import { APIResource } from "../core/resource.js";
import * as Shared from "./shared.js";
import { APIPromise } from "../core/api-promise.js";
import { RequestOptions } from "../internal/request-options.js";
export declare class ClientTokens extends APIResource {
    /**
     * Create a short-lived client token for browser SDK use.
     *
     * **Use case:** Your backend calls this endpoint to generate a token, then passes
     * it to your frontend. The frontend uses the token to make authenticated requests
     * to `/client/*` endpoints.
     *
     * **Payload:**
     *
     * - `publicMetadata`: Displayable properties, exposed via GET `/client/token`. For
     *   agent identity/attributes use serverContext.
     * - `serverContext`: Agent-facing context (identity, attributes, pass-through).
     *   Same shape as request context for chat/invoke. Never exposed to client.
     *
     * **Security:**
     *
     * - Tokens are short-lived (default 1 hour, max 24 hours)
     * - Both context types are trusted and cannot be tampered with
     * - Store the token securely - it will only be shown once
     *
     * **Example flow:**
     *
     * 1. User logs in to your app
     * 2. Your backend calls `POST /v1/client-tokens` with
     *    `{ publicMetadata: { displayName: "Jane", plan: "pro" }, serverContext: { identity: { user_id: "user_123" }, attributes: { user: { name: "Jane", email: "jane@example.com" } } } }`
     * 3. Your backend returns the token to your frontend
     * 4. Frontend uses the token to call `/client/*` endpoints
     *
     * @example
     * ```ts
     * const clientToken = await client.clientTokens.create({
     *   publicMetadata: { displayName: 'Jane', plan: 'pro' },
     * });
     * ```
     */
    create(body: ClientTokenCreateParams, options?: RequestOptions): APIPromise<ClientTokenCreateResponse>;
    /**
     * Revoke a client token immediately.
     *
     * Once revoked, the token can no longer be used for authentication. This is a soft
     * delete - the token record is kept for audit purposes.
     *
     * @example
     * ```ts
     * await client.clientTokens.revoke('x');
     * ```
     */
    revoke(id: string, options?: RequestOptions): APIPromise<void>;
}
export interface ClientTokenCreateResponse {
    /**
     * Token ID for management purposes
     */
    id: string;
    /**
     * The client token. Store this securely - it will not be shown again.
     */
    token: string;
    /**
     * ISO 8601 timestamp when the token expires
     */
    expiresAt: string;
}
export interface ClientTokenCreateParams {
    /**
     * Public metadata (display name, plan, etc.) exposed via GET /client/token. For
     * agent identity/attributes use serverContext.
     */
    publicMetadata: {
        [key: string]: unknown;
    };
    /**
     * Optional context: identity (conversation scoping), attributes (injected into
     * system prompt), and pass-through for tools
     */
    serverContext?: Shared.Context;
    /**
     * Time-to-live in seconds. Default: 3600 (1 hour). Max: 86400 (24 hours).
     */
    ttlSeconds?: number;
}
export declare namespace ClientTokens {
    export { type ClientTokenCreateResponse as ClientTokenCreateResponse, type ClientTokenCreateParams as ClientTokenCreateParams, };
}
//# sourceMappingURL=client-tokens.d.ts.map