/**
 * Cloud Postgres migrations for domains-serve.
 *
 * Combines the app schema (`PG_MIGRATIONS`) with the vendored storage kit's
 * checksum-guarded `MigrationLedger` and the @hasna/contracts api-keys table.
 * Runs against the OWNER role DSN (DDL), not the request-path app role.
 *
 * PURE REMOTE (Amendment A1): migrations run against the cloud Postgres. There
 * is no local schema and no ledger sync between machines.
 */
import { type Migration, type MigrationResult } from "../generated/storage-kit/index.js";
/** Env var holding the owner-role DSN (DDL privileges). Falls back to the app DSN. */
export declare const OWNER_DSN_ENV = "HASNA_DOMAINS_DATABASE_URL_OWNER";
export declare const APP_DSN_ENV = "HASNA_DOMAINS_DATABASE_URL";
/**
 * Applied-ledger rows recorded before the ledger's id scheme stabilized, which
 * no build in this repo's history generates (verified across every published
 * tarball 0.0.30-0.0.46 and all git history). They are acknowledged via the
 * storage kit's `acknowledgedLegacyIds`: they pass the downgrade guard, are
 * never checksum-compared (their SQL is not reproducible from any source), and
 * are never re-applied or re-inserted.
 *
 * `domains_apikeys_tenancy_0001`, `domains_apikeys_tenancy_0002`,
 * `domains_tenancy_0001`..`domains_tenancy_0010` were recorded against the
 * prod ledger out-of-band during the 2026-07 self-hosted cutover. Deploy
 * evidence 2026-08-25: the 02:00Z pass failed on `_0001` (O15-00671 filed);
 * the 16:44Z pass, carrying the kit with `_0001` acknowledged
 * (hasna/apps#1176), advanced to `_0002`; the next pass then failed on the
 * third row `domains_tenancy_0001` (O15-00758 filed), the 2026-08-25 PASS-18
 * pass then failed on the fourth row `domains_tenancy_0002` at
 * `domains-prod-migrate:42` (O15-00762 filed), and the 2026-08-25 pass then
 * failed on the fifth row `domains_tenancy_0003` at `domains-prod-migrate:42`
 * (O15-00766 filed). Deploy evidence 2026-08-26: passes 48-96 then failed on
 * the sixth row `domains_tenancy_0004` at `domains-prod-migrate:44` through
 * `:49` (todos 2b474505). Deploy evidence 2026-08-26/27: the 2026-08-27
 * 06:47Z pass failed on the seventh row `domains_tenancy_0005` at
 * `domains-prod-migrate:50` (O15-01822 filed). The ledger census (inspection
 * task oss-fleet-prod/4b7c37626965439e96d5386c8e8a73d4) shows the complete
 * out-of-band set is the 12 rows below — `domains_apikeys_tenancy_0001-0002`
 * plus `domains_tenancy_0001..0010` — so this list covers the full measured
 * prod ledger rather than one row per deploy pass. The apikeys rows'
 * substance — the api-keys tenancy (`tid`) column — is carried today by
 * `hasna_auth_0003_api_keys_tenant`; the substance of the `domains_tenancy_*`
 * rows is not reproducible from any source in this repo, and no build
 * generates the ids, so they are acknowledged as history rather than
 * re-applied. Acknowledging all twelve unblocks `domains db migrate` (the ECS
 * migrate task) and therefore the domains deploy lane.
 */
export declare const ACKNOWLEDGED_LEGACY_MIGRATION_IDS: readonly string[];
/** The ordered migration set: app schema first, then the shared api-keys table. */
export declare function buildMigrations(): Migration[];
/** Run all pending migrations against the owner DSN. */
export declare function runMigrations(opts?: {
    dryRun?: boolean;
    env?: NodeJS.ProcessEnv;
}): Promise<MigrationResult>;
//# sourceMappingURL=migrations.d.ts.map