@intentius/chant 0.123.0 → 0.124.1

package/dist/cli/commands/check-lexicon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-lexicon.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/check-lexicon.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAInD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB;AAyBD,gEAAgE;AAChE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAIlE;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAyB/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,GACV;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAanC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAazE;AAID;;GAEG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA8lBpE;AAqBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAmDzE"}
+{"version":3,"file":"check-lexicon.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/check-lexicon.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAInD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB;AAyBD,gEAAgE;AAChE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAIlE;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAyB/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,GACV;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAanC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAazE;AAID;;GAEG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgmBpE;AAqBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAmDzE"}

package/dist/config-import.d.ts

@@ -6,7 +6,7 @@
  * — one narrow module whose only job is "execute project-authored code here",
  * so that the question "did any project code run in this process?" has one
  * place to look and one place to instrument (see
- * `examples/sandbox-execution-boundary.test.ts`, which spies on both).
+ * `examples/sandbox-execution-boundary.e2e.test.ts`, which spies on both).
  *
  * Callers must not `import()` a config file directly. `./config-sandbox.ts`
  * decides whether a given load is allowed to come through here at all: under

package/dist/lint/policy-import.d.ts

@@ -7,7 +7,7 @@
  * `importConfigModule` (`chant.config.ts`): one narrow module whose only job is
  * "execute project-authored code here", so that "did any project code run in
  * this process?" has one place to look and one place to instrument — see
- * `examples/sandbox-execution-boundary.test.ts`, which spies on all three.
+ * `examples/sandbox-execution-boundary.e2e.test.ts`, which spies on all three.
  *
  * Before chant #1131 `./policy.ts` called `await import(resolved)` inline,
  * which is why the corpus boundary gate could not see it even after #1113 put

package/dist/notify-verify.js

@@ -0,0 +1,76 @@
+/**
+ * Signing and checking a notify event (#3761). This module needs only
+ * `node:crypto`, so a receiver can import it alone and bundle nothing else:
+ *
+ * ```ts
+ * import { verifyWebhook } from "@intentius/chant/notify-verify";
+ *
+ * const checked = verifyWebhook({ body, headers: req.headers, key: process.env.CHANT_WEBHOOK_KEY });
+ * if (!checked.ok) return reply(401, checked.reason);
+ * handle(checked.event);
+ * ```
+ *
+ * The signature is HMAC-SHA256, keyed with the shared secret, over
+ * `<timestamp>.<body>`: the timestamp header (seconds since the epoch), a
+ * dot, and the request body exactly as sent. It travels as
+ * `x-chant-signature: sha256=<hex>`. Signing the timestamp with the body lets
+ * a receiver refuse a delivery replayed later; {@link verifyWebhook} refuses
+ * one more than five minutes from now by default. This is SQL Yodeler's
+ * scheme (#3756), with the header prefix a product can keep as its own.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+/** The header names' default prefix. A product passes its own (`x-yodel`, `x-terragucci`) to keep its receivers working. */
+export const DEFAULT_HEADER_PREFIX = "x-chant";
+/** The four headers a delivery carries, under `prefix`. */
+export function webhookHeaderNames(prefix = DEFAULT_HEADER_PREFIX) {
+    const p = prefix.toLowerCase();
+    return { signature: `${p}-signature`, timestamp: `${p}-timestamp`, event: `${p}-event`, delivery: `${p}-delivery` };
+}
+/** How far from now a delivery's timestamp {@link verifyWebhook} still accepts, in seconds. */
+export const DEFAULT_TOLERANCE_SECONDS = 300;
+/** `sha256=<hex>` of `<timestamp>.<body>`, keyed with `key`. */
+export function signWebhook(key, timestamp, body) {
+    return `sha256=${createHmac("sha256", key).update(`${String(timestamp)}.${body}`, "utf8").digest("hex")}`;
+}
+function header(headers, name) {
+    if (typeof headers.get === "function")
+        return headers.get(name) ?? undefined;
+    for (const [k, v] of Object.entries(headers)) {
+        if (k.toLowerCase() !== name)
+            continue;
+        return Array.isArray(v) ? v[0] : v;
+    }
+    return undefined;
+}
+/**
+ * Whether a delivery was signed with `key` and is recent: the signature
+ * header matches (compared in constant time) and the timestamp is within the
+ * tolerance either side of now. On success, the parsed event.
+ */
+export function verifyWebhook(input) {
+    if (!input.key)
+        return { ok: false, reason: "no key to verify with" };
+    const names = webhookHeaderNames(input.prefix);
+    const body = typeof input.body === "string" ? input.body : Buffer.from(input.body).toString("utf8");
+    const signature = header(input.headers, names.signature);
+    const timestamp = header(input.headers, names.timestamp);
+    if (!signature)
+        return { ok: false, reason: `no ${names.signature} header` };
+    if (!timestamp || !/^\d+$/.test(timestamp))
+        return { ok: false, reason: `no ${names.timestamp} header, or not a number of seconds` };
+    const expected = Buffer.from(signWebhook(input.key, timestamp, body));
+    const given = Buffer.from(signature);
+    if (given.length !== expected.length || !timingSafeEqual(given, expected))
+        return { ok: false, reason: "the signature does not match" };
+    const now = input.now ?? Math.floor(Date.now() / 1000);
+    const tolerance = input.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+    if (Math.abs(now - Number(timestamp)) > tolerance)
+        return { ok: false, reason: `the timestamp is more than ${String(tolerance)}s from now` };
+    try {
+        return { ok: true, event: JSON.parse(body) };
+    }
+    catch {
+        return { ok: false, reason: "the body is not JSON" };
+    }
+}
+//# sourceMappingURL=notify-verify.js.map

