type LivePostgresRoleInspector = () => Promise<{
    rolname: string;
    rolsuper: boolean;
    rolbypassrls: boolean;
} | null>;
declare function setLivePostgresRoleInspectorForTests(inspect: LivePostgresRoleInspector | null): void;
/**
 * After the runtime pool is open, refuse rolsuper / rolbypassrls whenever
 * TENANCY_DRIVER=rls, including local. Fail closed if the live query cannot run.
 * MIGRATION_DATABASE_URL may stay a superuser.
 */
declare function assertRlsLiveDatabaseRole(env?: Record<string, string | undefined>, inspect?: LivePostgresRoleInspector): Promise<void>;
declare function assertProductionSecrets(env?: Record<string, string | undefined>): void;
export { assertProductionSecrets, assertRlsLiveDatabaseRole, setLivePostgresRoleInspectorForTests };