/**
 * mailpouch — Settings UI Server
 *
 * Starts a localhost-only HTTP server that serves a browser-based
 * configuration interface.  The UI lets users:
 *   • Set up SMTP / IMAP connection credentials
 *   • Choose a permission preset or configure per-tool access
 *   • Set per-tool rate limits
 *   • Test connectivity
 *   • View server status and the generated Claude Desktop config snippet
 *
 * The config is persisted to ~/.mailpouch.json (mode 0600).
 * The MCP server reads that file every 15 s, so changes take effect
 * without a restart.
 */
import http from "http";
import { type AccessToken } from "./security.js";
export interface ServerSecurityOptions {
    /** Port the server will listen on (needed for Origin validation). */
    port: number;
    /** True when binding to 0.0.0.0 (LAN mode). */
    lan: boolean;
    /** Access token required for every request in LAN mode. */
    accessToken: AccessToken | null;
    /**
     * Actual URI scheme the server is reachable on.
     * "https" when a self-signed cert was successfully generated; "http" otherwise.
     * Passed to isValidOrigin so browsers in TLS mode are accepted.
     */
    scheme: "http" | "https";
    /**
     * Called after a successful `npm install -g` update. The caller is
     * responsible for tearing down the tray, stopping services, and
     * restarting the process. When omitted the browser is told to restart
     * manually instead of auto-reloading.
     */
    onRestartRequested?: () => void;
    /**
     * Called when the UI requests a full shutdown via POST /api/shutdown.
     * The caller is responsible for graceful teardown (tray destroy, service
     * disconnect, then process exit). When omitted the server falls back to
     * `process.exit(0)`, which bypasses tray cleanup.
     */
    onShutdownRequested?: () => void;
}
export declare function createSettingsServer(secOpts: ServerSecurityOptions): http.Server;
/**
 * Start the settings HTTP(S) server.
 *
 * Local mode  (default): binds to 127.0.0.1 over plain HTTP.
 *             Only the local machine can reach it; no token required.
 *
 * LAN mode (--lan flag): binds to 0.0.0.0.
 *             • Attempts to generate a self-signed TLS cert via openssl.
 *               If successful, starts an HTTPS server and prints the cert
 *               fingerprint so the user can verify it in the browser.
 *             • Generates a 256-bit single-use access token displayed in the
 *               terminal; every non-root request must carry it via
 *               X-Access-Token header or ?token= query param.
 *             • Falls back to plain HTTP + token if openssl is absent.
 *             Use only on trusted local networks.
 *
 * @param port  TCP port to listen on (default 8765)
 * @param lan   Enable LAN mode (bind 0.0.0.0 + token + optional TLS)
 */
export declare function startSettingsServer(port?: number, lan?: boolean, quiet?: boolean, opts?: {
    onRestartRequested?: () => void;
    onShutdownRequested?: () => void;
}): Promise<{
    scheme: "http" | "https";
    stop: () => Promise<void>;
}>;
//# sourceMappingURL=server.d.ts.map