export interface ProtocolCheck {
    /** The TCP port accepted a connection. */
    reachable: boolean;
    /** STARTTLS + AUTH succeeded. null = not attempted (unreachable, or no creds). */
    authenticated: boolean | null;
    /** Short human-readable failure reason when authenticated === false. */
    error: string | null;
}
export interface ConnectionCheckResult {
    smtp: ProtocolCheck;
    imap: ProtocolCheck;
}
export declare function isAllowedProbeHost(host: unknown): host is string;
/** TCP-only reachability — the port answered a connect(). Refuses any host that
 *  is not localhost / private-LAN (SSRF guard) before opening the socket. */
export declare function tcpReachable(host: string, port: number, timeoutMs?: number): Promise<boolean>;
export declare function probeImap(host: string, port: number, user: string, pass: string, certPath: string, allowInsecure: boolean, timeoutMs?: number): Promise<ProtocolCheck>;
export declare function probeSmtp(host: string, port: number, user: string, pass: string, certPath: string, allowInsecure: boolean, timeoutMs?: number): Promise<ProtocolCheck>;
/** Run both probes. Host/port default to the saved config; credentials + TLS
 *  always come from the saved config/keychain (the form never carries the
 *  password). Pass overrides to test edited-but-unsaved host/port values. */
export declare function checkConnections(opts?: {
    smtpHost?: string;
    smtpPort?: number;
    imapHost?: string;
    imapPort?: number;
}): Promise<ConnectionCheckResult>;
//# sourceMappingURL=connection-check.d.ts.map