import ItemsService from "./ItemsService.js";
import type { TenantSettings } from '../types/index.js';
declare class SettingsService {
    private globalSettings;
    constructor();
    /**
     * Get cache instance
     */
    getCache(): import("../utils/cache.js").CacheInterface;
    loadGlobalSettings(): Promise<void>;
    loadSettings(): Promise<void>;
    createDefaultGlobalSettings(itemsService: ItemsService): Promise<TenantSettings>;
    createDefaultSettings(itemsService: ItemsService): Promise<TenantSettings>;
    getGlobalSettings(): TenantSettings;
    getSettings(): TenantSettings;
    /**
     * Get tenant-specific settings: global base + tenant overrides
     */
    getTenantSettings(tenantId: string | number): Promise<TenantSettings>;
    updateGlobalSettings(data: Partial<TenantSettings>, accountability?: any): Promise<TenantSettings>;
    updateSettings(data: Partial<TenantSettings>, accountability?: any): Promise<TenantSettings>;
    updateTenantSettings(tenantId: string | number, data: Partial<TenantSettings>, accountability?: any): Promise<TenantSettings>;
    deleteTenantSettings(tenantId: string | number, accountability?: any): Promise<void>;
    /**
     * Get SMTP configuration for tenant with fallback hierarchy
     */
    getTenantSMTPConfig(tenantId: string | number): Promise<any | null>;
    /**
     * Get email branding for tenant
     */
    getTenantEmailBranding(tenantId: string | number): Promise<any>;
    /**
     * Get tenant branding configuration
     */
    getTenantBranding(tenantId: string | number): Promise<any>;
    /**
     * Public/client-safe settings fields. The public settings endpoints return ONLY
     * these (an allow-list, not a deny-list) so a newly-added setting — a secret API
     * key, an internal flag, etc. — is never accidentally exposed. This covers
     * branding, identity, localization, logos, and the public session-limit hints.
     */
    private static readonly PUBLIC_SETTINGS_FIELDS;
    /**
     * Sanitize settings for public exposure.
     *
     * Allow-list: return only known client-safe fields. This is strictly safer than
     * the previous deny-list (which removed only SMTP fields and leaked everything
     * else, including `metadata`, `modules`, `session_limit_roles`, and any future
     * secret-bearing key).
     */
    sanitizeSettings(settings: TenantSettings | null): TenantSettings | null;
    /**
     * Cache management
     */
    invalidateTenantCache(tenantId: string | number): Promise<void>;
    invalidateAllCaches(): Promise<void>;
    getProjectInfo(tenantId?: string | number | null): Promise<any>;
    /**
     * Get settings by matching app_url
     */
    getSettingsByAppUrl(appUrl: string): Promise<TenantSettings>;
    /**
     * Get all unique URLs from global and tenant settings for CORS/auth whitelist
     */
    getAllSettingsUrls(): Promise<string[]>;
}
declare global {
    var __baasix_settingsService: SettingsService | undefined;
}
declare const settingsService: SettingsService;
export default settingsService;
//# sourceMappingURL=SettingsService.d.ts.map