import { type AuthMfaFeatureOptions } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
import { type LegalPagesOptions } from "@cosmicdrift/kumiko-bundled-features/legal-pages";
import { type UserDataRightsOptions } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
export type FileProviderKind = "inmemory" | "s3" | "s3-env";
export type MailTransportKind = "inmemory" | "smtp";
export type GdprStackOrder = "retention-first" | "compliance-first";
export type FileStackOptions = {
    readonly providers: readonly FileProviderKind[];
    readonly includeFilesFeature?: boolean;
};
export type MailStackOptions = {
    readonly transports: readonly MailTransportKind[];
};
export type PagesStackOptions = {
    readonly wrapLayout?: LegalPagesOptions["wrapLayout"];
};
export type GdprStackOptions = {
    readonly order?: GdprStackOrder;
    readonly sessions?: boolean;
    readonly tenantLifecycle?: boolean;
    /** Optional tokenVerifier provider(s) (e.g. PAT) when `sessions` is on.
     *  Session-only stacks need none — sessions registers sessionStore, which
     *  satisfies auth-foundation's boot check (#1570). Pass providers when the
     *  app also wants Bearer/PAT auth. */
    readonly providers?: readonly FeatureDefinition[];
};
export type UserDataRightsStackOptions = {
    readonly userDataRights?: UserDataRightsOptions;
    readonly includeDefaults?: boolean;
};
export type OpsStackOptions = {
    readonly delivery?: boolean;
    readonly audit?: boolean;
    readonly jobs?: boolean;
    readonly rateLimiting?: boolean;
};
/** sessions (+ optional auth-mfa). config/user/tenant/auth-email-password stay
 *  on composeFeatures(includeBundled). Pass `mfa` options to mount TOTP.
 *  When `sessions` is on (the default), auth-foundation is mounted alongside it —
 *  the framework's registry now hard-requires it (sessions.requires("auth-foundation")).
 *  Session-only is enough for boot (#1570); optional Bearer/PAT still needs a
 *  tokenVerifier provider from the caller (e.g. createPersonalAccessTokensFeature
 *  ({ scopes })) — PAT scopes are app-specific, so they stay caller-owned. */
export type IdentityStackOptions = {
    readonly sessions?: boolean;
    readonly mfa?: AuthMfaFeatureOptions;
};
export declare function stackFeatureNames(features: readonly FeatureDefinition[]): string[];
export declare function composePagesStack(options?: PagesStackOptions): FeatureDefinition[];
export declare function composeRendererStack(): FeatureDefinition[];
export declare function composeMailStack(options: MailStackOptions): FeatureDefinition[];
export declare function composeFileStack(options: FileStackOptions): FeatureDefinition[];
/** Retention + compliance (+ optional lifecycle/sessions). UDR/files mount separately — order varies per app. */
export declare function composeGdprStack(options?: GdprStackOptions): FeatureDefinition[];
export declare function composeUserDataRightsStack(options?: UserDataRightsStackOptions): FeatureDefinition[];
export declare function composeOpsStack(options?: OpsStackOptions): FeatureDefinition[];
/** Identity opt-ins: sessions by default; auth-mfa when `mfa` options given.
 *  Do not also pass `sessions: true` to composeGdprStack — duplicate feature. */
export declare function composeIdentityStack(options?: IdentityStackOptions): FeatureDefinition[];