@fullstackhouse/open-mercato-data-sync-durable 0.1.0 → 0.1.1

package/dist/engine/durable-run.js

@@ -23,8 +23,10 @@ function recordSlice(ctx, runService, progressService) {
        * Core's `finalizeRun` compares what comes back to what it asked for, and stays silent
        * when they differ — the branch it has for "another worker already finalized this". So
        * this both captures the outcome and suppresses the progress write, the operational log
-       * and the lifecycle event, leaving all three to the durable terminal transition, which
-       * writes them in the same transaction as the job's own terminal state.
+       * and the lifecycle event. The run's terminal status is then written by `onTransition`,
+       * in the same transaction as the job's own; the three suppressed side effects are
+       * replayed by `replayFinalize` after that commit, since an event inside a transaction
+       * that can still roll back is a lie waiting to happen.
        */
       async markStatus(runId, status, scope, error) {
         if (status === "completed" || status === "failed" || status === "cancelled") {
@@ -120,11 +122,81 @@ async function reopenRun(tx, runId) {
   );
   return { matched: result.rowCount };
 }
+async function replayFinalize(deps, run, status, errorMessage, scope, userId) {
+  const progressScope = { tenantId: scope.tenantId, organizationId: scope.organizationId, userId: userId ?? void 0 };
+  const enabled = deps.operationalTelemetry(run.integrationId);
+  if (run.progressJobId) {
+    const progress = deps.progressService;
+    if (status === "completed") {
+      await progress.completeJob?.(
+        run.progressJobId,
+        {
+          resultSummary: {
+            createdCount: run.createdCount,
+            updatedCount: run.updatedCount,
+            skippedCount: run.skippedCount,
+            failedCount: run.failedCount,
+            batchesCompleted: run.batchesCompleted
+          }
+        },
+        progressScope
+      );
+    } else if (status === "failed") {
+      await progress.failJob?.(run.progressJobId, { errorMessage: errorMessage ?? "Sync run failed" }, progressScope);
+    } else {
+      await progress.markCancelled?.(run.progressJobId, progressScope);
+    }
+  }
+  const health = status === "completed" ? "healthy" : status === "cancelled" ? "degraded" : "unhealthy";
+  if (enabled && deps.integrationStateService) {
+    await deps.integrationStateService.upsert(
+      run.integrationId,
+      { lastHealthStatus: health, lastHealthCheckedAt: /* @__PURE__ */ new Date() },
+      scope
+    );
+  }
+  if (enabled) {
+    const log = status === "completed" ? {
+      level: "info",
+      message: "Sync run completed",
+      payload: {
+        operationalStatus: "completed",
+        summary: `Sync completed with ${run.createdCount ?? 0} created, ${run.updatedCount ?? 0} updated, ${run.failedCount ?? 0} failed.`,
+        createdCount: run.createdCount,
+        updatedCount: run.updatedCount,
+        skippedCount: run.skippedCount,
+        failedCount: run.failedCount,
+        batchesCompleted: run.batchesCompleted
+      }
+    } : status === "cancelled" ? {
+      level: "warn",
+      message: "Sync run cancelled",
+      payload: { operationalStatus: "cancelled", summary: "The sync run was cancelled before completion." }
+    } : {
+      level: "error",
+      message: errorMessage ?? "Sync run failed",
+      payload: { operationalStatus: "failed", summary: errorMessage ?? "The sync run failed." }
+    };
+    await deps.integrationLogService.write({ integrationId: run.integrationId, runId: run.id, ...log }, scope);
+  }
+  await deps.emitEvent(`data_sync.run.${status}`, {
+    runId: run.id,
+    integrationId: run.integrationId,
+    entityType: run.entityType,
+    direction: run.direction,
+    // Only the failure event carries this, and a subscriber that switches on it would see
+    // every durable failure as an unexplained one if it were dropped.
+    ...status === "failed" ? { error: errorMessage ?? null } : {},
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId
+  });
+}
 export {
   SyncRunFailedError,
   mirrorRunStatus,
   outcomeOf,
   recordSlice,
-  reopenRun
+  reopenRun,
+  replayFinalize
 };
 //# sourceMappingURL=durable-run.js.map

package/dist/engine/durable-run.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/engine/durable-run.ts"],
-  "sourcesContent": ["// How a `data_sync` run becomes durable work without core's engine being changed or copied.\n//\n// Core's engine already survives being displaced by another worker: it asks a cancellation\n// question at every batch boundary, and it stays silent when a terminal write is refused. A\n// durable adopter is exactly a worker in that position, so all this does is answer those two\n// questions differently \u2014 and route the cursor commit through the lease fence.\n//\n// See docs/adr/0004: the original plan was to fork the batch loop. Reading the engine showed\n// the seams were already there.\n\nimport type { SliceContext, SliceOutcome, SqlExecutor } from '@fullstackhouse/open-mercato-durable-work'\n\nimport { SeamBrokenError } from '../modules/data_sync/lib/version-guard'\n\nexport type SyncScope = { tenantId: string; organizationId: string | null; userId?: string | null }\nexport type SyncTerminalStatus = 'completed' | 'failed' | 'cancelled'\n\n/** The methods this decorator *wraps*, not the whole service: core's engine calls plenty more,\n *  and they are passed through untouched. Anything not listed here is delegated. */\nexport type SyncRunServiceLike = {\n  [method: string]: unknown\n  getRun(runId: string, scope: SyncScope): Promise<{ status: string; progressJobId?: string | null } | null>\n  markStatus(runId: string, status: string, scope: SyncScope, error?: string): Promise<unknown>\n  commitBatchProgress(\n    runId: string,\n    delta: Record<string, unknown>,\n    cursor: unknown,\n    scope: SyncScope,\n    options?: Record<string, unknown>,\n  ): Promise<unknown>\n}\n\nexport type ProgressServiceLike = {\n  [method: string]: unknown\n  isCancellationRequested(progressJobId: string, tenantId: string, organizationId: string | null): Promise<boolean>\n}\n\n/** What core's engine tried to do, captured rather than applied. */\nexport type CapturedOutcome = { status: SyncTerminalStatus; error?: string } | null\n\nexport type SliceRecorder = {\n  runService: SyncRunServiceLike\n  progressService: ProgressServiceLike\n  /** What the engine tried to finalize the run as, if anything. */\n  captured(): CapturedOutcome\n  /** Why the slice stopped early, when it did. */\n  stopReason(): 'budget' | 'cancelled' | null\n  /** Batches whose cursor this slice committed. Zero means the slice made no progress. */\n  committedBatches(): number\n}\n\n/**\n * Wraps core's two services for the duration of one slice.\n *\n * @param ctx  the slice this recorder belongs to; its lease is what fences the cursor commits\n */\nexport function recordSlice(\n  ctx: SliceContext,\n  runService: SyncRunServiceLike,\n  progressService: ProgressServiceLike,\n): SliceRecorder {\n  let captured: CapturedOutcome = null\n  let stopReason: 'budget' | 'cancelled' | null = null\n  let committed = 0\n\n  return {\n    captured: () => captured,\n    stopReason: () => stopReason,\n    committedBatches: () => committed,\n\n    // Spread, not rebuilt.