@indigoai-us/hq-cli 5.345.178 → 5.345.179

package/dist/commands/sources.d.ts

@@ -11,6 +11,8 @@
  *   hq sources get       Fetch one source by id.
  *   hq sources channels  Print the canonical SOURCE_CHANNELS enum.
  *   hq sources entities  List entities the caller has access to.
+ *   hq sources runs      Show the local hot-channel run ledger for one day.
+ *   hq sources sync      Run every hot channel now for the signed-in person.
  *
  * Defaults:
  *   --entity   falls back to .hq/config.json activeCompany (per sync.ts).
@@ -18,5 +20,92 @@
  *   --limit    50.
  */
 import { Command } from "commander";
+import { type RunLedgerAdapterSummary, type RunLedgerEntry, type RunTrigger, type SignalsGeneratedFn } from "../lib/hot-channels/ledger.js";
+import type { HotChannelRegistry } from "../lib/hot-channels/registry.js";
+import { type OnDemandSyncDeps, type OnDemandSyncReport } from "../lib/hot-channels/run.js";
+type ListFormat = "table" | "json";
+export interface RunsOptions {
+    today?: boolean;
+    date?: string;
+    company?: string;
+    email?: string;
+    format?: ListFormat;
+    hqRoot: string;
+}
+export interface RunsReport {
+    company: string;
+    personKey: string;
+    day: string;
+    adapters: RunLedgerAdapterSummary[];
+    entries: RunLedgerEntry[];
+    malformed: number;
+}
+/**
+ * Reads one day's run ledger (`sources/_runs/@{personKey}/{day}.jsonl` in the
+ * company folder of the local HQ tree). The person key is
+ * `audienceKey([email])` of the signed-in person. No network calls.
+ */
+export declare function runRuns(options: RunsOptions, now?: Date): Promise<RunsReport>;
+export interface SyncOptions {
+    adapter?: string;
+    company?: string;
+    hqRoot: string;
+    json?: boolean;
+}
+export interface SyncOverrides {
+    /** Adapters to run. This build registers none, so the default is empty. */
+    registry?: HotChannelRegistry;
+    now?: () => Date;
+    /** The signals pass; defaults to the local `claude -p` pass under the user's own login. */
+    signalsGenerated?: SignalsGeneratedFn;
+}
+/**
+ * Network access for one sync: the catalog, the person's usable connections,
+ * and tool calls through the HQ gateway. Integration tokens stay server-side;
+ * the gateway routes each call by connection id.
+ */
+export declare function gatewaySyncDeps(token: string, companyUid: string): OnDemandSyncDeps;
+export interface CompanyHotChannelSyncInput {
+    hqRoot: string;
+    company: string;
+    adapter?: string;
+    registry?: HotChannelRegistry;
+    now?: () => Date;
+    /** `scheduled` for the bot's hot-signal-sync job; `on-demand` by default. */
+    trigger?: RunTrigger;
+    catchUp?: boolean;
+    signalsGenerated?: SignalsGeneratedFn;
+    /** The signed-in person's `prs_` person uid in this company; defaults to a roster lookup by email. */
+    resolvePersonUid?: (token: string, companyUid: string, email: string) => Promise<string | null>;
+    /**
+     * Where the signals-failure alert goes (US-012). Unset = no alert check.
+     * The company-channel post defaults to the Slack channel in the company's
+     * `settings/signals/preferences.yaml`, through the HQ integrations gateway.
+     */
+    signalsAlert?: SignalsAlertSenders;
+}
+export interface SignalsAlertSenders {
+    /** The primary alert to the owner; throws when it was not delivered. */
+    sendOwnerDm: (text: string) => Promise<void>;
+    postCompanyChannel?: (text: string) => Promise<void>;
+    log?: (message: string) => void;
+}
+/**
+ * One hot-channel sync for the signed-in person in one company: each adapter
+ * once per usable connection. Writes under `companies/{company}/`: landed
+ * sources in `sources/`, index rows in `sources/_index/`, cursors in
+ * `sources/_cursors/`, one ledger line per adapter in `sources/_runs/`, and
+ * signals in `signals/@{key}/`. `hq sources sync` and the bot's scheduled
+ * hot-signal-sync job both call it. Only one run per person per company goes
+ * at a time: a second one writes a `skipped` ledger line and lands nothing.
