import { AppStoreConnectApiKeyRole } from './app-store-connect';
import { AppleCertificateKind } from './portal';
import { AppleRelayWebSocketClient } from './relay';
import { AppleCertificateType, SigningSecret, SigningSecretStore } from './secret-store';
/**
 * Conventional secret name of a team's certificate bundle. One bundle per
 * team and Apple certificate type; the type is in the name so development
 * and distribution material never collide.
 */
export declare function appleCertificateSecretName(teamId: string, certificateType: AppleCertificateType): string;
export type EnsureAppleCertificateInput = {
    relay: AppleRelayWebSocketClient;
    teamId: string;
    secretStore: SigningSecretStore;
    /**
     * Which portal certificate kind to ensure. Ad-hoc and App Store signing
     * both use the distribution certificate. Defaults to development.
     */
    certificateKind?: AppleCertificateKind;
    /** Common name used when minting a new certificate. */
    commonName?: string;
    log?: (message: string, detail?: string) => void;
};
export type EnsureAppleCertificateResult = {
    secret: SigningSecret;
    certificateId: string;
    /** True when a new certificate was minted instead of reusing the stored one. */
    created: boolean;
};
/**
 * Returns a usable certificate secret of the requested kind for the team,
 * reusing the stored one when its certificate is still on the team and
 * minting a new one otherwise. Apple caps certificates per kind (2 for
 * development, 3 for distribution) and never returns private keys, so
 * reuse of the stored p12 is strongly preferred.
 *
 * Durability of the stored material is the secret store's concern:
 * implementors who want retries or fallbacks build them into their
 * SigningSecretStore.
 */
export declare function ensureAppleCertificateSecret({ relay, teamId, secretStore, certificateKind, commonName, log, }: EnsureAppleCertificateInput): Promise<EnsureAppleCertificateResult>;
export type SaveAppleProfileInput = {
    relay: AppleRelayWebSocketClient;
    teamId: string;
    profileId: string;
    secretStore: SigningSecretStore;
    log?: (message: string, detail?: string) => void;
};
/**
 * Downloads the provisioning profile and stores it as an
 * appleProvisioningProfile secret named `${teamId}/${uuid}`. The UUID is
 * unique per profile, so a team can hold many profiles for the same
 * bundle ID and certificate set; the reference fields (certificate
 * serials, bundle IDs, device IDs parsed out of the profile) are what
 * consumers filter on.
 */
export declare function saveAppleProfileSecret({ relay, teamId, profileId, secretStore, log, }: SaveAppleProfileInput): Promise<SigningSecret>;
/**
 * Conventional secret name of a team's App Store Connect API key: one
 * shared key per team.
 */
export declare function appStoreConnectApiKeySecretName(teamId: string): string;
export type EnsureAppStoreConnectApiKeyInput = {
    relay: AppleRelayWebSocketClient;
    teamId: string;
    /**
     * Numeric provider ID of the team from the Apple team list. When given,
     * the App Store Connect session is switched to this provider first;
     * required for accounts that belong to multiple teams.
     */
    providerId?: string | number;
    secretStore: SigningSecretStore;
    /** Display name for a newly minted key. Required; there is no default. */
    nickname: string;
    /** Roles of a newly minted key. Defaults to APP_MANAGER. */
    roles?: AppStoreConnectApiKeyRole[];
    log?: (message: string, detail?: string) => void;
};
export type EnsureAppStoreConnectApiKeyResult = {
    secret: SigningSecret;
    keyId: string;
    /** True when a new key was minted instead of reusing the stored one. */
    created: boolean;
};
/**
 * Returns a usable App Store Connect API key secret for the team, reusing
 * the stored one when its key is still active and minting a new one
 * otherwise. Apple serves a key's private half exactly once (at creation
 * time through the sparse fieldset download), so reuse of the stored .p8
 * is strongly preferred.
 *
 * The session user must be a team Admin to list or create keys.
 */
export declare function ensureAppStoreConnectApiKeySecret({ relay, teamId, providerId, secretStore, nickname, roles, log, }: EnsureAppStoreConnectApiKeyInput): Promise<EnsureAppStoreConnectApiKeyResult>;