import type { Authenticatable } from './contracts.js';
type AbilityCallback = (user: Authenticatable, ...args: unknown[]) => boolean | Promise<boolean>;
type BeforeCallback = (user: Authenticatable, ability: string) => boolean | null | undefined | Promise<boolean | null | undefined>;
export declare abstract class Policy {
    /**
     * Run before any other check. Return true/false to short-circuit,
     * or null/undefined to fall through to the specific method.
     */
    before?(_user: Authenticatable): boolean | null | undefined | Promise<boolean | null | undefined>;
}
type PolicyClass = new () => Policy;
type ModelClass = abstract new (...args: any[]) => unknown;
export declare class Gate {
    /**
     * Register an ability callback. The args tuple is generic so callers can
     * narrow parameter types without casting:
     *
     * ```ts
     * Gate.define('edit-post', (user, post: Post) => user.id === post.authorId)
     * ```
     *
     * The stored callback is widened to `AbilityCallback` (unknown args) for
     * the Map; narrowing only matters at the call site.
     */
    static define<TArgs extends unknown[] = unknown[]>(ability: string, callback: (user: Authenticatable, ...args: TArgs) => boolean | Promise<boolean>): void;
    static before(callback: BeforeCallback): void;
    static policy(model: ModelClass, policy: PolicyClass): void;
    static allows(ability: string, ...args: unknown[]): Promise<boolean>;
    static denies(ability: string, ...args: unknown[]): Promise<boolean>;
    /**
     * Check ability — throw 403 if denied.
     */
    static authorize(ability: string, ...args: unknown[]): Promise<void>;
    static forUser(user: Authenticatable): GateForUser;
    private static resolveUser;
    private static _check;
    /** Emit an observation event to the gate observer registry (if present). */
    private static _emitObservation;
    /** Test-cleanup hook (public — other packages reset across the boundary). */
    static reset(): void;
}
declare class GateForUser {
    private readonly user;
    private readonly abilities;
    private readonly policies;
    private readonly beforeCallbacks;
    constructor(user: Authenticatable, abilities: Map<string, AbilityCallback>, policies: Map<ModelClass, PolicyClass>, beforeCallbacks: BeforeCallback[]);
    allows(ability: string, ...args: unknown[]): Promise<boolean>;
    private _check;
    denies(ability: string, ...args: unknown[]): Promise<boolean>;
    authorize(ability: string, ...args: unknown[]): Promise<void>;
}
export declare class AuthorizationError extends Error {
    readonly status = 403;
    constructor(message?: string);
}
export {};
//# sourceMappingURL=gate.d.ts.map