import type { PassIdentity } from './pass-json';
/**
 * What a Pass Type ID certificate says about itself.
 *
 * Read rather than configured. The pass type identifier and the team identifier
 * must appear in `pass.json` *and* must match the certificate the file is signed
 * with, and a device refuses the pass when they disagree — with no message, and
 * across every tenant at once. Two configuration values that must equal two
 * fields of a certificate is a drift waiting to happen, so there is one source
 * and it is the certificate.
 */
export interface SigningCertificate {
    /** e.g. `pass.ro.stamped.loyalty`, taken from the common name. */
    passTypeIdentifier: string;
    /** The ten-character Apple team identifier, taken from the organisational unit. */
    teamIdentifier: string;
    subject: string;
    issuer: string;
    serialNumber: string;
    validFrom: Date;
    validTo: Date;
    /**
     * True when this certificate was not issued by Apple.
     *
     * A development certificate signs passes that satisfy every structural and
     * cryptographic rule in this package and that **no device will install**. That
     * is a useful thing to be able to do and a catastrophic thing to be confused
     * about, so it is a field rather than an inference, and the surfaces that show
     * a certificate are expected to say so in words.
     */
    selfSigned: boolean;
}
/**
 * Reads a PEM or DER certificate.
 *
 * Throws rather than returning problems: everything else in this package
 * collects, but there is no useful partial answer to "which certificate is
 * this" — and the caller is a startup path, where failing loudly is right.
 */
export declare function readSigningCertificate(pem: Buffer | string): SigningCertificate;
/** The identity written into `pass.json`, taken from the certificate that will sign it. */
export declare const identityOf: (certificate: SigningCertificate) => PassIdentity;
/**
 * How many days until this certificate stops signing.
 *
 * Negative once it has expired, which is the case worth being able to say out
 * loud: an expired certificate does not degrade anything, it stops every pass
 * update for every tenant, and it does so silently.
 */
export declare function daysUntilExpiry(certificate: SigningCertificate, now: Date): number;
/** The thresholds at which somebody is told. Renewal takes days, not minutes. */
export declare const EXPIRY_WARNINGS: readonly [60, 30, 7];
//# sourceMappingURL=certificate.d.ts.map