/**
 * Cross-package contract for the ClickHouse managed-users manifest.
 *
 * Producer: `ClickHouseDatabase.getMigrationContributions()` emits the
 * managed-password user names (every entry in the construct's
 * `managedPasswords:` prop — `schemaAdmin.name` is NOT included; the admin
 * is XML-defined in `users_xml` storage which is read-only, so SQL ALTER
 * against it would fail with `ACCESS_STORAGE_READONLY (495)`) as a
 * JSON-stringified array of strings on the migration container's env,
 * plus per-user `USER_<NAME>_PASSWORD` secretsImport entries.
 *
 * Consumer: `@fjall/clickhouse § provisionUsersFromEnv` parses the
 * env, reads each password from `process.env[USER_<NAME>_PASSWORD]` (injected
 * by ECS executionRole — no runtime SDK call), and issues
 * `CREATE USER IF NOT EXISTS … IDENTIFIED WITH sha256_password BY '<pw>'`
 * followed by `ALTER USER …`. Profile binding is NOT performed by the helper
 * — profiles are bound by customer SQL migrations via
 * `ALTER USER <name> SETTINGS PROFILE '<profile>'`.
 *
 * Coupled values — must move together per the shared-source-at-two-occurrences
 * rule. Lives in `@fjall/util` so the runtime Docker image picks the
 * constant + schema up without pulling `aws-cdk-lib`.
 */
import { z } from "zod";
/**
 * Container env var name carrying the JSON-stringified manifest of managed
 * users (just names — no profile binding). Set by
 * `getMigrationContributions()` at synth; consumed by the migration helper at
 * runtime.
 */
export declare const CLICKHOUSE_MANAGED_USERS_ENV: "CLICKHOUSE_MANAGED_USERS";
/**
 * ECS-injected env var name carrying a managed user's plaintext password.
 *
 * Producer: `ClickHouseDatabase.getMigrationContributions()` populates
 * `secretsImport[userPasswordEnvName(name)] = secret.getImport("password")`
 * (the framework wires the executionRole `secretsmanager:GetSecretValue` grant
 * via the standard `secretsImport` path).
 *
 * Consumer: `@fjall/clickhouse § provisionUsersFromEnv` reads
 * `process.env[userPasswordEnvName(name)]` for each entry in the manifest —
 * no runtime SDK call.
 *
 * Coupled values — must move together per the shared-source-at-two-occurrences
 * rule. Single source-of-truth here so a future shape change
 * (`USER_<NAME>_SECRET`, lower-case, prefixed) lands at one site, not three.
 */
export declare function userPasswordEnvName(userName: string): string;
/**
 * Lowercase snake_case name regex. Mirrors the construct's `NAME_PATTERN` at
 * `fjall/components/infrastructure/lib/resources/aws/database/clickhouseSchemas.ts § NAME_PATTERN`.
 * Drift between the two surfaces as a parse failure in the runner.
 */
export declare const MANAGED_USER_NAME_PATTERN: RegExp;
/**
 * One managed user — just the name. Passwords flow via the sibling
 * `USER_<NAME>_PASSWORD` env vars injected by ECS executionRole; profiles
 * flow via customer SQL (`ALTER USER … SETTINGS PROFILE …`), not via this
 * manifest.
 */
export declare const ManagedUserNameSchema: z.ZodString;
export type ManagedUserName = z.infer<typeof ManagedUserNameSchema>;
/**
 * Manifest = ordered array of managed user names. Order matches the
 * construct's `managedPasswords` declaration order so provisioning is
 * deterministic across deploys. `schemaAdmin.name` is NOT included — see
 * the producer note above.
 */
export declare const ManagedUserNamesSchema: z.ZodArray<z.ZodString>;
export type ManagedUserNames = z.infer<typeof ManagedUserNamesSchema>;