@fjall/components-infrastructure 0.100.0 → 1.1.0

package/dist/lib/resources/aws/analytics/clickhouseAlarms.js

@@ -1,140 +0,0 @@
-import { Duration } from "aws-cdk-lib";
-import { Alarm, ComparisonOperator, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
-import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
-import { Metric } from "aws-cdk-lib/aws-cloudwatch";
-import { FilterPattern, MetricFilter } from "aws-cdk-lib/aws-logs";
-import { ALARM_DEFAULTS, registerAlarm, buildAlarmDescription } from "../monitoring/alarmDefaults.js";
-const CLICKHOUSE_METRIC_NAMESPACE = "Fjall/ClickHouse";
-/**
- * Single-node ClickHouse posture alarms. Covers host-level CPU + (optional)
- * memory and disk via the CloudWatch Agent metric namespace `CWAgent`, plus
- * two log-driven alarms:
- *
- * - **Stuck merges** — `client.ts` polls `system.merges` every 5 min and logs
- *   `serverLogger.warn("ClickHouse", "Stuck merge detected")` when elapsed
- *   exceeds 30 min. The metric filter on the webapp log group emits a count
- *   metric per match; the alarm fires on Sum >= 1 over 5 min × 2 evaluations.
- * - **Backup failures** — `AccessDenied` or `S3Exception` from the backup
- *   task's BACKUP DATABASE TO S3 statement. Closes the silent-failure mode
- *   that masked the original IAM-grant misconfiguration (see
- *   `designs/2026-04-27-clickhouse-backup-iam-role.md`).
- */
-export function createClickHouseAlarms(props) {
-    const { scope, asg, alarmTopic, webappLogGroup, backupTaskLogGroup, config = {} } = props;
-    const alarms = [];
-    const snsAction = new SnsAction(alarmTopic);
-    const asgName = asg.autoScalingGroupName;
-    const cpuAlarm = new Alarm(scope, "ClickHouseCpuAlarm", {
-        alarmDescription: buildAlarmDescription("ClickHouse host CPU utilisation exceeds threshold", undefined),
-        metric: new Metric({
-            namespace: "AWS/EC2",
-            metricName: "CPUUtilization",
-            dimensionsMap: { AutoScalingGroupName: asgName },
-            period: ALARM_DEFAULTS.EVALUATION_PERIOD,
-            statistic: "Average"
-        }),
-        threshold: config.cpuThreshold ?? 90,
-        evaluationPeriods: 3,
-        datapointsToAlarm: 2,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
-        treatMissingData: TreatMissingData.NOT_BREACHING
-    });
-    registerAlarm(cpuAlarm, snsAction, alarms);
-    const memoryAlarm = new Alarm(scope, "ClickHouseMemoryAlarm", {
-        alarmDescription: buildAlarmDescription("ClickHouse host memory utilisation exceeds threshold (CWAgent)", undefined),
-        metric: new Metric({
-            namespace: "CWAgent",
-            metricName: "mem_used_percent",
-            dimensionsMap: { AutoScalingGroupName: asgName },
-            period: ALARM_DEFAULTS.EVALUATION_PERIOD,
-            statistic: "Average"
-        }),
-        threshold: config.memoryThreshold ?? 80,
-        evaluationPeriods: 3,
-        datapointsToAlarm: 2,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
-        treatMissingData: TreatMissingData.NOT_BREACHING
-    });
-    registerAlarm(memoryAlarm, snsAction, alarms);
-    const diskWarnAlarm = new Alarm(scope, "ClickHouseDiskWarnAlarm", {
-        alarmDescription: buildAlarmDescription("ClickHouse data volume above 70% used — plan growth response", undefined),
-        metric: new Metric({
-            namespace: "CWAgent",
-            metricName: "disk_used_percent",