+ */
+export declare function runCompanyHotChannelSync(input: CompanyHotChannelSyncInput): Promise<OnDemandSyncReport>;
+/**
+ * Run every hot channel for the signed-in person now: each adapter once per
+ * usable connection. Writes cursors, landed sources and an `on-demand` ledger
+ * line under `companies/{company}/sources/`, and nothing else.
+ */
+export declare function runSync(options: SyncOptions, overrides?: SyncOverrides): Promise<OnDemandSyncReport>;
 export declare function registerSourcesCommand(program: Command): void;
+export {};
 //# sourceMappingURL=sources.d.ts.map

package/dist/commands/sources.js

@@ -11,18 +11,34 @@
  *   hq sources get       Fetch one source by id.
  *   hq sources channels  Print the canonical SOURCE_CHANNELS enum.
  *   hq sources entities  List entities the caller has access to.
+ *   hq sources runs      Show the local hot-channel run ledger for one day.
+ *   hq sources sync      Run every hot channel now for the signed-in person.
  *
  * Defaults:
  *   --entity   falls back to .hq/config.json activeCompany (per sync.ts).
  *   --format   'table' when stdout is a TTY, 'json' when piped.
  *   --limit    50.
  */
+import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import chalk from "chalk";
 import { SOURCE_CHANNELS, assertSourceChannel, resolveEntity, listAvailableEntities, listSources, getSource, VaultClient, } from "@indigoai-us/hq-cloud";
-import { ensureCognitoToken, buildVaultConfig, DEFAULT_HQ_ROOT, } from "../utils/cognito-session.js";
+import { ensureCognitoToken, ensureCognitoIdToken, buildVaultConfig, DEFAULT_HQ_ROOT, } from "../utils/cognito-session.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { isAuthError } from "../utils/auth-error.js";
+import { IntegrationsCliError, callGateway, fetchUsableApps, gatewayResultIsError, isBuiltInGatewayProvider, raiseForResponse, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 import { Sentry } from "../sentry.js";
+import { resolveUploadAuthor } from "../utils/upload-author.js";
+import { createSignalsAlertChannelPoster, raiseSignalsFailureAlerts } from "../lib/hot-channels/alert.js";
+import { audienceKey } from "../lib/hot-channels/audience.js";
+import { appendRunLedgerEntry, ledgerDay, readRunLedger, summarizeRunLedger, } from "../lib/hot-channels/ledger.js";
+import { createClaudeSignalsPass } from "../lib/hot-channels/signals-pass.js";
+import { assertSafeSegment } from "../lib/hot-channels/landing.js";
+import { acquireSyncLock, SYNC_LOCK_BUSY_REASON } from "../lib/hot-channels/sync-lock.js";
+import { createBuiltinHotChannelRegistry } from "../lib/hot-channels/adapters/index.js";
+import { listActiveMembers } from "./members.js";
+import { runOnDemandSync, } from "../lib/hot-channels/run.js";
 // ---------------------------------------------------------------------------
 // Access token resolution — honors HQ_ACCESS_TOKEN for tests + CI smoke
 // ---------------------------------------------------------------------------
@@ -209,6 +225,330 @@ async function runEntities(options) {
         .join("\n");
     process.stdout.write([headerLine, sep, body].join("\n") + "\n");
 }
+/**
+ * Reads one day's run ledger (`sources/_runs/@{personKey}/{day}.jsonl` in the
+ * company folder of the local HQ tree). The person key is
+ * `audienceKey([email])` of the signed-in person. No network calls.
