate(session))
+    );
+  }
+
+  async cleanupRnsConnection(
+    owner: QAppReticulumOwner,
+    rnsConnectionId: string
+  ): Promise<void> {
+    const ownerKey = validatedOwnerKey(owner);
+    const sessions = [...(this.sessionsByOwner.get(ownerKey) ?? [])]
+      .map((id) => this.sessions.get(id))
+      .filter(
+        (session): session is SessionRecord =>
+          Boolean(session) && session?.rnsConnectionId === rnsConnectionId
+      );
+    await Promise.allSettled(
+      sessions.map((session) => this.terminate(session))
+    );
+  }
+
+  destroy(): void {
+    for (const session of this.sessions.values()) {
+      void session.transport.close().catch(() => undefined);
+    }
+    this.sessions.clear();
+    this.sessionsByOwner.clear();
+    this.removeAllListeners();
+  }
+
+  private requireOwned(
+    owner: QAppReticulumOwner,
+    sessionIdValue: unknown
+  ): SessionRecord {
+    const ownerKey = validatedOwnerKey(owner);
+    const sessionId =
+      typeof sessionIdValue === 'string' ? sessionIdValue.trim() : '';
+    if (!sessionId.startsWith('qapp-moq-'))
+      throw new QAppMoqError('INVALID_MOQ_SESSION');
+    const session = this.sessions.get(sessionId);
+    if (!session) throw new QAppMoqError('MOQ_SESSION_CLOSED');
+    if (session.ownerKey !== ownerKey)
+      throw new QAppMoqError('MOQ_SESSION_NOT_OWNED');
+    if (session.state !== 'OPEN') throw new QAppMoqError('MOQ_SESSION_CLOSED');
+    return session;
+  }
+
+  private handleTransportEvent(
+    sessionId: string,
+    generation: number,
+    event: MoqTransportEvent
+  ): void {
+    const session = this.sessions.get(sessionId);
+    if (
+      !session ||
+      session.generation !== generation ||
+      session.state !== 'OPEN'
+    )
+      return;
+    if (event.kind === 'object') {
+      if (
+        !session.subscriptions.has(event.subscriptionId) ||
+        event.payload.byteLength < 1 ||
+        // Native transport already enforces the separate datagram limit.
+        // Incoming events also carry complete reliable subgroup objects.
+        event.payload.byteLength > QAPP_MOQ_LIMITS.maxReliableObjectBytes
+      ) {
+        this.fail(session, 'MOQ_PROTOCOL_MISMATCH');
+        return;
+      }
+      this.emit('event', {
+        ownerKey: session.ownerKey,
+        action: 'MOQ_OBJECT',
+        sessionId,
+        subscriptionId: event.subscriptionId,
+        namespace: [...event.namespace],
+        trackName: event.trackName,
+        groupId: event.groupId,
+        objectId: event.objectId,
+        payload: Uint8Array.from(event.payload),
+      });
+      return;
+    }
+    this.emit('event', {
+      ownerKey: session.ownerKey,
+      action: 'MOQ_ERROR',
+      sessionId,
+      subscriptionId: event.subscriptionId,
+      code: event.code,
+    });
+    if (!event.subscriptionId) this.fail(session, event.code, false);
+  }
+
+  private fail(session: SessionRecord, code: string, emitError = true): void {
+    if (this.sessions.get(session.sessionId) !== session) return;
+    if (emitError) {
+      this.emit('event', {
+        ownerKey: session.ownerKey,
+        action: 'MOQ_ERROR',
+        sessionId: session.sessionId,
+        code,
+      });
+    }
+    this.remove(session);
+    this.emitState(session, 'CLOSED');
+    void session.transport.close().catch(() => undefined);
+  }
+
+  private remove(session: SessionRecord): void {
+    session.state = 'CLOSED';
+    this.sessions.delete(session.sessionId);
+    const owned = this.sessionsByOwner.get(session.ownerKey);
+    owned?.delete(session.sessionId);
+    if (owned?.size === 0) this.sessionsByOwner.delete(session.ownerKey);
+  }
+
+  private async terminate(session: SessionRecord): Promise<void> {
+    if (this.sessions.get(session.sessionId) !== session) return;
+    this.remove(session);
+    await session.transport.close().catch(() => undefined);
+    this.emitState(session, 'CLOSED');
+  }
+
+  private emitState(session: SessionRecord, state: 'OPEN' | 'CLOSED'): void {
+    this.emit('event', {
+      ownerKey: session.ownerKey,
+      action: 'MOQ_STATE',
+      sessionId: session.sessionId,
+      state,
+    });
+  }
+}
+
+function validatedOwnerKey(owner: QAppReticulumOwner): string {
+  try {
+    return privateChannelOwnerKey(owner);
+  } catch {
+    throw new QAppMoqError('PERMISSION_DENIED');
+  }
+}
+
+function requireNonemptyString(value: unknown, code: string): string {
+  const result = typeof value === 'string' ? value.trim() : '';
+  if (!result || result.length > 256) throw new QAppMoqError(code);
+  return result;
+}
+
+function requireName(value: unknown, code: string): string {
+  if (typeof value !== 'string' || !MOQ_NAME.test(value))
+    throw new QAppMoqError(code);
+  return value;
+}
+
+function requireNamespace(value: unknown, code: string): string[] {
+  if (
+    !Array.isArray(value) ||
+    value.length < 1 ||
+    value.length > 8 ||
+    !value.every((component) =>
+      typeof component === 'string' ? MOQ_NAME.test(component) : false
+    ) ||
+    value.reduce<number>((total, component) => total + component.length, 0) >
+      512
+  ) {
+    throw new QAppMoqError(code);
+  }
+  return [...value];
+}
+
+function requirePayload(
+  value: unknown,
+  limit: number = QAPP_MOQ_LIMITS.maxObjectBytes
+): Uint8Array {
+  if (!(value instanceof Uint8Array) && !(value instanceof ArrayBuffer))
+    throw new QAppMoqError('INVALID_MOQ_OBJECT');
+  if (value.byteLength < 1 || value.byteLength > limit) {
+    throw new QAppMoqError('MOQ_OBJECT_TOO_LARGE');
+  }
+  return value instanceof Uint8Array
+    ? Uint8Array.from(value)
+    : new Uint8Array(value.slice(0));
+}
+
+function normalizeError(error: unknown, fallback: string): QAppMoqError {
+  if (error instanceof QAppMoqError) return error;
+  const propertyCode =
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    typeof error.code === 'string' &&
+    /^[A-Z0-9_]{3,64}$/.test(error.code)
+      ? error.code
+      : '';
+  const messageCode =
+    error instanceof Error && /^[A-Z0-9_]{3,64}$/.test(error.message)
+      ? error.message
+      : '';
+  const code = propertyCode || messageCode || fallback;
+  return new QAppMoqError(code);
+}
diff --git a/electron/src/preload.ts b/electron/src/preload.ts
index fef0fde11..c18093f56 100644
--- a/electron/src/preload.ts
+++ b/electron/src/preload.ts
@@ -69,6 +69,46 @@ function parseWindowRoleFromArgv(): string {
   return 'main-shell';
 }
 
+async function invokePrivateChannel(
+  ipcChannel: string,
+  ...args: unknown[]
+): Promise<unknown> {
+  const result = (await ipcRenderer.invoke(ipcChannel, ...args)) as
+    | { ok: true; value: unknown }
+    | { ok: false; error: { code?: string; message?: string } };
+  if (result.ok === true) return result.value;
+  const failure = result as {
+    ok: false;
+    error: { code?: string; message?: string };
+  };
+  const code = failure.error?.code || 'PRIVATE_CHANNEL_ERROR';
+  const error = new Error(failure.error?.message || code) as Error & {
+    code?: string;
+  };
+  error.code = code;
+  throw error;
+}
+
+async function invokeMoqTransport(
+  ipcChannel: string,
+  ...args: unknown[]
+): Promise<unknown> {
+  const result = (await ipcRenderer.invoke(ipcChannel, ...args)) as
+    | { ok: true; value: unknown }
+    | { ok: false; error: { code?: string; message?: string } };
+  if (result.ok === true) return result.value;
+  const failure = result as {
+    ok: false;
+    error: { code?: string; message?: string };
+  };
+  const code = failure.error?.code || 'MOQ_ERROR';
+  const error = new Error(failure.error?.message || code) as Error & {
+    code?: string;
+  };
+  error.code = code;
+  throw error;
+}
+
 const hubP2pBootstrapIceServers = isDisabledLegacy
   ? []
   : buildBootstrapIceServers(parseHubBootstrapSeedsFromArgv());
@@ -449,6 +489,18 @@ try {
       return () => ipcRenderer.removeListener('system:lock-requested', handler);
     },
     getPlatform: () => ipcRenderer.invoke('window:getPlatform'),
+    onDisplayMediaRequest: (callback: (request: { requestId: string; origin: string }) => void) => {
+      const handler = (_event, request) => callback(request);
+      ipcRenderer.on('display-media:request', handler);
+      return () => ipcRenderer.removeListener('display-media:request', handler);
+    },
+    onDisplayMediaCancel: (callback: (requestId: string) => void) => {
+      const handler = (_event, requestId) => callback(requestId);
+      ipcRenderer.on('display-media:cancel', handler);
+      return () => ipcRenderer.removeListener('display-media:cancel', handler);
+    },
+    selectDisplayMedia: (requestId: string, sourceId?: string) => ipcRenderer.send('display-media:select', { requestId, sourceId }),
+    authorizeDisplayMedia: (requestId: string, accepted: boolean) => ipcRenderer.send('display-media:authorize', { requestId, accepted }),
     listScreenShareSources: () =>
       ipcRenderer.invoke('screenShare:listSources') as Promise<{
         success: boolean;
@@ -668,6 +720,105 @@ try {
       ) as Promise<{
         publicKeyBase64: string | null;
       }>,
+    qappReticulumRequest: (owner, options) =>
+      ipcRenderer.invoke('qappReticulum:request', owner, options),
+    qappReticulumConnect: (owner, destination: string) =>
+      ipcRenderer.invoke('qappReticulum:connect', owner, destination),
+    qappReticulumSend: (owner, connectionId: string, payload) =>
+      ipcRenderer.invoke('qappReticulum:send', owner, connectionId, payload),
+    qappReticulumClose: (owner, connectionId: string) =>
+      ipcRenderer.invoke('qappReticulum:close', owner, connectionId),
+    qappReticulumCleanupOwner: (owner) =>
+      ipcRenderer.invoke('qappReticulum:cleanupOwner', owner),
+    qappGuestPrepare: (owner, url: string, isDevMode: boolean) =>
+      ipcRenderer.invoke('qappGuest:prepare', owner, url, isDevMode),
+    qappGuestRelease: (owner) =>
+      ipcRenderer.invoke('qappGuest:release', owner),
+    onQAppReticulumEvent: (callback: (payload: unknown) => void) => {
+      const listener = (_event: Electron.IpcRendererEvent, payload: unknown) =>
+        callback(payload);
+      ipcRenderer.on('qappReticulum:event', listener);
+      return () => ipcRenderer.removeListener('qappReticulum:event', listener);
+    },
+    qappFileSave: (owner, request) => ipcRenderer.invoke('qappFileSave:request', owner, request),
+    privateChannelOpen: (owner, rnsConnectionId, purpose) =>
+      invokePrivateChannel(
+        'privateChannel:open',
+        owner,
+        rnsConnectionId,
+        purpose
+      ),
+    privateChannelSend: (
+      owner,
+      channelId,
+      lane,
+      messageId,
+      data,
+      streamOptions
+    ) =>
+      invokePrivateChannel(
+        'privateChannel:send',
+        owner,
+        channelId,
+        lane,
+        messageId,
+        data,
+        streamOptions
+      ),
+    privateChannelStatus: (owner, channelId) =>
+      invokePrivateChannel('privateChannel:status', owner, channelId),
+    privateChannelClose: (owner, channelId) =>
+      invokePrivateChannel('privateChannel:close', owner, channelId),
+    privateChannelCleanupOwner: (owner) =>
+      invokePrivateChannel('privateChannel:cleanupOwner', owner),
+    onPrivateChannelEvent: (callback: (payload: unknown) => void) => {
+      const listener = (_event: Electron.IpcRendererEvent, payload: unknown) =>
+        callback(payload);
+      ipcRenderer.on('privateChannel:event', listener);
+      return () => ipcRenderer.removeListener('privateChannel:event', listener);
+    },
+    qappMoqOpen: (
+      owner,
+      rnsConnectionId,
+      publicationNamespace,
+      publicationTrack
+    ) =>
+      invokeMoqTransport(
+        'qappMoq:open',
+        owner,
+        rnsConnectionId,
+        publicationNamespace,
+        publicationTrack
+      ),
+    qappMoqSubscribe: (
+      owner,
+      sessionId,
+      subscriptionId,
+      namespace,
+      trackName
+    ) =>
+      invokeMoqTransport(
+        'qappMoq:subscribe',
+        owner,
+        sessionId,
+        subscriptionId,
+        namespace,
+        trackName
+      ),
+    qappMoqPublish: (owner, sessionId, payload) =>
+      invokeMoqTransport('qappMoq:publish', owner, sessionId, payload),
+    qappMoqMetrics: (owner, sessionId) =>
+      invokeMoqTransport('qappMoq:metrics', owner, sessionId),
+    qappMoqClose: (owner, sessionId) =>
+      invokeMoqTransport('qappMoq:close', owner, sessionId),
+    qappMoqCleanupOwner: (owner) =>
+      invokeMoqTransport('qappMoq:cleanupOwner', owner),
+    onQAppMoqEvent: (callback: (payload: unknown) => void) => {
+      const listener = (_event: Electron.IpcRendererEvent, payload: unknown) =>
+        callback(payload);
+      ipcRenderer.on('qappMoq:event', listener);
+      return () => ipcRenderer.removeListener('qappMoq:event', listener);
+    },
     qchatFileSelect: () =>
       ipcRenderer.invoke('reticulum:qchatFileSelect') as Promise<{
         ok: boolean;
@@ -876,6 +1027,22 @@ try {
   });
 