-            dimensionsMap: { AutoScalingGroupName: asgName },
-            period: Duration.minutes(15),
-            statistic: "Average"
-        }),
-        threshold: config.diskWarnThreshold ?? 70,
-        evaluationPeriods: 2,
-        datapointsToAlarm: 2,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
-        treatMissingData: TreatMissingData.NOT_BREACHING
-    });
-    registerAlarm(diskWarnAlarm, snsAction, alarms);
-    const diskCriticalAlarm = new Alarm(scope, "ClickHouseDiskCriticalAlarm", {
-        alarmDescription: buildAlarmDescription("ClickHouse data volume above 85% used — imminent insert failures", undefined),
-        metric: new Metric({
-            namespace: "CWAgent",
-            metricName: "disk_used_percent",
-            dimensionsMap: { AutoScalingGroupName: asgName },
-            period: Duration.minutes(5),
-            statistic: "Average"
-        }),
-        threshold: config.diskCriticalThreshold ?? 85,
-        evaluationPeriods: 2,
-        datapointsToAlarm: 2,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
-        treatMissingData: TreatMissingData.NOT_BREACHING
-    });
-    registerAlarm(diskCriticalAlarm, snsAction, alarms);
-    const stuckMergeMetricName = "ClickHouseStuckMergeCount";
-    new MetricFilter(scope, "ClickHouseStuckMergeMetricFilter", {
-        logGroup: webappLogGroup,
-        metricNamespace: CLICKHOUSE_METRIC_NAMESPACE,
-        metricName: stuckMergeMetricName,
-        filterPattern: FilterPattern.literal('"Stuck merge detected"'),
-        metricValue: "1",
-        defaultValue: 0
-    });
-    const stuckMergeAlarm = new Alarm(scope, "ClickHouseStuckMergeAlarm", {
-        alarmDescription: buildAlarmDescription("ClickHouse merge stuck > 30 min — investigate parts pressure or replica health", undefined),
-        metric: new Metric({
-            namespace: CLICKHOUSE_METRIC_NAMESPACE,
-            metricName: stuckMergeMetricName,
-            period: Duration.minutes(5),
-            statistic: "Sum"
-        }),
-        threshold: 1,
-        evaluationPeriods: 2,
-        datapointsToAlarm: 2,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
-        treatMissingData: TreatMissingData.NOT_BREACHING
-    });
-    registerAlarm(stuckMergeAlarm, snsAction, alarms);
-    const backupFailureMetricName = "ClickHouseBackupFailureCount";
-    new MetricFilter(scope, "ClickHouseBackupFailureMetricFilter", {
-        logGroup: backupTaskLogGroup,
-        metricNamespace: CLICKHOUSE_METRIC_NAMESPACE,
-        metricName: backupFailureMetricName,
-        filterPattern: FilterPattern.anyTerm("AccessDenied", "S3Exception"),
-        metricValue: "1",
-        defaultValue: 0
-    });
-    const backupFailureAlarm = new Alarm(scope, "ClickHouseBackupFailureAlarm", {
-        alarmDescription: buildAlarmDescription("ClickHouse BACKUP TO S3 emitted AccessDenied/S3Exception — verify ASG instance role grant on backup bucket", undefined),
-        metric: new Metric({
-            namespace: CLICKHOUSE_METRIC_NAMESPACE,
-            metricName: backupFailureMetricName,
-            period: Duration.hours(1),
-            statistic: "Sum"
-        }),
-        threshold: 1,
-        evaluationPeriods: 1,
-        datapointsToAlarm: 1,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
-        treatMissingData: TreatMissingData.NOT_BREACHING
-    });
-    registerAlarm(backupFailureAlarm, snsAction, alarms);
-    return alarms;
-}

