@psnext/slingcli 3.0.20260827-1 → 3.3.20260911-1

package/node_modules/@types/node/crypto.d.ts

@@ -1,6 +1,24 @@
-declare module "node:crypto" {
+/**
+ * The `node:crypto` module provides cryptographic functionality that includes a
+ * set of wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify
+ * functions.
+ *
+ * ```js
+ * const { createHmac } = await import('node:crypto');
+ *
+ * const secret = 'abcdefg';
+ * const hash = createHmac('sha256', secret)
+ *                .update('I love cupcakes')
+ *                .digest('hex');
+ * console.log(hash);
+ * // Prints:
+ * //   c0fa1bc00531bd78ef38c628449c5102aeabd49b5dc3a2a516ea6ea959d6658e
+ * ```
+ * @see [source](https://github.com/nodejs/node/blob/v22.x/lib/crypto.js)
+ */
+declare module "crypto" {
     import { NonSharedBuffer } from "node:buffer";
-    import { Transform, TransformOptions, Writable, WritableOptions } from "node:stream";
+    import * as stream from "node:stream";
     import { PeerCertificate } from "node:tls";
     /**
      * SPKAC is a Certificate Signing Request mechanism originally implemented by
@@ -27,7 +45,7 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the `spkac` string.
          * @return The challenge component of the `spkac` data structure, which includes a public key and a challenge.
          */
-        static exportChallenge(spkac: BinaryLike, encoding?: BufferEncoding): NonSharedBuffer;
+        static exportChallenge(spkac: BinaryLike): NonSharedBuffer;
         /**
          * ```js
          * const { Certificate } = await import('node:crypto');
@@ -40,7 +58,7 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the `spkac` string.
          * @return The public key component of the `spkac` data structure, which includes a public key and a challenge.
          */
-        static exportPublicKey(spkac: BinaryLike, encoding?: BufferEncoding): NonSharedBuffer;
+        static exportPublicKey(spkac: BinaryLike, encoding?: string): NonSharedBuffer;
         /**
          * ```js
          * import { Buffer } from 'node:buffer';
@@ -54,34 +72,122 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the `spkac` string.
          * @return `true` if the given `spkac` data structure is valid, `false` otherwise.
          */
-        static verifySpkac(spkac: BinaryLike, encoding?: BufferEncoding): boolean;
+        static verifySpkac(spkac: NodeJS.ArrayBufferView): boolean;
         /**
          * @deprecated
-         * @param encoding The `encoding` of the `spkac` string.
+         * @param spkac
          * @returns The challenge component of the `spkac` data structure,
          * which includes a public key and a challenge.
          */
-        exportChallenge(spkac: BinaryLike, encoding?: BufferEncoding): NonSharedBuffer;
+        exportChallenge(spkac: BinaryLike): NonSharedBuffer;
         /**
          * @deprecated
+         * @param spkac
          * @param encoding The encoding of the spkac string.
          * @returns The public key component of the `spkac` data structure,
          * which includes a public key and a challenge.
          */
-        exportPublicKey(spkac: BinaryLike, encoding?: BufferEncoding): NonSharedBuffer;
+        exportPublicKey(spkac: BinaryLike, encoding?: string): NonSharedBuffer;
         /**
          * @deprecated
-         * @param encoding The `encoding` of the `spkac` string.
+         * @param spkac
          * @returns `true` if the given `spkac` data structure is valid,
          * `false` otherwise.
          */
-        verifySpkac(spkac: BinaryLike, encoding?: BufferEncoding): boolean;
+        verifySpkac(spkac: NodeJS.ArrayBufferView): boolean;
+    }
+    namespace constants {
+        // https://nodejs.org/dist/latest-v22.x/docs/api/crypto.html#crypto-constants
+        const OPENSSL_VERSION_NUMBER: number;
+        /** Applies multiple bug workarounds within OpenSSL. See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html for detail. */
+        const SSL_OP_ALL: number;
+        /** Instructs OpenSSL to allow a non-[EC]DHE-based key exchange mode for TLS v1.3 */
+        const SSL_OP_ALLOW_NO_DHE_KEX: number;
+        /** Allows legacy insecure renegotiation between OpenSSL and unpatched clients or servers. See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html. */
+        const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: number;
+        /** Attempts to use the server's preferences instead of the client's when selecting a cipher. See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html. */
+        const SSL_OP_CIPHER_SERVER_PREFERENCE: number;
+        /** Instructs OpenSSL to use Cisco's version identifier of DTLS_BAD_VER. */
+        const SSL_OP_CISCO_ANYCONNECT: number;
+        /** Instructs OpenSSL to turn on cookie exchange. */
+        const SSL_OP_COOKIE_EXCHANGE: number;
+        /** Instructs OpenSSL to add server-hello extension from an early version of the cryptopro draft. */
+        const SSL_OP_CRYPTOPRO_TLSEXT_BUG: number;
+        /** Instructs OpenSSL to disable a SSL 3.0/TLS 1.0 vulnerability workaround added in OpenSSL 0.9.6d. */
+        const SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS: number;
+        /** Allows initial connection to servers that do not support RI. */
+        const SSL_OP_LEGACY_SERVER_CONNECT: number;
+        /** Instructs OpenSSL to disable support for SSL/TLS compression. */
+        const SSL_OP_NO_COMPRESSION: number;
+        /** Instructs OpenSSL to disable encrypt-then-MAC. */
+        const SSL_OP_NO_ENCRYPT_THEN_MAC: number;
+        const SSL_OP_NO_QUERY_MTU: number;
+        /** Instructs OpenSSL to disable renegotiation. */
+        const SSL_OP_NO_RENEGOTIATION: number;
+        /** Instructs OpenSSL to always start a new session when performing renegotiation. */
+        const SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION: number;
+        /** Instructs OpenSSL to turn off SSL v2 */
+        const SSL_OP_NO_SSLv2: number;
+        /** Instructs OpenSSL to turn off SSL v3 */
+        const SSL_OP_NO_SSLv3: number;
+        /** Instructs OpenSSL to disable use of RFC4507bis tickets. */
+        const SSL_OP_NO_TICKET: number;
+        /** Instructs OpenSSL to turn off TLS v1 */
+        const SSL_OP_NO_TLSv1: number;
+        /** Instructs OpenSSL to turn off TLS v1.1 */
+        const SSL_OP_NO_TLSv1_1: number;
+        /** Instructs OpenSSL to turn off TLS v1.2 */
+        const SSL_OP_NO_TLSv1_2: number;
+        /** Instructs OpenSSL to turn off TLS v1.3 */
+        const SSL_OP_NO_TLSv1_3: number;
+        /** Instructs OpenSSL server to prioritize ChaCha20-Poly1305 when the client does. This option has no effect if `SSL_OP_CIPHER_SERVER_PREFERENCE` is not enabled. */
+        const SSL_OP_PRIORITIZE_CHACHA: number;
+        /** Instructs OpenSSL to disable version rollback attack detection. */
+        const SSL_OP_TLS_ROLLBACK_BUG: number;
+        const ENGINE_METHOD_RSA: number;
+        const ENGINE_METHOD_DSA: number;
+        const ENGINE_METHOD_DH: number;
+        const ENGINE_METHOD_RAND: number;
+        const ENGINE_METHOD_EC: number;
+        const ENGINE_METHOD_CIPHERS: number;
+        const ENGINE_METHOD_DIGESTS: number;
+        const ENGINE_METHOD_PKEY_METHS: number;
+        const ENGINE_METHOD_PKEY_ASN1_METHS: number;
+        const ENGINE_METHOD_ALL: number;
+        const ENGINE_METHOD_NONE: number;
+        const DH_CHECK_P_NOT_SAFE_PRIME: number;
+        const DH_CHECK_P_NOT_PRIME: number;
+        const DH_UNABLE_TO_CHECK_GENERATOR: number;
+        const DH_NOT_SUITABLE_GENERATOR: number;
+        const RSA_PKCS1_PADDING: number;
+        const RSA_SSLV23_PADDING: number;
+        const RSA_NO_PADDING: number;
+        const RSA_PKCS1_OAEP_PADDING: number;
+        const RSA_X931_PADDING: number;
+        const RSA_PKCS1_PSS_PADDING: number;
+        /** Sets the salt length for RSA_PKCS1_PSS_PADDING to the digest size when signing or verifying. */
+        const RSA_PSS_SALTLEN_DIGEST: number;
+        /** Sets the salt length for RSA_PKCS1_PSS_PADDING to the maximum permissible value when signing data. */
+        const RSA_PSS_SALTLEN_MAX_SIGN: number;
+        /** Causes the salt length for RSA_PKCS1_PSS_PADDING to be determined automatically when verifying a signature. */
+        const RSA_PSS_SALTLEN_AUTO: number;
+        const POINT_CONVERSION_COMPRESSED: number;
+        const POINT_CONVERSION_UNCOMPRESSED: number;
+        const POINT_CONVERSION_HYBRID: number;
+        /** Specifies the built-in default cipher list used by Node.js (colon-separated values). */
+        const defaultCoreCipherList: string;
+        /** Specifies the active default cipher list used by the current Node.js process  (colon-separated values). */
+        const defaultCipherList: string;
     }
-    /** @deprecated This property is deprecated. Please use `crypto.setFips()` and `crypto.getFips()` instead. */
-    var fips: boolean;
-    interface HashOptions extends TransformOptions {
+    interface HashOptions extends stream.TransformOptions {
+        /**
+         * For XOF hash functions such as `shake256`, the
+         * outputLength option can be used to specify the desired output length in bytes.
+         */
         outputLength?: number | undefined;
     }
+    /** @deprecated since v10.0.0 */
+    const fips: boolean;
     /**
      * Creates and returns a `Hash` object that can be used to generate hash digests
      * using the given `algorithm`. Optional `options` argument controls stream
@@ -124,9 +230,6 @@ declare module "node:crypto" {
      * @param options `stream.transform` options
      */
     function createHash(algorithm: string, options?: HashOptions): Hash;
-    interface HmacOptions extends TransformOptions {
-        encoding?: BufferEncoding | undefined;
-    }
     /**
      * Creates and returns an `Hmac` object that uses the given `algorithm` and `key`.
      * Optional `options` argument controls stream behavior.
@@ -171,7 +274,13 @@ declare module "node:crypto" {
      * @since v0.1.94
      * @param options `stream.transform` options
      */
-    function createHmac(algorithm: string, key: KeyLike, options?: HmacOptions): Hmac;
+    function createHmac(algorithm: string, key: BinaryLike | KeyObject, options?: stream.TransformOptions): Hmac;
+    // https://nodejs.org/api/buffer.html#buffer_buffers_and_character_encodings
+    type BinaryToTextEncoding = "base64" | "base64url" | "hex" | "binary";
+    type CharacterEncoding = "utf8" | "utf-8" | "utf16le" | "utf-16le" | "latin1";
+    type LegacyCharacterEncoding = "ascii" | "binary" | "ucs2" | "ucs-2";
+    type Encoding = BinaryToTextEncoding | CharacterEncoding | LegacyCharacterEncoding;
+    type ECDHKeyFormat = "compressed" | "uncompressed" | "hybrid";
     /**
      * The `Hash` class is a utility for creating hash digests of data. It can be
      * used in one of two ways:
@@ -236,7 +345,7 @@ declare module "node:crypto" {
      * ```
      * @since v0.1.92
      */
-    class Hash extends Transform {
+    class Hash extends stream.Transform {
         private constructor();
         /**
          * Creates a new `Hash` object that contains a deep copy of the internal state
@@ -282,7 +391,8 @@ declare module "node:crypto" {
          * @since v0.1.92
          * @param inputEncoding The `encoding` of the `data` string.
          */
-        update(data: string | NodeJS.ArrayBufferView, inputEncoding?: BufferEncoding): Hash;
+        update(data: BinaryLike): Hash;
+        update(data: string, inputEncoding: Encoding): Hash;
         /**
          * Calculates the digest of all of the data passed to be hashed (using the `hash.update()` method).
          * If `encoding` is provided a string will be returned; otherwise
@@ -294,7 +404,7 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the return value.
          */
         digest(): NonSharedBuffer;
-        digest(encoding: BufferEncoding): string;
+        digest(encoding: BinaryToTextEncoding): string;
     }
     /**
      * The `Hmac` class is a utility for creating cryptographic HMAC digests. It can
@@ -361,8 +471,9 @@ declare module "node:crypto" {
      * //   7fd04df92f636fd450bc841c9418e5825c17f33ad9c87c518115a45971f7f77e
      * ```
      * @since v0.1.94
+     * @deprecated Since v20.13.0 Calling `Hmac` class directly with `Hmac()` or `new Hmac()` is deprecated due to being internals, not intended for public use. Please use the {@link createHmac} method to create Hmac instances.
      */
-    class Hmac extends Transform {
+    class Hmac extends stream.Transform {
         private constructor();
         /**
          * Updates the `Hmac` content with the given `data`, the encoding of which
@@ -374,7 +485,8 @@ declare module "node:crypto" {
          * @since v0.1.94
          * @param inputEncoding The `encoding` of the `data` string.
          */
-        update(data: string | NodeJS.ArrayBufferView, inputEncoding?: BufferEncoding): Hmac;
+        update(data: BinaryLike): Hmac;
+        update(data: string, inputEncoding: Encoding): Hmac;
         /**
          * Calculates the HMAC digest of all of the data passed using `hmac.update()`.
          * If `encoding` is
@@ -386,97 +498,62 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the return value.
          */
         digest(): NonSharedBuffer;
-        digest(encoding: BufferEncoding): string;
+        digest(encoding: BinaryToTextEncoding): string;
     }
-    type KeyFormat = "pem" | "der" | "jwk" | "raw-public" | "raw-private" | "raw-seed";
     type KeyObjectType = "secret" | "public" | "private";
-    type PublicKeyExportType = "pkcs1" | "spki";
-    type PrivateKeyExportType = "pkcs1" | "pkcs8" | "sec1";
-    type KeyExportOptions =
-        | SymmetricKeyExportOptions
-        | PublicKeyExportOptions
-        | PrivateKeyExportOptions
-        | JwkKeyExportOptions
-        | RawPublicKeyExportOptions
-        | RawPrivateKeyExportOptions;
-    interface SymmetricKeyExportOptions {
-        format?: "buffer" | undefined;
-    }
-    interface PublicKeyExportOptions<T extends PublicKeyExportType = PublicKeyExportType> {
-        type: T;
-        format: "pem" | "der";
-    }
-    interface PrivateKeyExportOptions<T extends PrivateKeyExportType = PrivateKeyExportType> {
-        type: T;
-        format: "pem" | "der";
+    interface KeyExportOptions<T extends KeyFormat> {
+        type: "pkcs1" | "spki" | "pkcs8" | "sec1";
+        format: T;
         cipher?: string | undefined;
-        passphrase?: BinaryLike | undefined;
+        passphrase?: string | Buffer | undefined;
     }
     interface JwkKeyExportOptions {
         format: "jwk";
     }
-    interface RawPublicKeyExportOptions {
-        format: "raw-public";
-    }
-    interface RawPrivateKeyExportOptions {
-        format: "raw-private" | "raw-seed";
-    }
-    interface KeyPairExportOptions<
-        TPublic extends PublicKeyExportType = PublicKeyExportType,
-        TPrivate extends PrivateKeyExportType = PrivateKeyExportType,
-    > {
-        publicKeyEncoding?:
-            | PublicKeyExportOptions<TPublic>
-            | RawPublicKeyExportOptions
-            | JwkKeyExportOptions
-            | undefined;
-        privateKeyEncoding?:
-            | PrivateKeyExportOptions<TPrivate>
-            | RawPrivateKeyExportOptions
-            | JwkKeyExportOptions
-            | undefined;
-    }
-    type KeyExportResult<T, Default> = T extends { format: infer F extends KeyFormat } ? {
-            "der": NonSharedBuffer;
-            "jwk": webcrypto.JsonWebKey;
-            "pem": string;
-            "raw-public": NonSharedBuffer;
-            "raw-private": NonSharedBuffer;
-            "raw-seed": NonSharedBuffer;
-        }[F]
-        : Default;
-    interface KeyPairExportResult<T extends KeyPairExportOptions> {
-        publicKey: KeyExportResult<T["publicKeyEncoding"], KeyObject>;
-        privateKey: KeyExportResult<T["privateKeyEncoding"], KeyObject>;
-    }
-    type KeyPairExportCallback<T extends KeyPairExportOptions = {}> = (
-        err: Error | null,
-        publicKey: KeyExportResult<T["publicKeyEncoding"], KeyObject>,
-        privateKey: KeyExportResult<T["privateKeyEncoding"], KeyObject>,
-    ) => void;
-    type MLDSAKeyType = `ml-dsa-${44 | 65 | 87}`;
-    type MLKEMKeyType = `ml-kem-${1024 | 512 | 768}`;
-    type SLHDSAKeyType = `slh-dsa-${"sha2" | "shake"}-${128 | 192 | 256}${"f" | "s"}`;
-    type AsymmetricKeyType =
-        | "dh"
-        | "dsa"
-        | "ec"
-        | "ed25519"
-        | "ed448"
-        | MLDSAKeyType
-        | MLKEMKeyType
-        | "rsa-pss"
-        | "rsa"
-        | SLHDSAKeyType
-        | "x25519"
-        | "x448";
+    interface JsonWebKey {
+        crv?: string;
+        d?: string;
+        dp?: string;
+        dq?: string;
+        e?: string;
+        k?: string;
+        kty?: string;
+        n?: string;
+        p?: string;
+        q?: string;
+        qi?: string;
+        x?: string;
+        y?: string;
+        [key: string]: unknown;
+    }
     interface AsymmetricKeyDetails {
+        /**
+         * Key size in bits (RSA, DSA).