   // Generic persistent store (persistent-store.json, in-memory cache + debounced writes in main)
+  contextBridge.exposeInMainWorld('foreignWalletSigner', {
+    importKeys: (keys: Record<string, unknown>) =>
+      ipcRenderer.invoke('foreignWalletSigner:import', keys),
+    publicKey: (coin: string) =>
+      ipcRenderer.invoke('foreignWalletSigner:publicKey', coin),
+    clear: () => ipcRenderer.invoke('foreignWalletSigner:clear'),
+    sign: (request: unknown, language: string) =>
+      ipcRenderer.invoke('foreignWalletSigner:sign', request, language),
+  });
+  contextBridge.exposeInMainWorld('foreignWalletJournal', {
+    get: (key: string) => ipcRenderer.invoke('foreignWalletJournal:get', key),
+    set: (key: string, value: string) =>
+      ipcRenderer.invoke('foreignWalletJournal:set', key, value),
+    delete: (key: string, txId: string) =>
+      ipcRenderer.invoke('foreignWalletJournal:delete', key, txId),
+  });
   contextBridge.exposeInMainWorld('appStorage', {
     get: async (key) => {
       return ipcRenderer.invoke('persistentStore:get', key);
diff --git a/electron/src/private-channel-bootstrap.ts b/electron/src/private-channel-bootstrap.ts
new file mode 100644
index 000000000..8e2493458
--- /dev/null
+++ b/electron/src/private-channel-bootstrap.ts
@@ -0,0 +1,190 @@
+import { createHash, randomBytes } from 'crypto';
+import net from 'net';
+import {
+  PrivateChannelError,
+  type PrivateTransportContext,
+} from './private-channel-manager';
+import {
+  QAppReticulumManager,
+  type QAppReticulumOwner,
+} from './qapp-reticulum-manager';
+
+export const PRIVATE_BOOTSTRAP_VERSION = 1;
+export const PRIVATE_BOOTSTRAP_TRANSPORT = 'quic-masque-inner-v1';
+export const PRIVATE_BOOTSTRAP_PATH = '/qortal/private-transport/bootstrap/v1';
+
+export type PrivateBootstrapDescriptor = Readonly<{
+  version: 1;
+  transport: 'quic-masque-inner-v1';
+  logicalSessionId: string;
+  backendRnsDestination: string;
+  backendTransportEndpoint: string;
+  backendTransportServerName: string;
+  backendTransportCertSha256: string;
+  attachToken: string;
+  expiresAt: number;
+  nonce: string;
+  ownerBindingHash: string;
+  applicationProtocol?: string;
+  supportedFeatures: {
+    reliable: true;
+    datagrams: true;
+    moqt?: boolean;
+    moqtReliableGroups?: boolean;
+  };
+}>;
+
+export interface PrivateChannelBootstrapProvider {
+  getBootstrap(
+    context: PrivateTransportContext
+  ): Promise<PrivateBootstrapDescriptor>;
+}
+
+export class ReticulumPrivateChannelBootstrapProvider implements PrivateChannelBootstrapProvider {
+  private readonly consumedNonces = new Set<string>();
+
+  constructor(private readonly manager: QAppReticulumManager) {}
+
+  async getBootstrap(
+    context: PrivateTransportContext
+  ): Promise<PrivateBootstrapDescriptor> {
+    const destination = this.manager.connectionDestination(
+      context.owner,
+      context.rnsConnectionId
+    );
+    const nonce = randomBytes(24).toString('base64url');
+    let value: unknown;
+    try {
+      value = await this.manager.request(context.owner, {
+        destination,
+        path: PRIVATE_BOOTSTRAP_PATH,
+        payload: {
+          version: PRIVATE_BOOTSTRAP_VERSION,
+          transport: PRIVATE_BOOTSTRAP_TRANSPORT,
+          nonce,
+          purpose: context.purpose,
+        },
+        timeoutMs: 15_000,
+        maxResponseBytes: 16 * 1024,
+        connectionId: context.rnsConnectionId,
+      });
+    } catch {
+      throw new PrivateChannelError('BOOTSTRAP_FAILED');
+    }
+    return validatePrivateBootstrapDescriptor(value, {
+      context,
+      authenticatedRnsDestination: destination,
+      requestNonce: nonce,
+      consumedNonces: this.consumedNonces,
+    });
+  }
+}
+
+export function validatePrivateBootstrapDescriptor(
+  value: unknown,
+  expected: {
+    context: PrivateTransportContext;
+    authenticatedRnsDestination: string;
+    requestNonce: string;
+    consumedNonces: Set<string>;
+    now?: number;
+  }
+): PrivateBootstrapDescriptor {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new PrivateChannelError('BOOTSTRAP_FAILED');
+  }
+  const d = value as Record<string, unknown>;
+  if (d.error && typeof d.error === 'object') {
+    if ((d.error as { code?: unknown }).code === 'transport_already_attached')
+      throw new PrivateChannelError('TRANSPORT_ALREADY_ATTACHED');
+    throw new PrivateChannelError('BOOTSTRAP_FAILED');
+  }
+  if (d.version !== PRIVATE_BOOTSTRAP_VERSION) {
+    throw new PrivateChannelError('PROTOCOL_MISMATCH');
+  }
+  if (d.transport !== PRIVATE_BOOTSTRAP_TRANSPORT) {
+    throw new PrivateChannelError('UNSUPPORTED_TRANSPORT');
+  }
+  const now = expected.now ?? Date.now();
+  if (
+    typeof d.expiresAt !== 'number' ||
+    !Number.isSafeInteger(d.expiresAt) ||
+    d.expiresAt <= now ||
+    d.expiresAt > now + 5 * 60_000
+  )
+    throw new PrivateChannelError('BOOTSTRAP_EXPIRED');
+  if (
+    d.backendRnsDestination !== expected.authenticatedRnsDestination ||
+    d.nonce !== expected.requestNonce
+  )
+    throw new PrivateChannelError('BOOTSTRAP_BINDING_MISMATCH');
+  if (expected.consumedNonces.has(expected.requestNonce)) {
+    throw new PrivateChannelError('BOOTSTRAP_REUSED');
+  }
+  for (const key of [
+    'logicalSessionId',
+    'backendTransportServerName',
+    'attachToken',
+  ] as const) {
+    if (
+      typeof d[key] !== 'string' ||
+      !(d[key] as string).trim() ||
+      (d[key] as string).length > 512
+    ) {
+      throw new PrivateChannelError('BOOTSTRAP_FAILED');
+    }
+  }
+  const expectedOwnerBinding = privateBootstrapOwnerBindingHash(
+    expected.context.owner,
+    expected.context.rnsConnectionId,
+    expected.authenticatedRnsDestination,
+    d.logicalSessionId as string,
+    expected.requestNonce,
+    expected.context.purpose
+  );
+  if (d.ownerBindingHash !== expectedOwnerBinding) {
+    throw new PrivateChannelError('BOOTSTRAP_BINDING_MISMATCH');
+  }
+  if (
+    typeof d.backendTransportEndpoint !== 'string' ||
+    !isLiteralEndpoint(d.backendTransportEndpoint) ||
+    typeof d.backendTransportCertSha256 !== 'string' ||
+    !/^[a-f0-9]{64}$/.test(d.backendTransportCertSha256) ||
+    !d.supportedFeatures ||
+    typeof d.supportedFeatures !== 'object' ||
+    (d.supportedFeatures as Record<string, unknown>).reliable !== true ||
+    (d.supportedFeatures as Record<string, unknown>).datagrams !== true
+  )
+    throw new PrivateChannelError('BOOTSTRAP_FAILED');
+  expected.consumedNonces.add(expected.requestNonce);
+  while (expected.consumedNonces.size > 4096) {
+    const oldest = expected.consumedNonces.values().next().value;
+    if (typeof oldest !== 'string') break;
+    expected.consumedNonces.delete(oldest);
+  }
+  return d as unknown as PrivateBootstrapDescriptor;
+}
+
+export function privateBootstrapOwnerBindingHash(
+  owner: QAppReticulumOwner,
+  rnsConnectionId: string,
+  destination: string,
+  logicalSessionId: string,
+  nonce: string,
+  purpose: string
+): string {
+  return createHash('sha256')
+    .update(
+      `qortal-private-owner-v2\0${owner.name}\0${owner.service}\0${rnsConnectionId}\0${destination}\0${logicalSessionId}\0${nonce}\0${purpose}`
+    )
+    .digest('hex');
+}
+
+function isLiteralEndpoint(value: string): boolean {
+  const match = value.startsWith('[')
+    ? /^\[([^\]]+)\]:(\d+)$/.exec(value)
+    : /^([^:]+):(\d+)$/.exec(value);
+  if (!match) return false;
+  const port = Number(match[2]);
+  return net.isIP(match[1]) !== 0 && port >= 1 && port <= 65535;
+}
diff --git a/electron/src/private-channel-manager.test.ts b/electron/src/private-channel-manager.test.ts
new file mode 100644
index 000000000..846e68973
--- /dev/null
+++ b/electron/src/private-channel-manager.test.ts
@@ -0,0 +1,382 @@
+import { describe, expect, it, vi } from 'vitest';
+import {
+  MockPrivateTransport,
+  PRIVATE_CHANNEL_LIMITS,
+  PrivateChannelManager,
+  type PrivateTransport,
+  type PrivateTransportContext,
+  type PrivateTransportEvent,
+  type PrivateTransportMessage,
+} from './private-channel-manager';
+import type {
+  QAppReticulumConnectionOwnership,
+  QAppReticulumOwner,
+} from './qapp-reticulum-manager';
+
+const alice: QAppReticulumOwner = {
+  tabId: 'tab-a',
+  name: 'alice-app',
+  service: 'APP',
+};
+const bob: QAppReticulumOwner = {
+  tabId: 'tab-b',
+  name: 'bob-app',
+  service: 'APP',
+};
+const aliceRns = 'rns-alice';
+const bobRns = 'rns-bob';
+
+function ownership(
+  owner: QAppReticulumOwner,
+  connectionId: string
+): QAppReticulumConnectionOwnership {
+  if (connectionId === aliceRns) {
+    return owner.tabId === alice.tabId ? 'owned' : 'not-owned';
+  }
+  if (connectionId === bobRns) {
+    return owner.tabId === bob.tabId ? 'owned' : 'not-owned';
+  }
+  return 'missing';
+}
+
+class BlockingTransport implements PrivateTransport {
+  releases: Array<() => void> = [];
+  open = vi.fn(async (_context: PrivateTransportContext) => undefined);
+  close = vi.fn(async () => undefined);
+  sendReliable = vi.fn((_message: PrivateTransportMessage) => this.block());
+  sendDatagram = vi.fn((_message: PrivateTransportMessage) => this.block());
+
+  private block(): Promise<void> {
+    return new Promise((resolve) => this.releases.push(resolve));
+  }
+}
+
+describe('PrivateChannelManager', () => {
+  it('bounds binary bulk independently and leaves control capacity available', async () => {
+    const transport = new BlockingTransport();
+    const manager = new PrivateChannelManager(ownership, () => transport);
+    const channel = await manager.open(alice, aliceRns, 'file-transfer');
+    const payload = new Uint8Array(700 * 1024);
+    const sends = [0, 1].map((i) =>
+      manager.send(
+        alice,
+        channel.channelId,
+        'reliable',
+        `large-${i}`,
+        payload,
+        { streamKey: 'bulk' }
+      )
+    );
+    await expect(
+      manager.send(alice, channel.channelId, 'reliable', 'overflow', payload, {
+        streamKey: 'bulk',
+      })
+    ).rejects.toMatchObject({ code: 'QUEUE_LIMIT_REACHED' });
+    const control = manager.send(
+      alice,
+      channel.channelId,
+      'reliable',
+      'control',
+      { ping: true },
+      { streamKey: 'control' }
+    );
+    expect(transport.sendReliable).toHaveBeenCalledTimes(3);
+    transport.releases.splice(0).forEach((release) => release());
+    await Promise.all([...sends, control]);
+    const retry = manager.send(
+      alice,
+      channel.channelId,
+      'reliable',
+      'retry',
+      payload,
+      { streamKey: 'bulk' }
+    );
+    transport.releases.splice(0).forEach((release) => release());
+    await retry;
+    await manager.close(alice, channel.channelId);
+  });
+  it('bounds one stream without consuming the control stream queue and validates options', async () => {
+    const transport = new BlockingTransport();
+    const manager = new PrivateChannelManager(ownership, () => transport);
+    const channel = await manager.open(alice, aliceRns, 'file-transfer');
+    await expect(
+      manager.send(
+        alice,
+        channel.channelId,
+        'reliable',
+        'invalid',
+        {},
+        { streamKey: '../bad' }
+      )
+    ).rejects.toMatchObject({ code: 'INVALID_STREAM_OPTIONS' });
+    const sends = [0, 1, 2].map((i) =>
+      manager.send(
+        alice,
+        channel.channelId,
+        'reliable',
+        `bulk-${i}`,
+        new Uint8Array(64 * 1024),
+        { streamKey: 'bulk' }
+      )
+    );
+    await expect(
+      manager.send(
+        alice,
+        channel.channelId,
+        'reliable',
+        'overflow',
+        new Uint8Array(1),
+        { streamKey: 'bulk' }
+      )
+    ).rejects.toMatchObject({ code: 'QUEUE_LIMIT_REACHED' });
+    const control = manager.send(
+      alice,
+      channel.channelId,
+      'reliable',
+      'control',
+      { ping: true },
+      { streamKey: 'control' }
+    );
+    expect(transport.sendReliable).toHaveBeenLastCalledWith(
+      expect.objectContaining({ streamKey: 'control' })
+    );
+    transport.releases.forEach((release) => release());
+    await Promise.all([...sends, control]);
+  });
+  it('opens an owner-scoped mock channel with an opaque unique handle', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    const first = await manager.open(alice, aliceRns, 'game');
+    const second = await manager.open(alice, aliceRns, 'realtime');
+
+    expect(first).toMatchObject({ state: 'OPEN', purpose: 'game' });
+    expect(first.channelId).toMatch(/^private-[0-9a-f-]{36}$/);
+    expect(second.channelId).not.toBe(first.channelId);
+    expect(first).not.toHaveProperty('rnsConnectionId');
+    expect(first).not.toHaveProperty('destination');
+  });
+
+  it('rejects missing and cross-owner Reticulum connections', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    await expect(manager.open(alice, 'missing', 'game')).rejects.toMatchObject({
+      code: 'INVALID_RNS_CONNECTION',
+    });
+    await expect(manager.open(bob, aliceRns, 'game')).rejects.toMatchObject({
+      code: 'RNS_CONNECTION_NOT_OWNED',
+    });
+  });
+
+  it('validates purpose and canonical owner identity', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    await expect(manager.open(alice, aliceRns, 'video')).rejects.toMatchObject({
+      code: 'INVALID_PURPOSE',
+    });
+    await expect(
+      manager.open({ ...alice, name: 'Alice-App' }, aliceRns, 'game')
+    ).rejects.toMatchObject({ code: 'PERMISSION_DENIED' });
+  });
+
+  it('prevents another Q-App from using or closing a channel', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    const { channelId } = await manager.open(alice, aliceRns, 'game');
+    await expect(
+      manager.send(bob, channelId, 'reliable', '1', 'hello')
+    ).rejects.toMatchObject({ code: 'CHANNEL_NOT_OWNED' });
+    await expect(manager.close(bob, channelId)).rejects.toMatchObject({
+      code: 'CHANNEL_NOT_OWNED',
+    });
+  });
+
+  it('echoes binary-friendly mock messages only to the owning event key', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    const listener = vi.fn();
+    manager.on('event', listener);
+    const { channelId } = await manager.open(alice, aliceRns, 'realtime');
+    listener.mockClear();
+    const data = new Uint8Array([1, 2, 3]);
+
+    await manager.send(alice, channelId, 'datagram', 'message-1', data);
+
+    expect(listener).toHaveBeenCalledWith({
+      ownerKey: 'tab-a\u0000APP\u0000alice-app',
+      channelId,
+      action: 'PRIVATE_CHANNEL_MESSAGE',
+      lane: 'datagram',
+      messageId: 'message-1',
+      data,
+    });
+  });
+
+  it('enforces per-owner and global channel limits', async () => {
+    const manager = new PrivateChannelManager(() => 'owned');
+    for (
+      let index = 0;
+      index < PRIVATE_CHANNEL_LIMITS.maxChannelsPerOwner;
+      index += 1
+    ) {
+      await manager.open(alice, aliceRns, 'game');
+    }
+    await expect(manager.open(alice, aliceRns, 'game')).rejects.toMatchObject({
+      code: 'CHANNEL_LIMIT_REACHED',
+    });
+
+    const globalManager = new PrivateChannelManager(() => 'owned');
+    for (
+      let index = 0;
+      index < PRIVATE_CHANNEL_LIMITS.maxChannelsGlobal;
+      index += 1
+    ) {
+      await globalManager.open(
+        { tabId: `tab-${index}`, name: `app-${index}`, service: 'APP' },
+        `rns-${index}`,
+        'game'
+      );
+    }
+    await expect(
+      globalManager.open(
+        { tabId: 'overflow', name: 'overflow', service: 'APP' },
+        'rns-overflow',
+        'game'
+      )
+    ).rejects.toMatchObject({ code: 'CHANNEL_LIMIT_REACHED' });
+  });
+
+  it('rejects oversized messages', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    const { channelId } = await manager.open(alice, aliceRns, 'game');
+    await expect(
+      manager.send(
+        alice,
+        channelId,
+        'reliable',
+        'large',
+        new Uint8Array(PRIVATE_CHANNEL_LIMITS.maxBinaryMessageBytes + 1)
+      )
+    ).rejects.toMatchObject({ code: 'MESSAGE_TOO_LARGE' });
+  });
+
+  it('rejects values outside the bounded JSON or binary message model', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    const { channelId } = await manager.open(alice, aliceRns, 'game');
+    await expect(
+      manager.send(alice, channelId, 'reliable', 'map', new Map([['x', 1]]))
+    ).rejects.toMatchObject({ code: 'INVALID_MESSAGE' });
+    await expect(
+      manager.send(alice, channelId, 'reliable', 'infinite', {
+        value: Number.POSITIVE_INFINITY,
+      })
+    ).rejects.toMatchObject({ code: 'INVALID_MESSAGE' });
+  });
+
+  it('enforces channel and owner queued-byte limits while sends are pending', async () => {
+    const transports: BlockingTransport[] = [];
+    const manager = new PrivateChannelManager(ownership, () => {
+      const transport = new BlockingTransport();
+      transports.push(transport);
+      return transport;
+    });
+    const first = await manager.open(alice, aliceRns, 'game');
+    const second = await manager.open(alice, aliceRns, 'realtime');
+    const payload = new Uint8Array(PRIVATE_CHANNEL_LIMITS.maxMessageBytes);
+    const pending: Array<Promise<unknown>> = [];
+
+    for (let index = 0; index < 4; index += 1) {
+      pending.push(
+        manager.send(alice, first.channelId, 'reliable', `a-${index}`, payload)
+      );
+    }
+    await expect(
+      manager.send(
+        alice,
+        first.channelId,
+        'reliable',
+        'channel-overflow',
+        payload
+      )
+    ).rejects.toMatchObject({ code: 'QUEUE_LIMIT_REACHED' });
+
+    for (let index = 0; index < 4; index += 1) {
+      pending.push(
+        manager.send(alice, second.channelId, 'reliable', `b-${index}`, payload)
+      );
+    }
+    const third = await manager.open(alice, aliceRns, 'file-transfer');
+    await expect(
+      manager.send(
+        alice,
+        third.channelId,
+        'reliable',
+        'owner-overflow',
+        payload
+      )
+    ).rejects.toMatchObject({ code: 'QUEUE_LIMIT_REACHED' });
+
+    for (const transport of transports) {
+      for (const release of transport.releases) release();
+    }
+    await Promise.all(pending);
+  });
+
+  it('invalidates closed handles and makes close idempotent', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    const { channelId } = await manager.open(alice, aliceRns, 'game');
+    await expect(manager.close(alice, channelId)).resolves.toEqual({
+      channelId,
+      state: 'CLOSED',
+    });
+    await expect(manager.close(alice, channelId)).resolves.toEqual({
+      channelId,
+      state: 'CLOSED',
+    });
+    expect(manager.status(alice, channelId).state).toBe('CLOSED');
+    await expect(
+      manager.send(alice, channelId, 'reliable', 'after-close', 'x')
+    ).rejects.toMatchObject({ code: 'CHANNEL_CLOSED' });
+  });
+
+  it('cleans all channels for an owner without affecting another owner', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    const first = await manager.open(alice, aliceRns, 'game');
+    const second = await manager.open(alice, aliceRns, 'realtime');
+    const other = await manager.open(bob, bobRns, 'game');
+    await manager.cleanupOwner(alice);
+
+    expect(manager.status(alice, first.channelId).state).toBe('CLOSED');
+    expect(manager.status(alice, second.channelId).state).toBe('CLOSED');
+    expect(manager.status(bob, other.channelId).state).toBe('OPEN');
+  });
+
+  it('closes channels when their Reticulum control connection closes', async () => {
+    const manager = new PrivateChannelManager(ownership);
+    const first = await manager.open(alice, aliceRns, 'game');
+    const second = await manager.open(alice, aliceRns, 'realtime');
+    const other = await manager.open(bob, bobRns, 'game');
+
+    await manager.cleanupRnsConnection(alice, aliceRns);
+
+    expect(manager.status(alice, first.channelId).state).toBe('CLOSED');
+    expect(manager.status(alice, second.channelId).state).toBe('CLOSED');
+    expect(manager.status(bob, other.channelId).state).toBe('OPEN');
+  });
+
+  it('drops late transport events after channel cleanup', async () => {
+    let emit: ((event: PrivateTransportEvent) => void) | undefined;
+    const manager = new PrivateChannelManager(ownership, (listener) => {
+      emit = listener;
+      return new MockPrivateTransport(listener);
+    });
+    const listener = vi.fn();
+    manager.on('event', listener);
+    const { channelId } = await manager.open(alice, aliceRns, 'game');
+    await manager.cleanupOwner(alice);
+    listener.mockClear();
+
+    emit?.({
+      kind: 'message',
+      lane: 'reliable',
+      messageId: 'late',
+      data: 'ignored',
+    });
+    expect(listener).not.toHaveBeenCalled();
+    expect(() => manager.status(alice, channelId)).not.toThrow();
+  });
+});
diff --git a/electron/src/private-channel-manager.ts b/electron/src/private-channel-manager.ts
new file mode 100644
index 000000000..9a13f7660
--- /dev/null
+++ b/electron/src/private-channel-manager.ts
@@ -0,0 +1,619 @@
+import { EventEmitter } from 'events';
+import { randomUUID } from 'crypto';
+import type {
+  QAppReticulumConnectionOwnership,
+  QAppReticulumOwner,
+} from './qapp-reticulum-manager';
+
+export type PrivateChannelPurpose = 'game' | 'file-transfer' | 'realtime';
+export type PrivateChannelLane = 'reliable' | 'datagram';
+export type PrivateChannelState = 'OPENING' | 'OPEN' | 'CLOSING' | 'CLOSED';
+
+export const PRIVATE_CHANNEL_LIMITS = Object.freeze({
+  // Logical channels are intentionally scarce until a real transport exists.
+  maxChannelsPerOwner: 4,
+  maxChannelsGlobal: 32,
+  // JSON stays small; opaque binary messages have separate keyed-stream budgets.
+  maxMessageBytes: 64 * 1024,
+  maxBinaryMessageBytes: 1024 * 1024 - 1,
+  maxQueuedBytesPerChannel: 256 * 1024,
+  maxQueuedBytesPerOwner: 512 * 1024,
+});
+
+export const PRIVATE_CHANNEL_FEATURES = Object.freeze({
+  reliableStreams: true,
+  reliableMessages: true,
+  datagrams: true,
+  maxMessageBytes: PRIVATE_CHANNEL_LIMITS.maxMessageBytes,
+  maxBinaryMessageBytes: PRIVATE_CHANNEL_LIMITS.maxBinaryMessageBytes,
+});
+
+export class PrivateChannelError extends Error {
+  constructor(
+    public readonly code: string,
+    message = code
+  ) {
+    super(message);
+  }
+}
+
+export type PrivateTransportMessage = {
+  streamKey?: string;
+  endStream?: boolean;
+  lane: PrivateChannelLane;
+  messageId: string;
+  data: unknown;
+};
+
+export type PrivateTransportEvent =
+  | ({ kind: 'message' } & PrivateTransportMessage)
+  | { kind: 'error'; code: string; message?: string };
+
+export type PrivateTransportContext = {
+  channelId: string;
+  rnsConnectionId: string;
+  purpose: PrivateChannelPurpose;
+  generation: number;
+  owner: QAppReticulumOwner;
+};
+
+/** Transport-neutral seam for the future native QUIC/MASQUE implementation. */
+export interface PrivateTransport {
+  open(context: PrivateTransportContext): Promise<void>;
+  sendReliable(message: PrivateTransportMessage): Promise<void>;
+  sendDatagram(message: PrivateTransportMessage): Promise<void>;
+  close(): Promise<void>;
+}
+
+export type PrivateTransportFactory = (
+  emit: (event: PrivateTransportEvent) => void
+) => PrivateTransport;
+
+/** Step-1 transport: acknowledges sends by echoing them back in memory. */
+export class MockPrivateTransport implements PrivateTransport {
+  private openState = false;
+
+  constructor(private readonly emit: (event: PrivateTransportEvent) => void) {}
+
+  async open(_context: PrivateTransportContext): Promise<void> {
+    this.openState = true;
+  }
+
+  async sendReliable(message: PrivateTransportMessage): Promise<void> {
+    this.send(message);
+  }
+
+  async sendDatagram(message: PrivateTransportMessage): Promise<void> {
+    this.send(message);
+  }
+
+  async close(): Promise<void> {
+    this.openState = false;
+  }
+
+  private send(message: PrivateTransportMessage): void {
+    if (!this.openState) throw new PrivateChannelError('CHANNEL_CLOSED');
+    this.emit({ kind: 'message', ...message });
+  }
+}
+
+type ChannelRecord = {
+  channelId: string;
+  ownerKey: string;
+  rnsConnectionId: string;
+  purpose: PrivateChannelPurpose;
+  state: PrivateChannelState;
+  createdAt: number;
+  queuedBytes: number;
+  generation: number;
+  transport: PrivateTransport;
+};
+
+type ClosedChannel = { ownerKey: string; purpose: PrivateChannelPurpose };
+
+const VALID_PURPOSES = new Set<PrivateChannelPurpose>([
+  'game',
+  'file-transfer',
+  'realtime',
+]);
+const VALID_LANES = new Set<PrivateChannelLane>(['reliable', 'datagram']);
+const MAX_MESSAGE_ID_LENGTH = 128;
+const MAX_CLOSED_CHANNEL_TOMBSTONES = 256;
+
+export function privateChannelOwnerKey(owner: QAppReticulumOwner): string {
+  if (
+    !owner ||
+    typeof owner.tabId !== 'string' ||
+    !owner.tabId ||
+    owner.tabId.length > 128 ||
+    typeof owner.name !== 'string' ||
+    !owner.name ||
+    owner.name.length > 128 ||
+    owner.name !== owner.name.trim().toLowerCase() ||
+    typeof owner.service !== 'string' ||
+    owner.service !== owner.service.trim().toUpperCase() ||
+    !/^[A-Z0-9_]{1,32}$/.test(owner.service)
+  ) {
+    throw new PrivateChannelError('PERMISSION_DENIED');
+  }
+  return `${owner.tabId}\u0000${owner.service}\u0000${owner.name}`;
+}
+
+function byteLength(data: unknown): number {
+  if (typeof data === 'string') return Buffer.byteLength(data, 'utf8');
+  if (data instanceof ArrayBuffer) return data.byteLength;
+  if (ArrayBuffer.isView(data)) return data.byteLength;
+  if (
+    typeof SharedArrayBuffer !== 'undefined' &&
+    data instanceof SharedArrayBuffer
+  ) {
+    throw new PrivateChannelError('INVALID_MESSAGE');
+  }
+  try {
+    validateJsonValue(data, new WeakSet<object>(), 0);
+    const serialized = JSON.stringify(data ?? null);
+    if (serialized === undefined) throw new Error('not serializable');
+    return Buffer.byteLength(serialized, 'utf8');
+  } catch {
+    throw new PrivateChannelError('INVALID_MESSAGE');
+  }
+}
+
+function validateJsonValue(
+  value: unknown,
+  ancestors: WeakSet<object>,
+  depth: number
+): void {
+  if (
+    value === null ||
+    typeof value === 'string' ||
+    typeof value === 'boolean' ||
+    (typeof value === 'number' && Number.isFinite(value))
+  ) {
+    return;
+  }
+  if (depth >= 32 || typeof value !== 'object') {
+    throw new PrivateChannelError('INVALID_MESSAGE');
+  }
+  const object = value as object;
+  const prototype = Object.getPrototypeOf(object);
+  if (!Array.isArray(object) && prototype !== Object.prototype) {
+    throw new PrivateChannelError('INVALID_MESSAGE');
+  }
+  if (ancestors.has(object)) throw new PrivateChannelError('INVALID_MESSAGE');
+  ancestors.add(object);
+  const children = Array.isArray(object)
+    ? object
+    : Object.values(object as Record<string, unknown>);
+  for (const child of children) {
+    validateJsonValue(child, ancestors, depth + 1);
+  }
+  ancestors.delete(object);
+}
+
+export class PrivateChannelManager extends EventEmitter {
+  private readonly queuedBytesByStream = new Map<string, number>();
+  private readonly bulkQueued = new Map<string, number>();
+  private readonly channels = new Map<string, ChannelRecord>();
+  private readonly channelsByOwner = new Map<string, Set<string>>();
+  private readonly queuedBytesByOwner = new Map<string, number>();
+  private readonly closedChannels = new Map<string, ClosedChannel>();
+
+  constructor(
+    private readonly getRnsConnectionOwnership: (
+      owner: QAppReticulumOwner,
+      connectionId: string
+    ) => QAppReticulumConnectionOwnership,
+    private readonly transportFactory: PrivateTransportFactory = (emit) =>
+      new MockPrivateTransport(emit)
+  ) {
+    super();
+  }
+
+  async open(
+    owner: QAppReticulumOwner,
+    rnsConnectionIdValue: unknown,
+    purposeValue: unknown
+  ) {
+    const key = privateChannelOwnerKey(owner);
+    const rnsConnectionId =
+      typeof rnsConnectionIdValue === 'string'
+        ? rnsConnectionIdValue.trim()
+        : '';
+    if (!rnsConnectionId) {
+      throw new PrivateChannelError('INVALID_RNS_CONNECTION');
+    }
+    const ownership = this.getRnsConnectionOwnership(owner, rnsConnectionId);
+    if (ownership === 'missing') {
+      throw new PrivateChannelError('INVALID_RNS_CONNECTION');
+    }
+    if (ownership !== 'owned') {
+      throw new PrivateChannelError('RNS_CONNECTION_NOT_OWNED');
+    }
+    if (
+      typeof purposeValue !== 'string' ||
+      !VALID_PURPOSES.has(purposeValue as PrivateChannelPurpose)
+    ) {
+      throw new PrivateChannelError('INVALID_PURPOSE');
+    }
+    if (
+      (this.channelsByOwner.get(key)?.size ?? 0) >=
+        PRIVATE_CHANNEL_LIMITS.maxChannelsPerOwner ||
+      this.channels.size >= PRIVATE_CHANNEL_LIMITS.maxChannelsGlobal
+    ) {
+      throw new PrivateChannelError('CHANNEL_LIMIT_REACHED');
+    }
+
+    const purpose = purposeValue as PrivateChannelPurpose;
+    const channelId = `private-${randomUUID()}`;
+    const generation = 1;
+    const transport = this.transportFactory((event) =>
+      this.handleTransportEvent(channelId, generation, event)
+    );
+    const channel: ChannelRecord = {
+      channelId,
+      ownerKey: key,
+      rnsConnectionId,
+      purpose,
+      state: 'OPENING',
+      createdAt: Date.now(),
+      queuedBytes: 0,
+      generation,
+      transport,
+    };
+    this.channels.set(channelId, channel);
+    const owned = this.channelsByOwner.get(key) ?? new Set<string>();
+    owned.add(channelId);
+    this.channelsByOwner.set(key, owned);
+
+    try {
+      await transport.open({
+        channelId,
+        rnsConnectionId,
+        purpose,
+        generation,
+        owner,
+      });
+      if (
+        this.channels.get(channelId) !== channel ||
+        channel.state !== 'OPENING'
+      ) {
+        throw new PrivateChannelError('CHANNEL_CLOSED');
+      }
+      channel.state = 'OPEN';
+      this.emitState(channel, 'OPEN');
+      return this.safeStatus(channel);
+    } catch (error) {
+      this.removeChannel(channel);
+      void transport.close().catch(() => undefined);
+      if (error instanceof PrivateChannelError) throw error;
+      throw new PrivateChannelError('CHANNEL_OPEN_FAILED');
+    }
+  }
+
+  async send(
+    owner: QAppReticulumOwner,
+    channelIdValue: unknown,
+    laneValue: unknown,
+    messageIdValue: unknown,
+    data: unknown,
+    streamOptions?: unknown
+  ): Promise<{ channelId: string; messageId: string; accepted: true }> {
+    const channelId = this.validateChannelId(channelIdValue);
+    const channel = this.requireOwned(owner, channelId, true);
+    if (channel.state !== 'OPEN') {
+      throw new PrivateChannelError('CHANNEL_CLOSED');
+    }
+    if (
+      typeof laneValue !== 'string' ||
+      !VALID_LANES.has(laneValue as PrivateChannelLane)
+    ) {
+      throw new PrivateChannelError('INVALID_LANE');
+    }
+    const messageId =
+      typeof messageIdValue === 'string' ? messageIdValue.trim() : '';
+    if (!messageId || messageId.length > MAX_MESSAGE_ID_LENGTH) {
+      throw new PrivateChannelError('INVALID_MESSAGE_ID');
+    }
+    const size = byteLength(data);
+    const largeBinary =
+      size > PRIVATE_CHANNEL_LIMITS.maxMessageBytes &&
+      (data instanceof ArrayBuffer || ArrayBuffer.isView(data)) &&
+      laneValue === 'reliable';
+    if (
+      size >
+      (largeBinary
+        ? PRIVATE_CHANNEL_LIMITS.maxBinaryMessageBytes
+        : PRIVATE_CHANNEL_LIMITS.maxMessageBytes)
+    ) {
+      throw new PrivateChannelError('MESSAGE_TOO_LARGE');
+    }
+    const ownerQueued = this.queuedBytesByOwner.get(channel.ownerKey) ?? 0;
+    if (
+      !largeBinary &&
+      (channel.queuedBytes + size >
+        PRIVATE_CHANNEL_LIMITS.maxQueuedBytesPerChannel ||
+        ownerQueued + size > PRIVATE_CHANNEL_LIMITS.maxQueuedBytesPerOwner)
+    ) {
+      throw new PrivateChannelError('QUEUE_LIMIT_REACHED');
+    }
+
+    const lane = laneValue as PrivateChannelLane;
+    let streamKey: string | undefined;
+    let endStream: boolean | undefined;
+    if (streamOptions !== undefined) {
+      const o = streamOptions as { streamKey?: unknown; endStream?: unknown };
+      if (
+        !o ||
+        typeof o !== 'object' ||
+        Array.isArray(o) ||
+        lane !== 'reliable' ||
+        typeof o.streamKey !== 'string' ||
+        !/^[A-Za-z0-9._-]{1,96}$/.test(o.streamKey) ||
+        (o.endStream !== undefined && typeof o.endStream !== 'boolean')
+      )
+        throw new PrivateChannelError('INVALID_STREAM_OPTIONS');
+      streamKey = o.streamKey;
+      endStream = o.endStream === true;
+    }
+    const message = { lane, messageId, data, streamKey, endStream };
+    if (largeBinary) {
+      if (!streamKey) throw new PrivateChannelError('INVALID_STREAM_OPTIONS');
+      const budgets: Array<[string, number]> = [
+        ['global', 32 * 1024 * 1024],
+        [`owner:${channel.ownerKey}`, 8 * 1024 * 1024],
+        [`channel:${channelId}`, 4 * 1024 * 1024],
+        [`stream:${channelId}:${streamKey}`, 2 * 1024 * 1024],
+      ];
+      if (
+        budgets.some(
+          ([key, limit]) => (this.bulkQueued.get(key) ?? 0) + size > limit
+        )
+      )
+        throw new PrivateChannelError('QUEUE_LIMIT_REACHED');
+      for (const [key] of budgets)
+        this.bulkQueued.set(key, (this.bulkQueued.get(key) ?? 0) + size);
+      try {
+        await channel.transport.sendReliable(message);
+        return { channelId, messageId, accepted: true };
+      } catch (error) {
+        if (error instanceof PrivateChannelError) throw error;
+        throw new PrivateChannelError('CHANNEL_SEND_FAILED');
+      } finally {
+        for (const [key] of budgets) {
+          const left = (this.bulkQueued.get(key) ?? 0) - size;
+          if (left > 0) this.bulkQueued.set(key, left);
+          else this.bulkQueued.delete(key);
+        }
+      }
+    }
+    const queueKey = `${channelId}\0${streamKey ?? ''}`;
+    const streamBytes = this.queuedBytesByStream.get(queueKey) ?? 0;
+    if (streamKey && streamBytes + size > 192 * 1024)
+      throw new PrivateChannelError('QUEUE_LIMIT_REACHED');
+    this.queuedBytesByStream.set(queueKey, streamBytes + size);
+    channel.queuedBytes += size;
+    this.queuedBytesByOwner.set(channel.ownerKey, ownerQueued + size);
+    try {
+      if (lane === 'reliable') await channel.transport.sendReliable(message);
+      else await channel.transport.sendDatagram(message);
+      return { channelId, messageId, accepted: true };
+    } catch (error) {
+      if (error instanceof PrivateChannelError) throw error;
+      throw new PrivateChannelError('CHANNEL_SEND_FAILED');
+    } finally {
+      const remainingStream = Math.max(
+        0,
+        (this.queuedBytesByStream.get(queueKey) ?? 0) - size
+      );
+      if (remainingStream)
+        this.queuedBytesByStream.set(queueKey, remainingStream);
+      else this.queuedBytesByStream.delete(queueKey);
+      channel.queuedBytes = Math.max(0, channel.queuedBytes - size);
+      const remaining = Math.max(
+        0,
+        (this.queuedBytesByOwner.get(channel.ownerKey) ?? 0) - size
+      );
+      if (remaining === 0) this.queuedBytesByOwner.delete(channel.ownerKey);
+      else this.queuedBytesByOwner.set(channel.ownerKey, remaining);
+    }
+  }
+
+  status(owner: QAppReticulumOwner, channelIdValue: unknown) {
+    const channelId = this.validateChannelId(channelIdValue);
+    const channel = this.requireOwned(owner, channelId, false);
+    if (channel) return this.safeStatus(channel);
+    const closed = this.closedChannels.get(channelId)!;
+    return {
+      channelId,
+      state: 'CLOSED' as const,
+      purpose: closed.purpose,
+      features: PRIVATE_CHANNEL_FEATURES,
+      queuedBytes: 0,
+    };
+  }
+
+  async close(owner: QAppReticulumOwner, channelIdValue: unknown) {
+    const channelId = this.validateChannelId(channelIdValue);
+    const channel = this.requireOwned(owner, channelId, false);
+    if (!channel) {
+      return { channelId, state: 'CLOSED' as const };
+    }
+    channel.state = 'CLOSING';
+    this.emitState(channel, 'CLOSING');
+    this.removeChannel(channel);
+    this.rememberClosed(channel);
+    try {
+      await channel.transport.close();
+    } catch {
+      // The logical handle is invalid even if transport teardown fails.
+    }
+    this.emitState(channel, 'CLOSED');
+    return { channelId, state: 'CLOSED' as const };
+  }
+
+  async cleanupOwner(owner: QAppReticulumOwner): Promise<void> {
+    const key = privateChannelOwnerKey(owner);
+    const ids = [...(this.channelsByOwner.get(key) ?? [])];
+    await Promise.allSettled(ids.map((id) => this.close(owner, id)));
+  }
+
+  async cleanupRnsConnection(
+    owner: QAppReticulumOwner,
+    rnsConnectionId: string
+  ): Promise<void> {
+    const key = privateChannelOwnerKey(owner);
+    const ids = [...(this.channelsByOwner.get(key) ?? [])].filter(
+      (id) => this.channels.get(id)?.rnsConnectionId === rnsConnectionId
+    );
+    await Promise.allSettled(ids.map((id) => this.close(owner, id)));
+  }
+
+  destroy(): void {
+    for (const channel of this.channels.values()) {
+      channel.state = 'CLOSED';
+      void channel.transport.close().catch(() => undefined);
+    }
+    this.channels.clear();
+    this.channelsByOwner.clear();
+    this.queuedBytesByOwner.clear();
+    this.closedChannels.clear();
+    this.removeAllListeners();
+  }
+
+  private handleTransportEvent(
+    channelId: string,
+    generation: number,
+    event: PrivateTransportEvent
+  ): void {
+    const channel = this.channels.get(channelId);
+    if (
+      !channel ||
+      channel.state !== 'OPEN' ||
+      channel.generation !== generation
+    ) {
+      return;
+    }
+    if (event.kind === 'message') {
+      let size: number;
+      try {
+        size = byteLength(event.data);
+      } catch {
+        this.failTransport(channel);
+        return;
+      }
+      if (
+        size >
+          (event.lane === 'reliable' &&
+          (event.data instanceof ArrayBuffer || ArrayBuffer.isView(event.data))
+            ? PRIVATE_CHANNEL_LIMITS.maxBinaryMessageBytes
+            : PRIVATE_CHANNEL_LIMITS.maxMessageBytes) ||
+        !VALID_LANES.has(event.lane) ||
+        !event.messageId ||
+        event.messageId.length > MAX_MESSAGE_ID_LENGTH
+      ) {
+        this.failTransport(channel);
+        return;
+      }
+      this.emit('event', {
+        ownerKey: channel.ownerKey,
+        channelId,
+        action: 'PRIVATE_CHANNEL_MESSAGE',
+        lane: event.lane,
+        messageId: event.messageId,
+        data: event.data,
+      });
+      return;
+    }
+    this.failTransport(channel);
+  }
+
+  private emitTransportError(channel: ChannelRecord): void {
+    this.emit('event', {
+      ownerKey: channel.ownerKey,
+      channelId: channel.channelId,
+      action: 'PRIVATE_CHANNEL_ERROR',
+      code: 'TRANSPORT_ERROR',
+      message: 'Private channel transport error',
+    });
+  }
+
+  private failTransport(channel: ChannelRecord): void {
+    if (this.channels.get(channel.channelId) !== channel) return;
+    this.emitTransportError(channel);
+    channel.state = 'CLOSED';
+    this.removeChannel(channel);
+    this.rememberClosed(channel);
+    this.emitState(channel, 'CLOSED');
+    void channel.transport.close().catch(() => undefined);
+  }
+
+  private requireOwned(
+    owner: QAppReticulumOwner,
+    channelId: string,
+    rejectClosed: boolean
+  ): ChannelRecord | undefined {
+    const key = privateChannelOwnerKey(owner);
+    const channel = this.channels.get(channelId);
+    if (channel) {
+      if (channel.ownerKey !== key) {
+        throw new PrivateChannelError('CHANNEL_NOT_OWNED');
+      }
+      return channel;
+    }
+    const closed = this.closedChannels.get(channelId);
+    if (closed) {
+      if (closed.ownerKey !== key) {
+        throw new PrivateChannelError('CHANNEL_NOT_OWNED');
+      }
+      if (rejectClosed) throw new PrivateChannelError('CHANNEL_CLOSED');
+      return undefined;
+    }
+    throw new PrivateChannelError('INVALID_CHANNEL');
+  }
+
+  private validateChannelId(value: unknown): string {
+    if (typeof value !== 'string' || !value.startsWith('private-')) {
+      throw new PrivateChannelError('INVALID_CHANNEL');
+    }
+    return value;
+  }
+
+  private safeStatus(channel: ChannelRecord) {
+    return {
+      channelId: channel.channelId,
+      state: channel.state,
+      purpose: channel.purpose,
+      features: PRIVATE_CHANNEL_FEATURES,
+      queuedBytes: channel.queuedBytes,
+    };
+  }
+
+  private emitState(channel: ChannelRecord, state: PrivateChannelState): void {
+    this.emit('event', {
+      ownerKey: channel.ownerKey,
+      channelId: channel.channelId,
+      action: 'PRIVATE_CHANNEL_STATE',
+      state,
+    });
+  }
+
+  private removeChannel(channel: ChannelRecord): void {
+    this.channels.delete(channel.channelId);
+    const owned = this.channelsByOwner.get(channel.ownerKey);
+    owned?.delete(channel.channelId);
+    if (owned?.size === 0) this.channelsByOwner.delete(channel.ownerKey);
+  }
+
+  private rememberClosed(channel: ChannelRecord): void {
+    this.closedChannels.set(channel.channelId, {
+      ownerKey: channel.ownerKey,
+      purpose: channel.purpose,
+    });
+    while (this.closedChannels.size > MAX_CLOSED_CHANNEL_TOMBSTONES) {
+      const oldest = this.closedChannels.keys().next().value;
+      if (typeof oldest !== 'string') break;
+      this.closedChannels.delete(oldest);
+    }
+  }
+}
diff --git a/electron/src/private-channel-step3.test.ts b/electron/src/private-channel-step3.test.ts
new file mode 100644
index 000000000..0a021a154
--- /dev/null
+++ b/electron/src/private-channel-step3.test.ts
@@ -0,0 +1,761 @@
+import {
+  spawn,
+  spawnSync,
+  type ChildProcessWithoutNullStreams,
+} from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import dgram from 'node:dgram';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import {
+  PrivateChannelManager,
+  type PrivateTransportContext,
+} from './private-channel-manager';
+import {
+  privateBootstrapOwnerBindingHash,
+  validatePrivateBootstrapDescriptor,
+  type PrivateBootstrapDescriptor,
+  type PrivateChannelBootstrapProvider,
+} from './private-channel-bootstrap';
+import {
+  PrivateTransportSidecar,
+  type PrivateSessionConfig,
+  type PrivateTransportSidecarEvent,
+} from './private-transport-sidecar';
+import { QuicMasqueTransport } from './quic-masque-transport';
+
+type Startup = PrivateSessionConfig & {
+  expiresAt: number;
+  backendRnsDestination: string;
+  transport: 'quic-masque-inner-v1';
+};
+type Stats = {
+  receiveBuffers: Record<string, number>;
+  backendSource: string;
+  relayEgress: string;
+  reliableCount: number;
+  datagramCount: number;
+  tokenUsed: boolean;
+};
+
+const goBinary = process.env.QORTAL_GO_BINARY || 'go';
+const goAvailable =
+  spawnSync(goBinary, ['version'], { windowsHide: true }).status === 0;
+const integration = goAvailable ? describe.sequential : describe.skip;
+let tempDir = '';
+let sidecarBinary = '';
+let fixtureBinary = '';
+
+class Fixture {
+  readonly child: ChildProcessWithoutNullStreams;
+  private buffer = '';
+  private lines: string[] = [];
+  private waiters: Array<(line: string) => void> = [];
+  constructor(wrongAlpn = false, bulk = false, ackOnly = false) {
+    this.child = spawn(fixtureBinary, [], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      env: {
+        ...process.env,
+        QORTAL_STEP3_TEST_WRONG_ALPN: wrongAlpn ? '1' : '0',
+        QORTAL_STEP3_TEST_BULK: bulk ? '1' : '0',
+        QORTAL_STEP3_TEST_ACK_ONLY: ackOnly ? '1' : '0',
+      },
+    });
+    this.child.stdout.setEncoding('utf8');
+    this.child.stderr.resume();
+    this.child.stdout.on('data', (chunk: string) => {
+      this.buffer += chunk;
+      for (;;) {
+        const nl = this.buffer.indexOf('\n');
+        if (nl < 0) return;
+        const line = this.buffer.slice(0, nl);
+        this.buffer = this.buffer.slice(nl + 1);
+        const waiter = this.waiters.shift();
+        if (waiter) waiter(line);
+        else this.lines.push(line);
+      }
+    });
+  }
+  next<T>(): Promise<T> {
+    const line = this.lines.shift();
+    if (line !== undefined) return Promise.resolve(JSON.parse(line));
+    return new Promise((resolve) =>
+      this.waiters.push((value) => resolve(JSON.parse(value)))
+    );
+  }
+  async command<T>(operation: string): Promise<T> {
+    this.child.stdin.write(`${JSON.stringify({ operation })}\n`);
+    return this.next<T>();
+  }
+  async close() {
+    if (this.child.exitCode !== null) return;
+    await this.command('shutdown').catch(() => undefined);
+    this.child.kill();
+  }
+}
+
+integration('Step 3 inner QUIC through MASQUE', () => {
+  it.runIf(process.env.QORTAL_BULK_BENCH === '1').each([0, 60])(
+    'diagnoses binary upload over MASQUE with %i ms one-way simulated delay',
+    async (delay) => {
+      const fixture = new Fixture(false, true, true);
+      const config = await fixture.next<Startup>();
+      const targetPort = Number(config.relayAddress.split(':').at(-1));
+      const proxy = dgram.createSocket('udp4');
+      await new Promise<void>((r) => proxy.bind(0, '127.0.0.1', r));
+      proxy.setRecvBufferSize(8 * 1024 * 1024);
+      let clientPort = 0,
+        dropped = 0,
+        next = 0,
+        acknowledgements = 0;
+      const timers = new Set<ReturnType<typeof setTimeout>>();
+      proxy.on('message', (data, peer) => {
+        const fromRelay = peer.port === targetPort;
+        if (!fromRelay) clientPort = peer.port;
+        const port = fromRelay ? clientPort : targetPort;
+        if (!port || timers.size >= 8192) {
+          dropped++;
+          return;
+        }
+        const timer = setTimeout(() => {
+          timers.delete(timer);
+          proxy.send(data, port, '127.0.0.1');
+        }, delay);
+        timers.add(timer);
+      });
+      const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+      let realtimeTimer: ReturnType<typeof setInterval> | undefined;
+      try {
+        await sidecar.start();
+        const opened = await sidecar.openPrivateSession({
+          ...sessionConfig(config),
+          relayAddress: `127.0.0.1:${(proxy.address() as import('node:net').AddressInfo).port}`,
+        });
+        const count = process.env.QORTAL_BULK_BENCH_LARGE === '1' ? 256 : 64,
+          payload = Buffer.alloc(524886, 42);
+        let resolveAll!: () => void;
+        const all = new Promise<void>((r) => {
+          resolveAll = r;
+        });
+        const realtimePending = new Map<string, number>();
+        const realtimeRtts: number[] = [];
+        let realtimeSent = 0;
+        sidecar.on('event', (e: PrivateTransportSidecarEvent) => {
+          const sent = realtimePending.get(e.messageId);
+          if (sent !== undefined) {
+            realtimeRtts.push(performance.now() - sent);
+            realtimePending.delete(e.messageId);
+          }
+          if (
+            e.sessionId === opened.sessionId &&
+            e.event === 'reliableMessage' &&
+            ++acknowledgements === count
+          )
+            resolveAll();
+        });
+        const start = performance.now();
+        realtimeTimer = setInterval(() => {
+          for (const [id, at] of realtimePending)
+            if (performance.now() - at > 2000) realtimePending.delete(id);
+          if (realtimePending.size >= 64) return;
+          const id = `live-${realtimeSent++}`;
+          realtimePending.set(id, performance.now());
+          void sidecar
+            .sendPrivateDatagram(opened.sessionId, id, Buffer.alloc(160))
+            .catch(() => realtimePending.delete(id));
+        }, 20);
+        await Promise.all(
+          Array.from({ length: 2 }, async () => {
+            while (next < count) {
+              const i = next++;
+              await sidecar.sendPrivateReliable(
+                opened.sessionId,
+                `bench-${i}`,
+                payload,
+                'bulk'
+              );
+            }
+          })
+        );
+        await all;
+        clearInterval(realtimeTimer);
+        const seconds = (performance.now() - start) / 1000;
+        await new Promise((r) => setTimeout(r, 400));
+        realtimeRtts.sort((a, b) => a - b);
+        const p95 = realtimeRtts[Math.floor(realtimeRtts.length * 0.95)];
+        console.info('[BulkPathBenchmark]', {
+          delay,
+          bytes: count * payload.length,
+          seconds,
+          proxyDrops: dropped,
+          receiveBuffers: (await fixture.command<Stats>('stats'))
+            .receiveBuffers,
+          realtimeSent,
+          realtimeReceived: realtimeRtts.length,
+          realtimeP95Millis: p95,
+          metrics: await sidecar.sessionMetrics(opened.sessionId),
+        });
+        expect(dropped).toBe(0);
+        expect(acknowledgements).toBe(count);
+        expect(realtimeRtts.length).toBeGreaterThan(0);
+        expect(realtimeRtts.length / realtimeSent).toBeGreaterThanOrEqual(0.95);
+        expect(p95).toBeLessThan(500);
+      } finally {
+        clearInterval(realtimeTimer);
+        await sidecar.shutdown();
+        timers.forEach(clearTimeout);
+        proxy.close();
+        await fixture.close();
+      }
+    },
+    120000
+  );
+  beforeAll(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hub-step3-test-'));
+    sidecarBinary = path.join(tempDir, 'sidecar');
+    fixtureBinary = path.join(tempDir, 'fixture');
+    const root = path.join(
+      process.cwd(),
+      'electron',
+      'native',
+      'private-transport'
+    );
+    for (const [output, pkg] of [
+      [sidecarBinary, './cmd/qortal-private-transport'],
+      [fixtureBinary, './cmd/qortal-private-transport-step3-fixture'],
+    ]) {
+      const result = spawnSync(
+        goBinary,
+        ['build', '-trimpath', '-o', output, pkg],
+        { cwd: root, encoding: 'utf8' }
+      );
+      if (result.status !== 0)
+        throw new Error(result.stderr || result.error?.message);
+    }
+  }, 60_000);
+  afterAll(() => {
+    if (tempDir) fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it('establishes, attaches, and carries ordered streams plus QUIC datagrams', async () => {
+    const fixture = new Fixture();
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    const started = Date.now();
+    const opened = await sidecar.openPrivateSession(sessionConfig(config));
+    const handshakeMs = Date.now() - started;
+    const events: PrivateTransportSidecarEvent[] = [];
+    const received = new Promise<void>((resolve) =>
+      sidecar.on('event', (event: PrivateTransportSidecarEvent) => {
+        if (event.sessionId === opened.sessionId) {
+          events.push(event);
+          if (events.length === 3) resolve();
+        }
+      })
+    );
+    const rttStart = Date.now();
+    await Promise.all([
+      sidecar.sendPrivateReliable(
+        opened.sessionId,
+        'r1',
+        Buffer.from('reliable-one')
+      ),
+      sidecar.sendPrivateReliable(
+        opened.sessionId,
+        'r2',
+        Buffer.from('reliable-two')
+      ),
+      sidecar.sendPrivateDatagram(
+        opened.sessionId,
+        'd1',
+        Buffer.from('datagram-one')
+      ),
+    ]);
+    await received;
+    const applicationRttMs = Date.now() - rttStart;
+    expect(
+      events
+        .filter((e) => e.event === 'reliableMessage')
+        .map((e) => e.messageId)
+    ).toEqual(['r1', 'r2']);
+    expect(events.find((e) => e.messageId === 'r1')?.data.toString()).toBe(
+      'reliable-one'
+    );
+    expect(events.find((e) => e.messageId === 'd1')?.event).toBe('datagram');
+    const stats = await fixture.command<Stats>('stats');
+    expect(stats.backendSource).toBe(stats.relayEgress);
+    expect(stats.tokenUsed).toBe(true);
+    const metrics = await sidecar.sessionMetrics(opened.sessionId);
+    expect(metrics.bytesSent).toBeGreaterThan(0);
+    expect(metrics.bytesReceived).toBeGreaterThan(0);
+    expect({
+      handshakeMs,
+      applicationRttMs,
+      innerRttMs: metrics.innerRttMillis,
+    }).toEqual(
+      expect.objectContaining({
+        handshakeMs: expect.any(Number),
+        applicationRttMs: expect.any(Number),
+        innerRttMs: expect.any(Number),
+      })
+    );
+    await sidecar.closePrivateSession(opened.sessionId);
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+
+  it('carries a large opaque binary message through IPC and MASQUE on a keyed stream', async () => {
+    const fixture = new Fixture(false, true);
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    try {
+      await sidecar.start();
+      const opened = await sidecar.openPrivateSession(sessionConfig(config));
+      const payload = Buffer.alloc(525000);
+      for (let i = 0; i < payload.length; i++) payload[i] = i % 251;
+      const received = new Promise<PrivateTransportSidecarEvent>((resolve) => {
+        sidecar.on('event', (event: PrivateTransportSidecarEvent) => {
+          if (
+            event.sessionId === opened.sessionId &&
+            event.messageId === 'bulk'
+          )
+            resolve(event);
+        });
+      });
+      await sidecar.sendPrivateReliable(
+        opened.sessionId,
+        'bulk',
+        payload,
+        'opaque-bulk',
+        true
+      );
+      expect((await received).data.equals(payload)).toBe(true);
+      const stats = await fixture.command<Stats>('stats');
+      expect(stats.backendSource).toBe(stats.relayEgress);
+      expect(stats.reliableCount).toBe(1);
+      const metrics = await sidecar.sessionMetrics(opened.sessionId);
+      expect(metrics.innerPacketsSent).toBeGreaterThan(0);
+      expect(metrics.outerPacketsSent).toBeGreaterThan(0);
+      expect(metrics.innerWireBytesSent).toBeGreaterThan(payload.length);
+      expect(metrics.outerWireBytesSent).toBeGreaterThan(payload.length);
+      expect(metrics.tunnelWrites).toBeGreaterThan(0);
+      expect(metrics.tunnelWriteMicros).toBeGreaterThan(0);
+      expect(metrics.tunnelWriteErrors).toBe(0);
+      expect(metrics.innerPacketsLost).toBeGreaterThanOrEqual(0);
+      expect(metrics.outerPacketsLost).toBeGreaterThanOrEqual(0);
+    } finally {
+      await sidecar.shutdown();
+      await fixture.close();
+    }
+  }, 20_000);
+
+  it('fails closed on backend identity mismatch before attach', async () => {
+    const fixture = new Fixture();
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    await expect(
+      sidecar.openPrivateSession({
+        ...sessionConfig(config),
+        backendCertSha256: '00'.repeat(32),
+      })
+    ).rejects.toMatchObject({ code: 'BACKEND_IDENTITY_MISMATCH' });
+    expect((await fixture.command<Stats>('stats')).tokenUsed).toBe(false);
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+  it('rejects a wrong attach token and a reused valid token', async () => {
+    const fixture = new Fixture();
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    await expect(
+      sidecar.openPrivateSession({
+        ...sessionConfig(config),
+        attachToken: 'wrong-token',
+      })
+    ).rejects.toMatchObject({ code: 'ATTACH_TOKEN_REJECTED' });
+    const opened = await sidecar.openPrivateSession(sessionConfig(config));
+    await sidecar.closePrivateSession(opened.sessionId);
+    await expect(
+      sidecar.openPrivateSession(sessionConfig(config))
+    ).rejects.toMatchObject({ code: 'ATTACH_TOKEN_REJECTED' });
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+  it('rejects unsupported ALPN', async () => {
+    const fixture = new Fixture(true);
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    await expect(
+      sidecar.openPrivateSession(sessionConfig(config))
+    ).rejects.toMatchObject({ code: 'INNER_QUIC_FAILED' });
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+  it('keeps reliable delivery working when an application datagram is dropped', async () => {
+    const fixture = new Fixture();
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    const opened = await sidecar.openPrivateSession(sessionConfig(config));
+    await fixture.command('dropNextDatagram');
+    const reliable = new Promise<PrivateTransportSidecarEvent>((resolve) =>
+      sidecar.on('event', (e: PrivateTransportSidecarEvent) => {
+        if (e.messageId === 'survives') resolve(e);
+      })
+    );
+    await sidecar.sendPrivateDatagram(
+      opened.sessionId,
+      'lost',
+      Buffer.from('drop-me')
+    );
+    await sidecar.sendPrivateReliable(
+      opened.sessionId,
+      'survives',
+      Buffer.from('still-reliable')
+    );
+    expect((await reliable).data.toString()).toBe('still-reliable');
+    await expect(
+      sidecar.sendPrivateDatagram(
+        opened.sessionId,
+        'oversized',
+        Buffer.alloc(1025)
+      )
+    ).rejects.toMatchObject({ code: 'FRAME_TOO_LARGE' });
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+
+  it('maps the transport through opaque PrivateChannelManager handles', async () => {
+    const fixture = new Fixture();
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    const descriptor = descriptorFrom(config);
+    const provider: PrivateChannelBootstrapProvider = {
+      getBootstrap: async () => descriptor,
+    };
+    const manager = new PrivateChannelManager(
+      () => 'owned',
+      (emit) => new QuicMasqueTransport(emit, sidecar, config, provider)
+    );
+    const owner = { tabId: 'tab-step3', name: 'test-app', service: 'APP' };
+    const opened = await manager.open(owner, 'rns-owned', 'realtime');
+    expect(opened.channelId).toMatch(/^private-/);
+    const messages: unknown[] = [];
+    manager.on('event', (event) => {
+      if (event.action === 'PRIVATE_CHANNEL_MESSAGE') messages.push(event);
+    });
+    await Promise.all([
+      manager.send(owner, opened.channelId, 'reliable', 'm1', {
+        lane: 'reliable',
+      }),
+      manager.send(owner, opened.channelId, 'datagram', 'm2', {
+        lane: 'datagram',
+      }),
+    ]);
+    for (let i = 0; i < 50 && messages.length < 2; i++)
+      await new Promise((r) => setTimeout(r, 20));
+    expect(messages).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ messageId: 'm1', lane: 'reliable' }),
+        expect.objectContaining({ messageId: 'm2', lane: 'datagram' }),
+      ])
+    );
+    await manager.close(owner, opened.channelId);
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+
+  it('closes the affected logical channel when the sidecar dies', async () => {
+    const fixture = new Fixture();
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    const provider: PrivateChannelBootstrapProvider = {
+      getBootstrap: async () => descriptorFrom(config),
+    };
+    const manager = new PrivateChannelManager(
+      () => 'owned',
+      (emit) => new QuicMasqueTransport(emit, sidecar, config, provider)
+    );
+    const owner = { tabId: 'tab-death', name: 'test-app', service: 'APP' };
+    const opened = await manager.open(owner, 'rns-owned', 'realtime');
+    const closed = new Promise<void>((resolve) =>
+      manager.on('event', (event) => {
+        if (
+          event.channelId === opened.channelId &&
+          event.action === 'PRIVATE_CHANNEL_STATE' &&
+          event.state === 'CLOSED'
+        )
+          resolve();
+      })
+    );
+    sidecar.terminateForTest();
+    await closed;
+    expect(manager.status(owner, opened.channelId).state).toBe('CLOSED');
+    await fixture.close();
+  }, 20_000);
+
+  it('fails the active connection when the relay dies without a direct fallback', async () => {
+    const fixture = new Fixture();
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    const opened = await sidecar.openPrivateSession(sessionConfig(config));
+    const failed = new Promise<PrivateTransportSidecarEvent>((resolve) =>
+      sidecar.on('event', (event: PrivateTransportSidecarEvent) => {
+        if (event.sessionId === opened.sessionId && event.event === 'error')
+          resolve(event);
+      })
+    );
+    await fixture.command('stopRelay');
+    expect(
+      (
+        (await Promise.race([
+          failed,
+          new Promise((_, reject) =>
+            setTimeout(() => reject(new Error('relay death timeout')), 3000)
+          ),
+        ])) as PrivateTransportSidecarEvent
+      ).code
+    ).toBeTruthy();
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+
+  it('propagates backend death as a clean transport error', async () => {
+    const fixture = new Fixture();
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    const opened = await sidecar.openPrivateSession(sessionConfig(config));
+    const failed = new Promise<PrivateTransportSidecarEvent>((resolve) =>
+      sidecar.on('event', (event: PrivateTransportSidecarEvent) => {
+        if (event.sessionId === opened.sessionId && event.event === 'error')
+          resolve(event);
+      })
+    );
+    await fixture.command('stopBackend');
+    expect(
+      (
+        (await Promise.race([
+          failed,
+          new Promise((_, reject) =>
+            setTimeout(() => reject(new Error('backend death timeout')), 3000)
+          ),
+        ])) as PrivateTransportSidecarEvent
+      ).code
+    ).toBeTruthy();
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+
+  it('runs a bounded local small-message sanity diagnostic', async () => {
+    const fixture = new Fixture();
+    const config = await fixture.next<Startup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    const start = Date.now();
+    const opened = await sidecar.openPrivateSession(sessionConfig(config));
+    const handshakeMs = Date.now() - start;
+    const waitForEcho = (
+      messageId: string,
+      lane: PrivateTransportSidecarEvent['event']
+    ) =>
+      new Promise<void>((resolve) => {
+        const handler = (event: PrivateTransportSidecarEvent) => {
+          if (
+            event.sessionId === opened.sessionId &&
+            event.messageId === messageId &&
+            event.event === lane
+          ) {
+            sidecar.off('event', handler);
+            resolve();
+          }
+        };
+        sidecar.on('event', handler);
+      });
+    const reliableEcho = waitForEcho('diagnostic-reliable', 'reliableMessage');
+    const reliableStart = performance.now();
+    await sidecar.sendPrivateReliable(
+      opened.sessionId,
+      'diagnostic-reliable',
+      Buffer.from('ping')
+    );
+    await reliableEcho;
+    const reliableRttMs = performance.now() - reliableStart;
+    const datagramEcho = waitForEcho('diagnostic-datagram', 'datagram');
+    const datagramStart = performance.now();
+    await sidecar.sendPrivateDatagram(
+      opened.sessionId,
+      'diagnostic-datagram',
+      Buffer.from('ping')
+    );
+    await datagramEcho;
+    const datagramRttMs = performance.now() - datagramStart;
+    let received = 0;
+    const done = new Promise<void>((resolve) =>
+      sidecar.on('event', (event: PrivateTransportSidecarEvent) => {
+        if (
+          event.sessionId === opened.sessionId &&
+          event.event === 'reliableMessage' &&
+          ++received === 100
+        )
+          resolve();
+      })
+    );
+    const cpuStart = process.cpuUsage();
+    const heapStart = process.memoryUsage().heapUsed;
+    const sendStart = Date.now();
+    // This is a bounded throughput sanity check, not a queue-overflow test.
+    // Sending 100 simultaneous IPC requests races the native admission cap.
+    for (let start = 0; start < 100; start += 8) {
+      await Promise.all(
+        Array.from({ length: Math.min(8, 100 - start) }, (_, i) =>
+          sidecar.sendPrivateReliable(
+            opened.sessionId,
+            `bench-${start + i}`,
+            Buffer.from('small-message')
+          )
+        )
+      );
+    }
+    await done;
+    const elapsedMs = Date.now() - sendStart;
+    const cpu = process.cpuUsage(cpuStart);
+    const heapDelta = process.memoryUsage().heapUsed - heapStart;
+    console.info('[Step3Sanity]', {
+      handshakeMs,
+      reliableRttMs: Number(reliableRttMs.toFixed(2)),
+      datagramRttMs: Number(datagramRttMs.toFixed(2)),
+      messages: 100,
+      elapsedMs,
+      messagesPerSecond: Math.round(100000 / Math.max(1, elapsedMs)),
+      parentCpuMs: Math.round((cpu.user + cpu.system) / 1000),
+      parentHeapDeltaBytes: heapDelta,
+    });
+    expect(received).toBe(100);
+    expect(elapsedMs).toBeLessThan(10_000);
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+});
+
+function descriptorFrom(config: Startup): PrivateBootstrapDescriptor {
+  return {
+    version: 1,
+    transport: 'quic-masque-inner-v1',
+    logicalSessionId: config.logicalSessionId,
+    backendRnsDestination: config.backendRnsDestination,
+    backendTransportEndpoint: config.backendAddress,
+    backendTransportServerName: config.backendServerName,
+    backendTransportCertSha256: config.backendCertSha256,
+    attachToken: config.attachToken,
+    expiresAt: config.expiresAt,
+    nonce: config.nonce,
+    ownerBindingHash: config.ownerBindingHash,
+    supportedFeatures: { reliable: true, datagrams: true },
+  };
+}
+function sessionConfig(config: Startup): PrivateSessionConfig {
+  return {
+    relayAddress: config.relayAddress,
+    relayServerName: config.relayServerName,
+    relayCertSha256: config.relayCertSha256,
+    backendAddress: config.backendAddress,
+    backendServerName: config.backendServerName,
+    backendCertSha256: config.backendCertSha256,
+    logicalSessionId: config.logicalSessionId,
+    attachToken: config.attachToken,
+    nonce: config.nonce,
+    purpose: config.purpose,
+    ownerBindingHash: config.ownerBindingHash,
+  };
+}
+
+describe('private bootstrap validation', () => {
+  const owner = { tabId: 'tab', name: 'app', service: 'APP' };
+  const context = {
+    channelId: 'private-test',
+    rnsConnectionId: 'rns-test',
+    purpose: 'realtime',
+    generation: 1,
+    owner,
+  } satisfies PrivateTransportContext;
+  const destination = '0123456789abcdef0123456789abcdef';
+  const nonce = 'nonce';
+  const binding = privateBootstrapOwnerBindingHash(
+    owner,
+    'rns-test',
+    destination,
+    'logical',
+    nonce,
+    'realtime'
+  );
+  const base = {
+    version: 1,
+    transport: 'quic-masque-inner-v1',
+    logicalSessionId: 'logical',
+    backendRnsDestination: destination,
+    backendTransportEndpoint: '127.0.0.1:9000',
+    backendTransportServerName: 'backend',
+    backendTransportCertSha256: 'ab'.repeat(32),
+    attachToken: 'token',
+    expiresAt: 2000,
+    nonce,
+    ownerBindingHash: binding,
+    supportedFeatures: { reliable: true, datagrams: true },
+  };
+  const validate = (value: unknown, used = new Set<string>()) =>
+    validatePrivateBootstrapDescriptor(value, {
+      context,
+      authenticatedRnsDestination: destination,
+      requestNonce: nonce,
+      consumedNonces: used,
+      now: 1000,
+    });
+  it('accepts a bound descriptor and rejects expiry', () => {
+    expect(validate(base).logicalSessionId).toBe('logical');
+    expect(() => validate({ ...base, expiresAt: 999 })).toThrowError(
+      expect.objectContaining({ code: 'BOOTSTRAP_EXPIRED' })
+    );
+  });
+  it('reports a duplicate attachment explicitly but sanitizes unknown backend errors', () => {
+    expect(() =>
+      validate({ error: { code: 'transport_already_attached' } })
+    ).toThrowError(
+      expect.objectContaining({ code: 'TRANSPORT_ALREADY_ATTACHED' })
+    );
+    expect(() =>
+      validate({ error: { code: 'untrusted backend text' } })
+    ).toThrowError(expect.objectContaining({ code: 'BOOTSTRAP_FAILED' }));
+  });
+  it('rejects wrong RNS/owner binding and reuse', () => {
+    expect(() =>
+      validate({ ...base, backendRnsDestination: 'f'.repeat(32) })
+    ).toThrowError(
+      expect.objectContaining({ code: 'BOOTSTRAP_BINDING_MISMATCH' })
+    );
+    expect(() =>
+      validate({ ...base, ownerBindingHash: '0'.repeat(64) })
+    ).toThrowError(
+      expect.objectContaining({ code: 'BOOTSTRAP_BINDING_MISMATCH' })
+    );
+    const used = new Set<string>();
+    validate(base, used);
+    expect(() => validate(base, used)).toThrowError(
+      expect.objectContaining({ code: 'BOOTSTRAP_REUSED' })
+    );
+  });
+  it('rejects unsupported bootstrap versions and transports', () => {
+    expect(() => validate({ ...base, version: 2 })).toThrowError(
+      expect.objectContaining({ code: 'PROTOCOL_MISMATCH' })
+    );
+    expect(() => validate({ ...base, transport: 'direct-quic' })).toThrowError(
+      expect.objectContaining({ code: 'UNSUPPORTED_TRANSPORT' })
+    );
+  });
+});
diff --git a/electron/src/private-channel-step4.test.ts b/electron/src/private-channel-step4.test.ts
new file mode 100644
index 000000000..c2e368e1e
--- /dev/null
+++ b/electron/src/private-channel-step4.test.ts
@@ -0,0 +1,675 @@
+import {
+  spawn,
+  spawnSync,
+  type ChildProcessWithoutNullStreams,
+} from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import dgram from 'node:dgram';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { PrivateChannelManager } from './private-channel-manager';
+import {
+  ReticulumPrivateChannelBootstrapProvider,
+  type PrivateBootstrapDescriptor,
+} from './private-channel-bootstrap';
+import { PrivateTransportSidecar } from './private-transport-sidecar';
+import { QuicMasqueTransport } from './quic-masque-transport';
+import {
+  QAppReticulumManager,
+  type QAppReticulumNativeEvent,
+  type QAppReticulumTransport,
+} from './qapp-reticulum-manager';
+
+const desktopRoot = process.cwd();
+const backendRoot =
+  process.env.QORTAL_QAPP_BACKEND_REPO ??
+  '/home/qortal/Documents/qapp-backend-call';
+const goBinary = process.env.QORTAL_GO_BINARY || 'go';
+const uvBinary = process.env.QORTAL_UV_BINARY || 'uv';
+const available =
+  spawnSync(goBinary, ['version']).status === 0 &&
+  spawnSync(uvBinary, ['--version']).status === 0 &&
+  fs.existsSync(path.join(backendRoot, 'scripts/private_transport_fixture.py'));
+const integration = available ? describe.sequential : describe.skip;
+
+type BackendStartup = {
+  backendAddress: string;
+  backendDestination: string;
+  backendCertSha256: string;
+};
+type RelayStartup = {
+  relayAddress: string;
+  relayServerName: string;
+  relayCertSha256: string;
+};
+
+class JsonProcess {
+  private buffer = '';
+  private readonly lines: string[] = [];
+  private readonly waiters: Array<{
+    resolve: (value: unknown) => void;
+    reject: (error: Error) => void;
+  }> = [];
+  private failure?: Error;
+
+  constructor(readonly child: ChildProcessWithoutNullStreams) {
+    child.stdout.setEncoding('utf8');
+    child.stderr.resume();
+    const failed = (error: Error) => {
+      this.failure = error;
+      for (const waiter of this.waiters.splice(0)) waiter.reject(error);
+    };
+    child.once('error', failed);
+    child.once('exit', (code, signal) =>
+      failed(new Error(`Integration fixture exited (${code ?? signal})`))
+    );
+    child.stdout.on('data', (chunk: string) => {
+      this.buffer += chunk;
+      for (;;) {
+        const newline = this.buffer.indexOf('\n');
+        if (newline < 0) return;
+        const line = this.buffer.slice(0, newline);
+        this.buffer = this.buffer.slice(newline + 1);
+        const value = JSON.parse(line);
+        const waiter = this.waiters.shift();
+        if (waiter) waiter.resolve(value);
+        else this.lines.push(line);
+      }
+    });
+  }
+
+  next<T>(): Promise<T> {
+    const line = this.lines.shift();
+    if (line !== undefined) return Promise.resolve(JSON.parse(line) as T);
+    if (this.failure) return Promise.reject(this.failure);
+    return new Promise((resolve, reject) =>
+      this.waiters.push({ resolve: (value) => resolve(value as T), reject })
+    );
+  }
+
+  command<T>(
+    operation: string,
+    values: Record<string, unknown> = {}
+  ): Promise<T> {
+    this.child.stdin.write(`${JSON.stringify({ operation, ...values })}\n`);
+    return this.next<T>();
+  }
+
+  async close(): Promise<void> {
+    if (this.child.exitCode !== null) return;
+    await this.command('shutdown').catch(() => undefined);
+    this.child.kill();
+  }
+}
+
+class RealBackendRnsHarness implements QAppReticulumTransport {
+  readonly listeners = new Set<(event: QAppReticulumNativeEvent) => void>();
+  authenticatedLogicalSessionId = '';
+  constructor(readonly backend: JsonProcess) {}
+
+  onEvent(listener: (event: QAppReticulumNativeEvent) => void): () => void {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+
+  async invoke(action: string, payload: Record<string, unknown>) {
+    if (action === 'qapp_rns_connect') {
+      const authenticated = await this.backend.command<{
+        authentication: string;
+        logicalSessionId: string;
+        ok: boolean;
+      }>('bindAuthenticatedSession', {
+        logicalConnectionId: payload.connectionId,
+      });
+      expect(authenticated).toMatchObject({
+        authentication: 'signed-qapp-auth',
+        ok: true,
+      });
+      this.authenticatedLogicalSessionId = authenticated.logicalSessionId;
+      return { ok: true, payload: { state: 'CONNECTED' } };
+    }
+    if (action === 'qapp_rns_request') {
+      expect(payload.path).toBe('/qortal/private-transport/bootstrap/v1');
+      expect(payload.logicalConnectionId).toEqual(expect.any(String));
+      const request = JSON.parse(
+        Buffer.from(String(payload.payloadBase64), 'base64').toString('utf8')
+      );
+      const response = await this.backend.command('bootstrap', {
+        payload: request,
+      });
+      return {
+        ok: true,
+        payload: {
+          payloadBase64: Buffer.from(JSON.stringify(response)).toString(
+            'base64'
+          ),
+          encoding: 'json',
+        },
+      };
+    }
+    if (action === 'qapp_rns_close') {
+      await this.backend.command('disconnectReticulum');
+      return { ok: true, payload: { state: 'CLOSED' } };
+    }
+    if (action === 'qapp_rns_send') {
+      return { ok: true, payload: { messageId: 'reticulum-still-usable' } };
+    }
+    return { ok: false, code: 'RNS_PROTOCOL_ERROR' };
+  }
+}
+
+integration('Step 4 real backend bootstrap and attachment', () => {
+  let temporaryDirectory = '';
+  let sidecarBinary = '';
+  let relayBinary = '';
+
+  beforeAll(() => {
+    temporaryDirectory = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'hub-step4-test-')
+    );
+    sidecarBinary = path.join(temporaryDirectory, 'private-transport-sidecar');
+    relayBinary = path.join(temporaryDirectory, 'private-transport-relay');
+    const nativeRoot = path.join(
+      desktopRoot,
+      'electron',
+      'native',
+      'private-transport'
+    );
+    for (const [output, source] of [
+      [sidecarBinary, './cmd/qortal-private-transport'],
+      [relayBinary, './cmd/qortal-private-transport-step4-relay'],
+    ]) {
+      const result = spawnSync(
+        goBinary,
+        ['build', '-trimpath', '-o', output, source],
+        { cwd: nativeRoot, encoding: 'utf8' }
+      );
+      if (result.status !== 0)
+        throw new Error(result.stderr || result.error?.message);
+    }
+  }, 60_000);
+
+  afterAll(() => {
+    if (temporaryDirectory)
+      fs.rmSync(temporaryDirectory, { recursive: true, force: true });
+  });
+
+  it
+    .runIf(
+      process.env.QORTAL_PYTHON_BENCH === '1' ||
+        process.env.QORTAL_NATIVE_FILE_BENCH === '1'
+    )
+    .each(
+      process.env.QORTAL_NATIVE_FILE_BENCH === '1' ? [0] : [0, 1048576, 4194304]
+    )(
+    process.env.QORTAL_NATIVE_FILE_BENCH === '1'
+      ? 'benchmarks native durable file transport'
+      : 'benchmarks real Python QUIC receive buffer %i',
+    async (receiveBytes) => {
+      const backend = new JsonProcess(
+        spawn(
+          uvBinary,
+          [
+            'run',
+            ...(process.env.QORTAL_STEP4_UVLOOP === '1'
+              ? ['--with', 'uvloop']
+              : []),
+            'python',
+            'scripts/private_transport_fixture.py',
+          ],
+          {
+            cwd: backendRoot,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: {
+              ...process.env,
+              QORTAL_STEP4_BULK_BENCH:
+                process.env.QORTAL_NATIVE_FILE_BENCH === '1' ? '0' : '1',
+              QORTAL_STEP4_RECEIVE_BYTES: String(receiveBytes),
+            },
+          }
+        )
+      );
+      const startup = await backend.next<BackendStartup>();
+      const relay = new JsonProcess(
+        spawn(relayBinary, [], {
+          stdio: ['pipe', 'pipe', 'pipe'],
+          env: {
+            ...process.env,
+            QORTAL_STEP4_BULK_BENCH: '1',
+            QORTAL_STEP4_BACKEND_ADDRESS: startup.backendAddress,
+          },
+        })
+      );
+      const relayInfo = await relay.next<RelayStartup>();
+      const proxy = dgram.createSocket('udp4');
+      await new Promise<void>((r) => proxy.bind(0, '127.0.0.1', r));
+      proxy.setRecvBufferSize(4 * 1024 * 1024);
+      const target = Number(relayInfo.relayAddress.split(':').at(-1));
+      const timers = new Set<ReturnType<typeof setTimeout>>();
+      let client = 0,
+        proxyDrops = 0;
+      proxy.on('message', (data, peer) => {
+        const fromRelay = peer.port === target;
+        if (!fromRelay) client = peer.port;
+        if (timers.size >= 8192) {
+          proxyDrops++;
+          return;
+        }
+        const timer = setTimeout(() => {
+          timers.delete(timer);
+          proxy.send(data, fromRelay ? client : target, '127.0.0.1');
+        }, 60);
+        timers.add(timer);
+      });
+      const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+      try {
+        const owner = { tabId: 'bench', name: 'qapp-ui-call', service: 'APP' };
+        const rns = new QAppReticulumManager(
+          new RealBackendRnsHarness(backend)
+        );
+        const connected = await rns.connect(owner, startup.backendDestination);
+        const descriptor = await new ReticulumPrivateChannelBootstrapProvider(
+          rns
+        ).getBootstrap({
+          channelId: 'bench',
+          rnsConnectionId: connected.connectionId,
+          purpose: 'game',
+          generation: 1,
+          owner,
+        });
+        await sidecar.start();
+        const opened = await sidecar.openPrivateSession(
+          privateSessionConfig(descriptor, {
+            ...relayInfo,
+            relayAddress: `127.0.0.1:${(proxy.address() as import('node:net').AddressInfo).port}`,
+          })
+        );
+        if (process.env.QORTAL_NATIVE_FILE_BENCH === '1') {
+          const pending = new Map<
+            string,
+            {
+              resolve: (v: any) => void;
+              reject: (e: Error) => void;
+              timer: ReturnType<typeof setTimeout>;
+            }
+          >();
+          sidecar.on('event', (e) => {
+            const p = pending.get(e.messageId!);
+            if (!p) return;
+            pending.delete(e.messageId!);
+            clearTimeout(p.timer);
+            try {
+              const value = JSON.parse(e.data.subarray(1).toString());
+              if (value.ok === false) throw new Error(value.error);
+              p.resolve(value);
+            } catch (error) {
+              p.reject(error as Error);
+            }
+          });
+          let seq = 0;
+          const gates: Promise<void>[] = [Promise.resolve(), Promise.resolve()];
+          const request = async (payload: Buffer, key = 'file-control') => {
+            const n = seq++,
+              messageId = `file-bench-${n}`;
+            const reply = new Promise<any>((resolve, reject) => {
+              pending.set(messageId, {
+                resolve,
+                reject,
+                timer: setTimeout(() => {
+                  pending.delete(messageId);
+                  reject(new Error('file benchmark timeout'));
+                }, 15000),
+              });
+            });
+            const send = gates[n % 2].then(() =>
+              sidecar.sendPrivateReliable(
+                opened.sessionId,
+                messageId,
+                payload,
+                key
+              )
+            );
+            gates[n % 2] = send.catch(() => {});
+            await send;
+            return reply;
+          };
+          const json = (value: object) =>
+            request(
+              Buffer.concat([
+                Buffer.from([0]),
+                Buffer.from(JSON.stringify({ type: 'file_request', ...value })),
+              ])
+            );
+          const id = 'ab'.repeat(16),
+            batches = process.env.QORTAL_BULK_BENCH_LARGE === '1' ? 256 : 64;
+          await json({
+            op: 'create',
+            id,
+            size: batches * 16 * 32768,
+            ttl: 3600,
+            envelope: Buffer.from('opaque-envelope').toString('base64'),
+            manifest: Buffer.from('opaque-manifest').toString('base64'),
+          });
+          const realtime = new Map<string, number>(),
+            rtts: number[] = [];
+          let sent = 0;
+          sidecar.on('event', (e) => {
+            const at = realtime.get(e.messageId!);
+            if (at !== undefined) {
+              rtts.push(performance.now() - at);
+              realtime.delete(e.messageId!);
+            }
+          });
+          const ticker = setInterval(() => {
+            const mid = `live-${sent++}`;
+            realtime.set(mid, performance.now());
+            void sidecar
+              .sendPrivateDatagram(
+                opened.sessionId,
+                mid,
+                Buffer.concat([
+                  Buffer.from([0]),
+                  Buffer.from(
+                    JSON.stringify({
+                      type: 'private_transport_echo',
+                      value: 'live',
+                    })
+                  ),
+                ])
+              )
+              .catch(() => {});
+          }, 50);
+          const start = performance.now();
+          let next = 0;
+          try {
+            await Promise.all(
+              Array.from({ length: 8 }, async () => {
+                while (next < batches) {
+                  const batch = next++,
+                    payload = Buffer.alloc(1 + 22 + 16 * (8 + 32796), 42);
+                  payload[0] = 1;
+                  payload.write('QFB1', 1);
+                  Buffer.from(id, 'hex').copy(payload, 5);
+                  payload.writeUInt16BE(16, 21);
+                  let offset = 23;
+                  for (let j = 0; j < 16; j++) {
+                    payload.writeUInt32BE(batch * 16 + j, offset);
+                    payload.writeUInt32BE(32796, offset + 4);
+                    offset += 8 + 32796;
+                  }
+                  expect(
+                    (await request(payload, 'file-bulk')).result.received
+                  ).toHaveLength(16);
+                }
+              })
+            );
+          } finally {
+            clearInterval(ticker);
+          }
+          const seconds = (performance.now() - start) / 1000;
+          await json({ op: 'finish', id });
+          for (const index of [0, batches * 16 - 1]) {
+            expect(
+              Buffer.from(
+                (await json({ op: 'get', id, index })).result.chunk,
+                'base64'
+              )
+            ).toEqual(Buffer.alloc(32796, 42));
+          }
+          await new Promise((r) => setTimeout(r, 400));
+          rtts.sort((a, b) => a - b);
+          console.info(
+            '[NativeFileBenchmark]',
+            JSON.stringify({
+              seconds,
+              bytes: batches * 16 * 32768,
+              MBps: (batches * 16 * 32768) / seconds / 1e6,
+              proxyDrops,
+              realtimeSent: sent,
+              realtimeReceived: rtts.length,
+              realtimeP95: rtts[Math.floor(rtts.length * 0.95)],
+              metrics: await sidecar.sessionMetrics(opened.sessionId),
+            })
+          );
+          expect(rtts.length).toBeGreaterThanOrEqual(sent * 0.9);
+          expect(rtts[Math.floor(rtts.length * 0.95)]).toBeLessThan(500);
+          return;
+        }
+        const payload = Buffer.alloc(524886, 42);
+        payload[0] = 1;
+        const count = 64;
+        let next = 0,
+          acks = 0;
+        let resolveAll!: () => void;
+        const all = new Promise<void>((r) => (resolveAll = r));
+        sidecar.on('event', (e) => {
+          if (e.event === 'reliableMessage' && ++acks === count) resolveAll();
+        });
+        const start = performance.now();
+        await Promise.all(
+          Array.from({ length: 2 }, async () => {
+            while (next < count) {
+              const n = next++;
+              await sidecar.sendPrivateReliable(
+                opened.sessionId,
+                `bench-${n}`,
+                payload,
+                'bulk'
+              );
+            }
+          })
+        );
+        await all;
+        console.info(
+          '[PythonBulkBenchmark]',
+          JSON.stringify({
+            receiveBytes,
+            seconds: (performance.now() - start) / 1000,
+            bytes: count * payload.length,
+            proxyDrops,
+            backend: (await backend.command<{ diagnostic: unknown }>('stats'))
+              .diagnostic,
+            metrics: await sidecar.sessionMetrics(opened.sessionId),
+          })
+        );
+        expect(acks).toBe(count);
+      } finally {
+        await sidecar.shutdown();
+        timers.forEach(clearTimeout);
+        proxy.close();
+        await relay.close();
+        await backend.close();
+      }
+    },
+    120000
+  );
+
+  it('uses the real RNS handler to attach MASQUE QUIC to the same session', async () => {
+    const backend = new JsonProcess(
+      spawn(
+        uvBinary,
+        ['run', 'python', 'scripts/private_transport_fixture.py'],
+        { cwd: backendRoot, stdio: ['pipe', 'pipe', 'pipe'] }
+      )
+    );
+    const backendStartup = await backend.next<BackendStartup>();
+    const relay = new JsonProcess(
+      spawn(relayBinary, [], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: {
+          ...process.env,
+          QORTAL_STEP4_BACKEND_ADDRESS: backendStartup.backendAddress,
+        },
+      })
+    );
+    const relayStartup = await relay.next<RelayStartup>();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    const owner = { tabId: 'step4-tab', name: 'qapp-ui-call', service: 'APP' };
+    const nativeTransport = new RealBackendRnsHarness(backend);
+    const rnsManager = new QAppReticulumManager(nativeTransport);
+    const rns = await rnsManager.connect(
+      owner,
+      backendStartup.backendDestination
+    );
+    const bootstrapProvider = new ReticulumPrivateChannelBootstrapProvider(
+      rnsManager
+    );
+    const channels = new PrivateChannelManager(
+      (candidateOwner, connectionId) =>
+        rnsManager.connectionOwnership(candidateOwner, connectionId),
+      (emit) =>
+        new QuicMasqueTransport(emit, sidecar, relayStartup, bootstrapProvider)
+    );
+    try {
+      const directDescriptor = await bootstrapProvider.getBootstrap({
+        channelId: 'identity-and-token-probe',
+        rnsConnectionId: rns.connectionId,
+        purpose: 'game',
+        generation: 1,
+        owner,
+      });
+      await expect(
+        sidecar.openPrivateSession({
+          ...privateSessionConfig(directDescriptor, relayStartup),
+          backendCertSha256: '00'.repeat(32),
+        })
+      ).rejects.toMatchObject({ code: 'BACKEND_IDENTITY_MISMATCH' });
+      await expect(
+        sidecar.openPrivateSession({
+          ...privateSessionConfig(directDescriptor, relayStartup),
+          attachToken: 'missing-attach-token',
+        })
+      ).rejects.toMatchObject({ code: 'ATTACH_TOKEN_REJECTED' });
+      const directSession = await sidecar.openPrivateSession(
+        privateSessionConfig(directDescriptor, relayStartup)
+      );
+      await sidecar.closePrivateSession(directSession.sessionId);
+      await expect(
+        sidecar.openPrivateSession(
+          privateSessionConfig(directDescriptor, relayStartup)
+        )
+      ).rejects.toMatchObject({ code: 'ATTACH_TOKEN_REJECTED' });
+      for (let index = 0; index < 100; index += 1) {
+        const detached = await backend.command<{ privateAttached: boolean }>(
+          'stats'
+        );
+        if (!detached.privateAttached) break;
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      }
+      expect(await backend.command('stats')).toMatchObject({
+        privateAttached: false,
+        outstandingTokens: 0,
+      });
+
+      const opened = await channels.open(owner, rns.connectionId, 'game');
+      expect(opened.state).toBe('OPEN');
+      const stats = await backend.command<{
+        logicalSessionId: string;
+        privateAttached: boolean;
+        backendPeer: string;
+        outstandingTokens: number;
+      }>('stats');
+      expect(stats.logicalSessionId).toBe(
+        nativeTransport.authenticatedLogicalSessionId
+      );
+      expect(stats.privateAttached).toBe(true);
+      expect(stats.outstandingTokens).toBe(0);
+      const relayStats = await relay.command<{ relayEgress: string }>('stats');
+      expect(stats.backendPeer).toBe(relayStats.relayEgress);
+
+      const messages: Array<Record<string, unknown>> = [];
+      channels.on('event', (event) => {
+        if (event.action === 'PRIVATE_CHANNEL_MESSAGE') messages.push(event);
+      });
+      await Promise.all([
+        channels.send(owner, opened.channelId, 'reliable', 'real-r', {
+          type: 'private_transport_echo',
+          value: 'reliable-real-session',
+        }),
+        channels.send(owner, opened.channelId, 'datagram', 'real-d', {
+          type: 'private_transport_echo',
+          value: 'datagram-real-session',
+        }),
+      ]);
+      for (let index = 0; index < 100 && messages.length < 2; index += 1)
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      expect(messages).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            channelId: opened.channelId,
+            lane: 'reliable',
+            messageId: 'real-r',
+          }),
+          expect.objectContaining({
+            channelId: opened.channelId,
+            lane: 'datagram',
+            messageId: 'real-d',
+          }),
+        ])
+      );
+      expect(await backend.command('reticulumStatus')).toMatchObject({
+        usable: true,
+        logicalSessionId: stats.logicalSessionId,
+      });
+
+      await channels.close(owner, opened.channelId);
+      for (let index = 0; index < 100; index += 1) {
+        const detached = await backend.command<{ privateAttached: boolean }>(
+          'stats'
+        );
+        if (!detached.privateAttached) break;
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      }
+      expect(await backend.command('stats')).toMatchObject({
+        logicalSessionId: stats.logicalSessionId,
+        privateAttached: false,
+      });
+      expect(await backend.command('reticulumStatus')).toMatchObject({
+        usable: true,
+        logicalSessionId: stats.logicalSessionId,
+      });
+
+      await bootstrapProvider.getBootstrap({
+        channelId: 'unused-token',
+        rnsConnectionId: rns.connectionId,
+        purpose: 'game',
+        generation: 1,
+        owner,
+      });
+      expect(await backend.command('stats')).toMatchObject({
+        outstandingTokens: 1,
+      });
+      await rnsManager.close(owner, rns.connectionId);
+      expect(await backend.command('stats')).toMatchObject({
+        outstandingTokens: 0,
+      });
+      expect(backendStartup.backendCertSha256).toMatch(/^[a-f0-9]{64}$/);
+    } finally {
+      channels.destroy();
+      rnsManager.destroy();
+      await sidecar.shutdown();
+      await relay.close();
+      await backend.close();
+    }
+  }, 30_000);
+});
+
+function privateSessionConfig(
+  descriptor: PrivateBootstrapDescriptor,
+  relay: RelayStartup
+) {
+  return {
+    relayAddress: relay.relayAddress,
+    relayServerName: relay.relayServerName,
+    relayCertSha256: relay.relayCertSha256,
+    backendAddress: descriptor.backendTransportEndpoint,
+    backendServerName: descriptor.backendTransportServerName,
+    backendCertSha256: descriptor.backendTransportCertSha256,
+    logicalSessionId: descriptor.logicalSessionId,
+    attachToken: descriptor.attachToken,
+    nonce: descriptor.nonce,
+    purpose: 'game',
+    ownerBindingHash: descriptor.ownerBindingHash,
+  };
+}
diff --git a/electron/src/private-transport-runtime.test.ts b/electron/src/private-transport-runtime.test.ts
new file mode 100644
index 000000000..7c0b9268c
--- /dev/null
+++ b/electron/src/private-transport-runtime.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest';
+import {
+  getPrivateTransportFactory,
+  readTrustedRelayConfig,
+} from './private-transport-runtime';
+
+describe('private transport runtime selection', () => {
+  it('uses Reticulum discovery by default without a feature flag', () => {
+    expect(
+      getPrivateTransportFactory({} as never, () => null, {})
+    ).toBeTypeOf('function');
+  });
+
+  it('requires pinned relay values in explicit test mode', () => {
+    expect(() =>
+      getPrivateTransportFactory({} as never, () => null, {
+        QORTAL_PRIVATE_TRANSPORT: 'masque-test',
+      })
+    ).toThrow('Incomplete MASQUE prototype configuration');
+  });
+
+  it('parses the explicit test-mode relay boundary', () => {
+    expect(
+      readTrustedRelayConfig({
+        QORTAL_MASQUE_TEST_RELAY_ADDRESS: '127.0.0.1:47322',
+        QORTAL_MASQUE_TEST_RELAY_SERVER_NAME: 'relay.test',
+        QORTAL_MASQUE_TEST_RELAY_CERT_SHA256: 'ab'.repeat(32),
+      })
+    ).toEqual({
+      relayAddress: '127.0.0.1:47322',
+      relayServerName: 'relay.test',
+      relayCertSha256: 'ab'.repeat(32),
+    });
+  });
+});
diff --git a/electron/src/private-transport-runtime.ts b/electron/src/private-transport-runtime.ts
new file mode 100644
index 000000000..e85d3e5bd
--- /dev/null
+++ b/electron/src/private-transport-runtime.ts
@@ -0,0 +1,172 @@
+import net from 'net';
+import type { PrivateTransportFactory } from './private-channel-manager';
+import {
+  PrivateTransportSidecar,
+  type MasqueTestConfig,
+} from './private-transport-sidecar';
+import { QuicMasqueTransport } from './quic-masque-transport';
+import { ReticulumPrivateChannelBootstrapProvider } from './private-channel-bootstrap';
+import type { QAppReticulumManager } from './qapp-reticulum-manager';
+import type { ReticulumBridge } from './reticulum-bridge';
+import { RelayAccessCoordinator } from './relay-access-coordinator';
+import {
+  MoqMasqueTransport,
+  type MoqTransportEvent,
+} from './moq-masque-transport';
+
+let prototypeSidecar: PrivateTransportSidecar | null = null;
+let relayCoordinator: RelayAccessCoordinator | null = null;
+let sidecarShutdownPromise: Promise<void> | null = null;
+
+/**
+ * Main-process-only transport selection. Renderer/Q-App payloads are never
+ * consulted. Reticulum relay discovery is the normal production path.
+ */
+export function getPrivateTransportFactory(
+  reticulumManager: QAppReticulumManager,
+  reticulumBridgeProvider: () => ReticulumBridge | null = () => null,
+  environment: NodeJS.ProcessEnv = process.env
+): PrivateTransportFactory | undefined {
+  const mode = environment.QORTAL_PRIVATE_TRANSPORT;
+  const explicitRelay =
+    mode === 'masque-test' ? readTrustedRelayConfig(environment) : null;
+  const bootstrapProvider = new ReticulumPrivateChannelBootstrapProvider(
+    reticulumManager
+  );
+  prototypeSidecar ??= new PrivateTransportSidecar();
+  relayCoordinator ??= new RelayAccessCoordinator(prototypeSidecar);
+  return (emit) =>
+    new QuicMasqueTransport(
+      emit,
+      prototypeSidecar!,
+      explicitRelay ??
+        (async (excludedRelayAddresses) => {
+          const reticulumBridge = reticulumBridgeProvider();
+          if (!reticulumBridge) throw new Error('MASQUE_RELAY_UNAVAILABLE');
+          return relayCoordinator!.select(
+            reticulumBridge,
+            excludedRelayAddresses,
+            environment.QORTAL_PRIVATE_TRANSPORT_ALLOW_LOCAL_RELAY === '1'
+          );
+        }),
+      bootstrapProvider
+    );
+}
+
+/**
+ * Trusted main-process generic MOQT transport. The capability-scoped Q-App
+ * manager owns instances and keeps relay/bootstrap details out of renderers.
+ */
+export function createMoqTransport(
+  emit: (event: MoqTransportEvent) => void,
+  reticulumManager: QAppReticulumManager,
+  reticulumBridgeProvider: () => ReticulumBridge | null = () => null,
+  environment: NodeJS.ProcessEnv = process.env
+): MoqMasqueTransport {
+  const explicitRelay =
+    environment.QORTAL_PRIVATE_TRANSPORT === 'masque-test'
+      ? readTrustedRelayConfig(environment)
+      : null;
+  prototypeSidecar ??= new PrivateTransportSidecar();
+  relayCoordinator ??= new RelayAccessCoordinator(prototypeSidecar);
+  return new MoqMasqueTransport(
+    emit,
+    prototypeSidecar,
+    explicitRelay ??
+      (async (excludedRelayAddresses) => {
+        const reticulumBridge = reticulumBridgeProvider();
+        if (!reticulumBridge) throw new Error('MASQUE_RELAY_UNAVAILABLE');
+        return relayCoordinator!.select(
+          reticulumBridge,
+          excludedRelayAddresses,
+          environment.QORTAL_PRIVATE_TRANSPORT_ALLOW_LOCAL_RELAY === '1'
+        );
+      }),
+    new ReticulumPrivateChannelBootstrapProvider(reticulumManager)
+  );
+}
+
+export function readTrustedRelayConfig(environment: NodeJS.ProcessEnv) {
+  const relayAddress = required(environment.QORTAL_MASQUE_TEST_RELAY_ADDRESS);
+  assertLiteralEndpoint(relayAddress, 'relay');
+  const relayServerName = required(
+    environment.QORTAL_MASQUE_TEST_RELAY_SERVER_NAME
+  );
+  const relayCertSha256 = required(
+    environment.QORTAL_MASQUE_TEST_RELAY_CERT_SHA256
+  ).toLowerCase();
+  if (!/^[a-f0-9]{64}$/.test(relayCertSha256)) {
+    throw new Error('Invalid MASQUE test certificate pin');
+  }
+  return { relayAddress, relayServerName, relayCertSha256 };
+}
+
+export async function shutdownPrivateTransportSidecar(): Promise<void> {
+  if (sidecarShutdownPromise) return sidecarShutdownPromise;
+  const sidecar = prototypeSidecar;
+  relayCoordinator?.dispose();
+  relayCoordinator = null;
+  prototypeSidecar = null;
+  if (!sidecar) return;
+  sidecarShutdownPromise = sidecar.shutdown().finally(() => {
+    sidecarShutdownPromise = null;
+  });
+  return sidecarShutdownPromise;
+}
+
+export function readMasqueTestConfig(
+  environment: NodeJS.ProcessEnv
+): MasqueTestConfig {
+  const relayAddress = required(environment.QORTAL_MASQUE_TEST_RELAY_ADDRESS);
+  const targetAddress = required(environment.QORTAL_MASQUE_TEST_TARGET_ADDRESS);
+  assertLiteralEndpoint(relayAddress, 'relay');
+  assertLiteralEndpoint(targetAddress, 'target');
+  const relayServerName = required(
+    environment.QORTAL_MASQUE_TEST_RELAY_SERVER_NAME
+  );
+  const relayCertSha256 = required(
+    environment.QORTAL_MASQUE_TEST_RELAY_CERT_SHA256
+  ).toLowerCase();
+  if (!/^[a-f0-9]{64}$/.test(relayCertSha256)) {
+    throw new Error('Invalid MASQUE test certificate pin');
+  }
+  return {
+    relayAddress,
+    relayServerName,
+    relayCertSha256,
+    targetAddress,
+  };
+}
+
+function required(value: string | undefined): string {
+  const result = String(value ?? '').trim();
+  if (!result) throw new Error('Incomplete MASQUE prototype configuration');
+  return result;
+}
+
+function assertLiteralEndpoint(value: string, label: string): void {
+  let host = '';
+  let portText = '';
+  if (value.startsWith('[')) {
+    const end = value.indexOf(']:');
+    if (end > 0) {
+      host = value.slice(1, end);
+      portText = value.slice(end + 2);
+    }
+  } else {
+    const separator = value.lastIndexOf(':');
+    if (separator > 0) {
+      host = value.slice(0, separator);
+      portText = value.slice(separator + 1);
+    }
+  }
+  const port = Number(portText);
+  if (
+    net.isIP(host) === 0 ||
+    !Number.isInteger(port) ||
+    port < 1 ||
+    port > 65535
+  ) {
+    throw new Error(`Invalid literal ${label} endpoint`);
+  }
+}
diff --git a/electron/src/private-transport-sidecar.test.ts b/electron/src/private-transport-sidecar.test.ts
new file mode 100644
index 000000000..f47cfbcf3
--- /dev/null
+++ b/electron/src/private-transport-sidecar.test.ts
@@ -0,0 +1,276 @@
+import {
+  spawn,
+  spawnSync,
+  type ChildProcessWithoutNullStreams,
+} from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import {
+  PrivateTransportSidecar,
+  PrivateTransportSidecarError,
+  type MasqueTestConfig,
+} from './private-transport-sidecar';
+import { readMasqueTestConfig } from './private-transport-runtime';
+
+type FixtureStartup = MasqueTestConfig;
+type FixtureStats = {
+  echoCount: number;
+  echoSource: string;
+  relayEgress: string;
+};
+
+let temporaryDirectory = '';
+let sidecarBinary = '';
+let fixtureBinary = '';
+const goBinary = process.env.QORTAL_GO_BINARY || 'go';
+const goAvailable =
+  spawnSync(goBinary, ['version'], { windowsHide: true }).status === 0;
+
+class FixtureProcess {
+  readonly child: ChildProcessWithoutNullStreams;
+  private buffer = '';
+  private lines: string[] = [];
+  private waiters: Array<(line: string) => void> = [];
+
+  constructor() {
+    this.child = spawn(fixtureBinary, [], { stdio: ['pipe', 'pipe', 'pipe'] });
+    this.child.stdout.setEncoding('utf8');
+    this.child.stderr.resume();
+    this.child.stdout.on('data', (chunk: string) => {
+      this.buffer += chunk;
+      for (;;) {
+        const newline = this.buffer.indexOf('\n');
+        if (newline < 0) return;
+        const line = this.buffer.slice(0, newline);
+        this.buffer = this.buffer.slice(newline + 1);
+        const waiter = this.waiters.shift();
+        if (waiter) waiter(line);
+        else this.lines.push(line);
+      }
+    });
+  }
+
+  async startup(): Promise<FixtureStartup> {
+    return JSON.parse(await this.nextLine()) as FixtureStartup;
+  }
+
+  async command<T>(operation: string): Promise<T> {
+    this.child.stdin.write(`${JSON.stringify({ operation })}\n`);
+    return JSON.parse(await this.nextLine()) as T;
+  }
+
+  async close(): Promise<void> {
+    if (this.child.exitCode !== null) return;
+    await this.command('shutdown').catch(() => undefined);
+    this.child.kill();
+  }
+
+  private nextLine(): Promise<string> {
+    const line = this.lines.shift();
+    if (line !== undefined) return Promise.resolve(line);
+    return new Promise((resolve) => this.waiters.push(resolve));
+  }
+}
+
+const describeIntegration = goAvailable ? describe.sequential : describe.skip;
+
+describeIntegration('private transport sidecar integration', () => {
+  beforeAll(() => {
+    temporaryDirectory = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'hub-private-transport-test-')
+    );
+    sidecarBinary = path.join(temporaryDirectory, 'qortal-private-transport');
+    fixtureBinary = path.join(
+      temporaryDirectory,
+      'qortal-private-transport-test-fixture'
+    );
+    const moduleRoot = path.join(
+      process.cwd(),
+      'electron',
+      'native',
+      'private-transport'
+    );
+    for (const [output, pkg] of [
+      [sidecarBinary, './cmd/qortal-private-transport'],
+      [fixtureBinary, './cmd/qortal-private-transport-test-fixture'],
+    ]) {
+      const result = spawnSync(
+        goBinary,
+        ['build', '-trimpath', '-o', output, pkg],
+        {
+          cwd: moduleRoot,
+          encoding: 'utf8',
+          windowsHide: true,
+        }
+      );
+      if (result.status !== 0) {
+        throw new Error(
+          `Go fixture build failed: ${result.error?.message ?? result.stderr}`
+        );
+      }
+    }
+  }, 60_000);
+
+  afterAll(() => {
+    if (temporaryDirectory)
+      fs.rmSync(temporaryDirectory, { recursive: true, force: true });
+  });
+
+  it('handshakes, tunnels a datagram, and shuts down cleanly', async () => {
+    const fixture = new FixtureProcess();
+    const config = await fixture.startup();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    expect(await sidecar.health()).toEqual({
+      service: 'qortal-private-transport',
+      sidecarVersion: '0.11.0',
+      protocolVersion: 2,
+      innerAlpn: 'qortal-private/1',
+      moqAlpn: 'moqt-18',
+    });
+
+    const tunnelId = await sidecar.openMasqueTunnel(config);
+    expect(tunnelId).toMatch(/^tunnel-/);
+    const payload = Buffer.from('known-connect-udp-datagram');
+    await sidecar.sendDatagram(tunnelId, payload);
+    expect(await sidecar.receiveDatagram(tunnelId)).toEqual(payload);
+    const stats = await fixture.command<FixtureStats>('stats');
+    expect(stats.echoCount).toBe(1);
+    expect(stats.echoSource).toBe(stats.relayEgress);
+
+    await sidecar.closeTunnel(tunnelId);
+    await sidecar.shutdown();
+    expect(sidecar.isRunning()).toBe(false);
+    await fixture.close();
+  }, 20_000);
+
+  it('prepares and reuses a relay without forwarding any backend traffic', async () => {
+    const fixture = new FixtureProcess();
+    const config = await fixture.startup();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    try {
+      const result = await sidecar.prepareRelay(config);
+      expect(result.ready).toBe(true);
+      expect(await sidecar.authorizeRelay(result.handle)).toEqual(result);
+      expect((await fixture.command<FixtureStats>('stats')).echoCount).toBe(0);
+      await sidecar.closeRelay(result.handle);
+      await expect(sidecar.authorizeRelay(result.handle)).rejects.toMatchObject(
+        { code: 'RELAY_CONNECTION_CLOSED' }
+      );
+    } finally {
+      await sidecar.shutdown();
+      await fixture.close();
+    }
+  }, 20_000);
+
+  it('fails closed on a certificate pin mismatch', async () => {
+    const fixture = new FixtureProcess();
+    const config = await fixture.startup();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    await expect(
+      sidecar.openMasqueTunnel({
+        ...config,
+        relayCertSha256: '00'.repeat(32),
+        timeoutMs: 1_000,
+      })
+    ).rejects.toMatchObject({ code: 'MASQUE_OPEN_FAILED' });
+    expect((await fixture.command<FixtureStats>('stats')).echoCount).toBe(0);
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+
+  it('never falls back directly when the literal-IP relay is unavailable', async () => {
+    const fixture = new FixtureProcess();
+    const config = await fixture.startup();
+    await fixture.command('stopRelay');
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    await expect(
+      sidecar.openMasqueTunnel({ ...config, timeoutMs: 500 })
+    ).rejects.toMatchObject({ code: 'MASQUE_OPEN_FAILED' });
+    expect((await fixture.command<FixtureStats>('stats')).echoCount).toBe(0);
+    await sidecar.shutdown();
+    await fixture.close();
+  }, 20_000);
+
+  it('rejects pending work when the sidecar exits mid-request', async () => {
+    const fixture = new FixtureProcess();
+    const config = await fixture.startup();
+    const sidecar = new PrivateTransportSidecar({ command: sidecarBinary });
+    await sidecar.start();
+    const tunnelId = await sidecar.openMasqueTunnel(config);
+    const pending = sidecar.receiveDatagram(tunnelId, 10_000);
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    sidecar.terminateForTest();
+    await expect(pending).rejects.toMatchObject({ code: 'SIDECAR_EXITED' });
+    expect(sidecar.isRunning()).toBe(false);
+    await fixture.close();
+  }, 20_000);
+
+  it('kills a sidecar that emits malformed IPC without crashing Electron', async () => {
+    const script = `
+      const readline = require('readline');
+      let count = 0;
+      readline.createInterface({ input: process.stdin }).on('line', (line) => {
+        const request = JSON.parse(line);
+        if (count++ === 0) process.stdout.write(JSON.stringify({version:2,type:'response',requestId:request.requestId,ok:true,result:{service:'qortal-private-transport',sidecarVersion:'0.11.0',protocolVersion:2,innerAlpn:'qortal-private/1',moqAlpn:'moqt-18'}}) + '\\n');
+        else process.stdout.write('{not-json\\n');
+      });
+    `;
+    const sidecar = new PrivateTransportSidecar({
+      command: process.execPath,
+      args: ['-e', script],
+    });
+    await sidecar.start();
+    await expect(
+      sidecar.openMasqueTunnel({
+        relayAddress: '127.0.0.1:1',
+        relayServerName: 'test',
+        relayCertSha256: '00'.repeat(32),
+        targetAddress: '127.0.0.1:2',
+      })
+    ).rejects.toMatchObject({ code: 'MALFORMED_RESPONSE' });
+    expect(sidecar.isRunning()).toBe(false);
+  });
+});
+
+describe('MASQUE prototype configuration boundary', () => {
+  it('accepts only trusted literal endpoints', () => {
+    expect(() =>
+      readMasqueTestConfig({
+        QORTAL_MASQUE_TEST_RELAY_ADDRESS: 'relay.example:443',
+        QORTAL_MASQUE_TEST_TARGET_ADDRESS: '127.0.0.1:9000',
+        QORTAL_MASQUE_TEST_RELAY_SERVER_NAME: 'relay.example',
+        QORTAL_MASQUE_TEST_RELAY_CERT_SHA256: 'ab'.repeat(32),
+      })
+    ).toThrow('Invalid literal relay endpoint');
+  });
+
+  it('uses stable coded sidecar errors', () => {
+    expect(new PrivateTransportSidecarError('TEST').code).toBe('TEST');
+  });
+
+  it('rejects invalid MOQT names and oversized objects before IPC', async () => {
+    const sidecar = new PrivateTransportSidecar();
+    await expect(
+      sidecar.openMoqSession({
+        relayAddress: '127.0.0.1:1',
+        relayServerName: 'relay',
+        relayCertSha256: '00'.repeat(32),
+        backendAddress: '127.0.0.1:2',
+        backendServerName: 'backend',
+        backendCertSha256: '11'.repeat(32),
+        logicalSessionId: 'logical',
+        attachToken: 'x'.repeat(32),
+        publicationNamespace: ['invalid component'],
+        publicationTrack: 'events',
+      })
+    ).rejects.toMatchObject({ code: 'INVALID_MOQ_CONFIG' });
+    await expect(
+      sidecar.publishMoqObject('moq-session', new Uint8Array(1025))
+    ).rejects.toMatchObject({ code: 'MOQ_OBJECT_TOO_LARGE' });
+  });
+});
diff --git a/electron/src/private-transport-sidecar.ts b/electron/src/private-transport-sidecar.ts
new file mode 100644
index 000000000..a15a59527
--- /dev/null
+++ b/electron/src/private-transport-sidecar.ts
@@ -0,0 +1,799 @@
+import { spawn, type ChildProcessWithoutNullStreams } from 'child_process';
+import { randomUUID } from 'crypto';
+import { app } from 'electron';
+import { EventEmitter } from 'events';
+import path from 'path';
+
+export const PRIVATE_TRANSPORT_PROTOCOL_VERSION = 2;
+export const PRIVATE_TRANSPORT_SIDECAR_VERSION = '0.11.0';
+export const MAX_MOQ_OBJECT_BYTES = 1024;
+export const MAX_MOQ_RELIABLE_OBJECT_BYTES = 1024 * 1024;
+export type PreparedRelay = {
+  handle: string;
+  ready: boolean;
+  challenge?: Record<string, unknown>;
+  expiresAt?: number;
+};
+const MOQ_NAME = /^[A-Za-z0-9._-]{1,128}$/;
+
+function validMoqNamespace(namespace: readonly string[]): boolean {
+  return (
+    namespace.length >= 1 &&
+    namespace.length <= 8 &&
+    namespace.every((component) => MOQ_NAME.test(component)) &&
+    namespace.reduce((total, component) => total + component.length, 0) <= 512
+  );
+}
+const MAX_RESPONSE_LINE_BYTES = 64 * 1024;
+const DEFAULT_REQUEST_TIMEOUT_MS = 7_000;
+
+export class PrivateTransportSidecarError extends Error {
+  constructor(
+    public readonly code: string,
+    message = code
+  ) {
+    super(message);
+  }
+}
+
+export type MasqueTestConfig = Readonly<{
+  relayAddress: string;
+  relayServerName: string;
+  relayCertSha256: string;
+  targetAddress: string;
+  timeoutMs?: number;
+}>;
+
+export type PrivateSessionConfig = Readonly<{
+  preparedRelay?: string;
+  relayAddress: string;
+  relayServerName: string;
+  relayCertSha256: string;
+  backendAddress: string;
+  backendServerName: string;
+  backendCertSha256: string;
+  logicalSessionId: string;
+  attachToken: string;
+  nonce: string;
+  purpose: string;
+  ownerBindingHash: string;
+  timeoutMs?: number;
+}>;
+
+export type MoqSessionConfig = Readonly<{
+  preparedRelay?: string;
+  relayAddress: string;
+  relayServerName: string;
+  relayCertSha256: string;
+  backendAddress: string;
+  backendServerName: string;
+  backendCertSha256: string;
+  logicalSessionId: string;
+  attachToken: string;
+  publicationNamespace: readonly string[];
+  publicationTrack: string | readonly string[];
+  timeoutMs?: number;
+}>;
+
+export type MoqSessionInfo = Readonly<{
+  moqSessionId: string;
+  logicalSessionId: string;
+  publicationNamespace: string[];
+  publicationTrack: string | readonly string[];
+  applicationProtocol: 'moqt-18';
+}>;
+
+export type PrivateTransportSidecarEvent = {
+  event: 'reliableMessage' | 'datagram' | 'object' | 'error';
+  sessionId: string;
+  messageId?: string;
+  subscriptionId?: string;
+  namespace?: string[];
+  trackName?: string;
+  groupId?: number;
+  objectId?: number;
+  code?: string;
+  data: Buffer;
+};
+
+type SidecarOperation =
+  | 'prepareRelay'
+  | 'authorizeRelay'
+  | 'closeRelay'
+  | 'clearRelays'
+  | 'prepareRelayTickets'
+  | 'finalizeRelayTickets'
+  | 'health'
+  | 'openMasqueTunnel'
+  | 'sendDatagram'
+  | 'receiveDatagram'
+  | 'closeTunnel'
+  | 'openPrivateSession'
+  | 'sendPrivateReliable'
+  | 'sendPrivateDatagram'
+  | 'sessionMetrics'
+  | 'closePrivateSession'
+  | 'openMoqSession'
+  | 'subscribeMoqTrack'
+  | 'publishMoqObject'
+  | 'moqSessionMetrics'
+  | 'closeMoqSession'
+  | 'shutdown';
+
+type SidecarResponse = {
+  version: number;
+  requestId: string;
+  ok: boolean;
+  result?: unknown;
+  error?: { code?: unknown; message?: unknown };
+  type?: unknown;
+  event?: unknown;
+  sessionId?: unknown;
+  messageId?: unknown;
+  subscriptionId?: unknown;
+  namespace?: unknown;
+  trackName?: unknown;
+  groupId?: unknown;
+  objectId?: unknown;
+  code?: unknown;
+  binaryLength?: unknown;
+};
+
+type PendingRequest = {
+  resolve: (result: unknown) => void;
+  reject: (error: Error) => void;
+  timer: NodeJS.Timeout;
+};
+
+export type PrivateTransportSidecarTestOptions = {
+  /** Test-only trusted launch override. Never populated from renderer input. */
+  command?: string;
+  args?: string[];
+  requestTimeoutMs?: number;
+};
+
+function platformDirectory(): string {
+  const platform =
+    process.platform === 'win32'
+      ? 'windows'
+      : process.platform === 'darwin'
+        ? 'darwin'
+        : 'linux';
+  const arch = process.arch === 'arm64' ? 'arm64' : 'x64';
+  return `${platform}-${arch}`;
+}
+
+export function getPrivateTransportSidecarPath(): string {
+  const executable =
+    process.platform === 'win32'
+      ? 'qortal-private-transport.exe'
+      : 'qortal-private-transport';
+  if (app.isPackaged) {
+    return path.join(
+      process.resourcesPath,
+      'private-transport',
+      platformDirectory(),
+      executable
+    );
+  }
+  return path.join(
+    app.getAppPath(),
+    'resources',
+    'private-transport',
+    platformDirectory(),
+    executable
+  );
+}
+
+export class PrivateTransportSidecar extends EventEmitter {
+  private child: ChildProcessWithoutNullStreams | null = null;
+  private startPromise: Promise<void> | null = null;
+  private stdoutBuffer = Buffer.alloc(0);
+  private pendingBinaryEvent:
+    | (Omit<PrivateTransportSidecarEvent, 'data'> & {
+        binaryLength: number;
+      })
+    | null = null;
+  private readonly pending = new Map<string, PendingRequest>();
+  private stopping = false;
+
+  constructor(
+    private readonly testOptions: PrivateTransportSidecarTestOptions = {}
+  ) {
+    super();
+  }
+
+  async start(): Promise<void> {
+    if (this.startPromise) return this.startPromise;
+    if (this.child) return;
+    this.startPromise = this.spawnAndHandshake().finally(() => {
+      this.startPromise = null;
+    });
+    return this.startPromise;
+  }
+
+  async health(): Promise<{
+    service: string;
+    sidecarVersion: string;
+    protocolVersion: number;
+    innerAlpn?: string;
+    moqAlpn?: string;
+  }> {
+    const result = await this.request('health', {});
+    return result as {
+      service: string;
+      sidecarVersion: string;
+      protocolVersion: number;
+      innerAlpn?: string;
+      moqAlpn?: string;
+    };
+  }
+
+  async prepareRelayTickets(descriptor: Record<string, unknown>) {
+    await this.start();
+    return (await this.request('prepareRelayTickets', { descriptor })) as {
+      handle: string;
+      blinded: string[];
+    };
+  }
+  async finalizeRelayTickets(handle: string, signatures: string[]) {
+    return (await this.request('finalizeRelayTickets', {
+      handle,
+      signatures,
+    })) as { tickets: string[]; expiresAt: number };
+  }
+  async prepareRelay(config: {
+    relayAddress: string;
+    relayServerName: string;
+    relayCertSha256: string;
+    legacyRelay?: boolean;
+  }) {
+    await this.start();
+    return this.validatePreparedRelay(
+      await this.request(
+        'prepareRelay',
+        {
+          relayAddress: config.relayAddress,
+          relayServerName: config.relayServerName,
+          relayCertSha256: config.relayCertSha256,
+          legacyRelay: config.legacyRelay === true,
+        },
+        6_000
+      )
+    );
+  }
+  async authorizeRelay(handle: string, proof = '', renew = false) {
+    return this.validatePreparedRelay(
+      await this.request(
+        'authorizeRelay',
+        { handle, proof, renew: renew || !!proof },
+        9_000
+      )
+    );
+  }
+  private validatePreparedRelay(value: unknown): PreparedRelay {
+    const r = value as PreparedRelay;
+    if (
+      !r ||
+      typeof r.handle !== 'string' ||
+      !/^[a-f0-9]{48}$/.test(r.handle) ||
+      typeof r.ready !== 'boolean' ||
+      (r.expiresAt !== undefined &&
+        (!Number.isSafeInteger(r.expiresAt) || r.expiresAt <= Date.now())) ||
+      (r.challenge !== undefined &&
+        (!r.challenge ||
+          typeof r.challenge !== 'object' ||
+          Array.isArray(r.challenge) ||
+          JSON.stringify(r.challenge).length > 1024)) ||
+      (!r.ready && !r.challenge) ||
+      (r.ready && r.challenge)
+    )
+      throw new PrivateTransportSidecarError('MALFORMED_RESPONSE');
+    return r;
+  }
+  async closeRelay(handle: string) {
+    if (this.child) await this.request('closeRelay', { handle });
+  }
+  async clearRelays() {
+    if (this.child) await this.request('clearRelays', {});
+  }
+
+  async openMasqueTunnel(config: MasqueTestConfig): Promise<string> {
+    await this.start();
+    const result = (await this.request('openMasqueTunnel', config)) as {
+      tunnelId?: unknown;
+    };
+    if (typeof result?.tunnelId !== 'string' || !result.tunnelId) {
+      throw new PrivateTransportSidecarError('MALFORMED_RESPONSE');
+    }
+    return result.tunnelId;
+  }
+
+  async sendDatagram(tunnelId: string, data: Buffer): Promise<void> {
+    await this.request('sendDatagram', {
+      tunnelId,
+      dataBase64: data.toString('base64'),
+    });
+  }
+
+  async receiveDatagram(tunnelId: string, timeoutMs = 5_000): Promise<Buffer> {
+    const result = (await this.request(
+      'receiveDatagram',
+      { tunnelId, timeoutMs },
+      timeoutMs + 1_000
+    )) as { dataBase64?: unknown };
+    if (typeof result?.dataBase64 !== 'string') {
+      throw new PrivateTransportSidecarError('MALFORMED_RESPONSE');
+    }
+    return Buffer.from(result.dataBase64, 'base64');
+  }
+
+  async closeTunnel(tunnelId: string): Promise<void> {
+    if (!this.child) return;
+    await this.request('closeTunnel', { tunnelId });
+  }
+
+  async openPrivateSession(config: PrivateSessionConfig): Promise<{
+    sessionId: string;
+    innerQuicConnectionId: string;
+    logicalSessionId: string;
+    transportGeneration: number;
+  }> {
+    await this.start();
+    const result = (await this.request('openPrivateSession', config)) as Record<
+      string,
+      unknown
+    >;
+    if (
+      typeof result?.sessionId !== 'string' ||
+      typeof result?.innerQuicConnectionId !== 'string' ||
+      typeof result?.logicalSessionId !== 'string' ||
+      result?.transportGeneration !== 1
+    )
+      throw new PrivateTransportSidecarError('MALFORMED_RESPONSE');
+    return result as {
+      sessionId: string;
+      innerQuicConnectionId: string;
+      logicalSessionId: string;
+      transportGeneration: number;
+    };
+  }
+
+  async sendPrivateReliable(
+    sessionId: string,
+    messageId: string,
+    data: Buffer,
+    streamKey?: string,
+    endStream?: boolean
+  ): Promise<void> {
+    await this.request(
+      'sendPrivateReliable',
+      { sessionId, messageId, streamKey, endStream },
+      undefined,
+      data
+    );
+  }
+
+  async sendPrivateDatagram(
+    sessionId: string,
+    messageId: string,
+    data: Buffer
+  ): Promise<void> {
+    await this.request(
+      'sendPrivateDatagram',
+      { sessionId, messageId },
+      undefined,
+      data
+    );
+  }
+
+  async sessionMetrics(sessionId: string): Promise<Record<string, number>> {
+    return (await this.request('sessionMetrics', { sessionId })) as Record<
+      string,
+      number
+    >;
+  }
+
+  async closePrivateSession(sessionId: string): Promise<void> {
+    if (this.child) await this.request('closePrivateSession', { sessionId });
+  }
+
+  async openMoqSession(config: MoqSessionConfig): Promise<MoqSessionInfo> {
+    if (
+      !validMoqNamespace(config.publicationNamespace) ||
+      !(
+        typeof config.publicationTrack === 'string'
+          ? [config.publicationTrack]
+          : config.publicationTrack
+      ).every((track) => MOQ_NAME.test(track))
+    ) {
+      throw new PrivateTransportSidecarError('INVALID_MOQ_CONFIG');
+    }
+    await this.start();
+    const result = (await this.request('openMoqSession', config)) as Record<
+      string,
+      unknown
+    >;
+    if (
+      typeof result?.moqSessionId !== 'string' ||
+      !result.moqSessionId.startsWith('moq-') ||
+      typeof result?.logicalSessionId !== 'string' ||
+      !Array.isArray(result?.publicationNamespace) ||
+      result.publicationNamespace.length !==
+        config.publicationNamespace.length ||
+      !result.publicationNamespace.every(
+        (component, index) => component === config.publicationNamespace[index]
+      ) ||
+      JSON.stringify(result?.publicationTrack) !==
+        JSON.stringify(config.publicationTrack) ||
+      result?.applicationProtocol !== 'moqt-18'
+    ) {
+      throw new PrivateTransportSidecarError('MALFORMED_RESPONSE');
+    }
+    return result as MoqSessionInfo;
+  }
+
+  async subscribeMoqTrack(
+    moqSessionId: string,
+    subscriptionId: string,
+    namespace: readonly string[],
+    trackName: string
+  ): Promise<void> {
+    if (
+      !MOQ_NAME.test(subscriptionId) ||
+      !validMoqNamespace(namespace) ||
+      !MOQ_NAME.test(trackName)
+    ) {
+      throw new PrivateTransportSidecarError('INVALID_MOQ_SUBSCRIPTION');
+    }
+    await this.request('subscribeMoqTrack', {
+      moqSessionId,
+      subscriptionId,
+      namespace,
+      trackName,
+    });
+  }
+
+  async publishMoqObject(
+    moqSessionId: string,
+    payload: Uint8Array,
+    trackName?: string,
+    batch?: readonly Uint8Array[],
+    delivery?: {
+      priority: number;
+      maxQueueAgeMillis: number;
+      groupId?: number;
+      objectId?: number;
+    }
+  ): Promise<void> {
+    const reliable =
+      delivery?.groupId !== undefined || delivery?.objectId !== undefined;
+    const limit = reliable
+      ? MAX_MOQ_RELIABLE_OBJECT_BYTES
+      : MAX_MOQ_OBJECT_BYTES;
+    if (
+      reliable &&
+      (!Number.isSafeInteger(delivery?.groupId) ||
+        delivery!.groupId! < 0 ||
+        !Number.isSafeInteger(delivery?.objectId) ||
+        delivery!.objectId! < 0 ||
+        !trackName ||
+        !MOQ_NAME.test(trackName) ||
+        batch?.length !== 1)
+    ) {
+      throw new PrivateTransportSidecarError('INVALID_MOQ_CONFIG');
+    }
+    if (payload.byteLength < 1 || payload.byteLength > limit) {
+      throw new PrivateTransportSidecarError('MOQ_OBJECT_TOO_LARGE');
+    }
+    let binary = payload;
+    if (batch && !reliable) {
+      if (
+        !batch.length ||
+        batch.length > 8 ||
+        !trackName ||
+        !MOQ_NAME.test(trackName) ||
+        batch.some((item) => !item.length || item.length > MAX_MOQ_OBJECT_BYTES)
+      )
+        throw new PrivateTransportSidecarError('MOQ_OBJECT_TOO_LARGE');
+      binary = Buffer.concat(
+        batch.map((item) => {
+          const size = Buffer.alloc(2);
+          size.writeUInt16BE(item.length);
+          return Buffer.concat([size, Buffer.from(item)]);
+        })
+      );
+    }
+    await this.request(
+      'publishMoqObject',
+      {
+        moqSessionId,
+        ...(trackName ? { trackName } : {}),
+        ...(batch && !reliable ? { batched: true } : {}),
+        ...(delivery
+          ? {
+              delivery: {
+                priority: delivery.priority,
+                maxQueueAgeMillis: delivery.maxQueueAgeMillis,
+              },
+            }
+          : {}),
+        ...(reliable
+          ? { groupId: delivery!.groupId, objectId: delivery!.objectId }
+          : {}),
+      },
+      undefined,
+      binary
+    );
+  }
+
+  async moqSessionMetrics(
+    moqSessionId: string
+  ): Promise<Record<string, number>> {
+    return (await this.request('moqSessionMetrics', {
+      moqSessionId,
+    })) as Record<string, number>;
+  }
+
+  async closeMoqSession(moqSessionId: string): Promise<void> {
+    if (this.child) await this.request('closeMoqSession', { moqSessionId });
+  }
+
+  async shutdown(): Promise<void> {
+    const child = this.child;
+    if (!child) return;
+    this.stopping = true;
+    try {
+      await this.request('shutdown', {}, 1_000);
+    } catch {
+      // Exit/kill below remains authoritative.
+    }
+    if (this.child === child && child.exitCode === null) {
+      await Promise.race([
+        new Promise<void>((resolve) => child.once('exit', () => resolve())),
+        new Promise<void>((resolve) => setTimeout(resolve, 500)),
+      ]);
+    }
+    if (this.child === child && child.exitCode === null) child.kill();
+    this.child = null;
+    this.rejectPending('SIDECAR_STOPPED');
+    this.stopping = false;
+  }
+
+  /** Exposed for lifecycle tests; production callers use the typed methods. */
+  isRunning(): boolean {
+    return this.child !== null;
+  }
+
+  /** Test-only fault injection; not reachable from preload or renderer IPC. */
+  terminateForTest(): void {
+    this.child?.kill();
+  }
+
+  private async spawnAndHandshake(): Promise<void> {
+    const command =
+      this.testOptions.command ?? getPrivateTransportSidecarPath();
+    const args = this.testOptions.args ?? [];
+    const child = spawn(command, args, {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true,
+      shell: false,
+    });
+    this.child = child;
+    this.stopping = false;
+    child.stderr.resume();
+    child.stdout.on('data', (chunk: Buffer) => this.handleStdout(child, chunk));
+    child.on('error', () => this.handleDeath(child, 'SIDECAR_SPAWN_FAILED'));
+    child.on('exit', () => this.handleDeath(child, 'SIDECAR_EXITED'));
+
+    try {
+      const health = await this.health();
+      if (
+        health.service !== 'qortal-private-transport' ||
+        health.sidecarVersion !== PRIVATE_TRANSPORT_SIDECAR_VERSION ||
+        health.protocolVersion !== PRIVATE_TRANSPORT_PROTOCOL_VERSION ||
+        health.innerAlpn !== 'qortal-private/1' ||
+        health.moqAlpn !== 'moqt-18'
+      ) {
+        throw new PrivateTransportSidecarError('SIDECAR_VERSION_MISMATCH');
+      }
+    } catch (error) {
+      if (this.child === child) child.kill();
+      this.child = null;
+      throw error;
+    }
+  }
+
+  private request(
+    operation: SidecarOperation,
+    params: unknown,
+    timeoutMs = this.testOptions.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,
+    binary: Uint8Array = Buffer.alloc(0)
+  ): Promise<unknown> {
+    const child = this.child;
+    if (!child || !child.stdin.writable) {
+      return Promise.reject(
+        new PrivateTransportSidecarError('SIDECAR_NOT_RUNNING')
+      );
+    }
+    const requestId = randomUUID();
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(requestId);
+        reject(new PrivateTransportSidecarError('SIDECAR_REQUEST_TIMEOUT'));
+      }, timeoutMs);
+      this.pending.set(requestId, { resolve, reject, timer });
+      const frame = JSON.stringify({
+        version: PRIVATE_TRANSPORT_PROTOCOL_VERSION,
+        requestId,
+        operation,
+        params,
+        binaryLength: binary.length || undefined,
+      });
+      child.stdin.write(
+        Buffer.concat([Buffer.from(`${frame}\n`), binary]),
+        (error) => {
+          if (!error) return;
+          const pending = this.pending.get(requestId);
+          if (!pending) return;
+          clearTimeout(pending.timer);
+          this.pending.delete(requestId);
+          pending.reject(
+            new PrivateTransportSidecarError('SIDECAR_WRITE_FAILED')
+          );
+        }
+      );
+    });
+  }
+
+  private handleStdout(
+    child: ChildProcessWithoutNullStreams,
+    chunk: Buffer
+  ): void {
+    if (this.child !== child) return;
+    this.stdoutBuffer = Buffer.concat([this.stdoutBuffer, chunk]);
+    for (;;) {
+      if (this.pendingBinaryEvent) {
+        if (this.stdoutBuffer.length < this.pendingBinaryEvent.binaryLength)
+          return;
+        const pending = this.pendingBinaryEvent;
+        const data = this.stdoutBuffer.subarray(0, pending.binaryLength);
+        this.stdoutBuffer = this.stdoutBuffer.subarray(pending.binaryLength);
+        this.pendingBinaryEvent = null;
+        this.emit('event', { ...pending, binaryLength: undefined, data });
+        continue;
+      }
+      const newline = this.stdoutBuffer.indexOf(0x0a);
+      if (newline === -1) {
+        if (this.stdoutBuffer.length > MAX_RESPONSE_LINE_BYTES) {
+          this.failMalformed(child);
+        }
+        return;
+      }
+      const line = this.stdoutBuffer
+        .subarray(0, newline)
+        .toString('utf8')
+        .trim();
+      this.stdoutBuffer = this.stdoutBuffer.subarray(newline + 1);
+      if (!line) continue;
+      if (Buffer.byteLength(line, 'utf8') > MAX_RESPONSE_LINE_BYTES) {
+        this.failMalformed(child);
+        return;
+      }
+      let response: SidecarResponse;
+      try {
+        response = JSON.parse(line) as SidecarResponse;
+      } catch {
+        this.failMalformed(child);
+        return;
+      }
+      if (response.type === 'event') {
+        if (
+          response.version !== PRIVATE_TRANSPORT_PROTOCOL_VERSION ||
+          typeof response.event !== 'string' ||
+          !['reliableMessage', 'datagram', 'object', 'error'].includes(
+            response.event
+          ) ||
+          typeof response.sessionId !== 'string' ||
+          (response.namespace !== undefined &&
+            (!Array.isArray(response.namespace) ||
+              !response.namespace.every(
+                (component) => typeof component === 'string'
+              ))) ||
+          (response.binaryLength !== undefined &&
+            (!Number.isInteger(response.binaryLength) ||
+              (response.binaryLength as number) < 0 ||
+              (response.binaryLength as number) > 1024 * 1024))
+        ) {
+          this.failMalformed(child);
+          return;
+        }
+        const event = {
+          event: response.event as PrivateTransportSidecarEvent['event'],
+          sessionId: response.sessionId,
+          messageId:
+            typeof response.messageId === 'string'
+              ? response.messageId
+              : undefined,
+          subscriptionId:
+            typeof response.subscriptionId === 'string'
+              ? response.subscriptionId
+              : undefined,
+          namespace: Array.isArray(response.namespace)
+            ? (response.namespace as string[])
+            : undefined,
+          trackName:
+            typeof response.trackName === 'string'
+              ? response.trackName
+              : undefined,
+          groupId:
+            typeof response.groupId === 'number' &&
+            Number.isSafeInteger(response.groupId) &&
+            response.groupId >= 0
+              ? response.groupId
+              : undefined,
+          objectId:
+            typeof response.objectId === 'number' &&
+            Number.isSafeInteger(response.objectId) &&
+            response.objectId >= 0
+              ? response.objectId
+              : undefined,
+          code: typeof response.code === 'string' ? response.code : undefined,
+          binaryLength: Number(response.binaryLength ?? 0),
+        };
+        if (event.binaryLength === 0)
+          this.emit('event', { ...event, data: Buffer.alloc(0) });
+        else this.pendingBinaryEvent = event;
+        continue;
+      }
+      if (
+        response.version !== PRIVATE_TRANSPORT_PROTOCOL_VERSION ||
+        typeof response.requestId !== 'string' ||
+        typeof response.ok !== 'boolean'
+      ) {
+        this.failMalformed(child);
+        return;
+      }
+      const pending = this.pending.get(response.requestId);
+      if (!pending) {
+        this.failMalformed(child);
+        return;
+      }
+      clearTimeout(pending.timer);
+      this.pending.delete(response.requestId);
+      if (response.ok) pending.resolve(response.result);
+      else {
+        const code =
+          typeof response.error?.code === 'string'
+            ? response.error.code
+            : 'SIDECAR_OPERATION_FAILED';
+        pending.reject(new PrivateTransportSidecarError(code));
+      }
+    }
+  }
+
+  private failMalformed(child: ChildProcessWithoutNullStreams): void {
+    this.handleDeath(child, 'MALFORMED_RESPONSE');
+    child.kill();
+  }
+
+  private handleDeath(
+    child: ChildProcessWithoutNullStreams,
+    code: string
+  ): void {
+    if (this.child !== child) return;
+    this.child = null;
+    this.stdoutBuffer = Buffer.alloc(0);
+    this.pendingBinaryEvent = null;
+    this.emit('death', code);
+    this.rejectPending(this.stopping ? 'SIDECAR_STOPPED' : code);
+  }
+
+  private rejectPending(code: string): void {
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(new PrivateTransportSidecarError(code));
+    }
+    this.pending.clear();
+  }
+}
diff --git a/electron/src/qapp-file-save.test.ts b/electron/src/qapp-file-save.test.ts
new file mode 100644
index 000000000..933dfc764
--- /dev/null
+++ b/electron/src/qapp-file-save.test.ts
@@ -0,0 +1,154 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { promises as fs } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { QAppFileSaves, SAVE_CHUNK_LIMIT } from './qapp-file-save';
+
+describe('permission-scoped streaming saves', () => {
+  let dir: string, destination: string, manager: QAppFileSaves, now: number;
+  beforeEach(async () => {
+    dir = await fs.mkdtemp(join(tmpdir(), 'qapp-save-test-'));
+    destination = join(dir, 'chosen.txt');
+    now = 0;
+    manager = new QAppFileSaves(join(dir, 'journal'), () => now);
+  });
+  afterEach(async () => {
+    await manager.cleanup();
+    await fs.rm(dir, { recursive: true, force: true });
+  });
+  const bytes = new Uint8Array([1, 2, 3]);
+  const open = () =>
+    manager.open('tab-a', 'suggested.txt', 3, async () => destination);
+
+  it('does not replace the approved destination until exact-length finish', async () => {
+    await fs.writeFile(destination, 'original');
+    const { saveId } = await open();
+    expect(await fs.readFile(destination, 'utf8')).toBe('original');
+    await expect(manager.finish('tab-a', saveId)).rejects.toThrow(
+      'SAVE_INCOMPLETE'
+    );
+    await manager.write('tab-a', saveId, 0, bytes);
+    expect(await fs.readFile(destination, 'utf8')).toBe('original');
+    expect(await manager.finish('tab-a', saveId)).toEqual({ saved: true });
+    expect(new Uint8Array(await fs.readFile(destination))).toEqual(bytes);
+    expect(await fs.readdir(join(dir, 'journal'))).toEqual([]);
+  });
+  it('rejects cross-tab writes/finish and ignores cross-tab abort', async () => {
+    const { saveId } = await open();
+    await expect(manager.write('tab-b', saveId, 0, bytes)).rejects.toThrow(
+      'SAVE_NOT_FOUND'
+    );
+    await expect(manager.finish('tab-b', saveId)).rejects.toThrow(
+      'SAVE_NOT_FOUND'
+    );
+    await manager.abort('tab-b', saveId);
+    await manager.write('tab-a', saveId, 0, bytes);
+    await manager.finish('tab-a', saveId);
+  });
+  it('bounds chunks and enforces size, offset and one in-flight write', async () => {
+    const { saveId } = await open();
+    await expect(manager.write('tab-a', saveId, 1, bytes)).rejects.toThrow(
+      'SAVE_INVALID_CHUNK'
+    );
+    await expect(
+      manager.write('tab-a', saveId, 0, new Uint8Array(SAVE_CHUNK_LIMIT + 1))
+    ).rejects.toThrow('SAVE_INVALID_CHUNK');
+    await expect(
+      manager.write('tab-a', saveId, 0, new Uint8Array(4))
+    ).rejects.toThrow('SAVE_INVALID_CHUNK');
+    const write = manager.write('tab-a', saveId, 0, bytes);
+    await expect(manager.write('tab-a', saveId, 0, bytes)).rejects.toThrow(
+      'SAVE_BUSY'
+    );
+    await write;
+  });
+  it('cancels an active save without touching an existing destination', async () => {
+    await fs.writeFile(destination, 'original');
+    const { saveId } = await open();
+    await manager.write('tab-a', saveId, 0, bytes);
+    await manager.cleanup('tab-a');
+    expect(await fs.readFile(destination, 'utf8')).toBe('original');
+    expect((await fs.readdir(dir)).filter((n) => n.endsWith('.part'))).toEqual(
+      []
+    );
+    await expect(manager.finish('tab-a', saveId)).rejects.toThrow(
+      'SAVE_NOT_FOUND'
+    );
+  });
+  it('invalidates pending approval on logout and creates no file', async () => {
+    let choose!: (path: string) => void;
+    const opening = manager.open(
+      'tab-a',
+      'name.txt',
+      3,
+      () =>
+        new Promise((resolve) => {
+          choose = resolve;
+        })
+    );
+    while (!choose) await new Promise((resolve) => setTimeout(resolve, 1));
+    await manager.cleanup();
+    choose(destination);
+    await expect(opening).rejects.toThrow('SAVE_CANCELLED');
+    expect((await fs.readdir(dir)).filter((n) => n.endsWith('.part'))).toEqual(
+      []
+    );
+  });
+
+  it('cancels during an in-flight write and cleans up after that write settles', async () => {
+    await fs.writeFile(destination, 'original');
+    const { saveId } = await open();
+    const writing = manager.write('tab-a', saveId, 0, bytes);
+    await manager.abort('tab-a', saveId);
+    await expect(writing).rejects.toThrow('SAVE_CANCELLED');
+    expect(await fs.readFile(destination, 'utf8')).toBe('original');
+    expect((await fs.readdir(dir)).filter((n) => n.endsWith('.part'))).toEqual(
+      []
+    );
+  });
+  it('expires idle saves and limits unapproved concurrent prompts', async () => {
+    const { saveId } = await open();
+    await expect(open()).rejects.toThrow('SAVE_BUSY');
+    now = 5 * 60_000 + 1;
+    await manager.expire();
+    await expect(manager.write('tab-a', saveId, 0, bytes)).rejects.toThrow(
+      'SAVE_NOT_FOUND'
+    );
+  });
+  it('rejects paths, bidi filenames and unreasonable sizes before prompting', async () => {
+    for (const filename of ['../secret', 'a\\b', 'a\u202etxt'])
+      await expect(
+        manager.open('tab-a', filename, 3, async () => destination)
+      ).rejects.toThrow('SAVE_INVALID_REQUEST');
+    await expect(
+      manager.open('tab-a', 'ok', 9 * 1024 ** 3, async () => destination)
+    ).rejects.toThrow('SAVE_INVALID_REQUEST');
+  });
+  it('cleans journalled crash remnants without deleting the completed file', async () => {
+    await fs.mkdir(join(dir, 'journal'));
+    const id = '12345678-1234-1234-1234-123456789abc';
+    const part = join(dir, `.qortal-save-${id}.part`);
+    await fs.writeFile(part, 'incomplete');
+    await fs.writeFile(destination, 'complete');
+    await fs.writeFile(
+      join(dir, 'journal', `${id}.json`),
+      JSON.stringify({ part })
+    );
+    await manager.initialize();
+    await expect(fs.stat(part)).rejects.toMatchObject({ code: 'ENOENT' });
+    expect(await fs.readFile(destination, 'utf8')).toBe('complete');
+  });
+  it('handles empty files and user cancellation', async () => {
+    await expect(
+      manager.open('tab-a', 'empty', 0, async () => undefined)
+    ).rejects.toThrow('SAVE_CANCELLED');
+    const { saveId } = await manager.open(
+      'tab-a',
+      'empty',
+      0,
+      async () => destination
+    );
+    await manager.finish('tab-a', saveId);
+    expect((await fs.stat(destination)).size).toBe(0);
+  });
+});
diff --git a/electron/src/qapp-file-save.ts b/electron/src/qapp-file-save.ts
new file mode 100644
index 000000000..3dc0c6621
--- /dev/null
+++ b/electron/src/qapp-file-save.ts
@@ -0,0 +1,252 @@
+import { randomUUID } from 'crypto';
+import { promises as fs } from 'fs';
+import type { FileHandle } from 'fs/promises';
+import { basename, dirname, isAbsolute, join } from 'path';
+
+export const SAVE_CHUNK_LIMIT = 256 * 1024;
+const MAX_SIZE = 8 * 1024 ** 3;
+const IDLE_MS = 5 * 60_000;
+type Save = {
+  id: string;
+  owner: string;
+  size: number;
+  offset: number;
+  created: number;
+  touched: number;
+  cancelled: boolean;
+  busy: boolean;
+  file?: FileHandle;
+  part?: string;
+  destination?: string;
+};
+export class SaveError extends Error {}
+function fail(code: string): never {
+  throw new SaveError(code);
+}
+
+/** Paths never cross the renderer boundary. Only the native dialog chooses them. */
+export class QAppFileSaves {
+  private saves = new Map<string, Save>();
+  private recovery?: Promise<void>;
+  constructor(
+    private journal: string,
+    private now = Date.now
+  ) {}
+  initialize() {
+    return (this.recovery ??= this.recover());
+  }
+
+  private async recover() {
+    await fs.mkdir(this.journal, { recursive: true, mode: 0o700 });
+    for (const name of await fs.readdir(this.journal)) {
+      if (!/^[a-f0-9-]{36}\.json$/.test(name)) continue;
+      const record = join(this.journal, name);
+      try {
+        const part = JSON.parse(await fs.readFile(record, 'utf8')).part;
+        if (
+          typeof part !== 'string' ||
+          !isAbsolute(part) ||
+          basename(part) !== `.qortal-save-${name.slice(0, -5)}.part`
+        )
+          continue;
+        await fs.unlink(part).catch((e) => {
+          if (e.code !== 'ENOENT') throw e;
+        });
+        await fs.unlink(record);
+      } catch {
+        /* Keep failed records for a later recovery attempt. */
+      }
+    }
+  }
+
+  async open(
+    owner: string,
+    filename: unknown,
+    size: unknown,
+    choose: (
+      filename: string,
+      size: number,
+      checkLive: () => void
+    ) => Promise<string | undefined>
+  ) {
+    if (
+      typeof filename !== 'string' ||
+      !filename ||
+      filename.length > 200 ||
+      /[\\/\u202a-\u202e\u2066-\u2069]/.test(filename) ||
+      [...filename].some(
+        (char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127
+      ) ||
+      filename === '.' ||
+      filename === '..' ||
+      !Number.isSafeInteger(size) ||
+      (size as number) < 0 ||
+      (size as number) > MAX_SIZE
+    )
+      fail('SAVE_INVALID_REQUEST');
+    if (
+      this.saves.size >= 8 ||
+      [...this.saves.values()].some((s) => s.owner === owner)
+    )
+      fail('SAVE_BUSY');
+    const save: Save = {
+      id: randomUUID(),
+      owner,
+      size: size as number,
+      offset: 0,
+      created: this.now(),
+      touched: this.now(),
+      busy: true,
+      cancelled: false,
+    };
+    this.saves.set(save.id, save);
+    try {
+      await this.initialize();
+      this.live(save);
+      const destination = await choose(filename, save.size, () =>
+        this.live(save)
+      );
+      this.live(save);
+      if (!destination) fail('SAVE_CANCELLED');
+      if (!isAbsolute(destination)) fail('SAVE_INVALID_REQUEST');
+      // Do not allow two saves to race replacement of the same destination.
+      if (
+        [...this.saves.values()].some(
+          (s) => s !== save && s.destination === destination
+        )
+      )
+        fail('SAVE_BUSY');
+      save.destination = destination;
+      save.part = join(dirname(destination), `.qortal-save-${save.id}.part`);
+      const record = await fs.open(
+        join(this.journal, `${save.id}.json`),
+        'wx',
+        0o600
+      );
+      try {
+        await record.writeFile(JSON.stringify({ part: save.part }));
+        await record.sync();
+      } finally {
+        await record.close();
+      }
+      save.file = await fs.open(save.part, 'wx', 0o600);
+      this.live(save);
+      save.touched = this.now();
+      save.busy = false;
+      return { saveId: save.id, maxChunkBytes: SAVE_CHUNK_LIMIT };
+    } catch (error) {
+      await this.dispose(save);
+      throw error;
+    }
+  }
+
+  private live(save: Save) {
+    if (
+      save.cancelled ||
+      this.now() - save.touched > IDLE_MS ||
+      this.now() - save.created > 24 * 60 * 60_000
+    )
+      fail('SAVE_CANCELLED');
+  }
+  private get(owner: string, id: unknown) {
+    const save = typeof id === 'string' ? this.saves.get(id) : undefined;
+    if (!save || save.owner !== owner) fail('SAVE_NOT_FOUND');
+    this.live(save);
+    if (save.busy) fail('SAVE_BUSY');
+    return save;
+  }
+  async write(owner: string, id: unknown, offset: unknown, data: unknown) {
+    const save = this.get(owner, id);
+    if (
+      !(data instanceof Uint8Array) ||
+      data.byteLength < 1 ||
+      data.byteLength > SAVE_CHUNK_LIMIT ||
+      offset !== save.offset ||
+      save.offset + data.byteLength > save.size
+    )
+      fail('SAVE_INVALID_CHUNK');
+    save.busy = true;
+    try {
+      let written = 0;
+      while (written < data.byteLength) {
+        this.live(save);
+        const result = await save.file.write(
+          data,
+          written,
+          data.byteLength - written,
+          save.offset + written
+        );
+        if (!result.bytesWritten) fail('SAVE_IO_ERROR');
+        written += result.bytesWritten;
+      }
+      this.live(save);
+      save.offset += written;
+      save.touched = this.now();
+      return { bytesWritten: save.offset };
+    } catch (error) {
+      await this.dispose(save);
+      throw error;
+    } finally {
+      save.busy = false;
+    }
+  }
+  async finish(owner: string, id: unknown) {
+    const save = this.get(owner, id);
+    if (save.offset !== save.size) fail('SAVE_INCOMPLETE');
+    save.busy = true;
+    try {
+      await save.file.sync();
+      await save.file.close();
+      save.file = undefined;
+      this.live(save);
+      // Atomic replacement only after the app explicitly finishes verification.
+      await fs.rename(save.part, save.destination);
+      return { saved: true };
+    } finally {
+      await this.dispose(save);
+    }
+  }
+  async abort(owner: string, id: unknown) {
+    const save = typeof id === 'string' ? this.saves.get(id) : undefined;
+    if (!save || save.owner !== owner) return { aborted: true };
+    save.cancelled = true;
+    // In-flight operations own cleanup; don't close a descriptor beneath a write.
+    if (!save.busy) await this.dispose(save);
+    return { aborted: true };
+  }
+  async cleanup(owner?: string) {
+    await Promise.all(
+      [...this.saves.values()]
+        .filter((s) => !owner || s.owner === owner)
+        .map((s) => this.abort(s.owner, s.id))
+    );
+  }
+  async expire() {
+    await Promise.all(
+      [...this.saves.values()]
+        .filter(
+          (s) =>
+            this.now() - s.touched > IDLE_MS ||
+            this.now() - s.created > 24 * 60 * 60_000
+        )
+        .map((s) => this.abort(s.owner, s.id))
+    );
+  }
+  private async dispose(save: Save) {
+    save.cancelled = true;
+    try {
+      await save.file?.close();
+      save.file = undefined;
+      if (save.part)
+        await fs.unlink(save.part).catch((e) => {
+          if (e.code !== 'ENOENT') throw e;
+        });
+      await fs.unlink(join(this.journal, `${save.id}.json`)).catch((e) => {
+        if (e.code !== 'ENOENT') throw e;
+      });
+    } catch {
+      /* Journal retains the exact partial path for next launch cleanup. */
+    }
+    this.saves.delete(save.id);
+  }
+}
diff --git a/electron/src/qapp-guest-network-policy.ts b/electron/src/qapp-guest-network-policy.ts
new file mode 100644
index 000000000..df4b36bc9
--- /dev/null
+++ b/electron/src/qapp-guest-network-policy.ts
@@ -0,0 +1,8 @@
+import type { WebContents } from 'electron';
+
+/** Keep a Q-App guest from gathering direct WebRTC network candidates. */
+export function restrictQAppGuestWebRtc(
+  guest: Pick<WebContents, 'setWebRTCIPHandlingPolicy'>
+): void {
+  guest.setWebRTCIPHandlingPolicy('disable_non_proxied_udp');
+}
diff --git a/electron/src/qapp-guest-policy.test.ts b/electron/src/qapp-guest-policy.test.ts
new file mode 100644
index 000000000..62528e061
--- /dev/null
+++ b/electron/src/qapp-guest-policy.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest';
+import { qappGuestPartition, qappGuestUrlAllowed } from './qapp-guest-policy';
+
+const owner = { tabId: 'tab-1', service: 'APP', name: 'a-test-2' };
+const initial = 'https://127.0.0.1:12391/render/APP/a-test-2/?theme=dark';
+
+describe('Q-App guest isolation policy', () => {
+  it('keeps browser storage separate for different apps on one Core origin', () => {
+    const origin = 'https://127.0.0.1:12391';
+    expect(qappGuestPartition(origin, owner)).toBe(
+      qappGuestPartition(origin, { ...owner, tabId: 'tab-2' })
+    );
+    expect(qappGuestPartition(origin, owner)).not.toBe(
+      qappGuestPartition(origin, { ...owner, name: 'other-app' })
+    );
+    expect(qappGuestPartition(origin, owner)).not.toBe(
+      qappGuestPartition('https://127.0.0.1:12392', owner)
+    );
+  });
+
+  it('allows routes within the app and blocks navigation into another app', () => {
+    expect(
+      qappGuestUrlAllowed(initial, `${initial}#call=1`, owner, false)
+    ).toBe(true);
+    expect(
+      qappGuestUrlAllowed(
+        initial,
+        'https://127.0.0.1:12391/render/APP/a-test-2/call/123',
+        owner,
+        false
+      )
+    ).toBe(true);
+    expect(
+      qappGuestUrlAllowed(
+        initial,
+        'https://127.0.0.1:12391/render/APP/other-app/',
+        owner,
+        false
+      )
+    ).toBe(false);
+    expect(
+      qappGuestUrlAllowed(
+        initial,
+        'https://127.0.0.1:12391/render/APP/a-test-2-evil/',
+        owner,
+        false
+      )
+    ).toBe(false);
+    expect(
+      qappGuestUrlAllowed(
+        initial,
+        'https://attacker.example/render/APP/a-test-2/',
+        owner,
+        false
+      )
+    ).toBe(false);
+    expect(
+      qappGuestUrlAllowed(initial, 'file:///tmp/secret', owner, false)
+    ).toBe(false);
+    expect(
+      qappGuestUrlAllowed(
+        'https://127.0.0.1:12391/render/hash/abc123/',
+        'https://127.0.0.1:12391/render/APP/other-app/',
+        owner,
+        false
+      )
+    ).toBe(false);
+  });
+});
diff --git a/electron/src/qapp-guest-policy.ts b/electron/src/qapp-guest-policy.ts
new file mode 100644
index 000000000..aba066db5
--- /dev/null
+++ b/electron/src/qapp-guest-policy.ts
@@ -0,0 +1,40 @@
+import { createHash } from 'crypto';
+
+export type QAppGuestOwner = {
+  tabId: string;
+  name: string;
+  service: string;
+};
+
+export function qappGuestPartition(
+  origin: string,
+  owner: QAppGuestOwner
+): string {
+  const digest = createHash('sha256')
+    .update(JSON.stringify([origin, owner.service, owner.name]))
+    .digest('hex');
+  return `persist:qapp-${digest}`;
+}
+
+export function qappGuestUrlAllowed(
+  initialUrl: string,
+  nextUrl: string,
+  owner: QAppGuestOwner,
+  isDevMode: boolean
+): boolean {
+  try {
+    const initial = new URL(initialUrl);
+    const next = new URL(nextUrl);
+    if (initial.origin !== next.origin) return false;
+    if (!['http:', 'https:'].includes(next.protocol)) return false;
+    if (isDevMode) return true;
+    if (initial.pathname.startsWith('/render/hash/')) {
+      const root = initial.pathname.split('/').slice(0, 4).join('/');
+      return next.pathname === root || next.pathname.startsWith(`${root}/`);
+    }
+    const root = `/render/${encodeURIComponent(owner.service)}/${encodeURIComponent(owner.name)}`;
+    return next.pathname === root || next.pathname.startsWith(`${root}/`);
+  } catch {
+    return false;
+  }
+}
diff --git a/electron/src/qapp-guest-preload.ts b/electron/src/qapp-guest-preload.ts
new file mode 100644
index 000000000..6b583ff79
--- /dev/null
+++ b/electron/src/qapp-guest-preload.ts
@@ -0,0 +1,120 @@
+import { ipcRenderer } from 'electron';
+
+// This preload runs only in an isolated Q-App guest. No Electron API is exposed
+// to the page. Core's q-apps.js posts UI requests to window.parent; in a guest
+// page parent === window, so capture the marked request and bridge its reply port.
+const documentId = Array.from(
+  globalThis.crypto.getRandomValues(new Uint8Array(16))
+)
+  .map((byte) => byte.toString(16).padStart(2, '0'))
+  .join('');
+let nextRequestId = 0;
+const pending = new Map<number, { port: MessagePort; createdAt: number }>();
+const MAX_PENDING_REPLIES = 256;
+const MAX_QUEUED_REQUESTS = 256;
+const REPLY_TTL_MS = 2 * 60 * 60 * 1000;
+const queued: Array<{ documentId: string; requestId: number; data: unknown }> =
+  [];
+const injectedEvents = new WeakSet<MessageEvent>();
+let ready = false;
+
+window.addEventListener('message', (event: MessageEvent) => {
+  if (injectedEvents.has(event)) return;
+  if (event.source !== window ||
+      (event.data?.requestedHandler !== 'UI' &&
+       event.data?.action !== 'NAVIGATION_SUCCESS')) return;
+  const requestId = ++nextRequestId;
+  const port = event.ports?.[0];
+  if (!ready && queued.length >= MAX_QUEUED_REQUESTS) {
+    port?.postMessage({ result: null, error: 'QAPP_BRIDGE_BUSY' });
+    port?.close();
+    return;
+  }
+  if (port) {
+    const now = Date.now();
+    for (const [id, entry] of pending) {
+      if (now - entry.createdAt <= REPLY_TTL_MS) continue;
+      pending.delete(id);
+      entry.port.close();
+    }
+    if (pending.size >= MAX_PENDING_REPLIES) {
+      port.postMessage({ result: null, error: 'QAPP_BRIDGE_BUSY' });
+      port.close();
+      return;
+    }
+    pending.set(requestId, { port, createdAt: now });
+  }
+  try {
+    const request = {
+      documentId,
+      requestId,
+      data: event.data,
+    };
+    if (ready) ipcRenderer.sendToHost('qapp:request', request);
+    else queued.push(request);
+  } catch {
+    pending.delete(requestId);
+    port?.postMessage({ result: null, error: 'QAPP_BRIDGE_ERROR' });
+    port?.close();
+  }
+});
+
+ipcRenderer.on('qapp:ready', (_event, acceptedDocumentId: string) => {
+  if (acceptedDocumentId !== documentId) return;
+  ready = true;
+  for (const request of queued.splice(0)) {
+    try {
+      ipcRenderer.sendToHost('qapp:request', request);
+    } catch {
+      const entry = pending.get(request.requestId);
+      pending.delete(request.requestId);
+      entry?.port.postMessage({ result: null, error: 'QAPP_BRIDGE_ERROR' });
+      entry?.port.close();
+    }
+  }
+});
+
+// Main binds this guest to its prepared owner using a token passed only to the
+// isolated preload. The shell releases requests as soon as that succeeds.
+const guestToken = process.argv
+  ?.find((arg) => arg.startsWith('--qapp-guest-token='))
+  ?.slice('--qapp-guest-token='.length);
+void (async () => {
+  if (!guestToken) {
+    ipcRenderer.sendToHost('qapp:error');
+    return;
+  }
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try {
+      await ipcRenderer.invoke('qappGuest:hello', guestToken);
+      ipcRenderer.sendToHost('qapp:hello', { documentId });
+      return;
+    } catch {
+      if (attempt < 4)
+        await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+  }
+  ipcRenderer.sendToHost('qapp:error');
+})();
+
+ipcRenderer.on('qapp:response', (_event, response) => {
+  if (response?.documentId !== documentId) return;
+  const entry = pending.get(response.requestId);
+  if (!entry) return;
+  pending.delete(response.requestId);
+  entry.port.postMessage(response.result);
+  entry.port.close();
+});
+
+ipcRenderer.on('qapp:event', (_event, data) => {
+  const forwardedData = data?.action === 'PERFORMING_NON_MANUAL'
+    ? data
+    : { ...data, requestedHandler: 'UI' };
+  const event = new MessageEvent('message', {
+    data: forwardedData,
+    origin: window.location.origin,
+    source: window,
+  });
+  injectedEvents.add(event);
+  window.dispatchEvent(event);
+});
diff --git a/electron/src/qapp-reticulum-framing.test.ts b/electron/src/qapp-reticulum-framing.test.ts
new file mode 100644
index 000000000..861571977
--- /dev/null
+++ b/electron/src/qapp-reticulum-framing.test.ts
@@ -0,0 +1,130 @@
+import { describe, expect, it } from 'vitest';
+import {
+  decodeQAppRnsControl,
+  encodeQAppRnsControl,
+  encodeQAppRnsFrame,
+  QAppRnsFrameParser,
+  QAppRnsFrameType,
+  QAppRnsProtocolError,
+} from './qapp-reticulum-framing';
+import vectors from '../../protocol-v1-vectors.json';
+
+describe('Q-App Reticulum framing', () => {
+  it('matches the frozen DATA, ACK, and CONTROL golden vectors', () => {
+    const cases = [
+      [vectors.data_frame, QAppRnsFrameType.Data],
+      [vectors.ack_frame, QAppRnsFrameType.Ack],
+      [vectors.control_frame, QAppRnsFrameType.Control],
+    ] as const;
+    for (const [vector, type] of cases) {
+      const encoded = encodeQAppRnsFrame(
+        type,
+        BigInt(`0x${vector.message_id_hex}`),
+        Buffer.from(vector.payload_hex, 'hex')
+      );
+      expect(encoded.toString('hex')).toBe(vector.frame_hex);
+      const [decoded] = new QAppRnsFrameParser().push(encoded);
+      expect(decoded.type).toBe(type);
+      expect(decoded.messageId).toBe(BigInt(`0x${vector.message_id_hex}`));
+      expect(decoded.payload.toString('hex')).toBe(vector.payload_hex);
+    }
+    expect(encodeQAppRnsControl('PING').toString('hex')).toBe(
+      vectors.control_frame.payload_hex
+    );
+    expect(decodeQAppRnsControl(encodeQAppRnsControl('PING'))).toEqual({
+      type: 'PING',
+    });
+    expect(
+      decodeQAppRnsControl(encodeQAppRnsControl('CLOSE', 'rns-one'))
+    ).toEqual({ type: 'CLOSE', connectionId: 'rns-one' });
+  });
+
+  it('round-trips the maximum unsigned message ID', () => {
+    const frame = encodeQAppRnsFrame(
+      QAppRnsFrameType.Data,
+      0xffffffffffffffffn,
+      Buffer.alloc(0)
+    );
+    expect(new QAppRnsFrameParser().push(frame)[0].messageId).toBe(
+      0xffffffffffffffffn
+    );
+  });
+
+  it('parses complete, binary, and zero-length frames', () => {
+    const parser = new QAppRnsFrameParser();
+    const binary = Buffer.from([0, 255, 7]);
+    const frames = parser.push(
+      Buffer.concat([
+        encodeQAppRnsFrame(QAppRnsFrameType.Data, 1n, binary),
+        encodeQAppRnsFrame(QAppRnsFrameType.Ack, 1n, Buffer.alloc(0)),
+      ])
+    );
+    expect(frames.map((frame) => frame.type)).toEqual([1, 2]);
+    expect(frames[0].payload).toEqual(binary);
+    expect(frames[1].payload).toHaveLength(0);
+  });
+
+  it('handles every possible split point', () => {
+    const encoded = encodeQAppRnsFrame(
+      QAppRnsFrameType.Data,
+      42n,
+      Buffer.from('partial payload')
+    );
+    for (let split = 1; split < encoded.length; split += 1) {
+      const parser = new QAppRnsFrameParser();
+      expect(parser.push(encoded.subarray(0, split))).toEqual([]);
+      const frames = parser.push(encoded.subarray(split));
+      expect(frames).toHaveLength(1);
+      expect(frames[0].messageId).toBe(42n);
+      expect(frames[0].payload.toString()).toBe('partial payload');
+    }
+  });
+
+  it('parses several frames from one read', () => {
+    const parser = new QAppRnsFrameParser();
+    const bytes = Buffer.concat(
+      [1n, 2n, 3n].map((id) =>
+        encodeQAppRnsFrame(QAppRnsFrameType.Data, id, Buffer.from(`${id}`))
+      )
+    );
+    expect(parser.push(bytes).map((frame) => frame.messageId)).toEqual([
+      1n,
+      2n,
+      3n,
+    ]);
+  });
+
+  it('rejects malformed and oversized lengths without retaining input', () => {
+    const malformed = Buffer.alloc(14);
+    malformed[0] = 1;
+    malformed[1] = 1;
+    malformed.writeUInt32BE(65, 10);
+    const parser = new QAppRnsFrameParser(64, 128);
+    expect(() => parser.push(malformed)).toThrow(QAppRnsProtocolError);
+    expect(parser.bufferedBytes).toBe(0);
+  });
+
+  it('rejects unsupported protocol versions and frame types', () => {
+    for (const offset of [0, 1]) {
+      const malformed = encodeQAppRnsFrame(
+        QAppRnsFrameType.Data,
+        1n,
+        Buffer.alloc(0)
+      );
+      malformed[offset] = 99;
+      expect(() => new QAppRnsFrameParser().push(malformed)).toThrow(
+        QAppRnsProtocolError
+      );
+    }
+  });
+
+  it('rejects unsupported CONTROL payloads', () => {
+    expect(() =>
+      decodeQAppRnsControl(Buffer.from('{"type":"WELCOME"}'))
+    ).toThrow(QAppRnsProtocolError);
+    expect(() => encodeQAppRnsControl('CLOSE')).toThrow(QAppRnsProtocolError);
+    expect(() => decodeQAppRnsControl(Buffer.from('{"type":"CLOSE"}'))).toThrow(
+      QAppRnsProtocolError
+    );
+  });
+});
diff --git a/electron/src/qapp-reticulum-framing.ts b/electron/src/qapp-reticulum-framing.ts
new file mode 100644
index 000000000..5560c86a0
--- /dev/null
+++ b/electron/src/qapp-reticulum-framing.ts
@@ -0,0 +1,159 @@
+export const QAPP_RNS_PROTOCOL_VERSION = 1;
+export const QAPP_RNS_HEADER_BYTES = 14;
+export const QAPP_RNS_DEFAULT_MAX_FRAME_BYTES = 256 * 1024;
+
+export enum QAppRnsFrameType {
+  Data = 1,
+  Ack = 2,
+  Control = 3,
+}
+
+export type QAppRnsControlType = 'PING' | 'PONG' | 'CLOSE';
+
+export type QAppRnsControl =
+  | { type: 'PING' | 'PONG' }
+  | { type: 'CLOSE'; connectionId: string };
+
+export type QAppRnsFrame = {
+  version: number;
+  type: QAppRnsFrameType;
+  messageId: bigint;
+  payload: Buffer;
+};
+
+export class QAppRnsProtocolError extends Error {}
+
+export function encodeQAppRnsFrame(
+  type: QAppRnsFrameType,
+  messageId: bigint,
+  payload: Uint8Array,
+  maxFrameBytes = QAPP_RNS_DEFAULT_MAX_FRAME_BYTES
+): Buffer {
+  if (!Object.values(QAppRnsFrameType).includes(type)) {
+    throw new QAppRnsProtocolError('RNS_PROTOCOL_ERROR');
+  }
+  if (payload.byteLength > maxFrameBytes) {
+    throw new QAppRnsProtocolError('RNS_MESSAGE_TOO_LARGE');
+  }
+  if (messageId < 0n || messageId > 0xffffffffffffffffn) {
+    throw new QAppRnsProtocolError('RNS_PROTOCOL_ERROR');
+  }
+  const frame = Buffer.allocUnsafe(QAPP_RNS_HEADER_BYTES + payload.byteLength);
+  frame.writeUInt8(QAPP_RNS_PROTOCOL_VERSION, 0);
+  frame.writeUInt8(type, 1);
+  frame.writeBigUInt64BE(messageId, 2);
+  frame.writeUInt32BE(payload.byteLength, 10);
+  Buffer.from(payload).copy(frame, QAPP_RNS_HEADER_BYTES);
+  return frame;
+}
+
+export function encodeQAppRnsControl(
+  type: QAppRnsControlType,
+  connectionId?: string
+): Buffer {
+  if (type === 'CLOSE') {
+    if (!connectionId || connectionId.length > 128) {
+      throw new QAppRnsProtocolError('RNS_PROTOCOL_ERROR');
+    }
+    return Buffer.from(JSON.stringify({ type, connectionId }), 'utf8');
+  }
+  if (connectionId !== undefined) {
+    throw new QAppRnsProtocolError('RNS_PROTOCOL_ERROR');
+  }
+  return Buffer.from(JSON.stringify({ type }), 'utf8');
+}
+
+export function decodeQAppRnsControl(payload: Uint8Array): QAppRnsControl {
+  try {
+    const value = JSON.parse(Buffer.from(payload).toString('utf8'));
+    if (!value || typeof value !== 'object') {
+      throw new Error('unsupported control');
+    }
+    if (value.type === 'CLOSE') {
+      if (
+        Object.keys(value).length !== 2 ||
+        typeof value.connectionId !== 'string' ||
+        value.connectionId.length < 1 ||
+        value.connectionId.length > 128
+      ) {
+        throw new Error('unsupported control');
+      }
+      return { type: 'CLOSE', connectionId: value.connectionId };
+    }
+    if (
+      Object.keys(value).length !== 1 ||
+      (value.type !== 'PING' && value.type !== 'PONG')
+    ) {
+      throw new Error('unsupported control');
+    }
+    return { type: value.type };
+  } catch {
+    throw new QAppRnsProtocolError('RNS_PROTOCOL_ERROR');
+  }
+}
+
+export class QAppRnsFrameParser {
+  private buffered = Buffer.alloc(0);
+
+  constructor(
+    private readonly maxFrameBytes = QAPP_RNS_DEFAULT_MAX_FRAME_BYTES,
+    private readonly maxReceiveBufferBytes = maxFrameBytes * 2
+  ) {}
+
+  push(chunk: Uint8Array): QAppRnsFrame[] {
+    if (chunk.byteLength === 0) return [];
+    if (
+      this.buffered.byteLength + chunk.byteLength >
+      this.maxReceiveBufferBytes
+    ) {
+      this.reset();
+      throw new QAppRnsProtocolError('RNS_PROTOCOL_ERROR');
+    }
+    this.buffered = Buffer.concat([this.buffered, Buffer.from(chunk)]);
+    const frames: QAppRnsFrame[] = [];
+    while (this.buffered.byteLength >= QAPP_RNS_HEADER_BYTES) {
+      const version = this.buffered.readUInt8(0);
+      const type = this.buffered.readUInt8(1);
+      const messageId = this.buffered.readBigUInt64BE(2);
+      const payloadLength = this.buffered.readUInt32BE(10);
+      if (version !== QAPP_RNS_PROTOCOL_VERSION) {
+        this.reset();
+        throw new QAppRnsProtocolError('RNS_PROTOCOL_ERROR');
+      }
+      if (
+        ![
+          QAppRnsFrameType.Data,
+          QAppRnsFrameType.Ack,
+          QAppRnsFrameType.Control,
+        ].includes(type)
+      ) {
+        this.reset();
+        throw new QAppRnsProtocolError('RNS_PROTOCOL_ERROR');
+      }
+      if (payloadLength > this.maxFrameBytes) {
+        this.reset();
+        throw new QAppRnsProtocolError('RNS_MESSAGE_TOO_LARGE');
+      }
+      const frameLength = QAPP_RNS_HEADER_BYTES + payloadLength;
+      if (this.buffered.byteLength < frameLength) break;
+      frames.push({
+        version,
+        type,
+        messageId,
+        payload: Buffer.from(
+          this.buffered.subarray(QAPP_RNS_HEADER_BYTES, frameLength)
+        ),
+      });
+      this.buffered = this.buffered.subarray(frameLength);
+    }
+    return frames;
+  }
+
+  reset(): void {
+    this.buffered = Buffer.alloc(0);
+  }
+
+  get bufferedBytes(): number {
+    return this.buffered.byteLength;
+  }
+}
diff --git a/electron/src/qapp-reticulum-manager.test.ts b/electron/src/qapp-reticulum-manager.test.ts
new file mode 100644
index 000000000..2b7d3a57d
--- /dev/null
+++ b/electron/src/qapp-reticulum-manager.test.ts
@@ -0,0 +1,430 @@
+import { describe, expect, it, vi } from 'vitest';
+import {
+  QAppReticulumError,
+  QAppReticulumManager,
+  type QAppReticulumNativeEvent,
+  type QAppReticulumOwner,
+  type QAppReticulumTransport,
+} from './qapp-reticulum-manager';
+import vectors from '../../protocol-v1-vectors.json';
+
+class FakeTransport implements QAppReticulumTransport {
+  listeners = new Set<(event: QAppReticulumNativeEvent) => void>();
+  invoke = vi.fn(async (action: string, payload: Record<string, unknown>) => ({
+    ok: true,
+    payload:
+      action === 'qapp_rns_request'
+        ? {
+            payloadBase64: Buffer.from(JSON.stringify({ ok: true })).toString(
+              'base64'
+            ),
+            encoding: 'json',
+          }
+        : { messageId: '1', ...payload },
+  }));
+  onEvent(listener: (event: QAppReticulumNativeEvent) => void) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+}
+
+const destination = '0123456789abcdef0123456789abcdef';
+const alice: QAppReticulumOwner = {
+  tabId: '1',
+  name: 'Alice App',
+  service: 'APP',
+};
+const bob: QAppReticulumOwner = {
+  tabId: '2',
+  name: 'Bob App',
+  service: 'APP',
+};
+
+describe('QAppReticulumManager', () => {
+  it('rejects a connect completed after navigation cleanup and preserves its replacement', async () => {
+    const transport = new FakeTransport();
+    let complete!: (value: any) => void;
+    transport.invoke.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          complete = resolve;
+        })
+    );
+    const manager = new QAppReticulumManager(transport);
+    const pending = manager.connect(alice, destination);
+    const rejected = expect(pending).rejects.toMatchObject({
+      code: 'RNS_CONNECTION_CLOSED',
+    });
+    await manager.cleanupOwner(alice);
+    const fresh = await manager.connect(alice, destination);
+    complete({ ok: true, payload: {} });
+    await rejected;
+    expect(manager.connectionOwnership(alice, fresh.connectionId)).toBe(
+      'owned'
+    );
+    await expect(
+      manager.send(alice, fresh.connectionId, { test: true })
+    ).resolves.toBeDefined();
+    expect(
+      transport.invoke.mock.calls.filter(
+        ([action]) => action === 'qapp_rns_close'
+      )
+    ).toHaveLength(2);
+    manager.destroy();
+  });
+
+  it('does not overwrite a terminal native event with connected', async () => {
+    const transport = new FakeTransport();
+    transport.invoke.mockImplementationOnce(async (_action, payload) => {
+      for (const listener of transport.listeners)
+        listener({
+          managerKey: String(payload.managerKey),
+          connectionId: String(payload.connectionId),
+          kind: 'state',
+          state: 'DISCONNECTED',
+        });
+      return { ok: true, payload: {} };
+    });
+    const manager = new QAppReticulumManager(transport);
+    await expect(manager.connect(alice, destination)).rejects.toMatchObject({
+      code: 'RNS_CONNECTION_CLOSED',
+    });
+    manager.destroy();
+  });
+
+  it('reports connection ownership without exposing its destination', async () => {
+    const manager = new QAppReticulumManager(new FakeTransport());
+    const { connectionId } = await manager.connect(alice, destination);
+    expect(manager.connectionOwnership(alice, connectionId)).toBe('owned');
+    expect(manager.connectionOwnership(bob, connectionId)).toBe('not-owned');
+    expect(manager.connectionOwnership(alice, 'missing')).toBe('missing');
+  });
+
+  it('uses the same isolated manager key for RPC and realtime', async () => {
+    const transport = new FakeTransport();
+    const manager = new QAppReticulumManager(transport);
+    await manager.connect(alice, destination);
+    await manager.request(alice, { destination, path: '/hello', payload: {} });
+    const connectPayload = transport.invoke.mock.calls[0][1];
+    const requestPayload = transport.invoke.mock.calls[1][1];
+    expect(connectPayload.managerKey).toBe(requestPayload.managerKey);
+  });
+
+  it('binds reserved main-process RPCs to an owned logical connection', async () => {
+    const transport = new FakeTransport();
+    const manager = new QAppReticulumManager(transport);
+    const { connectionId } = await manager.connect(alice, destination);
+    await manager.request(alice, {
+      destination,
+      path: '/qortal/private-transport/bootstrap/v1',
+      payload: {},
+      connectionId,
+    });
+    expect(transport.invoke.mock.calls[1][1]).toMatchObject({
+      logicalConnectionId: connectionId,
+    });
+    await expect(
+      manager.request(bob, {
+        destination,
+        path: '/qortal/private-transport/bootstrap/v1',
+        connectionId,
+      })
+    ).rejects.toMatchObject({ code: 'RNS_INVALID_CONNECTION' });
+  });
+
+  it('encodes the frozen RPC request payload and decodes its JSON response', async () => {
+    const transport = new FakeTransport();
+    const manager = new QAppReticulumManager(transport);
+    const response = await manager.request(alice, {
+      destination,
+      path: '/hello',
+      payload: vectors.rpc_request.application_json,
+      requestId: vectors.rpc_request.request_id,
+    });
+    const request = transport.invoke.mock.calls[0][1];
+    expect(request).toMatchObject({
+      path: '/hello',
+      requestId: vectors.rpc_request.request_id,
+      encoding: 'json',
+      payloadBase64: vectors.rpc_request.payload_base64,
+    });
+    expect(response).toEqual({ ok: true });
+  });
+
+  it('encodes RNS_SEND JSON and decodes RNS_MESSAGE JSON symmetrically', async () => {
+    const transport = new FakeTransport();
+    const manager = new QAppReticulumManager(transport);
+    const listener = vi.fn();
+    manager.on('event', listener);
+    const connection = await manager.connect(alice, destination);
+    await manager.send(
+      alice,
+      connection.connectionId,
+      vectors.data_envelope.application_json
+    );
+    const sendPayload = transport.invoke.mock.calls[1][1];
+    expect(sendPayload).toMatchObject({
+      encoding: 'json',
+      payloadBase64: vectors.data_envelope.payload_base64,
+    });
+    const managerKey = transport.invoke.mock.calls[0][1].managerKey as string;
+    for (const callback of transport.listeners) {
+      callback({
+        managerKey,
+        connectionId: connection.connectionId,
+        kind: 'message',
+        encoding: 'json',
+        payloadBase64: vectors.data_envelope.payload_base64,
+      });
+    }
+    expect(listener).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'RNS_MESSAGE',
+        payload: vectors.data_envelope.application_json,
+      })
+    );
+  });
+
+  it('delivers a zero-length binary RNS_MESSAGE', async () => {
+    const transport = new FakeTransport();
+    const manager = new QAppReticulumManager(transport);
+    const listener = vi.fn();
+    manager.on('event', listener);
+    const connection = await manager.connect(alice, destination);
+    const managerKey = transport.invoke.mock.calls[0][1].managerKey as string;
+    for (const callback of transport.listeners) {
+      callback({
+        managerKey,
+        connectionId: connection.connectionId,
+        kind: 'message',
+        encoding: 'base64',
+        payloadBase64: '',
+      });
+    }
+    expect(listener).toHaveBeenCalledWith(
+      expect.objectContaining({
+        action: 'RNS_MESSAGE',
+        payload: new Uint8Array(0),
+      })
+    );
+  });
+
+  it('rejects cross-Q-App send and close attempts', async () => {
+    const manager = new QAppReticulumManager(new FakeTransport());
+    const { connectionId } = await manager.connect(alice, destination);
+    await expect(manager.send(bob, connectionId, {})).rejects.toMatchObject({
+      code: 'RNS_INVALID_CONNECTION',
+    });
+    await expect(manager.close(bob, connectionId)).rejects.toBeInstanceOf(
+      QAppReticulumError
+    );
+  });
+
+  it('cleans every logical connection owned by a destroyed tab', async () => {
+    const transport = new FakeTransport();
+    const manager = new QAppReticulumManager(transport);
+    await manager.connect(alice, destination);
+    await manager.connect(alice, destination);
+    await manager.cleanupOwner(alice);
+    expect(
+      transport.invoke.mock.calls.filter(
+        ([action]) => action === 'qapp_rns_close'
+      )
+    ).toHaveLength(2);
+  });
+
+  it('drops native events whose manager ownership does not match', async () => {
+    const transport = new FakeTransport();
+    const manager = new QAppReticulumManager(transport);
+    const listener = vi.fn();
+    manager.on('event', listener);
+    const connection = await manager.connect(alice, destination);
+    for (const callback of transport.listeners) {
+      callback({
+        managerKey: 'attacker',
+        connectionId: connection.connectionId,
+        kind: 'message',
+        payloadBase64: Buffer.from('{}').toString('base64'),
+        encoding: 'json',
+      });
+    }
+    expect(listener).not.toHaveBeenCalled();
+  });
+
+  it('does not resurrect a connection closed while native events are pending', async () => {
+    const transport = new FakeTransport();
+    const manager = new QAppReticulumManager(transport);
+    const listener = vi.fn();
+    manager.on('event', listener);
+    const connection = await manager.connect(alice, destination);
+    const managerKey = transport.invoke.mock.calls[0][1].managerKey as string;
+    await manager.close(alice, connection.connectionId);
+    for (const callback of transport.listeners) {
+      callback({
+        managerKey,
+        connectionId: connection.connectionId,
+        kind: 'state',
+        state: 'CONNECTED',
+      });
+    }
+    expect(listener.mock.calls.map(([event]) => event.state)).toEqual([
+      'CLOSING',
+      'CLOSED',
+    ]);
+    await expect(
+      manager.send(alice, connection.connectionId, {})
+    ).rejects.toMatchObject({ code: 'RNS_INVALID_CONNECTION' });
+  });
+
+  it('rejects a raw payload whose Base64 DATA envelope exceeds the frame limit', async () => {
+    const manager = new QAppReticulumManager(new FakeTransport());
+    const connection = await manager.connect(alice, destination);
+    await expect(
+      manager.send(alice, connection.connectionId, new Uint8Array(256 * 1024))
+    ).rejects.toMatchObject({ code: 'RNS_MESSAGE_TOO_LARGE' });
+  });
+
+  it('does not automatically replay an ambiguously failed RPC', async () => {
+    const transport = new FakeTransport();
+    transport.invoke = vi.fn(async () => ({
+      ok: false,
+      code: 'RNS_REQUEST_TIMEOUT',
+    }));
+    const manager = new QAppReticulumManager(transport);
+    await expect(
+      manager.request(alice, {
+        destination,
+        path: '/create-item',
+        payload: { value: 1 },
+        requestId: 'operation-1',
+      })
+    ).rejects.toMatchObject({ code: 'RNS_REQUEST_TIMEOUT' });
+    expect(transport.invoke).toHaveBeenCalledTimes(1);
+  });
+
+  it('limits pending RPCs independently for each Q-App owner', async () => {
+    const transport = new FakeTransport();
+    const releases: Array<() => void> = [];
+    transport.invoke = vi.fn(
+      () =>
+        new Promise((resolve) => {
+          releases.push(() =>
+            resolve({
+              ok: true,
+              payload: {
+                payloadBase64: Buffer.from('{}').toString('base64'),
+                encoding: 'json',
+              },
+            })
+          );
+        })
+    );
+    const manager = new QAppReticulumManager(transport);
+    const pending = Array.from({ length: 8 }, (_, index) =>
+      manager.request(alice, {
+        destination,
+        path: '/status',
+        requestId: `pending-${index}`,
+      })
+    );
+
+    await expect(
+      manager.request(alice, { destination, path: '/status' })
+    ).rejects.toMatchObject({ code: 'RNS_SEND_QUEUE_FULL' });
+    const bobRequest = manager.request(bob, {
+      destination,
+      path: '/status',
+    });
+
+    for (const release of releases) release();
+    await expect(Promise.all([...pending, bobRequest])).resolves.toHaveLength(
+      9
+    );
+  });
+
+  it('bounds pending RPCs across all Q-App owners', async () => {
+    const transport = new FakeTransport();
+    const releases: Array<() => void> = [];
+    transport.invoke = vi.fn(
+      () =>
+        new Promise((resolve) => {
+          releases.push(() =>
+            resolve({
+              ok: true,
+              payload: {
+                payloadBase64: Buffer.from('{}').toString('base64'),
+                encoding: 'json',
+              },
+            })
+          );
+        })
+    );
+    const manager = new QAppReticulumManager(transport);
+    const pending = Array.from({ length: 64 }, (_, index) =>
+      manager.request(
+        { ...alice, tabId: `global-rpc-${index}` },
+        { destination, path: '/status' }
+      )
+    );
+
+    await expect(
+      manager.request(
+        { ...alice, tabId: 'global-rpc-overflow' },
+        { destination, path: '/status' }
+      )
+    ).rejects.toMatchObject({ code: 'RNS_SEND_QUEUE_FULL' });
+
+    for (const release of releases) release();
+    await expect(Promise.all(pending)).resolves.toHaveLength(64);
+  });
+
+  it('releases a logical connection slot when native connect rejects', async () => {
+    const transport = new FakeTransport();
+    transport.invoke = vi
+      .fn()
+      .mockRejectedValueOnce(new Error('transport unavailable'))
+      .mockResolvedValue({ ok: true, payload: {} });
+    const manager = new QAppReticulumManager(transport);
+
+    await expect(manager.connect(alice, destination)).rejects.toThrow(
+      'transport unavailable'
+    );
+    await expect(
+      Promise.all(
+        Array.from({ length: 8 }, () => manager.connect(alice, destination))
+      )
+    ).resolves.toHaveLength(8);
+  });
+
+  it('limits logical realtime connections per Q-App owner', async () => {
+    const manager = new QAppReticulumManager(new FakeTransport());
+    await Promise.all(
+      Array.from({ length: 8 }, () => manager.connect(alice, destination))
+    );
+    await expect(manager.connect(alice, destination)).rejects.toMatchObject({
+      code: 'RNS_SEND_QUEUE_FULL',
+    });
+    await expect(manager.connect(bob, destination)).resolves.toMatchObject({
+      state: 'CONNECTED',
+    });
+  });
+
+  it('bounds logical realtime connections across all Q-App owners', async () => {
+    const manager = new QAppReticulumManager(new FakeTransport());
+    await Promise.all(
+      Array.from({ length: 64 }, (_, index) =>
+        manager.connect(
+          { ...alice, tabId: `global-connection-${index}` },
+          destination
+        )
+      )
+    );
+
+    await expect(
+      manager.connect(
+        { ...alice, tabId: 'global-connection-overflow' },
+        destination
+      )
+    ).rejects.toMatchObject({ code: 'RNS_SEND_QUEUE_FULL' });
+  });
+});
diff --git a/electron/src/qapp-reticulum-manager.ts b/electron/src/qapp-reticulum-manager.ts
new file mode 100644
index 000000000..358c9f7b7
--- /dev/null
+++ b/electron/src/qapp-reticulum-manager.ts
@@ -0,0 +1,410 @@
+import { EventEmitter } from 'events';
+import { randomUUID } from 'crypto';
+
+export type QAppReticulumState =
+  | 'CONNECTING'
+  | 'CONNECTED'
+  | 'RECONNECTING'
+  | 'DISCONNECTED'
+  | 'CLOSING'
+  | 'CLOSED'
+  | 'ERROR';
+
+export type QAppReticulumOwner = {
+  tabId: string;
+  name: string;
+  service: string;
+};
+
+export type QAppReticulumConnectionOwnership =
+  | 'owned'
+  | 'not-owned'
+  | 'missing';
+
+export type QAppReticulumNativeEvent = {
+  managerKey: string;
+  connectionId?: string;
+  kind: 'message' | 'state';
+  state?: QAppReticulumState;
+  payloadBase64?: string;
+  encoding?: 'json' | 'base64';
+  reason?: string;
+};
+
+export interface QAppReticulumTransport {
+  invoke(
+    action: string,
+    payload: Record<string, unknown>
+  ): Promise<{
+    ok: boolean;
+    payload?: Record<string, unknown>;
+    code?: string;
+  }>;
+  onEvent(listener: (event: QAppReticulumNativeEvent) => void): () => void;
+}
+
+export class QAppReticulumError extends Error {
+  constructor(
+    public readonly code: string,
+    message = code
+  ) {
+    super(message);
+  }
+}
+
+type LogicalConnection = {
+  connectionId: string;
+  ownerKey: string;
+  managerKey: string;
+  destination: string;
+  state: QAppReticulumState;
+};
+
+const DESTINATION_PATTERN = /^[0-9a-f]{32}$/;
+const MAX_RPC_REQUEST_BYTES = 256 * 1024;
+const MAX_RPC_RESPONSE_BYTES = 1024 * 1024;
+const MAX_REALTIME_MESSAGE_BYTES = 256 * 1024;
+const MAX_PENDING_RPC_REQUESTS_PER_OWNER = 8;
+const MAX_PENDING_RPC_REQUESTS_GLOBAL = 64;
+const MAX_CONNECTIONS_PER_OWNER = 8;
+const MAX_CONNECTIONS_GLOBAL = 64;
+
+function ownerKey(owner: QAppReticulumOwner): string {
+  return `${owner.tabId}\u0000${owner.service}\u0000${owner.name}`;
+}
+
+function encodePayload(
+  payload: unknown,
+  limit: number
+): {
+  payloadBase64: string;
+  encoding: 'json' | 'base64';
+} {
+  const bytes =
+    payload instanceof Uint8Array
+      ? Buffer.from(payload)
+      : Buffer.from(JSON.stringify(payload ?? null), 'utf8');
+  if (bytes.byteLength > limit) {
+    throw new QAppReticulumError('RNS_MESSAGE_TOO_LARGE');
+  }
+  return {
+    payloadBase64: bytes.toString('base64'),
+    encoding: payload instanceof Uint8Array ? 'base64' : 'json',
+  };
+}
+
+function decodePayload(payload: Record<string, unknown>): unknown {
+  const encoded = String(payload.payloadBase64 ?? '');
+  const bytes = Buffer.from(encoded, 'base64');
+  if (bytes.byteLength > MAX_RPC_RESPONSE_BYTES) {
+    throw new QAppReticulumError('RNS_RESPONSE_TOO_LARGE');
+  }
+  return payload.encoding === 'base64'
+    ? new Uint8Array(bytes)
+    : JSON.parse(bytes.toString('utf8'));
+}
+
+export class QAppReticulumManager extends EventEmitter {
+  private readonly connections = new Map<string, LogicalConnection>();
+  private readonly connectionsByOwner = new Map<string, Set<string>>();
+  private readonly pendingRequestsByOwner = new Map<string, number>();
+  private pendingRequestCount = 0;
+  private readonly detachTransport: () => void;
+
+  constructor(private readonly transport: QAppReticulumTransport) {
+    super();
+    this.detachTransport = transport.onEvent((event) =>
+      this.handleTransportEvent(event)
+    );
+  }
+
+  async request(
+    owner: QAppReticulumOwner,
+    options: {
+      destination: string;
+      path: string;
+      payload?: unknown;
+      timeoutMs?: number;
+      maxResponseBytes?: number;
+      requestId?: string;
+      /** Main-process binding for reserved RPCs on an owned logical session. */
+      connectionId?: string;
+    }
+  ): Promise<unknown> {
+    const destination = this.validateDestination(options.destination);
+    if (options.connectionId) {
+      const connection = this.requireOwned(owner, options.connectionId);
+      if (connection.destination !== destination) {
+        throw new QAppReticulumError('RNS_PERMISSION_DENIED');
+      }
+    }
+    const path = String(options.path ?? '').trim();
+    if (!path.startsWith('/') || path.length > 512) {
+      throw new QAppReticulumError(
+        'RNS_PROTOCOL_ERROR',
+        'Invalid request path'
+      );
+    }
+    const key = ownerKey(owner);
+    const pending = this.pendingRequestsByOwner.get(key) ?? 0;
+    if (
+      pending >= MAX_PENDING_RPC_REQUESTS_PER_OWNER ||
+      this.pendingRequestCount >= MAX_PENDING_RPC_REQUESTS_GLOBAL
+    ) {
+      throw new QAppReticulumError('RNS_SEND_QUEUE_FULL');
+    }
+    this.pendingRequestsByOwner.set(key, pending + 1);
+    this.pendingRequestCount += 1;
+    try {
+      const encoded = encodePayload(options.payload, MAX_RPC_REQUEST_BYTES);
+      const result = await this.transport.invoke('qapp_rns_request', {
+        managerKey: this.managerKey(owner, destination),
+        destination,
+        path,
+        ...encoded,
+        timeoutMs: Math.min(
+          Math.max(options.timeoutMs ?? 30_000, 1_000),
+          120_000
+        ),
+        maxResponseBytes: Math.min(
+          Math.max(options.maxResponseBytes ?? MAX_RPC_RESPONSE_BYTES, 1),
+          MAX_RPC_RESPONSE_BYTES
+        ),
+        requestId: String(options.requestId ?? randomUUID()),
+        logicalConnectionId: options.connectionId,
+      });
+      if (!result.ok || !result.payload) {
+        throw new QAppReticulumError(result.code ?? 'RNS_REQUEST_TIMEOUT');
+      }
+      return decodePayload(result.payload);
+    } finally {
+      this.releasePendingRequest(key);
+    }
+  }
+
+  async connect(
+    owner: QAppReticulumOwner,
+    destinationValue: string
+  ): Promise<{ connectionId: string; state: QAppReticulumState }> {
+    const destination = this.validateDestination(destinationValue);
+    const connectionId = `rns-${randomUUID()}`;
+    const key = ownerKey(owner);
+    if (
+      (this.connectionsByOwner.get(key)?.size ?? 0) >=
+        MAX_CONNECTIONS_PER_OWNER ||
+      this.connections.size >= MAX_CONNECTIONS_GLOBAL
+    ) {
+      throw new QAppReticulumError('RNS_SEND_QUEUE_FULL');
+    }
+    const connection: LogicalConnection = {
+      connectionId,
+      ownerKey: key,
+      managerKey: this.managerKey(owner, destination),
+      destination,
+      state: 'CONNECTING',
+    };
+    this.connections.set(connectionId, connection);
+    const owned = this.connectionsByOwner.get(key) ?? new Set<string>();
+    owned.add(connectionId);
+    this.connectionsByOwner.set(key, owned);
+    let result: Awaited<ReturnType<QAppReticulumTransport['invoke']>>;
+    try {
+      result = await this.transport.invoke('qapp_rns_connect', {
+        managerKey: connection.managerKey,
+        connectionId,
+        destination,
+      });
+    } catch (error) {
+      this.removeConnection(connection);
+      throw error;
+    }
+    if (!result.ok) {
+      this.removeConnection(connection);
+      throw new QAppReticulumError(
+        result.code ?? 'RNS_DESTINATION_UNREACHABLE'
+      );
+    }
+    if (this.connections.get(connectionId) !== connection) {
+      // A reload/close may have removed ownership while native setup waited.
+      // Also close a late native success, never hand out a dead connection ID.
+      void this.transport
+        .invoke('qapp_rns_close', {
+          managerKey: connection.managerKey,
+          connectionId,
+        })
+        .catch(() => undefined);
+      throw new QAppReticulumError('RNS_CONNECTION_CLOSED');
+    }
+    if (connection.state !== 'CONNECTING' && connection.state !== 'CONNECTED') {
+      this.removeConnection(connection);
+      void this.transport
+        .invoke('qapp_rns_close', {
+          managerKey: connection.managerKey,
+          connectionId,
+        })
+        .catch(() => undefined);
+      throw new QAppReticulumError('RNS_CONNECTION_CLOSED');
+    }
+    connection.state = 'CONNECTED';
+    return { connectionId, state: 'CONNECTED' };
+  }
+
+  async send(
+    owner: QAppReticulumOwner,
+    connectionId: string,
+    payload: unknown
+  ): Promise<{ messageId: string }> {
+    const connection = this.requireOwned(owner, connectionId);
+    if (
+      connection.state !== 'CONNECTED' &&
+      connection.state !== 'RECONNECTING'
+    ) {
+      throw new QAppReticulumError('RNS_CONNECTION_CLOSED');
+    }
+    const encoded = encodePayload(payload, MAX_REALTIME_MESSAGE_BYTES);
+    const envelopeBytes = Buffer.byteLength(
+      JSON.stringify({
+        connectionId,
+        payloadBase64: encoded.payloadBase64,
+        encoding: encoded.encoding,
+      }),
+      'utf8'
+    );
+    if (envelopeBytes > MAX_REALTIME_MESSAGE_BYTES) {
+      throw new QAppReticulumError('RNS_MESSAGE_TOO_LARGE');
+    }
+    const result = await this.transport.invoke('qapp_rns_send', {
+      managerKey: connection.managerKey,
+      connectionId,
+      ...encoded,
+    });
+    if (!result.ok) {
+      throw new QAppReticulumError(result.code ?? 'RNS_SEND_QUEUE_FULL');
+    }
+    return { messageId: String(result.payload?.messageId ?? '') };
+  }
+
+  async close(owner: QAppReticulumOwner, connectionId: string): Promise<void> {
+    const connection = this.requireOwned(owner, connectionId);
+    connection.state = 'CLOSING';
+    this.emit('event', {
+      ownerKey: connection.ownerKey,
+      connectionId,
+      action: 'RNS_CONNECTION_STATE',
+      state: 'CLOSING',
+    });
+    this.removeConnection(connection);
+    await this.transport.invoke('qapp_rns_close', {
+      managerKey: connection.managerKey,
+      connectionId,
+    });
+    this.emit('event', {
+      ownerKey: connection.ownerKey,
+      connectionId,
+      action: 'RNS_CONNECTION_STATE',
+      state: 'CLOSED',
+    });
+  }
+
+  async cleanupOwner(owner: QAppReticulumOwner): Promise<void> {
+    const key = ownerKey(owner);
+    const ids = [...(this.connectionsByOwner.get(key) ?? [])];
+    await Promise.allSettled(ids.map((id) => this.close(owner, id)));
+  }
+
+  connectionOwnership(
+    owner: QAppReticulumOwner,
+    connectionIdValue: unknown
+  ): QAppReticulumConnectionOwnership {
+    const connectionId =
+      typeof connectionIdValue === 'string' ? connectionIdValue : '';
+    const connection = this.connections.get(connectionId);
+    if (!connection) return 'missing';
+    if (connection.ownerKey !== ownerKey(owner)) return 'not-owned';
+    return connection.state === 'CONNECTED' ||
+      connection.state === 'RECONNECTING'
+      ? 'owned'
+      : 'missing';
+  }
+
+  /** Electron-main-only lookup used by reserved authenticated services. */
+  connectionDestination(
+    owner: QAppReticulumOwner,
+    connectionId: string
+  ): string {
+    return this.requireOwned(owner, connectionId).destination;
+  }
+
+  destroy(): void {
+    this.detachTransport();
+    this.connections.clear();
+    this.connectionsByOwner.clear();
+    this.pendingRequestsByOwner.clear();
+    this.pendingRequestCount = 0;
+  }
+
+  private handleTransportEvent(event: QAppReticulumNativeEvent): void {
+    const connectionId = String(event.connectionId ?? '');
+    const connection = this.connections.get(connectionId);
+    if (!connection || connection.managerKey !== event.managerKey) return;
+    if (event.kind === 'state' && event.state) {
+      connection.state = event.state;
+      this.emit('event', {
+        ownerKey: connection.ownerKey,
+        connectionId,
+        action: 'RNS_CONNECTION_STATE',
+        state: event.state,
+        reason: event.reason,
+      });
+      return;
+    }
+    if (event.kind === 'message' && typeof event.payloadBase64 === 'string') {
+      this.emit('event', {
+        ownerKey: connection.ownerKey,
+        connectionId,
+        action: 'RNS_MESSAGE',
+        payload: decodePayload(event as unknown as Record<string, unknown>),
+      });
+    }
+  }
+
+  private requireOwned(
+    owner: QAppReticulumOwner,
+    connectionId: string
+  ): LogicalConnection {
+    const connection = this.connections.get(connectionId);
+    if (!connection || connection.ownerKey !== ownerKey(owner)) {
+      throw new QAppReticulumError('RNS_INVALID_CONNECTION');
+    }
+    return connection;
+  }
+
+  private removeConnection(connection: LogicalConnection): void {
+    this.connections.delete(connection.connectionId);
+    const owned = this.connectionsByOwner.get(connection.ownerKey);
+    owned?.delete(connection.connectionId);
+    if (owned?.size === 0) this.connectionsByOwner.delete(connection.ownerKey);
+  }
+
+  private releasePendingRequest(key: string): void {
+    const pending = this.pendingRequestsByOwner.get(key) ?? 0;
+    if (pending <= 0) return;
+    if (pending === 1) this.pendingRequestsByOwner.delete(key);
+    else this.pendingRequestsByOwner.set(key, pending - 1);
+    this.pendingRequestCount = Math.max(0, this.pendingRequestCount - 1);
+  }
+
+  private managerKey(owner: QAppReticulumOwner, destination: string): string {
+    return `${ownerKey(owner)}\u0000${destination}`;
+  }
+
+  private validateDestination(destinationValue: string): string {
+    const destination = String(destinationValue ?? '')
+      .trim()
+      .toLowerCase();
+    if (!DESTINATION_PATTERN.test(destination)) {
+      throw new QAppReticulumError('RNS_DESTINATION_UNREACHABLE');
+    }
+    return destination;
+  }
+}
diff --git a/electron/src/quic-masque-transport.test.ts b/electron/src/quic-masque-transport.test.ts
new file mode 100644
index 000000000..ee5e05824
--- /dev/null
+++ b/electron/src/quic-masque-transport.test.ts
@@ -0,0 +1,178 @@
+import { EventEmitter } from 'events';
+import { describe, expect, it, vi } from 'vitest';
+import type { PrivateChannelBootstrapProvider } from './private-channel-bootstrap';
+import {
+  PrivateTransportSidecarError,
+  type PrivateSessionConfig,
+} from './private-transport-sidecar';
+import { QuicMasqueTransport } from './quic-masque-transport';
+import { PrivateChannelError } from './private-channel-manager';
+
+class SidecarStub extends EventEmitter {
+  attempts: PrivateSessionConfig[] = [];
+
+  async openPrivateSession(config: PrivateSessionConfig) {
+    this.attempts.push(config);
+    if (this.attempts.length === 1) {
+      throw new PrivateTransportSidecarError('MASQUE_TUNNEL_FAILED');
+    }
+    return { sessionId: 'local-session' };
+  }
+}
+
+class RecoveringSidecarStub extends EventEmitter {
+  attempts: PrivateSessionConfig[] = [];
+  closePrivateSession = vi.fn(async () => undefined);
+  sendPrivateReliable = vi.fn(async () => undefined);
+  sendPrivateDatagram = vi.fn(async () => undefined);
+
+  async openPrivateSession(config: PrivateSessionConfig) {
+    this.attempts.push(config);
+    return { sessionId: `native-${this.attempts.length}` };
+  }
+}
+
+describe('QUIC MASQUE transport', () => {
+  it('preserves duplicate-connection rejection without retrying relays', async () => {
+    const sidecar = new RecoveringSidecarStub();
+    const getBootstrap = vi.fn(async () => {
+      throw new PrivateChannelError('TRANSPORT_ALREADY_ATTACHED');
+    });
+    const relay = vi.fn(async () => ({
+      relayAddress: '8.8.8.8:47322',
+      relayServerName: 'relay.test',
+      relayCertSha256: 'ab'.repeat(32),
+    }));
+    const transport = new QuicMasqueTransport(
+      vi.fn(),
+      sidecar as never,
+      relay,
+      { getBootstrap }
+    );
+    await expect(
+      transport.open({
+        owner: { tabId: 'tab', name: 'app', service: 'APP' },
+        rnsConnectionId: 'rns',
+        purpose: 'file-transfer',
+      })
+    ).rejects.toMatchObject({ code: 'TRANSPORT_ALREADY_ATTACHED' });
+    expect(getBootstrap).toHaveBeenCalledTimes(1);
+    expect(sidecar.attempts).toHaveLength(0);
+    await transport.close();
+  });
+  it('falls back to the pinned same-host relay when public NAT hairpinning fails', async () => {
+    const sidecar = new SidecarStub();
+    const bootstrapProvider: PrivateChannelBootstrapProvider = {
+      getBootstrap: vi.fn(async () => ({
+        backendRnsDestination: 'ab'.repeat(16),
+        backendTransportEndpoint: '127.0.0.1:4445',
+        backendTransportServerName: 'backend.test',
+        backendTransportCertSha256: 'cd'.repeat(32),
+        logicalSessionId: 'logical-session',
+        attachToken: 'attach-token',
+        nonce: 'n'.repeat(32),
+        ownerBindingHash: 'ef'.repeat(32),
+        expiresAt: Date.now() + 10_000,
+      })),
+    };
+    const transport = new QuicMasqueTransport(
+      vi.fn(),
+      sidecar as never,
+      {
+        relayAddress: '8.8.8.8:47322',
+        relayServerName: 'relay.test',
+        relayCertSha256: '12'.repeat(32),
+        localFallbackAddress: '127.0.0.1:47322',
+      },
+      bootstrapProvider
+    );
+
+    await transport.open({
+      owner: { tabId: 'tab', name: 'qapp-ui-call', service: 'APP' },
+      rnsConnectionId: 'rns-connection',
+      purpose: 'realtime',
+    });
+
+    expect(sidecar.attempts.map((attempt) => attempt.relayAddress)).toEqual([
+      '8.8.8.8:47322',
+      '127.0.0.1:47322',
+    ]);
+  });
+
+  it('re-discovers another relay with fresh credentials without replacing the logical channel', async () => {
+    const sidecar = new RecoveringSidecarStub();
+    let bootstrapNumber = 0;
+    const bootstrapProvider: PrivateChannelBootstrapProvider = {
+      getBootstrap: vi.fn(async () => ({
+        backendRnsDestination: 'ab'.repeat(16),
+        backendTransportEndpoint: '127.0.0.1:4445',
+        backendTransportServerName: 'backend.test',
+        backendTransportCertSha256: 'cd'.repeat(32),
+        logicalSessionId: `logical-${++bootstrapNumber}`,
+        attachToken: `attach-token-${bootstrapNumber}`,
+        nonce: `nonce-${bootstrapNumber}`,
+        ownerBindingHash: 'ef'.repeat(32),
+        expiresAt: Date.now() + 10_000,
+      })),
+    };
+    const relayProvider = vi.fn(async (excluded?: ReadonlySet<string>) => ({
+      relayAddress: excluded?.has('8.8.8.8:47322')
+        ? '1.1.1.1:47322'
+        : '8.8.8.8:47322',
+      relayServerName: 'relay.test',
+      relayCertSha256: '12'.repeat(32),
+    }));
+    const events = vi.fn();
+    const transport = new QuicMasqueTransport(
+      events,
+      sidecar as never,
+      relayProvider,
+      bootstrapProvider
+    );
+    await transport.open({
+      channelId: 'private-logical',
+      owner: { tabId: 'tab', name: 'qapp-ui-call', service: 'APP' },
+      rnsConnectionId: 'rns-connection',
+      purpose: 'realtime',
+      generation: 1,
+    });
+
+    sidecar.sendPrivateReliable.mockRejectedValueOnce(
+      new PrivateTransportSidecarError('RELIABLE_SEND_NOT_STARTED')
+    );
+    await expect(transport.sendReliable({
+      lane: 'reliable', messageId: 'not-started', data: new Uint8Array(70000), streamKey: 'bulk',
+    })).rejects.toMatchObject({ code: 'RELIABLE_SEND_NOT_STARTED' });
+    expect(sidecar.attempts).toHaveLength(1);
+    expect(sidecar.closePrivateSession).not.toHaveBeenCalled();
+
+    sidecar.emit('event', {
+      event: 'error',
+      sessionId: 'native-1',
+      code: 'INNER_QUIC_FAILED',
+      data: Buffer.alloc(0),
+    });
+    await transport.sendReliable({
+      lane: 'reliable',
+      messageId: 'after-recovery',
+      data: { ok: true },
+    });
+
+    expect(sidecar.attempts.map((attempt) => attempt.relayAddress)).toEqual([
+      '8.8.8.8:47322',
+      '1.1.1.1:47322',
+    ]);
+    expect(sidecar.attempts.map((attempt) => attempt.attachToken)).toEqual([
+      'attach-token-1',
+      'attach-token-2',
+    ]);
+    expect(sidecar.sendPrivateReliable).toHaveBeenCalledWith(
+      'native-2',
+      'after-recovery',
+      expect.any(Buffer),
+      undefined,
+      undefined
+    );
+    expect(events).not.toHaveBeenCalled();
+  });
+});
diff --git a/electron/src/quic-masque-transport.ts b/electron/src/quic-masque-transport.ts
new file mode 100644
index 000000000..7cc3ab751
--- /dev/null
+++ b/electron/src/quic-masque-transport.ts
@@ -0,0 +1,412 @@
+import {
+  PrivateChannelError,
+  type PrivateTransport,
+  type PrivateTransportContext,
+  type PrivateTransportEvent,
+  type PrivateTransportMessage,
+} from './private-channel-manager';
+import type { PrivateChannelBootstrapProvider } from './private-channel-bootstrap';
+import {
+  PrivateTransportSidecar,
+  PrivateTransportSidecarError,
+  type PrivateTransportSidecarEvent,
+} from './private-transport-sidecar';
+
+export type TrustedRelayConfig = Readonly<{
+  protocolVersion?: number;
+  relayIdentity?: string;
+  ticketIdentity?: string;
+  ticketKeyId?: string;
+  accessMode?: 'public' | 'groups';
+  allowedGroupIds?: number[];
+  preparedRelay?: string;
+  relayAddress: string;
+  relayServerName: string;
+  relayCertSha256: string;
+  /** Same-host fallback, protected by the advertised certificate pin. */
+  localFallbackAddress?: string;
+}>;
+export type TrustedRelayProvider = (
+  excludedRelayAddresses?: ReadonlySet<string>
+) => Promise<TrustedRelayConfig>;
+
+const RECOVERY_DELAYS_MS = [0, 500, 2_000] as const;
+const FAILED_RELAY_COOLDOWN_MS = 60_000;
+
+const MAX_RELIABLE_BINARY_BYTES = 1024 * 1024;
+const MAX_DATAGRAM_BINARY_BYTES = 1024;
+
+export class QuicMasqueTransport implements PrivateTransport {
+  private sessionId: string | null = null;
+  private context: PrivateTransportContext | null = null;
+  private activeRelayAddress: string | null = null;
+  private lastAttemptedRelayAddress: string | null = null;
+  private recoveryPromise: Promise<string> | null = null;
+  private readonly failedRelayAddresses = new Map<string, number>();
+  private closed = false;
+  private readonly onSidecarEvent = (event: PrivateTransportSidecarEvent) =>
+    this.handleSidecarEvent(event);
+  private readonly onSidecarDeath = () => {
+    if (!this.closed && this.sessionId) {
+      void this.recover('TRANSPORT_CLOSED');
+    }
+  };
+
+  constructor(
+    private readonly emit: (event: PrivateTransportEvent) => void,
+    private readonly sidecar: PrivateTransportSidecar,
+    private readonly relay: TrustedRelayConfig | TrustedRelayProvider,
+    private readonly bootstrapProvider: PrivateChannelBootstrapProvider
+  ) {
+    sidecar.on('event', this.onSidecarEvent);
+    sidecar.on('death', this.onSidecarDeath);
+  }
+
+  async open(context: PrivateTransportContext): Promise<void> {
+    if (this.closed) throw new PrivateChannelError('TRANSPORT_CLOSED');
+    this.context = context;
+    try {
+      for (let attempt = 0; ; attempt++) {
+        try {
+          await this.connect(context);
+          break;
+        } catch (error) {
+          if (
+            attempt >= 2 ||
+            !this.lastAttemptedRelayAddress ||
+            !isRecoverableTransportError(error) ||
+            this.closed
+          )
+            throw error;
+          if (this.lastAttemptedRelayAddress)
+            this.failedRelayAddresses.set(
+              this.lastAttemptedRelayAddress,
+              Date.now()
+            );
+        }
+      }
+    } catch (error) {
+      throw translateSidecarError(error);
+    }
+  }
+
+  async sendReliable(message: PrivateTransportMessage): Promise<void> {
+    const encoded = encodeApplicationData(message.data);
+    if (encoded.length > MAX_RELIABLE_BINARY_BYTES) {
+      throw new PrivateChannelError('MESSAGE_TOO_LARGE_FOR_TRANSPORT');
+    }
+    try {
+      const sessionId = await this.requireSession();
+      await this.sidecar.sendPrivateReliable(
+        sessionId,
+        message.messageId,
+        encoded,
+        message.streamKey,
+        message.endStream
+      );
+    } catch (error) {
+      if (isRecoverableTransportError(error)) {
+        try {
+          const replacementSessionId = await this.recover(errorCode(error));
+          await this.sidecar.sendPrivateReliable(
+            replacementSessionId,
+            message.messageId,
+            encoded,
+            message.streamKey,
+            message.endStream
+          );
+          return;
+        } catch (recoveryError) {
+          throw translateSidecarError(recoveryError);
+        }
+      }
+      throw translateSidecarError(error);
+    }
+  }
+
+  async sendDatagram(message: PrivateTransportMessage): Promise<void> {
+    const encoded = encodeApplicationData(message.data);
+    if (encoded.length > MAX_DATAGRAM_BINARY_BYTES) {
+      throw new PrivateChannelError('MESSAGE_TOO_LARGE_FOR_TRANSPORT');
+    }
+    try {
+      const sessionId = await this.requireSession();
+      await this.sidecar.sendPrivateDatagram(
+        sessionId,
+        message.messageId,
+        encoded
+      );
+    } catch (error) {
+      if (isRecoverableTransportError(error)) {
+        try {
+          // Datagram delivery is intentionally best-effort. Recover the path,
+          // but do not replay a stale real-time packet on the replacement.
+          await this.recover(errorCode(error));
+          return;
+        } catch (recoveryError) {
+          throw translateSidecarError(recoveryError);
+        }
+      }
+      throw translateSidecarError(error);
+    }
+  }
+
+  async close(): Promise<void> {
+    this.closed = true;
+    this.context = null;
+    this.recoveryPromise = null;
+    const sessionId = this.sessionId;
+    this.sessionId = null;
+    this.sidecar.off('event', this.onSidecarEvent);
+    this.sidecar.off('death', this.onSidecarDeath);
+    if (sessionId)
+      await this.sidecar.closePrivateSession(sessionId).catch(() => undefined);
+  }
+
+  private async requireSession(): Promise<string> {
+    if (this.recoveryPromise) await this.recoveryPromise;
+    if (this.closed || !this.sessionId)
+      throw new PrivateChannelError('TRANSPORT_CLOSED');
+    return this.sessionId;
+  }
+
+  private handleSidecarEvent(event: PrivateTransportSidecarEvent): void {
+    if (event.sessionId !== this.sessionId || this.closed) return;
+    if (event.event === 'error') {
+      if (isRecoverableCode(event.code)) {
+        void this.recover(event.code ?? 'TRANSPORT_CLOSED');
+        return;
+      }
+      this.emit({ kind: 'error', code: event.code ?? 'TRANSPORT_ERROR' });
+      return;
+    }
+    if (!event.messageId) {
+      this.emit({ kind: 'error', code: 'PROTOCOL_MISMATCH' });
+      return;
+    }
+    try {
+      this.emit({
+        kind: 'message',
+        lane: event.event === 'datagram' ? 'datagram' : 'reliable',
+        messageId: event.messageId,
+        data: decodeApplicationData(event.data),
+      });
+    } catch {
+      this.emit({ kind: 'error', code: 'PROTOCOL_MISMATCH' });
+    }
+  }
+
+  private async connect(context: PrivateTransportContext): Promise<void> {
+    this.lastAttemptedRelayAddress = null;
+    let [relay, bootstrap] = await Promise.all([
+      this.resolveRelay(),
+      this.bootstrapProvider.getBootstrap(context),
+    ]);
+    // Discovery/authentication can outlast a short-lived backend credential.
+    // Refresh before sending it; a real backend rejection remains terminal.
+    if (bootstrap.expiresAt < Date.now() + 5_000)
+      bootstrap = await this.bootstrapProvider.getBootstrap(context);
+    const openAt = (relayAddress: string) =>
+      this.sidecar.openPrivateSession({
+        preparedRelay: relay.preparedRelay,
+        relayAddress,
+        relayServerName: relay.relayServerName,
+        relayCertSha256: relay.relayCertSha256,
+        backendAddress: bootstrap.backendTransportEndpoint,
+        backendServerName: bootstrap.backendTransportServerName,
+        backendCertSha256: bootstrap.backendTransportCertSha256,
+        logicalSessionId: bootstrap.logicalSessionId,
+        attachToken: bootstrap.attachToken,
+        nonce: bootstrap.nonce,
+        purpose: context.purpose,
+        ownerBindingHash: bootstrap.ownerBindingHash,
+      });
+    let opened;
+    this.lastAttemptedRelayAddress = relay.relayAddress;
+    try {
+      opened = await openAt(relay.relayAddress);
+    } catch (error) {
+      if (
+        !(error instanceof PrivateTransportSidecarError) ||
+        error.code !== 'MASQUE_TUNNEL_FAILED' ||
+        !relay.localFallbackAddress ||
+        relay.localFallbackAddress === relay.relayAddress
+      )
+        throw error;
+      opened = await openAt(relay.localFallbackAddress);
+    }
+    if (this.closed) {
+      await this.sidecar
+        .closePrivateSession(opened.sessionId)
+        .catch(() => undefined);
+      throw new PrivateChannelError('TRANSPORT_CLOSED');
+    }
+    this.sessionId = opened.sessionId;
+    this.activeRelayAddress = relay.relayAddress;
+  }
+
+  private resolveRelay(): Promise<TrustedRelayConfig> {
+    const now = Date.now();
+    for (const [address, failedAt] of this.failedRelayAddresses) {
+      if (now - failedAt >= FAILED_RELAY_COOLDOWN_MS)
+        this.failedRelayAddresses.delete(address);
+    }
+    const excluded = new Set(this.failedRelayAddresses.keys());
+    return typeof this.relay === 'function'
+      ? this.relay(excluded)
+      : Promise.resolve(this.relay);
+  }
+
+  private recover(_reason: string): Promise<string> {
+    if (this.closed)
+      return Promise.reject(new PrivateChannelError('TRANSPORT_CLOSED'));
+    if (this.recoveryPromise) return this.recoveryPromise;
+    const context = this.context;
+    if (!context)
+      return Promise.reject(new PrivateChannelError('TRANSPORT_CLOSED'));
+    if (this.activeRelayAddress)
+      this.failedRelayAddresses.set(this.activeRelayAddress, Date.now());
+    const oldSessionId = this.sessionId;
+    this.sessionId = null;
+    this.activeRelayAddress = null;
+    if (oldSessionId)
+      void this.sidecar
+        .closePrivateSession(oldSessionId)
+        .catch(() => undefined);
+    const recovery = (async (): Promise<string> => {
+      let lastError: unknown = new PrivateChannelError('TRANSPORT_CLOSED');
+      for (const delayMs of RECOVERY_DELAYS_MS) {
+        if (delayMs) await delay(delayMs);
+        if (this.closed) throw new PrivateChannelError('TRANSPORT_CLOSED');
+        try {
+          await this.connect(context);
+          if (!this.sessionId)
+            throw new PrivateChannelError('TRANSPORT_CLOSED');
+          return this.sessionId;
+        } catch (error) {
+          lastError = error;
+          if (this.lastAttemptedRelayAddress)
+            this.failedRelayAddresses.set(
+              this.lastAttemptedRelayAddress,
+              Date.now()
+            );
+          this.sessionId = null;
+          this.activeRelayAddress = null;
+          if (!isRecoverableTransportError(error)) break;
+        }
+      }
+      throw lastError;
+    })();
+    this.recoveryPromise = recovery;
+    void recovery
+      .catch((error) => {
+        if (!this.closed)
+          this.emit({ kind: 'error', code: translateSidecarError(error).code });
+      })
+      .finally(() => {
+        if (this.recoveryPromise === recovery) this.recoveryPromise = null;
+      });
+    return recovery;
+  }
+}
+
+function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function errorCode(error: unknown): string {
+  return error instanceof PrivateTransportSidecarError ||
+    error instanceof PrivateChannelError
+    ? error.code
+    : error instanceof Error
+      ? error.message
+      : 'TRANSPORT_ERROR';
+}
+
+function isRecoverableCode(code: string | undefined): boolean {
+  return (
+    code === 'RELAY_CONNECT_FAILED' ||
+    code === 'RELAY_CONNECTION_CLOSED' ||
+    code === 'RELAY_TARGET_DENIED' ||
+    code === 'RELAY_FULL' ||
+    code === 'RELAY_AUTH_REQUIRED' ||
+    code === 'RELAY_ACCESS_DENIED' ||
+    code === 'RELAY_MEMBERSHIP_UNAVAILABLE' ||
+    code === 'INNER_QUIC_FAILED' ||
+    code === 'TRANSPORT_CLOSED' ||
+    code === 'MASQUE_TUNNEL_FAILED' ||
+    code === 'SIDECAR_EXITED' ||
+    code === 'SIDECAR_NOT_RUNNING' ||
+    code === 'SIDECAR_REQUEST_TIMEOUT' ||
+    code === 'SIDECAR_WRITE_FAILED' ||
+    code === 'MASQUE_RELAY_UNAVAILABLE' ||
+    code === 'BOOTSTRAP_FAILED'
+  );
+}
+
+function isRecoverableTransportError(error: unknown): boolean {
+  return isRecoverableCode(errorCode(error));
+}
+
+function encodeApplicationData(value: unknown): Buffer {
+  if (value instanceof ArrayBuffer)
+    return Buffer.concat([Buffer.from([1]), Buffer.from(value)]);
+  if (ArrayBuffer.isView(value)) {
+    return Buffer.concat([
+      Buffer.from([1]),
+      Buffer.from(value.buffer, value.byteOffset, value.byteLength),
+    ]);
+  }
+  try {
+    return Buffer.concat([
+      Buffer.from([0]),
+      Buffer.from(JSON.stringify(value ?? null), 'utf8'),
+    ]);
+  } catch {
+    throw new PrivateChannelError('INVALID_MESSAGE');
+  }
+}
+
+function decodeApplicationData(value: Buffer): unknown {
+  if (value.length < 1) throw new Error('missing application encoding');
+  if (value[0] === 1) return new Uint8Array(value.subarray(1));
+  if (value[0] === 0) return JSON.parse(value.subarray(1).toString('utf8'));
+  throw new Error('unsupported application encoding');
+}
+
+function translateSidecarError(error: unknown): PrivateChannelError {
+  const code =
+    error instanceof PrivateTransportSidecarError ||
+    error instanceof PrivateChannelError
+      ? error.code
+      : error instanceof Error && error.message === 'MASQUE_RELAY_UNAVAILABLE'
+        ? error.message
+        : 'TRANSPORT_ERROR';
+  const allowed = new Set([
+    'STREAM_LIMIT_REACHED',
+    'RELIABLE_STREAM_FAILED',
+    'RELIABLE_SEND_NOT_STARTED',
+    'RELIABLE_STREAMS_UNSUPPORTED',
+    'TRANSPORT_ALREADY_ATTACHED',
+    'RELAY_NO_ELIGIBLE_RELAY',
+    'RELAY_ACCESS_DENIED',
+    'RELAY_PROOF_INVALID',
+    'RELAY_MEMBERSHIP_UNAVAILABLE',
+    'RELAY_TARGET_DENIED',
+    'RELAY_FULL',
+    'RELAY_AUTH_REQUIRED',
+    'RELAY_CONNECTION_CLOSED',
+    'RELAY_CONNECT_FAILED',
+    'BACKEND_IDENTITY_MISMATCH',
+    'MASQUE_TUNNEL_FAILED',
+    'MASQUE_RELAY_UNAVAILABLE',
+    'INNER_QUIC_FAILED',
+    'SESSION_ATTACH_FAILED',
+    'ATTACH_TOKEN_REJECTED',
+    'DATAGRAM_UNSUPPORTED',
+    'TRANSPORT_CLOSED',
+    'PROTOCOL_MISMATCH',
+    'FRAME_TOO_LARGE',
+  ]);
+  return new PrivateChannelError(allowed.has(code) ? code : 'TRANSPORT_ERROR');
+}
diff --git a/electron/src/relay-access-coordinator.test.ts b/electron/src/relay-access-coordinator.test.ts
new file mode 100644
index 000000000..f69fcff6f
--- /dev/null
+++ b/electron/src/relay-access-coordinator.test.ts
@@ -0,0 +1,263 @@
+import { EventEmitter } from 'events';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  RelayAccessCoordinator,
+  configureRelaySigner,
+  setRelayAccount,
+  setRelayGroups,
+} from './relay-access-coordinator';
+import { PrivateTransportSidecarError } from './private-transport-sidecar';
+import { RelayTicketWallet } from './relay-ticket-wallet';
+
+class Sidecar extends EventEmitter {
+  prepareRelay = vi.fn(
+    async (_config: unknown) =>
+      ({ handle: 'ab'.repeat(24), ready: true }) as any
+  );
+  authorizeRelay = vi.fn(
+    async (_handle: string, _proof?: string, _renew?: boolean) =>
+      ({ handle: 'ab'.repeat(24), ready: true }) as any
+  );
+  closeRelay = vi.fn(async (_handle: string) => {});
+  clearRelays = vi.fn(async () => {});
+}
+const advertisement = (host = '8.8.8.8', ids: number[] = []) => ({
+  host,
+  port: 47322,
+  serverName: 'relay.test',
+  certSha256: 'ab'.repeat(32),
+  expiresAt: Date.now() + 600_000,
+  protocolVersion: 3,
+  ticketIdentity: 'ef'.repeat(32) + 'cd'.repeat(32),
+  ticketKeyId: '12'.repeat(32),
+  relayIdentity: 'cd'.repeat(32),
+  accessMode: ids.length ? 'groups' : 'public',
+  allowedGroupIds: ids,
+});
+const bridgeFor = (...relays: unknown[]) =>
+  ({ getCommunityMasqueRelays: vi.fn(async () => relays) }) as never;
+let coordinator: RelayAccessCoordinator;
+let sidecar: Sidecar;
+beforeEach(() => {
+  vi.spyOn(RelayTicketWallet.prototype, 'ensure').mockResolvedValue(undefined);
+  vi.spyOn(RelayTicketWallet.prototype, 'take').mockReturnValue(
+    '{"epoch":1,"keyId":"key","message":"anonymous","signature":"blind"}'
+  );
+  setRelayAccount('account-A', true);
+  configureRelaySigner(async () => ({
+    authorAddress: 'account-A',
+    authorPublicKey: 'key',
+    signature: 'signature',
+  }));
+  sidecar = new Sidecar();
+  coordinator = new RelayAccessCoordinator(sidecar as never, () => 0);
+});
+afterEach(() => {
+  coordinator.dispose();
+  vi.restoreAllMocks();
+  vi.useRealTimers();
+});
+
+describe('shared relay selection and authorization', () => {
+  it.each([{ ids: [] }, { ids: [9] }])(
+    'does not contact restricted relays with fresh nonmatching groups %j',
+    async ({ ids }) => {
+      setRelayGroups(ids);
+      await expect(
+        coordinator.select(bridgeFor(advertisement('8.8.8.8', [42])))
+      ).rejects.toMatchObject({ code: 'RELAY_NO_ELIGIBLE_RELAY' });
+      expect(RelayTicketWallet.prototype.ensure).not.toHaveBeenCalled();
+      expect(sidecar.prepareRelay).not.toHaveBeenCalled();
+      expect(sidecar.authorizeRelay).not.toHaveBeenCalled();
+    }
+  );
+  it('still tries a restricted relay when membership is unknown', async () => {
+    await coordinator.select(bridgeFor(advertisement('8.8.8.8', [42])));
+    expect(RelayTicketWallet.prototype.ensure).toHaveBeenCalledTimes(1);
+    expect(sidecar.prepareRelay).toHaveBeenCalledTimes(1);
+  });
+  it('does not exclude a relay using stale nonmembership information', async () => {
+    vi.useFakeTimers();
+    setRelayGroups([]);
+    await vi.advanceTimersByTimeAsync(30_000);
+    await coordinator.select(bridgeFor(advertisement('8.8.8.8', [42])));
+    expect(sidecar.prepareRelay).toHaveBeenCalledTimes(1);
+  });
+  it('uses a public alternative without contacting the ineligible relay', async () => {
+    setRelayGroups([]);
+    const selected = await coordinator.select(
+      bridgeFor(advertisement('8.8.8.8', [42]), advertisement('1.1.1.1'))
+    );
+    expect(selected.relayAddress).toBe('1.1.1.1:47322');
+    expect(sidecar.prepareRelay).toHaveBeenCalledTimes(1);
+    expect(RelayTicketWallet.prototype.ensure).not.toHaveBeenCalled();
+  });
+  it('treats a successful empty Core membership result as known nonmembership', async () => {
+    configureRelaySigner(vi.fn(), undefined, async () => []);
+    await expect(
+      coordinator.select(bridgeFor(advertisement('8.8.8.8', [42])))
+    ).rejects.toMatchObject({ code: 'RELAY_NO_ELIGIBLE_RELAY' });
+    expect(sidecar.prepareRelay).not.toHaveBeenCalled();
+  });
+  it('shares a concurrent preparation between applications', async () => {
+    const bridge = bridgeFor(advertisement());
+    const [a, b] = await Promise.all([
+      coordinator.select(bridge),
+      coordinator.select(bridge),
+    ]);
+    expect(a.preparedRelay).toBe(b.preparedRelay);
+    expect(sidecar.prepareRelay).toHaveBeenCalledTimes(1);
+    await coordinator.select(bridge);
+    expect(sidecar.authorizeRelay).toHaveBeenCalledTimes(1);
+  });
+  it('moves immediately past a rejected relay', async () => {
+    sidecar.prepareRelay.mockRejectedValueOnce(
+      new PrivateTransportSidecarError('RELAY_ACCESS_DENIED')
+    );
+    const result = await coordinator.select(
+      bridgeFor(advertisement(), advertisement('1.1.1.1'))
+    );
+    expect(result.relayAddress).toBe('1.1.1.1:47322');
+    expect(sidecar.prepareRelay).toHaveBeenCalledTimes(2);
+  });
+  it('discovers a new relay automatically when its cached relay fails', async () => {
+    const bridge = new EventEmitter() as EventEmitter & {
+      getCommunityMasqueRelays: ReturnType<typeof vi.fn>;
+    };
+    let fresh = false;
+    bridge.getCommunityMasqueRelays = vi.fn(async (announce: boolean) => {
+      if (announce) fresh = true;
+      return [advertisement(), ...(fresh ? [advertisement('1.1.1.1')] : [])];
+    });
+    sidecar.prepareRelay.mockRejectedValueOnce(
+      new PrivateTransportSidecarError('RELAY_ACCESS_DENIED')
+    );
+    await expect(coordinator.select(bridge as never)).resolves.toMatchObject({
+      relayAddress: '1.1.1.1:47322',
+    });
+    expect(bridge.getCommunityMasqueRelays).toHaveBeenCalledWith(true);
+  });
+  it('hedges a slow relay without waiting for its timeout', async () => {
+    vi.useFakeTimers();
+    sidecar.prepareRelay.mockImplementationOnce(() => new Promise(() => {}));
+    const pending = coordinator.select(
+      bridgeFor(advertisement(), advertisement('1.1.1.1'))
+    );
+    await vi.advanceTimersByTimeAsync(300);
+    await expect(pending).resolves.toMatchObject({
+      relayAddress: '1.1.1.1:47322',
+    });
+    expect(sidecar.prepareRelay).toHaveBeenCalledTimes(2);
+  });
+  it('prefers a known matching group without treating the hint as authorization', async () => {
+    setRelayGroups([42]);
+    await coordinator.select(
+      bridgeFor(advertisement('8.8.8.8', [9]), advertisement('1.1.1.1', [42]))
+    );
+    expect(sidecar.prepareRelay.mock.calls[0][0]).toMatchObject({
+      relayAddress: '1.1.1.1:47322',
+    });
+  });
+  it('loads group hints independently when chat has not supplied memberships', async () => {
+    const readGroups = vi.fn(async () => [42]);
+    configureRelaySigner(
+      async () => ({
+        authorAddress: 'account-A',
+        authorPublicKey: 'key',
+        signature: 'signature',
+      }),
+      undefined,
+      readGroups
+    );
+    await coordinator.select(
+      bridgeFor(advertisement('8.8.8.8', [9]), advertisement('1.1.1.1', [42]))
+    );
+    expect(readGroups).toHaveBeenCalledWith('account-A');
+    expect(sidecar.prepareRelay.mock.calls[0][0]).toMatchObject({
+      relayAddress: '1.1.1.1:47322',
+    });
+  });
+  it('rejects late results after an account change and releases their connection', async () => {
+    let finish!: (value: any) => void;
+    sidecar.prepareRelay.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve;
+        })
+    );
+    const pending = coordinator.select(bridgeFor(advertisement()));
+    const checked = expect(pending).rejects.toThrow('RELAY_ACCOUNT_CHANGED');
+    await vi.waitFor(() =>
+      expect(sidecar.prepareRelay).toHaveBeenCalledTimes(1)
+    );
+    setRelayAccount('account-B');
+    finish({ handle: 'ab'.repeat(24), ready: true });
+    await checked;
+    expect(sidecar.closeRelay).toHaveBeenCalledWith('ab'.repeat(24));
+  });
+  it('sends only an anonymous ticket over QUIC', async () => {
+    const challenge = {
+      type: 'masque-ticket-required-v1',
+    };
+    sidecar.prepareRelay.mockResolvedValueOnce({
+      handle: 'ab'.repeat(24),
+      ready: false,
+      challenge,
+    });
+    await coordinator.select(bridgeFor(advertisement('8.8.8.8', [42])));
+    expect(JSON.parse(sidecar.authorizeRelay.mock.calls[0][1]!)).toMatchObject({
+      message: 'anonymous',
+    });
+    expect(sidecar.authorizeRelay.mock.calls[0][1]).not.toContain('account-A');
+  });
+  it('never signs a mismatched policy', async () => {
+    const sign = vi.fn();
+    configureRelaySigner(sign);
+    sidecar.prepareRelay.mockResolvedValueOnce({
+      handle: 'ab'.repeat(24),
+      ready: false,
+      challenge: { type: 'masque-relay-auth-v1' },
+    });
+    await expect(
+      coordinator.select(bridgeFor(advertisement('8.8.8.8', [42])))
+    ).rejects.toThrow('RELAY_PROTOCOL_UNSUPPORTED');
+    expect(sign).not.toHaveBeenCalled();
+  });
+  it('removes its sidecar listener on disposal', () => {
+    coordinator.dispose();
+    expect(sidecar.listenerCount('death')).toBe(0);
+  });
+  it('renews an expiring grant and shares renewal with new applications', async () => {
+    vi.useFakeTimers();
+    const handle = 'ab'.repeat(24);
+    sidecar.prepareRelay.mockResolvedValueOnce({
+      handle,
+      ready: true,
+      expiresAt: Date.now() + 360_000,
+    });
+    const bridge = bridgeFor(advertisement('8.8.8.8', [42]));
+    await coordinator.select(bridge);
+    sidecar.authorizeRelay.mockResolvedValueOnce({
+      handle,
+      ready: true,
+      expiresAt: Date.now() + 43_200_000,
+    });
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(sidecar.authorizeRelay).toHaveBeenCalledWith(handle, '', true);
+    expect(sidecar.prepareRelay).toHaveBeenCalledTimes(1);
+  });
+  it('does not keep renewing a connection after confirmed rejection', async () => {
+    vi.useFakeTimers();
+    sidecar.prepareRelay.mockResolvedValueOnce({
+      handle: 'ab'.repeat(24),
+      ready: true,
+      expiresAt: Date.now() + 60_000,
+    });
+    await coordinator.select(bridgeFor(advertisement('8.8.8.8', [42])));
+    sidecar.authorizeRelay.mockRejectedValue(
+      new PrivateTransportSidecarError('RELAY_ACCESS_DENIED')
+    );
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(sidecar.authorizeRelay).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/electron/src/relay-access-coordinator.ts b/electron/src/relay-access-coordinator.ts
new file mode 100644
index 000000000..6a4aad79a
--- /dev/null
+++ b/electron/src/relay-access-coordinator.ts
@@ -0,0 +1,502 @@
+import { RelayTicketWallet } from './relay-ticket-wallet';
+import net from 'net';
+import type { ReticulumBridge } from './reticulum-bridge';
+import {
+  discoverCommunityMasqueRelay,
+  validateCommunityMasqueRelay,
+} from './masque-relay-discovery';
+import {
+  PrivateTransportSidecar,
+  PrivateTransportSidecarError,
+  type PreparedRelay,
+} from './private-transport-sidecar';
+import type { TrustedRelayConfig } from './quic-masque-transport';
+
+type Signature = {
+  authorAddress: string;
+  authorPublicKey: string;
+  signature: string;
+};
+type Signer = (fields: Record<string, unknown>) => Promise<Signature | null>;
+let signer: Signer | undefined;
+let accountReader: (() => Promise<string>) | undefined;
+let groupReader: ((address: string) => Promise<number[] | null>) | undefined;
+let groupRead: { epoch: number; promise: Promise<number[] | null> } | undefined;
+let accountRead: Promise<void> | undefined;
+let account = '';
+let generation = 0;
+let groups: Set<number> | null = null;
+let groupsAt = 0;
+const instances = new Set<RelayAccessCoordinator>();
+
+export function configureRelaySigner(
+  value: Signer,
+  readAccount?: () => Promise<string>,
+  readGroups?: (address: string) => Promise<number[] | null>
+) {
+  signer = value;
+  accountReader = readAccount;
+  groupReader = readGroups;
+}
+export function setRelayAccount(address: string, force = false) {
+  if (address === account && !force) return;
+  const clearHints = !!account || !address;
+  account = address;
+  generation++;
+  if (clearHints) {
+    groups = null;
+    groupsAt = 0;
+  }
+  for (const coordinator of instances) coordinator.clear();
+}
+export function setRelayGroups(ids: number[]) {
+  groups = new Set(ids.filter((id) => Number.isInteger(id) && id > 0));
+  groupsAt = Date.now();
+}
+
+/** Main-process only. Announcements are selection hints; admission is enforced
+ * on the peer's actual TLS connection. Neither QApps nor discovery can sign. */
+export class RelayAccessCoordinator {
+  private tickets: RelayTicketWallet;
+  private bridge?: ReticulumBridge;
+  private pending = new Map<string, Promise<TrustedRelayConfig>>();
+  private ready = new Map<string, TrustedRelayConfig>();
+  private failures = new Map<string, number>();
+  private failedEndpoints = new Map<string, number>();
+  private renewals = new Map<string, NodeJS.Timeout>();
+  private discovery: Promise<unknown> | null = null;
+  private onDeath = () => this.clear();
+  constructor(
+    private sidecar: PrivateTransportSidecar,
+    private random = Math.random
+  ) {
+    this.tickets = new RelayTicketWallet(sidecar);
+    instances.add(this);
+    sidecar.on('death', this.onDeath);
+  }
+  clear() {
+    this.tickets.clear();
+    for (const timer of this.renewals.values()) clearTimeout(timer);
+    this.renewals.clear();
+    this.pending.clear();
+    this.ready.clear();
+    this.failures.clear();
+    this.failedEndpoints.clear();
+    void this.sidecar.clearRelays().catch(() => undefined);
+  }
+  dispose() {
+    this.clear();
+    this.sidecar.off('death', this.onDeath);
+    instances.delete(this);
+  }
+  async select(
+    bridge: ReticulumBridge,
+    excluded: ReadonlySet<string> = new Set(),
+    allowLoopback = false
+  ): Promise<TrustedRelayConfig> {
+    this.bridge = bridge;
+    const deadline = Date.now() + 60_000;
+    try {
+      return await this.selectPass(bridge, excluded, allowLoopback, deadline);
+    } catch (error) {
+      const code =
+        error instanceof PrivateTransportSidecarError
+          ? error.code
+          : error instanceof Error
+            ? error.message
+            : '';
+      if (
+        ![
+          'RELAY_CONNECT_FAILED',
+          'RELAY_ACCESS_DENIED',
+          'RELAY_MEMBERSHIP_UNAVAILABLE',
+          'RELAY_FULL',
+          'RELAY_BUSY',
+          'MASQUE_RELAY_UNAVAILABLE',
+        ].includes(code) ||
+        Date.now() >= deadline
+      )
+        throw error;
+      const rejected = new Set(excluded);
+      for (const [endpoint, until] of this.failedEndpoints)
+        if (until > Date.now()) rejected.add(endpoint);
+      // Cached relays can all be dead or inaccessible. Ask the network once
+      // for a fresh alternative instead of requiring a manual reconnect.
+      this.discovery ??= discoverCommunityMasqueRelay(bridge, {
+        allowLoopback,
+        excludeRelayAddresses: rejected,
+        timeoutMs: Math.min(5_000, deadline - Date.now()),
+      }).finally(() => {
+        this.discovery = null;
+      });
+      try {
+        await this.discovery;
+      } catch {
+        throw error;
+      }
+      return this.selectPass(bridge, rejected, allowLoopback, deadline);
+    }
+  }
+  private async selectPass(
+    bridge: ReticulumBridge,
+    excluded: ReadonlySet<string>,
+    allowLoopback: boolean,
+    deadlineAt: number
+  ): Promise<TrustedRelayConfig> {
+    if (accountReader) {
+      if (!accountRead) {
+        const before = generation;
+        accountRead = accountReader()
+          .then((address) => {
+            if (before !== generation) throw new Error('RELAY_ACCOUNT_CHANGED');
+            setRelayAccount(address);
+          })
+          .finally(() => {
+            accountRead = undefined;
+          });
+      }
+      await accountRead;
+    }
+    const epoch = generation;
+    const collect = async () =>
+      (await bridge.getCommunityMasqueRelays(false))
+        .map((value) => validateCommunityMasqueRelay(value, { allowLoopback }))
+        .filter(Boolean)
+        .map(
+          (relay) =>
+            ({
+              relayAddress: `${net.isIP(relay!.host) === 6 ? `[${relay!.host}]` : relay!.host}:${relay!.port}`,
+              relayServerName: relay!.serverName,
+              relayCertSha256: relay!.certSha256,
+              localFallbackAddress: `127.0.0.1:${relay!.port}`,
+              protocolVersion: relay!.protocolVersion,
+              relayIdentity: relay!.relayIdentity,
+              ticketIdentity: relay!.ticketIdentity,
+              ticketKeyId: relay!.ticketKeyId,
+              accessMode: relay!.accessMode,
+              allowedGroupIds: relay!.allowedGroupIds,
+            }) satisfies TrustedRelayConfig
+        );
+    let candidates = await collect();
+    if (!candidates.some((r) => !excluded.has(r.relayAddress))) {
+      this.discovery ??= discoverCommunityMasqueRelay(bridge, {
+        allowLoopback,
+        excludeRelayAddresses: excluded,
+        timeoutMs: Math.max(1, Math.min(8_000, deadlineAt - Date.now())),
+      }).finally(() => {
+        this.discovery = null;
+      });
+      await this.discovery;
+      candidates = await collect();
+    }
+    if (
+      candidates.length &&
+      candidates.every((r) => r.accessMode === 'groups') &&
+      (!groups || Date.now() - groupsAt >= 30_000) &&
+      groupReader &&
+      account
+    ) {
+      if (!groupRead || groupRead.epoch !== epoch) {
+        const operation = groupReader(account).catch(() => null);
+        groupRead = { epoch, promise: operation };
+        void operation.finally(() => {
+          if (groupRead?.promise === operation) groupRead = undefined;
+        });
+      }
+      const hints = await groupRead.promise;
+      if (epoch !== generation) throw new Error('RELAY_ACCOUNT_CHANGED');
+      if (hints) setRelayGroups(hints);
+    }
+    const score = (relay: TrustedRelayConfig) => {
+      if (this.ready.has(this.key(relay))) return 0;
+      if (relay.accessMode !== 'groups') return 1;
+      if (groups && relay.allowedGroupIds?.some((id) => groups!.has(id)))
+        return 1;
+      return 2;
+    };
+    candidates = candidates.filter(
+      (r) =>
+        !excluded.has(r.relayAddress) &&
+        (this.failures.get(this.key(r)) ?? 0) <= Date.now()
+    );
+    const tieBreak = new Map(
+      candidates.map((r) => [this.key(r), this.random()])
+    );
+    candidates.sort(
+      (a, b) =>
+        score(a) - score(b) ||
+        tieBreak.get(this.key(a))! - tieBreak.get(this.key(b))!
+    );
+    // Unknown/stale membership is lower priority, never permanent exclusion.
+    const eligible = candidates.filter(
+      (r) =>
+        !(
+          r.accessMode === 'groups' &&
+          groups &&
+          Date.now() - groupsAt < 30_000 &&
+          !r.allowedGroupIds?.some((id) => groups!.has(id))
+        )
+    );
+    if (candidates.length && !eligible.length)
+      throw new PrivateTransportSidecarError('RELAY_NO_ELIGIBLE_RELAY');
+    candidates = eligible;
+    if (!candidates.length) throw new Error('MASQUE_RELAY_UNAVAILABLE');
+    let index = 0,
+      finished = false,
+      active = 0;
+    return new Promise((resolve, reject) => {
+      const deadline = setTimeout(
+        () => {
+          finished = true;
+          reject(new Error('MASQUE_RELAY_UNAVAILABLE'));
+        },
+        Math.max(1, deadlineAt - Date.now())
+      );
+      let lastError: unknown = new Error('MASQUE_RELAY_UNAVAILABLE');
+      const next = () => {
+        if (finished) return;
+        if (epoch !== generation) {
+          finished = true;
+          clearTimeout(deadline);
+          reject(new Error('RELAY_ACCOUNT_CHANGED'));
+          return;
+        }
+        if (index >= Math.min(6, candidates.length)) {
+          if (!active) {
+            finished = true;
+            clearTimeout(deadline);
+            reject(lastError);
+          }
+          return;
+        }
+        const candidate = candidates[index++];
+        active++;
+        this.prepare(candidate, epoch)
+          .then((result) => {
+            if (finished) return;
+            if (epoch !== generation) {
+              finished = true;
+              clearTimeout(deadline);
+              reject(new Error('RELAY_ACCOUNT_CHANGED'));
+              return;
+            }
+            finished = true;
+            clearTimeout(deadline);
+            resolve(result);
+          })
+          .catch((error) => {
+            lastError = error;
+            active--;
+            next();
+          });
+      };
+      next();
+      const hedge = setTimeout(() => {
+        if (!finished && active < 2) next();
+      }, 300);
+      hedge.unref?.();
+    });
+  }
+  private key(r: TrustedRelayConfig) {
+    return `${generation}:${r.relayAddress}:${r.relayCertSha256}:${JSON.stringify(r.allowedGroupIds ?? [])}`;
+  }
+  private prepare(
+    relay: TrustedRelayConfig,
+    epoch: number
+  ): Promise<TrustedRelayConfig> {
+    const key = this.key(relay);
+    const pending = this.pending.get(key);
+    if (pending) return pending;
+    if (this.pending.size >= 32)
+      return Promise.reject(new PrivateTransportSidecarError('RELAY_BUSY'));
+    const operation = (async () => {
+      let prepared: PreparedRelay | undefined;
+      let connectedRelay = relay;
+      const prior = this.ready.get(key);
+      try {
+        if (prior?.preparedRelay) {
+          try {
+            prepared = await this.sidecar.authorizeRelay(prior.preparedRelay);
+          } catch {
+            this.ready.delete(key);
+          }
+        }
+        if (prepared && prior) connectedRelay = prior;
+        if (!prepared || prepared.challenge)
+          await this.ensureTickets(relay, epoch);
+        if (!prepared) {
+          try {
+            prepared = await this.sidecar.prepareRelay({
+              ...relay,
+              legacyRelay: ![2, 3].includes(relay.protocolVersion ?? 1),
+            });
+          } catch (error) {
+            // Same-host fallback requires possession of the advertised TLS key.
+            if (
+              !(error instanceof PrivateTransportSidecarError) ||
+              error.code !== 'RELAY_CONNECT_FAILED' ||
+              !relay.localFallbackAddress ||
+              relay.localFallbackAddress === relay.relayAddress
+            )
+              throw error;
+            connectedRelay = {
+              ...relay,
+              relayAddress: relay.localFallbackAddress,
+            };
+            prepared = await this.sidecar.prepareRelay({
+              ...connectedRelay,
+              legacyRelay: ![2, 3].includes(relay.protocolVersion ?? 1),
+            });
+          }
+        }
+        prepared = await this.complete(relay, prepared, epoch);
+        if (this.ready.size >= 512 && !this.ready.has(key)) {
+          const disposable = [...this.ready.keys()].find(
+            (k) => !this.renewals.has(k)
+          );
+          if (disposable) this.ready.delete(disposable);
+          else throw new PrivateTransportSidecarError('RELAY_POOL_FULL');
+        }
+        const ready = { ...connectedRelay, preparedRelay: prepared.handle };
+        this.ready.set(key, ready);
+        this.scheduleRenewal(key, ready, prepared.expiresAt, epoch);
+        return ready;
+      } catch (error) {
+        if (prepared?.handle)
+          void this.sidecar.closeRelay(prepared.handle).catch(() => undefined);
+        this.ready.delete(key);
+        const code =
+          error instanceof PrivateTransportSidecarError ? error.code : '';
+        if (this.failures.size >= 256)
+          this.failures.delete(this.failures.keys().next().value!);
+        this.failures.set(
+          key,
+          Date.now() + (code === 'RELAY_ACCESS_DENIED' ? 15_000 : 5_000)
+        );
+        if (this.failedEndpoints.size >= 256)
+          this.failedEndpoints.delete(
+            this.failedEndpoints.keys().next().value!
+          );
+        this.failedEndpoints.set(relay.relayAddress, Date.now() + 5_000);
+        throw error;
+      }
+    })().finally(() => {
+      if (this.pending.get(key) === operation) this.pending.delete(key);
+    });
+    this.pending.set(key, operation);
+    return operation;
+  }
+  private async complete(
+    relay: TrustedRelayConfig,
+    result: PreparedRelay,
+    epoch: number
+  ) {
+    if (epoch !== generation) throw new Error('RELAY_ACCOUNT_CHANGED');
+    if (result.challenge) {
+      if (
+        relay.protocolVersion !== 3 ||
+        relay.accessMode !== 'groups' ||
+        JSON.stringify(result.challenge) !==
+          '{"type":"masque-ticket-required-v1"}'
+      )
+        throw new PrivateTransportSidecarError('RELAY_PROTOCOL_UNSUPPORTED');
+      result = await this.sidecar.authorizeRelay(
+        result.handle,
+        this.tickets.take(relay)
+      );
+    }
+    if (!result.ready || epoch !== generation)
+      throw new Error('RELAY_AUTH_UNAVAILABLE');
+    return result;
+  }
+  private async ensureTickets(relay: TrustedRelayConfig, epoch: number) {
+    if (relay.accessMode !== 'groups') return;
+    if (!this.bridge || !account || !signer)
+      throw new Error('RELAY_AUTH_UNAVAILABLE');
+    // Refresh signed key commitment after hourly rotation, including renewals.
+    const candidates = await this.bridge.getCommunityMasqueRelays(false);
+    const latest = candidates
+      .map((v) => validateCommunityMasqueRelay(v, { allowLoopback: true }))
+      .find(
+        (v) =>
+          v?.relayIdentity === relay.relayIdentity &&
+          v?.certSha256 === relay.relayCertSha256 &&
+          JSON.stringify(v?.allowedGroupIds) ===
+            JSON.stringify(relay.allowedGroupIds)
+      );
+    const current = latest
+      ? {
+          ...relay,
+          ticketIdentity: latest.ticketIdentity,
+          ticketKeyId: latest.ticketKeyId,
+          protocolVersion: latest.protocolVersion,
+        }
+      : relay;
+    await this.tickets.ensure(
+      this.bridge,
+      current,
+      account,
+      signer,
+      () => epoch === generation
+    );
+  }
+  private scheduleRenewal(
+    key: string,
+    relay: TrustedRelayConfig,
+    expires: number | undefined,
+    epoch: number,
+    retryDelay?: number
+  ) {
+    const old = this.renewals.get(key);
+    if (old) clearTimeout(old);
+    if (!expires || !relay.preparedRelay) return;
+    const timer = setTimeout(
+      async () => {
+        this.renewals.delete(key);
+        if (epoch !== generation) return;
+        if (this.pending.has(key)) {
+          this.scheduleRenewal(key, relay, expires, epoch, 1_000);
+          return;
+        }
+        const renewal = (async () => {
+          await this.ensureTickets(relay, epoch);
+          let result = await this.sidecar.authorizeRelay(
+            relay.preparedRelay!,
+            '',
+            true
+          );
+          result = await this.complete(relay, result, epoch);
+          this.scheduleRenewal(key, relay, result.expiresAt, epoch);
+          return relay;
+        })();
+        this.pending.set(key, renewal);
+        try {
+          await renewal;
+        } catch (error) {
+          this.ready.delete(key);
+          if (
+            error instanceof PrivateTransportSidecarError &&
+            [
+              'RELAY_ACCESS_DENIED',
+              'RELAY_PROOF_INVALID',
+              'RELAY_CONNECTION_CLOSED',
+            ].includes(error.code)
+          ) {
+            this.failures.set(key, Date.now() + 15_000);
+            return;
+          }
+          // The relay's deadline remains authoritative if renewal is unavailable.
+          // Retry promptly while it remains valid; never extend cached permission.
+          if (epoch === generation && Date.now() + 5_000 < expires) {
+            this.scheduleRenewal(key, relay, expires, epoch, 5_000);
+          }
+        } finally {
+          if (this.pending.get(key) === renewal) this.pending.delete(key);
+        }
+      },
+      retryDelay ?? Math.max(1_000, expires - Date.now() - 5 * 60_000)
+    );
+    timer.unref?.();
+    this.renewals.set(key, timer);
+  }
+}
diff --git a/electron/src/relay-ticket-wallet.test.ts b/electron/src/relay-ticket-wallet.test.ts
new file mode 100644
index 000000000..b79e31f64
--- /dev/null
+++ b/electron/src/relay-ticket-wallet.test.ts
@@ -0,0 +1,141 @@
+import { createHash } from 'crypto';
+import { describe, it, expect, vi } from 'vitest';
+import { RelayTicketWallet, relayPolicy } from './relay-ticket-wallet';
+
+function fixture() {
+  const relay = {
+    protocolVersion: 3 as const,
+    accessMode: 'groups' as const,
+    allowedGroupIds: [1144],
+    relayIdentity: 'cd'.repeat(32),
+    ticketIdentity: 'ef'.repeat(32) + 'cd'.repeat(32),
+    ticketKeyId: 'ab'.repeat(32),
+    relayCertSha256: '12'.repeat(32),
+    relayAddress: '8.8.8.8:47322',
+    relayServerName: 'relay',
+  };
+  const descriptor = {
+    epoch: Math.floor(Date.now() / 3600000),
+    expiresAt: Date.now() + 43200000,
+    publicKey: 'key',
+    keyId: relay.ticketKeyId,
+    relayPin: relay.relayCertSha256,
+    policy: relayPolicy(relay),
+  };
+  const blinded = ['a', 'b', 'c'];
+  const sidecar = {
+    prepareRelayTickets: vi.fn(async () => ({
+      handle: 'ab'.repeat(24),
+      blinded,
+    })),
+    finalizeRelayTickets: vi.fn(async () => ({
+      tickets: ['ticket1', 'ticket2', 'ticket3'],
+      expiresAt: descriptor.expiresAt,
+    })),
+  };
+  const bridge = {
+    relayTicketRequest: vi.fn(
+      async (_id: string, path: string, _data: unknown) => {
+        if (path === '/catalog') return descriptor;
+        if (path === '/challenge')
+          return {
+            type: 'masque-ticket-issue-v1',
+            relayPin: relay.relayCertSha256,
+            policy: relayPolicy(relay),
+            binding: createHash('sha256')
+              .update(JSON.stringify({ key: descriptor.keyId, blinded }))
+              .digest('hex'),
+            nonce: '34'.repeat(32),
+            expiresAt: Date.now() + 60000,
+          };
+        return { signatures: ['s1', 's2', 's3'] };
+      }
+    ),
+    getCommunityMasqueRelays: vi.fn(async () => []),
+  };
+  const sign = vi.fn(async () => ({
+    authorAddress: 'account-A',
+    authorPublicKey: 'pub',
+    signature: 'sig',
+  }));
+  const wallet = new RelayTicketWallet(sidecar as never);
+  const ensure = () =>
+    wallet.ensure(bridge as never, relay, 'account-A', sign, () => true);
+  return { wallet, sidecar, bridge, relay, descriptor, sign, ensure };
+}
+describe('anonymous relay ticket wallet', () => {
+  it('coalesces issuance, keeps spares and spends each ticket once', async () => {
+    const f = fixture();
+    await Promise.all([f.ensure(), f.ensure()]);
+    expect(f.sign).toHaveBeenCalledTimes(1);
+    expect(f.bridge.relayTicketRequest.mock.calls.map((c) => c[1])).toEqual([
+      '/catalog',
+      '/challenge',
+      '/issue',
+    ]);
+    expect(f.wallet.take(f.relay)).toBe('ticket1');
+    await f.ensure();
+    expect(f.sign).toHaveBeenCalledTimes(1);
+    expect(f.wallet.take(f.relay)).toBe('ticket2');
+    expect(f.wallet.take(f.relay)).toBe('ticket3');
+    expect(() => f.wallet.take(f.relay)).toThrow();
+  });
+  it('does not sign a wrong relay or policy', async () => {
+    const f = fixture();
+    f.descriptor.policy = '00'.repeat(32);
+    await expect(f.ensure()).rejects.toThrow('RELAY_PROOF_INVALID');
+    expect(f.sign).not.toHaveBeenCalled();
+  });
+  it('sends account proof only through Reticulum', async () => {
+    const f = fixture();
+    await f.ensure();
+    const issued = f.bridge.relayTicketRequest.mock.calls.find(
+      (c) => c[1] === '/issue'
+    )![2] as any;
+    expect(issued.proof.authorAddress).toBe('account-A');
+    expect(
+      JSON.stringify(f.sidecar.prepareRelayTickets.mock.calls)
+    ).not.toContain('account-A');
+    expect(
+      JSON.stringify(f.sidecar.finalizeRelayTickets.mock.calls)
+    ).not.toContain('account-A');
+  });
+  it('discards all tickets on logout', async () => {
+    const f = fixture();
+    await f.ensure();
+    f.wallet.clear();
+    expect(() => f.wallet.take(f.relay)).toThrow();
+    await f.ensure();
+    expect(f.sign).toHaveBeenCalledTimes(2);
+  });
+  it('rejects an account change during issuance', async () => {
+    const f = fixture();
+    f.sign.mockImplementationOnce(async () => {
+      f.wallet.clear();
+      return {
+        authorAddress: 'account-A',
+        authorPublicKey: 'pub',
+        signature: 'sig',
+      };
+    });
+    await expect(f.ensure()).rejects.toThrow('RELAY_ACCOUNT_CHANGED');
+    expect(f.sidecar.finalizeRelayTickets).not.toHaveBeenCalled();
+    expect(() => f.wallet.take(f.relay)).toThrow();
+  });
+  it('fails closed on membership failure without caching credentials', async () => {
+    const f = fixture();
+    f.bridge.relayTicketRequest.mockRejectedValueOnce(
+      new Error('RELAY_MEMBERSHIP_UNAVAILABLE')
+    );
+    await expect(f.ensure()).rejects.toThrow('RELAY_MEMBERSHIP_UNAVAILABLE');
+    expect(() => f.wallet.take(f.relay)).toThrow();
+    await f.ensure();
+    expect(f.sign).toHaveBeenCalledTimes(1);
+  });
+  it('refuses old account-proof relays', async () => {
+    const f = fixture();
+    f.relay.protocolVersion = 2 as never;
+    await expect(f.ensure()).rejects.toThrow('RELAY_PROTOCOL_UNSUPPORTED');
+    expect(f.sign).not.toHaveBeenCalled();
+  });
+});
diff --git a/electron/src/relay-ticket-wallet.ts b/electron/src/relay-ticket-wallet.ts
new file mode 100644
index 000000000..61c528207
--- /dev/null
+++ b/electron/src/relay-ticket-wallet.ts
@@ -0,0 +1,207 @@
+import { createHash } from 'crypto';
+import type { ReticulumBridge } from './reticulum-bridge';
+import {
+  PrivateTransportSidecar,
+  PrivateTransportSidecarError,
+} from './private-transport-sidecar';
+import type { TrustedRelayConfig } from './quic-masque-transport';
+import { validateCommunityMasqueRelay } from './masque-relay-discovery';
+
+export function relayPolicy(relay: TrustedRelayConfig) {
+  return createHash('sha256')
+    .update(
+      JSON.stringify({
+        Mode: relay.accessMode,
+        Groups: relay.allowedGroupIds?.length
+          ? [...relay.allowedGroupIds].sort((a, b) => a - b)
+          : null,
+      })
+    )
+    .digest('hex');
+}
+type Signature = {
+  authorAddress: string;
+  authorPublicKey: string;
+  signature: string;
+};
+type Batch = { tickets: string[]; expiresAt: number };
+/** In-memory, account-scoped bearer credentials. Never exposed to a QApp. */
+export class RelayTicketWallet {
+  private batches = new Map<string, Batch>();
+  private pending = new Map<string, Promise<void>>();
+  private generation = 0;
+  constructor(private sidecar: PrivateTransportSidecar) {}
+  clear() {
+    this.generation++;
+    this.batches.clear();
+    this.pending.clear();
+  }
+  private key(r: TrustedRelayConfig) {
+    return `${r.relayIdentity}:${r.relayCertSha256}:${relayPolicy(r)}`;
+  }
+  async ensure(
+    bridge: ReticulumBridge,
+    relay: TrustedRelayConfig,
+    account: string,
+    sign: (p: Record<string, unknown>) => Promise<Signature | null>,
+    valid: () => boolean
+  ) {
+    const key = this.key(relay),
+      existing = this.batches.get(key);
+    if (
+      existing?.tickets.length &&
+      existing.expiresAt > Date.now() + 10 * 60_000
+    )
+      return;
+    if (this.pending.has(key)) return this.pending.get(key)!;
+    if (
+      relay.protocolVersion !== 3 ||
+      !relay.ticketIdentity ||
+      !relay.ticketKeyId
+    )
+      throw new PrivateTransportSidecarError('RELAY_PROTOCOL_UNSUPPORTED');
+    if (this.pending.size >= 4)
+      throw new PrivateTransportSidecarError('RELAY_BUSY');
+    const epoch = this.generation;
+    const check = () => {
+      if (epoch !== this.generation || !valid())
+        throw new Error('RELAY_ACCOUNT_CHANGED');
+    };
+    const operation = (async () => {
+      for (let attempt = 0; attempt < 2; attempt++) {
+        const startedWindow = Math.floor(Date.now() / 3_600_000);
+        try {
+          const request = async (
+            path: string,
+            data: Record<string, unknown>
+          ) => {
+            check();
+            try {
+              const result = await bridge.relayTicketRequest(
+                relay.ticketIdentity!,
+                path,
+                data
+              );
+              check();
+              return result;
+            } catch (error) {
+              check();
+              throw new PrivateTransportSidecarError(
+                error instanceof Error && /^RELAY_[A-Z_]+$/.test(error.message)
+                  ? error.message
+                  : 'RELAY_AUTH_UNAVAILABLE'
+              );
+            }
+          };
+          const descriptor = await request('/catalog', {});
+          let committedKey = relay.ticketKeyId;
+          if (descriptor.keyId !== committedKey) {
+            await bridge.getCommunityMasqueRelays(true);
+            for (let attempt = 0; attempt < 10; attempt++) {
+              check();
+              const ads = await bridge.getCommunityMasqueRelays(false);
+              const current = ads
+                .map((v) =>
+                  validateCommunityMasqueRelay(v, { allowLoopback: true })
+                )
+                .find(
+                  (v) =>
+                    v?.protocolVersion === 3 &&
+                    v.relayIdentity === relay.relayIdentity &&
+                    v.certSha256 === relay.relayCertSha256 &&
+                    JSON.stringify(v.allowedGroupIds) ===
+                      JSON.stringify(relay.allowedGroupIds) &&
+                    v.ticketKeyId === descriptor.keyId
+                );
+              if (current) {
+                committedKey = current.ticketKeyId;
+                break;
+              }
+              await new Promise((resolve) => setTimeout(resolve, 300));
+            }
+          }
+          if (
+            Object.keys(descriptor).sort().join(',') !==
+              'epoch,expiresAt,keyId,policy,publicKey,relayPin' ||
+            descriptor.keyId !== committedKey ||
+            descriptor.relayPin !== relay.relayCertSha256 ||
+            descriptor.policy !== relayPolicy(relay)
+          )
+            throw new PrivateTransportSidecarError('RELAY_PROOF_INVALID');
+          const state = await this.sidecar.prepareRelayTickets(descriptor);
+          check();
+          if (
+            !/^[a-f0-9]{48}$/.test(state.handle) ||
+            !Array.isArray(state.blinded) ||
+            state.blinded.length !== 3
+          )
+            throw new Error('RELAY_PROOF_INVALID');
+          const data = { descriptor, blinded: state.blinded };
+          const c = await request('/challenge', data);
+          const binding = createHash('sha256')
+            .update(
+              JSON.stringify({ key: descriptor.keyId, blinded: state.blinded })
+            )
+            .digest('hex');
+          if (
+            Object.keys(c).sort().join(',') !==
+              'binding,expiresAt,nonce,policy,relayPin,type' ||
+            c.type !== 'masque-ticket-issue-v1' ||
+            c.binding !== binding ||
+            c.policy !== relayPolicy(relay) ||
+            c.relayPin !== relay.relayCertSha256 ||
+            !/^[a-f0-9]{64}$/.test(c.nonce) ||
+            !Number.isSafeInteger(c.expiresAt) ||
+            c.expiresAt <= Date.now() ||
+            c.expiresAt > Date.now() + 65_000
+          )
+            throw new Error('RELAY_PROOF_INVALID');
+          const signature = await sign(c);
+          check();
+          if (!signature || signature.authorAddress !== account)
+            throw new Error('RELAY_ACCOUNT_CHANGED');
+          const response = await request('/issue', {
+            ...data,
+            proof: { ...c, ...signature },
+          });
+          const finalized = await this.sidecar.finalizeRelayTickets(
+            state.handle,
+            response.signatures
+          );
+          check();
+          if (
+            finalized.expiresAt !== descriptor.expiresAt ||
+            !Array.isArray(finalized.tickets) ||
+            finalized.tickets.length !== 3
+          )
+            throw new Error('RELAY_PROOF_INVALID');
+          if (this.batches.size >= 32 && !this.batches.has(key))
+            this.batches.delete(this.batches.keys().next().value!);
+          this.batches.set(key, finalized);
+          return;
+        } catch (error) {
+          check();
+          // A request crossing an hourly key rotation may safely start again
+          // with new blind randomness; never replay the previous proof/token.
+          if (
+            attempt === 0 &&
+            Math.floor(Date.now() / 3_600_000) !== startedWindow
+          )
+            continue;
+          throw error;
+        }
+      }
+    })().finally(() => {
+      if (this.pending.get(key) === operation) this.pending.delete(key);
+    });
+    this.pending.set(key, operation);
+    return operation;
+  }
+  take(relay: TrustedRelayConfig): string {
+    const batch = this.batches.get(this.key(relay));
+    if (!batch || batch.expiresAt <= Date.now() || !batch.tickets.length)
+      throw new PrivateTransportSidecarError('RELAY_AUTH_UNAVAILABLE');
+    // Consume before sending. A lost response must never cause token replay.
+    return batch.tickets.shift()!;
+  }
+}
diff --git a/electron/src/reticulum-bridge.ts b/electron/src/reticulum-bridge.ts
index 911baaf36..828208494 100644
--- a/electron/src/reticulum-bridge.ts
+++ b/electron/src/reticulum-bridge.ts
@@ -201,6 +201,8 @@ type BridgeCmdFrame = {
     | 'overlay_note_candidate_failure'
     | 'configure_community_stun'
     | 'get_community_stun_endpoints'
+    | 'get_community_masque_relays'
+    | 'relay_ticket_request'
     | 'configure_developer_log_filter'
     | 'stop'
     | 'send_call'
@@ -235,6 +237,10 @@ type BridgeCmdFrame = {
     | 'configure_group_audio_data_plane_routes'
     | 'configure_group_audio_forwarding'
     | 'configure_land_state_forwarding'
+    | 'qapp_rns_request'
+    | 'qapp_rns_connect'
+    | 'qapp_rns_send'
+    | 'qapp_rns_close'
     | 'get_local_identity_public_key'
     | 'ensure_peer_identity'
     | 'register_peer_identity';
@@ -823,6 +829,11 @@ type BridgeEventFrame =
         lastActivityAgeMs?: number | null;
       };
     }
+  | {
+      type: 'event';
+      event: 'qapp_rns';
+      payload?: Record<string, unknown>;
+    }
   | {
       type: 'event';
       event: 'qchat_file_transfer';
@@ -854,6 +865,17 @@ type BridgeEventFrame =
       event: 'community_stun_endpoint';
       payload?: { host?: string; port?: number; expiresAt?: number };
     }
+  | {
+      type: 'event';
+      event: 'community_masque_relay';
+      payload?: {
+        host?: string;
+        port?: number;
+        serverName?: string;
+        certSha256?: string;
+        expiresAt?: number;
+      };
+    }
   | {
       type: 'event';
       event: 'error';
@@ -1153,6 +1175,7 @@ function commandPriorityForAction(
     case 'overlay_note_candidate_failure':
     case 'configure_community_stun':
     case 'get_community_stun_endpoints':
+    case 'get_community_masque_relays':
     case 'configure_developer_log_filter':
       return 'low';
     default:
@@ -3364,6 +3387,46 @@ export class ReticulumBridge extends EventEmitter implements PresenceTransport {
     );
   }
 
