import * as vulnScanner from "@distilled.cloud/cloudflare/vulnerability-scanner";
import * as Redacted from "effect/Redacted";
import * as Provider from "../../Provider.ts";
import { Resource } from "../../Resource.ts";
import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
import type { Providers } from "../Providers.ts";
declare const TypeId: "Cloudflare.VulnerabilityScanner.Credential";
type TypeId = typeof TypeId;
/**
 * Where the scanner attaches a credential in outgoing requests.
 */
export type VulnScannerCredentialLocation = "header" | "cookie";
export interface VulnScannerCredentialProps {
    /**
     * The credential set this credential belongs to. The parent is part of
     * the credential's API path, so changing it triggers a replacement.
     */
    credentialSetId: string;
    /**
     * Human-readable name for the credential. If omitted, a unique name is
     * generated from the app, stage, and logical ID.
     * @default ${app}-${stage}-${id}
     */
    name?: string;
    /**
     * Where the credential is attached in outgoing requests: as an HTTP
     * `header` or a `cookie`. Mutable.
     */
    location: VulnScannerCredentialLocation;
    /**
     * Name of the header or cookie the credential is attached as
     * (e.g. `authorization`, `session_id`). Cloudflare requires the name in
     * normalized (lowercase) form and rejects e.g. `Authorization` with a
     * `BadRequest`. Mutable.
     */
    locationName: string;
    /**
     * The credential value (e.g. API key, session token). Write-only — the
     * Cloudflare API never returns it, so rotation is detected by comparing
     * against the previously deployed value.
     */
    value: Redacted.Redacted<string>;
}
export interface VulnScannerCredentialAttributes {
    /** Server-assigned credential identifier (UUID). */
    credentialId: string;
    /** The parent credential set identifier. */
    credentialSetId: string;
    /** The Cloudflare account the credential belongs to. */
    accountId: string;
    /** Human-readable name. */
    name: string;
    /** Where the credential is attached in outgoing requests. */
    location: VulnScannerCredentialLocation;
    /** Name of the header or cookie the credential is attached as. */
    locationName: string;
}
export type VulnScannerCredential = Resource<TypeId, VulnScannerCredentialProps, VulnScannerCredentialAttributes, never, Providers>;
/**
 * A credential inside a Cloudflare Vulnerability Scanner credential set —
 * an HTTP header or cookie value the DAST scanner attaches to outgoing
 * requests so it can scan authenticated surfaces.
 *
 * The credential `value` is write-only: Cloudflare never returns it, so the
 * provider rotates it by comparing the desired value against the previously
 * deployed one. `name`, `location`, and `locationName` are mutable in place;
 * moving the credential to a different set triggers a replacement.
 * ### Creating a Credential
 * **Example:** Authorization header
 * ```typescript
 * const creds = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredentialSet("scanner-creds", {});
 *
 * const apiKey = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredential("api-key", {
 *   credentialSetId: creds.credentialSetId,
 *   location: "header",
 *   // Cloudflare requires normalized (lowercase) header/cookie names.
 *   locationName: "authorization",
 *   value: Redacted.make("Bearer my-api-key"),
 * });
 * ```
 *
 * **Example:** Session cookie
 * ```typescript
 * const session = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredential("session", {
 *   credentialSetId: creds.credentialSetId,
 *   location: "cookie",
 *   locationName: "session_id",
 *   value: Redacted.make("s3cr3t-session-token"),
 * });
 * ```
 *
 * ### Rotating the Value
 * **Example:** Rotate by redeploying with a new value
 * ```typescript
 * // Change the redacted value and redeploy — the provider PUTs the new
 * // value even though the API never echoes it back.
 * const rotated = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredential("api-key", {
 *   credentialSetId: creds.credentialSetId,
 *   location: "header",
 *   locationName: "authorization",
 *   value: Redacted.make("Bearer my-new-api-key"),
 * });
 * ```
 *
 * @see https://developers.cloudflare.com/security-center/
 *
 * @resource
 * @product Vulnerability Scanner
 * @category Application Security
 */
export declare const VulnScannerCredential: import("../../Resource.ts").ResourceClass<VulnScannerCredential>;
/**
 * Returns true if the given value is a VulnScannerCredential resource.
 */
export declare const isVulnScannerCredential: (value: unknown) => value is VulnScannerCredential;
export declare const VulnScannerCredentialProvider: () => import("effect/Layer").Layer<Provider.Provider<VulnScannerCredential>, never, CloudflareEnvironment | import("../../Stack.ts").Stack | import("../../Stage.ts").Stage | vulnScanner.CloudflareOpContext>;
export {};
//# sourceMappingURL=Credential.d.ts.map