+ */
+export async function runRuns(options, now = new Date()) {
+    if (options.today && options.date) {
+        throw new Error("Pass either --today or --date, not both.");
+    }
+    if (options.date !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(options.date)) {
+        throw new Error(`--date must be YYYY-MM-DD (got '${options.date}').`);
+    }
+    const day = options.date ?? ledgerDay(now);
+    const company = options.company ?? readActiveCompanySlug(options.hqRoot);
+    if (!company) {
+        throw new Error("No company specified. Pass --company <slug> or set activeCompany in .hq/config.json.");
+    }
+    const email = options.email ?? resolveUploadAuthor()?.email;
+    if (!email) {
+        throw new Error("Could not tell who is signed in. Run `hq login` or pass --email <address>.");
+    }
+    const personKey = audienceKey([email]);
+    const vaultRoot = path.join(options.hqRoot, "companies", company);
+    const { entries, malformed } = await readRunLedger(vaultRoot, personKey, day);
+    const report = {
+        company,
+        personKey,
+        day,
+        adapters: summarizeRunLedger(entries),
+        entries,
+        malformed,
+    };
+    const format = options.format ?? defaultListFormat();
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+        return report;
+    }
+    process.stdout.write(renderRunsTable(report) + "\n");
+    return report;
+}
+function renderRunsTable(report) {
+    const lines = [`Runs for ${report.company} on ${report.day} (UTC), person key @${report.personKey}`];
+    if (report.entries.length === 0) {
+        lines.push("(no runs logged)");
+    }
+    else {
+        const pad = (s, w) => s + " ".repeat(Math.max(0, w - s.length));
+        const header = ["ADAPTER", "RUNS", "SOURCES", "SIGNALS", "FAILED", "LAST FINISHED"];
+        const rows = report.adapters.map((a) => [
+            a.adapter,
+            String(a.runs),
+            String(a.sourcesLanded),
+            String(a.signalsGenerated),
+            String(a.failed),
+            a.lastFinishedAt,
+        ]);
+        const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+        lines.push("", header.map((h, i) => pad(h, widths[i])).join("  "));
+        for (const row of rows)
+            lines.push(row.map((cell, i) => pad(cell, widths[i])).join("  "));
+        lines.push("", "Runs:");
+        for (const e of [...report.entries].sort((a, b) => a.startedAt.localeCompare(b.startedAt))) {
+            const outcome = e.status === "ok"
+                ? "ok"
+                : e.status === "skipped"
+                    ? `skipped: ${e.reason ?? "no reason given"}`
+                    : `failed: ${e.error ?? "unknown error"}`;
+            lines.push(`  ${e.startedAt}  ${e.adapter}  ${e.trigger}  sources=${e.sourcesLanded} signals=${e.signalsGenerated}  ${outcome}`);
+        }
+    }
+    if (report.malformed > 0)
+        lines.push(`(${report.malformed} unreadable line(s) skipped)`);
+    return lines.join("\n");
+}
+const SIGN_IN_PROMPT = "Your HQ session has expired or you're not signed in. Run `hq login`, then `hq sources sync` again.";
+const MAX_TOOL_ERROR_TEXT = 500;
+/** The catalog API's `hotChannels` array, or null when the server has none. */
+async function fetchHotChannels(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/factory/catalog",
+        query: { companyUid },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to read the integrations catalog");
+    const data = (await res.json());
+    return Array.isArray(data.hotChannels) ? data.hotChannels : null;
+}
+/**
+ * Network access for one sync: the catalog, the person's usable connections,
+ * and tool calls through the HQ gateway. Integration tokens stay server-side;
+ * the gateway routes each call by connection id.
