/**
 * Worker role credential lifecycle management.
 *
 * These are the low-level functions that create, rotate, and revoke
 * Postgres roles for worker routers. Each role is scoped to specific
 * stream_name(s) via the `app.allowed_streams` session variable.
 *
 * **Prefer the high-level API**: Call `HotMesh.provisionWorkerRole()`,
 * `HotMesh.rotateWorkerPassword()`, etc. — those methods handle
 * connection creation and cleanup automatically.
 */
import { PostgresClientType } from '../../../../types/postgres';
export interface WorkerCredential {
    roleName: string;
    password: string;
}
export interface WorkerCredentialInfo {
    id: number;
    roleName: string;
    streamNames: string[];
    createdAt: Date;
    revokedAt: Date | null;
    lastRotatedAt: Date;
}
/**
 * Provision a new Postgres role scoped to specific stream names.
 *
 * The role:
 * - Can LOGIN with the returned password
 * - Has USAGE on the schema
 * - Has EXECUTE on the 5 worker stored procedures
 * - Has `app.allowed_streams` set to the comma-separated stream names
 * - Has NO direct table access
 *
 * @param adminClient - A Postgres client connected as the admin/owner
 * @param schema - The appId schema name (e.g., 'durable')
 * @param streamNames - Stream names this role can access (e.g., ['payment-activity'])
 * @param password - Optional password (generated if not provided)
 * @returns The created role name and password
 */
export declare function provisionWorkerRole(adminClient: PostgresClientType, schema: string, streamNames: string[], password?: string): Promise<WorkerCredential>;
/**
 * Rotate the password for an existing worker role.
 */
export declare function rotateWorkerPassword(adminClient: PostgresClientType, schema: string, roleName: string, newPassword?: string): Promise<{
    password: string;
}>;
/**
 * Revoke a worker role by disabling login.
 * The role is not dropped — this preserves the audit trail.
 */
export declare function revokeWorkerRole(adminClient: PostgresClientType, schema: string, roleName: string): Promise<void>;
/**
 * List all worker roles for a schema.
 */
export declare function listWorkerRoles(adminClient: PostgresClientType, schema: string): Promise<WorkerCredentialInfo[]>;