/**
 * Application Postgres login role for FORCE RLS.
 *
 * Superuser (typically `postgres`) may CREATE ROLE, CREATE DATABASE, GRANT,
 * migrate, and migrate:fresh DROP TABLE. Tables are owned by the role that ran
 * CREATE TABLE, so the NOBYPASSRLS runtime role cannot drop them. Runtime
 * DATABASE_URL / APP_DATABASE_URL must be this NOBYPASSRLS role.
 * docker-entrypoint-initdb.d only runs on an empty volume; call
 * ensurePostgresDatabaseAndAppRole() on every boot so existing volumes get the
 * same role and table GRANTs after migrate:fresh.
 *
 * Admin DDL (GRANT ALL TABLES, CREATE TABLE, DROP TABLE) must run on the
 * application database. postgres/template1 are only for CREATE DATABASE.
 */
declare const POSTGRES_APP_ROLE = "strata_app";
declare const POSTGRES_APP_ROLE_PASSWORD = "dev-strata-app-change-me";
declare const POSTGRES_SUPERUSER_PASSWORD = "dev-postgres-change-me";
declare const LEGACY_POSTGRES_SUPERUSER_PASSWORD = "postgres";
type PostgresSql = {
    unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
    close?: () => Promise<void> | void;
};
type ConnectPostgres = (url: string) => PostgresSql;
type LivePostgresRole = {
    rolname: string;
    rolsuper: boolean;
    rolbypassrls: boolean;
};
type PostgresAdminOptions = {
    runtimeUrl: string;
    migrationUrl?: string;
    superuserPassword?: string;
    connect?: ConnectPostgres;
};
declare function assertSafeSqlIdentifier(identifier: string, label: string): string;
declare function quoteSqlLiteral(value: string): string;
declare function isPostgresUrl(raw: string | undefined): boolean;
declare function postgresUrlUsername(raw: string): string | null;
declare function postgresDatabaseNameFromUrl(raw: string): string;
declare function postgresAdminUrls(options: {
    runtimeUrl: string;
    migrationUrl?: string;
    superuserPassword?: string;
}): string[];
declare function openPostgresAdminConnection(options: PostgresAdminOptions): Promise<PostgresSql>;
declare function postgresAppRoleCreateSql(options?: {
    role?: string;
    password?: string;
}): string;
declare function postgresAppRoleSql(options: {
    database: string;
    role?: string;
    password?: string;
}): string;
declare function grantPostgresAppRolePrivileges(sql: PostgresSql, options: {
    database: string;
    role?: string;
}): Promise<void>;
declare function ensurePostgresAppRole(sql: PostgresSql, options: {
    database: string;
    role?: string;
    password?: string;
}): Promise<void>;
declare function ensurePostgresDatabaseAndAppRole(options: {
    runtimeUrl: string;
    migrationUrl?: string;
    role?: string;
    password?: string;
    connect?: ConnectPostgres;
}): Promise<string>;
declare function dropPostgresTablesAsAdmin(tables: readonly string[], options: PostgresAdminOptions): Promise<void>;
declare function inspectCurrentPostgresRole(sql: PostgresSql): Promise<LivePostgresRole | null>;
declare function assertPostgresRoleCannotBypassRls(role: LivePostgresRole | null, source?: string): void;
export type { ConnectPostgres, LivePostgresRole, PostgresSql };
export { assertPostgresRoleCannotBypassRls, assertSafeSqlIdentifier, dropPostgresTablesAsAdmin, ensurePostgresAppRole, ensurePostgresDatabaseAndAppRole, grantPostgresAppRolePrivileges, inspectCurrentPostgresRole, isPostgresUrl, LEGACY_POSTGRES_SUPERUSER_PASSWORD, openPostgresAdminConnection, POSTGRES_APP_ROLE, POSTGRES_APP_ROLE_PASSWORD, POSTGRES_SUPERUSER_PASSWORD, postgresAdminUrls, postgresAppRoleCreateSql, postgresAppRoleSql, postgresDatabaseNameFromUrl, postgresUrlUsername, quoteSqlLiteral, };