package/dist/notify.js

@@ -0,0 +1,307 @@
+/**
+ * Notify (#3761): tell people that a wave waits for an approval, that a run
+ * was refused or failed, or that drift was found.
+ *
+ * terragucci and SQL Yodeler each carried a copy of this (#3756). chant owns
+ * the event, its signing and the Slack and Teams posting; a product decides
+ * when to send and what its summary says. One event shape,
+ * `chant.notify/v1` (`./notify.schema.json`), carries what both send: the
+ * wave or environment, the targets concerned, the plan digest, the command
+ * that approves it and the run's link.
+ *
+ * ```ts
+ * import { makeNotifyEvent, sendNotify } from "@intentius/chant/notify";
+ *
+ * const event = makeNotifyEvent({ source: "sql-yodeler", event: "waiting", summary: "prod waits for an approval", targets: ["0007_add_index"], digest, approve: { command } });
+ * await sendNotify({ webhook: "YODEL_WEBHOOK_URL", key: "YODEL_WEBHOOK_KEY", slack: "SLACK_WEBHOOK_URL" }, event);
+ * ```
+ *
+ * The configuration names environment variables, never URLs or keys, and
+ * nothing here prints a URL or a key. The generic webhook gets the event as
+ * JSON, signed over `<timestamp>.<body>` (`./notify-verify.ts`); it is never
+ * posted unsigned. Slack and Teams incoming webhooks get a message rendered
+ * from the event, unsigned, since neither checks a signature. A delivery that
+ * fails is logged and returned; {@link sendNotify} never throws, so a
+ * caller's exit code never depends on it.
+ *
+ * Bundle-safe: this module reaches only `node:crypto` and
+ * `./notify-verify.ts` (`./notify-bundle.test.ts`).
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { DEFAULT_HEADER_PREFIX, signWebhook, webhookHeaderNames } from "./notify-verify.js";
+export { DEFAULT_HEADER_PREFIX, DEFAULT_TOLERANCE_SECONDS, signWebhook, verifyWebhook, webhookHeaderNames } from "./notify-verify.js";
+/** The event's `schema` value. A field is only ever added within a version. */
+export const NOTIFY_SCHEMA = "chant.notify/v1";
+/** The JSON Schema's `$id`. */
+export const NOTIFY_SCHEMA_ID = "https://intentius.io/chant/schemas/notify/v1/notify.schema.json";
+/** What happened. */
+export const NOTIFY_EVENTS = ["waiting", "refused", "failed", "drift"];
+/** The CI run, from its environment: GitHub Actions, Forgejo Actions or GitLab CI. */
+export function ciRun(env) {
+    const out = {};
+    if (env.CI_JOB_URL)
+        out.url = env.CI_JOB_URL;
+    else if (env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY && env.GITHUB_RUN_ID)
+        out.url = `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`;
+    else if (env.CI_PIPELINE_URL)
+        out.url = env.CI_PIPELINE_URL;
+    if (env.GITLAB_CI === "true")
+        out.forge = "gitlab";
+    else if (env.GITEA_ACTIONS === "true" || env.FORGEJO_ACTIONS === "true")
+        out.forge = "forgejo";
+    else if (env.GITHUB_ACTIONS === "true")
+        out.forge = "github";
+    const repository = env.GITHUB_REPOSITORY || env.CI_PROJECT_PATH;
+    if (repository)
+        out.repository = repository;
+    const commit = env.GITHUB_SHA || env.CI_COMMIT_SHA;
+    if (commit)
+        out.commit = commit;
+    return out;
+}
+/**
+ * A whole event: the fields, with the schema, the time, the CI run (the
+ * product's own `run` fields win) and an id. The id is a hash over the
+ * source, project, event, wave, environment and digest (else the drift
+ * fingerprint, else the commit), so a re-run sends the same id; with none of
+ * the three it is random.
+ */
+export function makeNotifyEvent(fields, options = {}) {
+    const env = options.env ?? process.env;
+    const { id: given, project, targets, run: own, ...rest } = fields;
+    const run = { ...ciRun(env), ...(own ?? {}) };
+    const resolvedProject = project ?? run.repository ?? "this project";
+    const key = fields.digest ?? fields.drift?.fingerprint ?? run.commit;
+    const id = given ??
+        (key
+            ? createHash("sha256").update(JSON.stringify([fields.source, resolvedProject, fields.event, fields.wave?.number ?? null, fields.environment ?? null, key])).digest("hex")
+            : randomUUID());
+    return {
+        schema: NOTIFY_SCHEMA,
+        id,
+        at: (options.now ?? new Date()).toISOString(),
+        ...rest,
+        project: resolvedProject,
+        targets: targets ?? [],
+        ...(Object.keys(run).length > 0 ? { run } : {}),
+    };
+}
+const HEADLINE = {
+    waiting: "waits for an approval",
+    refused: "was refused",
+    failed: "failed",
+    drift: "drifted",
+};
+/** The first line of every chat message: `<source>: <summary>`, or what happened to what when there is no summary. */
+export function notifyHeadline(e) {
+    if (e.summary)
+        return `${e.source}: ${e.summary}`;
+    const what = e.wave ? `wave ${e.wave.number}${e.wave.name ? ` (${e.wave.name})` : ""} of ${e.project}` : e.environment ? `${e.environment} in ${e.project}` : e.project;
