/**
 * @typedef {'totp' | 'hotp'} ProvisioningType
 */
/**
 * @typedef {object} ProvisioningOptions
 * @property {string} label
 *   Account identifier — typically the user's email or username.
 *   Rendered in the Authenticator app's list.
 * @property {string} secret
 *   Base32-encoded secret. Do NOT pass the raw Buffer.
 * @property {string} [issuer]
 *   Your app name. Shows above the account label in the app UI and
 *   is duplicated into the label per the Google Authenticator
 *   Key URI Format recommendation.
 * @property {ProvisioningType} [type='totp']
 * @property {6 | 7 | 8 | 9 | 10} [digits=6]
 * @property {number} [period=30]                   TOTP only.
 * @property {number} [counter]                     HOTP only — required for hotp type.
 * @property {'SHA1' | 'SHA256' | 'SHA512'} [algorithm='SHA1']
 */
/**
 * Build an `otpauth://` provisioning URI — the string you render as a
 * QR code on the enrollment screen. Compatible with Google
 * Authenticator, Authy, 1Password, Bitwarden, Yubico Authenticator,
 * Aegis, and every other mainstream 2FA app.
 *
 * The format is documented at:
 *   https://github.com/google/google-authenticator/wiki/Key-Uri-Format
 *
 * @param {ProvisioningOptions} options
 * @returns {string}
 */
declare function provisioningUri(options: ProvisioningOptions): string;
/**
 * @typedef {object} ParsedProvisioning
 * @property {'totp' | 'hotp'} type
 * @property {string} label            The account identifier — the
 *                                     "Issuer:" prefix (if any) is stripped.
 * @property {string} secret           Base32, unpadded — pass straight into `totp` / `hotp`.
 * @property {string | undefined} issuer
 * @property {6 | 7 | 8 | undefined} digits
 * @property {number | undefined} period    TOTP only.
 * @property {number | undefined} counter   HOTP only.
 * @property {'SHA1' | 'SHA224' | 'SHA256' | 'SHA384' | 'SHA512' | undefined} algorithm
 */
/**
 * Parse an `otpauth://` provisioning URI back into its parts — the
 * inverse of {@link provisioningUri}. Handy for migration flows where
 * you decode a QR the user scanned from another app.
 *
 * Returns `null` for anything that isn't a well-formed provisioning
 * URI. Never throws on malformed input.
 *
 *   const info = parseProvisioningUri(qrPayload)
 *   if (!info) return res.status(400).end('invalid QR')
 *   await db.users.upsert(userId, { secret: info.secret })
 *
 * @param {unknown} input
 * @returns {ParsedProvisioning | null}
 */
declare function parseProvisioningUri(input: unknown): ParsedProvisioning | null;
type ProvisioningType = "totp" | "hotp";
type ProvisioningOptions = {
    /**
     *   Account identifier — typically the user's email or username.
     *   Rendered in the Authenticator app's list.
     */
    label: string;
    /**
     *   Base32-encoded secret. Do NOT pass the raw Buffer.
     */
    secret: string;
    /**
     * Your app name. Shows above the account label in the app UI and
     * is duplicated into the label per the Google Authenticator
     * Key URI Format recommendation.
     */
    issuer?: string | undefined;
    type?: ProvisioningType | undefined;
    digits?: 6 | 7 | 8 | 9 | 10 | undefined;
    /**
     * TOTP only.
     */
    period?: number | undefined;
    /**
     * HOTP only — required for hotp type.
     */
    counter?: number | undefined;
    algorithm?: "SHA1" | "SHA256" | "SHA512" | undefined;
};
type ParsedProvisioning = {
    type: "totp" | "hotp";
    /**
     * The account identifier — the
     * "Issuer:" prefix (if any) is stripped.
     */
    label: string;
    /**
     * Base32, unpadded — pass straight into `totp` / `hotp`.
     */
    secret: string;
    issuer: string | undefined;
    digits: 6 | 7 | 8 | undefined;
    /**
     * TOTP only.
     */
    period: number | undefined;
    /**
     * HOTP only.
     */
    counter: number | undefined;
    algorithm: "SHA1" | "SHA224" | "SHA256" | "SHA384" | "SHA512" | undefined;
};

export { parseProvisioningUri, provisioningUri };
export type { ParsedProvisioning, ProvisioningOptions, ProvisioningType };