export declare function allowedUsersCachePath(dataDir: string, larkAppId: string): string;
/** Read the persisted `raw → ou_` cache (ou_ values only). `{}` on any error. */
export declare function readAllowedUsersResolveCache(dataDir: string, larkAppId: string): Record<string, string>;
export interface WriteAllowedUsersCacheOpts {
    /**
     * Fresh `raw → ou_` pairs to upsert (only ou_ values are kept). Callers pass
     * the resolve/mutation result map.
     */
    map: Map<string, string> | Record<string, string>;
    /**
     * Entries to delete from the cache regardless of `map` — e.g. definitively-gone
     * ids (removed from tenant) or a raw entry just revoked. Pruned so a later
     * restart during an API blip can't mark them transient and revive a stale owner.
     */
    deleteEntries?: Iterable<string>;
    /**
     * When provided, the cache is pruned to ONLY these raw keys (plus whatever
     * `map` upserts). Pass the current raw allowedUsers config so keys no longer
     * configured (owner swap) never linger. Omit to merge without pruning.
     */
    retainKeys?: Iterable<string>;
}
/**
 * Persist the `raw → ou_` cache. Merges `map` over the existing cache, deletes
 * `deleteEntries`, and — when `retainKeys` is given — drops every key not in
 * that set. Best-effort; never throws.
 */
export declare function writeAllowedUsersResolveCache(dataDir: string, larkAppId: string, opts: WriteAllowedUsersCacheOpts): void;
//# sourceMappingURL=allowed-users-cache.d.ts.map