\n    //\n    // Core's engine calls far more than the three methods decorated here \u2014 `startJob`,\n    // `updateProgress`, `touchJobHeartbeat`, `markCancelled` and others on the progress\n    // service, and more of the run service besides. An object carrying only the overrides\n    // looks fine to TypeScript through a structural type and then fails at the first\n    // undecorated call, mid-run.\n    runService: {\n      ...runService,\n\n      /**\n       * Records a terminal transition instead of performing it, and answers with the run\n       * unchanged.\n       *\n       * Core's `finalizeRun` compares what comes back to what it asked for, and stays silent\n       * when they differ \u2014 the branch it has for \"another worker already finalized this\". So\n       * this both captures the outcome and suppresses the progress write, the operational log\n       * and the lifecycle event, leaving all three to the durable terminal transition, which\n       * writes them in the same transaction as the job's own terminal state.\n       */\n      async markStatus(runId, status, scope, error) {\n        if (status === 'completed' || status === 'failed' || status === 'cancelled') {\n          captured = { status, error }\n          return runService.getRun(runId, scope)\n        }\n        return runService.markStatus(runId, status, scope, error)\n      },\n\n      /**\n       * Commits the batch cursor under the lease.\n       *\n       * This is the write that must not outlive the right to make it: a worker whose lease\n       * expired mid-batch would otherwise advance the cursor of a run another worker is now\n       * driving, and the two would interleave over one stream.\n       */\n      async commitBatchProgress(runId, delta, cursor, scope, options) {\n        const result = await ctx.fencedWrite(async () => runService.commitBatchProgress(runId, delta, cursor, scope, options))\n        committed += 1\n        // A committed unit of work resets the failure and orphan budgets: a run that is making\n        // progress has not earned the suspicion those counters represent, however many times\n        // it was interrupted getting there.\n        await ctx.heartbeat({ committed: true })\n        return result\n      },\n    },\n\n    progressService: {\n      ...progressService,\n\n      /**\n       * Mirrors the run's counters onto the durable job as they move.\n       *\n       * Core reports progress here after every committed batch. Without this the operator API\n       * shows a job that is plainly running with `0 of null` processed, and the one place\n       * somebody looks to see whether a multi-day backfill is advancing tells them nothing.\n       */\n      async updateProgress(progressJobId: string, patch: { processedCount?: number; totalCount?: number | null }, scope: unknown) {\n        await ctx\n          .heartbeat({ processedCount: patch?.processedCount, totalCount: patch?.totalCount ?? null })\n          .catch(() => undefined)\n        const inner = progressService.updateProgress as\n          | ((id: string, patch: unknown, scope: unknown) => Promise<unknown>)\n          | undefined\n        return inner?.call(progressService, progressJobId, patch, scope)\n      },\n\n      /**\n       * Core asks this once per batch and stops the stream cleanly when it is true. That makes\n       * it the slice's hand-back point as well as its cancellation point \u2014 the two need the\n       * same clean stop, and differ only in what happens afterwards.\n       */\n      async isCancellationRequested(progressJobId, tenantId, organizationId) {\n        if (await progressService.isCancellationRequested(progressJobId, tenantId, organizationId)) {\n          stopReason = 'cancelled'\n          return true\n        }\n        if (ctx.signal.aborted || ctx.shouldYield()) {\n          stopReason = 'budget'\n          return true\n        }\n        return false\n      },\n    },\n  }\n}\n\n/** A run that ended `failed` inside core's engine. Thrown so the durable error taxonomy and the\n *  retry budget apply to it, instead of the run being thrown away at the first blip. */\nexport class SyncRunFailedError extends Error {\n  readonly durableErrorClass = 'transient' as const\n  constructor(\n    readonly runId: string,\n    message: string,\n  ) {\n    super(message)\n    this.name = 'SyncRunFailedError'\n  }\n}\n\n/**\n * Turns what the recorder saw into the outcome the mechanism understands.\n *\n * @param runStatus the run's status after the slice, used only to tell \"already finished\" from\n *                  \"core finalized this itself\" \u2014 see the seam check below\n */\nexport function outcomeOf(recorder: SliceRecorder, runId: string, runStatus?: string): SliceOutcome {\n  const captured = recorder.captured()\n\n  if (recorder.stopReason() === 'budget') return 'budget'\n  if (recorder.stopReason() === 'cancelled') return 'cancelled'\n\n  if (!captured) {\n    // Nothing was recorded. Two very different situations look the same from here, and telling\n    // them apart is the whole point:\n    //\n    //   - the run was already terminal, or gone, before this slice started \u2014 nothing to do\n    //   - core finalized the run itself, without going through the decorated `markStatus`\n    //\n    // The second means the seam this package rests on has moved (ADR 0004), and reporting it\n    // as success would leave a job that says `completed` beside a run that says `failed`.\n    // Committed batches are what distinguishes them: a slice that did real work and then found\n    // the run terminal without recording anything did not simply arrive late.\n    if (recorder.committedBatches() > 0 && runStatus && runStatus !== 'running' && runStatus !== 'pending') {\n      throw new SeamBrokenError(runId, `the run reached \"${runStatus}\" without the adopter recording it`)\n    }\n    return 'drained'\n  }\n  if (captured.status === 'failed') throw new SyncRunFailedError(runId, captured.error ?? 'Sync run failed')\n  if (captured.status === 'cancelled') return 'cancelled'\n  return 'drained'\n}\n\n/** Maps a durable terminal state onto the run's own, inside the terminal transaction. */\nexport async function mirrorRunStatus(\n  tx: SqlExecutor,\n  runId: string,\n  status: SyncTerminalStatus,\n  errorMessage: string | null,\n): Promise<{ matched: number }> {\n  // Fenced on the run still being open, so a run finished by another path is not overwritten \u2014\n  // \"mirrored\" means the domain row agrees, and a row that already disagrees for a good reason\n  // must not be forced.\n  const result = await tx.query(\n    `update sync_runs\n        set status = $2, last_error = $3, updated_at = now()\n      where id = $1 and deleted_at is null and status in ('pending','running')`,\n    [runId, status, errorMessage],\n  )\n  return { matched: result.rowCount }\n}\n\n/** Re-opens a run when an operator re-drives its job. The mirror image of the above. */\nexport async function reopenRun(tx: SqlExecutor, runId: string): Promise<{ matched: number }> {\n  const result = await tx.query(\n    `update sync_runs\n        set status = 'running', last_error = null, updated_at = now()\n      where id = $1 and deleted_at is null and status in ('failed','pending','running')`,\n    [runId],\n  )\n  return { matched: result.rowCount }\n}\n"],
