@rio-cloud/cdk-v2-constructs 8.2.0 → 8.2.1-alpha.0

package/node_modules/@types/node/crypto.d.ts

@@ -14,9 +14,10 @@
  * // Prints:
  * //   c0fa1bc00531bd78ef38c628449c5102aeabd49b5dc3a2a516ea6ea959d6658e
  * ```
- * @see [source](https://github.com/nodejs/node/blob/v20.2.0/lib/crypto.js)
+ * @see [source](https://github.com/nodejs/node/blob/v24.x/lib/crypto.js)
  */
 declare module "crypto" {
+    import { NonSharedBuffer } from "node:buffer";
     import * as stream from "node:stream";
     import { PeerCertificate } from "node:tls";
     /**
@@ -27,7 +28,7 @@ declare module "crypto" {
      * should not use this element anymore.
      *
      * The `node:crypto` module provides the `Certificate` class for working with SPKAC
-     * data. The most common usage is handling output generated by the HTML5`<keygen>` element. Node.js uses [OpenSSL's SPKAC
+     * data. The most common usage is handling output generated by the HTML5 `<keygen>` element. Node.js uses [OpenSSL's SPKAC
      * implementation](https://www.openssl.org/docs/man3.0/man1/openssl-spkac.html) internally.
      * @since v0.11.8
      */
@@ -44,7 +45,7 @@ declare module "crypto" {
          * @param encoding The `encoding` of the `spkac` string.
          * @return The challenge component of the `spkac` data structure, which includes a public key and a challenge.
          */
-        static exportChallenge(spkac: BinaryLike): Buffer;
+        static exportChallenge(spkac: BinaryLike): NonSharedBuffer;
         /**
          * ```js
          * const { Certificate } = await import('node:crypto');
@@ -57,7 +58,7 @@ declare module "crypto" {
          * @param encoding The `encoding` of the `spkac` string.
          * @return The public key component of the `spkac` data structure, which includes a public key and a challenge.
          */
-        static exportPublicKey(spkac: BinaryLike, encoding?: string): Buffer;
+        static exportPublicKey(spkac: BinaryLike, encoding?: string): NonSharedBuffer;
         /**
          * ```js
          * import { Buffer } from 'node:buffer';
@@ -78,7 +79,7 @@ declare module "crypto" {
          * @returns The challenge component of the `spkac` data structure,
          * which includes a public key and a challenge.
          */
-        exportChallenge(spkac: BinaryLike): Buffer;
+        exportChallenge(spkac: BinaryLike): NonSharedBuffer;
         /**
          * @deprecated
          * @param spkac
@@ -86,7 +87,7 @@ declare module "crypto" {
          * @returns The public key component of the `spkac` data structure,
          * which includes a public key and a challenge.
          */
-        exportPublicKey(spkac: BinaryLike, encoding?: string): Buffer;
+        exportPublicKey(spkac: BinaryLike, encoding?: string): NonSharedBuffer;
         /**
          * @deprecated
          * @param spkac
@@ -96,15 +97,17 @@ declare module "crypto" {
         verifySpkac(spkac: NodeJS.ArrayBufferView): boolean;
     }
     namespace constants {
-        // https://nodejs.org/dist/latest-v20.x/docs/api/crypto.html#crypto-constants
+        // https://nodejs.org/dist/latest-v24.x/docs/api/crypto.html#crypto-constants
         const OPENSSL_VERSION_NUMBER: number;
         /** Applies multiple bug workarounds within OpenSSL. See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html for detail. */
         const SSL_OP_ALL: number;
+        /** Instructs OpenSSL to allow a non-[EC]DHE-based key exchange mode for TLS v1.3 */
+        const SSL_OP_ALLOW_NO_DHE_KEX: number;
         /** Allows legacy insecure renegotiation between OpenSSL and unpatched clients or servers. See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html. */
         const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: number;
         /** Attempts to use the server's preferences instead of the client's when selecting a cipher. See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_options.html. */
         const SSL_OP_CIPHER_SERVER_PREFERENCE: number;
-        /** Instructs OpenSSL to use Cisco's "speshul" version of DTLS_BAD_VER. */
+        /** Instructs OpenSSL to use Cisco's version identifier of DTLS_BAD_VER. */
         const SSL_OP_CISCO_ANYCONNECT: number;
         /** Instructs OpenSSL to turn on cookie exchange. */
         const SSL_OP_COOKIE_EXCHANGE: number;
@@ -116,15 +119,29 @@ declare module "crypto" {
         const SSL_OP_LEGACY_SERVER_CONNECT: number;
         /** Instructs OpenSSL to disable support for SSL/TLS compression. */
         const SSL_OP_NO_COMPRESSION: number;
+        /** Instructs OpenSSL to disable encrypt-then-MAC. */
+        const SSL_OP_NO_ENCRYPT_THEN_MAC: number;
         const SSL_OP_NO_QUERY_MTU: number;
+        /** Instructs OpenSSL to disable renegotiation. */
+        const SSL_OP_NO_RENEGOTIATION: number;
         /** Instructs OpenSSL to always start a new session when performing renegotiation. */
         const SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION: number;
+        /** Instructs OpenSSL to turn off SSL v2 */
         const SSL_OP_NO_SSLv2: number;
+        /** Instructs OpenSSL to turn off SSL v3 */
         const SSL_OP_NO_SSLv3: number;
+        /** Instructs OpenSSL to disable use of RFC4507bis tickets. */
         const SSL_OP_NO_TICKET: number;
+        /** Instructs OpenSSL to turn off TLS v1 */
         const SSL_OP_NO_TLSv1: number;
+        /** Instructs OpenSSL to turn off TLS v1.1 */
         const SSL_OP_NO_TLSv1_1: number;
+        /** Instructs OpenSSL to turn off TLS v1.2 */
         const SSL_OP_NO_TLSv1_2: number;
+        /** Instructs OpenSSL to turn off TLS v1.3 */
+        const SSL_OP_NO_TLSv1_3: number;
+        /** Instructs OpenSSL server to prioritize ChaCha20-Poly1305 when the client does. This option has no effect if `SSL_OP_CIPHER_SERVER_PREFERENCE` is not enabled. */
+        const SSL_OP_PRIORITIZE_CHACHA: number;
         /** Instructs OpenSSL to disable version rollback attack detection. */
         const SSL_OP_TLS_ROLLBACK_BUG: number;
         const ENGINE_METHOD_RSA: number;
@@ -363,7 +380,7 @@ declare module "crypto" {
          * @since v13.1.0
          * @param options `stream.transform` options
          */
-        copy(options?: stream.TransformOptions): Hash;
+        copy(options?: HashOptions): Hash;
         /**
          * Updates the hash content with the given `data`, the encoding of which
          * is given in `inputEncoding`.
@@ -386,7 +403,7 @@ declare module "crypto" {
          * @since v0.1.92
          * @param encoding The `encoding` of the return value.
          */
-        digest(): Buffer;
+        digest(): NonSharedBuffer;
         digest(encoding: BinaryToTextEncoding): string;
     }
     /**
@@ -454,6 +471,7 @@ declare module "crypto" {
      * //   7fd04df92f636fd450bc841c9418e5825c17f33ad9c87c518115a45971f7f77e
      * ```
      * @since v0.1.94
+     * @deprecated Since v20.13.0 Calling `Hmac` class directly with `Hmac()` or `new Hmac()` is deprecated due to being internals, not intended for public use. Please use the {@link createHmac} method to create Hmac instances.
      */
     class Hmac extends stream.Transform {
         private constructor();
@@ -479,7 +497,7 @@ declare module "crypto" {
          * @since v0.1.94
          * @param encoding The `encoding` of the return value.
          */
-        digest(): Buffer;
+        digest(): NonSharedBuffer;
         digest(encoding: BinaryToTextEncoding): string;
     }
     type KeyObjectType = "secret" | "public" | "private";
@@ -493,50 +511,50 @@ declare module "crypto" {
         format: "jwk";
     }
     interface JsonWebKey {
-        crv?: string | undefined;
-        d?: string | undefined;
-        dp?: string | undefined;
-        dq?: string | undefined;
-        e?: string | undefined;
-        k?: string | undefined;
-        kty?: string | undefined;
-        n?: string | undefined;
-        p?: string | undefined;
-        q?: string | undefined;
-        qi?: string | undefined;
-        x?: string | undefined;
-        y?: string | undefined;
+        crv?: string;
+        d?: string;
+        dp?: string;
+        dq?: string;
+        e?: string;
+        k?: string;
+        kty?: string;
+        n?: string;
+        p?: string;
+        q?: string;
+        qi?: string;
+        x?: string;
+        y?: string;
         [key: string]: unknown;
     }
     interface AsymmetricKeyDetails {
         /**
          * Key size in bits (RSA, DSA).
          */
-        modulusLength?: number | undefined;
+        modulusLength?: number;
         /**
          * Public exponent (RSA).
          */
-        publicExponent?: bigint | undefined;
+        publicExponent?: bigint;
         /**
          * Name of the message digest (RSA-PSS).
          */
-        hashAlgorithm?: string | undefined;
+        hashAlgorithm?: string;
         /**
          * Name of the message digest used by MGF1 (RSA-PSS).
          */
-        mgf1HashAlgorithm?: string | undefined;
+        mgf1HashAlgorithm?: string;
         /**
          * Minimal salt length in bytes (RSA-PSS).
          */
-        saltLength?: number | undefined;
+        saltLength?: number;
         /**
          * Size of q in bits (DSA).
          */
-        divisorLength?: number | undefined;
+        divisorLength?: number;
         /**
          * Name of the curve (EC).
          */
-        namedCurve?: string | undefined;
+        namedCurve?: string;
     }
     /**
      * Node.js uses a `KeyObject` class to represent a symmetric or asymmetric key,
@@ -574,29 +592,14 @@ declare module "crypto" {
          */
         static from(key: webcrypto.CryptoKey): KeyObject;
         /**
-         * For asymmetric keys, this property represents the type of the key. Supported key
-         * types are:
-         *
-         * * `'rsa'` (OID 1.2.840.113549.1.1.1)
-         * * `'rsa-pss'` (OID 1.2.840.113549.1.1.10)
-         * * `'dsa'` (OID 1.2.840.10040.4.1)
-         * * `'ec'` (OID 1.2.840.10045.2.1)
-         * * `'x25519'` (OID 1.3.101.110)
-         * * `'x448'` (OID 1.3.101.111)
-         * * `'ed25519'` (OID 1.3.101.112)
-         * * `'ed448'` (OID 1.3.101.113)
-         * * `'dh'` (OID 1.2.840.113549.1.3.1)
+         * For asymmetric keys, this property represents the type of the key. See the
+         * supported [asymmetric key types](https://nodejs.org/docs/latest-v24.x/api/crypto.html#asymmetric-key-types).
          *
          * This property is `undefined` for unrecognized `KeyObject` types and symmetric
          * keys.
          * @since v11.6.0
          */
-        asymmetricKeyType?: KeyType | undefined;
-        /**
-         * For asymmetric keys, this property represents the size of the embedded key in
-         * bytes. This property is `undefined` for symmetric keys.
-         */
-        asymmetricKeySize?: number | undefined;
+        asymmetricKeyType?: KeyType;
         /**
          * This property exists only on asymmetric keys. Depending on the type of the key,
          * this object contains information about the key. None of the information obtained
@@ -610,7 +613,7 @@ declare module "crypto" {
          * Other key details might be exposed via this API using additional attributes.
          * @since v15.7.0
          */
-        asymmetricKeyDetails?: AsymmetricKeyDetails | undefined;
+        asymmetricKeyDetails?: AsymmetricKeyDetails;
         /**
          * For symmetric keys, the following encoding options can be used:
          *
@@ -634,15 +637,35 @@ declare module "crypto" {
          * PKCS#1 and SEC1 encryption.
          * @since v11.6.0
          */
-        export(options: KeyExportOptions<"pem">): string | Buffer;
-        export(options?: KeyExportOptions<"der">): Buffer;
+        export(options: KeyExportOptions<"pem">): string | NonSharedBuffer;
+        export(options?: KeyExportOptions<"der">): NonSharedBuffer;
         export(options?: JwkKeyExportOptions): JsonWebKey;
+        /**
+         * Returns `true` or `false` depending on whether the keys have exactly the same
+         * type, value, and parameters. This method is not [constant time](https://en.wikipedia.org/wiki/Timing_attack).
+         * @since v17.7.0, v16.15.0
+         * @param otherKeyObject A `KeyObject` with which to compare `keyObject`.
+         */
+        equals(otherKeyObject: KeyObject): boolean;
         /**
          * For secret keys, this property represents the size of the key in bytes. This
          * property is `undefined` for asymmetric keys.
          * @since v11.6.0
          */
-        symmetricKeySize?: number | undefined;
+        symmetricKeySize?: number;
+        /**
+         * Converts a `KeyObject` instance to a `CryptoKey`.
+         * @since 22.10.0
+         */
+        toCryptoKey(
+            algorithm:
+                | webcrypto.AlgorithmIdentifier
+                | webcrypto.RsaHashedImportParams
+                | webcrypto.EcKeyImportParams
+                | webcrypto.HmacImportParams,
+            extractable: boolean,
+            keyUsages: readonly webcrypto.KeyUsage[],
+        ): webcrypto.CryptoKey;
         /**
          * Depending on the type of this `KeyObject`, this property is either`'secret'` for secret (symmetric) keys, `'public'` for public (asymmetric) keys
          * or `'private'` for private (asymmetric) keys.
@@ -650,9 +673,10 @@ declare module "crypto" {
          */
         type: KeyObjectType;
     }
-    type CipherCCMTypes = "aes-128-ccm" | "aes-192-ccm" | "aes-256-ccm" | "chacha20-poly1305";
+    type CipherCCMTypes = "aes-128-ccm" | "aes-192-ccm" | "aes-256-ccm";
     type CipherGCMTypes = "aes-128-gcm" | "aes-192-gcm" | "aes-256-gcm";
     type CipherOCBTypes = "aes-128-ocb" | "aes-192-ocb" | "aes-256-ocb";
+    type CipherChaCha20Poly1305Types = "chacha20-poly1305";
     type BinaryLike = string | NodeJS.ArrayBufferView;
     type CipherKey = BinaryLike | KeyObject;
     interface CipherCCMOptions extends stream.TransformOptions {
@@ -664,48 +688,10 @@ declare module "crypto" {
     interface CipherOCBOptions extends stream.TransformOptions {
         authTagLength: number;
     }
-    /**
-     * Creates and returns a `Cipher` object that uses the given `algorithm` and`password`.
-     *
-     * The `options` argument controls stream behavior and is optional except when a
-     * cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the`authTagLength` option is required and specifies the length of the
-     * authentication tag in bytes, see `CCM mode`. In GCM mode, the `authTagLength`option is not required but can be used to set the length of the authentication
-     * tag that will be returned by `getAuthTag()` and defaults to 16 bytes.
-     * For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
-     *
-     * The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
-     * recent OpenSSL releases, `openssl list -cipher-algorithms` will
-     * display the available cipher algorithms.
-     *
-     * The `password` is used to derive the cipher key and initialization vector (IV).
-     * The value must be either a `'latin1'` encoded string, a `Buffer`, a`TypedArray`, or a `DataView`.
-     *
-     * **This function is semantically insecure for all**
-     * **supported ciphers and fatally flawed for ciphers in counter mode (such as CTR,**
-     * **GCM, or CCM).**
-     *
-     * The implementation of `crypto.createCipher()` derives keys using the OpenSSL
-     * function [`EVP_BytesToKey`](https://www.openssl.org/docs/man3.0/man3/EVP_BytesToKey.html) with the digest algorithm set to MD5, one
-     * iteration, and no salt. The lack of salt allows dictionary attacks as the same
-     * password always creates the same key. The low iteration count and
-     * non-cryptographically secure hash algorithm allow passwords to be tested very
-     * rapidly.
-     *
-     * In line with OpenSSL's recommendation to use a more modern algorithm instead of [`EVP_BytesToKey`](https://www.openssl.org/docs/man3.0/man3/EVP_BytesToKey.html) it is recommended that
-     * developers derive a key and IV on
-     * their own using {@link scrypt} and to use {@link createCipheriv} to create the `Cipher` object. Users should not use ciphers with counter mode
-     * (e.g. CTR, GCM, or CCM) in `crypto.createCipher()`. A warning is emitted when
-     * they are used in order to avoid the risk of IV reuse that causes
-     * vulnerabilities. For the case when IV is reused in GCM, see [Nonce-Disrespecting Adversaries](https://github.com/nonce-disrespect/nonce-disrespect) for details.
-     * @since v0.1.94
-     * @deprecated Since v10.0.0 - Use {@link createCipheriv} instead.
-     * @param options `stream.transform` options
-     */
-    function createCipher(algorithm: CipherCCMTypes, password: BinaryLike, options: CipherCCMOptions): CipherCCM;
-    /** @deprecated since v10.0.0 use `createCipheriv()` */
-    function createCipher(algorithm: CipherGCMTypes, password: BinaryLike, options?: CipherGCMOptions): CipherGCM;
-    /** @deprecated since v10.0.0 use `createCipheriv()` */
-    function createCipher(algorithm: string, password: BinaryLike, options?: stream.TransformOptions): Cipher;
+    interface CipherChaCha20Poly1305Options extends stream.TransformOptions {
+        /** @default 16 */
+        authTagLength?: number | undefined;
+    }
     /**
      * Creates and returns a `Cipher` object, with the given `algorithm`, `key` and
      * initialization vector (`iv`).
