Prefetch before you go dark
A cache can only serve what it has already been asked for once. That is fine until the day the network goes away and you discover which dependency nobody happened to build with. Prefetch is how you decide what the mirror has seen, in advance, rather than finding out afterwards.
Asynchronous by design
Warming a whole dependency tree can take a long time, and tying that to a single HTTP request means a dropped connection loses the work. So POST /prefetch enqueues a job and returns immediately, a background worker drains it, and you poll /prefetch/status?job= to watch it.
For the file backend, prefetch takes a full URL — so you can paste the line straight out of the Makefile that needs it, rather than translating it into some other coordinate system first.
Verified on the way in
A prefetch may assert the digest you expect. Bytes are hashed as they stream through a spool file and are committed only once the whole hash is known — so an artifact that does not match is never stored at all, rather than stored and then deleted. The distinction matters: there is no window in which a wrong file is sitting in the mirror answering pulls.