/**
 * Reading the email config, and resolving the one secret it points at.
 *
 * Split out of `email-service.ts` to keep that file under the repository's
 * per-file line cap. Nothing here opens a socket: every function takes plain
 * values and a secret store, which is what lets the validation rules and the
 * credential-scope rule be exercised without a mail server.
 */
import type { EmailCapabilityFailureNotice } from './imap-open.js';
import type { EmailConfig, EmailSocketFactory, EmailTransportPort, ImapSecurityMode } from './email-service.js';
/**
 * Which transport member opens the IMAP connection.
 *
 * The IMAP counterpart of the SMTP selection in `EmailService`, and here rather
 * than beside it because that file is at the repository's per-file line cap.
 *
 * A transport with no `connectImapPlain` cannot honour a plaintext request, and
 * is refused by name: silently handing back the TLS factory would open a TLS
 * handshake against a plain listener and report a protocol error from a port the
 * operator never asked to be encrypted.
 */
export declare function imapSocketFactoryFor(transport: Pick<EmailTransportPort, 'connectImapTls' | 'connectImapPlain'>, security: ImapSecurityMode | undefined): EmailSocketFactory;
export declare function readEmailConfig(getConfig: (key: string) => unknown): EmailConfig;
/**
 * Which secret submission authenticates with: the SMTP-specific one when the
 * operator set it, otherwise the mailbox password. Resolved through one helper
 * so `sendMail` and `testConnection` cannot disagree about which credential a
 * send would actually use, a test that passes with the wrong password is worse
 * than no test.
 */
export declare function smtpPasswordRefFor(config: EmailConfig): string;
export declare function validateEmailConfig(config: EmailConfig): string[];
/**
 * A mail password that is not where this process reads secrets.
 *
 * Carries the same routable `notice` an `ImapOpenError` does, so a supervisor
 * delivers a missing credential to the owner by the same path it delivers a
 * rejected one. Terminal: nothing about waiting makes a secret appear.
 */
export declare class EmailCredentialUnavailableError extends Error {
    readonly notice: EmailCapabilityFailureNotice;
    constructor(detail: string);
}
/**
 * Resolve the mail password from the secret store this process was given.
 *
 * ONE store is consulted: the one the composition root handed in, which for
 * the daemon is the daemon's own. There is deliberately no fallback to a
 * surface-local store. A credential captured by another surface is not visible
 * here, and reaching for it would produce a capability that works on the
 * machine where it happened to be captured and fails on every other one,
 * which is a far harder failure to diagnose than a missing secret. A secret
 * that is not here is reported as missing, by name, with the step that fixes
 * it.
 */
export declare function resolveEmailPassword(passwordRef: string, secretsManager: {
    readonly get: (key: string) => Promise<string | null>;
}): Promise<string>;
//# sourceMappingURL=email-config.d.ts.map