+  async relayTicketRequest(identity: string, path: string, data: Record<string, unknown>): Promise<Record<string, any>> {
+    await this.start();
+    const result = await this.sendCommand('relay_ticket_request', { identity, path, data });
+    if (!result.ok || result.payload?.error) throw new Error(String(result.payload?.error || result.error || 'RELAY_AUTH_UNAVAILABLE'));
+    return result.payload ?? {};
+  }
+
+  async getCommunityMasqueRelays(announce = false): Promise<
+    Array<{
+      host: string;
+      port: number;
+      serverName: string;
+      certSha256: string;
+      expiresAt: number;
+    }>
+  > {
+    await this.start();
+    if (this.state !== 'ready') return [];
+    const resp = await this.sendCommand('get_community_masque_relays', {
+      announce,
+    });
+    if (!resp.ok || !Array.isArray(resp.payload?.relays)) return [];
+    return resp.payload.relays.filter(
+      (value): value is {
+        host: string;
+        port: number;
+        serverName: string;
+        certSha256: string;
+        expiresAt: number;
+      } =>
+        value != null &&
+        typeof value === 'object' &&
+        typeof (value as { host?: unknown }).host === 'string' &&
+        typeof (value as { port?: unknown }).port === 'number' &&
+        typeof (value as { serverName?: unknown }).serverName === 'string' &&
+        typeof (value as { certSha256?: unknown }).certSha256 === 'string' &&
+        typeof (value as { expiresAt?: unknown }).expiresAt === 'number'
+    );
+  }
+
   async setDeveloperLogsFiltered(filtered: boolean): Promise<boolean> {
     const changed = this.developerLogsFiltered !== filtered;
     this.developerLogsFiltered = filtered;
@@ -3655,6 +3718,39 @@ export class ReticulumBridge extends EventEmitter implements PresenceTransport {
     }
   }
 
+  async invokeQAppReticulum(
+    action:
+      | 'qapp_rns_request'
+      | 'qapp_rns_connect'
+      | 'qapp_rns_send'
+      | 'qapp_rns_close',
+    payload: Record<string, unknown>
+  ): Promise<{
+    ok: boolean;
+    payload?: Record<string, unknown>;
+    code?: string;
+  }> {
+    try {
+      await this.start();
+      if (this.state !== 'ready') {
+        return { ok: false, code: 'RNS_DESTINATION_UNREACHABLE' };
+      }
+      const response = await this.sendCommand(action, payload);
+      return {
+        ok: response.ok,
+        payload: response.payload,
+        code:
+          typeof response.payload?.code === 'string'
+            ? response.payload.code
+            : response.ok
+              ? undefined
+              : 'RNS_DESTINATION_UNREACHABLE',
+      };
+    } catch {
+      return { ok: false, code: 'RNS_LINK_TIMEOUT' };
+    }
+  }
+
   async ensurePeerIdentityKnown(peerPresenceHash: string): Promise<boolean> {
     const peer = peerPresenceHash.trim().toLowerCase();
     if (!peer) return false;
@@ -3963,12 +4059,24 @@ export class ReticulumBridge extends EventEmitter implements PresenceTransport {
     const id = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
     const frame: BridgeCmdFrame = { type: 'cmd', action, id, payload };
     const wire = JSON.stringify(frame) + '\n';
+    const timeoutMs =
+      action === 'relay_ticket_request' ? 28_000 : action === 'qapp_rns_connect'
+        ? 45_000
+        : action === 'qapp_rns_request'
+          ? Math.min(
+              125_000,
+              Math.max(
+                REQUEST_TIMEOUT_MS,
+                Number(payload?.timeoutMs ?? 30_000) + 5_000
+              )
+            )
+          : REQUEST_TIMEOUT_MS;
 
     return new Promise<BridgeRespFrame>((resolve, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new Error(`Reticulum bridge request timed out: ${action}`));
-      }, REQUEST_TIMEOUT_MS);
+      }, timeoutMs);
       this.pending.set(id, { action, priority, resolve, reject, timer });
       this.enqueueCommand({ id, wire, priority });
       this.flushWriteQueue();
@@ -5328,6 +5436,10 @@ export class ReticulumBridge extends EventEmitter implements PresenceTransport {
         this.emitBridgeFrameEvent('qchat-file-transfer', frame.payload ?? {});
         return;
       }
+      case 'qapp_rns': {
+        this.emitBridgeFrameEvent('qapp-rns', frame.payload ?? {});
+        return;
+      }
       case 'reticulum_chat_resource': {
         this.emitBridgeFrameEvent(
           'reticulum-chat-resource',
@@ -5353,6 +5465,13 @@ export class ReticulumBridge extends EventEmitter implements PresenceTransport {
         );
         return;
       }
+      case 'community_masque_relay': {
+        this.emitBridgeFrameEvent(
+          'community-masque-relay',
+          frame.payload ?? {}
+        );
+        return;
+      }
       case 'error': {
         const payload = frame.payload;
         const message =
diff --git a/electron/src/reticulum-chat-db.ts b/electron/src/reticulum-chat-db.ts
index 3c31a20d3..457b8662f 100644
--- a/electron/src/reticulum-chat-db.ts
+++ b/electron/src/reticulum-chat-db.ts
@@ -13627,7 +13627,7 @@ export class ReticulumChatDatabase {
         now + 1,
         1_000
       );
-      occurrence = recent.at(-1) ?? null;
+      occurrence = recent[recent.length - 1] ?? null;
     }
     if (!occurrence) return null;
     const creation = this.db
diff --git a/electron/src/reticulum-resource.worker.test.ts b/electron/src/reticulum-resource.worker.test.ts
index 52784db78..4fd253288 100644
--- a/electron/src/reticulum-resource.worker.test.ts
+++ b/electron/src/reticulum-resource.worker.test.ts
@@ -7,6 +7,7 @@ import {
   deleteReticulumResourcePaths,
   finalizeReticulumResource,
   hashReticulumResourceFile,
+  readAndHashReticulumResourceFile,
   writeReticulumResourceRange,
 } from './reticulum-resource.worker';
 
@@ -43,6 +44,21 @@ describe('reticulum resource worker operations', () => {
     expect(fs.readFileSync(sourcePath)).toEqual(contents);
   });
 
+  it('copies file bytes into a transferable array buffer', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'reticulum-resource-worker-test-'));
+    directories.push(dir);
+    const sourcePath = path.join(dir, 'download.partial');
+    const contents = Buffer.from('transferable worker resource');
+    const expectedHash = nodeCrypto.createHash('sha256').update(contents).digest('hex');
+    fs.writeFileSync(sourcePath, contents);
+
+    const result = readAndHashReticulumResourceFile(sourcePath);
+
+    expect(Buffer.isBuffer(result.bytes)).toBe(false);
+    expect(Buffer.from(result.bytes)).toEqual(contents);
+    expect(result.hash).toBe(expectedHash);
+  });
+
   it('moves a completed download into place without a second full-size copy', () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'reticulum-resource-worker-test-'));
     directories.push(dir);
diff --git a/electron/src/reticulum-resource.worker.ts b/electron/src/reticulum-resource.worker.ts
index 87a9f00f5..ae04843f5 100644
--- a/electron/src/reticulum-resource.worker.ts
+++ b/electron/src/reticulum-resource.worker.ts
@@ -54,11 +54,20 @@ export type ReticulumResourceWorkerTask =
     };
 
 export type ReticulumResourceWorkerTaskInput =
-  | Omit<Extract<ReticulumResourceWorkerTask, { kind: 'finalize_resource' }>, 'id'>
+  | Omit<
+      Extract<ReticulumResourceWorkerTask, { kind: 'finalize_resource' }>,
+      'id'
+    >
   | Omit<Extract<ReticulumResourceWorkerTask, { kind: 'delete_paths' }>, 'id'>
   | Omit<Extract<ReticulumResourceWorkerTask, { kind: 'hash_file' }>, 'id'>
-  | Omit<Extract<ReticulumResourceWorkerTask, { kind: 'read_and_hash_file' }>, 'id'>
-  | Omit<Extract<ReticulumResourceWorkerTask, { kind: 'write_range_file' }>, 'id'>
+  | Omit<
+      Extract<ReticulumResourceWorkerTask, { kind: 'read_and_hash_file' }>,
+      'id'
+    >
+  | Omit<
+      Extract<ReticulumResourceWorkerTask, { kind: 'write_range_file' }>,
+      'id'
+    >
   | Omit<Extract<ReticulumResourceWorkerTask, { kind: 'inspect_paths' }>, 'id'>;
 
 export type ReticulumResourceWorkerResult =
@@ -101,6 +110,22 @@ export function hashReticulumResourceFile(filePath: string): string {
   return hash.digest('hex');
 }
 
