export interface Operator {
    id: string;
    name?: string;
    admin?: boolean;
    can?: string[];
}
export interface OperatorRegistry {
    operators: Record<string, Operator>;
}
export declare function getOperatorsPath(root?: string): string;
export declare function loadOperators(root?: string): OperatorRegistry;
export declare function getOperator(id: string, root?: string): Operator | undefined;
export declare function isKnownOperator(id: string, root?: string): boolean;
export declare function isAdmin(id: string, root?: string): boolean;
export declare function canPerform(id: string, action: string, root?: string): boolean;
/** High-consequence blocks require a known operator with explicit merge/deploy/admin rights. */
export declare function isHighConsequenceAllowed(blockConsequence: string | undefined, operatorId: string, root?: string): boolean;
/**
 * Prove operator identity for high-consequence answers.
 *
 * Knowing an id listed in operators.yaml is not authentication — any same-user
 * process can pass `--as muqsit`. Require the process environment to claim the
 * same id via AGENTS_OPERATOR_ID (typically injected by `agents secrets` /
 * the human's launch context).
 */
export declare function verifyOperatorIdentity(claimedId: string | undefined, root?: string): boolean;