+    return `${e.source}: ${what} ${HEADLINE[e.event]}`;
+}
+/** The label and value lines both chat messages show, in order. */
+function facts(e) {
+    const out = [];
+    if (e.approve?.review)
+        out.push({ title: "Review and approve", value: `pull request ${e.approve.review.pr}, then run it again`, link: e.approve.review.url });
+    if (e.drift) {
+        if (e.drift.changed.length > 0)
+            out.push({ title: "Drifted", value: e.drift.changed.join(", ") });
+        if (e.drift.missing?.length)
+            out.push({ title: "Missing", value: e.drift.missing.join(", ") });
+        if (e.drift.failed?.length)
+            out.push({ title: "Not refreshed", value: e.drift.failed.join(", ") });
+    }
+    else if (e.targets.length > 0)
+        out.push({ title: "Targets", value: e.targets.join(", ") });
+    if (e.digest)
+        out.push({ title: "Digest", value: e.digest });
+    if (e.approve)
+        out.push({ title: e.approve.review ? "Or approve" : "Approve", value: e.approve.command });
+    if (e.reason)
+        out.push({ title: "Reason", value: e.reason });
+    if (e.run?.url)
+        out.push({ title: "Run", value: e.run.url, link: e.run.url });
+    if (e.reportUrl)
+        out.push({ title: "Report", value: e.reportUrl, link: e.reportUrl });
+    return out;
+}
+/** A Slack incoming webhook's body: one mrkdwn text, with the approve command as code and the links as links. */
+export function slackMessage(e) {
+    const lines = [`*${notifyHeadline(e)}*`];
+    for (const f of facts(e)) {
+        if (f.title === "Review and approve")
+            lines.push(`${f.title}: <${f.link}|pull request ${e.approve.review.pr}>, then run it again`);
+        else if (f.title === "Approve" || f.title === "Or approve" || f.title === "Digest")
+            lines.push(`${f.title}: \`${f.value}\``);
+        else if (f.link)
+            lines.push(`${f.title}: <${f.link}>`);
+        else
+            lines.push(`${f.title}: ${f.value}`);
+    }
+    return { text: lines.join("\n") };
+}
+/** A Teams incoming webhook's body (a Workflows webhook): one Adaptive Card, with buttons that open the review page and the run. */
+export function teamsMessage(e) {
+    const all = facts(e);
+    const actions = [
+        ...(e.approve?.review ? [{ type: "Action.OpenUrl", title: "Review and approve", url: e.approve.review.url }] : []),
+        ...(e.run?.url ? [{ type: "Action.OpenUrl", title: "Open the run", url: e.run.url }] : []),
+    ];
+    return {
+        type: "message",
+        attachments: [
+            {
+                contentType: "application/vnd.microsoft.card.adaptive",
+                contentUrl: null,
+                content: {
+                    $schema: "http://adaptivecards.io/schemas/adaptive-card.json",
+                    type: "AdaptiveCard",
+                    version: "1.4",
+                    body: [
+                        { type: "TextBlock", text: notifyHeadline(e), weight: "Bolder", wrap: true },
+                        { type: "FactSet", facts: all.map((f) => ({ title: f.title, value: f.link && f.title === "Review and approve" ? `${f.value}: ${f.link}` : f.value })) },
+                    ],
+                    ...(actions.length > 0 ? { actions } : {}),
+                },
+            },
+        ],
+    };
+}
+const VARIABLE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SETTINGS = ["webhook", "key", "slack", "teams", "events"];
+/** The first problem with a {@link NotifyConfig}, or undefined. `where` prefixes the message. */
+export function notifyConfigProblem(value, where = "notify") {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return `${where}: expected { webhook, key, slack, teams, events }`;
+    const v = value;
+    for (const k of Object.keys(v))
+        if (!SETTINGS.includes(k))
+            return `${where}.${k}: unknown setting (expected ${SETTINGS.join(", ")})`;
+    for (const k of ["webhook", "key", "slack", "teams"]) {
+        const n = v[k];
+        if (n === undefined)
+            continue;
+        if (typeof n !== "string" || !VARIABLE.test(n)) {
+            const what = k === "key" ? "signing key" : "URL";
+            return `${where}.${k}: the name of the environment variable that holds the ${what}, never the ${k === "key" ? "key" : "URL"} itself`;
+        }
+    }
+    if (v.webhook !== undefined && v.key === undefined)
+        return `${where}.key: a webhook needs a signing key; name the variable that holds it`;
+    if (v.key !== undefined && v.webhook === undefined)
+        return `${where}.webhook: a key is for a webhook; name the variable that holds its URL`;
+    if (v.webhook === undefined && v.slack === undefined && v.teams === undefined)
+        return `${where}: name a webhook (with its key), a slack or a teams URL variable`;