+         */
         modulusLength?: number;
+        /**
+         * Public exponent (RSA).
+         */
         publicExponent?: bigint;
+        /**
+         * Name of the message digest (RSA-PSS).
+         */
         hashAlgorithm?: string;
+        /**
+         * Name of the message digest used by MGF1 (RSA-PSS).
+         */
         mgf1HashAlgorithm?: string;
+        /**
+         * Minimal salt length in bytes (RSA-PSS).
+         */
         saltLength?: number;
+        /**
+         * Size of q in bits (DSA).
+         */
         divisorLength?: number;
+        /**
+         * Name of the curve (EC).
+         */
         namedCurve?: string;
     }
     /**
@@ -495,11 +572,7 @@ declare module "node:crypto" {
     class KeyObject {
         private constructor();
         /**
-         * Returns the underlying `KeyObject` of a `CryptoKey`. The returned `KeyObject`
-         * does not retain any of the restrictions imposed by the Web Crypto API on the
-         * original `CryptoKey`, such as the allowed key usages, the algorithm or hash
-         * algorithm bindings, and the extractability flag. In particular, the underlying
-         * key material of the returned `KeyObject` can always be exported.
+         * Example: Converting a `CryptoKey` instance to a `KeyObject`:
          *
          * ```js
          * const { KeyObject } = await import('node:crypto');
@@ -519,14 +592,24 @@ declare module "node:crypto" {
          */
         static from(key: webcrypto.CryptoKey): KeyObject;
         /**
-         * For asymmetric keys, this property represents the type of the key. See the
-         * supported [asymmetric key types](https://nodejs.org/docs/latest-v26.x/api/crypto.html#asymmetric-key-types).
+         * For asymmetric keys, this property represents the type of the key. Supported key
+         * types are:
+         *
+         * * `'rsa'` (OID 1.2.840.113549.1.1.1)
+         * * `'rsa-pss'` (OID 1.2.840.113549.1.1.10)
+         * * `'dsa'` (OID 1.2.840.10040.4.1)
+         * * `'ec'` (OID 1.2.840.10045.2.1)
+         * * `'x25519'` (OID 1.3.101.110)
+         * * `'x448'` (OID 1.3.101.111)
+         * * `'ed25519'` (OID 1.3.101.112)
+         * * `'ed448'` (OID 1.3.101.113)
+         * * `'dh'` (OID 1.2.840.113549.1.3.1)
          *
          * This property is `undefined` for unrecognized `KeyObject` types and symmetric
          * keys.
          * @since v11.6.0
          */
-        asymmetricKeyType?: AsymmetricKeyType;
+        asymmetricKeyType?: KeyType;
         /**
          * This property exists only on asymmetric keys. Depending on the type of the key,
          * this object contains information about the key. None of the information obtained
@@ -542,21 +625,31 @@ declare module "node:crypto" {
          */
         asymmetricKeyDetails?: AsymmetricKeyDetails;
         /**
+         * For symmetric keys, the following encoding options can be used:
+         *
+         * For public keys, the following encoding options can be used:
+         *
+         * For private keys, the following encoding options can be used:
+         *
          * The result type depends on the selected encoding format, when PEM the
          * result is a string, when DER it will be a buffer containing the data
-         * encoded as DER, when [JWK](https://tools.ietf.org/html/rfc7517) it will be an object. Raw formats return a
-         * `Buffer` containing the raw key material.
-         *
-         * Private keys can be encrypted by specifying a `cipher` and `passphrase`.
-         * The PKCS#8 `type` supports encryption with both PEM and DER `format` for any
-         * key algorithm. PKCS#1 and SEC1 can only be encrypted when the PEM `format` is
-         * used. For maximum compatibility, use PKCS#8 for encrypted private keys. Since
-         * PKCS#8 defines its own encryption mechanism, PEM-level encryption is not
-         * supported when encrypting a PKCS#8 key. See [RFC 5208](https://www.rfc-editor.org/rfc/rfc5208.txt) for PKCS#8 encryption
-         * and [RFC 1421](https://www.rfc-editor.org/rfc/rfc1421.txt) for PKCS#1 and SEC1 encryption.
+         * encoded as DER, when [JWK](https://tools.ietf.org/html/rfc7517) it will be an object.
+         *
+         * When [JWK](https://tools.ietf.org/html/rfc7517) encoding format was selected, all other encoding options are
+         * ignored.
+         *
+         * PKCS#1, SEC1, and PKCS#8 type keys can be encrypted by using a combination of
+         * the `cipher` and `format` options. The PKCS#8 `type` can be used with any`format` to encrypt any key algorithm (RSA, EC, or DH) by specifying a`cipher`. PKCS#1 and SEC1 can only be
+         * encrypted by specifying a `cipher`when the PEM `format` is used. For maximum compatibility, use PKCS#8 for
+         * encrypted private keys. Since PKCS#8 defines its own
+         * encryption mechanism, PEM-level encryption is not supported when encrypting
+         * a PKCS#8 key. See [RFC 5208](https://www.rfc-editor.org/rfc/rfc5208.txt) for PKCS#8 encryption and [RFC 1421](https://www.rfc-editor.org/rfc/rfc1421.txt) for
+         * PKCS#1 and SEC1 encryption.
          * @since v11.6.0
          */
-        export<T extends KeyExportOptions = {}>(options?: T): KeyExportResult<T, NonSharedBuffer>;
+        export(options: KeyExportOptions<"pem">): string | NonSharedBuffer;
+        export(options?: KeyExportOptions<"der">): NonSharedBuffer;
+        export(options?: JwkKeyExportOptions): JsonWebKey;
         /**
          * Returns `true` or `false` depending on whether the keys have exactly the same
          * type, value, and parameters. This method is not [constant time](https://en.wikipedia.org/wiki/Timing_attack).
@@ -594,18 +687,19 @@ declare module "node:crypto" {
     type CipherGCMTypes = "aes-128-gcm" | "aes-192-gcm" | "aes-256-gcm";
     type CipherOCBTypes = "aes-128-ocb" | "aes-192-ocb" | "aes-256-ocb";
     type CipherChaCha20Poly1305Types = "chacha20-poly1305";
-    type BinaryLike = string | ArrayBufferLike | NodeJS.ArrayBufferView;
-    type KeyLike = BinaryLike | KeyObject;
-    interface CipherCCMOptions extends TransformOptions {
+    type BinaryLike = string | NodeJS.ArrayBufferView;
+    type CipherKey = BinaryLike | KeyObject;
+    interface CipherCCMOptions extends stream.TransformOptions {
         authTagLength: number;
     }
-    interface CipherGCMOptions extends TransformOptions {
+    interface CipherGCMOptions extends stream.TransformOptions {
         authTagLength?: number | undefined;
     }
-    interface CipherOCBOptions extends TransformOptions {
+    interface CipherOCBOptions extends stream.TransformOptions {
         authTagLength: number;
     }
-    interface CipherChaCha20Poly1305Options extends TransformOptions {
+    interface CipherChaCha20Poly1305Options extends stream.TransformOptions {
+        /** @default 16 */
         authTagLength?: number | undefined;
     }
     /**
@@ -640,36 +734,36 @@ declare module "node:crypto" {
      */
     function createCipheriv(
         algorithm: CipherCCMTypes,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike,
         options: CipherCCMOptions,
     ): CipherCCM;
     function createCipheriv(
         algorithm: CipherOCBTypes,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike,
         options: CipherOCBOptions,
     ): CipherOCB;
     function createCipheriv(
         algorithm: CipherGCMTypes,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike,
         options?: CipherGCMOptions,
     ): CipherGCM;
     function createCipheriv(
         algorithm: CipherChaCha20Poly1305Types,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike,
         options?: CipherChaCha20Poly1305Options,
     ): CipherChaCha20Poly1305;
     function createCipheriv(
         algorithm: string,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike | null,
-        options?: TransformOptions,
-    ): Cipheriv;
+        options?: stream.TransformOptions,
+    ): Cipher;
     /**
-     * Instances of the `Cipheriv` class are used to encrypt data. The class can be
+     * Instances of the `Cipher` class are used to encrypt data. The class can be
      * used in one of two ways:
      *
      * * As a `stream` that is both readable and writable, where plain unencrypted
@@ -678,10 +772,10 @@ declare module "node:crypto" {
      * the encrypted data.
      *
      * The {@link createCipheriv} method is
-     * used to create `Cipheriv` instances. `Cipheriv` objects are not to be created
+     * used to create `Cipher` instances. `Cipher` objects are not to be created
      * directly using the `new` keyword.
      *
-     * Example: Using `Cipheriv` objects as streams:
+     * Example: Using `Cipher` objects as streams:
      *
      * ```js
      * const {
@@ -716,7 +810,7 @@ declare module "node:crypto" {
      * });
      * ```
      *
-     * Example: Using `Cipheriv` and piped streams:
+     * Example: Using `Cipher` and piped streams:
      *
      * ```js
      * import {
@@ -787,7 +881,7 @@ declare module "node:crypto" {
      * ```
      * @since v0.1.94
      */
-    class Cipheriv extends Transform {
+    class Cipher extends stream.Transform {
         private constructor();
         /**
          * Updates the cipher with `data`. If the `inputEncoding` argument is given,
@@ -803,14 +897,12 @@ declare module "node:crypto" {
          * @param inputEncoding The `encoding` of the data.
          * @param outputEncoding The `encoding` of the return value.
          */
-        update(data: string | NodeJS.ArrayBufferView, inputEncoding?: BufferEncoding): NonSharedBuffer;
-        update(
-            data: string | NodeJS.ArrayBufferView,
-            inputEncoding: BufferEncoding | null | undefined,
-            outputEncoding: BufferEncoding,
-        ): string;
+        update(data: BinaryLike): NonSharedBuffer;
+        update(data: string, inputEncoding: Encoding): NonSharedBuffer;
+        update(data: NodeJS.ArrayBufferView, inputEncoding: undefined, outputEncoding: Encoding): string;
+        update(data: string, inputEncoding: Encoding | undefined, outputEncoding: Encoding): string;
         /**
-         * Once the `cipher.final()` method has been called, the `Cipheriv` object can no
+         * Once the `cipher.final()` method has been called, the `Cipher` object can no
          * longer be used to encrypt data. Attempts to call `cipher.final()` more than
          * once will result in an error being thrown.
          * @since v0.1.94
@@ -820,7 +912,7 @@ declare module "node:crypto" {
         final(): NonSharedBuffer;
         final(outputEncoding: BufferEncoding): string;
         /**
-         * When using block encryption algorithms, the `Cipheriv` class will automatically
+         * When using block encryption algorithms, the `Cipher` class will automatically
          * add padding to the input data to the appropriate block size. To disable the
          * default padding call `cipher.setAutoPadding(false)`.
          *
@@ -836,31 +928,50 @@ declare module "node:crypto" {
          */
         setAutoPadding(autoPadding?: boolean): this;
     }
-    interface CipherAEADMethods {
+    interface CipherCCM extends Cipher {
+        setAAD(
+            buffer: NodeJS.ArrayBufferView,
+            options: {
+                plaintextLength: number;
+            },
+        ): this;
+        getAuthTag(): NonSharedBuffer;
+    }
+    interface CipherGCM extends Cipher {
+        setAAD(
+            buffer: NodeJS.ArrayBufferView,
+            options?: {
+                plaintextLength: number;
+            },
+        ): this;
+        getAuthTag(): NonSharedBuffer;
+    }
+    interface CipherOCB extends Cipher {
+        setAAD(
+            buffer: NodeJS.ArrayBufferView,
+            options?: {
+                plaintextLength: number;
+            },
+        ): this;
         getAuthTag(): NonSharedBuffer;
-        setAAD(buffer: BinaryLike, options?: {
-            plaintextLength?: number | undefined;
-            encoding?: BufferEncoding | undefined;
-        }): this;
     }
-    interface CipherCCM extends Cipheriv, CipherAEADMethods {
-        setAAD(buffer: BinaryLike, options: {
-            plaintextLength: number;
-            encoding?: BufferEncoding | undefined;
-        }): this;
+    interface CipherChaCha20Poly1305 extends Cipher {
+        setAAD(
+            buffer: NodeJS.ArrayBufferView,
+            options: {
+                plaintextLength: number;
+            },
+        ): this;
+        getAuthTag(): NonSharedBuffer;
     }
-    interface CipherGCM extends Cipheriv, CipherAEADMethods {}
-    interface CipherOCB extends Cipheriv, CipherAEADMethods {}
-    interface CipherChaCha20Poly1305 extends Cipheriv, CipherAEADMethods {}
     /**
-     * Creates and returns a `Decipheriv` object that uses the given `algorithm`, `key` and initialization vector (`iv`).
+     * Creates and returns a `Decipher` object that uses the given `algorithm`, `key` and initialization vector (`iv`).
      *
      * The `options` argument controls stream behavior and is optional except when a
-     * cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
-     * `authTagLength` option is required and specifies the length of the
-     * authentication tag in bytes, see [CCM mode](https://nodejs.org/docs/latest-v26.x/api/crypto.html#ccm-mode).
-     * For AES-GCM and `chacha20-poly1305`, the `authTagLength` option defaults to 16
-     * bytes and must be set to a different value if a different length is used.
+     * cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the `authTagLength` option is required and specifies the length of the
+     * authentication tag in bytes, see `CCM mode`. In GCM mode, the `authTagLength` option is not required but can be used to restrict accepted authentication tags
+     * to those with the specified length.
+     * For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
      *
      * The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
      * recent OpenSSL releases, `openssl list -cipher-algorithms` will
@@ -884,36 +995,36 @@ declare module "node:crypto" {
      */
     function createDecipheriv(
         algorithm: CipherCCMTypes,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike,
         options: CipherCCMOptions,
     ): DecipherCCM;
     function createDecipheriv(
         algorithm: CipherOCBTypes,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike,
         options: CipherOCBOptions,
     ): DecipherOCB;
     function createDecipheriv(
         algorithm: CipherGCMTypes,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike,
         options?: CipherGCMOptions,
     ): DecipherGCM;
     function createDecipheriv(
         algorithm: CipherChaCha20Poly1305Types,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike,
         options?: CipherChaCha20Poly1305Options,
     ): DecipherChaCha20Poly1305;
     function createDecipheriv(
         algorithm: string,
-        key: KeyLike,
+        key: CipherKey,
         iv: BinaryLike | null,
-        options?: TransformOptions,
-    ): Decipheriv;
+        options?: stream.TransformOptions,
+    ): Decipher;
     /**
-     * Instances of the `Decipheriv` class are used to decrypt data. The class can be
+     * Instances of the `Decipher` class are used to decrypt data. The class can be
      * used in one of two ways:
      *
      * * As a `stream` that is both readable and writable, where plain encrypted
@@ -922,10 +1033,10 @@ declare module "node:crypto" {
      * produce the unencrypted data.
      *
      * The {@link createDecipheriv} method is
-     * used to create `Decipheriv` instances. `Decipheriv` objects are not to be created
+     * used to create `Decipher` instances. `Decipher` objects are not to be created
      * directly using the `new` keyword.
      *
-     * Example: Using `Decipheriv` objects as streams:
+     * Example: Using `Decipher` objects as streams:
      *
      * ```js
      * import { Buffer } from 'node:buffer';
@@ -964,7 +1075,7 @@ declare module "node:crypto" {
      * decipher.end();
      * ```
      *
-     * Example: Using `Decipheriv` and piped streams:
+     * Example: Using `Decipher` and piped streams:
      *
      * ```js
      * import {
@@ -1020,7 +1131,7 @@ declare module "node:crypto" {
      * ```
      * @since v0.1.94
      */
-    class Decipheriv extends Transform {
+    class Decipher extends stream.Transform {
         private constructor();
         /**
          * Updates the decipher with `data`. If the `inputEncoding` argument is given,
@@ -1036,14 +1147,12 @@ declare module "node:crypto" {
          * @param inputEncoding The `encoding` of the `data` string.
          * @param outputEncoding The `encoding` of the return value.
