klyro 1.0.0 → 1.0.2

package/dist/cli/commit.js

@@ -0,0 +1,142 @@
+/**
+ * `klyro commit` — conventional commit of already-staged changes.
+ *
+ * Steps:
+ *   (a) `git status --porcelain` must show staged entries (index column set).
+ *       Nothing staged → error 'nothing staged (git add first)', exit 2.
+ *       (`--yes` never bypasses this — there is nothing to commit.)
+ *   (b) Secret-scan the staged diff via `redact()`: if redaction shrinks or
+ *       alters the diff, refuse and list the files (exit 2) unless
+ *       `--force-secret` is passed.
+ *   (c) Build a conventional message: type heuristic + top-dir scope +
+ *       `--message` summary (or `update <n> files`).
+ *   (d) `git commit -m` via execFileSync (no shell). Verification hooks always
+ *       run — by construction this file contains no flag that skips them.
+ *   (e) `--dry-run` prints the message + files and exits 0 without committing.
+ */
+import { execFileSync } from 'node:child_process';
+import { redact } from '../policy/secret-redactor.js';
+function git(cwd, args) {
+    return execFileSync('git', args, { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] }).toString();
+}
+/** Porcelain XY: staged iff the index (first) column is set. Handles renames. */
+export function stagedFilesFromPorcelain(porcelain) {
+    const out = [];
+    for (const line of porcelain.split('\n')) {
+        if (line.length < 4)
+            continue;
+        const indexStatus = line[0];
+        if (indexStatus === ' ' || indexStatus === '?' || indexStatus === '!')
+            continue;
+        let file = line.slice(3).trim();
+        // Rename/copy form: "old -> new" — the new path is what's committed.
+        const arrow = file.indexOf(' -> ');
+        if (arrow !== -1)
+            file = file.slice(arrow + 4);
+        // Quoted paths from core.quotePath — strip surrounding quotes.
+        if (file.startsWith('"') && file.endsWith('"'))
+            file = file.slice(1, -1);
+        if (file)
+            out.push(file);
+    }
+    return out;
+}
+const LOCKFILES = new Set([
+    'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'Cargo.lock',
+    'Gemfile.lock', 'poetry.lock', 'composer.lock',
+]);
+function isTestPath(f) {
+    const l = f.toLowerCase();
+    return (l.includes('.test.') || l.includes('.spec.') ||
+        l.includes('__tests__') || /(^|\/)tests?\//.test(l) || /(^|\/)spec\//.test(l));
+}
+function isDocsPath(f) {
+    const l = f.toLowerCase();
+    return l.endsWith('.md') || l.startsWith('docs/') || l.includes('/docs/');
+}
+/** Type heuristic: test-only→test, docs-only→docs, lockfiles→chore, else feat. */
+export function commitTypeFor(files) {
+    if (files.length > 0 && files.every((f) => LOCKFILES.has(f.split('/').pop() ?? f)))
+        return 'chore';
+    if (files.length > 0 && files.every(isTestPath))
+        return 'test';
+    if (files.length > 0 && files.every(isDocsPath))
+        return 'docs';
+    return 'feat';
+}
+/** Scope = most common top-level dir among staged files with a dir; '' if none. */
+export function commitScopeFor(files) {
+    const counts = new Map();
+    for (const f of files) {
+        const slash = f.indexOf('/');
+        if (slash > 0) {
+            const top = f.slice(0, slash);
+            counts.set(top, (counts.get(top) ?? 0) + 1);
+        }
+    }
+    let best = '';
+    let bestN = 0;
+    for (const [dir, n] of counts) {
+        if (n > bestN) {
+            best = dir;
+            bestN = n;
+        }
+    }
+    return best;
+}
+export function buildCommitMessage(files, summaryOpt) {
+    const type = commitTypeFor(files);
+    const scope = commitScopeFor(files);
+    const summary = (summaryOpt ?? '').trim() || `update ${files.length} file${files.length === 1 ? '' : 's'}`;
+    return scope ? `${type}(${scope}): ${summary}` : `${type}: ${summary}`;
+}
+export async function runCommit(opts) {
+    void opts.yes; // accepted for uniformity; never bypasses the staged check
+    const cwd = opts.cwd;
+    let porcelain;
+    try {
+        porcelain = git(cwd, ['status', '--porcelain']);
+    }
+    catch (err) {
+        process.stderr.write(`klyro: commit: not a git repo or git unavailable (${err instanceof Error ? err.message.split('\n')[0] : String(err)})\n`);
+        return 2;
+    }
+    const staged = stagedFilesFromPorcelain(porcelain);
+    if (staged.length === 0) {
+        process.stderr.write('klyro: commit: nothing staged (git add first)\n');
+        return 2;
+    }
+    let namesOnly;
+    try {
+        namesOnly = git(cwd, ['diff', '--cached', '--name-only']).split('\n').map((s) => s.trim()).filter(Boolean);
+    }
+    catch {
+        namesOnly = staged;
+    }
+    const files = namesOnly.length > 0 ? namesOnly : staged;
+    // (b) secret scan of the staged diff (read-only — redact() never writes).
+    try {
+        const diff = git(cwd, ['diff', '--cached', '--']);
+        if (redact(diff) !== diff && !opts.forceSecret) {
+            process.stderr.write(`klyro: commit: refused — possible secret in staged diff (files: ${files.join(', ')}). Review with \`git diff --cached\`, unstage the secret, or re-run with --force-secret.\n`);
+            return 2;
+        }
+    }
+    catch {
+        // Could not read the diff — proceed; the commit itself is authoritative.
+    }
+    const message = buildCommitMessage(files, opts.message);
+    if (opts.dryRun) {
+        process.stdout.write(`${message}\nfiles:\n${files.map((f) => `  ${f}`).join('\n')}\n`);
+        return 0;
+    }
+    try {
+        // NOTE: verification hooks must run — no skip flag is ever passed here.
+        execFileSync('git', ['commit', '-m', message], { cwd, stdio: 'inherit' });
+    }
+    catch {
+        process.stderr.write('klyro: commit: `git commit` failed (see output above)\n');
+        return 1;
+    }
+    return 0;
+}