package/dist/lib/resources/aws/analytics/clickhouseConstants.d.ts

@@ -1,73 +0,0 @@
-/** Cluster/task family name used for ECS resources. */
-export declare const CLICKHOUSE_CLUSTER_NAME = "clickhouse-analytics";
-/** Default EC2 instance type for ClickHouse (Graviton — best cost/performance). */
-export declare const DEFAULT_CLICKHOUSE_INSTANCE_TYPE = "t4g.medium";
-/** ClickHouse container image. */
-export declare const CLICKHOUSE_IMAGE = "clickhouse/clickhouse-server:26.3-alpine";
-/** EBS volume configuration. */
-export declare const CLICKHOUSE_EBS_VOLUME_SIZE_GB = 80;
-export declare const CLICKHOUSE_EBS_IOPS = 3000;
-export declare const CLICKHOUSE_EBS_THROUGHPUT_MBPS = 125;
-/** ECS task resource allocation (t4g.medium = 4 GB total). */
-export declare const CLICKHOUSE_TASK_MEMORY_MIB = 3072;
-export declare const CLICKHOUSE_TASK_CPU_UNITS = 1024;
-/** ClickHouse ports. */
-export declare const CLICKHOUSE_HTTP_PORT = 8123;
-export declare const CLICKHOUSE_NATIVE_PORT = 9000;
-export declare const CLICKHOUSE_PROMETHEUS_PORT = 9363;
-/** EBS device name for the data volume (must match user data script). */
-export declare const CLICKHOUSE_EBS_DEVICE_NAME = "/dev/xvdf";
-/** EBS mount path on the EC2 host. */
-export declare const CLICKHOUSE_DATA_MOUNT_PATH = "/mnt/clickhouse-data";
-/** Secrets Manager path prefix. */
-export declare const CLICKHOUSE_SECRETS_PREFIX = "fjall/clickhouse";
-/** Secret names (under the prefix). */
-export declare const CLICKHOUSE_SECRET_NAMES: {
-    readonly APP_PASSWORD: "app-password";
-    readonly AUDIT_PASSWORD: "audit-password";
-    readonly BACKUP_PASSWORD: "backup-password";
-    readonly SCHEMA_PASSWORD: "schema-password";
-};
-/** Shared secret generation options (all ClickHouse users share the same policy). */
-export declare const CLICKHOUSE_SECRET_OPTIONS: {
-    readonly excludePunctuation: true;
-    readonly passwordLength: 32;
-};
-/** Health check configuration. */
-export declare const CLICKHOUSE_HEALTH_CHECK: {
-    readonly INTERVAL_SECONDS: 30;
-    readonly TIMEOUT_SECONDS: 5;
-    readonly RETRIES: 3;
-    readonly START_PERIOD_SECONDS: 60;
-};
-/** OPTIMIZE TABLE FINAL schedule.
- *  RMT tables carry min_age_to_force_merge_seconds=600 so the engine already merges
- *  old parts within 10 min; this task is a safety net for MVs (no engine-level setting)
- *  and for ReplacingMergeTree dedup under skewed write patterns. 6 hours is sufficient. */
-export declare const OPTIMISE_FINAL_SCHEDULE = "rate(6 hours)";
-/** Tables requiring periodic OPTIMIZE FINAL (ReplacingMergeTree only).
- *  Keep in sync with REPLACING_MERGE_TREE_TABLES in
- *  webapp/app/.server/lib/clickhouse/tenantQuery.ts (auto-FINAL). */
-export declare const REPLACING_MERGE_TREE_TABLES: readonly ["application_metrics", "cost_records", "log_fingerprints", "insights", "asset_inventory"];
-/** Subdirectory on the EBS volume for server config files (must match CDK volume mount). */
-export declare const CLICKHOUSE_CONFIG_SUBDIR = "server-config.d";
-/** Subdirectory on the EBS volume for users config files (must match CDK volume mount). */
-export declare const CLICKHOUSE_USERS_SUBDIR = "server-users.d";
-/** Cloud Map namespace for ClickHouse service discovery. */
-export declare const CLICKHOUSE_CLOUDMAP_NAMESPACE = "clickhouse.local";
-/** Cloud Map service name (resolves to clickhouse.clickhouse.local). */
-export declare const CLICKHOUSE_CLOUDMAP_SERVICE_NAME = "clickhouse";
-/** Materialised views that benefit from periodic OPTIMIZE to reduce part count at read time.
- *  These are not ReplacingMergeTree (no dedup needed) but un-merged parts force
- *  read-time aggregation which degrades query performance. */
-export declare const OPTIMISE_MV_TABLES: readonly ["metrics_hourly_mv", "metrics_daily_mv", "response_time_quantiles_hourly_mv", "deployment_duration_quantiles_daily_mv", "log_severity_hourly_mv", "compliance_score_daily_mv", "ai_usage_daily_mv", "finding_daily_aggregate", "insight_pattern_dismissals"];
-/** Resource allocation for the lightweight optimise task. */
-export declare const OPTIMISE_TASK_MEMORY_MIB = 256;
-export declare const OPTIMISE_TASK_CPU_UNITS = 256;
-/** Automated backup schedule (daily 03:00 UTC — low-traffic window). */
-export declare const BACKUP_SCHEDULE = "cron(0 3 * * ? *)";
-/** Resource allocation for the backup task (lightweight — clickhouse-client only). */
-export declare const BACKUP_TASK_MEMORY_MIB = 256;
-export declare const BACKUP_TASK_CPU_UNITS = 256;
-/** Backup object expiration: 14 days (retains 14 daily snapshots). */
-export declare const BACKUP_RETENTION_DAYS = 14;

