import type { Runner } from "../internals/proc.js";
import { type ResolvedNpmSource } from "./scan-gate.js";
export interface AcquireNpmTreeOptions {
    runner: Runner;
    cacheHome: string;
    /**
     * When set, `npm view <pkg>@<version> gitHead` must equal this exact value or
     * acquisition fails closed — a source-provenance assertion beyond the SRI.
     */
    expectedGitHead?: string;
}
/**
 * Acquire, verify, unpack, and digest the EXACT npm tarball for a resolved npm
 * identity, returning it enriched with the materialized tree (treeDigest /
 * treePath / files, and gitHead when asserted). Idempotent: a second call for the
 * same (package, version, integrity) serves the content-addressed cache only after
 * re-verifying the cached tree's digest. Fail-closed at every step (bad identity,
 * SRI mismatch, gitHead mismatch, malicious tar entry) — nothing is published to
 * the cache and staging is always cleaned.
 */
export declare function acquireNpmTree(resolved: ResolvedNpmSource, opts: AcquireNpmTreeOptions): Promise<ResolvedNpmSource>;