/** `D` — version drift: the root package.json pin != the installed version. Decided in `sh`. */
export declare const L0_FAULT_DRIFT = "D";
/** `X` — the guard bin is missing (fresh clone, new worktree, package removed). Decided in `sh`. */
export declare const L0_FAULT_BIN_MISSING = "X";
/** `U` — the bin is missing AND nothing declares the package, so an install is a no-op. `sh`. */
export declare const L0_FAULT_UNDECLARED = "U";
/** `K` — the bin is present but CRASHED (corrupt node_modules). Decided in `sh`. */
export declare const L0_FAULT_BIN_BROKEN = "K";
/** `S` — the committed `.claude/webpieces/ai-hook.sh` != `renderShim()`. Decided in the bin, in JS. */
export declare const L0_FAULT_SHIM_STALE = "S";
/** `C` — `webpieces.config.json` is missing. Decided in the bin, in JS. */
export declare const L0_FAULT_CONFIG_MISSING = "C";
/** `Y` — a loaded rule has no `webpieces.config.json` key. Decided in the bin, in JS. */
export declare const L0_FAULT_CONFIG_OUT_OF_SYNC = "Y";
/**
 * No fault AT THIS LAYER — the value every audit line carries when nothing fired.
 *
 * Never a claim that nothing was wrong: a `fault=-` line from the `sh` shim only says the sh half found
 * nothing, and the bin it then exec'd may still have blocked on S/C/Y and stamped its own line.
 */
export declare const L0_FAULT_NONE = "-";
/**
 * The faults decided in POSIX `sh`, BEFORE the bin runs — a stale, missing or broken validator cannot
 * be trusted to validate itself. In first-match-wins order.
 */
export declare const L0_SH_FAULT_CODES: readonly ["D", "X", "U", "K"];
/**
 * The faults decided INSIDE the guard bin, in JS. These reached the audit trail with no fault label at
 * all until the JS emitters started stamping them: an `S` storm that blocked an agent for ~20 tool
 * calls left two lines in the `rejections/` stream, both attributed to a downstream rule, and nothing
 * anywhere identifying L0.
 */
export declare const L0_JS_FAULT_CODES: readonly ["S", "C", "Y"];
/**
 * EVERY L0 fault code, as a type. The two arrays above are the halves; this is their union, and it is
 * what makes `L0_FAULT_NAMES` TOTAL — a `Record<string, …>` would have forced a `?? 'unknown'` fallback
 * at every read, which is shim shape #4 (a runtime default standing in for a type that could have
 * expressed the invariant). With the union, a new fault added without a name is a COMPILE error, and
 * neither reader needs a defensive branch.
 */
export type L0FaultCode = typeof L0_SH_FAULT_CODES[number] | typeof L0_JS_FAULT_CODES[number];
/**
 * The stable, human-readable GUARD NAME per fault code — what goes in the deny's `[…]` header, in the
 * matrix doc's own `guard` column, and nowhere else in a second spelling.
 *
 * L1 prints `[stale-main-bash-guard] (1 violation)` and L0 printed nothing comparable; the names below
 * are deliberately in that same kebab shape so the two layers read as one system. They are IDENTITY, not
 * prose: renaming one silently breaks a grep that spans all three artifacts, exactly as renumbering an
 * L1 row would (see L1_ROWS' header).
 */
export declare const L0_FAULT_NAMES: Readonly<Record<L0FaultCode, string>>;
/**
 * The LAYER token — the other half of every join key, spelled once. The deny header, the matrix
 * citation, the sh audit line and guards/L0-tooling.md all read it from here, so `grep layer=L0` cannot
 * miss an artifact that typed the token itself.
 */
export declare const L0_LAYER = "L0";
/**
 * The three rows of L0's decision matrix, by number — the numbers `renderGuardMatrixDoc` prints, the
 * numbers the audit line's `row=` carries, and the numbers a deny cites. L0's matrix has no genuine
 * second dimension: every branch reduces to `fault present?` x `on the allowlist?`.
 *
 * All three are named because all three are LOGGED: the sh half writes a line for the healthy hand-down
 * too (`PASS-BIN-ALLOW`), which is the line that tells "the guard ran and found nothing" apart from
 * "the guard never ran".
 */
export declare const L0_ROW_HANDED_DOWN = "1";
/** Row 2: a fault is present but the call is on the L0 allowlist — a cure, a Read, or the config edit. */
export declare const L0_ROW_ALLOWLISTED = "2";
/** Row 3: a fault is present and the call is NOT on the allowlist. The one row that ever BLOCKS. */
export declare const L0_ROW_BLOCKED = "3";
/**
 * The `[guard-name] (layer=L0 fault=<code> row=<n>)` header every L0 deny opens with, after the ❌ line.
 *
 * ONE builder, called by the JS denies directly and interpolated into the POSIX-sh denies at render
 * time by renderShim() — so the sh half cannot spell the coordinates differently from the JS half even
 * though it cannot import anything at runtime. `detail` is the per-fault count that mirrors
 * formatReport's `(N violations)`.
 */
export declare function l0GuardHeader(fault: L0FaultCode, detail: string): string;
/**
 * The one-line citation of WHICH matrix row was taken and on what dimension values — L1's pattern
 * (its deny cites "`w` / `n` / `n` - row 8"), in L0's own two columns.
 */
export declare function l0MatrixCitation(fault: L0FaultCode): string;