/**
 * `neotoma agents grants import` — one-shot migration command.
 *
 * Reads the legacy capability registry from
 *   1. `NEOTOMA_AGENT_CAPABILITIES_JSON` (raw JSON string)
 *   2. `NEOTOMA_AGENT_CAPABILITIES_FILE` (path to a JSON file)
 *   3. `config/agent_capabilities.default.json` (repo default)
 * and upserts each entry as an `agent_grant` entity owned by the supplied
 * `--owner-user-id`. The agent_grant entity_type is the new source of
 * truth — see docs/subsystems/agent_attribution_integration.md.
 *
 * Idempotent: rerunning the command after a partial migration finds the
 * existing grant for `(match_sub, match_iss, match_thumbprint)` and
 * updates label / capabilities in place via `correct` observations.
 *
 * Stamps each created or updated grant with
 * `import_source: "env_config"` so the audit history clearly shows the
 * migration origin.
 */
import { type AgentGrant } from "../services/agent_grants.js";
export type ImportOutcome = {
    kind: "created";
    grant: AgentGrant;
    label: string;
} | {
    kind: "updated";
    grant: AgentGrant;
    label: string;
    changed: string[];
} | {
    kind: "skipped";
    reason: string;
    label: string;
};
export interface ImportResult {
    source: "json" | "file" | "default" | "none";
    source_detail?: string;
    total: number;
    created: number;
    updated: number;
    skipped: number;
    outcomes: ImportOutcome[];
}
export interface ImportOptions {
    ownerUserId: string;
    repoRoot?: string;
}
/**
 * Run the migration. The caller is expected to have validated the
 * `ownerUserId` exists; we treat the value as opaque to avoid a heavy
 * users-table dependency from the CLI.
 */
export declare function runAgentsGrantsImport(options: ImportOptions): Promise<ImportResult>;
/**
 * Format an {@link ImportResult} for human-readable CLI output.
 */
export declare function formatImportResult(result: ImportResult): string;
//# sourceMappingURL=agents_grants_import.d.ts.map