import * as React from 'react';
import React__default, { PropsWithChildren } from 'react';

/**
 * A single access requirement that can be evaluated against a user.
 *
 * Matching semantics:
 * - By default (`requireAll` omitted / false) access is granted when the user
 *   matches ANY of the provided roles OR ANY of the provided permissions OR the
 *   custom `check` predicate returns `true` (logical OR across every supplied
 *   criterion).
 * - When `requireAll` is `true`, every supplied criterion must pass: the user
 *   must have ALL listed roles AND ALL listed permissions AND satisfy `check`.
 *
 * Roles and permissions support `*` wildcards (e.g. a granted `user:*` matches a
 * required `user:read`, and a granted `*` matches everything).
 */
interface AccessQuery<Role extends string = string, Permission extends string = string> {
    roles?: Role[] | Role;
    permissions?: Permission[] | Permission;
    /** Require every listed role AND permission (AND semantics) instead of ANY. */
    requireAll?: boolean;
    /** Custom predicate for rules that roles/permissions can't express. */
    check?: (user: IUserPayload) => boolean;
}
/** Normalizes a value that may be a single item, an array, or undefined. */
declare const toArray: <T>(value?: T[] | T) => T[];
/**
 * Returns `true` when a granted role/permission pattern matches a required one.
 * Supports `*` wildcards on the granted side, matching per `:`-delimited segment.
 *
 *   matchesPattern("*", "anything")          -> true
 *   matchesPattern("user:read", "user:read") -> true
 *   matchesPattern("user:*", "user:read")    -> true
 *   matchesPattern("user:read", "user:*")    -> false (wildcards only granted-side)
 */
declare const matchesPattern: (granted: string, required: string) => boolean;
/**
 * Pure, synchronous authorization check. This is the single source of truth used
 * by the provider, the `can` helper, the `useAuthorized` hook and `AllowedAccess`.
 */
declare const isUserAuthorized: (user: IUserPayload | null | undefined, query: AccessQuery) => boolean;

interface IUserPayload<Role extends string = string, Permission extends string = string> {
    id: string | number;
    roles?: Role[];
    permissions?: Permission[];
}
interface PermissionAuthContext {
    /** The currently set user, or `null` when no user is set. */
    user: IUserPayload | null;
    /** Sets (or replaces) the current user. */
    setUser: (user: IUserPayload) => void;
    /** Clears the current user (e.g. on logout). */
    clearUser: () => void;
    /** Synchronous authorization check. */
    can: (query: AccessQuery) => boolean;
    /**
     * Promise-based authorization check. Kept for backwards compatibility;
     * resolves synchronously since checks are performed in memory.
     */
    isAuthorized: (roleNames?: string[] | string, permissionNames?: string[] | string, options?: Pick<AccessQuery, "requireAll" | "check">) => Promise<boolean>;
    /** Retained for backwards compatibility; always `false` (checks are instant). */
    isLoading: boolean;
}
declare const PermissionContext: React.Context<PermissionAuthContext>;

interface HasAccessProps<Role extends string = string, Permission extends string = string> {
    roles?: Role[] | Role;
    permissions?: Permission[] | Permission;
    /** Require every listed role AND permission instead of ANY. */
    requireAll?: boolean;
    /** Custom predicate for rules roles/permissions can't express. */
    check?: (user: IUserPayload) => boolean;
    /** Rendered when the user is NOT authorized. */
    renderAuthFailed?: React.ReactNode;
    /**
     * @deprecated Checks are now synchronous, so there is no loading phase.
     * Kept for backwards compatibility; it is ignored.
     */
    isLoading?: React.ReactNode;
    /**
     * Content shown when authorized. May also be a render-prop function that
     * receives the boolean result, letting you render both states inline.
     */
    children?: React.ReactNode | ((isAllowed: boolean) => React.ReactNode);
}
declare const AllowedAccess: <Role extends string = string, Permission extends string = string>({ roles, permissions, requireAll, check, renderAuthFailed, children, }: HasAccessProps<Role, Permission>) => React.ReactElement | null;

declare const usePermission: () => PermissionAuthContext;

/**
 * Synchronously resolves whether the current user satisfies an access query.
 * Recomputes automatically when the user or the query changes.
 *
 * @example
 * const canEdit = useAuthorized({ permissions: "post:edit" });
 */
declare const useAuthorized: <Role extends string = string, Permission extends string = string>(query: AccessQuery<Role, Permission>) => boolean;

declare const PermissionProvider: ({ children }: PropsWithChildren) => React__default.JSX.Element;

export { type AccessQuery, AllowedAccess, type HasAccessProps, type IUserPayload, type PermissionAuthContext, PermissionContext, PermissionProvider, isUserAuthorized, matchesPattern, toArray, useAuthorized, usePermission };