+    if (v.events !== undefined && !(Array.isArray(v.events) && v.events.every((e) => NOTIFY_EVENTS.includes(e)))) {
+        return `${where}.events: a list of ${NOTIFY_EVENTS.join(", ")}`;
+    }
+    return undefined;
+}
+/** The environment variables a configuration names, for a pipeline to map its secrets into. */
+export function notifyVariables(config) {
+    if (!config)
+        return [];
+    return [config.webhook, config.key, config.slack, config.teams].filter((n) => typeof n === "string" && n !== "");
+}
+/** The request {@link sendNotify} posts to the webhook: the event as JSON, signed with `key` over `<timestamp>.<body>`. */
+export function webhookRequest(event, key, options = {}) {
+    const body = JSON.stringify(event);
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    const names = webhookHeaderNames(options.prefix ?? DEFAULT_HEADER_PREFIX);
+    return {
+        body,
+        headers: {
+            "content-type": "application/json",
+            "user-agent": options.userAgent ?? event.source,
+            [names.event]: event.event,
+            [names.delivery]: event.id,
+            [names.timestamp]: String(now),
+            [names.signature]: signWebhook(key, now, body),
+        },
+    };
+}
+/** A failure's message, with every URL it names cut out. */
+function redact(message, urls) {
+    let out = message;
+    for (const u of urls)
+        if (u)
+            out = out.split(u).join("<url>");
+    return out.replace(/https?:\/\/\S+/g, "<url>");
+}
+async function post(fetchFn, url, request, attempts, sleep) {
+    let last = "not attempted";
+    for (let i = 0; i < attempts; i++) {
+        if (i > 0)
+            await sleep(500 * i);
+        try {
+            const res = await fetchFn(url, { method: "POST", ...request, signal: AbortSignal.timeout(10000) });
+            if (res.ok)
+                return undefined;
+            last = `HTTP ${String(res.status)}`;
+            // A 4xx will not change on a retry: the receiver refused the event.
+            if (res.status < 500)
+                return last;
+        }
+        catch (e) {
+            last = redact(e instanceof Error ? e.message : String(e), [url]);
+        }
+    }
+    return last;
+}
+const LABEL = { webhook: "the webhook", slack: "Slack", teams: "Teams" };
+/**
+ * Sends `event` to what `config` names, reading the URLs and the key from
+ * the environment at send time. Never throws: each delivery's outcome is
+ * returned, and a failed one is logged without its URL.
+ */
+export async function sendNotify(config, event, options = {}) {
+    if (!config || !event)
+        return [];
+    if (config.events && !config.events.includes(event.event))
+        return [];
+    const env = options.env ?? process.env;
+    const fetchFn = options.fetch ?? ((url, init) => globalThis.fetch(url, init));
+    const attempts = Math.max(1, options.attempts ?? 3);
+    const sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const log = options.log ?? ((line) => process.stderr.write(line + "\n"));
+    const out = [];
+    const deliver = async (target, variable, request) => {
+        let d;
+        try {
+            const url = env[variable];
+            if (!url)
+                d = { target, ok: false, detail: `${variable} is not set` };
+            else {
+                const r = request();
+                if (typeof r === "string")
+                    d = { target, ok: false, detail: r };
+                else {
+                    const failed = await post(fetchFn, url, r, attempts, sleep);
+                    d = { target, ok: failed === undefined, detail: failed ?? "delivered" };
+                }
+            }
+        }
+        catch (e) {
+            d = { target, ok: false, detail: redact(e instanceof Error ? e.message : String(e), [env[variable] ?? ""]) };
+        }
+        if (!d.ok)
+            log(`notify: the ${event.event} event was not delivered to ${LABEL[target]}: ${d.detail}`);
+        out.push(d);
+    };
+    const json = (body) => ({ headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+    if (config.webhook) {
+        await deliver("webhook", config.webhook, () => {
+            const key = config.key ? env[config.key] : undefined;
+            if (!key)
+                return `${config.key ?? "the key variable"} is not set, and an event is never sent unsigned`;
+            return webhookRequest(event, key, { ...(options.now !== undefined ? { now: options.now } : {}), ...(options.prefix ? { prefix: options.prefix } : {}), ...(options.userAgent ? { userAgent: options.userAgent } : {}) });
+        });
+    }
+    if (config.slack)
+        await deliver("slack", config.slack, () => json((options.render?.slack ?? slackMessage)(event)));
+    if (config.teams)
+        await deliver("teams", config.teams, () => json((options.render?.teams ?? teamsMessage)(event)));
+    return out;
+}
+//# sourceMappingURL=notify.js.map