-  "mappings": "AAYA,SAAS,uBAAuB;AA4CzB,SAAS,YACd,KACA,YACA,iBACe;AACf,MAAI,WAA4B;AAChC,MAAI,aAA4C;AAChD,MAAI,YAAY;AAEhB,SAAO;AAAA,IACL,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM;AAAA,IAClB,kBAAkB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxB,YAAY;AAAA,MACV,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYH,MAAM,WAAW,OAAO,QAAQ,OAAO,OAAO;AAC5C,YAAI,WAAW,eAAe,WAAW,YAAY,WAAW,aAAa;AAC3E,qBAAW,EAAE,QAAQ,MAAM;AAC3B,iBAAO,WAAW,OAAO,OAAO,KAAK;AAAA,QACvC;AACA,eAAO,WAAW,WAAW,OAAO,QAAQ,OAAO,KAAK;AAAA,MAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA,MAAM,oBAAoB,OAAO,OAAO,QAAQ,OAAO,SAAS;AAC9D,cAAM,SAAS,MAAM,IAAI,YAAY,YAAY,WAAW,oBAAoB,OAAO,OAAO,QAAQ,OAAO,OAAO,CAAC;AACrH,qBAAa;AAIb,cAAM,IAAI,UAAU,EAAE,WAAW,KAAK,CAAC;AACvC,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,iBAAiB;AAAA,MACf,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASH,MAAM,eAAe,eAAuB,OAAgE,OAAgB;AAC1H,cAAM,IACH,UAAU,EAAE,gBAAgB,OAAO,gBAAgB,YAAY,OAAO,cAAc,KAAK,CAAC,EAC1F,MAAM,MAAM,MAAS;AACxB,cAAM,QAAQ,gBAAgB;AAG9B,eAAO,OAAO,KAAK,iBAAiB,eAAe,OAAO,KAAK;AAAA,MACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,MAAM,wBAAwB,eAAe,UAAU,gBAAgB;AACrE,YAAI,MAAM,gBAAgB,wBAAwB,eAAe,UAAU,cAAc,GAAG;AAC1F,uBAAa;AACb,iBAAO;AAAA,QACT;AACA,YAAI,IAAI,OAAO,WAAW,IAAI,YAAY,GAAG;AAC3C,uBAAa;AACb,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAIO,MAAM,2BAA2B,MAAM;AAAA,EAE5C,YACW,OACT,SACA;AACA,UAAM,OAAO;AAHJ;AAFX,SAAS,oBAAoB;AAM3B,SAAK,OAAO;AAAA,EACd;AACF;AAQO,SAAS,UAAU,UAAyB,OAAe,WAAkC;AAClG,QAAM,WAAW,SAAS,SAAS;AAEnC,MAAI,SAAS,WAAW,MAAM,SAAU,QAAO;AAC/C,MAAI,SAAS,WAAW,MAAM,YAAa,QAAO;AAElD,MAAI,CAAC,UAAU;AAWb,QAAI,SAAS,iBAAiB,IAAI,KAAK,aAAa,cAAc,aAAa,cAAc,WAAW;AACtG,YAAM,IAAI,gBAAgB,OAAO,oBAAoB,SAAS,oCAAoC;AAAA,IACpG;AACA,WAAO;AAAA,EACT;AACA,MAAI,SAAS,WAAW,SAAU,OAAM,IAAI,mBAAmB,OAAO,SAAS,SAAS,iBAAiB;AACzG,MAAI,SAAS,WAAW,YAAa,QAAO;AAC5C,SAAO;AACT;AAGA,eAAsB,gBACpB,IACA,OACA,QACA,cAC8B;AAI9B,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA;AAAA;AAAA,IAGA,CAAC,OAAO,QAAQ,YAAY;AAAA,EAC9B;AACA,SAAO,EAAE,SAAS,OAAO,SAAS;AACpC;AAGA,eAAsB,UAAU,IAAiB,OAA6C;AAC5F,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA;AAAA;AAAA,IAGA,CAAC,KAAK;AAAA,EACR;AACA,SAAO,EAAE,SAAS,OAAO,SAAS;AACpC;",
+  "sourcesContent": ["// How a `data_sync` run becomes durable work without core's engine being changed or copied.\n//\n// Core's engine already survives being displaced by another worker: it asks a cancellation\n// question at every batch boundary, and it stays silent when a terminal write is refused. A\n// durable adopter is exactly a worker in that position, so all this does is answer those two\n// questions differently \u2014 and route the cursor commit through the lease fence.\n//\n// See docs/adr/0004: the original plan was to fork the batch loop. Reading the engine showed\n// the seams were already there.\n\nimport type { SliceContext, SliceOutcome, SqlExecutor } from '@fullstackhouse/open-mercato-durable-work'\n\nimport { SeamBrokenError } from '../modules/data_sync/lib/version-guard'\n\nexport type SyncScope = { tenantId: string; organizationId: string | null; userId?: string | null }\nexport type SyncTerminalStatus = 'completed' | 'failed' | 'cancelled'\n\n/** The methods this decorator *wraps*, not the whole service: core's engine calls plenty more,\n *  and they are passed through untouched. Anything not listed here is delegated. */\nexport type SyncRunServiceLike = {\n  [method: string]: unknown\n  getRun(runId: string, scope: SyncScope): Promise<{ status: string; progressJobId?: string | null } | null>\n  markStatus(runId: string, status: string, scope: SyncScope, error?: string): Promise<unknown>\n  commitBatchProgress(\n    runId: string,\n    delta: Record<string, unknown>,\n    cursor: unknown,\n    scope: SyncScope,\n    options?: Record<string, unknown>,\n  ): Promise<unknown>\n}\n\nexport type ProgressServiceLike = {\n  [method: string]: unknown\n  isCancellationRequested(progressJobId: string, tenantId: string, organizationId: string | null): Promise<boolean>\n}\n\n/** What core's engine tried to do, captured rather than applied. */\nexport type CapturedOutcome = { status: SyncTerminalStatus; error?: string } | null\n\nexport type SliceRecorder = {\n  runService: SyncRunServiceLike\n  progressService: ProgressServiceLike\n  /** What the engine tried to finalize the run as, if anything. */\n  captured(): CapturedOutcome\n  /** Why the slice stopped early, when it did. */\n  stopReason(): 'budget' | 'cancelled' | null\n  /** Batches whose cursor this slice committed. Zero means the slice made no progress. */\n  committedBatches(): number\n}\n\n/**\n * Wraps core's two services for the duration of one slice.\n *\n * @param ctx  the slice this recorder belongs to; its lease is what fences the cursor commits\n */\nexport function recordSlice(\n  ctx: SliceContext,\n  runService: SyncRunServiceLike,\n  progressService: ProgressServiceLike,\n): SliceRecorder {\n  let captured: CapturedOutcome = null\n  let stopReason: 'budget' | 'cancelled' | null = null\n  let committed = 0\n\n  return {\n    captured: () => captured,\n    stopReason: () => stopReason,\n    committedBatches: () => committed,\n\n    // Spread, not rebuilt.\n    //\n    // Core's engine calls far more than the three methods decorated here \u2014 `startJob`,\n    // `updateProgress`, `touchJobHeartbeat`, `markCancelled` and others on the progress\n    // service, and more of the run service besides. An object carrying only the overrides\n    // looks fine to TypeScript through a structural type and then fails at the first\n    // undecorated call, mid-run.\n    runService: {\n      ...runService,\n\n      /**\n       * Records a terminal transition instead of performing it, and answers with the run\n       * unchanged.\n       *\n       * Core's `finalizeRun` compares what comes back to what it asked for, and stays silent\n       * when they differ \u2014 the branch it has for \"another worker already finalized this\". So\n       * this both captures the outcome and suppresses the progress write, the operational log\n       * and the lifecycle event. The run's terminal status is then written by `onTransition`,\n       * in the same transaction as the job's own; the three suppressed side effects are\n       * replayed by `replayFinalize` after that commit, since an event inside a transaction\n       * that can still roll back is a lie waiting to happen.\n       */\n      async markStatus(runId, status, scope, error) {\n        if (status === 'completed' || status === 'failed' || status === 'cancelled') {\n          captured = { status, error }\n          return runService.getRun(runId, scope)\n        }\n        return runService.markStatus(runId, status, scope, error)\n      },\n\n      /**\n       * Commits the batch cursor under the lease.\n       *\n       * This is the write that must not outlive the right to make it: a worker whose lease\n       * expired mid-batch would otherwise advance the cursor of a run another worker is now\n       * driving, and the two would interleave over one stream.\n       */\n      async commitBatchProgress(runId, delta, cursor, scope, options) {\n        const result = await ctx.fencedWrite(async () => runService.commitBatchProgress(runId, delta, cursor, scope, options))\n        committed += 1\n        // A committed unit of work resets the failure and orphan budgets: a run that is making\n        // progress has not earned the suspicion those counters represent, however many times\n        // it was interrupted getting there.\n        await ctx.heartbeat({ committed: true })\n        return result\n      },\n    },\n\n    progressService: {\n      ...progressService,\n\n      /**\n       * Mirrors the run's counters onto the durable job as they move.