import { ProjectMemberRole, SystemRole } from '@prisma/client';
export type Action = 'manage_employees' | 'create_project' | 'manage_project' | 'view_task' | 'edit_task' | 'change_task_status' | 'edit_requirements' | 'log_time' | 'upload_evidence' | 'create_bug' | 'manage_bug' | 'change_bug_status' | 'assign_work' | 'apply_leave' | 'manage_leave' | 'view_reports_all' | 'view_reports_project';
export type AuthUser = {
    id: string;
    code: string;
    name: string;
    email: string;
    role: SystemRole;
    active: boolean;
};
export type CanContext = {
    projectId?: string;
    projectAdminId?: string;
    isProjectMember?: boolean;
    projectRole?: ProjectMemberRole | null;
    isTaskAssignee?: boolean;
    taskStageDone?: boolean;
    /** Bug assignee (not parent-task assignee) */
    isBugAssignee?: boolean;
    /** Current bug status label, e.g. Ready for Retest */
    bugStatus?: string;
    /** Target status for change_bug_status checks */
    toStatus?: string;
};
export declare function loadProjectContext(userId: string, projectId: string): Promise<CanContext>;
export declare function can(user: AuthUser, action: Action, ctx?: CanContext): boolean;
export declare function assertCan(user: AuthUser, action: Action, ctx?: CanContext): void;
/** Project visibility: SA all; others member/admin projects */
export declare function visibleProjectIds(user: AuthUser): Promise<string[] | 'all'>;