@@ -754,14 +740,20 @@ declare module "crypto" {
         iv: BinaryLike,
         options?: CipherGCMOptions,
     ): CipherGCM;
+    function createCipheriv(
+        algorithm: CipherChaCha20Poly1305Types,
+        key: CipherKey,
+        iv: BinaryLike,
+        options?: CipherChaCha20Poly1305Options,
+    ): CipherChaCha20Poly1305;
     function createCipheriv(
         algorithm: string,
         key: CipherKey,
         iv: BinaryLike | null,
         options?: stream.TransformOptions,
-    ): Cipher;
+    ): Cipheriv;
     /**
-     * Instances of the `Cipher` class are used to encrypt data. The class can be
+     * Instances of the `Cipheriv` class are used to encrypt data. The class can be
      * used in one of two ways:
      *
      * * As a `stream` that is both readable and writable, where plain unencrypted
@@ -769,11 +761,11 @@ declare module "crypto" {
      * * Using the `cipher.update()` and `cipher.final()` methods to produce
      * the encrypted data.
      *
-     * The {@link createCipher} or {@link createCipheriv} methods are
-     * used to create `Cipher` instances. `Cipher` objects are not to be created
+     * The {@link createCipheriv} method is
+     * used to create `Cipheriv` instances. `Cipheriv` objects are not to be created
      * directly using the `new` keyword.
      *
-     * Example: Using `Cipher` objects as streams:
+     * Example: Using `Cipheriv` objects as streams:
      *
      * ```js
      * const {
@@ -808,7 +800,7 @@ declare module "crypto" {
      * });
      * ```
      *
-     * Example: Using `Cipher` and piped streams:
+     * Example: Using `Cipheriv` and piped streams:
      *
      * ```js
      * import {
@@ -879,12 +871,12 @@ declare module "crypto" {
      * ```
      * @since v0.1.94
      */
-    class Cipher extends stream.Transform {
+    class Cipheriv extends stream.Transform {
         private constructor();
         /**
          * Updates the cipher with `data`. If the `inputEncoding` argument is given,
-         * the `data`argument is a string using the specified encoding. If the `inputEncoding`argument is not given, `data` must be a `Buffer`, `TypedArray`, or`DataView`. If `data` is a `Buffer`,
-         * `TypedArray`, or `DataView`, then`inputEncoding` is ignored.
+         * the `data`argument is a string using the specified encoding. If the `inputEncoding`argument is not given, `data` must be a `Buffer`, `TypedArray`, or `DataView`. If `data` is a `Buffer`,
+         * `TypedArray`, or `DataView`, then `inputEncoding` is ignored.
          *
          * The `outputEncoding` specifies the output format of the enciphered
          * data. If the `outputEncoding`is specified, a string using the specified encoding is returned. If no`outputEncoding` is provided, a `Buffer` is returned.
@@ -895,22 +887,22 @@ declare module "crypto" {
          * @param inputEncoding The `encoding` of the data.
          * @param outputEncoding The `encoding` of the return value.
          */
-        update(data: BinaryLike): Buffer;
-        update(data: string, inputEncoding: Encoding): Buffer;
+        update(data: BinaryLike): NonSharedBuffer;
+        update(data: string, inputEncoding: Encoding): NonSharedBuffer;
         update(data: NodeJS.ArrayBufferView, inputEncoding: undefined, outputEncoding: Encoding): string;
         update(data: string, inputEncoding: Encoding | undefined, outputEncoding: Encoding): string;
         /**
-         * Once the `cipher.final()` method has been called, the `Cipher` object can no
+         * Once the `cipher.final()` method has been called, the `Cipheriv` object can no
          * longer be used to encrypt data. Attempts to call `cipher.final()` more than
          * once will result in an error being thrown.
          * @since v0.1.94
          * @param outputEncoding The `encoding` of the return value.
          * @return Any remaining enciphered contents. If `outputEncoding` is specified, a string is returned. If an `outputEncoding` is not provided, a {@link Buffer} is returned.
          */
-        final(): Buffer;
+        final(): NonSharedBuffer;
         final(outputEncoding: BufferEncoding): string;
         /**
-         * When using block encryption algorithms, the `Cipher` class will automatically
+         * When using block encryption algorithms, the `Cipheriv` class will automatically
          * add padding to the input data to the appropriate block size. To disable the
          * default padding call `cipher.setAutoPadding(false)`.
          *
@@ -926,70 +918,48 @@ declare module "crypto" {
          */
         setAutoPadding(autoPadding?: boolean): this;
     }
-    interface CipherCCM extends Cipher {
+    interface CipherCCM extends Cipheriv {
         setAAD(
             buffer: NodeJS.ArrayBufferView,
             options: {
                 plaintextLength: number;
             },
         ): this;
-        getAuthTag(): Buffer;
+        getAuthTag(): NonSharedBuffer;
     }
-    interface CipherGCM extends Cipher {
+    interface CipherGCM extends Cipheriv {
         setAAD(
             buffer: NodeJS.ArrayBufferView,
             options?: {
                 plaintextLength: number;
             },
         ): this;
-        getAuthTag(): Buffer;
+        getAuthTag(): NonSharedBuffer;
     }
-    interface CipherOCB extends Cipher {
+    interface CipherOCB extends Cipheriv {
         setAAD(
             buffer: NodeJS.ArrayBufferView,
             options?: {
                 plaintextLength: number;
             },
         ): this;
-        getAuthTag(): Buffer;
+        getAuthTag(): NonSharedBuffer;
+    }
+    interface CipherChaCha20Poly1305 extends Cipheriv {
+        setAAD(
+            buffer: NodeJS.ArrayBufferView,
+            options: {
+                plaintextLength: number;
+            },
+        ): this;
+        getAuthTag(): NonSharedBuffer;
     }
     /**
-     * Creates and returns a `Decipher` object that uses the given `algorithm` and`password` (key).
-     *
-     * The `options` argument controls stream behavior and is optional except when a
-     * cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the`authTagLength` option is required and specifies the length of the
-     * authentication tag in bytes, see `CCM mode`.
-     * For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
-     *
-     * **This function is semantically insecure for all**
-     * **supported ciphers and fatally flawed for ciphers in counter mode (such as CTR,**
-     * **GCM, or CCM).**
-     *
-     * The implementation of `crypto.createDecipher()` derives keys using the OpenSSL
-     * function [`EVP_BytesToKey`](https://www.openssl.org/docs/man3.0/man3/EVP_BytesToKey.html) with the digest algorithm set to MD5, one
-     * iteration, and no salt. The lack of salt allows dictionary attacks as the same
-     * password always creates the same key. The low iteration count and
-     * non-cryptographically secure hash algorithm allow passwords to be tested very
-     * rapidly.
-     *
-     * In line with OpenSSL's recommendation to use a more modern algorithm instead of [`EVP_BytesToKey`](https://www.openssl.org/docs/man3.0/man3/EVP_BytesToKey.html) it is recommended that
-     * developers derive a key and IV on
-     * their own using {@link scrypt} and to use {@link createDecipheriv} to create the `Decipher` object.
-     * @since v0.1.94
-     * @deprecated Since v10.0.0 - Use {@link createDecipheriv} instead.
-     * @param options `stream.transform` options
-     */
-    function createDecipher(algorithm: CipherCCMTypes, password: BinaryLike, options: CipherCCMOptions): DecipherCCM;
-    /** @deprecated since v10.0.0 use `createDecipheriv()` */
-    function createDecipher(algorithm: CipherGCMTypes, password: BinaryLike, options?: CipherGCMOptions): DecipherGCM;
-    /** @deprecated since v10.0.0 use `createDecipheriv()` */
-    function createDecipher(algorithm: string, password: BinaryLike, options?: stream.TransformOptions): Decipher;
-    /**
-     * Creates and returns a `Decipher` object that uses the given `algorithm`, `key`and initialization vector (`iv`).
+     * Creates and returns a `Decipheriv` object that uses the given `algorithm`, `key` and initialization vector (`iv`).
      *
      * The `options` argument controls stream behavior and is optional except when a
-     * cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the`authTagLength` option is required and specifies the length of the
-     * authentication tag in bytes, see `CCM mode`. In GCM mode, the `authTagLength`option is not required but can be used to restrict accepted authentication tags
+     * cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the `authTagLength` option is required and specifies the length of the
+     * authentication tag in bytes, see `CCM mode`. In GCM mode, the `authTagLength` option is not required but can be used to restrict accepted authentication tags
      * to those with the specified length.
      * For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
      *
@@ -1031,14 +1001,20 @@ declare module "crypto" {
         iv: BinaryLike,
         options?: CipherGCMOptions,
     ): DecipherGCM;
+    function createDecipheriv(
+        algorithm: CipherChaCha20Poly1305Types,
+        key: CipherKey,
+        iv: BinaryLike,
+        options?: CipherChaCha20Poly1305Options,
+    ): DecipherChaCha20Poly1305;
     function createDecipheriv(
         algorithm: string,
         key: CipherKey,
         iv: BinaryLike | null,
         options?: stream.TransformOptions,
-    ): Decipher;
+    ): Decipheriv;
     /**
-     * Instances of the `Decipher` class are used to decrypt data. The class can be
+     * Instances of the `Decipheriv` class are used to decrypt data. The class can be
      * used in one of two ways:
      *
      * * As a `stream` that is both readable and writable, where plain encrypted
@@ -1046,11 +1022,11 @@ declare module "crypto" {
      * * Using the `decipher.update()` and `decipher.final()` methods to
      * produce the unencrypted data.
      *
-     * The {@link createDecipher} or {@link createDecipheriv} methods are
-     * used to create `Decipher` instances. `Decipher` objects are not to be created
+     * The {@link createDecipheriv} method is
+     * used to create `Decipheriv` instances. `Decipheriv` objects are not to be created
      * directly using the `new` keyword.
      *
-     * Example: Using `Decipher` objects as streams:
+     * Example: Using `Decipheriv` objects as streams:
      *
      * ```js
      * import { Buffer } from 'node:buffer';
@@ -1089,7 +1065,7 @@ declare module "crypto" {
      * decipher.end();
      * ```
      *
-     * Example: Using `Decipher` and piped streams:
+     * Example: Using `Decipheriv` and piped streams:
      *
      * ```js
      * import {
@@ -1145,15 +1121,15 @@ declare module "crypto" {
      * ```
      * @since v0.1.94
      */
-    class Decipher extends stream.Transform {
+    class Decipheriv extends stream.Transform {
         private constructor();
         /**
          * Updates the decipher with `data`. If the `inputEncoding` argument is given,
-         * the `data`argument is a string using the specified encoding. If the `inputEncoding`argument is not given, `data` must be a `Buffer`. If `data` is a `Buffer` then `inputEncoding` is
+         * the `data` argument is a string using the specified encoding. If the `inputEncoding` argument is not given, `data` must be a `Buffer`. If `data` is a `Buffer` then `inputEncoding` is
          * ignored.
          *
          * The `outputEncoding` specifies the output format of the enciphered
-         * data. If the `outputEncoding`is specified, a string using the specified encoding is returned. If no`outputEncoding` is provided, a `Buffer` is returned.
+         * data. If the `outputEncoding` is specified, a string using the specified encoding is returned. If no `outputEncoding` is provided, a `Buffer` is returned.
          *
          * The `decipher.update()` method can be called multiple times with new data until `decipher.final()` is called. Calling `decipher.update()` after `decipher.final()` will result in an error
          * being thrown.
@@ -1161,22 +1137,22 @@ declare module "crypto" {
          * @param inputEncoding The `encoding` of the `data` string.
          * @param outputEncoding The `encoding` of the return value.
          */
-        update(data: NodeJS.ArrayBufferView): Buffer;
-        update(data: string, inputEncoding: Encoding): Buffer;
+        update(data: NodeJS.ArrayBufferView): NonSharedBuffer;
+        update(data: string, inputEncoding: Encoding): NonSharedBuffer;
         update(data: NodeJS.ArrayBufferView, inputEncoding: undefined, outputEncoding: Encoding): string;
         update(data: string, inputEncoding: Encoding | undefined, outputEncoding: Encoding): string;
         /**
-         * Once the `decipher.final()` method has been called, the `Decipher` object can
+         * Once the `decipher.final()` method has been called, the `Decipheriv` object can
          * no longer be used to decrypt data. Attempts to call `decipher.final()` more
          * than once will result in an error being thrown.
          * @since v0.1.94
          * @param outputEncoding The `encoding` of the return value.
          * @return Any remaining deciphered contents. If `outputEncoding` is specified, a string is returned. If an `outputEncoding` is not provided, a {@link Buffer} is returned.
          */
-        final(): Buffer;
+        final(): NonSharedBuffer;
         final(outputEncoding: BufferEncoding): string;
         /**
-         * When data has been encrypted without standard block padding, calling`decipher.setAutoPadding(false)` will disable automatic padding to prevent `decipher.final()` from checking for and
+         * When data has been encrypted without standard block padding, calling `decipher.setAutoPadding(false)` will disable automatic padding to prevent `decipher.final()` from checking for and
          * removing padding.
          *
          * Turning auto padding off will only work if the input data's length is a
@@ -1189,7 +1165,7 @@ declare module "crypto" {
          */
         setAutoPadding(auto_padding?: boolean): this;
     }
-    interface DecipherCCM extends Decipher {
+    interface DecipherCCM extends Decipheriv {
         setAuthTag(buffer: NodeJS.ArrayBufferView): this;
         setAAD(
             buffer: NodeJS.ArrayBufferView,
@@ -1198,7 +1174,7 @@ declare module "crypto" {
             },
         ): this;
     }
-    interface DecipherGCM extends Decipher {
+    interface DecipherGCM extends Decipheriv {
         setAuthTag(buffer: NodeJS.ArrayBufferView): this;
         setAAD(
             buffer: NodeJS.ArrayBufferView,
@@ -1207,7 +1183,7 @@ declare module "crypto" {
             },
         ): this;
     }
-    interface DecipherOCB extends Decipher {
+    interface DecipherOCB extends Decipheriv {
         setAuthTag(buffer: NodeJS.ArrayBufferView): this;
         setAAD(
             buffer: NodeJS.ArrayBufferView,
@@ -1216,6 +1192,15 @@ declare module "crypto" {
             },
         ): this;
     }
+    interface DecipherChaCha20Poly1305 extends Decipheriv {
+        setAuthTag(buffer: NodeJS.ArrayBufferView): this;
+        setAAD(
+            buffer: NodeJS.ArrayBufferView,
+            options: {
+                plaintextLength: number;
+            },
+        ): this;
+    }
     interface PrivateKeyInput {
         key: string | Buffer;
         format?: KeyFormat | undefined;
@@ -1230,7 +1215,7 @@ declare module "crypto" {
         encoding?: string | undefined;
     }
     /**
-     * Asynchronously generates a new random secret key of the given `length`. The`type` will determine which validations will be performed on the `length`.
+     * Asynchronously generates a new random secret key of the given `length`. The `type` will determine which validations will be performed on the `length`.
      *
      * ```js
      * const {
@@ -1256,7 +1241,7 @@ declare module "crypto" {
         callback: (err: Error | null, key: KeyObject) => void,
     ): void;
     /**
-     * Synchronously generates a new random secret key of the given `length`. The`type` will determine which validations will be performed on the `length`.
+     * Synchronously generates a new random secret key of the given `length`. The `type` will determine which validations will be performed on the `length`.
      *
      * ```js
      * const {
@@ -1284,7 +1269,7 @@ declare module "crypto" {
     }
     /**
      * Creates and returns a new key object containing a private key. If `key` is a
-     * string or `Buffer`, `format` is assumed to be `'pem'`; otherwise, `key`must be an object with the properties described above.
+     * string or `Buffer`, `format` is assumed to be `'pem'`; otherwise, `key` must be an object with the properties described above.
      *
      * If the private key is encrypted, a `passphrase` must be specified. The length
      * of the passphrase is limited to 1024 bytes.
@@ -1293,7 +1278,7 @@ declare module "crypto" {
     function createPrivateKey(key: PrivateKeyInput | string | Buffer | JsonWebKeyInput): KeyObject;
     /**
      * Creates and returns a new key object containing a public key. If `key` is a
-     * string or `Buffer`, `format` is assumed to be `'pem'`; if `key` is a `KeyObject`with type `'private'`, the public key is derived from the given private key;
+     * string or `Buffer`, `format` is assumed to be `'pem'`; if `key` is a `KeyObject` with type `'private'`, the public key is derived from the given private key;
      * otherwise, `key` must be an object with the properties described above.
      *
      * If the format is `'pem'`, the `'key'` may also be an X.509 certificate.
@@ -1301,7 +1286,7 @@ declare module "crypto" {
      * Because public keys can be derived from private keys, a private key may be
      * passed instead of a public key. In that case, this function behaves as if {@link createPrivateKey} had been called, except that the type of the
      * returned `KeyObject` will be `'public'` and that the private key cannot be
-     * extracted from the returned `KeyObject`. Similarly, if a `KeyObject` with type`'private'` is given, a new `KeyObject` with type `'public'` will be returned
+     * extracted from the returned `KeyObject`. Similarly, if a `KeyObject` with type `'private'` is given, a new `KeyObject` with type `'public'` will be returned
      * and it will be impossible to extract the private key from the returned object.
      * @since v11.6.0
      */
@@ -1326,6 +1311,7 @@ declare module "crypto" {
      * @since v0.1.92
      * @param options `stream.Writable` options
      */
+    // TODO: signing algorithm type
     function createSign(algorithm: string, options?: stream.WritableOptions): Sign;
     type DSAEncoding = "der" | "ieee-p1363";
     interface SigningOptions {
@@ -1335,11 +1321,13 @@ declare module "crypto" {
         padding?: number | undefined;
         saltLength?: number | undefined;
         dsaEncoding?: DSAEncoding | undefined;
+        context?: ArrayBuffer | NodeJS.ArrayBufferView | undefined;
     }
     interface SignPrivateKeyInput extends PrivateKeyInput, SigningOptions {}
     interface SignKeyObjectInput extends SigningOptions {
         key: KeyObject;
     }
+    interface SignJsonWebKeyInput extends JsonWebKeyInput, SigningOptions {}
     interface VerifyPublicKeyInput extends PublicKeyInput, SigningOptions {}
     interface VerifyKeyObjectInput extends SigningOptions {
         key: KeyObject;
@@ -1426,7 +1414,7 @@ declare module "crypto" {
         /**
          * Calculates the signature on all the data passed through using either `sign.update()` or `sign.write()`.
