/**
 * ComplianceIssue status vocabulary — the ONE spelling every consumer takes
 * from the minted package: the webapp's Postgres CHECK, `ComplianceIssueStatus`
 * const, client union and policy sets; the `mcp` `list_compliance_issues`
 * filter; the `ai-tools` `query_compliance` filter; the generated MCP tool
 * surface. Client-safe (no node built-ins) — the webapp imports it from the
 * root barrel in browser code.
 *
 * Semantics — the definitional home; the webapp's policy sets cite it:
 * - `open`: live; counts against the posture score.
 * - `acknowledged`: machine-written by the tier-aware alert policy (actor
 *   sentinel `tier-policy`): expected on the organisation's configuration,
 *   re-derived every scan. Not a suppression. The 2026-09-02 rework moves
 *   that lane to `expected` and reserves this value with no writer.
 * - `pending_verification`: the cure-lane hold — a cure ran and only the next
 *   scan can observe the violation gone. Non-compliant until settled (absent
 *   → `resolved`, seen again → `open`, or returned to `open` by the sweep).
 * - `resolved`: the terminal state every lane leaves; a recurrence reopens the
 *   same row.
 * - `suppressed`: a person opted out; no machine actor writes over it.
 * - `expected`: machine-written: a structural consequence of the app's tier
 *   knob on a development- or staging-stage asset. Informational — outside
 *   the headline figure, inside coverage; re-derived every scan; escalates to
 *   `open` when the stage, knob or rule changes; never on production, root or
 *   platform-stage accounts, never for a critical rule; suppression wins.
 * - `mitigated`: machine-written: a construct-level compensating control
 *   covers the rule for that resource at every stage. Counted as met; the
 *   reason carries the evidence pointer; suppression wins.
 * `expected` and `mitigated` have no writer until the rework ships; they
 * exist here first so the vocabulary mints once.
 *
 * Fjall-first: a status lands here and mints before the webapp bumps,
 * migrates its CHECK and Enum8 and classifies it (design
 * 2026-09-01-tier-aware-alert-policy § 13.5). The mint→deploy window is safe
 * only while `webapp/app/routes/api/compliance/issues.ts` rejects an unknown
 * `status` filter with 400 — that gate must not loosen.
 *
 * Deliberately NO zod schema here: `.describe()` text is registered per zod
 * instance and the MCP SDK renders JSON Schema from its own, so a util-built
 * schema could reach the tool surface with its descriptions silently dropped.
 * `mcp` and `ai-tools` build `z.enum(COMPLIANCE_ISSUE_STATUSES)` locally.
 */
export declare const COMPLIANCE_ISSUE_STATUSES: readonly ["open", "acknowledged", "pending_verification", "resolved", "suppressed", "expected", "mitigated"];
export type ComplianceIssueStatus = (typeof COMPLIANCE_ISSUE_STATUSES)[number];
/** Type guard: checks whether a string is a ComplianceIssue status. */
export declare function isComplianceIssueStatus(value: string): value is ComplianceIssueStatus;
/**
 * ComplianceIssue severity vocabulary, most severe first — the order the
 * webapp's `COMPLIANCE_SEVERITY_RANK` (app/.server/types/database-enums.ts)
 * ranks by and its `/api/compliance/issues` `severity` filter accepts. The
 * `mcp` `list_compliance_issues` filter builds `z.enum(...)` from it (same
 * no-zod-here rationale as the statuses).
 */
export declare const COMPLIANCE_ISSUE_SEVERITIES: readonly ["critical", "high", "medium", "low"];
/** @public — tuple companion type; ships with its tuple (knip skips @public) */
export type ComplianceIssueSeverity = (typeof COMPLIANCE_ISSUE_SEVERITIES)[number];