/** Exposed so email-status can report which store the credential resolved from. */
export declare function credentialStorePath(): string;
export interface EmailConfig {
    email: string;
    agentAddress: string;
    imapHost: string;
    imapPort: number;
    imapSecurity: "tls" | "starttls";
    smtpHost: string;
    smtpPort: number;
    smtpSecurity: "tls" | "starttls";
    /** Explicit IMAP Drafts folder path for hosts where the client-visible Drafts
     *  folder is not the one flagged \Drafts. Undefined → auto-discover via the
     *  \Drafts special-use flag. */
    draftsFolder?: string;
}
export interface PollState {
    agentSlug: string | null;
    pollIntervalMinutes: number;
    lastFetchedUid: number;
    lastPollAt: string | null;
    uidValidity: number | null;
}
export interface FullCredentials {
    config: EmailConfig;
    password: string;
}
/**
 * Read the password that unlocks `email` from the brand store.
 *
 * On a store miss, adopt the legacy single secret for `email` (migration) if
 * present, so a live brand does not lose email on upgrade. Otherwise throw
 * naming the active email and the mailbox identities that ARE stored, so a
 * foreign-owned or mis-keyed credential surfaces as a named mismatch rather
 * than a generic downstream 535.
 */
export declare function readPassword(email: string): string;
/**
 * Upsert the password for `email` in the brand store (mode 0600).
 */
export declare function writePassword(email: string, password: string): void;
/**
 * Remove the password for `email` from the brand store (rollback path).
 */
export declare function removePassword(email: string): void;
/**
 * Read one mailbox's EmailAccount config from the graph, keyed by
 * (accountId, email). Returns null if no node exists for that exact mailbox.
 */
export declare function readConfig(accountId: string, email: string): Promise<EmailConfig | null>;
/**
 * List every mailbox configured under one account, ordered by email for a
 * stable surface. The active-config layer is multi-mailbox: each mailbox is its
 * own :EmailAccount node keyed by (accountId, email).
 */
export declare function listConfigs(accountId: string): Promise<EmailConfig[]>;
/**
 * Resolve which configured mailbox a call targets.
 * Resolution order:
 *   - explicit `mailbox` → that mailbox, or a typed refusal naming the stored
 *     identities when it matches none;
 *   - no `mailbox` + exactly one configured → that one (single-mailbox back-compat);
 *   - no `mailbox` + two or more configured → a typed ambiguity refusal naming
 *     every stored identity so the agent can pick without guessing an address.
 */
export declare function resolveConfig(accountId: string, mailbox?: string): Promise<{
    config: EmailConfig;
} | {
    error: string;
}>;
/**
 * Write or update the EmailAccount config in the graph.
 * Uses MERGE to be idempotent — calling setup again overwrites the config.
 *
 * When agentAddress changes, updates recipientAddress on all existing Email
 * nodes for this account so stored emails remain consistent with the current
 * config. This prevents stale recipientAddress values from causing confusion
 * in queries (dedup is handled separately by the messageId pre-check).
 */
export declare function writeConfig(accountId: string, config: EmailConfig): Promise<void>;
/**
 * Remove the EmailAccount node from the graph (for rollback).
 *
 * Hard-delete is deliberate: EmailAccount holds credential/config
 * state, not user-domain content — it is semantically the graph-side
 * equivalent of deleting the `.email-password` file above. There is no
 * user-facing "restore my deleted EmailAccount" flow; re-running email-setup
 * re-creates it via MERGE. Email content nodes are protected separately by
 * the `contact-erase` cascade, which this function does not touch.
 */
export declare function removeConfig(accountId: string, email: string): Promise<void>;
/**
 * Stamp the EmailAccount node with the time of a verified IMAP connection.
 * Called from every successful IMAP probe (email-setup, email-status) so a
 * mailbox that has authenticated at least once is distinguishable from one that
 * never has. No-op when no EmailAccount node exists for the account.
 */
export declare function recordSuccessfulConnect(accountId: string, email: string): Promise<void>;
/**
 * Read the last verified-IMAP-connection timestamp for an account.
 * Returns null when the account has no EmailAccount node, or one that has never
 * recorded a successful connect (the never-connected state).
 */
export declare function readLastSuccessfulConnect(accountId: string, email: string): Promise<string | null>;
/**
 * Read poll state from the EmailAccount node.
 * Returns defaults if properties are not yet set (first run).
 */
export declare function readPollState(accountId: string, email: string): Promise<PollState | null>;
/**
 * Update poll tracking state after a successful fetch cycle.
 */
export declare function updatePollState(accountId: string, email: string, lastFetchedUid: number, uidValidity: number): Promise<void>;
/**
 * Set the agentSlug and poll config on an EmailAccount.
 * Called during email-setup to bind an agent to an email address.
 */
export declare function writeBindingConfig(accountId: string, email: string, agentSlug: string, pollIntervalMinutes: number): Promise<void>;
/**
 * Check if an email address is already bound to a different agent.
 * Returns the conflicting agentSlug if claimed, or null if available.
 */
export declare function checkAddressBinding(agentAddress: string, currentSlug: string): Promise<string | null>;
/**
 * Load full credentials (config + password) for one mailbox.
 * `mailbox` selects which configured mailbox to act on; omit it to resolve the
 * single configured mailbox (back-compat). Returns a typed error — naming the
 * stored mailbox identities — on a not-configured, ambiguous, or unmatched
 * selector, or on a missing/empty password.
 */
export declare function loadCredentials(accountId: string, mailbox?: string): Promise<{
    credentials: FullCredentials;
} | {
    error: string;
}>;
//# sourceMappingURL=credentials.d.ts.map