\n       *\n       * Core reports progress here after every committed batch. Without this the operator API\n       * shows a job that is plainly running with `0 of null` processed, and the one place\n       * somebody looks to see whether a multi-day backfill is advancing tells them nothing.\n       */\n      async updateProgress(progressJobId: string, patch: { processedCount?: number; totalCount?: number | null }, scope: unknown) {\n        await ctx\n          .heartbeat({ processedCount: patch?.processedCount, totalCount: patch?.totalCount ?? null })\n          .catch(() => undefined)\n        const inner = progressService.updateProgress as\n          | ((id: string, patch: unknown, scope: unknown) => Promise<unknown>)\n          | undefined\n        return inner?.call(progressService, progressJobId, patch, scope)\n      },\n\n      /**\n       * Core asks this once per batch and stops the stream cleanly when it is true. That makes\n       * it the slice's hand-back point as well as its cancellation point \u2014 the two need the\n       * same clean stop, and differ only in what happens afterwards.\n       */\n      async isCancellationRequested(progressJobId, tenantId, organizationId) {\n        if (await progressService.isCancellationRequested(progressJobId, tenantId, organizationId)) {\n          stopReason = 'cancelled'\n          return true\n        }\n        if (ctx.signal.aborted || ctx.shouldYield()) {\n          stopReason = 'budget'\n          return true\n        }\n        return false\n      },\n    },\n  }\n}\n\n/** A run that ended `failed` inside core's engine. Thrown so the durable error taxonomy and the\n *  retry budget apply to it, instead of the run being thrown away at the first blip. */\nexport class SyncRunFailedError extends Error {\n  readonly durableErrorClass = 'transient' as const\n  constructor(\n    readonly runId: string,\n    message: string,\n  ) {\n    super(message)\n    this.name = 'SyncRunFailedError'\n  }\n}\n\n/**\n * Turns what the recorder saw into the outcome the mechanism understands.\n *\n * @param runStatus the run's status after the slice, used only to tell \"already finished\" from\n *                  \"core finalized this itself\" \u2014 see the seam check below\n */\nexport function outcomeOf(recorder: SliceRecorder, runId: string, runStatus?: string): SliceOutcome {\n  const captured = recorder.captured()\n\n  if (recorder.stopReason() === 'budget') return 'budget'\n  if (recorder.stopReason() === 'cancelled') return 'cancelled'\n\n  if (!captured) {\n    // Nothing was recorded. Two very different situations look the same from here, and telling\n    // them apart is the whole point:\n    //\n    //   - the run was already terminal, or gone, before this slice started \u2014 nothing to do\n    //   - core finalized the run itself, without going through the decorated `markStatus`\n    //\n    // The second means the seam this package rests on has moved (ADR 0004), and reporting it\n    // as success would leave a job that says `completed` beside a run that says `failed`.\n    // Committed batches are what distinguishes them: a slice that did real work and then found\n    // the run terminal without recording anything did not simply arrive late.\n    if (recorder.committedBatches() > 0 && runStatus && runStatus !== 'running' && runStatus !== 'pending') {\n      throw new SeamBrokenError(runId, `the run reached \"${runStatus}\" without the adopter recording it`)\n    }\n    return 'drained'\n  }\n  if (captured.status === 'failed') throw new SyncRunFailedError(runId, captured.error ?? 'Sync run failed')\n  if (captured.status === 'cancelled') return 'cancelled'\n  return 'drained'\n}\n\n/** Maps a durable terminal state onto the run's own, inside the terminal transaction. */\nexport async function mirrorRunStatus(\n  tx: SqlExecutor,\n  runId: string,\n  status: SyncTerminalStatus,\n  errorMessage: string | null,\n): Promise<{ matched: number }> {\n  // Fenced on the run still being open, so a run finished by another path is not overwritten \u2014\n  // \"mirrored\" means the domain row agrees, and a row that already disagrees for a good reason\n  // must not be forced.\n  const result = await tx.query(\n    `update sync_runs\n        set status = $2, last_error = $3, updated_at = now()\n      where id = $1 and deleted_at is null and status in ('pending','running')`,\n    [runId, status, errorMessage],\n  )\n  return { matched: result.rowCount }\n}\n\n/** Re-opens a run when an operator re-drives its job. The mirror image of the above. */\nexport async function reopenRun(tx: SqlExecutor, runId: string): Promise<{ matched: number }> {\n  const result = await tx.query(\n    `update sync_runs\n        set status = 'running', last_error = null, updated_at = now()\n      where id = $1 and deleted_at is null and status in ('failed','pending','running')`,\n    [runId],\n  )\n  return { matched: result.rowCount }\n}\n\n/**\n * The services core's `finalizeRun` reaches for once the status is written.\n *\n * Named separately from the slice's dependencies because these are needed at a different\n * moment: the slice runs under a lease, this runs after the job's terminal transition has\n * committed, on whatever worker got there.\n */\nexport type FinalizeDeps = {\n  progressService: ProgressServiceLike\n  integrationLogService: { write(entry: Record<string, unknown>, scope: SyncScope): Promise<unknown> }\n  integrationStateService?: {\n    upsert(integrationId: string, patch: Record<string, unknown>, scope: SyncScope): Promise<unknown>\n  } | null\n  /** `adapter.operationalTelemetry === true`, which is core's own gate on the two writes below. */\n  operationalTelemetry(integrationId: string): boolean\n  emitEvent(name: string, payload: Record<string, unknown>): Promise<void>\n}\n\n/** The run fields core's tail reads. */\nexport type FinalizedRun = {\n  id: string\n  integrationId: string\n  entityType: string\n  direction: string\n  progressJobId?: string | null\n  createdCount?: number\n  updatedCount?: number\n  skippedCount?: number\n  failedCount?: number\n  batchesCompleted?: number\n}\n\n/**\n * Everything core's `finalizeRun` does after the status write, done here instead.\n *\n * Core stops at its \"another worker already finalized this\" branch on every durable run \u2014 that\n * is deliberate, and it is what lets the durable transition own the terminal state (see\n * `markStatus` above). But stopping there also skips the three things that came after it: the\n * progress job is never resolved, the operational log never written, and the lifecycle event\n * never emitted. Left unreplayed, a host loses the progress indicator an operator watches, the\n * integration health state, and `data_sync.run.completed` \u2014 which is dispatched to tenant\n * webhooks, so its absence is visible outside the app entirely.\n *\n * This runs after the commit, not inside it: events and enqueues must not sit in a transaction\n * that can still roll back, and the mechanism gives after-commit hooks at-most-once semantics\n * for exactly this. A throw here is logged and dropped rather than retried \u2014 the same standing\n * core's own tail has, where a failed webhook has never un-completed a run.