import { AppleRelayWebSocketClient } from './relay';
import { AppleRelayClientOptions } from './portal';
/**
 * A session-authenticated App Store Connect request. Payloads pass through
 * as JSON and GET parameters go into an explicit query map because the App
 * Store Connect API uses bracketed JSON:API keys like fields[apiKeys].
 */
export type AppStoreConnectRequest = {
    method?: 'GET' | 'POST';
    path: string;
    query?: Record<string, string>;
    payload?: unknown;
};
/**
 * A JSON:API resource returned by the session-authenticated App Store
 * Connect API. Kept loose on purpose: the endpoint is not a public contract
 * and Apple adds attributes freely.
 */
export type AppStoreConnectResource = {
    type?: string;
    id?: string;
    attributes?: Record<string, unknown>;
    relationships?: Record<string, unknown>;
};
type AppStoreConnectEnvelope = {
    data?: AppStoreConnectResource | AppStoreConnectResource[];
    included?: AppStoreConnectResource[];
    errors?: Array<{
        status?: string;
        code?: string;
        title?: string;
        detail?: string;
    }>;
};
export type SwitchAppStoreConnectProviderOptions = AppleRelayClientOptions & {
    /** The numeric provider ID of the team, from the team list's providerId. */
    providerId: string | number;
};
/**
 * Points the App Store Connect session at the given team (provider). Must
 * run before any other App Store Connect call when the account belongs to
 * multiple teams, because the session carries an active provider.
 */
export declare function switchAppStoreConnectProvider({ relay, providerId, }: SwitchAppStoreConnectProviderOptions): Promise<import('./relay').AppleRelayResponse<AppStoreConnectEnvelope>>;
/**
 * Roles Apple accepts on App Store Connect API keys. APP_MANAGER is enough
 * to upload builds and manage TestFlight, which is why it is the default
 * for keys minted by ensureAppStoreConnectApiKeySecret.
 */
export type AppStoreConnectApiKeyRole = 'ADMIN' | 'APP_MANAGER' | 'CUSTOMER_SUPPORT' | 'DEVELOPER' | 'FINANCE' | 'MARKETING' | 'SALES';
/** Lists the team's App Store Connect API keys. Requires an Admin session. */
export declare function listAppStoreConnectApiKeys({ relay }: AppleRelayClientOptions): Promise<AppStoreConnectResource[]>;
export type CreateAppStoreConnectApiKeyOptions = AppleRelayClientOptions & {
    /** Display name of the key. Required; implementors brand keys themselves. */
    nickname: string;
    roles?: AppStoreConnectApiKeyRole[];
    allAppsVisible?: boolean;
};
/**
 * Creates a team App Store Connect API key through the logged-in session,
 * the same way the App Store Connect website does. The session user must
 * be a team Admin. The private key is NOT part of the response; download
 * it once with downloadAppStoreConnectApiKeyPrivateKey.
 */
export declare function createAppStoreConnectApiKey({ relay, nickname, roles, allAppsVisible, }: CreateAppStoreConnectApiKeyOptions): Promise<AppStoreConnectResource>;
export type DownloadAppStoreConnectApiKeyOptions = AppleRelayClientOptions & {
    keyId: string;
};
export type DownloadedAppStoreConnectApiKey = {
    /** PEM contents of the .p8 private key. */
    privateKeyPem: string;
    /** Issuer ID for JWTs signed with this key, when Apple returned it. */
    issuerId?: string;
};
/**
 * Downloads the private half of an App Store Connect API key. Apple serves
 * it exactly once per key; afterwards the sparse fieldset comes back empty
 * and the key must be revoked and re-minted.
 */
export declare function downloadAppStoreConnectApiKeyPrivateKey({ relay, keyId, }: DownloadAppStoreConnectApiKeyOptions): Promise<DownloadedAppStoreConnectApiKey>;
/**
 * Issuer ID of the session's active provider (team), read from the olympus
 * session. Team API keys must sign their JWTs with this as `iss`; a token
 * signed without it is rejected with 401 NOT_AUTHORIZED.
 */
export declare function fetchAppStoreConnectIssuerId(relay: AppleRelayWebSocketClient): Promise<string | undefined>;
export type FindAppStoreConnectAppOptions = AppleRelayClientOptions & {
    bundleId: string;
};
/** Looks up the App Store Connect app record for a bundle ID, if any. */
export declare function findAppStoreConnectApp({ relay, bundleId }: FindAppStoreConnectAppOptions): Promise<AppStoreConnectResource | undefined>;
export type CreateAppStoreConnectAppOptions = AppleRelayClientOptions & {
    bundleId: string;
    /** App name shown on the App Store. Required; there is no default. */
    name: string;
    /** Unique internal identifier. Defaults to the bundle ID. */
    sku?: string;
    /** Primary App Store locale. Defaults to en-US. */
    primaryLocale?: string;
    /** Version string of the first App Store version. Defaults to 1.0. */
    versionString?: string;
};
/**
 * Creates the App Store Connect app record for a bundle ID. Only the
 * session-authenticated API can create app records (the key-authenticated
 * public API cannot), which is why this goes through the relay. The body
 * mirrors what the App Store Connect website and fastlane's produce send.
 */
export declare function createAppStoreConnectApp({ relay, bundleId, name, sku, primaryLocale, versionString, }: CreateAppStoreConnectAppOptions): Promise<AppStoreConnectResource>;
export type EnsureAppStoreConnectAppOptions = CreateAppStoreConnectAppOptions;
/**
 * Returns the App Store Connect app record for the bundle ID, creating it
 * when it does not exist yet. A first-time IPA upload fails without an app
 * record, so run this before the first publish of a new bundle ID.
 */
export declare function ensureAppStoreConnectApp(options: EnsureAppStoreConnectAppOptions): Promise<{
    app: AppStoreConnectResource;
    created: boolean;
}>;
export {};