type KeyInput$4 = any | Buffer | Uint8Array | string | Record<string, unknown>;

/**
 * @typedef {import('./internal/keys.js').KeyInput} KeyInput
 */
/**
 * @typedef {Object} DecryptOptions
 * @property {string[]} alg  Allowlist of accepted key-management algorithms
 *   (REQUIRED, non-empty). Omitting it raises {@link ErrorCode.MISSING_ALG_ALLOWLIST}.
 * @property {string[]} enc  Allowlist of accepted content-encryption
 *   algorithms (REQUIRED, non-empty).
 * @property {number} [maxTokenSize=8192]  Reject larger tokens with
 *   {@link ErrorCode.TOKEN_TOO_LARGE} before doing any crypto.
 * @property {string[]} [knownCriticalHeaders]  `crit` params this caller understands.
 * @property {number} [clockTolerance=0]  Seconds of leeway when enforcing `exp`.
 */
/**
 * @typedef {Object} DecryptResult
 * @property {Record<string, unknown>} protectedHeader
 * @property {unknown} payload  Parsed JSON when the plaintext is JSON, else the raw `Buffer`.
 */
/**
 * Decrypt a compact JWE.
 *
 * @param {string} token
 * @param {KeyInput} key  The recipient key — a private key / JWK for
 *   RSA-OAEP and ECDH-ES, symmetric key material for AES-KW and `dir`.
 * @param {DecryptOptions} options
 * @returns {Promise<DecryptResult>}
 */
declare function decrypt(token: string, key: KeyInput$3, options: DecryptOptions$2): Promise<DecryptResult$2>;
type KeyInput$3 = KeyInput$4;
type DecryptOptions$2 = {
    /**
     * Allowlist of accepted key-management algorithms
     * (REQUIRED, non-empty). Omitting it raises {@link ErrorCode.MISSING_ALG_ALLOWLIST}.
     */
    alg: string[];
    /**
     * Allowlist of accepted content-encryption
     * algorithms (REQUIRED, non-empty).
     */
    enc: string[];
    /**
     * Reject larger tokens with
     * {@link ErrorCode.TOKEN_TOO_LARGE} before doing any crypto.
     */
    maxTokenSize?: number | undefined;
    /**
     * `crit` params this caller understands.
     */
    knownCriticalHeaders?: string[] | undefined;
    /**
     * Seconds of leeway when enforcing `exp`.
     */
    clockTolerance?: number | undefined;
};
type DecryptResult$2 = {
    protectedHeader: Record<string, unknown>;
    /**
     * Parsed JSON when the plaintext is JSON, else the raw `Buffer`.
     */
    payload: unknown;
};

/**
 * Encrypt into the General JWE JSON serialization.
 *
 * @param {unknown} payload
 * @param {JweRecipientInput[]} recipients
 * @param {EncryptJsonOptions} options
 * @returns {Promise<GeneralJwe>}
 */
declare function encryptJson(payload: unknown, recipients: JweRecipientInput[], options: EncryptJsonOptions): Promise<GeneralJwe$1>;
/**
 * @typedef {import('./decrypt.js').DecryptOptions} DecryptOptions
 */
/**
 * Decrypt a General or Flattened JWE JSON serialization.
 *
 * @param {GeneralJwe | Record<string, unknown>} jwe
 * @param {KeyInput} key
 * @param {DecryptOptions} options
 * @returns {Promise<DecryptResult>}
 */
declare function decryptJson(jwe: GeneralJwe$1 | Record<string, unknown>, key: KeyInput$2, options: DecryptOptions$1): Promise<DecryptResult$1>;
type KeyInput$2 = KeyInput$4;
type DecryptResult$1 = DecryptResult$2;
type JweRecipientInput = {
    key: KeyInput$2;
    /**
     * Key-management algorithm for this recipient.
     */
    alg: string;
    kid?: string | undefined;
    /**
     * Extra per-recipient header params.
     */
    header?: Record<string, unknown> | undefined;
    apu?: string | Buffer | Uint8Array;
    apv?: string | Buffer | Uint8Array;
};
type EncryptJsonOptions = {
    /**
     * Content-encryption algorithm (REQUIRED).
     */
    enc: string;
    /**
     * Extra protected-header params.
     */
    header?: Record<string, unknown> | undefined;
    /**
     * Optional JWE AAD, bound into the tag.
     */
    aad?: string | Buffer | Uint8Array;
    expiresIn?: string | number | undefined;
};
type GeneralJwe$1 = {
    protected: string;
    recipients: Array<{
        header?: Record<string, unknown>;
        encrypted_key: string;
    }>;
    iv: string;
    ciphertext: string;
    tag: string;
    aad?: string | undefined;
};
type DecryptOptions$1 = DecryptOptions$2;