package/dist/op/__fixtures__/decide-stub-backend.d.ts

@@ -15,7 +15,7 @@
  * forces one (429 or 529, say). Every request it read is kept in `requests`.
  *
  * It lives under `__fixtures__` because it listens on a port, and no module
- * chant runs does (#2657, `test/no-listener.test.ts`): only tests start it.
+ * chant runs does (#2657, `test/no-listener.e2e.test.ts`): only tests start it.
  */
 import type { WireAnswer } from "../../workspace/points.js";
 import { type BackendRequest } from "../decide-backend.js";

package/dist/op/index.d.ts

@@ -20,10 +20,10 @@ export { discoverOps } from "./discover.js";
 export type { DiscoveredOp, OpDiscoveryResult } from "./discover.js";
 export { generateOpsPipeline, generateOpWavesPipeline, withOpSchedules } from "./generate-pipeline.js";
 export type { GenerateOpsPipelineResult, GenerateOpWavesPipelineResult } from "./generate-pipeline.js";
-export { OP_WAVE_DEFAULT_APPLY, OP_WAVE_GATE_POLICIES, OP_WAVE_HOOK_MOMENTS, assertOpWaveHooks, assertOpWavesSpec, opWaveHooksAt, opWaveJobs, opWaveRecordPath, opWaveShare, } from "./op-waves.js";
-export type { OpWave, OpWaveGatePolicy, OpWaveHook, OpWaveHookFailure, OpWaveHookMoment, OpWaveHooks, OpWaveJob, OpWaveRun, OpWavesSpec } from "./op-waves.js";
-export { opWaveNeedsApproval, opWavePlansPath, opWaveRunsPath, parseOpWavesSpec, readOpWavePolicy, runOpWave } from "./op-waves-run.js";
-export type { OpWaveBaseRules, OpWaveDecision, OpWaveHookOutcome, OpWaveMember, OpWavePlanFile, OpWavePlansFile, OpWaveRunsFile, RunOpWaveOptions, RunOpWaveResult, } from "./op-waves-run.js";
+export { OP_WAVE_APPLY_HOOKS_RUNNERS, OP_WAVE_DEFAULT_APPLY, OP_WAVE_GATE_POLICIES, OP_WAVE_HOOK_MOMENTS, assertOpWaveHooks, assertOpWavesSpec, opWaveApplyHooksRunBy, opWaveHooksAt, opWaveJobs, opWaveRecordPath, opWaveShare, } from "./op-waves.js";
+export type { OpWave, OpWaveApplyHooksRunner, OpWaveGatePolicy, OpWaveHook, OpWaveHookFailure, OpWaveHookMoment, OpWaveHooks, OpWaveJob, OpWaveRun, OpWavesSpec } from "./op-waves.js";
+export { opWaveHooksAtBase, opWaveNeedsApproval, opWavePlansPath, opWaveRunsPath, parseOpWavesSpec, readOpWaveHooksFile, readOpWavePolicy, runOpWave, runOpWaveApplyHooks, } from "./op-waves-run.js";
+export type { OpWaveBaseRules, OpWaveDecision, OpWaveApplyHooksRun, OpWaveHookOutcome, OpWaveHookRun, OpWaveHooksFile, OpWaveHooksResult, OpWaveMember, OpWavePlanFile, OpWavePlansFile, OpWaveRunsFile, RunOpWaveOptions, RunOpWaveResult, } from "./op-waves-run.js";
 export { notifyOpWave, opWaveNotifyFields } from "./op-waves-notify.js";
 export type { OpWaveOutcome } from "./op-waves-notify.js";
 export { loadActivities, loadProfiles, resolveActivity } from "./activity-registry.js";