package/dist/cli/config.d.ts

@@ -17,8 +17,53 @@ export declare const ConfigSchema: z.ZodObject<{
     api_key: z.ZodOptional<z.ZodString>;
     'model.default': z.ZodOptional<z.ZodString>;
     'model.small': z.ZodOptional<z.ZodString>;
+    providers: z.ZodOptional<z.ZodObject<{
+        failover: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            provider: z.ZodEnum<{
+                openai: "openai";
+                anthropic: "anthropic";
+            }>;
+            baseURL: z.ZodOptional<z.ZodString>;
+            apiKey: z.ZodOptional<z.ZodString>;
+            apiKeyEnv: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
 }, z.core.$loose>;
 export type KlyroConfig = z.infer<typeof ConfigSchema>;
+export declare const FailoverEntrySchema: z.ZodObject<{
+    provider: z.ZodEnum<{
+        openai: "openai";
+        anthropic: "anthropic";
+    }>;
+    baseURL: z.ZodOptional<z.ZodString>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    apiKeyEnv: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type FailoverEntry = z.infer<typeof FailoverEntrySchema>;
+export declare const FailoverConfigSchema: z.ZodObject<{
+    failover: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        provider: z.ZodEnum<{
+            openai: "openai";
+            anthropic: "anthropic";
+        }>;
+        baseURL: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        apiKeyEnv: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export interface ResolvedProviderEntry {
+    provider: 'openai' | 'anthropic';
+    baseURL?: string;
+    apiKey?: string;
+}
+/**
+ * Build the ordered provider chain: primary (existing precedence:
+ * flags > env > merged config > defaults) followed by `providers.failover`
+ * entries. `apiKeyEnv` names an env var resolved at build time; entries
+ * whose key is missing/empty are skipped (with a stderr reason) so a
+ * half-configured fallback can never become the active provider.
+ */
+export declare function resolveProviderChain(cwd?: string, flags?: Record<string, unknown>): Promise<ResolvedProviderEntry[]>;
 export declare function getConfigDir(): string;
 export declare function getConfigPath(): string;
 export declare function getConfigSearchPaths(cwd?: string): Array<{
@@ -46,12 +91,18 @@ export interface PermissionRules {
  * without re-prompting.
  */
 export declare function loadPermissionRules(cwd?: string): Promise<PermissionRules>;
+export declare function isValidAllowRule(rule: string): boolean;
 /**
- * Persist an "always allow" pattern to the home settings file
- * (~/.klyro/settings.json, honors KLYRO_CONFIG). Returns whether it was
+ * Persist an "always allow" pattern. Validates the rule against the strict
+ * grammar (throws `invalid rule` otherwise). When `cwd` is a project dir
+ * (exists + contains .git or .klyro), writes to <cwd>/.klyro/settings.json;
+ * otherwise writes to the home settings file. Returns whether it was
  * added (false when already present) and the file written.
+ *
+ * NOTE for the repl integrator (sibling-owned repl.ts): pass the session
+ * cwd as the second arg to persist project-scoped allows.
  */
-export declare function persistAllowRule(rule: string): Promise<{
+export declare function persistAllowRule(rule: string, cwd?: string): Promise<{
     added: boolean;
     path: string;
 }>;