+export function readAndHashReticulumResourceFile(filePath: string): {
+  bytes: Uint8Array;
+  hash: string;
+} {
+  const fileBytes = fs.readFileSync(filePath);
+  // Node 24 marks buffers returned by fs.readFileSync() as non-transferable.
+  // Copy into a plain ArrayBuffer-backed view before using a worker transfer
+  // list so Electron 44 can hand the bytes back to the main process.
+  const bytes = new Uint8Array(fileBytes.length);
+  bytes.set(fileBytes);
+  return {
+    bytes,
+    hash: nodeCrypto.createHash('sha256').update(fileBytes).digest('hex'),
+  };
+}
+
 export function finalizeReticulumResource(
   task: Extract<ReticulumResourceWorkerTask, { kind: 'finalize_resource' }>
 ): string {
@@ -170,7 +195,8 @@ export function writeReticulumResourceRange(
     while (remaining > 0) {
       const readSize = Math.min(buffer.length, remaining);
       const bytesRead = fs.readSync(source, buffer, 0, readSize, offset);
-      if (bytesRead <= 0) throw new Error('Unexpected EOF while reading resource range');
+      if (bytesRead <= 0)
+        throw new Error('Unexpected EOF while reading resource range');
       const slice = buffer.subarray(0, bytesRead);
       fs.writeSync(output, slice);
       hash.update(slice);
@@ -201,16 +227,21 @@ parentPort?.on('message', (task: ReticulumResourceWorkerTask) => {
       return;
     }
     if (task.kind === 'read_and_hash_file') {
-      const bytes = fs.readFileSync(task.path);
+      const { bytes, hash } = readAndHashReticulumResourceFile(task.path);
+      // Own the exact ArrayBuffer sent to the parent. Node Buffers may expose
+      // ArrayBufferLike (including pooled/shared backing), which is not a safe
+      // transferable and also fails Electron's Transferable contract.
+      const transferableBytes = new Uint8Array(bytes.byteLength);
+      transferableBytes.set(bytes);
       const result = {
         id: task.id,
         kind: task.kind,
         ok: true,
-        bytes,
-        hash: nodeCrypto.createHash('sha256').update(bytes).digest('hex'),
+        bytes: transferableBytes,
+        hash,
         durationMs: Date.now() - startedAt,
       } satisfies ReticulumResourceWorkerResult;
-      parentPort?.postMessage(result, [bytes.buffer as ArrayBuffer]);
+      parentPort?.postMessage(result, [transferableBytes.buffer]);
       return;
     }
     if (task.kind === 'write_range_file') {
@@ -245,7 +276,8 @@ parentPort?.on('message', (task: ReticulumResourceWorkerTask) => {
             stat.isFile() &&
             stat.size === entry.expectedSize &&
             (entry.expectComplete ||
-              hashReticulumResourceFile(entry.assembledPath) === entry.expectedHash);
+              hashReticulumResourceFile(entry.assembledPath) ===
+                entry.expectedHash);
         } catch {
           assembledValid = false;
         }
diff --git a/electron/src/setup.ts b/electron/src/setup.ts
index 6adba669b..41a3f5d26 100644
--- a/electron/src/setup.ts
+++ b/electron/src/setup.ts
@@ -1,3 +1,13 @@
+import {
+  clearForeignWalletSigner,
+  importForeignWalletKeys,
+  foreignWalletPublicKey,
+  signForeignWalletPayment,
+} from './foreign-wallet-signer';
+import { createForeignWalletJournal } from './foreign-wallet-journal';
+import { QAppFileSaves, SaveError } from './qapp-file-save';
+import { qappGuestPartition, qappGuestUrlAllowed, type QAppGuestOwner } from './qapp-guest-policy';
+import { restrictQAppGuestWebRtc } from './qapp-guest-network-policy';
 import type { CapacitorElectronConfig } from '@capacitor-community/electron';
 import {
   CapElectronEventEmitter,
@@ -23,9 +33,11 @@ import {
 import electronIsDev from 'electron-is-dev';
 import windowStateKeeper from 'electron-window-state';
 import { dirname, join } from 'path';
+import { randomUUID } from 'crypto';
 import { pipeline } from 'stream/promises';
 import { pathToFileURL } from 'url';
 import { materializeReticulumResourceForOpen } from './reticulum-resource-open';
+import { installDisplayMediaPicker } from './display-media-picker';
 import {
   DEV_LOGS_DISABLED_STORAGE_KEY,
   log as loggerLog,
@@ -59,6 +71,8 @@ import {
 } from './core';
 import {
   ensureCertForBase,
+  installCertificateVerification,
+  installLocalNodeHttpsBlock,
   isLocalPrivateHost,
   persistedLocalNodeCaExists,
   setLocalNodeHttpsReady,
@@ -132,6 +146,26 @@ import {
   startReticulumBridge,
   type ReticulumOverlayVerifiedPeer,
 } from './reticulum-bridge';
+import {
+  QAppReticulumManager,
+  type QAppReticulumNativeEvent,
+  type QAppReticulumOwner,
+} from './qapp-reticulum-manager';
+import {
+  PrivateChannelError,
+  PrivateChannelManager,
+} from './private-channel-manager';
+import {
+  createMoqTransport,
+  getPrivateTransportFactory,
+  shutdownPrivateTransportSidecar,
+} from './private-transport-runtime';
+import { QAppMoqError, QAppMoqTransportManager } from './moq-transport-manager';
+import {
+  configureRelaySigner,
+  setRelayAccount,
+  setRelayGroups,
+} from './relay-access-coordinator';
 import { attachReticulumStatusBridgeEvents } from './reticulum-daemon';
 import {
   startReticulumMeshCoordinator,
@@ -162,6 +196,7 @@ import {
   buildAudioSurfaceUrl,
   withAudioSurfaceIsolationHeaders,
 } from './audio-window-policy';
+import { withEmbeddedFrameWebRtcBlocked } from './embedded-frame-network-policy';
 import { ensureAudioSurfaceHttpsServer } from './audio-surface-https';
 import {
   buildDefaultAudioSurfaceBridgeStateLike,
@@ -351,7 +386,6 @@ const defaultDomains = [
   'https://apinode2.qortalnodes.live',
   'https://apinode3.qortalnodes.live',
   'https://apinode4.qortalnodes.live',
-  'https://www.qort.trade',
 ];
 
 let reticulumResourceStore: ReticulumResourceStore | null = null;
@@ -1031,6 +1065,7 @@ export class ElectronCapacitorApp {
       webPreferences: {
         nodeIntegration: true,
         contextIsolation: true,
+        webviewTag: true,
         preload: preloadPath,
         backgroundThrottling: false,
         additionalArguments: [
@@ -1039,7 +1074,81 @@ export class ElectronCapacitorApp {
         ],
       },
     });
+    configuredQAppSessions.clear();
+    this.MainWindow.webContents.on('will-attach-webview', (event, webPreferences, params) => {
+      const prepared = [...preparedQAppGuests.values()].find(
+        (candidate) => qappGuestUrlAllowed(
+          candidate.url,
+          params.src,
+          candidate.owner,
+          candidate.isDevMode
+        ) &&
+          candidate.partition === params.partition &&
+          candidate.preloadTokenUrl === params.preload
+      );
+      if (!prepared) {
+        event.preventDefault();
+        return;
+      }
+      webPreferences.preload = qappGuestPreloadPath;
+      params.preload = pathToFileURL(qappGuestPreloadPath).toString();
+      webPreferences.nodeIntegration = false;
+      webPreferences.nodeIntegrationInSubFrames = false;
+      webPreferences.contextIsolation = true;
+      webPreferences.sandbox = true;
+      webPreferences.webviewTag = false;
+      webPreferences.partition = prepared.partition;
+      webPreferences.additionalArguments = [`--qapp-guest-token=${prepared.guestToken}`];
+    });
+    this.MainWindow.webContents.on('did-attach-webview', (_event, guest) => {
+      attachedQAppGuests.set(guest.id, { contents: guest, prepared: null });
+      // Restrict WebRTC on the Q-App guest itself. The iframe response policy
+      // does not cover a webview's main document, and this also covers nested
+      // frames that share the guest's WebContents.
+      restrictQAppGuestWebRtc(guest);
+      guest.setWindowOpenHandler(() => ({ action: 'deny' }));
+      const allowedGuestUrl = (nextUrl: string) => {
+        const bound = attachedQAppGuests.get(guest.id)?.prepared;
+        const candidates = bound ? [bound] : [...preparedQAppGuests.values()];
+        return candidates.some(
+          (candidate) =>
+            guest.session === session.fromPartition(candidate.partition) &&
+            qappGuestUrlAllowed(candidate.url, nextUrl, candidate.owner, candidate.isDevMode)
+        );
+      };
+      guest.on('will-navigate', (event, nextUrl) => {
+        if (!allowedGuestUrl(nextUrl)) event.preventDefault();
+      });
+      guest.on('will-redirect', (event, nextUrl, _inPlace, isMainFrame) => {
+        if (isMainFrame && !allowedGuestUrl(nextUrl)) event.preventDefault();
+      });
+      guest.on('did-start-navigation', (_event, _url, inPlace, mainFrame) => {
+        if (mainFrame && !inPlace) {
+          const owner = attachedQAppGuests.get(guest.id)?.prepared?.owner;
+          if (owner) void cleanupQAppOwner(owner);
+        }
+      });
+      const cleanup = () => {
+        const attached = attachedQAppGuests.get(guest.id);
+        attachedQAppGuests.delete(guest.id);
+        if (attached?.prepared) void cleanupQAppOwner(attached.prepared.owner);
+      };
+      guest.on('destroyed', cleanup);
+      guest.on('render-process-gone', cleanup);
+    });
+    const clearGuestRegistrations = () => {
+      for (const attached of attachedQAppGuests.values()) {
+        if (attached.prepared) void cleanupQAppOwner(attached.prepared.owner);
+      }
+      attachedQAppGuests.clear();
+      preparedQAppGuests.clear();
+    };
+    this.MainWindow.webContents.on('did-start-navigation', (_event, _url, inPlace, mainFrame) => {
+      if (mainFrame && !inPlace) clearGuestRegistrations();
+    });
+    this.MainWindow.webContents.on('destroyed', clearGuestRegistrations);
     this.mainWindowState.manage(this.MainWindow);
+    installDisplayMediaPicker(this.MainWindow);
     this.MainWindow.on('maximize', () => {
       this.MainWindow?.webContents.send('window:state-changed', true);
     });
@@ -1246,8 +1355,8 @@ export class ElectronCapacitorApp {
   }
 }
 
-export function setupContentSecurityPolicy(customScheme: string): void {
-  session.defaultSession.webRequest.onHeadersReceived(
+export function setupContentSecurityPolicy(customScheme: string, targetSession = session.defaultSession): void {
+  targetSession.webRequest.onHeadersReceived(
     (details: any, callback) => {
       const requestUrl = details.url;
       const expandedDomains = [...domainHolder.allowedDomains];
@@ -1324,10 +1433,11 @@ export function setupContentSecurityPolicy(customScheme: string): void {
 
       // Determine if the request is cross-origin
       const isCrossOrigin = requestOrigin !== requestUrlOrigin;
+      const originalResponseHeaders = details.responseHeaders ?? {};
 
       // Check if the response already includes Access-Control-Allow-Origin
       const hasAccessControlAllowOrigin = Object.keys(
-        details.responseHeaders
+        originalResponseHeaders
       ).some(
         (header) => header.toLowerCase() === 'access-control-allow-origin'
       );
@@ -1336,14 +1446,17 @@ export function setupContentSecurityPolicy(customScheme: string): void {
       // so only our permissive CSP is applied and qapps (e.g. extract7z) can use eval.
       const cspHeaderLower = 'content-security-policy';
       const filtered = Object.fromEntries(
-        Object.entries(details.responseHeaders).filter(
+        Object.entries(originalResponseHeaders).filter(
           ([key]) => key.toLowerCase() !== cspHeaderLower
         )
       );
-      const responseHeaders: Record<string, string | string[]> = {
-        ...filtered,
-        'Content-Security-Policy': [csp],
-      };
+      const responseHeaders = withEmbeddedFrameWebRtcBlocked(
+        {
+          ...filtered,
+          'Content-Security-Policy': [csp],
+        },
+        { resourceType: details.resourceType }
+      );
 
       Object.assign(
         responseHeaders,
@@ -1686,6 +1799,76 @@ export function flushMiscPersistentStore(): void {
   miscPersistentStore.flush();
 }
 
+let foreignSignerOwner: number | null = null;
+function requireForeignWalletHost(event: Electron.IpcMainInvokeEvent) {
+  if (
+    !isMainShellSender(event.sender) ||
+    event.senderFrame !== event.sender.mainFrame
+  )
+    throw new Error('Wallet signer is restricted to the main frame');
+  const parent = BrowserWindow.fromWebContents(event.sender);
+  if (!parent) throw new Error('Wallet window unavailable');
+  return parent;
+}
+ipcMain.handle('foreignWalletSigner:import', (event, keys) => {
+  requireForeignWalletHost(event);
+  const publicKeys = importForeignWalletKeys(keys);
+  foreignSignerOwner = event.sender.id;
+  return publicKeys;
+});
+ipcMain.handle('foreignWalletSigner:publicKey', (event, coin) => {
+  requireForeignWalletHost(event);
+  return foreignWalletPublicKey(coin);
+});
+ipcMain.handle('foreignWalletSigner:clear', (event) => {
+  requireForeignWalletHost(event);
+  clearForeignWalletSigner();
+});
+ipcMain.handle('foreignWalletSigner:sign', (event, request) => {
+  requireForeignWalletHost(event);
+  return signForeignWalletPayment(request);
+});
+app.on('before-quit', clearForeignWalletSigner);
+app.on('web-contents-created', (_event, contents) => {
+  const contentsId = contents.id;
+  const clearIfHost = () => {
+    if (foreignSignerOwner === contentsId) clearForeignWalletSigner();
+  };
+  contents.on(
+    'did-start-navigation',
+    (_event, _url, isInPlace, isMainFrame) => {
+      if (isMainFrame && !isInPlace) clearIfHost();
+    }
+  );
+  contents.on('render-process-gone', clearIfHost);
+  contents.on('destroyed', clearIfHost);
+});
+
+let foreignWalletJournal: ReturnType<typeof createForeignWalletJournal>;
+function getForeignWalletJournal(event: Electron.IpcMainInvokeEvent) {
+  if (
+    !isMainShellSender(event.sender) ||
+    event.senderFrame !== event.sender.mainFrame
+  )
+    throw new Error('Foreign wallet journal is restricted to the main frame');
+  return (foreignWalletJournal ??= createForeignWalletJournal(
+    path.join(app.getPath('appData'), 'qortal-hub', 'foreign-wallet-journal')
+  ));
+}
+ipcMain.handle('foreignWalletJournal:get', (event, key: string) =>
+  getForeignWalletJournal(event).get(key)
+);
+ipcMain.handle(
+  'foreignWalletJournal:set',
+  (event, key: string, value: string) =>
+    getForeignWalletJournal(event).set(key, value)
+);
+ipcMain.handle(
+  'foreignWalletJournal:delete',
+  (event, key: string, txId: string) =>
+    getForeignWalletJournal(event).delete(key, txId)
+);
+
 ipcMain.handle('persistentStore:get', async (_event, key: string) =>
   persistentStore.get(key)
 );
@@ -2823,11 +3006,504 @@ export function stopReticulumManagers(): void {
   stopReticulumChatManager();
   reticulumChatListenersAttached = false;
   stopPresenceManager();
+  privateChannelManager?.destroy();
+  privateChannelManager = null;
+  qAppMoqTransportManager?.destroy();
+  qAppMoqTransportManager = null;
+  void shutdownPrivateTransportSidecar();
+  qAppReticulumManager?.destroy();
+  qAppReticulumManager = null;
   shutdownReticulumResourceStore();
   attachReticulumStatusBridgeEvents(null);
   reticulumChatReadiness.reset();
 }
 
+let qAppReticulumManager: QAppReticulumManager | null = null;
+let privateChannelManager: PrivateChannelManager | null = null;
+let qAppMoqTransportManager: QAppMoqTransportManager | null = null;
+let qAppReticulumBridge: ReturnType<typeof getReticulumBridge> = null;
+const qAppReticulumNativeListeners = new Set<
+  (event: QAppReticulumNativeEvent) => void
+>();
+
+function getQAppReticulumManager(): QAppReticulumManager {
+  if (qAppReticulumManager) return qAppReticulumManager;
+  const transport = {
+    invoke: async (action: string, payload: Record<string, unknown>) => {
+      await ensureReticulumManagersStarted();
+      const bridge = getReticulumBridge() ?? (await startReticulumBridge());
+      if (qAppReticulumBridge !== bridge) {
+        qAppReticulumBridge = bridge;
+        bridge.on('qapp-rns', (event: QAppReticulumNativeEvent) => {
+          for (const listener of qAppReticulumNativeListeners) listener(event);
+        });
+      }
+      return bridge.invokeQAppReticulum(action as any, payload);
+    },
+    onEvent: (listener: (event: QAppReticulumNativeEvent) => void) => {
+      qAppReticulumNativeListeners.add(listener);
+      return () => qAppReticulumNativeListeners.delete(listener);
+    },
+  };
+  qAppReticulumManager = new QAppReticulumManager(transport);
+  qAppReticulumManager.on('event', (event) => {
+    const win = myCapacitorApp.getMainWindow();
+    if (!win.isDestroyed()) win.webContents.send('qappReticulum:event', event);
+  });
+  return qAppReticulumManager;
+}
+
+function getPrivateChannelManager(): PrivateChannelManager {
+  configureRelaySigner(
+    signReticulumChatControlFields,
+    readRelayWalletAddress,
+    readRelayGroupHints
+  );
+  if (privateChannelManager) return privateChannelManager;
+  privateChannelManager = new PrivateChannelManager(
+    (owner, connectionId) =>
+      getQAppReticulumManager().connectionOwnership(owner, connectionId),
+    getPrivateTransportFactory(getQAppReticulumManager(), () =>
+      getReticulumBridge()
+    )
+  );
+  privateChannelManager.on('event', (event) => {
+    const win = myCapacitorApp.getMainWindow();
+    if (!win.isDestroyed()) win.webContents.send('privateChannel:event', event);
+  });
+  return privateChannelManager;
+}
+
+function getQAppMoqTransportManager(): QAppMoqTransportManager {
+  configureRelaySigner(
+    signReticulumChatControlFields,
+    readRelayWalletAddress,
+    readRelayGroupHints
+  );
+  if (qAppMoqTransportManager) return qAppMoqTransportManager;
+  qAppMoqTransportManager = new QAppMoqTransportManager(
+    (owner, connectionId) =>
+      getQAppReticulumManager().connectionOwnership(owner, connectionId),
+    (emit) =>
+      createMoqTransport(emit, getQAppReticulumManager(), () =>
+        getReticulumBridge()
+      )
+  );
+  qAppMoqTransportManager.on('event', (event) => {
+    const win = myCapacitorApp.getMainWindow();
+    if (!win.isDestroyed()) win.webContents.send('qappMoq:event', event);
+  });
+  return qAppMoqTransportManager;
+}
+
+function validateQAppReticulumIpcSender(
+  event: Electron.IpcMainInvokeEvent
+): void {
+  const win = myCapacitorApp.getMainWindow();
+  if (win.isDestroyed() || event.sender.id !== win.webContents.id) {
+    throw new Error('RNS_PERMISSION_DENIED');
+  }
+}
+
+let qappFileSaves: QAppFileSaves;
+function fileSaves() {
+  return (qappFileSaves ??= new QAppFileSaves(join(app.getPath('userData'), 'file-save-journal')));
+}
+void app.whenReady().then(() => fileSaves().initialize()).catch(() => undefined);
+function saveOwner(owner: any) {
+  if (!owner || !['tabId', 'name', 'service'].every(key =>
+    typeof owner[key] === 'string' && owner[key].length > 0 && owner[key].length <= 256))
+    throw new SaveError('SAVE_INVALID_REQUEST');
+  return JSON.stringify([owner.tabId, owner.name, owner.service]);
+}
+ipcMain.handle('qappFileSave:request', async (event, owner, request) => {
+  if (!isMainShellSender(event.sender) || event.senderFrame !== event.sender.mainFrame)
+    return { error: 'SAVE_PERMISSION_DENIED' };
+  try {
+    const key = saveOwner(owner);
+    const manager = fileSaves();
+    switch (request?.action) {
+      case 'FILE_SAVE_OPEN':
+        return await manager.open(key, request.filename, request.size, async (filename, _size, checkLive) => {
+          const labels = request.labels;
+          if (!labels || !['title', 'detail', 'allow', 'cancel'].every(k =>
+            typeof labels[k] === 'string' && labels[k].length <= 2048))
+            throw new SaveError('SAVE_INVALID_REQUEST');
+          const win = myCapacitorApp.getMainWindow();
+          const permission = await dialog.showMessageBox(win, {
+            type: 'question', message: labels.title, detail: labels.detail,
+            buttons: [labels.cancel, labels.allow], defaultId: 0, cancelId: 0,
+            noLink: true,
+          });
+          if (permission.response !== 1) return undefined;
+          checkLive();
+          const result = await dialog.showSaveDialog(win, {
+            defaultPath: filename, title: labels.title,
+            properties: ['showOverwriteConfirmation', 'createDirectory'],
+          });
+          return result.canceled ? undefined : result.filePath;
+        });
+      case 'FILE_SAVE_WRITE': return await manager.write(key, request.saveId, request.offset, request.data);
+      case 'FILE_SAVE_FINISH': return await manager.finish(key, request.saveId);
+      case 'FILE_SAVE_ABORT': return await manager.abort(key, request.saveId);
+      case 'FILE_SAVE_CLEANUP': await manager.cleanup(key); return { aborted: true };
+      default: throw new SaveError('SAVE_INVALID_REQUEST');
+    }
+  } catch (error) {
+    // Never expose OS errors containing filesystem paths to a QApp.
+    return { error: error instanceof SaveError ? error.message : 'SAVE_IO_ERROR' };
+  }
+});
+setInterval(() => { void qappFileSaves?.expire(); }, 30_000).unref();
+app.on('before-quit', () => { void qappFileSaves?.cleanup(); });
+app.on('web-contents-created', (_event, contents) => {
+  const cleanup = () => { if (isMainShellSender(contents)) void qappFileSaves?.cleanup(); };
+  contents.on('render-process-gone', cleanup);
+  contents.on('destroyed', cleanup);
+  contents.on('did-start-navigation', (_e, _url, inPlace, mainFrame) => {
+    if (mainFrame && !inPlace) cleanup();
+  });
+});
+
+async function cleanupQAppOwner(owner: QAppReticulumOwner): Promise<void> {
+  // All managers snapshot their old resources before any shutdown is awaited.
+  await Promise.allSettled([
+    privateChannelManager?.cleanupOwner(owner),
+    qAppMoqTransportManager?.cleanupOwner(owner),
+    qAppReticulumManager?.cleanupOwner(owner),
+    qappFileSaves?.cleanup(saveOwner(owner)),
+  ]);
+}
+
+type PreparedQAppGuest = {
+  owner: QAppGuestOwner;
+  url: string;
+  partition: string;
+  isDevMode: boolean;
+  guestToken: string;
+  preloadTokenUrl: string;
+};
+const preparedQAppGuests = new Map<string, PreparedQAppGuest>();
+const attachedQAppGuests = new Map<number, { contents: WebContents; prepared: PreparedQAppGuest | null }>();
+const configuredQAppSessions = new Set<string>();
+const qappGuestPreloadPath = join(__dirname, 'qapp-guest-preload.js');
+
+function qappGuestOwnerKey(owner: QAppGuestOwner): string {
+  return `${owner.tabId}\u0000${owner.service}\u0000${owner.name}`;
+}
+
+function configureQAppGuestSession(partition: string): void {
+  if (configuredQAppSessions.has(partition)) return;
+  const guestSession = session.fromPartition(partition);
+  setupContentSecurityPolicy(myCapacitorApp.getCustomURLScheme(), guestSession);
+  installCertificateVerification(guestSession);
+  installLocalNodeHttpsBlock(guestSession);
+  installDisplayMediaPicker(
+    myCapacitorApp.getMainWindow(),
+    process.platform,
+    guestSession,
+    (contents) => Boolean(attachedQAppGuests.get(contents.id)?.prepared)
+  );
+  configuredQAppSessions.add(partition);
+}
+
+ipcMain.handle('qappGuest:prepare', (event, owner: QAppGuestOwner, url: string, isDevMode: boolean) => {
+  validateQAppReticulumIpcSender(event);
+  if (event.senderFrame !== event.sender.mainFrame) throw new Error('QAPP_PERMISSION_DENIED');
+  saveOwner(owner);
+  if (typeof url !== 'string' || url.length > 4096) throw new Error('QAPP_INVALID_URL');
+  const parsed = new URL(url);
+  if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error('QAPP_INVALID_URL');
+  if (!qappGuestUrlAllowed(url, url, owner, isDevMode === true)) throw new Error('QAPP_INVALID_URL');
+  const guestToken = randomUUID();
+  const prepared = {
+    owner,
+    url,
+    partition: qappGuestPartition(parsed.origin, owner),
+    isDevMode: isDevMode === true,
+    guestToken,
+    preloadTokenUrl: `${pathToFileURL(qappGuestPreloadPath).toString()}?authorization=${guestToken}`,
+  };
+  configureQAppGuestSession(prepared.partition);
+  preparedQAppGuests.set(qappGuestOwnerKey(owner), prepared);
+  return {
+    partition: prepared.partition,
+    preload: prepared.preloadTokenUrl,
+  };
+});
+
+ipcMain.handle('qappGuest:hello', (event, guestToken: string) => {
+  if (event.sender.getType() !== 'webview' ||
+      event.senderFrame !== event.sender.mainFrame ||
+      typeof guestToken !== 'string' ||
+      !/^[a-f0-9-]{36}$/.test(guestToken))
+    throw new Error('QAPP_PERMISSION_DENIED');
+  const prepared = [...preparedQAppGuests.values()].find(
+    (candidate) => candidate.guestToken === guestToken
+  );
+  const attached = attachedQAppGuests.get(event.sender.id);
+  if (!prepared || !attached ||
+      (attached.prepared && attached.prepared !== prepared))
+    throw new Error('QAPP_GUEST_UNAVAILABLE');
+  if (attached.contents.session !== session.fromPartition(prepared.partition))
+    throw new Error('QAPP_GUEST_MISMATCH');
+  const currentUrl = attached.contents.getURL();
+  if (!qappGuestUrlAllowed(
+    prepared.url,
+    !currentUrl || currentUrl === 'about:blank' ? prepared.url : currentUrl,
+    prepared.owner,
+    prepared.isDevMode
+  ))
+    throw new Error('QAPP_GUEST_MISMATCH');
+  attached.prepared = prepared;
+  return true;
+});
+
+ipcMain.handle('qappGuest:release', (event, owner: QAppGuestOwner) => {
+  validateQAppReticulumIpcSender(event);
+  if (event.senderFrame !== event.sender.mainFrame) throw new Error('QAPP_PERMISSION_DENIED');
+  const key = qappGuestOwnerKey(owner);
+  preparedQAppGuests.delete(key);
+  for (const [guestId, attached] of attachedQAppGuests) {
+    if (!attached.prepared || qappGuestOwnerKey(attached.prepared.owner) !== key)
+      continue;
+    attachedQAppGuests.delete(guestId);
+  }
+  void cleanupQAppOwner(owner);
+  return true;
+});
+ipcMain.handle(
+  'qappReticulum:request',
+  async (event, owner: QAppReticulumOwner, options) => {
+    validateQAppReticulumIpcSender(event);
+    return getQAppReticulumManager().request(owner, options);
+  }
+);
+ipcMain.handle(
+  'qappReticulum:connect',
+  async (event, owner: QAppReticulumOwner, destination: string) => {
+    validateQAppReticulumIpcSender(event);
+    return getQAppReticulumManager().connect(owner, destination);
+  }
+);
+ipcMain.handle(
+  'qappReticulum:send',
+  async (event, owner: QAppReticulumOwner, connectionId: string, payload) => {
+    validateQAppReticulumIpcSender(event);
+    return getQAppReticulumManager().send(owner, connectionId, payload);
+  }
+);
+ipcMain.handle(
+  'qappReticulum:close',
+  async (event, owner: QAppReticulumOwner, connectionId: string) => {
+    validateQAppReticulumIpcSender(event);
+    await privateChannelManager?.cleanupRnsConnection(owner, connectionId);
+    await qAppMoqTransportManager?.cleanupRnsConnection(owner, connectionId);
+    await getQAppReticulumManager().close(owner, connectionId);
+    return true;
+  }
+);
+ipcMain.handle(
+  'qappReticulum:cleanupOwner',
+  async (event, owner: QAppReticulumOwner) => {
+    validateQAppReticulumIpcSender(event);
+    await cleanupQAppOwner(owner);
+    return true;
+  }
+);
+
+async function qAppMoqIpcResult<T>(
+  operation: () => Promise<T> | T
+): Promise<
+  | { ok: true; value: T }
+  | { ok: false; error: { code: string; message: string } }
+> {
+  try {
+    return { ok: true, value: await operation() };
+  } catch (error) {
+    const code = error instanceof QAppMoqError ? error.code : 'MOQ_ERROR';
+    return { ok: false, error: { code, message: code } };
+  }
+}
+
+ipcMain.handle(
+  'qappMoq:open',
+  async (
+    event,
+    owner: QAppReticulumOwner,
+    rnsConnectionId: unknown,
+    publicationNamespace: unknown,
+    publicationTrack: unknown
+  ) => {
+    validatePrivateChannelIpcSender(event);
+    return qAppMoqIpcResult(() =>
+      getQAppMoqTransportManager().open(
+        owner,
+        rnsConnectionId,
+        publicationNamespace,
+        publicationTrack
+      )
+    );
+  }
+);
+ipcMain.handle(
+  'qappMoq:subscribe',
+  async (
+    event,
+    owner: QAppReticulumOwner,
+    sessionId: unknown,
+    subscriptionId: unknown,
+    namespace: unknown,
+    trackName: unknown
+  ) => {
+    validatePrivateChannelIpcSender(event);
+    return qAppMoqIpcResult(() =>
+      getQAppMoqTransportManager().subscribe(
+        owner,
+        sessionId,
+        subscriptionId,
+        namespace,
+        trackName
+      )
+    );
+  }
+);
+ipcMain.handle(
+  'qappMoq:publish',
+  async (
+    event,
+    owner: QAppReticulumOwner,
+    sessionId: unknown,
+    payload: unknown
+  ) => {
+    validatePrivateChannelIpcSender(event);
+    return qAppMoqIpcResult(() =>
+      getQAppMoqTransportManager().publish(owner, sessionId, payload)
+    );
+  }
+);
+ipcMain.handle(
+  'qappMoq:metrics',
+  (event, owner: QAppReticulumOwner, sessionId: unknown) => {
+    validatePrivateChannelIpcSender(event);
+    return qAppMoqIpcResult(() =>
+      getQAppMoqTransportManager().metrics(owner, sessionId)
+    );
+  }
+);
+ipcMain.handle(
+  'qappMoq:close',
+  async (event, owner: QAppReticulumOwner, sessionId: unknown) => {
+    validatePrivateChannelIpcSender(event);
+    return qAppMoqIpcResult(() =>
+      getQAppMoqTransportManager().close(owner, sessionId)
+    );
+  }
+);
+ipcMain.handle(
+  'qappMoq:cleanupOwner',
+  async (event, owner: QAppReticulumOwner) => {
+    validatePrivateChannelIpcSender(event);
+    return qAppMoqIpcResult(async () => {
+      await qAppMoqTransportManager?.cleanupOwner(owner);
+      return true;
+    });
+  }
+);
+
+function validatePrivateChannelIpcSender(
+  event: Electron.IpcMainInvokeEvent
+): void {
+  const win = myCapacitorApp.getMainWindow();
+  if (win.isDestroyed() || event.sender.id !== win.webContents.id) {
+    throw new Error('PERMISSION_DENIED');
+  }
+}
+
+async function privateChannelIpcResult<T>(
+  operation: () => Promise<T> | T
+): Promise<
+  | { ok: true; value: T }
+  | { ok: false; error: { code: string; message: string } }
+> {
+  try {
+    return { ok: true, value: await operation() };
+  } catch (error) {
+    const code =
+      error instanceof PrivateChannelError
+        ? error.code
+        : 'PRIVATE_CHANNEL_ERROR';
+    return { ok: false, error: { code, message: code } };
+  }
+}
+
+ipcMain.handle(
+  'privateChannel:open',
+  async (
+    event,
+    owner: QAppReticulumOwner,
+    rnsConnectionId: unknown,
+    purpose: unknown
+  ) => {
+    validatePrivateChannelIpcSender(event);
+    return privateChannelIpcResult(() =>
+      getPrivateChannelManager().open(owner, rnsConnectionId, purpose)
+    );
+  }
+);
+ipcMain.handle(
+  'privateChannel:send',
+  async (
+    event,
+    owner: QAppReticulumOwner,
+    channelId: unknown,
+    lane: unknown,
+    messageId: unknown,
+    data: unknown,
+    streamOptions?: unknown
+  ) => {
+    validatePrivateChannelIpcSender(event);
+    return privateChannelIpcResult(() =>
+      getPrivateChannelManager().send(
+        owner,
+        channelId,
+        lane,
+        messageId,
+        data,
+        streamOptions
+      )
+    );
+  }
+);
+ipcMain.handle(
+  'privateChannel:status',
+  (event, owner: QAppReticulumOwner, channelId: unknown) => {
+    validatePrivateChannelIpcSender(event);
+    return privateChannelIpcResult(() =>
+      getPrivateChannelManager().status(owner, channelId)
+    );
+  }
+);
+ipcMain.handle(
+  'privateChannel:close',
+  async (event, owner: QAppReticulumOwner, channelId: unknown) => {
+    validatePrivateChannelIpcSender(event);
+    return privateChannelIpcResult(() =>
+      getPrivateChannelManager().close(owner, channelId)
+    );
+  }
+);
+ipcMain.handle(
+  'privateChannel:cleanupOwner',
+  async (event, owner: QAppReticulumOwner) => {
+    validatePrivateChannelIpcSender(event);
+    return privateChannelIpcResult(async () => {
+      await privateChannelManager?.cleanupOwner(owner);
+      return true;
+    });
+  }
+);
+
 async function getReadyReticulumChatManager(): Promise<
   ReturnType<typeof getReticulumChatManager>
 > {
@@ -3120,6 +3796,46 @@ function scheduleReticulumOverlayStateSyncRetry(
   reticulumOverlaySyncRetryTimer.unref?.();
 }
 
+async function readRelayGroupHints(address: string): Promise<number[] | null> {
+  const main = myCapacitorApp.getMainWindow();
+  if (
+    !main ||
+    main.isDestroyed() ||
+    !isRendererMainFrameReady(main.webContents)
+  )
+    return null;
+  const result = await main.webContents.executeJavaScript(
+    `(async () => {
+    const result = await window.sendMessage('getRelayGroupHints', {address:${JSON.stringify(address)}}, 3000);
+    return result?.groups ?? null;
+  })()`,
+    true
+  );
+  return Array.isArray(result) &&
+    result.length <= 4096 &&
+    result.every((id) => Number.isInteger(id) && id > 0 && id <= 2147483647)
+    ? result
+    : null;
+}
+
+async function readRelayWalletAddress(): Promise<string> {
+  const main = myCapacitorApp.getMainWindow();
+  if (
+    !main ||
+    main.isDestroyed() ||
+    !isRendererMainFrameReady(main.webContents)
+  )
+    return '';
+  const result = await main.webContents.executeJavaScript(
+    `(async () => {
+    const result = await window.sendMessage('getWalletInfo', {}, 5000);
+    return result?.hasKeyPair && typeof result?.walletInfo?.address0 === 'string' ? result.walletInfo.address0 : '';
+  })()`,
+    true
+  );
+  return typeof result === 'string' ? result : '';
+}
+
 async function signReticulumChatControlFields(
   fields: Record<string, unknown>
 ): Promise<{
@@ -3973,6 +4689,11 @@ ipcMain.handle(
       return { success: false, error: 'Account session changed' };
     }
     manager.setLocalGroupMemberships(Array.isArray(groupIds) ? groupIds : []);
+    setRelayGroups(
+      (Array.isArray(groupIds) ? groupIds : []).map((value) =>
+        typeof value === 'number' ? value : Number(value.groupId)
+      )
+    );
     return { success: true };
   }
 );
@@ -4041,6 +4762,8 @@ ipcMain.handle(
 );
 
 ipcMain.handle('reticulumChat:clearLocalAccountState', async () => {
+  await qappFileSaves?.cleanup();
+  setRelayAccount('', true);
   reticulumLocalAccountLifecycleGeneration += 1;
   // These managers live for the lifetime of the main process too. Clear their
   // account routing at the same explicit logout boundary so a later login
diff --git a/electron/src/single-flight-readiness.test.ts b/electron/src/single-flight-readiness.test.ts
index 5f82e6d29..e85af7ee5 100644
--- a/electron/src/single-flight-readiness.test.ts
+++ b/electron/src/single-flight-readiness.test.ts
@@ -19,6 +19,23 @@ function deferred(): {
 }
 
 describe('SingleFlightReadiness', () => {
+  it('is a no-op when the target is already ready', async () => {
+    const start = vi.fn(async () => undefined);
+    const onStatusChange = vi.fn();
+    const readiness = new SingleFlightReadiness({
+      isReady: () => true,
+      onStatusChange,
+      start,
+    });
+
+    await expect(readiness.ensureReady()).resolves.toBeUndefined();
+    await expect(readiness.ensureReady()).resolves.toBeUndefined();
+
+    expect(start).not.toHaveBeenCalled();
+    expect(onStatusChange).not.toHaveBeenCalled();
+    expect(readiness.getStatus()).toEqual({ state: 'ready', revision: 0 });
+  });
+
   it('shares one startup attempt between concurrent callers', async () => {
     const startup = deferred();
     let ready = false;
diff --git a/electron/src/single-flight-readiness.ts b/electron/src/single-flight-readiness.ts
index 5ea346804..933e3ab9c 100644
--- a/electron/src/single-flight-readiness.ts
+++ b/electron/src/single-flight-readiness.ts
@@ -31,6 +31,14 @@ export class SingleFlightReadiness {
       return this.activeStart;
     }
 
+    // Callers use ensureReady() at request boundaries. Once the target exists,
+    // another call is not a lifecycle transition and must not publish a false
+    // `starting -> ready` cycle. Consumers treat that cycle as a reconnect and
+    // may perform expensive recovery work.
+    if (this.options.isReady()) {
+      return Promise.resolve();
+    }
+
     this.setStatus({ state: 'starting' });
     const generation = this.generation;
     const start = Promise.resolve()
diff --git a/examples/qapp-reticulum/backend.py b/examples/qapp-reticulum/backend.py
new file mode 100644
index 000000000..05137872f
--- /dev/null
+++ b/examples/qapp-reticulum/backend.py
@@ -0,0 +1,167 @@
+#!/usr/bin/env python3
+"""Minimal Q-App Reticulum backend for protocol version 1."""
+
+import argparse
+import base64
+from collections import deque
+import json
+import os
+import secrets
+import struct
+import threading
+import time
+
+import RNS
+
+HEADER = struct.Struct(">BBQI")
+VERSION, DATA, ACK, STREAM_ID = 1, 1, 2, 7
+MAX_FRAME = 256 * 1024
+STATE_LOCK = threading.Lock()
+SEEN_ORDER, SEEN = deque(), set()
+PENDING = {}
+NEXT_MESSAGE_ID = secrets.randbits(63) or 1
+
+
+def frame(kind, message_id, payload=b""):
+    if len(payload) > MAX_FRAME:
+        raise ValueError("frame too large")
+    return HEADER.pack(VERSION, kind, message_id, len(payload)) + payload
+
+
+def write_all(writer, data):
+    offset = 0
+    while offset < len(data):
+        written = int(writer.write(data[offset:]) or 0)
+        if written <= 0:
+            time.sleep(0.01)
+            continue
+        offset += written
+    writer.flush()
+
+
+def serve_link(link):
+    global NEXT_MESSAGE_ID
+    channel = link.get_channel()
+    reader = RNS.Buffer.create_reader(STREAM_ID, channel)
+    writer = RNS.Buffer.create_writer(STREAM_ID, channel)
+    buffered = bytearray()
+    while True:
+        chunk = reader.read(64 * 1024)
+        if chunk is None:
+            time.sleep(0.01)
+            continue
+        if chunk == b"":
+            return
+        buffered.extend(chunk)
+        if len(buffered) > MAX_FRAME * 2:
+            link.teardown()
+            return
+        while len(buffered) >= HEADER.size:
+            version, kind, message_id, length = HEADER.unpack_from(buffered)
+            if version != VERSION or length > MAX_FRAME:
+                link.teardown()
+                return
+            total = HEADER.size + length
+            if len(buffered) < total:
+                break
+            payload = bytes(buffered[HEADER.size:total])
+            del buffered[:total]
+            if kind == ACK:
+                with STATE_LOCK:
+                    PENDING.pop(message_id, None)
+                continue
+            if kind != DATA:
+                link.teardown()
+                return
+            write_all(writer, frame(ACK, message_id))
+            envelope = json.loads(payload.decode("utf-8"))
+            connection_id = envelope["connectionId"]
+            with STATE_LOCK:
+                pending_for_connection = [
+                    item["frame"]
+                    for _, item in sorted(PENDING.items())
+                    if item["connectionId"] == connection_id
+                ]
+            for pending_frame in pending_for_connection:
+                write_all(writer, pending_frame)
+            with STATE_LOCK:
+                duplicate = message_id in SEEN
+                if not duplicate:
+                    if len(SEEN_ORDER) >= 512:
+                        SEEN.discard(SEEN_ORDER.popleft())
+                    SEEN_ORDER.append(message_id)
+                    SEEN.add(message_id)
+            if duplicate:
+                continue
+            decoded = base64.b64decode(envelope["payloadBase64"])
+            response = {
+                "type": "echo",
+                "received": (
+                    json.loads(decoded.decode("utf-8"))
+                    if envelope.get("encoding") == "json"
+                    else envelope["payloadBase64"]
+                ),
+            }
+            response_envelope = {
+                "connectionId": connection_id,
+                "encoding": "json",
+                "payloadBase64": base64.b64encode(
+                    json.dumps(response, separators=(",", ":")).encode("utf-8")
+                ).decode("ascii"),
+            }
+            body = json.dumps(response_envelope, separators=(",", ":")).encode("utf-8")
+            with STATE_LOCK:
+                outgoing_id = NEXT_MESSAGE_ID
+                NEXT_MESSAGE_ID = (NEXT_MESSAGE_ID + 1) & 0xFFFFFFFFFFFFFFFF
+                outgoing_frame = frame(DATA, outgoing_id, body)
+                PENDING[outgoing_id] = {
+                    "connectionId": connection_id,
+                    "frame": outgoing_frame,
+                }
+            write_all(writer, outgoing_frame)
+
+
+def hello(_path, data, _request_id, _link_id, _remote_identity, _requested_at):
+    payload = base64.b64decode(str(data.get("payloadBase64") or ""))
+    name = "world"
+    if data.get("encoding") == "json":
+        name = str(json.loads(payload.decode("utf-8")).get("name") or name)
+    return {"message": f"Hello, {name}", "requestId": data.get("requestId")}
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--config", default=None)
+    parser.add_argument("--identity", default="qapp-backend.identity")
+    args = parser.parse_args()
+    RNS.Reticulum(configdir=args.config)
+    identity = (
+        RNS.Identity.from_file(args.identity)
+        if os.path.exists(args.identity)
+        else RNS.Identity()
+    )
+    if not os.path.exists(args.identity):
+        identity.to_file(args.identity)
+    destination = RNS.Destination(
+        identity,
+        RNS.Destination.IN,
+        RNS.Destination.SINGLE,
+        "qortal-hub-v3",
+        "qapp-backend",
+        "v1",
+    )
+    destination.register_request_handler(
+        "/hello", response_generator=hello, allow=RNS.Destination.ALLOW_ALL
+    )
+    destination.set_link_established_callback(
+        lambda link: threading.Thread(target=serve_link, args=(link,), daemon=True).start()
+    )
+    destination.announce()
+    print(f"Destination: {RNS.prettyhexrep(destination.hash)}")
+    while True:
+        time.sleep(60)
+        destination.announce()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/examples/qapp-reticulum/client.js b/examples/qapp-reticulum/client.js
new file mode 100644
index 000000000..1164eddf4
--- /dev/null
+++ b/examples/qapp-reticulum/client.js
@@ -0,0 +1,37 @@
+/* global qortalRequest */
+const destination = 'REPLACE_WITH_32_CHARACTER_DESTINATION_HASH';
+
+window.addEventListener('message', (event) => {
+  if (event.data?.action === 'RNS_MESSAGE') {
+    console.log(
+      'Reticulum message',
+      event.data.connectionId,
+      event.data.payload
+    );
+  }
+  if (event.data?.action === 'RNS_CONNECTION_STATE') {
+    console.log('Reticulum state', event.data.connectionId, event.data.state);
+  }
+});
+
+const profile = await qortalRequest({
+  action: 'RNS_REQUEST',
+  destination,
+  path: '/hello',
+  payload: { name: 'Alice' },
+  requestId: crypto.randomUUID(),
+});
+
+const connection = await qortalRequest({
+  action: 'RNS_CONNECT',
+  destination,
+});
+
+await qortalRequest({
+  action: 'RNS_SEND',
+  connectionId: connection.connectionId,
+  payload: { type: 'hello', text: profile.message },
+});
+
+// Later:
+// await qortalRequest({ action: 'RNS_CLOSE', connectionId: connection.connectionId });
diff --git a/package-lock.json b/package-lock.json
index 0787611fa..e464a6998 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -24,6 +24,11 @@
         "@mui/icons-material": "^7.0.1",
         "@mui/lab": "^7.0.0-beta.11",
         "@mui/material": "^7.0.1",
+        "@noble/curves": "1.9.7",
+        "@noble/hashes": "1.8.0",
+        "@scure/base": "1.2.6",
+        "@scure/bip32": "1.7.0",
+        "@scure/btc-signer": "2.4.1",
         "@tanstack/react-virtual": "^3.13.6",
         "@testing-library/jest-dom": "^6.4.6",
         "@testing-library/user-event": "^14.6.1",
@@ -73,7 +78,6 @@
         "react-countdown-circle-timer": "^3.2.1",
         "react-dom": "^19.2.0",
         "react-dropzone": "^14.2.3",
-        "react-frame-component": "^5.2.7",
         "react-i18next": "^15.4.1",
         "react-intersection-observer": "^9.16.0",
         "react-joyride": "^3.2.0",
@@ -106,6 +110,7 @@
         "@typescript-eslint/eslint-plugin": "^7.1.1",
         "@typescript-eslint/parser": "^7.1.1",
         "@vitejs/plugin-react": "^4.7.0",
+        "esbuild": "0.28.2",
         "esbuild-plugin-react-virtualized": "^1.0.5",
         "eslint": "^8.57.0",
         "eslint-plugin-react-hooks": "^4.6.0",
@@ -2684,12 +2689,13 @@
       "integrity": "sha512-EsBwpc7hBUJWAsNPBmJy4hxWx12v6bshQsldrVmjxJoc3isbxhOrF2IcCpaXxfvq03NwkI7sbsOLXbYuqF/8Ww=="
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
-      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
+      "integrity": "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==",
       "cpu": [
         "ppc64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2700,12 +2706,13 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
-      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.2.tgz",
+      "integrity": "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==",
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2716,12 +2723,13 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
-      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.2.tgz",
+      "integrity": "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2732,12 +2740,13 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
-      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.2.tgz",
+      "integrity": "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2748,12 +2757,13 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
-      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.2.tgz",
+      "integrity": "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2764,12 +2774,13 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
-      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.2.tgz",
+      "integrity": "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2780,12 +2791,13 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2796,12 +2808,13 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
-      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.2.tgz",
+      "integrity": "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2812,12 +2825,13 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
-      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.2.tgz",
+      "integrity": "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==",
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2828,12 +2842,13 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
-      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.2.tgz",
+      "integrity": "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2844,12 +2859,13 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
-      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.2.tgz",
+      "integrity": "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==",
       "cpu": [
         "ia32"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2860,12 +2876,13 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
-      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.2.tgz",
+      "integrity": "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==",
       "cpu": [
         "loong64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2876,12 +2893,13 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
-      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.2.tgz",
+      "integrity": "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==",
       "cpu": [
         "mips64el"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2892,12 +2910,13 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
-      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.2.tgz",
+      "integrity": "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==",
       "cpu": [
         "ppc64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2908,12 +2927,13 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
-      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.2.tgz",
+      "integrity": "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==",
       "cpu": [
         "riscv64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2924,12 +2944,13 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
-      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.2.tgz",
+      "integrity": "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==",
       "cpu": [
         "s390x"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2940,12 +2961,13 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
-      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.2.tgz",
+      "integrity": "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2956,12 +2978,13 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2972,12 +2995,13 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2988,12 +3012,13 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3004,12 +3029,13 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3020,12 +3046,13 @@
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
-      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.2.tgz",
+      "integrity": "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3036,12 +3063,13 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
-      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.2.tgz",
+      "integrity": "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3052,12 +3080,13 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
-      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.2.tgz",
+      "integrity": "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3068,12 +3097,13 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
-      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.2.tgz",
+      "integrity": "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==",
       "cpu": [
         "ia32"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3084,12 +3114,13 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
-      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.2.tgz",
+      "integrity": "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5105,6 +5136,33 @@
         "@tybys/wasm-util": "^0.10.0"
       }
     },
+    "node_modules/@noble/curves": {
+      "version": "1.9.7",
+      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.9.7.tgz",
+      "integrity": "sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==",
+      "license": "MIT",
+      "dependencies": {
+        "@noble/hashes": "1.8.0"
+      },
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+      "license": "MIT",
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -5570,6 +5628,80 @@
         "win32"
       ]
     },
+    "node_modules/@scure/base": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@scure/base/-/base-1.2.6.tgz",
+      "integrity": "sha512-g/nm5FgUa//MCj1gV09zTJTaM6KBAHqLN907YVQqf7zC49+DcO4B1so4ZX07Ef10Twr6nuqYEH9GEggFXA4Fmg==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@scure/bip32": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/@scure/bip32/-/bip32-1.7.0.tgz",
+      "integrity": "sha512-E4FFX/N3f4B80AKWp5dP6ow+flD1LQZo/w8UnLGYZO674jS6YnYeepycOOksv+vLPSpgN35wgKgy+ybfTb2SMw==",
+      "license": "MIT",
+      "dependencies": {
+        "@noble/curves": "~1.9.0",
+        "@noble/hashes": "~1.8.0",
+        "@scure/base": "~1.2.5"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@scure/btc-signer": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/@scure/btc-signer/-/btc-signer-2.4.1.tgz",
+      "integrity": "sha512-ch6h66o9nPhEoe/KciMMUJeH2MBPB8UAJI1if35Fxl6885lKTsc9YoCRqTW0/RjI0Vv9GSg1tmKtHHODyAw81g==",
+      "license": "MIT",
+      "dependencies": {
+        "@noble/curves": "2.4.0",
+        "@noble/hashes": "2.4.0",
+        "@scure/base": "2.4.0",
+        "micro-packed": "0.11.1"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@scure/btc-signer/node_modules/@noble/curves": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-2.4.0.tgz",
+      "integrity": "sha512-P4/62zrgfH33CneE3Dn4WhJVA22YUU0eR51wKIan4NVRvwsA0YnPTwWGpNbpuacSujmSFLvyzpyuR30+fbq2Ew==",
+      "license": "MIT",
+      "dependencies": {
+        "@noble/hashes": "2.4.0"
+      },
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@scure/btc-signer/node_modules/@noble/hashes": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz",
+      "integrity": "sha512-X5XaVWZIBCT7HHZGm5I7ZQXDwLG+bGXuSrMQAW+7Zvl87h1kmc1ZB1VSRJcpUfoUrGQp4Fkoxm5kZ+Ms+aW+eA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@scure/btc-signer/node_modules/@scure/base": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@scure/base/-/base-2.4.0.tgz",
+      "integrity": "sha512-thZ1TuJwFwBblOhgsjDKvvGirBxNp+wSvY/DR6tJBJOTDhdAAcHJ8Vbr2eFnqaxeca4+t0i9KBf+uHYGWwZORg==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/@selderee/plugin-htmlparser2": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/@selderee/plugin-htmlparser2/-/plugin-htmlparser2-0.11.0.tgz",
@@ -10166,9 +10298,10 @@
       "optional": true
     },
     "node_modules/esbuild": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
-      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
+      "integrity": "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==",
+      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "bin": {
@@ -10178,32 +10311,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.27.3",
-        "@esbuild/android-arm": "0.27.3",
-        "@esbuild/android-arm64": "0.27.3",
-        "@esbuild/android-x64": "0.27.3",
-        "@esbuild/darwin-arm64": "0.27.3",
-        "@esbuild/darwin-x64": "0.27.3",
-        "@esbuild/freebsd-arm64": "0.27.3",
-        "@esbuild/freebsd-x64": "0.27.3",
-        "@esbuild/linux-arm": "0.27.3",
-        "@esbuild/linux-arm64": "0.27.3",
-        "@esbuild/linux-ia32": "0.27.3",
-        "@esbuild/linux-loong64": "0.27.3",
-        "@esbuild/linux-mips64el": "0.27.3",
-        "@esbuild/linux-ppc64": "0.27.3",
-        "@esbuild/linux-riscv64": "0.27.3",
-        "@esbuild/linux-s390x": "0.27.3",
-        "@esbuild/linux-x64": "0.27.3",
-        "@esbuild/netbsd-arm64": "0.27.3",
-        "@esbuild/netbsd-x64": "0.27.3",
-        "@esbuild/openbsd-arm64": "0.27.3",
-        "@esbuild/openbsd-x64": "0.27.3",
-        "@esbuild/openharmony-arm64": "0.27.3",
-        "@esbuild/sunos-x64": "0.27.3",
-        "@esbuild/win32-arm64": "0.27.3",
-        "@esbuild/win32-ia32": "0.27.3",
-        "@esbuild/win32-x64": "0.27.3"
+        "@esbuild/aix-ppc64": "0.28.2",
+        "@esbuild/android-arm": "0.28.2",
+        "@esbuild/android-arm64": "0.28.2",
+        "@esbuild/android-x64": "0.28.2",
+        "@esbuild/darwin-arm64": "0.28.2",
+        "@esbuild/darwin-x64": "0.28.2",
+        "@esbuild/freebsd-arm64": "0.28.2",
+        "@esbuild/freebsd-x64": "0.28.2",
+        "@esbuild/linux-arm": "0.28.2",
+        "@esbuild/linux-arm64": "0.28.2",
+        "@esbuild/linux-ia32": "0.28.2",
+        "@esbuild/linux-loong64": "0.28.2",
+        "@esbuild/linux-mips64el": "0.28.2",
+        "@esbuild/linux-ppc64": "0.28.2",
+        "@esbuild/linux-riscv64": "0.28.2",
+        "@esbuild/linux-s390x": "0.28.2",
+        "@esbuild/linux-x64": "0.28.2",
+        "@esbuild/netbsd-arm64": "0.28.2",
+        "@esbuild/netbsd-x64": "0.28.2",
+        "@esbuild/openbsd-arm64": "0.28.2",
+        "@esbuild/openbsd-x64": "0.28.2",
+        "@esbuild/openharmony-arm64": "0.28.2",
+        "@esbuild/sunos-x64": "0.28.2",
+        "@esbuild/win32-arm64": "0.28.2",
+        "@esbuild/win32-ia32": "0.28.2",
+        "@esbuild/win32-x64": "0.28.2"
       }
     },
     "node_modules/esbuild-plugin-react-virtualized": {
@@ -14026,6 +14159,30 @@
         "node": ">= 8"
       }
     },
+    "node_modules/micro-packed": {
+      "version": "0.11.1",
+      "resolved": "https://registry.npmjs.org/micro-packed/-/micro-packed-0.11.1.tgz",
+      "integrity": "sha512-agQGBnBCw8OoKQZMUxcaQPaOowdfxyEmBsq4CNAXAXCyB8KxlRG0lTl5GADJIsMEDaFb0trhXBHKYsjTWa5kuw==",
+      "license": "MIT",
+      "dependencies": {
+        "@scure/base": "2.4.0"
+      },
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/micro-packed/node_modules/@scure/base": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@scure/base/-/base-2.4.0.tgz",
+      "integrity": "sha512-thZ1TuJwFwBblOhgsjDKvvGirBxNp+wSvY/DR6tJBJOTDhdAAcHJ8Vbr2eFnqaxeca4+t0i9KBf+uHYGWwZORg==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/micromatch": {
       "version": "4.0.8",
       "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
@@ -18438,16 +18595,6 @@
         "react": ">= 16.8 || 18.0.0"
       }
     },
-    "node_modules/react-frame-component": {
-      "version": "5.2.7",
-      "resolved": "https://registry.npmjs.org/react-frame-component/-/react-frame-component-5.2.7.tgz",
-      "integrity": "sha512-ROjHtSLoSVYUBfTieazj/nL8jIX9rZFmHC0yXEU+dx6Y82OcBEGgU9o7VyHMrBFUN9FuQ849MtIPNNLsb4krbg==",
-      "peerDependencies": {
-        "prop-types": "^15.5.9",
-        "react": ">= 16.3",
-        "react-dom": ">= 16.3"
-      }
-    },
     "node_modules/react-i18next": {
       "version": "15.4.1",
       "resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-15.4.1.tgz",
@@ -21584,6 +21731,463 @@
         "vite": "^2 || ^3 || ^4 || ^5 || ^6 || ^7"
       }
     },
+    "node_modules/vite/node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz",
+      "integrity": "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-arm": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.7.tgz",
+      "integrity": "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.7.tgz",
+      "integrity": "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.7.tgz",
+      "integrity": "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.7.tgz",
+      "integrity": "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.7.tgz",
+      "integrity": "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.7.tgz",
+      "integrity": "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-arm": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.7.tgz",
+      "integrity": "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.7.tgz",
+      "integrity": "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.7.tgz",
+      "integrity": "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.7.tgz",
+      "integrity": "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.7.tgz",
+      "integrity": "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.7.tgz",
+      "integrity": "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.7.tgz",
+      "integrity": "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.7.tgz",
+      "integrity": "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.7.tgz",
+      "integrity": "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.7.tgz",
+      "integrity": "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.7.tgz",
+      "integrity": "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.7.tgz",
+      "integrity": "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.7.tgz",
+      "integrity": "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.7.tgz",
+      "integrity": "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-ia32": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.7.tgz",
+      "integrity": "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.7.tgz",
+      "integrity": "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/esbuild": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.7.tgz",
+      "integrity": "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.27.7",
+        "@esbuild/android-arm": "0.27.7",
+        "@esbuild/android-arm64": "0.27.7",
+        "@esbuild/android-x64": "0.27.7",
+        "@esbuild/darwin-arm64": "0.27.7",
+        "@esbuild/darwin-x64": "0.27.7",
+        "@esbuild/freebsd-arm64": "0.27.7",
+        "@esbuild/freebsd-x64": "0.27.7",
+        "@esbuild/linux-arm": "0.27.7",
+        "@esbuild/linux-arm64": "0.27.7",
+        "@esbuild/linux-ia32": "0.27.7",
+        "@esbuild/linux-loong64": "0.27.7",
+        "@esbuild/linux-mips64el": "0.27.7",
+        "@esbuild/linux-ppc64": "0.27.7",
+        "@esbuild/linux-riscv64": "0.27.7",
+        "@esbuild/linux-s390x": "0.27.7",
+        "@esbuild/linux-x64": "0.27.7",
+        "@esbuild/netbsd-arm64": "0.27.7",
+        "@esbuild/netbsd-x64": "0.27.7",
+        "@esbuild/openbsd-arm64": "0.27.7",
+        "@esbuild/openbsd-x64": "0.27.7",
+        "@esbuild/openharmony-arm64": "0.27.7",
+        "@esbuild/sunos-x64": "0.27.7",
+        "@esbuild/win32-arm64": "0.27.7",
+        "@esbuild/win32-ia32": "0.27.7",
+        "@esbuild/win32-x64": "0.27.7"
+      }
+    },
     "node_modules/vite/node_modules/fdir": {
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
diff --git a/package.json b/package.json
index e4e5ad37a..f9924df17 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "version": "0.0.0",
   "type": "module",
   "scripts": {
-    "build": "vite build",
+    "build": "node electron/scripts/build-wallet-engine.mjs && node --max-old-space-size=4096 ./node_modules/vite/bin/vite.js build",
     "coverage": "vitest run --coverage",
     "dev": "vite",
     "format": "prettier --write .",
@@ -12,6 +12,7 @@
     "preview": "vite preview",
     "pretest": "tsc electron/src/reticulum-resource.worker.ts electron/src/reticulum-chat.worker.ts --outDir electron/build/src --target ES2020 --module CommonJS --moduleResolution node --esModuleInterop --skipLibCheck --types node",
     "test": "vitest",
+    "test:private-transport": "vitest run electron/src/private-channel-step3.test.ts electron/src/private-channel-step4.test.ts electron/src/private-transport-sidecar.test.ts electron/src/private-channel-manager.test.ts electron/src/masque-relay-discovery.test.ts electron/src/private-transport-runtime.test.ts electron/src/quic-masque-transport.test.ts electron/src/moq-masque-transport.test.ts electron/src/moq-transport-manager.test.ts src/qortal/qapp-private-channel-request.test.ts src/qortal/qapp-moq-request.test.ts",
     "test:gcall:e2e": "GCALL_E2E_ARTIFACT_DIR=${GCALL_E2E_ARTIFACT_DIR:-.artifacts/gcall-e2e} vitest run src/lib/group-call/v2/groupCallE2eQuality.test.ts",
     "test:gcall:e2e:offline": "GCALL_E2E_ARTIFACT_DIR=${GCALL_E2E_ARTIFACT_DIR:-.artifacts/gcall-e2e} vitest run src/lib/group-call/v2/groupCallE2eQuality.test.ts src/lib/group-call/v2/groupCallE2eLiveExport.test.ts src/lib/group-call/v2/replayHarness.test.ts electron/src/group-call-e2e-electron.test.ts",
     "test:gcall:e2e:watch": "GCALL_E2E_ARTIFACT_DIR=${GCALL_E2E_ARTIFACT_DIR:-.artifacts/gcall-e2e} vitest src/lib/group-call/v2/groupCallE2eQuality.test.ts",
@@ -37,6 +38,11 @@
     "@mui/icons-material": "^7.0.1",
     "@mui/lab": "^7.0.0-beta.11",
     "@mui/material": "^7.0.1",
+    "@noble/curves": "1.9.7",
+    "@noble/hashes": "1.8.0",
+    "@scure/base": "1.2.6",
+    "@scure/bip32": "1.7.0",
+    "@scure/btc-signer": "2.4.1",
     "@tanstack/react-virtual": "^3.13.6",
     "@testing-library/jest-dom": "^6.4.6",
     "@testing-library/user-event": "^14.6.1",
@@ -86,7 +92,6 @@
     "react-countdown-circle-timer": "^3.2.1",
     "react-dom": "^19.2.0",
     "react-dropzone": "^14.2.3",
-    "react-frame-component": "^5.2.7",
     "react-i18next": "^15.4.1",
     "react-intersection-observer": "^9.16.0",
     "react-joyride": "^3.2.0",
@@ -119,6 +124,7 @@
     "@typescript-eslint/eslint-plugin": "^7.1.1",
     "@typescript-eslint/parser": "^7.1.1",
     "@vitejs/plugin-react": "^4.7.0",
+    "esbuild": "0.28.2",
     "esbuild-plugin-react-virtualized": "^1.0.5",
     "eslint": "^8.57.0",
     "eslint-plugin-react-hooks": "^4.6.0",
diff --git a/protocol-v1-vectors.json b/protocol-v1-vectors.json
new file mode 100644
index 000000000..c7edfc456
--- /dev/null
+++ b/protocol-v1-vectors.json
@@ -0,0 +1,47 @@
+{
+  "protocol": "qortal-hub-v3.qapp-backend.v1",
+  "header_bytes": 14,
+  "data_frame": {
+    "version": 1,
+    "type": 1,
+    "message_id_hex": "0102030405060708",
+    "payload_hex": "01020304",
+    "frame_hex": "010101020304050607080000000401020304"
+  },
+  "ack_frame": {
+    "version": 1,
+    "type": 2,
+    "message_id_hex": "1112131415161718",
+    "payload_hex": "",
+    "frame_hex": "0102111213141516171800000000"
+  },
+  "control_frame": {
+    "version": 1,
+    "type": 3,
+    "message_id_hex": "2122232425262728",
+    "control": { "type": "PING" },
+    "payload_hex": "7b2274797065223a2250494e47227d",
+    "frame_hex": "010321222324252627280000000f7b2274797065223a2250494e47227d"
+  },
+  "data_envelope": {
+    "connection_id": "rns-00000000-0000-0000-0000-000000000000",
+    "encoding": "json",
+    "application_json": { "type": "echo", "value": 42, "text": "hello" },
+    "application_utf8_hex": "7b2274797065223a226563686f222c2276616c7565223a34322c2274657874223a2268656c6c6f227d",
+    "payload_base64": "eyJ0eXBlIjoiZWNobyIsInZhbHVlIjo0MiwidGV4dCI6ImhlbGxvIn0=",
+    "envelope_utf8": "{\"connectionId\":\"rns-00000000-0000-0000-0000-000000000000\",\"payloadBase64\":\"eyJ0eXBlIjoiZWNobyIsInZhbHVlIjo0MiwidGV4dCI6ImhlbGxvIn0=\",\"encoding\":\"json\"}"
+  },
+  "rpc_request": {
+    "version": 1,
+    "request_id": "request-0001",
+    "encoding": "json",
+    "application_json": { "name": "Alice" },
+    "payload_base64": "eyJuYW1lIjoiQWxpY2UifQ=="
+  },
+  "rpc_response": {
+    "application_json": {
+      "message": "Hello, Alice",
+      "requestId": "request-0001"
+    }
+  }
+}
diff --git a/src/App.tsx b/src/App.tsx
index 1eedd15bb..d5e11f793 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -78,6 +78,7 @@ import {
 } from './utils/events';
 import { stopSharedEarbumpPlayback } from './components/Group/earbumpSharedAudio';
 import { Settings } from './components/Group/Settings';
+import { QAppScreenCapturePermission } from './components/Apps/QAppScreenCapturePermission';
 import { useRetrieveDataLocalStorage } from './hooks/useRetrieveDataLocalStorage.tsx';
 import { useQortalGetSaveSettings } from './hooks/useQortalGetSaveSettings.tsx';
 import {
@@ -140,6 +141,7 @@ import type { AuthUnlockTransitionSnapshot } from './types/authTransition';
 import { openQWalletsTab } from './utils/openQWalletsTab';
 import { clearLastAuthenticatedWalletAddress } from './utils/lastAuthenticatedWallet';
 import { appLockedAtom, isIdleAtom } from './atoms/presence';
+import { reconcilePendingLocalForeignCoinSends } from './qortal/foreign-coin-send';
 import {
   DEFAULT_AUTO_LOCK_TIMEOUT_MINUTES,
   isAutoLockDue,
@@ -476,6 +478,24 @@ function App() {
     }
   }, [extState, setIsAppLocked, setIsIdle]);
 
+  useEffect(() => {
+    if (extState !== 'authenticated' || !isMainWindow || isAppLocked) return;
+    const controller = new AbortController();
+    const reconcile = () => {
+      void reconcilePendingLocalForeignCoinSends(controller.signal).catch(
+        () => undefined
+      );
+    };
+    reconcile();
+    const intervalId = window.setInterval(reconcile, 60_000);
+    window.addEventListener('focus', reconcile);
+    return () => {
+      controller.abort();
+      window.clearInterval(intervalId);
+      window.removeEventListener('focus', reconcile);
+    };
+  }, [extState, isAppLocked, selectedNode?.apikey, selectedNode?.url]);
+
   useEffect(() => {
     if (
       extState !== 'authenticated' ||
@@ -2064,6 +2084,7 @@ function App() {
       }}
     >
       <CustomTitleBar rightNav={titleBarRightNav} />
+      <QAppScreenCapturePermission active={extState === 'authenticated' && isMainWindow} />
       {extState === 'authenticated' && isMainWindow && (
         <GlobalQortalNavBar
           desktopViewMode={desktopViewMode}
diff --git a/src/background/background-cases.ts b/src/background/background-cases.ts
index 437b64bba..da6b744ed 100644
--- a/src/background/background-cases.ts
+++ b/src/background/background-cases.ts
@@ -2440,11 +2440,81 @@ export async function signPresenceMessageCase(request, event) {
   }
 }
 
+export async function getRelayGroupHintsCase(request, event) {
+  let groups: number[] | null = null;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 2_000);
+  try {
+    const wallet = await getData<any>('walletInfo');
+    const address = request.payload?.address;
+    if (
+      event.source !== window ||
+      typeof address !== 'string' ||
+      wallet?.address0 !== address
+    )
+      throw new Error('Account changed');
+    const endpoint = await createEndpoint(
+      `/groups/member/${encodeURIComponent(address)}`
+    );
+    const response = await fetch(endpoint, { signal: controller.signal });
+    if (!response.ok || !response.body)
+      throw new Error('Group hints unavailable');
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let size = 0,
+      text = '';
+    try {
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > 262144) throw new Error('Group hints too large');
+        text += decoder.decode(value, { stream: true });
+      }
+      text += decoder.decode();
+    } finally {
+      await reader.cancel().catch(() => undefined);
+    }
+    const rows = JSON.parse(text);
+    if (
+      !Array.isArray(rows) ||
+      rows.length > 4096 ||
+      rows.some(
+        (row) =>
+          !Number.isInteger(row?.groupId) ||
+          row.groupId <= 0 ||
+          row.groupId > 2147483647
+      )
+    )
+      throw new Error('Invalid group hints');
+    groups = [...new Set(rows.map((row) => row.groupId))];
+  } catch {
+    /* Hints are optional; the relay still verifies actual membership. */
+  } finally {
+    clearTimeout(timer);
+  }
+  event.source.postMessage(
+    {
+      requestId: request.requestId,
+      action: 'getRelayGroupHints',
+      payload: { groups },
+      type: 'backgroundMessageResponse',
+    },
+    event.origin
+  );
+}
+
 export async function signReticulumChatEventCase(request, event) {
   let resKeyPair;
   let privateKeyBytes: Uint8Array | null = null;
   let messageBytes: Uint8Array | null = null;
   try {
+    if (
+      request.payload?.type === 'masque-ticket-issue-v1' &&
+      event.source !== window
+    ) {
+      throw new Error('Relay authorization is restricted to the Hub wallet');
+    }
     assertAllowedReticulumSigningPayload(request.payload);
     resKeyPair = await getKeyPair();
     privateKeyBytes = Base58.decode(resKeyPair.privateKey);
diff --git a/src/background/background.ts b/src/background/background.ts
index 8cbb2745f..851b3a8a1 100644
--- a/src/background/background.ts
+++ b/src/background/background.ts
@@ -4,7 +4,7 @@ import { getNotificationOsPushDisabled } from '../qortal/qortal-requests';
 import { isArray } from 'lodash';
 import { uint8ArrayToObject } from '../encryption/encryption.ts';
 import Base58 from '../encryption/Base58';
-import axios from 'axios';
+import i18n from 'i18next';
 import {
   base64ToUint8Array,
   decryptSingle,
@@ -28,10 +28,7 @@ import {
   API_ENDPOINTS,
   EXT_NODE_QORTAL_LINK,
   getDefaultLocalNodeUrl,
-  HTTPS_QORT_TRADE,
-  HTTPS_TRADE_NODE,
   LOCALHOST_12391,
-  MIN_REQUIRED_QORTS,
   RESOURCE_TYPE_NUMBER_GROUP_CHAT_REACTIONS,
   TIME_MINUTES_10_IN_MILLISECONDS,
   TIME_WEEKS_1_IN_MILLISECONDS,
@@ -69,6 +66,7 @@ import {
   getRewardSharePrivateKeyCase,
   signPresenceMessageCase,
   signReticulumChatEventCase,
+  getRelayGroupHintsCase,
   decryptBoxWithMyKeyCase,
   encryptSupportMessageCase,
   decryptSupportMessageCase,
@@ -255,20 +253,18 @@ export const clearAllQueues = () => {
 };
 
 export const getForeignKey = async (foreignBlockchain) => {
+  if (
+    ['BITCOIN', 'LITECOIN', 'DOGECOIN', 'DIGIBYTE', 'RAVENCOIN'].includes(
+      foreignBlockchain
+    )
+  ) {
+    throw new Error(i18n.t('question:local_send.upgrade'));
+  }
+
   const resKeyPair = await getKeyPair();
   const parsedData = resKeyPair;
 
   switch (foreignBlockchain) {
-    case 'LITECOIN':
-      return parsedData.ltcPrivateKey;
-    case 'DOGECOIN':
-      return parsedData.dogePrivateKey;
-    case 'BITCOIN':
-      return parsedData.btcPrivateKey;
-    case 'DIGIBYTE':
-      return parsedData.dgbPrivateKey;
-    case 'RAVENCOIN':
-      return parsedData.rvnPrivateKey;
     case 'PIRATECHAIN':
       return parsedData.arrrSeed58;
     default:
@@ -351,8 +347,6 @@ export const createEndpoint = async (endpoint, customApi?: string) => {
 
 export const walletVersion = 2;
 
-const proxyAccountAddress = 'QXPejUe5Za1KD3zCMViWCX35AreMQ9H7ku';
-const proxyAccountPublicKey = '5hP6stDWybojoDw5t8z9D51nV945oMPX7qBd29rhX1G7';
 const pendingResponses = new Map();
 
 let groups = null;
@@ -657,23 +651,6 @@ async function connection(hostname: string) {
   return isConnected;
 }
 
-async function getTradeInfo(qortalAtAddress) {
-  const response = await fetch(
-    HTTPS_TRADE_NODE + '/crosschain/trade/' + qortalAtAddress
-  );
-  if (!response?.ok) throw new Error('Cannot crosschain trade information');
-  const data = await response.json();
-  return data;
-}
-
-async function getTradesInfo(qortalAtAddresses) {
-  // Use Promise.all to fetch data for all addresses concurrently
-  const trades = await Promise.all(
-    qortalAtAddresses.map((address) => getTradeInfo(address))
-  );
-  return trades; // Return the array of trade info objects
-}
-
 export async function getBalanceInfo() {
   const wallet = await getSaveWallet();
   const address = wallet.address0;
@@ -1240,121 +1217,6 @@ export async function handleActiveGroupDataFromSocket({ groups, directs }) {
   }
 }
 
-async function sendChatForBuyOrder({
-  qortAddress,
-  recipientPublicKey,
-  message,
-  atAddresses,
-  isSingle,
-}) {
-  let _reference = new Uint8Array(64);
-  self.crypto.getRandomValues(_reference);
-
-  let sendTimestamp = Date.now();
-  const wallet = await getSaveWallet();
-  const address = wallet.address0;
-  let reference = Base58.encode(_reference);
-  const resKeyPair = await getKeyPair();
-  const parsedData = resKeyPair;
-  const uint8PrivateKey = Base58.decode(parsedData.privateKey);
-  const uint8PublicKey = Base58.decode(parsedData.publicKey);
-  const keyPair = {
-    privateKey: uint8PrivateKey,
-    publicKey: uint8PublicKey,
-  };
-  const balance = await getBalanceInfo();
-  const hasEnoughBalance = +balance < MIN_REQUIRED_QORTS ? false : true;
-  const jsonData = {
-    addresses: message.addresses,
-    foreignKey: message.foreignKey,
-    receivingAddress: message.receivingAddress,
-  };
-  const finalJson = {
-    callRequest: jsonData,
-    extra: {
-      type: isSingle ? 'single' : 'multiple',
-    },
-  };
-  const messageStringified = JSON.stringify(finalJson);
-
-  const tx = await createTransaction(18, keyPair, {
-    timestamp: sendTimestamp,
-    recipient: qortAddress,
-    recipientPublicKey: recipientPublicKey,
-    hasChatReference: 0,
-    message: messageStringified,
-    lastReference: reference,
-    proofOfWorkNonce: 0,
-    isEncrypted: 1,
-    isText: 1,
-  });
-  //TODO
-  // if (!hasEnoughBalance) {
-  if (!hasEnoughBalance) {
-    const _encryptedMessage = tx._encryptedMessage;
-    const encryptedMessageToBase58 = Base58.encode(_encryptedMessage);
-    const signature =
-      'id-' + Date.now() + '-' + Math.floor(Math.random() * 1000);
-    const checkGatewayStatusRes = await fetch(
-      `${HTTPS_TRADE_NODE}/admin/status`
-    );
-    const checkGatewayStatusData = await checkGatewayStatusRes.json();
-    if (
-      +checkGatewayStatusData?.syncPercent !== 100 ||
-      checkGatewayStatusData?.isSynchronizing !== false
-    ) {
-      throw new Error('Cannot make trade. Gateway node is synchronizing');
-    }
-    const healthCheckRes = await fetch(
-      HTTPS_QORT_TRADE + '/api/transaction/healthcheck'
-    );
-    const healthcheckData = await healthCheckRes.json();
-    if (healthcheckData?.dbConnection !== 'healthy') {
-      throw new Error('Could not connect to db. Try again later.');
-    }
-    const res = await axios.post(
-      HTTPS_QORT_TRADE + `/api/transaction/updatetxgateway`,
-      {
-        qortalAtAddresses: atAddresses,
-        qortAddress: address,
-        node: HTTPS_TRADE_NODE,
-        status: 'message-sent',
-        encryptedMessageToBase58,
-        signature,
-        reference,
-        senderPublicKey: parsedData.publicKey,
-        sender: address,
-      },
-      {
-        headers: {
-          'Content-Type': 'application/json',
-        },
-      }
-    );
-
-    return {
-      encryptedMessageToBase58,
-      status: 'message-sent',
-      signature,
-    };
-  }
-
-  const chatBytes = tx.chatBytes;
-  const difficulty = 8;
-  const { nonce, chatBytesArray } = await performPowTask(chatBytes, difficulty);
-
-  let _response = await signChatFunc(
-    chatBytesArray,
-    nonce,
-    HTTPS_TRADE_NODE,
-    keyPair
-  );
-  if (_response?.error) {
-    throw new Error(_response?.message);
-  }
-  return _response;
-}
-
 export async function sendChatGroup({
   groupId,
   typeMessage,
@@ -1570,143 +1432,60 @@ export async function createBuyOrderTx({
   isGateway,
   foreignBlockchain,
 }) {
-  try {
-    if (!isGateway) {
-      const wallet = await getSaveWallet();
-
-      const address = wallet.address0;
-      let message;
-      if (foreignBlockchain === 'PIRATECHAIN') {
-        message = {
-          atAddress: crosschainAtInfo[0].qortalAtAddress,
-          foreignKey: await getForeignKey(foreignBlockchain),
-          receivingAddress: address,
-        };
-      } else {
-        message = {
-          addresses: crosschainAtInfo.map((order) => order.qortalAtAddress),
-          foreignKey: await getForeignKey(foreignBlockchain),
-          receivingAddress: address,
-        };
-      }
-
-      let responseVar;
-      let txn;
-      let url;
-      if (foreignBlockchain === 'PIRATECHAIN') {
-        txn = new TradeBotRespondRequest().createTransaction(message);
-
-        url = await createEndpoint('/crosschain/tradebot/respond');
-      } else {
-        txn = new TradeBotRespondMultipleRequest().createTransaction(message);
-
-        url = await createEndpoint('/crosschain/tradebot/respondmultiple');
-      }
-
-      const responseFetch = await fetch(url, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(txn),
-      });
-
-      const res = await responseFetch.json();
-      if (res?.error && res?.message) {
-        throw new Error(res?.message);
-      }
-      if (!responseFetch?.ok) throw new Error('Failed to submit buy order');
+  if (isGateway) {
+    throw new Error(
+      i18n.t('question:message.generic.no_action_public_node', {
+        postProcess: 'capitalizeFirstChar',
+      })
+    );
+  }
 
-      if (res === false) {
-        responseVar = {
-          response: 'Unable to execute buy order',
-          success: false,
-        };
-      } else {
-        responseVar = { response: res, success: true };
-      }
-      const { response, success } = responseVar;
-      let responseMessage;
-      if (success) {
-        responseMessage = {
-          callResponse: response,
-          extra: {
-            message: 'Transaction processed successfully!',
-            atAddresses:
-              foreignBlockchain === 'PIRATECHAIN'
-                ? [crosschainAtInfo[0].qortalAtAddress]
-                : crosschainAtInfo.map((order) => order.qortalAtAddress),
-            senderAddress: address,
-            node: url,
-          },
-        };
-      } else {
-        responseMessage = {
-          callResponse: 'ERROR',
-          extra: {
-            message: response,
-            atAddresses:
-              foreignBlockchain === 'PIRATECHAIN'
-                ? [crosschainAtInfo[0].qortalAtAddress]
-                : crosschainAtInfo.map((order) => order.qortalAtAddress),
-            senderAddress: address,
-            node: url,
-          },
-        };
+  const wallet = await getSaveWallet();
+  const address = wallet.address0;
+  const isPirateChain = foreignBlockchain === 'PIRATECHAIN';
+  const atAddresses = crosschainAtInfo.map((order) => order.qortalAtAddress);
+  const message = isPirateChain
+    ? {
+        atAddress: atAddresses[0],
+        foreignKey: await getForeignKey(foreignBlockchain),
+        receivingAddress: address,
       }
-
-      return responseMessage;
-    }
-    const wallet = await getSaveWallet();
-    const address = wallet.address0;
-
-    const message = {
-      addresses:
-        foreignBlockchain === 'PIRATECHAIN'
-          ? [crosschainAtInfo[0].qortalAtAddress]
-          : crosschainAtInfo.map((order) => order.qortalAtAddress),
-      foreignKey: await getForeignKey(foreignBlockchain),
-      receivingAddress: address,
-    };
-    const res = await sendChatForBuyOrder({
-      qortAddress: proxyAccountAddress,
-      recipientPublicKey: proxyAccountPublicKey,
-      message,
-      atAddresses:
-        foreignBlockchain === 'PIRATECHAIN'
-          ? [crosschainAtInfo[0].qortalAtAddress]
-          : crosschainAtInfo.map((order) => order.qortalAtAddress),
-      isSingle: foreignBlockchain === 'PIRATECHAIN',
-    });
-
-    if (res?.signature) {
-      const message = await listenForChatMessageForBuyOrder({
-        nodeBaseUrl: HTTPS_TRADE_NODE,
-        senderAddress: proxyAccountAddress,
-        senderPublicKey: proxyAccountPublicKey,
-        signature: res?.signature,
-      });
-
-      const responseMessage = {
-        callResponse: message.callResponse,
-        extra: {
-          message: message?.extra?.message,
-          senderAddress: address,
-          node: HTTPS_TRADE_NODE,
-          atAddresses:
-            foreignBlockchain === 'PIRATECHAIN'
-              ? [crosschainAtInfo[0].qortalAtAddress]
-              : crosschainAtInfo.map((order) => order.qortalAtAddress),
-        },
+    : {
+        addresses: atAddresses,
+        foreignKey: await getForeignKey(foreignBlockchain),
+        receivingAddress: address,
       };
-
-      return responseMessage;
-    } else {
-      throw new Error('Unable to send buy order message');
-    }
-  } catch (error) {
-    throw new Error(error.message);
+  const txn = isPirateChain
+    ? new TradeBotRespondRequest().createTransaction(message)
+    : new TradeBotRespondMultipleRequest().createTransaction(message);
+  const url = await createEndpoint(
+    isPirateChain
+      ? '/crosschain/tradebot/respond'
+      : '/crosschain/tradebot/respondmultiple'
+  );
+  const responseFetch = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(txn),
+  });
+  const response = await responseFetch.json();
+  if (response?.error && response?.message) {
+    throw new Error(response.message);
   }
+  if (!responseFetch.ok) throw new Error('Failed to submit buy order');
+
+  const success = response !== false;
+  return {
+    callResponse: success ? response : 'ERROR',
+    extra: {
+      message: success
+        ? 'Transaction processed successfully!'
+        : 'Unable to execute buy order',
+      atAddresses: isPirateChain ? [atAddresses[0]] : atAddresses,
+      senderAddress: address,
+      node: url,
+    },
+  };
 }
 
 export async function sendChatNotification(
@@ -2385,69 +2164,6 @@ function fetchMessages(apiCall) {
   });
 }
 
-async function fetchMessagesForBuyOrders(apiCall, signature, senderPublicKey) {
-  let retryDelay = 2000; // Start with a 2-second delay
-  const maxDuration = 360000 * 2; // Maximum duration set to 12 minutes
-  const startTime = Date.now(); // Record the start time
-  let triedChatMessage = [];
-  // Promise to handle polling logic
-  await new Promise((res) => {
-    setTimeout(() => {
-      res();
-    }, 40000);
-  });
-  return new Promise((resolve, reject) => {
-    const attemptFetch = async () => {
-      if (Date.now() - startTime > maxDuration) {
-        return reject(new Error('Maximum polling time exceeded'));
-      }
-
-      try {
-        const response = await fetch(apiCall);
-        let data = await response.json();
-
-        data = data.filter(
-          (item) => !triedChatMessage.includes(item.signature)
-        );
-        if (data && data.length > 0) {
-          const encodedMessageObj = data[0];
-          const resKeyPair = await getKeyPair();
-          const parsedData = resKeyPair;
-          const uint8PrivateKey = Base58.decode(parsedData.privateKey);
-          const uint8PublicKey = Base58.decode(parsedData.publicKey);
-          const keyPair = {
-            privateKey: uint8PrivateKey,
-            publicKey: uint8PublicKey,
-          };
-
-          const decodedMessage = decryptChatMessage(
-            encodedMessageObj.data,
-            keyPair.privateKey,
-            senderPublicKey,
-            encodedMessageObj.reference
-          );
-          const parsedMessage = JSON.parse(decodedMessage);
-          if (parsedMessage?.extra?.chatRequestSignature === signature) {
-            resolve(parsedMessage);
-          } else {
-            triedChatMessage.push(encodedMessageObj.signature);
-            setTimeout(attemptFetch, retryDelay);
-            retryDelay = Math.min(retryDelay * 2, 360000); // Ensure delay does not exceed 6 minutes
-          }
-          // Resolve the promise when data is found
-        } else {
-          setTimeout(attemptFetch, retryDelay);
-          retryDelay = Math.min(retryDelay * 2, 360000); // Ensure delay does not exceed 6 minutes
-        }
-      } catch (error) {
-        reject(error); // Reject the promise on error
-      }
-    };
-
-    attemptFetch(); // Initial call to start the polling
-  });
-}
-
 async function listenForChatMessage({
   nodeBaseUrl,
   senderAddress,
@@ -2493,49 +2209,6 @@ async function listenForChatMessage({
   }
 }
 
-async function listenForChatMessageForBuyOrder({
-  nodeBaseUrl,
-  senderAddress,
-  senderPublicKey,
-  signature,
-}) {
-  try {
-    let validApi = '';
-    const checkIfNodeBaseUrlIsAcceptable = API_ENDPOINTS.find(
-      (item) => item === nodeBaseUrl
-    );
-    if (checkIfNodeBaseUrlIsAcceptable) {
-      validApi = checkIfNodeBaseUrlIsAcceptable;
-    } else {
-      validApi = await findUsableApi();
-    }
-    const wallet = await getSaveWallet();
-    const address = wallet.address0;
-    const before = Date.now() + 1200000;
-    const after = Date.now();
-    const apiCall = `${validApi}/chat/messages?involving=${senderAddress}&involving=${address}&reverse=true&limit=1&before=${before}&after=${after}&encoding=BASE64`;
-    const parsedMessageObj = await fetchMessagesForBuyOrders(
-      apiCall,
-      signature,
-      senderPublicKey
-    );
-
-    return parsedMessageObj;
-
-    // chrome.tabs.query({}, function (tabs) {
-    //   tabs.forEach((tab) => {
-    //     chrome.tabs.sendMessage(tab.id, {
-    //       type: "RESPONSE_FOR_TRADES",
-    //       message: parsedMessageObj,
-    //     });
-    //   });
-    // });
-  } catch (error) {
-    console.error(error);
-    throw new Error(error.message);
-  }
-}
-
 export function removeDuplicateWindow(popupUrl) {
   // chrome.windows.getAll(
   //   { populate: true, windowTypes: ["popup"] },
@@ -3102,6 +2775,9 @@ function setupMessageListener() {
       case 'signReticulumChatEvent':
         signReticulumChatEventCase(request, event);
         break;
+      case 'getRelayGroupHints':
+        getRelayGroupHintsCase(request, event);
+        break;
       case 'decryptBoxWithMyKey':
         decryptBoxWithMyKeyCase(request, event);
         break;
diff --git a/src/background/reticulum-signing-policy.test.ts b/src/background/reticulum-signing-policy.test.ts
index df7582863..d0c5530b1 100644
--- a/src/background/reticulum-signing-policy.test.ts
+++ b/src/background/reticulum-signing-policy.test.ts
@@ -12,6 +12,26 @@ function expectAllowed(
 }
 
 describe('Reticulum wallet signing policy', () => {
+  it('accepts only the exact fresh relay authorization domain', () => {
+    const challenge = {
+      type: 'masque-ticket-issue-v1',
+      binding: 'ab'.repeat(32),
+      nonce: 'cd'.repeat(32),
+      policy: 'ef'.repeat(32),
+      relayPin: '12'.repeat(32),
+      expiresAt: Date.now() + 10_000,
+    };
+    expectAllowed(assertAllowedReticulumSigningPayload, challenge);
+    for (const invalid of [
+      { ...challenge, extra: 'injected' },
+      { ...challenge, expiresAt: 1 },
+      { ...challenge, expiresAt: Date.now() + 120_000 },
+      { ...challenge, type: 'masque-relay-auth-v1' },
+      { ...challenge, binding: 'short' },
+    ]) {
+      expect(() => assertAllowedReticulumSigningPayload(invalid)).toThrow();
+    }
+  });
   it('allows only an exact, short-lived Qortal Land proximity capability', () => {
     const now = Date.now();
     const capability = {
diff --git a/src/background/reticulum-signing-policy.ts b/src/background/reticulum-signing-policy.ts
index 7c8ab1c88..ad2fed711 100644
--- a/src/background/reticulum-signing-policy.ts
+++ b/src/background/reticulum-signing-policy.ts
@@ -946,6 +946,27 @@ export function assertAllowedPresenceSigningPayload(
 export function assertAllowedReticulumSigningPayload(
   payload: unknown
 ): asserts payload is Record<string, unknown> {
+  if (
+    payload &&
+    typeof payload === 'object' &&
+    (payload as Record<string, unknown>).type === 'masque-ticket-issue-v1'
+  ) {
+    const p = payload as Record<string, unknown>;
+    if (
+      Object.keys(p).sort().join(',') !==
+        'binding,expiresAt,nonce,policy,relayPin,type' ||
+      ['binding', 'nonce', 'policy', 'relayPin'].some(
+        (key) =>
+          typeof p[key] !== 'string' || !/^[a-f0-9]{64}$/.test(p[key] as string)
+      ) ||
+      !Number.isSafeInteger(p.expiresAt) ||
+      Number(p.expiresAt) <= Date.now() ||
+      Number(p.expiresAt) > Date.now() + 65_000
+    ) {
+      throw new Error('Invalid relay authorization proof');
+    }
+    return;
+  }
   assertPayload(
     payload,
     rchatSchemas,
diff --git a/src/components/App/QortalRequestExtensionDialog.test.tsx b/src/components/App/QortalRequestExtensionDialog.test.tsx
new file mode 100644
index 000000000..bd111a081
--- /dev/null
+++ b/src/components/App/QortalRequestExtensionDialog.test.tsx
@@ -0,0 +1,53 @@
+import { useState } from 'react';
+import { ThemeProvider } from '@mui/material/styles';
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it, vi } from 'vitest';
+import { QortalRequestExtensionDialog } from './QortalRequestExtensionDialog';
+import '../../i18n/i18n';
+import { darkTheme } from '../../styles/theme-dark';
+
+describe('QortalRequestExtensionDialog confirmation', () => {
+  it('requires the acknowledgement before accepting', async () => {
+    const onAccept = vi.fn();
+    const user = userEvent.setup();
+
+    function Harness() {
+      const [confirmed, setConfirmed] = useState(false);
+      return (
+        <QortalRequestExtensionDialog
+          open
+          message={{
+            text1: 'Example Q-App wants to connect to a remote backend.',
+            confirmCheckbox: true,
+            confirmCheckboxLabel:
+              'I understand this Q-App will exchange data with a remote backend outside Qortal Hub.',
+          }}
+          sendPaymentError=""
+          confirmRequestRead={confirmed}
+          onConfirmRequestReadChange={setConfirmed}
+          onCheckbox1Change={vi.fn()}
+          onAccept={onAccept}
+          onCancel={vi.fn()}
+          onCountdownComplete={vi.fn()}
+        />
+      );
+    }
+
+    render(
+      <ThemeProvider theme={darkTheme}>
+        <Harness />
+      </ThemeProvider>
+    );
+    await user.click(screen.getByText('Accept'));
+    expect(onAccept).not.toHaveBeenCalled();
+
+    await user.click(
+      screen.getByText(
+        'I understand this Q-App will exchange data with a remote backend outside Qortal Hub.'
+      )
+    );
+    await user.click(screen.getByText('Accept'));
+    expect(onAccept).toHaveBeenCalledOnce();
+  });
+});
diff --git a/src/components/App/QortalRequestExtensionDialog.tsx b/src/components/App/QortalRequestExtensionDialog.tsx
index b585ac167..748d3bd30 100644
--- a/src/components/App/QortalRequestExtensionDialog.tsx
+++ b/src/components/App/QortalRequestExtensionDialog.tsx
@@ -64,7 +64,7 @@ export function QortalRequestExtensionDialog({
   onCountdownComplete,
 }: QortalRequestExtensionDialogProps) {
   const theme = useTheme();
-  const { t } = useTranslation(['core']);
+  const { t } = useTranslation(['core', 'question']);
   const requestMessage = (message || {}) as MessageQortalRequestExtension & {
     appName?: string;
     sourceKind?: string;
@@ -81,7 +81,7 @@ export function QortalRequestExtensionDialog({
   const summaryText =
     requestMessage.highlightedText ||
     (requestMessage.text1?.toLowerCase().includes('authenticate')
-      ? 'Grant permissions for this session only'
+      ? t('question:permission.session_only_summary')
       : requestMessage.text1);
   const wrappingTextSx = {
     overflowWrap: 'anywhere',
@@ -635,7 +635,8 @@ export function QortalRequestExtensionDialog({
                   transform: canAccept ? 'translateY(-1px)' : 'none',
                 },
               }}
-              onClick={onAccept}
+              aria-disabled={!canAccept}
+              onClick={canAccept ? onAccept : undefined}
             >
               {t('core:action.accept', { postProcess: 'capitalizeFirstChar' })}
             </CustomButtonAccept>
diff --git a/src/components/Apps/AppViewer.tsx b/src/components/Apps/AppViewer.tsx
index d6920f1cc..07d04166c 100644
--- a/src/components/Apps/AppViewer.tsx
+++ b/src/components/Apps/AppViewer.tsx
@@ -1,32 +1,39 @@
-import { forwardRef, useCallback, useEffect, useMemo, useState } from 'react';
-import { Box } from '@mui/material';
+import { createElement, forwardRef, useCallback, useEffect, useImperativeHandle, useLayoutEffect, useMemo, useRef, useState } from 'react';
+import { Box, Button } from '@mui/material';
 import { getBaseApiReact } from '../../App';
 import { subscribeToEvent, unsubscribeFromEvent } from '../../utils/events';
-import { useFrame } from 'react-frame-component';
 import { useQortalMessageListener } from '../../hooks/useQortalMessageListener';
 import { useThemeContext } from '../Theme/ThemeContext';
 import { useTranslation } from 'react-i18next';
 import { QORTAL_PROTOCOL } from '../../constants/constants';
-import { appHeighOffsetPx } from '../Desktop/CustomTitleBar';
+import { buildPreviewUrl } from './appPreviewUrl';
 
 type AppViewerProps = {
   app: any;
-  hide: boolean;
   isDevMode: boolean;
 };
 
 export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
-  ({ app, hide, isDevMode }, iframeRef) => {
-    const { window: frameWindow } = useFrame();
+  ({ app, isDevMode }, forwardedRef) => {
+    const nativeViewRef = useRef<any>(null);
+    const [nativeConfig, setNativeConfig] = useState<null | { partition: string; preload: string }>(null);
+    const [nativeGuestActive, setNativeGuestActive] = useState(false);
+    const [nativeGuestFailed, setNativeGuestFailed] = useState(false);
+    const [guestPreloadDocument, setGuestPreloadDocument] = useState('');
+    const [guestAttempt, setGuestAttempt] = useState(0);
+    const guestHelloRef = useRef(false);
+    const preparingRef = useRef(false);
+    const preparedInitialUrlRef = useRef('');
+    useImperativeHandle(forwardedRef, () => nativeViewRef.current);
     const { path, history, changeCurrentIndex, resetHistory } =
       useQortalMessageListener(
-        frameWindow,
-        iframeRef,
         app?.tabId,
         isDevMode,
         isDevMode ? 'devapp' : app?.name,
-        app?.service,
-        app?.identifier
+        isDevMode ? 'APP' : app?.service,
+        app?.identifier,
+        nativeViewRef,
+        nativeGuestActive
       );
 
     const [url, setUrl] = useState('');
@@ -53,25 +60,132 @@ export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
     useEffect(() => {
       if (app?.isPreview && app?.url) {
         resetHistory();
-        setUrl(app.url + `&theme=${themeMode}&lang=${currentLang}`);
+        setUrl(
+          buildPreviewUrl(app.url, {
+            language: currentLang,
+            theme: themeMode,
+          })
+        );
       }
-    }, [app?.url, app?.isPreview]);
+    }, [app?.url, app?.isPreview, currentLang, resetHistory, themeMode]);
 
     const defaultUrl = useMemo(() => {
       return url;
     }, [url, isDevMode]);
 