          *
-         * If `privateKey` is not a `KeyObject`, this function behaves as if`privateKey` had been passed to {@link createPrivateKey}. If it is an
+         * If `privateKey` is not a `KeyObject`, this function behaves as if `privateKey` had been passed to {@link createPrivateKey}. If it is an
          * object, the following additional properties can be passed:
          *
          * If `outputEncoding` is provided a string is returned; otherwise a `Buffer` is returned.
@@ -1435,16 +1423,16 @@ declare module "crypto" {
          * called. Multiple calls to `sign.sign()` will result in an error being thrown.
          * @since v0.1.92
          */
-        sign(privateKey: KeyLike | SignKeyObjectInput | SignPrivateKeyInput): Buffer;
+        sign(privateKey: KeyLike | SignKeyObjectInput | SignPrivateKeyInput | SignJsonWebKeyInput): NonSharedBuffer;
         sign(
-            privateKey: KeyLike | SignKeyObjectInput | SignPrivateKeyInput,
+            privateKey: KeyLike | SignKeyObjectInput | SignPrivateKeyInput | SignJsonWebKeyInput,
             outputFormat: BinaryToTextEncoding,
         ): string;
     }
     /**
      * Creates and returns a `Verify` object that uses the given algorithm.
      * Use {@link getHashes} to obtain an array of names of the available
-     * signing algorithms. Optional `options` argument controls the`stream.Writable` behavior.
+     * signing algorithms. Optional `options` argument controls the `stream.Writable` behavior.
      *
      * In some cases, a `Verify` instance can be created using the name of a signature
      * algorithm, such as `'RSA-SHA256'`, instead of a digest algorithm. This will use
@@ -1464,7 +1452,7 @@ declare module "crypto" {
      * * Using the `verify.update()` and `verify.verify()` methods to verify
      * the signature.
      *
-     * The {@link createVerify} method is used to create `Verify` instances.`Verify` objects are not to be created directly using the `new` keyword.
+     * The {@link createVerify} method is used to create `Verify` instances. `Verify` objects are not to be created directly using the `new` keyword.
      *
      * See `Sign` for examples.
      * @since v0.1.92
@@ -1475,7 +1463,7 @@ declare module "crypto" {
          * Updates the `Verify` content with the given `data`, the encoding of which
          * is given in `inputEncoding`.
          * If `inputEncoding` is not provided, and the `data` is a string, an
-         * encoding of `'utf8'` is enforced. If `data` is a `Buffer`, `TypedArray`, or`DataView`, then `inputEncoding` is ignored.
+         * encoding of `'utf8'` is enforced. If `data` is a `Buffer`, `TypedArray`, or `DataView`, then `inputEncoding` is ignored.
          *
          * This can be called many times with new data as it is streamed.
          * @since v0.1.92
@@ -1486,13 +1474,13 @@ declare module "crypto" {
         /**
          * Verifies the provided data using the given `object` and `signature`.
          *
-         * If `object` is not a `KeyObject`, this function behaves as if`object` had been passed to {@link createPublicKey}. If it is an
+         * If `object` is not a `KeyObject`, this function behaves as if `object` had been passed to {@link createPublicKey}. If it is an
          * object, the following additional properties can be passed:
          *
          * The `signature` argument is the previously calculated signature for the data, in
          * the `signatureEncoding`.
          * If a `signatureEncoding` is specified, the `signature` is expected to be a
-         * string; otherwise `signature` is expected to be a `Buffer`,`TypedArray`, or `DataView`.
+         * string; otherwise `signature` is expected to be a `Buffer`, `TypedArray`, or `DataView`.
          *
          * The `verify` object can not be used again after `verify.verify()` has been
          * called. Multiple calls to `verify.verify()` will result in an error being
@@ -1516,7 +1504,7 @@ declare module "crypto" {
      * Creates a `DiffieHellman` key exchange object using the supplied `prime` and an
      * optional specific `generator`.
      *
-     * The `generator` argument can be a number, string, or `Buffer`. If`generator` is not specified, the value `2` is used.
+     * The `generator` argument can be a number, string, or `Buffer`. If `generator` is not specified, the value `2` is used.
      *
      * If `primeEncoding` is specified, `prime` is expected to be a string; otherwise
      * a `Buffer`, `TypedArray`, or `DataView` is expected.
@@ -1594,7 +1582,7 @@ declare module "crypto" {
          * @since v0.5.0
          * @param encoding The `encoding` of the return value.
          */
-        generateKeys(): Buffer;
+        generateKeys(): NonSharedBuffer;
         generateKeys(encoding: BinaryToTextEncoding): string;
         /**
          * Computes the shared secret using `otherPublicKey` as the other
@@ -1602,15 +1590,23 @@ declare module "crypto" {
          * key is interpreted using the specified `inputEncoding`, and secret is
          * encoded using specified `outputEncoding`.
          * If the `inputEncoding` is not
-         * provided, `otherPublicKey` is expected to be a `Buffer`,`TypedArray`, or `DataView`.
+         * provided, `otherPublicKey` is expected to be a `Buffer`, `TypedArray`, or `DataView`.
          *
          * If `outputEncoding` is given a string is returned; otherwise, a `Buffer` is returned.
          * @since v0.5.0
          * @param inputEncoding The `encoding` of an `otherPublicKey` string.
          * @param outputEncoding The `encoding` of the return value.
          */
-        computeSecret(otherPublicKey: NodeJS.ArrayBufferView, inputEncoding?: null, outputEncoding?: null): Buffer;
-        computeSecret(otherPublicKey: string, inputEncoding: BinaryToTextEncoding, outputEncoding?: null): Buffer;
+        computeSecret(
+            otherPublicKey: NodeJS.ArrayBufferView,
+            inputEncoding?: null,
+            outputEncoding?: null,
+        ): NonSharedBuffer;
+        computeSecret(
+            otherPublicKey: string,
+            inputEncoding: BinaryToTextEncoding,
+            outputEncoding?: null,
+        ): NonSharedBuffer;
         computeSecret(
             otherPublicKey: NodeJS.ArrayBufferView,
             inputEncoding: null,
@@ -1628,7 +1624,7 @@ declare module "crypto" {
          * @since v0.5.0
          * @param encoding The `encoding` of the return value.
          */
-        getPrime(): Buffer;
+        getPrime(): NonSharedBuffer;
         getPrime(encoding: BinaryToTextEncoding): string;
         /**
          * Returns the Diffie-Hellman generator in the specified `encoding`.
@@ -1637,7 +1633,7 @@ declare module "crypto" {
          * @since v0.5.0
          * @param encoding The `encoding` of the return value.
          */
-        getGenerator(): Buffer;
+        getGenerator(): NonSharedBuffer;
         getGenerator(encoding: BinaryToTextEncoding): string;
         /**
          * Returns the Diffie-Hellman public key in the specified `encoding`.
@@ -1646,7 +1642,7 @@ declare module "crypto" {
          * @since v0.5.0
          * @param encoding The `encoding` of the return value.
          */
-        getPublicKey(): Buffer;
+        getPublicKey(): NonSharedBuffer;
         getPublicKey(encoding: BinaryToTextEncoding): string;
         /**
          * Returns the Diffie-Hellman private key in the specified `encoding`.
@@ -1655,10 +1651,10 @@ declare module "crypto" {
          * @since v0.5.0
          * @param encoding The `encoding` of the return value.
          */
-        getPrivateKey(): Buffer;
+        getPrivateKey(): NonSharedBuffer;
         getPrivateKey(encoding: BinaryToTextEncoding): string;
         /**
-         * Sets the Diffie-Hellman public key. If the `encoding` argument is provided,`publicKey` is expected
+         * Sets the Diffie-Hellman public key. If the `encoding` argument is provided, `publicKey` is expected
          * to be a string. If no `encoding` is provided, `publicKey` is expected
          * to be a `Buffer`, `TypedArray`, or `DataView`.
          * @since v0.5.0
@@ -1761,10 +1757,10 @@ declare module "crypto" {
     /**
      * Provides an asynchronous Password-Based Key Derivation Function 2 (PBKDF2)
      * implementation. A selected HMAC digest algorithm specified by `digest` is
-     * applied to derive a key of the requested byte length (`keylen`) from the`password`, `salt` and `iterations`.
+     * applied to derive a key of the requested byte length (`keylen`) from the `password`, `salt` and `iterations`.
      *
-     * The supplied `callback` function is called with two arguments: `err` and`derivedKey`. If an error occurs while deriving the key, `err` will be set;
-     * otherwise `err` will be `null`. By default, the successfully generated`derivedKey` will be passed to the callback as a `Buffer`. An error will be
+     * The supplied `callback` function is called with two arguments: `err` and `derivedKey`. If an error occurs while deriving the key, `err` will be set;
+     * otherwise `err` will be `null`. By default, the successfully generated `derivedKey` will be passed to the callback as a `Buffer`. An error will be
      * thrown if any of the input arguments specify invalid values or types.
      *
      * The `iterations` argument must be a number set as high as possible. The
@@ -1799,12 +1795,12 @@ declare module "crypto" {
         iterations: number,
         keylen: number,
         digest: string,
-        callback: (err: Error | null, derivedKey: Buffer) => void,
+        callback: (err: Error | null, derivedKey: NonSharedBuffer) => void,
     ): void;
     /**
      * Provides a synchronous Password-Based Key Derivation Function 2 (PBKDF2)
      * implementation. A selected HMAC digest algorithm specified by `digest` is
-     * applied to derive a key of the requested byte length (`keylen`) from the`password`, `salt` and `iterations`.
+     * applied to derive a key of the requested byte length (`keylen`) from the `password`, `salt` and `iterations`.
      *
      * If an error occurs an `Error` will be thrown, otherwise the derived key will be
      * returned as a `Buffer`.
@@ -1836,14 +1832,14 @@ declare module "crypto" {
         iterations: number,
         keylen: number,
         digest: string,
-    ): Buffer;
+    ): NonSharedBuffer;
     /**
      * Generates cryptographically strong pseudorandom data. The `size` argument
      * is a number indicating the number of bytes to generate.
      *
      * If a `callback` function is provided, the bytes are generated asynchronously
      * and the `callback` function is invoked with two arguments: `err` and `buf`.
-     * If an error occurs, `err` will be an `Error` object; otherwise it is `null`. The`buf` argument is a `Buffer` containing the generated bytes.
+     * If an error occurs, `err` will be an `Error` object; otherwise it is `null`. The `buf` argument is a `Buffer` containing the generated bytes.
      *
      * ```js
      * // Asynchronous
@@ -1889,15 +1885,15 @@ declare module "crypto" {
      * @param size The number of bytes to generate. The `size` must not be larger than `2**31 - 1`.
      * @return if the `callback` function is not provided.
      */
-    function randomBytes(size: number): Buffer;
-    function randomBytes(size: number, callback: (err: Error | null, buf: Buffer) => void): void;
-    function pseudoRandomBytes(size: number): Buffer;
-    function pseudoRandomBytes(size: number, callback: (err: Error | null, buf: Buffer) => void): void;
+    function randomBytes(size: number): NonSharedBuffer;
+    function randomBytes(size: number, callback: (err: Error | null, buf: NonSharedBuffer) => void): void;
+    function pseudoRandomBytes(size: number): NonSharedBuffer;
+    function pseudoRandomBytes(size: number, callback: (err: Error | null, buf: NonSharedBuffer) => void): void;
     /**
      * Return a random integer `n` such that `min <= n < max`.  This
      * implementation avoids [modulo bias](https://en.wikipedia.org/wiki/Fisher%E2%80%93Yates_shuffle#Modulo_bias).
      *
-     * The range (`max - min`) must be less than 248. `min` and `max` must
+     * The range (`max - min`) must be less than 2**48. `min` and `max` must
      * be [safe integers](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number/isSafeInteger).
      *
      * If the `callback` function is not provided, the random integer is
@@ -2014,7 +2010,7 @@ declare module "crypto" {
      * });
      * ```
      *
-     * Any `ArrayBuffer`, `TypedArray`, or `DataView` instance may be passed as`buffer`.
+     * Any `ArrayBuffer`, `TypedArray`, or `DataView` instance may be passed as `buffer`.
      *
      * While this includes instances of `Float32Array` and `Float64Array`, this
      * function should not be used to generate random floating-point numbers. The
@@ -2094,7 +2090,7 @@ declare module "crypto" {
      *
      * When passing strings for `password` or `salt`, please consider `caveats when using strings as inputs to cryptographic APIs`.
      *
-     * The `callback` function is called with two arguments: `err` and `derivedKey`.`err` is an exception object when key derivation fails, otherwise `err` is`null`. `derivedKey` is passed to the
+     * The `callback` function is called with two arguments: `err` and `derivedKey`. `err` is an exception object when key derivation fails, otherwise `err` is `null`. `derivedKey` is passed to the
      * callback as a `Buffer`.
      *
      * An exception is thrown when any of the input arguments specify invalid values
@@ -2122,14 +2118,14 @@ declare module "crypto" {
         password: BinaryLike,
         salt: BinaryLike,
         keylen: number,
-        callback: (err: Error | null, derivedKey: Buffer) => void,
+        callback: (err: Error | null, derivedKey: NonSharedBuffer) => void,
     ): void;
     function scrypt(
         password: BinaryLike,
         salt: BinaryLike,
         keylen: number,
         options: ScryptOptions,
-        callback: (err: Error | null, derivedKey: Buffer) => void,
+        callback: (err: Error | null, derivedKey: NonSharedBuffer) => void,
     ): void;
     /**
      * Provides a synchronous [scrypt](https://en.wikipedia.org/wiki/Scrypt) implementation. Scrypt is a password-based
@@ -2161,7 +2157,12 @@ declare module "crypto" {
      * ```
      * @since v10.5.0
      */
-    function scryptSync(password: BinaryLike, salt: BinaryLike, keylen: number, options?: ScryptOptions): Buffer;
+    function scryptSync(
+        password: BinaryLike,
+        salt: BinaryLike,
+        keylen: number,
+        options?: ScryptOptions,
+    ): NonSharedBuffer;
     interface RsaPublicKey {
         key: KeyLike;
         padding?: number | undefined;
@@ -2180,44 +2181,56 @@ declare module "crypto" {
      * Encrypts the content of `buffer` with `key` and returns a new `Buffer` with encrypted content. The returned data can be decrypted using
      * the corresponding private key, for example using {@link privateDecrypt}.
      *
-     * If `key` is not a `KeyObject`, this function behaves as if`key` had been passed to {@link createPublicKey}. If it is an
-     * object, the `padding` property can be passed. Otherwise, this function uses`RSA_PKCS1_OAEP_PADDING`.
+     * If `key` is not a `KeyObject`, this function behaves as if `key` had been passed to {@link createPublicKey}. If it is an
+     * object, the `padding` property can be passed. Otherwise, this function uses `RSA_PKCS1_OAEP_PADDING`.
      *
      * Because RSA public keys can be derived from private keys, a private key may
      * be passed instead of a public key.
      * @since v0.11.14
      */
-    function publicEncrypt(key: RsaPublicKey | RsaPrivateKey | KeyLike, buffer: NodeJS.ArrayBufferView): Buffer;
+    function publicEncrypt(
+        key: RsaPublicKey | RsaPrivateKey | KeyLike,
+        buffer: NodeJS.ArrayBufferView | string,
+    ): NonSharedBuffer;
     /**
      * Decrypts `buffer` with `key`.`buffer` was previously encrypted using
      * the corresponding private key, for example using {@link privateEncrypt}.
      *
-     * If `key` is not a `KeyObject`, this function behaves as if`key` had been passed to {@link createPublicKey}. If it is an
-     * object, the `padding` property can be passed. Otherwise, this function uses`RSA_PKCS1_PADDING`.
+     * If `key` is not a `KeyObject`, this function behaves as if `key` had been passed to {@link createPublicKey}. If it is an
+     * object, the `padding` property can be passed. Otherwise, this function uses `RSA_PKCS1_PADDING`.
      *
      * Because RSA public keys can be derived from private keys, a private key may
      * be passed instead of a public key.
      * @since v1.1.0
      */
-    function publicDecrypt(key: RsaPublicKey | RsaPrivateKey | KeyLike, buffer: NodeJS.ArrayBufferView): Buffer;
+    function publicDecrypt(
+        key: RsaPublicKey | RsaPrivateKey | KeyLike,
+        buffer: NodeJS.ArrayBufferView | string,
+    ): NonSharedBuffer;
     /**
      * Decrypts `buffer` with `privateKey`. `buffer` was previously encrypted using
      * the corresponding public key, for example using {@link publicEncrypt}.
      *
-     * If `privateKey` is not a `KeyObject`, this function behaves as if`privateKey` had been passed to {@link createPrivateKey}. If it is an
-     * object, the `padding` property can be passed. Otherwise, this function uses`RSA_PKCS1_OAEP_PADDING`.
+     * If `privateKey` is not a `KeyObject`, this function behaves as if `privateKey` had been passed to {@link createPrivateKey}. If it is an
+     * object, the `padding` property can be passed. Otherwise, this function uses `RSA_PKCS1_OAEP_PADDING`.
      * @since v0.11.14
      */
-    function privateDecrypt(privateKey: RsaPrivateKey | KeyLike, buffer: NodeJS.ArrayBufferView): Buffer;
+    function privateDecrypt(
+        privateKey: RsaPrivateKey | KeyLike,
+        buffer: NodeJS.ArrayBufferView | string,
+    ): NonSharedBuffer;
     /**
      * Encrypts `buffer` with `privateKey`. The returned data can be decrypted using
      * the corresponding public key, for example using {@link publicDecrypt}.
      *
-     * If `privateKey` is not a `KeyObject`, this function behaves as if`privateKey` had been passed to {@link createPrivateKey}. If it is an
-     * object, the `padding` property can be passed. Otherwise, this function uses`RSA_PKCS1_PADDING`.
+     * If `privateKey` is not a `KeyObject`, this function behaves as if `privateKey` had been passed to {@link createPrivateKey}. If it is an
+     * object, the `padding` property can be passed. Otherwise, this function uses `RSA_PKCS1_PADDING`.
