import type { ClickHouseClient } from "@clickhouse/client";
import { type FjallClickHouseUser } from "./constants.js";
import type { MigrationLogger } from "./logger.js";
export interface ProvisionFrameworkUsersFromEnvOpts {
    client: ClickHouseClient;
    /**
     * Database whose audit table the gate reads and whose tables the
     * maintenance identity may OPTIMIZE / BACKUP. Defaults to env
     * `CLICKHOUSE_DATABASE`; absent on both → fails closed (a GRANT on the
     * wrong database is a silent misconfiguration).
     */
    database?: string;
    signal?: AbortSignal;
    logger?: MigrationLogger;
    env?: NodeJS.ProcessEnv;
}
export interface ProvisionFrameworkUsersFromEnvResult {
    provisioned: readonly FjallClickHouseUser[];
}
/**
 * Provisions the framework-owned ClickHouse identities (`fjall_schema_gate`,
 * `fjall_maintenance`) from the migration task, running as the XML schema
 * admin. Sibling of `provisionUsersFromEnv` (customer users): reads the
 * manifest from `CLICKHOUSE_FRAMEWORK_USERS`, each password from
 * `USER_<NAME>_PASSWORD`, and the maintenance profile from
 * `CLICKHOUSE_MAINTENANCE_PROFILE`.
 *
 * An absent manifest is NOT an error — constructs older than the framework
 * identities emit no manifest, and a runner image ahead of its constructs
 * must still migrate. Every other missing input fails closed BEFORE the
 * first statement, naming the env (never the value).
 *
 * Idempotent: `CREATE USER IF NOT EXISTS` → `ALTER USER … SETTINGS <complete
 * list>` → `GRANT …`, each safe to re-run. Failures carry the
 * `classifyClickHouseError` verdict so the runner's forensic log reads
 * `denied 497` rather than raw text.
 */
export declare function provisionFrameworkUsersFromEnv(opts: ProvisionFrameworkUsersFromEnvOpts): Promise<ProvisionFrameworkUsersFromEnvResult>;