          */
-        update(data: string | NodeJS.ArrayBufferView, inputEncoding?: BufferEncoding): NonSharedBuffer;
-        update(
-            data: string | NodeJS.ArrayBufferView,
-            inputEncoding: BufferEncoding | null | undefined,
-            outputEncoding: BufferEncoding,
-        ): string;
+        update(data: NodeJS.ArrayBufferView): NonSharedBuffer;
+        update(data: string, inputEncoding: Encoding): NonSharedBuffer;
+        update(data: NodeJS.ArrayBufferView, inputEncoding: undefined, outputEncoding: Encoding): string;
+        update(data: string, inputEncoding: Encoding | undefined, outputEncoding: Encoding): string;
         /**
-         * Once the `decipher.final()` method has been called, the `Decipheriv` object can
+         * Once the `decipher.final()` method has been called, the `Decipher` object can
          * no longer be used to decrypt data. Attempts to call `decipher.final()` more
          * than once will result in an error being thrown.
          * @since v0.1.94
@@ -1066,59 +1175,54 @@ declare module "node:crypto" {
          */
         setAutoPadding(auto_padding?: boolean): this;
     }
-    interface DecipherAEADMethods {
+    interface DecipherCCM extends Decipher {
+        setAuthTag(buffer: NodeJS.ArrayBufferView): this;
+        setAAD(
+            buffer: NodeJS.ArrayBufferView,
+            options: {
+                plaintextLength: number;
+            },
+        ): this;
+    }
+    interface DecipherGCM extends Decipher {
+        setAuthTag(buffer: NodeJS.ArrayBufferView): this;
+        setAAD(
+            buffer: NodeJS.ArrayBufferView,
+            options?: {
+                plaintextLength: number;
+            },
+        ): this;
+    }
+    interface DecipherOCB extends Decipher {
+        setAuthTag(buffer: NodeJS.ArrayBufferView): this;
         setAAD(
-            buffer: BinaryLike,
+            buffer: NodeJS.ArrayBufferView,
             options?: {
-                plaintextLength?: number | undefined;
-                encoding?: BufferEncoding | undefined;
+                plaintextLength: number;
             },
         ): this;
-        setAuthTag(buffer: BinaryLike, encoding?: BufferEncoding): this;
     }
-    interface DecipherCCM extends Decipheriv, DecipherAEADMethods {
+    interface DecipherChaCha20Poly1305 extends Decipher {
+        setAuthTag(buffer: NodeJS.ArrayBufferView): this;
         setAAD(
-            buffer: BinaryLike,
+            buffer: NodeJS.ArrayBufferView,
             options: {
                 plaintextLength: number;
-                encoding?: BufferEncoding | undefined;
             },
         ): this;
     }
-    interface DecipherGCM extends Decipheriv, DecipherAEADMethods {}
-    interface DecipherOCB extends Decipheriv, DecipherAEADMethods {}
-    interface DecipherChaCha20Poly1305 extends Decipheriv, DecipherAEADMethods {}
     interface PrivateKeyInput {
-        key: BinaryLike;
-        format?: "pem" | "der" | undefined;
-        type?: PrivateKeyExportType | undefined;
-        passphrase?: BinaryLike | undefined;
-        encoding?: BufferEncoding | undefined;
+        key: string | Buffer;
+        format?: KeyFormat | undefined;
+        type?: "pkcs1" | "pkcs8" | "sec1" | undefined;
+        passphrase?: string | Buffer | undefined;
+        encoding?: string | undefined;
     }
     interface PublicKeyInput {
-        key: BinaryLike;
-        format?: "pem" | "der" | undefined;
-        type?: PublicKeyExportType | undefined;
-        encoding?: BufferEncoding | undefined;
-    }
-    interface RawPrivateKeyInput {
-        key: ArrayBufferLike | NodeJS.ArrayBufferView;
-        format: "raw-private" | "raw-seed";
-        asymmetricKeyType: AsymmetricKeyType;
-        namedCurve?: string | undefined;
-    }
-    interface RawPublicKeyInput {
-        key: ArrayBufferLike | NodeJS.ArrayBufferView;
-        format: "raw-public";
-        asymmetricKeyType: AsymmetricKeyType;
-        namedCurve?: string | undefined;
-    }
-    interface JsonWebKeyInput {
-        key: webcrypto.JsonWebKey;
-        format: "jwk";
-    }
-    interface SecretKeyOptions {
-        length: number;
+        key: string | Buffer;
+        format?: KeyFormat | undefined;
+        type?: "pkcs1" | "spki" | undefined;
+        encoding?: string | undefined;
     }
     /**
      * Asynchronously generates a new random secret key of the given `length`. The `type` will determine which validations will be performed on the `length`.
@@ -1141,7 +1245,9 @@ declare module "node:crypto" {
      */
     function generateKey(
         type: "hmac" | "aes",
-        options: SecretKeyOptions,
+        options: {
+            length: number;
+        },
         callback: (err: Error | null, key: KeyObject) => void,
     ): void;
     /**
@@ -1161,7 +1267,16 @@ declare module "node:crypto" {
      * @since v15.0.0
      * @param type The intended use of the generated secret key. Currently accepted values are `'hmac'` and `'aes'`.
      */
-    function generateKeySync(type: "hmac" | "aes", options: SecretKeyOptions): KeyObject;
+    function generateKeySync(
+        type: "hmac" | "aes",
+        options: {
+            length: number;
+        },
+    ): KeyObject;
+    interface JsonWebKeyInput {
+        key: JsonWebKey;
+        format: "jwk";
+    }
     /**
      * Creates and returns a new key object containing a private key. If `key` is a
      * string or `Buffer`, `format` is assumed to be `'pem'`; otherwise, `key` must be an object with the properties described above.
@@ -1170,7 +1285,7 @@ declare module "node:crypto" {
      * of the passphrase is limited to 1024 bytes.
      * @since v11.6.0
      */
-    function createPrivateKey(key: PrivateKeyInput | RawPrivateKeyInput | JsonWebKeyInput | BinaryLike): KeyObject;
+    function createPrivateKey(key: PrivateKeyInput | string | Buffer | JsonWebKeyInput): KeyObject;
     /**
      * Creates and returns a new key object containing a public key. If `key` is a
      * string or `Buffer`, `format` is assumed to be `'pem'`; if `key` is a `KeyObject` with type `'private'`, the public key is derived from the given private key;
@@ -1185,14 +1300,15 @@ declare module "node:crypto" {
      * and it will be impossible to extract the private key from the returned object.
      * @since v11.6.0
      */
-    function createPublicKey(key: PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput | KeyLike): KeyObject;
+    function createPublicKey(key: PublicKeyInput | string | Buffer | KeyObject | JsonWebKeyInput): KeyObject;
     /**
      * Creates and returns a new key object containing a secret key for symmetric
      * encryption or `Hmac`.
      * @since v11.6.0
      * @param encoding The string encoding when `key` is a string.
      */
-    function createSecretKey(key: BinaryLike, encoding?: BufferEncoding): KeyObject;
+    function createSecretKey(key: NodeJS.ArrayBufferView): KeyObject;
+    function createSecretKey(key: string, encoding: BufferEncoding): KeyObject;
     /**
      * Creates and returns a `Sign` object that uses the given `algorithm`. Use {@link getHashes} to obtain the names of the available digest algorithms.
      * Optional `options` argument controls the `stream.Writable` behavior.
@@ -1205,26 +1321,27 @@ declare module "node:crypto" {
      * @since v0.1.92
      * @param options `stream.Writable` options
      */
-    function createSign(algorithm: string, options?: WritableOptions): Sign;
+    function createSign(algorithm: string, options?: stream.WritableOptions): Sign;
     type DSAEncoding = "der" | "ieee-p1363";
     interface SigningOptions {
+        /**
+         * @see crypto.constants.RSA_PKCS1_PADDING
+         */
         padding?: number | undefined;
         saltLength?: number | undefined;
         dsaEncoding?: DSAEncoding | undefined;
-        context?: NodeJS.ArrayBufferView | undefined;
     }
     interface SignPrivateKeyInput extends PrivateKeyInput, SigningOptions {}
-    interface SignRawPrivateKeyInput extends RawPrivateKeyInput, SigningOptions {}
-    interface SignJsonWebKeyInput extends JsonWebKeyInput, SigningOptions {}
     interface SignKeyObjectInput extends SigningOptions {
         key: KeyObject;
     }
+    interface SignJsonWebKeyInput extends JsonWebKeyInput, SigningOptions {}
     interface VerifyPublicKeyInput extends PublicKeyInput, SigningOptions {}
-    interface VerifyRawPublicKeyInput extends RawPublicKeyInput, SigningOptions {}
-    interface VerifyJsonWebKeyInput extends JsonWebKeyInput, SigningOptions {}
     interface VerifyKeyObjectInput extends SigningOptions {
         key: KeyObject;
     }
+    interface VerifyJsonWebKeyInput extends JsonWebKeyInput, SigningOptions {}
+    type KeyLike = string | Buffer | KeyObject;
     /**
      * The `Sign` class is a utility for generating signatures. It can be used in one
      * of two ways:
@@ -1288,7 +1405,7 @@ declare module "node:crypto" {
      * ```
      * @since v0.1.92
      */
-    class Sign extends Writable {
+    class Sign extends stream.Writable {
         private constructor();
         /**
          * Updates the `Sign` content with the given `data`, the encoding of which
@@ -1300,7 +1417,8 @@ declare module "node:crypto" {
          * @since v0.1.92
          * @param inputEncoding The `encoding` of the `data` string.
          */
-        update(data: string | NodeJS.ArrayBufferView, inputEncoding?: BufferEncoding): this;
+        update(data: BinaryLike): this;
+        update(data: string, inputEncoding: Encoding): this;
         /**
          * Calculates the signature on all the data passed through using either `sign.update()` or `sign.write()`.
          *
@@ -1313,22 +1431,10 @@ declare module "node:crypto" {
          * called. Multiple calls to `sign.sign()` will result in an error being thrown.
          * @since v0.1.92
          */
+        sign(privateKey: KeyLike | SignKeyObjectInput | SignPrivateKeyInput | SignJsonWebKeyInput): NonSharedBuffer;
         sign(
-            privateKey:
-                | KeyLike
-                | SignKeyObjectInput
-                | SignPrivateKeyInput
-                | SignRawPrivateKeyInput
-                | SignJsonWebKeyInput,
-        ): NonSharedBuffer;
-        sign(
-            privateKey:
-                | KeyLike
-                | SignKeyObjectInput
-                | SignPrivateKeyInput
-                | SignRawPrivateKeyInput
-                | SignJsonWebKeyInput,
-            outputFormat: BufferEncoding,
+            privateKey: KeyLike | SignKeyObjectInput | SignPrivateKeyInput | SignJsonWebKeyInput,
+            outputFormat: BinaryToTextEncoding,
         ): string;
     }
     /**
@@ -1344,7 +1450,7 @@ declare module "node:crypto" {
      * @since v0.1.92
      * @param options `stream.Writable` options
      */
-    function createVerify(algorithm: string, options?: WritableOptions): Verify;
+    function createVerify(algorithm: string, options?: stream.WritableOptions): Verify;
     /**
      * The `Verify` class is a utility for verifying signatures. It can be used in one
      * of two ways:
@@ -1359,7 +1465,7 @@ declare module "node:crypto" {
      * See `Sign` for examples.
      * @since v0.1.92
      */
-    class Verify extends Writable {
+    class Verify extends stream.Writable {
         private constructor();
         /**
          * Updates the `Verify` content with the given `data`, the encoding of which
@@ -1371,11 +1477,12 @@ declare module "node:crypto" {
          * @since v0.1.92
          * @param inputEncoding The `encoding` of the `data` string.
          */
-        update(data: string | NodeJS.ArrayBufferView, inputEncoding?: BufferEncoding): Verify;
+        update(data: BinaryLike): Verify;
+        update(data: string, inputEncoding: Encoding): Verify;
         /**
-         * Verifies the provided data using the given `key` and `signature`.
+         * Verifies the provided data using the given `object` and `signature`.
          *
-         * If `key` is not a `KeyObject`, this function behaves as if `key` had been passed to {@link createPublicKey}. If it is an
+         * If `object` is not a `KeyObject`, this function behaves as if `object` had been passed to {@link createPublicKey}. If it is an
          * object, the following additional properties can be passed:
          *
          * The `signature` argument is the previously calculated signature for the data, in
@@ -1392,14 +1499,13 @@ declare module "node:crypto" {
          * @since v0.1.92
          */
         verify(
-            key:
-                | KeyLike
-                | VerifyKeyObjectInput
-                | VerifyPublicKeyInput
-                | VerifyRawPublicKeyInput
-                | VerifyJsonWebKeyInput,
-            signature: BinaryLike,
-            signatureEncoding?: BufferEncoding,
+            object: KeyLike | VerifyKeyObjectInput | VerifyPublicKeyInput | VerifyJsonWebKeyInput,
+            signature: NodeJS.ArrayBufferView,
+        ): boolean;
+        verify(
+            object: KeyLike | VerifyKeyObjectInput | VerifyPublicKeyInput | VerifyJsonWebKeyInput,
+            signature: string,
+            signature_format?: BinaryToTextEncoding,
         ): boolean;
     }
     /**
@@ -1420,15 +1526,24 @@ declare module "node:crypto" {
      */
     function createDiffieHellman(primeLength: number, generator?: number): DiffieHellman;
     function createDiffieHellman(
-        prime: BinaryLike,
-        primeEncoding?: BufferEncoding,
-        generator?: number | BinaryLike,
-        generatorEncoding?: BufferEncoding,
+        prime: ArrayBuffer | NodeJS.ArrayBufferView,
+        generator?: number | ArrayBuffer | NodeJS.ArrayBufferView,
+    ): DiffieHellman;
+    function createDiffieHellman(
+        prime: ArrayBuffer | NodeJS.ArrayBufferView,
+        generator: string,
+        generatorEncoding: BinaryToTextEncoding,
+    ): DiffieHellman;
+    function createDiffieHellman(
+        prime: string,
+        primeEncoding: BinaryToTextEncoding,
+        generator?: number | ArrayBuffer | NodeJS.ArrayBufferView,
     ): DiffieHellman;
     function createDiffieHellman(
-        prime: BinaryLike,
-        generator: number | BinaryLike,
-        generatorEncoding?: BufferEncoding,
+        prime: string,
+        primeEncoding: BinaryToTextEncoding,
+        generator: string,
+        generatorEncoding: BinaryToTextEncoding,
     ): DiffieHellman;
     /**
      * The `DiffieHellman` class is a utility for creating Diffie-Hellman key
@@ -1470,15 +1585,13 @@ declare module "node:crypto" {
          * If `encoding` is provided a string is returned; otherwise a `Buffer` is returned.
          *
          * This function is a thin wrapper around [`DH_generate_key()`](https://www.openssl.org/docs/man3.0/man3/DH_generate_key.html). In particular,
-         * once a private key has been generated or set, calling this function only
-         * recomputes the public key from the existing private key. Since the public key is
-         * determined by the private key, the result will be the same unless the private key
-         * has been changed via `diffieHellman.setPrivateKey()`.
+         * once a private key has been generated or set, calling this function only updates
+         * the public key but does not generate a new private key.
          * @since v0.5.0
          * @param encoding The `encoding` of the return value.
          */
         generateKeys(): NonSharedBuffer;
-        generateKeys(encoding: BufferEncoding): string;
+        generateKeys(encoding: BinaryToTextEncoding): string;
         /**
          * Computes the shared secret using `otherPublicKey` as the other
          * party's public key and returns the computed shared secret. The supplied
@@ -1493,13 +1606,24 @@ declare module "node:crypto" {
          * @param outputEncoding The `encoding` of the return value.
          */
         computeSecret(
-            otherPublicKey: BinaryLike,
-            inputEncoding?: BufferEncoding,
+            otherPublicKey: NodeJS.ArrayBufferView,
+            inputEncoding?: null,
+            outputEncoding?: null,
+        ): NonSharedBuffer;
+        computeSecret(
+            otherPublicKey: string,
+            inputEncoding: BinaryToTextEncoding,
+            outputEncoding?: null,
         ): NonSharedBuffer;
         computeSecret(
-            otherPublicKey: BinaryLike,
-            inputEncoding: BufferEncoding | null | undefined,
-            outputEncoding: BufferEncoding,
+            otherPublicKey: NodeJS.ArrayBufferView,
+            inputEncoding: null,
+            outputEncoding: BinaryToTextEncoding,
+        ): string;
+        computeSecret(
+            otherPublicKey: string,
+            inputEncoding: BinaryToTextEncoding,
+            outputEncoding: BinaryToTextEncoding,
         ): string;
         /**
          * Returns the Diffie-Hellman prime in the specified `encoding`.
@@ -1509,7 +1633,7 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the return value.
          */
         getPrime(): NonSharedBuffer;
-        getPrime(encoding: BufferEncoding): string;
+        getPrime(encoding: BinaryToTextEncoding): string;
         /**
          * Returns the Diffie-Hellman generator in the specified `encoding`.
          * If `encoding` is provided a string is
@@ -1518,7 +1642,7 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the return value.
          */
         getGenerator(): NonSharedBuffer;
-        getGenerator(encoding: BufferEncoding): string;
+        getGenerator(encoding: BinaryToTextEncoding): string;
         /**
          * Returns the Diffie-Hellman public key in the specified `encoding`.
          * If `encoding` is provided a
@@ -1527,7 +1651,7 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the return value.
