@indigoai-us/hq-cloud 5.1.0 → 5.1.9

package/dist/bin/sync-runner.d.ts

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+/**
+ * hq-sync-runner — machine-targeted entrypoint for `@indigoai-us/hq-cloud`
+ * (ADR-0001).
+ *
+ * The AppBar Sync menubar (Tauri + Rust) spawns this binary as a subprocess
+ * and reads ndjson events from stdout. The protocol is intentionally narrow
+ * and versioned-by-shape, not by tooling — no chalk, no colors, no human
+ * prose. If you want to invoke sync as a human, use `hq sync` in
+ * `@indigoai-us/hq-cli`.
+ *
+ * Flags:
+ *   --companies               Fan out across every membership the caller has
+ *   --company <slug-or-uid>   Sync a single company (alternative to --companies)
+ *   --on-conflict <strategy>  abort | overwrite | keep (default: abort)
+ *   --hq-root <path>          Local HQ directory (default: $HOME/hq)
+ *   --json                    Ignored — ndjson on stdout is the default and
+ *                             only output mode. Accepted for symmetry with the
+ *                             AppBar's argv in case someone passes it.
+ *
+ * Event protocol (one JSON object per line on stdout):
+ *   setup-needed   — caller signed in but has no person entity yet
+ *   auth-error     — no valid token available (interactive login disabled)
+ *   fanout-plan    — list of companies we're about to sync
+ *   progress       — per-file download
+ *   error          — per-file or per-company error
+ *   complete       — per-company summary
+ *   all-complete   — aggregate summary after fanout
+ *
+ * Exit code:
+ *   0 — event stream describes the outcome (including setup-needed)
+ *   1 — argv parse error or unrecoverable pre-sync failure
+ */
+import { type VaultServiceConfig, type Membership, type EntityInfo, type PendingInviteByEmail } from "../index.js";
+import type { SyncOptions, SyncResult, SyncProgressEvent } from "../cli/sync.js";
+/**
+ * Every event emitted on stdout. The `company` field is present on every
+ * event except `setup-needed` / `auth-error` / `fanout-plan` / `all-complete`
+ * (which describe the whole run) — consumers should treat its absence as
+ * "meta-event, not tied to a specific company".
+ */
+export type RunnerEvent = {
+    type: "setup-needed";
+} | {
+    type: "auth-error";
+    message: string;
+} | {
+    type: "fanout-plan";
+    companies: Array<{
+        uid: string;
+        slug: string;
+        name?: string;
+    }>;
+} | ({
+    type: "progress";
+    company: string;
+} & Omit<Extract<SyncProgressEvent, {
+    type: "progress";
+}>, "type">) | ({
+    type: "error";
+    company?: string;
+} & Omit<Extract<SyncProgressEvent, {
+    type: "error";
+}>, "type">) | ({
+    type: "complete";
+    company: string;
+} & SyncResult) | {
+    type: "all-complete";
+    companiesAttempted: number;
+    filesDownloaded: number;
+    bytesDownloaded: number;
+    errors: Array<{
+        company: string;
+        message: string;
+    }>;
+};
+/**
+ * The narrow VaultClient surface the runner actually uses. Declared here (not
+ * `Pick<VaultClient, ...>`) because `Pick` preserves the *entire* `entity`
+ * accessor object — but the runner only needs `entity.get`, and forcing test
+ * stubs to also implement `findBySlug`/`create` would be dishonest about the
+ * real dependency. Keep this interface in sync with the real VaultClient
+ * method signatures (both return types come straight from the SDK).