+    const guestOwner = useMemo(
+      () => ({
+        tabId: String(app?.tabId ?? ''),
+        name: isDevMode ? 'devapp' : String(app?.name ?? ''),
+        service: isDevMode ? 'APP' : String(app?.service ?? ''),
+      }),
+      [app?.tabId, app?.name, app?.service, isDevMode]
+    );
+
+    useEffect(() => {
+      if (!defaultUrl || !guestOwner.tabId ||
+          !guestOwner.name || !guestOwner.service ||
+          preparingRef.current || preparedInitialUrlRef.current) return;
+      if (!window.electronAPI?.qappGuestPrepare) {
+        setNativeGuestFailed(true);
+        return;
+      }
+      preparingRef.current = true;
+      preparedInitialUrlRef.current = defaultUrl;
+      void window.electronAPI.qappGuestPrepare(
+        guestOwner,
+        defaultUrl,
+        isDevMode
+      ).then(setNativeConfig).catch(() => setNativeGuestFailed(true));
+    }, [defaultUrl, guestOwner, isDevMode, guestAttempt]);
+
+    const retryNativeGuest = () => {
+      guestHelloRef.current = false;
+      setNativeGuestActive(false);
+      setNativeGuestFailed(false);
+      setGuestPreloadDocument('');
+      if (!nativeConfig) {
+        preparingRef.current = false;
+        preparedInitialUrlRef.current = '';
+        setGuestAttempt((value) => value + 1);
+      }
+    };
+
+    useEffect(() => () => {
+      void window.electronAPI.qappGuestRelease(guestOwner).catch(() => undefined);
+    }, [guestOwner]);
+
+    useLayoutEffect(() => {
+      const view = nativeViewRef.current;
+      if (!nativeConfig || !view) return;
+      const preloadHello = (event) => {
+        if (event.target !== view) return;
+        if (event.channel === 'qapp:error') {
+          setNativeGuestFailed(true);
+          return;
+        }
+        if (event.channel !== 'qapp:hello') return;
+        const documentId = event.args?.[0]?.documentId;
+        if (typeof documentId === 'string' && /^[a-f0-9]{32}$/.test(documentId)) {
+          guestHelloRef.current = true;
+          setGuestPreloadDocument(documentId);
+          setNativeGuestActive(true);
+        }
+      };
+      const guestGone = () => setNativeGuestFailed(true);
+      const loadFailed = (event) => {
+        if (event.isMainFrame && event.errorCode !== -3)
+          setNativeGuestFailed(true);
+      };
+      view.addEventListener('ipc-message', preloadHello);
+      view.addEventListener('render-process-gone', guestGone);
+      view.addEventListener('did-fail-load', loadFailed);
+      const attachTimer = setTimeout(() => {
+        if (!guestHelloRef.current) setNativeGuestFailed(true);
+      }, 10_000);
+      // The guest is attached only after these listeners are registered.
+      if (defaultUrl && view.getAttribute('src') !== defaultUrl)
+        view.setAttribute('src', defaultUrl);
+      return () => {
+        clearTimeout(attachTimer);
+        view.removeEventListener('ipc-message', preloadHello);
+        view.removeEventListener('render-process-gone', guestGone);
+        view.removeEventListener('did-fail-load', loadFailed);
+      };
+    }, [nativeConfig, guestOwner, defaultUrl]);
+
+    useEffect(() => {
+      if (nativeGuestActive && guestPreloadDocument)
+        nativeViewRef.current?.send('qapp:ready', guestPreloadDocument);
+    }, [nativeGuestActive, guestPreloadDocument]);
+
+    const postToApp = useCallback((message) => {
+      if (nativeGuestActive) nativeViewRef.current?.send('qapp:event', message);
+    }, [nativeGuestActive]);
+
     const refreshAppFunc = (e) => {
       const { tabId } = e.detail;
       if (tabId === app?.tabId) {
+        if (app?.isPreview && app?.url) {
+          resetHistory();
+          setUrl(
+            buildPreviewUrl(app.url, {
+              cacheBuster: Date.now(),
+              language: currentLang,
+              theme: themeMode,
+            })
+          );
+          return;
+        }
         if (isDevMode) {
           resetHistory();
-          if (!app?.isPreview || app?.isPrivate) {
-            setUrl(
-              app?.url +
-                `?time=${Date.now()}&theme=${themeMode}&lang=${currentLang}`
-            );
-          }
+          setUrl(
+            buildPreviewUrl(app?.url, {
+              cacheBuster: Date.now(),
+              language: currentLang,
+              theme: themeMode,
+            })
+          );
           return;
         }
         const constructUrl = `${getBaseApiReact()}/render/${app?.service}/${app?.name}${path != null ? path : ''}?theme=${themeMode}&lang=${currentLang}&identifier=${app?.identifier != null ? app?.identifier : ''}&time=${new Date().getMilliseconds()}`;
@@ -88,38 +202,24 @@ export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
     }, [app, path, isDevMode, themeMode, currentLang]);
 
     useEffect(() => {
-      const iframe = iframeRef?.current;
-      if (!iframe || !iframe?.src) return;
-
       try {
-        const targetOrigin = new URL(iframe.src).origin;
-        iframe.contentWindow?.postMessage(
-          { action: 'THEME_CHANGED', theme: themeMode, requestedHandler: 'UI' },
-          targetOrigin
-        );
+        postToApp({ action: 'THEME_CHANGED', theme: themeMode, requestedHandler: 'UI' });
       } catch (err) {
-        console.error('Failed to send theme change to iframe:', err);
+        console.error('Failed to send theme change to Q-App:', err);
       }
-    }, [themeMode]);
+    }, [themeMode, postToApp]);
 
     useEffect(() => {
-      const iframe = iframeRef?.current;
-      if (!iframe || !iframe?.src) return;
-
       try {
-        const targetOrigin = new URL(iframe.src).origin;
-        iframe.contentWindow?.postMessage(
-          {
-            action: 'LANGUAGE_CHANGED',
-            language: currentLang,
-            requestedHandler: 'UI',
-          },
-          targetOrigin
-        );
+        postToApp({
+          action: 'LANGUAGE_CHANGED',
+          language: currentLang,
+          requestedHandler: 'UI',
+        });
       } catch (err) {
-        console.error('Failed to send language change to iframe:', err);
+        console.error('Failed to send language change to Q-App:', err);
       }
-    }, [currentLang]);
+    }, [currentLang, postToApp]);
 
     const removeTrailingSlash = (str) => str.replace(/\/$/, '');
 
@@ -153,8 +253,6 @@ export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
 
     const receiveChunksFunc = useCallback(
       (e) => {
-        const iframe = iframeRef?.current;
-        if (!iframe || !iframe?.src) return;
         if (app?.tabId !== e.detail?.tabId) return;
         const publishLocation = e.detail?.publishLocation;
         const chunksSubmitted = e.detail?.chunksSubmitted;
@@ -163,7 +261,7 @@ export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
         const filename = e.detail?.filename;
         try {
           if (publishLocation === undefined || publishLocation === null) return;
-          const dataToBeSent = {};
+          const dataToBeSent: Record<string, unknown> = {};
           if (chunksSubmitted !== undefined && chunksSubmitted !== null) {
             dataToBeSent.chunks = chunksSubmitted;
           }
@@ -176,22 +274,18 @@ export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
           if (filename !== undefined && filename !== null) {
             dataToBeSent.filename = filename;
           }
-          const targetOrigin = new URL(iframe.src).origin;
-          iframe.contentWindow?.postMessage(
-            {
-              action: 'PUBLISH_STATUS',
-              publishLocation,
-              ...dataToBeSent,
-              requestedHandler: 'UI',
-              processed: e.detail?.processed || false,
-            },
-            targetOrigin
-          );
+          postToApp({
+            action: 'PUBLISH_STATUS',
+            publishLocation,
+            ...dataToBeSent,
+            requestedHandler: 'UI',
+            processed: e.detail?.processed || false,
+          });
         } catch (err) {
-          console.error('Failed to send status to iframe:', err);
+          console.error('Failed to send status to Q-App:', err);
         }
       },
-      [iframeRef, app?.tabId]
+      [postToApp, app?.tabId]
     );
 
     useEffect(() => {
@@ -202,88 +296,42 @@ export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
       };
     }, [receiveChunksFunc]);
 
-    // Function to navigate back in iframe
-    const navigateBackInIframe = async () => {
-      const iframe = iframeRef.current;
-      if (iframe && iframe.contentWindow && history?.currentIndex > 0) {
-        // Calculate the previous index and path
-        const previousPageIndex = history.currentIndex - 1;
-        const previousPath = history.customQDNHistoryPaths[previousPageIndex];
-        let targetOrigin;
-        try {
-          targetOrigin = new URL(iframe.src).origin;
-        } catch {
-          return;
-        }
-        // Signal non-manual navigation
-        iframe.contentWindow.postMessage(
-          { action: 'PERFORMING_NON_MANUAL', currentIndex: previousPageIndex },
-          targetOrigin
-        );
-        // Update the current index locally
-        changeCurrentIndex(previousPageIndex);
-
-        // Create a navigation promise with a 200ms timeout
-        const navigationPromise = new Promise((resolve, reject) => {
-          function handleNavigationSuccess(event) {
-            if (
-              event.source === iframe.contentWindow &&
-              event.origin === targetOrigin &&
-              event.data?.action === 'NAVIGATION_SUCCESS' &&
-              event.data.path === previousPath
-            ) {
-              frameWindow.removeEventListener(
-                'message',
-                handleNavigationSuccess
-              );
-              resolve();
-            }
-          }
-
-          frameWindow.addEventListener('message', handleNavigationSuccess);
-
-          // Timeout after 200ms if no response
-          setTimeout(() => {
-            frameWindow.removeEventListener('message', handleNavigationSuccess);
-            reject(
-              new Error(
-                t('core:message.error.navigation_timeout', {
-                  postProcess: 'capitalizeFirstChar',
-                })
-              )
-            );
-          }, 200);
-          // Send the navigation command after setting up the listener and timeout
-          iframe.contentWindow.postMessage(
-            {
-              action: 'NAVIGATE_TO_PATH',
-              path: previousPath,
-              requestedHandler: 'UI',
-            },
-            targetOrigin
-          );
-        });
-
-        // Execute navigation promise and handle timeout fallback
-        try {
-          await navigationPromise;
-        } catch (error) {
-          if (isDevMode) {
-            setUrl(
-              `${url}${previousPath != null ? previousPath : ''}?theme=${themeMode}&lang=${currentLang}&time=${new Date().getMilliseconds()}&isManualNavigation=false`
-            );
-            return;
-          }
-          setUrl(
-            `${getBaseApiReact()}/render/${app?.service}/${app?.name}${previousPath != null ? previousPath : ''}?theme=${themeMode}&lang=${currentLang}&identifier=${app?.identifier != null && app?.identifier != 'null' ? app?.identifier : ''}&time=${new Date().getMilliseconds()}&isManualNavigation=false`
-          );
-          // iframeRef.current.contentWindow.location.href = previousPath; // Fallback URL update
-        }
+    const waitForNativeNavigation = (targetPath: string, timeoutMs: number) =>
+      new Promise<void>((resolve, reject) => {
+        const view = nativeViewRef.current;
+        if (!view || !nativeGuestActive) return reject(new Error('navigation_timeout'));
+        const onMessage = (event) => {
+          const data = event.args?.[0]?.data;
+          if (event.channel !== 'qapp:request' ||
+              data?.action !== 'NAVIGATION_SUCCESS' ||
+              data.path !== targetPath) return;
+          clearTimeout(timer);
+          view.removeEventListener('ipc-message', onMessage);
+          resolve();
+        };
+        view.addEventListener('ipc-message', onMessage);
+        const timer = setTimeout(() => {
+          view.removeEventListener('ipc-message', onMessage);
+          reject(new Error('navigation_timeout'));
+        }, timeoutMs);
+        postToApp({ action: 'NAVIGATE_TO_PATH', path: targetPath, requestedHandler: 'UI' });
+      });
+
+    const navigateBackInApp = async () => {
+      if (!nativeGuestActive || history?.currentIndex <= 0) return;
+      const previousPageIndex = history.currentIndex - 1;
+      const previousPath = history.customQDNHistoryPaths[previousPageIndex];
+      postToApp({ action: 'PERFORMING_NON_MANUAL', currentIndex: previousPageIndex });
+      changeCurrentIndex(previousPageIndex);
+      try {
+        await waitForNativeNavigation(previousPath, 1000);
+      } catch {
+        setUrl(`${getBaseApiReact()}/render/${app?.service}/${app?.name}${previousPath ?? ''}?theme=${themeMode}&lang=${currentLang}&identifier=${app?.identifier ?? ''}&time=${Date.now()}&isManualNavigation=false`);
       }
     };
 
     const navigateBackAppFunc = (e) => {
-      navigateBackInIframe();
+      navigateBackInApp();
     };
 
     useEffect(() => {
@@ -301,63 +349,15 @@ export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
     const navigateToPathFunc = useCallback(
       async (e) => {
         const { path: targetPath = '' } = e.detail;
-        const iframe = iframeRef.current;
-        if (!iframe?.contentWindow) return;
-
-        let targetOrigin;
-        try {
-          targetOrigin = new URL(iframe.src).origin;
-        } catch {
-          return;
-        }
-
-        const navigationPromise = new Promise((resolve, reject) => {
-          function handleNavigationSuccess(event) {
-            if (
-              event.source === iframe.contentWindow &&
-              event.origin === targetOrigin &&
-              event.data?.action === 'NAVIGATION_SUCCESS' &&
-              event.data.path === targetPath
-            ) {
-              frameWindow.removeEventListener(
-                'message',
-                handleNavigationSuccess
-              );
-              resolve(undefined);
-            }
-          }
-
-          frameWindow.addEventListener('message', handleNavigationSuccess);
-
-          setTimeout(() => {
-            frameWindow.removeEventListener('message', handleNavigationSuccess);
-            reject(new Error('navigation_timeout'));
-          }, 250);
-          iframe.contentWindow.postMessage(
-            {
-              action: 'NAVIGATE_TO_PATH',
-              path: targetPath,
-              requestedHandler: 'UI',
-            },
-            targetOrigin
-          );
-        });
-
         try {
-          await navigationPromise;
+          await waitForNativeNavigation(targetPath, 1000);
         } catch {
-          if (isDevMode) {
-            setUrl(
-              `${url}${targetPath}?theme=${themeMode}&lang=${currentLang}&time=${new Date().getMilliseconds()}&isManualNavigation=false`
-            );
-            return;
-          }
           setUrl(
             `${getBaseApiReact()}/render/${app?.service}/${app?.name}/${targetPath}?theme=${themeMode}&lang=${currentLang}&identifier=${app?.identifier != null && app?.identifier != 'null' ? app?.identifier : ''}&time=${new Date().getMilliseconds()}&isManualNavigation=false`
           );
         }
       },
-      [app, frameWindow, iframeRef, isDevMode, url, themeMode, currentLang]
+      [app, themeMode, currentLang, postToApp, nativeGuestActive]
     );
 
     useEffect(() => {
@@ -372,25 +372,12 @@ export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
       };
     }, [app?.tabId, navigateToPathFunc]);
 
-    // Function to navigate back in iframe
-    const navigateForwardInIframe = async () => {
-      if (iframeRef.current && iframeRef.current.contentWindow) {
-        const targetOrigin = iframeRef.current
-          ? new URL(iframeRef.current.src).origin
-          : '*';
-        iframeRef.current.contentWindow.postMessage(
-          { action: 'NAVIGATE_FORWARD' },
-          targetOrigin
-        );
-      }
-    };
-
     return (
       <Box
         sx={{
           display: 'flex',
           flexDirection: 'column',
-          height: '100vh',
+          height: '100%',
           minHeight: 0,
           overflow: 'hidden',
           overflowAnchor: 'none',
@@ -398,27 +385,29 @@ export const AppViewer = forwardRef<HTMLIFrameElement, AppViewerProps>(
           width: '100%',
         }}
       >
-        <iframe
-          ref={iframeRef}
-          style={{
-            border: 'none',
-            contain: 'layout paint style',
-            display: 'block',
-            flex: '0 0 auto',
-            height: '100vh',
-            isolation: 'isolate',
-            minHeight: 0,
-            overflow: 'hidden',
-            overflowAnchor: 'none',
-            overscrollBehavior: 'none',
-            width: '100%',
-          }}
-          id="browser-iframe"
-          tabIndex={-1}
-          src={defaultUrl}
-          sandbox="allow-scripts allow-same-origin allow-forms allow-downloads allow-modals"
-          allow="fullscreen; clipboard-read; clipboard-write; screen-wake-lock"
-        ></iframe>
+        {nativeConfig && !nativeGuestFailed ? createElement('webview' as any, {
+            ref: nativeViewRef,
+            partition: nativeConfig.partition,
+            preload: nativeConfig.preload,
+            webpreferences: 'contextIsolation=yes,nodeIntegration=no,sandbox=yes,webviewTag=no',
+            style: {
+              border: 'none',
+              // A webview needs flex sizing; otherwise its internal document
+              // falls back to the browser's default 150px viewport height.
+              display: 'flex',
+              flex: '1 1 auto',
+              height: '100%',
+              minHeight: 0,
+              width: '100%',
+            },
+          }) : nativeGuestFailed ? (
+            <Box sx={{ p: 2 }} role="alert">
+              {t('core:message.error.generic', { postProcess: 'capitalizeFirstChar' })}
+              <Button onClick={retryNativeGuest}>
+                {t('core:retry', { postProcess: 'capitalizeFirstChar' })}
+              </Button>
+            </Box>
+          ) : null}
       </Box>
     );
   }
diff --git a/src/components/Apps/AppViewerContainer.tsx b/src/components/Apps/AppViewerContainer.tsx
index 6823cb03c..59a620bb8 100644
--- a/src/components/Apps/AppViewerContainer.tsx
+++ b/src/components/Apps/AppViewerContainer.tsx
@@ -1,6 +1,6 @@
 import { forwardRef } from 'react';
 import { AppViewer } from './AppViewer';
-import Frame from 'react-frame-component';
+import { Box } from '@mui/material';
 import { appChromeOffsetPx } from '../Desktop/CustomTitleBar';
 
 type AppViewerContainerProps = {
@@ -16,73 +16,30 @@ const AppViewerContainer = forwardRef<
   AppViewerContainerProps
 >(({ app, isSelected, hide, isDevMode, customHeight }, ref) => {
   const isHidden = !isSelected || hide;
+  const style = {
+    border: 'none',
+    contain: 'layout paint style',
+    display: 'block',
+    height: customHeight || `calc(100vh - ${appChromeOffsetPx})`,
+    isolation: 'isolate',
+    left: isHidden ? '-200vw' : '0',
+    minHeight: 0,
+    overflow: 'hidden',
+    overflowAnchor: 'none',
+    overscrollBehavior: 'none',
+    position: isHidden ? 'absolute' : 'relative',
+    top: 0,
+    width: '100%',
+  } as const;
 
   return (
-    <Frame
-      id={`browser-iframe-${app?.tabId}`}
-      head={
-        <>
-          <style>
-            {`
-              html,
-              body {
-                height: 100%;
-                margin: 0;
-                padding: 0;
-                overflow: hidden;
-                overscroll-behavior: none;
-                overflow-anchor: none;
-                position: fixed;
-                inset: 0;
-                width: 100%;
-              }
-              .frame-root,
-              .frame-content {
-                display: flex;
-                flex-direction: column;
-                height: 100%;
-                min-height: 0;
-                overflow: hidden;
-                overscroll-behavior: none;
-                overflow-anchor: none;
-                width: 100%;
-              }
-              * {
-                box-sizing: border-box;
-                -ms-overflow-style: none; /* IE and Edge */
-                scrollbar-width: none;  /* Firefox */
-              }
-              *::-webkit-scrollbar {
-                display: none;  /* Chrome, Safari, Opera */
-              }
-            `}
-          </style>
-        </>
-      }
-      style={{
-        border: 'none',
-        contain: 'layout paint style',
-        display: 'block',
-        height: customHeight || `calc(100vh - ${appChromeOffsetPx})`,
-        isolation: 'isolate',
-        left: isHidden ? '-200vw' : '0',
-        minHeight: 0,
-        overflow: 'hidden',
-        overflowAnchor: 'none',
-        overscrollBehavior: 'none',
-        position: isHidden ? 'absolute' : 'relative',
-        top: 0,
-        width: '100%',
-      }}
-      tabIndex={-1}
-    >
+    <Box sx={style}>
       <AppViewer
         app={app}
-        hide={!isSelected || hide}
         isDevMode={isDevMode}
         ref={ref}
       />
-    </Frame>
+    </Box>
   );
 });
 
diff --git a/src/components/Apps/AppsDesktop.tsx b/src/components/Apps/AppsDesktop.tsx
index 98cc915dd..4ececde71 100644
--- a/src/components/Apps/AppsDesktop.tsx
+++ b/src/components/Apps/AppsDesktop.tsx
@@ -925,6 +925,26 @@ export const AppsDesktop = ({
     };
   }, [tabs]);
 
+  const updateAppUrlFunc = useCallback((e) => {
+    const { tabId, url } = e.detail ?? {};
+    if (!tabId || !url) return;
+
+    setTabs((currentTabs) =>
+      currentTabs.map((tab) => (tab?.tabId === tabId ? { ...tab, url } : tab))
+    );
+    setSelectedTab((currentTab) =>
+      currentTab?.tabId === tabId ? { ...currentTab, url } : currentTab
+    );
+  }, []);
+
+  useEffect(() => {
+    subscribeToEvent('updateAppUrl', updateAppUrlFunc);
+
+    return () => {
+      unsubscribeFromEvent('updateAppUrl', updateAppUrlFunc);
+    };
+  }, [updateAppUrlFunc]);
+
   const setSelectedTabFunc = (e) => {
     const data = e.detail?.data;
     const isDev = e.detail?.isDevMode;
diff --git a/src/components/Apps/AppsPrivate.tsx b/src/components/Apps/AppsPrivate.tsx
index e74010264..4630d8c6b 100644
--- a/src/components/Apps/AppsPrivate.tsx
+++ b/src/components/Apps/AppsPrivate.tsx
@@ -47,6 +47,7 @@ import {
 import { useTranslation } from 'react-i18next';
 import { useSortedMyNames } from '../../hooks/useSortedMyNames';
 import { Label } from '../../styles/App-styles.ts';
+import { filterPrivateGroups } from './privateGroups';
 
 const maxFileSize = 50 * 1024 * 1024; // 50MB
 
@@ -65,8 +66,9 @@ export const AppsPrivate = ({ myName, myAddress }) => {
   const [myGroupsWhereIAmAdminFromGlobal] = useAtom(myGroupsWhereIAmAdminAtom);
 
   const myGroupsWhereIAmAdmin = useMemo(() => {
-    return myGroupsWhereIAmAdminFromGlobal?.filter(
-      (group) => groupsProperties[group?.groupId]?.isOpen === false
+    return filterPrivateGroups(
+      myGroupsWhereIAmAdminFromGlobal,
+      groupsProperties
     );
   }, [myGroupsWhereIAmAdminFromGlobal, groupsProperties]);
 
@@ -80,9 +82,7 @@ export const AppsPrivate = ({ myName, myAddress }) => {
   const { t } = useTranslation(['auth', 'core', 'group', 'question']);
 
   const myGroupsPrivate = useMemo(() => {
-    return memberGroups?.filter(
-      (group) => groupsProperties[group?.groupId]?.isOpen === false
-    );
+    return filterPrivateGroups(memberGroups, groupsProperties);
   }, [memberGroups, groupsProperties]);
 
   const [privateAppValues, setPrivateAppValues] = useState({
@@ -463,15 +463,13 @@ export const AppsPrivate = ({ myName, myAddress }) => {
                       })}
                     </MenuItem>
 
-                    {myGroupsPrivate
-                      ?.filter((item) => !item?.isOpen)
-                      .map((group) => {
-                        return (
-                          <MenuItem key={group?.groupId} value={group?.groupId}>
-                            {group?.groupName}
-                          </MenuItem>
-                        );
-                      })}
+                    {myGroupsPrivate?.map((group) => {
+                      return (
+                        <MenuItem key={group?.groupId} value={group?.groupId}>
+                          {group?.groupName}
+                        </MenuItem>
+                      );
+                    })}
                   </Select>
                 </Box>
 
@@ -680,15 +678,13 @@ export const AppsPrivate = ({ myName, myAddress }) => {
                       })}
                     </MenuItem>
 
-                    {myGroupsWhereIAmAdmin
-                      ?.filter((item) => !item?.isOpen)
-                      .map((group) => {
-                        return (
-                          <MenuItem key={group?.groupId} value={group?.groupId}>
-                            {group?.groupName}
-                          </MenuItem>
-                        );
-                      })}
+                    {myGroupsWhereIAmAdmin?.map((group) => {
+                      return (
+                        <MenuItem key={group?.groupId} value={group?.groupId}>
+                          {group?.groupName}
+                        </MenuItem>
+                      );
+                    })}
                   </Select>
                 </Box>
 
diff --git a/src/components/Apps/QAppScreenCapturePermission.tsx b/src/components/Apps/QAppScreenCapturePermission.tsx
new file mode 100644
index 000000000..af06ae699
--- /dev/null
+++ b/src/components/Apps/QAppScreenCapturePermission.tsx
@@ -0,0 +1,79 @@
+import { useEffect, useRef, useState } from 'react';
+import {
+  Button,
+  Dialog,
+  DialogActions,
+  DialogContent,
+  DialogTitle,
+  Typography,
+} from '@mui/material';
+import { useTranslation } from 'react-i18next';
+
+type Request = { requestId: string; origin: string };
+
+export function QAppScreenCapturePermission({ active }: { active: boolean }) {
+  const { t } = useTranslation(['question', 'core']);
+  const [request, setRequest] = useState<Request | null>(null);
+  const pending = useRef<Request | null>(null);
+  useEffect(() => {
+    const api = window.electronAPI;
+    const stop = api?.onDisplayMediaRequest?.((value) => {
+      if (!active) {
+        api.authorizeDisplayMedia?.(value.requestId, false);
+        return;
+      }
+      pending.current = value;
+      setRequest(value);
+    });
+    const stopCancel = api?.onDisplayMediaCancel?.((id) => {
+      if (pending.current?.requestId === id) {
+        pending.current = null;
+        setRequest(null);
+      }
+    });
+    return () => {
+      stop?.();
+      stopCancel?.();
+      if (pending.current)
+        api?.authorizeDisplayMedia?.(pending.current.requestId, false);
+      pending.current = null;
+      setRequest(null);
+    };
+  }, [active]);
+  const answer = (accepted: boolean) => {
+    if (request)
+      window.electronAPI?.authorizeDisplayMedia?.(request.requestId, accepted);
+    pending.current = null;
+    setRequest(null);
+  };
+  return (
+    <Dialog
+      open={!!request && active}
+      onClose={() => answer(false)}
+      maxWidth="sm"
+      fullWidth
+      aria-labelledby="display-capture-title"
+    >
+      <DialogTitle id="display-capture-title">
+        {t('question:permission.screen_capture_title')}
+      </DialogTitle>
+      <DialogContent>
+        <Typography sx={{ overflowWrap: 'anywhere' }}>
+          {t('question:permission.screen_capture_description', {
+            origin: request?.origin,
+          })}
+        </Typography>
+      </DialogContent>
+      <DialogActions>
+        <Button autoFocus onClick={() => answer(false)}>
+          {t('core:action.cancel', { postProcess: 'capitalizeFirstChar' })}
+        </Button>
+        <Button onClick={() => answer(true)}>
+          {t('question:permission.notification_allow', {
+            postProcess: 'capitalizeFirstChar',
+          })}
+        </Button>
+      </DialogActions>
+    </Dialog>
+  );
+}
diff --git a/src/components/Apps/__tests__/appPreviewUrl.test.ts b/src/components/Apps/__tests__/appPreviewUrl.test.ts
new file mode 100644
index 000000000..4ce3f0fad
--- /dev/null
+++ b/src/components/Apps/__tests__/appPreviewUrl.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest';
+import { buildPreviewUrl } from '../appPreviewUrl';
+
+describe('buildPreviewUrl', () => {
+  it('preserves a private preview secret when adding viewer settings', () => {
+    const result = buildPreviewUrl(
+      'http://localhost:12391/render/hash/example?secret=private-token',
+      {
+        language: 'en',
+        theme: 'dark',
+      }
+    );
+
+    expect(result).toBe(
+      'http://localhost:12391/render/hash/example?secret=private-token&theme=dark&lang=en'
+    );
+  });
+
+  it('adds a cache buster without replacing the preview route', () => {
+    const result = buildPreviewUrl(
+      'http://localhost:12391/render/hash/example?secret=private-token',
+      {
+        cacheBuster: 123456,
+        language: 'de',
+        theme: 'light',
+      }
+    );
+
+    expect(result).toBe(
+      'http://localhost:12391/render/hash/example?secret=private-token&theme=light&lang=de&time=123456'
+    );
+    expect(result).not.toContain('/render/DOCUMENT/');
+  });
+
+  it('starts a query string when the preview URL has no parameters', () => {
+    expect(
+      buildPreviewUrl('http://localhost:12391/render/hash/example', {
+        language: 'en',
+        theme: 'dark',
+      })
+    ).toBe('http://localhost:12391/render/hash/example?theme=dark&lang=en');
+  });
+});
diff --git a/src/components/Apps/__tests__/privateGroups.test.ts b/src/components/Apps/__tests__/privateGroups.test.ts
new file mode 100644
index 000000000..5fa974342
--- /dev/null
+++ b/src/components/Apps/__tests__/privateGroups.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest';
+import { filterPrivateGroups } from '../privateGroups';
+
+describe('filterPrivateGroups', () => {
+  it('keeps private admin groups that are absent from the member-group cache', () => {
+    const groups = [
+      { groupId: 1, groupName: 'Cached private', isOpen: false },
+      { groupId: 2, groupName: 'Admin-only private', isOpen: false },
+    ];
+    const groupsProperties = {
+      1: { isOpen: false },
+    };
+
+    expect(filterPrivateGroups(groups, groupsProperties)).toEqual(groups);
+  });
+
+  it('uses cached privacy when the group does not include it', () => {
+    const privateGroup = { groupId: '3', groupName: 'Private' };
+    const publicGroup = { groupId: 4, groupName: 'Public' };
+
+    expect(
+      filterPrivateGroups([privateGroup, publicGroup], {
+        3: { isOpen: false },
+        4: { isOpen: true },
+      })
+    ).toEqual([privateGroup]);
+  });
+
+  it('does not let stale cached metadata override group data', () => {
+    const publicGroup = { groupId: 5, groupName: 'Public', isOpen: true };
+
+    expect(
+      filterPrivateGroups([publicGroup], {
+        5: { isOpen: false },
+      })
+    ).toEqual([]);
+  });
+});
diff --git a/src/components/Apps/appPreviewUrl.ts b/src/components/Apps/appPreviewUrl.ts
new file mode 100644
index 000000000..0665cacad
--- /dev/null
+++ b/src/components/Apps/appPreviewUrl.ts
@@ -0,0 +1,24 @@
+type PreviewUrlOptions = {
+  cacheBuster?: number;
+  language: string;
+  theme: string;
+};
+
+export const buildPreviewUrl = (
+  url: string,
+  { cacheBuster, language, theme }: PreviewUrlOptions
+): string => {
+  const query = new URLSearchParams({
+    theme,
+    lang: language,
+  });
+
+  if (cacheBuster != null) {
+    query.set('time', String(cacheBuster));
+  }
+
+  const separator =
+    url.endsWith('?') || url.endsWith('&') ? '' : url.includes('?') ? '&' : '?';
+
+  return `${url}${separator}${query.toString()}`;
+};
diff --git a/src/components/Apps/privateGroups.ts b/src/components/Apps/privateGroups.ts
new file mode 100644
index 000000000..d9fc60f70
--- /dev/null
+++ b/src/components/Apps/privateGroups.ts
@@ -0,0 +1,27 @@
+type GroupWithPrivacy = {
+  groupId?: number | string;
+  isOpen?: boolean;
+};
+
+type GroupProperties = Record<
+  string,
+  {
+    isOpen?: boolean;
+  }
+>;
+
+export const filterPrivateGroups = <T extends GroupWithPrivacy>(
+  groups: T[] | null | undefined,
+  groupsProperties: GroupProperties | null | undefined
+): T[] => {
+  return (groups ?? []).filter((group) => {
+    const cachedIsOpen =
+      group.groupId == null
+        ? undefined
+        : groupsProperties?.[String(group.groupId)]?.isOpen;
+    const isOpen =
+      typeof group.isOpen === 'boolean' ? group.isOpen : cachedIsOpen;
+
+    return isOpen === false;
+  });
+};
diff --git a/src/components/Chat/ChatGroup.blockIsolation.test.ts b/src/components/Chat/ChatGroup.blockIsolation.test.ts
new file mode 100644
index 000000000..65f804f1d
--- /dev/null
+++ b/src/components/Chat/ChatGroup.blockIsolation.test.ts
@@ -0,0 +1,158 @@
+import { runInNewContext } from 'node:vm';
+import ts from 'typescript';
+import { describe, expect, it, vi } from 'vitest';
+import componentSource from './ChatGroup.tsx?raw';
+import { buildReticulumInitialHistoryState } from './reticulumInitialHistory';
+import { projectReticulumReactionReferences } from '../../utils/reticulumReactionProjection';
+
+// Exercise the component's actual callback wiring without mounting its native
+// transports, editors, and providers. Testing only the history reducer would
+// miss this regression: it was the caller supplying the wrong exclusion policy.
+const source = ts.createSourceFile(
+  'ChatGroup.tsx',
+  componentSource,
+  ts.ScriptTarget.Latest,
+  true,
+  ts.ScriptKind.TSX
+);
+
+const findNodes = (predicate: (node: ts.Node) => boolean) => {
+  const found: ts.Node[] = [];
+  const visit = (node: ts.Node) => {
+    if (predicate(node)) found.push(node);
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return found;
+};
+
+const evaluate = (node: ts.Node, scope: Record<string, unknown>) =>
+  runInNewContext(
+    ts.transpileModule(`(${node.getText(source)})`, {
+      compilerOptions: { target: ts.ScriptTarget.ES2020 },
+    }).outputText,
+    scope
+  );
+
+const callback = (name: string, scope: Record<string, unknown>) => {
+  const declarations = findNodes(
+    (node) =>
+      ts.isVariableDeclaration(node) && node.name.getText(source) === name
+  ) as ts.VariableDeclaration[];
+  expect(declarations).toHaveLength(1);
+  const initializer = declarations[0].initializer as ts.CallExpression;
+  return evaluate(initializer.arguments[0], scope);
+};
+
+const parent = {
+  signature: 'parent',
+  eventType: 'message',
+  sender: 'PolarBear',
+  message: 'Original message',
+};
+const reply = {
+  signature: 'reply',
+  eventType: 'message',
+  sender: 'Other',
+  message: 'Reply',
+  repliedTo: 'parent',
+};
+
+const visibility = (hidden = false) => ({
+  // A node-wide legacy block must not even be consulted by Reticulum.
+  isChatSenderBlocked: vi.fn((item) => item?.sender === parent.sender),
+  isReticulumHiddenAuthor: (address: unknown) =>
+    hidden && address === parent.sender,
+});
+
+describe('ChatGroup transport block isolation', () => {
+  it.each([false, true])(
+    'uses only Reticulum hiding in initial and incremental history (hidden=%s)',
+    (hidden) => {
+      const predicates = findNodes(
+        (node) =>
+          ts.isPropertyAssignment(node) &&
+          node.name.getText(source) === 'shouldExclude'
+      ) as ts.PropertyAssignment[];
+      expect(predicates).toHaveLength(2);
+      for (const predicate of predicates) {
+        const scope = visibility(hidden);
+        const shouldExclude = evaluate(predicate.initializer, scope);
+        const result = buildReticulumInitialHistoryState([parent, reply], {
+          shouldExclude,
+        });
+        expect(result.messages.map((item) => item.signature)).toEqual(
+          hidden ? ['reply'] : ['parent', 'reply']
+        );
+        expect(scope.isChatSenderBlocked).not.toHaveBeenCalled();
+      }
+    }
+  );
+
+  it.each([false, true])(
+    'uses only Reticulum hiding for live messages (hidden=%s)',
+    (hidden) => {
+      const scope = visibility(hidden);
+      let messages = [];
+      const apply = callback('applyReticulumChatItem', {
+        ...scope,
+        setMessages: (update) => {
+          messages = update(messages);
+        },
+      });
+      apply(parent);
+      apply(reply);
+      expect(messages.map((item) => item.signature)).toEqual(
+        hidden ? ['reply'] : ['parent', 'reply']
+      );
+      expect(scope.isChatSenderBlocked).not.toHaveBeenCalled();
+    }
+  );
+
+  it.each([false, true])(
+    'uses only Reticulum hiding for reactions (hidden=%s)',
+    (hidden) => {
+      const scope = visibility(hidden);
+      const project = callback('reticulumReactionReferences', {
+        ...scope,
+        reticulumChatEnabled: true,
+        projectReticulumReactionReferences,
+        reticulumChatEvents: [
+          {
+            eventId: 'reaction',
+            eventType: 'reaction_add',
+            authorAddress: parent.sender,
+            targetEventId: parent.signature,
+            timestamp: 1,
+            encryptedPayload: JSON.stringify({ content: '👍' }),
+          },
+        ],
+      });
+      const references = project();
+      expect(Object.keys(references)).toEqual(hidden ? [] : ['parent']);
+      expect(scope.isChatSenderBlocked).not.toHaveBeenCalled();
+    }
+  );
+
+  it.each([false, true])(
+    'limits Core block-update events to legacy chat (Reticulum=%s)',
+    (reticulumChatEnabled) => {
+      const scope = visibility();
+      let messages = [parent, reply];
+      const onBlockUpdate = callback('updateChatMessagesWithBlocksFunc', {
+        ...scope,
+        reticulumChatEnabled,
+        setMessages: (update) => {
+          messages = update(messages);
+        },
+      });
+      onBlockUpdate({ detail: true });
+      expect(messages.map((item) => item.signature)).toEqual(
+        reticulumChatEnabled ? ['parent', 'reply'] : ['reply']
+      );
+      expect(scope.isChatSenderBlocked).toHaveBeenCalledTimes(
+        reticulumChatEnabled ? 0 : 2
+      );
+    }
+  );
+});
diff --git a/src/components/Chat/ChatGroup.tsx b/src/components/Chat/ChatGroup.tsx
index c0df9702a..a011951b9 100644
--- a/src/components/Chat/ChatGroup.tsx
+++ b/src/components/Chat/ChatGroup.tsx
@@ -2779,12 +2779,10 @@ export const ChatGroup = ({
     return projectReticulumReactionReferences(
       reticulumChatEvents.filter(
         (event: any) =>
-          !isChatSenderBlocked({ sender: event?.authorAddress }) &&
           !isReticulumHiddenAuthor(event?.authorAddress)
       )
     );
   }, [
-    isChatSenderBlocked,
     isReticulumHiddenAuthor,
     reticulumChatEnabled,
     reticulumChatEvents,
@@ -3742,13 +3740,14 @@ export const ChatGroup = ({
 
   const updateChatMessagesWithBlocksFunc = useCallback(
     (e) => {
-      if (e.detail) {
+      // Core block lists apply only to legacy Q-Chat. Reticulum uses silences.
+      if (e.detail && !reticulumChatEnabled) {
         setMessages((prev) =>
           prev?.filter((item) => !isChatSenderBlocked(item))
         );
       }
     },
-    [isChatSenderBlocked]
+    [isChatSenderBlocked, reticulumChatEnabled]
   );
 
   useEffect(() => {
@@ -4627,12 +4626,7 @@ export const ChatGroup = ({
 
   const applyReticulumChatItem = useCallback(
     (item) => {
-      if (
-        !item ||
-        isChatSenderBlocked(item) ||
-        isReticulumHiddenAuthor(item?.sender)
-      )
-        return;
+      if (!item || isReticulumHiddenAuthor(item?.sender)) return;
       const targetReference = item.chatReference;
       const itemType =
         item?.eventType || item?.decryptedData?.type || item?.type;
@@ -4687,11 +4681,7 @@ export const ChatGroup = ({
         ? processWithNewMessages([item], reticulumChatQueueId)
         : [item];
       const nextItem = processed?.[0] || item;
-      if (
-        isChatSenderBlocked(nextItem) ||
-        isReticulumHiddenAuthor(nextItem?.sender)
-      )
-        return;
+      if (isReticulumHiddenAuthor(nextItem?.sender)) return;
 
       if (
         targetReference &&
@@ -4779,12 +4769,7 @@ export const ChatGroup = ({
         return [...prev, nextItem];
       });
     },
-    [
-      isChatSenderBlocked,
-      isReticulumHiddenAuthor,
-      processWithNewMessages,
-      reticulumChatQueueId,
-    ]
+    [isReticulumHiddenAuthor, processWithNewMessages, reticulumChatQueueId]
   );
 
   const convertReticulumEventToChatItem = useCallback(
@@ -5659,7 +5644,6 @@ export const ChatGroup = ({
           conversionResults.map((result) => result.item),
           {
             shouldExclude: (item) =>
-              isChatSenderBlocked(item) ||
               isReticulumHiddenAuthor(item?.sender),
             reconcileItem: (item) => {
               const specialId = reticulumHistoryItemSpecialId(item);
@@ -5763,7 +5747,7 @@ export const ChatGroup = ({
           initialMessages: messages,
           initialChatReferences: chatReferences,
           shouldExclude: (item) =>
-            isChatSenderBlocked(item) || isReticulumHiddenAuthor(item?.sender),
+            isReticulumHiddenAuthor(item?.sender),
           reconcileItem: (item) => {
             const specialId = reticulumHistoryItemSpecialId(item);
             const hasPendingOptimisticMatch = Boolean(
@@ -5817,7 +5801,6 @@ export const ChatGroup = ({
   }, [
     chatReferences,
     convertReticulumEventToChatItem,
-    isChatSenderBlocked,
     isReticulumHiddenAuthor,
     messages,
     processWithNewMessages,
diff --git a/src/components/Group/Group.tsx b/src/components/Group/Group.tsx
index 66822b41b..3be4b4c5a 100644
--- a/src/components/Group/Group.tsx
+++ b/src/components/Group/Group.tsx
@@ -3562,7 +3562,6 @@ export const Group = ({
     setIsLoadingThreadKey(false);
     setFirstSecretKeyInCreation(false);
     setMountedLandGroupId(null);
-    setReticulumMountedGroupSections({});
     setNotificationReticulumChannelId('');
     setNotificationReticulumMessageId('');
     setGroupSection('home');
diff --git a/src/constants/constants.ts b/src/constants/constants.ts
index 6a34ce729..a46a86f95 100644
--- a/src/constants/constants.ts
+++ b/src/constants/constants.ts
@@ -204,8 +204,6 @@ export const HTTPS_EXT_NODE_QORTAL_LINK: string =
 
 export const HTTP_LOCALHOST_12391: string = 'http://127.0.0.1:12391';
 export const HTTPS_LOCALHOST_12391: string = 'https://127.0.0.1:12391';
-export const HTTPS_QORT_TRADE: string = 'https://www.qort.trade';
-export const HTTPS_TRADE_NODE: string = 'https://appnode.qortal.org';
 export const LOCALHOST: string = '127.0.0.1';
 export const LOCALHOST_12391: string = '127.0.0.1:12391';
 
diff --git a/src/hooks/useHandlePrivateApps.tsx b/src/hooks/useHandlePrivateApps.tsx
index 27d80322f..13cc96790 100644
--- a/src/hooks/useHandlePrivateApps.tsx
+++ b/src/hooks/useHandlePrivateApps.tsx
@@ -139,53 +139,54 @@ export const useHandlePrivateApps = () => {
             }),
           });
 
-          const endpoint = await createEndpoint(
-            `/arbitrary/APP/${privateAppProperties?.name}/zip?preview=true`
-          );
+          const buildPrivatePreview = async () => {
+            const endpoint = await createEndpoint(
+              `/arbitrary/APP/${privateAppProperties?.name}/zip?preview=true`
+            );
+            const response = await fetch(endpoint, {
+              method: 'POST',
+              headers: {
+                'Content-Type': 'text/plain',
+              },
+              body: UintToObject?.app,
+            });
 
-          const response = await fetch(endpoint, {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'text/plain',
-            },
-            body: UintToObject?.app,
-          });
+            if (!response.ok) {
+              throw new Error(
+                t('core:message.error.build_app', {
+                  postProcess: 'capitalizeFirstChar',
+                })
+              );
+            }
 
-          const previewPath = await response.text();
+            return createEndpoint(await response.text());
+          };
 
-          const refreshfunc = async (tabId, privateAppProperties) => {
-            const checkIfPreviewLinkStillWorksUrl = await createEndpoint(
-              `/render/hash/HmtnZpcRPwisMfprUXuBp27N2xtv5cDiQjqGZo8tbZS?secret=E39WTiG4qBq3MFcMPeRZabtQuzyfHg9ZuR5SgY7nW1YH`
-            );
-            const res = await fetch(checkIfPreviewLinkStillWorksUrl);
-            if (res.ok) {
-              executeEvent('refreshApp', {
-                tabId: tabId,
-              });
-            } else {
-              const endpoint = await createEndpoint(
-                `/arbitrary/APP/${privateAppProperties?.name}/zip?preview=true`
-              );
+          const previewUrl = await buildPrivatePreview();
 
-              const response = await fetch(endpoint, {
-                method: 'POST',
-                headers: {
-                  'Content-Type': 'text/plain',
-                },
-                body: UintToObject?.app,
+          const refreshFunc = async (tabId) => {
+            try {
+              setOpenSnackGlobal(true);
+              setInfoSnackCustom({
+                type: 'info',
+                message: t('core:message.generic.building_app', {
+                  postProcess: 'capitalizeFirstChar',
+                }),
               });
-
-              const previewPath = await response.text();
               executeEvent('updateAppUrl', {
-                tabId: tabId,
-                url: await createEndpoint(previewPath),
+                tabId,
+                url: await buildPrivatePreview(),
+              });
+            } catch (error) {
+              setOpenSnackGlobal(true);
+              setInfoSnackCustom({
+                type: 'error',
+                message:
+                  error?.message ||
+                  t('core:message.error.build_app', {
+                    postProcess: 'capitalizeFirstChar',
+                  }),
               });
-
-              setTimeout(() => {
-                executeEvent('refreshApp', {
-                  tabId: tabId,
-                });
-              }, 300);
             }
           };
 
@@ -198,13 +199,13 @@ export const useHandlePrivateApps = () => {
             identifier: privateAppProperties?.identifier,
             name: privateAppProperties?.name,
             service: privateAppProperties?.service,
-            url: await createEndpoint(previewPath),
+            url: previewUrl,
             isPreview: true,
             isPrivate: true,
             privateAppProperties: { ...privateAppProperties, logo, appName },
             filePath: '',
             refreshFunc: (tabId) => {
-              refreshfunc(tabId, privateAppProperties);
+              void refreshFunc(tabId);
             },
           };
           executeEvent('addTab', {
diff --git a/src/hooks/useQortalMessageListener.tsx b/src/hooks/useQortalMessageListener.tsx
index f4b8e73ae..a0f7ee4e6 100644
--- a/src/hooks/useQortalMessageListener.tsx
+++ b/src/hooks/useQortalMessageListener.tsx
@@ -17,6 +17,25 @@ import {
   TIME_SECONDS_30_IN_MILLISECONDS,
 } from '../constants/constants';
 import { buildQortalResourceLink } from '../utils/qortalLink';
+import {
+  dispatchQAppReticulumRequest,
+  isQAppReticulumAction,
+} from '../qortal/qapp-reticulum-request';
+import {
+  dispatchQAppPrivateChannelRequest,
+  isQAppPrivateChannelAction,
+} from '../qortal/qapp-private-channel-request';
+import {
+  dispatchQAppMoqRequest,
+  isQAppMoqAction,
+} from '../qortal/qapp-moq-request';
+import { normalizeQappIdentityContext } from '../qortal/qapp-identity';
+import { dispatchQAppScreenCaptureRequest } from '../qortal/qapp-screen-capture-request';
+import {
+  dispatchQAppFileSaveRequest,
+  isQAppFileSaveAction,
+} from '../qortal/qapp-file-save-request';
+import { serializeQortalRequestError } from '../qortal/qortal-request-errors';
 
 export const saveFileInChunks = async (
   blob: Blob,
@@ -178,6 +197,24 @@ export function openIndexedDB() {
 }
 
 export const listOfAllQortalRequests = [
+  'FILE_SAVE_OPEN',
+  'FILE_SAVE_WRITE',
+  'FILE_SAVE_FINISH',
+  'FILE_SAVE_ABORT',
+  'SCREEN_CAPTURE_SELECT',
+  'RNS_CLOSE',
+  'RNS_CONNECT',
+  'RNS_REQUEST',
+  'RNS_SEND',
+  'PRIVATE_CHANNEL_CLOSE',
+  'PRIVATE_CHANNEL_OPEN',
+  'PRIVATE_CHANNEL_SEND',
+  'PRIVATE_CHANNEL_STATUS',
+  'MOQ_OBJECT_PUBLISH',
+  'MOQ_SESSION_CLOSE',
+  'MOQ_SESSION_METRICS',
+  'MOQ_SESSION_OPEN',
+  'MOQ_TRACK_SUBSCRIBE',
   'ADD_FOREIGN_SERVER',
   'ADD_GROUP_ADMIN',
   'ADD_LIST_ITEMS',
@@ -272,6 +309,7 @@ export const listOfAllQortalRequests = [
   'SHOW_ACTIONS',
   'SHOW_PDF_READER',
   'SIGN_FOREIGN_FEES',
+  'SIGN_QAPP_IDENTITY',
   'SIGN_TRANSACTION',
   'START_CROSSCHAIN_SERVER',
   'TRANSFER_ASSET',
@@ -285,6 +323,24 @@ export const listOfAllQortalRequests = [
 ];
 
 export const UIQortalRequests = [
+  'FILE_SAVE_OPEN',
+  'FILE_SAVE_WRITE',
+  'FILE_SAVE_FINISH',
+  'FILE_SAVE_ABORT',
+  'SCREEN_CAPTURE_SELECT',
+  'RNS_CLOSE',
+  'RNS_CONNECT',
+  'RNS_REQUEST',
+  'RNS_SEND',
+  'PRIVATE_CHANNEL_CLOSE',
+  'PRIVATE_CHANNEL_OPEN',
+  'PRIVATE_CHANNEL_SEND',
+  'PRIVATE_CHANNEL_STATUS',
+  'MOQ_OBJECT_PUBLISH',
+  'MOQ_SESSION_CLOSE',
+  'MOQ_SESSION_METRICS',
+  'MOQ_SESSION_OPEN',
+  'MOQ_TRACK_SUBSCRIBE',
   'ADD_FOREIGN_SERVER',
   'ADD_GROUP_ADMIN',
   'ADD_LIST_ITEMS',
@@ -351,6 +407,7 @@ export const UIQortalRequests = [
   'SHOW_ACTIONS',
   'SHOW_PDF_READER',
   'SIGN_FOREIGN_FEES',
+  'SIGN_QAPP_IDENTITY',
   'SIGN_TRANSACTION',
   'START_CROSSCHAIN_SERVER',
   'TRANSFER_ASSET',
@@ -547,13 +604,13 @@ async function storeFilesInIndexedDB(obj) {
 }
 
 export const useQortalMessageListener = (
-  frameWindow,
-  iframeRef,
   tabId,
   isDevMode,
   appName,
   appService,
-  appIdentifier
+  appIdentifier,
+  nativeViewRef,
+  nativeGuestActive
 ) => {
   const [path, setPath] = useState('');
   const [history, setHistory] = useState({
@@ -673,19 +730,6 @@ export const useQortalMessageListener = (
     const listener = async (event) => {
       if (event?.data?.requestedHandler !== 'UI') return;
 
-      const appWindow = iframeRef.current?.contentWindow;
-      if (!appWindow || event.source !== appWindow) return;
-
-      let appOrigin = null;
-      try {
-        appOrigin = iframeRef.current?.src
-          ? new URL(iframeRef.current.src).origin
-          : null;
-      } catch {
-        return;
-      }
-      if (appOrigin && event.origin !== appOrigin) return;
-
       const eventPort = event.ports?.[0];
 
       const sendMessageToRuntime = (message, eventPort) => {
@@ -720,12 +764,18 @@ export const useQortalMessageListener = (
                   result: null,
                   error: {
                     error: response?.error,
+                    ...(typeof response?.code === 'string'
+                      ? { code: response.code }
+                      : {}),
                     message:
-                      typeof response?.error === 'string'
-                        ? response?.error
-                        : typeof response?.message === 'string'
-                          ? response?.message
-                          : 'An error has occurred',
+                      typeof response?.code === 'string' &&
+                      typeof response?.message === 'string'
+                        ? response?.message
+                        : typeof response?.error === 'string'
+                          ? response?.error
+                          : typeof response?.message === 'string'
+                            ? response?.message
+                            : 'An error has occurred',
                   },
                 });
               } else {
@@ -747,17 +797,36 @@ export const useQortalMessageListener = (
           return;
         }
 
-        const requestPromise = window.sendMessage(
-          message.action,
-          message.payload,
-          timeout,
-          message.isExtension,
-          {
-            name: appName,
-            service: appService,
-            tabId,
-          }
-        );
+        const requestContext = {
+          appName,
+          appService,
+          isFromExtension: message.isExtension,
+          tabId,
+        };
+        const requestPromise = isQAppFileSaveAction(message?.action)
+          ? dispatchQAppFileSaveRequest(message.payload, requestContext)
+          : isQAppReticulumAction(message?.action)
+            ? dispatchQAppReticulumRequest(message.payload, requestContext)
+            : isQAppPrivateChannelAction(message?.action)
+              ? dispatchQAppPrivateChannelRequest(
+                  message.payload,
+                  requestContext
+                )
+              : isQAppMoqAction(message?.action)
+                ? dispatchQAppMoqRequest(message.payload, requestContext)
+                : message?.action === 'SCREEN_CAPTURE_SELECT'
+                  ? dispatchQAppScreenCaptureRequest(message.payload)
+                  : window.sendMessage(
+                      message.action,
+                      message.payload,
+                      timeout,
+                      message.isExtension,
+                      {
+                        name: appName,
+                        service: appService,
+                        tabId,
+                      }
+                    );
 
         // Store the promise for deduplication
         if (isDeduplicable) {
@@ -774,12 +843,18 @@ export const useQortalMessageListener = (
                 result: null,
                 error: {
                   error: response?.error,
+                  ...(typeof response?.code === 'string'
+                    ? { code: response.code }
+                    : {}),
                   message:
-                    typeof response?.error === 'string'
-                      ? response?.error
-                      : typeof response?.message === 'string'
-                        ? response?.message
-                        : 'An error has occurred',
+                    typeof response?.code === 'string' &&
+                    typeof response?.message === 'string'
+                      ? response?.message
+                      : typeof response?.error === 'string'
+                        ? response?.error
+                        : typeof response?.message === 'string'
+                          ? response?.message
+                          : 'An error has occurred',
                 },
               });
             } else {
@@ -793,10 +868,7 @@ export const useQortalMessageListener = (
             console.error('Failed qortalRequest', error);
             eventPort.postMessage({
               result: null,
-              error: {
-                error: error?.message || 'Request failed',
-                message: error?.message || 'An error has occurred',
-              },
+              error: serializeQortalRequestError(error),
             });
           });
       };
@@ -918,19 +990,12 @@ export const useQortalMessageListener = (
         executeEvent('addTab', {
           data: event?.data?.payload,
         });
-        const targetOrigin = iframeRef.current
-          ? new URL(iframeRef.current.src).origin
-          : '*';
-        iframeRef.current.contentWindow.postMessage(
-          {
-            action: 'SET_TAB_SUCCESS',
-            requestedHandler: 'UI',
-            payload: {
-              name: event?.data?.payload?.name,
-            },
-          },
-          targetOrigin
-        );
+        const reply = {
+          action: 'SET_TAB_SUCCESS',
+          requestedHandler: 'UI',
+          payload: { name: event?.data?.payload?.name },
+        };
+        nativeViewRef.current?.send('qapp:event', reply);
         // Respond to close the MessageChannel and prevent pending connections
         if (event.ports[0]) {
           event.ports[0].postMessage({ result: true, error: null });
@@ -938,14 +1003,116 @@ export const useQortalMessageListener = (
       }
     };
 
-    // Add the listener for messages coming from the frameWindow
-    frameWindow.addEventListener('message', listener);
+    const nativeView = nativeGuestActive ? nativeViewRef?.current : null;
+    const nativeListener = (event) => {
+      if (event.target !== nativeView || event.channel !== 'qapp:request') return;
+      const request = event.args?.[0];
+      if (
+        typeof request?.documentId !== 'string' ||
+        request.documentId.length > 128 ||
+        !Number.isSafeInteger(request?.requestId) ||
+        request.requestId < 1 ||
+        !request.data ||
+        typeof request.data !== 'object'
+      ) return;
+      const port = {
+        postMessage: (result) => {
+          if (nativeView.isConnected)
+            nativeView.send('qapp:response', {
+              documentId: request.documentId,
+              requestId: request.requestId,
+              result,
+            });
+        },
+      };
+      void listener({ data: request.data, ports: [port] });
+    };
+    nativeView?.addEventListener('ipc-message', nativeListener);
 
     // Cleanup function to remove the event listener when the component is unmounted
     return () => {
-      frameWindow.removeEventListener('message', listener);
+      nativeView?.removeEventListener('ipc-message', nativeListener);
+    };
+  }, [isDevMode, appName, appService, tabId, nativeGuestActive]);
+
+  useEffect(() => {
+    const api = window.electronAPI;
+    const nativeView = nativeGuestActive ? nativeViewRef?.current : null;
+    if (!api || !nativeView || tabId == null || !appName) return;
+    let identity;
+    try {
+      identity = normalizeQappIdentityContext({
+        name: appName,
+        service: appService,
+      });
+    } catch {
+      return;
+    }
+    const owner = {
+      tabId: String(tabId),
+      name: identity.name,
+      service: identity.service,
+    };
+    const expectedOwnerKey = `${owner.tabId}\u0000${owner.service}\u0000${owner.name}`;
+    const postToApp = (payload) => {
+      if (nativeView.isConnected) nativeView.send('qapp:event', payload);
+    };
+    const unsubscribe = api.onQAppReticulumEvent?.((payload) => {
+      if (payload?.ownerKey !== expectedOwnerKey) return;
+      postToApp({
+        action: payload.action,
+        connectionId: payload.connectionId,
+        ...(payload.action === 'RNS_MESSAGE'
+          ? { payload: payload.payload }
+          : { state: payload.state, reason: payload.reason }),
+        requestedHandler: 'UI',
+      });
+    });
+    const unsubscribePrivateChannel = api.onPrivateChannelEvent?.((payload) => {
+      if (payload?.ownerKey !== expectedOwnerKey) return;
+      const eventPayload =
+        payload.action === 'PRIVATE_CHANNEL_MESSAGE'
+          ? {
+              lane: payload.lane,
+              messageId: payload.messageId,
+              data: payload.data,
+            }
+          : payload.action === 'PRIVATE_CHANNEL_ERROR'
+            ? { code: payload.code, message: payload.message }
+            : { state: payload.state };
+      postToApp({
+        action: payload.action,
+        channelId: payload.channelId,
+        ...eventPayload,
+        requestedHandler: 'UI',
+      });
+    });
+    const unsubscribeMoq = api.onQAppMoqEvent?.((payload) => {
+      if (payload?.ownerKey !== expectedOwnerKey) return;
+      postToApp({
+        action: payload.action,
+        sessionId: payload.sessionId,
+        ...(payload.action === 'MOQ_OBJECT'
+          ? {
+              subscriptionId: payload.subscriptionId,
+              namespace: payload.namespace,
+              trackName: payload.trackName,
+              groupId: payload.groupId,
+              objectId: payload.objectId,
+              payload: payload.payload,
+            }
+          : payload.action === 'MOQ_ERROR'
+            ? { subscriptionId: payload.subscriptionId, code: payload.code }
+            : { state: payload.state }),
+        requestedHandler: 'UI',
+      });
+    });
+    return () => {
+      unsubscribe?.();
+      unsubscribePrivateChannel?.();
+      unsubscribeMoq?.();
     };
-  }, [isDevMode, appName, appService, tabId]); // Empty dependency array to run once when the component mounts
+  }, [appName, appService, tabId, nativeGuestActive]);
 