package/dist/cli/config.js

@@ -24,8 +24,90 @@ export const ConfigSchema = z
     // Global flags persisted
     'model.default': z.string().optional(),
     'model.small': z.string().optional(),
+    // Provider failover chain (L15): ordered fallbacks after the primary.
+    // Optional so existing configs keep validating; invalid entries exit 3.
+    providers: z
+        .object({
+        failover: z
+            .array(z.object({
+            provider: z.enum(['openai', 'anthropic']),
+            baseURL: z.string().optional(),
+            apiKey: z.string().optional(),
+            apiKeyEnv: z.string().optional(),
+        }))
+            .optional(),
+    })
+        .optional(),
 })
     .passthrough();
+// --- Provider failover chain (L15 differentiator) ---
+// `providers.failover` is an ordered list of fallback providers. Entries
+// with unresolvable/missing API keys are skipped at chain-build time.
+export const FailoverEntrySchema = z.object({
+    provider: z.enum(['openai', 'anthropic']),
+    baseURL: z.string().optional(),
+    apiKey: z.string().optional(),
+    apiKeyEnv: z.string().optional(),
+});
+export const FailoverConfigSchema = z.object({
+    failover: z.array(FailoverEntrySchema).optional(),
+});
+/**
+ * Build the ordered provider chain: primary (existing precedence:
+ * flags > env > merged config > defaults) followed by `providers.failover`
+ * entries. `apiKeyEnv` names an env var resolved at build time; entries
+ * whose key is missing/empty are skipped (with a stderr reason) so a
+ * half-configured fallback can never become the active provider.
+ */
+export async function resolveProviderChain(cwd = process.cwd(), flags = {}) {
+    const merged = await loadMergedConfig(cwd, flags);
+    const chain = [];
+    const skipped = [];
+    // Primary — mirror the precedence resolveProvider uses: explicit flags,
+    // then KLYRO_* env, then merged config.
+    const flagProvider = typeof flags['provider'] === 'string' ? flags['provider'] : undefined;
+    const flagBaseUrl = typeof flags['baseUrl'] === 'string' ? flags['baseUrl'] : typeof flags['baseURL'] === 'string' ? flags['baseURL'] : undefined;
+    const flagApiKey = typeof flags['apiKey'] === 'string' ? flags['apiKey'] : undefined;
+    const primaryProvider = (flagProvider ?? merged.provider ?? process.env.KLYRO_PROVIDER ?? 'openai');
+    const primaryBaseURL = flagBaseUrl ?? merged.baseUrl ?? merged.baseURL ?? process.env.KLYRO_BASE_URL;
+    const primaryApiKey = flagApiKey ?? merged.apiKey ?? merged.api_key ?? process.env.KLYRO_API_KEY;
+    if (primaryProvider === 'openai' || primaryProvider === 'anthropic') {
+        chain.push({
+            provider: primaryProvider,
+            ...(primaryBaseURL ? { baseURL: primaryBaseURL } : {}),
+            ...(primaryApiKey ? { apiKey: primaryApiKey } : {}),
+        });
+    }
+    // Failover list — validated leniently (invalid entries skipped, never fatal).
+    const providersRaw = merged.providers;
+    const parsed = FailoverConfigSchema.safeParse(providersRaw ?? {});
+    if (parsed.success && parsed.data.failover) {
+        for (const entry of parsed.data.failover) {
+            let key = entry.apiKey;
+            if (!key && entry.apiKeyEnv) {
+                const v = process.env[entry.apiKeyEnv];
+                if (v && v.length > 0)
+                    key = v;
+            }
+            if (!key) {
+                skipped.push(`failover ${entry.provider}${entry.apiKeyEnv ? ` (env ${entry.apiKeyEnv} unset)` : ' (no apiKey)'}`);