\n */\nexport async function replayFinalize(\n  deps: FinalizeDeps,\n  run: FinalizedRun,\n  status: SyncTerminalStatus,\n  errorMessage: string | null,\n  scope: SyncScope,\n  userId: string | null,\n): Promise<void> {\n  const progressScope = { tenantId: scope.tenantId, organizationId: scope.organizationId, userId: userId ?? undefined }\n  const enabled = deps.operationalTelemetry(run.integrationId)\n\n  if (run.progressJobId) {\n    const progress = deps.progressService as unknown as Record<string, ((...args: unknown[]) => Promise<unknown>) | undefined>\n    if (status === 'completed') {\n      await progress.completeJob?.(\n        run.progressJobId,\n        {\n          resultSummary: {\n            createdCount: run.createdCount,\n            updatedCount: run.updatedCount,\n            skippedCount: run.skippedCount,\n            failedCount: run.failedCount,\n            batchesCompleted: run.batchesCompleted,\n          },\n        },\n        progressScope,\n      )\n    } else if (status === 'failed') {\n      await progress.failJob?.(run.progressJobId, { errorMessage: errorMessage ?? 'Sync run failed' }, progressScope)\n    } else {\n      await progress.markCancelled?.(run.progressJobId, progressScope)\n    }\n  }\n\n  const health = status === 'completed' ? 'healthy' : status === 'cancelled' ? 'degraded' : 'unhealthy'\n  if (enabled && deps.integrationStateService) {\n    await deps.integrationStateService.upsert(\n      run.integrationId,\n      { lastHealthStatus: health, lastHealthCheckedAt: new Date() },\n      scope,\n    )\n  }\n\n  if (enabled) {\n    const log =\n      status === 'completed'\n        ? {\n            level: 'info',\n            message: 'Sync run completed',\n            payload: {\n              operationalStatus: 'completed',\n              summary: `Sync completed with ${run.createdCount ?? 0} created, ${run.updatedCount ?? 0} updated, ${run.failedCount ?? 0} failed.`,\n              createdCount: run.createdCount,\n              updatedCount: run.updatedCount,\n              skippedCount: run.skippedCount,\n              failedCount: run.failedCount,\n              batchesCompleted: run.batchesCompleted,\n            },\n          }\n        : status === 'cancelled'\n          ? {\n              level: 'warn',\n              message: 'Sync run cancelled',\n              payload: { operationalStatus: 'cancelled', summary: 'The sync run was cancelled before completion.' },\n            }\n          : {\n              level: 'error',\n              message: errorMessage ?? 'Sync run failed',\n              payload: { operationalStatus: 'failed', summary: errorMessage ?? 'The sync run failed.' },\n            }\n\n    await deps.integrationLogService.write({ integrationId: run.integrationId, runId: run.id, ...log }, scope)\n  }\n\n  await deps.emitEvent(`data_sync.run.${status}`, {\n    runId: run.id,\n    integrationId: run.integrationId,\n    entityType: run.entityType,\n    direction: run.direction,\n    // Only the failure event carries this, and a subscriber that switches on it would see\n    // every durable failure as an unexplained one if it were dropped.\n    ...(status === 'failed' ? { error: errorMessage ?? null } : {}),\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n}\n"],
+  "mappings": "AAYA,SAAS,uBAAuB;AA4CzB,SAAS,YACd,KACA,YACA,iBACe;AACf,MAAI,WAA4B;AAChC,MAAI,aAA4C;AAChD,MAAI,YAAY;AAEhB,SAAO;AAAA,IACL,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM;AAAA,IAClB,kBAAkB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASxB,YAAY;AAAA,MACV,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAcH,MAAM,WAAW,OAAO,QAAQ,OAAO,OAAO;AAC5C,YAAI,WAAW,eAAe,WAAW,YAAY,WAAW,aAAa;AAC3E,qBAAW,EAAE,QAAQ,MAAM;AAC3B,iBAAO,WAAW,OAAO,OAAO,KAAK;AAAA,QACvC;AACA,eAAO,WAAW,WAAW,OAAO,QAAQ,OAAO,KAAK;AAAA,MAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA,MAAM,oBAAoB,OAAO,OAAO,QAAQ,OAAO,SAAS;AAC9D,cAAM,SAAS,MAAM,IAAI,YAAY,YAAY,WAAW,oBAAoB,OAAO,OAAO,QAAQ,OAAO,OAAO,CAAC;AACrH,qBAAa;AAIb,cAAM,IAAI,UAAU,EAAE,WAAW,KAAK,CAAC;AACvC,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,iBAAiB;AAAA,MACf,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASH,MAAM,eAAe,eAAuB,OAAgE,OAAgB;AAC1H,cAAM,IACH,UAAU,EAAE,gBAAgB,OAAO,gBAAgB,YAAY,OAAO,cAAc,KAAK,CAAC,EAC1F,MAAM,MAAM,MAAS;AACxB,cAAM,QAAQ,gBAAgB;AAG9B,eAAO,OAAO,KAAK,iBAAiB,eAAe,OAAO,KAAK;AAAA,MACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,MAAM,wBAAwB,eAAe,UAAU,gBAAgB;AACrE,YAAI,MAAM,gBAAgB,wBAAwB,eAAe,UAAU,cAAc,GAAG;AAC1F,uBAAa;AACb,iBAAO;AAAA,QACT;AACA,YAAI,IAAI,OAAO,WAAW,IAAI,YAAY,GAAG;AAC3C,uBAAa;AACb,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAIO,MAAM,2BAA2B,MAAM;AAAA,EAE5C,YACW,OACT,SACA;AACA,UAAM,OAAO;AAHJ;AAFX,SAAS,oBAAoB;AAM3B,SAAK,OAAO;AAAA,EACd;AACF;AAQO,SAAS,UAAU,UAAyB,OAAe,WAAkC;AAClG,QAAM,WAAW,SAAS,SAAS;AAEnC,MAAI,SAAS,WAAW,MAAM,SAAU,QAAO;AAC/C,MAAI,SAAS,WAAW,MAAM,YAAa,QAAO;AAElD,MAAI,CAAC,UAAU;AAWb,QAAI,SAAS,iBAAiB,IAAI,KAAK,aAAa,cAAc,aAAa,cAAc,WAAW;AACtG,YAAM,IAAI,gBAAgB,OAAO,oBAAoB,SAAS,oCAAoC;AAAA,IACpG;AACA,WAAO;AAAA,EACT;AACA,MAAI,SAAS,WAAW,SAAU,OAAM,IAAI,mBAAmB,OAAO,SAAS,SAAS,iBAAiB;AACzG,MAAI,SAAS,WAAW,YAAa,QAAO;AAC5C,SAAO;AACT;AAGA,eAAsB,gBACpB,IACA,OACA,QACA,cAC8B;AAI9B,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA;AAAA;AAAA,IAGA,CAAC,OAAO,QAAQ,YAAY;AAAA,EAC9B;AACA,SAAO,EAAE,SAAS,OAAO,SAAS;AACpC;AAGA,eAAsB,UAAU,IAAiB,OAA6C;AAC5F,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA;AAAA;AAAA,IAGA,CAAC,KAAK;AAAA,EACR;AACA,SAAO,EAAE,SAAS,OAAO,SAAS;AACpC;AAkDA,eAAsB,eACpB,MACA,KACA,QACA,cACA,OACA,QACe;AACf,QAAM,gBAAgB,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,QAAQ,UAAU,OAAU;AACpH,QAAM,UAAU,KAAK,qBAAqB,IAAI,aAAa;AAE3D,MAAI,IAAI,eAAe;AACrB,UAAM,WAAW,KAAK;AACtB,QAAI,WAAW,aAAa;AAC1B,YAAM,SAAS;AAAA,QACb,IAAI;AAAA,QACJ;AAAA,UACE,eAAe;AAAA,YACb,cAAc,IAAI;AAAA,YAClB,cAAc,IAAI;AAAA,YAClB,cAAc,IAAI;AAAA,YAClB,aAAa,IAAI;AAAA,YACjB,kBAAkB,IAAI;AAAA,UACxB;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,IACF,WAAW,WAAW,UAAU;AAC9B,YAAM,SAAS,UAAU,IAAI,eAAe,EAAE,cAAc,gBAAgB,kBAAkB,GAAG,aAAa;AAAA,IAChH,OAAO;AACL,YAAM,SAAS,gBAAgB,IAAI,eAAe,aAAa;AAAA,IACjE;AAAA,EACF;AAEA,QAAM,SAAS,WAAW,cAAc,YAAY,WAAW,cAAc,aAAa;AAC1F,MAAI,WAAW,KAAK,yBAAyB;AAC3C,UAAM,KAAK,wBAAwB;AAAA,MACjC,IAAI;AAAA,MACJ,EAAE,kBAAkB,QAAQ,qBAAqB,oBAAI,KAAK,EAAE;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS;AACX,UAAM,MACJ,WAAW,cACP;AAAA,MACE,OAAO;AAAA,MACP,SAAS;AAAA,MACT,SAAS;AAAA,QACP,mBAAmB;AAAA,QACnB,SAAS,uBAAuB,IAAI,gBAAgB,CAAC,aAAa,IAAI,gBAAgB,CAAC,aAAa,IAAI,eAAe,CAAC;AAAA,QACxH,cAAc,IAAI;AAAA,QAClB,cAAc,IAAI;AAAA,QAClB,cAAc,IAAI;AAAA,QAClB,aAAa,IAAI;AAAA,QACjB,kBAAkB,IAAI;AAAA,MACxB;AAAA,IACF,IACA,WAAW,cACT;AAAA,MACE,OAAO;AAAA,MACP,SAAS;AAAA,MACT,SAAS,EAAE,mBAAmB,aAAa,SAAS,gDAAgD;AAAA,IACtG,IACA;AAAA,MACE,OAAO;AAAA,MACP,SAAS,gBAAgB;AAAA,MACzB,SAAS,EAAE,mBAAmB,UAAU,SAAS,gBAAgB,uBAAuB;AAAA,IAC1F;AAER,UAAM,KAAK,sBAAsB,MAAM,EAAE,eAAe,IAAI,eAAe,OAAO,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;AAAA,EAC3G;AAEA,QAAM,KAAK,UAAU,iBAAiB,MAAM,IAAI;AAAA,IAC9C,OAAO,IAAI;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA;AAAA;AAAA,IAGf,GAAI,WAAW,WAAW,EAAE,OAAO,gBAAgB,KAAK,IAAI,CAAC;AAAA,IAC7D,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACH;",
   "names": []
 }

package/dist/kinds/data-sync-run.js

@@ -2,7 +2,8 @@ import {
   mirrorRunStatus,
   outcomeOf,
   recordSlice,
-  reopenRun
+  reopenRun,
+  replayFinalize
 } from "../engine/durable-run.js";
 const IMPORT_KIND = "data_sync.import";
 const EXPORT_KIND = "data_sync.export";
@@ -33,6 +34,26 @@ function dataSyncKinds(deps) {
     },
     async onRedrive(job, _scope, tx) {
       return reopenRun(tx, job.input.runId);
+    },
+    /**
+     * The rest of core's `finalizeRun`, which core itself skips on every durable run.