+ */
+export function gatewaySyncDeps(token, companyUid) {
+    return {
+        fetchHotChannels: () => fetchHotChannels(token, companyUid),
+        fetchUsableApps: async () => (await fetchUsableApps(token, companyUid)).apps,
+        async callTool(app, tool, args) {
+            const idempotencyKey = `hq-sources-sync-${randomUUID()}`;
+            const params = isBuiltInGatewayProvider(app.provider)
+                ? {
+                    companyUid,
+                    acceptAsync: true,
+                    name: tool,
+                    arguments: { ...args, companyUid, connectionId: app.connectionId, idempotencyKey },
+                }
+                : {
+                    companyUid,
+                    acceptAsync: true,
+                    name: `${toolPrefixForProvider(app.provider)}.mcp.tools.call`,
+                    arguments: { companyUid, connectionId: app.connectionId, toolName: tool, arguments: args, idempotencyKey },
+                };
+            const message = await callGateway(token, params, idempotencyKey, "tools/call");
+            const payload = unwrapGatewayResult(message.result);
+            if (gatewayResultIsError(message.result) || gatewayResultIsError(payload)) {
+                const text = typeof payload === "string" ? payload : JSON.stringify(payload);
+                throw new IntegrationsCliError((text ?? "tool call failed").slice(0, MAX_TOOL_ERROR_TEXT), {
+                    expected: true,
+                });
+            }
+            return payload;
+        },
+    };
+}
+function signInReport() {
+    return {
+        runId: null,
+        signInRequired: true,
+        outcomes: [],
+        entries: [],
+        notices: [SIGN_IN_PROMPT],
+        exitCode: 1,
+    };
+}
+async function signedInSession(company) {
+    let token;
+    try {
+        token = process.env.HQ_ACCESS_TOKEN || (await ensureCognitoIdToken({ interactive: false }));
+    }
+    catch {
+        return null;
+    }
+    try {
+        return { token, companyUid: await getCompanyUid(token, company) };
+    }
+    catch (err) {
+        if (isAuthError(err) || err.status === 401)
+            return null;
+        throw err;
+    }
+}
+/** The signed-in member's `prs_` uid from the company roster, or null when the roster is unavailable. */
+async function rosterPersonUid(token, companyUid, email) {
+    try {
+        const wanted = email.toLowerCase();
+        const member = (await listActiveMembers(token, companyUid)).find((m) => m.personEmail?.toLowerCase() === wanted);
+        return member?.personUid ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The signed-in person's identities a meeting audience can name: their email
+ * and their `prs_` person uid. The run's `personUid` is the Cognito sub, which
+ * meeting transcripts never carry.
+ */
+async function meetingIdentities(input, session, email) {
+    const personUid = await (input.resolvePersonUid ?? rosterPersonUid)(session.token, session.companyUid, email);
+    return personUid ? [email, personUid] : [email];
+}
+/**
+ * One hot-channel sync for the signed-in person in one company: each adapter
+ * once per usable connection. Writes under `companies/{company}/`: landed
+ * sources in `sources/`, index rows in `sources/_index/`, cursors in
+ * `sources/_cursors/`, one ledger line per adapter in `sources/_runs/`, and
+ * signals in `signals/@{key}/`. `hq sources sync` and the bot's scheduled
+ * hot-signal-sync job both call it. Only one run per person per company goes
+ * at a time: a second one writes a `skipped` ledger line and lands nothing.
