/**
 * Cross-package contract for the framework-owned ClickHouse identities —
 * one SQL user per control-plane workload class, so no two classes ever
 * contend for the same per-user concurrency cap.
 *
 * | identity             | holder(s)                              | rights                                   |
 * | -------------------- | -------------------------------------- | ---------------------------------------- |
 * | `schemaAdmin.name`   | migration task (XML, `ddl_admin`)      | full DDL; cap 1 = DDL single-flight      |
 * | `fjall_schema_gate`  | materialised gate container            | `readonly=2`, SELECT on `_schema_migrations` only; NO per-user cap |
 * | `fjall_maintenance`  | backup + optimise sidecars             | today's `ddl_admin` numbers (cap 1); OPTIMIZE / BACKUP / RESTORE / scratch DROP |
 *
 * Producer: `ClickHouseDatabase` mints a Secrets-Manager password per
 * framework identity (OUTSIDE the customer `managedPasswords` set — these
 * secrets are never injected into the ClickHouse service container, so
 * adopting them changes no ClickHouse task definition) and
 * `getMigrationContributions()` emits `CLICKHOUSE_FRAMEWORK_USERS` (a
 * JSON-stringified array of the names below) plus a `USER_<NAME>_PASSWORD`
 * import per identity on the migration task.
 *
 * Consumer: `@fjall/clickhouse § provisionFrameworkUsersFromEnv` runs as
 * `schemaAdmin` from the pre-scale-up lifecycle hook — ordered ahead of every
 * gate and sidecar — and issues the idempotent CREATE / ALTER / GRANT set for
 * each identity, so the identities exist before anything authenticates as
 * them. SQL-provisioned (not `users.xml`) deliberately: no ClickHouse
 * restart, no `SYSTEM RELOAD USERS` race, zero outage on adoption.
 *
 * Coupled values — must move together per the shared-source-at-two-occurrences
 * rule.
 */
import { z } from "zod";
/** Read-only identity the materialised schema gate authenticates as. */
export declare const FJALL_SCHEMA_GATE_USER: "fjall_schema_gate";
/** Identity the backup + optimise maintenance sidecars authenticate as. */
export declare const FJALL_MAINTENANCE_USER: "fjall_maintenance";
/**
 * Every framework-owned identity, in provisioning order. Derive from this —
 * never re-list the names — so a new workload class lands in the manifest,
 * the reserved-name validator, and the provisioning loop at once.
 */
export declare const FJALL_CLICKHOUSE_USERS: readonly ["fjall_schema_gate", "fjall_maintenance"];
export type FjallClickHouseUser = (typeof FJALL_CLICKHOUSE_USERS)[number];
/**
 * Prefix reserved for framework identities. `ClickHouseDatabase` throws at
 * synth when a customer `schemaAdmin.name` or `managedPasswords` entry
 * starts with it, so a customer user can never collide with (or be silently
 * re-provisioned as) a framework identity.
 */
export declare const FJALL_CLICKHOUSE_USER_PREFIX: "fjall_";
export declare function isReservedClickHouseUserName(name: string): boolean;
/**
 * Container env var name carrying the JSON-stringified manifest of framework
 * identities to provision. Sibling to `CLICKHOUSE_MANAGED_USERS` (customer
 * users); kept separate because the two sets differ in ownership — the
 * framework decides its identities' rights, customer SQL decides the managed
 * users' profiles.
 */
export declare const CLICKHOUSE_FRAMEWORK_USERS_ENV: "CLICKHOUSE_FRAMEWORK_USERS";
/**
 * Container env var name carrying the settings-profile name the maintenance
 * identity binds to — the construct contributes `schemaAdmin.profile` (the
 * `ddl_admin` profile at the resolved instance's scale), so
 * `fjall_maintenance` inherits today's memory / execution caps and tracks
 * instance resizes without the runner knowing any numbers. The runner pins
 * `max_concurrent_queries_for_user = 1 CONST` on top: a bare setting is a
 * default the session can override, only `CONST` makes the cap binding.
 */
export declare const CLICKHOUSE_MAINTENANCE_PROFILE_ENV: "CLICKHOUSE_MAINTENANCE_PROFILE";
export declare const FrameworkUserNameSchema: z.ZodString & z.ZodType<"fjall_schema_gate" | "fjall_maintenance", string, z.core.$ZodTypeInternals<"fjall_schema_gate" | "fjall_maintenance", string>>;
export type FrameworkUserName = z.infer<typeof FrameworkUserNameSchema>;
export declare const FrameworkUserNamesSchema: z.ZodArray<z.ZodString & z.ZodType<"fjall_schema_gate" | "fjall_maintenance", string, z.core.$ZodTypeInternals<"fjall_schema_gate" | "fjall_maintenance", string>>>;
export type FrameworkUserNames = z.infer<typeof FrameworkUserNamesSchema>;
/**
 * Scratch database the backup sidecar restores into to verify a backup, and
 * the only database `fjall_maintenance` may DROP. Coupled across the
 * construct (backup script, IAM) and `@fjall/clickhouse` (the GRANT set) —
 * a drift would grant DROP on a database the script never touches while the
 * one it does touch fails with `ACCESS_DENIED`.
 */
export declare const CLICKHOUSE_BACKUP_SCRATCH_DATABASE: "fjall_backup_verify";