      * @since v1.1.0
      */
-    function privateEncrypt(privateKey: RsaPrivateKey | KeyLike, buffer: NodeJS.ArrayBufferView): Buffer;
+    function privateEncrypt(
+        privateKey: RsaPrivateKey | KeyLike,
+        buffer: NodeJS.ArrayBufferView | string,
+    ): NonSharedBuffer;
     /**
      * ```js
      * const {
@@ -2309,9 +2322,9 @@ declare module "crypto" {
          * On recent OpenSSL releases, `openssl ecparam -list_curves` will also display
          * the name and description of each available elliptic curve.
          *
-         * If `format` is not specified the point will be returned in `'uncompressed'`format.
+         * If `format` is not specified the point will be returned in `'uncompressed'` format.
          *
-         * If the `inputEncoding` is not provided, `key` is expected to be a `Buffer`,`TypedArray`, or `DataView`.
+         * If the `inputEncoding` is not provided, `key` is expected to be a `Buffer`, `TypedArray`, or `DataView`.
          *
          * Example (uncompressing a key):
          *
@@ -2346,20 +2359,20 @@ declare module "crypto" {
             inputEncoding?: BinaryToTextEncoding,
             outputEncoding?: "latin1" | "hex" | "base64" | "base64url",
             format?: "uncompressed" | "compressed" | "hybrid",
-        ): Buffer | string;
+        ): NonSharedBuffer | string;
         /**
          * Generates private and public EC Diffie-Hellman key values, and returns
          * the public key in the specified `format` and `encoding`. This key should be
          * transferred to the other party.
          *
-         * The `format` argument specifies point encoding and can be `'compressed'` or`'uncompressed'`. If `format` is not specified, the point will be returned in`'uncompressed'` format.
+         * The `format` argument specifies point encoding and can be `'compressed'` or `'uncompressed'`. If `format` is not specified, the point will be returned in`'uncompressed'` format.
          *
          * If `encoding` is provided a string is returned; otherwise a `Buffer` is returned.
          * @since v0.11.14
          * @param encoding The `encoding` of the return value.
          * @param [format='uncompressed']
          */
-        generateKeys(): Buffer;
+        generateKeys(): NonSharedBuffer;
         generateKeys(encoding: BinaryToTextEncoding, format?: ECDHKeyFormat): string;
         /**
          * Computes the shared secret using `otherPublicKey` as the other
@@ -2367,19 +2380,19 @@ declare module "crypto" {
          * key is interpreted using specified `inputEncoding`, and the returned secret
          * is encoded using the specified `outputEncoding`.
          * If the `inputEncoding` is not
-         * provided, `otherPublicKey` is expected to be a `Buffer`, `TypedArray`, or`DataView`.
+         * provided, `otherPublicKey` is expected to be a `Buffer`, `TypedArray`, or `DataView`.
          *
          * If `outputEncoding` is given a string will be returned; otherwise a `Buffer` is returned.
          *
-         * `ecdh.computeSecret` will throw an`ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY` error when `otherPublicKey`lies outside of the elliptic curve. Since `otherPublicKey` is
+         * `ecdh.computeSecret` will throw an`ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY` error when `otherPublicKey` lies outside of the elliptic curve. Since `otherPublicKey` is
          * usually supplied from a remote user over an insecure network,
          * be sure to handle this exception accordingly.
          * @since v0.11.14
          * @param inputEncoding The `encoding` of the `otherPublicKey` string.
          * @param outputEncoding The `encoding` of the return value.
          */
-        computeSecret(otherPublicKey: NodeJS.ArrayBufferView): Buffer;
-        computeSecret(otherPublicKey: string, inputEncoding: BinaryToTextEncoding): Buffer;
+        computeSecret(otherPublicKey: NodeJS.ArrayBufferView): NonSharedBuffer;
+        computeSecret(otherPublicKey: string, inputEncoding: BinaryToTextEncoding): NonSharedBuffer;
         computeSecret(otherPublicKey: NodeJS.ArrayBufferView, outputEncoding: BinaryToTextEncoding): string;
         computeSecret(
             otherPublicKey: string,
@@ -2393,10 +2406,10 @@ declare module "crypto" {
          * @param encoding The `encoding` of the return value.
          * @return The EC Diffie-Hellman in the specified `encoding`.
          */
-        getPrivateKey(): Buffer;
+        getPrivateKey(): NonSharedBuffer;
         getPrivateKey(encoding: BinaryToTextEncoding): string;
         /**
-         * The `format` argument specifies point encoding and can be `'compressed'` or`'uncompressed'`. If `format` is not specified the point will be returned in`'uncompressed'` format.
+         * The `format` argument specifies point encoding and can be `'compressed'` or `'uncompressed'`. If `format` is not specified the point will be returned in`'uncompressed'` format.
          *
          * If `encoding` is specified, a string is returned; otherwise a `Buffer` is
          * returned.
@@ -2405,12 +2418,12 @@ declare module "crypto" {
          * @param [format='uncompressed']
          * @return The EC Diffie-Hellman public key in the specified `encoding` and `format`.
          */
-        getPublicKey(encoding?: null, format?: ECDHKeyFormat): Buffer;
+        getPublicKey(encoding?: null, format?: ECDHKeyFormat): NonSharedBuffer;
         getPublicKey(encoding: BinaryToTextEncoding, format?: ECDHKeyFormat): string;
         /**
          * Sets the EC Diffie-Hellman private key.
          * If `encoding` is provided, `privateKey` is expected
-         * to be a string; otherwise `privateKey` is expected to be a `Buffer`,`TypedArray`, or `DataView`.
+         * to be a string; otherwise `privateKey` is expected to be a `Buffer`, `TypedArray`, or `DataView`.
          *
          * If `privateKey` is not valid for the curve specified when the `ECDH` object was
          * created, an error is thrown. Upon setting the private key, the associated
@@ -2430,7 +2443,7 @@ declare module "crypto" {
      */
     function createECDH(curveName: string): ECDH;
     /**
-     * This function compares the underlying bytes that represent the given`ArrayBuffer`, `TypedArray`, or `DataView` instances using a constant-time
+     * This function compares the underlying bytes that represent the given `ArrayBuffer`, `TypedArray`, or `DataView` instances using a constant-time
      * algorithm.
      *
      * This function does not leak timing information that
@@ -2445,8 +2458,8 @@ declare module "crypto" {
      * entry, such as `Uint16Array`, the result will be computed using the platform
      * byte order.
      *
-     * **When both of the inputs are `Float32Array`s or`Float64Array`s, this function might return unexpected results due to IEEE 754**
-     * **encoding of floating-point numbers. In particular, neither `x === y` nor`Object.is(x, y)` implies that the byte representations of two floating-point**
+     * **When both of the inputs are `Float32Array`s or `Float64Array`s, this function might return unexpected results due to IEEE 754**
+     * **encoding of floating-point numbers. In particular, neither `x === y` nor `Object.is(x, y)` implies that the byte representations of two floating-point**
      * **numbers `x` and `y` are equal.**
      *
      * Use of `crypto.timingSafeEqual` does not guarantee that the _surrounding_ code
@@ -2455,7 +2468,34 @@ declare module "crypto" {
      * @since v6.6.0
      */
     function timingSafeEqual(a: NodeJS.ArrayBufferView, b: NodeJS.ArrayBufferView): boolean;
-    type KeyType = "rsa" | "rsa-pss" | "dsa" | "ec" | "ed25519" | "ed448" | "x25519" | "x448";
+    type KeyType =
+        | "dh"
+        | "dsa"
+        | "ec"
+        | "ed25519"
+        | "ed448"
+        | "ml-dsa-44"
+        | "ml-dsa-65"
+        | "ml-dsa-87"
+        | "ml-kem-1024"
+        | "ml-kem-512"
+        | "ml-kem-768"
+        | "rsa-pss"
+        | "rsa"
+        | "slh-dsa-sha2-128f"
+        | "slh-dsa-sha2-128s"
+        | "slh-dsa-sha2-192f"
+        | "slh-dsa-sha2-192s"
+        | "slh-dsa-sha2-256f"
+        | "slh-dsa-sha2-256s"
+        | "slh-dsa-shake-128f"
+        | "slh-dsa-shake-128s"
+        | "slh-dsa-shake-192f"
+        | "slh-dsa-shake-192s"
+        | "slh-dsa-shake-256f"
+        | "slh-dsa-shake-256s"
+        | "x25519"
+        | "x448";
     type KeyFormat = "pem" | "der" | "jwk";
     interface BasePrivateKeyEncodingOptions<T extends KeyFormat> {
         format: T;
@@ -2470,11 +2510,18 @@ declare module "crypto" {
     interface ED448KeyPairKeyObjectOptions {}
     interface X25519KeyPairKeyObjectOptions {}
     interface X448KeyPairKeyObjectOptions {}
+    interface MLDSAKeyPairKeyObjectOptions {}
+    interface MLKEMKeyPairKeyObjectOptions {}
+    interface SLHDSAKeyPairKeyObjectOptions {}
     interface ECKeyPairKeyObjectOptions {
         /**
          * Name of the curve to use
          */
         namedCurve: string;
+        /**
+         * Must be `'named'` or `'explicit'`. Default: `'named'`.
+         */
+        paramEncoding?: "explicit" | "named" | undefined;
     }
     interface RSAKeyPairKeyObjectOptions {
         /**
@@ -2500,15 +2547,15 @@ declare module "crypto" {
         /**
          * Name of the message digest
          */
-        hashAlgorithm?: string;
+        hashAlgorithm?: string | undefined;
         /**
          * Name of the message digest used by MGF1
          */
-        mgf1HashAlgorithm?: string;
+        mgf1HashAlgorithm?: string | undefined;
         /**
          * Minimal salt length in bytes
          */
-        saltLength?: string;
+        saltLength?: string | undefined;
     }
     interface DSAKeyPairKeyObjectOptions {
         /**
@@ -2551,15 +2598,15 @@ declare module "crypto" {
         /**
          * Name of the message digest
          */
-        hashAlgorithm?: string;
+        hashAlgorithm?: string | undefined;
         /**
          * Name of the message digest used by MGF1
          */
-        mgf1HashAlgorithm?: string;
+        mgf1HashAlgorithm?: string | undefined;
         /**
          * Minimal salt length in bytes
          */
-        saltLength?: string;
+        saltLength?: string | undefined;
         publicKeyEncoding: {
             type: "spki";
             format: PubF;
@@ -2585,11 +2632,7 @@ declare module "crypto" {
             type: "pkcs8";
         };
     }
-    interface ECKeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
-        /**
-         * Name of the curve to use.
-         */
-        namedCurve: string;
+    interface ECKeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> extends ECKeyPairKeyObjectOptions {
         publicKeyEncoding: {
             type: "pkcs1" | "spki";
             format: PubF;
@@ -2634,17 +2677,44 @@ declare module "crypto" {
             type: "pkcs8";
         };
     }
+    interface MLDSAKeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        publicKeyEncoding: {
+            type: "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs8";
+        };
+    }
+    interface MLKEMKeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        publicKeyEncoding: {
+            type: "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs8";
+        };
+    }
+    interface SLHDSAKeyPairOptions<PubF extends KeyFormat, PrivF extends KeyFormat> {
+        publicKeyEncoding: {
+            type: "spki";
+            format: PubF;
+        };
+        privateKeyEncoding: BasePrivateKeyEncodingOptions<PrivF> & {
+            type: "pkcs8";
+        };
+    }
     interface KeyPairSyncResult<T1 extends string | Buffer, T2 extends string | Buffer> {
         publicKey: T1;
         privateKey: T2;
     }
     /**
-     * Generates a new asymmetric key pair of the given `type`. RSA, RSA-PSS, DSA, EC,
-     * Ed25519, Ed448, X25519, X448, and DH are currently supported.
+     * Generates a new asymmetric key pair of the given `type`.
+     * See the supported [asymmetric key types](https://nodejs.org/docs/latest-v24.x/api/crypto.html#asymmetric-key-types).
      *
      * If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
-     * behaves as if `keyObject.export()` had been called on its result. Otherwise,
-     * the respective part of the key is returned as a `KeyObject`.
+     * behaves as if {@link KeyObject.export `keyObject.export()`} had been called on its result. Otherwise,
+     * the respective part of the key is returned as a {@link KeyObject `KeyObject`}.
      *
      * When encoding public keys, it is recommended to use `'spki'`. When encoding
      * private keys, it is recommended to use `'pkcs8'` with a strong passphrase,
@@ -2677,7 +2747,8 @@ declare module "crypto" {
      * When PEM encoding was selected, the respective key will be a string, otherwise
      * it will be a buffer containing the data encoded as DER.
      * @since v10.12.0
-     * @param type Must be `'rsa'`, `'rsa-pss'`, `'dsa'`, `'ec'`, `'ed25519'`, `'ed448'`, `'x25519'`, `'x448'`, or `'dh'`.
+     * @param type The asymmetric key type to generate. See the
+     * supported [asymmetric key types](https://nodejs.org/docs/latest-v24.x/api/crypto.html#asymmetric-key-types).
      */
     function generateKeyPairSync(
         type: "rsa",
@@ -2686,15 +2757,15 @@ declare module "crypto" {
     function generateKeyPairSync(
         type: "rsa",
         options: RSAKeyPairOptions<"pem", "der">,
-    ): KeyPairSyncResult<string, Buffer>;
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
     function generateKeyPairSync(
         type: "rsa",
         options: RSAKeyPairOptions<"der", "pem">,
-    ): KeyPairSyncResult<Buffer, string>;
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
     function generateKeyPairSync(
         type: "rsa",
         options: RSAKeyPairOptions<"der", "der">,
-    ): KeyPairSyncResult<Buffer, Buffer>;
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
     function generateKeyPairSync(type: "rsa", options: RSAKeyPairKeyObjectOptions): KeyPairKeyObjectResult;
     function generateKeyPairSync(
         type: "rsa-pss",
@@ -2703,15 +2774,15 @@ declare module "crypto" {
     function generateKeyPairSync(
         type: "rsa-pss",
         options: RSAPSSKeyPairOptions<"pem", "der">,
-    ): KeyPairSyncResult<string, Buffer>;
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
     function generateKeyPairSync(
         type: "rsa-pss",
         options: RSAPSSKeyPairOptions<"der", "pem">,
-    ): KeyPairSyncResult<Buffer, string>;
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
     function generateKeyPairSync(
         type: "rsa-pss",
         options: RSAPSSKeyPairOptions<"der", "der">,
-    ): KeyPairSyncResult<Buffer, Buffer>;
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
     function generateKeyPairSync(type: "rsa-pss", options: RSAPSSKeyPairKeyObjectOptions): KeyPairKeyObjectResult;
     function generateKeyPairSync(
         type: "dsa",
@@ -2720,15 +2791,15 @@ declare module "crypto" {
     function generateKeyPairSync(
         type: "dsa",
         options: DSAKeyPairOptions<"pem", "der">,
-    ): KeyPairSyncResult<string, Buffer>;
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
     function generateKeyPairSync(
         type: "dsa",
         options: DSAKeyPairOptions<"der", "pem">,
-    ): KeyPairSyncResult<Buffer, string>;
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
     function generateKeyPairSync(
         type: "dsa",
         options: DSAKeyPairOptions<"der", "der">,
-    ): KeyPairSyncResult<Buffer, Buffer>;
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
     function generateKeyPairSync(type: "dsa", options: DSAKeyPairKeyObjectOptions): KeyPairKeyObjectResult;
     function generateKeyPairSync(
         type: "ec",
@@ -2737,15 +2808,15 @@ declare module "crypto" {
     function generateKeyPairSync(
         type: "ec",
         options: ECKeyPairOptions<"pem", "der">,
-    ): KeyPairSyncResult<string, Buffer>;
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
     function generateKeyPairSync(
         type: "ec",
         options: ECKeyPairOptions<"der", "pem">,
-    ): KeyPairSyncResult<Buffer, string>;
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
     function generateKeyPairSync(
         type: "ec",
         options: ECKeyPairOptions<"der", "der">,
-    ): KeyPairSyncResult<Buffer, Buffer>;
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
     function generateKeyPairSync(type: "ec", options: ECKeyPairKeyObjectOptions): KeyPairKeyObjectResult;
     function generateKeyPairSync(
         type: "ed25519",
@@ -2754,15 +2825,15 @@ declare module "crypto" {
     function generateKeyPairSync(
         type: "ed25519",
         options: ED25519KeyPairOptions<"pem", "der">,
-    ): KeyPairSyncResult<string, Buffer>;
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
     function generateKeyPairSync(
         type: "ed25519",
         options: ED25519KeyPairOptions<"der", "pem">,
-    ): KeyPairSyncResult<Buffer, string>;
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
     function generateKeyPairSync(
         type: "ed25519",
         options: ED25519KeyPairOptions<"der", "der">,
-    ): KeyPairSyncResult<Buffer, Buffer>;
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
     function generateKeyPairSync(type: "ed25519", options?: ED25519KeyPairKeyObjectOptions): KeyPairKeyObjectResult;
     function generateKeyPairSync(
         type: "ed448",
@@ -2771,15 +2842,15 @@ declare module "crypto" {
     function generateKeyPairSync(
         type: "ed448",
         options: ED448KeyPairOptions<"pem", "der">,
-    ): KeyPairSyncResult<string, Buffer>;
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
     function generateKeyPairSync(
         type: "ed448",
         options: ED448KeyPairOptions<"der", "pem">,
-    ): KeyPairSyncResult<Buffer, string>;
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
     function generateKeyPairSync(
         type: "ed448",
         options: ED448KeyPairOptions<"der", "der">,
-    ): KeyPairSyncResult<Buffer, Buffer>;
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
     function generateKeyPairSync(type: "ed448", options?: ED448KeyPairKeyObjectOptions): KeyPairKeyObjectResult;
     function generateKeyPairSync(
         type: "x25519",
@@ -2788,15 +2859,15 @@ declare module "crypto" {
     function generateKeyPairSync(
         type: "x25519",
         options: X25519KeyPairOptions<"pem", "der">,
-    ): KeyPairSyncResult<string, Buffer>;
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
     function generateKeyPairSync(
         type: "x25519",
         options: X25519KeyPairOptions<"der", "pem">,
-    ): KeyPairSyncResult<Buffer, string>;
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
     function generateKeyPairSync(
         type: "x25519",
         options: X25519KeyPairOptions<"der", "der">,
-    ): KeyPairSyncResult<Buffer, Buffer>;
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
     function generateKeyPairSync(type: "x25519", options?: X25519KeyPairKeyObjectOptions): KeyPairKeyObjectResult;
     function generateKeyPairSync(
         type: "x448",
@@ -2805,25 +2876,145 @@ declare module "crypto" {
     function generateKeyPairSync(
         type: "x448",
         options: X448KeyPairOptions<"pem", "der">,
-    ): KeyPairSyncResult<string, Buffer>;
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
     function generateKeyPairSync(
         type: "x448",
         options: X448KeyPairOptions<"der", "pem">,
-    ): KeyPairSyncResult<Buffer, string>;
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
     function generateKeyPairSync(
         type: "x448",
         options: X448KeyPairOptions<"der", "der">,
-    ): KeyPairSyncResult<Buffer, Buffer>;
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
     function generateKeyPairSync(type: "x448", options?: X448KeyPairKeyObjectOptions): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options: MLDSAKeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options: MLDSAKeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options: MLDSAKeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options: MLDSAKeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options?: MLDSAKeyPairKeyObjectOptions,
+    ): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options: MLKEMKeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options: MLKEMKeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options: MLKEMKeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<NonSharedBuffer, string>;
+    function generateKeyPairSync(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options: MLKEMKeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<NonSharedBuffer, NonSharedBuffer>;
+    function generateKeyPairSync(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options?: MLKEMKeyPairKeyObjectOptions,
+    ): KeyPairKeyObjectResult;
+    function generateKeyPairSync(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options: SLHDSAKeyPairOptions<"pem", "pem">,
+    ): KeyPairSyncResult<string, string>;
+    function generateKeyPairSync(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options: SLHDSAKeyPairOptions<"pem", "der">,
+    ): KeyPairSyncResult<string, Buffer>;
+    function generateKeyPairSync(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options: SLHDSAKeyPairOptions<"der", "pem">,
+    ): KeyPairSyncResult<Buffer, string>;
+    function generateKeyPairSync(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options: SLHDSAKeyPairOptions<"der", "der">,
+    ): KeyPairSyncResult<Buffer, Buffer>;
+    function generateKeyPairSync(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options?: SLHDSAKeyPairKeyObjectOptions,
+    ): KeyPairKeyObjectResult;
     /**
-     * Generates a new asymmetric key pair of the given `type`. RSA, RSA-PSS, DSA, EC,
-     * Ed25519, Ed448, X25519, X448, and DH are currently supported.