+     *
+     * Without this a host is told the run is over by the `sync_runs` row alone: the progress
+     * job an operator watches never resolves, the integration's health state never moves, and
+     * `data_sync.run.completed` — a tenant webhook — is never dispatched. The decoration that
+     * makes a run durable is supposed to be invisible to a host, and those three are exactly
+     * how a host would notice.
+     *
+     * At-most-once and best-effort by the mechanism's contract, which is the same standing
+     * these have in core: a webhook that fails there has never un-completed a run either.
+     */
+    async onAfterTransition(job, scope) {
+      const { runId } = job.input;
+      const status = job.status === "completed" ? "completed" : job.status === "cancelled" ? "cancelled" : "failed";
+      const { runService, finalize } = await deps.resolve();
+      const run = await runService.getRun(runId, scope);
+      if (!run) return;
+      await replayFinalize(finalize, run, status, job.errorMessage, scope, job.createdBy);
     }
   };
   return [

package/dist/kinds/data-sync-run.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/kinds/data-sync-run.ts"],
-  "sourcesContent": ["// The job kinds a `data_sync` run becomes.\n//\n// A slice is one call into core's own engine, with the run service and the progress service\n// decorated for its duration. The engine does all the work it always did; what changes is where\n// its cursor commits go (through the lease fence), when it stops (at a batch boundary when the\n// slice budget is spent), and who writes the terminal state (the durable transition, in the\n// same transaction as the job's own).\n\nimport type { KindDefinition, SliceContext, SliceOutcome, SqlExecutor } from '@fullstackhouse/open-mercato-durable-work'\n\nimport {\n  mirrorRunStatus,\n  outcomeOf,\n  recordSlice,\n  reopenRun,\n  type ProgressServiceLike,\n  type SyncRunServiceLike,\n  type SyncScope,\n} from '../engine/durable-run'\n\nexport const IMPORT_KIND = 'data_sync.import'\nexport const EXPORT_KIND = 'data_sync.export'\nexport const DATA_SYNC_QUEUE = 'durable-work.data-sync'\n\nexport type SyncRunInput = {\n  runId: string\n  batchSize: number\n  direction: 'import' | 'export'\n}\n\n/** What a slice needs from the host, resolved per slice from the container. */\nexport type SyncEngineLike = {\n  runImport(runId: string, batchSize: number, scope: SyncScope): Promise<void>\n  runExport(runId: string, batchSize: number, scope: SyncScope): Promise<void>\n}\n\nexport type DataSyncKindDeps = {\n  /** Resolved per slice, because each slice runs on its own EntityManager. */\n  resolve(): Promise<{\n    engine: (services: { runService: SyncRunServiceLike; progressService: ProgressServiceLike }) => SyncEngineLike\n    runService: SyncRunServiceLike\n    progressService: ProgressServiceLike\n  }>\n}\n\nasync function runSlice(ctx: SliceContext<SyncRunInput>, deps: DataSyncKindDeps): Promise<SliceOutcome> {\n  const input = ctx.job.input as SyncRunInput\n  const scope: SyncScope = { tenantId: ctx.scope.tenantId, organizationId: ctx.scope.organizationId }\n  const { engine, runService, progressService } = await deps.resolve()\n\n  const recorder = recordSlice(ctx, runService, progressService)\n  const decorated = engine({ runService: recorder.runService, progressService: recorder.progressService })\n\n  if (input.direction === 'export') await decorated.runExport(input.runId, input.batchSize, scope)\n  else await decorated.runImport(input.runId, input.batchSize, scope)\n\n  const after = await runService.getRun(input.runId, scope)\n  return outcomeOf(recorder, input.runId, after?.status)\n}\n\n/**\n * Builds both kinds.\n *\n * `orphanPolicy: 'redrive'` is deliberate and is the one place the adopter asserts something\n * about the work rather than the mechanism: a sync run keeps a committed cursor, so re-running\n * it after a worker died resumes rather than repeats. That is what makes automatic recovery\n * safe here when the mechanism's default is to park and wait for a human.\n */\nexport function dataSyncKinds(deps: DataSyncKindDeps): KindDefinition<SyncRunInput, never>[] {\n  const shared = {\n    queue: DATA_SYNC_QUEUE,\n    requiredFeatures: ['data_sync.run'],\n    orphanPolicy: 'redrive' as const,\n    // Long enough that a slow adapter page does not look like a dead worker, short enough that\n    // a dead worker is noticed in about a minute.\n    lease: { ttlMs: 60_000, sliceBudgetMs: 300_000, pendingTtlMs: 900_000 },\n\n    async onTransition(job: { id: string; input: unknown; status: string; errorMessage: string | null }, _scope: unknown, tx: SqlExecutor) {\n      const { runId } = job.input as SyncRunInput\n      const status = job.status === 'completed' ? 'completed' : job.status === 'cancelled' ? 'cancelled' : 'failed'\n      return mirrorRunStatus(tx, runId, status, job.errorMessage)\n    },\n\n    async onRedrive(job: { input: unknown }, _scope: unknown, tx: SqlExecutor) {\n      return reopenRun(tx, (job.input as SyncRunInput).runId)\n    },\n  }\n\n  return [\n    { ...shared, kind: IMPORT_KIND, step: (ctx) => runSlice(ctx, deps) } as KindDefinition<SyncRunInput, never>,\n    { ...shared, kind: EXPORT_KIND, step: (ctx) => runSlice(ctx, deps) } as KindDefinition<SyncRunInput, never>,\n  ]\n}\n\n/** The single-runner key: one live run per integration, entity and direction. Two imports of\n *  the same entity would interleave over one cursor. */\nexport function syncLockKey(integrationId: string, entityType: string, direction: string): string {\n  return `data_sync:${integrationId}:${entityType}:${direction}`\n}\n\n/** Makes starting a run twice for the same run id return the first job rather than a second. */\nexport function syncIdempotencyKey(runId: string): string {\n  return `data_sync.run:${runId}`\n}\n"],
-  "mappings": "AAUA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAEA,MAAM,cAAc;AACpB,MAAM,cAAc;AACpB,MAAM,kBAAkB;AAuB/B,eAAe,SAAS,KAAiC,MAA+C;AACtG,QAAM,QAAQ,IAAI,IAAI;AACtB,QAAM,QAAmB,EAAE,UAAU,IAAI,MAAM,UAAU,gBAAgB,IAAI,MAAM,eAAe;AAClG,QAAM,EAAE,QAAQ,YAAY,gBAAgB,IAAI,MAAM,KAAK,QAAQ;AAEnE,QAAM,WAAW,YAAY,KAAK,YAAY,eAAe;AAC7D,QAAM,YAAY,OAAO,EAAE,YAAY,SAAS,YAAY,iBAAiB,SAAS,gBAAgB,CAAC;AAEvG,MAAI,MAAM,cAAc,SAAU,OAAM,UAAU,UAAU,MAAM,OAAO,MAAM,WAAW,KAAK;AAAA,MAC1F,OAAM,UAAU,UAAU,MAAM,OAAO,MAAM,WAAW,KAAK;AAElE,QAAM,QAAQ,MAAM,WAAW,OAAO,MAAM,OAAO,KAAK;AACxD,SAAO,UAAU,UAAU,MAAM,OAAO,OAAO,MAAM;AACvD;AAUO,SAAS,cAAc,MAA+D;AAC3F,QAAM,SAAS;AAAA,IACb,OAAO;AAAA,IACP,kBAAkB,CAAC,eAAe;AAAA,IAClC,cAAc;AAAA;AAAA;AAAA,IAGd,OAAO,EAAE,OAAO,KAAQ,eAAe,KAAS,cAAc,IAAQ;AAAA,IAEtE,MAAM,aAAa,KAAkF,QAAiB,IAAiB;AACrI,YAAM,EAAE,MAAM,IAAI,IAAI;AACtB,YAAM,SAAS,IAAI,WAAW,cAAc,cAAc,IAAI,WAAW,cAAc,cAAc;AACrG,aAAO,gBAAgB,IAAI,OAAO,QAAQ,IAAI,YAAY;AAAA,IAC5D;AAAA,IAEA,MAAM,UAAU,KAAyB,QAAiB,IAAiB;AACzE,aAAO,UAAU,IAAK,IAAI,MAAuB,KAAK;AAAA,IACxD;AAAA,EACF;AAEA,SAAO;AAAA,IACL,EAAE,GAAG,QAAQ,MAAM,aAAa,MAAM,CAAC,QAAQ,SAAS,KAAK,IAAI,EAAE;AAAA,IACnE,EAAE,GAAG,QAAQ,MAAM,aAAa,MAAM,CAAC,QAAQ,SAAS,KAAK,IAAI,EAAE;AAAA,EACrE;AACF;AAIO,SAAS,YAAY,eAAuB,YAAoB,WAA2B;AAChG,SAAO,aAAa,aAAa,IAAI,UAAU,IAAI,SAAS;AAC9D;AAGO,SAAS,mBAAmB,OAAuB;AACxD,SAAO,iBAAiB,KAAK;AAC/B;",