          */
         getPublicKey(): NonSharedBuffer;
-        getPublicKey(encoding: BufferEncoding): string;
+        getPublicKey(encoding: BinaryToTextEncoding): string;
         /**
          * Returns the Diffie-Hellman private key in the specified `encoding`.
          * If `encoding` is provided a
@@ -1536,7 +1660,7 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the return value.
          */
         getPrivateKey(): NonSharedBuffer;
-        getPrivateKey(encoding: BufferEncoding): string;
+        getPrivateKey(encoding: BinaryToTextEncoding): string;
         /**
          * Sets the Diffie-Hellman public key. If the `encoding` argument is provided, `publicKey` is expected
          * to be a string. If no `encoding` is provided, `publicKey` is expected
@@ -1544,7 +1668,8 @@ declare module "node:crypto" {
          * @since v0.5.0
          * @param encoding The `encoding` of the `publicKey` string.
          */
-        setPublicKey(publicKey: BinaryLike, encoding?: BufferEncoding): void;
+        setPublicKey(publicKey: NodeJS.ArrayBufferView): void;
+        setPublicKey(publicKey: string, encoding: BufferEncoding): void;
         /**
          * Sets the Diffie-Hellman private key. If the `encoding` argument is provided,`privateKey` is expected
          * to be a string. If no `encoding` is provided, `privateKey` is expected
@@ -1555,7 +1680,8 @@ declare module "node:crypto" {
          * @since v0.5.0
          * @param encoding The `encoding` of the `privateKey` string.
          */
-        setPrivateKey(privateKey: BinaryLike, encoding?: BufferEncoding): void;
+        setPrivateKey(privateKey: NodeJS.ArrayBufferView): void;
+        setPrivateKey(privateKey: string, encoding: BufferEncoding): void;
         /**
          * A bit field containing any warnings and/or errors resulting from a check
          * performed during initialization of the `DiffieHellman` object.
@@ -1593,10 +1719,13 @@ declare module "node:crypto" {
      * ```
      * @since v0.7.5
      */
-    class DiffieHellmanGroup {
-        private constructor();
+    const DiffieHellmanGroup: DiffieHellmanGroupConstructor;
+    interface DiffieHellmanGroupConstructor {
+        new(name: string): DiffieHellmanGroup;
+        (name: string): DiffieHellmanGroup;
+        readonly prototype: DiffieHellmanGroup;
     }
-    interface DiffieHellmanGroup extends Omit<DiffieHellman, "setPublicKey" | "setPrivateKey"> {}
+    type DiffieHellmanGroup = Omit<DiffieHellman, "setPublicKey" | "setPrivateKey">;
     /**
      * Creates a predefined `DiffieHellmanGroup` key exchange object. The
      * supported groups are listed in the documentation for `DiffieHellmanGroup`.
@@ -1810,8 +1939,9 @@ declare module "node:crypto" {
      * console.log(`The dice rolled: ${n}`);
      * ```
      * @since v14.10.0, v12.19.0
-     * @param min Start of random range (inclusive).
+     * @param [min=0] Start of random range (inclusive).
      * @param max End of random range (exclusive).
+     * @param callback `function(err, n) {}`.
      */
     function randomInt(max: number): number;
     function randomInt(min: number, max: number): number;
@@ -1858,11 +1988,7 @@ declare module "node:crypto" {
      * @param [size=buffer.length - offset]
      * @return The object passed as `buffer` argument.
      */
-    function randomFillSync<T extends ArrayBufferLike | NodeJS.ArrayBufferView>(
-        buffer: T,
-        offset?: number,
-        size?: number,
-    ): T;
+    function randomFillSync<T extends NodeJS.ArrayBufferView>(buffer: T, offset?: number, size?: number): T;
     /**
      * This function is similar to {@link randomBytes} but requires the first
      * argument to be a `Buffer` that will be filled. It also
@@ -1938,16 +2064,16 @@ declare module "node:crypto" {
      * @param [size=buffer.length - offset]
      * @param callback `function(err, buf) {}`.
      */
-    function randomFill<T extends ArrayBufferLike | NodeJS.ArrayBufferView>(
+    function randomFill<T extends NodeJS.ArrayBufferView>(
         buffer: T,
         callback: (err: Error | null, buf: T) => void,
     ): void;
-    function randomFill<T extends ArrayBufferLike | NodeJS.ArrayBufferView>(
+    function randomFill<T extends NodeJS.ArrayBufferView>(
         buffer: T,
         offset: number,
         callback: (err: Error | null, buf: T) => void,
     ): void;
-    function randomFill<T extends ArrayBufferLike | NodeJS.ArrayBufferView>(
+    function randomFill<T extends NodeJS.ArrayBufferView>(
         buffer: T,
         offset: number,
         size: number,
@@ -2045,25 +2171,19 @@ declare module "node:crypto" {
         keylen: number,
         options?: ScryptOptions,
     ): NonSharedBuffer;
-    interface PublicDecryptOptions {
+    interface RsaPublicKey {
+        key: KeyLike;
         padding?: number | undefined;
-        encoding?: BufferEncoding | undefined;
-    }
-    interface PublicDecryptPrivateKeyInput extends PrivateKeyInput, PublicDecryptOptions {}
-    interface PublicDecryptPublicKeyInput extends PublicKeyInput, PublicDecryptOptions {}
-    interface PublicDecryptJsonWebKeyInput extends JsonWebKeyInput, PublicDecryptOptions {}
-    interface PublicDecryptKeyObjectInput extends PublicDecryptOptions {
-        key: KeyObject;
     }
-    interface PublicEncryptOptions extends PublicDecryptOptions {
+    interface RsaPrivateKey {
+        key: KeyLike;
+        passphrase?: string | undefined;
+        /**
+         * @default 'sha1'
+         */
         oaepHash?: string | undefined;
-        oaepLabel?: BinaryLike | undefined;
-    }
-    interface PublicEncryptPrivateKeyInput extends PrivateKeyInput, PublicEncryptOptions {}
-    interface PublicEncryptPublicKeyInput extends PublicKeyInput, PublicEncryptOptions {}
-    interface PublicEncryptJsonWebKeyInput extends JsonWebKeyInput, PublicEncryptOptions {}
-    interface PublicEncryptKeyObjectInput extends PublicEncryptOptions {
-        key: KeyObject;
+        oaepLabel?: NodeJS.TypedArray | undefined;
+        padding?: number | undefined;
     }
     /**
      * Encrypts the content of `buffer` with `key` and returns a new `Buffer` with encrypted content. The returned data can be decrypted using
@@ -2077,13 +2197,8 @@ declare module "node:crypto" {
      * @since v0.11.14
      */
     function publicEncrypt(
-        key:
-            | KeyLike
-            | PublicEncryptKeyObjectInput
-            | PublicEncryptPrivateKeyInput
-            | PublicEncryptPublicKeyInput
-            | PublicEncryptJsonWebKeyInput,
-        buffer: BinaryLike,
+        key: RsaPublicKey | RsaPrivateKey | KeyLike,
+        buffer: NodeJS.ArrayBufferView | string,
     ): NonSharedBuffer;
     /**
      * Decrypts `buffer` with `key`.`buffer` was previously encrypted using
@@ -2097,13 +2212,8 @@ declare module "node:crypto" {
      * @since v1.1.0
      */
     function publicDecrypt(
-        key:
-            | KeyLike
-            | PublicDecryptKeyObjectInput
-            | PublicDecryptPrivateKeyInput
-            | PublicDecryptPublicKeyInput
-            | PublicDecryptJsonWebKeyInput,
-        buffer: BinaryLike,
+        key: RsaPublicKey | RsaPrivateKey | KeyLike,
+        buffer: NodeJS.ArrayBufferView | string,
     ): NonSharedBuffer;
     /**
      * Decrypts `buffer` with `privateKey`. `buffer` was previously encrypted using
@@ -2114,12 +2224,8 @@ declare module "node:crypto" {
      * @since v0.11.14
      */
     function privateDecrypt(
-        privateKey:
-            | KeyLike
-            | PublicEncryptKeyObjectInput
-            | PublicEncryptPrivateKeyInput
-            | PublicEncryptJsonWebKeyInput,
-        buffer: BinaryLike,
+        privateKey: RsaPrivateKey | KeyLike,
+        buffer: NodeJS.ArrayBufferView | string,
     ): NonSharedBuffer;
     /**
      * Encrypts `buffer` with `privateKey`. The returned data can be decrypted using
@@ -2130,12 +2236,8 @@ declare module "node:crypto" {
      * @since v1.1.0
      */
     function privateEncrypt(
-        privateKey:
-            | KeyLike
-            | PublicDecryptKeyObjectInput
-            | PublicDecryptPrivateKeyInput
-            | PublicDecryptJsonWebKeyInput,
-        buffer: BinaryLike,
+        privateKey: RsaPrivateKey | KeyLike,
+        buffer: NodeJS.ArrayBufferView | string,
     ): NonSharedBuffer;
     /**
      * ```js
@@ -2185,7 +2287,6 @@ declare module "node:crypto" {
      * @return An array of the names of the supported hash algorithms, such as `'RSA-SHA256'`. Hash algorithms are also called "digest" algorithms.
      */
     function getHashes(): string[];
-    type ECDHKeyFormat = "compressed" | "uncompressed" | "hybrid";
     /**
      * The `ECDH` class is a utility for creating Elliptic Curve Diffie-Hellman (ECDH)
      * key exchanges.
@@ -2258,21 +2359,15 @@ declare module "node:crypto" {
          * @since v10.0.0
          * @param inputEncoding The `encoding` of the `key` string.
          * @param outputEncoding The `encoding` of the return value.
+         * @param [format='uncompressed']
          */
         static convertKey(
             key: BinaryLike,
             curve: string,
-            inputEncoding?: BufferEncoding,
-            outputEncoding?: null,
-            format?: "uncompressed" | "compressed" | "hybrid",
-        ): NonSharedBuffer;
-        static convertKey(
-            key: BinaryLike,
-            curve: string,
-            inputEncoding: BufferEncoding | null | undefined,
-            outputEncoding: BufferEncoding,
+            inputEncoding?: BinaryToTextEncoding,
+            outputEncoding?: "latin1" | "hex" | "base64" | "base64url",
             format?: "uncompressed" | "compressed" | "hybrid",
-        ): string;
+        ): NonSharedBuffer | string;
         /**
          * Generates private and public EC Diffie-Hellman key values, and returns
          * the public key in the specified `format` and `encoding`. This key should be
@@ -2285,8 +2380,8 @@ declare module "node:crypto" {
          * @param encoding The `encoding` of the return value.
          * @param [format='uncompressed']
          */
-        generateKeys(encoding?: null, format?: ECDHKeyFormat): NonSharedBuffer;
-        generateKeys(encoding: BufferEncoding, format?: ECDHKeyFormat): string;
+        generateKeys(): NonSharedBuffer;
+        generateKeys(encoding: BinaryToTextEncoding, format?: ECDHKeyFormat): string;
         /**
          * Computes the shared secret using `otherPublicKey` as the other
          * party's public key and returns the computed shared secret. The supplied
@@ -2304,11 +2399,13 @@ declare module "node:crypto" {
          * @param inputEncoding The `encoding` of the `otherPublicKey` string.
          * @param outputEncoding The `encoding` of the return value.
          */
-        computeSecret(otherPublicKey: BinaryLike, inputEncoding?: BufferEncoding): NonSharedBuffer;
+        computeSecret(otherPublicKey: NodeJS.ArrayBufferView): NonSharedBuffer;
+        computeSecret(otherPublicKey: string, inputEncoding: BinaryToTextEncoding): NonSharedBuffer;
+        computeSecret(otherPublicKey: NodeJS.ArrayBufferView, outputEncoding: BinaryToTextEncoding): string;
         computeSecret(
-            otherPublicKey: BinaryLike,
-            inputEncoding: BufferEncoding | null | undefined,
-            outputEncoding: BufferEncoding,
+            otherPublicKey: string,
+            inputEncoding: BinaryToTextEncoding,
+            outputEncoding: BinaryToTextEncoding,
         ): string;
         /**
          * If `encoding` is specified, a string is returned; otherwise a `Buffer` is
@@ -2318,7 +2415,7 @@ declare module "node:crypto" {
          * @return The EC Diffie-Hellman in the specified `encoding`.
          */
         getPrivateKey(): NonSharedBuffer;
-        getPrivateKey(encoding: BufferEncoding): string;
+        getPrivateKey(encoding: BinaryToTextEncoding): string;
         /**
          * The `format` argument specifies point encoding and can be `'compressed'` or `'uncompressed'`. If `format` is not specified the point will be returned in`'uncompressed'` format.
          *
@@ -2330,7 +2427,7 @@ declare module "node:crypto" {
          * @return The EC Diffie-Hellman public key in the specified `encoding` and `format`.
          */
         getPublicKey(encoding?: null, format?: ECDHKeyFormat): NonSharedBuffer;
-        getPublicKey(encoding: BufferEncoding, format?: ECDHKeyFormat): string;
+        getPublicKey(encoding: BinaryToTextEncoding, format?: ECDHKeyFormat): string;
         /**
          * Sets the EC Diffie-Hellman private key.
          * If `encoding` is provided, `privateKey` is expected
@@ -2342,7 +2439,8 @@ declare module "node:crypto" {
          * @since v0.11.14
          * @param encoding The `encoding` of the `privateKey` string.
          */
-        setPrivateKey(privateKey: BinaryLike, encoding?: BufferEncoding): void;
+        setPrivateKey(privateKey: NodeJS.ArrayBufferView): void;
+        setPrivateKey(privateKey: string, encoding: BinaryToTextEncoding): void;
     }
     /**
      * Creates an Elliptic Curve Diffie-Hellman (`ECDH`) key exchange object using a
@@ -2377,45 +2475,193 @@ declare module "node:crypto" {
      * not introduce timing vulnerabilities.
      * @since v6.6.0
      */
-    function timingSafeEqual(
-        a: ArrayBufferLike | NodeJS.ArrayBufferView,
-        b: ArrayBufferLike | NodeJS.ArrayBufferView,
-    ): boolean;
-    interface DHKeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {
-        prime?: NodeJS.ArrayBufferView | undefined;
-        primeLength?: number | undefined;
-        generator?: number | undefined;
-        groupName?: string | undefined;
+    function timingSafeEqual(a: NodeJS.ArrayBufferView, b: NodeJS.ArrayBufferView): boolean;
+    type KeyType = "rsa" | "rsa-pss" | "dsa" | "ec" | "ed25519" | "ed448" | "x25519" | "x448";
+    type KeyFormat = "pem" | "der" | "jwk";
+    interface BasePrivateKeyEncodingOptions<T extends KeyFormat> {
+        format: T;
+        cipher?: string | undefined;
+        passphrase?: string | undefined;
     }
-    interface DSAKeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {
-        modulusLength: number;
-        divisorLength?: number | undefined;
+    interface KeyPairKeyObjectResult {
+        publicKey: KeyObject;
+        privateKey: KeyObject;
     }
-    interface ECKeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8" | "sec1"> {
+    interface ED25519KeyPairKeyObjectOptions {}
+    interface ED448KeyPairKeyObjectOptions {}
+    interface X25519KeyPairKeyObjectOptions {}
+    interface X448KeyPairKeyObjectOptions {}
+    interface ECKeyPairKeyObjectOptions {
+        /**
+         * Name of the curve to use
+         */
         namedCurve: string;
+        /**
+         * Must be `'named'` or `'explicit'`. Default: `'named'`.
