/**
 * What the RLS checks concluded.
 *
 * `unchecked` exists because "we could not look" and "we looked and it is fine"
 * used to be reported identically: a collections path that did not resolve made
 * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`
 * early-returned an empty diff, and the gate printed
 * `✓ RLS policies match your collections` having compared zero policies against
 * zero collections. Any exception at all — a collection file that throws on
 * import, a `pg_policies` read the CI role is not granted, a connection reset —
 * did the same thing through a `warn`, and exited 0.
 */
export type PolicyCheckStatus = "ok" | "problems" | "unchecked";
/**
 * The exit code for `rebase doctor --policies`.
 *
 * A gate that could not run has not passed. Only a completed, clean check
 * exits 0 — anything else, including "we never opened a connection", is a
 * failure, or the flag certifies a database nobody looked at.
 */
export declare function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1;
/**
 * Policies actually deployed vs the ones the collections describe, plus policy
 * roles this server could never satisfy.
 *
 * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.
 */
export declare function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus>;