/**
 * A pluggable store for Apple signing secrets.
 *
 * Credential material always lands in the browser first (the Apple relay
 * only proxies); the browser then writes it into a store implementing this
 * interface. Limrun's org secret store is the default implementation, an
 * IndexedDB-backed one keeps everything local, and customers can bring
 * their own store by implementing the same interface.
 */
export declare const APPLE_CERTIFICATE_SECRET_TYPE = "appleCertificate";
export declare const APPLE_PROVISIONING_PROFILE_SECRET_TYPE = "appleProvisioningProfile";
export declare const APP_STORE_CONNECT_API_KEY_SECRET_TYPE = "appStoreConnectApiKey";
/** Android upload keystore; escrowed by the CLI's `lim gradle build --sign`. */
export declare const ANDROID_SIGNING_KEY_SECRET_TYPE = "androidSigningKey";
export type SigningSecretType = typeof APPLE_CERTIFICATE_SECRET_TYPE | typeof APPLE_PROVISIONING_PROFILE_SECRET_TYPE | typeof APP_STORE_CONNECT_API_KEY_SECRET_TYPE | typeof ANDROID_SIGNING_KEY_SECRET_TYPE;
export type SigningSecretMetadata = {
    type: string;
    name: string;
    createdAt?: string;
};
/** Type-specific flat key-value payload of a signing secret. */
export type SigningSecretData = Record<string, string>;
export type SigningSecret = SigningSecretMetadata & {
    data: SigningSecretData;
};
export interface SigningSecretStore {
    /**
     * Stores a secret. When a secret with the same type and name already
     * exists its data is overwritten. Returns the stored secret; callers
     * should use the returned data.
     */
    put(type: SigningSecretType, name: string, data: SigningSecretData): Promise<SigningSecret>;
    /** Returns the secret including its data, or undefined when absent. */
    get(type: SigningSecretType, name: string): Promise<SigningSecret | undefined>;
    /** Lists metadata of all stored signing secrets, never their data. */
    list(): Promise<SigningSecretMetadata[]>;
    /** Deletes a secret; resolves even when the secret does not exist. */
    delete(type: SigningSecretType, name: string): Promise<void>;
}
/**
 * Apple's certificate types as defined by the App Store Connect API
 * (https://developer.apple.com/documentation/appstoreconnectapi/certificatetype).
 */
export type AppleCertificateType = 'DEVELOPMENT' | 'DISTRIBUTION' | 'IOS_DEVELOPMENT' | 'IOS_DISTRIBUTION' | 'MAC_APP_DEVELOPMENT' | 'MAC_APP_DISTRIBUTION' | 'MAC_INSTALLER_DISTRIBUTION' | 'DEVELOPER_ID_APPLICATION' | 'DEVELOPER_ID_INSTALLER' | 'DEVELOPER_ID_KEXT' | 'PASS_TYPE_ID' | 'PASS_TYPE_ID_WITH_NFC';
/** Data payload of an appleCertificate secret. */
export type AppleCertificateSecretData = {
    certificateP12Base64: string;
    /** Which of Apple's certificate types the p12 holds. */
    certificateType: AppleCertificateType;
    certificatePassword?: string;
    teamID?: string;
    /** Apple's portal certificate id, never a Limrun DB id. */
    certificateID?: string;
    /** The certificate's serial number: uppercase hex, no leading zeros. */
    serialNumber?: string;
    expirationDate?: string;
};
/**
 * Data payload of an appleProvisioningProfile secret. The
 * certificateSerialNumbers, bundleIDs and deviceIDs fields duplicate what
 * the signed profile binds (as comma-separated lists) so profiles can be
 * filtered by certificate, bundle ID or device without parsing every
 * entry. Certificates are referenced by serial number, the identifier
 * Apple embeds in the profile itself.
 */
export type AppleProvisioningProfileSecretData = {
    provisioningProfileBase64: string;
    certificateSerialNumbers?: string;
    bundleIDs?: string;
    deviceIDs?: string;
    teamID?: string;
    profileName?: string;
    uuid?: string;
    expirationDate?: string;
};
/**
 * Data payload of an appStoreConnectApiKey secret: the private half of an
 * App Store Connect API key plus the identifiers needed to sign JWTs with
 * it. Apple serves the private key exactly once, so the stored copy is the
 * only one.
 */
export type AppStoreConnectApiKeySecretData = {
    /** Base64 of the .p8 private key PEM. */
    privateKeyP8Base64: string;
    /** Apple's key ID, e.g. 2X9R4HXF34. */
    keyId: string;
    /** Issuer ID for team keys. Absent for individual keys. */
    issuerId?: string;
    nickname?: string;
    teamID?: string;
    expirationDate?: string;
};
/** Stores an Apple certificate bundle, conventionally named `${teamID}/${certificateType}`. */
export declare function putAppleCertificateSecret(store: SigningSecretStore, name: string, data: AppleCertificateSecretData): Promise<SigningSecret>;
/**
 * Stores a provisioning profile, conventionally named `${teamID}/${uuid}`
 * so a team can hold many profiles for the same bundle ID and certificate
 * set; consumers select by the reference fields, not by name.
 */
export declare function putAppleProvisioningProfileSecret(store: SigningSecretStore, name: string, data: AppleProvisioningProfileSecretData): Promise<SigningSecret>;
/**
 * Stores an App Store Connect API key, conventionally named
 * `${teamID}/APP_STORE_CONNECT_API_KEY`: one shared key per team.
 */
export declare function putAppStoreConnectApiKeySecret(store: SigningSecretStore, name: string, data: AppStoreConnectApiKeySecretData): Promise<SigningSecret>;
export type LimrunSecretStoreOptions = {
    /** Base URL of the Limrun backend API, e.g. https://api.limrun.com */
    apiUrl: string;
    /** Bearer token: a user or organization token. */
    token: string;
    /** Organization TID owning the secrets. */
    organizationId: string;
    /** Custom fetch, mainly for tests. */
    fetch?: typeof fetch;
};
/**
 * A SigningSecretStore backed by Limrun's organization secret store
 * (`/v1/organizations/{org}/secrets`). Secrets are stored server-side and
 * shared across the organization.
 */
export declare function createLimrunSecretStore(options: LimrunSecretStoreOptions): SigningSecretStore;
/**
 * A SigningSecretStore keeping everything in the browser's IndexedDB.
 * Nothing leaves the machine; secrets are per-browser-profile.
 */
export declare function createBrowserSecretStore(): SigningSecretStore;