+                continue;
+            }
+            chain.push({
+                provider: entry.provider,
+                ...(entry.baseURL ? { baseURL: entry.baseURL } : {}),
+                apiKey: key,
+            });
+        }
+    }
+    for (const reason of skipped) {
+        try {
+            process.stderr.write(`klyro: skipping failover entry — ${reason}\n`);
+        }
+        catch { /* ignore */ }
+    }
+    return chain;
+}
 // --- Paths ---
 export function getConfigDir() {
     if (process.env.KLYRO_CONFIG_DIR)
@@ -338,11 +420,72 @@ export async function loadPermissionRules(cwd = process.cwd()) {
     };
 }
 /**
- * Persist an "always allow" pattern to the home settings file
- * (~/.klyro/settings.json, honors KLYRO_CONFIG). Returns whether it was
+ * Strict allow-rule grammar: `tool` or `tool(glob)` where tool is
+ * lowercase alnum+underscore and glob contains no parens.
+ */
+const ALLOW_RULE_RE = /^[a-z0-9_]+\([^()]*\)$|^[a-z0-9_]+$/;
+export function isValidAllowRule(rule) {
+    return ALLOW_RULE_RE.test(rule.trim());
+}
+function isProjectDir(cwd) {
+    try {
+        const st = fsSync.statSync(cwd);
+        if (!st.isDirectory())
+            return false;
+    }
+    catch {
+        return false;
+    }
+    return fsSync.existsSync(path.join(cwd, '.git')) || fsSync.existsSync(path.join(cwd, '.klyro'));
+}
+/**
+ * Persist an "always allow" pattern. Validates the rule against the strict
+ * grammar (throws `invalid rule` otherwise). When `cwd` is a project dir
+ * (exists + contains .git or .klyro), writes to <cwd>/.klyro/settings.json;
+ * otherwise writes to the home settings file. Returns whether it was
  * added (false when already present) and the file written.
+ *
+ * NOTE for the repl integrator (sibling-owned repl.ts): pass the session
+ * cwd as the second arg to persist project-scoped allows.
  */
-export async function persistAllowRule(rule) {
+export async function persistAllowRule(rule, cwd) {
+    if (!isValidAllowRule(rule)) {
+        throw new Error(`invalid rule: ${rule}`);
+    }
+    // Project-scoped persist when cwd is a project dir.
+    if (cwd && isProjectDir(cwd)) {
+        const projPath = path.join(cwd, '.klyro', 'settings.json');
+        let cfg = {};
+        try {
+            const raw = await fs.readFile(projPath, 'utf-8');
+            cfg = validateConfig(parseJsonc(raw, projPath), projPath);
+        }
+        catch (err) {
+            const e = err;
+            if (e.code !== 'ENOENT')
+                throw err;
+        }
+        const allow = asStringArray(cfg.allow);
+        if (allow.includes(rule))
+            return { added: false, path: projPath };
+        cfg.allow = [...allow, rule];
+        await fs.mkdir(path.dirname(projPath), { recursive: true });
+        const tmp = `${projPath}.tmp-${process.pid}-${Date.now()}`;
+        const data = JSON.stringify(validateConfig(cfg, projPath), null, 2) + '\n';
+        await fs.writeFile(tmp, data, { mode: 0o600 });
+        try {
+            await fs.rename(tmp, projPath);
+        }
+        catch (err) {
+            await fs.unlink(tmp).catch(() => undefined);
+            throw err;
+        }
+        try {
+            await fs.chmod(projPath, 0o600);
+        }
+        catch { /* ignore on Windows */ }
+        return { added: true, path: projPath };
+    }
     const cfg = await loadConfig();
     const allow = asStringArray(cfg.allow);
     if (allow.includes(rule))

