type KeyInput$1 = any | Buffer | Uint8Array | string | Record<string, unknown>;

/**
 * @typedef {import('./internal/keys.js').KeyInput} KeyInput
 */
/**
 * @typedef {Object} DecryptOptions
 * @property {string[]} alg  Allowlist of accepted key-management algorithms
 *   (REQUIRED, non-empty). Omitting it raises {@link ErrorCode.MISSING_ALG_ALLOWLIST}.
 * @property {string[]} enc  Allowlist of accepted content-encryption
 *   algorithms (REQUIRED, non-empty).
 * @property {number} [maxTokenSize=8192]  Reject larger tokens with
 *   {@link ErrorCode.TOKEN_TOO_LARGE} before doing any crypto.
 * @property {string[]} [knownCriticalHeaders]  `crit` params this caller understands.
 * @property {number} [clockTolerance=0]  Seconds of leeway when enforcing `exp`.
 */
/**
 * @typedef {Object} DecryptResult
 * @property {Record<string, unknown>} protectedHeader
 * @property {unknown} payload  Parsed JSON when the plaintext is JSON, else the raw `Buffer`.
 */
/**
 * Decrypt a compact JWE.
 *
 * @param {string} token
 * @param {KeyInput} key  The recipient key — a private key / JWK for
 *   RSA-OAEP and ECDH-ES, symmetric key material for AES-KW and `dir`.
 * @param {DecryptOptions} options
 * @returns {Promise<DecryptResult>}
 */
declare function decrypt(token: string, key: KeyInput, options: DecryptOptions): Promise<DecryptResult>;
type KeyInput = KeyInput$1;
type DecryptOptions = {
    /**
     * Allowlist of accepted key-management algorithms
     * (REQUIRED, non-empty). Omitting it raises {@link ErrorCode.MISSING_ALG_ALLOWLIST}.
     */
    alg: string[];
    /**
     * Allowlist of accepted content-encryption
     * algorithms (REQUIRED, non-empty).
     */
    enc: string[];
    /**
     * Reject larger tokens with
     * {@link ErrorCode.TOKEN_TOO_LARGE} before doing any crypto.
     */
    maxTokenSize?: number | undefined;
    /**
     * `crit` params this caller understands.
     */
    knownCriticalHeaders?: string[] | undefined;
    /**
     * Seconds of leeway when enforcing `exp`.
     */
    clockTolerance?: number | undefined;
};
type DecryptResult = {
    protectedHeader: Record<string, unknown>;
    /**
     * Parsed JSON when the plaintext is JSON, else the raw `Buffer`.
     */
    payload: unknown;
};

export { decrypt };
export type { DecryptOptions, DecryptResult, KeyInput };