/**
 * Filesystem-backed cache storage.
 *
 * Mirrors the `CacheStorage` interface that `S3CacheStorage` provides, but
 * stores blobs as files under a configured base directory. Pre-signed URLs
 * are replaced by HMAC-signed `http://<orchUrl>/api/v1/cache/blob/...` URLs
 * — see `sign-url.ts` for the token mechanics and `app.ts` for the route.
 *
 * Intended for single-host deployments and E2E sandboxes where standing up
 * an S3-compatible service is overkill. Production should still use S3.
 *
 * Metadata is co-located as a sibling JSON file (`<key>.meta.json`) so the
 * data file is byte-identical to what the agent receives over HTTP. TTL is
 * enforced lazily on access — same model as the S3 backend.
 */
import type { CacheStorage } from './types.js';
export interface FilesystemCacheStorageOptions {
    /** Absolute path to the cache root directory. Created on first write if missing. */
    basePath: string;
    /** Item TTL in milliseconds. Items past TTL since lastAccessedAt are evicted. */
    ttlMs: number;
    /** Base URL the agent uses to reach the orchestrator (e.g., `http://orch:10143`). */
    baseUrl: string;
    /** Per-process HMAC secret used to sign URLs. See sign-url.ts. */
    signingSecret: string;
    /** Optional URL path mount point. Defaults to `/api/v1/cache/blob/`. */
    routePrefix?: string;
}
export declare class FilesystemCacheStorage implements CacheStorage {
    private readonly basePath;
    private readonly ttlMs;
    private readonly baseUrl;
    private readonly signingSecret;
    private readonly routePrefix;
    constructor(options: FilesystemCacheStorageOptions);
    /**
     * Map a cache key to its on-disk path. Keys may contain `/`, which becomes a
     * directory separator. Reject keys containing `..` segments or NUL bytes to
     * prevent path traversal — the same defence the route layer enforces too.
     */
    private resolvePath;
    /** Public for the HTTP route. The route validates the key before calling. */
    pathFor(key: string): string;
    private metaPath;
    private isExpired;
    private readMeta;
    private writeMeta;
    put(key: string, data: Buffer | string): Promise<void>;
    get(key: string, ttlMsOverride?: number): Promise<Buffer | null>;
    has(key: string, ttlMsOverride?: number): Promise<boolean>;
    delete(key: string): Promise<boolean>;
    touch(key: string): Promise<void>;
    getUrl(key: string, ttlMsOverride?: number): Promise<string | null>;
    getUploadUrl(key: string): Promise<string>;
    getInternalUploadUrl(key: string): Promise<string>;
    initMeta(key: string): Promise<void>;
    list(subPrefix: string): Promise<string[]>;
    copy(srcKey: string, destKey: string): Promise<void>;
    /**
     * Recursively collect data files under `dir`, returning each as a cache key
     * relative to `basePath` paired with its mtime. Metadata sidecars
     * (`*.meta.json`) and the atomic-write temp files (`*.tmp-*`) are skipped so
     * `list()` only surfaces real cache objects.
     */
    private walkDataFiles;
    private signedUrl;
    private deleteFiles;
}
//# sourceMappingURL=filesystem.d.ts.map