+ */
+export interface VaultClientSurface {
+    listMyMemberships: () => Promise<Membership[]>;
+    listMyPendingInvitesByEmail: () => Promise<PendingInviteByEmail[]>;
+    claimPendingInvitesByEmail: (personUid: string) => Promise<void>;
+    ensureMyPersonEntity: (hints: {
+        ownerSub: string;
+        displayName: string;
+    }) => Promise<EntityInfo>;
+    entity: {
+        get: (uid: string) => Promise<EntityInfo>;
+    };
+}
+/** Minimal shape of the claims we read off the Cognito idToken. */
+interface IdTokenClaims {
+    sub?: string;
+    email?: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+}
+export interface RunnerDeps {
+    /** Where to write ndjson events. Defaults to `process.stdout`. */
+    stdout?: {
+        write: (chunk: string) => boolean | void;
+    };
+    /** Where to write diagnostics. Defaults to `process.stderr`. */
+    stderr?: {
+        write: (chunk: string) => boolean | void;
+    };
+    /** Resolve a valid access token. Defaults to `getValidAccessToken` non-interactive. */
+    getAccessToken?: () => Promise<string>;
+    /**
+     * Read the caller's identity claims (sub/email/name) off the cached Cognito
+     * idToken. Defaults to decoding `loadCachedTokens().idToken`. Returns `null`
+     * when no cached tokens exist — the runner will then skip the claim-dance
+     * and fall through to the usual listMyMemberships path.
+     */
+    getIdTokenClaims?: () => IdTokenClaims | null;
+    /**
+     * Produce a VaultClient-like object. Defaults to `new VaultClient(config)`.
+     * Tests inject a stub here — the runner only calls the methods listed in
+     * `VaultClientSurface`.
+     */
+    createVaultClient?: (config: VaultServiceConfig) => VaultClientSurface;
+    /** Sync function. Defaults to `cli/sync.sync`. */
+    sync?: (options: SyncOptions) => Promise<SyncResult>;
+}
+export declare function runRunner(argv: string[], deps?: RunnerDeps): Promise<number>;
+export {};
+//# sourceMappingURL=sync-runner.d.ts.map

package/dist/bin/sync-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-runner.d.ts","sourceRoot":"","sources":["../../src/bin/sync-runner.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,OAAO,EAOL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AA6BxB;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvC;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,GACD,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GACxG,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,CAAC,GACnG,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAAC,GACpD;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD,CAAC;AAEN;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/C,2BAA2B,EAAE,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnE,0BAA0B,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,oBAAoB,EAAE,CAAC,KAAK,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1B,MAAM,EAAE;QACN,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;KAC3C,CAAC;CACH;AAED,mEAAmE;AACnE,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,gEAAgE;IAChE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,kBAAkB,CAAC;IACvE,kDAAkD;IAClD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACtD;AAuID,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,MAAM,CAAC,CAmKjB"}

package/dist/bin/sync-runner.js

@@ -0,0 +1,360 @@
+#!/usr/bin/env node
+/**
+ * hq-sync-runner — machine-targeted entrypoint for `@indigoai-us/hq-cloud`
+ * (ADR-0001).
+ *
+ * The AppBar Sync menubar (Tauri + Rust) spawns this binary as a subprocess
+ * and reads ndjson events from stdout. The protocol is intentionally narrow
+ * and versioned-by-shape, not by tooling — no chalk, no colors, no human
+ * prose. If you want to invoke sync as a human, use `hq sync` in
+ * `@indigoai-us/hq-cli`.
+ *
+ * Flags:
+ *   --companies               Fan out across every membership the caller has
+ *   --company <slug-or-uid>   Sync a single company (alternative to --companies)
+ *   --on-conflict <strategy>  abort | overwrite | keep (default: abort)
+ *   --hq-root <path>          Local HQ directory (default: $HOME/hq)
+ *   --json                    Ignored — ndjson on stdout is the default and
+ *                             only output mode. Accepted for symmetry with the
+ *                             AppBar's argv in case someone passes it.
+ *
+ * Event protocol (one JSON object per line on stdout):
+ *   setup-needed   — caller signed in but has no person entity yet
+ *   auth-error     — no valid token available (interactive login disabled)
+ *   fanout-plan    — list of companies we're about to sync
+ *   progress       — per-file download
+ *   error          — per-file or per-company error
+ *   complete       — per-company summary
+ *   all-complete   — aggregate summary after fanout
+ *
+ * Exit code:
+ *   0 — event stream describes the outcome (including setup-needed)
+ *   1 — argv parse error or unrecoverable pre-sync failure
+ */
+import * as os from "os";
+import * as path from "path";
+import * as fs from "fs";
+import { fileURLToPath } from "url";
+import { getValidAccessToken, loadCachedTokens, VaultClient, VaultAuthError, } from "../index.js";
+import { sync as defaultSync } from "../cli/sync.js";
+// ---------------------------------------------------------------------------
+// Defaults — mirror `hq-cli/src/utils/cognito-session.ts`. Inlined (not
+// imported) to avoid a circular dep between hq-cli and hq-cloud. If these
+// drift, the symptom is "runner talks to a different stage than hq sync"
+// — keep both files lined up.