+         */
         paramEncoding?: "explicit" | "named" | undefined;
     }
-    interface ED25519KeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {}
-    interface ED448KeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {}
-    interface MLDSAKeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {}
-    interface MLKEMKeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {}
-    interface RSAPSSKeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {
+    interface RSAKeyPairKeyObjectOptions {
+        /**
+         * Key size in bits
+         */
+        modulusLength: number;
+        /**
+         * Public exponent
+         * @default 0x10001
+         */
+        publicExponent?: number | undefined;
+    }
+    interface RSAPSSKeyPairKeyObjectOptions {
+        /**
+         * Key size in bits
+         */
         modulusLength: number;
+        /**
+         * Public exponent
+         * @default 0x10001
+         */
         publicExponent?: number | undefined;
+        /**
+         * Name of the message digest
+         */
         hashAlgorithm?: string | undefined;
+        /**
+         * Name of the message digest used by MGF1
+         */
         mgf1HashAlgorithm?: string | undefined;
+        /**
+         * Minimal salt length in bytes
+         */
         saltLength?: string | undefined;
     }
-    interface RSAKeyPairOptions extends KeyPairExportOptions<"pkcs1" | "spki", "pkcs1" | "pkcs8"> {
+    interface DSAKeyPairKeyObjectOptions {
+        /**
+         * Key size in bits
+         */
+        modulusLength: number;
+        /**
+         * Size of q in bits
+         */
+        divisorLength: number;
+    }
+    interface RSAKeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        /**
+         * Key size in bits
+         */
         modulusLength: number;
+        /**
+         * Public exponent
+         * @default 0x10001
+         */
+        publicExponent?: number | undefined;
+        publicKeyEncoding: {
+            type: "pkcs1" | "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs1" | "pkcs8";
+        };
+    }
+    interface RSAPSSKeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        /**
+         * Key size in bits
+         */
+        modulusLength: number;
+        /**
+         * Public exponent
+         * @default 0x10001
+         */
         publicExponent?: number | undefined;
+        /**
+         * Name of the message digest
+         */
+        hashAlgorithm?: string | undefined;
+        /**
+         * Name of the message digest used by MGF1
+         */
+        mgf1HashAlgorithm?: string | undefined;
+        /**
+         * Minimal salt length in bytes
+         */
+        saltLength?: string | undefined;
+        publicKeyEncoding: {
+            type: "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs8";
+        };
+    }
+    interface DSAKeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        /**
+         * Key size in bits
+         */
+        modulusLength: number;
+        /**
+         * Size of q in bits
+         */
+        divisorLength: number;
+        publicKeyEncoding: {
+            type: "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs8";
+        };
+    }
+    interface ECKeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> extends ECKeyPairKeyObjectOptions {
+        publicKeyEncoding: {
+            type: "pkcs1" | "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "sec1" | "pkcs8";
+        };
+    }
+    interface ED25519KeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        publicKeyEncoding: {
+            type: "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs8";
+        };
+    }
+    interface ED448KeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        publicKeyEncoding: {
+            type: "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs8";
+        };
+    }
+    interface X25519KeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        publicKeyEncoding: {
+            type: "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs8";
+        };
+    }
+    interface X448KeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        publicKeyEncoding: {
+            type: "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs8";
+        };
+    }
+    interface KeyPairSyncResult<T1 extends string | Buffer, T2 extends string | Buffer> {
+        publicKey: T1;
+        privateKey: T2;
     }
-    interface SLHDSAKeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {}
-    interface X25519KeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {}
-    interface X448KeyPairOptions extends KeyPairExportOptions<"spki", "pkcs8"> {}
     /**
-     * Generates a new asymmetric key pair of the given `type`. See the
-     * supported [asymmetric key types](https://nodejs.org/docs/latest-v26.x/api/crypto.html#asymmetric-key-types).
+     * Generates a new asymmetric key pair of the given `type`. RSA, RSA-PSS, DSA, EC,
+     * Ed25519, Ed448, X25519, X448, and DH are currently supported.
      *
      * If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
      * behaves as if `keyObject.export()` had been called on its result. Otherwise,
@@ -2452,61 +2698,148 @@ declare module "node:crypto" {
      * When PEM encoding was selected, the respective key will be a string, otherwise
      * it will be a buffer containing the data encoded as DER.
      * @since v10.12.0
-     * @param type The asymmetric key type to generate. See the
-     * supported [asymmetric key types](https://nodejs.org/docs/latest-v26.x/api/crypto.html#asymmetric-key-types).
-     */
-    function generateKeyPairSync<T extends DHKeyPairOptions>(
-        type: "dh",
-        options: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends DSAKeyPairOptions>(
-        type: "dsa",
-        options: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends ECKeyPairOptions>(
-        type: "ec",
-        options: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends ED25519KeyPairOptions = {}>(
-        type: "ed25519",
-        options?: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends ED448KeyPairOptions = {}>(
-        type: "ed448",
-        options?: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends MLDSAKeyPairOptions = {}>(
-        type: MLDSAKeyType,
-        options?: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends MLKEMKeyPairOptions = {}>(
-        type: MLKEMKeyType,
-        options?: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends RSAPSSKeyPairOptions>(
-        type: "rsa-pss",
-        options: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends RSAKeyPairOptions>(
+     * @param type Must be `'rsa'`, `'rsa-pss'`, `'dsa'`, `'ec'`, `'ed25519'`, `'ed448'`, `'x25519'`, `'x448'`, or `'dh'`.
+     */
+    function generateKeyPairSync(
         type: "rsa",
-        options: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends SLHDSAKeyPairOptions = {}>(
-        type: SLHDSAKeyType,
-        options?: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends X25519KeyPairOptions = {}>(
-        type: "x25519",
-        options?: T,
-    ): KeyPairExportResult<T>;
-    function generateKeyPairSync<T extends X448KeyPairOptions = {}>(
-        type: "x448",
-        options?: T,
-    ): KeyPairExportResult<T>;
-    /**
-     * Generates a new asymmetric key pair of the given `type`. See the
-     * supported [asymmetric key types](https://nodejs.org/docs/latest-v26.x/api/crypto.html#asymmetric-key-types).
-     *
+        options: RSAKeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "rsa",
+        options: RSAKeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "rsa",
+        options: RSAKeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "rsa",
+        options: RSAKeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(type: "rsa", options: RSAKeyPairKeyObjectOptions): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type: "rsa-pss",
+        options: RSAPSSKeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "rsa-pss",
+        options: RSAPSSKeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "rsa-pss",
+        options: RSAPSSKeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "rsa-pss",
+        options: RSAPSSKeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(type: "rsa-pss", options: RSAPSSKeyPairKeyObjectOptions): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type: "dsa",
+        options: DSAKeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "dsa",
+        options: DSAKeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "dsa",
+        options: DSAKeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "dsa",
+        options: DSAKeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(type: "dsa", options: DSAKeyPairKeyObjectOptions): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type: "ec",
+        options: ECKeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "ec",
+        options: ECKeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "ec",
+        options: ECKeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "ec",
+        options: ECKeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(type: "ec", options: ECKeyPairKeyObjectOptions): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type: "ed25519",
+        options: ED25519KeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "ed25519",
+        options: ED25519KeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "ed25519",
+        options: ED25519KeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "ed25519",
+        options: ED25519KeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(type: "ed25519", options?: ED25519KeyPairKeyObjectOptions): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type: "ed448",
+        options: ED448KeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "ed448",
+        options: ED448KeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "ed448",
+        options: ED448KeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "ed448",
+        options: ED448KeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(type: "ed448", options?: ED448KeyPairKeyObjectOptions): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type: "x25519",
+        options: X25519KeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "x25519",
+        options: X25519KeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "x25519",
+        options: X25519KeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "x25519",
+        options: X25519KeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(type: "x25519", options?: X25519KeyPairKeyObjectOptions): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type: "x448",
+        options: X448KeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "x448",
+        options: X448KeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "x448",
+        options: X448KeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "x448",
+        options: X448KeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(type: "x448", options?: X448KeyPairKeyObjectOptions): KeyPairKeyObjectResult;
+    /**
+     * Generates a new asymmetric key pair of the given `type`. RSA, RSA-PSS, DSA, EC,
+     * Ed25519, Ed448, X25519, X448, and DH are currently supported.
+     *
      * If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
      * behaves as if `keyObject.export()` had been called on its result. Otherwise,
      * the respective part of the key is returned as a `KeyObject`.
@@ -2540,154 +2873,455 @@ declare module "node:crypto" {
      * If this method is invoked as its `util.promisify()` ed version, it returns
      * a `Promise` for an `Object` with `publicKey` and `privateKey` properties.
      * @since v10.12.0
-     * @param type The asymmetric key type to generate. See the
-     * supported [asymmetric key types](https://nodejs.org/docs/latest-v26.x/api/crypto.html#asymmetric-key-types).
+     * @param type Must be `'rsa'`, `'rsa-pss'`, `'dsa'`, `'ec'`, `'ed25519'`, `'ed448'`, `'x25519'`, `'x448'`, or `'dh'`.
      */
-    function generateKeyPair<T extends DHKeyPairOptions>(
-        type: "dh",
-        options: T,
-        callback: KeyPairExportCallback<T>,
+    function generateKeyPair(
+        type: "rsa",
+        options: RSAKeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "rsa",
+        options: RSAKeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "rsa",
+        options: RSAKeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "rsa",
+        options: RSAKeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "rsa",
+        options: RSAKeyPairKeyObjectOptions,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
+    ): void;
+    function generateKeyPair(
+        type: "rsa-pss",
+        options: RSAPSSKeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "rsa-pss",
+        options: RSAPSSKeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "rsa-pss",
+        options: RSAPSSKeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "rsa-pss",
+        options: RSAPSSKeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "rsa-pss",
+        options: RSAPSSKeyPairKeyObjectOptions,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
+    ): void;
+    function generateKeyPair(
+        type: "dsa",
+        options: DSAKeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
     ): void;
-    function generateKeyPair<T extends DSAKeyPairOptions>(
+    function generateKeyPair(
         type: "dsa",
-        options: T,
-        callback: KeyPairExportCallback<T>,
+        options: DSAKeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
-    function generateKeyPair<T extends ECKeyPairOptions>(
+    function generateKeyPair(
+        type: "dsa",
+        options: DSAKeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "dsa",
+        options: DSAKeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "dsa",
+        options: DSAKeyPairKeyObjectOptions,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
+    ): void;
+    function generateKeyPair(
         type: "ec",
-        options: T,
-        callback: KeyPairExportCallback<T>,
+        options: ECKeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ec",
+        options: ECKeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ec",
+        options: ECKeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ec",
+        options: ECKeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ec",
+        options: ECKeyPairKeyObjectOptions,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
     ): void;
     function generateKeyPair(
         type: "ed25519",
-        callback: KeyPairExportCallback,
+        options: ED25519KeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
     ): void;
-    function generateKeyPair<T extends ED25519KeyPairOptions = {}>(
+    function generateKeyPair(
         type: "ed25519",
-        options: T | undefined,
-        callback: KeyPairExportCallback<T>,
+        options: ED25519KeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
-        type: "ed448",
-        callback: KeyPairExportCallback,
+        type: "ed25519",
+        options: ED25519KeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
-    function generateKeyPair<T extends ED448KeyPairOptions = {}>(
-        type: "ed448",
-        options: T | undefined,
-        callback: KeyPairExportCallback<T>,
+    function generateKeyPair(
+        type: "ed25519",
+        options: ED25519KeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
-        type: MLDSAKeyType,
-        callback: KeyPairExportCallback,
+        type: "ed25519",
+        options: ED25519KeyPairKeyObjectOptions | undefined,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
     ): void;
-    function generateKeyPair<T extends MLDSAKeyPairOptions = {}>(
-        type: MLDSAKeyType,
-        options: T | undefined,
-        callback: KeyPairExportCallback<T>,
+    function generateKeyPair(
+        type: "ed448",
+        options: ED448KeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
     ): void;
     function generateKeyPair(
-        type: MLKEMKeyType,
-        callback: KeyPairExportCallback,
+        type: "ed448",
+        options: ED448KeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
-    function generateKeyPair<T extends MLKEMKeyPairOptions = {}>(
-        type: MLKEMKeyType,
-        options: T | undefined,
-        callback: KeyPairExportCallback<T>,
+    function generateKeyPair(
+        type: "ed448",
+        options: ED448KeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
-    function generateKeyPair<T extends RSAPSSKeyPairOptions>(
-        type: "rsa-pss",
-        options: T,
-        callback: KeyPairExportCallback<T>,
+    function generateKeyPair(
+        type: "ed448",
+        options: ED448KeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
-    function generateKeyPair<T extends RSAKeyPairOptions>(
-        type: "rsa",
-        options: T,
-        callback: KeyPairExportCallback<T>,
+    function generateKeyPair(
+        type: "ed448",
+        options: ED448KeyPairKeyObjectOptions | undefined,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
     ): void;
     function generateKeyPair(
-        type: SLHDSAKeyType,
-        callback: KeyPairExportCallback,
+        type: "x25519",
+        options: X25519KeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
     ): void;
-    function generateKeyPair<T extends SLHDSAKeyPairOptions = {}>(
-        type: SLHDSAKeyType,
-        options: T | undefined,
-        callback: KeyPairExportCallback<T>,
+    function generateKeyPair(
+        type: "x25519",
+        options: X25519KeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "x25519",
-        callback: KeyPairExportCallback,
+        options: X25519KeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
-    function generateKeyPair<T extends X25519KeyPairOptions = {}>(
+    function generateKeyPair(
+        type: "x25519",
+        options: X25519KeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
         type: "x25519",
-        options: T | undefined,
-        callback: KeyPairExportCallback<T>,
+        options: X25519KeyPairKeyObjectOptions | undefined,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
+    ): void;
+    function generateKeyPair(
+        type: "x448",
+        options: X448KeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
     ): void;
     function generateKeyPair(
         type: "x448",
-        callback: KeyPairExportCallback,
+        options: X448KeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
-    function generateKeyPair<T extends X448KeyPairOptions = {}>(
+    function generateKeyPair(
         type: "x448",
-        options: T | undefined,
-        callback: KeyPairExportCallback<T>,
+        options: X448KeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "x448",
+        options: X448KeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "x448",
+        options: X448KeyPairKeyObjectOptions | undefined,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
     ): void;
     namespace generateKeyPair {
-        function __promisify__<T extends DHKeyPairOptions>(
-            type: "dh",
-            options: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends DSAKeyPairOptions>(
+        function __promisify__(
+            type: "rsa",
+            options: RSAKeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "rsa",
+            options: RSAKeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "rsa",
+            options: RSAKeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "rsa",
+            options: RSAKeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(type: "rsa", options: RSAKeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
+            type: "rsa-pss",
+            options: RSAPSSKeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "rsa-pss",
+            options: RSAPSSKeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "rsa-pss",
+            options: RSAPSSKeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "rsa-pss",
+            options: RSAPSSKeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "rsa-pss",
+            options: RSAPSSKeyPairKeyObjectOptions,
+        ): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
+            type: "dsa",
+            options: DSAKeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "dsa",
+            options: DSAKeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "dsa",
+            options: DSAKeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
             type: "dsa",
-            options: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends ECKeyPairOptions>(
+            options: DSAKeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(type: "dsa", options: DSAKeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
             type: "ec",
-            options: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends ED25519KeyPairOptions = {}>(
+            options: ECKeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "ec",
+            options: ECKeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "ec",
+            options: ECKeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "ec",
+            options: ECKeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(type: "ec", options: ECKeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
+            type: "ed25519",
+            options: ED25519KeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "ed25519",
+            options: ED25519KeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "ed25519",
+            options: ED25519KeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
             type: "ed25519",
-            options?: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends ED448KeyPairOptions = {}>(
+            options: ED25519KeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "ed25519",
+            options?: ED25519KeyPairKeyObjectOptions,
+        ): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
             type: "ed448",
-            options?: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends MLDSAKeyPairOptions = {}>(
-            type: MLDSAKeyType,
-            options?: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends MLKEMKeyPairOptions = {}>(
-            type: MLKEMKeyType,
-            options?: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends RSAPSSKeyPairOptions>(
-            type: "rsa-pss",
-            options: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends RSAKeyPairOptions>(
-            type: "rsa",
-            options: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends SLHDSAKeyPairOptions = {}>(
-            type: SLHDSAKeyType,
-            options?: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends X25519KeyPairOptions = {}>(
+            options: ED448KeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "ed448",
+            options: ED448KeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "ed448",
+            options: ED448KeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "ed448",
+            options: ED448KeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(type: "ed448", options?: ED448KeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
             type: "x25519",
-            options?: T,
-        ): Promise<KeyPairExportResult<T>>;
-        function __promisify__<T extends X448KeyPairOptions = {}>(
+            options: X25519KeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "x25519",
+            options: X25519KeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "x25519",
+            options: X25519KeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "x25519",
+            options: X25519KeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "x25519",
+            options?: X25519KeyPairKeyObjectOptions,
+        ): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
+            type: "x448",
+            options: X448KeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "x448",
+            options: X448KeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
             type: "x448",
-            options?: T,
-        ): Promise<KeyPairExportResult<T>>;
+            options: X448KeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "x448",
+            options: X448KeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(type: "x448", options?: X448KeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
     }
     /**
      * Calculates and returns the signature for `data` using the given private key and
      * algorithm. If `algorithm` is `null` or `undefined`, then the algorithm is
-     * dependent upon the key type.
-     *
-     * `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
-     * ML-DSA.
+     * dependent upon the key type (especially Ed25519 and Ed448).
      *
      * If `key` is not a `KeyObject`, this function behaves as if `key` had been
      * passed to {@link createPrivateKey}. If it is an object, the following
@@ -2698,22 +3332,18 @@ declare module "node:crypto" {
      */
     function sign(
         algorithm: string | null | undefined,
-        data: BinaryLike,
+        data: NodeJS.ArrayBufferView,
         key: KeyLike | SignKeyObjectInput | SignPrivateKeyInput | SignJsonWebKeyInput,
     ): NonSharedBuffer;
     function sign(
         algorithm: string | null | undefined,
-        data: BinaryLike,
+        data: NodeJS.ArrayBufferView,
         key: KeyLike | SignKeyObjectInput | SignPrivateKeyInput | SignJsonWebKeyInput,
         callback: (error: Error | null, data: NonSharedBuffer) => void,
     ): void;
     /**
-     * Verifies the given signature for `data` using the given key and algorithm. If
-     * `algorithm` is `null` or `undefined`, then the algorithm is dependent upon the
-     * key type.
