/**
 * EPSS (Exploit Prediction Scoring System) enrichment.
 *
 * EPSS is maintained by FIRST.org and scores each CVE 0.0–1.0 for the
 * probability of exploitation in the wild within the next 30 days.
 * We join it onto `DepVulnFinding.epssScore` so renders can surface
 * "this one's getting hit right now" alongside CVSS (which only
 * measures severity if exploited, not likelihood).
 *
 * API: `GET https://api.first.org/data/v1/epss?cve=CVE-1,CVE-2,...`
 * Response shape (we only read `data[]`):
 *   {
 *     "status": "OK",
 *     "data": [
 *       { "cve": "CVE-2022-1234", "epss": "0.00042",
 *         "percentile": "0.06523", "date": "2026-04-23" }
 *     ]
 *   }
 *
 * Design mirrors `osv.ts`:
 *   - Session-scoped Map cache so repeated runs in one process don't
 *     re-query the same CVE.
 *   - AbortSignal.timeout keeps the analyzer from hanging behind a
 *     slow/unreachable EPSS endpoint.
 *   - Fetcher is injectable for unit tests that must avoid real network.
 *   - Graceful degradation: every IO failure maps to "no score", which
 *     callers treat as "don't render an EPSS column for this finding".
 *
 * Only CVE IDs are scoreable — GHSA/RUSTSEC/GO-YYYY-NNNN records need
 * a CVE alias to get an EPSS score. Callers pull CVEs from both
 * `DepVulnFinding.id` and `aliases[]` before enrichment.
 */
/** Signature of the fetcher — swapped in tests to avoid real network. */
export type EpssFetcher = (ids: ReadonlyArray<string>) => Promise<Map<string, number>>;
/**
 * Extract the CVE ID from a DepVulnFinding-ish input. Returns the
 * primary `id` if it's already a CVE, otherwise the first CVE alias,
 * or null when none exists. GHSA/RUSTSEC/GO/PYSEC primaries rely on
 * aliases to pick up a CVE.
 */
export declare function extractCveId(finding: {
    id: string;
    aliases?: ReadonlyArray<string>;
}): string | null;
/**
 * Enrich `ids` with EPSS scores. Consults the session cache first;
 * batches everything else via the fetcher. Returns a map keyed by
 * CVE id — IDs with no score (not in EPSS dataset, or all batches
 * failed) are absent from the result map. Callers should treat
 * absence as "no data available".
 */
export declare function enrichEpss(ids: ReadonlyArray<string>, fetcher?: EpssFetcher): Promise<Map<string, number>>;
/** Test-only — reset the process cache between tests. */
export declare function __clearEpssCache(): void;
//# sourceMappingURL=epss.d.ts.map