/**
 * Shared owner-identity boundary for every Bot onboarding path.
 *
 * An `ou_` open_id is meaningful only to the app that issued/observed it; even
 * `BOTMUX_OWNER_OPEN_ID` belongs to the source `BOTMUX_LARK_APP_ID`. Never copy
 * it into another/new app. Normalize an authenticated source owner before app
 * creation, then validate owner entries through the target app before
 * persisting them. Reject unknown `ou_` values before app creation; target-app
 * network/scope failures remain inconclusive unless the identity is definitively
 * unusable.
 *
 * Keep new Dashboard, interactive, scripted, and Agent-driven onboarding paths
 * on these helpers. A format-only sister path can otherwise reintroduce the
 * same lockout while every existing onboarding regression test remains green.
 */
import { type Brand } from '../im/lark/lark-hosts.js';
/**
 * Validate an open_id with the app that is supposed to own it. Prefer the
 * cross-app-stable union_id; never preserve an open_id the app cannot prove.
 */
export declare function resolveScannerAllowedUser(appId: string, appSecret: string, openId: string, brand?: Brand): Promise<string | undefined>;
/**
 * Resolve the verified Open Platform session email into a stable owner entry.
 * An inconclusive request keeps the verified email for runtime retry; a clean
 * empty response proves the account is not addressable in this tenant.
 */
export declare function resolveSessionEmailAllowedUser(appId: string, appSecret: string, email: string, brand?: Brand): Promise<string | undefined>;
/**
 * Best-effort detection of owner entries that are definitively unusable by the
 * target app. Transient/scope errors remain inconclusive and are not rejected.
 */
export declare function detectUnusableOwnerEntries(appId: string, appSecret: string, brand: Brand, entries: string[]): Promise<string[]>;
export interface ManagedOwnerContext {
    sourceAppId?: string;
    sourceOwnerOpenId?: string;
    creatingApp: boolean;
    targetAppId?: string;
}
/**
 * A managed Agent sees the daemon-frozen session owner as an app-scoped
 * BOTMUX_OWNER_OPEN_ID. This is not the current-turn sender. When the Agent
 * creates/configures another bot, copying that ou_ verbatim locks the owner
 * out. Convert only that exact injected identity through the source app; leave
 * explicitly supplied co-owners untouched.
 */
export declare function normalizeManagedOwnerEntries(rawAllowedUsers: string | undefined, context: ManagedOwnerContext, resolveStableOwner: (sourceAppId: string, sourceOwnerOpenId: string) => Promise<string | undefined>): Promise<string | undefined>;
//# sourceMappingURL=owner-identity.d.ts.map