import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
import * as Provider from "../../Provider.ts";
import { Resource } from "../../Resource.ts";
import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
import type { Providers } from "../Providers.ts";
declare const TypeId: "Cloudflare.Gateway.Certificate";
type TypeId = typeof TypeId;
/**
 * Deployment status of the certificate on Cloudflare's edge. Gateway TLS
 * interception can use certificates in the `available` state.
 */
export type CertificateBindingStatus = "pending_deployment" | "available" | "pending_deletion" | "inactive" | (string & {});
export interface CertificateProps {
    /**
     * Certificate validity period in days (range: 1–10,950 days / ~30
     * years). Only settable at creation time — changing it triggers a
     * replacement (a new certificate is generated).
     *
     * @default 1825
     */
    validityPeriodDays?: number;
    /**
     * Whether the certificate should be activated (deployed to Cloudflare's
     * edge so Gateway TLS interception can use it). Activation typically
     * completes within seconds; the provider waits (bounded) for the
     * `available` binding status. Set `false` to keep or return the
     * certificate to the `inactive` state.
     *
     * @default true
     */
    activate?: boolean;
}
export interface CertificateAttributes {
    /** UUID of the certificate, assigned by Cloudflare. */
    certificateId: string;
    /** Cloudflare account that owns the certificate. */
    accountId: string;
    /** Edge deployment status (`available` means usable for interception). */
    bindingStatus: CertificateBindingStatus | undefined;
    /** The CA certificate PEM (read-only, generated by Cloudflare). */
    certificate: string | undefined;
    /** SHA256 fingerprint of the certificate. */
    fingerprint: string | undefined;
    /**
     * Whether Gateway TLS interception currently uses this certificate.
     * Configured via the Gateway configuration `certificate` setting, not
     * on the certificate itself.
     */
    inUse: boolean | undefined;
    /** Organization that issued the certificate. */
    issuerOrg: string | undefined;
    /** Certificate kind — Cloudflare-generated (`gateway_managed`) or BYO-PKI (`custom`). */
    certificateType: string | undefined;
    /** ISO8601 expiry timestamp. */
    expiresOn: string | undefined;
    /** ISO8601 creation timestamp. */
    createdAt: string | undefined;
}
export type Certificate = Resource<TypeId, CertificateProps, CertificateAttributes, never, Providers>;
/**
 * A Cloudflare Zero Trust Gateway certificate — a Cloudflare-generated CA
 * used by Gateway to inspect TLS traffic (HTTPS filtering, antivirus
 * scanning, browser isolation). The certificate body is generated by
 * Cloudflare; you only choose the validity period and whether it is
 * activated (deployed to the edge).
 *
 * To make Gateway actually intercept with this certificate, reference its
 * `certificateId` from the Gateway configuration's `certificate` setting
 * (see `Cloudflare.Gateway.Configuration`).
 * ### Creating a Certificate
 * **Example:** Activated certificate (default)
 * ```typescript
 * const cert = yield* Cloudflare.Gateway.Certificate("InspectionCa", {});
 * // cert.bindingStatus === "available" once deployed to the edge
 * ```
 *
 * **Example:** Short-lived, kept inactive
 * ```typescript
 * const cert = yield* Cloudflare.Gateway.Certificate("StagedCa", {
 *   validityPeriodDays: 365,
 *   activate: false,
 * });
 * ```
 *
 * ### Using the certificate for TLS interception
 * **Example:** Wire into the Gateway configuration
 * ```typescript
 * const cert = yield* Cloudflare.Gateway.Certificate("InspectionCa", {});
 * yield* Cloudflare.Gateway.Configuration("Gateway", {
 *   settings: {
 *     tlsDecrypt: { enabled: true },
 *     certificate: { id: cert.certificateId },
 *   },
 * });
 * ```
 *
 * @see https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/user-side-certificates/
 *
 * @resource
 * @product Gateway
 * @category Cloudflare One (Zero Trust)
 */
export declare const Certificate: import("../../Resource.ts").ResourceClass<Certificate>;
/**
 * Returns true if the given value is a Certificate resource.
 */
export declare const isCertificate: (value: unknown) => value is Certificate;
export declare const CertificateProvider: () => import("effect/Layer").Layer<Provider.Provider<Certificate>, never, CloudflareEnvironment | zeroTrust.CloudflareOpContext>;
export {};
//# sourceMappingURL=Certificate.d.ts.map