+// ---------------------------------------------------------------------------
+const DEFAULT_COGNITO = {
+    region: process.env.AWS_REGION ?? "us-east-1",
+    userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "hq-vault-dev",
+    clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "4mmujmjq3srakdueg656b9m0mp",
+    port: process.env.HQ_COGNITO_CALLBACK_PORT
+        ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
+        : 8765,
+};
+const DEFAULT_VAULT_API_URL = process.env.HQ_VAULT_API_URL ??
+    "https://tqdwdqxv75.execute-api.us-east-1.amazonaws.com";
+const DEFAULT_HQ_ROOT = path.join(os.homedir(), "hq");
+// ---------------------------------------------------------------------------
+// JWT claim decoder — inlined to avoid pulling a dep just to read an idToken.
+// We do NOT verify the signature here — Cognito already did that when it
+// issued the token, and we only read the public claims (sub/email/name) to
+// drive the claim-dance + create the person entity. If the token is tampered
+// with, the downstream vault-service call will reject it (signature-verified
+// there) long before any claimed value causes harm.
+// ---------------------------------------------------------------------------
+function decodeJwtClaims(jwt) {
+    const parts = jwt.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const padded = payload + "=".repeat((4 - (payload.length % 4)) % 4);
+        const json = Buffer.from(padded, "base64").toString("utf-8");
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+function defaultGetIdTokenClaims() {
+    const tokens = loadCachedTokens();
+    if (!tokens?.idToken)
+        return null;
+    return decodeJwtClaims(tokens.idToken);
+}
+/**
+ * Best-effort: claim any email-keyed pending invites that were sent before
+ * this user had a person entity. Mirrors the installer's vault-handoff flow.
+ *
+ * Silent on the happy path — only logs to stderr on soft failures (so a
+ * transient network blip doesn't block the sync). Never throws: a caller who
+ * can't list memberships despite an unclaimed invite is no worse off than the
+ * pre-claim-dance behavior (which was to emit setup-needed).
+ */
+async function runClaimDance(client, claims, stderr) {
+    try {
+        const pending = await client.listMyPendingInvitesByEmail();
+        if (pending.length === 0)
+            return;
+        const displayName = claims.name ??
+            [claims.given_name, claims.family_name].filter(Boolean).join(" ") ??
+            claims.email ??
+            "";
+        const ownerSub = claims.sub ?? "";
+        if (!ownerSub || !displayName) {
+            stderr.write("hq-sync-runner: skipping claim-dance — idToken missing sub/name\n");
+            return;
+        }
+        const person = await client.ensureMyPersonEntity({
+            ownerSub,
+            displayName,
+        });
+        await client.claimPendingInvitesByEmail(person.uid);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        stderr.write(`hq-sync-runner: claim-dance skipped — ${msg}\n`);
+    }
+}
+function parseArgs(argv) {
+    let companies = false;
+    let company;
+    let onConflict = "abort";
+    let hqRoot = DEFAULT_HQ_ROOT;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        switch (arg) {
+            case "--companies":
+                companies = true;
+                break;
+            case "--company":
+                company = argv[++i];
+                if (!company)
+                    return { error: "--company requires a value" };
+                break;
+            case "--on-conflict": {
+                const val = argv[++i];
+                if (val !== "abort" && val !== "overwrite" && val !== "keep") {
+                    return {
+                        error: `--on-conflict must be one of abort|overwrite|keep, got: ${val ?? "(missing)"}`,
+                    };
+                }
+                onConflict = val;
+                break;
+            }
+            case "--hq-root":
+                hqRoot = argv[++i];
+                if (!hqRoot)
+                    return { error: "--hq-root requires a value" };
+                break;
+            case "--json":
+                // Accepted but ignored — ndjson is the only output mode.