+  "sourcesContent": ["// The job kinds a `data_sync` run becomes.\n//\n// A slice is one call into core's own engine, with the run service and the progress service\n// decorated for its duration. The engine does all the work it always did; what changes is where\n// its cursor commits go (through the lease fence), when it stops (at a batch boundary when the\n// slice budget is spent), and who writes the terminal state (the durable transition, in the\n// same transaction as the job's own).\n\nimport type { KindDefinition, SliceContext, SliceOutcome, SqlExecutor } from '@fullstackhouse/open-mercato-durable-work'\n\nimport {\n  mirrorRunStatus,\n  outcomeOf,\n  recordSlice,\n  reopenRun,\n  replayFinalize,\n  type FinalizeDeps,\n  type ProgressServiceLike,\n  type SyncRunServiceLike,\n  type SyncScope,\n} from '../engine/durable-run'\n\nexport const IMPORT_KIND = 'data_sync.import'\nexport const EXPORT_KIND = 'data_sync.export'\nexport const DATA_SYNC_QUEUE = 'durable-work.data-sync'\n\nexport type SyncRunInput = {\n  runId: string\n  batchSize: number\n  direction: 'import' | 'export'\n}\n\n/** What a slice needs from the host, resolved per slice from the container. */\nexport type SyncEngineLike = {\n  runImport(runId: string, batchSize: number, scope: SyncScope): Promise<void>\n  runExport(runId: string, batchSize: number, scope: SyncScope): Promise<void>\n}\n\nexport type DataSyncKindDeps = {\n  /** Resolved per slice, because each slice runs on its own EntityManager. */\n  resolve(): Promise<{\n    engine: (services: { runService: SyncRunServiceLike; progressService: ProgressServiceLike }) => SyncEngineLike\n    runService: SyncRunServiceLike\n    progressService: ProgressServiceLike\n    /** What core's `finalizeRun` would have done after the status write. */\n    finalize: FinalizeDeps\n  }>\n}\n\nasync function runSlice(ctx: SliceContext<SyncRunInput>, deps: DataSyncKindDeps): Promise<SliceOutcome> {\n  const input = ctx.job.input as SyncRunInput\n  const scope: SyncScope = { tenantId: ctx.scope.tenantId, organizationId: ctx.scope.organizationId }\n  const { engine, runService, progressService } = await deps.resolve()\n\n  const recorder = recordSlice(ctx, runService, progressService)\n  const decorated = engine({ runService: recorder.runService, progressService: recorder.progressService })\n\n  if (input.direction === 'export') await decorated.runExport(input.runId, input.batchSize, scope)\n  else await decorated.runImport(input.runId, input.batchSize, scope)\n\n  const after = await runService.getRun(input.runId, scope)\n  return outcomeOf(recorder, input.runId, after?.status)\n}\n\n/**\n * Builds both kinds.\n *\n * `orphanPolicy: 'redrive'` is deliberate and is the one place the adopter asserts something\n * about the work rather than the mechanism: a sync run keeps a committed cursor, so re-running\n * it after a worker died resumes rather than repeats. That is what makes automatic recovery\n * safe here when the mechanism's default is to park and wait for a human.\n */\nexport function dataSyncKinds(deps: DataSyncKindDeps): KindDefinition<SyncRunInput, never>[] {\n  const shared = {\n    queue: DATA_SYNC_QUEUE,\n    requiredFeatures: ['data_sync.run'],\n    orphanPolicy: 'redrive' as const,\n    // Long enough that a slow adapter page does not look like a dead worker, short enough that\n    // a dead worker is noticed in about a minute.\n    lease: { ttlMs: 60_000, sliceBudgetMs: 300_000, pendingTtlMs: 900_000 },\n\n    async onTransition(job: { id: string; input: unknown; status: string; errorMessage: string | null }, _scope: unknown, tx: SqlExecutor) {\n      const { runId } = job.input as SyncRunInput\n      const status = job.status === 'completed' ? 'completed' : job.status === 'cancelled' ? 'cancelled' : 'failed'\n      return mirrorRunStatus(tx, runId, status, job.errorMessage)\n    },\n\n    async onRedrive(job: { input: unknown }, _scope: unknown, tx: SqlExecutor) {\n      return reopenRun(tx, (job.input as SyncRunInput).runId)\n    },\n\n    /**\n     * The rest of core's `finalizeRun`, which core itself skips on every durable run.\n     *\n     * Without this a host is told the run is over by the `sync_runs` row alone: the progress\n     * job an operator watches never resolves, the integration's health state never moves, and\n     * `data_sync.run.completed` \u2014 a tenant webhook \u2014 is never dispatched. The decoration that\n     * makes a run durable is supposed to be invisible to a host, and those three are exactly\n     * how a host would notice.\n     *\n     * At-most-once and best-effort by the mechanism's contract, which is the same standing\n     * these have in core: a webhook that fails there has never un-completed a run either.\n     */\n    async onAfterTransition(job: { id: string; input: unknown; status: string; errorMessage: string | null; createdBy: string | null }, scope: { tenantId: string; organizationId: string | null }) {\n      const { runId } = job.input as SyncRunInput\n      const status = job.status === 'completed' ? 'completed' : job.status === 'cancelled' ? 'cancelled' : 'failed'\n      const { runService, finalize } = await deps.resolve()\n\n      const run = (await runService.getRun(runId, scope)) as\n        | (Parameters<typeof replayFinalize>[1] & Record<string, unknown>)\n        | null\n      // A run that has been hard-deleted since the job finished is not an error to report:\n      // there is nothing left to resolve, and the job's own terminal state is already correct.\n      if (!run) return\n\n      await replayFinalize(finalize, run, status, job.errorMessage, scope, job.createdBy)\n    },\n  }\n\n  return [\n    { ...shared, kind: IMPORT_KIND, step: (ctx) => runSlice(ctx, deps) } as KindDefinition<SyncRunInput, never>,\n    { ...shared, kind: EXPORT_KIND, step: (ctx) => runSlice(ctx, deps) } as KindDefinition<SyncRunInput, never>,\n  ]\n}\n\n/** The single-runner key: one live run per integration, entity and direction. Two imports of\n *  the same entity would interleave over one cursor. */\nexport function syncLockKey(integrationId: string, entityType: string, direction: string): string {\n  return `data_sync:${integrationId}:${entityType}:${direction}`\n}\n\n/** Makes starting a run twice for the same run id return the first job rather than a second. */\nexport function syncIdempotencyKey(runId: string): string {\n  return `data_sync.run:${runId}`\n}\n"],