-     *
-     * `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
-     * ML-DSA.
+     * Verifies the given signature for `data` using the given key and algorithm. If `algorithm` is `null` or `undefined`, then the algorithm is dependent upon the
+     * key type (especially Ed25519 and Ed448).
      *
      * If `key` is not a `KeyObject`, this function behaves as if `key` had been
      * passed to {@link createPublicKey}. If it is an object, the following
@@ -2729,118 +3359,28 @@ declare module "node:crypto" {
      */
     function verify(
         algorithm: string | null | undefined,
-        data: BinaryLike,
+        data: NodeJS.ArrayBufferView,
         key: KeyLike | VerifyKeyObjectInput | VerifyPublicKeyInput | VerifyJsonWebKeyInput,
-        signature: BinaryLike,
+        signature: NodeJS.ArrayBufferView,
     ): boolean;
     function verify(
         algorithm: string | null | undefined,
-        data: BinaryLike,
+        data: NodeJS.ArrayBufferView,
         key: KeyLike | VerifyKeyObjectInput | VerifyPublicKeyInput | VerifyJsonWebKeyInput,
-        signature: BinaryLike,
+        signature: NodeJS.ArrayBufferView,
         callback: (error: Error | null, result: boolean) => void,
     ): void;
     /**
-     * Key decapsulation using a KEM algorithm with a private key.
-     *
-     * Supported key types and their KEM algorithms are:
-     *
-     * * `'rsa'` RSA Secret Value Encapsulation
-     * * `'ec'` DHKEM(P-256, HKDF-SHA256), DHKEM(P-384, HKDF-SHA256), DHKEM(P-521, HKDF-SHA256)
-     * * `'x25519'` DHKEM(X25519, HKDF-SHA256)
-     * * `'x448'` DHKEM(X448, HKDF-SHA512)
-     * * `'ml-kem-512'` ML-KEM
-     * * `'ml-kem-768'` ML-KEM
-     * * `'ml-kem-1024'` ML-KEM
-     *
-     * If `key` is not a {@link KeyObject}, this function behaves as if `key` had been
-     * passed to `crypto.createPrivateKey()`.
-     *
-     * If the `callback` function is provided this function uses libuv's threadpool.
-     * @since v24.7.0
-     */
-    function decapsulate(
-        key: KeyLike | PrivateKeyInput | RawPrivateKeyInput | JsonWebKeyInput,
-        ciphertext: ArrayBufferLike | NodeJS.ArrayBufferView,
-    ): NonSharedBuffer;
-    function decapsulate(
-        key: KeyLike | PrivateKeyInput | RawPrivateKeyInput | JsonWebKeyInput,
-        ciphertext: ArrayBufferLike | NodeJS.ArrayBufferView,
-        callback: (err: Error, sharedKey: NonSharedBuffer) => void,
-    ): void;
-    interface DiffieHellmanOptions {
-        privateKey: KeyLike | PrivateKeyInput;
-        publicKey: KeyLike | PublicKeyInput;
-    }
-    /**
-     * Computes the Diffie-Hellman shared secret based on a `privateKey` and a `publicKey`.
-     * Both keys must have the same `asymmetricKeyType` and must support either the DH or
-     * ECDH operation.
-     *
-     * If the `callback` function is provided this function uses libuv's threadpool.
+     * Computes the Diffie-Hellman secret based on a `privateKey` and a `publicKey`.
+     * Both keys must have the same `asymmetricKeyType`, which must be one of `'dh'` (for Diffie-Hellman), `'ec'` (for ECDH), `'x448'`, or `'x25519'` (for ECDH-ES).
      * @since v13.9.0, v12.17.0
      */
-    function diffieHellman(options: DiffieHellmanOptions): NonSharedBuffer;
-    function diffieHellman(
-        options: DiffieHellmanOptions,
-        callback: (err: Error | null, secret: NonSharedBuffer) => void,
-    ): void;
-    /**
-     * Key encapsulation using a KEM algorithm with a public key.
-     *
-     * Supported key types and their KEM algorithms are:
-     *
-     * * `'rsa'` RSA Secret Value Encapsulation
-     * * `'ec'` DHKEM(P-256, HKDF-SHA256), DHKEM(P-384, HKDF-SHA256), DHKEM(P-521, HKDF-SHA256)
-     * * `'x25519'` DHKEM(X25519, HKDF-SHA256)
-     * * `'x448'` DHKEM(X448, HKDF-SHA512)
-     * * `'ml-kem-512'` ML-KEM
-     * * `'ml-kem-768'` ML-KEM
-     * * `'ml-kem-1024'` ML-KEM
-     *
-     * If `key` is not a {@link KeyObject}, this function behaves as if `key` had been
-     * passed to `crypto.createPublicKey()`.
-     *
-     * If the `callback` function is provided this function uses libuv's threadpool.
-     * @since v24.7.0
-     */
-    function encapsulate(
-        key: KeyLike | PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput,
-    ): { sharedKey: NonSharedBuffer; ciphertext: NonSharedBuffer };
-    function encapsulate(
-        key: KeyLike | PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput,
-        callback: (err: Error, result: { sharedKey: NonSharedBuffer; ciphertext: NonSharedBuffer }) => void,
-    ): void;
-    interface OneShotDigestOptions {
-        /**
-         * Encoding used to encode the returned digest.
-         * @default 'hex'
-         */
-        outputEncoding?: BufferEncoding | "buffer" | undefined;
-        /**
-         * For XOF hash functions such as 'shake256', the outputLength option
-         * can be used to specify the desired output length in bytes.
-         */
-        outputLength?: number | undefined;
-    }
-    interface OneShotDigestOptionsWithStringEncoding extends OneShotDigestOptions {
-        outputEncoding?: BufferEncoding | undefined;
-    }
-    interface OneShotDigestOptionsWithBufferEncoding extends OneShotDigestOptions {
-        outputEncoding: "buffer";
-    }
+    function diffieHellman(options: { privateKey: KeyObject; publicKey: KeyObject }): NonSharedBuffer;
     /**
-     * A utility for creating one-shot hash digests of data. It can be faster than
-     * the object-based `crypto.createHash()` when hashing a smaller amount of data
-     * (<= 5MB) that's readily available. If the data can be big or if it is streamed,
-     * it's still recommended to use `crypto.createHash()` instead.
-     *
-     * The `algorithm` is dependent on the available algorithms supported by the
-     * version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-     * On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-     * display the available digest algorithms.
-     *
-     * If `options` is a string, then it specifies the `outputEncoding`.
+     * A utility for creating one-shot hash digests of data. It can be faster than the object-based `crypto.createHash()` when hashing a smaller amount of data
+     * (<= 5MB) that's readily available. If the data can be big or if it is streamed, it's still recommended to use `crypto.createHash()` instead. The `algorithm`
+     * is dependent on the available algorithms supported by the version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc. On recent releases
+     * of OpenSSL, `openssl list -digest-algorithms` will display the available digest algorithms.
      *
      * Example:
      *
@@ -2860,25 +3400,16 @@ declare module "node:crypto" {
      * console.log(crypto.hash('sha1', Buffer.from(base64, 'base64'), 'buffer'));
      * ```
      * @since v21.7.0, v20.12.0
-     * @param data When `data` is a string, it will be encoded as UTF-8 before being hashed. If a different
-     * input encoding is desired for a string input, user could encode the string
-     * into a `TypedArray` using either `TextEncoder` or `Buffer.from()` and passing
-     * the encoded `TypedArray` into this API instead.
+     * @param data When `data` is a string, it will be encoded as UTF-8 before being hashed. If a different input encoding is desired for a string input, user
+     *             could encode the string into a `TypedArray` using either `TextEncoder` or `Buffer.from()` and passing the encoded `TypedArray` into this API instead.
+     * @param [outputEncoding='hex'] [Encoding](https://nodejs.org/docs/latest-v22.x/api/buffer.html#buffers-and-character-encodings) used to encode the returned digest.
      */
+    function hash(algorithm: string, data: BinaryLike, outputEncoding?: BinaryToTextEncoding): string;
+    function hash(algorithm: string, data: BinaryLike, outputEncoding: "buffer"): NonSharedBuffer;
     function hash(
         algorithm: string,
         data: BinaryLike,
-        options?: OneShotDigestOptionsWithStringEncoding | BufferEncoding,
-    ): string;
-    function hash(
-        algorithm: string,
-        data: BinaryLike,
-        options: OneShotDigestOptionsWithBufferEncoding | "buffer",
-    ): NonSharedBuffer;
-    function hash(
-        algorithm: string,
-        data: BinaryLike,
-        options: OneShotDigestOptions | BufferEncoding | "buffer",
+        outputEncoding?: BinaryToTextEncoding | "buffer",
     ): string | NonSharedBuffer;
     type CipherMode = "cbc" | "ccm" | "cfb" | "ctr" | "ecb" | "gcm" | "ocb" | "ofb" | "stream" | "wrap" | "xts";
     interface CipherInfoOptions {
@@ -2892,11 +3423,31 @@ declare module "node:crypto" {
         ivLength?: number | undefined;
     }
     interface CipherInfo {
+        /**
+         * The name of the cipher.
+         */
         name: string;
+        /**
+         * The nid of the cipher.
+         */
         nid: number;
-        blockSize?: number;
-        ivLength?: number;
+        /**
+         * The block size of the cipher in bytes.
+         * This property is omitted when mode is 'stream'.
+         */
+        blockSize?: number | undefined;
+        /**
+         * The expected or default initialization vector length in bytes.
+         * This property is omitted if the cipher does not use an initialization vector.
+         */
+        ivLength?: number | undefined;
+        /**
+         * The expected or default key length in bytes.
+         */
         keyLength: number;
+        /**
+         * The cipher mode.
+         */
         mode: CipherMode;
     }
     /**
@@ -2940,7 +3491,7 @@ declare module "node:crypto" {
      */
     function hkdf(
         digest: string,
-        ikm: KeyLike,
+        irm: BinaryLike | KeyObject,
         salt: BinaryLike,
         info: BinaryLike,
         keylen: number,
@@ -2974,15 +3525,27 @@ declare module "node:crypto" {
      */
     function hkdfSync(
         digest: string,
-        ikm: KeyLike,
+        ikm: BinaryLike | KeyObject,
         salt: BinaryLike,
         info: BinaryLike,
         keylen: number,
     ): ArrayBuffer;
     interface SecureHeapUsage {
+        /**
+         * The total allocated secure heap size as specified using the `--secure-heap=n` command-line flag.
+         */
         total: number;
+        /**
+         * The minimum allocation from the secure heap as specified using the `--secure-heap-min` command-line flag.
+         */
         min: number;
+        /**
+         * The total number of bytes currently allocated from the secure heap.
+         */
         used: number;
+        /**
+         * The calculated ratio of `used` to `total` allocated bytes.
+         */
         utilization: number;
     }
     /**
@@ -2995,11 +3558,11 @@ declare module "node:crypto" {
          * Node.js will pre-emptively generate and persistently cache enough
          * random data to generate up to 128 random UUIDs. To generate a UUID
          * without using the cache, set `disableEntropyCache` to `true`.
+         *
          * @default `false`
          */
         disableEntropyCache?: boolean | undefined;
     }
-    interface RandomUUIDV7Options extends RandomUUIDOptions {}
     type UUID = `${string}-${string}-${string}-${string}-${string}`;
     /**
      * Generates a random [RFC 4122](https://www.rfc-editor.org/rfc/rfc4122.txt) version 4 UUID. The UUID is generated using a
@@ -3007,21 +3570,26 @@ declare module "node:crypto" {
      * @since v15.6.0, v14.17.0
      */
     function randomUUID(options?: RandomUUIDOptions): UUID;
-    /**
-     * Generates a random [RFC 9562](https://www.rfc-editor.org/rfc/rfc9562.txt) version 7 UUID. The UUID contains a millisecond
-     * precision Unix timestamp in the most significant 48 bits, followed by
-     * cryptographically secure random bits for the remaining fields, making it
-     * suitable for use as a database key with time-based sorting. The embedded
-     * timestamp relies on a non-monotonic clock and is not guaranteed to be strictly
-     * increasing.
-     * @since v26.1.0
-     */
-    function randomUUIDv7(options?: RandomUUIDV7Options): UUID;
     interface X509CheckOptions {
+        /**
+         * @default 'always'
+         */
         subject?: "always" | "default" | "never" | undefined;
+        /**
+         * @default true
+         */
         wildcards?: boolean | undefined;
+        /**
+         * @default true
+         */
         partialWildcards?: boolean | undefined;
+        /**
+         * @default false
+         */
         multiLabelWildcards?: boolean | undefined;
+        /**
+         * @default false
+         */
         singleLabelSubdomains?: boolean | undefined;
     }
     /**
@@ -3144,16 +3712,6 @@ declare module "node:crypto" {
          * @since v15.6.0
          */
         readonly serialNumber: string;
-        /**
-         * The algorithm used to sign the certificate or `undefined` if the signature algorithm is unknown by OpenSSL.
-         * @since v24.9.0
-         */
-        readonly signatureAlgorithm: string | undefined;
-        /**
-         * The OID of the algorithm used to sign the certificate.
-         * @since v24.9.0
-         */
-        readonly signatureAlgorithmOid: string;
         /**
          * The date/time from which this certificate is considered valid.
          * @since v15.6.0
@@ -3174,7 +3732,7 @@ declare module "node:crypto" {
          * @since v22.10.0
          */
         readonly validToDate: Date;
-        constructor(buffer: string | NodeJS.ArrayBufferView);
+        constructor(buffer: BinaryLike);
         /**
          * Checks whether the certificate matches the given email address.
          *
@@ -3277,10 +3835,13 @@ declare module "node:crypto" {
          */
         verify(publicKey: KeyObject): boolean;
     }
-    type LargeNumberLike = ArrayBufferLike | NodeJS.ArrayBufferView | bigint;
+    type LargeNumberLike = NodeJS.ArrayBufferView | SharedArrayBuffer | ArrayBuffer | bigint;
     interface GeneratePrimeOptions {
         add?: LargeNumberLike | undefined;
         rem?: LargeNumberLike | undefined;
+        /**
+         * @default false
+         */
         safe?: boolean | undefined;
         bigint?: boolean | undefined;
     }
@@ -3320,13 +3881,13 @@ declare module "node:crypto" {
     function generatePrime(size: number, callback: (err: Error | null, prime: ArrayBuffer) => void): void;
     function generatePrime(
         size: number,
-        options: GeneratePrimeOptionsArrayBuffer,
-        callback: (err: Error | null, prime: ArrayBuffer) => void,
+        options: GeneratePrimeOptionsBigInt,
+        callback: (err: Error | null, prime: bigint) => void,
     ): void;
     function generatePrime(
         size: number,
-        options: GeneratePrimeOptionsBigInt,
-        callback: (err: Error | null, prime: bigint) => void,
+        options: GeneratePrimeOptionsArrayBuffer,
+        callback: (err: Error | null, prime: ArrayBuffer) => void,
     ): void;
     function generatePrime(
         size: number,
@@ -3361,8 +3922,8 @@ declare module "node:crypto" {
      * @param size The size (in bits) of the prime to generate.
      */
     function generatePrimeSync(size: number): ArrayBuffer;
-    function generatePrimeSync(size: number, options: GeneratePrimeOptionsArrayBuffer): ArrayBuffer;
     function generatePrimeSync(size: number, options: GeneratePrimeOptionsBigInt): bigint;
+    function generatePrimeSync(size: number, options: GeneratePrimeOptionsArrayBuffer): ArrayBuffer;
     function generatePrimeSync(size: number, options: GeneratePrimeOptions): ArrayBuffer | bigint;
     interface CheckPrimeOptions {
         /**
@@ -3370,6 +3931,7 @@ declare module "node:crypto" {
          * When the value is 0 (zero), a number of checks is used that yields a false positive rate of at most `2**-64` for random input.
          * Care must be used when selecting a number of checks.
          * Refer to the OpenSSL documentation for the BN_is_prime_ex function nchecks options for more details.
+         *
          * @default 0
          */
         checks?: number | undefined;
@@ -3421,101 +3983,7 @@ declare module "node:crypto" {
      * @since v17.4.0
      * @return Returns `typedArray`.
      */
-    function getRandomValues<
-        T extends Exclude<
-            NodeJS.NonSharedTypedArray,
-            NodeJS.NonSharedFloat16Array | NodeJS.NonSharedFloat32Array | NodeJS.NonSharedFloat64Array
-        >,
-    >(typedArray: T): T;
-    type Argon2Algorithm = "argon2d" | "argon2i" | "argon2id";
-    interface Argon2Parameters {
-        message: BinaryLike;
-        nonce: BinaryLike;
-        parallelism: number;
-        tagLength: number;
-        memory: number;
-        passes: number;
-        secret?: BinaryLike | undefined;
-        associatedData?: BinaryLike | undefined;
-    }
-    /**
-     * Provides an asynchronous [Argon2](https://www.rfc-editor.org/rfc/rfc9106.html) implementation. Argon2 is a password-based
-     * key derivation function that is designed to be expensive computationally and
-     * memory-wise in order to make brute-force attacks unrewarding.
