/**
 * Shared value helpers for the Fusion tools: severity scales, timestamps,
 * identifier checks, QL string handling, comment mentions, tag merging and
 * the detection record formatter.
 */
import type { FusionDetectionEntity, FusionDetectionRecord, FusionTimestamp } from "./types.js";
/**
 * Case severity is an integer. Sophos documents these five values and says
 * more may be added between them, so range comparisons are preferred over
 * exact matches when filtering.
 */
export declare const CASE_SEVERITY_LABELS: Record<number, string>;
export declare const CASE_SEVERITY_NAMES: readonly ["informational", "low", "medium", "high", "critical"];
export type CaseSeverityName = (typeof CASE_SEVERITY_NAMES)[number];
/** Accepts 2, 4, 6, 8, 10 or one of the five labels. Returns the integer. */
export declare function normaliseCaseSeverity(value: number | string): number;
export declare function caseSeverityLabel(value: number | null | undefined): string | null;
/** Detections API `{ seconds, nanos }` to ISO 8601. */
export declare function timestampToIso(ts: FusionTimestamp | null | undefined): string | null;
export declare function isUuid(value: string): boolean;
/** Fusion short IDs look like CSE00001. */
export declare function isCaseShortId(value: string): boolean;
/**
 * Classic (legacy) Sophos Central case IDs look like 1-598868. They never
 * resolve in Fusion, which holds a separate case set.
 */
export declare function isLegacyCaseId(value: string): boolean;
/**
 * Detection and event IDs on the case evidence mutations are six section
 * resource names, for example
 * alert://priv:event-filter:123456:1789526908712:aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
 * or event://priv:scwx.process:123456:1789526819919:99999999-8888-7777-6666-555555555555.
 * A bare UUID is refused by the API with "invalid rn format, should have 6
 * sections, got: 1" (live tenant, 22/09/2026), so the shape is checked here
 * and the caller gets a useful message instead.
 */
export declare function isResourceName(value: string): boolean;
export declare const RESOURCE_NAME_EXAMPLE = "alert://priv:event-filter:123456:1789526908712:aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
/**
 * Single-quote a value for a QL predicate. Sophos does not document an escape
 * sequence for a quote inside a QL string, so values that contain one are
 * refused rather than guessed at; the raw `query` parameter is the way round.
 */
export declare function qlString(value: string): string;
/** Guards assignee_id: Fusion takes a Subject ID or an @mention, never an email. */
export declare function looksLikeEmail(value: string): boolean;
/**
 * The @mention tokens a comment would fire, in the form mentionsIds stores
 * them: lower case, leading @ kept, deduplicated. Only word-initial tokens
 * count, so an email address inside the comment is not a mention. This mirrors
 * the parser's measured behaviour (22/09/2026); the API's mentionsIds is the
 * truth for which tokens actually resolved.
 */
export declare function parseMentionTokens(text: string): string[];
/** Union of the current tags and the additions, order preserved, no duplicates. */
export declare function mergeTags(current: string[] | null | undefined, additions: string[]): string[];
export declare function formatEntity(e: FusionDetectionEntity): {
    name: string;
    subtype: string;
    identifiers: string[];
};
/** One detection record as the tools return it. Severity here is the 0 to 1 float. */
export declare function formatDetection(r: FusionDetectionRecord, attachment?: {
    createdAt: string;
    isGenesis: boolean;
}): {
    id: string;
    title: string | null;
    severity_0_to_1: number | null;
    confidence: number | null;
    status: string | null;
    resolution_reason: string | null;
    origin: string | null;
    detector: string | null;
    detector_id: string | null;
    created_at: string | null;
    first_seen_at: string | null;
    sensor_types: string[];
    tags: string[];
    attack_technique_ids: string[];
    source_entities: {
        name: string;
        subtype: string;
        identifiers: string[];
    }[];
    target_entities: {
        name: string;
        subtype: string;
        identifiers: string[];
    }[];
    event_count: number;
    is_genesis: boolean | null;
    attached_at: string | null;
};
//# sourceMappingURL=format.d.ts.map