package/dist/lib/resources/aws/analytics/clickhouseConstants.js

@@ -1,89 +0,0 @@
-/** Cluster/task family name used for ECS resources. */
-export const CLICKHOUSE_CLUSTER_NAME = "clickhouse-analytics";
-/** Default EC2 instance type for ClickHouse (Graviton — best cost/performance). */
-export const DEFAULT_CLICKHOUSE_INSTANCE_TYPE = "t4g.medium";
-/** ClickHouse container image. */
-export const CLICKHOUSE_IMAGE = "clickhouse/clickhouse-server:26.3-alpine";
-/** EBS volume configuration. */
-export const CLICKHOUSE_EBS_VOLUME_SIZE_GB = 80;
-export const CLICKHOUSE_EBS_IOPS = 3000;
-export const CLICKHOUSE_EBS_THROUGHPUT_MBPS = 125;
-/** ECS task resource allocation (t4g.medium = 4 GB total). */
-export const CLICKHOUSE_TASK_MEMORY_MIB = 3072;
-export const CLICKHOUSE_TASK_CPU_UNITS = 1024;
-/** ClickHouse ports. */
-export const CLICKHOUSE_HTTP_PORT = 8123;
-export const CLICKHOUSE_NATIVE_PORT = 9000;
-export const CLICKHOUSE_PROMETHEUS_PORT = 9363;
-/** EBS device name for the data volume (must match user data script). */
-export const CLICKHOUSE_EBS_DEVICE_NAME = "/dev/xvdf";
-/** EBS mount path on the EC2 host. */
-export const CLICKHOUSE_DATA_MOUNT_PATH = "/mnt/clickhouse-data";
-/** Secrets Manager path prefix. */
-export const CLICKHOUSE_SECRETS_PREFIX = "fjall/clickhouse";
-/** Secret names (under the prefix). */
-export const CLICKHOUSE_SECRET_NAMES = {
-    APP_PASSWORD: "app-password",
-    AUDIT_PASSWORD: "audit-password",
-    BACKUP_PASSWORD: "backup-password",
-    SCHEMA_PASSWORD: "schema-password"
-};
-/** Shared secret generation options (all ClickHouse users share the same policy). */
-export const CLICKHOUSE_SECRET_OPTIONS = {
-    excludePunctuation: true,
-    passwordLength: 32
-};
-/** Health check configuration. */
-export const CLICKHOUSE_HEALTH_CHECK = {
-    INTERVAL_SECONDS: 30,
-    TIMEOUT_SECONDS: 5,
-    RETRIES: 3,
-    START_PERIOD_SECONDS: 60
-};
-/** OPTIMIZE TABLE FINAL schedule.
- *  RMT tables carry min_age_to_force_merge_seconds=600 so the engine already merges
- *  old parts within 10 min; this task is a safety net for MVs (no engine-level setting)
- *  and for ReplacingMergeTree dedup under skewed write patterns. 6 hours is sufficient. */
-export const OPTIMISE_FINAL_SCHEDULE = "rate(6 hours)";
-/** Tables requiring periodic OPTIMIZE FINAL (ReplacingMergeTree only).
- *  Keep in sync with REPLACING_MERGE_TREE_TABLES in
- *  webapp/app/.server/lib/clickhouse/tenantQuery.ts (auto-FINAL). */
-export const REPLACING_MERGE_TREE_TABLES = [
-    "application_metrics",
-    "cost_records",
-    "log_fingerprints",
-    "insights",
-    "asset_inventory"
-];
-/** Subdirectory on the EBS volume for server config files (must match CDK volume mount). */
-export const CLICKHOUSE_CONFIG_SUBDIR = "server-config.d";
-/** Subdirectory on the EBS volume for users config files (must match CDK volume mount). */
-export const CLICKHOUSE_USERS_SUBDIR = "server-users.d";
-/** Cloud Map namespace for ClickHouse service discovery. */
-export const CLICKHOUSE_CLOUDMAP_NAMESPACE = "clickhouse.local";
-/** Cloud Map service name (resolves to clickhouse.clickhouse.local). */
-export const CLICKHOUSE_CLOUDMAP_SERVICE_NAME = "clickhouse";
-/** Materialised views that benefit from periodic OPTIMIZE to reduce part count at read time.
- *  These are not ReplacingMergeTree (no dedup needed) but un-merged parts force
- *  read-time aggregation which degrades query performance. */
-export const OPTIMISE_MV_TABLES = [
-    "metrics_hourly_mv",
-    "metrics_daily_mv",
-    "response_time_quantiles_hourly_mv",
-    "deployment_duration_quantiles_daily_mv",
-    "log_severity_hourly_mv",
-    "compliance_score_daily_mv",
-    "ai_usage_daily_mv",
-    "finding_daily_aggregate",
-    "insight_pattern_dismissals"
-];
-/** Resource allocation for the lightweight optimise task. */
-export const OPTIMISE_TASK_MEMORY_MIB = 256;
-export const OPTIMISE_TASK_CPU_UNITS = 256;
-/** Automated backup schedule (daily 03:00 UTC — low-traffic window). */
-export const BACKUP_SCHEDULE = "cron(0 3 * * ? *)";
-/** Resource allocation for the backup task (lightweight — clickhouse-client only). */
-export const BACKUP_TASK_MEMORY_MIB = 256;
-export const BACKUP_TASK_CPU_UNITS = 256;
-/** Backup object expiration: 14 days (retains 14 daily snapshots). */
-export const BACKUP_RETENTION_DAYS = 14;

