import type { ForgeStorageClient, ForgeStorageEnv } from '@bitmagic/world-forger/pipeline/index.js';
/** Where forge job artifacts live, relative to the project root. `.bitmagic/` is gitignored by
 *  the scaffold (see scaffold/project-files.ts) and already holds `verify/`'s artifacts. */
export declare const FORGE_STORE_DIR: string;
/**
 * Resolve one storage key to a file path, refusing anything that would escape the store root.
 *
 * The keys this store sees are built by the shared package from a jobId api-server already
 * validated against `FORGE_JOB_ID_PATTERN`, so this can never fire in practice today. It is here
 * because the check is what makes that a *fact about the current callers* rather than a
 * *property of this module*: a key is untrusted input the moment anything else builds one, and
 * "it happens to be safe upstream" is not a guarantee a filesystem writer should rely on.
 * Refuses loudly — it is never correct to silently write somewhere else.
 */
export declare function resolveStoreKeyPath(rootDir: string, key: string): string;
/**
 * A `ForgeStorageClient` over the local filesystem. `bucket` is an absolute DIRECTORY here
 * rather than a bucket name — the seam is structural (see the package's storage-types.ts), and a
 * directory is exactly the "namespace a key is resolved against" the field means.
 */
export declare function createLocalForgeStorageClient(): ForgeStorageClient;
/**
 * The `ForgeStorageEnv` steps 3-5 run against, rooted in this project.
 *
 * `publicUrl` is a `file://` URL for the store directory. Nothing in steps 3-5 reads it — it
 * exists for step 2's uploads, which run on api-server — but the seam declares it required, and
 * the honest value for a local store is where those bytes actually are. (`storage-types.ts`
 * names `file://` as an expected form.)
 */
export declare function createLocalForgeStorage(projectRoot: string): ForgeStorageEnv;