+     * Generates a new asymmetric key pair of the given `type`.
+     * See the supported [asymmetric key types](https://nodejs.org/docs/latest-v24.x/api/crypto.html#asymmetric-key-types).
      *
      * If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
-     * behaves as if `keyObject.export()` had been called on its result. Otherwise,
-     * the respective part of the key is returned as a `KeyObject`.
+     * behaves as if {@link KeyObject.export `keyObject.export()`} had been called on its result. Otherwise,
+     * the respective part of the key is returned as a {@link KeyObject `KeyObject`}.
      *
-     * It is recommended to encode public keys as `'spki'` and private keys as`'pkcs8'` with encryption for long-term storage:
+     * It is recommended to encode public keys as `'spki'` and private keys as `'pkcs8'` with encryption for long-term storage:
      *
      * ```js
      * const {
@@ -2847,12 +3038,13 @@ declare module "crypto" {
      * });
      * ```
      *
-     * On completion, `callback` will be called with `err` set to `undefined` and`publicKey` / `privateKey` representing the generated key pair.
+     * On completion, `callback` will be called with `err` set to `undefined` and `publicKey` / `privateKey` representing the generated key pair.
      *
      * If this method is invoked as its `util.promisify()` ed version, it returns
      * a `Promise` for an `Object` with `publicKey` and `privateKey` properties.
      * @since v10.12.0
-     * @param type Must be `'rsa'`, `'rsa-pss'`, `'dsa'`, `'ec'`, `'ed25519'`, `'ed448'`, `'x25519'`, `'x448'`, or `'dh'`.
+     * @param type The asymmetric key type to generate. See the
+     * supported [asymmetric key types](https://nodejs.org/docs/latest-v24.x/api/crypto.html#asymmetric-key-types).
      */
     function generateKeyPair(
         type: "rsa",
@@ -2862,17 +3054,17 @@ declare module "crypto" {
     function generateKeyPair(
         type: "rsa",
         options: RSAKeyPairOptions<"pem", "der">,
-        callback: (err: Error | null, publicKey: string, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "rsa",
         options: RSAKeyPairOptions<"der", "pem">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: string) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
     function generateKeyPair(
         type: "rsa",
         options: RSAKeyPairOptions<"der", "der">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "rsa",
@@ -2887,17 +3079,17 @@ declare module "crypto" {
     function generateKeyPair(
         type: "rsa-pss",
         options: RSAPSSKeyPairOptions<"pem", "der">,
-        callback: (err: Error | null, publicKey: string, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "rsa-pss",
         options: RSAPSSKeyPairOptions<"der", "pem">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: string) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
     function generateKeyPair(
         type: "rsa-pss",
         options: RSAPSSKeyPairOptions<"der", "der">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "rsa-pss",
@@ -2912,17 +3104,17 @@ declare module "crypto" {
     function generateKeyPair(
         type: "dsa",
         options: DSAKeyPairOptions<"pem", "der">,
-        callback: (err: Error | null, publicKey: string, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "dsa",
         options: DSAKeyPairOptions<"der", "pem">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: string) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
     function generateKeyPair(
         type: "dsa",
         options: DSAKeyPairOptions<"der", "der">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "dsa",
@@ -2937,17 +3129,17 @@ declare module "crypto" {
     function generateKeyPair(
         type: "ec",
         options: ECKeyPairOptions<"pem", "der">,
-        callback: (err: Error | null, publicKey: string, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "ec",
         options: ECKeyPairOptions<"der", "pem">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: string) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
     function generateKeyPair(
         type: "ec",
         options: ECKeyPairOptions<"der", "der">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "ec",
@@ -2962,17 +3154,17 @@ declare module "crypto" {
     function generateKeyPair(
         type: "ed25519",
         options: ED25519KeyPairOptions<"pem", "der">,
-        callback: (err: Error | null, publicKey: string, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "ed25519",
         options: ED25519KeyPairOptions<"der", "pem">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: string) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
     function generateKeyPair(
         type: "ed25519",
         options: ED25519KeyPairOptions<"der", "der">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "ed25519",
@@ -2987,17 +3179,17 @@ declare module "crypto" {
     function generateKeyPair(
         type: "ed448",
         options: ED448KeyPairOptions<"pem", "der">,
-        callback: (err: Error | null, publicKey: string, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "ed448",
         options: ED448KeyPairOptions<"der", "pem">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: string) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
     function generateKeyPair(
         type: "ed448",
         options: ED448KeyPairOptions<"der", "der">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "ed448",
@@ -3012,17 +3204,17 @@ declare module "crypto" {
     function generateKeyPair(
         type: "x25519",
         options: X25519KeyPairOptions<"pem", "der">,
-        callback: (err: Error | null, publicKey: string, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "x25519",
         options: X25519KeyPairOptions<"der", "pem">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: string) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
     function generateKeyPair(
         type: "x25519",
         options: X25519KeyPairOptions<"der", "der">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "x25519",
@@ -3037,23 +3229,158 @@ declare module "crypto" {
     function generateKeyPair(
         type: "x448",
         options: X448KeyPairOptions<"pem", "der">,
-        callback: (err: Error | null, publicKey: string, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "x448",
         options: X448KeyPairOptions<"der", "pem">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: string) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
     ): void;
     function generateKeyPair(
         type: "x448",
         options: X448KeyPairOptions<"der", "der">,
-        callback: (err: Error | null, publicKey: Buffer, privateKey: Buffer) => void,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
     ): void;
     function generateKeyPair(
         type: "x448",
         options: X448KeyPairKeyObjectOptions | undefined,
         callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
     ): void;
+    function generateKeyPair(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options: MLDSAKeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options: MLDSAKeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options: MLDSAKeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options: MLDSAKeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+        options: MLDSAKeyPairKeyObjectOptions | undefined,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options: MLKEMKeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options: MLKEMKeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options: MLKEMKeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options: MLKEMKeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: NonSharedBuffer, privateKey: NonSharedBuffer) => void,
+    ): void;
+    function generateKeyPair(
+        type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+        options: MLKEMKeyPairKeyObjectOptions | undefined,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
+    ): void;
+    function generateKeyPair(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options: SLHDSAKeyPairOptions<"pem", "pem">,
+        callback: (err: Error | null, publicKey: string, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options: SLHDSAKeyPairOptions<"pem", "der">,
+        callback: (err: Error | null, publicKey: string, privateKey: Buffer) => void,
+    ): void;
+    function generateKeyPair(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options: SLHDSAKeyPairOptions<"der", "pem">,
+        callback: (err: Error | null, publicKey: Buffer, privateKey: string) => void,
+    ): void;
+    function generateKeyPair(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options: SLHDSAKeyPairOptions<"der", "der">,
+        callback: (err: Error | null, publicKey: Buffer, privateKey: Buffer) => void,
+    ): void;
+    function generateKeyPair(
+        type:
+            | "slh-dsa-sha2-128f"
+            | "slh-dsa-sha2-128s"
+            | "slh-dsa-sha2-192f"
+            | "slh-dsa-sha2-192s"
+            | "slh-dsa-sha2-256f"
+            | "slh-dsa-sha2-256s"
+            | "slh-dsa-shake-128f"
+            | "slh-dsa-shake-128s"
+            | "slh-dsa-shake-192f"
+            | "slh-dsa-shake-192s"
+            | "slh-dsa-shake-256f"
+            | "slh-dsa-shake-256s",
+        options: SLHDSAKeyPairKeyObjectOptions | undefined,
+        callback: (err: Error | null, publicKey: KeyObject, privateKey: KeyObject) => void,
+    ): void;
     namespace generateKeyPair {
         function __promisify__(
             type: "rsa",
@@ -3067,21 +3394,21 @@ declare module "crypto" {
             options: RSAKeyPairOptions<"pem", "der">,
         ): Promise<{
             publicKey: string;
-            privateKey: Buffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "rsa",
             options: RSAKeyPairOptions<"der", "pem">,
         ): Promise<{
-            publicKey: Buffer;
+            publicKey: NonSharedBuffer;
             privateKey: string;
         }>;
         function __promisify__(
             type: "rsa",
             options: RSAKeyPairOptions<"der", "der">,
         ): Promise<{
-            publicKey: Buffer;
-            privateKey: Buffer;
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(type: "rsa", options: RSAKeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
         function __promisify__(
@@ -3096,21 +3423,21 @@ declare module "crypto" {
             options: RSAPSSKeyPairOptions<"pem", "der">,
         ): Promise<{
             publicKey: string;
-            privateKey: Buffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "rsa-pss",
             options: RSAPSSKeyPairOptions<"der", "pem">,
         ): Promise<{
-            publicKey: Buffer;
+            publicKey: NonSharedBuffer;
             privateKey: string;
         }>;
         function __promisify__(
             type: "rsa-pss",
             options: RSAPSSKeyPairOptions<"der", "der">,
         ): Promise<{
-            publicKey: Buffer;
-            privateKey: Buffer;
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "rsa-pss",
@@ -3128,21 +3455,21 @@ declare module "crypto" {
             options: DSAKeyPairOptions<"pem", "der">,
         ): Promise<{
             publicKey: string;
-            privateKey: Buffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "dsa",
             options: DSAKeyPairOptions<"der", "pem">,
         ): Promise<{
-            publicKey: Buffer;
+            publicKey: NonSharedBuffer;
             privateKey: string;
         }>;
         function __promisify__(
             type: "dsa",
             options: DSAKeyPairOptions<"der", "der">,
         ): Promise<{
-            publicKey: Buffer;
-            privateKey: Buffer;
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(type: "dsa", options: DSAKeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
         function __promisify__(
@@ -3157,21 +3484,21 @@ declare module "crypto" {
             options: ECKeyPairOptions<"pem", "der">,
         ): Promise<{
             publicKey: string;
-            privateKey: Buffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "ec",
             options: ECKeyPairOptions<"der", "pem">,
         ): Promise<{
-            publicKey: Buffer;
+            publicKey: NonSharedBuffer;
             privateKey: string;
         }>;
         function __promisify__(
             type: "ec",
             options: ECKeyPairOptions<"der", "der">,
         ): Promise<{
-            publicKey: Buffer;
-            privateKey: Buffer;
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(type: "ec", options: ECKeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
         function __promisify__(
@@ -3186,21 +3513,21 @@ declare module "crypto" {
             options: ED25519KeyPairOptions<"pem", "der">,
         ): Promise<{
             publicKey: string;
-            privateKey: Buffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "ed25519",
             options: ED25519KeyPairOptions<"der", "pem">,
         ): Promise<{
-            publicKey: Buffer;
+            publicKey: NonSharedBuffer;
             privateKey: string;
         }>;
         function __promisify__(
             type: "ed25519",
             options: ED25519KeyPairOptions<"der", "der">,
         ): Promise<{
-            publicKey: Buffer;
-            privateKey: Buffer;
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "ed25519",
@@ -3218,21 +3545,21 @@ declare module "crypto" {
             options: ED448KeyPairOptions<"pem", "der">,
         ): Promise<{
             publicKey: string;
-            privateKey: Buffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "ed448",
             options: ED448KeyPairOptions<"der", "pem">,
         ): Promise<{
-            publicKey: Buffer;
+            publicKey: NonSharedBuffer;
             privateKey: string;
         }>;
         function __promisify__(
             type: "ed448",
             options: ED448KeyPairOptions<"der", "der">,
         ): Promise<{
-            publicKey: Buffer;
-            privateKey: Buffer;
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(type: "ed448", options?: ED448KeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
         function __promisify__(
@@ -3247,21 +3574,21 @@ declare module "crypto" {
             options: X25519KeyPairOptions<"pem", "der">,
         ): Promise<{
             publicKey: string;
-            privateKey: Buffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "x25519",
             options: X25519KeyPairOptions<"der", "pem">,
         ): Promise<{
-            publicKey: Buffer;
+            publicKey: NonSharedBuffer;
             privateKey: string;
         }>;
         function __promisify__(
             type: "x25519",
             options: X25519KeyPairOptions<"der", "der">,
         ): Promise<{
-            publicKey: Buffer;
-            privateKey: Buffer;
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "x25519",
@@ -3279,28 +3606,187 @@ declare module "crypto" {
             options: X448KeyPairOptions<"pem", "der">,
         ): Promise<{
             publicKey: string;
-            privateKey: Buffer;
+            privateKey: NonSharedBuffer;
         }>;
         function __promisify__(
             type: "x448",
             options: X448KeyPairOptions<"der", "pem">,
         ): Promise<{
-            publicKey: Buffer;
+            publicKey: NonSharedBuffer;
             privateKey: string;
         }>;
         function __promisify__(
             type: "x448",
             options: X448KeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(type: "x448", options?: X448KeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
+            type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+            options: MLDSAKeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+            options: MLDSAKeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+            options: MLDSAKeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+            options: MLDSAKeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87",
+            options?: MLDSAKeyPairKeyObjectOptions,
+        ): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
+            type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+            options: MLKEMKeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+            options: MLKEMKeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+            options: MLKEMKeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+            options: MLKEMKeyPairOptions<"der", "der">,
+        ): Promise<{
+            publicKey: NonSharedBuffer;
+            privateKey: NonSharedBuffer;
+        }>;
+        function __promisify__(
+            type: "ml-kem-1024" | "ml-kem-512" | "ml-kem-768",
+            options?: MLKEMKeyPairKeyObjectOptions,
+        ): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
+            type:
+                | "slh-dsa-sha2-128f"
+                | "slh-dsa-sha2-128s"
+                | "slh-dsa-sha2-192f"
+                | "slh-dsa-sha2-192s"
+                | "slh-dsa-sha2-256f"
+                | "slh-dsa-sha2-256s"
+                | "slh-dsa-shake-128f"
+                | "slh-dsa-shake-128s"
+                | "slh-dsa-shake-192f"
+                | "slh-dsa-shake-192s"
+                | "slh-dsa-shake-256f"
+                | "slh-dsa-shake-256s",
+            options: SLHDSAKeyPairOptions<"pem", "pem">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type:
+                | "slh-dsa-sha2-128f"
+                | "slh-dsa-sha2-128s"
+                | "slh-dsa-sha2-192f"
+                | "slh-dsa-sha2-192s"
+                | "slh-dsa-sha2-256f"
+                | "slh-dsa-sha2-256s"
+                | "slh-dsa-shake-128f"
+                | "slh-dsa-shake-128s"
+                | "slh-dsa-shake-192f"
+                | "slh-dsa-shake-192s"
+                | "slh-dsa-shake-256f"
+                | "slh-dsa-shake-256s",
+            options: SLHDSAKeyPairOptions<"pem", "der">,
+        ): Promise<{
+            publicKey: string;
+            privateKey: Buffer;
+        }>;
+        function __promisify__(
+            type:
+                | "slh-dsa-sha2-128f"
+                | "slh-dsa-sha2-128s"
+                | "slh-dsa-sha2-192f"
+                | "slh-dsa-sha2-192s"
+                | "slh-dsa-sha2-256f"
+                | "slh-dsa-sha2-256s"
+                | "slh-dsa-shake-128f"
+                | "slh-dsa-shake-128s"
+                | "slh-dsa-shake-192f"
+                | "slh-dsa-shake-192s"
+                | "slh-dsa-shake-256f"
+                | "slh-dsa-shake-256s",
+            options: SLHDSAKeyPairOptions<"der", "pem">,
+        ): Promise<{
+            publicKey: Buffer;
+            privateKey: string;
+        }>;
+        function __promisify__(
+            type:
+                | "slh-dsa-sha2-128f"
+                | "slh-dsa-sha2-128s"
+                | "slh-dsa-sha2-192f"
+                | "slh-dsa-sha2-192s"
+                | "slh-dsa-sha2-256f"
+                | "slh-dsa-sha2-256s"
+                | "slh-dsa-shake-128f"
+                | "slh-dsa-shake-128s"
+                | "slh-dsa-shake-192f"
+                | "slh-dsa-shake-192s"
+                | "slh-dsa-shake-256f"
+                | "slh-dsa-shake-256s",
+            options: SLHDSAKeyPairOptions<"der", "der">,
         ): Promise<{
             publicKey: Buffer;
             privateKey: Buffer;
         }>;
-        function __promisify__(type: "x448", options?: X448KeyPairKeyObjectOptions): Promise<KeyPairKeyObjectResult>;
+        function __promisify__(
+            type:
+                | "slh-dsa-sha2-128f"
+                | "slh-dsa-sha2-128s"
+                | "slh-dsa-sha2-192f"
+                | "slh-dsa-sha2-192s"
+                | "slh-dsa-sha2-256f"
+                | "slh-dsa-sha2-256s"
+                | "slh-dsa-shake-128f"
+                | "slh-dsa-shake-128s"
+                | "slh-dsa-shake-192f"
+                | "slh-dsa-shake-192s"
+                | "slh-dsa-shake-256f"
+                | "slh-dsa-shake-256s",
+            options?: SLHDSAKeyPairKeyObjectOptions,
+        ): Promise<KeyPairKeyObjectResult>;
     }
     /**
      * Calculates and returns the signature for `data` using the given private key and
      * algorithm. If `algorithm` is `null` or `undefined`, then the algorithm is
-     * dependent upon the key type (especially Ed25519 and Ed448).
