/**
 * Supported hash algorithms for RFC 6238 TOTP.
 */
export type TotpHashAlgorithm = 'sha1' | 'sha256' | 'sha512';
/**
 * Parameters required to generate/verify RFC 6238 TOTP tokens.
 */
export interface TotpParams {
    /**
     * Base32-encoded shared secret (RFC 4648, no padding).
     */
    secret: string;
    /**
     * Number of digits in the token (typically 6 or 8).
     */
    digits: 6 | 8;
    /**
     * Time step in seconds (typically 30).
     */
    period: number;
    /**
     * HMAC hash algorithm used for token generation.
     */
    algorithm: TotpHashAlgorithm;
}
/**
 * Parameters required to build a standard `otpauth://` URI for authenticator apps.
 */
export interface OtpAuthUriParams extends TotpParams {
    /**
     * Issuer name shown in authenticator apps (e.g. "Acme").
     */
    issuer: string;
    /**
     * Account label shown in authenticator apps (e.g. user email).
     */
    label: string;
}
/**
 * Decode a base32 string (RFC 4648, no padding) into bytes.
 *
 * ⚠️ WARNING: This is security-sensitive. We reject invalid characters to avoid
 * ambiguous decoding behavior.
 *
 * @param input - Base32 string, case-insensitive, without padding.
 * @returns Decoded bytes.
 * @throws {Error} When input contains invalid base32 characters.
 */
export declare function base32Decode(input: string): Uint8Array;
/**
 * Encode bytes into a base32 string (RFC 4648, no padding).
 *
 * @param bytes - Input bytes.
 * @returns Base32 string without padding.
 */
export declare function base32Encode(bytes: Uint8Array): string;
/**
 * Generate a random base32 secret suitable for TOTP.
 *
 * @param byteLength - Number of random bytes to generate (default 20 = 160-bit secret).
 * @returns Base32 secret (uppercase, no padding).
 */
export declare function generateBase32Secret(byteLength?: number): string;
/**
 * Generate an HOTP token for a secret and counter (RFC 4226).
 *
 * @param secretBytes - Shared secret bytes.
 * @param counter - HOTP counter value.
 * @param digits - Token length (6 or 8).
 * @param algorithm - HMAC hash algorithm.
 * @returns Numeric token as a zero-padded string.
 */
export declare function hotpGenerate(secretBytes: Uint8Array, counter: bigint, digits: 6 | 8, algorithm: TotpHashAlgorithm): string;
/**
 * Generate a TOTP token for the current time (RFC 6238).
 *
 * @param params - TOTP generation parameters.
 * @param nowMs - Current time in milliseconds (defaults to `Date.now()`).
 * @returns Token as a numeric string.
 */
export declare function totpGenerate(params: TotpParams, nowMs?: number): string;
/**
 * Verify a TOTP token within a time-step window.
 *
 * @param params - TOTP verification parameters.
 * @param token - Token to verify (numeric string).
 * @param window - Number of time steps to check before/after the current step.
 * @param nowMs - Current time in milliseconds (defaults to `Date.now()`).
 * @returns `true` when token matches within the window.
 */
export declare function totpVerify(params: TotpParams, token: string, window: number, nowMs?: number): boolean;
/**
 * Build an `otpauth://` URI compatible with major authenticator apps.
 *
 * @param params - URI parameters.
 * @returns `otpauth://totp/...` URI.
 */
export declare function buildOtpAuthUri(params: OtpAuthUriParams): string;
//# sourceMappingURL=totp.utils.d.ts.map