/**
 * Real `ReferrerLookup` backend (#610, epic #551 follow-up to #568's
 * `ReferrerLookup` interface). Shells out to `oras discover --format json
 * <digest>` — the OCI distribution spec's referrers API, as exposed by the
 * `oras` CLI — through the same injectable `ProcessRunner`
 * (../components/verbs/process-runner.ts) the deep-scan `SbomGenerator`
 * backend (../components/verbs/tool-sbom-generator.ts) and `publish-image`'s
 * referrer-attach step share, mirroring ../components/verbs/cloud-executor.ts's
 * `CloudExecutor` pattern once more: production code shells out, tests inject
 * a `MockProcessRunner` and never touch a real registry/`oras` binary.
 *
 * Not the process-wide default: ./build-ledger.ts's `noopReferrerLookup`
 * remains that (reports no referrers, no network, no registry credentials
 * required) for exactly the reason `notImplementedSbomGenerator` and
 * `SbomGenerator`'s hermetic backend aren't `sbom-generator.ts`'s default
 * either — a project opts into the real registry-backed lookup explicitly
 * (`buildLedgerEntries(manifest, createOrasReferrerLookup())`) rather than
 * every previously-network-free build-ledger query silently starting to hit
 * a registry.
 */
import { type ProcessRunner } from "../components/verbs/process-runner.js";
import type { ReferrerLookup } from "./build-ledger.js";
export interface OrasReferrerLookupOptions {
    /** Injected process boundary. Defaults to the real, `child_process`-backed runner. */
    runner?: ProcessRunner;
    /** Registry/repo prefix `digest` is resolved against (e.g. `123.dkr.ecr.us-east-1.amazonaws.com/search`) — `oras discover` needs a full `repo@digest` reference, not a bare digest. Required; a `ReferrerLookup.discover(digest)` call with no repo context has nothing to query. */
    repo: string;
}
/**
 * Build a real `ReferrerLookup` backed by `oras discover`. `discover(digest)`
 * runs `oras discover --format json <repo>@<digest>` and maps every returned
 * manifest into a `Referrer`, classified by `classify` above. Returns `[]`
 * (never throws) when `oras` reports no referrers for a digest — an image
 * with no attached SBOM/provenance/signature is a normal outcome, not an
 * error. Throws `ToolNotAvailableError`
 * (../components/verbs/process-runner.ts) if `oras` itself is not installed,
 * so a misconfigured environment fails loudly rather than silently reporting
 * "no referrers" for every digest.
 */
export declare function createOrasReferrerLookup(options: OrasReferrerLookupOptions): ReferrerLookup;
//# sourceMappingURL=oras-referrer-lookup.d.ts.map