import { type ApiKey, type Tenant } from "../schema";
export declare function createApiKeyForTenant(tenantId: string, rawKey: string, label?: string): Promise<ApiKey>;
/** Resolves the owning tenant from a raw widget API key. Rejects revoked keys. */
export declare function findTenantByApiKey(rawKey: string): Promise<{
    tenant: Tenant;
    apiKey: ApiKey;
} | null>;
export declare function touchLastUsed(apiKeyId: string): Promise<void>;
/** Active (non-revoked) keys for the dashboard's API Keys view. Never selects hashedKey. */
export declare function listActiveApiKeys(tenantId: string): Promise<Omit<ApiKey, "hashedKey">[]>;
/**
 * Replaces every active widget key for the tenant with one freshly generated key,
 * so a tenant who lost their raw key (or wants to kill a leaked one) always has a
 * path back to a working embed -- the raw key is returned here and only here,
 * exactly like the one-time reveal on registration. Wrapped in a transaction (see
 * replaceChunksForDocument in kbChunks.ts for the same pattern) so a crash
 * mid-rotation can never leave the tenant with either zero active keys or two.
 */
export declare function rotateApiKey(tenantId: string): Promise<{
    rawKey: string;
    apiKey: ApiKey;
}>;