+                break;
+            default:
+                return { error: `Unknown argument: ${arg}` };
+        }
+    }
+    if (companies && company) {
+        return { error: "Pass --companies OR --company <slug>, not both" };
+    }
+    if (!companies && !company) {
+        return { error: "Pass --companies or --company <slug>" };
+    }
+    return { companies, company, onConflict, hqRoot };
+}
+// ---------------------------------------------------------------------------
+// runRunner — testable entrypoint
+// ---------------------------------------------------------------------------
+export async function runRunner(argv, deps = {}) {
+    const stdout = deps.stdout ?? process.stdout;
+    const stderr = deps.stderr ?? process.stderr;
+    const emit = (event) => {
+        stdout.write(`${JSON.stringify(event)}\n`);
+    };
+    // ---- argv -------------------------------------------------------------
+    const parsed = parseArgs(argv);
+    if ("error" in parsed) {
+        stderr.write(`hq-sync-runner: ${parsed.error}\n`);
+        return 1;
+    }
+    // ---- auth -------------------------------------------------------------
+    let accessToken;
+    try {
+        const getAccessToken = deps.getAccessToken ??
+            (() => getValidAccessToken(DEFAULT_COGNITO, { interactive: false }));
+        accessToken = await getAccessToken();
+    }
+    catch (err) {
+        emit({
+            type: "auth-error",
+            message: err instanceof Error ? err.message : String(err),
+        });
+        return 0;
+    }
+    // ---- vault client -----------------------------------------------------
+    const vaultConfig = {
+        apiUrl: DEFAULT_VAULT_API_URL,
+        authToken: accessToken,
+        region: DEFAULT_COGNITO.region,
+    };
+    const client = deps.createVaultClient?.(vaultConfig) ?? new VaultClient(vaultConfig);
+    // ---- resolve targets --------------------------------------------------
+    let memberships;
+    try {
+        if (parsed.companies) {
+            // Before giving up on memberships, run the claim-dance: new users signed
+            // in via the tray may have email-keyed invites waiting for them. Without
+            // this, an invited user would see "setup-needed" on every tray click.
+            const getClaims = deps.getIdTokenClaims ?? defaultGetIdTokenClaims;
+            const claims = getClaims();
+            if (claims) {
+                await runClaimDance(client, claims, stderr);
+            }
+            memberships = await client.listMyMemberships();
+            if (memberships.length === 0) {
+                // Truly empty — still a valid state (no memberships = nothing to
+                // sync). The tray will show a friendly "create your first company"
+                // CTA rather than an alarm banner.
+                emit({ type: "setup-needed" });
+                return 0;
+            }
+        }
+        else {
+            // Single-company mode: fabricate a minimal membership so the fanout
+            // loop below treats it uniformly. We don't need to hit
+            // /membership/me — the caller already told us which company.
+            memberships = [{ companyUid: parsed.company }];
+        }
+    }
+    catch (err) {
+        if (err instanceof VaultAuthError) {
+            emit({
+                type: "auth-error",
+                message: err.message,
+            });
+            return 0;
+        }
+        // Any other failure is unrecoverable — surface as an error event and
+        // exit non-zero so the spawner knows the runner didn't get far enough
+        // to emit a useful protocol stream.
+        emit({
+            type: "error",
+            message: err instanceof Error ? err.message : String(err),
+            path: "(discovery)",
+        });
+        return 1;
+    }
+    // ---- resolve slugs for the fanout plan --------------------------------
+    // The menubar wants "Syncing indigo" in its UI, not the raw cmp_* ULID.
+    // If the entity fetch fails for some row (entity deleted, scoping issue),
+    // degrade to using the UID as the slug rather than aborting the run.
+    const plan = [];
+    for (const m of memberships) {
+        let slug = m.companyUid;
+        let name;
+        try {
+            const info = await client.entity.get(m.companyUid);
+            slug = info.slug || m.companyUid;
+            name = info.name;
+        }
+        catch {
+            // Best-effort — keep UID as the display identifier.
