/**
 * `--auth better-auth` - wire authentication into a scaffolded app, the same "bundle the right tool,
 * correctly" move as `--db`. nifra owns the *mount* (`@nifrajs/better-auth` plugs better-auth's handler
 * into a `server()` and gives typed `getSession`/`requireSession` guards); better-auth owns the auth
 * logic. Auth needs a database, so this composes with `--db`: the generated `auth.ts` reuses the client
 * from `./db` via better-auth's adapter for the chosen ORM (`drizzleAdapter` / `prismaAdapter`). The
 * agent then runs `bunx @better-auth/cli generate` to add the auth tables and migrates.
 *
 * `--auth` therefore requires `--db` (the CLI enforces it). better-auth's clean adapters cover Drizzle
 * and Prisma; Kysely is rejected (it has no drop-in adapter - wire better-auth's own dialect manually).
 * One preset today: `better-auth`.
 */
import { type DbChoice } from "./db.js";
export declare const AUTH_CHOICES: readonly ["better-auth"];
export type AuthChoice = (typeof AUTH_CHOICES)[number];
/**
 * Guard `--auth` against a DB whose ORM has no clean better-auth adapter. Throws an actionable error
 * for Kysely (passing a raw dialect to better-auth is manual wiring we won't fake-scaffold). Called by
 * the CLI before scaffolding so the failure is early and explains the fix.
 */
export declare function assertAuthableDb(db: DbChoice): void;
export interface AuthPreset {
    readonly label: string;
    readonly note: string;
    readonly deps: Readonly<Record<string, string>>;
}
export declare const AUTH_PRESETS: Readonly<Record<AuthChoice, AuthPreset>>;
/** Write `auth.ts` and append the auth env vars to the (db-preset-created) `.env.example`. */
export declare function writeAuthFiles(target: string, _auth: AuthChoice, db: DbChoice): Promise<void>;
//# sourceMappingURL=auth.d.ts.map