/**
 * Decide how to apply a startup / refresh resolve of allowedUsers.
 *
 * Runtime permission (canTalk/canOperate) only matches app-scoped open_ids
 * (`ou_…`). Config may store stable `on_…` / emails that must be resolved each
 * boot. A transient contact API failure used to overwrite the runtime list with
 * `[]`, which fail-closed locks out even the real owner with almost no signal.
 *
 * This module merges the fresh resolve with a last-known-good `raw → ou_` cache,
 * but ONLY per-entry and ONLY when that entry both (a) transient-failed this
 * pass and (b) is still present in the current raw config. That guards against
 * two revival hazards a bare `ou_[]` fallback list would create:
 *   - config swaps owner `on_old → on_new`, contact API blips → `ou_old` would
 *     be resurrected from cache even though the operator removed it;
 *   - an owner is definitively removed from the tenant (errored=false,
 *     resolved=[]) → they would be revived indefinitely.
 * The cache is keyed by raw entry, so an entry no longer in config, or one that
 * resolved definitively-gone, is never reused.
 */
import type { EntryResolveStatus } from '../im/lark/client.js';
export interface AllowedUsersResolveResultLike {
    resolved: string[];
    map: Map<string, string>;
    /** True when contact API hit a transient failure (network / 5xx / rate limit). */
    errored?: boolean;
    /**
     * Per-raw-entry outcome. Entries absent from the map are treated as
     * `definitive` (safest: never revived from cache).
     */
    entryStatus?: Map<string, EntryResolveStatus>;
}
export interface ApplyAllowedUsersResolveInput {
    /** Raw bots.json entries (ou_ / on_ / email). */
    rawEntries: string[];
    /**
     * Last known-good `raw entry → ou_` mapping (persisted sidecar from a prior
     * healthy resolve). Used only as a per-entry fallback for still-configured,
     * transient-failed entries. A plain `raw → ou_` object (JSON-friendly).
     */
    previousResolvedMap: Record<string, string>;
    resolveResult: AllowedUsersResolveResultLike;
}
export interface ApplyAllowedUsersResolveOutput {
    /** Runtime allowlist: `ou_` only, deduped, config order preserved. */
    resolved: string[];
    /**
     * `raw → ou_` map consistent with `resolved` (includes both freshly resolved
     * and cache-recovered entries). Callers persist/assign this as the source of
     * truth so `/revoke` reverse-lookup and the sidecar stay coherent.
     */
    map: Map<string, string>;
    /** True when any runtime entry came from the cache, not this resolve. */
    usedFallback: boolean;
    /**
     * True when config has entries but we could not produce a clean successful
     * resolve (some entry transient-failed and/or the runtime list is degraded).
     * Callers must surface a notice + schedule a retry.
     */
    failed: boolean;
    /** Human-readable notice for logs / owner DM; null when nothing to report. */
    notice: string | null;
}
/**
 * Pure merge of a fresh resolve result + a last-known-good `raw → ou_` cache.
 *
 * Walk raw config in order. For each entry:
 *   - fresh `ou_` from this resolve → use it (authoritative);
 *   - else if this entry transient-failed AND has a cached `ou_` → reuse cache
 *     (marks usedFallback + failed);
 *   - else (definitive miss / no cache / non-resolvable literal) → drop it.
 * Never leaves bare `on_` / emails in the runtime list — those cannot match
 * message senders and would still lock the owner out. Output `map` mirrors the
 * chosen `resolved` set so downstream `/revoke` + sidecar stay consistent.
 */
export declare function applyAllowedUsersResolve(input: ApplyAllowedUsersResolveInput): ApplyAllowedUsersResolveOutput;
//# sourceMappingURL=allowed-users-apply.d.ts.map