import type { ToolDefinition } from "./types.js";
/**
 * `GET /api/v1/repositories/:repository_id/agent_keys` as a tool — shipped in
 * the platform (`specguard/config/routes.rb`,
 * `Api::V1::UserRepositoryAgentKeysController#index`, SPGD-1004, `dfb9892`).
 *
 * == The id source is THIS listing, and only this listing
 *
 * Agent keys have no mint tool on this bridge — deliberately: the platform
 * mints them web-only at /account (the controller header states the rule), so
 * unlike `sgk_` keys there is no create response to read an id from. The `id`
 * each row serves is therefore the ONLY way an agent can name an agent key to
 * `revoke_repository_agent_key`, and the description says so rather than
 * leaving it implicit — an agent that arrives needing to cut a key without
 * having listed first has no fallback path.
 *
 * == Rows, pass-through
 *
 * The endpoint answers `{agent_keys: [...]}`, one row per LIVE key covering
 * this repository: `id`, `name`, `owner`, `token_hint`, `repository_count`
 * (the size of the key's stored set — the blast radius a revoke would land
 * on), `permissions` (rendered the way the web panel renders it, "read only"
 * for the minimal grant), `created_at` and `last_used_at` (SPGD-1108 — the
 * offboarding arc's decision half: when the key's token last authenticated,
 * null meaning the key has NEVER been presented — the negative is served, not
 * omitted). `token_hint` is a hint and never
 * the token: the plaintext existed for exactly one response at mint time and
 * nothing persisted it. Revoked rows leave the listing — a retained revoked
 * row is not a credential — and the still-presented triage over those rows is
 * `list_repository_agent_keys_presented_revoked`.
 *
 * == No client-side capability probing
 *
 * The server gates at `current_repository(:keys_manage)`, the same gate the
 * `sgk_` key pair answers to: a caller who cannot administer this
 * repository's keys is refused 403 in SpecGuard's own words, and a caller who
 * cannot see the repository at all gets the nil-is-404 fork. This tool
 * predicts neither; it reports what came back.
 */
declare const listRepositoryAgentKeys: ToolDefinition;
export default listRepositoryAgentKeys;