package/dist/op/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/op/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAClH,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EACzP,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAC5C,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAC3D,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EACrG,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EACzF,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAC5D,wBAAwB,EAAE,mBAAmB,EAC7C,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EACtD,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACnL,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzK,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpH,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACxJ,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EACL,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,kBAAkB,GAC3H,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACnH,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAC/F,OAAO,EACL,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EACzC,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EACrE,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,EAAE,oBAAoB,EACvC,aAAa,EAAE,gBAAgB,EAC/B,gBAAgB,EAAE,mBAAmB,EAAE,YAAY,EACnD,qBAAqB,EAAE,wBAAwB,EAC/C,qBAAqB,EAAE,wBAAwB,EAC/C,sBAAsB,EAAE,yBAAyB,EACjD,iBAAiB,EAAE,oBAAoB,GACxC,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,GACxF,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EACV,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAC5F,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EACpD,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,GAClE,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC5J,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACrI,YAAY,EACV,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpF,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,YAAY,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAClG,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,cAAc,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACnI,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC5I,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1E,OAAO,EACL,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,GAC7I,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EACpG,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,oBAAoB,GACxF,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,uBAAuB,GAC5G,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,qBAAqB,EAAE,kBAAkB,GAC/G,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACxI,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,YAAY,EACV,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,UAAU,EAAE,WAAW,EAChG,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,GACjE,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACzF,YAAY,EACV,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,GAChG,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,uBAAuB,EAC9G,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzJ,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EACL,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EACtD,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,EAClE,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,gBAAgB,EACtB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EAAE,iBAAiB,EACpC,wBAAwB,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EACpG,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,GAClD,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAC1E,gBAAgB,EAAE,4BAA4B,EAAE,mBAAmB,EACnE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,GAC/F,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,cAAc,EAAE,uBAAuB,EAAE,eAAe,EAAE,QAAQ,EAAE,wBAAwB,GAC7F,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACvI,OAAO,EACL,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAC7G,oBAAoB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EACtF,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,GACvE,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,kBAAkB,EAAE,wBAAwB,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAC1F,aAAa,EAAE,kBAAkB,GAClC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,4BAA4B,GACtF,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,GACpF,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9F,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC5E,YAAY,EACV,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAC5D,gBAAgB,EAAE,mBAAmB,GACtC,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAClF,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/D,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAIrE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACrH,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/op/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAClH,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EACzP,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAC5C,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAC3D,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EACrG,aAAa,EAAE,YAAY,EAC3B,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EACzF,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAC5D,wBAAwB,EAAE,mBAAmB,EAC7C,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EACtD,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACnL,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzK,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpH,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACxJ,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EACL,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,UAAU,EAAE,kBAAkB,GAC3H,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACnH,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAC/F,OAAO,EACL,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EACzC,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EACrE,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,EAAE,oBAAoB,EACvC,aAAa,EAAE,gBAAgB,EAC/B,gBAAgB,EAAE,mBAAmB,EAAE,YAAY,EACnD,qBAAqB,EAAE,wBAAwB,EAC/C,qBAAqB,EAAE,wBAAwB,EAC/C,sBAAsB,EAAE,yBAAyB,EACjD,iBAAiB,EAAE,oBAAoB,GACxC,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,GACxF,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EACV,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAC5F,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EACpD,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,GAClE,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,MAAM,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACpL,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,SAAS,EACT,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpF,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,YAAY,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAClG,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,cAAc,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACnI,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC5I,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1E,OAAO,EACL,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,GAC7I,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EACpG,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,oBAAoB,GACxF,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,uBAAuB,GAC5G,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,qBAAqB,EAAE,kBAAkB,GAC/G,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACxI,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,YAAY,EACV,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,UAAU,EAAE,WAAW,EAChG,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,GACjE,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACzF,YAAY,EACV,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,GAChG,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,uBAAuB,EAC9G,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzJ,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EACL,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EACtD,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,EAClE,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,gBAAgB,EACtB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EAAE,iBAAiB,EACpC,wBAAwB,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EACpG,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,GAClD,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAC1E,gBAAgB,EAAE,4BAA4B,EAAE,mBAAmB,EACnE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,GAC/F,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,cAAc,EAAE,uBAAuB,EAAE,eAAe,EAAE,QAAQ,EAAE,wBAAwB,GAC7F,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACvI,OAAO,EACL,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAC7G,oBAAoB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EACtF,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,GACvE,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,kBAAkB,EAAE,wBAAwB,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAC1F,aAAa,EAAE,kBAAkB,GAClC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,4BAA4B,GACtF,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,GACpF,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9F,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC5E,YAAY,EACV,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAC5D,gBAAgB,EAAE,mBAAmB,GACtC,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAClF,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/D,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAIrE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACrH,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC"}

