/**
 * TOTP (RFC 6238) on Web Crypto, so it runs unchanged in Node and on Workers.
 *
 * Implemented and tested here because it is small and self-contained — and then never wired up.
 * There is no enrolment (QR code, confirm-a-code step) and sign-in never challenges for a second
 * factor, so **everything in this file is currently unreachable**: a grep for `totp` across
 * `packages/astro` returns nothing. The `totp_secrets` table exists and is empty.
 *
 * Kept rather than deleted because it is verified against the RFC 6238 test vectors, which is the
 * expensive part; what remains is an enrolment screen and a step in the login flow. Recorded here
 * plainly so nobody reads "TOTP is implemented" off the export list and assumes the account is
 * protected by it.
 */
/** Generate a new shared secret, base32-encoded as authenticator apps expect. */
export declare function generateTotpSecret(): string;
/** Compute the code for a given moment. `atMs` exists so tests are not time-dependent. */
export declare function generateTotpCode(secret: string, atMs?: number): Promise<string>;
/**
 * Verify a submitted code.
 *
 * `window` counts periods checked either side of now, absorbing clock drift between the server
 * and the user's phone. One period (±30s) is the usual compromise between usability and keeping
 * the acceptance window tight.
 */
export declare function verifyTotpCode(secret: string, code: string, options?: {
    atMs?: number;
    window?: number;
}): Promise<boolean>;
/**
 * The time step a code matched, or `null`.
 *
 * The step is what makes replay protection possible: a code stays valid for its whole period plus
 * the drift window, so without recording which step was spent, a code observed over someone's
 * shoulder — or captured by a phishing page and relayed — works a second time for up to ninety
 * seconds. The caller stores the highest step it has accepted and refuses anything at or below it.
 *
 * Returning the step leaks nothing: it is derived from the clock, which is not a secret. The
 * constant-time property being protected here is *whether an early candidate matched*, and every
 * candidate is still evaluated.
 */
export declare function findTotpStep(secret: string, code: string, options?: {
    atMs?: number;
    window?: number;
}): Promise<number | null>;
/** The `otpauth://` URI an authenticator app scans. */
export declare function totpUri(secret: string, accountName: string, issuer?: string): string;
export declare function base32Encode(bytes: Uint8Array): string;
export declare function base32Decode(value: string): Uint8Array;