-     *
-     * The `nonce` should be as unique as possible. It is recommended that a nonce is
-     * random and at least 16 bytes long. See [NIST SP 800-132](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf) for details.
-     *
-     * When passing strings for `message`, `nonce`, `secret` or `associatedData`, please
-     * consider [caveats when using strings as inputs to cryptographic APIs](https://nodejs.org/docs/latest-v26.x/api/crypto.html#using-strings-as-inputs-to-cryptographic-apis).
-     *
-     * The `callback` function is called with two arguments: `err` and `derivedKey`.
-     * `err` is an exception object when key derivation fails, otherwise `err` is
-     * `null`. `derivedKey` is passed to the callback as a `Buffer`.
-     *
-     * An exception is thrown when any of the input arguments specify invalid values
-     * or types.
-     *
-     * ```js
-     * const { argon2, randomBytes } = await import('node:crypto');
-     *
-     * const parameters = {
-     *   message: 'password',
-     *   nonce: randomBytes(16),
-     *   parallelism: 4,
-     *   tagLength: 64,
-     *   memory: 65536,
-     *   passes: 3,
-     * };
-     *
-     * argon2('argon2id', parameters, (err, derivedKey) => {
-     *   if (err) throw err;
-     *   console.log(derivedKey.toString('hex'));  // 'af91dad...9520f15'
-     * });
-     * ```
-     * @since v24.7.0
-     * @param algorithm Variant of Argon2, one of `"argon2d"`, `"argon2i"` or `"argon2id"`.
-     */
-    function argon2(
-        algorithm: Argon2Algorithm,
-        parameters: Argon2Parameters,
-        callback: (err: Error | null, derivedKey: NonSharedBuffer) => void,
-    ): void;
-    /**
-     * Provides a synchronous [Argon2][] implementation. Argon2 is a password-based
-     * key derivation function that is designed to be expensive computationally and
-     * memory-wise in order to make brute-force attacks unrewarding.
-     *
-     * The `nonce` should be as unique as possible. It is recommended that a nonce is
-     * random and at least 16 bytes long. See [NIST SP 800-132](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf) for details.
-     *
-     * When passing strings for `message`, `nonce`, `secret` or `associatedData`, please
-     * consider [caveats when using strings as inputs to cryptographic APIs](https://nodejs.org/docs/latest-v26.x/api/crypto.html#using-strings-as-inputs-to-cryptographic-apis).
-     *
-     * An exception is thrown when key derivation fails, otherwise the derived key is
-     * returned as a `Buffer`.
-     *
-     * An exception is thrown when any of the input arguments specify invalid values
-     * or types.
-     *
-     * ```js
-     * const { argon2Sync, randomBytes } = await import('node:crypto');
-     *
-     * const parameters = {
-     *   message: 'password',
-     *   nonce: randomBytes(16),
-     *   parallelism: 4,
-     *   tagLength: 64,
-     *   memory: 65536,
-     *   passes: 3,
-     * };
-     *
-     * const derivedKey = argon2Sync('argon2id', parameters);
-     * console.log(derivedKey.toString('hex'));  // 'af91dad...9520f15'
-     * ```
-     * @since v24.7.0
-     */
-    function argon2Sync(algorithm: Argon2Algorithm, parameters: Argon2Parameters): NonSharedBuffer;
+    function getRandomValues<T extends webcrypto.BufferSource>(typedArray: T): T;
     /**
      * A convenient alias for `crypto.webcrypto.subtle`.
      * @since v17.4.0
@@ -3529,40 +3997,37 @@ declare module "node:crypto" {
      */
     const webcrypto: webcrypto.Crypto;
     namespace webcrypto {
-        type AlgorithmIdentifier = Algorithm | string;
-        type BigInteger = NodeJS.NonSharedUint8Array;
-        type KeyFormat = "jwk" | "pkcs8" | "raw" | "raw-public" | "raw-secret" | "raw-seed" | "spki";
+        type BufferSource = ArrayBufferView | ArrayBuffer;
+        type KeyFormat = "jwk" | "pkcs8" | "raw" | "spki";
         type KeyType = "private" | "public" | "secret";
         type KeyUsage =
-            | "decapsulateBits"
-            | "decapsulateKey"
             | "decrypt"
             | "deriveBits"
             | "deriveKey"
-            | "encapsulateBits"
-            | "encapsulateKey"
             | "encrypt"
             | "sign"
             | "unwrapKey"
             | "verify"
             | "wrapKey";
+        type AlgorithmIdentifier = Algorithm | string;
         type HashAlgorithmIdentifier = AlgorithmIdentifier;
         type NamedCurve = string;
-        interface AeadParams extends Algorithm {
-            additionalData?: NodeJS.BufferSource;
-            iv: NodeJS.BufferSource;
-            tagLength: number;
-        }
+        type BigInteger = Uint8Array;
         interface AesCbcParams extends Algorithm {
-            iv: NodeJS.BufferSource;
+            iv: BufferSource;
         }
         interface AesCtrParams extends Algorithm {
-            counter: NodeJS.BufferSource;
+            counter: BufferSource;
             length: number;
         }
         interface AesDerivedKeyParams extends Algorithm {
             length: number;
         }
+        interface AesGcmParams extends Algorithm {
+            additionalData?: BufferSource;
+            iv: BufferSource;
+            tagLength?: number;
+        }
         interface AesKeyAlgorithm extends KeyAlgorithm {
             length: number;
         }
@@ -3572,23 +4037,6 @@ declare module "node:crypto" {
         interface Algorithm {
             name: string;
         }
-        interface Argon2Params extends Algorithm {
-            associatedData?: NodeJS.BufferSource;
-            memory: number;
-            nonce: NodeJS.BufferSource;
-            parallelism: number;
-            passes: number;
-            secretValue?: NodeJS.BufferSource;
-            version?: number;
-        }
-        interface CShakeParams extends Algorithm {
-            customization?: NodeJS.BufferSource;
-            functionName?: NodeJS.BufferSource;
-            outputLength: number;
-        }
-        interface ContextParams extends Algorithm {
-            context?: NodeJS.BufferSource;
-        }
         interface EcKeyAlgorithm extends KeyAlgorithm {
             namedCurve: NamedCurve;
         }
@@ -3604,10 +4052,13 @@ declare module "node:crypto" {
         interface EcdsaParams extends Algorithm {
             hash: HashAlgorithmIdentifier;
         }
+        interface Ed448Params extends Algorithm {
+            context?: BufferSource;
+        }
         interface HkdfParams extends Algorithm {
             hash: HashAlgorithmIdentifier;
-            info: NodeJS.BufferSource;
-            salt: NodeJS.BufferSource;
+            info: BufferSource;
+            salt: BufferSource;
         }
         interface HmacImportParams extends Algorithm {
             hash: HashAlgorithmIdentifier;
@@ -3621,10 +4072,6 @@ declare module "node:crypto" {
             hash: HashAlgorithmIdentifier;
             length?: number;
         }
-        interface KangarooTwelveParams {
-            customization?: NodeJS.BufferSource;
-            outputLength: number;
-        }
         interface JsonWebKey {
             alg?: string;
             crv?: string;
@@ -3648,23 +4095,10 @@ declare module "node:crypto" {
         interface KeyAlgorithm {
             name: string;
         }
-        interface KmacImportParams extends Algorithm {
-            length?: number;
-        }
-        interface KmacKeyAlgorithm extends KeyAlgorithm {
-            length: number;
-        }
-        interface KmacKeyGenParams extends Algorithm {
-            length?: number;
-        }
-        interface KmacParams extends Algorithm {
-            customization?: NodeJS.BufferSource;
-            outputLength: number;
-        }
         interface Pbkdf2Params extends Algorithm {
             hash: HashAlgorithmIdentifier;
             iterations: number;
-            salt: NodeJS.BufferSource;
+            salt: BufferSource;
         }
         interface RsaHashedImportParams extends Algorithm {
             hash: HashAlgorithmIdentifier;
@@ -3684,7 +4118,7 @@ declare module "node:crypto" {
             publicExponent: BigInteger;
         }
         interface RsaOaepParams extends Algorithm {
-            label?: NodeJS.BufferSource;
+            label?: BufferSource;
         }
         interface RsaOtherPrimesInfo {
             d?: string;
@@ -3694,110 +4128,269 @@ declare module "node:crypto" {
         interface RsaPssParams extends Algorithm {
             saltLength: number;
         }
-        interface TurboShakeParams {
-            domainSeparation?: number;
-            outputLength: number;
-        }
+        /**
+         * Importing the `webcrypto` object (`import { webcrypto } from 'node:crypto'`) gives an instance of the `Crypto` class.
+         * `Crypto` is a singleton that provides access to the remainder of the crypto API.
+         * @since v15.0.0
+         */
         interface Crypto {
+            /**
+             * Provides access to the `SubtleCrypto` API.
+             * @since v15.0.0
+             */
             readonly subtle: SubtleCrypto;
-            getRandomValues<
-                T extends Exclude<
-                    NodeJS.NonSharedTypedArray,
-                    NodeJS.NonSharedFloat16Array | NodeJS.NonSharedFloat32Array | NodeJS.NonSharedFloat64Array
-                >,
-            >(
-                typedArray: T,
-            ): T;
+            /**
+             * Generates cryptographically strong random values.
+             * The given `typedArray` is filled with random values, and a reference to `typedArray` is returned.
+             *
+             * The given `typedArray` must be an integer-based instance of {@link NodeJS.TypedArray}, i.e. `Float32Array` and `Float64Array` are not accepted.
+             *
+             * An error will be thrown if the given `typedArray` is larger than 65,536 bytes.
+             * @since v15.0.0
+             */
+            getRandomValues<T extends Exclude<NodeJS.TypedArray, Float32Array | Float64Array>>(typedArray: T): T;
+            /**
+             * Generates a random {@link https://www.rfc-editor.org/rfc/rfc4122.txt RFC 4122} version 4 UUID.
+             * The UUID is generated using a cryptographic pseudorandom number generator.
+             * @since v16.7.0
+             */
             randomUUID(): UUID;
+            CryptoKey: CryptoKeyConstructor;
         }
+        // This constructor throws ILLEGAL_CONSTRUCTOR so it should not be newable.
+        interface CryptoKeyConstructor {
+            /** Illegal constructor */
+            (_: { readonly _: unique symbol }): never; // Allows instanceof to work but not be callable by the user.
+            readonly length: 0;
+            readonly name: "CryptoKey";
+            readonly prototype: CryptoKey;
+        }
+        /**
+         * @since v15.0.0
+         */
         interface CryptoKey {
+            /**
+             * An object detailing the algorithm for which the key can be used along with additional algorithm-specific parameters.
+             * @since v15.0.0
+             */
             readonly algorithm: KeyAlgorithm;
+            /**
+             * When `true`, the {@link CryptoKey} can be extracted using either `subtleCrypto.exportKey()` or `subtleCrypto.wrapKey()`.
+             * @since v15.0.0
+             */
             readonly extractable: boolean;
+            /**
+             * A string identifying whether the key is a symmetric (`'secret'`) or asymmetric (`'private'` or `'public'`) key.
+             * @since v15.0.0
+             */
             readonly type: KeyType;
+            /**
+             * An array of strings identifying the operations for which the key may be used.
+             *
+             * The possible usages are:
+             * - `'encrypt'` - The key may be used to encrypt data.
+             * - `'decrypt'` - The key may be used to decrypt data.
+             * - `'sign'` - The key may be used to generate digital signatures.
+             * - `'verify'` - The key may be used to verify digital signatures.
+             * - `'deriveKey'` - The key may be used to derive a new key.
+             * - `'deriveBits'` - The key may be used to derive bits.
+             * - `'wrapKey'` - The key may be used to wrap another key.
+             * - `'unwrapKey'` - The key may be used to unwrap another key.
+             *
+             * Valid key usages depend on the key algorithm (identified by `cryptokey.algorithm.name`).
+             * @since v15.0.0
+             */
             readonly usages: KeyUsage[];
         }
+        /**
+         * The `CryptoKeyPair` is a simple dictionary object with `publicKey` and `privateKey` properties, representing an asymmetric key pair.
+         * @since v15.0.0
+         */
         interface CryptoKeyPair {
+            /**
+             * A {@link CryptoKey} whose type will be `'private'`.
+             * @since v15.0.0
+             */
             privateKey: CryptoKey;
+            /**
+             * A {@link CryptoKey} whose type will be `'public'`.
+             * @since v15.0.0
+             */
             publicKey: CryptoKey;
         }
-        interface EncapsulatedBits {
-            sharedKey: ArrayBuffer;
-            ciphertext: ArrayBuffer;
-        }
-        interface EncapsulatedKey {
-            sharedKey: CryptoKey;
-            ciphertext: ArrayBuffer;
-        }
+        /**
+         * @since v15.0.0
+         */
         interface SubtleCrypto {
-            decapsulateBits(
-                decapsulationAlgorithm: AlgorithmIdentifier,
-                decapsulationKey: CryptoKey,
-                ciphertext: NodeJS.BufferSource,
-            ): Promise<ArrayBuffer>;
-            decapsulateKey(
-                decapsulationAlgorithm: AlgorithmIdentifier,
-                decapsulationKey: CryptoKey,
-                ciphertext: NodeJS.BufferSource,
-                sharedKeyAlgorithm: AlgorithmIdentifier | HmacImportParams | AesDerivedKeyParams | KmacImportParams,
-                extractable: boolean,
-                keyUsages: KeyUsage[],
-            ): Promise<CryptoKey>;
+            /**
+             * Using the method and parameters specified in `algorithm` and the keying material provided by `key`,
+             * `subtle.decrypt()` attempts to decipher the provided `data`. If successful,
+             * the returned promise will be resolved with an `<ArrayBuffer>` containing the plaintext result.
+             *
+             * The algorithms currently supported include:
+             *
+             * - `'RSA-OAEP'`
+             * - `'AES-CTR'`
+             * - `'AES-CBC'`
+             * - `'AES-GCM'`
+             * @since v15.0.0
+             */
             decrypt(
-                algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,
+                algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams,
                 key: CryptoKey,
-                data: NodeJS.BufferSource,
+                data: BufferSource,
             ): Promise<ArrayBuffer>;
+            /**
+             * Using the method and parameters specified in `algorithm` and the keying material provided by `baseKey`,
+             * `subtle.deriveBits()` attempts to generate `length` bits.
+             * The Node.js implementation requires that when `length` is a number it must be multiple of `8`.
+             * When `length` is `null` the maximum number of bits for a given algorithm is generated. This is allowed
+             * for the `'ECDH'`, `'X25519'`, and `'X448'` algorithms.
+             * If successful, the returned promise will be resolved with an `<ArrayBuffer>` containing the generated data.
+             *
+             * The algorithms currently supported include:
+             *
+             * - `'ECDH'`
+             * - `'X25519'`
+             * - `'X448'`
+             * - `'HKDF'`
+             * - `'PBKDF2'`
+             * @since v15.0.0
+             */
             deriveBits(
-                algorithm: AlgorithmIdentifier | EcdhKeyDeriveParams | HkdfParams | Pbkdf2Params | Argon2Params,
+                algorithm: EcdhKeyDeriveParams,
                 baseKey: CryptoKey,
                 length?: number | null,
             ): Promise<ArrayBuffer>;
+            deriveBits(
+                algorithm: EcdhKeyDeriveParams | HkdfParams | Pbkdf2Params,
+                baseKey: CryptoKey,
+                length: number,
+            ): Promise<ArrayBuffer>;
+            /**
+             * Using the method and parameters specified in `algorithm`, and the keying material provided by `baseKey`,
+             * `subtle.deriveKey()` attempts to generate a new <CryptoKey>` based on the method and parameters in `derivedKeyAlgorithm`.
+             *
+             * Calling `subtle.deriveKey()` is equivalent to calling `subtle.deriveBits()` to generate raw keying material,
+             * then passing the result into the `subtle.importKey()` method using the `deriveKeyAlgorithm`, `extractable`, and `keyUsages` parameters as input.
+             *
+             * The algorithms currently supported include:
+             *
+             * - `'ECDH'`
+             * - `'X25519'`
+             * - `'X448'`
+             * - `'HKDF'`
+             * - `'PBKDF2'`
+             * @param keyUsages See {@link https://nodejs.org/docs/latest/api/webcrypto.html#cryptokeyusages Key usages}.
