/**
 * Entity vocabulary shared by `Chip purpose="entity"`, `EntityMenu` and
 * `AnalystMarkdown`.
 *
 * The kind list is provisional: it covers what the product surfaces today, but
 * the canonical set belongs to the entity-resolution service and should be
 * agreed with its owners before anything depends on exhaustiveness. It is a
 * closed union rather than a string so that the defang rules below, and the
 * accessible-name labels, cannot silently miss a kind.
 */
export type EntityKind = 'ip' | 'domain' | 'url' | 'email' | 'hash' | 'file' | 'process' | 'host' | 'user' | 'account' | 'cve' | 'technique' | 'rule';
/** Intelligence verdict. Uses the status palette, never the severity scale. */
export type EntityVerdict = 'malicious' | 'suspicious' | 'benign' | 'unknown';
/**
 * Spoken form of each kind. This is what prefixes an entity's accessible name,
 * so a screen-reader user hears "IP address 203.0.113.47" rather than a bare
 * string of digits with no indication of what it is.
 */
export declare const ENTITY_KIND_LABEL: Record<EntityKind, string>;
export declare function isDefangable(kind: EntityKind): boolean;
/**
 * Neutralise an indicator so it can be pasted into a ticket, a chat message or
 * an email without being turned into a live link, unfurled by a preview bot, or
 * rewritten by a security proxy.
 *
 * Follows the convention used by CyberChef and MISP: every dot is bracketed,
 * `http` becomes `hxxp`, and `@` is bracketed. Bracketing every dot rather than
 * only the last is what makes the result unambiguous to the analyst refanging
 * it at the other end.
 *
 * @example defangIndicator('203.0.113.47')     // '203[.]0[.]113[.]47'
 * @example defangIndicator('https://evil.com') // 'hxxps[://]evil[.]com'
 */
export declare function defangIndicator(value: string): string;