import type { OnboardingProgress, OnboardingStep } from './types.js';
/**
 * Load onboarding progress for an app. Returns null if no progress file exists.
 */
export declare function loadProgress(appId: string, baseDir?: string): Promise<OnboardingProgress | null>;
/**
 * Save onboarding progress. Creates the onboarding directory if needed.
 * File is written with mode 0o600, directory with 0o700.
 */
export declare function saveProgress(appId: string, progress: OnboardingProgress, baseDir?: string): Promise<void>;
/**
 * Delete the progress file for an app (called on successful completion).
 */
export declare function deleteProgress(appId: string, baseDir?: string): Promise<void>;
/**
 * Determine the first incomplete step based on saved progress.
 * Returns the step to resume from.
 *
 * Branches on `setupMethod` so the import flow doesn't accidentally resume
 * into the create-new path's `creating-certificate` step (which would trigger
 * the Apple 3-cert-limit error for users at the limit).
 */
export declare function getResumeStep(progress: OnboardingProgress | null): OnboardingStep;
/**
 * Pure routing decision used by the `import-scanning` useEffect to skip
 * questions the user already answered on a previous attempt.
 *
 * The shipped flow always sent users to `import-distribution-mode` after
 * scanning, and the distribution-mode picker always sent app_store users to
 * `api-key-instructions`. That re-asked the .p8 file path on resume even
 * though `keyId` / `issuerId` / `p8Path` were already saved in progress —
 * exposed by users seeing "✔ API Key verified — Key: X" (hydrated log)
 * alongside "How do you want to provide the .p8 file?" on the same screen.
 *
 * IMPORTANT — we intentionally do NOT short-circuit on
 * `completedSteps.apiKeyVerified`. Going through `verifying-key` on every
 * resume is a brief network round-trip that catches two failure modes a
 * short-circuit would silently allow:
 *   1. The user moved/deleted the saved .p8 between runs — `verifying-key`
 *      surfaces this via NeedP8Error and routes back to the .p8 input.
 *   2. The key was revoked on Apple's side — `verifying-key` gets a 401 and
 *      the user gets a clear error instead of a late failure inside
 *      `saving-credentials` (after the Keychain ACL prompt has already
 *      fired for the .p12 export).
 *
 * Exported so the routing decision can be unit-tested without rendering Ink.
 *
 * Returns the step to land on after a successful Keychain scan.
 */
export declare function getImportEntryStep(progress: OnboardingProgress | null): OnboardingStep;
export declare function extractKeyIdFromP8Path(filePath: string): string;