/**
 * Encode a payload into the plaintext byte string, stamping `exp` when
 * `expiresIn` is set and the payload is a JSON object.
 *
 * @param {unknown} payload
 * @param {{ expiresIn?: string | number }} options
 * @returns {Buffer}
 */
export function encodePlaintext(payload: unknown, options: {
    expiresIn?: string | number;
}): Buffer;
/**
 * Interpret recovered plaintext — parsed JSON when it is valid JSON, the
 * raw `Buffer` otherwise (binary payloads round-trip untouched).
 *
 * @param {Buffer} plaintext
 * @returns {unknown}
 */
export function decodePlaintext(plaintext: Buffer): unknown;
/**
 * Enforce an `exp` claim if the decrypted payload carries one.
 *
 * @param {unknown} payload
 * @param {{ clockTolerance?: number }} options
 */
export function enforceExpiry(payload: unknown, options: {
    clockTolerance?: number;
}): void;
/**
 * Validate the `crit` header (RFC 7516 §4.1.13): every listed parameter
 * must be understood by the caller (`knownCriticalHeaders`) and actually
 * present in the header.
 *
 * @param {Record<string, unknown>} header
 * @param {{ knownCriticalHeaders?: string[] }} options
 */
export function checkCrit(header: Record<string, unknown>, options: {
    knownCriticalHeaders?: string[];
}): void;
/**
 * Assert a decoded protected header is a JSON object.
 *
 * @param {unknown} header
 * @returns {Record<string, unknown>}
 */
export function assertHeaderObject(header: unknown): Record<string, unknown>;