+     * dependent upon the key type.
+     *
+     * `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
+     * ML-DSA.
      *
      * If `key` is not a `KeyObject`, this function behaves as if `key` had been
      * passed to {@link createPrivateKey}. If it is an object, the following
@@ -3312,17 +3798,21 @@ declare module "crypto" {
     function sign(
         algorithm: string | null | undefined,
         data: NodeJS.ArrayBufferView,
-        key: KeyLike | SignKeyObjectInput | SignPrivateKeyInput,
-    ): Buffer;
+        key: KeyLike | SignKeyObjectInput | SignPrivateKeyInput | SignJsonWebKeyInput,
+    ): NonSharedBuffer;
     function sign(
         algorithm: string | null | undefined,
         data: NodeJS.ArrayBufferView,
-        key: KeyLike | SignKeyObjectInput | SignPrivateKeyInput,
-        callback: (error: Error | null, data: Buffer) => void,
+        key: KeyLike | SignKeyObjectInput | SignPrivateKeyInput | SignJsonWebKeyInput,
+        callback: (error: Error | null, data: NonSharedBuffer) => void,
     ): void;
     /**
-     * Verifies the given signature for `data` using the given key and algorithm. If`algorithm` is `null` or `undefined`, then the algorithm is dependent upon the
-     * key type (especially Ed25519 and Ed448).
+     * Verifies the given signature for `data` using the given key and algorithm. If
+     * `algorithm` is `null` or `undefined`, then the algorithm is dependent upon the
+     * key type.
+     *
+     * `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
+     * ML-DSA.
      *
      * If `key` is not a `KeyObject`, this function behaves as if `key` had been
      * passed to {@link createPublicKey}. If it is an object, the following
@@ -3350,11 +3840,141 @@ declare module "crypto" {
         callback: (error: Error | null, result: boolean) => void,
     ): void;
     /**
-     * Computes the Diffie-Hellman secret based on a `privateKey` and a `publicKey`.
-     * Both keys must have the same `asymmetricKeyType`, which must be one of `'dh'`(for Diffie-Hellman), `'ec'` (for ECDH), `'x448'`, or `'x25519'` (for ECDH-ES).
+     * Key decapsulation using a KEM algorithm with a private key.
+     *
+     * Supported key types and their KEM algorithms are:
+     *
+     * * `'rsa'` RSA Secret Value Encapsulation
+     * * `'ec'` DHKEM(P-256, HKDF-SHA256), DHKEM(P-384, HKDF-SHA256), DHKEM(P-521, HKDF-SHA256)
+     * * `'x25519'` DHKEM(X25519, HKDF-SHA256)
+     * * `'x448'` DHKEM(X448, HKDF-SHA512)
+     * * `'ml-kem-512'` ML-KEM
+     * * `'ml-kem-768'` ML-KEM
+     * * `'ml-kem-1024'` ML-KEM
+     *
+     * If `key` is not a {@link KeyObject}, this function behaves as if `key` had been
+     * passed to `crypto.createPrivateKey()`.
+     *
+     * If the `callback` function is provided this function uses libuv's threadpool.
+     * @since v24.7.0
+     */
+    function decapsulate(
+        key: KeyLike | PrivateKeyInput | JsonWebKeyInput,
+        ciphertext: ArrayBuffer | NodeJS.ArrayBufferView,
+    ): NonSharedBuffer;
+    function decapsulate(
+        key: KeyLike | PrivateKeyInput | JsonWebKeyInput,
+        ciphertext: ArrayBuffer | NodeJS.ArrayBufferView,
+        callback: (err: Error, sharedKey: NonSharedBuffer) => void,
+    ): void;
+    /**
+     * Computes the Diffie-Hellman shared secret based on a `privateKey` and a `publicKey`.
+     * Both keys must have the same `asymmetricKeyType` and must support either the DH or
+     * ECDH operation.
+     *
+     * If the `callback` function is provided this function uses libuv's threadpool.
      * @since v13.9.0, v12.17.0
      */
-    function diffieHellman(options: { privateKey: KeyObject; publicKey: KeyObject }): Buffer;
+    function diffieHellman(options: { privateKey: KeyObject; publicKey: KeyObject }): NonSharedBuffer;
+    function diffieHellman(
+        options: { privateKey: KeyObject; publicKey: KeyObject },
+        callback: (err: Error | null, secret: NonSharedBuffer) => void,
+    ): void;
+    /**
+     * Key encapsulation using a KEM algorithm with a public key.
+     *
+     * Supported key types and their KEM algorithms are:
+     *
+     * * `'rsa'` RSA Secret Value Encapsulation
+     * * `'ec'` DHKEM(P-256, HKDF-SHA256), DHKEM(P-384, HKDF-SHA256), DHKEM(P-521, HKDF-SHA256)
+     * * `'x25519'` DHKEM(X25519, HKDF-SHA256)
+     * * `'x448'` DHKEM(X448, HKDF-SHA512)
+     * * `'ml-kem-512'` ML-KEM
+     * * `'ml-kem-768'` ML-KEM
+     * * `'ml-kem-1024'` ML-KEM
+     *
+     * If `key` is not a {@link KeyObject}, this function behaves as if `key` had been
+     * passed to `crypto.createPublicKey()`.
+     *
+     * If the `callback` function is provided this function uses libuv's threadpool.
+     * @since v24.7.0
+     */
+    function encapsulate(
+        key: KeyLike | PublicKeyInput | JsonWebKeyInput,
+    ): { sharedKey: NonSharedBuffer; ciphertext: NonSharedBuffer };
+    function encapsulate(
+        key: KeyLike | PublicKeyInput | JsonWebKeyInput,
+        callback: (err: Error, result: { sharedKey: NonSharedBuffer; ciphertext: NonSharedBuffer }) => void,
+    ): void;
+    interface OneShotDigestOptions {
+        /**
+         * Encoding used to encode the returned digest.
+         * @default 'hex'
+         */
+        outputEncoding?: BinaryToTextEncoding | "buffer" | undefined;
+        /**
+         * For XOF hash functions such as 'shake256', the outputLength option
+         * can be used to specify the desired output length in bytes.
+         */
+        outputLength?: number | undefined;
+    }
+    interface OneShotDigestOptionsWithStringEncoding extends OneShotDigestOptions {
+        outputEncoding?: BinaryToTextEncoding | undefined;
+    }
+    interface OneShotDigestOptionsWithBufferEncoding extends OneShotDigestOptions {
+        outputEncoding: "buffer";
+    }
+    /**
+     * A utility for creating one-shot hash digests of data. It can be faster than
+     * the object-based `crypto.createHash()` when hashing a smaller amount of data
+     * (<= 5MB) that's readily available. If the data can be big or if it is streamed,
+     * it's still recommended to use `crypto.createHash()` instead.
+     *
+     * The `algorithm` is dependent on the available algorithms supported by the
+     * version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
+     * On recent releases of OpenSSL, `openssl list -digest-algorithms` will
+     * display the available digest algorithms.
+     *
+     * If `options` is a string, then it specifies the `outputEncoding`.
+     *
+     * Example:
+     *
+     * ```js
+     * import crypto from 'node:crypto';
+     * import { Buffer } from 'node:buffer';
+     *
+     * // Hashing a string and return the result as a hex-encoded string.
+     * const string = 'Node.js';
+     * // 10b3493287f831e81a438811a1ffba01f8cec4b7
+     * console.log(crypto.hash('sha1', string));
+     *
+     * // Encode a base64-encoded string into a Buffer, hash it and return
+     * // the result as a buffer.
+     * const base64 = 'Tm9kZS5qcw==';
+     * // <Buffer 10 b3 49 32 87 f8 31 e8 1a 43 88 11 a1 ff ba 01 f8 ce c4 b7>
+     * console.log(crypto.hash('sha1', Buffer.from(base64, 'base64'), 'buffer'));
+     * ```
+     * @since v21.7.0, v20.12.0
+     * @param data When `data` is a string, it will be encoded as UTF-8 before being hashed. If a different
+     * input encoding is desired for a string input, user could encode the string
+     * into a `TypedArray` using either `TextEncoder` or `Buffer.from()` and passing
+     * the encoded `TypedArray` into this API instead.
+     */
+    function hash(
+        algorithm: string,
+        data: BinaryLike,
+        options?: OneShotDigestOptionsWithStringEncoding | BinaryToTextEncoding,
+    ): string;
+    function hash(
+        algorithm: string,
+        data: BinaryLike,
+        options: OneShotDigestOptionsWithBufferEncoding | "buffer",
+    ): NonSharedBuffer;
+    function hash(
+        algorithm: string,
+        data: BinaryLike,
+        options: OneShotDigestOptions | BinaryToTextEncoding | "buffer",
+    ): string | NonSharedBuffer;
     type CipherMode = "cbc" | "ccm" | "cfb" | "ctr" | "ecb" | "gcm" | "ocb" | "ofb" | "stream" | "wrap" | "xts";
     interface CipherInfoOptions {
         /**
@@ -3407,9 +4027,9 @@ declare module "crypto" {
      */
     function getCipherInfo(nameOrNid: string | number, options?: CipherInfoOptions): CipherInfo | undefined;
     /**
-     * HKDF is a simple key derivation function defined in RFC 5869\. The given `ikm`,`salt` and `info` are used with the `digest` to derive a key of `keylen` bytes.
+     * HKDF is a simple key derivation function defined in RFC 5869\. The given `ikm`, `salt` and `info` are used with the `digest` to derive a key of `keylen` bytes.
      *
-     * The supplied `callback` function is called with two arguments: `err` and`derivedKey`. If an errors occurs while deriving the key, `err` will be set;
+     * The supplied `callback` function is called with two arguments: `err` and `derivedKey`. If an errors occurs while deriving the key, `err` will be set;
      * otherwise `err` will be `null`. The successfully generated `derivedKey` will
      * be passed to the callback as an [ArrayBuffer](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer). An error will be thrown if any
      * of the input arguments specify invalid values or types.
@@ -3443,7 +4063,7 @@ declare module "crypto" {
     ): void;
     /**
      * Provides a synchronous HKDF key derivation function as defined in RFC 5869\. The
-     * given `ikm`, `salt` and `info` are used with the `digest` to derive a key of`keylen` bytes.
+     * given `ikm`, `salt` and `info` are used with the `digest` to derive a key of `keylen` bytes.
      *
      * The successfully generated `derivedKey` will be returned as an [ArrayBuffer](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer).
      *
@@ -3518,23 +4138,23 @@ declare module "crypto" {
         /**
          * @default 'always'
          */
-        subject?: "always" | "default" | "never";
+        subject?: "always" | "default" | "never" | undefined;
         /**
          * @default true
          */
-        wildcards?: boolean;
+        wildcards?: boolean | undefined;
         /**
          * @default true
          */
-        partialWildcards?: boolean;
+        partialWildcards?: boolean | undefined;
         /**
          * @default false
          */
-        multiLabelWildcards?: boolean;
+        multiLabelWildcards?: boolean | undefined;
         /**
          * @default false
          */
-        singleLabelSubdomains?: boolean;
+        singleLabelSubdomains?: boolean | undefined;
     }
     /**
      * Encapsulates an X509 certificate and provides read-only access to
@@ -3636,7 +4256,7 @@ declare module "crypto" {
          * available.
          * @since v15.9.0
          */
-        readonly issuerCertificate?: X509Certificate | undefined;
+        readonly issuerCertificate: X509Certificate | undefined;
         /**
          * The public key `KeyObject` for this certificate.
          * @since v15.6.0
@@ -3646,7 +4266,7 @@ declare module "crypto" {
          * A `Buffer` containing the DER encoding of this certificate.
          * @since v15.6.0
          */
-        readonly raw: Buffer;
+        readonly raw: NonSharedBuffer;
         /**
          * The serial number of this certificate.
          *
@@ -3656,16 +4276,36 @@ declare module "crypto" {
          * @since v15.6.0
          */
         readonly serialNumber: string;
+        /**
+         * The algorithm used to sign the certificate or `undefined` if the signature algorithm is unknown by OpenSSL.
+         * @since v24.9.0
+         */
+        readonly signatureAlgorithm: string | undefined;
+        /**
+         * The OID of the algorithm used to sign the certificate.
+         * @since v24.9.0
+         */
+        readonly signatureAlgorithmOid: string;
         /**
          * The date/time from which this certificate is considered valid.
          * @since v15.6.0
          */
         readonly validFrom: string;
+        /**
+         * The date/time from which this certificate is valid, encapsulated in a `Date` object.
+         * @since v22.10.0
+         */
+        readonly validFromDate: Date;
         /**
          * The date/time until which this certificate is considered valid.
          * @since v15.6.0
          */
         readonly validTo: string;
+        /**
+         * The date/time until which this certificate is valid, encapsulated in a `Date` object.
+         * @since v22.10.0
+         */
+        readonly validToDate: Date;
         constructor(buffer: BinaryLike);
         /**
          * Checks whether the certificate matches the given email address.
@@ -3718,7 +4358,23 @@ declare module "crypto" {
          */
         checkIP(ip: string): string | undefined;
         /**
-         * Checks whether this certificate was issued by the given `otherCert`.
+         * Checks whether this certificate was potentially issued by the given `otherCert`
+         * by comparing the certificate metadata.
+         *
+         * This is useful for pruning a list of possible issuer certificates which have been
+         * selected using a more rudimentary filtering routine, i.e. just based on subject
+         * and issuer names.
+         *
+         * Finally, to verify that this certificate's signature was produced by a private key
+         * corresponding to `otherCert`'s public key use `x509.verify(publicKey)`
+         * with `otherCert`'s public key represented as a `KeyObject`
+         * like so
+         *
+         * ```js
+         * if (!x509.verify(otherCert.publicKey)) {
+         *   throw new Error('otherCert did not issue x509');
+         * }
+         * ```
          * @since v15.6.0
          */
         checkIssued(otherCert: X509Certificate): boolean;
@@ -3772,7 +4428,7 @@ declare module "crypto" {
     /**
      * Generates a pseudorandom prime of `size` bits.
      *
-     * If `options.safe` is `true`, the prime will be a safe prime -- that is,`(prime - 1) / 2` will also be a prime.
+     * If `options.safe` is `true`, the prime will be a safe prime -- that is, `(prime - 1) / 2` will also be a prime.
      *
      * The `options.add` and `options.rem` parameters can be used to enforce additional
      * requirements, e.g., for Diffie-Hellman:
@@ -3788,7 +4444,7 @@ declare module "crypto" {
      * * `options.rem` is ignored if `options.add` is not given.
      *
      * Both `options.add` and `options.rem` must be encoded as big-endian sequences
-     * if given as an `ArrayBuffer`, `SharedArrayBuffer`, `TypedArray`, `Buffer`, or`DataView`.
+     * if given as an `ArrayBuffer`, `SharedArrayBuffer`, `TypedArray`, `Buffer`, or `DataView`.
      *
      * By default, the prime is encoded as a big-endian sequence of octets
      * in an [ArrayBuffer](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer). If the `bigint` option is `true`, then a
@@ -3815,7 +4471,7 @@ declare module "crypto" {
     /**
      * Generates a pseudorandom prime of `size` bits.
      *
-     * If `options.safe` is `true`, the prime will be a safe prime -- that is,`(prime - 1) / 2` will also be a prime.
+     * If `options.safe` is `true`, the prime will be a safe prime -- that is, `(prime - 1) / 2` will also be a prime.
      *
      * The `options.add` and `options.rem` parameters can be used to enforce additional
      * requirements, e.g., for Diffie-Hellman:
@@ -3831,7 +4487,7 @@ declare module "crypto" {
      * * `options.rem` is ignored if `options.add` is not given.
      *
      * Both `options.add` and `options.rem` must be encoded as big-endian sequences
-     * if given as an `ArrayBuffer`, `SharedArrayBuffer`, `TypedArray`, `Buffer`, or`DataView`.
