/**
 * The real `MailboxConnectionPort`: an `ImapClient` behind the narrow shape
 * the watcher was written against.
 *
 * The watcher deals in `MailboxConnection`, a report, a reader, a wire and a
 * close, because that is everything a listener needs and because a test can
 * build one by hand. This file is the one place that knows those come from an
 * `ImapClient`, `imapConnection()` and `logout()`.
 *
 * It is also where "authenticated" stops standing in for "can read the mail".
 * IMAP publishes no scope list, so before a connection is handed over it reads
 * one existing message and checks what came back against what the server's own
 * BODYSTRUCTURE declared, see `imap-body-probe.ts`. A connection that cannot
 * produce message content raises here instead of becoming a watcher that
 * reports a mailbox as permanently quiet.
 *
 * The socket arrives as a factory rather than a value. One connection is one
 * socket: a reconnect needs a NEW one, because a destroyed socket cannot be
 * re-opened and handing the same instance to a second `ImapClient` would give
 * it a session whose stream had already failed. The factory is also what keeps
 * `node:tls` out of this module's import graph, production passes
 * `createImapTlsSocket()` from the sibling node entry, and a test passes a
 * plain loopback socket.
 */
import type { Socket } from 'node:net';
import type { MailboxConnectionPort } from './ports.js';
export interface ImapMailboxConnectionOptions {
    /** Opens ONE socket. Called once per connection attempt. */
    readonly connect: () => Promise<Socket>;
    readonly username: string;
    /** An app password, or `Bearer <token>` for XOAUTH2. Never logged. */
    readonly password: string;
    /** The EXAMINE target. Read-only; nothing is ever marked `\Seen`. */
    readonly mailbox: string;
    /** Per-command deadline. Not the IDLE wait, which has none by design. */
    readonly timeoutMs?: number | undefined;
}
/**
 * Open authenticated, EXAMINEd connections to one mailbox on demand.
 *
 * A failed `open()` destroys the socket it was given before the failure
 * propagates. Without that, every reconnect attempt against a server that
 * refuses at LOGIN leaks a live socket, and a watcher retrying on a five
 * minute ceiling leaks them for as long as the condition lasts, which for a
 * refused credential is "until somebody notices".
 */
export declare function imapMailboxConnectionPort(options: ImapMailboxConnectionOptions): MailboxConnectionPort;
//# sourceMappingURL=connection.d.ts.map