/**
 * Real, deep-scan `SbomGenerator` backend (#610, epic #551's "deep external
 * tool" half of the SBOM story — the counterpart to ./lockfile-sbom-generator.ts's
 * hermetic, zero-dependency default from #613). Shells out to whichever
 * external scanner fits the artifact type, through the injectable
 * `ProcessRunner` (./process-runner.ts, itself mirroring
 * ./cloud-executor.ts's `CloudExecutor` pattern):
 *
 *  - `image` -> `docker buildx build --sbom=true` (BuildKit's native SPDX
 *    attestation) when a Dockerfile build context is available, otherwise a
 *    `syft <tarball>` scan of the already-built OCI-layout tarball;
 *  - `jar`   -> `syft`, or `cyclonedx-maven` when the jar's project directory
 *    carries a `pom.xml` (a more Maven-native scan than a bytecode-level jar
 *    scan);
 *  - `zip`   -> `syft <zip>`;
 *  - `dir`   -> `syft <dir>`, falling back to `cdxgen <dir>` when `syft` is
 *    unavailable (`cdxgen`'s "wnat's on disk" mode covers ecosystems syft
 *    might not have detected).
 *
 * Every method resolves the specific tool it needs, checks availability via
 * `ProcessRunner.available` first, and throws `ToolNotAvailableError`
 * (./process-runner.ts) with an actionable install hint if the tool is
 * missing — never a silent empty SBOM. Tests inject `MockProcessRunner`
 * (./__tests__/mock-process-runner.ts) and assert on the constructed command
 * line + parsed output; nothing here ever spawns a real process.
 *
 * This backend is **not** the process-wide default (see
 * ./sbom-generator.ts's `notImplementedSbomGenerator` and
 * ./lockfile-sbom-generator.ts's `lockfileSbomGenerator` module docs for why):
 * a project opts in explicitly by constructing
 * `createGenerateSbomCapability(createToolSbomGenerator())` when it wants the
 * deeper, external-tool-backed scan (e.g. to see an image's base-layer OS
 * packages, which no lockfile read can see).
 */
import { type SbomGenerator } from "./sbom-generator.js";
import { type ProcessRunner } from "./process-runner.js";
export interface ToolSbomGeneratorOptions {
    /** Injected process boundary. Defaults to the real, `child_process`-backed runner. */
    runner?: ProcessRunner;
    /** Directory `syft`/`cdxgen`/`cyclonedx-maven` write their output file into before this backend reads it back. Defaults to `node:os`'s tmpdir via each call's own scratch path — see `scratchPath`. */
    workDir?: string;
}
/**
 * Build a real, deep-scan `SbomGenerator` backend. Every method shells out
 * through `options.runner` (default: the real `ProcessRunner`); tests should
 * always pass a `MockProcessRunner` instead.
 */
export declare function createToolSbomGenerator(options?: ToolSbomGeneratorOptions): SbomGenerator;
/** Process-wide, real-tool-backed `SbomGenerator`, ready to inject wherever a project opts into the deep-scan path over ./lockfile-sbom-generator.ts's hermetic default. Never constructed by a test. */
export declare const toolSbomGenerator: SbomGenerator;
//# sourceMappingURL=tool-sbom-generator.d.ts.map