/**
 * @typedef {Object} DecodedJwe
 * @property {Record<string, unknown>} header  Protected (JOSE) header.
 * @property {Buffer} encryptedKey  Wrapped CEK (empty for `dir` / `ECDH-ES`).
 * @property {Buffer} iv  Content-encryption Initialization Vector.
 * @property {Buffer} ciphertext  The AEAD ciphertext.
 * @property {Buffer} tag  The AEAD authentication tag.
 */
/**
 * Split and decode a compact JWE without decrypting it.
 *
 * @param {string} token
 * @returns {DecodedJwe}
 */
declare function decode(token: string): DecodedJwe$1;
/**
 * Return only the protected header. Handy for `alg` / `enc` / `kid`
 * extraction before calling `decrypt` with a resolver.
 *
 * @param {string} token
 * @returns {Record<string, unknown>}
 */
declare function decodeProtectedHeader(token: string): Record<string, unknown>;
type DecodedJwe$1 = {
    /**
     * Protected (JOSE) header.
     */
    header: Record<string, unknown>;
    /**
     * Wrapped CEK (empty for `dir` / `ECDH-ES`).
     */
    encryptedKey: Buffer;
    /**
     * Content-encryption Initialization Vector.
     */
    iv: Buffer;
    /**
     * The AEAD ciphertext.
     */
    ciphertext: Buffer;
    /**
     * The AEAD authentication tag.
     */
    tag: Buffer;
};

/**
 * @typedef {import('./internal/keys.js').KeyInput} KeyInput
 */
/**
 * @typedef {Object} EncryptOptions
 * @property {string} alg  Key-management algorithm (REQUIRED) — e.g.
 *   `'RSA-OAEP-256'`, `'ECDH-ES+A256KW'`, `'A256KW'`, `'dir'`.
 * @property {string} enc  Content-encryption algorithm (REQUIRED) — e.g.
 *   `'A256GCM'`, `'A128CBC-HS256'`.
 * @property {string} [kid]  Key ID written to the protected header.
 * @property {Record<string, unknown>} [header]  Extra protected-header
 *   params, merged first; `alg` / `enc` / `kid` and the key-management
 *   params (`epk` / `apu` / `apv`) always win over them.
 * @property {string | number} [expiresIn]  When the payload is a JSON
 *   object, stamp an `exp` claim this far in the future (duration string
 *   like `'1h'`, or milliseconds).
 * @property {string | Buffer | Uint8Array} [apu]  ECDH-ES Agreement
 *   PartyUInfo. Ignored by non-ECDH algorithms.
 * @property {string | Buffer | Uint8Array} [apv]  ECDH-ES Agreement PartyVInfo.
 */
/**
 * Encrypt a payload into a compact JWE string.
 *
 * @param {unknown} payload  A JSON-serialisable value, a string, or raw
 *   bytes (`Buffer` / `Uint8Array`).
 * @param {KeyInput} key  The recipient key — a public key / JWK for
 *   RSA-OAEP and ECDH-ES, symmetric key material for AES-KW and `dir`.
 * @param {EncryptOptions} options
 * @returns {Promise<string>}
 */
declare function encrypt(payload: unknown, key: KeyInput$1, options: EncryptOptions$1): Promise<string>;
type KeyInput$1 = KeyInput$4;
type EncryptOptions$1 = {
    /**
     * Key-management algorithm (REQUIRED) — e.g.
     * `'RSA-OAEP-256'`, `'ECDH-ES+A256KW'`, `'A256KW'`, `'dir'`.
     */
    alg: string;
    /**
     * Content-encryption algorithm (REQUIRED) — e.g.
     * `'A256GCM'`, `'A128CBC-HS256'`.
     */
    enc: string;
    /**
     * Key ID written to the protected header.
     */
    kid?: string | undefined;
    /**
     * Extra protected-header
     * params, merged first; `alg` / `enc` / `kid` and the key-management
     * params (`epk` / `apu` / `apv`) always win over them.
     */
    header?: Record<string, unknown> | undefined;
    /**
     * When the payload is a JSON
     * object, stamp an `exp` claim this far in the future (duration string
     * like `'1h'`, or milliseconds).
     */
    expiresIn?: string | number | undefined;
    /**
     * ECDH-ES Agreement
     * PartyUInfo. Ignored by non-ECDH algorithms.
     */
    apu?: string | Buffer | Uint8Array;
    /**
     * ECDH-ES Agreement PartyVInfo.
     */
    apv?: string | Buffer | Uint8Array;
};

