export interface CachedFetchArgs {
    /** Per-user cache root (created 0700 if absent). */
    cacheDir: string;
    /** Integrity digest — PART of the cache key so a changed digest misses (spec §11a). */
    digest: string;
    /** Stable logical key (e.g. sanitized URL or package@version). */
    key: string;
    /** Force re-download/re-resolve (verify still runs). */
    refresh?: boolean;
    /** Populate the (empty) cache entry dir. Runs only on a miss or refresh. */
    fetchInto: (dir: string) => Promise<void>;
    /** Re-check integrity against `digest`. Runs on EVERY call (hit and miss). */
    verify: (dir: string) => Promise<void>;
}
/**
 * Content-addressed fetch cache with mandatory §11a hardening:
 *  - cache root + entries are 0700 and rejected if not owned by the current uid;
 *  - the entry key INCLUDES the integrity digest, so changing a declared digest
 *    misses the old entry instead of reusing stale content;
 *  - verify() runs unconditionally before returning, even on a cache hit and even
 *    under refresh.
 *
 * @returns Forward-slash absolute path to the cached entry directory.
 */
export declare function withCachedFetch(args: CachedFetchArgs): Promise<string>;
//# sourceMappingURL=fetch-cache.d.ts.map