+ */
+export async function runCompanyHotChannelSync(input) {
+    assertSafeSegment(input.company, "company");
+    const author = resolveUploadAuthor();
+    const session = author ? await signedInSession(input.company) : null;
+    if (!author || !session)
+        return signInReport();
+    const vaultRoot = path.join(input.hqRoot, "companies", input.company);
+    const personKey = audienceKey([author.email]);
+    const now = input.now ?? (() => new Date());
+    const lock = await acquireSyncLock(vaultRoot, personKey, { now });
+    if (!lock)
+        return skippedReport(input, vaultRoot, personKey, author.userSub, now);
+    try {
+        return await runLockedCompanySync(input, vaultRoot, personKey, author, session, lock.assertHeld);
+    }
+    finally {
+        await lock.release();
+    }
+}
+async function skippedReport(input, vaultRoot, personKey, personUid, now) {
+    const at = now().toISOString();
+    const line = {
+        runId: `run_${randomUUID()}`,
+        trigger: input.trigger ?? "on-demand",
+        adapter: "all",
+        connectionId: null,
+        sourcesLanded: 0,
+        signalsGenerated: 0,
+        startedAt: at,
+        finishedAt: at,
+        status: "skipped",
+        error: null,
+        reason: SYNC_LOCK_BUSY_REASON,
+        personUid,
+        catchUp: input.catchUp ?? false,
+    };
+    await appendRunLedgerEntry(vaultRoot, personKey, line);
+    return {
+        runId: line.runId,
+        signInRequired: false,
+        skipped: true,
+        outcomes: [],
+        entries: [line],
+        notices: [`Another hot-channel sync for ${input.company} is already running, so this one was skipped.`],
+        exitCode: 0,
+    };
+}
+async function runLockedCompanySync(input, vaultRoot, personKey, author, session, lockHeld) {
+    const deps = gatewaySyncDeps(session.token, session.companyUid);
+    const report = await runOnDemandSync({
+        deps,
+        registry: input.registry ??
+            createBuiltinHotChannelRegistry({ vaultRoot, identities: await meetingIdentities(input, session, author.email) }),
+        vaultRoot,
+        personUid: author.userSub,
+        personKey,
+        ...(input.adapter !== undefined ? { adapter: input.adapter } : {}),
+        ...(input.now ? { now: input.now } : {}),
+        ...(input.trigger ? { trigger: input.trigger } : {}),
+        ...(input.catchUp === undefined ? {} : { catchUp: input.catchUp }),
+        ...(input.signalsGenerated ? { signalsGenerated: input.signalsGenerated } : {}),
+        beforeWrite: lockHeld,
+    });
+    if (input.signalsAlert) {
+        const postCompanyChannel = input.signalsAlert.postCompanyChannel ??
+            createSignalsAlertChannelPoster({ hqRoot: input.hqRoot, company: input.company, deps });
+        await raiseSignalsFailureAlerts({
+            vaultRoot,
+            personKey,
+            entries: report.entries,
+            now: input.now ?? (() => new Date()),
+            personName: author.email,
+            sendOwnerDm: input.signalsAlert.sendOwnerDm,
+            ...(postCompanyChannel ? { postCompanyChannel } : {}),
+            ...(input.signalsAlert.log ? { log: input.signalsAlert.log } : {}),
+        });
+    }
+    return report;
+}
+/**
+ * Run every hot channel for the signed-in person now: each adapter once per
+ * usable connection. Writes cursors, landed sources and an `on-demand` ledger
+ * line under `companies/{company}/sources/`, and nothing else.
+ */
+export async function runSync(options, overrides = {}) {
+    const company = options.company ?? readActiveCompanySlug(options.hqRoot);
+    if (!company) {
+        throw new Error("No company specified. Pass --company <slug> or set activeCompany in .hq/config.json.");
+    }
+    const report = await runCompanyHotChannelSync({
+        hqRoot: options.hqRoot,
+        company,
+        ...(options.adapter !== undefined ? { adapter: options.adapter } : {}),
+        ...(overrides.registry ? { registry: overrides.registry } : {}),
+        ...(overrides.now ? { now: overrides.now } : {}),
+        signalsGenerated: overrides.signalsGenerated ?? createClaudeSignalsPass({ hqRoot: options.hqRoot, company }),
+        // The CLI has no owner-DM sender: the terminal is the primary alert here.
