/**
 * VortexAuthorityGuard — enforces @vortex exclusive authority over
 * irreversible, outward-facing operations in the autonomous path.
 *
 * Phase 3 (Governance on Every Mission) of the autonomous-agent milestone.
 *
 * Locked rule (project constitution + agent-authority.md): git push, gh PR
 * create/merge, and npm publish are @vortex-exclusive. An autonomous mission
 * MUST NOT perform them without EXPLICIT user authorization.
 *
 * The authorization is a token the user sets deliberately
 * (OPENLIFE_VORTEX_TOKEN) and that a mission carries in its context
 * (context.vortexAuthorization). No token set → the capability simply cannot
 * be authorized, so the autonomous agent can never push on its own. This is
 * fail-closed by design: the absence of configuration denies, never allows.
 */
export interface VortexCheck {
    /** True when the goal requests a @vortex-exclusive operation. */
    requiresAuthority: boolean;
    /** True when authority is required AND a valid token authorizes it. */
    authorized: boolean;
    /** Which exclusive operations were detected in the goal. */
    matchedOps: string[];
}
export declare class VortexAuthorityGuard {
    /**
     * Inspect a mission goal + context. Does NOT throw.
     *
     * @param goal    the mission goal text
     * @param context optional mission context; context.vortexAuthorization is
     *                the one-shot token the caller presents.
     */
    check(goal: string, context?: Record<string, unknown>): VortexCheck;
    /**
     * Constant-time compare against the configured token. Fail-closed: if no
     * token is configured, NOTHING authorizes (the autonomous agent cannot
     * push). An empty presented token never matches.
     */
    private tokenValid;
}
