type BackupCodesOptions = {
    /**
     * Total number of characters per code (excluding group separators).
     * 10 chars from a 32-symbol alphabet = 50 bits of entropy per code —
     * comfortably beyond brute-force even with weak server-side hashing.
     */
    length?: number | undefined;
    /**
     * How many dash-separated groups to visually split the code into
     * for readability. Set to `1` to disable grouping.
     */
    groups?: number | undefined;
    /**
     * Override the character set. The default (Crockford Base32) skips
     * the ambiguous `0/O/1/I/L` glyphs.
     */
    alphabet?: string | undefined;
};

type SecretEncoding = "base32" | "base32padded" | "hex" | "raw";
type SecretOptions = {
    /**
     * Number of random bytes to generate. Default matches RFC 4226's
     * "recommended minimum" — 20 bytes = 160 bits, the size of a
     * SHA-1 output. Use 32 for SHA-256, 64 for SHA-512.
     */
    bytes?: number | undefined;
    /**
     * How to encode the returned string. Google Authenticator and every
     * other TOTP app expects `base32` (RFC 4648, no padding).
     */
    encoding?: SecretEncoding | undefined;
};

type OtpAlgorithm = "SHA1" | "SHA224" | "SHA256" | "SHA384" | "SHA512";

/**
 * @typedef {object} EnrollOptions
 * @property {string} label
 *   Account identifier — usually the user's email or username.
 *   Rendered in the Authenticator app.
 * @property {string} [issuer]
 *   Your app name. Shows above the account label in the app UI.
 * @property {'totp' | 'hotp'} [type='totp']
 * @property {6 | 7 | 8 | 9 | 10} [digits=6]
 * @property {number} [period=30]                 TOTP only.
 * @property {number} [counter=0]                 HOTP only — starting counter.
 * @property {import('./hotp.js').OtpAlgorithm} [algorithm='SHA1']
 * @property {import('./secret.js').SecretOptions} [secretOptions]
 *   Overrides for the underlying `generateSecret` call — bytes, encoding.
 * @property {number} [backupCodeCount=10]
 *   Set to `0` to skip generating backup codes.
 * @property {import('./backup.js').BackupCodesOptions} [backupCodeOptions]
 *   Passed straight to `backupCodes` — shape, alphabet, groups.
 */
/**
 * @typedef {object} EnrollmentBundle
 * @property {string} secret            Base32-encoded secret to save.
 * @property {string} uri               `otpauth://` URI — render as QR.
 * @property {string[]} backupCodes     One-time recovery codes. Empty
 *                                      array when `backupCodeCount: 0`.
 */
/**
 * One-call enrollment — mint a secret, build the provisioning URI, and
 * generate backup codes in a single step.
 *
 *   const { secret, uri, backupCodes } = enroll({
 *     label: 'alice@example.com',
 *     issuer: 'MyApp',
 *   })
 *   // Save `secret` and hashed(backupCodes) server-side.
 *   // Render `uri` as a QR on the enrollment page.
 *
 * The bundle is composed from `generateSecret` + `provisioningUri` +
 * `backupCodes` — everything each helper accepts is passed through so
 * you can still tune individual pieces (algorithm, period, backup code
 * format, etc.) without dropping down to primitives.
 *
 * @param {EnrollOptions} options
 * @returns {EnrollmentBundle}
 */
declare function enroll(options: EnrollOptions): EnrollmentBundle;
type EnrollOptions = {
    /**
     *   Account identifier — usually the user's email or username.
     *   Rendered in the Authenticator app.
     */
    label: string;
    /**
     * Your app name. Shows above the account label in the app UI.
     */
    issuer?: string | undefined;
    type?: "totp" | "hotp" | undefined;
    digits?: 6 | 7 | 8 | 9 | 10 | undefined;
    /**
     * TOTP only.
     */
    period?: number | undefined;
    /**
     * HOTP only — starting counter.
     */
    counter?: number | undefined;
    algorithm?: OtpAlgorithm | undefined;
    /**
     * Overrides for the underlying `generateSecret` call — bytes, encoding.
     */
    secretOptions?: SecretOptions | undefined;
    /**
     * Set to `0` to skip generating backup codes.
     */
    backupCodeCount?: number | undefined;
    /**
     * Passed straight to `backupCodes` — shape, alphabet, groups.
     */
    backupCodeOptions?: BackupCodesOptions | undefined;
};
type EnrollmentBundle = {
    /**
     * Base32-encoded secret to save.
     */
    secret: string;
    /**
     * `otpauth://` URI — render as QR.
     */
    uri: string;
    /**
     * One-time recovery codes. Empty
     * array when `backupCodeCount: 0`.
     */
    backupCodes: string[];
};

export { enroll };
export type { EnrollOptions, EnrollmentBundle };