   return { path, history, resetHistory, changeCurrentIndex };
 };
diff --git a/src/i18n/locales/ar/auth.json b/src/i18n/locales/ar/auth.json
index b7d0e4b53..12881129a 100644
--- a/src/i18n/locales/ar/auth.json
+++ b/src/i18n/locales/ar/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }} غير موجود في JSON",
       "find_secret_key": "تعذر العثور على المفتاح السري الصحيح",
       "incorrect_password": "كلمة مرور غير صحيحة",
+      "invalid_qapp_identity_challenge": "تحدي هوية Q-App غير صالح",
+      "invalid_qapp_identity_context": "سياق هوية Q-App غير صالح",
       "invalid_qortal_link": "رابط كورتال غير صالح",
       "invalid_secret_key": "المفتاح السري غير صالح",
       "invalid_uint8": "بيانات Uint8Array المقدمة غير صالحة",
       "name_not_existing": "الاسم غير موجود",
       "name_not_registered": "الاسم غير مسجل",
+      "qapp_account_authentication_required": "يجب على Q-App مصادقة حساب Qortal الخاص بك قبل طلب إثبات الهوية",
       "read_blob_base64": "فشل قراءة Blob كسلسلة مشفرة base64",
       "reencrypt_secret_key": "تعذر إعادة تشفير المفتاح السري",
-      "set_apikey": "فشل تعيين مفتاح API:"
+      "set_apikey": "فشل تعيين مفتاح API:",
+      "wallet_account_mismatch": "المحفظة المصادَق عليها لا تطابق حساب Qortal النشط"
     },
     "generic": {
       "block_list_intro": "أضف اسمًا أو عنوان Qortal للحظر. العناوين تؤثر على المعاملات؛ حظر الاسم يخفي بياناته في كل الـ Hub.",
diff --git a/src/i18n/locales/ar/question.json b/src/i18n/locales/ar/question.json
index 907bebc16..3a1589f0c 100644
--- a/src/i18n/locales/ar/question.json
+++ b/src/i18n/locales/ar/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "عايز تنشر الـ AT دا؟",
   "description": "الوصف: {{ description }}",
   "download_file": "عايز تحمل الملف دا؟",
+  "local_send": {
+    "changed": "تغيرت المحفظة أو العقدة أو الأموال المتاحة. راجع الدفع مرة أخرى.",
+    "confirming": "لا تزال دفعتك السابقة في انتظار تأكيد الشبكة. المعاملة: {{txId}}. لم يتم إرسال دفعة جديدة.",
+    "declined": "تم رفض الدفع.",
+    "invalid": "تعذر إعداد هذا الدفع بأمان. تحقق من العنوان والمبلغ والرصيد والرسوم والاتصال بالعقدة.",
+    "native_body": "المحفظة: {{wallet}}\n\nالمخرجات:\n{{outputs}}\n\nرسوم الشبكة: {{fee}}",
+    "native_title": "تأكيد الدفع من المحفظة",
+    "pending": "يجب التحقق من دفعة سابقة قبل إرسال دفعة أخرى. المعاملة: {{txId}}",
+    "previous": "تم إرسال دفعتك السابقة. المعاملة: {{txId}}. ابدأ دفعة جديدة إذا أردت الإرسال مرة أخرى.",
+    "recovery": "لا تزال دفعة تمت الموافقة عليها سابقًا معلّقة. هل تريد إعادة بث المعاملة نفسها؟ لن يؤدي ذلك إلى إرسال الدفعة الجديدة التي طلبتها.",
+    "unknown": "نتيجة البث غير معروفة. لا ترسل مرة أخرى. تحقق من المعاملة {{txId}} في سجل المحفظة.",
+    "upgrade": "يتطلب توقيع معاملات المحفظة محليًا إصدارات محدثة من Qortal Core وQortal Hub."
+  },
   "message": {
     "error": {
       "add_to_list": "مش عارف أضيف في القايمة",
@@ -44,6 +57,7 @@
       "file_extension": "مش عارف أعرف امتداد الملف",
       "gateway_balance_local_node": "مش هتقدر تشوف رصيد {{ token }} من الجيتواي. استخدم اللوكل نود بتاعك.",
       "gateway_non_qort_local_node": "مينفعش ترسل عملة غير QORT من الجيتواي. استخدم اللوكل نود بتاعك.",
+      "gateway_pirate_local_node": "عملة Pirate Chain (ARRR) غير متاحة عبر العقد العامة. يُرجى استخدام عقدة محلية.",
       "gateway_retrieve_balance": "جلب رصيد {{ token }} مش مسموح من الجيتواي",
       "gateway_wallet_local_node": "مش هتقدر تشوف محفظة {{ token }} من الجيتواي. استخدم اللوكل نود بتاعك.",
       "get_foreign_fee": "غلط في جلب مصاريف العملة الأجنبية",
@@ -131,6 +145,9 @@
     "add_admin": "هل تسمح للتطبيق بإضافة {{ invitee }} كأدمن؟",
     "all_item_list": "هل تسمح للتطبيق بإضافة الآتي للقائمة {{ name }}:",
     "authenticate": "هل تسمح للتطبيق بتسجيل الدخول؟",
+    "backend_connection": "هل تسمح لتطبيق {{appName}} بالاتصال بخادمه؟",
+    "backend_connection_description": "يتيح هذا للتطبيق إرسال البيانات واستقبالها مع خادمه ما دامت علامة التبويب هذه مفتوحة.",
+    "backend_connection_understand": "أسمح لهذا التطبيق بالاتصال بخادمه وتبادل البيانات معه.",
     "ban": "هل تسمح للتطبيق بمنع {{ partecipant }} من الجروب؟",
     "buy_name": "هل تسمح للتطبيق بشراء اسم؟",
     "buy_name_detail": "شراء {{ name }} بسعر {{ price }} QORT",
@@ -170,6 +187,10 @@
     "register_name": "هل تسمح للتطبيق بتسجيل هذا الاسم؟",
     "remove_admin": "هل تسمح للتطبيق بإزالة {{ partecipant }} من الأدمنية؟",
     "remove_from_list": "هل تسمح للتطبيق بإزالة الآتي من القائمة {{ name }}:",
+    "reticulum_destination": "يريد {{appName}} الاتصال بخادم Reticulum الخلفي {{destination}}. هل تسمح بهذا الاتصال لعلامة التبويب هذه؟",
+    "reticulum_remote_backend_understand": "أفهم أن تطبيق Q-App هذا سيتبادل البيانات مع واجهة خلفية بعيدة خارج Qortal Hub.",
+    "screen_capture_description": "هل تسمح لـ {{origin}} بعرض معاينات الشاشات والنوافذ والتقاط المحتوى لهذا الطلب؟ اسمح فقط للتطبيقات التي تثق بها. اختر الشاشة أو النافذة داخل التطبيق.",
+    "screen_capture_title": "السماح بالتقاط الشاشة؟",
     "sell_name_cancel": "هل تسمح للتطبيق بإلغاء بيع الاسم؟",
     "sell_name_transaction": "هل تسمح للتطبيق بعمل صفقة بيع اسم؟",
     "sell_name_transaction_detail": "بيع {{ name }} بسعر {{ price }} QORT",
@@ -178,6 +199,7 @@
     "send_coins": "هل تسمح للتطبيق بإرسال عملات؟",
     "server_add": "هل تسمح للتطبيق بإضافة سيرفر؟",
     "server_remove": "هل تسمح للتطبيق بإزالة سيرفر؟",
+    "session_only_summary": "منح الأذونات لهذه الجلسة فقط",
     "session_permissions": "{{appName}} يطلب أذونات الجلسة",
     "session_permissions_description": "سيتم منح الأذونات التالية تلقائيًا لهذه الجلسة:",
     "session_understand": "أثق بهذا التطبيق وأفهم أن هذه الأذونات ستُنفذ تلقائيًا",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} ساتوشي لكل كيلوبايت",
   "server_host": "السيرفر: {{ host }}",
   "server_type": "النوع: {{ type }}",
+  "stream_save": {
+    "choose": "اختيار الموقع",
+    "detail": "التطبيق: {{app}}\nاسم الملف المقترح: {{filename}}\nالحجم المُعلَن: {{size}} بايت\n\nهذه التفاصيل مقدمة من التطبيق. لا يستطيع Hub التحقق من المحتوى أو سلامة الملف. ينطبق هذا الإذن على عملية الحفظ هذه فقط.",
+    "failed": "تعذر حفظ الملف. يُرجى المحاولة مرة أخرى.",
+    "title": "حفظ ملف على جهازك",
+    "unavailable": "يتطلب حفظ الملفات تدريجيًا إصدارًا محدثًا من Qortal Hub لسطح المكتب."
+  },
   "to_group": "ل: جروب {{ group_id }}",
   "to_recipient": "ل: {{ recipient }}",
   "total_locking_fee": "إجمالي عمولة القفل:",
diff --git a/src/i18n/locales/de/auth.json b/src/i18n/locales/de/auth.json
index 41271c232..f2ba27e37 100644
--- a/src/i18n/locales/de/auth.json
+++ b/src/i18n/locales/de/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }} nicht im JSON gefunden",
       "find_secret_key": "Korrekter SecretKey konnte nicht gefunden werden",
       "incorrect_password": "falsches Passwort",
+      "invalid_qapp_identity_challenge": "ungültige Q-App-Identitätsanforderung",
+      "invalid_qapp_identity_context": "ungültiger Q-App-Identitätskontext",
       "invalid_qortal_link": "ungültiger Qortal-Link",
       "invalid_secret_key": "SecretKey ist ungültig",
       "invalid_uint8": "Das eingereichte Uint8ArrayData ist ungültig",
       "name_not_existing": "Name existiert nicht",
       "name_not_registered": "Name nicht registriert",
+      "qapp_account_authentication_required": "die Q-App muss dein Qortal-Konto authentifizieren, bevor sie einen Identitätsnachweis anfordert",
       "read_blob_base64": "Blob konnte nicht als base64-codierter String gelesen werden",
       "reencrypt_secret_key": "Secret Key konnte nicht neu verschlüsselt werden",
-      "set_apikey": "API-Schlüssel konnte nicht gesetzt werden:"
+      "set_apikey": "API-Schlüssel konnte nicht gesetzt werden:",
+      "wallet_account_mismatch": "die authentifizierte Wallet stimmt nicht mit dem aktiven Qortal-Konto überein"
     },
     "generic": {
       "block_list_intro": "Füge einen Qortal-Namen oder eine Adresse hinzu, um zu blockieren. Adressen wirken auf Transaktionen; das Blockieren eines Namens blendet Daten im gesamten Hub aus.",
diff --git a/src/i18n/locales/de/question.json b/src/i18n/locales/de/question.json
index 1531fbfbb..fc093641f 100644
--- a/src/i18n/locales/de/question.json
+++ b/src/i18n/locales/de/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "Möchten Sie dieses AT bereitstellen?",
   "description": "Beschreibung: {{ description }}",
   "download_file": "Möchten Sie herunterladen:",
+  "local_send": {
+    "changed": "Wallet, Node oder verfügbare Mittel haben sich geändert. Prüfe die Zahlung erneut.",
+    "confirming": "Ihre vorherige Zahlung wartet noch auf die Netzwerkbestätigung. Transaktion: {{txId}}. Es wurde keine neue Zahlung gesendet.",
+    "declined": "Zahlung abgelehnt.",
+    "invalid": "Diese Zahlung kann nicht sicher vorbereitet werden. Prüfe Adresse, Betrag, Guthaben, Gebühr und Node-Verbindung.",
+    "native_body": "Wallet: {{wallet}}\n\nAusgänge:\n{{outputs}}\n\nNetzwerkgebühr: {{fee}}",
+    "native_title": "Wallet-Zahlung bestätigen",
+    "pending": "Eine frühere Zahlung muss abgeglichen werden, bevor eine weitere gesendet werden kann. Transaktion: {{txId}}",
+    "previous": "Ihre vorherige Zahlung wurde gesendet. Transaktion: {{txId}}. Starten Sie eine neue Zahlung, wenn Sie erneut senden möchten.",
+    "recovery": "Eine zuvor genehmigte Zahlung ist noch ausstehend. Soll dieselbe Transaktion erneut übertragen werden? Die neu angeforderte Zahlung wird dabei nicht gesendet.",
+    "unknown": "Das Ergebnis der Übertragung ist unbekannt. Nicht erneut senden. Prüfe Transaktion {{txId}} im Wallet-Verlauf.",
+    "upgrade": "Das lokale Signieren von Wallet-Transaktionen erfordert aktuelle Versionen von Qortal Core und Qortal Hub."
+  },
   "message": {
     "error": {
       "add_to_list": "Fehler beim Hinzufügen zur Liste",
@@ -44,6 +57,7 @@
       "file_extension": "Dateierweiterung konnte nicht ermittelt werden",
       "gateway_balance_local_node": "{{ token }}-Saldo kann über das Gateway nicht angezeigt werden. Bitte lokalen Node verwenden.",
       "gateway_non_qort_local_node": "Nicht-QORT-Coins können nicht über das Gateway gesendet werden. Bitte lokalen Node verwenden.",
+      "gateway_pirate_local_node": "Pirate Chain (ARRR) ist über öffentliche Nodes nicht verfügbar. Bitte verwende einen lokalen Node.",
       "gateway_retrieve_balance": "Abruf des {{ token }}-Saldos über das Gateway nicht erlaubt",
       "gateway_wallet_local_node": "{{ token }}-Wallet kann über das Gateway nicht angezeigt werden. Bitte lokalen Node verwenden.",
       "get_foreign_fee": "Fehler beim Abrufen der externen Gebühr",
@@ -131,6 +145,9 @@
     "add_admin": "Möchten Sie dieser Anwendung die Berechtigung geben, den Benutzer {{ invitee }} als Administrator hinzuzufügen?",
     "all_item_list": "Möchten Sie dieser Anwendung die Berechtigung geben, Folgendes zur Liste {{ name }} hinzuzufügen:",
     "authenticate": "Möchten Sie dieser Anwendung die Berechtigung zur Authentifizierung geben?",
+    "backend_connection": "Darf {{appName}} eine Verbindung zu seinem Backend herstellen?",
+    "backend_connection_description": "Damit kann die App Daten mit ihrem Backend austauschen, solange dieser Tab geöffnet ist.",
+    "backend_connection_understand": "Ich erlaube dieser App, sich mit ihrem Backend zu verbinden und Daten auszutauschen.",
     "ban": "Möchten Sie dieser Anwendung die Berechtigung geben, {{ partecipant }} aus der Gruppe zu verbannen?",
     "buy_name": "Möchten Sie dieser Anwendung die Berechtigung geben, einen Namen zu kaufen?",
     "buy_name_detail": "{{ name }} für {{ price }} QORT kaufen",
@@ -170,6 +187,10 @@
     "register_name": "Möchten Sie dieser Anwendung die Berechtigung geben, diesen Namen zu registrieren?",
     "remove_admin": "Möchten Sie dieser Anwendung die Berechtigung geben, den Benutzer {{ partecipant }} als Administrator zu entfernen?",
     "remove_from_list": "Möchten Sie dieser Anwendung die Berechtigung geben, Folgendes aus der Liste {{ name }} zu entfernen:",
+    "reticulum_destination": "{{appName}} möchte eine Verbindung zum Reticulum-Backend {{destination}} herstellen. Diese Verbindung für diesen Tab zulassen?",
+    "reticulum_remote_backend_understand": "Ich verstehe, dass diese Q-App Daten mit einem entfernten Backend außerhalb von Qortal Hub austauscht.",
+    "screen_capture_description": "Darf {{origin}} Bildschirm-/Fenstervorschauen sehen und für diese Anfrage Inhalte aufnehmen? Erlaube dies nur vertrauenswürdigen Apps. Wähle den Bildschirm oder das Fenster in der App.",
+    "screen_capture_title": "Bildschirmaufnahme erlauben?",
     "sell_name_cancel": "Möchten Sie dieser Anwendung die Berechtigung geben, den Verkauf eines Namens abzubrechen?",
     "sell_name_transaction": "Möchten Sie dieser Anwendung die Berechtigung geben, eine Verkaufs-Transaktion für einen Namen zu erstellen?",
     "sell_name_transaction_detail": "{{ name }} für {{ price }} QORT verkaufen",
@@ -178,6 +199,7 @@
     "send_coins": "Möchten Sie dieser Anwendung die Berechtigung geben, Coins zu senden?",
     "server_add": "Möchten Sie dieser Anwendung die Berechtigung geben, einen Server hinzuzufügen?",
     "server_remove": "Möchten Sie dieser Anwendung die Berechtigung geben, einen Server zu entfernen?",
+    "session_only_summary": "Berechtigungen nur für diese Sitzung erteilen",
     "session_permissions": "{{appName}} fordert Sitzungsberechtigungen an",
     "session_permissions_description": "Die folgenden Berechtigungen werden für diese Sitzung automatisch erteilt:",
     "session_understand": "Ich vertraue dieser App und verstehe, dass diese Berechtigungen automatisch ausgeführt werden",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} Sats pro KB",
   "server_host": "Host: {{ host }}",
   "server_type": "Typ: {{ type }}",
+  "stream_save": {
+    "choose": "Speicherort wählen",
+    "detail": "App: {{app}}\nVorgeschlagener Dateiname: {{filename}}\nAngegebene Größe: {{size}} Bytes\n\nDiese Angaben stammen von der App. Hub kann weder den Inhalt noch die Sicherheit der Datei prüfen. Diese Erlaubnis gilt nur für diesen Speichervorgang.",
+    "failed": "Die Datei konnte nicht gespeichert werden. Bitte versuche es erneut.",
+    "title": "Datei auf deinem Gerät speichern",
+    "unavailable": "Zum schrittweisen Speichern von Dateien wird eine aktuelle Desktop-Version von Qortal Hub benötigt."
+  },
   "to_group": "an: Gruppe {{ group_id }}",
   "to_recipient": "an: {{ recipient }}",
   "total_locking_fee": "Gesamte Sperrgebühr:",
diff --git a/src/i18n/locales/en/auth.json b/src/i18n/locales/en/auth.json
index 4fadeb20b..c7a92328c 100644
--- a/src/i18n/locales/en/auth.json
+++ b/src/i18n/locales/en/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }}  not found in JSON",
       "find_secret_key": "cannot find correct secretKey",
       "incorrect_password": "incorrect password",
+      "invalid_qapp_identity_challenge": "invalid Q-App identity challenge",
+      "invalid_qapp_identity_context": "invalid Q-App identity context",
       "invalid_qortal_link": "invalid qortal link",
       "invalid_secret_key": "secretKey is not valid",
       "invalid_uint8": "the Uint8ArrayData you've submitted is invalid",
       "name_not_existing": "name does not exist",
       "name_not_registered": "name not registered",
+      "qapp_account_authentication_required": "the Q-App must authenticate your Qortal account before requesting an identity proof",
       "read_blob_base64": "failed to read the Blob as a base64-encoded string",
       "reencrypt_secret_key": "unable to re-encrypt secret key",
-      "set_apikey": "failed to set API key:"
+      "set_apikey": "failed to set API key:",
+      "wallet_account_mismatch": "the authenticated wallet does not match the active Qortal account"
     },
     "generic": {
       "block_list_intro": "Add a Qortal name or address to block them. Addresses affect transaction handling; blocking a name hides their data across the Hub.",
diff --git a/src/i18n/locales/en/question.json b/src/i18n/locales/en/question.json
index 418e6700a..05346ce18 100644
--- a/src/i18n/locales/en/question.json
+++ b/src/i18n/locales/en/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "would you like to deploy this AT?",
   "description": "description: {{ description }}",
   "download_file": "would you like to download:",
+  "local_send": {
+    "changed": "The wallet, node, or spendable funds changed. Please review the payment again.",
+    "confirming": "Your previous payment is still waiting for network confirmation. Transaction: {{txId}}. No new payment was sent.",
+    "declined": "Payment declined.",
+    "invalid": "Unable to prepare this payment safely. Check the address, amount, balance, fee, and node connection.",
+    "native_body": "Wallet: {{wallet}}\n\nOutputs:\n{{outputs}}\n\nNetwork fee: {{fee}}",
+    "native_title": "Confirm wallet payment",
+    "pending": "A previous payment needs reconciliation before another can be sent. Transaction: {{txId}}",
+    "previous": "Your previous payment was sent. Transaction: {{txId}}. Start a new payment if you want to send again.",
+    "recovery": "A previously approved payment is still pending. Retry broadcasting that same transaction? This will not send the new payment you requested.",
+    "unknown": "The broadcast outcome is unknown. Do not send again. Check transaction {{txId}} in your wallet history.",
+    "upgrade": "Local wallet signing requires updated versions of Qortal Core and Qortal Hub."
+  },
   "message": {
     "error": {
       "add_to_list": "failed to add to list",
@@ -44,6 +57,7 @@
       "file_extension": "a file extension could not be derived",
       "gateway_balance_local_node": "cannot view {{ token }} balance through the gateway. Please use your local node.",
       "gateway_non_qort_local_node": "cannot send a non-QORT coin through the gateway. Please use your local node.",
+      "gateway_pirate_local_node": "Pirate Chain (ARRR) is not available on public nodes. Please use a local node.",
       "gateway_retrieve_balance": "retrieving {{ token }} balance is not allowed through a gateway",
       "gateway_wallet_local_node": "cannot view {{ token }} wallet through the gateway. Please use your local node.",
       "get_foreign_fee": "error in get foreign fee",
@@ -131,6 +145,9 @@
     "add_admin": "do you give this application permission to add user {{ invitee }} as an admin?",
     "all_item_list": "do you give this application permission to add the following to the list {{ name }}:",
     "authenticate": "do you give this application permission to authenticate?",
+    "backend_connection": "Allow {{appName}} to connect to its backend?",
+    "backend_connection_description": "This lets the app send and receive data with its backend while this tab is open.",
+    "backend_connection_understand": "I allow this app to connect and exchange data with its backend.",
     "ban": "do you give this application permission to ban {{ partecipant }} from the group?",
     "buy_name": "do you give this application permission to buy a name?",
     "buy_name_detail": "buying {{ name }} for {{ price }} QORT",
@@ -170,6 +187,10 @@
     "register_name": "do you give this application permission to register this name?",
     "remove_admin": "do you give this application permission to remove user {{ partecipant }} as an admin?",
     "remove_from_list": "do you give this application permission to remove the following from the list {{ name }}:",
+    "reticulum_destination": "{{appName}} wants to connect to the Reticulum backend {{destination}}. Allow this connection for this tab?",
+    "reticulum_remote_backend_understand": "I understand this Q-App will exchange data with a remote backend outside Qortal Hub.",
+    "screen_capture_description": "Allow {{origin}} to see screen/window previews and capture content for this request? Only allow apps you trust. Choose the screen or window inside the app.",
+    "screen_capture_title": "Allow screen capture?",
     "sell_name_cancel": "do you give this application permission to cancel the selling of a name?",
     "sell_name_transaction": "do you give this application permission to create a sell name transaction?",
     "sell_name_transaction_detail": "sell {{ name }} for {{ price }} QORT",
@@ -178,6 +199,7 @@
     "send_coins": "do you give this application permission to send coins?",
     "server_add": "do you give this application permission to add a server?",
     "server_remove": "do you give this application permission to remove a server?",
+    "session_only_summary": "Grant permissions for this session only",
     "session_permissions": "{{appName}} is requesting session permissions",
     "session_permissions_description": "The following permissions will be automatically granted for this session:",
     "session_understand": "I trust this app and understand these permissions will auto-execute",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} sats per KB",
   "server_host": "host: {{ host }}",
   "server_type": "type: {{ type }}",
+  "stream_save": {
+    "choose": "Choose location",
+    "detail": "App: {{app}}\nSuggested filename: {{filename}}\nDeclared size: {{size}} bytes\n\nThese details are supplied by the app. Hub cannot verify the contents or whether the file is safe. This permission applies only to this save.",
+    "failed": "The file could not be saved. Please try again.",
+    "title": "Save a file to your device",
+    "unavailable": "Streaming file saves require an updated desktop version of Qortal Hub."
+  },
   "to_group": "to: group {{ group_id }}",
   "to_recipient": "to: {{ recipient }}",
   "total_locking_fee": "total Locking Fee:",
diff --git a/src/i18n/locales/es/auth.json b/src/i18n/locales/es/auth.json
index bf1b37799..c60c36bbe 100644
--- a/src/i18n/locales/es/auth.json
+++ b/src/i18n/locales/es/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }} no encontrado en el JSON",
       "find_secret_key": "no se puede encontrar la clave secreta correcta",
       "incorrect_password": "contraseña incorrecta",
+      "invalid_qapp_identity_challenge": "desafío de identidad de Q-App no válido",
+      "invalid_qapp_identity_context": "contexto de identidad de Q-App no válido",
       "invalid_qortal_link": "enlace Qortal inválido",
       "invalid_secret_key": "clave secreta no válida",
       "invalid_uint8": "el Uint8ArrayData enviado no es válido",
       "name_not_existing": "el nombre no existe",
       "name_not_registered": "nombre no registrado",
+      "qapp_account_authentication_required": "la Q-App debe autenticar tu cuenta de Qortal antes de solicitar una prueba de identidad",
       "read_blob_base64": "fallo al leer el Blob como cadena codificada en base64",
       "reencrypt_secret_key": "no se pudo reencriptar la clave secreta",
-      "set_apikey": "fallo al establecer la clave API:"
+      "set_apikey": "fallo al establecer la clave API:",
+      "wallet_account_mismatch": "la cartera autenticada no coincide con la cuenta de Qortal activa"
     },
     "generic": {
       "block_list_intro": "Añade un nombre Qortal o una dirección para bloquearlos. Las direcciones afectan las transacciones; bloquear un nombre oculta sus datos en todo el Hub.",
diff --git a/src/i18n/locales/es/question.json b/src/i18n/locales/es/question.json
index 1b73f8d47..9332c786d 100644
--- a/src/i18n/locales/es/question.json
+++ b/src/i18n/locales/es/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "¿Desea implementar este AT?",
   "description": "descripción: {{ description }}",
   "download_file": "¿Desea descargar:",
+  "local_send": {
+    "changed": "La cartera, el nodo o los fondos disponibles han cambiado. Revisa el pago de nuevo.",
+    "confirming": "Su pago anterior aún espera la confirmación de la red. Transacción: {{txId}}. No se envió ningún pago nuevo.",
+    "declined": "Pago rechazado.",
+    "invalid": "No se puede preparar este pago de forma segura. Comprueba la dirección, el importe, el saldo, la comisión y la conexión al nodo.",
+    "native_body": "Cartera: {{wallet}}\n\nSalidas:\n{{outputs}}\n\nComisión de red: {{fee}}",
+    "native_title": "Confirmar pago de la cartera",
+    "pending": "Es necesario comprobar un pago anterior antes de enviar otro. Transacción: {{txId}}",
+    "previous": "Su pago anterior fue enviado. Transacción: {{txId}}. Inicie un nuevo pago si desea enviar de nuevo.",
+    "recovery": "Un pago autorizado anteriormente sigue pendiente. ¿Volver a transmitir esa misma transacción? Esto no enviará el nuevo pago solicitado.",
+    "unknown": "Se desconoce el resultado de la transmisión. No vuelvas a enviar el pago. Comprueba la transacción {{txId}} en el historial de la cartera.",
+    "upgrade": "La firma local de transacciones de la cartera requiere versiones actualizadas de Qortal Core y Qortal Hub."
+  },
   "message": {
     "error": {
       "add_to_list": "no se pudo agregar a la lista",
@@ -44,6 +57,7 @@
       "file_extension": "no se pudo derivar una extensión de archivo",
       "gateway_balance_local_node": "no se puede ver el saldo de {{ token }} a través del gateway. Utilice su nodo local.",
       "gateway_non_qort_local_node": "no se puede enviar una moneda que no sea QORT a través del gateway. Utilice su nodo local.",
+      "gateway_pirate_local_node": "Pirate Chain (ARRR) no está disponible en nodos públicos. Usa un nodo local.",
       "gateway_retrieve_balance": "no está permitido recuperar el saldo de {{ token }} a través de un gateway",
       "gateway_wallet_local_node": "no se puede ver la cartera de {{ token }} a través del gateway. Utilice su nodo local.",
       "get_foreign_fee": "error al obtener la tarifa extranjera",
@@ -131,6 +145,9 @@
     "add_admin": "¿Deseas permitir que esta aplicación agregue al usuario {{ invitee }} como administrador?",
     "all_item_list": "¿Deseas permitir que esta aplicación agregue lo siguiente a la lista {{ name }}:",
     "authenticate": "¿Deseas permitir que esta aplicación se autentique?",
+    "backend_connection": "¿Permitir que {{appName}} se conecte a su servidor?",
+    "backend_connection_description": "Esto permite que la aplicación envíe y reciba datos de su servidor mientras esta pestaña esté abierta.",
+    "backend_connection_understand": "Permito que esta aplicación se conecte e intercambie datos con su servidor.",
     "ban": "¿Deseas permitir que esta aplicación expulse a {{ partecipant }} del grupo?",
     "buy_name": "¿Deseas permitir que esta aplicación compre un nombre?",
     "buy_name_detail": "comprando {{ name }} por {{ price }} QORT",
@@ -170,6 +187,10 @@
     "register_name": "¿Deseas permitir que esta aplicación registre este nombre?",
     "remove_admin": "¿Deseas permitir que esta aplicación elimine al usuario {{ partecipant }} como administrador?",
     "remove_from_list": "¿Deseas permitir que esta aplicación elimine lo siguiente de la lista {{ name }}?",
+    "reticulum_destination": "{{appName}} quiere conectarse al backend de Reticulum {{destination}}. ¿Permitir esta conexión para esta pestaña?",
+    "reticulum_remote_backend_understand": "Entiendo que esta Q-App intercambiará datos con un backend remoto externo a Qortal Hub.",
+    "screen_capture_description": "¿Permitir que {{origin}} vea vistas previas de pantallas y ventanas y capture contenido para esta solicitud? Permite solo aplicaciones de confianza. Elige la pantalla o ventana dentro de la aplicación.",
+    "screen_capture_title": "¿Permitir la captura de pantalla?",
     "sell_name_cancel": "¿Deseas permitir que esta aplicación cancele la venta de un nombre?",
     "sell_name_transaction": "¿Deseas permitir que esta aplicación cree una transacción para vender un nombre?",
     "sell_name_transaction_detail": "vender {{ name }} por {{ price }} QORT",
@@ -178,6 +199,7 @@
     "send_coins": "¿Deseas permitir que esta aplicación envíe monedas?",
     "server_add": "¿Deseas permitir que esta aplicación agregue un servidor?",
     "server_remove": "¿Deseas permitir que esta aplicación elimine un servidor?",
+    "session_only_summary": "Conceder permisos solo para esta sesión",
     "session_permissions": "{{appName}} solicita permisos de sesión",
     "session_permissions_description": "Los siguientes permisos se concederán automáticamente para esta sesión:",
     "session_understand": "Confío en esta aplicación y entiendo que estos permisos se ejecutarán automáticamente",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} sats por KB",
   "server_host": "host: {{ host }}",
   "server_type": "tipo: {{ type }}",
+  "stream_save": {
+    "choose": "Elegir ubicación",
+    "detail": "App: {{app}}\nNombre sugerido: {{filename}}\nTamaño declarado: {{size}} bytes\n\nLa app proporciona estos datos. Hub no puede verificar el contenido ni si el archivo es seguro. Este permiso solo se aplica a este guardado.",
+    "failed": "No se pudo guardar el archivo. Inténtalo de nuevo.",
+    "title": "Guardar un archivo en tu dispositivo",
+    "unavailable": "El guardado progresivo de archivos requiere una versión de escritorio actualizada de Qortal Hub."
+  },
   "to_group": "a: grupo {{ group_id }}",
   "to_recipient": "a: {{ recipient }}",
   "total_locking_fee": "cuota total de bloqueo:",
diff --git a/src/i18n/locales/et/auth.json b/src/i18n/locales/et/auth.json
index 243f09c93..906f56d1b 100644
--- a/src/i18n/locales/et/auth.json
+++ b/src/i18n/locales/et/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }} ei leitud JSON-ist",
       "find_secret_key": "õiget salavõtit ei leitud",
       "incorrect_password": "vale parool",
+      "invalid_qapp_identity_challenge": "vigane Q-Appi identiteediväljakutse",
+      "invalid_qapp_identity_context": "vigane Q-Appi identiteedikontekst",
       "invalid_qortal_link": "vigane Qortal link",
       "invalid_secret_key": "salavõti pole kehtiv",
       "invalid_uint8": "esitatud Uint8ArrayData pole kehtiv",
       "name_not_existing": "nimi ei eksisteeri",
       "name_not_registered": "nimi pole registreeritud",
+      "qapp_account_authentication_required": "Q-App peab enne identiteeditõendi taotlemist sinu Qortali konto autentima",
       "read_blob_base64": "Blob'i ei õnnestunud lugeda base64-stringina",
       "reencrypt_secret_key": "salavõtit ei saa uuesti krüpteerida",
-      "set_apikey": "API võtme seadmine ebaõnnestus:"
+      "set_apikey": "API võtme seadmine ebaõnnestus:",
+      "wallet_account_mismatch": "autenditud rahakott ei vasta aktiivsele Qortali kontole"
     },
     "generic": {
       "block_list_intro": "Lisa Qortali nimi või aadress blokeerimiseks. Aadressid mõjutavad tehinguid; nime blokeerimine peidab selle andmed kogu Hubis.",
diff --git a/src/i18n/locales/et/question.json b/src/i18n/locales/et/question.json
index 4cad1f6f6..6450b06b6 100644
--- a/src/i18n/locales/et/question.json
+++ b/src/i18n/locales/et/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "kas sa soovid seda AT-d (automaatset tehingut) käivitada?",
   "description": "kirjeldus: {{ description }}",
   "download_file": "kas sa soovid allalaadida:",
+  "local_send": {
+    "changed": "Rahakott, sõlm või saadaolevad vahendid on muutunud. Vaata makse uuesti üle.",
+    "confirming": "Teie eelmine makse ootab endiselt võrgu kinnitust. Tehing: {{txId}}. Uut makset ei saadetud.",
+    "declined": "Makse tagasi lükatud.",
+    "invalid": "Makset ei saa turvaliselt ette valmistada. Kontrolli aadressi, summat, saldot, tasu ja ühendust sõlmega.",
+    "native_body": "Rahakott: {{wallet}}\n\nVäljundid:\n{{outputs}}\n\nVõrgutasu: {{fee}}",
+    "native_title": "Kinnita rahakoti makse",
+    "pending": "Enne uue makse saatmist tuleb eelmine makse üle kontrollida. Tehing: {{txId}}",
+    "previous": "Teie eelmine makse saadeti. Tehing: {{txId}}. Kui soovite uuesti saata, alustage uut makset.",
+    "recovery": "Varem kinnitatud makse on endiselt ootel. Kas edastada sama tehing uuesti võrku? See ei saada sinu taotletud uut makset.",
+    "unknown": "Edastamise tulemus pole teada. Ära saada uuesti. Kontrolli tehingut {{txId}} rahakoti ajaloos.",
+    "upgrade": "Rahakoti tehingute kohalik allkirjastamine nõuab Qortal Core’i ja Qortal Hubi uuendatud versioone."
+  },
   "message": {
     "error": {
       "add_to_list": "nimekirja lisamine ebaõnnestus",
@@ -44,6 +57,7 @@
       "file_extension": "faililaiendit ei suudetud tuletada",
       "gateway_balance_local_node": "ei saa vaadata {{ token }} saldot lüüsi kaudu. Palun kasuta oma kohalikku haaret.",
       "gateway_non_qort_local_node": "ei saa saata mitte-QORT münti lüüsi kaudu. Palun kasuta oma kohalikku haaret.",
+      "gateway_pirate_local_node": "Pirate Chain (ARRR) ei ole avalikes sõlmedes saadaval. Kasuta kohalikku sõlme.",
       "gateway_retrieve_balance": "{{ token }} saldo kättesaamine ei ole lüüsi kaudu lubatud",
       "gateway_wallet_local_node": "ei saa vaadata {{ token }} rahakotti lüüsi kaudu. Palun kasuta oma kohalikku haaret.",
       "get_foreign_fee": "viga välismaise tasu kättesaamisel",
@@ -131,6 +145,9 @@
     "add_admin": "kas sa annad sellele rakendusele loa lisada kasutaja {{ invitee }} administraatoriks?",
     "all_item_list": "kas sa annad sellele rakendusele loa lisada järgnevad asjad nimekirja {{ name }}:",
     "authenticate": "kas sa annad sellele rakendusele loa autentida?",
+    "backend_connection": "Kas lubada rakendusel {{appName}} oma serveriga ühenduda?",
+    "backend_connection_description": "See lubab rakendusel oma serveriga andmeid vahetada, kuni see vahekaart on avatud.",
+    "backend_connection_understand": "Luban sellel rakendusel oma serveriga ühenduda ja andmeid vahetada.",
     "ban": "kas sa annad sellele rakendusele loa keelata {{ partecipant }} rühmast?",
     "buy_name": "kas sa annad sellele rakendusele loa nime osta?",
     "buy_name_detail": "ostan {{ name }} hinnaga {{ price }} QORT",
@@ -170,6 +187,10 @@
     "register_name": "kas sa annad sellele rakendusele loa registreerida see nimi?",
     "remove_admin": "kas sa annad sellele rakendusele loa eemaldada kasutaja {{ partecipant }} administraatori staatusest?",
     "remove_from_list": "kas sa annad sellele rakendusele loa eemaldada järgmised asjad nimekirjast {{ name }}:",
+    "reticulum_destination": "{{appName}} soovib luua ühenduse Reticulumi taustserveriga {{destination}}. Kas lubada see ühendus sellel vahekaardil?",
+    "reticulum_remote_backend_understand": "Mõistan, et see Q-App vahetab andmeid Qortal Hubist väljaspool asuva kaugtaustateenusega.",
+    "screen_capture_description": "Kas lubada rakendusel {{origin}} näha ekraanide ja akende eelvaateid ning jäädvustada selle päringu jaoks sisu? Luba ainult usaldusväärseid rakendusi. Vali ekraan või aken rakenduses.",
+    "screen_capture_title": "Kas lubada ekraani jäädvustamine?",
     "sell_name_cancel": "kas sa annad sellele rakendusele loa tühistada nime müümise?",
     "sell_name_transaction": "kas sa annad sellele rakendusele loa luua nime müümise tehing?",
     "sell_name_transaction_detail": "müü {{ name }} hinnaga {{ price }} QORT",
@@ -178,6 +199,7 @@
     "send_coins": "kas sa annad sellele rakendusele loa saata münte?",
     "server_add": "kas sa annad sellele rakendusele loa serverit lisada?",
     "server_remove": "kas sa annad sellele rakendusele loa serverit eemaldada?",
+    "session_only_summary": "Anna õigused ainult selleks seansiks",
     "session_permissions": "{{appName}} taotleb seansi õigusi",
     "session_permissions_description": "Järgmised õigused antakse selle seansi jaoks automaatselt:",
     "session_understand": "Ma usaldan seda rakendust ja mõistan, et need õigused käivitatakse automaatselt",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} satsi per KB",
   "server_host": "host: {{ host }}",
   "server_type": "tüüp: {{ type }}",
+  "stream_save": {
+    "choose": "Vali asukoht",
+    "detail": "Rakendus: {{app}}\nSoovitatud failinimi: {{filename}}\nMärgitud suurus: {{size}} baiti\n\nNeed andmed pärinevad rakendusest. Hub ei saa kontrollida sisu ega faili ohutust. See luba kehtib ainult selle salvestamise kohta.",
+    "failed": "Faili ei saanud salvestada. Palun proovi uuesti.",
+    "title": "Faili salvestamine seadmesse",
+    "unavailable": "Failide järkjärguline salvestamine nõuab Qortal Hubi uuendatud töölauaversiooni."
+  },
   "to_group": "vastuvõtja: rühm {{ group_id }}",
   "to_recipient": "vastuvõtja: {{ recipient }}",
   "total_locking_fee": "lukustustasu kokku:",
diff --git a/src/i18n/locales/fi/auth.json b/src/i18n/locales/fi/auth.json
index 24d97a678..b861d857a 100644
--- a/src/i18n/locales/fi/auth.json
+++ b/src/i18n/locales/fi/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }} ei löytynyt JSONista",
       "find_secret_key": "oikeaa salaista avainta ei löytynyt",
       "incorrect_password": "väärä salasana",
+      "invalid_qapp_identity_challenge": "virheellinen Q-App-identiteettihaaste",
+      "invalid_qapp_identity_context": "virheellinen Q-App-identiteettikonteksti",
       "invalid_qortal_link": "virheellinen Qortal-linkki",
       "invalid_secret_key": "salainen avain ei ole kelvollinen",
       "invalid_uint8": "antamasi Uint8ArrayData on virheellinen",
       "name_not_existing": "nimeä ei ole olemassa",
       "name_not_registered": "nimeä ei ole rekisteröity",
+      "qapp_account_authentication_required": "Q-Appin on tunnistettava Qortal-tilisi ennen identiteettitodisteen pyytämistä",
       "read_blob_base64": "Blobin lukeminen base64-merkkijonona epäonnistui",
       "reencrypt_secret_key": "salaisen avaimen uudelleensalaus epäonnistui",
-      "set_apikey": "API-avaimen asettaminen epäonnistui:"
+      "set_apikey": "API-avaimen asettaminen epäonnistui:",
+      "wallet_account_mismatch": "tunnistettu lompakko ei vastaa aktiivista Qortal-tiliä"
     },
     "generic": {
       "block_list_intro": "Lisää Qortal-nimi tai -osoite estääksesi. Osoitteet vaikuttavat tapahtumiin; nimen esto piilottaa tiedot koko Hubissa.",
diff --git a/src/i18n/locales/fi/question.json b/src/i18n/locales/fi/question.json
index 769946266..1ba3b1918 100644
--- a/src/i18n/locales/fi/question.json
+++ b/src/i18n/locales/fi/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "haluatko ottaa tämän AT:n käyttöön?",
   "description": "kuvaus: {{ description }}",
   "download_file": "haluatko ladata:",
+  "local_send": {
+    "changed": "Lompakko, solmu tai käytettävissä olevat varat ovat muuttuneet. Tarkista maksu uudelleen.",
+    "confirming": "Edellinen maksusi odottaa vielä verkon vahvistusta. Tapahtuma: {{txId}}. Uutta maksua ei lähetetty.",
+    "declined": "Maksu hylätty.",
+    "invalid": "Maksua ei voi valmistella turvallisesti. Tarkista osoite, summa, saldo, siirtomaksu ja yhteys solmuun.",
+    "native_body": "Lompakko: {{wallet}}\n\nUlostulot:\n{{outputs}}\n\nVerkkomaksu: {{fee}}",
+    "native_title": "Vahvista lompakon maksu",
+    "pending": "Aiempi maksu on tarkistettava ennen uuden lähettämistä. Tapahtuma: {{txId}}",
+    "previous": "Edellinen maksusi lähetettiin. Tapahtuma: {{txId}}. Aloita uusi maksu, jos haluat lähettää uudelleen.",
+    "recovery": "Aiemmin hyväksytty maksu on yhä odottamassa. Lähetetäänkö sama tapahtuma uudelleen verkkoon? Tämä ei lähetä pyytämääsi uutta maksua.",
+    "unknown": "Lähetyksen tulos on tuntematon. Älä lähetä uudelleen. Tarkista tapahtuma {{txId}} lompakon historiasta.",
+    "upgrade": "Lompakon tapahtumien paikallinen allekirjoittaminen edellyttää päivitettyjä Qortal Core- ja Qortal Hub -versioita."
+  },
   "message": {
     "error": {
       "add_to_list": "lisäys luetteloon epäonnistui",
@@ -44,6 +57,7 @@
       "file_extension": "tiedostopäätettä ei voitu päätellä",
       "gateway_balance_local_node": "et voi tarkastella {{ token }} saldoa yhdyskäytävän kautta. Käytä paikallista solmuasi.",
       "gateway_non_qort_local_node": "et voi lähettää muuta kuin QORT-kolikkoa yhdyskäytävän kautta. Käytä paikallista solmuasi.",
+      "gateway_pirate_local_node": "Pirate Chain (ARRR) ei ole käytettävissä julkisilla solmuilla. Käytä paikallista solmua.",
       "gateway_retrieve_balance": "{{ token }} saldon nouto ei ole sallittua yhdyskäytävän kautta",
       "gateway_wallet_local_node": "et voi tarkastella {{ token }} lompakkoa yhdyskäytävän kautta. Käytä paikallista solmuasi.",
       "get_foreign_fee": "virhe ulkomaan maksun noutamisessa",
@@ -131,6 +145,9 @@
     "add_admin": "annatko tälle sovellukselle luvan lisätä käyttäjä {{ invitee }} järjestelmänvalvojaksi?",
     "all_item_list": "annatko tälle sovellukselle luvan lisätä seuraavat kohteet luetteloon {{ name }}:",
     "authenticate": "annatko tälle sovellukselle luvan todentaa?",
+    "backend_connection": "Sallitaanko sovelluksen {{appName}} muodostaa yhteys taustapalvelimeensa?",
+    "backend_connection_description": "Tämä sallii sovelluksen lähettää ja vastaanottaa tietoja taustapalvelimensa kanssa tämän välilehden ollessa avoinna.",
+    "backend_connection_understand": "Sallin tämän sovelluksen muodostaa yhteyden taustapalvelimeensa ja vaihtaa tietoja sen kanssa.",
     "ban": "annatko tälle sovellukselle luvan kieltää {{ partecipant }} ryhmästä?",
     "buy_name": "annatko tälle sovellukselle luvan ostaa nimen?",
     "buy_name_detail": "ostetaan {{ name }} hintaan {{ price }} QORT",
@@ -170,6 +187,10 @@
     "register_name": "annatko tälle sovellukselle luvan rekisteröidä tämän nimen?",
     "remove_admin": "annatko tälle sovellukselle luvan poistaa käyttäjä {{ partecipant }} järjestelmänvalvojana?",
     "remove_from_list": "annatko tälle sovellukselle luvan poistaa seuraavat kohteet luettelosta {{ name }}:",
+    "reticulum_destination": "{{appName}} haluaa muodostaa yhteyden Reticulum-taustapalvelimeen {{destination}}. Sallitaanko yhteys tässä välilehdessä?",
+    "reticulum_remote_backend_understand": "Ymmärrän, että tämä Q-App vaihtaa tietoja Qortal Hubin ulkopuolisen etätaustapalvelun kanssa.",
+    "screen_capture_description": "Saako {{origin}} nähdä näyttöjen ja ikkunoiden esikatselut ja tallentaa sisältöä tätä pyyntöä varten? Salli vain luotetut sovellukset. Valitse näyttö tai ikkuna sovelluksessa.",
+    "screen_capture_title": "Sallitaanko näytön tallennus?",
     "sell_name_cancel": "annatko tälle sovellukselle luvan peruuttaa nimen myynnin?",
     "sell_name_transaction": "annatko tälle sovellukselle luvan luoda nimenmyyntitransaktion?",
     "sell_name_transaction_detail": "myy {{ name }} hintaan {{ price }} QORT",
@@ -178,6 +199,7 @@
     "send_coins": "annatko tälle sovellukselle luvan lähettää kolikoita?",
     "server_add": "annatko tälle sovellukselle luvan lisätä palvelimen?",
     "server_remove": "annatko tälle sovellukselle luvan poistaa palvelimen?",
+    "session_only_summary": "Myönnä oikeudet vain tälle istunnolle",
     "session_permissions": "{{appName}} pyytää istuntokohtaisia oikeuksia",
     "session_permissions_description": "Seuraavat oikeudet myönnetään automaattisesti tälle istunnolle:",
     "session_understand": "Luotan tähän sovellukseen ja ymmärrän, että nämä oikeudet suoritetaan automaattisesti",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} sats per kt",
   "server_host": "isäntä: {{ host }}",
   "server_type": "tyyppi: {{ type }}",
+  "stream_save": {
+    "choose": "Valitse sijainti",
+    "detail": "Sovellus: {{app}}\nEhdotettu tiedostonimi: {{filename}}\nIlmoitettu koko: {{size}} tavua\n\nSovellus antaa nämä tiedot. Hub ei voi tarkistaa sisältöä tai tiedoston turvallisuutta. Tämä lupa koskee vain tätä tallennusta.",
+    "failed": "Tiedostoa ei voitu tallentaa. Yritä uudelleen.",
+    "title": "Tallenna tiedosto laitteellesi",
+    "unavailable": "Tiedostojen tallentaminen osissa edellyttää Qortal Hubin päivitettyä työpöytäversiota."
+  },
   "to_group": "vastaanottaja: ryhmä {{ group_id }}",
   "to_recipient": "vastaanottaja: {{ recipient }}",
   "total_locking_fee": "lukitusmaksu yhteensä:",
diff --git a/src/i18n/locales/fr/auth.json b/src/i18n/locales/fr/auth.json
index c39583069..fa59fec3e 100644
--- a/src/i18n/locales/fr/auth.json
+++ b/src/i18n/locales/fr/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }} introuvable dans le JSON",
       "find_secret_key": "clé secrète correcte introuvable",
       "incorrect_password": "mot de passe incorrect",
+      "invalid_qapp_identity_challenge": "défi d’identité Q-App non valide",
+      "invalid_qapp_identity_context": "contexte d’identité Q-App non valide",
       "invalid_qortal_link": "lien Qortal invalide",
       "invalid_secret_key": "clé secrète invalide",
       "invalid_uint8": "les données Uint8Array soumises sont invalides",
       "name_not_existing": "le nom n'existe pas",
       "name_not_registered": "nom non enregistré",
+      "qapp_account_authentication_required": "la Q-App doit authentifier votre compte Qortal avant de demander une preuve d’identité",
       "read_blob_base64": "échec de la lecture du Blob en base64",
       "reencrypt_secret_key": "impossible de re-chiffrer la clé secrète",
-      "set_apikey": "échec de la configuration de la clé API :"
+      "set_apikey": "échec de la configuration de la clé API :",
+      "wallet_account_mismatch": "le portefeuille authentifié ne correspond pas au compte Qortal actif"
     },
     "generic": {
       "block_list_intro": "Ajoutez un nom Qortal ou une adresse pour les bloquer. Les adresses concernent les transactions ; bloquer un nom masque ses données dans tout le Hub.",
diff --git a/src/i18n/locales/fr/question.json b/src/i18n/locales/fr/question.json
index e9afed2a8..ee8df2d8b 100644
--- a/src/i18n/locales/fr/question.json
+++ b/src/i18n/locales/fr/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "Souhaitez-vous déployer cet AT ?",
   "description": "description : {{ description }}",
   "download_file": "Souhaitez-vous télécharger :",
+  "local_send": {
+    "changed": "Le portefeuille, le nœud ou les fonds disponibles ont changé. Vérifiez à nouveau le paiement.",
+    "confirming": "Votre paiement précédent attend toujours la confirmation du réseau. Transaction : {{txId}}. Aucun nouveau paiement n’a été envoyé.",
+    "declined": "Paiement refusé.",
+    "invalid": "Impossible de préparer ce paiement en toute sécurité. Vérifiez l’adresse, le montant, le solde, les frais et la connexion au nœud.",
+    "native_body": "Portefeuille : {{wallet}}\n\nSorties :\n{{outputs}}\n\nFrais de réseau : {{fee}}",
+    "native_title": "Confirmer le paiement du portefeuille",
+    "pending": "Un paiement précédent doit être vérifié avant tout nouvel envoi. Transaction : {{txId}}",
+    "previous": "Votre paiement précédent a été envoyé. Transaction : {{txId}}. Commencez un nouveau paiement si vous souhaitez envoyer à nouveau.",
+    "recovery": "Un paiement précédemment autorisé est toujours en attente. Voulez-vous rediffuser cette même transaction ? Cela n’enverra pas le nouveau paiement demandé.",
+    "unknown": "Le résultat de la diffusion est inconnu. Ne renvoyez pas le paiement. Vérifiez la transaction {{txId}} dans l’historique du portefeuille.",
+    "upgrade": "La signature locale des transactions du portefeuille nécessite des versions à jour de Qortal Core et Qortal Hub."
+  },
   "message": {
     "error": {
       "add_to_list": "échec de l'ajout à la liste",
@@ -44,6 +57,7 @@
       "file_extension": "impossible de déterminer l'extension du fichier",
       "gateway_balance_local_node": "le solde {{ token }} ne peut pas être consulté via la passerelle. Utilisez votre nœud local.",
       "gateway_non_qort_local_node": "les pièces non-QORT ne peuvent pas être envoyées via la passerelle. Utilisez votre nœud local.",
+      "gateway_pirate_local_node": "Pirate Chain (ARRR) n’est pas disponible sur les nœuds publics. Utilisez un nœud local.",
       "gateway_retrieve_balance": "la récupération du solde {{ token }} n'est pas autorisée via une passerelle",
       "gateway_wallet_local_node": "le portefeuille {{ token }} ne peut pas être consulté via la passerelle. Utilisez votre nœud local.",
       "get_foreign_fee": "erreur lors de l'obtention des frais étrangers",
@@ -131,6 +145,9 @@
     "add_admin": "Souhaitez-vous autoriser cette application à ajouter l'utilisateur {{ invitee }} comme administrateur ?",
     "all_item_list": "Souhaitez-vous autoriser cette application à ajouter les éléments suivants à la liste {{ name }} :",
     "authenticate": "Souhaitez-vous autoriser cette application à s'authentifier ?",
+    "backend_connection": "Autoriser {{appName}} à se connecter à son serveur ?",
+    "backend_connection_description": "Cela permet à l’application d’envoyer et de recevoir des données avec son serveur tant que cet onglet est ouvert.",
+    "backend_connection_understand": "J’autorise cette application à se connecter à son serveur et à échanger des données avec lui.",
     "ban": "Souhaitez-vous autoriser cette application à bannir {{ partecipant }} du groupe ?",
     "buy_name": "Souhaitez-vous autoriser cette application à acheter un nom ?",
     "buy_name_detail": "achat de {{ name }} pour {{ price }} QORT",
@@ -170,6 +187,10 @@
     "register_name": "Souhaitez-vous autoriser cette application à enregistrer ce nom ?",
     "remove_admin": "Souhaitez-vous autoriser cette application à retirer {{ partecipant }} en tant qu'administrateur ?",
     "remove_from_list": "Souhaitez-vous autoriser cette application à supprimer les éléments suivants de la liste {{ name }} :",
+    "reticulum_destination": "{{appName}} souhaite se connecter au serveur Reticulum {{destination}}. Autoriser cette connexion pour cet onglet ?",
+    "reticulum_remote_backend_understand": "Je comprends que cette Q-App échangera des données avec un serveur distant externe à Qortal Hub.",
+    "screen_capture_description": "Autoriser {{origin}} à voir les aperçus des écrans et fenêtres et à capturer du contenu pour cette demande ? N’autorisez que les applications de confiance. Choisissez l’écran ou la fenêtre dans l’application.",
+    "screen_capture_title": "Autoriser la capture d’écran ?",
     "sell_name_cancel": "Souhaitez-vous autoriser cette application à annuler la vente d'un nom ?",
     "sell_name_transaction": "Souhaitez-vous autoriser cette application à créer une transaction de vente de nom ?",
     "sell_name_transaction_detail": "vente de {{ name }} pour {{ price }} QORT",
@@ -178,6 +199,7 @@
     "send_coins": "Souhaitez-vous autoriser cette application à envoyer des pièces ?",
     "server_add": "Souhaitez-vous autoriser cette application à ajouter un serveur ?",
     "server_remove": "Souhaitez-vous autoriser cette application à supprimer un serveur ?",
+    "session_only_summary": "Accorder les autorisations uniquement pour cette session",
     "session_permissions": "{{appName}} demande des autorisations de session",
     "session_permissions_description": "Les autorisations suivantes seront automatiquement accordées pour cette session :",
     "session_understand": "Je fais confiance à cette application et comprends que ces autorisations seront exécutées automatiquement",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} sats par KB",
   "server_host": "hôte : {{ host }}",
   "server_type": "type : {{ type }}",
+  "stream_save": {
+    "choose": "Choisir un emplacement",
+    "detail": "App : {{app}}\nNom de fichier suggéré : {{filename}}\nTaille déclarée : {{size}} octets\n\nCes informations proviennent de l’app. Hub ne peut vérifier ni le contenu ni la sécurité du fichier. Cette autorisation ne vaut que pour cet enregistrement.",
+    "failed": "Le fichier n’a pas pu être enregistré. Veuillez réessayer.",
+    "title": "Enregistrer un fichier sur votre appareil",
+    "unavailable": "L’enregistrement progressif des fichiers nécessite une version de bureau à jour de Qortal Hub."
+  },
   "to_group": "à : groupe {{ group_id }}",
   "to_recipient": "à : {{ recipient }}",
   "total_locking_fee": "frais de verrouillage totaux :",
diff --git a/src/i18n/locales/it/auth.json b/src/i18n/locales/it/auth.json
index c43e164b5..8105e81ad 100644
--- a/src/i18n/locales/it/auth.json
+++ b/src/i18n/locales/it/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }} non trovato nel JSON",
       "find_secret_key": "impossibile trovare secretkey corretta",
       "incorrect_password": "password errata",
+      "invalid_qapp_identity_challenge": "richiesta di identità Q-App non valida",
+      "invalid_qapp_identity_context": "contesto di identità Q-App non valido",
       "invalid_qortal_link": "collegamento Qortal non valido",
       "invalid_secret_key": "la chiave segreta non è valida",
       "invalid_uint8": "l'uint8arraydata inviato non è valido",
       "name_not_existing": "il nome non esiste",
       "name_not_registered": "nome non registrato",
+      "qapp_account_authentication_required": "la Q-App deve autenticare il tuo account Qortal prima di richiedere una prova d’identità",
       "read_blob_base64": "impossibile leggere il BLOB come stringa codificata da base64",
       "reencrypt_secret_key": "impossibile recriptare la chiave segreta",
-      "set_apikey": "impossibile impostare la chiave API:"
+      "set_apikey": "impossibile impostare la chiave API:",
+      "wallet_account_mismatch": "il portafoglio autenticato non corrisponde all’account Qortal attivo"
     },
     "generic": {
       "block_list_intro": "Aggiungi un nome Qortal o un indirizzo per bloccarli. Gli indirizzi influenzano le transazioni; bloccare un nome nasconde i suoi dati in tutto il Hub.",
diff --git a/src/i18n/locales/it/question.json b/src/i18n/locales/it/question.json
index bdd99026c..b6b57e9e8 100644
--- a/src/i18n/locales/it/question.json
+++ b/src/i18n/locales/it/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "vuoi distribuire questo AT?",
   "description": "descrizione: {{ description }}",
   "download_file": "vuoi scaricare:",
+  "local_send": {
+    "changed": "Il portafoglio, il nodo o i fondi disponibili sono cambiati. Controlla nuovamente il pagamento.",
+    "confirming": "Il pagamento precedente è ancora in attesa della conferma della rete. Transazione: {{txId}}. Non è stato inviato alcun nuovo pagamento.",
+    "declined": "Pagamento rifiutato.",
+    "invalid": "Impossibile preparare questo pagamento in sicurezza. Controlla indirizzo, importo, saldo, commissione e connessione al nodo.",
+    "native_body": "Portafoglio: {{wallet}}\n\nUscite:\n{{outputs}}\n\nCommissione di rete: {{fee}}",
+    "native_title": "Conferma il pagamento dal portafoglio",
+    "pending": "Un pagamento precedente deve essere verificato prima di inviarne un altro. Transazione: {{txId}}",
+    "previous": "Il pagamento precedente è stato inviato. Transazione: {{txId}}. Avvia un nuovo pagamento se desideri inviare di nuovo.",
+    "recovery": "Un pagamento autorizzato in precedenza è ancora in sospeso. Vuoi ritrasmettere la stessa transazione? Il nuovo pagamento richiesto non verrà inviato.",
+    "unknown": "L’esito della trasmissione è sconosciuto. Non inviare di nuovo. Controlla la transazione {{txId}} nella cronologia del portafoglio.",
+    "upgrade": "La firma locale delle transazioni del portafoglio richiede versioni aggiornate di Qortal Core e Qortal Hub."
+  },
   "message": {
     "error": {
       "add_to_list": "impossibile aggiungere alla lista",
@@ -44,6 +57,7 @@
       "file_extension": "impossibile determinare l'estensione del file",
       "gateway_balance_local_node": "non è possibile visualizzare il saldo {{ token }} tramite il gateway. Utilizzare il nodo locale.",
       "gateway_non_qort_local_node": "non è possibile inviare monete non-QORT tramite il gateway. Utilizzare il nodo locale.",
+      "gateway_pirate_local_node": "Pirate Chain (ARRR) non è disponibile sui nodi pubblici. Usa un nodo locale.",
       "gateway_retrieve_balance": "il recupero del saldo {{ token }} non è consentito tramite un gateway",
       "gateway_wallet_local_node": "non è possibile visualizzare il wallet {{ token }} tramite il gateway. Utilizzare il nodo locale.",
       "get_foreign_fee": "errore nel recupero delle commissioni estere",
@@ -131,6 +145,9 @@
     "add_admin": "consenti a questa applicazione di aggiungere l'utente {{ invitee }} come amministratore?",
     "all_item_list": "consenti a questa applicazione di aggiungere i seguenti elementi alla lista {{ name }}:",
     "authenticate": "consenti a questa applicazione di autenticarti?",
+    "backend_connection": "Consentire a {{appName}} di connettersi al proprio server?",
+    "backend_connection_description": "Questo consente all’app di inviare e ricevere dati dal proprio server finché questa scheda rimane aperta.",
+    "backend_connection_understand": "Consento a questa app di connettersi al proprio server e scambiare dati con esso.",
     "ban": "consenti a questa applicazione di escludere {{ partecipant }} dal gruppo?",
     "buy_name": "consenti a questa applicazione di acquistare un nome?",
     "buy_name_detail": "acquisto di {{ name }} per {{ price }} QORT",
@@ -170,6 +187,10 @@
     "register_name": "consenti a questa applicazione di registrare questo nome?",
     "remove_admin": "consenti a questa applicazione di rimuovere l'utente {{ partecipant }} come amministratore?",
     "remove_from_list": "consenti a questa applicazione di rimuovere i seguenti elementi dalla lista {{ name }}?",
+    "reticulum_destination": "{{appName}} vuole connettersi al backend Reticulum {{destination}}. Consentire questa connessione per questa scheda?",
+    "reticulum_remote_backend_understand": "Comprendo che questa Q-App scambierà dati con un backend remoto esterno a Qortal Hub.",
+    "screen_capture_description": "Consentire a {{origin}} di vedere le anteprime di schermi e finestre e acquisire contenuti per questa richiesta? Autorizza solo app affidabili. Scegli lo schermo o la finestra nell’app.",
+    "screen_capture_title": "Consentire la cattura dello schermo?",
     "sell_name_cancel": "consenti a questa applicazione di annullare la vendita di un nome?",
     "sell_name_transaction": "consenti a questa applicazione di creare una transazione di vendita nome?",
     "sell_name_transaction_detail": "vendi {{ name }} per {{ price }} QORT",
@@ -178,6 +199,7 @@
     "send_coins": "consenti a questa applicazione di inviare monete?",
     "server_add": "consenti a questa applicazione di aggiungere un server?",
     "server_remove": "consenti a questa applicazione di rimuovere un server?",
+    "session_only_summary": "Concedi le autorizzazioni solo per questa sessione",
     "session_permissions": "{{appName}} richiede autorizzazioni di sessione",
     "session_permissions_description": "Le seguenti autorizzazioni verranno concesse automaticamente per questa sessione:",
     "session_understand": "Mi fido di questa applicazione e comprendo che queste autorizzazioni verranno eseguite automaticamente",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} sats per KB",
   "server_host": "host: {{ host }}",
   "server_type": "tipo: {{ type }}",
+  "stream_save": {
+    "choose": "Scegli posizione",
+    "detail": "App: {{app}}\nNome file suggerito: {{filename}}\nDimensione dichiarata: {{size}} byte\n\nQuesti dati sono forniti dall’app. Hub non può verificare il contenuto o la sicurezza del file. Questa autorizzazione vale solo per questo salvataggio.",
+    "failed": "Impossibile salvare il file. Riprova.",
+    "title": "Salva un file sul tuo dispositivo",
+    "unavailable": "Il salvataggio progressivo dei file richiede una versione desktop aggiornata di Qortal Hub."
+  },
   "to_group": "a: gruppo {{ group_id }}",
   "to_recipient": "a: {{ recipient }}",
   "total_locking_fee": "commissione totale di blocco:",
diff --git a/src/i18n/locales/ja/auth.json b/src/i18n/locales/ja/auth.json
index 58fadcece..2f3bf19ce 100644
--- a/src/i18n/locales/ja/auth.json
+++ b/src/i18n/locales/ja/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "JSONに{{ field }}が見つかりません",
       "find_secret_key": "正しい秘密鍵が見つかりません",
       "incorrect_password": "パスワードが間違っています",
+      "invalid_qapp_identity_challenge": "Q-Appの本人確認チャレンジが無効です",
+      "invalid_qapp_identity_context": "Q-Appの本人確認コンテキストが無効です",
       "invalid_qortal_link": "無効なQortalリンク",
       "invalid_secret_key": "無効な秘密鍵です",
       "invalid_uint8": "送信されたUint8ArrayDataは無効です",
       "name_not_existing": "名前が存在しません",
       "name_not_registered": "名前が登録されていません",
+      "qapp_account_authentication_required": "本人確認証明を要求する前に、Q-AppでQortalアカウントを認証する必要があります",
       "read_blob_base64": "Blobをbase64文字列として読み取れませんでした",
       "reencrypt_secret_key": "秘密鍵を再暗号化できませんでした",
-      "set_apikey": "APIキーの設定に失敗しました："
+      "set_apikey": "APIキーの設定に失敗しました：",
+      "wallet_account_mismatch": "認証されたウォレットが現在のQortalアカウントと一致しません"
     },
     "generic": {
       "block_list_intro": "Qortal の名前またはアドレスを追加してブロックします。アドレスは取引処理に影響し、名前をブロックすると Hub 全体でそのデータが表示されません。",
diff --git a/src/i18n/locales/ja/question.json b/src/i18n/locales/ja/question.json
index 490e636c3..dcf66b68e 100644
--- a/src/i18n/locales/ja/question.json
+++ b/src/i18n/locales/ja/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "このATをデプロイしますか？",
   "description": "説明：{{ description }}",
   "download_file": "次のファイルをダウンロードしますか：",
+  "local_send": {
+    "changed": "ウォレット、ノード、または利用可能な資金が変更されました。支払いを再確認してください。",
+    "confirming": "前回の支払いはまだネットワークの確認を待っています。トランザクション：{{txId}}。新しい支払いは送信されていません。",
+    "declined": "支払いが拒否されました。",
+    "invalid": "この支払いを安全に準備できません。アドレス、金額、残高、手数料、ノードへの接続を確認してください。",
+    "native_body": "ウォレット：{{wallet}}\n\n出力：\n{{outputs}}\n\nネットワーク手数料：{{fee}}",
+    "native_title": "ウォレットの支払いを確認",
+    "pending": "次の支払いを送信する前に、以前の支払いを確認する必要があります。トランザクション：{{txId}}",
+    "previous": "前回の支払いは送信されました。トランザクション：{{txId}}。もう一度送信する場合は、新しい支払いを開始してください。",
+    "recovery": "以前承認した支払いがまだ保留中です。同じトランザクションを再送信しますか？新しく依頼した支払いは送信されません。",
+    "unknown": "ブロードキャストの結果が不明です。再送信しないでください。ウォレットの履歴でトランザクション{{txId}}を確認してください。",
+    "upgrade": "ウォレットのトランザクションをローカルで署名するには、Qortal CoreとQortal Hubを更新する必要があります。"
+  },
   "message": {
     "error": {
       "add_to_list": "リストへの追加に失敗しました",
@@ -44,6 +57,7 @@
       "file_extension": "ファイルの拡張子を特定できませんでした",
       "gateway_balance_local_node": "ゲートウェイ経由で{{ token }}の残高を表示できません。ローカルノードを使用してください。",
       "gateway_non_qort_local_node": "ゲートウェイ経由でQORT以外のコインを送信できません。ローカルノードを使用してください。",
+      "gateway_pirate_local_node": "Pirate Chain（ARRR）は公開ノードでは利用できません。ローカルノードを使用してください。",
       "gateway_retrieve_balance": "ゲートウェイ経由では{{ token }}の残高取得は許可されていません",
       "gateway_wallet_local_node": "ゲートウェイ経由で{{ token }}のウォレットを表示できません。ローカルノードを使用してください。",
       "get_foreign_fee": "外国手数料の取得時にエラーが発生しました",
@@ -131,6 +145,9 @@
     "add_admin": "このアプリにユーザー {{ invitee }} を管理者として追加することを許可しますか？",
     "all_item_list": "このアプリに以下をリスト {{ name }} に追加することを許可しますか？",
     "authenticate": "このアプリに認証を許可しますか？",
+    "backend_connection": "{{appName}}がバックエンドに接続することを許可しますか？",
+    "backend_connection_description": "このタブが開いている間、アプリがバックエンドとデータを送受信できるようになります。",
+    "backend_connection_understand": "このアプリがバックエンドに接続し、データを交換することを許可します。",
     "ban": "このアプリに {{ partecipant }} をグループから追放することを許可しますか？",
     "buy_name": "このアプリに名前を購入することを許可しますか？",
     "buy_name_detail": "{{ price }} QORTで{{ name }}を購入",
@@ -170,6 +187,10 @@
     "register_name": "このアプリにこの名前を登録することを許可しますか？",
     "remove_admin": "このアプリに {{ partecipant }} を管理者から削除することを許可しますか？",
     "remove_from_list": "このアプリにリスト {{ name }} から以下を削除することを許可しますか？",
+    "reticulum_destination": "{{appName}} が Reticulum バックエンド {{destination}} への接続を要求しています。このタブで接続を許可しますか？",
+    "reticulum_remote_backend_understand": "このQ-AppがQortal Hub外部のリモートバックエンドとデータを交換することを理解しています。",
+    "screen_capture_description": "{{origin}} に画面やウィンドウのプレビューの表示と、このリクエストでのコンテンツのキャプチャを許可しますか？信頼できるアプリのみに許可してください。画面やウィンドウはアプリ内で選択します。",
+    "screen_capture_title": "画面キャプチャを許可しますか？",
     "sell_name_cancel": "このアプリに名前の販売をキャンセルすることを許可しますか？",
     "sell_name_transaction": "このアプリに名前の販売取引を作成することを許可しますか？",
     "sell_name_transaction_detail": "{{ price }} QORTで{{ name }}を販売",
@@ -178,6 +199,7 @@
     "send_coins": "このアプリにコインを送信することを許可しますか？",
     "server_add": "このアプリにサーバーを追加することを許可しますか？",
     "server_remove": "このアプリにサーバーを削除することを許可しますか？",
+    "session_only_summary": "このセッションにのみ権限を付与",
     "session_permissions": "{{appName}} がセッション権限を要求しています",
     "session_permissions_description": "以下の権限はこのセッション中に自動的に付与されます：",
     "session_understand": "このアプリを信頼しており、これらの権限が自動的に実行されることを理解しています",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} sats／KB",
   "server_host": "ホスト：{{ host }}",
   "server_type": "タイプ：{{ type }}",
+  "stream_save": {
+    "choose": "保存先を選択",
+    "detail": "アプリ：{{app}}\n提案されたファイル名：{{filename}}\n申告サイズ：{{size}} バイト\n\nこれらの情報はアプリから提供されています。Hubは内容やファイルの安全性を確認できません。この許可は今回の保存にのみ適用されます。",
+    "failed": "ファイルを保存できませんでした。もう一度お試しください。",
+    "title": "デバイスにファイルを保存",
+    "unavailable": "ファイルの逐次保存には、最新のデスクトップ版Qortal Hubが必要です。"
+  },
   "to_group": "宛先：グループ {{ group_id }}",
   "to_recipient": "宛先：{{ recipient }}",
   "total_locking_fee": "ロック手数料合計：",
diff --git a/src/i18n/locales/pt/auth.json b/src/i18n/locales/pt/auth.json
index d724b0f5f..88d3fbbac 100644
--- a/src/i18n/locales/pt/auth.json
+++ b/src/i18n/locales/pt/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }} não encontrado no JSON",
       "find_secret_key": "não é possível encontrar a chave secreta correta",
       "incorrect_password": "senha incorreta",
+      "invalid_qapp_identity_challenge": "desafio de identidade da Q-App inválido",
+      "invalid_qapp_identity_context": "contexto de identidade da Q-App inválido",
       "invalid_qortal_link": "link do qortal inválido",
       "invalid_secret_key": "chave secreta inválida",
       "invalid_uint8": "o Uint8ArrayData enviado é inválido",
       "name_not_existing": "nome não existe",
       "name_not_registered": "nome não registrado",
+      "qapp_account_authentication_required": "a Q-App deve autenticar a sua conta Qortal antes de solicitar uma prova de identidade",
       "read_blob_base64": "falha ao ler o Blob como string codificada em base64",
       "reencrypt_secret_key": "não foi possível recriptografar a chave secreta",
-      "set_apikey": "falha ao definir a APIkey:"
+      "set_apikey": "falha ao definir a APIkey:",
+      "wallet_account_mismatch": "a carteira autenticada não corresponde à conta Qortal ativa"
     },
     "generic": {
       "block_list_intro": "Adicione um nome Qortal ou um endereço para bloqueá-los. Os endereços afetam transações; bloquear um nome oculta seus dados em todo o Hub.",
diff --git a/src/i18n/locales/pt/question.json b/src/i18n/locales/pt/question.json
index c5a64dbe7..9a3e2b959 100644
--- a/src/i18n/locales/pt/question.json
+++ b/src/i18n/locales/pt/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "você gostaria de implantar este AT?",
   "description": "descrição: {{ description }}",
   "download_file": "você gostaria de baixar:",
+  "local_send": {
+    "changed": "A carteira, o nó ou os fundos disponíveis mudaram. Revise o pagamento novamente.",
+    "confirming": "O seu pagamento anterior ainda aguarda confirmação da rede. Transação: {{txId}}. Nenhum novo pagamento foi enviado.",
+    "declined": "Pagamento recusado.",
+    "invalid": "Não foi possível preparar este pagamento com segurança. Verifique o endereço, o valor, o saldo, a taxa e a conexão com o nó.",
+    "native_body": "Carteira: {{wallet}}\n\nSaídas:\n{{outputs}}\n\nTaxa de rede: {{fee}}",
+    "native_title": "Confirmar pagamento da carteira",
+    "pending": "É necessário verificar um pagamento anterior antes de enviar outro. Transação: {{txId}}",
+    "previous": "O seu pagamento anterior foi enviado. Transação: {{txId}}. Inicie um novo pagamento se quiser enviar novamente.",
+    "recovery": "Um pagamento autorizado anteriormente ainda está pendente. Retransmitir essa mesma transação? Isto não enviará o novo pagamento solicitado.",
+    "unknown": "O resultado da transmissão é desconhecido. Não envie novamente. Verifique a transação {{txId}} no histórico da carteira.",
+    "upgrade": "A assinatura local de transações da carteira requer versões atualizadas do Qortal Core e do Qortal Hub."
+  },
   "message": {
     "error": {
       "add_to_list": "falha ao adicionar à lista",
@@ -44,6 +57,7 @@
       "file_extension": "não foi possível determinar a extensão do arquivo",
       "gateway_balance_local_node": "não é possível visualizar o saldo de {{ token }} pelo gateway. Por favor, use seu nó local.",
       "gateway_non_qort_local_node": "não é possível enviar uma moeda que não seja QORT pelo gateway. Por favor, use seu nó local.",
+      "gateway_pirate_local_node": "Pirate Chain (ARRR) não está disponível em nós públicos. Use um nó local.",
       "gateway_retrieve_balance": "recuperar o saldo de {{ token }} não é permitido através de um gateway",
       "gateway_wallet_local_node": "não é possível visualizar a carteira de {{ token }} pelo gateway. Por favor, use seu nó local.",
       "get_foreign_fee": "erro ao obter taxa externa",
@@ -131,6 +145,9 @@
     "add_admin": "você dá permissão para que este aplicativo adicione o usuário {{ invitee }} como administrador?",
     "all_item_list": "você dá permissão para que este aplicativo adicione o seguinte à lista {{ name }}:",
     "authenticate": "você dá permissão para que este aplicativo autentique?",
+    "backend_connection": "Permitir que {{appName}} se conecte ao seu servidor?",
+    "backend_connection_description": "Isto permite que a aplicação envie e receba dados do seu servidor enquanto este separador estiver aberto.",
+    "backend_connection_understand": "Permito que esta aplicação se conecte ao seu servidor e troque dados com ele.",
     "ban": "você dá permissão para que este aplicativo bloqueie {{ partecipant }} do grupo?",
     "buy_name": "você dá permissão para que este aplicativo compre um nome?",
     "buy_name_detail": "comprando {{ name }} por {{ price }} QORTs",
@@ -170,6 +187,10 @@
     "register_name": "você dá permissão para que este aplicativo registre este nome?",
     "remove_admin": "você dá permissão para que este aplicativo remova o usuário {{ partecipant }} como administrador?",
     "remove_from_list": "você dá permissão para que este aplicativo remova o seguinte da lista {{ name }}:",
+    "reticulum_destination": "{{appName}} quer se conectar ao backend Reticulum {{destination}}. Permitir esta conexão para esta aba?",
+    "reticulum_remote_backend_understand": "Entendo que este Q-App trocará dados com um backend remoto externo ao Qortal Hub.",
+    "screen_capture_description": "Permitir que {{origin}} veja pré-visualizações de ecrãs e janelas e capture conteúdo para este pedido? Autorize apenas aplicações de confiança. Escolha o ecrã ou a janela na aplicação.",
+    "screen_capture_title": "Permitir a captura de ecrã?",
     "sell_name_cancel": "você dá permissão para que este aplicativo cancele a venda de um nome?",
     "sell_name_transaction": "você dá permissão para que este aplicativo crie uma transação de venda de nome?",
     "sell_name_transaction_detail": "vender {{ name }} por {{ price }} QORTs",
@@ -178,6 +199,7 @@
     "send_coins": "você dá permissão para que este aplicativo envie moedas?",
     "server_add": "você dá permissão para que este aplicativo adicione um servidor?",
     "server_remove": "você dá permissão para que este aplicativo remova um servidor?",
+    "session_only_summary": "Conceder permissões apenas para esta sessão",
     "session_permissions": "{{appName}} está solicitando permissões de sessão",
     "session_permissions_description": "As seguintes permissões serão concedidas automaticamente para esta sessão:",
     "session_understand": "Confio neste aplicativo e entendo que essas permissões serão executadas automaticamente",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} sats por KB",
   "server_host": "servidor: {{ host }}",
   "server_type": "tipo: {{ type }}",
+  "stream_save": {
+    "choose": "Escolher localização",
+    "detail": "App: {{app}}\nNome de ficheiro sugerido: {{filename}}\nTamanho declarado: {{size}} bytes\n\nEstes dados são fornecidos pela app. O Hub não pode verificar o conteúdo nem se o ficheiro é seguro. Esta permissão aplica-se apenas a esta gravação.",
+    "failed": "Não foi possível guardar o ficheiro. Tente novamente.",
+    "title": "Guardar um ficheiro no seu dispositivo",
+    "unavailable": "A gravação progressiva de ficheiros requer uma versão de computador atualizada do Qortal Hub."
+  },
   "to_group": "para: grupo {{ group_id }}",
   "to_recipient": "para: {{ recipient }}",
   "total_locking_fee": "taxa de bloqueio total:",
diff --git a/src/i18n/locales/ru/auth.json b/src/i18n/locales/ru/auth.json
index 7fa68363e..33dae5b7d 100644
--- a/src/i18n/locales/ru/auth.json
+++ b/src/i18n/locales/ru/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "{{ field }} не найден в JSON",
       "find_secret_key": "не удалось найти правильный секретный ключ",
       "incorrect_password": "неверный пароль",
+      "invalid_qapp_identity_challenge": "недопустимый запрос подтверждения личности Q-App",
+      "invalid_qapp_identity_context": "недопустимый контекст идентификации Q-App",
       "invalid_qortal_link": "недействительная ссылка Qortal",
       "invalid_secret_key": "недопустимый секретный ключ",
       "invalid_uint8": "предоставленные данные Uint8Array недействительны",
       "name_not_existing": "имя не существует",
       "name_not_registered": "имя не зарегистрировано",
+      "qapp_account_authentication_required": "Q-App должно аутентифицировать вашу учётную запись Qortal перед запросом подтверждения личности",
       "read_blob_base64": "не удалось прочитать Blob как строку base64",
       "reencrypt_secret_key": "не удалось повторно зашифровать секретный ключ",
-      "set_apikey": "не удалось установить API-ключ:"
+      "set_apikey": "не удалось установить API-ключ:",
+      "wallet_account_mismatch": "аутентифицированный кошелёк не соответствует активной учётной записи Qortal"
     },
     "generic": {
       "block_list_intro": "Добавьте имя Qortal или адрес для блокировки. Адреса влияют на транзакции; блокировка имени скрывает данные в Hub.",
diff --git a/src/i18n/locales/ru/question.json b/src/i18n/locales/ru/question.json
index 3c5b79c2d..54653d8e5 100644
--- a/src/i18n/locales/ru/question.json
+++ b/src/i18n/locales/ru/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "Вы хотите развернуть этот AT?",
   "description": "описание: {{ description }}",
   "download_file": "Вы хотите загрузить:",
+  "local_send": {
+    "changed": "Кошелёк, узел или доступные средства изменились. Проверьте платёж ещё раз.",
+    "confirming": "Ваш предыдущий платёж всё ещё ожидает подтверждения сетью. Транзакция: {{txId}}. Новый платёж не был отправлен.",
+    "declined": "Платёж отклонён.",
+    "invalid": "Не удалось безопасно подготовить платёж. Проверьте адрес, сумму, баланс, комиссию и подключение к узлу.",
+    "native_body": "Кошелёк: {{wallet}}\n\nВыходы:\n{{outputs}}\n\nКомиссия сети: {{fee}}",
+    "native_title": "Подтвердить платёж из кошелька",
+    "pending": "Перед отправкой нового платежа необходимо проверить предыдущий. Транзакция: {{txId}}",
+    "previous": "Ваш предыдущий платеж был отправлен. Транзакция: {{txId}}. Начните новый платеж, если хотите отправить средства снова.",
+    "recovery": "Ранее одобренный платёж всё ещё ожидает обработки. Повторно отправить ту же транзакцию в сеть? Новый запрошенный платёж отправлен не будет.",
+    "unknown": "Результат отправки неизвестен. Не отправляйте повторно. Проверьте транзакцию {{txId}} в истории кошелька.",
+    "upgrade": "Для локального подписания транзакций кошелька требуются обновлённые версии Qortal Core и Qortal Hub."
+  },
   "message": {
     "error": {
       "add_to_list": "не удалось добавить в список",
@@ -44,6 +57,7 @@
       "file_extension": "не удалось определить расширение файла",
       "gateway_balance_local_node": "нельзя просмотреть баланс {{ token }} через шлюз. Используйте локальный узел.",
       "gateway_non_qort_local_node": "нельзя отправить не-QORT монету через шлюз. Используйте локальный узел.",
+      "gateway_pirate_local_node": "Pirate Chain (ARRR) недоступен через публичные узлы. Используйте локальный узел.",
       "gateway_retrieve_balance": "получение баланса {{ token }} через шлюз запрещено",
       "gateway_wallet_local_node": "нельзя просмотреть кошелек {{ token }} через шлюз. Используйте локальный узел.",
       "get_foreign_fee": "ошибка при получении внешней комиссии",
@@ -131,6 +145,9 @@
     "add_admin": "Разрешить этому приложению назначить пользователя {{ invitee }} администратором?",
     "all_item_list": "Разрешить этому приложению добавить следующее в список {{ name }}:",
     "authenticate": "Разрешить этому приложению выполнить аутентификацию?",
+    "backend_connection": "Разрешить {{appName}} подключаться к своему серверу?",
+    "backend_connection_description": "Это позволит приложению отправлять и получать данные от своего сервера, пока эта вкладка открыта.",
+    "backend_connection_understand": "Я разрешаю этому приложению подключаться к своему серверу и обмениваться с ним данными.",
     "ban": "Разрешить этому приложению забанить {{ partecipant }} в группе?",
     "buy_name": "Разрешить этому приложению купить имя?",
     "buy_name_detail": "покупка {{ name }} за {{ price }} QORT",
@@ -170,6 +187,10 @@
     "register_name": "Разрешить этому приложению зарегистрировать это имя?",
     "remove_admin": "Разрешить этому приложению удалить пользователя {{ partecipant }} из администраторов?",
     "remove_from_list": "Разрешить этому приложению удалить следующее из списка {{ name }}:",
+    "reticulum_destination": "{{appName}} запрашивает подключение к серверу Reticulum {{destination}}. Разрешить это подключение для данной вкладки?",
+    "reticulum_remote_backend_understand": "Я понимаю, что это Q-App будет обмениваться данными с удалённым сервером за пределами Qortal Hub.",
+    "screen_capture_description": "Разрешить {{origin}} видеть предварительные просмотры экранов и окон и захватывать содержимое для этого запроса? Доверяйте только проверенным приложениям. Выберите экран или окно в приложении.",
+    "screen_capture_title": "Разрешить захват экрана?",
     "sell_name_cancel": "Разрешить этому приложению отменить продажу имени?",
     "sell_name_transaction": "Разрешить этому приложению создать транзакцию продажи имени?",
     "sell_name_transaction_detail": "продажа {{ name }} за {{ price }} QORT",
@@ -178,6 +199,7 @@
     "send_coins": "Разрешить этому приложению отправить монеты?",
     "server_add": "Разрешить этому приложению добавить сервер?",
     "server_remove": "Разрешить этому приложению удалить сервер?",
+    "session_only_summary": "Предоставить разрешения только для этого сеанса",
     "session_permissions": "{{appName}} запрашивает разрешения сеанса",
     "session_permissions_description": "Следующие разрешения будут автоматически предоставлены для этого сеанса:",
     "session_understand": "Я доверяю этому приложению и понимаю, что эти разрешения будут выполняться автоматически",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} сатоши за KB",
   "server_host": "хост: {{ host }}",
   "server_type": "тип: {{ type }}",
+  "stream_save": {
+    "choose": "Выбрать место",
+    "detail": "Приложение: {{app}}\nПредлагаемое имя файла: {{filename}}\nЗаявленный размер: {{size}} байт\n\nЭти сведения предоставлены приложением. Hub не может проверить содержимое или безопасность файла. Разрешение действует только для этого сохранения.",
+    "failed": "Не удалось сохранить файл. Повторите попытку.",
+    "title": "Сохранить файл на устройство",
+    "unavailable": "Для потокового сохранения файлов нужна обновлённая настольная версия Qortal Hub."
+  },
   "to_group": "в: группа {{ group_id }}",
   "to_recipient": "кому: {{ recipient }}",
   "total_locking_fee": "общая комиссия за блокировку:",
diff --git a/src/i18n/locales/zh/auth.json b/src/i18n/locales/zh/auth.json
index b9e1a419f..edc17c3fd 100644
--- a/src/i18n/locales/zh/auth.json
+++ b/src/i18n/locales/zh/auth.json
@@ -199,14 +199,18 @@
       "field_not_found_json": "在 JSON 中未找到 {{ field }}",
       "find_secret_key": "找不到正确的密钥",
       "incorrect_password": "密码错误",
+      "invalid_qapp_identity_challenge": "无效的Q-App身份验证质询",
+      "invalid_qapp_identity_context": "无效的Q-App身份上下文",
       "invalid_qortal_link": "无效的 Qortal 链接",
       "invalid_secret_key": "密钥无效",
       "invalid_uint8": "提供的 Uint8ArrayData 无效",
       "name_not_existing": "名称不存在",
       "name_not_registered": "名称未注册",
+      "qapp_account_authentication_required": "Q-App必须先验证您的Qortal账户，才能请求身份证明",
       "read_blob_base64": "无法将 Blob 读取为 base64 编码字符串",
       "reencrypt_secret_key": "无法重新加密密钥",
-      "set_apikey": "设置 API 密钥失败："
+      "set_apikey": "设置 API 密钥失败：",
+      "wallet_account_mismatch": "已验证的钱包与当前Qortal账户不匹配"
     },
     "generic": {
       "block_list_intro": "添加 Qortal 名称或地址以屏蔽。地址会影响交易处理；屏蔽名称会在整个 Hub 中隐藏其数据。",
diff --git a/src/i18n/locales/zh/question.json b/src/i18n/locales/zh/question.json
index 1a48325ec..2be35376c 100644
--- a/src/i18n/locales/zh/question.json
+++ b/src/i18n/locales/zh/question.json
@@ -13,6 +13,19 @@
   "deploy_at": "您想部署此AT吗？",
   "description": "描述：{{ description }}",
   "download_file": "您想下载以下内容：",
+  "local_send": {
+    "changed": "钱包、节点或可用资金已发生变化。请重新检查付款。",
+    "confirming": "您之前的付款仍在等待网络确认。交易：{{txId}}。未发送新的付款。",
+    "declined": "付款已拒绝。",
+    "invalid": "无法安全地准备此付款。请检查地址、金额、余额、手续费和节点连接。",
+    "native_body": "钱包：{{wallet}}\n\n输出：\n{{outputs}}\n\n网络手续费：{{fee}}",
+    "native_title": "确认钱包付款",
+    "pending": "发送下一笔付款前，需要核实之前的付款。交易：{{txId}}",
+    "previous": "您之前的付款已发送。交易：{{txId}}。如果您想再次发送，请发起新的付款。",
+    "recovery": "之前批准的付款仍在等待处理。是否重新广播同一笔交易？这不会发送您新请求的付款。",
+    "unknown": "广播结果未知。请勿再次发送。请在钱包历史记录中检查交易{{txId}}。",
+    "upgrade": "在本地签署钱包交易需要更新至新版Qortal Core和Qortal Hub。"
+  },
   "message": {
     "error": {
       "add_to_list": "添加到列表失败",
@@ -44,6 +57,7 @@
       "file_extension": "无法推断文件扩展名",
       "gateway_balance_local_node": "无法通过网关查看 {{ token }} 余额。请使用本地节点。",
       "gateway_non_qort_local_node": "无法通过网关发送非 QORT 币。请使用本地节点。",
+      "gateway_pirate_local_node": "Pirate Chain（ARRR）无法在公共节点上使用。请使用本地节点。",
       "gateway_retrieve_balance": "无法通过网关获取 {{ token }} 余额",
       "gateway_wallet_local_node": "无法通过网关查看 {{ token }} 钱包。请使用本地节点。",
       "get_foreign_fee": "获取外部费用时出错",
@@ -131,6 +145,9 @@
     "add_admin": "是否允许该应用将用户 {{ invitee }} 添加为管理员？",
     "all_item_list": "是否允许该应用将以下内容添加到列表 {{ name }} 中？",
     "authenticate": "是否允许该应用进行身份验证？",
+    "backend_connection": "允许{{appName}}连接其后端吗？",
+    "backend_connection_description": "在此标签页打开期间，应用可以与其后端收发数据。",
+    "backend_connection_understand": "我允许此应用连接其后端并交换数据。",
     "ban": "是否允许该应用将 {{ partecipant }} 从群组中封禁？",
     "buy_name": "是否允许该应用购买名称？",
     "buy_name_detail": "以 {{ price }} QORT 购买 {{ name }}",
@@ -170,6 +187,10 @@
     "register_name": "是否允许该应用注册该名称？",
     "remove_admin": "是否允许该应用将用户 {{ partecipant }} 移除管理员权限？",
     "remove_from_list": "是否允许该应用从列表 {{ name }} 中移除以下内容？",
+    "reticulum_destination": "{{appName}} 想要连接到 Reticulum 后端 {{destination}}。是否允许此标签页建立连接？",
+    "reticulum_remote_backend_understand": "我了解此 Q-App 将与 Qortal Hub 外部的远程后端交换数据。",
+    "screen_capture_description": "是否允许 {{origin}} 查看屏幕和窗口预览，并为此次请求捕获内容？请仅允许您信任的应用。在应用内选择屏幕或窗口。",
+    "screen_capture_title": "允许屏幕捕获？",
     "sell_name_cancel": "是否允许该应用取消名称的出售？",
     "sell_name_transaction": "是否允许该应用创建出售名称的交易？",
     "sell_name_transaction_detail": "以 {{ price }} QORT 出售 {{ name }}",
@@ -178,6 +199,7 @@
     "send_coins": "是否允许该应用发送代币？",
     "server_add": "是否允许该应用添加服务器？",
     "server_remove": "是否允许该应用移除服务器？",
+    "session_only_summary": "仅为此会话授予权限",
     "session_permissions": "{{appName}} 正在请求会话权限",
     "session_permissions_description": "以下权限将自动授予本次会话：",
     "session_understand": "我信任此应用，并理解这些权限将自动执行",
@@ -198,6 +220,13 @@
   "sats_per_kb": "{{ amount }} sats / KB",
   "server_host": "主机：{{ host }}",
   "server_type": "类型：{{ type }}",
+  "stream_save": {
+    "choose": "选择位置",
+    "detail": "应用：{{app}}\n建议的文件名：{{filename}}\n声明的大小：{{size}} 字节\n\n这些信息由应用提供。Hub 无法验证内容或文件是否安全。此权限仅适用于本次保存。",
+    "failed": "无法保存文件，请重试。",
+    "title": "将文件保存到设备",
+    "unavailable": "流式保存文件需要更新后的 Qortal Hub 桌面版。"
+  },
   "to_group": "发送至群组：{{ group_id }}",
   "to_recipient": "发送至：{{ recipient }}",
   "total_locking_fee": "总锁仓费用：",
diff --git a/src/lib/foreign-wallet/desktop-engine.ts b/src/lib/foreign-wallet/desktop-engine.ts
new file mode 100644
index 000000000..b8522b357
--- /dev/null
+++ b/src/lib/foreign-wallet/desktop-engine.ts
@@ -0,0 +1,115 @@
+// Bundled for Electron main. This module is never imported by the renderer.
+import { hex } from '@scure/base';
+import {
+  walletPublicKey,
+  foreignCoins,
+  type ForeignWalletCoin,
+} from './foreign-wallets';
+import {
+  prepareForeignWalletPsbt,
+  signForeignWalletPsbt,
+  type ForeignWalletTransactionRequest,
+} from './foreign-wallet-transaction';
+import { assertForeignWalletPlanWithinPolicy } from './foreign-wallet-policy-bounds';
+export { inspectSignedTransaction } from './foreign-wallet-transaction';
+export type DesktopSignRequest = Omit<
+  ForeignWalletTransactionRequest,
+  'xprv' | 'cache' | 'crypto'
+> & { psbtHex: string };
+class SigningError extends Error {
+  constructor(public code: 'invalid' | 'changed' | 'declined' | 'pending') {
+    super(code);
+  }
+}
+export function createDesktopWalletSigner() {
+  let roots: Partial<Record<ForeignWalletCoin, string>> = {};
+  let epoch = 0;
+  let busy = false;
+  const clear = () => {
+    roots = {};
+    epoch++;
+  };
+  return {
+    clear,
+    importKeys(payload: Record<string, unknown>) {
+      clear();
+      const next: Partial<Record<ForeignWalletCoin, string>> = {};
+      const publicKeys: Partial<Record<ForeignWalletCoin, string>> = {};
+      for (const coin of foreignCoins) {
+        const key = payload[`${coin.toLowerCase()}PrivateKey`];
+        if (typeof key !== 'string') throw new Error('Missing wallet key');
+        publicKeys[coin] = walletPublicKey(key, coin);
+        next[coin] = key;
+      }
+      roots = next;
+      return publicKeys;
+    },
+    publicKey(coin: ForeignWalletCoin) {
+      if (!foreignCoins.includes(coin) || !roots[coin])
+        throw new Error('Wallet is locked');
+      return walletPublicKey(roots[coin], coin);
+    },
+    async sign(
+      rawRequest: DesktopSignRequest,
+      approve: (details: {
+        coin: ForeignWalletCoin;
+        xpub: string;
+        outputs: { address: string; value: bigint }[];
+        fee: bigint;
+      }) => Promise<boolean>
+    ) {
+      if (busy) throw new SigningError('pending');
+      busy = true;
+      const session = epoch;
+      const started = Date.now();
+      try {
+        const request = structuredClone(rawRequest);
+        const { coin } = request;
+        if (
+          !foreignCoins.includes(coin) ||
+          !roots[coin] ||
+          request.xpub !== walletPublicKey(roots[coin], coin)
+        )
+          throw new SigningError('changed');
+        // Ignore all caller-supplied fields except the explicitly supported public contract.
+        const input = {
+          coin,
+          xpub: request.xpub,
+          inputs: request.inputs,
+          outputs: request.outputs,
+          transactionVersion: 1,
+        };
+        const expected = prepareForeignWalletPsbt(input);
+        if (request.psbtHex !== hex.encode(expected))
+          throw new SigningError('invalid');
+        const inputAmount = input.inputs.reduce((n, u) => n + u.value, 0n);
+        const outputAmount = input.outputs.reduce((n, u) => n + u.value, 0n);
+        const fee = inputAmount - outputAmount;
+        assertForeignWalletPlanWithinPolicy({
+          coin,
+          fee,
+          amount: outputAmount,
+          feePerByte: 1n,
+          estimatedMaximumSize:
+            10 + input.inputs.length * 149 + input.outputs.length * 43,
+          sendMax: true,
+        });
+        if (
+          !(await approve({
+            coin,
+            xpub: request.xpub,
+            outputs: structuredClone([...input.outputs]),
+            fee,
+          }))
+        )
+          throw new SigningError('declined');
+        if (session !== epoch || Date.now() - started > 300000 || !roots[coin])
+          throw new SigningError('changed');
+        return signForeignWalletPsbt({ ...input, xprv: roots[coin] }, expected);
+      } finally {
+        busy = false;
+      }
+    },
+  };
+}
+export { desktopWalletTranslations } from './desktop-i18n';
diff --git a/src/lib/foreign-wallet/desktop-i18n.ts b/src/lib/foreign-wallet/desktop-i18n.ts
new file mode 100644
index 000000000..5ca30a292
--- /dev/null
+++ b/src/lib/foreign-wallet/desktop-i18n.ts
@@ -0,0 +1,110 @@
+import { createInstance } from 'i18next';
+import enQuestion from '../../i18n/locales/en/question.json';
+import enCore from '../../i18n/locales/en/core.json';
+import deQuestion from '../../i18n/locales/de/question.json';
+import deCore from '../../i18n/locales/de/core.json';
+import esQuestion from '../../i18n/locales/es/question.json';
+import esCore from '../../i18n/locales/es/core.json';
+import frQuestion from '../../i18n/locales/fr/question.json';
+import frCore from '../../i18n/locales/fr/core.json';
+import itQuestion from '../../i18n/locales/it/question.json';
+import itCore from '../../i18n/locales/it/core.json';
+import ptQuestion from '../../i18n/locales/pt/question.json';
+import ptCore from '../../i18n/locales/pt/core.json';
+import ruQuestion from '../../i18n/locales/ru/question.json';
+import ruCore from '../../i18n/locales/ru/core.json';
+import zhQuestion from '../../i18n/locales/zh/question.json';
+import zhCore from '../../i18n/locales/zh/core.json';
+import jaQuestion from '../../i18n/locales/ja/question.json';
+import jaCore from '../../i18n/locales/ja/core.json';
+import arQuestion from '../../i18n/locales/ar/question.json';
+import arCore from '../../i18n/locales/ar/core.json';
+import fiQuestion from '../../i18n/locales/fi/question.json';
+import fiCore from '../../i18n/locales/fi/core.json';
+import etQuestion from '../../i18n/locales/et/question.json';
+import etCore from '../../i18n/locales/et/core.json';
+const resources = {
+  en: {
+    question: { local_send: enQuestion.local_send },
+    core: {
+      action: { send: enCore.action.send, cancel: enCore.action.cancel },
+    },
+  },
+  de: {
+    question: { local_send: deQuestion.local_send },
+    core: {
+      action: { send: deCore.action.send, cancel: deCore.action.cancel },
+    },
+  },
+  es: {
+    question: { local_send: esQuestion.local_send },
+    core: {
+      action: { send: esCore.action.send, cancel: esCore.action.cancel },
+    },
+  },
+  fr: {
+    question: { local_send: frQuestion.local_send },
+    core: {
+      action: { send: frCore.action.send, cancel: frCore.action.cancel },
+    },
+  },
+  it: {
+    question: { local_send: itQuestion.local_send },
+    core: {
+      action: { send: itCore.action.send, cancel: itCore.action.cancel },
+    },
+  },
+  pt: {
+    question: { local_send: ptQuestion.local_send },
+    core: {
+      action: { send: ptCore.action.send, cancel: ptCore.action.cancel },
+    },
+  },
+  ru: {
+    question: { local_send: ruQuestion.local_send },
+    core: {
+      action: { send: ruCore.action.send, cancel: ruCore.action.cancel },
+    },
+  },
+  zh: {
+    question: { local_send: zhQuestion.local_send },
+    core: {
+      action: { send: zhCore.action.send, cancel: zhCore.action.cancel },
+    },
+  },
+  ja: {
+    question: { local_send: jaQuestion.local_send },
+    core: {
+      action: { send: jaCore.action.send, cancel: jaCore.action.cancel },
+    },
+  },
+  ar: {
+    question: { local_send: arQuestion.local_send },
+    core: {
+      action: { send: arCore.action.send, cancel: arCore.action.cancel },
+    },
+  },
+  fi: {
+    question: { local_send: fiQuestion.local_send },
+    core: {
+      action: { send: fiCore.action.send, cancel: fiCore.action.cancel },
+    },
+  },
+  et: {
+    question: { local_send: etQuestion.local_send },
+    core: {
+      action: { send: etCore.action.send, cancel: etCore.action.cancel },
+    },
+  },
+};
+export function desktopWalletTranslations(language: string) {
+  const i18n = createInstance();
+  void i18n.init({
+    resources,
+    lng: typeof language === 'string' ? language.slice(0, 20) : 'en',
+    fallbackLng: 'en',
+    initImmediate: false,
+    interpolation: { escapeValue: false },
+  });
+  return i18n;
+}
diff --git a/src/lib/foreign-wallet/foreign-wallet-policy-bounds.ts b/src/lib/foreign-wallet/foreign-wallet-policy-bounds.ts
new file mode 100644
index 000000000..305e0f79e
--- /dev/null
+++ b/src/lib/foreign-wallet/foreign-wallet-policy-bounds.ts
@@ -0,0 +1,47 @@
+import type { ForeignWalletCoin } from './foreign-wallets';
+// Local ceilings remain independent of Core's estimates. These are safety limits,
+// not recommended fees; the user approves the actual total before signing.
+const limits = {
+  BTC: [10000n, 1000000n, 2000n],
+  LTC: [2000000n, 20000000n, 20000n],
+  DOGE: [2000000000n, 20000000000n, 200000n],
+  DGB: [10000n, 100000000n, 200000n],
+  RVN: [50000n, 100000000n, 200000n],
+} as const;
+export function getForeignWalletPolicyBounds(coin: ForeignWalletCoin) {
+  if (!Object.prototype.hasOwnProperty.call(limits, coin))
+    throw new Error('Unsupported wallet coin');
+  const [maximumDustThreshold, maximumFee, maximumFeePerByte] = limits[coin];
+  return { maximumDustThreshold, maximumFee, maximumFeePerByte };
+}
+export function assertForeignWalletContextWithinPolicy(context: {
+  coin: ForeignWalletCoin;
+  minimumNonDustOutput: bigint;
+  recommendedFeePerByte: bigint;
+}) {
+  const bounds = getForeignWalletPolicyBounds(context.coin);
+  if (
+    context.minimumNonDustOutput <= 0n ||
+    context.minimumNonDustOutput > bounds.maximumDustThreshold ||
+    context.recommendedFeePerByte <= 0n ||
+    context.recommendedFeePerByte > bounds.maximumFeePerByte
+  )
+    throw new Error('Wallet fee policy exceeded');
+}
+export function assertForeignWalletPlanWithinPolicy(plan: {
+  coin: ForeignWalletCoin;
+  fee: bigint;
+  feePerByte: bigint;
+  amount: bigint;
+  estimatedMaximumSize: number;
+  sendMax: boolean;
+}) {
+  const bounds = getForeignWalletPolicyBounds(plan.coin);
+  if (
+    plan.fee < 0n ||
+    plan.fee > bounds.maximumFee ||
+    plan.fee > BigInt(plan.estimatedMaximumSize) * bounds.maximumFeePerByte ||
+    (!plan.sendMax && plan.fee > plan.amount)
+  )
+    throw new Error('Wallet fee policy exceeded');
+}
diff --git a/src/lib/foreign-wallet/foreign-wallet-spend-context.ts b/src/lib/foreign-wallet/foreign-wallet-spend-context.ts
new file mode 100644
index 000000000..c2ba18119
--- /dev/null
+++ b/src/lib/foreign-wallet/foreign-wallet-spend-context.ts
@@ -0,0 +1,141 @@
+// Validate the public Core API contract before constructing a transaction.
+import {
+  assertForeignWalletWatchInputBounds,
+  walletPath,
+  type ForeignWalletWatchInput,
+} from './foreign-wallet-transaction';
+import type { ForeignWalletCoin } from './foreign-wallets';
+export const FOREIGN_WALLET_MAINNET_CHAIN_IDS = Object.freeze({
+  BTC: 'bip122:000000000019d6689c085ae165831e93',
+  LTC: 'bip122:12a765e31ffd4059bada1e25190f6e98',
+  DOGE: 'bip122:1a91e3dace36e2be3bf030a65679fe82',
+  DGB: 'bip122:7497ea1b465eb39f1c8f507bc877078f',
+  RVN: 'bip122:0000006b444bc2f2ffe627be9d9e7e7a',
+});
+const blockchains = {
+  BTC: 'BITCOIN',
+  LTC: 'LITECOIN',
+  DOGE: 'DOGECOIN',
+  DGB: 'DIGIBYTE',
+  RVN: 'RAVENCOIN',
+};
+export const FOREIGN_WALLET_SPEND_CONTEXT_RESPONSE_MAX_BYTES = 20 * 1024 * 1024;
+export const FOREIGN_WALLET_SPEND_CONTEXT_MAX_RAW_TRANSACTION_BYTES = 1000000;
+export const FOREIGN_WALLET_SPEND_CONTEXT_MAX_TOTAL_RAW_TRANSACTION_BYTES = 8000000;
+export type ForeignWalletSpendContext = Readonly<{
+  activeNetwork: string;
+  blockchain: string;
+  chainId: string;
+  coin: ForeignWalletCoin;
+  minimumNonDustOutput: bigint;
+  recommendedFeePerByte: bigint;
+  tipHeight: number;
+  transactionVersion: number;
+  utxos: readonly ForeignWalletWatchInput[];
+}>;
+const assert = (ok: unknown) => {
+  if (!ok) throw new Error('Invalid public wallet context');
+};
+const record = (v: unknown): v is Record<string, any> =>
+  !!v && typeof v === 'object' && !Array.isArray(v);
+const amount = (v: unknown) => {
+  assert(typeof v === 'string' && /^[1-9][0-9]{0,18}$/.test(v as string));
+  const n = BigInt(v as string);
+  assert(n <= 0x7fffffffffffffffn);
+  return n;
+};
+export function getForeignWalletMainnetChainId(coin: ForeignWalletCoin) {
+  assert(
+    Object.prototype.hasOwnProperty.call(FOREIGN_WALLET_MAINNET_CHAIN_IDS, coin)
+  );
+  return FOREIGN_WALLET_MAINNET_CHAIN_IDS[coin];
+}
+export function normalizeForeignWalletSpendContext(
+  raw: unknown,
+  coin: ForeignWalletCoin
+): ForeignWalletSpendContext {
+  assert(record(raw));
+  const v = raw as Record<string, any>;
+  const chainId = getForeignWalletMainnetChainId(coin);
+  assert(
+    v.version === 1 &&
+      v.chainId === chainId &&
+      v.currencyCode === coin &&
+      v.blockchain === blockchains[coin] &&
+      v.activeNetwork === 'MAIN'
+  );
+  assert(
+    v.confirmedOnly === true &&
+      v.transactionFormat === 'LEGACY' &&
+      v.transactionVersion === 1 &&
+      v.sighashType === 1 &&
+      v.sequence === 0xffffffff &&
+      v.lockTime === 0
+  );
+  assert(Number.isSafeInteger(v.tipHeight) && v.tipHeight > 0);
+  assert(
+    Array.isArray(v.utxos) &&
+      v.utxos.length <= 1000 &&
+      record(v.previousTransactions)
+  );
+  const hashes = Object.keys(v.previousTransactions);
+  assert(
+    hashes.length <= 1000 && hashes.every((h) => /^[a-f0-9]{64}$/.test(h))
+  );
+  const referenced = new Set<string>();
+  const seen = new Set<string>();
+  const utxos: ForeignWalletWatchInput[] = v.utxos.map((u: any) => {
+    assert(
+      record(u) &&
+        typeof u.txHash === 'string' &&
+        Object.prototype.hasOwnProperty.call(v.previousTransactions, u.txHash)
+    );
+    assert(
+      Number.isSafeInteger(u.height) && u.height > 0 && u.height <= v.tipHeight
+    );
+    assert(
+      Number.isSafeInteger(u.outputIndex) &&
+        u.outputIndex >= 0 &&
+        u.outputIndex <= 0xffffffff
+    );
+    assert(
+      typeof u.address === 'string' &&
+        u.address.length <= 128 &&
+        /^[a-f0-9]{50}$/.test(u.scriptPubKeyHex)
+    );
+    const path = walletPath(u.pathAsString);
+    assert(
+      Array.isArray(u.path) &&
+        u.path.length === 2 &&
+        u.path[0] === path.chain &&
+        u.path[1] === path.index
+    );
+    const point = `${u.txHash}:${u.outputIndex}`;
+    assert(!seen.has(point));
+    seen.add(point);
+    referenced.add(u.txHash);
+    return Object.freeze({
+      address: u.address,
+      height: u.height,
+      path: u.pathAsString,
+      previousTransactionHex: v.previousTransactions[u.txHash],
+      scriptPubKey: u.scriptPubKeyHex,
+      txHash: u.txHash,
+      txPos: u.outputIndex,
+      value: amount(u.value),
+    });
+  });
+  assert(referenced.size === hashes.length);
+  assertForeignWalletWatchInputBounds(utxos);
+  return Object.freeze({
+    coin,
+    chainId,
+    activeNetwork: 'MAIN',
+    blockchain: blockchains[coin],
+    transactionVersion: 1,
+    tipHeight: v.tipHeight,
+    minimumNonDustOutput: amount(v.minimumNonDustOutput),
+    recommendedFeePerByte: amount(v.recommendedFeePerByte),
+    utxos: Object.freeze(utxos),
+  });
+}
diff --git a/src/lib/foreign-wallet/foreign-wallet-spend-plan.ts b/src/lib/foreign-wallet/foreign-wallet-spend-plan.ts
new file mode 100644
index 000000000..2332c233c
--- /dev/null
+++ b/src/lib/foreign-wallet/foreign-wallet-spend-plan.ts
@@ -0,0 +1,166 @@
+// Hub payment policy. All amounts are atomic units; planning needs only an xpub.
+import { CompactSize } from '@scure/btc-signer';
+import {
+  assertForeignWalletWatchInputBounds,
+  assertForeignWalletSigningWorkBounds,
+  attestForeignWalletWatchInput,
+  validateForeignWalletRecipient,
+  positiveAtomic,
+  type ForeignWalletWatchInput,
+  type ForeignWalletPaymentOutput,
+  type ForeignWalletPreviousTransactionCache,
+} from './foreign-wallet-transaction';
+import type { ForeignWalletCoin, ForeignWalletCrypto } from './foreign-wallets';
+export type ForeignWalletSpendPlan = {
+  amount: bigint;
+  change: bigint;
+  changeAddress: string | null;
+  estimatedMaximumSize: number;
+  fee: bigint;
+  feePerByte: bigint;
+  inputAmount: bigint;
+  inputs: ForeignWalletWatchInput[];
+  outputAmount: bigint;
+  outputs: ForeignWalletPaymentOutput[];
+  recipientAddress: string;
+  sendMax: boolean;
+};
+export function estimateMaximumForeignWalletTransactionSize(
+  count: number,
+  lengths: readonly number[]
+) {
+  assertForeignWalletSigningWorkBounds(count, lengths);
+  // Compressed P2PKH: 149 bytes bounds DER signature length without relying on low-R grinding.
+  return (
+    8 +
+    CompactSize.encode(BigInt(count)).length +
+    count * 149 +
+    CompactSize.encode(BigInt(lengths.length)).length +
+    lengths.reduce(
+      (sum, n) => sum + 8 + CompactSize.encode(BigInt(n)).length + n,
+      0
+    )
+  );
+}
+export function planForeignWalletSpend(input: {
+  amount?: bigint;
+  payments?: readonly ForeignWalletPaymentOutput[];
+  cache?: ForeignWalletPreviousTransactionCache;
+  coin: ForeignWalletCoin;
+  crypto?: ForeignWalletCrypto;
+  feePerByte: bigint;
+  minimumNonDustOutput: bigint;
+  recipientAddress: string;
+  xpub?: string;
+  xprv?: string;
+  sendMax?: boolean;
+  utxos: readonly ForeignWalletWatchInput[];
+}): ForeignWalletSpendPlan {
+  const fail = () => {
+    throw new Error('Invalid or unfunded wallet payment');
+  };
+  positiveAtomic(input.feePerByte);
+  positiveAtomic(input.minimumNonDustOutput);
+  const sendMax = input.sendMax === true;
+  if (
+    sendMax
+      ? input.amount !== undefined || !!input.payments
+      : input.amount === undefined
+  )
+    fail();
+  const recipientAddress = validateForeignWalletRecipient({
+    coin: input.coin,
+    address: input.recipientAddress,
+  }).address;
+  const payments = input.payments
+    ? input.payments.map((p) => ({ ...p }))
+    : [{ address: recipientAddress, value: input.amount }];
+  if (!payments.length || payments.length > 20) fail();
+  if (!sendMax) {
+    positiveAtomic(input.amount);
+    if (payments.reduce((sum, p) => sum + p.value, 0n) !== input.amount) fail();
+    payments.forEach((p) => {
+      positiveAtomic(p.value);
+      if (p.value < input.minimumNonDustOutput) fail();
+    });
+  }
+  const lengths = payments.map(
+    (p) =>
+      validateForeignWalletRecipient({ coin: input.coin, address: p.address })
+        .scriptPubKey.length
+  );
+  assertForeignWalletWatchInputBounds(input.utxos);
+  const seen = new Set<string>();
+  const candidates = input.utxos
+    .map((u) => {
+      const point = `${u.txHash}:${u.txPos}`;
+      if (seen.has(point)) fail();
+      seen.add(point);
+      attestForeignWalletWatchInput({ ...input, watchInput: u });
+      return { ...u };
+    })
+    .sort((a, b) =>
+      a.value !== b.value
+        ? a.value > b.value
+          ? -1
+          : 1
+        : a.txHash.localeCompare(b.txHash) || a.txPos - b.txPos
+    );
+  if (!candidates.length) fail();
+  const selected: ForeignWalletWatchInput[] = [];
+  let inputAmount = 0n;
+  const finish = (
+    amount: bigint,
+    fee: bigint,
+    change: bigint,
+    size: number
+  ): ForeignWalletSpendPlan => {
+    const changeAddress = change ? selected[0].address : null;
+    return {
+      amount,
+      fee,
+      change,
+      changeAddress,
+      estimatedMaximumSize: size,
+      feePerByte: input.feePerByte,
+      inputAmount,
+      inputs: selected,
+      outputAmount: inputAmount - fee,
+      recipientAddress,
+      sendMax,
+      outputs: sendMax
+        ? [{ address: recipientAddress, value: amount }]
+        : [
+            ...payments,
+            ...(change ? [{ address: changeAddress, value: change }] : []),
+          ],
+    };
+  };
+  for (const u of candidates) {
+    selected.push(u);
+    inputAmount += u.value;
+    positiveAtomic(inputAmount);
+    if (sendMax && selected.length !== candidates.length) continue;
+    const size = estimateMaximumForeignWalletTransactionSize(
+      selected.length,
+      lengths
+    );
+    const minimumFee = BigInt(size) * input.feePerByte;
+    if (sendMax) {
+      const amount = inputAmount - minimumFee;
+      if (amount < input.minimumNonDustOutput) fail();
+      return finish(amount, minimumFee, 0n, size);
+    }
+    if (inputAmount < input.amount + minimumFee) continue;
+    const changeSize = estimateMaximumForeignWalletTransactionSize(
+      selected.length,
+      [...lengths, 25]
+    );
+    const fee = BigInt(changeSize) * input.feePerByte;
+    const change = inputAmount - input.amount - fee;
+    if (change >= input.minimumNonDustOutput)
+      return finish(input.amount, fee, change, changeSize);
+    return finish(input.amount, inputAmount - input.amount, 0n, size);
+  }
+  return fail();
+}
diff --git a/src/lib/foreign-wallet/foreign-wallet-transaction.ts b/src/lib/foreign-wallet/foreign-wallet-transaction.ts
new file mode 100644
index 000000000..ec7024654
--- /dev/null
+++ b/src/lib/foreign-wallet/foreign-wallet-transaction.ts
@@ -0,0 +1,341 @@
+// Internal errors are mapped to localized messages at the application boundary.
+import { Address, OutScript, Transaction, p2pkh } from '@scure/btc-signer';
+import { hex } from '@scure/base';
+import {
+  deriveForeignWalletLeafPublicData,
+  withForeignWalletLeaf,
+  walletPublicKey,
+  walletFingerprint,
+  type ForeignWalletCoin,
+  type ForeignWalletCrypto,
+} from './foreign-wallets';
+
+export type ForeignWalletOutputType = 'P2PKH' | 'P2SH' | 'P2WPKH' | 'P2WSH';
+export type ForeignWalletRecipient = {
+  address: string;
+  outputType: ForeignWalletOutputType;
+  scriptPubKey: Uint8Array;
+};
+export type ForeignWalletWatchInput = {
+  address: string;
+  height: number;
+  path: string;
+  previousTransactionHex: string;
+  scriptPubKey: string;
+  txHash: string;
+  txPos: number;
+  value: bigint;
+};
+export type ForeignWalletPaymentOutput = { address: string; value: bigint };
+export type ForeignWalletSignedTransaction = {
+  fee: bigint;
+  inputAmount: bigint;
+  outputAmount: bigint;
+  rawTransactionHex: string;
+  transactionSize: number;
+  txId: string;
+};
+const networks = {
+  BTC: { pubKeyHash: 0, scriptHash: 5, bech32: 'bc', wif: 128 },
+  LTC: { pubKeyHash: 48, scriptHash: 50, bech32: 'ltc', wif: 176 },
+  DOGE: { pubKeyHash: 30, scriptHash: 22, bech32: '', wif: 158 },
+  DGB: { pubKeyHash: 30, scriptHash: 63, bech32: 'dgb', wif: 128 },
+  RVN: { pubKeyHash: 60, scriptHash: 122, bech32: '', wif: 128 },
+} as const;
+const types = {
+  pkh: 'P2PKH',
+  sh: 'P2SH',
+  wpkh: 'P2WPKH',
+  wsh: 'P2WSH',
+} as const;
+const strict = {
+  version: 1,
+  lockTime: 0,
+  PSBTVersion: 0,
+  strictPrevoutValidation: true,
+};
+const equal = (a: Uint8Array, b: Uint8Array) => hex.encode(a) === hex.encode(b);
+const requireValid = (condition: unknown) => {
+  if (!condition) throw new Error('Invalid wallet transaction');
+};
+export const positiveAtomic = (value: bigint) =>
+  requireValid(
+    typeof value === 'bigint' && value > 0n && value <= 0x7fffffffffffffffn
+  );
+export function walletPath(path: string) {
+  const match =
+    typeof path === 'string' && /^M\/([01])\/(0|[1-9][0-9]{0,9})$/.exec(path);
+  requireValid(match && Number(match[2]) < 0x80000000);
+  return { chain: Number(match[1]), index: Number(match[2]) };
+}
+export function validateForeignWalletRecipient(input: {
+  address: string;
+  coin: ForeignWalletCoin;
+  crypto?: ForeignWalletCrypto;
+}): ForeignWalletRecipient {
+  requireValid(
+    typeof input.address === 'string' &&
+      input.address.length <= 128 &&
+      networks[input.coin]
+  );
+  const address = input.address.trim();
+  const network = networks[input.coin];
+  let decoded: ReturnType<ReturnType<typeof Address>['decode']>;
+  try {
+    decoded = Address(network).decode(address);
+  } catch (error) {
+    if (input.coin !== 'LTC') throw error;
+    // Litecoin also accepts the older Bitcoin-compatible P2SH prefix.
+    decoded = Address({ ...network, scriptHash: 5 }).decode(address);
+    requireValid(decoded.type === 'sh');
+  }
+  requireValid(decoded.type in types);
+  if (decoded.type === 'wpkh' || decoded.type === 'wsh')
+    requireValid(!!network.bech32);
+  return {
+    address,
+    outputType: types[decoded.type],
+    scriptPubKey: OutScript.encode(decoded),
+  };
+}
+export type ForeignWalletPreviousTransactionCache = {
+  entries: Map<string, { rawHex: string; parsed: Transaction }>;
+  parses: number;
+};
+export function createForeignWalletPreviousTransactionCache(): ForeignWalletPreviousTransactionCache {
+  return { entries: new Map(), parses: 0 };
+}
+export function assertForeignWalletWatchInputBounds(
+  inputs: readonly ForeignWalletWatchInput[]
+) {
+  requireValid(Array.isArray(inputs) && inputs.length <= 1000);
+  const transactions = new Map<string, string>();
+  let size = 0;
+  for (const input of inputs) {
+    requireValid(
+      typeof input.txHash === 'string' && /^[a-f0-9]{64}$/.test(input.txHash)
+    );
+    const raw = input.previousTransactionHex;
+    requireValid(
+      typeof raw === 'string' &&
+        raw.length > 0 &&
+        raw.length <= 2000000 &&
+        raw.length % 2 === 0 &&
+        /^[a-f0-9]+$/i.test(raw)
+    );
+    if (transactions.has(input.txHash))
+      requireValid(transactions.get(input.txHash) === raw);
+    else {
+      size += raw.length / 2;
+      transactions.set(input.txHash, raw);
+    }
+    requireValid(size <= 8000000);
+  }
+}
+export function assertForeignWalletSigningWorkBounds(
+  count: number,
+  lengths: readonly number[]
+) {
+  requireValid(
+    Number.isSafeInteger(count) &&
+      count > 0 &&
+      count <= 1000 &&
+      lengths.length > 0 &&
+      lengths.length <= 21
+  );
+  requireValid(
+    lengths.every((n) => Number.isSafeInteger(n) && n >= 0 && n <= 10000)
+  );
+  requireValid(
+    count * (26 + count * 149 + lengths.reduce((n, len) => n + 17 + len, 0)) <=
+      256 * 1024 * 1024
+  );
+}
+type WalletInput = {
+  coin: ForeignWalletCoin;
+  xpub?: string;
+  xprv?: string;
+  crypto?: ForeignWalletCrypto;
+  cache?: ForeignWalletPreviousTransactionCache;
+  watchInput: ForeignWalletWatchInput;
+};
+export function attestForeignWalletWatchInput(input: WalletInput) {
+  const u = input.watchInput;
+  assertForeignWalletWatchInputBounds([u]);
+  positiveAtomic(u.value);
+  requireValid(
+    Number.isSafeInteger(u.height) &&
+      u.height > 0 &&
+      Number.isSafeInteger(u.txPos) &&
+      u.txPos >= 0 &&
+      u.txPos <= 0xffffffff
+  );
+  let previous = input.cache?.entries.get(u.txHash);
+  if (!previous || previous.rawHex !== u.previousTransactionHex) {
+    // Previous transactions may contain unrelated scripts; only the spent output
+    // must be P2PKH. Parsing never authorizes signing unknown scripts.
+    const parsed = Transaction.fromRaw(hex.decode(u.previousTransactionHex), {
+      allowUnknownOutputs: true,
+      allowUnknownInputs: true,
+      allowUnknownVersion: true,
+    });
+    requireValid(parsed.id === u.txHash);
+    previous = { rawHex: u.previousTransactionHex, parsed };
+    if (input.cache) {
+      input.cache.entries.set(u.txHash, previous);
+      input.cache.parses++;
+    }
+  }
+  requireValid(u.txPos < previous.parsed.outputsLength);
+  const output = previous.parsed.getOutput(u.txPos);
+  const leaf = deriveForeignWalletLeafPublicData({
+    ...input,
+    ...walletPath(u.path),
+  });
+  const script = p2pkh(leaf.publicKey).script;
+  requireValid(
+    output.amount === u.value &&
+      equal(output.script, script) &&
+      hex.encode(script) === u.scriptPubKey &&
+      leaf.address === u.address
+  );
+  return leaf;
+}
+export type ForeignWalletTransactionRequest = {
+  coin: ForeignWalletCoin;
+  xpub?: string;
+  xprv?: string;
+  crypto?: ForeignWalletCrypto;
+  inputs: readonly ForeignWalletWatchInput[];
+  outputs: readonly ForeignWalletPaymentOutput[];
+  cache?: ForeignWalletPreviousTransactionCache;
+  transactionVersion?: number;
+};
+export function prepareForeignWalletPsbt(
+  input: ForeignWalletTransactionRequest
+): Uint8Array {
+  assertForeignWalletWatchInputBounds(input.inputs);
+  requireValid(
+    input.transactionVersion === undefined || input.transactionVersion === 1
+  );
+  const scripts = input.outputs.map((o) => {
+    positiveAtomic(o.value);
+    return validateForeignWalletRecipient({
+      address: o.address,
+      coin: input.coin,
+    }).scriptPubKey;
+  });
+  assertForeignWalletSigningWorkBounds(
+    input.inputs.length,
+    scripts.map((s) => s.length)
+  );
+  // PSBT repeats the full previous transaction per input. Bound both the expanded
+  // payload and the library's strict all-prevout checks performed for each signature.
+  const previousBytes = input.inputs.reduce(
+    (n, u) => n + u.previousTransactionHex.length / 2,
+    0
+  );
+  requireValid(
+    previousBytes <= 8000000 &&
+      previousBytes * input.inputs.length <= 256 * 1024 * 1024
+  );
+  const tx = new Transaction(strict);
+  const xpub = input.xpub ?? walletPublicKey(input.xprv, input.coin);
+  const fingerprint = walletFingerprint(xpub, input.coin);
+  const seen = new Set<string>();
+  input.inputs.forEach((u) => {
+    const leaf = attestForeignWalletWatchInput({
+      ...input,
+      xpub,
+      watchInput: u,
+    });
+    const path = walletPath(u.path);
+    const point = `${u.txHash}:${u.txPos}`;
+    requireValid(!seen.has(point));
+    seen.add(point);
+    tx.addInput({
+      txid: u.txHash,
+      index: u.txPos,
+      sequence: 0xffffffff,
+      bip32Derivation: [
+        [leaf.publicKey, { fingerprint, path: [path.chain, path.index] }],
+      ],
+      sighashType: 1,
+      nonWitnessUtxo: hex.decode(u.previousTransactionHex),
+    });
+  });
+  input.outputs.forEach((o, i) =>
+    tx.addOutput({ amount: o.value, script: scripts[i] })
+  );
+  requireValid(tx.fee >= 0n);
+  positiveAtomic(input.inputs.reduce((sum, u) => sum + u.value, 0n));
+  return tx.toPSBT(0);
+}
+/** Rebuild the expected PSBT independently before using any private key. */
+export function signForeignWalletPsbt(
+  input: ForeignWalletTransactionRequest & { xprv: string },
+  psbt: Uint8Array
+): ForeignWalletSignedTransaction {
+  const xpub = walletPublicKey(input.xprv, input.coin);
+  requireValid(!input.xpub || input.xpub === xpub);
+  const expected = prepareForeignWalletPsbt({
+    ...input,
+    xpub,
+    xprv: undefined,
+  });
+  requireValid(equal(psbt, expected));
+  const tx = Transaction.fromPSBT(psbt, strict);
+  input.inputs.forEach((u, i) =>
+    withForeignWalletLeaf(
+      { coin: input.coin, xprv: input.xprv, ...walletPath(u.path) },
+      (leaf) => {
+        requireValid(leaf.privateKey && tx.signIdx(leaf.privateKey, i, [1]));
+      }
+    )
+  );
+  tx.finalize();
+  const raw = tx.extract();
+  const inputAmount = input.inputs.reduce((sum, u) => sum + u.value, 0n);
+  const outputAmount = input.outputs.reduce((sum, o) => sum + o.value, 0n);
+  return {
+    fee: tx.fee,
+    inputAmount,
+    outputAmount,
+    rawTransactionHex: hex.encode(raw),
+    transactionSize: raw.length,
+    txId: tx.id,
+  };
+}
+export function buildForeignWalletSignedTransaction(
+  input: ForeignWalletTransactionRequest & { xprv: string }
+) {
+  return signForeignWalletPsbt(input, prepareForeignWalletPsbt(input));
+}
+export function inspectSignedTransaction(rawHex: string) {
+  requireValid(
+    typeof rawHex === 'string' &&
+      rawHex.length <= 400000 &&
+      rawHex.length % 2 === 0 &&
+      /^[a-f0-9]+$/.test(rawHex)
+  );
+  const tx = Transaction.fromRaw(hex.decode(rawHex));
+  requireValid(
+    tx.version === 1 &&
+      tx.lockTime === 0 &&
+      tx.inputsLength > 0 &&
+      tx.inputsLength <= 1000
+  );
+  const outpoints = Array.from({ length: tx.inputsLength }, (_, i) => {
+    const u = tx.getInput(i);
+    requireValid(u.sequence === 0xffffffff && u.finalScriptSig?.length > 0);
+    return `${hex.encode(u.txid)}:${u.index}`;
+  });
+  return { txId: tx.id, outpoints };
+}
+
+export function foreignWalletOutputAddress(
+  script: Uint8Array,
+  coin: ForeignWalletCoin
+) {
+  return Address(networks[coin]).encode(OutScript.decode(script));
+}
diff --git a/src/lib/foreign-wallet/foreign-wallets.ts b/src/lib/foreign-wallet/foreign-wallets.ts
new file mode 100644
index 000000000..5fb11135b
--- /dev/null
+++ b/src/lib/foreign-wallet/foreign-wallets.ts
@@ -0,0 +1,98 @@
+import { HDKey } from '@scure/bip32';
+import { base58check } from '@scure/base';
+import { sha256 } from '@noble/hashes/sha256';
+import { sha512 } from '@noble/hashes/sha512';
+import { ripemd160 } from '@noble/hashes/ripemd160';
+
+export type ForeignWalletCoin = 'BTC' | 'LTC' | 'DOGE' | 'DGB' | 'RVN';
+export type ForeignWalletCrypto = {
+  sha256: typeof sha256;
+  sha512: typeof sha512;
+  ripemd160: typeof ripemd160;
+};
+export const foreignCrypto: ForeignWalletCrypto = { sha256, sha512, ripemd160 };
+export const foreignCoins: readonly ForeignWalletCoin[] = [
+  'BTC',
+  'LTC',
+  'DOGE',
+  'DGB',
+  'RVN',
+];
+const prefixes = { BTC: 0, LTC: 48, DOGE: 30, DGB: 30, RVN: 60 };
+export const walletVersions = (coin: ForeignWalletCoin) =>
+  coin === 'DOGE'
+    ? { private: 0x02fac398, public: 0x02facafd }
+    : { private: 0x0488ade4, public: 0x0488b21e };
+
+// Import the existing extended key; never rederive the wallet from a new seed scheme.
+export function walletPublicKey(xprv: string, coin: ForeignWalletCoin): string {
+  const root = HDKey.fromExtendedKey(xprv, walletVersions(coin));
+  try {
+    if (!root.privateKey || root.depth !== 0)
+      throw new Error('Invalid wallet root');
+    return root.publicExtendedKey;
+  } finally {
+    root.wipePrivateData();
+  }
+}
+
+type LeafInput = {
+  xprv?: string;
+  xpub?: string;
+  coin: ForeignWalletCoin;
+  chain: number;
+  index: number;
+  crypto?: ForeignWalletCrypto;
+};
+export function withForeignWalletLeaf<T>(
+  input: LeafInput,
+  callback: (key: HDKey) => T
+): T {
+  if (
+    ![0, 1].includes(input.chain) ||
+    !Number.isSafeInteger(input.index) ||
+    input.index < 0 ||
+    input.index >= 0x80000000
+  )
+    throw new Error('Invalid wallet path');
+  const root = HDKey.fromExtendedKey(
+    input.xpub ?? input.xprv,
+    walletVersions(input.coin)
+  );
+  let branch: HDKey;
+  let leaf: HDKey;
+  try {
+    if (root.depth !== 0) throw new Error('Invalid wallet root');
+    branch = root.deriveChild(input.chain);
+    leaf = branch.deriveChild(input.index);
+    return callback(leaf);
+  } finally {
+    leaf?.wipePrivateData();
+    branch?.wipePrivateData();
+    root.wipePrivateData();
+  }
+}
+function publicData(input: LeafInput, leaf: HDKey) {
+  const hash = ripemd160(sha256(leaf.publicKey));
+  return {
+    publicKey: Uint8Array.from(leaf.publicKey),
+    path: `M/${input.chain}/${input.index}`,
+    address: base58check(sha256).encode(
+      Uint8Array.from([prefixes[input.coin], ...hash])
+    ),
+  };
+}
+export function deriveForeignWalletLeafPublicData(input: LeafInput) {
+  return withForeignWalletLeaf(input, (leaf) => publicData(input, leaf));
+}
+
+export function walletFingerprint(xpub: string, coin: ForeignWalletCoin) {
+  const root = HDKey.fromExtendedKey(xpub, walletVersions(coin));
+  try {
+    if (root.privateKey || root.depth !== 0)
+      throw new Error('Expected a public wallet root');
+    return root.fingerprint;
+  } finally {
+    root.wipePrivateData();
+  }
+}
diff --git a/src/lib/foreign-wallet/psbt.test.ts b/src/lib/foreign-wallet/psbt.test.ts
new file mode 100644
index 000000000..f08d9c621
--- /dev/null
+++ b/src/lib/foreign-wallet/psbt.test.ts
@@ -0,0 +1,286 @@
+import { describe, it, expect, vi } from 'vitest';
+import { HDKey } from '@scure/bip32';
+import { hex } from '@scure/base';
+import { sha256 } from '@noble/hashes/sha256';
+import { Transaction, p2pkh } from '@scure/btc-signer';
+import {
+  createDesktopWalletSigner,
+  desktopWalletTranslations,
+} from './desktop-engine';
+import {
+  foreignCoins,
+  walletVersions,
+  deriveForeignWalletLeafPublicData,
+} from './foreign-wallets';
+import {
+  prepareForeignWalletPsbt,
+  signForeignWalletPsbt,
+  inspectSignedTransaction,
+  validateForeignWalletRecipient,
+} from './foreign-wallet-transaction';
+import { normalizeForeignWalletSpendContext } from './foreign-wallet-spend-context';
+
+const roots = Object.fromEntries(
+  foreignCoins.map((coin) => [
+    coin,
+    HDKey.fromMasterSeed(new Uint8Array(32).fill(9), walletVersions(coin)),
+  ])
+);
+const keys = Object.fromEntries(
+  foreignCoins.map((coin) => [
+    `${coin.toLowerCase()}PrivateKey`,
+    roots[coin].privateExtendedKey,
+  ])
+);
+function fixture(coin: (typeof foreignCoins)[number] = 'LTC') {
+  const xprv = roots[coin].privateExtendedKey;
+  const xpub = roots[coin].publicExtendedKey;
+  const leaf = deriveForeignWalletLeafPublicData({
+    coin,
+    xpub,
+    chain: 0,
+    index: 0,
+  });
+  const scriptPubKey = hex.encode(p2pkh(leaf.publicKey).script);
+  const previousTransactionHex = `0100000001${'11'.repeat(32)}0000000000ffffffff0100ca9a3b0000000019${scriptPubKey}00000000`;
+  const txHash = hex.encode(
+    sha256(sha256(hex.decode(previousTransactionHex))).reverse()
+  );
+  const inputs = [
+    {
+      address: leaf.address,
+      height: 100,
+      path: 'M/0/0',
+      previousTransactionHex,
+      scriptPubKey,
+      txHash,
+      txPos: 0,
+      value: 1000000000n,
+    },
+  ];
+  const outputs = [{ address: leaf.address, value: 999990000n }];
+  const request = { coin, xpub, inputs, outputs };
+  return { ...request, xprv, psbt: prepareForeignWalletPsbt(request) };
+}
+describe('PSBT and isolated desktop signing', () => {
+  it.each(foreignCoins)(
+    '%s includes full previous transactions and public derivation metadata',
+    (coin) => {
+      const f = fixture(coin);
+      const tx = Transaction.fromPSBT(f.psbt);
+      expect(tx.getInput(0).nonWitnessUtxo).toBeDefined();
+      expect(tx.getInput(0).bip32Derivation[0][1]).toEqual({
+        fingerprint: roots[coin].fingerprint,
+        path: [0, 0],
+      });
+      expect(tx.getInput(0).sighashType).toBe(1);
+      const signed = signForeignWalletPsbt(f, f.psbt);
+      expect(inspectSignedTransaction(signed.rawTransactionHex)).toEqual({
+        txId: signed.txId,
+        outpoints: [`${f.inputs[0].txHash}:0`],
+      });
+    }
+  );
+  it('refuses altered outputs, sighash flags, version, and added PSBT metadata', () => {
+    const f = fixture();
+    for (const mutate of [
+      (tx: Transaction) => tx.updateOutput(0, { amount: 999980000n }),
+      (tx: Transaction) => tx.updateInput(0, { sighashType: 2 }),
+      (tx: Transaction) => tx.updateInput(0, { sequence: 0xfffffffe }),
+      (tx: Transaction) =>
+        tx.updateInput(0, {
+          bip32Derivation: [
+            [
+              new Uint8Array([2, ...new Uint8Array(32).fill(1)]),
+              { fingerprint: 1, path: [0, 0] },
+            ],
+          ],
+        }),
+    ]) {
+      const tx = Transaction.fromPSBT(f.psbt);
+      mutate(tx);
+      expect(() => signForeignWalletPsbt(f, tx.toPSBT())).toThrow();
+    }
+    expect(() =>
+      prepareForeignWalletPsbt({ ...f, transactionVersion: 2 })
+    ).toThrow();
+  });
+  it('rejects missing previous bytes, forged scripts, duplicate inputs and wrong paths', () => {
+    const f = fixture();
+    for (const change of [
+      { previousTransactionHex: '' },
+      { value: 1n },
+      { scriptPubKey: '00'.repeat(25) },
+      { path: 'M/0/2147483648' },
+      { txPos: 1 },
+      { height: 0 },
+    ])
+      expect(() =>
+        prepareForeignWalletPsbt({
+          ...f,
+          inputs: [{ ...f.inputs[0], ...change }],
+        })
+      ).toThrow();
+    expect(() =>
+      prepareForeignWalletPsbt({ ...f, inputs: [f.inputs[0], f.inputs[0]] })
+    ).toThrow();
+  });
+  it('does not accept Bitcoin witness recipients for Dogecoin or Ravencoin', () => {
+    const f = fixture('BTC');
+    expect(() =>
+      validateForeignWalletRecipient({
+        coin: 'LTC',
+        address: f.outputs[0].address,
+      })
+    ).toThrow();
+    for (const coin of ['DOGE', 'RVN'] as const)
+      expect(() =>
+        validateForeignWalletRecipient({
+          coin,
+          address: 'bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4',
+        })
+      ).toThrow();
+  });
+  it('returns public keys only and requires native approval for every signature', async () => {
+    const signer = createDesktopWalletSigner();
+    const f = fixture();
+    expect(signer.importKeys(keys)).toEqual(
+      Object.fromEntries(
+        foreignCoins.map((coin) => [coin, roots[coin].publicExtendedKey])
+      )
+    );
+    const approve = vi.fn(async () => false);
+    const request = {
+      coin: f.coin,
+      xpub: f.xpub,
+      inputs: f.inputs,
+      outputs: f.outputs,
+      psbtHex: hex.encode(f.psbt),
+    };
+    await expect(signer.sign(request, approve)).rejects.toThrow();
+    expect(approve).toHaveBeenCalledOnce();
+    const signed = await signer.sign(request, async (details) => {
+      expect(details.fee).toBe(10000n);
+      expect(details.outputs).toEqual(f.outputs);
+      return true;
+    });
+    expect(signed.txId).toMatch(/^[a-f0-9]{64}$/);
+    signer.clear();
+    expect(() => signer.publicKey('LTC')).toThrow();
+    await expect(signer.sign(request, approve)).rejects.toThrow();
+    expect(approve).toHaveBeenCalledOnce();
+  });
+  it('binds approval to an immutable snapshot and cancels on logout or account replacement', async () => {
+    const f = fixture();
+    const signer = createDesktopWalletSigner();
+    signer.importKeys(keys);
+    const request = { ...f, psbtHex: hex.encode(f.psbt) };
+    const signed = await signer.sign(request, async () => {
+      request.outputs[0].value = 1n;
+      return true;
+    });
+    expect(signed.outputAmount).toBe(999990000n);
+    const next = fixture();
+    const req = { ...next, psbtHex: hex.encode(next.psbt) };
+    await expect(
+      signer.sign(req, async () => {
+        signer.clear();
+        return true;
+      })
+    ).rejects.toThrow();
+    signer.importKeys(keys);
+    await expect(
+      signer.sign(req, async () => {
+        signer.importKeys(keys);
+        return true;
+      })
+    ).rejects.toThrow();
+  });
+  it('rejects concurrent approvals and tampering before showing the native dialog', async () => {
+    const f = fixture();
+    const signer = createDesktopWalletSigner();
+    signer.importKeys(keys);
+    const req = { ...f, psbtHex: hex.encode(f.psbt) };
+    const approve = vi.fn(async () => true);
+    await expect(
+      signer.sign({ ...req, psbtHex: req.psbtHex + '00' }, approve)
+    ).rejects.toThrow();
+    expect(approve).not.toHaveBeenCalled();
+    await signer.sign(req, async () => {
+      await expect(signer.sign(req, approve)).rejects.toThrow();
+      return true;
+    });
+  });
+  it('provides localized native confirmations and falls back for unknown languages', () => {
+    expect(
+      desktopWalletTranslations('de').t('question:local_send.native_title')
+    ).toBe('Wallet-Zahlung bestätigen');
+    expect(
+      desktopWalletTranslations('unsupported').t(
+        'question:local_send.native_title'
+      )
+    ).toBe('Confirm wallet payment');
+  });
+  it('rejects unsupported public context contracts', () => {
+    for (const input of [
+      null,
+      {},
+      { version: 1, currencyCode: 'LTC', chainId: 'wrong' },
+    ])
+      expect(() => normalizeForeignWalletSpendContext(input, 'LTC')).toThrow();
+  });
+});
+it('accepts the intended address formats while rejecting unsupported Taproot outputs', async () => {
+  const { Address, OutScript, p2tr } = await import('@scure/btc-signer');
+  const hash = new Uint8Array(20).fill(3);
+  const legacy = Address({
+    pubKeyHash: 48,
+    scriptHash: 5,
+    bech32: 'ltc',
+    wif: 176,
+  }).encode({ type: 'sh', hash });
+  const current = Address({
+    pubKeyHash: 48,
+    scriptHash: 50,
+    bech32: 'ltc',
+    wif: 176,
+  }).encode({ type: 'sh', hash });
+  expect(
+    validateForeignWalletRecipient({ coin: 'LTC', address: legacy })
+      .scriptPubKey
+  ).toEqual(
+    validateForeignWalletRecipient({ coin: 'LTC', address: current })
+      .scriptPubKey
+  );
+  for (const [coin, bech32] of [
+    ['BTC', 'bc'],
+    ['LTC', 'ltc'],
+    ['DGB', 'dgb'],
+  ] as const) {
+    const address = Address({
+      pubKeyHash: 0,
+      scriptHash: 5,
+      bech32,
+      wif: 128,
+    }).encode({ type: 'wpkh', hash });
+    expect(
+      validateForeignWalletRecipient({ coin, address }).scriptPubKey
+    ).toEqual(OutScript.encode({ type: 'wpkh', hash }));
+  }
+  const taproot = p2tr(roots.BTC.publicKey.slice(1));
+  expect(() =>
+    validateForeignWalletRecipient({ coin: 'BTC', address: taproot.address })
+  ).toThrow();
+});
+it('uses the non-witness transaction ID when spending a P2PKH output funded by a witness transaction', () => {
+  const f = fixture();
+  const original = f.inputs[0].previousTransactionHex;
+  const previousTransactionHex =
+    original.slice(0, 8) +
+    '0001' +
+    original.slice(8, -8) +
+    '010101' +
+    original.slice(-8);
+  const inputs = [{ ...f.inputs[0], previousTransactionHex }];
+  expect(() => prepareForeignWalletPsbt({ ...f, inputs })).not.toThrow();
+});
diff --git a/src/lib/foreign-wallet/send.test.ts b/src/lib/foreign-wallet/send.test.ts
new file mode 100644
index 000000000..1e27aacba
--- /dev/null
+++ b/src/lib/foreign-wallet/send.test.ts
@@ -0,0 +1,760 @@
+vi.unmock('asmcrypto.js');
+vi.unmock('asmcrypto.js/asmcrypto.all.js');
+import { describe, expect, it, vi } from 'vitest';
+import { HDKey } from '@scure/bip32';
+import { bytesToHex } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha256';
+import { ripemd160 } from '@noble/hashes/ripemd160';
+import { base58check } from '@scure/base';
+import {
+  foreignCrypto,
+  foreignCoins,
+  deriveForeignWalletLeafPublicData,
+  walletPublicKey,
+} from './foreign-wallets';
+import { buildForeignWalletSignedTransaction } from './foreign-wallet-transaction';
+import {
+  sendForeignCoin,
+  reconcilePendingForeignCoin,
+  atomicAmount,
+  type PendingSend,
+} from './send';
+import { getForeignWalletMainnetChainId } from './foreign-wallet-spend-context';
+import PhraseWallet from '../../utils/generateWallet/phrase-wallet';
+
+function fixture(coin: (typeof foreignCoins)[number]) {
+  const wallet = new PhraseWallet(new Uint8Array(32).fill(7), 2);
+  const original = wallet.addresses[0][`${coin.toLowerCase()}Wallet`];
+  const xprv = original.derivedMasterPrivateKey;
+  const leaf = deriveForeignWalletLeafPublicData({
+    xprv,
+    coin,
+    crypto: foreignCrypto,
+    chain: 0,
+    index: 0,
+  });
+  const script = `76a914${bytesToHex(ripemd160(sha256(leaf.publicKey)))}88ac`;
+  // Non-coinbase funding fixture paying 10 coins to the existing Hub wallet.
+  const previousTransactionHex = `0100000001${'11'.repeat(32)}0000000000ffffffff0100ca9a3b0000000019${script}00000000`;
+  const txHash = bytesToHex(
+    sha256(
+      sha256(
+        Uint8Array.from(
+          previousTransactionHex.match(/../g)!.map((v) => parseInt(v, 16))
+        )
+      )
+    ).reverse()
+  );
+  const input = {
+    address: leaf.address,
+    height: 100,
+    path: 'M/0/0',
+    previousTransactionHex,
+    scriptPubKey: script,
+    txHash,
+    txPos: 0,
+    value: 1000000000n,
+  };
+  const context = {
+    version: 1,
+    blockchain: {
+      BTC: 'BITCOIN',
+      LTC: 'LITECOIN',
+      DOGE: 'DOGECOIN',
+      DGB: 'DIGIBYTE',
+      RVN: 'RAVENCOIN',
+    }[coin],
+    currencyCode: coin,
+    activeNetwork: 'MAIN',
+    chainId: getForeignWalletMainnetChainId(coin),
+    tipHeight: 200,
+    confirmedOnly: true,
+    transactionFormat: 'LEGACY',
+    transactionVersion: 1,
+    sighashType: 1,
+    sequence: 0xffffffff,
+    lockTime: 0,
+    minimumNonDustOutput: '546',
+    recommendedFeePerByte: '10',
+    previousTransactions: { [txHash]: previousTransactionHex },
+    utxos: [
+      {
+        ...input,
+        path: [0, 0],
+        pathAsString: input.path,
+        outputIndex: input.txPos,
+        scriptPubKeyHex: input.scriptPubKey,
+        value: input.value.toString(),
+      },
+    ],
+  };
+  return { xprv, original, leaf, input, context };
+}
+
+function transactionStatus(
+  coin: (typeof foreignCoins)[number],
+  txId: string,
+  status: 'UNKNOWN' | 'MEMPOOL' | 'CONFIRMED'
+) {
+  return {
+    version: 1,
+    currencyCode: coin,
+    activeNetwork: 'MAIN',
+    chainId: getForeignWalletMainnetChainId(coin),
+    txId,
+    status,
+  };
+}
+
+describe('local foreign wallet signing', () => {
+  for (const coin of foreignCoins) {
+    it(`${coin}: preserves existing Hub derivation and signs valid input scripts`, async () => {
+      const { xprv, original, leaf, input } = fixture(coin);
+      expect(walletPublicKey(xprv, coin)).toBe(original.derivedMasterPublicKey);
+      expect(leaf.address).toBe(original.address);
+      const result = buildForeignWalletSignedTransaction({
+        coin,
+        xprv,
+        crypto: foreignCrypto,
+        inputs: [input],
+        outputs: [{ address: leaf.address, value: 999990000n }],
+      });
+      expect(result.fee).toBe(10000n);
+      expect(result.rawTransactionHex).not.toContain(xprv);
+      expect(result.txId).toMatch(/^[a-f0-9]{64}$/);
+      // Independent bitcoinj validation consumes these fixtures in Core tests.
+      if (process.env.FOREIGN_FIXTURE_DIR) {
+        const fs = await import('node:fs');
+        fs.writeFileSync(
+          `${process.env.FOREIGN_FIXTURE_DIR}/${coin}.json`,
+          JSON.stringify({
+            coin,
+            xprv,
+            publicKey: bytesToHex(leaf.publicKey),
+            raw: result.rawTransactionHex,
+            previous: input.previousTransactionHex,
+            txId: result.txId,
+          })
+        );
+      }
+    });
+  }
+  it('plans multiple trade outputs, change and send-max without floating point fees', async () => {
+    const { planForeignWalletSpend } =
+      await import('./foreign-wallet-spend-plan');
+    const { xprv, leaf, input } = fixture('LTC');
+    const secondAddress = deriveForeignWalletLeafPublicData({
+      coin: 'LTC',
+      xprv,
+      crypto: foreignCrypto,
+      chain: 1,
+      index: 7,
+    }).address;
+    const common = {
+      coin: 'LTC' as const,
+      xprv,
+      crypto: foreignCrypto,
+      feePerByte: 30n,
+      minimumNonDustOutput: 100000n,
+      utxos: [input],
+      recipientAddress: leaf.address,
+    };
+    const payments = [
+      { address: leaf.address, value: 100000000n },
+      { address: secondAddress, value: 200000000n },
+    ];
+    const plan = planForeignWalletSpend({
+      ...common,
+      amount: 300000000n,
+      payments,
+    });
+    expect(plan.outputs.slice(0, 2)).toEqual(payments);
+    expect(plan.outputs).toHaveLength(3);
+    expect(plan.amount + plan.change + plan.fee).toBe(input.value);
+    const signed = buildForeignWalletSignedTransaction({
+      ...common,
+      inputs: plan.inputs,
+      outputs: plan.outputs,
+    });
+    expect(signed.fee).toBe(plan.fee);
+    expect(signed.transactionSize).toBeLessThanOrEqual(
+      plan.estimatedMaximumSize
+    );
+    const max = planForeignWalletSpend({ ...common, sendMax: true });
+    expect(max.change).toBe(0n);
+    expect(max.amount + max.fee).toBe(input.value);
+    expect(() => planForeignWalletSpend({ ...common, amount: 1n })).toThrow();
+  });
+  it('does not broadcast when journal persistence fails', async () => {
+    const { xprv, leaf, context } = fixture('LTC');
+    let broadcasts = 0;
+    const deps = {
+      approve: async () => true,
+      stillValid: async () => true,
+      readPending: async () => null,
+      writePending: async () => {
+        throw new Error('disk failure');
+      },
+      post: async (path: string) => {
+        if (path.endsWith('/send/broadcast')) broadcasts++;
+        return context;
+      },
+    };
+    await expect(
+      sendForeignCoin(
+        { coin: 'LTC', xprv, amount: '1', recipient: leaf.address },
+        deps
+      )
+    ).rejects.toThrow('disk failure');
+    expect(broadcasts).toBe(0);
+  });
+  it('retains a reservation while the exact transaction is in the mempool', async () => {
+    const { xprv, leaf, context } = fixture('LTC');
+    let pending: PendingSend = null;
+    const deps = {
+      approve: async () => true,
+      stillValid: async () => true,
+      readPending: async () => pending,
+      writePending: async (value: PendingSend) => {
+        pending = value;
+      },
+      post: async (path: string, body: any) =>
+        path.endsWith('/send/broadcast')
+          ? pending.txId
+          : path.endsWith('transaction-status')
+            ? transactionStatus('LTC', body.txId, 'MEMPOOL')
+            : context,
+    };
+    const req = {
+      coin: 'LTC' as const,
+      xprv,
+      amount: '1',
+      recipient: leaf.address,
+    };
+    const txId = await sendForeignCoin(req, deps);
+    expect(pending.txId).toBe(txId);
+    await expect(sendForeignCoin(req, deps)).rejects.toMatchObject({
+      code: 'confirming',
+      txId,
+    });
+    expect(pending.txId).toBe(txId);
+  });
+  it('clears a confirmed old payment and asks normally about the current one', async () => {
+    const { xprv, leaf, context } = fixture('LTC');
+    let pending: PendingSend = null;
+    let status: 'UNKNOWN' | 'CONFIRMED' = 'UNKNOWN';
+    const approve = vi
+      .fn<() => Promise<boolean>>()
+      .mockResolvedValueOnce(true)
+      .mockResolvedValueOnce(false);
+    const post = vi.fn(async (path: string, body: any) => {
+      if (path.endsWith('/send/broadcast')) return pending.txId;
+      if (path.endsWith('transaction-status'))
+        return transactionStatus('LTC', body.txId, status);
+      return context;
+    });
+    const deps = {
+      approve,
+      stillValid: async () => true,
+      readPending: async () => pending,
+      writePending: async (value: PendingSend) => {
+        pending = value;
+      },
+      post,
+    };
+    const req = {
+      coin: 'LTC' as const,
+      xprv,
+      amount: '1',
+      recipient: leaf.address,
+    };
+    const previousTxId = await sendForeignCoin(req, deps);
+    status = 'CONFIRMED';
+
+    await expect(sendForeignCoin(req, deps)).rejects.toMatchObject({
+      code: 'declined',
+    });
+    expect(pending).toBeNull();
+    expect(approve).toHaveBeenCalledTimes(2);
+    expect(
+      post.mock.calls.filter(([path]) => path.endsWith('/send/broadcast'))
+    ).toHaveLength(1);
+  });
+  it('rejects forged amounts and previous transactions', () => {
+    const { xprv, leaf, input } = fixture('LTC');
+    for (const changed of [
+      { ...input, value: input.value + 1n },
+      {
+        ...input,
+        previousTransactionHex: input.previousTransactionHex.replace(
+          '00ca9a3b',
+          '01ca9a3b'
+        ),
+      },
+      { ...input, path: 'M/1/0' },
+    ]) {
+      expect(() =>
+        buildForeignWalletSignedTransaction({
+          coin: 'LTC',
+          xprv,
+          crypto: foreignCrypto,
+          inputs: [changed],
+          outputs: [{ address: leaf.address, value: 100000n }],
+        })
+      ).toThrow();
+    }
+  });
+  it('accepts existing numeric fee values and rejects fractional atomic units', () => {
+    expect(atomicAmount(0.0000003)).toBe(30n);
+    expect(atomicAmount('0.00000001')).toBe(1n);
+    for (const raw of [0, -1, NaN, Infinity, '1e3', '0.000000001', 0.000000001])
+      expect(() => atomicAmount(raw)).toThrow();
+  });
+  it('honors an explicit fee below the Core recommendation', async () => {
+    const { xprv, leaf, context } = fixture('LTC');
+    const approve = vi.fn(async () => false);
+
+    await expect(
+      sendForeignCoin(
+        {
+          coin: 'LTC',
+          xprv,
+          amount: '0.07',
+          recipient: leaf.address,
+          fee: '0.00000009',
+        },
+        {
+          post: async () => context,
+          stillValid: async () => true,
+          approve,
+          readPending: async () => null,
+          writePending: vi.fn(),
+        }
+      )
+    ).rejects.toMatchObject({ code: 'declined' });
+    expect(approve).toHaveBeenCalledWith(
+      expect.objectContaining({
+        amount: 7000000n,
+        feePerByte: 9n,
+      })
+    );
+  });
+  it('keeps an explicit fee when the Core recommendation changes', async () => {
+    const { xprv, leaf, context } = fixture('LTC');
+    let pending: PendingSend = null;
+    let reads = 0;
+    const post = vi.fn(async (path: string) => {
+      if (path.endsWith('/send/broadcast')) return pending.txId;
+      reads++;
+      return reads === 1
+        ? context
+        : { ...context, recommendedFeePerByte: '11' };
+    });
+
+    const txId = await sendForeignCoin(
+      {
+        coin: 'LTC',
+        xprv,
+        amount: '0.07',
+        recipient: leaf.address,
+        fee: '0.00000009',
+      },
+      {
+        post,
+        stillValid: async () => true,
+        approve: async () => true,
+        readPending: async () => null,
+        writePending: async (value) => {
+          pending = value;
+        },
+      }
+    );
+
+    expect(txId).toBe(pending.txId);
+    expect(post).toHaveBeenCalledTimes(3);
+  });
+  it('still rejects an explicit fee above the local safety ceiling', async () => {
+    const { xprv, leaf, context } = fixture('LTC');
+    const approve = vi.fn(async () => true);
+
+    await expect(
+      sendForeignCoin(
+        {
+          coin: 'LTC',
+          xprv,
+          amount: '0.07',
+          recipient: leaf.address,
+          fee: '0.00020001',
+        },
+        {
+          post: async () => context,
+          stillValid: async () => true,
+          approve,
+          readPending: async () => null,
+          writePending: vi.fn(),
+        }
+      )
+    ).rejects.toThrow('Wallet fee policy exceeded');
+    expect(approve).not.toHaveBeenCalled();
+  });
+  it('retains ambiguous broadcasts and never sends the key to Core', async () => {
+    const { xprv, leaf, context } = fixture('LTC');
+    let pending: PendingSend = null;
+    let broadcasts = 0;
+    const bodies: string[] = [];
+    const deps = {
+      stillValid: async () => true,
+      approve: async () => true,
+      readPending: async () => pending,
+      writePending: async (value: PendingSend) => {
+        pending = value;
+      },
+      post: async (path: string, body: unknown) => {
+        bodies.push(JSON.stringify(body));
+        if (path.endsWith('spend-context')) return context;
+        if (path.endsWith('transaction-status'))
+          return transactionStatus('LTC', pending.txId, 'UNKNOWN');
+        broadcasts++;
+        throw new Error('timeout');
+      },
+    };
+    const req = {
+      coin: 'LTC' as const,
+      xprv,
+      amount: '1',
+      recipient: leaf.address,
+    };
+    await expect(sendForeignCoin(req, deps)).rejects.toMatchObject({
+      code: 'unknown',
+    });
+    expect(pending?.txId).toMatch(/^[a-f0-9]{64}$/);
+    await expect(sendForeignCoin(req, deps)).rejects.toMatchObject({
+      code: 'pending',
+    });
+    expect(broadcasts).toBe(1);
+    expect(bodies.join('')).not.toContain(xprv);
+  });
+  it('refuses a changed wallet after approval without broadcasting', async () => {
+    const { xprv, leaf, context } = fixture('BTC');
+    const deps = {
+      post: async () => context,
+      stillValid: async () => false,
+      approve: async () => true,
+      readPending: async () => null,
+      writePending: async () => {
+        throw new Error('must not stage');
+      },
+    };
+    await expect(
+      sendForeignCoin(
+        { coin: 'BTC', xprv, amount: '1', recipient: leaf.address },
+        deps
+      )
+    ).rejects.toMatchObject({ code: 'changed' });
+  });
+});
+
+it('recovers only the identical persisted bytes and never reports an old payment as a new send', async () => {
+  const { xprv, leaf, context } = fixture('LTC');
+  let pending: PendingSend = null;
+  const sent: unknown[] = [];
+  let allowBroadcast = false;
+  const deps = {
+    stillValid: async () => true,
+    approve: vi.fn(async () => true),
+    approveRecovery: vi.fn(async () => true),
+    readPending: async () => pending,
+    writePending: async (value: PendingSend) => {
+      pending = value;
+    },
+    post: async (path: string, body: any) => {
+      if (path.endsWith('spend-context')) return context;
+      if (path.endsWith('transaction-status'))
+        return transactionStatus('LTC', pending.txId, 'UNKNOWN');
+      sent.push(body);
+      if (!allowBroadcast) throw new Error('lost connection');
+      return pending.txId;
+    },
+  };
+  const request = {
+    coin: 'LTC' as const,
+    xprv,
+    recipient: leaf.address,
+    amount: '1',
+  };
+  await expect(sendForeignCoin(request, deps)).rejects.toMatchObject({
+    code: 'unknown',
+  });
+  expect(pending.rawTransactionHex).toBeTruthy();
+  allowBroadcast = true;
+  await expect(
+    sendForeignCoin({ ...request, amount: '2' }, deps)
+  ).rejects.toMatchObject({ code: 'pending' });
+  expect(sent).toHaveLength(2);
+  expect(sent[1]).toEqual(sent[0]);
+  expect(deps.approve).toHaveBeenCalledOnce();
+  expect(deps.approveRecovery).toHaveBeenCalledOnce();
+});
+it('rejects corrupt recovery bytes and respects expired trade funding deadlines', async () => {
+  const { xprv, leaf, input } = fixture('LTC');
+  const signed = buildForeignWalletSignedTransaction({
+    coin: 'LTC',
+    xprv,
+    inputs: [input],
+    outputs: [{ address: leaf.address, value: 999990000n }],
+  });
+  const approveRecovery = vi.fn(async () => true);
+  const post = vi.fn(async (_path: string, body: any) =>
+    transactionStatus('LTC', body.txId, 'UNKNOWN')
+  );
+  for (const entry of [
+    { txId: 'a'.repeat(64), rawTransactionHex: signed.rawTransactionHex },
+    {
+      txId: signed.txId,
+      rawTransactionHex: signed.rawTransactionHex,
+      broadcastBefore: Date.now() - 1000,
+    },
+  ]) {
+    await expect(
+      sendForeignCoin(
+        { coin: 'LTC', xprv, recipient: leaf.address, amount: '1' },
+        {
+          stillValid: async () => true,
+          approve: async () => true,
+          approveRecovery,
+          post,
+          readPending: async () => ({
+            ...entry,
+            outpoints: [`${input.txHash}:0`],
+          }),
+          writePending: vi.fn(),
+        }
+      )
+    ).rejects.toMatchObject({ code: 'pending' });
+  }
+  expect(approveRecovery).not.toHaveBeenCalled();
+  expect(
+    post.mock.calls.every(([path]) => path.endsWith('transaction-status'))
+  ).toBe(true);
+});
+
+it('background reconciliation clears only a confirmed exact transaction', async () => {
+  const { xprv } = fixture('LTC');
+  const xpub = walletPublicKey(xprv, 'LTC');
+  const txId = 'a'.repeat(64);
+  let pending: PendingSend = {
+    txId,
+    outpoints: [`${'b'.repeat(64)}:0`],
+  };
+  const writePending = vi.fn(async (value: PendingSend) => {
+    pending = value;
+  });
+  const state = await reconcilePendingForeignCoin('LTC', xpub, {
+    stillValid: async () => true,
+    readPending: async () => pending,
+    writePending,
+    post: async (_path, body: any) =>
+      transactionStatus('LTC', body.txId, 'CONFIRMED'),
+  });
+  expect(state).toBe('confirmed');
+  expect(pending).toBeNull();
+  expect(writePending).toHaveBeenCalledWith(null);
+});
+
+it.each(['UNKNOWN', 'MEMPOOL'] as const)(
+  'background reconciliation keeps a %s transaction reserved',
+  async (status) => {
+    const { xprv } = fixture('LTC');
+    const xpub = walletPublicKey(xprv, 'LTC');
+    const pending: PendingSend = {
+      txId: 'a'.repeat(64),
+      outpoints: [`${'b'.repeat(64)}:0`],
+    };
+    const writePending = vi.fn();
+    expect(
+      await reconcilePendingForeignCoin('LTC', xpub, {
+        stillValid: async () => true,
+        readPending: async () => pending,
+        writePending,
+        post: async (_path, body: any) =>
+          transactionStatus('LTC', body.txId, status),
+      })
+    ).toBe(status.toLowerCase());
+    expect(writePending).not.toHaveBeenCalled();
+  }
+);
+
+it('does not clear a confirmed reservation after the wallet or Core changes', async () => {
+  const { xprv } = fixture('LTC');
+  const xpub = walletPublicKey(xprv, 'LTC');
+  const pending: PendingSend = {
+    txId: 'a'.repeat(64),
+    outpoints: [`${'b'.repeat(64)}:0`],
+  };
+  const writePending = vi.fn();
+  expect(
+    await reconcilePendingForeignCoin('LTC', xpub, {
+      stillValid: async () => false,
+      readPending: async () => pending,
+      writePending,
+      post: async (_path, body: any) =>
+        transactionStatus('LTC', body.txId, 'CONFIRMED'),
+    })
+  ).toBe('unknown');
+  expect(writePending).not.toHaveBeenCalled();
+});
+
+it('rejects a transaction-status response for a different transaction', async () => {
+  const { xprv } = fixture('LTC');
+  const xpub = walletPublicKey(xprv, 'LTC');
+  const pending: PendingSend = {
+    txId: 'a'.repeat(64),
+    outpoints: [`${'b'.repeat(64)}:0`],
+  };
+  const writePending = vi.fn();
+  await expect(
+    reconcilePendingForeignCoin('LTC', xpub, {
+      stillValid: async () => true,
+      readPending: async () => pending,
+      writePending,
+      post: async () => transactionStatus('LTC', 'c'.repeat(64), 'CONFIRMED'),
+    })
+  ).rejects.toMatchObject({ code: 'invalid' });
+  expect(writePending).not.toHaveBeenCalled();
+});
+
+it('plans with only a public key when using the isolated signer', async () => {
+  const { xprv, leaf, context } = fixture('LTC');
+  let pending: PendingSend = null;
+  const sign = vi.fn(async (plan, psbt) => {
+    const { signForeignWalletPsbt } =
+      await import('./foreign-wallet-transaction');
+    return signForeignWalletPsbt(
+      { coin: 'LTC', xprv, inputs: plan.inputs, outputs: plan.outputs },
+      psbt
+    );
+  });
+  const result = await sendForeignCoin(
+    {
+      coin: 'LTC',
+      xpub: walletPublicKey(xprv, 'LTC'),
+      recipient: leaf.address,
+      amount: '1',
+    },
+    {
+      sign,
+      stillValid: async () => true,
+      approve: async () => true,
+      readPending: async () => null,
+      writePending: async (value) => {
+        pending = value;
+      },
+      post: async (path) =>
+        path.endsWith('/send/broadcast') ? pending.txId : context,
+    }
+  );
+  expect(result).toBe(pending.txId);
+  expect(sign).toHaveBeenCalledOnce();
+  expect(
+    JSON.stringify(sign.mock.calls, (_, v) =>
+      typeof v === 'bigint' ? v.toString() : v
+    )
+  ).not.toContain(xprv);
+});
+
+it('rejects a private extended key mislabeled as xpub before making any network request', async () => {
+  const { xprv, leaf } = fixture('LTC');
+  const post = vi.fn();
+  await expect(
+    sendForeignCoin(
+      { coin: 'LTC', xpub: xprv, recipient: leaf.address, amount: '1' },
+      {
+        post,
+        stillValid: async () => true,
+        approve: async () => true,
+        readPending: async () => null,
+        writePending: vi.fn(),
+      }
+    )
+  ).rejects.toThrow();
+  expect(post).not.toHaveBeenCalled();
+});
+
+it('rejects a busy cross-tab lock without queuing another send', async () => {
+  const { xprv, leaf } = fixture('LTC');
+  const post = vi.fn();
+  const requestLock = vi.fn(async (_name, options, callback) => {
+    expect(options).toEqual({ ifAvailable: true });
+    return callback(null);
+  });
+  vi.stubGlobal('navigator', { locks: { request: requestLock } });
+  try {
+    await expect(
+      sendForeignCoin(
+        { coin: 'LTC', xprv, amount: '1', recipient: leaf.address },
+        { post } as any
+      )
+    ).rejects.toMatchObject({ code: 'pending' });
+    expect(post).not.toHaveBeenCalled();
+  } finally {
+    vi.unstubAllGlobals();
+  }
+});
+
+it('retains signed bytes but does not broadcast if a trade expires during persistence', async () => {
+  const { xprv, leaf, context } = fixture('LTC');
+  const now = Date.now();
+  const clock = vi.spyOn(Date, 'now').mockReturnValue(now);
+  let saved: PendingSend;
+  const post = vi.fn(async () => context);
+  try {
+    await expect(
+      sendForeignCoin(
+        {
+          coin: 'LTC',
+          xprv,
+          amount: '1',
+          recipient: leaf.address,
+          broadcastBefore: now + 1000,
+        },
+        {
+          post,
+          approve: async () => true,
+          stillValid: async () => true,
+          readPending: async () => null,
+          writePending: async (entry) => {
+            saved = entry;
+            clock.mockReturnValue(now + 1001);
+          },
+        }
+      )
+    ).rejects.toMatchObject({ code: 'changed' });
+    expect(saved.rawTransactionHex).toBeTruthy();
+    expect(post.mock.calls).toHaveLength(2);
+  } finally {
+    clock.mockRestore();
+  }
+});
+
+it('does not sign or broadcast when the normal Hub permission is declined', async () => {
+  const { xprv, leaf, context } = fixture('LTC');
+  const sign = vi.fn();
+  const writePending = vi.fn();
+  const post = vi.fn(async () => context);
+  await expect(
+    sendForeignCoin(
+      { coin: 'LTC', xprv, amount: '1', recipient: leaf.address },
+      {
+        post,
+        sign,
+        writePending,
+        readPending: async () => null,
+        stillValid: async () => true,
+        approve: async () => false,
+      }
+    )
+  ).rejects.toMatchObject({ code: 'declined' });
+  expect(sign).not.toHaveBeenCalled();
+  expect(writePending).not.toHaveBeenCalled();
+  expect(post).toHaveBeenCalledTimes(1);
+});
diff --git a/src/lib/foreign-wallet/send.ts b/src/lib/foreign-wallet/send.ts
new file mode 100644
index 000000000..e087ed2dd
--- /dev/null
+++ b/src/lib/foreign-wallet/send.ts
@@ -0,0 +1,386 @@
+import { hex } from '@scure/base';
+import { Transaction } from '@scure/btc-signer';
+import {
+  buildForeignWalletSignedTransaction,
+  prepareForeignWalletPsbt,
+  inspectSignedTransaction,
+  type ForeignWalletSignedTransaction,
+  createForeignWalletPreviousTransactionCache,
+} from './foreign-wallet-transaction';
+import {
+  planForeignWalletSpend,
+  type ForeignWalletSpendPlan,
+} from './foreign-wallet-spend-plan';
+import {
+  normalizeForeignWalletSpendContext,
+  getForeignWalletMainnetChainId,
+} from './foreign-wallet-spend-context';
+import {
+  assertForeignWalletContextWithinPolicy,
+  assertForeignWalletPlanWithinPolicy,
+} from './foreign-wallet-policy-bounds';
+import {
+  foreignCrypto,
+  walletPublicKey,
+  walletFingerprint,
+  type ForeignWalletCoin,
+} from './foreign-wallets';
+
+export class ForeignSendError extends Error {
+  constructor(
+    public code:
+      | 'invalid'
+      | 'upgrade'
+      | 'changed'
+      | 'pending'
+      | 'confirming'
+      | 'unknown'
+      | 'declined',
+    public txId?: string
+  ) {
+    super(code);
+  }
+}
+export type PendingSend = {
+  txId: string;
+  outpoints: string[];
+  rawTransactionHex?: string;
+  broadcastBefore?: number;
+};
+export type SendDependencies = {
+  post: (endpoint: string, body: unknown) => Promise<unknown>;
+  sign?: (
+    plan: ForeignWalletSpendPlan,
+    psbt: Uint8Array
+  ) => Promise<ForeignWalletSignedTransaction>;
+  approveRecovery?: (pending: PendingSend) => Promise<boolean>;
+  approve: (plan: ForeignWalletSpendPlan) => Promise<boolean>;
+  stillValid: () => Promise<boolean>;
+  readPending: () => Promise<PendingSend | null>;
+  writePending: (entry: PendingSend | null) => Promise<void>;
+};
+type ReconciliationDependencies = Pick<
+  SendDependencies,
+  'post' | 'stillValid' | 'readPending' | 'writePending'
+>;
+export type ForeignTransactionState =
+  | 'none'
+  | 'unknown'
+  | 'mempool'
+  | 'confirmed'
+  | 'busy';
+const busy = new Set<string>();
+
+async function withWalletLock<T>(
+  lock: string,
+  unavailable: () => T | Promise<T>,
+  action: () => Promise<T>
+): Promise<T> {
+  const run = async () => {
+    if (busy.has(lock)) return unavailable();
+    busy.add(lock);
+    try {
+      return await action();
+    } finally {
+      busy.delete(lock);
+    }
+  };
+  if (typeof navigator !== 'undefined' && navigator.locks)
+    return navigator.locks.request(lock, { ifAvailable: true }, (held) =>
+      held ? run() : unavailable()
+    );
+  return run();
+}
+
+function normalizeTransactionStatus(
+  value: unknown,
+  coin: ForeignWalletCoin,
+  expectedChainId: string,
+  txId: string
+): 'UNKNOWN' | 'MEMPOOL' | 'CONFIRMED' {
+  const response = value as Record<string, unknown>;
+  if (
+    !response ||
+    response.version !== 1 ||
+    response.currencyCode !== coin ||
+    response.activeNetwork !== 'MAIN' ||
+    response.chainId !== expectedChainId ||
+    response.txId !== txId ||
+    !['UNKNOWN', 'MEMPOOL', 'CONFIRMED'].includes(response.status as string)
+  )
+    throw new ForeignSendError('invalid');
+  return response.status as 'UNKNOWN' | 'MEMPOOL' | 'CONFIRMED';
+}
+
+async function transactionStatus(
+  coin: ForeignWalletCoin,
+  expectedChainId: string,
+  txId: string,
+  post: SendDependencies['post']
+) {
+  return normalizeTransactionStatus(
+    await post(
+      `/crosschain/${coin.toLowerCase()}/wallet/public/transaction-status`,
+      {
+        expectedChainId,
+        txId,
+      }
+    ),
+    coin,
+    expectedChainId,
+    txId
+  );
+}
+
+export async function reconcilePendingForeignCoin(
+  coin: ForeignWalletCoin,
+  xpub: string,
+  deps: ReconciliationDependencies
+): Promise<ForeignTransactionState> {
+  walletFingerprint(xpub, coin);
+  const expectedChainId = getForeignWalletMainnetChainId(coin);
+  return withWalletLock(
+    `${coin}:${xpub}`,
+    () => 'busy',
+    async () => {
+      const pending = await deps.readPending();
+      if (!pending) return 'none';
+      const status = await transactionStatus(
+        coin,
+        expectedChainId,
+        pending.txId,
+        deps.post
+      );
+      if (status === 'CONFIRMED') {
+        if (!(await deps.stillValid())) return 'unknown';
+        await deps.writePending(null);
+        return 'confirmed';
+      }
+      return status === 'MEMPOOL' ? 'mempool' : 'unknown';
+    }
+  );
+}
+export function atomicAmount(raw: unknown): bigint {
+  // Existing q-apps pass numbers; accept their decimal spelling without multiplying floats.
+  const text =
+    typeof raw === 'number' && Number.isFinite(raw)
+      ? Number(raw.toFixed(8)) === raw
+        ? raw.toFixed(8)
+        : ''
+      : raw;
+  if (
+    typeof text !== 'string' ||
+    !/^(0|[1-9][0-9]*)?(\.[0-9]{1,8})?$/.test(text) ||
+    !text ||
+    text === '.'
+  )
+    throw new ForeignSendError('invalid');
+  const [whole, decimals = ''] = text.split('.');
+  const value =
+    BigInt(whole || '0') * 100000000n + BigInt(decimals.padEnd(8, '0'));
+  if (value <= 0n || value > 0x7fffffffffffffffn)
+    throw new ForeignSendError('invalid');
+  return value;
+}
+export function decimalAmount(value: bigint): string {
+  return `${value / 100000000n}.${(value % 100000000n).toString().padStart(8, '0')}`;
+}
+const snapshot = (value: unknown) =>
+  JSON.stringify(value, (_, v) => (typeof v === 'bigint' ? v.toString() : v));
+
+export async function sendForeignCoin(
+  request: {
+    coin: ForeignWalletCoin;
+    xprv?: string;
+    xpub?: string;
+    broadcastBefore?: number;
+    amount?: unknown;
+    recipient: string;
+    fee?: unknown;
+    sendMax?: boolean;
+    payments?: { address: string; value: bigint }[];
+  },
+  deps: SendDependencies
+): Promise<string> {
+  request = structuredClone(request);
+  const { coin, xprv } = request;
+  const xpub = request.xpub ?? walletPublicKey(xprv, coin);
+  // Reject private extended keys even if a caller accidentally labels one xpub.
+  walletFingerprint(xpub, coin);
+  const expectedChainId = getForeignWalletMainnetChainId(coin);
+  const lock = `${coin}:${xpub}`;
+  // Reject overlapping sends across tabs as well as within this process.
+  return withWalletLock(
+    lock,
+    () => {
+      throw new ForeignSendError('pending');
+    },
+    execute
+  );
+
+  async function execute() {
+    let pending = await deps.readPending();
+    if (pending) {
+      const status = await transactionStatus(
+        coin,
+        expectedChainId,
+        pending.txId,
+        deps.post
+      );
+      if (status === 'CONFIRMED') {
+        if (!(await deps.stillValid())) throw new ForeignSendError('changed');
+        await deps.writePending(null);
+        pending = null;
+      } else if (status === 'MEMPOOL') {
+        throw new ForeignSendError('confirming', pending.txId);
+      } else {
+        if (
+          pending.rawTransactionHex &&
+          deps.approveRecovery &&
+          (!pending.broadcastBefore || Date.now() < pending.broadcastBefore)
+        ) {
+          const parsed = inspectSignedTransaction(pending.rawTransactionHex);
+          if (
+            parsed.txId !== pending.txId ||
+            snapshot(parsed.outpoints) !== snapshot(pending.outpoints)
+          )
+            throw new ForeignSendError('pending', pending.txId);
+          if (await deps.approveRecovery(structuredClone(pending))) {
+            if (
+              !(await deps.stillValid()) ||
+              (pending.broadcastBefore && Date.now() >= pending.broadcastBefore)
+            )
+              throw new ForeignSendError('changed');
+            try {
+              const ack = await deps.post(
+                `/crosschain/${coin.toLowerCase()}/send/broadcast`,
+                {
+                  expectedChainId,
+                  rawTransactionHex: pending.rawTransactionHex,
+                }
+              );
+              if (ack !== pending.txId)
+                throw new Error('Unconfirmed broadcast');
+            } catch {
+              throw new ForeignSendError('unknown', pending.txId);
+            }
+          }
+        }
+        // A recovered payment must never be reported as success for a new request.
+        throw new ForeignSendError('pending', pending.txId);
+      }
+    }
+    const read = async () => {
+      const context = normalizeForeignWalletSpendContext(
+        await deps.post(
+          `/crosschain/${coin.toLowerCase()}/wallet/public/spend-context`,
+          { xpub58: xpub, expectedChainId }
+        ),
+        coin
+      );
+      assertForeignWalletContextWithinPolicy(context);
+      return context;
+    };
+    const context = await read();
+
+    if (request.sendMax && request.amount !== undefined)
+      throw new ForeignSendError('invalid');
+    const fee =
+      request.fee === undefined
+        ? context.recommendedFeePerByte
+        : atomicAmount(request.fee);
+    const cache = createForeignWalletPreviousTransactionCache();
+    const planFor = (state: typeof context) =>
+      planForeignWalletSpend({
+        coin,
+        xpub,
+        crypto: foreignCrypto,
+        cache,
+        utxos: state.utxos,
+        feePerByte: fee,
+        minimumNonDustOutput: state.minimumNonDustOutput,
+        amount: request.sendMax ? undefined : atomicAmount(request.amount),
+        sendMax: request.sendMax,
+        recipientAddress: request.recipient,
+        payments: request.payments,
+      });
+    const plan = planFor(context);
+    assertForeignWalletPlanWithinPolicy({ ...plan, coin });
+    const started = Date.now();
+    if (!(await deps.approve(structuredClone(plan))))
+      throw new ForeignSendError('declined');
+    if (!(await deps.stillValid())) throw new ForeignSendError('changed');
+    const after = await read();
+    if (
+      (request.fee === undefined &&
+        context.recommendedFeePerByte !== after.recommendedFeePerByte) ||
+      context.minimumNonDustOutput !== after.minimumNonDustOutput ||
+      snapshot(planFor(after)) !== snapshot(plan)
+    )
+      throw new ForeignSendError('changed');
+    if (!(await deps.stillValid()) || Date.now() - started > 5 * 60 * 1000)
+      throw new ForeignSendError('changed');
+    const transaction = {
+      coin,
+      xpub,
+      inputs: plan.inputs,
+      outputs: plan.outputs,
+      transactionVersion: context.transactionVersion,
+    };
+    const psbt = prepareForeignWalletPsbt(transaction);
+    const signed = deps.sign
+      ? await deps.sign(structuredClone(plan), psbt)
+      : buildForeignWalletSignedTransaction({ ...transaction, xprv });
+    if (
+      !(await deps.stillValid()) ||
+      Date.now() - started > 300000 ||
+      (request.broadcastBefore && Date.now() >= request.broadcastBefore)
+    )
+      throw new ForeignSendError('changed');
+    const decoded = Transaction.fromRaw(hex.decode(signed.rawTransactionHex));
+    if (
+      hex.encode(decoded.unsignedTx) !==
+        hex.encode(Transaction.fromPSBT(psbt).unsignedTx) ||
+      decoded.id !== signed.txId
+    )
+      throw new ForeignSendError('invalid');
+    if (
+      signed.fee !== plan.fee ||
+      signed.transactionSize !== signed.rawTransactionHex.length / 2 ||
+      signed.transactionSize > plan.estimatedMaximumSize
+    )
+      throw new ForeignSendError('invalid');
+    // Write before network I/O. Keep even an ambiguous storage failure conservative.
+    await deps.writePending({
+      txId: signed.txId,
+      rawTransactionHex: signed.rawTransactionHex,
+      ...(request.broadcastBefore
+        ? { broadcastBefore: request.broadcastBefore }
+        : {}),
+      outpoints: plan.inputs.map((i) => `${i.txHash}:${i.txPos}`),
+    });
+    // Persistence can take time: recheck immediately before releasing signed bytes.
+    if (
+      !(await deps.stillValid()) ||
+      Date.now() - started > 300000 ||
+      (request.broadcastBefore && Date.now() >= request.broadcastBefore)
+    )
+      throw new ForeignSendError('changed', signed.txId);
+    try {
+      const result = await deps.post(
+        `/crosschain/${coin.toLowerCase()}/send/broadcast`,
+        { expectedChainId, rawTransactionHex: signed.rawTransactionHex }
+      );
+      if (
+        typeof result !== 'string' ||
+        result.trim().toLowerCase() !== signed.txId
+      )
+        throw new ForeignSendError('unknown', signed.txId);
+    } catch {
+      throw new ForeignSendError('unknown', signed.txId);
+    }
+    // Keep the reservation until wallet history observes this transaction. An
+    // acknowledgement can precede propagation to the wallet's read server.
+    return signed.txId;
+  }
+}
diff --git a/src/lib/foreign-wallet/trade-plan.test.ts b/src/lib/foreign-wallet/trade-plan.test.ts
new file mode 100644
index 000000000..752cc0515
--- /dev/null
+++ b/src/lib/foreign-wallet/trade-plan.test.ts
@@ -0,0 +1,95 @@
+import { describe, it, expect, vi } from 'vitest';
+import { base58check } from '@scure/base';
+import { sha256 } from '@noble/hashes/sha256';
+import { ripemd160 } from '@noble/hashes/ripemd160';
+import { hexToBytes, bytesToHex } from '@noble/hashes/utils';
+import { foreignCoins } from './foreign-wallets';
+import { validateLocalTradePlan } from './trade-plan';
+import Base58 from '../../encryption/Base58';
+
+describe('trade funding validation', () => {
+  for (const coin of foreignCoins)
+    it(`${coin}: verifies the HTLC, amount, seller and refund deadline`, () => {
+      const offer = {
+        qortalAtAddress: 'AT',
+        receivingAddress: 'QORT',
+        expectedForeignAmount: '1',
+        tradeTimeout: 60,
+        creatorForeignPKH: Base58.encode(new Uint8Array(20).fill(3)),
+      };
+      const lockTime = Math.floor(Date.now() / 1000) + 3600;
+      const time = new Uint8Array(4);
+      new DataView(time.buffer).setUint32(0, lockTime, true);
+      const redeemScript = `7dada97614${'01'.repeat(20)}87637504${bytesToHex(time)}b16714${'03'.repeat(20)}88a914${'02'.repeat(20)}8768`;
+      const prefix = { BTC: 5, LTC: 50, DOGE: 22, DGB: 63, RVN: 122 }[coin];
+      const address = base58check(sha256).encode(
+        Uint8Array.from([
+          prefix,
+          ...ripemd160(sha256(hexToBytes(redeemScript))),
+        ])
+      );
+      const plan = {
+        atAddress: 'AT',
+        receivingAddress: 'QORT',
+        amount: '100001000',
+        fundingReserve: '1000',
+        refundPublicKeyHash: '01'.repeat(20),
+        hashOfSecret: '02'.repeat(20),
+        redeemScript,
+        lockTime,
+        address,
+      };
+      expect(validateLocalTradePlan([plan], [offer], coin, 'QORT')).toEqual([
+        { address, value: 100001000n },
+      ]);
+      for (const changed of [
+        { ...plan, amount: '100002000' },
+        { ...plan, lockTime: 0 },
+        { ...plan, atAddress: 'OTHER' },
+        { ...plan, redeemScript: redeemScript.replace('03', '04') },
+        { ...plan, receivingAddress: 'OTHER' },
+      ]) {
+        expect(() =>
+          validateLocalTradePlan([changed], [offer], coin, 'QORT')
+        ).toThrow();
+      }
+      expect(() =>
+        validateLocalTradePlan(
+          [plan],
+          [{ ...offer, creatorForeignPKH: 'not-valid-base58-0' }],
+          coin,
+          'QORT'
+        )
+      ).toThrow();
+    });
+
+  it('accepts the Base58 seller key hash returned by the live Core API', () => {
+    const now = vi.spyOn(Date, 'now').mockReturnValue(1788958554000);
+    const offer = {
+      qortalAtAddress: 'AQyL6gfcJ6vbmN7thDii3h3di5Mq7u1uZ4',
+      expectedForeignAmount: '0.04350000',
+      tradeTimeout: 120,
+      creatorForeignPKH: '3TuTyu7byeYxS4Ly4pJGepauRZet',
+    };
+    const plan = {
+      atAddress: offer.qortalAtAddress,
+      receivingAddress: 'QORT',
+      address: '31kxF481xPMfR5H6bdMib5XUu8mYC9e6JH',
+      amount: '4352730',
+      fundingReserve: '2730',
+      lockTime: 1788965754,
+      refundPublicKeyHash: 'c04caa54b7a5251dcb0597da62e586101048d6b9',
+      hashOfSecret: 'a1d75bb7ed909f700bb25be919e4b6cba31f07e1',
+      redeemScript:
+        '7dada97614c04caa54b7a5251dcb0597da62e586101048d6b9876375047a73a16ab16714b0da988370168d62ea7968d7f0a38ff8a10098f588a914a1d75bb7ed909f700bb25be919e4b6cba31f07e18768',
+    };
+
+    try {
+      expect(validateLocalTradePlan([plan], [offer], 'LTC', 'QORT')).toEqual([
+        { address: plan.address, value: 4352730n },
+      ]);
+    } finally {
+      now.mockRestore();
+    }
+  });
+});
diff --git a/src/lib/foreign-wallet/trade-plan.ts b/src/lib/foreign-wallet/trade-plan.ts
new file mode 100644
index 000000000..7a9a7db07
--- /dev/null
+++ b/src/lib/foreign-wallet/trade-plan.ts
@@ -0,0 +1,66 @@
+import { atomicAmount } from './send';
+import { type ForeignWalletCoin, foreignCrypto } from './foreign-wallets';
+import { validateForeignWalletRecipient } from './foreign-wallet-transaction';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+import { ripemd160 } from '@noble/hashes/ripemd160';
+import { sha256 } from '@noble/hashes/sha256';
+import Base58 from '../../encryption/Base58';
+// Pure validation before any signing: bind outputs to the selected ATs and HTLC terms.
+export function validateLocalTradePlan(
+  plans: any,
+  offers: any[],
+  coin: ForeignWalletCoin,
+  receivingAddress: string
+) {
+  if (
+    !Array.isArray(plans) ||
+    plans.length !== offers.length ||
+    plans.length === 0 ||
+    plans.length > 20
+  )
+    throw new Error('Invalid trade plan');
+  return plans.map((plan, index) => {
+    const offer = offers[index];
+    if (
+      plan.atAddress !== offer.qortalAtAddress ||
+      plan.receivingAddress !== receivingAddress ||
+      !Number.isSafeInteger(plan.lockTime) ||
+      plan.lockTime < Date.now() / 1000 + 300 ||
+      plan.lockTime >
+        Date.now() / 1000 + Number(offer.tradeTimeout) * 60 + 60 ||
+      !/^[a-f0-9]{40}$/.test(plan.refundPublicKeyHash) ||
+      !/^[a-f0-9]{40}$/.test(plan.hashOfSecret)
+    )
+      throw new Error('Invalid trade terms');
+    // Qortal's API adapter serializes byte[] values as Base58 strings.
+    const seller =
+      typeof offer.creatorForeignPKH === 'string'
+        ? bytesToHex(Base58.decode(offer.creatorForeignPKH))
+        : bytesToHex(Uint8Array.from(offer.creatorForeignPKH || []));
+    if (!/^[a-f0-9]{40}$/.test(seller)) throw new Error('Invalid seller');
+    const lock = new Uint8Array(4);
+    new DataView(lock.buffer).setUint32(0, plan.lockTime, true);
+    const script = `7dada97614${plan.refundPublicKeyHash}87637504${bytesToHex(lock)}b16714${seller}88a914${plan.hashOfSecret}8768`;
+    if (script !== plan.redeemScript) throw new Error('Invalid HTLC');
+    const recipient = validateForeignWalletRecipient({
+      address: plan.address,
+      coin,
+      crypto: foreignCrypto,
+    });
+    const expectedScript = `a914${bytesToHex(ripemd160(sha256(hexToBytes(script))))}87`;
+    if (bytesToHex(recipient.scriptPubKey) !== expectedScript)
+      throw new Error('Invalid funding address');
+    if (
+      !/^[0-9]{1,18}$/.test(plan.amount) ||
+      !/^[0-9]{1,18}$/.test(plan.fundingReserve)
+    )
+      throw new Error('Invalid funding amount');
+    const reserve = BigInt(plan.fundingReserve);
+    const amount = BigInt(plan.amount);
+    const value = atomicAmount(offer.expectedForeignAmount);
+    // Reserve is explicitly shown as part of the total paid; bound it relative to the purchase.
+    if (reserve <= 0n || reserve > value || amount !== value + reserve)
+      throw new Error('Invalid funding reserve');
+    return { address: recipient.address, value: amount };
+  });
+}
diff --git a/src/messaging/MessagesToBackground.tsx b/src/messaging/MessagesToBackground.tsx
index 6780027a7..adb112b01 100644
--- a/src/messaging/MessagesToBackground.tsx
+++ b/src/messaging/MessagesToBackground.tsx
@@ -18,7 +18,7 @@ window.addEventListener('message', (event) => {
     return;
   }
 