package/dist/cli/doctor.d.ts

@@ -5,4 +5,5 @@
  */
 export declare function runDoctor(opts?: {
     json?: boolean;
+    cwd?: string;
 }): Promise<number>;

package/dist/cli/doctor.js

@@ -10,7 +10,6 @@ import { spawn } from 'node:child_process';
 import { getConfigPath, loadConfig } from './config.js';
 import { resolveProvider, providerHelp } from '../providers.js';
 import { getDefaultSessionsDir } from '../persistence/session.js';
-import { builtinRegistry } from '../tools/registry.js';
 function checkNode() {
     const v = process.versions.node;
     const major = Number(v.split('.')[0] ?? 0);
@@ -94,26 +93,92 @@ function checkGit() {
         });
     });
 }
-function checkTools() {
-    const reg = builtinRegistry();
-    return { name: 'Tools', ok: true, detail: `${reg.list().length} tools: ${reg.list().map((t) => t.name).join(', ')}` };
+async function checkTools() {
+    try {
+        const { builtinRegistry } = await import('../tools/registry.js');
+        const reg = builtinRegistry();
+        return { name: 'Tools', ok: true, detail: `${reg.list().length} tools: ${reg.list().map((t) => t.name).join(', ')}` };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { name: 'Tools', ok: false, detail: `registry unavailable: ${msg}` };
+    }
 }
 function checkPlatform() {
     const ok = ['win32', 'linux', 'darwin'].includes(process.platform);
     return { name: 'Platform', ok, detail: `${process.platform} ${process.arch} ${ok ? '✓' : '✗ unsupported'}` };
 }
+async function checkMcp(cwd) {
+    try {
+        const { loadMcpServers } = await import('../mcp/config.js');
+        const cfg = loadMcpServers(cwd);
+        const names = Object.keys(cfg.servers);
+        if (names.length === 0)
+            return { name: 'MCP servers', ok: true, detail: 'none' };
+        let project = 0;
+        for (const n of names) {
+            if (cfg.sources[n] === 'project')
+                project++;
+        }
+        return { name: 'MCP servers', ok: true, detail: `${names.length} servers (global ${names.length - project}/project ${project})` };
+    }
+    catch {
+        return { name: 'MCP servers', ok: true, detail: 'none' };
+    }
+}
+function countTrustEntries(p) {
+    try {
+        const raw = fsSync.readFileSync(p, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return Object.keys(parsed).length;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+async function checkTrust() {
+    try {
+        const [{ defaultTrustStorePath }] = [await import('../context/trust.js')];
+        const [{ defaultMcpTrustStorePath }] = [await import('../mcp/trust.js')];
+        const ctx = countTrustEntries(defaultTrustStorePath());
+        const mcp = countTrustEntries(defaultMcpTrustStorePath());
+        if (ctx === null && mcp === null)
+            return { name: 'Trust stores', ok: true, detail: 'none' };
+        return {
+            name: 'Trust stores',
+            ok: true,
+            detail: `context-trust ${ctx ?? 0} entries, mcp-trust ${mcp ?? 0} entries`,
+        };
+    }
+    catch {
+        return { name: 'Trust stores', ok: true, detail: 'none' };
+    }
+}
 export async function runDoctor(opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
     const checks = [];
     checks.push(checkNode());
     checks.push(await checkConfig());
     checks.push(await checkProvider());
     checks.push(await checkSessions());
     checks.push(await checkGit());
-    checks.push(checkTools());
+    checks.push(await checkTools());
     checks.push(checkPlatform());
+    const mcpCheck = await checkMcp(cwd);
+    const trustCheck = await checkTrust();
+    checks.push(mcpCheck);
+    checks.push(trustCheck);
     const allOk = checks.every((c) => c.ok);
     if (opts.json) {
-        process.stdout.write(JSON.stringify({ ok: allOk, checks }, null, 2) + '\n');
+        process.stdout.write(JSON.stringify({
+            ok: allOk,
+            checks,
+            mcp: { ok: mcpCheck.ok, detail: mcpCheck.detail },
+            trust: { ok: trustCheck.ok, detail: trustCheck.detail },
+        }, null, 2) + '\n');
         return allOk ? 0 : 1;
     }
     process.stdout.write('\nklyro doctor\n');