package/dist/op/op-waves-run.d.ts

@@ -29,12 +29,20 @@
  *   approved set (#3762). A share job (`--share i`) re-plans its
  *   slice first and refuses, without applying it, a run whose plan digest is
  *   not the one the deciding job recorded (exit 4).
+ * - Hooks file (#3804): every apply call gets `CHANT_HOOKS`, a JSON file
+ *   ({@link OpWaveHooksFile}) with the outcomes of the hooks that already ran
+ *   and whether an approval stands. Under `hooks.apply.runBy: "apply"` (read
+ *   at base) chant does not run the apply-stage hooks itself: the file hands
+ *   them to the apply, which runs them under its own lock with
+ *   {@link runOpWaveApplyHooks}, and their outcomes come back through
+ *   `CHANT_HOOKS_RESULT`. A non-wave apply reads the same hooks at base with
+ *   {@link opWaveHooksAtBase}.
  */
 import { type WaveMember } from "../gated-waves.js";
 import { type GateLedgerPort } from "./gate.js";
 import type { HeadPlans, ReviewSource } from "./gate-review.js";
 import type { TrustPolicy } from "../workspace/trust/policy.js";
-import { type GateApprovalSource, type OpWaveGatePolicy, type OpWaveHook, type OpWaveHookMoment, type OpWavesSpec } from "./op-waves.js";
+import { type GateApprovalSource, type OpWaveApplyHooksRunner, type OpWaveGatePolicy, type OpWaveHook, type OpWaveHookMoment, type OpWavesSpec } from "./op-waves.js";
 /** What a run's plan command writes to `{plan}`. */
 export interface OpWavePlanFile {
     planDigest: string;
@@ -119,6 +127,10 @@ export interface OpWaveDecision {
     approvedAt?: string;
     /** When the wave recorded that it applies under the approval, which spent it. */
     spentAt?: string;
+    /** `apply`: the apply command runs the apply-stage hooks under its own lock (#3804), as read at base. Absent: chant runs them. */
+    applyHooksRunBy?: "apply";
+    /** Every hook's outcome so far in the job that wrote the record (#3804). */
+    outcomes?: OpWaveHookOutcome[];
 }
 /** One hook's run (#3762). */
 export interface OpWaveHookOutcome {
@@ -127,7 +139,76 @@ export interface OpWaveHookOutcome {
     /** The run, for a `perRun` hook. */
     target?: string;
     exit: number;
-    outcome: "passed" | "failed" | "held";
+    outcome: "passed" | "failed" | "held" | "skipped";
+    /** Why the moment was skipped, for `skipped` (#3811). */
+    reason?: string;
+}
+/** One run as a hook sees it (#3804). */
+export interface OpWaveHookRun {
+    target: string;
+    op: string;
+    /** The run's plan file, once planned. */
+    plan?: string;
+}
+/**
+ * What chant hands an apply command in `CHANT_HOOKS` (#3804), and what
+ * {@link opWaveHooksAtBase} builds for an apply outside the waves. Paths are
+ * relative to the job's working directory.
+ */
+export interface OpWaveHooksFile {
+    version: 1;
+    /** The Op waves spec's name. */
+    opWaves: string;
+    /** The spec's `op`: a hook's `{op}` when it runs once for the wave. */
+    op: string;
+    wave: string;
+    /** 1-based; 0 when the working tree's spec has no such wave. */
+    number: number;
+    /** The commit the hooks were read at. */
+    base?: string;
+    /** The wave's set digest, once decided. */
+    digest?: string;
+    /** An approval of the digest stands, so a held hook does not stop the apply. */
+    approved: boolean;
+    /** The labels of the hooks that held the wave, approved or not. */
+    heldBy?: string[];
+    /** Who runs the apply-stage hooks. With `chant`, `hooks` is empty: chant runs them around the apply. */
+    runBy: OpWaveApplyHooksRunner;
+    /** The runs this apply call applies. */
+    runs: OpWaveHookRun[];
+    /** The runs file, a hook's `{runs}` and `CHANT_RUNS`. */
+    runsFile: string;
+    /** The hooks the apply runs, by moment, as read at base. */
+    hooks: Partial<Record<OpWaveHookMoment, OpWaveHook[]>>;
+    /** The hooks that already ran for this wave in this job, and how each came out. */
+    outcomes: OpWaveHookOutcome[];
+    /** Where {@link runOpWaveApplyHooks} writes its outcomes (`CHANT_HOOKS_RESULT`), which chant reads back. */
+    result?: string;
+    /** Set when the hooks at base could not be read: none run, and the runner refuses to proceed. */
+    refused?: string;
+}
+/** What {@link runOpWaveApplyHooks} writes to `CHANT_HOOKS_RESULT` (#3804). */
+export interface OpWaveHooksResult {
