import type { Db } from './db.js';
/**
 * Least-privilege database roles (ARCHITECTURE.md §8). Roles are created once per cluster by
 * deploy/postgres-init; grants are (re)applied after every migration so new tables are covered.
 * Missing roles are skipped, so local development with a single superuser keeps working.
 */
export declare const DB_ROLES: {
    /** apps/sync — writes the catalog, its own bookkeeping, and owns the pg-boss schema. */
    readonly sync: "mcp_sync";
    /** apps/catalog-api — read-only catalog + sync status. */
    readonly api: "mcp_api";
    /** apps/mcp-server — audit log (insert-only) and OAuth session tables. Cannot read the catalog. */
    readonly server: "mcp_server";
};
/** Apply grants for every role that exists. Returns the roles granted. */
export declare function applyGrants(db: Db): Promise<string[]>;
//# sourceMappingURL=grants.d.ts.map