/**
 * Tool-surface curation for single-tenant vs. team/org installs.
 *
 * ForgeOS ships a single-consumer governance flow by default. The
 * department-pipeline and manager/director oversight tools only make sense
 * when several humans operate distinct roles against the same engine. On a
 * solo / self-hosted install those tools are confusing surface area — they
 * imply hidden multi-tenant machinery that isn't there.
 *
 * Policy (productization, 2026-06-29):
 *   - Team/org tools are OPT-IN, never hidden-but-present. A default install
 *     does NOT advertise them via tools/list AND refuses to execute them.
 *   - Opt in by setting FORGEOS_TEAM_MODE to a truthy value
 *     (true | 1 | yes | team | org). This is documented in the README and
 *     .env.production.example so the surface is always explainable to the
 *     customer running the engine on their own box.
 *
 * This is presentation/visibility only — it does not change what the engine
 * stores or where. The engine still enforces its own auth/RBAC.
 */
/**
 * Category (b) — multi-user org / pipeline-management tools.
 * Gated behind FORGEOS_TEAM_MODE because they are meaningless and confusing
 * on a single-tenant install (they route work between departments and roll
 * pipelines up to managers/directors).
 */
export declare const TEAM_TOOL_NAMES: ReadonlySet<string>;
/**
 * Return true when team/org tools should be surfaced and executable.
 * Resolved solely from the FORGEOS_TEAM_MODE environment variable so the
 * decision is explicit and auditable. Defaults to false (single-tenant).
 */
export declare function isTeamModeEnabled(): boolean;
/** True if `name` is a gated team/org tool. */
export declare function isTeamTool(name: string): boolean;
/**
 * Filter a tool list down to what the current mode is allowed to advertise.
 * In single-tenant (default) mode, team/org tools are removed entirely.
 */
export declare function visibleTools<T extends {
    name: string;
}>(tools: readonly T[]): T[];
/** Error thrown when a gated team/org tool is called in single-tenant mode. */
export declare class TeamModeDisabledError extends Error {
    constructor(toolName: string);
}
/**
 * Guard for the call path: throws TeamModeDisabledError if a gated tool is
 * invoked while team mode is off. Defense-in-depth so a client that hardcodes
 * a tool name cannot reach hidden surface area.
 */
export declare function assertToolAllowed(name: string): void;
//# sourceMappingURL=tool-modes.d.ts.map