package/dist/lib/resources/aws/analytics/clickhouseSecurityGroup.d.ts

@@ -1,13 +0,0 @@
-import { type ISecurityGroup, type IVpc } from "aws-cdk-lib/aws-ec2";
-import type { Construct } from "constructs";
-import { SecurityGroup } from "../networking/securityGroup.js";
-/**
- * Creates the ClickHouse security group.
- *
- * Inbound:
- *   - TCP 8123 from webapp ECS service SG (HTTP queries)
- *
- * Outbound:
- *   - HTTPS 443 to 0.0.0.0/0 (R2 endpoint + Secrets Manager)
- */
-export declare function createClickHouseSecurityGroup(scope: Construct, vpc: IVpc, webappSecurityGroup: ISecurityGroup): SecurityGroup;

package/dist/lib/resources/aws/analytics/clickhouseSecurityGroup.js

@@ -1,28 +0,0 @@
-import { Peer, Port } from "aws-cdk-lib/aws-ec2";
-import { SecurityGroup } from "../networking/securityGroup.js";
-import { CLICKHOUSE_HTTP_PORT, CLICKHOUSE_NATIVE_PORT } from "./clickhouseConstants.js";
-/**
- * Creates the ClickHouse security group.
- *
- * Inbound:
- *   - TCP 8123 from webapp ECS service SG (HTTP queries)
- *
- * Outbound:
- *   - HTTPS 443 to 0.0.0.0/0 (R2 endpoint + Secrets Manager)
- */
-export function createClickHouseSecurityGroup(scope, vpc, webappSecurityGroup) {
-    const sg = new SecurityGroup(scope, "ClickHouseSecurityGroup", {
-        vpc,
-        description: "Security group for ClickHouse analytics instance",
-        allowAllOutbound: false
-    });
-    // Inbound: HTTP API from webapp
-    sg.addIngressRule(webappSecurityGroup, Port.tcp(CLICKHOUSE_HTTP_PORT), "ClickHouse HTTP API from webapp ECS service");
-    // Inbound: Native protocol from optimise scheduled task (same SG, self-referencing)
-    sg.addIngressRule(sg, Port.tcp(CLICKHOUSE_NATIVE_PORT), "ClickHouse native protocol from optimise task");
-    // Outbound: HTTPS for R2 cold storage and Secrets Manager
-    sg.addEgressRule(Peer.anyIpv4(), Port.tcp(443), "HTTPS to R2 and Secrets Manager endpoints");
-    // Outbound: Native protocol to ClickHouse (optimise task connection)
-    sg.addEgressRule(sg, Port.tcp(CLICKHOUSE_NATIVE_PORT), "ClickHouse native protocol for optimise task");
-    return sg;
-}

