/**
 * A Pass Type ID certificate that Apple did not issue.
 *
 * The one hard dependency of this whole package is an Apple Developer account,
 * and waiting for one would stop every other part of a product being built — so
 * this generates a certificate with the right shape and the wrong provenance.
 * Passes signed with it satisfy every structural and cryptographic rule the
 * conformance suite applies, and **no device will install one**.
 *
 * That combination is useful and dangerous in equal measure, so two things guard
 * it. {@link readSigningCertificate} reports `selfSigned`, and the surfaces that
 * show a certificate are expected to say so in words rather than showing a
 * green tick. And a real chain check — `verifyPkPass` with Apple's root as a
 * trust anchor — fails on one of these, which is the correct answer.
 *
 * It also removes openssl from the tests. A suite that shells out to a binary
 * is a suite whose failures depend on which machine it ran on.
 */
export interface DevelopmentCertificateInput {
    /** e.g. `pass.ro.stamped.loyalty`. Written into the common name. */
    passTypeIdentifier: string;
    /** The ten-character team identifier. Written into the organisational unit. */
    teamIdentifier: string;
    organisation?: string;
    validFrom: Date;
    validTo: Date;
    /**
     * Sign with this rather than with itself.
     *
     * Turns the result into a leaf of a chain, which is what the conformance tests
     * need in order to prove that chain checking actually rejects something.
     */
    issuer?: CertificateAndKey;
}
export interface CertificateAndKey {
    certificatePem: string;
    privateKeyPem: string;
}
export declare function generateDevelopmentCertificate(input: DevelopmentCertificateInput): Promise<CertificateAndKey>;
//# sourceMappingURL=development-certificate.d.ts.map