import React from 'react';
import type { TableMetadata, ActionDefinition } from './types';
/** Predicate answering "can the current user use this capability?". */
export type CanFn = (capability: string) => boolean;
export interface PermissionsProviderProps {
    /** Granted capabilities (`"pos_orders.create"`, `"general.x"`, or `"*"`). */
    permissions: string[];
    /** Superrole bypass — admins/owners see everything, no filtering at all. */
    isAdmin: boolean;
    children: React.ReactNode;
}
/**
 * Builds the capability predicate from a raw permission list. Pure — exported
 * so hosts/tests can evaluate permissions outside React.
 */
export declare function makeCan(permissions: string[], isAdmin: boolean): CanFn;
export declare function PermissionsProvider({ permissions, isAdmin, children }: PermissionsProviderProps): React.JSX.Element;
/**
 * Returns the capability predicate. Without a <PermissionsProvider> ancestor
 * it returns an always-true function — existing hosts that never mount the
 * provider keep today's "everything visible" behaviour.
 */
export declare function useCan(): CanFn;
/** True when a <PermissionsProvider> is mounted above (permission gating active). */
export declare function usePermissionsActive(): boolean;
/**
 * Maps a row/table action key onto the capability action segment. The UI's
 * legacy `view`/`edit` keys correspond to the kernel's `index`/`update`
 * capabilities; everything else (delete, custom keys) maps verbatim.
 */
export declare function capabilityForActionKey(actionKey: string): string;
/** Canonical capability for an action on a model: `lowercase(model).<action>`. */
export declare function modelCapability(model: string, actionKey: string): string;
/**
 * Applies the capability predicate to a model's table metadata:
 *   - `canExport` / `canImport` are ANDed with `can(model.export|import)`.
 *   - explicit row/table actions are filtered by `can(model.<key>)` (with the
 *     view→index / edit→update mapping above).
 *   - when the metadata has NO explicit actions but `enableCRUDActions` is on,
 *     the implicit View/Edit/Delete trio is materialized here as explicit
 *     actions so individual entries can be dropped; `tx` resolves their labels
 *     (defaults to the Spanish fallbacks used by the column factory).
 *
 * Pure + idempotent. Callers should only invoke it when a provider is active
 * (`usePermissionsActive()`), otherwise pass the metadata through untouched.
 */
export declare function gateTableMetadata(metadata: TableMetadata, model: string, can: CanFn, tx?: (i18nKey: string, fallback: string) => string): TableMetadata;
/**
 * Resolves the per-row (`placement: 'row'`) action list for a model exactly the
 * way DynamicTable's action column does, so the kanban card menu shows the SAME
 * actions:
 *   - when a <PermissionsProvider> is active, the metadata is run through
 *     `gateTableMetadata` first (filters by capability + materializes the CRUD
 *     trio), otherwise the raw metadata is used.
 *   - explicit actions win; absent them, the implicit View/Edit/Delete trio is
 *     materialized when `enableCRUDActions` is on.
 *   - table/create-placement actions are stripped (they belong to the toolbar).
 *
 * Pure. `tx` resolves the trio's i18n labels (defaults to the Spanish fallbacks).
 */
export declare function resolveRowActions(metadata: TableMetadata, model: string, can: CanFn, permissionsActive: boolean, tx?: (i18nKey: string, fallback: string) => string): ActionDefinition[];
//# sourceMappingURL=permissions-context.d.ts.map