/**
 * Shared base error class — the single error structure behind every
 * `@exortek/*` package's `errors.js`.
 *
 * Every package keeps its own class identity with a one-liner subclass;
 * codes stay per-package frozen maps, status mapping is declared as a
 * static field:
 *
 *   import { BaseError } from '@exortek/shared/errors';
 *
 *   export const ErrorCode = Object.freeze({
 *     INVALID_ARGUMENT: 'INVALID_ARGUMENT',
 *     INVALID_TOKEN: 'INVALID_TOKEN',
 *   });
 *
 *   export class JwtError extends BaseError {
 *     static statuses = { INVALID_ARGUMENT: 400, INVALID_TOKEN: 401 };
 *     static defaultStatus = 500;
 *   }
 *
 * Instances carry a stable machine-readable `code` (branch on this,
 * never on the message), an optional HTTP `status`, an optional
 * `details` object, and the standard `cause` chain.
 */
declare class BaseError extends Error {
    /**
     * Optional `code → HTTP status` map declared on the subclass. When
     * absent the instance carries no `status` at all — for HTTP-agnostic
     * packages like `@exortek/crypto`.
     *
     * @type {Record<string, number> | undefined}
     */
    static statuses: Record<string, number> | undefined;
    /**
     * Fallback status for codes missing from `statuses`.
     *
     * @type {number}
     */
    static defaultStatus: number;
    /**
     * @param {string} code    Stable machine-readable code; branch on this.
     * @param {string} message Human-readable diagnostic. Free-form; may
     *                         change across versions.
     * @param {{ cause?: unknown, status?: number, details?: Record<string, unknown> }} [options]
     */
    constructor(code: string, message: string, options?: {
        cause?: unknown;
        status?: number;
        details?: Record<string, unknown>;
    });
    /** @type {string} */
    code: string;
    /** @type {number | undefined} */
    status: number | undefined;
    /** @type {Record<string, unknown> | undefined} */
    details: Record<string, unknown> | undefined;
}

declare const ErrorCode: Readonly<{
    INVALID_ARGUMENT: "INVALID_ARGUMENT";
    INVALID_TOKEN: "INVALID_TOKEN";
    INVALID_HEADER: "INVALID_HEADER";
    INVALID_KEY: "INVALID_KEY";
    UNSUPPORTED_ALGORITHM: "UNSUPPORTED_ALGORITHM";
    UNSUPPORTED_ENCRYPTION: "UNSUPPORTED_ENCRYPTION";
    ALGORITHM_MISMATCH: "ALGORITHM_MISMATCH";
    ENCRYPTION_MISMATCH: "ENCRYPTION_MISMATCH";
    MISSING_ALG_ALLOWLIST: "MISSING_ALG_ALLOWLIST";
    MISSING_ENC_ALLOWLIST: "MISSING_ENC_ALLOWLIST";
    CRIT_UNSUPPORTED: "CRIT_UNSUPPORTED";
    DECRYPTION_FAILED: "DECRYPTION_FAILED";
    KEY_NOT_FOUND: "KEY_NOT_FOUND";
    TOKEN_TOO_LARGE: "TOKEN_TOO_LARGE";
    TOKEN_EXPIRED: "TOKEN_EXPIRED";
}>;
/**
 * Every recoverable failure raised by this package. Carries a stable
 * `code` (from {@link ErrorCode}) and a `status` — the HTTP response
 * status a middleware layer would use when translating the error.
 */
declare class JweError extends BaseError {
    static statuses: {
        INVALID_ARGUMENT: number;
        UNSUPPORTED_ALGORITHM: number;
        UNSUPPORTED_ENCRYPTION: number;
        MISSING_ALG_ALLOWLIST: number;
        MISSING_ENC_ALLOWLIST: number;
        INVALID_TOKEN: number;
        INVALID_HEADER: number;
        INVALID_KEY: number;
        ALGORITHM_MISMATCH: number;
        ENCRYPTION_MISMATCH: number;
        CRIT_UNSUPPORTED: number;
        DECRYPTION_FAILED: number;
        KEY_NOT_FOUND: number;
        TOKEN_EXPIRED: number;
        TOKEN_TOO_LARGE: number;
    };
}

/**
 * Bundled namespace matching the ARCHITECTURE example.
 */
declare const jwe: Readonly<{
    encrypt: typeof encrypt;
    decrypt: typeof decrypt;
    decode: typeof decode;
    decodeProtectedHeader: typeof decodeProtectedHeader;
    encryptJson: typeof encryptJson;
    decryptJson: typeof decryptJson;
}>;
type EncryptOptions = EncryptOptions$1;
type KeyInput = KeyInput$1;
type DecryptOptions = DecryptOptions$2;
type DecryptResult = DecryptResult$2;
type DecodedJwe = DecodedJwe$1;
type GeneralJwe = GeneralJwe$1;

export { ErrorCode, JweError, decode, decodeProtectedHeader, decrypt, decryptJson, encrypt, encryptJson, jwe };
export type { DecodedJwe, DecryptOptions, DecryptResult, EncryptOptions, GeneralJwe, KeyInput };