+        }
+        plan.push({ uid: m.companyUid, slug, ...(name ? { name } : {}) });
+    }
+    emit({ type: "fanout-plan", companies: plan });
+    // ---- fanout -----------------------------------------------------------
+    const syncFn = deps.sync ?? defaultSync;
+    let totalFiles = 0;
+    let totalBytes = 0;
+    const errors = [];
+    for (const target of plan) {
+        const companyLabel = target.slug;
+        try {
+            const result = await syncFn({
+                company: target.uid,
+                vaultConfig,
+                hqRoot: parsed.hqRoot,
+                onConflict: parsed.onConflict,
+                onEvent: (event) => {
+                    // Tag per-file events with the company they belong to so the
+                    // menubar can route them to the right company's progress bar.
+                    if (event.type === "progress") {
+                        emit({
+                            type: "progress",
+                            company: companyLabel,
+                            path: event.path,
+                            bytes: event.bytes,
+                            ...(event.message ? { message: event.message } : {}),
+                        });
+                    }
+                    else {
+                        emit({
+                            type: "error",
+                            company: companyLabel,
+                            path: event.path,
+                            message: event.message,
+                        });
+                    }
+                },
+            });
+            emit({ type: "complete", company: companyLabel, ...result });
+            totalFiles += result.filesDownloaded;
+            totalBytes += result.bytesDownloaded;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            errors.push({ company: companyLabel, message });
+            emit({
+                type: "error",
+                company: companyLabel,
+                path: "(company)",
+                message,
+            });
+            // Continue — one company's failure shouldn't abort the whole fanout.
+        }
+    }
+    emit({
+        type: "all-complete",
+        companiesAttempted: plan.length,
+        filesDownloaded: totalFiles,
+        bytesDownloaded: totalBytes,
+        errors,
+    });
+    return 0;
+}
+// ---------------------------------------------------------------------------
+// Entrypoint — only runs when invoked directly, not when imported for tests
+// ---------------------------------------------------------------------------
+// Detect whether this module is the entry point. The obvious check
+// (`import.meta.url === file://${argv[1]}`) breaks for every real-world
+// install shape: npm-link'd binaries, global installs via Homebrew, and
+// pnpm's `node_modules/.bin` shims all leave `process.argv[1]` pointing
+// at a symlink named `hq-sync-runner` (no `.js` suffix) while
+// `import.meta.url` always resolves to the underlying `sync-runner.js`.
+//
+// Resolve both sides through realpath before comparing — that's the only
+// way to handle all symlink layouts without false negatives. If realpath
+// fails (argv[1] gone, permissions), fall through to `false` so we
+// don't run twice when imported as a library.
+const isDirectInvocation = (() => {
+    if (!process.argv[1])
+        return false;
+    try {
+        const modulePath = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argvPath = fs.realpathSync(process.argv[1]);
+        return modulePath === argvPath;
+    }
+    catch {
+        return false;
+    }
+})();
+if (isDirectInvocation) {
+    runRunner(process.argv.slice(2))
+        .then((code) => process.exit(code))
+        .catch((err) => {
+        process.stderr.write(`hq-sync-runner: uncaught error — ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=sync-runner.js.map

package/dist/bin/sync-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-runner.js","sourceRoot":"","sources":["../../src/bin/sync-runner.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,cAAc,GAOf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAQrD,8EAA8E;AAC9E,wEAAwE;AACxE,0EAA0E;AAC1E,yEAAyE;AACzE,8BAA8B;AAC9B,8EAA8E;AAE9E,MAAM,eAAe,GAAsB;IACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;IAC7C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,cAAc;IAC/D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,4BAA4B;IAC1E,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACxC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC9C,CAAC,CAAC,IAAI;CACT,CAAC;AAEF,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC5B,wDAAwD,CAAC;AAE3D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AAoFtD,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,oDAAoD;AACpD,8EAA8E;AAE9E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,MAAM,GAAyB,gBAAgB,EAAE,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAC1B,MAA0B,EAC1B,MAAqB,EACrB,MAAoD;IAEpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,MAAM,WAAW,GACf,MAAM,CAAC,IAAI;YACX,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,MAAM,