/**
 * Agent-owned local mailbox credentials (Cogent Mail M2). The mailbox password is a
 * SECRET — the control plane hands it to the bridge ONCE (on provisioning/rotation)
 * and never stores it, so the ONLY durable copy lives here, in an owner-only file.
 * `cogent_send_mail` / `cogent_fetch_mail` read it; `cogent_rotate_mail_creds` updates it.
 *
 * Mirrors {@link ./credential-store} deliberately: a per-cwd file so project A's mailbox
 * can't bleed into project B (the same isolation the cloud-credential store enforces).
 */
/**
 * The single source of truth for "this agent has no mailbox".
 *
 * 🔴 IT USED TO NAME AN IMPOSSIBLE ACTION (fixed 2026-09-04). Both mail tools independently said
 * "Run cogent_setup_mail with the address + password from the admin Mail panel first". That panel
 * is a TEAM-ONLY surface: free channels never provision a mailbox, and the free relay has no
 * CONTROL_PLANE_URL, so no mailbox can ever exist there. A real agent escalated to its operator
 * for a password that is never issued to anyone — and the operator could not supply it either.
 *
 * Deliberately does NOT assert which tier the caller is on: `PersistedCredentials` carries no
 * orgId, so the bridge genuinely cannot tell, and a confident wrong answer is worse than an honest
 * either/or. Mail is Team-only by product decision (operator, 2026-09-04) — this fixes the wording,
 * not the tier.
 *
 * Shared by send-mail and fetch-mail so the two can never drift apart again.
 */
export declare const MAIL_NOT_CONFIGURED_HINT: string;
export interface PersistedMailCredentials {
    /** Full mailbox address `[peer]-[channel]@mail.cogent.tools`. */
    address: string;
    /** Mailbox password (SECRET) — used for SMTP submission + IMAP fetch. */
    password: string;
    imapHost: string;
    imapPort: number;
    smtpHost: string;
    smtpPort: number;
    savedAt: string;
}
/** The Cogent Mail box hostname — default IMAP/SMTP host for a mailbox (M2). */
export declare const MAIL_DEFAULT_HOST = "mail.cogent.tools";
/**
 * Resolve the mailbox-credential path with the override hierarchy:
 *   1. explicit `credentialPath` arg            (tests, advanced users)
 *   2. process.env.COGENT_MAIL_CREDENTIALS_FILE  (operators with custom paths)
 *   3. defaultMailCredentialPath(process.cwd())  (per-cwd, the default)
 */
export declare function resolveMailCredentialPath(credentialPath?: string): string;
/** Load persisted mailbox credentials. Returns null on any error (absent / corrupt). */
export declare function loadMailCredentials(credentialPath?: string): Promise<PersistedMailCredentials | null>;
/** Save (upsert) mailbox credentials as 0600 JSON; creates the owner-only parent dir. */
export declare function saveMailCredentials(creds: PersistedMailCredentials, credentialPath?: string): Promise<void>;
/**
 * Persist an auto-provisioned mailbox (Cogent Mail M2.7) with default hosts (IMAP 993 / SMTP 465
 * on {@link MAIL_DEFAULT_HOST}). Returns true if it saved, false if there was nothing to save
 * (no address, or no one-time password — e.g. a re-register that didn't re-issue the password).
 * The caller uses this best-effort: a save failure must not break peer registration.
 */
export declare function persistProvisionedMailbox(mailbox: {
    address?: string;
    password?: string;
} | undefined, credentialPath?: string): Promise<boolean>;
/** Delete the mailbox-credential file. Idempotent — a missing file is not an error. */
export declare function clearMailCredentials(credentialPath?: string): Promise<void>;
//# sourceMappingURL=mail-credential-store.d.ts.map