package/dist/lib/resources/aws/analytics/clickhouseTypes.d.ts

@@ -1,59 +0,0 @@
-import type { IVpc, ISecurityGroup } from "aws-cdk-lib/aws-ec2";
-import type { ILogGroup } from "aws-cdk-lib/aws-logs";
-import type { IBucket } from "aws-cdk-lib/aws-s3";
-import type { ISecret } from "aws-cdk-lib/aws-secretsmanager";
-import type { ITopic } from "aws-cdk-lib/aws-sns";
-/** Props for the ClickHouse CDK construct. */
-export interface ClickHouseProps {
-    /** VPC to deploy into. */
-    vpc: IVpc;
-    /**
-     * EC2 instance type for ClickHouse.
-     * Overridden by CDK context parameter `clickhouseInstanceType` if set.
-     * Default: t4g.medium (4 GB RAM).
-     */
-    instanceType?: string;
-    /**
-     * Security group of the webapp ECS service.
-     * Used to allow inbound HTTP (8123) from the webapp.
-     */
-    webappSecurityGroup: ISecurityGroup;
-    /**
-     * R2 configuration for cold storage.
-     * If omitted, tiered storage is disabled (local-only).
-     */
-    r2Config?: ClickHouseR2Config;
-    /**
-     * SNS topic for CloudWatch alarms (CPU, memory, disk, stuck merges).
-     * If omitted, posture alarms are not created.
-     */
-    alarmTopic?: ITopic;
-    /**
-     * Webapp log group, required when `alarmTopic` is set so the stuck-merge
-     * metric filter can read the structured warning emitted by `client.ts`.
-     */
-    webappLogGroup?: ILogGroup;
-}
-/** Cloudflare R2 configuration for tiered storage and backups. */
-export interface ClickHouseR2Config {
-    /** Cloudflare account ID. */
-    accountId: string;
-    /** R2 access key (stored in Secrets Manager). */
-    accessKeySecret: ISecret;
-    /** R2 secret key (stored in Secrets Manager). */
-    secretKeySecret: ISecret;
-}
-/** Outputs from the ClickHouse construct for use by other constructs. */
-export interface ClickHouseOutputs {
-    /** Security group for the ClickHouse instance (for connection rules). */
-    securityGroup: ISecurityGroup;
-    /** S3 bucket for weekly automated backups (for restore operations). */
-    backupBucket: IBucket;
-    /** Secrets Manager secrets for ClickHouse passwords. */
-    secrets: {
-        appPassword: ISecret;
-        auditPassword: ISecret;
-        backupPassword: ISecret;
-        schemaPassword: ISecret;
-    };
-}

package/dist/lib/resources/aws/analytics/clickhouseTypes.js

@@ -1 +0,0 @@
-export {};

