/**
 * DB-backed email delivery configuration store (Settings > Email).
 *
 * Storage: a single Document row with `collection = '__email_config__'`,
 * mirroring the AI config-store pattern (`src/ai/config-store.ts`) so no
 * Prisma migration is required.
 *
 * Security invariants:
 *   - API keys and SMTP passwords are encrypted at rest via `encryptSecret`.
 *   - Encrypted values are NEVER returned to the client; handlers serialize
 *     through {@link toPublicEmailConfig} (masked last-4 + has-flags only).
 *   - Sending with these settings requires the provider factory registered by
 *     `@actuate-media/plugin-email` (dependency direction stays plugin → core).
 */
import type { ResolvedEmailProviderSettings } from './sender.js';
export declare const EMAIL_CONFIG_COLLECTION = "__email_config__";
export declare const EMAIL_PROVIDER_KEYS: readonly ["resend", "smtpcom", "ses", "smtp"];
export type EmailProviderKey = (typeof EMAIL_PROVIDER_KEYS)[number];
export declare function isEmailProviderKey(value: unknown): value is EmailProviderKey;
export declare const EMAIL_PROVIDER_LABELS: Record<EmailProviderKey, string>;
/** Persisted shape of the `__email_config__` document (secrets encrypted). */
export interface EmailConfigDocument {
    /** `null` = email is not configured through the admin UI. */
    provider: EmailProviderKey | null;
    /** Default sender address (e.g. `noreply@example.com`). */
    from?: string;
    /** Resend / SMTP.com API key (encrypted at rest). */
    apiKeyEncrypted?: string;
    apiKeyLast4?: string;
    /** SMTP.com sender channel. */
    channel?: string;
    /** Amazon SES region (credentials come from the runtime's AWS env/role). */
    region?: string;
    /** Generic SMTP relay. */
    host?: string;
    port?: number;
    secure?: boolean;
    smtpUser?: string;
    smtpPassEncrypted?: string;
    /** Result of the most recent test send. */
    lastTestStatus?: 'success' | 'failed';
    lastTestedAt?: string;
    lastTestError?: string;
    updatedAt?: string;
    updatedBy?: string;
}
/** Client-safe view: secrets stripped, replaced by masked metadata. */
export interface EmailConfigPublic {
    provider: EmailProviderKey | null;
    from?: string;
    apiKeyLast4?: string;
    hasApiKey: boolean;
    channel?: string;
    region?: string;
    host?: string;
    port?: number;
    secure?: boolean;
    smtpUser?: string;
    hasSmtpPass: boolean;
    lastTestStatus?: 'success' | 'failed';
    lastTestedAt?: string;
    lastTestError?: string;
    updatedAt?: string;
    updatedBy?: string;
}
/** Last 4 chars of a secret for masked display (never the full value). */
export declare function emailKeyLast4(key: string | undefined | null): string | undefined;
/** Read the email config document; `{ provider: null }` when none exists. */
export declare function getEmailConfig(db: unknown): Promise<EmailConfigDocument>;
/**
 * Upsert the email config document. Caller is responsible for auth/role
 * checks. Stamps `updatedAt`/`updatedBy`.
 */
export declare function putEmailConfig(db: unknown, next: EmailConfigDocument, userId: string): Promise<EmailConfigDocument>;
/** Strip secret material for client serialization. */
export declare function toPublicEmailConfig(doc: EmailConfigDocument): EmailConfigPublic;
/**
 * Decrypt the stored config into the plain settings consumed by the provider
 * factory. Returns `null` when no provider is configured or when a required
 * secret cannot be decrypted (wrong/missing `CMS_ENCRYPTION_KEY`) — callers
 * fall back to the env-configured sender rather than sending with bad creds.
 */
export declare function resolveEmailProviderSettings(doc: EmailConfigDocument): Promise<ResolvedEmailProviderSettings | null>;
/** Encrypt a plaintext secret for storage with its masked suffix. */
export declare function encryptEmailSecret(plaintext: string): Promise<{
    encrypted: string;
    last4: string;
}>;
/**
 * Which provider (if any) the environment variables currently configure.
 * Mirrors `resolveEmailConfigFromEnv()` in `@actuate-media/plugin-email` so
 * the Settings UI can tell admins what env-based config exists alongside the
 * DB settings.
 */
export declare function detectEnvEmailProvider(env?: Record<string, string | undefined>): EmailProviderKey | null;
export interface EmailSettingsInput {
    provider?: unknown;
    from?: unknown;
    apiKey?: unknown;
    channel?: unknown;
    region?: unknown;
    host?: unknown;
    port?: unknown;
    secure?: unknown;
    smtpUser?: unknown;
    smtpPass?: unknown;
}
/**
 * Validate a PUT payload against the selected provider's requirements.
 * `hasStoredApiKey`/`hasStoredSmtpPass` let an update keep an existing secret
 * without re-entering it (apiKey omitted = keep, null/'' = clear).
 */
export declare function validateEmailSettingsInput(input: EmailSettingsInput, stored: {
    hasApiKey: boolean;
}): string | null;
//# sourceMappingURL=settings-store.d.ts.map