/**
 * Refresh-flag dispatcher — wake-mid-401 hardening for Tier-2 git connectors.
 *
 * The Tier-2 git credential-helper script (rendered by
 * `connectors/credential-helper-script.ts`) touches a workspace-level
 * refresh-flag file when it detects a stale credentials file. The runner
 * watches that flag via `fs.watch` and on `change` invokes the dispatcher
 * here, which:
 *
 *   1. Lists git connectors whose `exposeAccessToken === true` AND
 *      `auth === 'backend'` (Tier-2 backend-mediated only — PAT connectors
 *      can't be refreshed runtime-side).
 *   2. For each eligible connector, calls the GitConnector's
 *      `refreshExposedCredential(connectorId, handle)` — which mediates a
 *      fresh access token via the runner-supplied `tokenMediator` and
 *      rewrites the credentials file via `atomicReplaceCredential`.
 *
 * Extracted into its own module so the watcher logic can be unit-tested
 * without spinning up the full WebSocket server.
 *
 * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md` Step 9a.
 */
import type { Logger } from "@skaile/workspaces/types";
/**
 * Minimal connector-manager surface the dispatcher needs. Matches the public
 * interface of `ConnectorManager` (`listGitConnectors`, `get`) but stays
 * structural so tests can pass mocks without importing the full class.
 */
export interface DispatchConnectorManager {
    listGitConnectors(): Array<{
        id: string;
        source: string;
        exposeAccessToken: boolean;
        auth?: string;
    }>;
    get(id: string): {
        connector: {
            refreshExposedCredential?: (connectorId: string, handle: unknown) => Promise<void>;
        };
        handle: unknown;
    };
}
/**
 * Iterate every currently connected git connector and refresh the credential
 * for those eligible (Tier-2 backend-mediated). Failures on one connector do
 * not abort the rest.
 *
 * @param manager - The active connector manager. Pass `null` to short-circuit
 *   (used during the brief window between session boot and provisioning).
 * @param log - Logger. The dispatcher emits `info` on success and `warn` on
 *   per-connector failure.
 */
export declare function dispatchRefreshToExposedGitMounts(manager: DispatchConnectorManager | null, log: Logger): Promise<void>;
//# sourceMappingURL=refresh-flag-dispatcher.d.ts.map