/** Returns `true` iff there is at least one admin entry, whether from env
 *  or runtime-added via `/setup admin`. When false, the system has no
 *  admin and service-control commands are blanket denied. */
export declare function isAllowlistConfigured(): boolean;
/** Returns `true` iff (platform, userId) appears in the combined env +
 *  runtime allowlist. */
export declare function isAdmin(platform: string, userId: string | undefined): boolean;
/** Return a copy of the current admin list (env + runtime). For UI display. */
export declare function listAdmins(): Array<{
    platform: string;
    userId: string;
}>;
/** Add an admin at runtime: in-memory immediately + persist to env file so
 *  the next restart still has them. Idempotent — duplicates are skipped.
 *  Returns true if added, false if already present. */
export declare function promoteAdmin(platform: string, userId: string, opts?: {
    actor?: string;
    traceId?: string;
}): Promise<boolean>;
/** Localized denial message. Three cases:
 *    A. No admins at all → "首次部署"，引导查 setup token
 *    B. Admins exist, you're not one → 礼貌拒绝，建议联系部署者
 *    C. (handled in setup-command path) bootstrap token consumable → A 已覆盖
 */
export declare function denialMessage(platform: string, userId: string | undefined): string;
export declare function logStartupResolution(): void;
/** Test-only — reset all state so tests can fully isolate. */
export declare function _resetCache(): void;
//# sourceMappingURL=admin-allowlist.d.ts.map