+        signalsAlert: {
+            sendOwnerDm: async (text) => {
+                process.stderr.write(chalk.red(`${text}\n`));
+            },
+            log: (message) => process.stderr.write(chalk.yellow(`${message}\n`)),
+        },
+    });
+    if (options.json) {
+        process.stdout.write(JSON.stringify({ company, ...report }, null, 2) + "\n");
+    }
+    else {
+        process.stdout.write(renderSyncTable(company, report) + "\n");
+    }
+    for (const outcome of report.outcomes) {
+        if (outcome.reconnect)
+            process.stderr.write(chalk.yellow(`${outcome.reconnect.prompt}\n`));
+    }
+    if (report.signInRequired)
+        process.stderr.write(chalk.yellow(`${SIGN_IN_PROMPT}\n`));
+    if (report.exitCode !== 0)
+        process.exitCode = report.exitCode;
+    return report;
+}
+function renderSyncTable(company, report) {
+    const lines = [`Hot-channel sync for ${company}`];
+    for (const notice of report.notices) {
+        if (!report.signInRequired)
+            lines.push(notice);
+    }
+    if (report.outcomes.length > 0) {
+        const pad = (s, w) => s + " ".repeat(Math.max(0, w - s.length));
+        const header = ["ADAPTER", "CONNECTION", "LANDED", "STATUS"];
+        const rows = report.outcomes.map((o) => [
+            o.adapter,
+            o.connectionId ?? "-",
+            String(o.landed),
+            o.status === "ok" ? "ok" : o.message ? `${o.status}: ${o.message}` : o.status,
+        ]);
+        const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+        lines.push("", header.map((h, i) => pad(h, widths[i])).join("  "));
+        for (const row of rows)
+            lines.push(row.map((cell, i) => pad(cell, widths[i])).join("  "));
+        const landed = report.outcomes.reduce((sum, o) => sum + o.landed, 0);
+        lines.push("", `${landed} source(s) landed.`);
+    }
+    return lines.join("\n");
+}
 // ---------------------------------------------------------------------------
 // Registration
 // ---------------------------------------------------------------------------
@@ -260,5 +600,27 @@ export function registerSourcesCommand(program) {
         .description("List entities (companies/personal) your account has access to")
         .option("--format <fmt>", "Output format: table | json (default: table for TTY, json piped)")
         .action(withErrorHandling(async (options) => runEntities(options)));
+    sources
+        .command("runs")
+        .description("Show the hot-channel run log: sources landed and signals generated per adapter")
+        .option("--today", "Show today's runs (UTC); the default")
+        .option("--date <YYYY-MM-DD>", "Show runs for this UTC day")
+        .option("--company <slug>", "Company slug (defaults to .hq/config.json activeCompany)")
+        .option("--email <address>", "Whose runs to show (defaults to the signed-in person)")
+        .option("--format <fmt>", "Output format: table | json (default: table for TTY, json piped)")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(withErrorHandling(async (options) => {
+        await runRuns(options);
+    }));
+    sources
+        .command("sync")
+        .description("Run every hot channel now: each adapter once per connection you can use")
+        .option("--adapter <id>", "Run one adapter only (a catalog provider or adapter id)")
+        .option("--company <slug>", "Company slug (defaults to .hq/config.json activeCompany)")
+        .option("--json", "Print the run report as JSON")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(withErrorHandling(async (options) => {
+        await runSync(options);
+    }));
 }
 //# sourceMappingURL=sources.js.map

package/dist/lib/bot/fleet-local.d.ts

@@ -133,7 +133,7 @@ export interface FleetLocalRemovalResult {
     credentialsRemoved: number;
 }
 export declare const HQ_FLEET_LOCAL_RELEASE: FleetLocalReleasePin;
