/**
 * Config file loader / saver for mailpouch.
 *
 * Config is persisted to a single JSON file (default: ~/.mailpouch.json).
 * Override the path with the MAILPOUCH_CONFIG env var.
 *
 * On Unix systems the file is written with mode 0600 (owner-read/write only)
 * to reduce the risk of credential exposure.
 */
import { type ServerConfig, type PermissionPreset } from "./schema.js";
export declare function getConfigPath(): string;
/**
 * Build a full permissions object from a named preset.
 *
 * full       — all tools enabled, no limits
 * read_only  — reading/analytics/system enabled; all writes blocked
 * supervised — all tools enabled; reading unlimited; sending ≤200/hr,
 *              schedule ≤100/hr, bulk actions ≤100/hr, deletion ≤20/hr,
 *              folder delete ≤20/hr, server lifecycle ≤5/hr
 * send_only  — reading unlimited; send/forward/schedule ≤50/hr;
 *              actions, deletion, folder writes, and bulk ops disabled
 * custom     — same as full (caller modifies individual tools after)
 */
export declare function buildPermissions(preset: PermissionPreset): ServerConfig["permissions"];
export declare function defaultConfig(): ServerConfig;
/** Invalidate the in-process config cache (called after saveConfig). */
export declare function invalidateConfigCache(): void;
export declare function configExists(): boolean;
export declare function loadConfig(): ServerConfig | null;
export declare function saveConfig(config: ServerConfig): void;
/**
 * Run a read-modify-write of the config file under the exclusive lock so the
 * read (loadConfig) and the write (saveConfig) cannot interleave with a racing
 * writer. saveConfig() reuses the held lock reentrantly. CRED-008.
 */
export declare function withConfigWriteLock<T>(fn: () => T): T;
/**
 * Async variant of withConfigWriteLock for callers whose read-modify-write
 * spans an await (e.g. writeRegistry, which routes secrets through the
 * keychain between load and save). The lock is held for the full duration and
 * released only after the promise settles. CRED-008.
 */
export declare function withConfigWriteLockAsync<T>(fn: () => Promise<T>): Promise<T>;
/**
 * Load credentials with priority: keychain > encrypted-file > plaintext config.
 * Returns the credentials and the storage method used.
 */
export declare function loadCredentialsFromKeychain(): Promise<{
    password: string;
    smtpToken: string;
    storage: "keychain" | "encrypted-file" | "config" | "decrypt-failed";
} | null>;
/**
 * Save config with credentials routed to the most secure available store.
 * Priority: keychain > encrypted-file (AES-256-GCM) > plaintext config (legacy).
 * Mutates `config` — blanks plaintext fields when storing elsewhere.
 */
export declare function saveConfigWithCredentials(config: ServerConfig): Promise<"keychain" | "encrypted-file" | "config">;
/**
 * Load passAccessToken + simpleloginApiKey from the keychain, falling back
 * to the config-file plaintext if the keychain has neither. Used at startup
 * to rehydrate the in-process clients after migrateCredentials() has blanked
 * the disk fields. Returns null if neither secret is configured anywhere.
 */
export declare function loadAuxiliaryCredentialsFromKeychain(): Promise<{
    passAccessToken: string;
    simpleloginApiKey: string;
    storage: "keychain" | "config";
} | null>;
/**
 * One-time migration: move plaintext credentials to the best available store.
 * Priority: keychain > encrypted-file. Idempotent — safe to call on every startup.
 */
export declare function migrateCredentials(): Promise<boolean>;
//# sourceMappingURL=loader.d.ts.map