import { Buffer } from 'node:buffer';
export interface MobileprovisionInfo {
    name: string;
    uuid: string;
    applicationIdentifier: string;
    bundleId: string;
}
/**
 * Detail returned by {@link parseMobileprovisionDetailed} — extends
 * {@link MobileprovisionInfo} with team/expiry/profile-type metadata and the
 * SHA1 of each developer certificate embedded in the profile.
 *
 * The SHA1 list enables matching a profile against a Keychain identity
 * returned by `security find-identity` (which reports identities by the same
 * SHA1 hash).
 */
export interface MobileprovisionDetail extends MobileprovisionInfo {
    /** Apple Team ID (10-char alphanumeric) — empty string if not present */
    teamId: string;
    /** ISO timestamp string from the profile's ExpirationDate, or empty string */
    expirationDate: string;
    /** High-level profile type derived from the profile's flags */
    profileType: 'app_store' | 'ad_hoc' | 'development' | 'enterprise' | 'unknown';
    /** SHA1 (40-char lowercase hex) of each DeveloperCertificate embedded in the profile */
    certificateSha1s: string[];
    /**
     * The capability-bearing keys parsed from the profile's `<key>Entitlements</key>`
     * dict, keyed by entitlement name. String/bool entitlements map to their value;
     * array entitlements (application-groups, associated-domains, keychain-access-groups,
     * iCloud container ids, etc.) map to the list of `<string>` members. Only keys
     * actually present in the profile are included, so a caller can both test
     * presence (`key in profileEntitlements`) and read the granted value/members.
     * No credential material is included — these are capability KEY names + their
     * declared identifiers, the same data the entitlement-coverage checks surface.
     */
    profileEntitlements: ProfileEntitlements;
}
export type ProfileEntitlementValue = string | string[] | boolean;
export type ProfileEntitlements = Record<string, ProfileEntitlementValue>;
export declare function parseMobileprovision(filePath: string): MobileprovisionInfo;
export declare function parseMobileprovisionFromBase64(base64Content: string): MobileprovisionInfo;
/**
 * Parse a mobileprovision file and return enriched metadata including:
 *   - team ID
 *   - expiration date
 *   - profile type (app_store / ad_hoc / development / enterprise)
 *   - SHA1 of each embedded developer certificate (used for cert↔profile matching)
 */
export declare function parseMobileprovisionDetailed(filePath: string): MobileprovisionDetail;
/** Base64 variant of {@link parseMobileprovisionDetailed} (profiles stored in CAPGO_IOS_PROVISIONING_MAP). */
export declare function parseMobileprovisionDetailedFromBase64(base64Content: string): MobileprovisionDetail;
/**
 * Buffer-based variant of {@link parseMobileprovisionDetailed} — parses the raw
 * .mobileprovision bytes directly instead of reading a path. Used by the iOS
 * onboarding engine's import-provide-profile-path effect, which reads the file
 * via its injected `readFile` dep (so the IO stays at the boundary) and parses
 * the returned Buffer here. `source` is a label used only in error messages.
 */
export declare function parseMobileprovisionBufferDetailed(data: Buffer, source?: string): MobileprovisionDetail;