-export declare const HQ_FLEET_LOCAL_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAOOL7NRKQgjMYI5cWxLY+HGppXf2AtwpQbCg5v+nBksM=\n-----END PUBLIC KEY-----\n";
+export declare const HQ_FLEET_LOCAL_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAbYvc1pwOmiCUPJv8yIa3E9RXfniFA84nH2+ROmLMGZU=\n-----END PUBLIC KEY-----\n";
 export declare function fleetHome(home?: string, env?: NodeJS.ProcessEnv): string;
 export declare function verifyFleetLocalRelease(files: FleetLocalReleaseFiles, release?: FleetLocalReleasePin, publicKey?: string): void;
 export declare function resolveFleetReleaseToken(env?: NodeJS.ProcessEnv): string;

package/dist/lib/bot/fleet-local.js

@@ -35,18 +35,18 @@ export function fleetProviderNeedsSignIn(provider) {
 }
 export const HQ_FLEET_LOCAL_RELEASE = {
     repository: "indigoai-us/hq-fleet-local",
-    tag: "v0.4.12",
-    version: "0.4.12",
-    artifact: "hq-fleet-local-0.4.12.zip",
-    artifactSha256: "2a07e79b1740e8ef68b19078b73b10cdf9377065a2fd1f53287b7e353099c577",
+    tag: "v0.4.13",
+    version: "0.4.13",
+    artifact: "hq-fleet-local-0.4.13.zip",
+    artifactSha256: "81b129ac129578240af9091b06ae190f47f6be38ff933b35ae5459d5b78c72df",
     runtimeArtifact: "hq-fleet-runtime-abccac13bd9e.tar",
     runtimeArtifactSha256: "29bcfe718ad7fbd3636afd00623772f2a25bc84c4f6f10d8d57f38e549d528d5",
-    manifestSha256: "cdac590bdcebea6629de0c164c42c7baf30c025a299ff5829380989dd22a9ff1",
-    signatureSha256: "f07911dd3187393cd325fc8f88ddaa6a7568825aee6d8748a992cea822d5d9b1",
+    manifestSha256: "42654f91264099ce173ce3a9f42e207f566e1412ea4b550dc21775d764327bbb",
+    signatureSha256: "93cf9b0a94d75c532454243e3391e421e2743f59f8e65989a5a56ec9152e2fa4",
     runtimeCommit: "abccac13bd9ea593b24c8cd9c0ba28d5c6050cc9",
 };
 export const HQ_FLEET_LOCAL_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAOOL7NRKQgjMYI5cWxLY+HGppXf2AtwpQbCg5v+nBksM=
+MCowBQYDK2VwAyEAbYvc1pwOmiCUPJv8yIa3E9RXfniFA84nH2+ROmLMGZU=
 -----END PUBLIC KEY-----
 `;
 function digest(value) {

package/dist/lib/bot/jobs/hot-signal-sync.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The bot's built-in hot-signal-sync job.
+ *
+ * A local bot that is bound to a company registers one recurring job in its
+ * own `jobs.json` the first time it starts (`ensureHotSignalSyncJob`). The job
+ * fires from the bot's inbox loop like every other local job
+ * (lib/bot/local-jobs.ts): no crontab, launchd or systemd entry is written.
+ * The default schedule is 06:30 daily in the machine's time zone, ahead of a
+ * morning brief; the owner changes it with
+ * `hq bot jobs <bot> --reschedule <jobId> --every "<when>"`, or removes it with
+ * `--rm`, and a removed job is not added back on the next start.
+ *
+ * When the job fires the bot runs the sync in-process, with no model turn
+ * (`runHotSignalSyncJob`): the same hot-channel sync `hq sources sync` runs,
+ * with `trigger: "scheduled"` and `catchUp` set when the run fired late after
+ * a missed window. Catch-up is bounded by each adapter's `catchUpWindow`, and
+ * per-connection cursors keep a redelivered run from landing anything twice.
+ * The claude signals pass (US-011) runs after each adapter when the bot wires
+ * one in; with none the signals count is 0.
+ */
+import type { HotChannelRunResult, WriteGuard } from "../../hot-channels/loop.js";
+import type { RunTrigger } from "../../hot-channels/ledger.js";
+import type { OnDemandSyncReport } from "../../hot-channels/run.js";
+import { type BotConfig } from "../config.js";
+import { type LocalJob } from "../local-jobs.js";
+export declare const HOT_SIGNAL_SYNC_JOB_KIND = "hot-signal-sync";
+/**
+ * 06:30 every day, in the job's time zone (the stored EventBridge form of
+ * "30 6 * * *"). Only the first registration uses it; after that the job's
+ * own schedule in `jobs.json` is the one that runs.
