import type { ToolDefinition } from "./types.js";
/**
 * `DELETE /api/v1/repositories/:repository_id/agent_keys/:id` as a tool —
 * shipped in the platform (`specguard/config/routes.rb`,
 * `Api::V1::UserRepositoryAgentKeysController#destroy`, SPGD-1004, `dfb9892`).
 *
 * == The blast radius is the whole stored set
 *
 * An agent key's grant — a repository set and a permission set — is chosen
 * once at mint time and stored ONCE, so revocation cuts the token on EVERY
 * repository in the set, not only the one this call names. On the web a
 * confirm dialog names that set BEFORE the cut; over the API there is no
 * dialog, so the disclosure travels in the response that performs it: count
 * first, then the still-existing names, with `deleted_repository_count`
 * present only when repositories have been deleted since mint and dropped out
 * of the names. The tool passes the body through rather than answering with a
 * summary of its own — the deployment already wrote the confirmation, and a
 * second wording of it is a second fact free to drift from the first.
 *
 * == 200 WITH a body, not the sibling's 204
 *
 * `revoke_repository_api_key` says "a 204 means revoked" because every
 * endpoint this bridge's DELETEs served until now answered empty. This one
 * deliberately does not: the disclosure body IS the confirmation, so the call
 * routes through `deleteJsonObject` — `requestJson`'s parse — rather than
 * `deleteJson`'s raw-text handling. The difference is carried in the
 * description because a caller pattern-matching on the sibling's contract
 * would otherwise misread the shape of success here.
 *
 * == The id is scoped, and both forks are 404
 *
 * `AgentApiKey.live.find_by` + one merged `nil?/covers?` raise — a key id that
 * is revoked already (a retained revoked row is not a credential) or whose
 * stored set does not cover THIS repository is a 404, never a cross-repository
 * cut; one raise site answers both forks with
 * "No agent key with that id is available to this repository."
 * The bridge relies on that server scoping entirely and adds no client-side
 * check of its own, for the reason every tool here states: the server is the
 * gate.
 *
 * == The id source
 *
 * No mint tool exists (deliberately web-only), so the id comes from
 * `list_repository_agent_keys` alone — stated in the description rather than
 * left implicit.
 */
declare const revokeRepositoryAgentKey: ToolDefinition;
export default revokeRepositoryAgentKey;