/**
 * TOTP (RFC 6238) / HOTP (RFC 4226) plus the Base32 (RFC 4648) and otpauth-URI
 * plumbing an authenticator app needs — all zero-dependency over Web Crypto.
 * SHA-1 is the default HMAC: it is the RFC-6238 baseline and the only algorithm
 * Google/Microsoft/etc. authenticators reliably support. The secret is
 * high-entropy, so SHA-1 here is not a weakness; SHA-256/512 are opt-in for apps
 * that handle them.
 */
export type TotpAlgorithm = 'SHA-1' | 'SHA-256' | 'SHA-512';
/** Encode bytes as unpadded Base32 (the form otpauth secrets use). */
export declare function base32Encode(data: Uint8Array): string;
/**
 * Decode Base32. Tolerant on input (case-insensitive, ignores spaces and `=`
 * padding) — but throws on a character outside the alphabet so a malformed
 * secret fails loudly rather than silently decoding to garbage.
 */
export declare function base32Decode(input: string): Uint8Array;
/**
 * HOTP (RFC 4226): HMAC over the 8-byte big-endian counter → dynamic
 * truncation → `mod 10^digits`, zero-padded. Operates on raw key bytes.
 */
export declare function hotp(key: Uint8Array, counter: number, opts?: {
    digits?: number;
    algorithm?: TotpAlgorithm;
}): Promise<string>;
/** TOTP (RFC 6238): HOTP with `counter = floor(unixSeconds / period)`. */
export declare function totp(key: Uint8Array, opts?: {
    timestamp?: number;
    period?: number;
    digits?: number;
    algorithm?: TotpAlgorithm;
}): Promise<string>;
/**
 * Verify a user-supplied code against a Base32 secret, accepting ±`window`
 * periods of clock drift (default ±1). The comparison is timing-safe. Returns
 * `false` for a non-numeric/empty code or any drift-window miss.
 */
export declare function verifyTotp(secret: string, code: string, opts?: {
    window?: number;
    period?: number;
    digits?: number;
    algorithm?: TotpAlgorithm;
    timestamp?: number;
}): Promise<boolean>;
/** Generate a fresh Base32 TOTP secret (default 160 bit, the RFC-6238 size). */
export declare function generateTotpSecret(bytes?: number): string;
/**
 * Build the `otpauth://totp/...` URI an authenticator app imports (usually via
 * QR). `label` is the account identifier (e.g. the email); `issuer` names the
 * app. The Base32 `secret` is embedded as-is.
 */
export declare function buildOtpauthUri(opts: {
    issuer: string;
    label: string;
    secret: string;
    algorithm?: TotpAlgorithm;
    digits?: number;
    period?: number;
}): string;
/** Encrypt a secret string → `base64(iv):base64(ciphertext)` (AES-256-GCM). */
export declare function encryptSecret(plaintext: string, keyMaterial: string): Promise<string>;
/**
 * Decrypt an `encryptSecret` payload. Returns `null` on a malformed payload, a
 * wrong key, or tampering (the GCM auth tag fails) — fail-closed, never throws.
 */
export declare function decryptSecret(payload: string, keyMaterial: string): Promise<string | null>;