package/dist/cli/eval.d.ts

@@ -39,7 +39,7 @@
  * is set, emits one JSON object per line. Exit code 0 if all pass, 1
  * otherwise.
  */
-import { type RunResult } from '../agent/runtime.js';
+import { type RunResult, type VerifyMode } from '../agent/runtime.js';
 import type { ProviderAdapter } from '../agent/provider-adapter.js';
 export interface EvalScenario {
     name: string;
@@ -47,6 +47,11 @@ export interface EvalScenario {
     model?: string;
     maxSteps?: number;
     maxTokens?: number;
+    /** Verification passthrough (default unchanged: strict pipeline when omitted). */
+    verify?: {
+        mode?: VerifyMode;
+        command?: string;
+    };
     /** Adapter events to script, as [eventKind, ...args] tuples. */
     scripted_events?: Array<Array<unknown[]>>;
     expect?: {

package/dist/cli/eval.js

@@ -236,6 +236,15 @@ export async function runScenario(sc) {
         maxSteps: sc.maxSteps,
         maxTokens: sc.maxTokens,
         nonInteractive: true,
+        ...(sc.verify
+            ? {
+                verify: {
+                    enabled: true,
+                    ...(sc.verify.command !== undefined ? { command: sc.verify.command } : {}),
+                    ...(sc.verify.mode !== undefined ? { mode: sc.verify.mode } : {}),
+                },
+            }
+            : {}),
     }, {
         adapter,
         registry,

package/dist/cli/hooks.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Hooks engine (10.2) — preToolUse / postToolUse shell hooks.
+ *
+ * Config files:
+ *   - project: `<cwd>/.klyro/hooks.json`
+ *   - global:  `~/.klyro/hooks.json` (merged; project wins on name clash)
+ *
+ * Schema: `{ hooks: Array<{ name, event, command, timeoutMs? }> }`.
+ *
+ * `loadHooks` never throws — a missing file is `[]`, an invalid file is
+ * `[]` plus a one-time stderr warning per path. `runHook` spawns the
+ * command with `shell: true` (commands are strings, must work on win +
+ * posix), a default 30s timeout, a filtered env, plus `KLYRO_TOOL_NAME`
+ * and `KLYRO_TOOL_INPUT_JSON` for the hook's inspection.
+ */
+import { z } from 'zod';
+export declare const HookSchema: z.ZodObject<{
+    name: z.ZodString;
+    event: z.ZodEnum<{
+        preToolUse: "preToolUse";
+        postToolUse: "postToolUse";
+    }>;
+    command: z.ZodString;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type Hook = z.infer<typeof HookSchema>;
+export interface HookResult {
+    ok: boolean;
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+}
+export declare const DEFAULT_HOOK_TIMEOUT_MS = 30000;
+/**
+ * Load hooks for a run. Global first, then project — a project hook with
+ * the same `name` replaces the global one. Never throws.
+ */
+export declare function loadHooks(cwd: string): Hook[];
+export interface HookContext {
+    toolName: string;
+    input: unknown;
+}
+/**
+ * Run one hook. Resolves (never rejects) with the exit code + sliced
+ * output. `ok` is true only when the process exited 0.
+ */
+export declare function runHook(hook: Hook, ctx: HookContext): Promise<HookResult>;