/**
 * Storage Configuration Loader and Validator
 *
 * Reads `.aiwg/storage.config` (project-local), validates it against the
 * v1 schema, and returns a typed `StorageConfig`. Absence of the file is
 * a no-op: every subsystem defaults to `fs` rooted under `.aiwg/`.
 *
 * Validation is hand-rolled rather than schema-validator-driven to avoid
 * adding an `ajv` dependency for a single file. The published JSON
 * Schema (`.aiwg/architecture/schemas/storage.config.v1.json`) remains
 * canonical for editor tooling and external consumers.
 *
 * @design @.aiwg/architecture/storage-design.md
 * @issue #934
 * @issue #953
 */
import { type StorageConfig, type SubsystemKey } from './types.js';
/**
 * Property names that must never appear at any nesting depth in
 * `storage.config`. Defense-in-depth against credentials being written
 * to disk. The published JSON Schema also enforces this; the recursive
 * runtime walk below catches custom backend extensions that bypass the
 * static `additionalProperties: false`.
 */
export declare const FORBIDDEN_CREDENTIAL_KEYS: readonly string[];
/** Default subsystem-to-relative-path mapping for the `fs` backend. */
export declare const DEFAULT_SUBSYSTEM_ROOTS: Record<SubsystemKey, string>;
/**
 * Resolve the path where `.aiwg/storage.config` is expected for a given
 * project root. Does not check existence.
 */
export declare function storageConfigPath(projectRoot: string): string;
/**
 * Load and validate `.aiwg/storage.config` from `projectRoot`.
 *
 * Returns `null` if the file is absent (caller falls back to defaults).
 * Throws a descriptive error for malformed JSON, unsupported version,
 * unknown subsystem keys, unknown backend types, or any credential-named
 * property at any depth.
 */
export declare function loadStorageConfig(projectRoot: string): Promise<StorageConfig | null>;
/**
 * Validate an already-parsed object as a `StorageConfig`. Exposed for
 * use by `aiwg doctor` and tests.
 */
export declare function validateStorageConfig(parsed: unknown, source?: string): StorageConfig;
/**
 * Recursively reject any property whose name appears in
 * FORBIDDEN_CREDENTIAL_KEYS. Throws on first hit with the full path.
 */
export declare function walkRejectingCredentials(value: unknown, source: string, path: string): void;
/**
 * Resolve the absolute filesystem path for an `fs`-backed subsystem,
 * applying `roots` overrides if present. Used by the fs adapter.
 *
 * Resolution order:
 *   1. `roots[subsystem]` if set, expanding `~` and accepting absolute paths
 *   2. `<projectRoot>/.aiwg/<DEFAULT_SUBSYSTEM_ROOTS[subsystem]>`
 */
export declare function resolveSubsystemRoot(subsystem: SubsystemKey, projectRoot: string, config: StorageConfig | null): string;
//# sourceMappingURL=config.d.ts.map