+     * if given as an `ArrayBuffer`, `SharedArrayBuffer`, `TypedArray`, `Buffer`, or `DataView`.
      *
      * By default, the prime is encoded as a big-endian sequence of octets
      * in an [ArrayBuffer](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer). If the `bigint` option is `true`, then a
@@ -3877,7 +4533,7 @@ declare module "crypto" {
      *
      * `engine` could be either an id or a path to the engine's shared library.
      *
-     * The optional `flags` argument uses `ENGINE_METHOD_ALL` by default. The `flags`is a bit field taking one of or a mix of the following flags (defined in`crypto.constants`):
+     * The optional `flags` argument uses `ENGINE_METHOD_ALL` by default. The `flags` is a bit field taking one of or a mix of the following flags (defined in `crypto.constants`):
      *
      * * `crypto.constants.ENGINE_METHOD_RSA`
      * * `crypto.constants.ENGINE_METHOD_DSA`
@@ -3902,6 +4558,130 @@ declare module "crypto" {
      * @return Returns `typedArray`.
      */
     function getRandomValues<T extends webcrypto.BufferSource>(typedArray: T): T;
+    type Argon2Algorithm = "argon2d" | "argon2i" | "argon2id";
+    interface Argon2Parameters {
+        /**
+         * REQUIRED, this is the password for password hashing applications of Argon2.
+         */
+        message: string | ArrayBuffer | NodeJS.ArrayBufferView;
+        /**
+         * REQUIRED, must be at least 8 bytes long. This is the salt for password hashing applications of Argon2.
+         */
+        nonce: string | ArrayBuffer | NodeJS.ArrayBufferView;
+        /**
+         * REQUIRED, degree of parallelism determines how many computational chains (lanes)
+         * can be run. Must be greater than 1 and less than `2**24-1`.
+         */
+        parallelism: number;
+        /**
+         * REQUIRED, the length of the key to generate. Must be greater than 4 and
+         * less than `2**32-1`.
+         */
+        tagLength: number;
+        /**
+         * REQUIRED, memory cost in 1KiB blocks. Must be greater than
+         * `8 * parallelism` and less than `2**32-1`. The actual number of blocks is rounded
+         * down to the nearest multiple of `4 * parallelism`.
+         */
+        memory: number;
+        /**
+         * REQUIRED, number of passes (iterations). Must be greater than 1 and less
+         * than `2**32-1`.
+         */
+        passes: number;
+        /**
+         * OPTIONAL, Random additional input,
+         * similar to the salt, that should **NOT** be stored with the derived key. This is known as pepper in
+         * password hashing applications. If used, must have a length not greater than `2**32-1` bytes.
+         */
+        secret?: string | ArrayBuffer | NodeJS.ArrayBufferView | undefined;
+        /**
+         * OPTIONAL, Additional data to
+         * be added to the hash, functionally equivalent to salt or secret, but meant for
+         * non-random data. If used, must have a length not greater than `2**32-1` bytes.
+         */
+        associatedData?: string | ArrayBuffer | NodeJS.ArrayBufferView | undefined;
+    }
+    /**
+     * Provides an asynchronous [Argon2](https://www.rfc-editor.org/rfc/rfc9106.html) implementation. Argon2 is a password-based
+     * key derivation function that is designed to be expensive computationally and
+     * memory-wise in order to make brute-force attacks unrewarding.
+     *
+     * The `nonce` should be as unique as possible. It is recommended that a nonce is
+     * random and at least 16 bytes long. See [NIST SP 800-132](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf) for details.
+     *
+     * When passing strings for `message`, `nonce`, `secret` or `associatedData`, please
+     * consider [caveats when using strings as inputs to cryptographic APIs](https://nodejs.org/docs/latest-v24.x/api/crypto.html#using-strings-as-inputs-to-cryptographic-apis).
+     *
+     * The `callback` function is called with two arguments: `err` and `derivedKey`.
+     * `err` is an exception object when key derivation fails, otherwise `err` is
+     * `null`. `derivedKey` is passed to the callback as a `Buffer`.
+     *
+     * An exception is thrown when any of the input arguments specify invalid values
+     * or types.
+     *
+     * ```js
+     * const { argon2, randomBytes } = await import('node:crypto');
+     *
+     * const parameters = {
+     *   message: 'password',
+     *   nonce: randomBytes(16),
+     *   parallelism: 4,
+     *   tagLength: 64,
+     *   memory: 65536,
+     *   passes: 3,
+     * };
+     *
+     * argon2('argon2id', parameters, (err, derivedKey) => {
+     *   if (err) throw err;
+     *   console.log(derivedKey.toString('hex'));  // 'af91dad...9520f15'
+     * });
+     * ```
+     * @since v24.7.0
+     * @param algorithm Variant of Argon2, one of `"argon2d"`, `"argon2i"` or `"argon2id"`.
+     * @experimental
+     */
+    function argon2(
+        algorithm: Argon2Algorithm,
+        parameters: Argon2Parameters,
+        callback: (err: Error | null, derivedKey: NonSharedBuffer) => void,
+    ): void;
+    /**
+     * Provides a synchronous [Argon2][] implementation. Argon2 is a password-based
+     * key derivation function that is designed to be expensive computationally and
+     * memory-wise in order to make brute-force attacks unrewarding.
+     *
+     * The `nonce` should be as unique as possible. It is recommended that a nonce is
+     * random and at least 16 bytes long. See [NIST SP 800-132](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf) for details.
+     *
+     * When passing strings for `message`, `nonce`, `secret` or `associatedData`, please
+     * consider [caveats when using strings as inputs to cryptographic APIs](https://nodejs.org/docs/latest-v24.x/api/crypto.html#using-strings-as-inputs-to-cryptographic-apis).
+     *
+     * An exception is thrown when key derivation fails, otherwise the derived key is
+     * returned as a `Buffer`.
+     *
+     * An exception is thrown when any of the input arguments specify invalid values
+     * or types.
+     *
+     * ```js
+     * const { argon2Sync, randomBytes } = await import('node:crypto');
+     *
+     * const parameters = {
+     *   message: 'password',
+     *   nonce: randomBytes(16),
+     *   parallelism: 4,
+     *   tagLength: 64,
+     *   memory: 65536,
+     *   passes: 3,
+     * };
+     *
+     * const derivedKey = argon2Sync('argon2id', parameters);
+     * console.log(derivedKey.toString('hex'));  // 'af91dad...9520f15'
+     * ```
+     * @since v24.7.0
+     * @experimental
+     */
+    function argon2Sync(algorithm: Argon2Algorithm, parameters: Argon2Parameters): NonSharedBuffer;
     /**
      * A convenient alias for `crypto.webcrypto.subtle`.
      * @since v17.4.0
@@ -3916,21 +4696,30 @@ declare module "crypto" {
     const webcrypto: webcrypto.Crypto;
     namespace webcrypto {
         type BufferSource = ArrayBufferView | ArrayBuffer;
-        type KeyFormat = "jwk" | "pkcs8" | "raw" | "spki";
+        type KeyFormat = "jwk" | "pkcs8" | "raw" | "raw-public" | "raw-secret" | "raw-seed" | "spki";
         type KeyType = "private" | "public" | "secret";
         type KeyUsage =
-            | "decrypt"
-            | "deriveBits"
-            | "deriveKey"
             | "encrypt"
+            | "decrypt"
             | "sign"
-            | "unwrapKey"
             | "verify"
-            | "wrapKey";
+            | "deriveKey"
+            | "deriveBits"
+            | "encapsulateBits"
+            | "decapsulateBits"
+            | "encapsulateKey"
+            | "decapsulateKey"
+            | "wrapKey"
+            | "unwrapKey";
         type AlgorithmIdentifier = Algorithm | string;
         type HashAlgorithmIdentifier = AlgorithmIdentifier;
         type NamedCurve = string;
         type BigInteger = Uint8Array;
+        interface AeadParams extends Algorithm {
+            additionalData?: BufferSource;
+            iv: BufferSource;
+            tagLength: number;
+        }
         interface AesCbcParams extends Algorithm {
             iv: BufferSource;
         }
@@ -3941,6 +4730,8 @@ declare module "crypto" {
         interface AesDerivedKeyParams extends Algorithm {
             length: number;
         }
+        // TODO: remove in next major
+        /** @deprecated Replaced by `AeadParams`. */
         interface AesGcmParams extends Algorithm {
             additionalData?: BufferSource;
             iv: BufferSource;
@@ -3955,6 +4746,23 @@ declare module "crypto" {
         interface Algorithm {
             name: string;
         }
+        interface Argon2Params extends Algorithm {
+            associatedData?: BufferSource;
+            memory: number;
+            nonce: BufferSource;
+            parallelism: number;
+            passes: number;
+            secretValue?: BufferSource;
+            version?: number;
+        }
+        interface CShakeParams extends Algorithm {
+            customization?: BufferSource;
+            functionName?: BufferSource;
+            length: number;
+        }
+        interface ContextParams extends Algorithm {
+            context?: BufferSource;
+        }
         interface EcKeyAlgorithm extends KeyAlgorithm {
             namedCurve: NamedCurve;
         }
@@ -3970,9 +4778,6 @@ declare module "crypto" {
         interface EcdsaParams extends Algorithm {
             hash: HashAlgorithmIdentifier;
         }
-        interface Ed448Params extends Algorithm {
-            context?: BufferSource;
-        }
         interface HkdfParams extends Algorithm {
             hash: HashAlgorithmIdentifier;
             info: BufferSource;
@@ -4013,6 +4818,19 @@ declare module "crypto" {
         interface KeyAlgorithm {
             name: string;
         }
+        interface KmacImportParams extends Algorithm {
+            length?: number;
+        }
+        interface KmacKeyAlgorithm extends KeyAlgorithm {
+            length: number;
+        }
+        interface KmacKeyGenParams extends Algorithm {
+            length?: number;
+        }
+        interface KmacParams extends Algorithm {
+            customization?: BufferSource;
+            length: number;
+        }
         interface Pbkdf2Params extends Algorithm {
             hash: HashAlgorithmIdentifier;
             iterations: number;
@@ -4047,7 +4865,7 @@ declare module "crypto" {
             saltLength: number;
         }
         /**
-         * Calling `require('node:crypto').webcrypto` returns an instance of the `Crypto` class.
+         * Importing the `webcrypto` object (`import { webcrypto } from 'node:crypto'`) gives an instance of the `Crypto` class.
          * `Crypto` is a singleton that provides access to the remainder of the crypto API.
          * @since v15.0.0
          */
@@ -4066,22 +4884,15 @@ declare module "crypto" {
              * An error will be thrown if the given `typedArray` is larger than 65,536 bytes.
              * @since v15.0.0
              */
-            getRandomValues<T extends Exclude<NodeJS.TypedArray, Float32Array | Float64Array>>(typedArray: T): T;
+            getRandomValues<T extends Exclude<NodeJS.TypedArray, Float16Array | Float32Array | Float64Array>>(
+                typedArray: T,
+            ): T;
             /**
              * Generates a random {@link https://www.rfc-editor.org/rfc/rfc4122.txt RFC 4122} version 4 UUID.
              * The UUID is generated using a cryptographic pseudorandom number generator.
              * @since v16.7.0
              */
             randomUUID(): UUID;
-            CryptoKey: CryptoKeyConstructor;
-        }
-        // This constructor throws ILLEGAL_CONSTRUCTOR so it should not be newable.
-        interface CryptoKeyConstructor {
-            /** Illegal constructor */
-            (_: { readonly _: unique symbol }): never; // Allows instanceof to work but not be callable by the user.
-            readonly length: 0;
-            readonly name: "CryptoKey";
-            readonly prototype: CryptoKey;
         }
         /**
          * @since v15.0.0
@@ -4136,31 +4947,81 @@ declare module "crypto" {
              */
             publicKey: CryptoKey;
         }
+        interface EncapsulatedBits {
+            sharedKey: ArrayBuffer;
+            ciphertext: ArrayBuffer;
+        }
+        interface EncapsulatedKey {
+            sharedKey: CryptoKey;
+            ciphertext: ArrayBuffer;
+        }
         /**
          * @since v15.0.0
          */
         interface SubtleCrypto {
+            /**
+             * A message recipient uses their asymmetric private key to decrypt an
+             * "encapsulated key" (ciphertext), thereby recovering a temporary symmetric
+             * key (represented as `ArrayBuffer`) which is then used to decrypt a message.
+             *
+             * The algorithms currently supported include:
+             *
+             * * `'ML-KEM-512'`
+             * * `'ML-KEM-768'`
+             * * `'ML-KEM-1024'`
+             * @since v24.7.0
+             * @returns Fulfills with `ArrayBuffer` upon success.
+             */
+            decapsulateBits(
+                decapsulationAlgorithm: AlgorithmIdentifier,
+                decapsulationKey: CryptoKey,
+                ciphertext: BufferSource,
+            ): Promise<ArrayBuffer>;
+            /**
+             * A message recipient uses their asymmetric private key to decrypt an
+             * "encapsulated key" (ciphertext), thereby recovering a temporary symmetric
+             * key (represented as `CryptoKey`) which is then used to decrypt a message.
+             *
+             * The algorithms currently supported include:
+             *
+             * * `'ML-KEM-512'`
+             * * `'ML-KEM-768'`
+             * * `'ML-KEM-1024'`
+             * @since v24.7.0
+             * @param usages See [Key usages](https://nodejs.org/docs/latest-v24.x/api/webcrypto.html#cryptokeyusages).
+             * @returns Fulfills with `CryptoKey` upon success.
+             */
+            decapsulateKey(
+                decapsulationAlgorithm: AlgorithmIdentifier,
+                decapsulationKey: CryptoKey,
+                ciphertext: BufferSource,
+                sharedKeyAlgorithm: AlgorithmIdentifier | HmacImportParams | AesDerivedKeyParams | KmacImportParams,
+                extractable: boolean,
+                usages: KeyUsage[],
+            ): Promise<CryptoKey>;
             /**
              * Using the method and parameters specified in `algorithm` and the keying material provided by `key`,
-             * `subtle.decrypt()` attempts to decipher the provided `data`. If successful,
+             * this method attempts to decipher the provided `data`. If successful,
              * the returned promise will be resolved with an `<ArrayBuffer>` containing the plaintext result.
              *
              * The algorithms currently supported include:
              *
-             * - `'RSA-OAEP'`
-             * - `'AES-CTR'`
-             * - `'AES-CBC'`
-             * - `'AES-GCM'`
+             * * `'AES-CBC'`
+             * * `'AES-CTR'`
+             * * `'AES-GCM'`
+             * * `'AES-OCB'`
+             * * `'ChaCha20-Poly1305'`
+             * * `'RSA-OAEP'`
              * @since v15.0.0
              */
             decrypt(
-                algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams,
+                algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,
                 key: CryptoKey,
                 data: BufferSource,
             ): Promise<ArrayBuffer>;
             /**
              * Using the method and parameters specified in `algorithm` and the keying material provided by `baseKey`,
-             * `subtle.deriveBits()` attempts to generate `length` bits.
+             * this method attempts to generate `length` bits.
              * The Node.js implementation requires that when `length` is a number it must be multiple of `8`.
              * When `length` is `null` the maximum number of bits for a given algorithm is generated. This is allowed
              * for the `'ECDH'`, `'X25519'`, and `'X448'` algorithms.
@@ -4168,45 +5029,50 @@ declare module "crypto" {
              *
              * The algorithms currently supported include:
              *
-             * - `'ECDH'`
-             * - `'X25519'`
-             * - `'X448'`
-             * - `'HKDF'`
-             * - `'PBKDF2'`
+             * * `'Argon2d'`
+             * * `'Argon2i'`
+             * * `'Argon2id'`
+             * * `'ECDH'`
+             * * `'HKDF'`
+             * * `'PBKDF2'`
+             * * `'X25519'`
+             * * `'X448'`
              * @since v15.0.0
              */
-            deriveBits(algorithm: EcdhKeyDeriveParams, baseKey: CryptoKey, length: number | null): Promise<ArrayBuffer>;
             deriveBits(
-                algorithm: AlgorithmIdentifier | HkdfParams | Pbkdf2Params,
+                algorithm: EcdhKeyDeriveParams,
+                baseKey: CryptoKey,
+                length?: number | null,
+            ): Promise<ArrayBuffer>;
+            deriveBits(
+                algorithm: EcdhKeyDeriveParams | HkdfParams | Pbkdf2Params | Argon2Params,
                 baseKey: CryptoKey,
                 length: number,
             ): Promise<ArrayBuffer>;
             /**
              * Using the method and parameters specified in `algorithm`, and the keying material provided by `baseKey`,
-             * `subtle.deriveKey()` attempts to generate a new <CryptoKey>` based on the method and parameters in `derivedKeyAlgorithm`.
+             * this method attempts to generate a new <CryptoKey>` based on the method and parameters in `derivedKeyAlgorithm`.
              *
              * Calling `subtle.deriveKey()` is equivalent to calling `subtle.deriveBits()` to generate raw keying material,
              * then passing the result into the `subtle.importKey()` method using the `deriveKeyAlgorithm`, `extractable`, and `keyUsages` parameters as input.
              *
              * The algorithms currently supported include:
              *
-             * - `'ECDH'`
-             * - `'X25519'`
-             * - `'X448'`
-             * - `'HKDF'`
-             * - `'PBKDF2'`
+             * * `'Argon2d'`
+             * * `'Argon2i'`
+             * * `'Argon2id'`
+             * * `'ECDH'`
+             * * `'HKDF'`
+             * * `'PBKDF2'`
+             * * `'X25519'`
+             * * `'X448'`
              * @param keyUsages See {@link https://nodejs.org/docs/latest/api/webcrypto.html#cryptokeyusages Key usages}.