+ */
+export declare const HOT_SIGNAL_SYNC_DEFAULT_CRON = "cron(30 6 * * ? *)";
+/** The private context that marks a job as this built-in, for one company. */
+export declare function hotSignalSyncJobContext(company: string): Record<string, unknown>;
+/** The company a job item syncs, when its context marks it as this built-in; else null. */
+export declare function hotSignalSyncJobCompany(context: unknown): string | null;
+/**
+ * The company a bot's hot-signal-sync job syncs: the bot's own company, else
+ * the first company it serves. Null = none, and no job is registered. There is
+ * no fallback to the HQ's active company: a personal bot syncs a company only
+ * when it was given one explicitly (`--company`), so the job never writes into
+ * a vault the bot does not belong to. Checked again each time the job fires.
+ */
+export declare function currentHotSignalSyncCompany(config: Pick<BotConfig, "companySlug" | "kind" | "companies" | "workerId">): string | null;
+/**
+ * Remove every hot-signal-sync job whose company is not `current` (all of them
+ * when `current` is null), and forget their registration so the company can be
+ * registered again if the bot is given it back. Returns the removed jobs.
+ */
+export declare function removeStaleHotSignalSyncJobs(dir: string, current: string | null): LocalJob[];
+export interface EnsureHotSignalSyncJobResult {
+    /** The job, or null when the owner removed it after it was first registered. */
+    job: LocalJob | null;
+    created: boolean;
+}
+/**
+ * Register the hot-signal-sync job for `company` once. Safe to call on every
+ * bot start: an existing job is left as it is (including a changed schedule),
+ * and a job the owner removed is not added again.
+ */
+export declare function ensureHotSignalSyncJob(dir: string, input: {
+    company: string;
+    timezone: string;
+}, now?: Date): EnsureHotSignalSyncJobResult;
+/**
+ * The signals pass over one adapter's landed sources: how many signals it
+ * generated. The bot wires the local `claude -p` pass
+ * (`createClaudeSignalsPass`); `noLocalSignalsPass` is the default when no
+ * pass is given.
+ */
+export type LocalSignalsPass = (result: HotChannelRunResult, guard?: WriteGuard) => Promise<number>;
+export declare const noLocalSignalsPass: LocalSignalsPass;
+/** One company's hot-channel sync, as `runCompanyHotChannelSync` runs it (minus the HQ root). */
+export type HotSignalSyncFn = (input: {
+    company: string;
+    trigger: RunTrigger;
+    catchUp: boolean;
+    signalsGenerated: LocalSignalsPass;
+    now: () => Date;
+    /** The owner DM for the signals-failure alert (US-012); unset = no alert check. */
+    signalsAlert?: {
+        sendOwnerDm: (text: string) => Promise<void>;
+        log?: (message: string) => void;
+    };
+}) => Promise<OnDemandSyncReport>;
+export interface HotSignalSyncRunInput {
+    company: string;
+    /** The run fired late, after a missed window (job-run.ts `isCatchUpRun`). */
+    catchUp: boolean;
+    now: () => Date;
+    sync: HotSignalSyncFn;
+    signalsPass?: LocalSignalsPass;
+    /**
+     * Sends the signals-failure alert to the owner as its own message, even when
+     * the job is quiet. Throws when the message was not delivered.
+     */
+    sendAlert?: (text: string) => Promise<void>;
+    log?: (message: string) => void;
+}
+export interface HotSignalSyncRunOutcome {
+    ok: boolean;
+    /** Plain report for the owner's DM and the job's run output. */
+    text: string;
+    report: OnDemandSyncReport | null;
+}
+/** Run the scheduled sync once and describe it in plain words. Never throws. */
+export declare function runHotSignalSyncJob(input: HotSignalSyncRunInput): Promise<HotSignalSyncRunOutcome>;
+export declare function describeSyncReport(company: string, report: OnDemandSyncReport): string;
+//# sourceMappingURL=hot-signal-sync.d.ts.map