+    version: 1;
+    /** The moments the apply ran, empty ones included. */
+    moments: OpWaveHookMoment[];
+    outcomes: OpWaveHookOutcome[];
+}
+/** One call of {@link runOpWaveApplyHooks}. */
+export interface OpWaveApplyHooksRun {
+    moment: OpWaveHookMoment;
+    outcomes: OpWaveHookOutcome[];
+    /** Set when a hook with `onFailure: fail` failed; the hooks after it did not run. */
+    failed?: string;
+    /** The `onFailure: approve` hooks that failed, or why the hooks could not be read at base. */
+    held: string[];
+    /**
+     * Whether the apply may go on: no hook failed, and nothing held it or an
+     * approval of the digest stands. When false after a hold, the apply applies
+     * nothing and exits non-zero; chant then waits for, or finds, an approval
+     * and calls it again.
+     */
+    proceed: boolean;
 }
 /** Runs one argv; returns its exit code. `env` is added to the job's environment. Injected so tests run no processes. */
 export type OpWaveExec = (argv: string[], cwd: string, env?: Record<string, string>) => number;
@@ -150,6 +231,8 @@ export interface OpWaveBaseRules {
     hooksRefused?: string;
     /** The spec at base sets `approvals.spend` (#3784). */
     spend: boolean;
+    /** Who runs the apply-stage hooks, as read at base (#3804). `chant` when the file, the wave or the hooks are missing there. */
+    applyHooksRunBy: OpWaveApplyHooksRunner;
 }
 /**
  * The policy of wave `name`, as the spec file at `base` declares it. The
@@ -211,6 +294,55 @@ export interface RunOpWaveResult {
     /** The hooks that ran (#3762). */
     hooks: OpWaveHookOutcome[];
 }
+/**
+ * Read the hooks file chant hands an apply command (#3804): the one at
+ * `path`, by default `CHANT_HOOKS`. Null when there is none, as for an apply
+ * that a wave job did not start.
+ */
+export declare function readOpWaveHooksFile(path?: string | undefined, cwd?: string): OpWaveHooksFile | null;
+/**
+ * Run one moment's hooks from a hooks file (#3804): what an apply command
+ * calls under its own lock, `before-apply` right before it changes anything
+ * and `after-apply` once it has, when the spec's `hooks.apply.runBy` at base
+ * is `apply`. Also what a product's apply outside the waves calls, with a
+ * file from {@link opWaveHooksAtBase}. A moment the file has no hooks for
+ * runs nothing and proceeds, so an apply can call it whoever runs the hooks.
+ *
+ * Each call adds its outcomes to the file's `result` (`CHANT_HOOKS_RESULT`),
+ * which chant reads back after the apply exits: the outcomes join the wave's
+ * result and decision record, and a hold makes the wave wait for, or find,
+ * an approval of its digest. `skip: "<reason>"` runs nothing and records the
+ * moment as skipped with the reason (#3811), for an apply that changes nothing:
+ * chant counts the moment as handled. A skip without a reason throws. `exec` runs one hook; inject it to run a hook
+ * in process or to keep its output.
+ */
+export declare function runOpWaveApplyHooks(file: OpWaveHooksFile, moment: OpWaveHookMoment, options?: {
+    cwd?: string;
+    exec?: OpWaveExec;
+    log?: (line: string) => void;
+    skip?: string;
+}): OpWaveApplyHooksRun;
+/**
+ * The hooks of wave `wave` read at base, for an apply outside the waves
+ * (#3804): a product's own `apply <env>` that runs the same Op as the wave
+ * does, and the same hooks. All four moments are in the file; the apply runs
+ * the ones it has a stage for with {@link runOpWaveApplyHooks}. Nothing is
+ * approved: a held hook stops the apply. The wave or the file missing at
+ * base has no hooks, as in a wave job.
+ */
+export declare function opWaveHooksAtBase(options: {
+    specFile: string;
+    wave: string;
+    /** The runs this apply applies. Default: the wave's runs in the working tree's spec. */
+    runs?: ReadonlyArray<{
+        target: string;
+        op?: string;
+    }>;
+    /** Default: the spec's `base`, else `HEAD^1`. */
+    base?: string;
+    cwd?: string;
+    show?: OpWaveShowAtBase;
+}): OpWaveHooksFile;
 /** Whether `policy` lets a wave with these members through without an approval. */
 export declare function opWaveNeedsApproval(policy: OpWaveGatePolicy, members: readonly OpWaveMember[]): boolean;
 /** Plan, decide and apply one wave, or one part of a wide wave. */