import { APIResource } from "../../../core/resource.js";
import { APIPromise } from "../../../core/api-promise.js";
import { RequestOptions } from "../../../internal/request-options.js";
export declare class BaseTokens extends APIResource {
    static readonly _key: readonly ['moq', 'relays', 'tokens'];
    /**
     * Mints a new relay-scoped token and adds it to the relay's accepted-auth
     * registry. The token value (secret) is shown once in the response. A relay may
     * hold up to 10 tokens; creating an 11th is rejected.
     *
     * @example
     * ```ts
     * const token = await client.moq.relays.tokens.create(
     *   'a1b2c3d4e5f67890a1b2c3d4e5f67890',
     *   {
     *     account_id: '023e105f4ecef8ad9ca31a8372d0c353',
     *     operations: ['publish', 'subscribe'],
     *   },
     * );
     * ```
     */
    create(relayID: string, params: TokenCreateParams, options?: RequestOptions): APIPromise<TokenCreateResponse>;
    /**
     * Returns metadata for every token the relay accepts. Secrets are never returned,
     * so a token that has been lost cannot be recovered here. There is no expiry
     * filter: compare each token's `expires` to the current time to tell which ones
     * have lapsed.
     *
     * @example
     * ```ts
     * const tokens = await client.moq.relays.tokens.list(
     *   'a1b2c3d4e5f67890a1b2c3d4e5f67890',
     *   { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
     * );
     * ```
     */
    list(relayID: string, params: TokenListParams, options?: RequestOptions): APIPromise<TokenListResponse>;
    /**
     * Revokes a token by removing it from the set the relay accepts. Relays cache that
     * set, so revocation takes effect within seconds rather than instantly, and
     * connections already established with the token are not closed. Revoking an
     * unknown token succeeds, so the call is idempotent.
     *
     * @example
     * ```ts
     * const token = await client.moq.relays.tokens.delete(
     *   'f3a1b2c3d4e5f67890a1b2c3d4e5f678',
     *   {
     *     account_id: '023e105f4ecef8ad9ca31a8372d0c353',
     *     relay_id: 'a1b2c3d4e5f67890a1b2c3d4e5f67890',
     *   },
     * );
     * ```
     */
    delete(jti: string, params: TokenDeleteParams, options?: RequestOptions): APIPromise<TokenDeleteResponse>;
}
export declare class Tokens extends BaseTokens {
}
/**
 * A relay's token collection, keyed on issuer `type` (a discriminated union). V1
 * ships exactly one arm (`cloudflare_jwt`). Clients iterate `issuers`, switch on
 * `type`, and ignore unknown types — that contract is what makes adding or
 * removing an arm non-breaking.
 */
export interface TokenCreateResponse {
    issuers: Array<TokenCreateResponse.Issuer>;
}
export declare namespace TokenCreateResponse {
    /**
     * One arm of the discriminated-union token collection.
     */
    interface Issuer {
        /**
         * Always present ([] when empty).
         */
        cloudflare_tokens: Array<Issuer.CloudflareToken>;
        issuer: 'cloudflare';
        type: 'cloudflare_jwt';
    }
    namespace Issuer {
        interface CloudflareToken {
            created: string;
            /**
             * Mandatory; no more than 1 year after `created`.
             */
            expires: string;
            /**
             * Token identity and registry key (32 hex chars).
             */
            jti: string;
            /**
             * Signed allowlist of what the token may do. V1 coarse roles; the array form
             * extends to fine-grained MoQT message names later without a breaking change.
             */
            operations: Array<'publish' | 'subscribe'>;
            /**
             * Optional, customer-set.
             */
            label?: string;
            /**
             * The signed JWT. Present ONLY in create / auto-create responses (shown once);
             * never returned by list, never stored.
             */
            secret?: string;
        }
    }
}
/**
 * A relay's token collection, keyed on issuer `type` (a discriminated union). V1
 * ships exactly one arm (`cloudflare_jwt`). Clients iterate `issuers`, switch on
 * `type`, and ignore unknown types — that contract is what makes adding or
 * removing an arm non-breaking.
 */
export interface TokenListResponse {
    issuers: Array<TokenListResponse.Issuer>;
}
export declare namespace TokenListResponse {
    /**
     * One arm of the discriminated-union token collection.
     */
    interface Issuer {
        /**
         * Always present ([] when empty).
         */
        cloudflare_tokens: Array<Issuer.CloudflareToken>;
        issuer: 'cloudflare';
        type: 'cloudflare_jwt';
    }
    namespace Issuer {
        interface CloudflareToken {
            created: string;
            /**
             * Mandatory; no more than 1 year after `created`.
             */
            expires: string;
            /**
             * Token identity and registry key (32 hex chars).
             */
            jti: string;
            /**
             * Signed allowlist of what the token may do. V1 coarse roles; the array form
             * extends to fine-grained MoQT message names later without a breaking change.
             */
            operations: Array<'publish' | 'subscribe'>;
            /**
             * Optional, customer-set.
             */
            label?: string;
            /**
             * The signed JWT. Present ONLY in create / auto-create responses (shown once);
             * never returned by list, never stored.
             */
            secret?: string;
        }
    }
}
export interface TokenDeleteResponse {
    errors: Array<TokenDeleteResponse.Error>;
    messages: Array<TokenDeleteResponse.Message>;
    success: boolean;
}
export declare namespace TokenDeleteResponse {
    interface Error {
        code?: number;
        message?: string;
    }
    interface Message {
        code?: number;
        message?: string;
    }
}
export interface TokenCreateParams {
    /**
     * Path param: Cloudflare account identifier.
     */
    account_id: string;
    /**
     * Body param: Non-empty subset of the V1 roles the token is allowed to perform.
     * Signed into the token.
     */
    operations: Array<'publish' | 'subscribe'>;
    /**
     * Body param: Optional expiry (RFC 3339). Defaults to 1 year from creation;
     * rejected if more than 1 year in the future.
     */
    expires?: string;
    /**
     * Body param: Optional, customer-set label.
     */
    label?: string;
}
export interface TokenListParams {
    /**
     * Cloudflare account identifier.
     */
    account_id: string;
}
export interface TokenDeleteParams {
    /**
     * Cloudflare account identifier.
     */
    account_id: string;
    /**
     * Relay unique identifier (32 hex characters).
     */
    relay_id: string;
}
export declare namespace Tokens {
    export { type TokenCreateResponse as TokenCreateResponse, type TokenListResponse as TokenListResponse, type TokenDeleteResponse as TokenDeleteResponse, type TokenCreateParams as TokenCreateParams, type TokenListParams as TokenListParams, type TokenDeleteParams as TokenDeleteParams, };
}
//# sourceMappingURL=tokens.d.ts.map