package/dist/lib/resources/aws/analytics/clickhouseUserData.d.ts

@@ -1,6 +0,0 @@
-export interface ClickHouseUserDataOptions {
-    /** Cloudflare account ID for R2 cold storage. If omitted, local-only storage is used. */
-    cfAccountId?: string;
-}
-export declare const USERS_CONFIG_XML = "<clickhouse>\n    <users>\n        <default>\n            <networks>\n                <ip>127.0.0.1</ip>\n                <ip>::1</ip>\n            </networks>\n        </default>\n    </users>\n    <profiles>\n        <default>\n            <optimize_move_to_prewhere>1</optimize_move_to_prewhere>\n            <!-- ALTER TABLE ... MODIFY TTL on a 30-day-partitioned table would otherwise\n                 trigger an immediate full-table rewrite (default = 1). On the t4g.medium\n                 box that's a merge-pool starvation event. Keep TTL changes lazy: parts\n                 re-evaluate TTL on their next natural merge, no forced rewrite. -->\n            <materialize_ttl_after_modify>0</materialize_ttl_after_modify>\n        </default>\n        <app_writer>\n            <max_threads>2</max_threads>\n            <max_insert_threads>1</max_insert_threads>\n            <max_concurrent_queries_for_user>4</max_concurrent_queries_for_user>\n            <log_queries_min_query_duration_ms>100</log_queries_min_query_duration_ms>\n            <optimize_move_to_prewhere>1</optimize_move_to_prewhere>\n            <use_query_condition_cache>1</use_query_condition_cache>\n            <!-- Re-enable skip indexes under FINAL (tenantQuery auto-FINALs RMT tables;\n                 default disables idx_aws_account, idx_application, idx_dedup, idx_fingerprint). -->\n            <use_skip_indexes_if_final>1</use_skip_indexes_if_final>\n            <!-- Tenant-isolation guards (ClickHouse PR #91065 fix). Belt-and-braces with the\n                 per-user SQL SETTINGS in 002-users.sql \u2014 keep both so `CREATE OR REPLACE USER`\n                 cannot regress this. Without these flags, FINAL queries on un-merged\n                 ReplacingMergeTree parts can leak across tenants. -->\n            <apply_row_policy_after_final>1</apply_row_policy_after_final>\n            <apply_prewhere_after_final>1</apply_prewhere_after_final>\n            <do_not_merge_across_partitions_select_final>1</do_not_merge_across_partitions_select_final>\n            <async_insert>1</async_insert>\n            <wait_for_async_insert>1</wait_for_async_insert>\n            <async_insert_max_data_size>10000000</async_insert_max_data_size>\n            <!-- Adaptive batching: tune flush window between 50 ms (low-latency rare inserts)\n                 and 2 s (absorbs bursts). A single fixed value is silently overridden by the\n                 adaptive algorithm. -->\n            <async_insert_busy_timeout_min_ms>50</async_insert_busy_timeout_min_ms>\n            <async_insert_busy_timeout_max_ms>2000</async_insert_busy_timeout_max_ms>\n            <async_insert_use_adaptive_busy_timeout>1</async_insert_use_adaptive_busy_timeout>\n            <!-- Server-side deduplication of async inserts. Latent retry safety net:\n                 if a producer retries the same insert window (network hiccup, lambda re-run,\n                 SQS redelivery), the second attempt collapses against the first. As of CH 26.1\n                 this also propagates end-to-end through dependent materialised views \u2014 without\n                 it, a retried insert could double-count in metrics_hourly_mv / log_severity_hourly_mv\n                 even if the base table dedups. CH pin is 26.3 so the propagation fix is in. -->\n            <async_insert_deduplicate>1</async_insert_deduplicate>\n            <input_format_parallel_parsing>0</input_format_parallel_parsing>\n            <output_format_parallel_formatting>0</output_format_parallel_formatting>\n            <!-- Lazy materialisation (CH 25.4+): for `SELECT * ... LIMIT N` shapes the planner\n                 reads only the columns needed to evaluate ORDER BY / WHERE, then fetches the\n                 remaining columns for the surviving N rows. Order-of-magnitude I/O reduction\n                 on dashboard queries (e.g. getLatestMetrics LIMIT 1 BY application_id). -->\n            <query_plan_optimize_lazy_materialization>1</query_plan_optimize_lazy_materialization>\n            <!-- Per-query memory cap (overrides server-wide max_memory_usage of 1 GB\n                 to give app_writer 2 GB headroom). Belt-and-braces with the inline\n                 SETTINGS in 002-users.sql so neither layer can drift alone. -->\n            <max_memory_usage>2000000000</max_memory_usage>\n            <max_memory_usage_for_user>2684354560</max_memory_usage_for_user>\n            <max_bytes_before_external_sort>536870912</max_bytes_before_external_sort>\n            <max_bytes_before_external_group_by>536870912</max_bytes_before_external_group_by>\n            <!-- Per-query caps. Belt-and-braces with the inline SETTINGS in\n                 002-users.sql so `CREATE OR REPLACE USER` cannot regress the bound. -->\n            <max_execution_time>30</max_execution_time>\n            <max_rows_to_read>10000000</max_rows_to_read>\n        </app_writer>\n        <audit_writer>\n            <max_threads>1</max_threads>\n            <max_insert_threads>1</max_insert_threads>\n            <max_concurrent_queries_for_user>2</max_concurrent_queries_for_user>\n            <max_memory_usage>500000000</max_memory_usage>\n            <max_execution_time>10</max_execution_time>\n            <async_insert>1</async_insert>\n            <wait_for_async_insert>1</wait_for_async_insert>\n        </audit_writer>\n        <backup_reader>\n            <max_threads>2</max_threads>\n            <max_concurrent_queries_for_user>1</max_concurrent_queries_for_user>\n            <max_memory_usage>1000000000</max_memory_usage>\n            <max_execution_time>3600</max_execution_time>\n        </backup_reader>\n        <schema_admin>\n            <max_threads>2</max_threads>\n            <max_concurrent_queries_for_user>1</max_concurrent_queries_for_user>\n            <max_memory_usage>1000000000</max_memory_usage>\n            <max_execution_time>1800</max_execution_time>\n        </schema_admin>\n    </profiles>\n    <quotas>\n        <tenant_default>\n            <interval>\n                <duration>3600</duration>\n                <queries>1000</queries>\n                <result_rows>10000000</result_rows>\n            </interval>\n        </tenant_default>\n    </quotas>\n</clickhouse>";
-export declare function generateClickHouseUserData(options?: ClickHouseUserDataOptions): string;