+             * @since v15.0.0
+             */
             deriveKey(
-                algorithm: AlgorithmIdentifier | EcdhKeyDeriveParams | HkdfParams | Pbkdf2Params | Argon2Params,
+                algorithm: EcdhKeyDeriveParams | HkdfParams | Pbkdf2Params,
                 baseKey: CryptoKey,
-                derivedKeyType: AlgorithmIdentifier | AesDerivedKeyParams | HmacImportParams | KmacImportParams,
+                derivedKeyAlgorithm: AlgorithmIdentifier | HmacImportParams | AesDerivedKeyParams,
                 extractable: boolean,
                 keyUsages: readonly KeyUsage[],
             ): Promise<CryptoKey>;
-            digest(
-                algorithm: AlgorithmIdentifier | CShakeParams | TurboShakeParams | KangarooTwelveParams,
-                data: NodeJS.BufferSource,
-            ): Promise<ArrayBuffer>;
-            encapsulateBits(
-                encapsulationAlgorithm: AlgorithmIdentifier,
-                encapsulationKey: CryptoKey,
-            ): Promise<EncapsulatedBits>;
-            encapsulateKey(
-                encapsulationAlgorithm: AlgorithmIdentifier,
-                encapsulationKey: CryptoKey,
-                sharedKeyAlgorithm: AlgorithmIdentifier | AesDerivedKeyParams | HmacImportParams | KmacImportParams,
-                extractable: boolean,
-                keyUsages: KeyUsage[],
-            ): Promise<EncapsulatedKey>;
+            /**
+             * Using the method identified by `algorithm`, `subtle.digest()` attempts to generate a digest of `data`.
+             * If successful, the returned promise is resolved with an `<ArrayBuffer>` containing the computed digest.
+             *
+             * If `algorithm` is provided as a `<string>`, it must be one of:
+             *
+             * - `'SHA-1'`
+             * - `'SHA-256'`
+             * - `'SHA-384'`
+             * - `'SHA-512'`
+             *
+             * If `algorithm` is provided as an `<Object>`, it must have a `name` property whose value is one of the above.
+             * @since v15.0.0
+             */
+            digest(algorithm: AlgorithmIdentifier, data: BufferSource): Promise<ArrayBuffer>;
+            /**
+             * Using the method and parameters specified by `algorithm` and the keying material provided by `key`,
+             * `subtle.encrypt()` attempts to encipher `data`. If successful,
+             * the returned promise is resolved with an `<ArrayBuffer>` containing the encrypted result.
+             *
+             * The algorithms currently supported include:
+             *
+             * - `'RSA-OAEP'`
+             * - `'AES-CTR'`
+             * - `'AES-CBC'`
+             * - `'AES-GCM'`
+             * @since v15.0.0
+             */
             encrypt(
-                algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,
+                algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams,
                 key: CryptoKey,
-                data: NodeJS.BufferSource,
+                data: BufferSource,
             ): Promise<ArrayBuffer>;
+            /**
+             * Exports the given key into the specified format, if supported.
+             *
+             * If the `<CryptoKey>` is not extractable, the returned promise will reject.
+             *
+             * When `format` is either `'pkcs8'` or `'spki'` and the export is successful,
+             * the returned promise will be resolved with an `<ArrayBuffer>` containing the exported key data.
+             *
+             * When `format` is `'jwk'` and the export is successful, the returned promise will be resolved with a
+             * JavaScript object conforming to the {@link https://tools.ietf.org/html/rfc7517 JSON Web Key} specification.
+             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, or `'jwk'`.
+             * @returns `<Promise>` containing `<ArrayBuffer>`.
+             * @since v15.0.0
+             */
             exportKey(format: "jwk", key: CryptoKey): Promise<JsonWebKey>;
             exportKey(format: Exclude<KeyFormat, "jwk">, key: CryptoKey): Promise<ArrayBuffer>;
-            exportKey(format: KeyFormat, key: CryptoKey): Promise<ArrayBuffer | JsonWebKey>;
+            /**
+             * Using the method and parameters provided in `algorithm`,
+             * `subtle.generateKey()` attempts to generate new keying material.
+             * Depending the method used, the method may generate either a single `<CryptoKey>` or a `<CryptoKeyPair>`.
+             *
+             * The `<CryptoKeyPair>` (public and private key) generating algorithms supported include:
+             *
+             * - `'RSASSA-PKCS1-v1_5'`
+             * - `'RSA-PSS'`
+             * - `'RSA-OAEP'`
+             * - `'ECDSA'`
+             * - `'Ed25519'`
+             * - `'Ed448'`
+             * - `'ECDH'`
+             * - `'X25519'`
+             * - `'X448'`
+             * The `<CryptoKey>` (secret key) generating algorithms supported include:
+             *
+             * - `'HMAC'`
+             * - `'AES-CTR'`
+             * - `'AES-CBC'`
+             * - `'AES-GCM'`
+             * - `'AES-KW'`
+             * @param keyUsages See {@link https://nodejs.org/docs/latest/api/webcrypto.html#cryptokeyusages Key usages}.
+             * @since v15.0.0
+             */
             generateKey(
                 algorithm: RsaHashedKeyGenParams | EcKeyGenParams,
                 extractable: boolean,
-                keyUsages: KeyUsage[],
+                keyUsages: readonly KeyUsage[],
             ): Promise<CryptoKeyPair>;
             generateKey(
-                algorithm: AesKeyGenParams | HmacKeyGenParams | Pbkdf2Params | KmacKeyGenParams,
+                algorithm: AesKeyGenParams | HmacKeyGenParams | Pbkdf2Params,
                 extractable: boolean,
-                keyUsages: KeyUsage[],
+                keyUsages: readonly KeyUsage[],
             ): Promise<CryptoKey>;
             generateKey(
                 algorithm: AlgorithmIdentifier,
                 extractable: boolean,
                 keyUsages: KeyUsage[],
             ): Promise<CryptoKeyPair | CryptoKey>;
-            getPublicKey(key: CryptoKey, keyUsages: KeyUsage[]): Promise<CryptoKey>;
+            /**
+             * The `subtle.importKey()` method attempts to interpret the provided `keyData` as the given `format`
+             * to create a `<CryptoKey>` instance using the provided `algorithm`, `extractable`, and `keyUsages` arguments.
+             * If the import is successful, the returned promise will be resolved with the created `<CryptoKey>`.
+             *
+             * If importing a `'PBKDF2'` key, `extractable` must be `false`.
+             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, or `'jwk'`.
+             * @param keyUsages See {@link https://nodejs.org/docs/latest/api/webcrypto.html#cryptokeyusages Key usages}.
+             * @since v15.0.0
+             */
             importKey(
                 format: "jwk",
                 keyData: JsonWebKey,
@@ -3806,147 +4399,147 @@ declare module "node:crypto" {
                     | RsaHashedImportParams
                     | EcKeyImportParams
                     | HmacImportParams
-                    | AesKeyAlgorithm
-                    | KmacImportParams,
+                    | AesKeyAlgorithm,
                 extractable: boolean,
-                keyUsages: KeyUsage[],
+                keyUsages: readonly KeyUsage[],
             ): Promise<CryptoKey>;
             importKey(
                 format: Exclude<KeyFormat, "jwk">,
-                keyData: NodeJS.BufferSource,
+                keyData: BufferSource,
                 algorithm:
                     | AlgorithmIdentifier
                     | RsaHashedImportParams
                     | EcKeyImportParams
                     | HmacImportParams
-                    | AesKeyAlgorithm
-                    | KmacImportParams,
+                    | AesKeyAlgorithm,
                 extractable: boolean,
                 keyUsages: KeyUsage[],
             ): Promise<CryptoKey>;
+            /**
+             * Using the method and parameters given by `algorithm` and the keying material provided by `key`,
+             * `subtle.sign()` attempts to generate a cryptographic signature of `data`. If successful,
+             * the returned promise is resolved with an `<ArrayBuffer>` containing the generated signature.
+             *
+             * The algorithms currently supported include:
+             *
+             * - `'RSASSA-PKCS1-v1_5'`
+             * - `'RSA-PSS'`
+             * - `'ECDSA'`
+             * - `'Ed25519'`
+             * - `'Ed448'`
+             * - `'HMAC'`
+             * @since v15.0.0
+             */
             sign(
-                algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams | ContextParams | KmacParams,
+                algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams | Ed448Params,
                 key: CryptoKey,
-                data: NodeJS.BufferSource,
+                data: BufferSource,
             ): Promise<ArrayBuffer>;
+            /**
+             * In cryptography, "wrapping a key" refers to exporting and then encrypting the keying material.
+             * The `subtle.unwrapKey()` method attempts to decrypt a wrapped key and create a `<CryptoKey>` instance.
+             * It is equivalent to calling `subtle.decrypt()` first on the encrypted key data (using the `wrappedKey`, `unwrapAlgo`, and `unwrappingKey` arguments as input)
+             * then passing the results in to the `subtle.importKey()` method using the `unwrappedKeyAlgo`, `extractable`, and `keyUsages` arguments as inputs.
+             * If successful, the returned promise is resolved with a `<CryptoKey>` object.
+             *
+             * The wrapping algorithms currently supported include:
+             *
+             * - `'RSA-OAEP'`
+             * - `'AES-CTR'`
+             * - `'AES-CBC'`
+             * - `'AES-GCM'`
+             * - `'AES-KW'`
+             *
+             * The unwrapped key algorithms supported include:
+             *
+             * - `'RSASSA-PKCS1-v1_5'`
+             * - `'RSA-PSS'`
+             * - `'RSA-OAEP'`
+             * - `'ECDSA'`
+             * - `'Ed25519'`
+             * - `'Ed448'`
+             * - `'ECDH'`
+             * - `'X25519'`
+             * - `'X448'`
+             * - `'HMAC'`
+             * - `'AES-CTR'`
+             * - `'AES-CBC'`
+             * - `'AES-GCM'`
+             * - `'AES-KW'`
+             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, or `'jwk'`.
+             * @param keyUsages See {@link https://nodejs.org/docs/latest/api/webcrypto.html#cryptokeyusages Key usages}.
+             * @since v15.0.0
+             */
             unwrapKey(
                 format: KeyFormat,
-                wrappedKey: NodeJS.BufferSource,
+                wrappedKey: BufferSource,
                 unwrappingKey: CryptoKey,
-                unwrapAlgorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,
+                unwrapAlgorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams,
                 unwrappedKeyAlgorithm:
                     | AlgorithmIdentifier
                     | RsaHashedImportParams
                     | EcKeyImportParams
                     | HmacImportParams
-                    | AesKeyAlgorithm
-                    | KmacImportParams,
+                    | AesKeyAlgorithm,
                 extractable: boolean,
                 keyUsages: KeyUsage[],
             ): Promise<CryptoKey>;
+            /**
+             * Using the method and parameters given in `algorithm` and the keying material provided by `key`,
+             * `subtle.verify()` attempts to verify that `signature` is a valid cryptographic signature of `data`.
+             * The returned promise is resolved with either `true` or `false`.
+             *
+             * The algorithms currently supported include:
+             *
+             * - `'RSASSA-PKCS1-v1_5'`
+             * - `'RSA-PSS'`
+             * - `'ECDSA'`
+             * - `'Ed25519'`
+             * - `'Ed448'`
+             * - `'HMAC'`
+             * @since v15.0.0
+             */
             verify(
-                algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams | ContextParams | KmacParams,
+                algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams | Ed448Params,
                 key: CryptoKey,
-                signature: NodeJS.BufferSource,
-                data: NodeJS.BufferSource,
+                signature: BufferSource,
+                data: BufferSource,
             ): Promise<boolean>;
+            /**
+             * In cryptography, "wrapping a key" refers to exporting and then encrypting the keying material.
+             * The `subtle.wrapKey()` method exports the keying material into the format identified by `format`,
+             * then encrypts it using the method and parameters specified by `wrapAlgo` and the keying material provided by `wrappingKey`.
+             * It is the equivalent to calling `subtle.exportKey()` using `format` and `key` as the arguments,
+             * then passing the result to the `subtle.encrypt()` method using `wrappingKey` and `wrapAlgo` as inputs.
+             * If successful, the returned promise will be resolved with an `<ArrayBuffer>` containing the encrypted key data.
+             *
+             * The wrapping algorithms currently supported include:
+             *
+             * - `'RSA-OAEP'`
+             * - `'AES-CTR'`
+             * - `'AES-CBC'`
+             * - `'AES-GCM'`
+             * - `'AES-KW'`
+             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, or `'jwk'`.
+             * @since v15.0.0
+             */
             wrapKey(
                 format: KeyFormat,
                 key: CryptoKey,
                 wrappingKey: CryptoKey,
-                wrapAlgorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,
+                wrapAlgorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams,
             ): Promise<ArrayBuffer>;
         }
     }
-    /**
-     * An object containing commonly used constants for crypto and security related
-     * operations. The specific constants currently defined are described in
-     * [Crypto constants](https://nodejs.org/docs/latest-v26.x/api/crypto.html#crypto-constants).
-     * @since v6.3.0
-     */
-    namespace constants {
-        const OPENSSL_VERSION_NUMBER: number;
-        const SSL_OP_ALL: number;
-        const SSL_OP_ALLOW_NO_DHE_KEX: number;
-        const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: number;
-        const SSL_OP_CIPHER_SERVER_PREFERENCE: number;
-        const SSL_OP_CISCO_ANYCONNECT: number;
-        const SSL_OP_COOKIE_EXCHANGE: number;
-        const SSL_OP_CRYPTOPRO_TLSEXT_BUG: number;
-        const SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS: number;
-        const SSL_OP_LEGACY_SERVER_CONNECT: number;
-        const SSL_OP_NO_COMPRESSION: number;
-        const SSL_OP_NO_ENCRYPT_THEN_MAC: number;
-        const SSL_OP_NO_QUERY_MTU: number;
-        const SSL_OP_NO_RENEGOTIATION: number;
-        const SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION: number;
-        const SSL_OP_NO_SSLv2: number;
-        const SSL_OP_NO_SSLv3: number;
-        const SSL_OP_NO_TICKET: number;
-        const SSL_OP_NO_TLSv1: number;
-        const SSL_OP_NO_TLSv1_1: number;
-        const SSL_OP_NO_TLSv1_2: number;
-        const SSL_OP_NO_TLSv1_3: number;
-        const SSL_OP_PRIORITIZE_CHACHA: number;
-        const SSL_OP_TLS_ROLLBACK_BUG: number;
-        const ENGINE_METHOD_RSA: number;
-        const ENGINE_METHOD_DSA: number;
-        const ENGINE_METHOD_DH: number;
-        const ENGINE_METHOD_RAND: number;
-        const ENGINE_METHOD_EC: number;
-        const ENGINE_METHOD_CIPHERS: number;
-        const ENGINE_METHOD_DIGESTS: number;
-        const ENGINE_METHOD_PKEY_METHS: number;
-        const ENGINE_METHOD_PKEY_ASN1_METHS: number;
-        const ENGINE_METHOD_ALL: number;
-        const ENGINE_METHOD_NONE: number;
-        const DH_CHECK_P_NOT_SAFE_PRIME: number;
-        const DH_CHECK_P_NOT_PRIME: number;
-        const DH_UNABLE_TO_CHECK_GENERATOR: number;
-        const DH_NOT_SUITABLE_GENERATOR: number;
-        const RSA_PKCS1_PADDING: number;
-        const RSA_NO_PADDING: number;
-        const RSA_PKCS1_OAEP_PADDING: number;
-        const RSA_X931_PADDING: number;
-        const RSA_PKCS1_PSS_PADDING: number;
-        const RSA_PSS_SALTLEN_DIGEST: number;
-        const RSA_PSS_SALTLEN_MAX_SIGN: number;
-        const RSA_PSS_SALTLEN_AUTO: number;
-        const TLS1_VERSION: number;
-        const TLS1_1_VERSION: number;
-        const TLS1_2_VERSION: number;
-        const TLS1_3_VERSION: number;
-        const POINT_CONVERSION_COMPRESSED: number;
-        const POINT_CONVERSION_UNCOMPRESSED: number;
-        const POINT_CONVERSION_HYBRID: number;
-        const defaultCipherList: string;
-        const defaultCoreCipherList: string;
-    }
-    // TODO: remove in future major version
-    /** @deprecated This type will be removed in a future version. Use `BufferEncoding` instead. */
-    type BinaryToTextEncoding = "base64" | "base64url" | "hex" | "binary";
-    /** @deprecated This type will be removed in a future version. Use `BufferEncoding` instead. */
-    type CharacterEncoding = "utf8" | "utf-8" | "utf16le" | "utf-16le" | "latin1";
-    /** @deprecated This type will be removed in a future version. Use `BufferEncoding` instead. */
-    type LegacyCharacterEncoding = "ascii" | "binary" | "ucs2" | "ucs-2";
-    /** @deprecated This type will be removed in a future version. Use `BufferEncoding` instead. */
-    type Encoding = BufferEncoding;
-    /** @deprecated This type will be removed in a future version. Use `KeyLike` instead. */
-    type CipherKey = KeyLike;
-    /** @deprecated This type will be removed in a future version. */
-    interface RsaPrivateKey {
-        key: KeyLike;
-        passphrase?: string | undefined;
-        oaepHash?: string | undefined;
-        oaepLabel?: NodeJS.TypedArray | undefined;
-        padding?: number | undefined;
-    }
-    /** @deprecated This type will be removed in a future version. */
-    interface RsaPublicKey {
-        key: KeyLike;
-        padding?: number | undefined;
+
+    global {
+        var crypto: typeof globalThis extends {
+            crypto: infer T;
+            onmessage: any;
+        } ? T
+            : webcrypto.Crypto;
     }
 }
-declare module "crypto" {
-    export * from "node:crypto";
+declare module "node:crypto" {
+    export * from "crypto";
 }