import type { MigrationEntry } from "../db/migrations.js";
/**
 * Better Auth encrypts persisted JWT private keys with the current auth
 * secret. If that secret is rotated, the old row remains the newest key and
 * every token-producing request fails before it can mint a replacement. Mark
 * active rows expired during the release so Better Auth rotates the signing
 * key without touching users or sessions. The JWKS endpoint keeps expired
 * keys during its grace period, so already-issued short-lived tokens remain
 * verifiable while the new key propagates.
 *
 * Also invoked at runtime by `jwks-secret-rotation.ts` when a live request
 * hits the decrypt failure — release migrations do not reach every deployed
 * database, so the release-time pass alone cannot be relied on.
 */
export declare function expireJwksKeysAfterAuthSecretRotation(): Promise<void>;
/**
 * Better Auth's framework-owned schema. This is deliberately a release
 * migration, not a fallback inside `getBetterAuth()`: request functions must
 * be able to construct the auth adapter without probing or creating tables.
 */
export declare const BETTER_AUTH_MIGRATIONS: MigrationEntry[];
export declare const betterAuthStore: import("../db/store-registry.js").Store;
/** Kept for callers of the public export; the store owns these migrations. */
export declare function runBetterAuthMigrations(_nitroApp?: unknown): Promise<void>;