-  const { type, requestId, payload, error, message } = event.data;
+  const { type, requestId } = event.data;
 
   // Only process messages of type `backgroundMessageResponse`
   if (type !== 'backgroundMessageResponse') return;
@@ -84,6 +84,9 @@ export const sendMessageBackground = async (
   } else if (response_2?.error || response_2?.message) {
     return {
       error: response_2.error,
+      ...(typeof response_2?.code === 'string'
+        ? { code: response_2.code }
+        : {}),
       message: response_2?.message || response_2?.error || 'An error occurred',
     };
   }
diff --git a/src/qortal/__tests__/backendPermission.test.ts b/src/qortal/__tests__/backendPermission.test.ts
new file mode 100644
index 000000000..b68e85eb4
--- /dev/null
+++ b/src/qortal/__tests__/backendPermission.test.ts
@@ -0,0 +1,207 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+// ── Module mocks (hoisted before any import) ────────────────────────────────
+// Factories live in ./common.ts; async dynamic import is used because vi.mock()
+// is hoisted before regular imports.
+
+vi.mock('../qortal-requests', async () =>
+  (await import('./common')).qortalRequestsFactory()
+);
+vi.mock('../../background/background', async () =>
+  (await import('./common')).backgroundFactory()
+);
+vi.mock('../../encryption/encryption', async () =>
+  (await import('./common')).encryptionFactory()
+);
+vi.mock('../../components/Chat/AdminSpaceInner', async () =>
+  (await import('./common')).adminSpaceFactory()
+);
+vi.mock('../../components/Chat/MessageDisplay', async () =>
+  (await import('./common')).messageDisplayFactory()
+);
+vi.mock('../../components/Group/Group', async () =>
+  (await import('./common')).groupFactory()
+);
+vi.mock('../../qdn/encryption/group-encryption', async () =>
+  (await import('./common')).groupEncryptionFactory()
+);
+vi.mock('../../qdn/publish/publish', async () =>
+  (await import('./common')).publishFactory()
+);
+vi.mock('../../transactions/TradeBotCreateRequest', async () =>
+  (await import('./common')).tradeBotCreateFactory()
+);
+vi.mock('../../transactions/TradeBotDeleteRequest', async () =>
+  (await import('./common')).tradeBotDeleteFactory()
+);
+vi.mock('../../transactions/signTradeBotTransaction', async () =>
+  (await import('./common')).signTradeBotFactory()
+);
+vi.mock('../../transactions/transactions', async () =>
+  (await import('./common')).transactionsFactory()
+);
+vi.mock('../../utils/events', async () =>
+  (await import('./common')).eventsFactory()
+);
+vi.mock('../../utils/fileReading/index', async () =>
+  (await import('./common')).fileReadingFactory()
+);
+vi.mock('../../utils/memeTypes', async () =>
+  (await import('./common')).mimeTypesFactory()
+);
+vi.mock('../../utils/queue/queue', async () =>
+  (await import('./common')).queueFactory()
+);
+vi.mock('../../utils/utils', async () =>
+  (await import('./common')).utilsFactory()
+);
+vi.mock('short-unique-id', async () =>
+  (await import('./common')).shortUidFactory()
+);
+vi.mock('../../utils/decode', async () =>
+  (await import('./common')).decodeFactory()
+);
+vi.mock('i18next', async () => (await import('./common')).i18nFactory());
+vi.mock('aes-js', async () => (await import('./common')).aesFactory());
+vi.mock('../../encryption/Base58', async () =>
+  (await import('./common')).base58Factory()
+);
+vi.mock('../../encryption/ed2curve', async () =>
+  (await import('./common')).ed2curveFactory()
+);
+vi.mock('../../encryption/nacl-fast', async () =>
+  (await import('./common')).naclFactory()
+);
+vi.mock('asmcrypto.js', async () =>
+  (await import('./common')).asmcryptoFactory()
+);
+vi.mock('../../hooks/useQortalMessageListener', async () =>
+  (await import('./common')).messageListenerFactory()
+);
+
+import {
+  authorizeRnsDestination,
+  clearRnsDestinationPermissionsByTabId,
+  sessionPermissions,
+} from '../get';
+import {
+  hasSessionPermission,
+  setSessionPermissions,
+  VALID_SESSION_PERMISSIONS,
+} from '../qortal-requests';
+import english from '../../i18n/locales/en/question.json';
+import i18n from 'i18next';
+
+const app = { tabId: 42, name: 'ExampleApp' };
+const destination = 'a'.repeat(32);
+let prompts: Array<{
+  text1: string;
+  text2?: string;
+  details?: { permissions: string[] };
+}>;
+let accepted = true;
+
+describe('backend approval through qortalRequest permission dialogs', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    prompts = [];
+    accepted = true;
+    const granted = new Set<string>();
+    vi.mocked(setSessionPermissions).mockImplementation(
+      (tab, name, permissions) => {
+        for (const permission of permissions)
+          granted.add(`${tab}:${name}:${permission}`);
+      }
+    );
+    vi.mocked(hasSessionPermission).mockImplementation(
+      (tab, name, permission) => granted.has(`${tab}:${name}:${permission}`)
+    );
+    VALID_SESSION_PERMISSIONS.splice(
+      0,
+      VALID_SESSION_PERMISSIONS.length,
+      'PRIVATE_DATA_CHANNEL',
+      'SEND_COIN'
+    );
+    vi.mocked(i18n.t).mockImplementation(
+      (key: string, options?: { appName?: string }) =>
+        key.startsWith('question:permission.')
+          ? (english.permission[
+              key.slice('question:permission.'.length)
+            ]?.replace('{{appName}}', options?.appName ?? '') ?? key)
+          : key
+    );
+    Object.assign(window, { electronAPI: { qappReticulumConnect: vi.fn() } });
+    vi.spyOn(window, 'postMessage').mockImplementation((message) => {
+      if (message.action !== 'QORTAL_REQUEST_PERMISSION') return;
+      prompts.push(message.payload);
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          origin: window.location.origin,
+          source: window,
+          data: {
+            action: 'QORTAL_REQUEST_PERMISSION_RESPONSE',
+            requestId: message.requestId,
+            result: { accepted },
+          },
+        })
+      );
+    });
+  });
+
+  afterEach(() => {
+    clearRnsDestinationPermissionsByTabId(app.tabId);
+    vi.restoreAllMocks();
+    vi.clearAllTimers();
+    vi.useRealTimers();
+    vi.clearAllMocks();
+  });
+
+  it('shows one plain backend prompt, then skips the private transport dialog', async () => {
+    await expect(
+      authorizeRnsDestination(destination.toUpperCase(), false, app)
+    ).resolves.toBe(destination);
+    await expect(
+      sessionPermissions({ permissions: ['PRIVATE_DATA_CHANNEL'] }, false, app)
+    ).resolves.toBe(true);
+    expect(prompts).toHaveLength(1);
+    expect(prompts[0].text1).toBe(
+      'Allow ExampleApp to connect to its backend?'
+    );
+    expect(JSON.stringify(prompts[0])).not.toMatch(
+      /Reticulum|destination|PRIVATE_DATA_CHANNEL/
+    );
+    expect(JSON.stringify(prompts[0])).not.toContain(destination);
+  });
+
+  it('still prompts for other requested capabilities after approving the backend', async () => {
+    await authorizeRnsDestination(destination, false, app);
+    await sessionPermissions(
+      { permissions: ['PRIVATE_DATA_CHANNEL', 'SEND_COIN'] },
+      false,
+      app
+    );
+    expect(prompts).toHaveLength(2);
+    expect(prompts[1].details?.permissions).toEqual(['SEND_COIN']);
+  });
+
+  it('declining the backend does not grant private transport', async () => {
+    accepted = false;
+    await expect(
+      authorizeRnsDestination(destination, false, app)
+    ).rejects.toThrow('RNS_PERMISSION_DENIED');
+    expect(setSessionPermissions).not.toHaveBeenCalled();
+    expect(
+      hasSessionPermission(app.tabId, app.name, 'PRIVATE_DATA_CHANNEL')
+    ).toBe(false);
+  });
+
+  it('validates destination and permission names before approval', async () => {
+    await expect(
+      authorizeRnsDestination('invalid', false, app)
+    ).rejects.toThrow('RNS_DESTINATION_UNREACHABLE');
+    await expect(
+      sessionPermissions({ permissions: ['INVALID'] }, false, app)
+    ).rejects.toThrow();
+    expect(prompts).toHaveLength(0);
+  });
+});
diff --git a/src/qortal/__tests__/createBuyOrder.test.ts b/src/qortal/__tests__/createBuyOrder.test.ts
index 57c4b519d..3c64b1078 100644
--- a/src/qortal/__tests__/createBuyOrder.test.ts
+++ b/src/qortal/__tests__/createBuyOrder.test.ts
@@ -79,11 +79,25 @@ vi.mock('../../hooks/useQortalMessageListener', async () =>
   (await import('./common')).messageListenerFactory()
 );
 
+vi.mock('../local-trade-funding', () => ({
+  localTradeCoins: { LITECOIN: 'LTC' },
+  fundLocalTrades: vi.fn(),
+}));
+vi.mock('../foreign-coin-send', () => ({
+  sendLocalForeignCoin: vi.fn(),
+}));
+import { fundLocalTrades } from '../local-trade-funding';
+import { sendLocalForeignCoin } from '../foreign-coin-send';
+
 // ── Imports (after mocks) ────────────────────────────────────────────────────
 
-import { createBuyOrder } from '../get';
+import { createBuyOrder, createSellOrder, sendCoin } from '../get';
 import { isRunningGateway } from '../qortal-requests';
-import { createEndpoint, createBuyOrderTx } from '../../background/background';
+import {
+  createEndpoint,
+  createBuyOrderTx,
+  getKeyPair,
+} from '../../background/background';
 import { simulatePermission } from './common';
 
 // ── Fixtures ─────────────────────────────────────────────────────────────────
@@ -103,6 +117,77 @@ const DEFAULT_AT_DATA = {
 const UNLOCK_FEE_SATS = 50_000; // 0.0005 LTC
 const LOCK_FEE_SATS = 1_000; // 0.00001 LTC
 
+describe('sendCoin on public nodes', () => {
+  afterEach(() => vi.clearAllMocks());
+
+  it('routes Bitcoin-family sends to the local signer without loading the private key', async () => {
+    vi.mocked(isRunningGateway).mockResolvedValue(true);
+    vi.mocked(sendLocalForeignCoin).mockResolvedValue({ success: true } as any);
+
+    await expect(
+      sendCoin({ coin: 'BTC', amount: '0.01', recipient: 'btc-address' }, false)
+    ).resolves.toEqual({ success: true });
+    expect(sendLocalForeignCoin).toHaveBeenCalledWith(
+      expect.objectContaining({ coin: 'BTC' }),
+      expect.any(Function)
+    );
+    expect(getKeyPair).not.toHaveBeenCalled();
+  });
+
+  it('blocks Pirate Chain before loading a key or contacting a node', async () => {
+    vi.mocked(isRunningGateway).mockResolvedValue(true);
+    const fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(
+      sendCoin(
+        { coin: 'ARRR', amount: '0.01', recipient: 'arrr-address' },
+        false
+      )
+    ).rejects.toThrow('question:message.error.gateway_pirate_local_node');
+    expect(getKeyPair).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(sendLocalForeignCoin).not.toHaveBeenCalled();
+    vi.unstubAllGlobals();
+  });
+});
+
+describe('createSellOrder on public nodes', () => {
+  afterEach(() => vi.clearAllMocks());
+
+  it('blocks Bitcoin-family sell offers before accessing wallet keys', async () => {
+    vi.mocked(isRunningGateway).mockResolvedValue(true);
+
+    await expect(
+      createSellOrder(
+        {
+          qortAmount: '10',
+          foreignBlockchain: 'BITCOIN',
+          foreignAmount: '0.1',
+        },
+        false
+      )
+    ).rejects.toThrow('question:message.generic.no_action_public_node');
+    expect(getKeyPair).not.toHaveBeenCalled();
+  });
+
+  it('blocks Pirate Chain offers before accessing wallet keys', async () => {
+    vi.mocked(isRunningGateway).mockResolvedValue(true);
+
+    await expect(
+      createSellOrder(
+        {
+          qortAmount: '10',
+          foreignBlockchain: 'PIRATECHAIN',
+          foreignAmount: '0.1',
+        },
+        false
+      )
+    ).rejects.toThrow('question:message.error.gateway_pirate_local_node');
+    expect(getKeyPair).not.toHaveBeenCalled();
+  });
+});
+
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
 /**
@@ -150,7 +235,14 @@ describe('createBuyOrder', () => {
     vi.mocked(createEndpoint).mockImplementation(
       async (path: string) => `http://localhost${path}`
     );
-    vi.mocked(createBuyOrderTx).mockResolvedValue({ success: true });
+    vi.mocked(fundLocalTrades).mockImplementation(
+      async (_offers, _coin, approve) => {
+        const permission = await approve({});
+        if (!permission?.accepted)
+          throw new Error('question:message.generic.user_declined_request');
+        return { success: true } as any;
+      }
+    );
   });
 
   afterEach(() => {
@@ -169,7 +261,10 @@ describe('createBuyOrder', () => {
 
     it('throws when foreignBlockchain is missing', async () => {
       await expect(
-        createBuyOrder({ crosschainAtInfo: [{ qortalAtAddress: AT_ADDRESS }] }, false)
+        createBuyOrder(
+          { crosschainAtInfo: [{ qortalAtAddress: AT_ADDRESS }] },
+          false
+        )
       ).rejects.toThrow('question:message.error.missing_fields');
     });
 
@@ -186,7 +281,9 @@ describe('createBuyOrder', () => {
     it('throws when the fetched AT has a different foreignBlockchain', async () => {
       vi.stubGlobal(
         'fetch',
-        makeFetch({ atData: { ...DEFAULT_AT_DATA, foreignBlockchain: 'BITCOIN' } })
+        makeFetch({
+          atData: { ...DEFAULT_AT_DATA, foreignBlockchain: 'BITCOIN' },
+        })
       );
 
       await expect(createBuyOrder(makeInput(), false)).rejects.toThrow(
@@ -202,17 +299,25 @@ describe('createBuyOrder', () => {
         vi.fn(async (url: string) => {
           if (url.includes('/crosschain/trade/')) {
             callCount++;
-            const blockchain =
-              callCount === 2 ? 'BITCOIN' : FOREIGN_BLOCKCHAIN;
+            const blockchain = callCount === 2 ? 'BITCOIN' : FOREIGN_BLOCKCHAIN;
             return {
               ok: true,
-              json: async () => ({ ...DEFAULT_AT_DATA, foreignBlockchain: blockchain }),
+              json: async () => ({
+                ...DEFAULT_AT_DATA,
+                foreignBlockchain: blockchain,
+              }),
             };
           }
           if (url.includes('/feerequired'))
-            return { ok: true, clone: () => ({ json: async () => UNLOCK_FEE_SATS }) };
+            return {
+              ok: true,
+              clone: () => ({ json: async () => UNLOCK_FEE_SATS }),
+            };
           if (url.includes('/feekb'))
-            return { ok: true, clone: () => ({ json: async () => LOCK_FEE_SATS }) };
+            return {
+              ok: true,
+              clone: () => ({ json: async () => LOCK_FEE_SATS }),
+            };
           throw new Error(`Unexpected URL: ${url}`);
         })
       );
@@ -234,22 +339,15 @@ describe('createBuyOrder', () => {
 
   // ── Fee-fetching errors ─────────────────────────────────────────────────────
 
-  describe('fee-fetching errors', () => {
-    it('propagates the error message when the fee endpoint returns non-ok', async () => {
-      vi.stubGlobal(
-        'fetch',
-        vi.fn(async (url: string) => {
-          if (url.includes('/crosschain/trade/'))
-            return { ok: true, json: async () => DEFAULT_AT_DATA };
-          // Both fee endpoints fail
-          return { ok: false };
-        })
-      );
-
-      await expect(createBuyOrder(makeInput(), false)).rejects.toThrow(
-        'question:message.error.fetch_generic'
-      );
-    });
+  it('propagates a local funding preparation failure without using the legacy sender', async () => {
+    vi.stubGlobal('fetch', makeFetch());
+    vi.mocked(fundLocalTrades).mockRejectedValueOnce(
+      new Error('local signing unavailable')
+    );
+    await expect(createBuyOrder(makeInput(), false)).rejects.toThrow(
+      'local signing unavailable'
+    );
+    expect(createBuyOrderTx).not.toHaveBeenCalled();
   });
 
   // ── Permission guard ────────────────────────────────────────────────────────
@@ -268,7 +366,7 @@ describe('createBuyOrder', () => {
   // ── Successful flow ─────────────────────────────────────────────────────────
 
   describe('successful buy order', () => {
-    it('returns the result from createBuyOrderTx', async () => {
+    it('returns the local funding result', async () => {
       vi.stubGlobal('fetch', makeFetch());
       simulatePermission(true);
 
@@ -277,32 +375,47 @@ describe('createBuyOrder', () => {
       expect(result).toEqual({ success: true });
     });
 
-    it('passes the resolved crosschainAtInfo and foreignBlockchain to createBuyOrderTx', async () => {
+    it('routes validated offers to local signing', async () => {
       vi.stubGlobal('fetch', makeFetch());
       simulatePermission(true);
 
       await createBuyOrder(makeInput(), false);
 
-      expect(createBuyOrderTx).toHaveBeenCalledOnce();
-      expect(createBuyOrderTx).toHaveBeenCalledWith(
-        expect.objectContaining({
-          crosschainAtInfo: [DEFAULT_AT_DATA],
-          foreignBlockchain: FOREIGN_BLOCKCHAIN,
-          isGateway: false,
-        })
+      expect(fundLocalTrades).toHaveBeenCalledWith(
+        [DEFAULT_AT_DATA],
+        'LTC',
+        expect.any(Function)
       );
+      expect(createBuyOrderTx).not.toHaveBeenCalled();
     });
 
-    it('passes isGateway=true to createBuyOrderTx when on a gateway node', async () => {
+    it('funds a Bitcoin-family trade on a public node using local signing', async () => {
       vi.mocked(isRunningGateway).mockResolvedValue(true);
       vi.stubGlobal('fetch', makeFetch());
       simulatePermission(true);
 
-      await createBuyOrder(makeInput(), false);
-
-      expect(createBuyOrderTx).toHaveBeenCalledWith(
-        expect.objectContaining({ isGateway: true })
+      await expect(createBuyOrder(makeInput(), false)).resolves.toEqual({
+        success: true,
+      });
+      expect(fundLocalTrades).toHaveBeenCalledWith(
+        [DEFAULT_AT_DATA],
+        'LTC',
+        expect.any(Function)
       );
+      expect(createBuyOrderTx).not.toHaveBeenCalled();
+    });
+
+    it('refuses Pirate Chain trades on a public node before fetching or signing', async () => {
+      vi.mocked(isRunningGateway).mockResolvedValue(true);
+      const fetchMock = makeFetch();
+      vi.stubGlobal('fetch', fetchMock);
+
+      await expect(
+        createBuyOrder(makeInput({ foreignBlockchain: 'PIRATECHAIN' }), false)
+      ).rejects.toThrow('question:message.error.gateway_pirate_local_node');
+      expect(fetchMock).not.toHaveBeenCalled();
+      expect(fundLocalTrades).not.toHaveBeenCalled();
+      expect(createBuyOrderTx).not.toHaveBeenCalled();
     });
 
     it('aggregates crosschainAtInfo for multiple AT addresses', async () => {
@@ -319,9 +432,15 @@ describe('createBuyOrder', () => {
           if (url.includes(`/crosschain/trade/${AT_ADDRESS_2}`))
             return { ok: true, json: async () => at2 };
           if (url.includes('/feerequired'))
-            return { ok: true, clone: () => ({ json: async () => UNLOCK_FEE_SATS }) };
+            return {
+              ok: true,
+              clone: () => ({ json: async () => UNLOCK_FEE_SATS }),
+            };
           if (url.includes('/feekb'))
-            return { ok: true, clone: () => ({ json: async () => LOCK_FEE_SATS }) };
+            return {
+              ok: true,
+              clone: () => ({ json: async () => LOCK_FEE_SATS }),
+            };
           throw new Error(`Unexpected URL: ${url}`);
         })
       );
@@ -338,11 +457,9 @@ describe('createBuyOrder', () => {
         false
       );
 
-      const received = vi.mocked(createBuyOrderTx).mock.calls[0][0];
-      expect(received.crosschainAtInfo).toHaveLength(2);
-      expect(received.crosschainAtInfo).toEqual(
-        expect.arrayContaining([DEFAULT_AT_DATA, at2])
-      );
+      const received = vi.mocked(fundLocalTrades).mock.calls[0][0];
+      expect(received).toHaveLength(2);
+      expect(received).toEqual(expect.arrayContaining([DEFAULT_AT_DATA, at2]));
     });
 
     it('fetches the trade endpoint once per AT address', async () => {
diff --git a/src/qortal/foreign-coin-send.test.ts b/src/qortal/foreign-coin-send.test.ts
new file mode 100644
index 000000000..1f314e375
--- /dev/null
+++ b/src/qortal/foreign-coin-send.test.ts
@@ -0,0 +1,218 @@
+import { beforeEach, afterEach, it, expect, vi } from 'vitest';
+import { HDKey } from '@scure/bip32';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+vi.mock('../background/background', () => ({
+  getKeyPair: vi.fn(),
+  getSaveWallet: vi.fn(),
+  createEndpoint: vi.fn(),
+}));
+vi.mock('../lib/foreign-wallet/send', async (original) => ({
+  ...(await original<any>()),
+  sendForeignCoin: vi.fn(),
+}));
+vi.mock('i18next', () => ({ default: { t: (key: string) => key } }));
+import {
+  getKeyPair,
+  getSaveWallet,
+  createEndpoint,
+} from '../background/background';
+import { ForeignSendError, sendForeignCoin } from '../lib/foreign-wallet/send';
+import {
+  reconcilePendingLocalForeignCoinSends,
+  sendLocalForeignCoin,
+} from './foreign-coin-send';
+
+beforeEach(() => {
+  const key = HDKey.fromMasterSeed(new Uint8Array(32).fill(5));
+  vi.mocked(getKeyPair).mockResolvedValue({
+    ltcPrivateKey: key.privateExtendedKey,
+  });
+  vi.mocked(getSaveWallet).mockResolvedValue({ address0: 'QORT' });
+  vi.mocked(createEndpoint).mockImplementation(
+    async (path) => `https://node.test${path}`
+  );
+});
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.resetAllMocks();
+  delete window.foreignWalletJournal;
+  delete window.foreignWalletSigner;
+  localStorage.clear();
+});
+it('awaits Electron journal persistence before posting signed bytes', async () => {
+  let stored: string;
+  const calls: string[] = [];
+  window.foreignWalletJournal = {
+    get: vi.fn(async () => stored),
+    set: vi.fn(async (_key, value) => {
+      calls.push('persist');
+      stored = value;
+    }),
+    delete: vi.fn(),
+  } as any;
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async () => {
+      calls.push('broadcast');
+      return new Response('a'.repeat(64));
+    })
+  );
+  vi.mocked(sendForeignCoin).mockImplementation(async (_request, deps) => {
+    const entry = { txId: 'a'.repeat(64), outpoints: ['b'.repeat(64) + ':0'] };
+    await deps.writePending(entry);
+    expect(await deps.readPending()).toEqual(entry);
+    await deps.post('/crosschain/ltc/send/broadcast', {
+      rawTransactionHex: '01000000',
+    });
+    return entry.txId;
+  });
+  await expect(
+    sendLocalForeignCoin(
+      { coin: 'LTC', recipient: 'LTC', amount: '1' },
+      async () => ({ accepted: true })
+    )
+  ).resolves.toBe('a'.repeat(64));
+  expect(calls).toEqual(['persist', 'broadcast']);
+  expect(localStorage.length).toBe(0);
+  expect(vi.mocked(fetch).mock.calls[0][1].body).toBe(
+    '{"rawTransactionHex":"01000000"}'
+  );
+});
+it('requires upgraded Core without falling back to the private-key send API', async () => {
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async () => new Response('', { status: 404 }))
+  );
+  vi.mocked(sendForeignCoin).mockImplementation(
+    async (_request, deps) =>
+      deps.post('/crosschain/ltc/wallet/public/spend-context', {
+        xpub58: 'public',
+      }) as any
+  );
+  await expect(sendLocalForeignCoin({ coin: 'LTC' }, vi.fn())).rejects.toThrow(
+    'question:local_send.upgrade'
+  );
+  expect(fetch).toHaveBeenCalledTimes(1);
+});
+it('does not post after the selected wallet changes', async () => {
+  vi.stubGlobal('fetch', vi.fn());
+  vi.mocked(sendForeignCoin).mockImplementation(async (_request, deps) => {
+    vi.mocked(getSaveWallet).mockResolvedValue({ address0: 'OTHER' });
+    return deps.post('/crosschain/ltc/send/broadcast', {
+      rawTransactionHex: '01000000',
+    }) as any;
+  });
+  await expect(sendLocalForeignCoin({ coin: 'LTC' }, vi.fn())).rejects.toThrow(
+    'question:local_send.changed'
+  );
+  expect(fetch).not.toHaveBeenCalled();
+});
+
+it('reports when an earlier payment is still awaiting confirmation', async () => {
+  vi.mocked(sendForeignCoin).mockRejectedValue(
+    new ForeignSendError('confirming', 'a'.repeat(64))
+  );
+  await expect(sendLocalForeignCoin({ coin: 'LTC' }, vi.fn())).rejects.toThrow(
+    'question:local_send.confirming'
+  );
+});
+
+it('automatically clears a confirmed journal entry without exposing wallet keys', async () => {
+  const keys = await getKeyPair();
+  const xpub = HDKey.fromExtendedKey(keys.ltcPrivateKey).publicExtendedKey;
+  const fingerprint = bytesToHex(sha256(new TextEncoder().encode(xpub)));
+  const storageKey = `foreign-send-v1:LTC:${fingerprint}`;
+  const txId = 'a'.repeat(64);
+  localStorage.setItem(
+    storageKey,
+    JSON.stringify({ txId, outpoints: [`${'b'.repeat(64)}:0`] })
+  );
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async (_url, init) => {
+      const body = JSON.parse(init.body as string);
+      return Response.json({
+        version: 1,
+        currencyCode: 'LTC',
+        activeNetwork: 'MAIN',
+        chainId: 'bip122:12a765e31ffd4059bada1e25190f6e98',
+        txId: body.txId,
+        status: 'CONFIRMED',
+      });
+    })
+  );
+
+  await reconcilePendingLocalForeignCoinSends();
+
+  expect(localStorage.getItem(storageKey)).toBeNull();
+  expect(fetch).toHaveBeenCalledOnce();
+  const requestBody = (vi.mocked(fetch).mock.calls[0][1] as RequestInit).body;
+  expect(requestBody).toBe(
+    JSON.stringify({
+      expectedChainId: 'bip122:12a765e31ffd4059bada1e25190f6e98',
+      txId,
+    })
+  );
+  expect(requestBody).not.toContain(keys.ltcPrivateKey);
+  expect(requestBody).not.toContain(xpub);
+});
+
+it('routes desktop signing through native IPC without passing a private key', async () => {
+  const root = HDKey.fromMasterSeed(new Uint8Array(32).fill(5));
+  vi.mocked(getKeyPair).mockResolvedValue({
+    ltcPublicKey: root.publicExtendedKey,
+  });
+  const signed = { txId: 'a'.repeat(64) };
+  window.foreignWalletSigner = {
+    importKeys: vi.fn(),
+    clear: vi.fn(),
+    publicKey: vi.fn(async () => root.publicExtendedKey),
+    sign: vi.fn(async () => ({ signed: signed as any })),
+  };
+  vi.mocked(sendForeignCoin).mockImplementation(async (request, deps) => {
+    expect(request.xprv).toBeUndefined();
+    expect(request.xpub).toBe(root.publicExtendedKey);
+    expect(await deps.stillValid()).toBe(true);
+    expect(
+      await deps.sign({ inputs: [], outputs: [] } as any, new Uint8Array([1]))
+    ).toEqual(signed);
+    return signed.txId;
+  });
+  expect(await sendLocalForeignCoin({ coin: 'LTC' }, vi.fn())).toBe(
+    signed.txId
+  );
+  expect(
+    JSON.stringify(vi.mocked(window.foreignWalletSigner.sign).mock.calls)
+  ).not.toContain(root.privateExtendedKey);
+});
+
+it('uses the separate recovery approval without invoking new-payment approval', async () => {
+  const approve = vi.fn();
+  const approveRecovery = vi.fn(async () => ({ accepted: true }));
+  vi.mocked(sendForeignCoin).mockImplementation(async (_request, deps) => {
+    expect(
+      await deps.approveRecovery({
+        txId: 'a'.repeat(64),
+        outpoints: ['b'.repeat(64) + ':0'],
+        rawTransactionHex: `0100000001${'11'.repeat(32)}0000000000ffffffff0100e1f505000000001976a914${'22'.repeat(20)}88ac00000000`,
+      })
+    ).toBe(true);
+    return 'recovery-test';
+  });
+  await sendLocalForeignCoin(
+    { coin: 'LTC' },
+    approve,
+    undefined,
+    undefined,
+    approveRecovery
+  );
+  expect(approve).not.toHaveBeenCalled();
+  expect(approveRecovery).toHaveBeenCalledWith(
+    expect.objectContaining({
+      text1: 'question:local_send.recovery',
+      text2: 'a'.repeat(64),
+      confirmCheckbox: true,
+    })
+  );
+});
diff --git a/src/qortal/foreign-coin-send.ts b/src/qortal/foreign-coin-send.ts
new file mode 100644
index 000000000..4ac541ac4
--- /dev/null
+++ b/src/qortal/foreign-coin-send.ts
@@ -0,0 +1,315 @@
+import { readBoundedWalletResponse } from './wallet-response';
+import { foreignWalletOutputAddress } from '../lib/foreign-wallet/foreign-wallet-transaction';
+import { hex } from '@scure/base';
+import { Transaction } from '@scure/btc-signer';
+import i18n from 'i18next';
+import {
+  createEndpoint,
+  getKeyPair,
+  getSaveWallet,
+} from '../background/background';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+import {
+  decimalAmount,
+  ForeignSendError,
+  reconcilePendingForeignCoin,
+  sendForeignCoin,
+  type PendingSend,
+} from '../lib/foreign-wallet/send';
+import {
+  foreignCoins,
+  walletPublicKey,
+  type ForeignWalletCoin,
+} from '../lib/foreign-wallet/foreign-wallets';
+
+export class LocalWalletError extends Error {
+  constructor(code: string, txId = '') {
+    super(i18n.t(`question:local_send.${code}`, { txId }));
+  }
+}
+
+function parsePendingSend(raw: string | null | undefined): PendingSend | null {
+  if (raw === null || raw === undefined) return null;
+  let value: Record<string, unknown>;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new ForeignSendError('pending');
+  }
+  if (
+    !value ||
+    !/^[a-f0-9]{64}$/.test(value.txId as string) ||
+    !Array.isArray(value.outpoints) ||
+    value.outpoints.length < 1 ||
+    value.outpoints.length > 1000 ||
+    value.outpoints.some(
+      (p: unknown) =>
+        typeof p !== 'string' || !/^[a-f0-9]{64}:[0-9]{1,10}$/.test(p)
+    ) ||
+    (value.rawTransactionHex !== undefined &&
+      (typeof value.rawTransactionHex !== 'string' ||
+        value.rawTransactionHex.length > 400000 ||
+        !/^(?:[a-f0-9]{2})+$/.test(value.rawTransactionHex))) ||
+    (value.broadcastBefore !== undefined &&
+      (!Number.isSafeInteger(value.broadcastBefore) ||
+        (value.broadcastBefore as number) <= 0))
+  )
+    throw new ForeignSendError('pending');
+  return value as PendingSend;
+}
+
+async function fetchWalletEndpoint(
+  path: string,
+  body: unknown,
+  stillValid: () => Promise<boolean>,
+  timeoutMs: number,
+  signal?: AbortSignal
+) {
+  if (!(await stillValid())) throw new ForeignSendError('changed');
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  signal?.addEventListener('abort', abort, { once: true });
+  const timeout = setTimeout(abort, timeoutMs);
+  try {
+    if (signal?.aborted) controller.abort();
+    const response = await fetch(await createEndpoint(path), {
+      method: 'POST',
+      headers: {
+        'Content-Type':
+          typeof body === 'string' ? 'text/plain' : 'application/json',
+      },
+      body: typeof body === 'string' ? body : JSON.stringify(body),
+      signal: controller.signal,
+    });
+    if (response.status === 404 || response.status === 405)
+      throw new ForeignSendError('upgrade');
+    if (!response.ok) throw new ForeignSendError('invalid');
+    const text = await readBoundedWalletResponse(response, 20 * 1024 * 1024);
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
+    }
+  } finally {
+    clearTimeout(timeout);
+    signal?.removeEventListener('abort', abort);
+  }
+}
+
+/** Reconciles saved sends without signing, broadcasting, or asking permission. */
+export async function reconcilePendingLocalForeignCoinSends(
+  signal?: AbortSignal
+) {
+  if (
+    signal?.aborted ||
+    (window.appStorage &&
+      (!window.foreignWalletJournal || !window.foreignWalletSigner))
+  )
+    return;
+  const keys = await getKeyPair();
+  const wallet = await getSaveWallet();
+  await Promise.allSettled(
+    foreignCoins.map(async (coin) => {
+      if (signal?.aborted) return;
+      const xprv = keys[`${coin.toLowerCase()}PrivateKey`];
+      const xpub = window.foreignWalletSigner
+        ? await window.foreignWalletSigner.publicKey(coin)
+        : walletPublicKey(xprv, coin);
+      if (
+        window.foreignWalletSigner &&
+        keys[`${coin.toLowerCase()}PublicKey`] !== xpub
+      )
+        return;
+      const fingerprint = bytesToHex(sha256(new TextEncoder().encode(xpub)));
+      const storageKey = `foreign-send-v1:${coin}:${fingerprint}`;
+      let pendingTxId: string;
+      const statusPath = `/crosschain/${coin.toLowerCase()}/wallet/public/transaction-status`;
+      const endpoint = await createEndpoint(statusPath);
+      const stillValid = async () => {
+        try {
+          return (
+            !signal?.aborted &&
+            (await getSaveWallet()).address0 === wallet.address0 &&
+            (window.foreignWalletSigner
+              ? (await window.foreignWalletSigner.publicKey(coin)) === xpub &&
+                (await getKeyPair())[`${coin.toLowerCase()}PublicKey`] === xpub
+              : (await getKeyPair())[`${coin.toLowerCase()}PrivateKey`] ===
+                xprv) &&
+            (await createEndpoint(statusPath)) === endpoint
+          );
+        } catch {
+          return false;
+        }
+      };
+      await reconcilePendingForeignCoin(coin, xpub, {
+        stillValid,
+        readPending: async () => {
+          const raw = window.foreignWalletJournal
+            ? await window.foreignWalletJournal.get(storageKey)
+            : localStorage.getItem(storageKey);
+          const pending = parsePendingSend(raw);
+          pendingTxId = pending?.txId;
+          return pending;
+        },
+        writePending: async (entry) => {
+          if (entry) throw new ForeignSendError('invalid');
+          if (window.foreignWalletJournal)
+            await window.foreignWalletJournal.delete(storageKey, pendingTxId);
+          else localStorage.removeItem(storageKey);
+        },
+        post: (path, body) =>
+          fetchWalletEndpoint(path, body, stillValid, 20_000, signal),
+      });
+    })
+  );
+}
+
+/** The app's private key is used only by the local signer, never by post(). */
+export async function sendLocalForeignCoin(
+  data: Record<string, any>,
+  approve: (payload: any) => Promise<any>,
+  payments?: { address: string; value: bigint }[],
+  validateIntent?: () => Promise<void>,
+  approveRecovery: (payload: any) => Promise<any> = approve
+) {
+  try {
+    if (
+      window.appStorage &&
+      (!window.foreignWalletJournal || !window.foreignWalletSigner)
+    )
+      throw new ForeignSendError('upgrade');
+    const coin = data.coin as ForeignWalletCoin;
+    const keys = await getKeyPair();
+    const wallet = await getSaveWallet();
+    const xprv = keys[`${coin.toLowerCase()}PrivateKey`];
+    const xpub = window.foreignWalletSigner
+      ? await window.foreignWalletSigner.publicKey(coin)
+      : walletPublicKey(xprv, coin);
+    if (
+      window.foreignWalletSigner &&
+      keys[`${coin.toLowerCase()}PublicKey`] !== xpub
+    )
+      throw new ForeignSendError('changed');
+    const endpoint = await createEndpoint(
+      `/crosschain/${coin.toLowerCase()}/wallet/public/spend-context`
+    );
+    const fingerprint = bytesToHex(sha256(new TextEncoder().encode(xpub)));
+    let pendingTxId: string;
+    const storageKey = `foreign-send-v1:${coin}:${fingerprint}`;
+    const stillValid = async () => {
+      try {
+        await validateIntent?.();
+        return (
+          (await getSaveWallet()).address0 === wallet.address0 &&
+          (window.foreignWalletSigner
+            ? (await window.foreignWalletSigner.publicKey(coin)) === xpub &&
+              (await getKeyPair())[`${coin.toLowerCase()}PublicKey`] === xpub
+            : (await getKeyPair())[`${coin.toLowerCase()}PrivateKey`] ===
+              xprv) &&
+          (await createEndpoint(
+            `/crosschain/${coin.toLowerCase()}/wallet/public/spend-context`
+          )) === endpoint
+        );
+      } catch {
+        return false;
+      }
+    };
+    return await sendForeignCoin(
+      {
+        coin,
+        xprv: window.foreignWalletSigner ? undefined : xprv,
+        xpub,
+        broadcastBefore: data.broadcastBefore,
+        amount: data.amount,
+        recipient: data.recipient || data.destinationAddress,
+        fee: data.fee,
+        sendMax: data.sendMax === true,
+        payments,
+      },
+      {
+        stillValid,
+        sign: window.foreignWalletSigner
+          ? async (plan, psbt) => {
+              const result = await window.foreignWalletSigner.sign(
+                {
+                  coin,
+                  xpub,
+                  inputs: plan.inputs,
+                  outputs: plan.outputs,
+                  psbtHex: hex.encode(psbt),
+                },
+                i18n.language
+              );
+              if (!result.signed || result.error)
+                throw new ForeignSendError(result.error || 'invalid');
+              return result.signed;
+            }
+          : undefined,
+        approveRecovery: async (pending) => {
+          const tx = Transaction.fromRaw(hex.decode(pending.rawTransactionHex));
+          const outputs = Array.from(
+            { length: tx.outputsLength },
+            (_, index) => {
+              const output = tx.getOutput(index);
+              return `${decimalAmount(output.amount)} ${coin} → ${foreignWalletOutputAddress(output.script, coin)}`;
+            }
+          ).join('\n');
+          return (
+            await approveRecovery({
+              text1: i18n.t('question:local_send.recovery'),
+              text2: pending.txId,
+              text3: outputs,
+              confirmCheckbox: true,
+            })
+          ).accepted;
+        },
+        readPending: async () => {
+          const raw = window.foreignWalletJournal
+            ? await window.foreignWalletJournal.get(storageKey)
+            : localStorage.getItem(storageKey);
+          const pending = parsePendingSend(raw);
+          pendingTxId = pending?.txId;
+          return pending;
+        },
+        writePending: async (entry) => {
+          if (window.foreignWalletJournal) {
+            if (entry)
+              await window.foreignWalletJournal.set(
+                storageKey,
+                JSON.stringify(entry)
+              );
+            else
+              await window.foreignWalletJournal.delete(storageKey, pendingTxId);
+          } else if (entry)
+            localStorage.setItem(storageKey, JSON.stringify(entry));
+          else localStorage.removeItem(storageKey);
+        },
+        post: async (path, body) => {
+          return fetchWalletEndpoint(path, body, stillValid, 90_000);
+        },
+        approve: async (plan) =>
+          (
+            await approve({
+              text1: i18n.t('question:permission.send_coins', {
+                postProcess: 'capitalizeFirstChar',
+              }),
+              text2: i18n.t('question:to_recipient', {
+                recipient: plan.recipientAddress,
+                postProcess: 'capitalizeFirstChar',
+              }),
+              highlightedText: `${decimalAmount(plan.amount)} ${coin}`,
+              foreignFee: `${decimalAmount(plan.fee)} ${coin}`,
+              confirmCheckbox: true,
+            })
+          ).accepted,
+      }
+    );
+  } catch (error) {
+    const code = error instanceof ForeignSendError ? error.code : 'invalid';
+    throw new LocalWalletError(
+      code,
+      error instanceof ForeignSendError ? error.txId || '' : ''
+    );
+  }
+}
diff --git a/src/qortal/get.ts b/src/qortal/get.ts
index 8c016dcb8..eb7e7ad4c 100644
--- a/src/qortal/get.ts
+++ b/src/qortal/get.ts
@@ -1,3 +1,5 @@
+import { fundLocalTrades, localTradeCoins } from './local-trade-funding';
+import { sendLocalForeignCoin } from './foreign-coin-send';
 import { Sha256 } from 'asmcrypto.js';
 import {
   createEndpoint,
@@ -47,6 +49,10 @@ import {
   uint8ArrayToObject,
 } from '../encryption/encryption.ts';
 import { showSaveFilePicker } from '../hooks/useQortalMessageListener.tsx';
+import {
+  codedQortalRequestError,
+  USER_DECLINED_REQUEST_CODE,
+} from './qortal-request-errors.ts';
 import { getPublishesFromAdminsAdminSpace } from '../components/Chat/AdminSpaceInner.tsx';
 import { extractComponents } from '../components/Chat/MessageDisplay.tsx';
 import {
@@ -56,17 +62,12 @@ import {
   validateSecretKey,
 } from '../components/Group/Group.tsx';
 import {
-  BTC_FEE_PER_BYTE,
-  DGB_FEE_PER_BYTE,
-  DOGE_FEE_PER_BYTE,
-  LTC_FEE_PER_BYTE,
   MAX_SIZE_PUBLIC_NODE,
   MAX_SIZE_PUBLISH,
   MIN_REQUIRED_QORTS,
   PUBLIC_NOTIFICATION_CODE_FIRST_SECRET_KEY,
   QORT_DECIMALS,
   QORTAL_PROTOCOL,
-  RVN_FEE_PER_BYTE,
   SELLER_FOREIGN_FEE,
   TIME_MINUTES_1_IN_MILLISECONDS,
   TIME_MINUTES_20_IN_MILLISECONDS,
@@ -112,6 +113,11 @@ import { getElectronPersistentStorage } from '../utils/electronPersistentStorage
 import { fileToBase64 } from '../utils/fileReading/index.ts';
 import { mimeToExtensionMap } from '../utils/memeTypes.ts';
 import { RequestQueueWithPromise } from '../utils/queue/queue.ts';
+import { normalizeQappIdentityContext } from './qapp-identity.ts';
+import {
+  createBackendPermissions,
+  unapprovedSessionPermissions,
+} from './qapp-backend-permission.ts';
 import utils from '../utils/utils.ts';
 import ShortUniqueId from 'short-unique-id';
 import {
@@ -124,7 +130,6 @@ import i18n from 'i18next';
 import aesjs from 'aes-js';
 import { roundUpToDecimals } from '../utils/numberFunctions.ts';
 import { normalizeFilename } from '../utils/downloadFromLocation.ts';
-import { getElectronPersistentStorage } from '../utils/electronPersistentStorage.ts';
 
 const uid = new ShortUniqueId({ length: 6 });
 
@@ -452,6 +457,25 @@ function getFileFromContentScript(fileId) {
 
 const responseResolvers = new Map();
 const notificationPermissionResolvers = new Map();
+const backendPermissions = createBackendPermissions(
+  async (appInfo, isFromExtension) => {
+    const response = await getUserPermission(
+      {
+        text1: i18n.t('question:permission.backend_connection', {
+          appName: appInfo.name,
+        }),
+        text2: i18n.t('question:permission.backend_connection_description'),
+        confirmCheckbox: true,
+        confirmCheckboxLabel: i18n.t(
+          'question:permission.backend_connection_understand'
+        ),
+      },
+      isFromExtension
+    );
+    return response?.accepted === true;
+  },
+  (tabId, name, permissions) => setSessionPermissions(tabId, name, permissions)
+);
 
 function generatePermissionRequestId(): string {
   if (globalThis.crypto?.randomUUID) {
@@ -515,6 +539,37 @@ async function getUserPermission(payload, isFromExtension) {
   });
 }
 
+export const authorizeRnsDestination = async (
+  destination: string,
+  isFromExtension: boolean,
+  appInfo: { tabId?: string | number; name?: string }
+) => {
+  const normalized = String(destination ?? '')
+    .trim()
+    .toLowerCase();
+  if (!/^[0-9a-f]{32}$/.test(normalized)) {
+    throw new Error('RNS_DESTINATION_UNREACHABLE');
+  }
+  if (!window.electronAPI?.qappReticulumConnect) {
+    throw new Error('RNS_NATIVE_TRANSPORT_UNAVAILABLE');
+  }
+  if (appInfo?.tabId == null || !appInfo?.name) {
+    throw new Error('RNS_PERMISSION_DENIED');
+  }
+  await backendPermissions.authorize(
+    { tabId: appInfo.tabId, name: appInfo.name },
+    normalized,
+    isFromExtension
+  );
+  return normalized;
+};
+
+export const clearRnsDestinationPermissionsByTabId = (
+  tabId: string | number
+) => {
+  backendPermissions.clearByTabId(tabId);
+};
+
 export const getWhichUI = async () => {
   try {
     // Check if we're running in Electron
@@ -600,6 +655,90 @@ export const getUserAccount = async ({ isFromExtension, appInfo }) => {
   }
 };
 
