/**
 * CISA Known Exploited Vulnerabilities (KEV) enrichment.
 *
 * CISA publishes a catalog of CVEs the US-federal-agency ISAC has
 * confirmed are being actively exploited in the wild (different from
 * EPSS's *probability of* exploitation). A KEV hit is the strongest
 * "fix this now" signal we can attach to a finding.
 *
 * Feed: `https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json`
 *
 * Shape (we only read `vulnerabilities[].cveID`):
 *   {
 *     "catalogVersion": "...",
 *     "dateReleased": "...",
 *     "count": 1200-ish,
 *     "vulnerabilities": [
 *       { "cveID": "CVE-2021-44228", "vendorProject": "Apache", ... }
 *     ]
 *   }
 *
 * Unlike EPSS (per-CVE lookup), KEV is a bulk download + local
 * lookup — one HTTP call per session, search is a `Set.has`.
 *
 * Design mirrors `osv.ts` / `epss.ts`:
 *   - Session-scoped cache so the catalog is fetched at most once
 *     per process (it's ~1300 entries, ~200KB).
 *   - AbortSignal.timeout prevents stalls.
 *   - Fetcher injectable for tests.
 *   - Graceful degradation: if the catalog is unreachable, every
 *     finding's `kev` stays unset (treated as "no data", not
 *     "confirmed not KEV").
 */
/** Shape of the fetcher — swapped in tests to avoid real network. */
export type KevFetcher = () => Promise<Set<string> | null>;
/**
 * Fetch (or return cached) KEV catalog as a Set of CVE IDs. Returns
 * an empty set on network failure so callers can treat "KEV lookup
 * succeeded but CVE X is not listed" and "KEV fetch failed" the
 * same way — both collapse to "no KEV flag on this finding". The
 * distinction is preserved in logs via DXKIT_DEBUG_KEV.
 */
export declare function getKevCatalog(fetcher?: KevFetcher): Promise<Set<string>>;
/**
 * Enrich `cves` with KEV membership. Returns the subset of input
 * CVE IDs that appear in the catalog. Empty result is safe —
 * callers interpret absence from the result set as "not KEV"
 * (true negative; caller should set `kev: false`).
 */
export declare function enrichKev(cves: ReadonlyArray<string>, fetcher?: KevFetcher): Promise<Set<string>>;
/** Test-only — reset the process cache between tests. */
export declare function __clearKevCache(): void;
//# sourceMappingURL=kev.d.ts.map