/**
 * Inbound `credentialRotated` broadcast handler — the runner's receive side of
 * the platform single-flight mediator's rotation broadcast (re-pull instead of
 * each container force-refreshing). Dormant until the platform ships it. Wire
 * shape + delivery-channel contract in root `MIGRATION.md`.
 * @docLink packages/runner/dev-guide#ai-credential-mediation
 */
import type { CredentialMint } from "@skaile/workspaces/types";
/** `LogSource.subkind` the platform tags its credential-rotation broadcast with. */
export declare const AI_PROVIDER_CREDENTIAL_SUBKIND = "ai-provider-credential";
/**
 * Whether an inbound message is the platform's credential-rotation broadcast.
 * Pure predicate — tolerant of unknown shapes so a malformed message is simply
 * not matched rather than throwing on the command ingress path.
 */
export declare function isCredentialRotatedSignal(msg: unknown): boolean;
/**
 * The AI provider config (seat) the broadcast wants this session moved to, when
 * it names one. A broadcast without it is a plain token rotation on the seat the
 * session already holds.
 *
 * Tolerant like {@link isCredentialRotatedSignal}: anything that is not a
 * non-empty string reads as absent, so a malformed broadcast degrades to a
 * re-pull rather than repointing the session at garbage.
 */
export declare function readCredentialRotatedConfigId(msg: unknown): string | undefined;
/**
 * Handle a credential-rotation broadcast: re-pull the fresh token through the
 * supplied `repull` (a `host.refresh_credential { reason: 'refresh' }` round
 * trip that rewrites `.credentials.json`). Idempotent and best-effort — a
 * failed re-pull is logged at error level and the reactive 401 path remains the
 * safety net; it never throws to the caller.
 *
 * When the broadcast names a `configId`, it is passed through so the re-pull
 * targets that seat instead of the stashed one — the serve.ts wiring then
 * restashes and restarts the driver. This is the path that moves a *running*
 * session off a parked seat; the platform's auto-activate parking only redirects
 * new resolutions (skaile-ai/platform#2861).
 *
 * The serve.ts wiring routes `repull` through the single-flight credential
 * re-pull, whose success path also re-arms the proactive refresh scheduler
 * against the fresh expiry — so a re-pull rewrites the file, restashes the
 * config, and re-schedules in one step.
 */
export declare function handleCredentialRotatedSignal(deps: {
    repull: (configId?: string) => Promise<CredentialMint>;
    /** Target seat named by the broadcast, from {@link readCredentialRotatedConfigId}. */
    configId?: string;
    log: (line: string) => void;
    logError: (line: string) => void;
}): Promise<void>;
//# sourceMappingURL=credential-rotated.d.ts.map