+export const signQappIdentityProof = async (
+  payload,
+  _isFromExtension,
+  appInfo
+) => {
+  const protocol = payload?.protocol;
+  const challengeId = payload?.challengeId;
+  const nonce = payload?.nonce;
+  const backendDestination = payload?.backendDestination;
+  const expiresAt = payload?.expiresAt;
+  if (
+    protocol !== 'qortal-qapp-auth-v1' ||
+    typeof challengeId !== 'string' ||
+    !/^[A-Za-z0-9_-]{12,128}$/.test(challengeId) ||
+    typeof nonce !== 'string' ||
+    !/^[A-Za-z0-9_-]{32,128}$/.test(nonce) ||
+    typeof backendDestination !== 'string' ||
+    !/^[0-9a-f]{32}$/.test(backendDestination) ||
+    !Number.isSafeInteger(expiresAt) ||
+    expiresAt < Date.now() - 5_000 ||
+    expiresAt > Date.now() + 180_000
+  ) {
+    throw new Error(
+      i18n.t('auth:message.error.invalid_qapp_identity_challenge')
+    );
+  }
+  const qapp = normalizeQappIdentityContext(appInfo);
+  if (appInfo?.tabId == null) {
+    throw new Error(i18n.t('auth:message.error.invalid_qapp_identity_context'));
+  }
+  const hasPersistentAccountPermission = appInfo?.name
+    ? Boolean(await getPermission(`qAPPAutoAuth-${appInfo.name}`))
+    : false;
+  const hasAccountSessionPermission = Boolean(
+    appInfo?.tabId &&
+    appInfo?.name &&
+    hasSessionPermission(appInfo.tabId, appInfo.name, 'GET_USER_ACCOUNT')
+  );
+  if (!hasPersistentAccountPermission && !hasAccountSessionPermission) {
+    throw new Error(
+      i18n.t('auth:message.error.qapp_account_authentication_required')
+    );
+  }
+  if (!backendPermissions.has(appInfo, backendDestination))
+    throw new Error('RNS_PERMISSION_DENIED');
+  const wallet = await getSaveWallet();
+  const account = {
+    address: wallet?.address0,
+    publicKey: wallet?.publicKey,
+  };
+  const keyPair = await getKeyPair();
+  if (
+    !account?.address ||
+    !account?.publicKey ||
+    keyPair?.publicKey !== account.publicKey
+  ) {
+    throw new Error(i18n.t('auth:message.error.wallet_account_mismatch'));
+  }
+  const fields = {
+    address: account.address,
+    backendDestination,
+    challengeId,
+    expiresAt,
+    nonce,
+    protocol,
+    publicKey: account.publicKey,
+    qappName: qapp.name,
+    qappService: qapp.service,
+  };
+  const sorted = {};
+  for (const key of Object.keys(fields).sort()) sorted[key] = fields[key];
+  const message = new TextEncoder().encode(JSON.stringify(sorted));
+  const privateKey = Base58.decode(keyPair.privateKey);
+  try {
+    return {
+      ...fields,
+      signature: Base58.encode(nacl.sign.detached(message, privateKey)),
+    };
+  } finally {
+    privateKey.fill(0);
+    message.fill(0);
+  }
+};
+
 export const getNotificationPermission = async ({ appInfo }) => {
   try {
     const stored =
@@ -723,6 +862,15 @@ export const sessionPermissions = async (data, isFromExtension, appInfo) => {
       );
     }
 
+    // RNS_CONNECT already approves private transport for this app's tab.
+    // Keep legacy SESSION_PERMISSIONS requests compatible without a second dialog.
+    const pendingPermissions = unapprovedSessionPermissions(
+      { tabId, name: appInfo.name },
+      permissions,
+      hasSessionPermission
+    );
+    if (pendingPermissions.length === 0) return true;
+
     const resPermission = await getUserPermission(
       {
         text1: i18n.t('question:permission.session_permissions', {
@@ -737,7 +885,7 @@ export const sessionPermissions = async (data, isFromExtension, appInfo) => {
         }),
         details: {
           type: 'sessionPermissions',
-          permissions,
+          permissions: pendingPermissions,
         },
         confirmCheckbox: true,
         confirmCheckboxLabel: i18n.t('question:permission.session_understand', {
@@ -5487,7 +5635,11 @@ export const getNotificationSubscriptions = async (_payload, appInfo) => {
 };
 
 export const sendCoin = async (data, isFromExtension) => {
-  const requiredFields = ['coin', 'amount'];
+  const requiredFields =
+    data.sendMax === true &&
+    ['BTC', 'LTC', 'DOGE', 'DGB', 'RVN'].includes(data.coin)
+      ? ['coin']
+      : ['coin', 'amount'];
   const missingFields: string[] = [];
   requiredFields.forEach((field) => {
     if (!data[field]) {
@@ -5511,19 +5663,17 @@ export const sendCoin = async (data, isFromExtension) => {
     );
   }
   const checkCoin = data.coin;
-  const wallet = await getSaveWallet();
-  const address = wallet.address0;
-  const resKeyPair = await getKeyPair();
-  const parsedData = resKeyPair;
   const isGateway = await isRunningGateway();
 
-  if (checkCoin !== 'QORT' && isGateway)
+  if (checkCoin === 'ARRR' && isGateway)
     throw new Error(
-      i18n.t('question:message.error.gateway_non_qort_local_node', {
+      i18n.t('question:message.error.gateway_pirate_local_node', {
         postProcess: 'capitalizeFirstChar',
       })
     );
   if (checkCoin === 'QORT') {
+    const wallet = await getSaveWallet();
+    const address = wallet.address0;
     // Params: data.coin, data.recipient, data.amount, data.fee
     // TODO: prompt user to send. If they confirm, call `POST /crosschain/:coin/send`, or for QORT, broadcast a PAYMENT transaction
     // then set the response string from the core to the `response` variable (defined above)
@@ -5605,390 +5755,17 @@ export const sendCoin = async (data, isFromExtension) => {
       );
       return makePayment.res?.data;
     } else {
-      throw new Error(
+      throw codedQortalRequestError(
+        USER_DECLINED_REQUEST_CODE,
         i18n.t('question:message.generic.user_declined_request', {
           postProcess: 'capitalizeFirstChar',
         })
       );
     }
-  } else if (checkCoin === 'BTC') {
-    const amount = Number(data.amount);
-    const recipient = data?.recipient || data.destinationAddress;
-    const xprv58 = parsedData.btcPrivateKey;
-    const feePerByte = data.fee ? data.fee : BTC_FEE_PER_BYTE;
-
-    const btcWalletBalance = await getWalletBalance({ coin: checkCoin }, true);
-
-    if (isNaN(Number(btcWalletBalance))) {
-      throw new Error(
-        i18n.t('question:message.error.fetch_balance_token', {
-          token: 'BTC',
-          postProcess: 'capitalizeFirstChar',
-        })
-      );
-    }
-    const btcWalletBalanceDecimals = Number(btcWalletBalance);
-    const btcAmountDecimals = Number(amount);
-    const fee = feePerByte * 500; // default 0.00050000
-    if (btcAmountDecimals + fee > btcWalletBalanceDecimals) {
-      throw new Error(
-        i18n.t('question:message.error.insufficient_funds', {
-          postProcess: 'capitalizeFirstChar',
-        })
-      );
-    }
-
-    const resPermission = await getUserPermission(
-      {
-        text1: i18n.t('question:permission.send_coins', {
-          postProcess: 'capitalizeFirstChar',
-        }),
-        text2: i18n.t('question:to_recipient', {
-          recipient: recipient,
-          postProcess: 'capitalizeFirstChar',
-        }),
-        highlightedText: `${amount} ${checkCoin}`,
-        foreignFee: `${fee} BTC`,
-      },
-      isFromExtension
+  } else if (['BTC', 'LTC', 'DOGE', 'DGB', 'RVN'].includes(checkCoin)) {
+    return sendLocalForeignCoin(data, (payload) =>
+      getUserPermission(payload, isFromExtension)
     );
-    const { accepted } = resPermission;
-
-    if (accepted) {
-      const opts = {
-        xprv58: xprv58,
-        receivingAddress: recipient,
-        bitcoinAmount: amount,
-        feePerByte: feePerByte,
-      };
-      const url = await createEndpoint(`/crosschain/btc/send`);
-
-      const response = await fetch(url, {
-        method: 'POST',
-        headers: {
-          Accept: 'application/json',
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(opts),
-      });
-      if (!response.ok)
-        throw new Error(
-          i18n.t('question:message.error.send', {
-            postProcess: 'capitalizeFirstChar',
-          })
-        );
-      let res;
-      try {
-        res = await response.clone().json();
-      } catch (e) {
-        res = await response.text();
-      }
-      return res;
-    } else {
-      throw new Error(
-        i18n.t('question:message.generic.user_declined_request', {
-          postProcess: 'capitalizeFirstChar',
-        })
-      );
-    }
-  } else if (checkCoin === 'LTC') {
-    const amount = Number(data.amount);
-    const recipient = data?.recipient || data.destinationAddress;
-    const xprv58 = parsedData.ltcPrivateKey;
-    const feePerByte = data.fee ? data.fee : LTC_FEE_PER_BYTE;
-    const ltcWalletBalance = await getWalletBalance({ coin: checkCoin }, true);
-
-    if (isNaN(Number(ltcWalletBalance))) {
-      const errorMsg = i18n.t('question:message.error.fetch_balance_token', {
-        token: 'LTC',
-        postProcess: 'capitalizeFirstChar',
-      });
-      throw new Error(errorMsg);
-    }
-    const ltcWalletBalanceDecimals = Number(ltcWalletBalance);
-    const ltcAmountDecimals = Number(amount);
-    const fee = feePerByte * 1000; // default 0.00030000
-    if (ltcAmountDecimals + fee > ltcWalletBalanceDecimals) {
-      throw new Error(
-        i18n.t('question:message.error.insufficient_funds', {
-          postProcess: 'capitalizeFirstChar',
-        })
-      );
-    }
-    const resPermission = await getUserPermission(
-      {
-        text1: i18n.t('question:permission.send_coins', {
-          postProcess: 'capitalizeFirstChar',
-        }),
-        text2: i18n.t('question:to_recipient', {
-          recipient: recipient,
-          postProcess: 'capitalizeFirstChar',
-        }),
-        highlightedText: `${amount} ${checkCoin}`,
-        foreignFee: `${fee} LTC`,
-      },
-      isFromExtension
-    );
-    const { accepted } = resPermission;
-
-    if (accepted) {
-      const url = await createEndpoint(`/crosschain/ltc/send`);
-      const opts = {
-        xprv58: xprv58,
-        receivingAddress: recipient,
-        litecoinAmount: amount,
-        feePerByte: feePerByte,
-      };
-      const response = await fetch(url, {
-        method: 'POST',
-        headers: {
-          Accept: 'application/json',
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(opts),
-      });
-      if (!response.ok)
-        throw new Error(
-          i18n.t('question:message.error.send', {
-            postProcess: 'capitalizeFirstChar',
-          })
-        );
-      let res;
-      try {
-        res = await response.clone().json();
-      } catch (e) {
-        res = await response.text();
-      }
-      return res;
-    } else {
-      throw new Error(
-        i18n.t('question:message.generic.user_declined_request', {
-          postProcess: 'capitalizeFirstChar',
-        })
-      );
-    }
-  } else if (checkCoin === 'DOGE') {
-    const amount = Number(data.amount);
-    const recipient = data?.recipient || data.destinationAddress;
-    const xprv58 = parsedData.dogePrivateKey;
-    const feePerByte = data.fee ? data.fee : DOGE_FEE_PER_BYTE;
-    const dogeWalletBalance = await getWalletBalance({ coin: checkCoin }, true);
-    if (isNaN(Number(dogeWalletBalance))) {
-      const errorMsg = i18n.t('question:message.error.fetch_balance_token', {
-        token: 'DOGE',
-        postProcess: 'capitalizeFirstChar',
-      });
-      throw new Error(errorMsg);
-    }
-    const dogeWalletBalanceDecimals = Number(dogeWalletBalance);
-    const dogeAmountDecimals = Number(amount);
-    const fee = feePerByte * 5000; // default 0.05000000
-    if (dogeAmountDecimals + fee > dogeWalletBalanceDecimals) {
-      const errorMsg = i18n.t('question:message.error.insufficient_funds', {
-        postProcess: 'capitalizeFirstChar',
-      });
-      throw new Error(errorMsg);
-    }
-
-    const resPermission = await getUserPermission(
-      {
-        text1: i18n.t('question:permission.send_coins', {
-          postProcess: 'capitalizeFirstChar',
-        }),
-        text2: i18n.t('question:to_recipient', {
-          recipient: recipient,
-          postProcess: 'capitalizeFirstChar',
-        }),
-        highlightedText: `${amount} ${checkCoin}`,
-        foreignFee: `${fee} DOGE`,
-      },
-      isFromExtension
-    );
-    const { accepted } = resPermission;
-
-    if (accepted) {
-      const opts = {
-        xprv58: xprv58,
-        receivingAddress: recipient,
-        dogecoinAmount: amount,
-        feePerByte: feePerByte,
-      };
-      const url = await createEndpoint(`/crosschain/doge/send`);
-
-      const response = await fetch(url, {
-        method: 'POST',
-        headers: {
-          Accept: 'application/json',
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(opts),
-      });
-      if (!response.ok)
-        throw new Error(
-          i18n.t('question:message.error.send', {
-            postProcess: 'capitalizeFirstChar',
-          })
-        );
-      let res;
-      try {
-        res = await response.clone().json();
-      } catch (e) {
-        res = await response.text();
-      }
-      return res;
-    } else {
-      throw new Error(
-        i18n.t('question:message.generic.user_declined_request', {
-          postProcess: 'capitalizeFirstChar',
-        })
-      );
-    }
-  } else if (checkCoin === 'DGB') {
-    const amount = Number(data.amount);
-    const recipient = data?.recipient || data.destinationAddress;
-    const xprv58 = parsedData.dgbPrivateKey;
-    const feePerByte = data.fee ? data.fee : DGB_FEE_PER_BYTE;
-    const dgbWalletBalance = await getWalletBalance({ coin: checkCoin }, true);
-    if (isNaN(Number(dgbWalletBalance))) {
-      const errorMsg = i18n.t('question:message.error.fetch_balance_token', {
-        token: 'DGB',
-        postProcess: 'capitalizeFirstChar',
-      });
-      throw new Error(errorMsg);
-    }
-    const dgbWalletBalanceDecimals = Number(dgbWalletBalance);
-    const dgbAmountDecimals = Number(amount);
-    const fee = feePerByte * 500; // default 0.00005000
-    if (dgbAmountDecimals + fee > dgbWalletBalanceDecimals) {
-      const errorMsg = i18n.t('question:message.error.insufficient_funds', {
-        postProcess: 'capitalizeFirstChar',
-      });
-      throw new Error(errorMsg);
-    }
-
-    const resPermission = await getUserPermission(
-      {
-        text1: i18n.t('question:permission.send_coins', {
-          postProcess: 'capitalizeFirstChar',
-        }),
-        text2: `To: ${recipient}`,
-        highlightedText: `${amount} ${checkCoin}`,
-        foreignFee: `${fee} DGB`,
-      },
-      isFromExtension
-    );
-    const { accepted } = resPermission;
-
-    if (accepted) {
-      const opts = {
-        xprv58: xprv58,
-        receivingAddress: recipient,
-        digibyteAmount: amount,
-        feePerByte: feePerByte,
-      };
-      const url = await createEndpoint(`/crosschain/dgb/send`);
-
-      const response = await fetch(url, {
-        method: 'POST',
-        headers: {
-          Accept: 'application/json',
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(opts),
-      });
-      if (!response.ok)
-        throw new Error(
-          i18n.t('question:message.error.send', {
-            postProcess: 'capitalizeFirstChar',
-          })
-        );
-      let res;
-      try {
-        res = await response.clone().json();
-      } catch (e) {
-        res = await response.text();
-      }
-      return res;
-    } else {
-      throw new Error(
-        i18n.t('question:message.generic.user_declined_request', {
-          postProcess: 'capitalizeFirstChar',
-        })
-      );
-    }
-  } else if (checkCoin === 'RVN') {
-    const amount = Number(data.amount);
-    const recipient = data?.recipient || data.destinationAddress;
-    const xprv58 = parsedData.rvnPrivateKey;
-    const feePerByte = data.fee ? data.fee : RVN_FEE_PER_BYTE;
-    const rvnWalletBalance = await getWalletBalance({ coin: checkCoin }, true);
-    if (isNaN(Number(rvnWalletBalance))) {
-      const errorMsg = i18n.t('question:message.error.fetch_balance_token', {
-        token: 'RVN',
-        postProcess: 'capitalizeFirstChar',
-      });
-      throw new Error(errorMsg);
-    }
-    const rvnWalletBalanceDecimals = Number(rvnWalletBalance);
-    const rvnAmountDecimals = Number(amount);
-    const fee = feePerByte * 500; // default 0.00562500
-    if (rvnAmountDecimals + fee > rvnWalletBalanceDecimals) {
-      const errorMsg = i18n.t('question:message.error.insufficient_funds', {
-        postProcess: 'capitalizeFirstChar',
-      });
-      throw new Error(errorMsg);
-    }
-
-    const resPermission = await getUserPermission(
-      {
-        text1: i18n.t('question:permission.send_coins', {
-          postProcess: 'capitalizeFirstChar',
-        }),
-        text2: `To: ${recipient}`,
-        highlightedText: `${amount} ${checkCoin}`,
-        foreignFee: `${fee} RVN`,
-      },
-      isFromExtension
-    );
-    const { accepted } = resPermission;
-
-    if (accepted) {
-      const opts = {
-        xprv58: xprv58,
-        receivingAddress: recipient,
-        ravencoinAmount: amount,
-        feePerByte: feePerByte,
-      };
-      const url = await createEndpoint(`/crosschain/rvn/send`);
-
-      const response = await fetch(url, {
-        method: 'POST',
-        headers: {
-          Accept: 'application/json',
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(opts),
-      });
-      if (!response.ok)
-        throw new Error(
-          i18n.t('question:message.error.send', {
-            postProcess: 'capitalizeFirstChar',
-          })
-        );
-      let res;
-      try {
-        res = await response.clone().json();
-      } catch (e) {
-        res = await response.text();
-      }
-      return res;
-    } else {
-      throw new Error(
-        i18n.t('question:message.generic.user_declined_request', {
-          postProcess: 'capitalizeFirstChar',
-        })
-      );
-    }
   } else if (checkCoin === 'ARRR') {
     const amount = Number(data.amount);
     const recipient = data?.recipient || data.destinationAddress;
@@ -6026,6 +5803,7 @@ export const sendCoin = async (data, isFromExtension) => {
     const { accepted } = resPermission;
 
     if (accepted) {
+      const parsedData = await getKeyPair();
       const opts = {
         entropy58: parsedData.arrrSeed58,
         receivingAddress: recipient,
@@ -6108,6 +5886,15 @@ export const createBuyOrder = async (data, isFromExtension) => {
   }
   const isGateway = await isRunningGateway();
   const foreignBlockchain = data.foreignBlockchain;
+  if (isGateway && !localTradeCoins[foreignBlockchain])
+    throw new Error(
+      i18n.t(
+        foreignBlockchain === 'PIRATECHAIN'
+          ? 'question:message.error.gateway_pirate_local_node'
+          : 'question:message.generic.no_action_public_node',
+        { postProcess: 'capitalizeFirstChar' }
+      )
+    );
   const atAddresses = data.crosschainAtInfo?.map(
     (order) => order.qortalAtAddress
   );
@@ -6129,6 +5916,13 @@ export const createBuyOrder = async (data, isFromExtension) => {
   );
 
   const crosschainAtInfo = await Promise.all(atPromises);
+  if (localTradeCoins[foreignBlockchain]) {
+    return fundLocalTrades(
+      crosschainAtInfo,
+      localTradeCoins[foreignBlockchain],
+      (payload) => getUserPermission(payload, isFromExtension)
+    );
+  }
 
   try {
     const buyingFees = await getBuyingFees(foreignBlockchain);
@@ -6378,6 +6172,17 @@ export const createSellOrder = async (data, isFromExtension) => {
     throw new Error(errorMsg);
   }
 
+  if (await isRunningGateway()) {
+    throw new Error(
+      i18n.t(
+        ['ARRR', 'PIRATECHAIN'].includes(data.foreignBlockchain)
+          ? 'question:message.error.gateway_pirate_local_node'
+          : 'question:message.generic.no_action_public_node',
+        { postProcess: 'capitalizeFirstChar' }
+      )
+    );
+  }
+
   const parsedForeignAmount = Number(data.foreignAmount)?.toFixed(8);
 
   const receivingAddress = await getUserWalletFunc(data.foreignBlockchain);
diff --git a/src/qortal/local-trade-funding.test.ts b/src/qortal/local-trade-funding.test.ts
new file mode 100644
index 000000000..eb36c6c34
--- /dev/null
+++ b/src/qortal/local-trade-funding.test.ts
@@ -0,0 +1,60 @@
+import { afterEach, expect, it, vi } from 'vitest';
+vi.mock('../background/background', () => ({
+  getSaveWallet: async () => ({ address0: 'QORT' }),
+  getKeyPair: async () => ({ ltcPrivateKey: 'private' }),
+  createEndpoint: async () => 'https://node.test/respond/local',
+}));
+vi.mock('../lib/foreign-wallet/foreign-wallets', () => ({
+  walletPublicKey: () => 'public',
+}));
+vi.mock('../lib/foreign-wallet/trade-plan', () => ({
+  validateLocalTradePlan: vi.fn(() => [
+    { address: 'funding', value: 100000001n },
+  ]),
+}));
+vi.mock('./foreign-coin-send', () => ({
+  LocalWalletError: class extends Error {},
+  sendLocalForeignCoin: vi.fn(),
+}));
+import { fundLocalTrades } from './local-trade-funding';
+import { sendLocalForeignCoin } from './foreign-coin-send';
+import { validateLocalTradePlan } from '../lib/foreign-wallet/trade-plan';
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.clearAllMocks();
+});
+
+it('preserves recovery details and snapshots offers before approval', async () => {
+  const offers = [{ qortalAtAddress: 'original', expectedForeignAmount: '1' }];
+  const recovery = {
+    text1: 'Recover previous payment',
+    text2: 'old transaction',
+    text3: 'old recipient',
+  };
+  const approve = vi.fn(async () => {
+    offers[0].qortalAtAddress = 'mutated';
+    return { accepted: true };
+  });
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(
+      async () =>
+        new Response(JSON.stringify([{ lockTime: Date.now() / 1000 + 3600 }]))
+    )
+  );
+  vi.mocked(sendLocalForeignCoin).mockImplementation(
+    async (_data, _approve, _payments, _validate, approveRecovery) => {
+      await approveRecovery(recovery);
+      return 'txid';
+    }
+  );
+  const result = await fundLocalTrades(offers, 'LTC', approve);
+  expect(approve).toHaveBeenLastCalledWith(recovery);
+  expect(result.extra.atAddresses).toEqual(['original']);
+  expect(
+    JSON.parse(vi.mocked(fetch).mock.calls[0][1].body as string).addresses
+  ).toEqual(['original']);
+  expect(
+    vi.mocked(validateLocalTradePlan).mock.calls[0][1][0].qortalAtAddress
+  ).toBe('original');
+});
diff --git a/src/qortal/local-trade-funding.ts b/src/qortal/local-trade-funding.ts
new file mode 100644
index 000000000..da65ce581
--- /dev/null
+++ b/src/qortal/local-trade-funding.ts
@@ -0,0 +1,149 @@
+import { readBoundedWalletResponse } from './wallet-response';
+import { validateLocalTradePlan } from '../lib/foreign-wallet/trade-plan';
+import i18n from 'i18next';
+import {
+  createEndpoint,
+  getKeyPair,
+  getSaveWallet,
+} from '../background/background';
+import { atomicAmount, decimalAmount } from '../lib/foreign-wallet/send';
+import {
+  type ForeignWalletCoin,
+  walletPublicKey,
+} from '../lib/foreign-wallet/foreign-wallets';
+import { getForeignWalletMainnetChainId } from '../lib/foreign-wallet/foreign-wallet-spend-context';
+import { sendLocalForeignCoin, LocalWalletError } from './foreign-coin-send';
+
+export const localTradeCoins: Record<string, ForeignWalletCoin> = {
+  BITCOIN: 'BTC',
+  LITECOIN: 'LTC',
+  DOGECOIN: 'DOGE',
+  DIGIBYTE: 'DGB',
+  RAVENCOIN: 'RVN',
+};
+export async function fundLocalTrades(
+  offers: any[],
+  coin: ForeignWalletCoin,
+  approve: (payload: any) => Promise<any>
+) {
+  try {
+    if (!Array.isArray(offers) || !offers.length || offers.length > 20)
+      throw new LocalWalletError('invalid');
+    // Bind both approvals and validation to the original selection.
+    offers = structuredClone(offers);
+    const wallet = await getSaveWallet();
+    const publicKey = async () =>
+      window.foreignWalletSigner
+        ? window.foreignWalletSigner.publicKey(coin)
+        : walletPublicKey(
+            (await getKeyPair())[`${coin.toLowerCase()}PrivateKey`],
+            coin
+          );
+    const xpub = await publicKey();
+    if (
+      window.foreignWalletSigner &&
+      (await getKeyPair())[`${coin.toLowerCase()}PublicKey`] !== xpub
+    )
+      throw new LocalWalletError('changed');
+    const endpoint = await createEndpoint('/crosschain/tradebot/respond/local');
+    const purchaseAmount = offers.reduce(
+      (sum, offer) => sum + atomicAmount(offer.expectedForeignAmount),
+      0n
+    );
+    const permission = await approve({
+      text1: i18n.t('question:permission.buy_order', {
+        postProcess: 'capitalizeFirstChar',
+      }),
+      text2: i18n.t('question:permission.buy_order_quantity', {
+        count: offers.length,
+        postProcess: 'capitalizeFirstChar',
+      }),
+      highlightedText: `${decimalAmount(purchaseAmount)} ${coin}`,
+      confirmCheckbox: true,
+    });
+    if (!permission?.accepted) throw new LocalWalletError('declined');
+    const assertSession = async () => {
+      if (
+        (await getSaveWallet()).address0 !== wallet.address0 ||
+        (await publicKey()) !== xpub ||
+        (await createEndpoint('/crosschain/tradebot/respond/local')) !==
+          endpoint
+      )
+        throw new LocalWalletError('changed');
+    };
+    await assertSession();
+    const response = await fetch(endpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        addresses: offers.map((o) => o.qortalAtAddress),
+        xpub58: xpub,
+        receivingAddress: wallet.address0,
+        expectedChainId: getForeignWalletMainnetChainId(coin),
+      }),
+      signal: AbortSignal.timeout(90000),
+    });
+    if (response.status === 404 || response.status === 405)
+      throw new LocalWalletError('upgrade');
+    if (!response.ok) throw new LocalWalletError('invalid');
+    const plans = JSON.parse(
+      await readBoundedWalletResponse(response, 1024 * 1024)
+    );
+    let payments;
+    try {
+      payments = validateLocalTradePlan(plans, offers, coin, wallet.address0);
+    } catch {
+      throw new LocalWalletError('invalid');
+    }
+    await assertSession();
+    const total = payments.reduce((sum, p) => sum + p.value, 0n);
+    const txId = await sendLocalForeignCoin(
+      {
+        coin,
+        amount: decimalAmount(total),
+        recipient: payments[0].address,
+        broadcastBefore: Math.min(
+          ...plans.map((p) => (p.lockTime - 300) * 1000)
+        ),
+      },
+      async (payload) => {
+        await assertSession();
+        const permission = await approve({
+          ...payload,
+          text1: i18n.t('question:permission.buy_order', {
+            postProcess: 'capitalizeFirstChar',
+          }),
+          text2: i18n.t('question:permission.buy_order_quantity', {
+            count: offers.length,
+            postProcess: 'capitalizeFirstChar',
+          }),
+          text3: payments
+            .map((p) => `${decimalAmount(p.value)} ${coin} → ${p.address}`)
+            .join('\n'),
+        });
+        await assertSession();
+        // Locktime validation is repeated after approval before allowing a signature.
+        validateLocalTradePlan(plans, offers, coin, wallet.address0);
+        return permission;
+      },
+      payments,
+      async () => {
+        await assertSession();
+        validateLocalTradePlan(plans, offers, coin, wallet.address0);
+      },
+      approve
+    );
+    return {
+      callResponse: true,
+      extra: {
+        txId,
+        atAddresses: offers.map((o) => o.qortalAtAddress),
+        senderAddress: wallet.address0,
+        node: endpoint.split('?')[0],
+      },
+    };
+  } catch (error) {
+    if (error instanceof LocalWalletError) throw error;
+    throw new LocalWalletError('invalid');
+  }
+}
diff --git a/src/qortal/qapp-backend-permission.test.ts b/src/qortal/qapp-backend-permission.test.ts
new file mode 100644
index 000000000..58a64a94e
--- /dev/null
+++ b/src/qortal/qapp-backend-permission.test.ts
@@ -0,0 +1,124 @@
+import { describe, expect, it, vi } from 'vitest';
+import {
+  createBackendPermissions,
+  unapprovedSessionPermissions,
+} from './qapp-backend-permission';
+
+const app = { tabId: 42, name: 'ExampleApp' };
+const destination = 'a'.repeat(32);
+
+const setup = () => {
+  const granted = new Map<string, Set<string>>();
+  const request = vi.fn().mockResolvedValue(true);
+  const grant = vi.fn((tabId, name, permissions: string[]) => {
+    granted.set(`${tabId}:${name}`, new Set(permissions));
+  });
+  const has = (tabId, name, permission) =>
+    granted.get(`${tabId}:${name}`)?.has(permission) ?? false;
+  const backend = createBackendPermissions(request, grant);
+  return { backend, request, grant, has };
+};
+
+describe('combined backend connection approval', () => {
+  it('one approval covers the backend and subsequent private transport permission', async () => {
+    const { backend, request, grant, has } = setup();
+    expect(
+      unapprovedSessionPermissions(app, ['PRIVATE_DATA_CHANNEL'], has)
+    ).toEqual(['PRIVATE_DATA_CHANNEL']);
+    await backend.authorize(app, destination, false);
+    expect(request).toHaveBeenCalledExactlyOnceWith(app, false);
+    expect(backend.has(app, destination)).toBe(true);
+    expect(grant).toHaveBeenCalledWith(42, 'ExampleApp', [
+      'PRIVATE_DATA_CHANNEL',
+    ]);
+    expect(
+      unapprovedSessionPermissions(app, ['PRIVATE_DATA_CHANNEL'], has)
+    ).toEqual([]);
+    await backend.authorize(app, destination, false);
+    expect(request).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not approve unrelated permissions in a mixed request', async () => {
+    const { backend, has } = setup();
+    await backend.authorize(app, destination, false);
+    expect(
+      unapprovedSessionPermissions(
+        app,
+        ['PRIVATE_DATA_CHANNEL', 'SEND_COIN', 'SEND_COIN'],
+        has
+      )
+    ).toEqual(['SEND_COIN']);
+    expect(
+      unapprovedSessionPermissions(
+        { ...app, tabId: 43 },
+        ['PRIVATE_DATA_CHANNEL'],
+        has
+      )
+    ).toEqual(['PRIVATE_DATA_CHANNEL']);
+  });
+
+  it('requires another approval for another backend, app, or tab', async () => {
+    const { backend, request } = setup();
+    await backend.authorize(app, destination, false);
+    for (const [owner, target] of [
+      [app, 'b'.repeat(32)],
+      [{ ...app, tabId: 43 }, destination],
+      [{ ...app, name: 'OtherApp' }, destination],
+    ] as const) {
+      expect(backend.has(owner, target)).toBe(false);
+      await backend.authorize(owner, target, false);
+    }
+    expect(request).toHaveBeenCalledTimes(4);
+  });
+
+  it('declining grants neither permission and allows a later retry', async () => {
+    const { backend, request, grant } = setup();
+    request.mockResolvedValueOnce(false);
+    await expect(backend.authorize(app, destination, true)).rejects.toThrow(
+      'RNS_PERMISSION_DENIED'
+    );
+    expect(backend.has(app, destination)).toBe(false);
+    expect(grant).not.toHaveBeenCalled();
+    await backend.authorize(app, destination, true);
+    expect(request).toHaveBeenCalledTimes(2);
+  });
+
+  it('coalesces simultaneous requests for the same backend', async () => {
+    const { backend, request } = setup();
+    await Promise.all([
+      backend.authorize(app, destination, false),
+      backend.authorize(app, destination, false),
+    ]);
+    expect(request).toHaveBeenCalledTimes(1);
+  });
+
+  it('clears only the closed tab and asks again when reopened', async () => {
+    const { backend, request } = setup();
+    const other = { ...app, tabId: 420 };
+    await backend.authorize(app, destination, false);
+    await backend.authorize(other, destination, false);
+    backend.clearByTabId(42);
+    expect(backend.has(app, destination)).toBe(false);
+    expect(backend.has(other, destination)).toBe(true);
+    await backend.authorize(app, destination, false);
+    expect(request).toHaveBeenCalledTimes(3);
+  });
+
+  it('ignores approval responses arriving after the tab was closed', async () => {
+    const { backend, request, grant } = setup();
+    let accept!: (value: boolean) => void;
+    request.mockImplementationOnce(
+      () =>
+        new Promise<boolean>((resolve) => {
+          accept = resolve;
+        })
+    );
+    const pending = backend.authorize(app, destination, false);
+    await Promise.resolve();
+    backend.clearByTabId(42);
+    accept(true);
+    await expect(pending).rejects.toThrow('RNS_PERMISSION_DENIED');
+    expect(backend.has(app, destination)).toBe(false);
+    expect(grant).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/qortal/qapp-backend-permission.ts b/src/qortal/qapp-backend-permission.ts
new file mode 100644
index 000000000..e16207045
--- /dev/null
+++ b/src/qortal/qapp-backend-permission.ts
@@ -0,0 +1,77 @@
+import { qappReticulumSessionPermissionKey } from './qapp-identity.ts';
+
+type AppInfo = { tabId: string | number; name: string };
+type HasPermission = (
+  tabId: string | number,
+  appName: string,
+  permission: string
+) => boolean;
+
+// Backend approval covers both regular messages and private data transport.
+// Destination checks and native connection ownership still apply independently.
+export const createBackendPermissions = (
+  requestApproval: (app: AppInfo, isFromExtension: boolean) => Promise<boolean>,
+  grantSessionPermissions: (
+    tabId: string | number,
+    name: string,
+    permissions: string[]
+  ) => unknown
+) => {
+  const approved = new Set<string>();
+  const pending = new Map<string, Promise<void>>();
+  const keyFor = (app: AppInfo, destination: string) =>
+    qappReticulumSessionPermissionKey(app.tabId, app.name, destination);
+
+  return {
+    has(app: AppInfo, destination: string) {
+      return approved.has(keyFor(app, destination));
+    },
+    async authorize(
+      app: AppInfo,
+      destination: string,
+      isFromExtension: boolean
+    ) {
+      const key = keyFor(app, destination);
+      if (!approved.has(key)) {
+        let approval = pending.get(key);
+        if (!approval) {
+          approval = Promise.resolve().then(async () => {
+            if (
+              !(await requestApproval(app, isFromExtension)) ||
+              pending.get(key) !== approval
+            ) {
+              throw new Error('RNS_PERMISSION_DENIED');
+            }
+            approved.add(key);
+          });
+          pending.set(key, approval);
+        }
+        try {
+          await approval;
+        } finally {
+          if (pending.get(key) === approval) pending.delete(key);
+        }
+      }
+      grantSessionPermissions(app.tabId, app.name, ['PRIVATE_DATA_CHANNEL']);
+    },
+    clearByTabId(tabId: string | number) {
+      const prefix = `${tabId}\u0000`;
+      for (const key of approved) {
+        if (key.startsWith(prefix)) approved.delete(key);
+      }
+      // A response arriving after the tab closes must not restore its grant.
+      for (const key of pending.keys()) {
+        if (key.startsWith(prefix)) pending.delete(key);
+      }
+    },
+  };
+};
+
+export const unapprovedSessionPermissions = (
+  app: AppInfo,
+  permissions: string[],
+  hasPermission: HasPermission
+) =>
+  [...new Set(permissions)].filter(
+    (permission) => !hasPermission(app.tabId, app.name, permission)
+  );
diff --git a/src/qortal/qapp-file-save-request.test.ts b/src/qortal/qapp-file-save-request.test.ts
new file mode 100644
index 000000000..ee043ace3
--- /dev/null
+++ b/src/qortal/qapp-file-save-request.test.ts
@@ -0,0 +1,46 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  dispatchQAppFileSaveRequest,
+  isQAppFileSaveAction,
+} from './qapp-file-save-request';
+
+describe('stream save request boundary', () => {
+  const context = { tabId: 7, appName: 'Example', appService: 'APP' };
+  const api = vi.fn();
+  beforeEach(() => {
+    api.mockReset();
+    window.electronAPI = { qappFileSave: api } as any;
+  });
+  it('uses the trusted tab/app and replaces all iframe permission labels', async () => {
+    api.mockResolvedValue({ saveId: 'random', maxChunkBytes: 262144 });
+    await dispatchQAppFileSaveRequest(
+      {
+        action: 'FILE_SAVE_OPEN',
+        filename: 'file.zip',
+        size: 3,
+        owner: { tabId: 'other' },
+        labels: { title: 'Verified safe file' },
+        path: '/sensitive',
+      },
+      context
+    );
+    const [owner, request] = api.mock.calls[0];
+    expect(owner).toEqual({ tabId: '7', name: 'example', service: 'APP' });
+    expect(request).not.toHaveProperty('path');
+    expect(request).not.toHaveProperty('owner');
+    expect(request.labels.title).not.toBe('Verified safe file');
+  });
+  it('preserves redacted machine-readable errors', async () => {
+    api.mockResolvedValue({ error: 'SAVE_CANCELLED' });
+    await expect(
+      dispatchQAppFileSaveRequest(
+        { action: 'FILE_SAVE_ABORT', saveId: 'id' },
+        context
+      )
+    ).rejects.toMatchObject({ code: 'SAVE_CANCELLED' });
+  });
+  it('does not expose internal lifecycle cleanup as a QApp action', () => {
+    expect(isQAppFileSaveAction('FILE_SAVE_CLEANUP')).toBe(false);
+    expect(isQAppFileSaveAction('FILE_SAVE_OPEN')).toBe(true);
+  });
+});
diff --git a/src/qortal/qapp-file-save-request.ts b/src/qortal/qapp-file-save-request.ts
new file mode 100644
index 000000000..3ac0ac80e
--- /dev/null
+++ b/src/qortal/qapp-file-save-request.ts
@@ -0,0 +1,57 @@
+import i18n from '../i18n/i18n';
+import { normalizeQappIdentityContext } from './qapp-identity';
+import { codedQortalRequestError } from './qortal-request-errors';
+
+export const isQAppFileSaveAction = (action: unknown) =>
+  [
+    'FILE_SAVE_OPEN',
+    'FILE_SAVE_WRITE',
+    'FILE_SAVE_FINISH',
+    'FILE_SAVE_ABORT',
+  ].includes(action as string);
+
+export async function dispatchQAppFileSaveRequest(message, context) {
+  const api = window.electronAPI?.qappFileSave;
+  if (!api)
+    throw codedQortalRequestError(
+      'SAVE_UNAVAILABLE',
+      i18n.t('question:stream_save.unavailable')
+    );
+  const identity = normalizeQappIdentityContext({
+    name: context.appName,
+    service: context.appService,
+  });
+  const owner = { tabId: String(context.tabId), ...identity };
+  // Never accept ownership or permission labels supplied by the iframe.
+  const request = {
+    action: message.action,
+    filename: message.filename,
+    size: message.size,
+    saveId: message.saveId,
+    offset: message.offset,
+    data: message.data,
+    ...(message.action === 'FILE_SAVE_OPEN'
+      ? {
+          labels: {
+            title: i18n.t('question:stream_save.title'),
+            detail: i18n.t('question:stream_save.detail', {
+              app: identity.name,
+              filename: String(message.filename).slice(0, 200),
+              size: Number(message.size).toLocaleString(),
+            }),
+            allow: i18n.t('question:stream_save.choose'),
+            cancel: i18n.t('core:action.cancel', {
+              postProcess: 'capitalizeFirstChar',
+            }),
+          },
+        }
+      : {}),
+  };
+  const result = await api(owner, request);
+  if (result?.error)
+    throw codedQortalRequestError(
+      result.error,
+      i18n.t('question:stream_save.failed')
+    );
+  return result;
+}
diff --git a/src/qortal/qapp-identity.test.ts b/src/qortal/qapp-identity.test.ts
new file mode 100644
index 000000000..231a76208
--- /dev/null
+++ b/src/qortal/qapp-identity.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest';
+import {
+  normalizeQappIdentityContext,
+  qappReticulumSessionPermissionKey,
+} from './qapp-identity';
+
+describe('Q-App identity context', () => {
+  it('canonicalizes only host-provided QDN identity fields', () => {
+    expect(
+      normalizeQappIdentityContext({
+        name: ' Official-App ',
+        service: 'app',
+      })
+    ).toEqual({
+      name: 'official-app',
+      service: 'APP',
+    });
+  });
+
+  it('rejects missing or malformed identity fields', () => {
+    expect(() => normalizeQappIdentityContext({ name: 'example' })).toThrow();
+    expect(() =>
+      normalizeQappIdentityContext({ name: 'example', service: 'APP/' })
+    ).toThrow();
+  });
+
+  it('scopes Reticulum permission to the tab, app, and backend', () => {
+    expect(qappReticulumSessionPermissionKey(7, 'Example', 'ab'.repeat(16))).toBe(
+      `7\u0000Example\u0000${'ab'.repeat(16)}`
+    );
+  });
+});
diff --git a/src/qortal/qapp-identity.ts b/src/qortal/qapp-identity.ts
new file mode 100644
index 000000000..94eeabe6d
--- /dev/null
+++ b/src/qortal/qapp-identity.ts
@@ -0,0 +1,34 @@
+import i18n from 'i18next';
+
+export type QAppIdentityContext = {
+  name: string;
+  service: string;
+};
+
+export const normalizeQappIdentityContext = (
+  appInfo: unknown
+): QAppIdentityContext => {
+  const candidate = appInfo as Record<string, unknown> | null | undefined;
+  const name =
+    typeof candidate?.name === 'string'
+      ? candidate.name.trim().toLowerCase()
+      : '';
+  const service =
+    typeof candidate?.service === 'string'
+      ? candidate.service.trim().toUpperCase()
+      : '';
+  if (
+    !name ||
+    name.length > 128 ||
+    !/^[A-Z0-9_]{1,32}$/.test(service)
+  ) {
+    throw new Error(i18n.t('auth:message.error.invalid_qapp_identity_context'));
+  }
+  return { name, service };
+};
+
+export const qappReticulumSessionPermissionKey = (
+  tabId: string | number,
+  appName: string,
+  destination: string
+) => `${tabId}\u0000${appName}\u0000${destination}`;
diff --git a/src/qortal/qapp-moq-request.test.ts b/src/qortal/qapp-moq-request.test.ts
new file mode 100644
index 000000000..228386b0d
--- /dev/null
+++ b/src/qortal/qapp-moq-request.test.ts
@@ -0,0 +1,98 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { hasSessionPermission } = vi.hoisted(() => ({
+  hasSessionPermission: vi.fn(),
+}));
+
+vi.mock('./qortal-requests.ts', () => ({ hasSessionPermission }));
+
+import { dispatchQAppMoqRequest } from './qapp-moq-request';
+
+const context = { appName: ' Call-App ', appService: 'app', tabId: 42 };
+const owner = { name: 'call-app', service: 'APP', tabId: '42' };
+
+describe('Q-App MOQT request dispatch', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    hasSessionPermission.mockReturnValue(true);
+    Object.assign(window, {
+      electronAPI: {
+        qappMoqOpen: vi.fn().mockResolvedValue({ sessionId: 'qapp-moq-1' }),
+        qappMoqSubscribe: vi.fn().mockResolvedValue({ subscribed: true }),
+        qappMoqPublish: vi.fn().mockResolvedValue({ accepted: true }),
+        qappMoqMetrics: vi.fn().mockResolvedValue({ objectsSent: 1 }),
+        qappMoqClose: vi.fn().mockResolvedValue({ state: 'CLOSED' }),
+      },
+    });
+  });
+
+  it('requires private-data permission', async () => {
+    hasSessionPermission.mockReturnValue(false);
+    await expect(
+      dispatchQAppMoqRequest(
+        {
+          action: 'MOQ_SESSION_OPEN',
+          rnsConnectionId: 'rns-1',
+          publicationNamespace: ['qortal', 'call', 'room', 'Alice'],
+          publicationTrack: 'audio',
+        },
+        context
+      )
+    ).rejects.toMatchObject({ code: 'PERMISSION_DENIED' });
+    expect(window.electronAPI.qappMoqOpen).not.toHaveBeenCalled();
+  });
+
+  it('uses trusted normalized ownership and ignores network injection fields', async () => {
+    await dispatchQAppMoqRequest(
+      {
+        action: 'MOQ_SESSION_OPEN',
+        rnsConnectionId: 'rns-1',
+        publicationNamespace: ['qortal', 'call', 'room', 'Alice'],
+        publicationTrack: 'audio',
+        relayAddress: 'attacker.example:443',
+        backendAddress: 'attacker.example:4446',
+      },
+      context
+    );
+    expect(window.electronAPI.qappMoqOpen).toHaveBeenCalledWith(
+      owner,
+      'rns-1',
+      ['qortal', 'call', 'room', 'Alice'],
+      'audio'
+    );
+  });
+
+  it('forwards only logical handles, tracks, and opaque payloads', async () => {
+    const payload = new Uint8Array([1, 2]);
+    await dispatchQAppMoqRequest(
+      {
+        action: 'MOQ_TRACK_SUBSCRIBE',
+        sessionId: 'qapp-moq-1',
+        subscriptionId: 'peer-Alice',
+        namespace: ['qortal', 'call', 'room', 'Alice'],
+        trackName: 'audio',
+      },
+      context
+    );
+    await dispatchQAppMoqRequest(
+      {
+        action: 'MOQ_OBJECT_PUBLISH',
+        sessionId: 'qapp-moq-1',
+        payload,
+      },
+      context
+    );
+    expect(window.electronAPI.qappMoqSubscribe).toHaveBeenCalledWith(
+      owner,
+      'qapp-moq-1',
+      'peer-Alice',
+      ['qortal', 'call', 'room', 'Alice'],
+      'audio'
+    );
+    expect(window.electronAPI.qappMoqPublish).toHaveBeenCalledWith(
+      owner,
+      'qapp-moq-1',
+      payload
+    );
+  });
+});
diff --git a/src/qortal/qapp-moq-request.ts b/src/qortal/qapp-moq-request.ts
new file mode 100644
index 000000000..2987e1b3c
--- /dev/null
+++ b/src/qortal/qapp-moq-request.ts
@@ -0,0 +1,102 @@
+import { normalizeQappIdentityContext } from './qapp-identity.ts';
+import { codedQortalRequestError } from './qortal-request-errors.ts';
+import { hasSessionPermission } from './qortal-requests.ts';
+
+const QAPP_MOQ_ACTIONS = new Set([
+  'MOQ_SESSION_OPEN',
+  'MOQ_TRACK_SUBSCRIBE',
+  'MOQ_OBJECT_PUBLISH',
+  'MOQ_SESSION_METRICS',
+  'MOQ_SESSION_CLOSE',
+]);
+
+type QAppMoqContext = {
+  appName: string;
+  appService?: string;
+  tabId: string | number;
+};
+
+type QAppMoqMessage = {
+  action?: string;
+  rnsConnectionId?: unknown;
+  sessionId?: unknown;
+  publicationNamespace?: unknown;
+  publicationTrack?: unknown;
+  subscriptionId?: unknown;
+  namespace?: unknown;
+  trackName?: unknown;
+  payload?: unknown;
+  [key: string]: unknown;
+};
+
+export function isQAppMoqAction(action: unknown): action is string {
+  return typeof action === 'string' && QAPP_MOQ_ACTIONS.has(action);
+}
+
+export async function dispatchQAppMoqRequest(
+  message: QAppMoqMessage,
+  context: QAppMoqContext
+) {
+  if (!isQAppMoqAction(message.action)) {
+    throw codedQortalRequestError('INVALID_ACTION', 'Invalid MOQT action');
+  }
+  if (
+    !hasSessionPermission(
+      context.tabId,
+      context.appName,
+      'PRIVATE_DATA_CHANNEL'
+    )
+  ) {
+    throw codedQortalRequestError(
+      'PERMISSION_DENIED',
+      'Private data channel permission is required'
+    );
+  }
+  const api = window.electronAPI;
+  if (!api) unavailable();
+  const identity = normalizeQappIdentityContext({
+    name: context.appName,
+    service: context.appService,
+  });
+  const owner = {
+    tabId: String(context.tabId),
+    name: identity.name,
+    service: identity.service,
+  };
+
+  switch (message.action) {
+    case 'MOQ_SESSION_OPEN':
+      if (!api.qappMoqOpen) unavailable();
+      return api.qappMoqOpen(
+        owner,
+        message.rnsConnectionId,
+        message.publicationNamespace,
+        message.publicationTrack
+      );
+    case 'MOQ_TRACK_SUBSCRIBE':
+      if (!api.qappMoqSubscribe) unavailable();
+      return api.qappMoqSubscribe(
+        owner,
+        message.sessionId,
+        message.subscriptionId,
+        message.namespace,
+        message.trackName
+      );
+    case 'MOQ_OBJECT_PUBLISH':
+      if (!api.qappMoqPublish) unavailable();
+      return api.qappMoqPublish(owner, message.sessionId, message.payload);
+    case 'MOQ_SESSION_METRICS':
+      if (!api.qappMoqMetrics) unavailable();
+      return api.qappMoqMetrics(owner, message.sessionId);
+    case 'MOQ_SESSION_CLOSE':
+      if (!api.qappMoqClose) unavailable();
+      return api.qappMoqClose(owner, message.sessionId);
+  }
+}
+
+function unavailable(): never {
+  throw codedQortalRequestError(
+    'MOQ_TRANSPORT_UNAVAILABLE',
+    'MOQT transport is unavailable'
+  );
+}
diff --git a/src/qortal/qapp-private-channel-request.test.ts b/src/qortal/qapp-private-channel-request.test.ts
new file mode 100644
index 000000000..ad5d5dd69
--- /dev/null
+++ b/src/qortal/qapp-private-channel-request.test.ts
@@ -0,0 +1,109 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { hasSessionPermission } = vi.hoisted(() => ({
+  hasSessionPermission: vi.fn(),
+}));
+
+vi.mock('./qortal-requests.ts', () => ({ hasSessionPermission }));
+
+import { dispatchQAppPrivateChannelRequest } from './qapp-private-channel-request';
+
+const context = {
+  appName: ' Example-App ',
+  appService: 'app',
+  tabId: 42,
+};
+const owner = { name: 'example-app', service: 'APP', tabId: '42' };
+
+describe('Q-App private channel request dispatch', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    hasSessionPermission.mockReturnValue(true);
+    Object.assign(window, {
+      electronAPI: {
+        privateChannelOpen: vi
+          .fn()
+          .mockResolvedValue({ channelId: 'private-1' }),
+        privateChannelSend: vi.fn().mockResolvedValue({ accepted: true }),
+        privateChannelStatus: vi.fn().mockResolvedValue({ state: 'OPEN' }),
+        privateChannelClose: vi.fn().mockResolvedValue({ state: 'CLOSED' }),
+      },
+    });
+  });
+
+  it('requires the explicit PRIVATE_DATA_CHANNEL session permission', async () => {
+    hasSessionPermission.mockReturnValue(false);
+    await expect(
+      dispatchQAppPrivateChannelRequest(
+        {
+          action: 'PRIVATE_CHANNEL_OPEN',
+          rnsConnectionId: 'rns-1',
+          purpose: 'game',
+        },
+        context
+      )
+    ).rejects.toMatchObject({ code: 'PERMISSION_DENIED' });
+    expect(window.electronAPI.privateChannelOpen).not.toHaveBeenCalled();
+  });
+
+  it('uses normalized trusted context and forwards no arbitrary network fields', async () => {
+    await dispatchQAppPrivateChannelRequest(
+      {
+        action: 'PRIVATE_CHANNEL_OPEN',
+        rnsConnectionId: 'rns-1',
+        purpose: 'game',
+        owner: { tabId: 'attacker' },
+        destination: 'attacker.example',
+        relay: '192.0.2.1',
+        port: 443,
+      },
+      context
+    );
+
+    expect(window.electronAPI.privateChannelOpen).toHaveBeenCalledWith(
+      owner,
+      'rns-1',
+      'game'
+    );
+  });
+
+  it('uses narrow methods for send, status, and close', async () => {
+    const data = new Uint8Array([1, 2]);
+    await dispatchQAppPrivateChannelRequest(
+      {
+        action: 'PRIVATE_CHANNEL_SEND',
+        channelId: 'private-1',
+        lane: 'reliable',
+        messageId: 'message-1',
+        data,
+        destination: 'ignored',
+      },
+      context
+    );
+    await dispatchQAppPrivateChannelRequest(
+      { action: 'PRIVATE_CHANNEL_STATUS', channelId: 'private-1' },
+      context
+    );
+    await dispatchQAppPrivateChannelRequest(
+      { action: 'PRIVATE_CHANNEL_CLOSE', channelId: 'private-1' },
+      context
+    );
+
+    expect(window.electronAPI.privateChannelSend).toHaveBeenCalledWith(
+      owner,
+      'private-1',
+      'reliable',
+      'message-1',
+      data,
+      undefined
+    );
+    expect(window.electronAPI.privateChannelStatus).toHaveBeenCalledWith(
+      owner,
+      'private-1'
+    );
+    expect(window.electronAPI.privateChannelClose).toHaveBeenCalledWith(
+      owner,
+      'private-1'
+    );
+  });
+});
diff --git a/src/qortal/qapp-private-channel-request.ts b/src/qortal/qapp-private-channel-request.ts
new file mode 100644
index 000000000..fe070c730
--- /dev/null
+++ b/src/qortal/qapp-private-channel-request.ts
@@ -0,0 +1,118 @@
+import { normalizeQappIdentityContext } from './qapp-identity.ts';
+import { codedQortalRequestError } from './qortal-request-errors.ts';
+import { hasSessionPermission } from './qortal-requests.ts';
+
+const QAPP_PRIVATE_CHANNEL_ACTIONS = new Set([
+  'PRIVATE_CHANNEL_OPEN',
+  'PRIVATE_CHANNEL_SEND',
+  'PRIVATE_CHANNEL_STATUS',
+  'PRIVATE_CHANNEL_CLOSE',
+]);
+
+type QAppPrivateChannelContext = {
+  appName: string;
+  appService?: string;
+  tabId: string | number;
+};
+
+type QAppPrivateChannelMessage = {
+  action?: string;
+  rnsConnectionId?: unknown;
+  purpose?: unknown;
+  channelId?: unknown;
+  lane?: unknown;
+  messageId?: unknown;
+  data?: unknown;
+  [key: string]: unknown;
+};
+
+export function isQAppPrivateChannelAction(action: unknown): action is string {
+  return typeof action === 'string' && QAPP_PRIVATE_CHANNEL_ACTIONS.has(action);
+}
+
+export async function dispatchQAppPrivateChannelRequest(
+  message: QAppPrivateChannelMessage,
+  context: QAppPrivateChannelContext
+) {
+  if (!isQAppPrivateChannelAction(message.action)) {
+    throw codedQortalRequestError(
+      'INVALID_ACTION',
+      'Invalid private channel action'
+    );
+  }
+  if (
+    !hasSessionPermission(
+      context.tabId,
+      context.appName,
+      'PRIVATE_DATA_CHANNEL'
+    )
+  ) {
+    throw codedQortalRequestError(
+      'PERMISSION_DENIED',
+      'Private data channel permission is required'
+    );
+  }
+
+  const api = window.electronAPI;
+  if (!api) {
+    throw codedQortalRequestError(
+      'PRIVATE_TRANSPORT_UNAVAILABLE',
+      'Private channel transport is unavailable'
+    );
+  }
+  const identity = normalizeQappIdentityContext({
+    name: context.appName,
+    service: context.appService,
+  });
+  const owner = {
+    tabId: String(context.tabId),
+    name: identity.name,
+    service: identity.service,
+  };
+
+  switch (message.action) {
+    case 'PRIVATE_CHANNEL_OPEN':
+      if (!api.privateChannelOpen) {
+        throw codedQortalRequestError(
+          'PRIVATE_TRANSPORT_UNAVAILABLE',
+          'Private channel transport is unavailable'
+        );
+      }
+      return api.privateChannelOpen(
+        owner,
+        message.rnsConnectionId,
+        message.purpose
+      );
+    case 'PRIVATE_CHANNEL_SEND':
+      if (!api.privateChannelSend) {
+        throw codedQortalRequestError(
+          'PRIVATE_TRANSPORT_UNAVAILABLE',
+          'Private channel transport is unavailable'
+        );
+      }
+      return api.privateChannelSend(
+        owner,
+        message.channelId,
+        message.lane,
+        message.messageId,
+        message.data,
+        message.streamOptions
+      );
+    case 'PRIVATE_CHANNEL_STATUS':
+      if (!api.privateChannelStatus) {
+        throw codedQortalRequestError(
+          'PRIVATE_TRANSPORT_UNAVAILABLE',
+          'Private channel transport is unavailable'
+        );
+      }
+      return api.privateChannelStatus(owner, message.channelId);
+    case 'PRIVATE_CHANNEL_CLOSE':
+      if (!api.privateChannelClose) {
+        throw codedQortalRequestError(
+          'PRIVATE_TRANSPORT_UNAVAILABLE',
+          'Private channel transport is unavailable'
+        );
+      }
+      return api.privateChannelClose(owner, message.channelId);
+  }
+}
diff --git a/src/qortal/qapp-reticulum-request.test.ts b/src/qortal/qapp-reticulum-request.test.ts
new file mode 100644
index 000000000..f63a56423
--- /dev/null
+++ b/src/qortal/qapp-reticulum-request.test.ts
@@ -0,0 +1,105 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { authorizeRnsDestination } = vi.hoisted(() => ({
+  authorizeRnsDestination: vi.fn(),
+}));
+
+vi.mock('./get.ts', () => ({ authorizeRnsDestination }));
+
+import { dispatchQAppReticulumRequest } from './qapp-reticulum-request';
+
+const destination = 'a'.repeat(32);
+const context = {
+  appName: 'ExampleApp',
+  appService: 'APP',
+  isFromExtension: true,
+  tabId: 42,
+};
+const owner = { name: 'exampleapp', service: 'APP', tabId: '42' };
+
+describe('dedicated Q-App Reticulum request dispatch', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    authorizeRnsDestination.mockResolvedValue(destination);
+    Object.assign(window, {
+      electronAPI: {
+        qappReticulumClose: vi.fn().mockResolvedValue(true),
+        qappReticulumConnect: vi
+          .fn()
+          .mockResolvedValue({ connectionId: 'connection', state: 'OPEN' }),
+        qappReticulumRequest: vi.fn().mockResolvedValue({ ok: true }),
+        qappReticulumSend: vi.fn().mockResolvedValue(true),
+      },
+      sendMessage: vi.fn(),
+    });
+  });
+
+  it('sends RPC directly to Electron without using the global message bus', async () => {
+    const message = {
+      action: 'RNS_REQUEST',
+      destination,
+      path: '/example/status',
+      payload: { requestId: 'request-1' },
+    };
+
+    await expect(
+      dispatchQAppReticulumRequest(message, context)
+    ).resolves.toEqual({ ok: true });
+
+    expect(authorizeRnsDestination).toHaveBeenCalledWith(destination, true, {
+      name: 'ExampleApp',
+      tabId: 42,
+    });
+    expect(window.electronAPI.qappReticulumRequest).toHaveBeenCalledWith(
+      owner,
+      message
+    );
+    expect(window.sendMessage).not.toHaveBeenCalled();
+  });
+
+  it('keeps realtime connections scoped to their Q-App owner', async () => {
+    await dispatchQAppReticulumRequest(
+      { action: 'RNS_CONNECT', destination },
+      context
+    );
+    await dispatchQAppReticulumRequest(
+      {
+        action: 'RNS_SEND',
+        connectionId: 'connection',
+        payload: { type: 'ping' },
+      },
+      context
+    );
+    await dispatchQAppReticulumRequest(
+      { action: 'RNS_CLOSE', connectionId: 'connection' },
+      context
+    );
+
+    expect(window.electronAPI.qappReticulumConnect).toHaveBeenCalledWith(
+      owner,
+      destination
+    );
+    expect(window.electronAPI.qappReticulumSend).toHaveBeenCalledWith(
+      owner,
+      'connection',
+      { type: 'ping' }
+    );
+    expect(window.electronAPI.qappReticulumClose).toHaveBeenCalledWith(
+      owner,
+      'connection'
+    );
+    expect(window.sendMessage).not.toHaveBeenCalled();
+  });
+
+  it('rejects malformed connection operations before native dispatch', async () => {
+    await expect(
+      dispatchQAppReticulumRequest(
+        { action: 'RNS_SEND', payload: 'message' },
+        context
+      )
+    ).rejects.toThrow('RNS_UNKNOWN_CONNECTION');
+
+    expect(window.electronAPI.qappReticulumSend).not.toHaveBeenCalled();
+    expect(window.sendMessage).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/qortal/qapp-reticulum-request.ts b/src/qortal/qapp-reticulum-request.ts
new file mode 100644
index 000000000..9d02edffd
--- /dev/null
+++ b/src/qortal/qapp-reticulum-request.ts
@@ -0,0 +1,96 @@
+import { authorizeRnsDestination } from './get.ts';
+import { normalizeQappIdentityContext } from './qapp-identity.ts';
+
+const QAPP_RETICULUM_ACTIONS = new Set([
+  'RNS_CLOSE',
+  'RNS_CONNECT',
+  'RNS_REQUEST',
+  'RNS_SEND',
+]);
+
+type QAppReticulumContext = {
+  appName: string;
+  appService?: string;
+  isFromExtension: boolean;
+  tabId: string | number;
+};
+
+type QAppReticulumMessage = {
+  action?: string;
+  connectionId?: string;
+  destination?: string;
+  payload?: unknown;
+  [key: string]: unknown;
+};
+
+export function isQAppReticulumAction(action: unknown): action is string {
+  return typeof action === 'string' && QAPP_RETICULUM_ACTIONS.has(action);
+}
+
+/**
+ * Dispatches native Q-App Reticulum operations without putting them on the
+ * Hub-wide backgroundMessage bus. That bus is shared by unrelated Hub
+ * features and is the wrong isolation boundary for a per-Q-App transport.
+ */
+export async function dispatchQAppReticulumRequest(
+  message: QAppReticulumMessage,
+  context: QAppReticulumContext
+) {
+  if (!isQAppReticulumAction(message.action)) {
+    throw new Error('RNS_PROTOCOL_ERROR');
+  }
+
+  const api = window.electronAPI;
+  if (!api) throw new Error('RNS_NATIVE_TRANSPORT_UNAVAILABLE');
+
+  const identity = normalizeQappIdentityContext({
+    name: context.appName,
+    service: context.appService,
+  });
+  const owner = {
+    tabId: String(context.tabId),
+    name: identity.name,
+    service: identity.service,
+  };
+  const appInfo = { tabId: context.tabId, name: context.appName };
+
+  if (message.action === 'RNS_REQUEST') {
+    if (!api.qappReticulumRequest)
+      throw new Error('RNS_NATIVE_TRANSPORT_UNAVAILABLE');
+    if (typeof message.destination !== 'string')
+      throw new Error('RNS_DESTINATION_UNREACHABLE');
+    const destination = await authorizeRnsDestination(
+      message.destination,
+      context.isFromExtension,
+      appInfo
+    );
+    return api.qappReticulumRequest(owner, { ...message, destination });
+  }
+
+  if (message.action === 'RNS_CONNECT') {
+    if (!api.qappReticulumConnect)
+      throw new Error('RNS_NATIVE_TRANSPORT_UNAVAILABLE');
+    if (typeof message.destination !== 'string')
+      throw new Error('RNS_DESTINATION_UNREACHABLE');
+    const destination = await authorizeRnsDestination(
+      message.destination,
+      context.isFromExtension,
+      appInfo
+    );
+    return api.qappReticulumConnect(owner, destination);
+  }
+
+  if (message.action === 'RNS_SEND') {
+    if (!api.qappReticulumSend)
+      throw new Error('RNS_NATIVE_TRANSPORT_UNAVAILABLE');
+    if (typeof message.connectionId !== 'string' || !message.connectionId)
+      throw new Error('RNS_UNKNOWN_CONNECTION');
+    return api.qappReticulumSend(owner, message.connectionId, message.payload);
+  }
+
+  if (!api.qappReticulumClose)
+    throw new Error('RNS_NATIVE_TRANSPORT_UNAVAILABLE');
+  if (typeof message.connectionId !== 'string' || !message.connectionId)
+    throw new Error('RNS_UNKNOWN_CONNECTION');
+  return api.qappReticulumClose(owner, message.connectionId);
+}
diff --git a/src/qortal/qapp-screen-capture-request.ts b/src/qortal/qapp-screen-capture-request.ts
new file mode 100644
index 000000000..000bedb1c
--- /dev/null
+++ b/src/qortal/qapp-screen-capture-request.ts
@@ -0,0 +1,22 @@
+export async function dispatchQAppScreenCaptureRequest(
+  message: Record<string, unknown>
+) {
+  if (
+    message.action !== 'SCREEN_CAPTURE_SELECT' ||
+    typeof message.requestId !== 'string' ||
+    !/^[0-9a-f-]{36}$/.test(message.requestId) ||
+    (message.sourceId !== undefined &&
+      (typeof message.sourceId !== 'string' || message.sourceId.length > 256))
+  ) {
+    throw new Error('INVALID_SCREEN_CAPTURE_REQUEST');
+  }
+  if (!window.electronAPI?.selectDisplayMedia)
+    throw new Error('SCREEN_CAPTURE_UNSUPPORTED');
+  // An unguessable, short-lived capability is delivered directly to the requesting
+  // native frame. Main revalidates that frame and the approved source list.
+  window.electronAPI.selectDisplayMedia(
+    message.requestId,
+    message.sourceId as string | undefined
+  );
+  return { accepted: true };
+}
diff --git a/src/qortal/qortal-request-errors.test.ts b/src/qortal/qortal-request-errors.test.ts
new file mode 100644
index 000000000..7662ba611
--- /dev/null
+++ b/src/qortal/qortal-request-errors.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest';
+import {
+  codedQortalRequestError,
+  serializeQortalRequestError,
+  USER_DECLINED_REQUEST_CODE,
+} from './qortal-request-errors';
+
+describe('Q-App request errors', () => {
+  it('preserves a stable code separately from its localized message', () => {
+    const error = codedQortalRequestError(
+      USER_DECLINED_REQUEST_CODE,
+      'Localized decline message'
+    );
+
+    expect(serializeQortalRequestError(error)).toEqual({
+      error: USER_DECLINED_REQUEST_CODE,
+      code: USER_DECLINED_REQUEST_CODE,
+      message: 'Localized decline message',
+    });
+  });
+
+  it('keeps uncoded failures backward compatible', () => {
+    expect(
+      serializeQortalRequestError(new Error('Network unavailable'))
+    ).toEqual({
+      error: 'Network unavailable',
+      message: 'Network unavailable',
+    });
+  });
+});
diff --git a/src/qortal/qortal-request-errors.ts b/src/qortal/qortal-request-errors.ts
new file mode 100644
index 000000000..16842a6ab
--- /dev/null
+++ b/src/qortal/qortal-request-errors.ts
@@ -0,0 +1,34 @@
+export const USER_DECLINED_REQUEST_CODE = 'USER_DECLINED';
+
+type CodedError = Error & { code?: string };
+
+export function codedQortalRequestError(
+  code: string,
+  message: string
+): CodedError {
+  const error = new Error(message) as CodedError;
+  error.code = code;
+  return error;
+}
+
+export function serializeQortalRequestError(error: unknown): {
+  error: string;
+  code?: string;
+  message: string;
+} {
+  const candidate =
+    typeof error === 'object' && error !== null
+      ? (error as { code?: unknown; message?: unknown })
+      : undefined;
+  const code =
+    typeof candidate?.code === 'string' && candidate.code
+      ? candidate.code
+      : undefined;
+  const message =
+    typeof candidate?.message === 'string' && candidate.message
+      ? candidate.message
+      : typeof error === 'string' && error
+        ? error
+        : 'Request failed';
+  return { error: code ?? message, ...(code ? { code } : {}), message };
+}
diff --git a/src/qortal/qortal-requests.ts b/src/qortal/qortal-requests.ts
index 2ca26a3d7..0366e69a9 100644
--- a/src/qortal/qortal-requests.ts
+++ b/src/qortal/qortal-requests.ts
@@ -71,6 +71,7 @@ import {
   sellNameRequest,
   cancelSellNameRequest,
   signForeignFees,
+  signQappIdentityProof,
   multiPaymentWithPrivateData,
   transferAssetRequest,
   reEncryptQortalKeys,
@@ -83,7 +84,9 @@ import {
   markNotificationSeenInApp,
   notificationHasPermission,
   removeNotificationSubscriptions,
+  clearRnsDestinationPermissionsByTabId,
 } from './get.ts';
+import { serializeQortalRequestError } from './qortal-request-errors.ts';
 import { triggerMemberGroupsFetch } from '../subscriptions/useInitializeMySubscriptions.ts';
 import { getData, storeData } from '../utils/chromeStorage.ts';
 import { executeEvent } from '../utils/events.ts';
@@ -411,12 +414,15 @@ export const VALID_SESSION_PERMISSIONS = [
   'REENCRYPT_GROUP_KEYS',
   'START_CROSSCHAIN_SERVER',
   'NOTIFICATION_PERMISSION',
+  'PRIVATE_DATA_CHANNEL',
 ];
 
-// Permissions automatically granted for the session when GET_USER_ACCOUNT is accepted
-// These are read-only, low-risk permissions
+// Permissions automatically granted for the same Q-App tab session when
+// GET_USER_ACCOUNT is accepted. LOCK_TAB is a reversible, tab-scoped UI
+// safeguard and therefore does not need a second prompt after authentication.
 export const AUTO_GRANTED_PERMISSIONS_ON_AUTH = [
   'GET_USER_ACCOUNT',
+  'LOCK_TAB',
   'GET_USER_WALLET',
   'GET_WALLET_BALANCE',
   'GET_USER_WALLET_INFO',
@@ -535,6 +541,7 @@ export function clearSessionPermissionsByTabId(tabId) {
       }
     }
     keysToDelete.forEach((key) => sessionPermissionsStore.delete(key));
+    clearRnsDestinationPermissionsByTabId(tabId);
 
     // Also cleanup any encrypted media associated with this tab
     cleanupEncryptedMediaByTabId(tabId).catch((error) => {
@@ -596,6 +603,35 @@ function setupMessageListenerQortalRequest() {
         }
         break;
       }
+      case 'SIGN_QAPP_IDENTITY': {
+        try {
+          const res = await signQappIdentityProof(
+            request.payload,
+            isFromExtension,
+            appInfo
+          );
+          event.source!.postMessage(
+            {
+              requestId: request.requestId,
+              action: request.action,
+              payload: res,
+              type: 'backgroundMessageResponse',
+            },
+            event.origin
+          );
+        } catch (error) {
+          event.source!.postMessage(
+            {
+              requestId: request.requestId,
+              action: request.action,
+              error: error?.message || 'Unable to sign Q-App identity proof',
+              type: 'backgroundMessageResponse',
+            },
+            event.origin
+          );
+        }
+        break;
+      }
 
       case 'NOTIFICATION_PERMISSION': {
         try {
@@ -1538,11 +1574,12 @@ function setupMessageListenerQortalRequest() {
             event.origin
           );
         } catch (error) {
+          const serializedError = serializeQortalRequestError(error);
           event.source.postMessage(
             {
               requestId: request.requestId,
               action: request.action,
-              error: error.message,
+              ...serializedError,
               type: 'backgroundMessageResponse',
             },
             event.origin
diff --git a/src/qortal/wallet-response.test.ts b/src/qortal/wallet-response.test.ts
new file mode 100644
index 000000000..20b835cb8
--- /dev/null
+++ b/src/qortal/wallet-response.test.ts
@@ -0,0 +1,29 @@
+import { expect, it, vi } from 'vitest';
+import { readBoundedWalletResponse } from './wallet-response';
+
+it('decodes UTF-8 across chunk boundaries', async () => {
+  const bytes = new TextEncoder().encode('€');
+  const body = new ReadableStream({
+    start(controller) {
+      controller.enqueue(bytes.slice(0, 1));
+      controller.enqueue(bytes.slice(1));
+      controller.close();
+    },
+  });
+  expect(await readBoundedWalletResponse(new Response(body), 3)).toBe('€');
+});
+
+it('cancels an oversized stream without relying on Content-Length', async () => {
+  const cancel = vi.fn();
+  const body = new ReadableStream({
+    start(controller) {
+      controller.enqueue(new Uint8Array(5));
+    },
+    cancel,
+  });
+  await expect(
+    readBoundedWalletResponse(new Response(body), 4)
+  ).rejects.toThrow();
+  expect(cancel).toHaveBeenCalledOnce();
+  expect(body.locked).toBe(false);
+});
diff --git a/src/qortal/wallet-response.ts b/src/qortal/wallet-response.ts
new file mode 100644
index 000000000..bcf67f2f4
--- /dev/null
+++ b/src/qortal/wallet-response.ts
@@ -0,0 +1,31 @@
+/** Bound untrusted node responses even when Content-Length is absent. */
+export async function readBoundedWalletResponse(
+  response: Response,
+  maximumBytes: number
+): Promise<string> {
+  const reader = response.body?.getReader();
+  if (!reader) throw new Error('Invalid wallet response');
+  const chunks: Uint8Array[] = [];
+  let length = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      length += value.length;
+      if (length > maximumBytes) {
+        await reader.cancel();
+        throw new Error('Wallet response too large');
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return new TextDecoder().decode(bytes);
+}
diff --git a/src/subscriptions/useSubscriptionsFromManagedGroups.ts b/src/subscriptions/useSubscriptionsFromManagedGroups.ts
index 072e9cd9d..643db1b87 100644
--- a/src/subscriptions/useSubscriptionsFromManagedGroups.ts
+++ b/src/subscriptions/useSubscriptionsFromManagedGroups.ts
@@ -21,6 +21,16 @@ export type ManagedSubscriptionEntry = {
   url: string;
 };
 
+const MANAGED_SUBSCRIPTIONS_CACHE_MS = 5 * 60 * 1000;
+const managedSubscriptionsCache = new Map<
+  string,
+  { expiresAt: number; value: ManagedSubscriptionEntry[] }
+>();
+const managedSubscriptionsInFlight = new Map<
+  string,
+  Promise<ManagedSubscriptionEntry[]>
+>();
+
 export async function getGroupMembers(groupNumber: number) {
   const response = await fetch(
     `${getBaseApiReact()}/groups/members/${groupNumber}?limit=0`
@@ -69,149 +79,183 @@ export function useManagedSubscriptionsFromGroups(
       if (!hasLoadedOnce.current) setLoading(true);
       setError(null);
 
-      try {
-        const results = await Promise.all(
-          groups
-            .filter((group) => group.owner === address)
-            .map(async (group): Promise<ManagedSubscriptionEntry | null> => {
-              try {
-                const subscriptionId = getSubscriptionIdForGroup(group.groupId);
-                const { detailsIdentifier, indexIdentifier } =
-                  await buildSubscriptionIdentifiers(subscriptionId);
-                const baseIdentifierPrefix = indexIdentifier.replace(
-                  /-v\d+$/,
-                  ''
-                );
-
-                const matchesResponse = await fetch(
-                  `${getBaseApiReact()}/arbitrary/resources/search?mode=ALL&service=DOCUMENT&identifier=${baseIdentifierPrefix}&exactmatchnames=true&limit=1&prefix=true&reverse=true&name=${name}`
-                );
-                if (!matchesResponse.ok) return null;
-                const matches = await matchesResponse.json();
-                const latestIdentifier = matches?.[0]?.identifier;
-                if (!latestIdentifier || !/-v\d+$/.test(latestIdentifier)) {
-                  return null;
-                }
+      const cacheKey = JSON.stringify({
+        address,
+        name,
+        groups: groups
+          .filter((group) => group.owner === address)
+          .map((group) => group.groupId)
+          .sort((left, right) => left - right),
+      });
+      const cached = managedSubscriptionsCache.get(cacheKey);
+      if (cached && cached.expiresAt > Date.now()) {
+        setManagedSubscriptions(cached.value);
+        hasLoadedOnce.current = true;
+        setLoading(false);
+        return;
+      }
 
-                let validJoinRequestCount = 0;
-                const joinResponse = await fetch(
-                  `${getBaseApiReact()}/groups/joinrequests/${group.groupId}`
-                );
-                if (joinResponse.ok) {
-                  const joinRequests = await joinResponse.json();
-                  const validations = await Promise.all(
-                    (Array.isArray(joinRequests) ? joinRequests : []).map(
-                      async (request) => {
-                        try {
-                          const nameResponse = await fetch(
-                            `${getBaseApiReact()}/names/primary/${request.joiner}`
-                          );
-                          if (!nameResponse.ok) return false;
-                          const primaryName = (await nameResponse.json())?.name;
-                          if (!primaryName) return false;
+      try {
+        let request = managedSubscriptionsInFlight.get(cacheKey);
+        if (!request) {
+          request = Promise.all(
+            groups
+              .filter((group) => group.owner === address)
+              .map(async (group): Promise<ManagedSubscriptionEntry | null> => {
+                try {
+                  const subscriptionId = getSubscriptionIdForGroup(
+                    group.groupId
+                  );
+                  const { detailsIdentifier, indexIdentifier } =
+                    await buildSubscriptionIdentifiers(subscriptionId);
+                  const baseIdentifierPrefix = indexIdentifier.replace(
+                    /-v\d+$/,
+                    ''
+                  );
 
-                          const resourceResponse = await fetch(
-                            `${getBaseApiReact()}/arbitrary/resources/search?mode=ALL&service=PRODUCT&identifier=${detailsIdentifier}&exactmatchnames=true&limit=1&prefix=true&reverse=true&name=${primaryName}`
-                          );
-                          const resources = await resourceResponse.json();
-                          return resourceResponse.ok && resources.length > 0;
-                        } catch {
-                          return false;
-                        }
-                      }
-                    )
+                  const matchesResponse = await fetch(
+                    `${getBaseApiReact()}/arbitrary/resources/search?mode=ALL&service=DOCUMENT&identifier=${baseIdentifierPrefix}&exactmatchnames=true&limit=1&prefix=true&reverse=true&name=${name}`
                   );
-                  validJoinRequestCount = validations.filter(Boolean).length;
-                }
+                  if (!matchesResponse.ok) return null;
+                  const matches = await matchesResponse.json();
+                  const latestIdentifier = matches?.[0]?.identifier;
+                  if (!latestIdentifier || !/-v\d+$/.test(latestIdentifier)) {
+                    return null;
+                  }
 
-                let needsReEncryption = false;
-                try {
-                  const memberData = await getGroupMembers(group.groupId);
-                  const { names: adminNames } = await getGroupAdmins(
-                    group.groupId
+                  let validJoinRequestCount = 0;
+                  const joinResponse = await fetch(
+                    `${getBaseApiReact()}/groups/joinrequests/${group.groupId}`
                   );
+                  if (joinResponse.ok) {
+                    const joinRequests = await joinResponse.json();
+                    const validations = await Promise.all(
+                      (Array.isArray(joinRequests) ? joinRequests : []).map(
+                        async (request) => {
+                          try {
+                            const nameResponse = await fetch(
+                              `${getBaseApiReact()}/names/primary/${request.joiner}`
+                            );
+                            if (!nameResponse.ok) return false;
+                            const primaryName = (await nameResponse.json())
+                              ?.name;
+                            if (!primaryName) return false;
 
-                  if (adminNames.length > 0) {
-                    const queryString = adminNames
-                      .map(
-                        (adminName) => `name=${encodeURIComponent(adminName)}`
+                            const resourceResponse = await fetch(
+                              `${getBaseApiReact()}/arbitrary/resources/search?mode=ALL&service=PRODUCT&identifier=${detailsIdentifier}&exactmatchnames=true&limit=1&prefix=true&reverse=true&name=${primaryName}`
+                            );
+                            const resources = await resourceResponse.json();
+                            return resourceResponse.ok && resources.length > 0;
+                          } catch {
+                            return false;
+                          }
+                        }
                       )
-                      .join('&');
-                    const resourcesResponse = await fetch(
-                      `${getBaseApiReact()}/arbitrary/resources/searchsimple?mode=ALL&service=DOCUMENT_PRIVATE&identifier=symmetric-qchat-group-${group.groupId}&exactmatchnames=true&limit=0&reverse=true&${queryString}&prefix=true`
+                    );
+                    validJoinRequestCount = validations.filter(Boolean).length;
+                  }
+
+                  let needsReEncryption = false;
+                  try {
+                    const memberData = await getGroupMembers(group.groupId);
+                    const { names: adminNames } = await getGroupAdmins(
+                      group.groupId
                     );
 
-                    if (!resourcesResponse.ok) {
-                      needsReEncryption = true;
-                    } else {
-                      const resources = await resourcesResponse.json();
-                      const matchingResources = resources.filter(
-                        (resource: any) =>
-                          resource.identifier ===
-                          `symmetric-qchat-group-${group.groupId}`
+                    if (adminNames.length > 0) {
+                      const queryString = adminNames
+                        .map(
+                          (adminName) => `name=${encodeURIComponent(adminName)}`
+                        )
+                        .join('&');
+                      const resourcesResponse = await fetch(
+                        `${getBaseApiReact()}/arbitrary/resources/searchsimple?mode=ALL&service=DOCUMENT_PRIVATE&identifier=symmetric-qchat-group-${group.groupId}&exactmatchnames=true&limit=0&reverse=true&${queryString}&prefix=true`
                       );
 
-                      if (!matchingResources.length) {
+                      if (!resourcesResponse.ok) {
                         needsReEncryption = true;
                       } else {
-                        const latestResource = matchingResources.sort(
-                          (left: any, right: any) => {
-                            const leftDate = left.updated
-                              ? new Date(left.updated)
-                              : new Date(left.created);
-                            const rightDate = right.updated
-                              ? new Date(right.updated)
-                              : new Date(right.created);
-                            return rightDate.getTime() - leftDate.getTime();
-                          }
-                        )[0];
-
-                        const encryptedResponse = await fetch(
-                          `${getBaseApiReact()}/arbitrary/DOCUMENT_PRIVATE/${latestResource.name}/${latestResource.identifier}?encoding=base64`
+                        const resources = await resourcesResponse.json();
+                        const matchingResources = resources.filter(
+                          (resource: any) =>
+                            resource.identifier ===
+                            `symmetric-qchat-group-${group.groupId}`
                         );
-                        const encryptedData = await encryptedResponse.text();
-                        const combined = base64ToUint8Array(encryptedData);
-                        const countStart = combined.length - 4;
-                        const countArray = combined.slice(
-                          countStart,
-                          countStart + 4
-                        );
-                        const count = new Uint32Array(countArray.buffer)[0];
 
-                        if (count !== memberData?.memberCount) {
+                        if (!matchingResources.length) {
                           needsReEncryption = true;
+                        } else {
+                          const latestResource = matchingResources.sort(
+                            (left: any, right: any) => {
+                              const leftDate = left.updated
+                                ? new Date(left.updated)
+                                : new Date(left.created);
+                              const rightDate = right.updated
+                                ? new Date(right.updated)
+                                : new Date(right.created);
+                              return rightDate.getTime() - leftDate.getTime();
+                            }
+                          )[0];
+
+                          const encryptedResponse = await fetch(
+                            `${getBaseApiReact()}/arbitrary/DOCUMENT_PRIVATE/${latestResource.name}/${latestResource.identifier}?encoding=base64`
+                          );
+                          const encryptedData = await encryptedResponse.text();
+                          const combined = base64ToUint8Array(encryptedData);
+                          const countStart = combined.length - 4;
+                          const countArray = combined.slice(
+                            countStart,
+                            countStart + 4
+                          );
+                          const count = new Uint32Array(countArray.buffer)[0];
+
+                          if (count !== memberData?.memberCount) {
+                            needsReEncryption = true;
+                          }
                         }
                       }
                     }
+                  } catch {
+                    // Network failures should not create false positive actions.
                   }
-                } catch {
-                  // Network failures should not create false positive actions.
-                }
 
-                const actions = {
-                  groupId: group.groupId,
-                  pendingJoinRequests: validJoinRequestCount,
-                  needsReEncryption,
-                  totalActions:
-                    validJoinRequestCount + (needsReEncryption ? 1 : 0),
-                };
-
-                return {
-                  group,
-                  groupId: group.groupId,
-                  actions,
-                  url: `manage/${group.groupId}`,
-                };
-              } catch {
-                return null;
-              }
-            })
-        );
+                  const actions = {
+                    groupId: group.groupId,
+                    pendingJoinRequests: validJoinRequestCount,
+                    needsReEncryption,
+                    totalActions:
+                      validJoinRequestCount + (needsReEncryption ? 1 : 0),
+                  };
 
-        if (!cancelled) {
-          setManagedSubscriptions(
-            results.filter(Boolean) as ManagedSubscriptionEntry[]
+                  return {
+                    group,
+                    groupId: group.groupId,
+                    actions,
+                    url: `manage/${group.groupId}`,
+                  };
+                } catch {
+                  return null;
+                }
+              })
+          ).then(
+            (results) => results.filter(Boolean) as ManagedSubscriptionEntry[]
           );
+          managedSubscriptionsInFlight.set(cacheKey, request);
+        }
+        let results: ManagedSubscriptionEntry[];
+        try {
+          results = await request;
+        } finally {
+          if (managedSubscriptionsInFlight.get(cacheKey) === request) {
+            managedSubscriptionsInFlight.delete(cacheKey);
+          }
+        }
+        managedSubscriptionsCache.set(cacheKey, {
+          expiresAt: Date.now() + MANAGED_SUBSCRIPTIONS_CACHE_MS,
+          value: results,
+        });
+        if (!cancelled) {
+          setManagedSubscriptions(results);
           hasLoadedOnce.current = true;
         }
       } catch (event: any) {
diff --git a/src/test/mocks/electron.ts b/src/test/mocks/electron.ts
index dc06729bb..25df0eccd 100644
--- a/src/test/mocks/electron.ts
+++ b/src/test/mocks/electron.ts
@@ -17,12 +17,21 @@ export const dialog = {
 };
 
 export const ipcMain = {
+  removeListener: () => undefined,
   handle: () => undefined,
   on: () => undefined,
   removeAllListeners: () => undefined,
   removeHandler: () => undefined,
 };
 
+export const systemPreferences = {
+  getMediaAccessStatus: (_type: string) => 'granted',
+};
+
+export const desktopCapturer = {
+  getSources: async (_options?: unknown): Promise<unknown[]> => [],
+};
+
 export const ipcRenderer = {
   invoke: async () => undefined,
   on: () => undefined,
@@ -37,4 +46,3 @@ export const contextBridge = {
 export const shell = {
   openExternal: async () => undefined,
 };
-
diff --git a/src/types/window.d.ts b/src/types/window.d.ts
index d50ed2577..ae59d349b 100644
--- a/src/types/window.d.ts
+++ b/src/types/window.d.ts
@@ -84,6 +84,25 @@ declare global {
       isExtension?: unknown,
       appInfo?: unknown
     ) => Promise<unknown>;
+    foreignWalletSigner?: {
+      importKeys: (
+        keys: Record<string, unknown>
+      ) => Promise<Record<string, string>>;
+      publicKey: (coin: string) => Promise<string>;
+      clear: () => Promise<void>;
+      sign: (
+        request: import('../lib/foreign-wallet/desktop-engine').DesktopSignRequest,
+        language: string
+      ) => Promise<{
+        signed?: import('../lib/foreign-wallet/foreign-wallet-transaction').ForeignWalletSignedTransaction;
+        error?: 'invalid' | 'changed' | 'declined' | 'pending';
+      }>;
+    };
+    foreignWalletJournal?: {
+      get: (key: string) => Promise<string | null>;
+      set: (key: string, value: string) => Promise<void>;
+      delete: (key: string, txId: string) => Promise<void>;
+    };
     appStorage?: {
       get: (key: string) => Promise<unknown>;
       set: (key: string, value: unknown) => Promise<void>;
@@ -130,6 +149,10 @@ declare global {
       ) => () => void;
       onSystemLockRequested?: (callback: () => void) => () => void;
       getPlatform?: () => Promise<string>;
+      onDisplayMediaRequest?: (callback: (request: { requestId: string; origin: string }) => void) => () => void;
+      onDisplayMediaCancel?: (callback: (requestId: string) => void) => () => void;
+      selectDisplayMedia?: (requestId: string, sourceId?: string) => void;
+      authorizeDisplayMedia?: (requestId: string, accepted: boolean) => void;
       listScreenShareSources?: () => Promise<{
         success: boolean;
         error?: string;
@@ -348,6 +371,67 @@ declare global {
       reticulumGetLocalIdentityPublicKeyBase64?: () => Promise<{
         publicKeyBase64: string | null;
       }>;
+      qappReticulumRequest?: (owner: any, options: any) => Promise<any>;
+      qappReticulumConnect?: (owner: any, destination: string) => Promise<any>;
+      qappReticulumSend?: (
+        owner: any,
+        connectionId: string,
+        payload: unknown
+      ) => Promise<any>;
+      qappReticulumClose?: (
+        owner: any,
+        connectionId: string
+      ) => Promise<boolean>;
+      qappReticulumCleanupOwner?: (owner: any) => Promise<boolean>;
+      qappGuestPrepare?: (
+        owner: { tabId: string; name: string; service: string },
+        url: string,
+        isDevMode: boolean
+      ) => Promise<{ partition: string; preload: string }>;
+      qappGuestRelease?: (
+        owner: { tabId: string; name: string; service: string }
+      ) => Promise<boolean>;
+      onQAppReticulumEvent?: (callback: (payload: any) => void) => () => void;
+      qappFileSave?: (owner: any, request: any) => Promise<any>;
+      privateChannelOpen?: (
+        owner: any,
+        rnsConnectionId: unknown,
+        purpose: unknown
+      ) => Promise<any>;
+      privateChannelSend?: (
+        owner: any,
+        channelId: unknown,
+        lane: unknown,
+        messageId: unknown,
+        data: unknown,
+        streamOptions?: unknown
+      ) => Promise<any>;
+      privateChannelStatus?: (owner: any, channelId: unknown) => Promise<any>;
+      privateChannelClose?: (owner: any, channelId: unknown) => Promise<any>;
+      privateChannelCleanupOwner?: (owner: any) => Promise<boolean>;
+      onPrivateChannelEvent?: (callback: (payload: any) => void) => () => void;
+      qappMoqOpen?: (
+        owner: any,
+        rnsConnectionId: unknown,
+        publicationNamespace: unknown,
+        publicationTrack: unknown
+      ) => Promise<any>;
+      qappMoqSubscribe?: (
+        owner: any,
+        sessionId: unknown,
+        subscriptionId: unknown,
+        namespace: unknown,
+        trackName: unknown
+      ) => Promise<any>;
+      qappMoqPublish?: (
+        owner: any,
+        sessionId: unknown,
+        payload: unknown
+      ) => Promise<any>;
+      qappMoqMetrics?: (owner: any, sessionId: unknown) => Promise<any>;
+      qappMoqClose?: (owner: any, sessionId: unknown) => Promise<any>;
+      qappMoqCleanupOwner?: (owner: any) => Promise<any>;
+      onQAppMoqEvent?: (callback: (payload: any) => void) => () => void;
       /** Hidden audio-surface: proxy signing to the main shell (wallet key in-memory). */
       gcallProxySignPresenceMessage?: (
         payload: Record<string, unknown>
diff --git a/src/utils/chromeStorage.foreign-wallet.test.ts b/src/utils/chromeStorage.foreign-wallet.test.ts
new file mode 100644
index 000000000..dc7d7574b
--- /dev/null
+++ b/src/utils/chromeStorage.foreign-wallet.test.ts
@@ -0,0 +1,92 @@
+import { beforeEach, afterEach, it, expect, vi } from 'vitest';
+import { webcrypto } from 'node:crypto';
+import { SecureStoragePlugin } from '@evva/capacitor-secure-storage-plugin';
+import { storeData, getData, removeKeysAndLogout } from './chromeStorage';
+const storage = new Map<string, string>();
+const privateKeys = Object.fromEntries(
+  ['btc', 'ltc', 'doge', 'dgb', 'rvn'].map((c) => [
+    `${c}PrivateKey`,
+    `${c}-secret`,
+  ])
+);
+const publicKeys = Object.fromEntries(
+  ['BTC', 'LTC', 'DOGE', 'DGB', 'RVN'].map((c) => [c, `${c}-public`])
+);
+beforeEach(() => {
+  // Node WebCrypto rejects jsdom's cross-realm ArrayBuffer; retain real AES-GCM
+  // while normalizing that one boundary to a native Buffer.
+  vi.stubGlobal('crypto', {
+    getRandomValues: webcrypto.getRandomValues.bind(webcrypto),
+    subtle: {
+      generateKey: webcrypto.subtle.generateKey.bind(webcrypto.subtle),
+      encrypt: webcrypto.subtle.encrypt.bind(webcrypto.subtle),
+      decrypt: (algorithm, key, data) =>
+        webcrypto.subtle.decrypt(
+          algorithm,
+          key,
+          Buffer.from(new Uint8Array(data))
+        ),
+    },
+  });
+  storage.clear();
+  vi.mocked(SecureStoragePlugin.set).mockImplementation(
+    async ({ key, value }) => {
+      storage.set(key, value);
+      return { value: true };
+    }
+  );
+  vi.mocked(SecureStoragePlugin.get).mockImplementation(async ({ key }) => ({
+    value: storage.get(key),
+  }));
+});
+afterEach(() => {
+  delete window.foreignWalletSigner;
+  vi.unstubAllGlobals();
+});
+function signer() {
+  window.foreignWalletSigner = {
+    importKeys: vi.fn(async () => publicKeys),
+    publicKey: vi.fn(),
+    sign: vi.fn(),
+    clear: vi.fn(async () => {}),
+  };
+  return window.foreignWalletSigner;
+}
+it('passes only foreign roots to native storage and removes them from renderer key records', async () => {
+  const native = signer();
+  await storeData('keyPair', {
+    ...privateKeys,
+    privateKey: 'qortal-secret',
+    arrrSeed58: 'pirate-secret',
+  });
+  expect(native.importKeys).toHaveBeenCalledWith(privateKeys);
+  const result = await getData('keyPair');
+  expect(result.privateKey).toBe('qortal-secret');
+  expect(result.arrrSeed58).toBe('pirate-secret');
+  for (const [coin, value] of Object.entries(publicKeys)) {
+    expect(result[`${coin.toLowerCase()}PublicKey`]).toBe(value);
+    expect(result).not.toHaveProperty(`${coin.toLowerCase()}PrivateKey`);
+  }
+});
+it('migrates existing encrypted renderer records once', async () => {
+  await storeData('keyPair', privateKeys);
+  const native = signer();
+  expect(await getData('keyPair')).not.toHaveProperty('ltcPrivateKey');
+  await getData('keyPair');
+  expect(native.importKeys).toHaveBeenCalledOnce();
+});
+it('fails closed if the native key import fails', async () => {
+  const native = signer();
+  vi.mocked(native.importKeys).mockRejectedValue(new Error('failed'));
+  await expect(storeData('keyPair', privateKeys)).rejects.toThrow();
+  expect(storage.has('keyPair')).toBe(false);
+});
+it('clears the signing session on logout', async () => {
+  const native = signer();
+  await removeKeysAndLogout(
+    ['keyPair'],
+    { source: { postMessage: vi.fn() }, origin: 'test' } as any,
+    { requestId: 'logout' }
+  );
+  expect(native.clear).toHaveBeenCalledOnce();
+});
diff --git a/src/utils/chromeStorage.ts b/src/utils/chromeStorage.ts
index 0b3ff7c21..ef0d1250b 100644
--- a/src/utils/chromeStorage.ts
+++ b/src/utils/chromeStorage.ts
@@ -1,3 +1,4 @@
+import i18n from 'i18next';
 import { SecureStoragePlugin } from '@evva/capacitor-secure-storage-plugin';
 
 let inMemoryKey: CryptoKey | null = null;
@@ -79,9 +80,39 @@ function base64ToJson(base64) {
   return JSON.parse(new TextDecoder().decode(bytes));
 }
 
+// Keep explicit foreign xprv strings in the native signing session after unlock.
+// Qortal's renderer-held secret still contains the shared derivation seed;
+
+async function isolateForeignWalletKeys(payload: any) {
+  if (!window.foreignWalletSigner) return payload;
+  const coins = ['BTC', 'LTC', 'DOGE', 'DGB', 'RVN'];
+  if (!coins.some((coin) => payload?.[`${coin.toLowerCase()}PrivateKey`]))
+    return payload;
+  let publicKeys: Record<string, string>;
+  try {
+    publicKeys = await window.foreignWalletSigner.importKeys(
+      Object.fromEntries(
+        coins.map((coin) => {
+          const field = `${coin.toLowerCase()}PrivateKey`;
+          return [field, payload[field]];
+        })
+      )
+    );
+  } catch {
+    throw new Error(i18n.t('question:local_send.invalid'));
+  }
+  const sanitized = { ...payload };
+  for (const coin of coins) {
+    delete sanitized[`${coin.toLowerCase()}PrivateKey`];
+    sanitized[`${coin.toLowerCase()}PublicKey`] = publicKeys[coin];
+  }
+  return sanitized;
+}
+
 export const storeData = async (key: string, payload: any): Promise<string> => {
   await initializeKeyAndIV();
 
+  if (key === 'keyPair') payload = await isolateForeignWalletKeys(payload);
   const base64Data = jsonToBase64(payload);
 
   if (keysToEncrypt.includes(key) && inMemoryKey) {
@@ -124,7 +155,13 @@ export const getData = async <T = any>(key: string): Promise<T | null> => {
           inMemoryKey,
           iv
         );
-        return base64ToJson(decryptedBase64Data);
+        const payload = base64ToJson(decryptedBase64Data);
+        if (key === 'keyPair' && window.foreignWalletSigner) {
+          const sanitized = await isolateForeignWalletKeys(payload);
+          if (sanitized !== payload) await storeData(key, sanitized);
+          return sanitized;
+        }
+        return payload;
       } else {
         // Decode non-encrypted data
         return base64ToJson(storedDataBase64.value);
@@ -144,6 +181,7 @@ export async function removeKeysAndLogout(
   request: any
 ) {
   try {
+    if (keys.includes('keyPair')) await window.foreignWalletSigner?.clear();
     for (const key of keys) {
       try {
         await SecureStoragePlugin.remove({ key });
diff --git a/vite.config.ts b/vite.config.ts
index 0ad25052c..7e344c1a4 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -43,7 +43,41 @@ export default defineConfig({
         : {},
   },
   build: {
+    // Explicit runtime baseline for the PSBT dependencies (Object.hasOwn).
+    // Also prevents the TLA plugin from reverting to its obsolete Safari 14 target.
+    target: ['es2020', 'chrome94', 'edge94', 'firefox93', 'safari15.4'],
     rollupOptions: {
+      onwarn(warning, warn) {
+        const id = warning.id?.replace(/\\/g, '/');
+        // Scure's documentation comment contains an example PURE annotation.
+        // Keep warnings about actual misplaced annotations everywhere else.
+        if (
+          warning.code === 'INVALID_ANNOTATION' &&
+          id?.endsWith('/node_modules/@scure/base/index.js') &&
+          warning.message.includes('// Freeze the result of a thunk.')
+        )
+          return;
+        // This Babel-only directive has no runtime effect.
+        if (
+          warning.code === 'MODULE_LEVEL_DIRECTIVE' &&
+          id?.endsWith(
+            '/node_modules/react-virtualized/dist/es/WindowScroller/utils/onScroll.js'
+          ) &&
+          warning.message.includes('no babel-plugin-flow-react-proptypes')
+        )
+          return;
+        // bcrypt 2.4.3 catches its optional Node import and uses Web Crypto.
+        // Do not hide other modules accidentally importing Node APIs.
+        if (
+          warning.code === 'PLUGIN_WARNING' &&
+          warning.plugin === 'vite:resolve' &&
+          /^(?:\[plugin vite:resolve\] )?Module "crypto" has been externalized for browser compatibility, imported by "[^"]*\/node_modules\/bcryptjs\/dist\/bcrypt\.js"\./.test(
+            warning.message.replace(/\\/g, '/')
+          )
+        )
+          return;
+        warn(warning);
+      },
       input: {
         main: resolve(__dirname, 'index.html'),
         audioSurface: resolve(__dirname, 'audio-surface.html'),