CAAC,KAAK;YACZ,EAAE,CAAC;QACL,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CACV,mEAAmE,CACpE,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC;YAC/C,QAAQ;YACR,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,0BAA0B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAaD,SAAS,SAAS,CAAC,IAAc;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAA2B,CAAC;IAChC,IAAI,UAAU,GAAqB,OAAO,CAAC;IAC3C,IAAI,MAAM,GAAG,eAAe,CAAC;IAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,aAAa;gBAChB,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;gBAC7D,MAAM;YACR,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACtB,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;oBAC7D,OAAO;wBACL,KAAK,EAAE,2DAA2D,GAAG,IAAI,WAAW,EAAE;qBACvF,CAAC;gBACJ,CAAC;gBACD,UAAU,GAAG,GAAG,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,KAAK,WAAW;gBACd,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;gBAC5D,MAAM;YACR,KAAK,QAAQ;gBACX,yDAAyD;gBACzD,MAAM;YACR;gBACE,OAAO,EAAE,KAAK,EAAE,qBAAqB,GAAG,EAAE,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAc,EACd,OAAmB,EAAE;IAErB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAE7C,MAAM,IAAI,GAAG,CAAC,KAAkB,EAAQ,EAAE;QACxC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC;IAEF,0EAA0E;IAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0EAA0E;IAC1E,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,cAAc,GAClB,IAAI,CAAC,cAAc;YACnB,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvE,WAAW,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0EAA0E;IAC1E,MAAM,WAAW,GAAuB;QACtC,MAAM,EAAE,qBAAqB;QAC7B,SAAS,EAAE,WAAW;QACtB,MAAM,EAAE,eAAe,CAAC,MAAM;KAC/B,CAAC;IACF,MAAM,MAAM,GACV,IAAI,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC;IAExE,0EAA0E;IAC1E,IAAI,WAA6C,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,yEAAyE;YACzE,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;YACnE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;YAED,WAAW,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,iEAAiE;gBACjE,mEAAmE;gBACnE,mCAAmC;gBACnC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC/B,OAAO,CAAC,CAAC;YACX,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,uDAAuD;YACvD,6DAA6D;YAC7D,WAAW,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,OAAQ,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QACX,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,oCAAoC;QACpC,IAAI,CAAC;YACH,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACzD,IAAI,EAAE,aAAa;SACpB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,IAAI,GAAwD,EAAE,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC;QACxB,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,0EAA0E;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACxC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,MAAM,GAAgD,EAAE,CAAC;IAE/D,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;gBAC1B,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,WAAW;gBACX,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,6DAA6D;oBAC7D,8DAA8D;oBAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,IAAI,CAAC;4BACH,IAAI,EAAE,UAAU;4BAChB,OAAO,EAAE,YAAY;4BACrB,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,KAAK,EAAE,KAAK,CAAC,KAAK;4BAClB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACrD,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC;4BACH,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,YAAY;4BACrB,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,OAAO,EAAE,KAAK,CAAC,OAAO;yBACvB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7D,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC;YACrC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,WAAW;gBACjB,OAAO;aACR,CAAC,CAAC;YACH,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,IAAI,EAAE,cAAc;QACpB,kBAAkB,EAAE,IAAI,CAAC,MAAM;QAC/B,eAAe,EAAE,UAAU;QAC3B,eAAe,EAAE,UAAU;QAC3B,MAAM;KACP,CAAC,CAAC;IACH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAE9E,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,8DAA8D;AAC9D,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,mEAAmE;AACnE,8CAA8C;AAC9C,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE;IAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,OAAO,UAAU,KAAK,QAAQ,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,kBAAkB,EAAE,CAAC;IACvB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC7B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAClC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACtG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/bin/sync-runner.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Unit tests for hq-sync-runner (ADR-0001).
+ *
+ * The runner is designed around `RunnerDeps` — every side effect is
+ * injectable, so tests assert on captured ndjson output rather than mocking
+ * modules. That keeps each test honest about what the runner does vs what
+ * its collaborators do.
+ */
+export {};
+//# sourceMappingURL=sync-runner.test.d.ts.map

package/dist/bin/sync-runner.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-runner.test.d.ts","sourceRoot":"","sources":["../../src/bin/sync-runner.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}