              * @since v15.0.0
              */
             deriveKey(
-                algorithm: AlgorithmIdentifier | EcdhKeyDeriveParams | HkdfParams | Pbkdf2Params,
+                algorithm: EcdhKeyDeriveParams | HkdfParams | Pbkdf2Params | Argon2Params,
                 baseKey: CryptoKey,
-                derivedKeyAlgorithm:
-                    | AlgorithmIdentifier
-                    | AesDerivedKeyParams
-                    | HmacImportParams
-                    | HkdfParams
-                    | Pbkdf2Params,
+                derivedKeyAlgorithm: AlgorithmIdentifier | HmacImportParams | AesDerivedKeyParams | KmacImportParams,
                 extractable: boolean,
                 keyUsages: readonly KeyUsage[],
             ): Promise<CryptoKey>;
@@ -4216,30 +5082,73 @@ declare module "crypto" {
              *
              * If `algorithm` is provided as a `<string>`, it must be one of:
              *
-             * - `'SHA-1'`
-             * - `'SHA-256'`
-             * - `'SHA-384'`
-             * - `'SHA-512'`
+             * * `'cSHAKE128'`
+             * * `'cSHAKE256'`
+             * * `'SHA-1'`
+             * * `'SHA-256'`
+             * * `'SHA-384'`
+             * * `'SHA-512'`
+             * * `'SHA3-256'`
+             * * `'SHA3-384'`
+             * * `'SHA3-512'`
              *
              * If `algorithm` is provided as an `<Object>`, it must have a `name` property whose value is one of the above.
              * @since v15.0.0
              */
-            digest(algorithm: AlgorithmIdentifier, data: BufferSource): Promise<ArrayBuffer>;
+            digest(algorithm: AlgorithmIdentifier | CShakeParams, data: BufferSource): Promise<ArrayBuffer>;
+            /**
+             * Uses a message recipient's asymmetric public key to encrypt a temporary symmetric key.
+             * This encrypted key is the "encapsulated key" represented as `EncapsulatedBits`.
+             *
+             * The algorithms currently supported include:
+             *
+             * * `'ML-KEM-512'`
+             * * `'ML-KEM-768'`
+             * * `'ML-KEM-1024'`
+             * @since v24.7.0
+             * @returns Fulfills with `EncapsulatedBits` upon success.
+             */
+            encapsulateBits(
+                encapsulationAlgorithm: AlgorithmIdentifier,
+                encapsulationKey: CryptoKey,
+            ): Promise<EncapsulatedBits>;
+            /**
+             * Uses a message recipient's asymmetric public key to encrypt a temporary symmetric key.
+             * This encrypted key is the "encapsulated key" represented as `EncapsulatedKey`.
+             *
+             * The algorithms currently supported include:
+             *
+             * * `'ML-KEM-512'`
+             * * `'ML-KEM-768'`
+             * * `'ML-KEM-1024'`
+             * @since v24.7.0
+             * @param usages See [Key usages](https://nodejs.org/docs/latest-v24.x/api/webcrypto.html#cryptokeyusages).
+             * @returns Fulfills with `EncapsulatedKey` upon success.
+             */
+            encapsulateKey(
+                encapsulationAlgorithm: AlgorithmIdentifier,
+                encapsulationKey: CryptoKey,
+                sharedKeyAlgorithm: AlgorithmIdentifier | HmacImportParams | AesDerivedKeyParams | KmacImportParams,
+                extractable: boolean,
+                usages: KeyUsage[],
+            ): Promise<EncapsulatedKey>;
             /**
              * Using the method and parameters specified by `algorithm` and the keying material provided by `key`,
-             * `subtle.encrypt()` attempts to encipher `data`. If successful,
+             * this method attempts to encipher `data`. If successful,
              * the returned promise is resolved with an `<ArrayBuffer>` containing the encrypted result.
              *
              * The algorithms currently supported include:
              *
-             * - `'RSA-OAEP'`
-             * - `'AES-CTR'`
-             * - `'AES-CBC'`
-             * - `'AES-GCM'`
+             * * `'AES-CBC'`
+             * * `'AES-CTR'`
+             * * `'AES-GCM'`
+             * * `'AES-OCB'`
+             * * `'ChaCha20-Poly1305'`
+             * * `'RSA-OAEP'`
              * @since v15.0.0
              */
             encrypt(
-                algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams,
+                algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,
                 key: CryptoKey,
                 data: BufferSource,
             ): Promise<ArrayBuffer>;
@@ -4253,35 +5162,47 @@ declare module "crypto" {
              *
              * When `format` is `'jwk'` and the export is successful, the returned promise will be resolved with a
              * JavaScript object conforming to the {@link https://tools.ietf.org/html/rfc7517 JSON Web Key} specification.
-             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, or `'jwk'`.
+             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, `'jwk'`, `'raw-secret'`,
+             * `'raw-public'`, or `'raw-seed'`.
              * @returns `<Promise>` containing `<ArrayBuffer>`.
              * @since v15.0.0
              */
             exportKey(format: "jwk", key: CryptoKey): Promise<JsonWebKey>;
             exportKey(format: Exclude<KeyFormat, "jwk">, key: CryptoKey): Promise<ArrayBuffer>;
             /**
-             * Using the method and parameters provided in `algorithm`,
-             * `subtle.generateKey()` attempts to generate new keying material.
-             * Depending the method used, the method may generate either a single `<CryptoKey>` or a `<CryptoKeyPair>`.
+             * Using the parameters provided in `algorithm`, this method
+             * attempts to generate new keying material. Depending on the algorithm used
+             * either a single `CryptoKey` or a `CryptoKeyPair` is generated.
              *
-             * The `<CryptoKeyPair>` (public and private key) generating algorithms supported include:
+             * The `CryptoKeyPair` (public and private key) generating algorithms supported
+             * include:
              *
-             * - `'RSASSA-PKCS1-v1_5'`
-             * - `'RSA-PSS'`
-             * - `'RSA-OAEP'`
-             * - `'ECDSA'`
-             * - `'Ed25519'`
-             * - `'Ed448'`
-             * - `'ECDH'`
-             * - `'X25519'`
-             * - `'X448'`
-             * The `<CryptoKey>` (secret key) generating algorithms supported include:
+             * * `'ECDH'`
+             * * `'ECDSA'`
+             * * `'Ed25519'`
+             * * `'Ed448'`
+             * * `'ML-DSA-44'`
+             * * `'ML-DSA-65'`
+             * * `'ML-DSA-87'`
+             * * `'ML-KEM-512'`
+             * * `'ML-KEM-768'`
+             * * `'ML-KEM-1024'`
+             * * `'RSA-OAEP'`
+             * * `'RSA-PSS'`
+             * * `'RSASSA-PKCS1-v1_5'`
+             * * `'X25519'`
+             * * `'X448'`
              *
-             * - `'HMAC'`
-             * - `'AES-CTR'`
-             * - `'AES-CBC'`
-             * - `'AES-GCM'`
-             * - `'AES-KW'`
+             * The `CryptoKey` (secret key) generating algorithms supported include:
+             * * `'AES-CBC'`
+             * * `'AES-CTR'`
+             * * `'AES-GCM'`
+             * * `'AES-KW'`
+             * * `'AES-OCB'`
+             * * `'ChaCha20-Poly1305'`
+             * * `'HMAC'`
+             * * `'KMAC128'`
+             * * `'KMAC256'`
              * @param keyUsages See {@link https://nodejs.org/docs/latest/api/webcrypto.html#cryptokeyusages Key usages}.
              * @since v15.0.0
              */
@@ -4291,7 +5212,7 @@ declare module "crypto" {
                 keyUsages: readonly KeyUsage[],
             ): Promise<CryptoKeyPair>;
             generateKey(
-                algorithm: AesKeyGenParams | HmacKeyGenParams | Pbkdf2Params,
+                algorithm: AesKeyGenParams | HmacKeyGenParams | Pbkdf2Params | KmacKeyGenParams,
                 extractable: boolean,
                 keyUsages: readonly KeyUsage[],
             ): Promise<CryptoKey>;
@@ -4301,12 +5222,23 @@ declare module "crypto" {
                 keyUsages: KeyUsage[],
             ): Promise<CryptoKeyPair | CryptoKey>;
             /**
-             * The `subtle.importKey()` method attempts to interpret the provided `keyData` as the given `format`
-             * to create a `<CryptoKey>` instance using the provided `algorithm`, `extractable`, and `keyUsages` arguments.
-             * If the import is successful, the returned promise will be resolved with the created `<CryptoKey>`.
+             * Derives the public key from a given private key.
+             * @since v24.7.0
+             * @param key A private key from which to derive the corresponding public key.
+             * @param keyUsages See [Key usages](https://nodejs.org/docs/latest-v24.x/api/webcrypto.html#cryptokeyusages).
+             * @returns Fulfills with a `CryptoKey` upon success.
+             */
+            getPublicKey(key: CryptoKey, keyUsages: KeyUsage[]): Promise<CryptoKey>;
+            /**
+             * This method attempts to interpret the provided `keyData`
+             * as the given `format` to create a `CryptoKey` instance using the provided
+             * `algorithm`, `extractable`, and `keyUsages` arguments. If the import is
+             * successful, the returned promise will be resolved with a {CryptoKey}
+             * representation of the key material.
              *
-             * If importing a `'PBKDF2'` key, `extractable` must be `false`.
-             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, or `'jwk'`.
+             * If importing KDF algorithm keys, `extractable` must be `false`.
+             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, `'jwk'`, `'raw-secret'`,
+             * `'raw-public'`, or `'raw-seed'`.
              * @param keyUsages See {@link https://nodejs.org/docs/latest/api/webcrypto.html#cryptokeyusages Key usages}.
              * @since v15.0.0
              */
@@ -4318,7 +5250,8 @@ declare module "crypto" {
                     | RsaHashedImportParams
                     | EcKeyImportParams
                     | HmacImportParams
-                    | AesKeyAlgorithm,
+                    | AesKeyAlgorithm
+                    | KmacImportParams,
                 extractable: boolean,
                 keyUsages: readonly KeyUsage[],
             ): Promise<CryptoKey>;
@@ -4330,62 +5263,81 @@ declare module "crypto" {
                     | RsaHashedImportParams
                     | EcKeyImportParams
                     | HmacImportParams
-                    | AesKeyAlgorithm,
+                    | AesKeyAlgorithm
+                    | KmacImportParams,
                 extractable: boolean,
                 keyUsages: KeyUsage[],
             ): Promise<CryptoKey>;
             /**
              * Using the method and parameters given by `algorithm` and the keying material provided by `key`,
-             * `subtle.sign()` attempts to generate a cryptographic signature of `data`. If successful,
+             * this method attempts to generate a cryptographic signature of `data`. If successful,
              * the returned promise is resolved with an `<ArrayBuffer>` containing the generated signature.
              *
              * The algorithms currently supported include:
              *
-             * - `'RSASSA-PKCS1-v1_5'`
-             * - `'RSA-PSS'`
-             * - `'ECDSA'`
-             * - `'Ed25519'`
-             * - `'Ed448'`
-             * - `'HMAC'`
+             * * `'ECDSA'`
+             * * `'Ed25519'`
+             * * `'Ed448'`
+             * * `'HMAC'`
+             * * `'KMAC128'`
+             * * `'KMAC256'`
+             * * `'ML-DSA-44'`
+             * * `'ML-DSA-65'`
+             * * `'ML-DSA-87'`
+             * * `'RSA-PSS'`
+             * * `'RSASSA-PKCS1-v1_5'`
              * @since v15.0.0
              */
             sign(
-                algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams | Ed448Params,
+                algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams | ContextParams | KmacParams,
                 key: CryptoKey,
                 data: BufferSource,
             ): Promise<ArrayBuffer>;
             /**
              * In cryptography, "wrapping a key" refers to exporting and then encrypting the keying material.
-             * The `subtle.unwrapKey()` method attempts to decrypt a wrapped key and create a `<CryptoKey>` instance.
+             * This method attempts to decrypt a wrapped key and create a `<CryptoKey>` instance.
              * It is equivalent to calling `subtle.decrypt()` first on the encrypted key data (using the `wrappedKey`, `unwrapAlgo`, and `unwrappingKey` arguments as input)
              * then passing the results in to the `subtle.importKey()` method using the `unwrappedKeyAlgo`, `extractable`, and `keyUsages` arguments as inputs.
              * If successful, the returned promise is resolved with a `<CryptoKey>` object.
              *
              * The wrapping algorithms currently supported include:
              *
-             * - `'RSA-OAEP'`
-             * - `'AES-CTR'`
-             * - `'AES-CBC'`
-             * - `'AES-GCM'`
-             * - `'AES-KW'`
+             * * `'AES-CBC'`
+             * * `'AES-CTR'`
+             * * `'AES-GCM'`
+             * * `'AES-KW'`
+             * * `'AES-OCB'`
+             * * `'ChaCha20-Poly1305'`
+             * * `'RSA-OAEP'`
              *
              * The unwrapped key algorithms supported include:
              *
-             * - `'RSASSA-PKCS1-v1_5'`
-             * - `'RSA-PSS'`
-             * - `'RSA-OAEP'`
-             * - `'ECDSA'`
-             * - `'Ed25519'`
-             * - `'Ed448'`
-             * - `'ECDH'`
-             * - `'X25519'`
-             * - `'X448'`
-             * - `'HMAC'`
-             * - `'AES-CTR'`
-             * - `'AES-CBC'`
-             * - `'AES-GCM'`
-             * - `'AES-KW'`
-             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, or `'jwk'`.
+             * * `'AES-CBC'`
+             * * `'AES-CTR'`
+             * * `'AES-GCM'`
+             * * `'AES-KW'`
+             * * `'AES-OCB'`
+             * * `'ChaCha20-Poly1305'`
+             * * `'ECDH'`
+             * * `'ECDSA'`
+             * * `'Ed25519'`
+             * * `'Ed448'`
+             * * `'HMAC'`
+             * * `'KMAC128'`
+             * * `'KMAC256'`
+             * * `'ML-DSA-44'`
+             * * `'ML-DSA-65'`
+             * * `'ML-DSA-87'`
+             * * `'ML-KEM-512'`
+             * * `'ML-KEM-768'`
+             * * `'ML-KEM-1024'`
+             * * `'RSA-OAEP'`
+             * * `'RSA-PSS'`
+             * * `'RSASSA-PKCS1-v1_5'`
+             * * `'X25519'`
+             * * `'X448'`
+             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, `'jwk'`, `'raw-secret'`,
+             * `'raw-public'`, or `'raw-seed'`.
              * @param keyUsages See {@link https://nodejs.org/docs/latest/api/webcrypto.html#cryptokeyusages Key usages}.
              * @since v15.0.0
              */
@@ -4393,40 +5345,46 @@ declare module "crypto" {
                 format: KeyFormat,
                 wrappedKey: BufferSource,
                 unwrappingKey: CryptoKey,
-                unwrapAlgorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams,
+                unwrapAlgorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,
                 unwrappedKeyAlgorithm:
                     | AlgorithmIdentifier
                     | RsaHashedImportParams
                     | EcKeyImportParams
                     | HmacImportParams
-                    | AesKeyAlgorithm,
+                    | AesKeyAlgorithm
+                    | KmacImportParams,
                 extractable: boolean,
                 keyUsages: KeyUsage[],
             ): Promise<CryptoKey>;
             /**
              * Using the method and parameters given in `algorithm` and the keying material provided by `key`,
-             * `subtle.verify()` attempts to verify that `signature` is a valid cryptographic signature of `data`.
+             * This method attempts to verify that `signature` is a valid cryptographic signature of `data`.
              * The returned promise is resolved with either `true` or `false`.
              *
              * The algorithms currently supported include:
              *
-             * - `'RSASSA-PKCS1-v1_5'`
-             * - `'RSA-PSS'`
-             * - `'ECDSA'`
-             * - `'Ed25519'`
-             * - `'Ed448'`
-             * - `'HMAC'`
+             * * `'ECDSA'`
+             * * `'Ed25519'`
+             * * `'Ed448'`
+             * * `'HMAC'`
+             * * `'KMAC128'`
+             * * `'KMAC256'`
+             * * `'ML-DSA-44'`
+             * * `'ML-DSA-65'`
+             * * `'ML-DSA-87'`
+             * * `'RSA-PSS'`
+             * * `'RSASSA-PKCS1-v1_5'`
              * @since v15.0.0
              */
             verify(
-                algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams | Ed448Params,
+                algorithm: AlgorithmIdentifier | RsaPssParams | EcdsaParams | ContextParams | KmacParams,
                 key: CryptoKey,
                 signature: BufferSource,
                 data: BufferSource,
             ): Promise<boolean>;
             /**
              * In cryptography, "wrapping a key" refers to exporting and then encrypting the keying material.
-             * The `subtle.wrapKey()` method exports the keying material into the format identified by `format`,
+             * This method exports the keying material into the format identified by `format`,
              * then encrypts it using the method and parameters specified by `wrapAlgo` and the keying material provided by `wrappingKey`.
              * It is the equivalent to calling `subtle.exportKey()` using `format` and `key` as the arguments,
              * then passing the result to the `subtle.encrypt()` method using `wrappingKey` and `wrapAlgo` as inputs.
@@ -4434,19 +5392,22 @@ declare module "crypto" {
              *
              * The wrapping algorithms currently supported include:
              *
-             * - `'RSA-OAEP'`
-             * - `'AES-CTR'`
-             * - `'AES-CBC'`
-             * - `'AES-GCM'`
-             * - `'AES-KW'`
-             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, or `'jwk'`.
+             * * `'AES-CBC'`
+             * * `'AES-CTR'`
+             * * `'AES-GCM'`
+             * * `'AES-KW'`
+             * * `'AES-OCB'`
+             * * `'ChaCha20-Poly1305'`
+             * * `'RSA-OAEP'`
+             * @param format Must be one of `'raw'`, `'pkcs8'`, `'spki'`, `'jwk'`, `'raw-secret'`,
+             * `'raw-public'`, or `'raw-seed'`.
              * @since v15.0.0
              */
             wrapKey(
                 format: KeyFormat,
                 key: CryptoKey,
                 wrappingKey: CryptoKey,
-                wrapAlgorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams,
+                wrapAlgorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,
             ): Promise<ArrayBuffer>;
         }
     }