import type { ToolDefinition } from "./types.js";
/**
 * `GET /api/v1/repositories/:repository_id/api_keys` as a tool — shipped in
 * the platform (`specguard/config/routes.rb`,
 * `Api::V1::UserRepositoryApiKeysController#index`, SPGD-993).
 *
 * == The verify step of the rotation this bridge otherwise cannot see
 *
 * The README prescribes the `sgk_` rotation — mint a replacement with
 * `create_repository_api_key`, deploy it, THEN revoke the old one — but until
 * this tool the bridge could not answer the question the middle step turns
 * on: has the replacement presented itself? The mint response is
 * point-in-time by construction (an `api_key` block describing only the new
 * key; usage accrues after it), and the one other read that touches keys,
 * `get_repository_overview`, serves findings only — its `credential_health`
 * is stranded + presented-revoked, and a replacement that never presented is
 * neither. Revoking first would lock the repository's CI out until a human
 * mints in a browser, so the listing is the check to run BEFORE the cut.
 *
 * == The id source for every row this session did not mint
 *
 * `revoke_repository_api_key`'s `key_id` is documented as coming from
 * `add_repository`'s or `create_repository_api_key`'s response — i.e. keys
 * this session minted. A key minted by a person in the panel, or in an
 * earlier session, has no bridge-learnable id except through this listing.
 * The mint response does carry the id of the key IT minted (SPGD-993); this
 * listing is the id source for every OTHER row.
 *
 * == Rows, pass-through
 *
 * The endpoint answers `{api_keys: [...]}` over the repository's key set —
 * LIVE AND REVOKED rows alike, unlike the `sga_` listing
 * (`list_repository_agent_keys`), which deliberately serves live rows only.
 * A revoked `sgk_` row is not a credential either, but the rotation's story
 * lives in the population: `status` (`live`/`revoked`, with `revoked_at`
 * present only on revoked rows) is what tells a replacement apart from its
 * predecessor. Each row serves the controller's own serialization: `id`,
 * `name`, `token_hint`, `created_at`, `created_by`, `last_used_at`
 * (null meaning the key has NEVER presented — the negative is served, not
 * omitted), `rotated_at` (null until `regenerate!` retired a token), and
 * `rotated_and_unused` (live-scoped — the stranded shape `credential_health`
 * reports, served here at row grain). `token_hint` is a hint and never the
 * token: the plaintext existed for exactly one response at mint time and
 * nothing persisted it. Passed through UNRESHAPED — the rows are the
 * controller's own serialization, and reshaping is how a field the revoke
 * needs gets dropped.
 *
 * == No client-side capability probing
 *
 * The server gates at `current_repository(:keys_manage)` — the same gate the
 * create/revoke pair answers to. A caller without `keys_manage` is refused
 * 403 in SpecGuard's own words; a repository outside the credential's reach
 * answers the nil-is-404 fork. This tool predicts neither; it reports what
 * came back.
 */
declare const listRepositoryApiKeys: ToolDefinition;
export default listRepositoryApiKeys;