+  "mappings": "AAUA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AAEA,MAAM,cAAc;AACpB,MAAM,cAAc;AACpB,MAAM,kBAAkB;AAyB/B,eAAe,SAAS,KAAiC,MAA+C;AACtG,QAAM,QAAQ,IAAI,IAAI;AACtB,QAAM,QAAmB,EAAE,UAAU,IAAI,MAAM,UAAU,gBAAgB,IAAI,MAAM,eAAe;AAClG,QAAM,EAAE,QAAQ,YAAY,gBAAgB,IAAI,MAAM,KAAK,QAAQ;AAEnE,QAAM,WAAW,YAAY,KAAK,YAAY,eAAe;AAC7D,QAAM,YAAY,OAAO,EAAE,YAAY,SAAS,YAAY,iBAAiB,SAAS,gBAAgB,CAAC;AAEvG,MAAI,MAAM,cAAc,SAAU,OAAM,UAAU,UAAU,MAAM,OAAO,MAAM,WAAW,KAAK;AAAA,MAC1F,OAAM,UAAU,UAAU,MAAM,OAAO,MAAM,WAAW,KAAK;AAElE,QAAM,QAAQ,MAAM,WAAW,OAAO,MAAM,OAAO,KAAK;AACxD,SAAO,UAAU,UAAU,MAAM,OAAO,OAAO,MAAM;AACvD;AAUO,SAAS,cAAc,MAA+D;AAC3F,QAAM,SAAS;AAAA,IACb,OAAO;AAAA,IACP,kBAAkB,CAAC,eAAe;AAAA,IAClC,cAAc;AAAA;AAAA;AAAA,IAGd,OAAO,EAAE,OAAO,KAAQ,eAAe,KAAS,cAAc,IAAQ;AAAA,IAEtE,MAAM,aAAa,KAAkF,QAAiB,IAAiB;AACrI,YAAM,EAAE,MAAM,IAAI,IAAI;AACtB,YAAM,SAAS,IAAI,WAAW,cAAc,cAAc,IAAI,WAAW,cAAc,cAAc;AACrG,aAAO,gBAAgB,IAAI,OAAO,QAAQ,IAAI,YAAY;AAAA,IAC5D;AAAA,IAEA,MAAM,UAAU,KAAyB,QAAiB,IAAiB;AACzE,aAAO,UAAU,IAAK,IAAI,MAAuB,KAAK;AAAA,IACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAcA,MAAM,kBAAkB,KAA4G,OAA4D;AAC9L,YAAM,EAAE,MAAM,IAAI,IAAI;AACtB,YAAM,SAAS,IAAI,WAAW,cAAc,cAAc,IAAI,WAAW,cAAc,cAAc;AACrG,YAAM,EAAE,YAAY,SAAS,IAAI,MAAM,KAAK,QAAQ;AAEpD,YAAM,MAAO,MAAM,WAAW,OAAO,OAAO,KAAK;AAKjD,UAAI,CAAC,IAAK;AAEV,YAAM,eAAe,UAAU,KAAK,QAAQ,IAAI,cAAc,OAAO,IAAI,SAAS;AAAA,IACpF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,EAAE,GAAG,QAAQ,MAAM,aAAa,MAAM,CAAC,QAAQ,SAAS,KAAK,IAAI,EAAE;AAAA,IACnE,EAAE,GAAG,QAAQ,MAAM,aAAa,MAAM,CAAC,QAAQ,SAAS,KAAK,IAAI,EAAE;AAAA,EACrE;AACF;AAIO,SAAS,YAAY,eAAuB,YAAoB,WAA2B;AAChG,SAAO,aAAa,aAAa,IAAI,UAAU,IAAI,SAAS;AAC9D;AAGO,SAAS,mBAAmB,OAAuB;AACxD,SAAO,iBAAiB,KAAK;AAC/B;",
   "names": []
 }

package/dist/modules/data_sync/di.js

@@ -1,5 +1,7 @@
 import { register as registerCore } from "@open-mercato/core/modules/data_sync/di";
 import { createSyncEngine } from "@open-mercato/core/modules/data_sync/lib/sync-engine";
+import { getDataSyncAdapter, resolveProviderKey } from "@open-mercato/core/modules/data_sync/lib/adapter-registry";
+import { emitDataSyncEvent } from "@open-mercato/core/modules/data_sync/events";
 import { registry } from "@fullstackhouse/open-mercato-durable-work";
 import { dataSyncKinds } from "../../kinds/data-sync-run.js";
 const KINDS = dataSyncKinds({
@@ -7,16 +9,28 @@ const KINDS = dataSyncKinds({
     const { createRequestContainer } = await import("@open-mercato/shared/lib/di/container");
     const container = await createRequestContainer();
     const em = container.resolve("em");
+    const progressService = container.resolve("progressService");
+    const integrationLogService = container.resolve("integrationLogService");
+    const integrationStateService = container.resolve("integrationStateService");
     return {
       runService: container.resolve("dataSyncRunService"),
-      progressService: container.resolve("progressService"),
-      engine: ({ runService, progressService }) => createSyncEngine({
+      progressService,
+      // Resolved from core's own registry and core's own event bus, so the replayed tail is
+      // core's behaviour rather than a second opinion about what it should have been.
+      finalize: {
+        progressService,
+        integrationLogService,
+        integrationStateService,
+        operationalTelemetry: (integrationId) => getDataSyncAdapter(resolveProviderKey(integrationId))?.operationalTelemetry === true,
+        emitEvent: (name, payload) => emitDataSyncEvent(name, payload)
+      },
+      engine: ({ runService, progressService: progressService2 }) => createSyncEngine({
         em,
         syncRunService: runService,
         integrationCredentialsService: container.resolve("integrationCredentialsService"),
-        integrationLogService: container.resolve("integrationLogService"),
-        integrationStateService: container.resolve("integrationStateService"),
-        progressService
+        integrationLogService,
+        integrationStateService,
+        progressService: progressService2
       })
     };
   }

package/dist/modules/data_sync/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/data_sync/di.ts"],
-  "sourcesContent": ["// Core's DI, plus the two job kinds a run becomes.\n//\n// Core's registrations are reused as they are \u2014 the engine, the run service, the mapping and\n// schedule services are all core's, unchanged. The decoration that makes a run durable happens\n// per slice, inside the kind, not here (see docs/adr/0004): a container-level decoration would\n// apply to every caller of the engine, including ones not running under a lease.\n\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { register as registerCore } from '@open-mercato/core/modules/data_sync/di'\nimport { createSyncEngine } from '@open-mercato/core/modules/data_sync/lib/sync-engine'\nimport { registry } from '@fullstackhouse/open-mercato-durable-work'\n\nimport { dataSyncKinds } from '../../kinds/data-sync-run'\n\n/**\n * Built once, at module scope, not once per container.\n *\n * `register` runs on every container build \u2014 which in a web process means every request \u2014 and\n * the registry refuses two different handlers under one kind id, because silently accepting\n * the second would make \"which code is running this job?\" depend on request ordering. Kinds\n * created per call would be a different handler every time, so the second request would throw.\n *\n * Each slice resolves its own container instead, which it needs anyway: slices run in the\n * worker process, outside any request, and each needs its own EntityManager rather than one\n * captured from whichever request happened to build the registry first.\n */\nconst KINDS = dataSyncKinds({\n  resolve: async () => {\n    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n    const container = await createRequestContainer()\n    const em = container.resolve<EntityManager>('em')\n    return {\n      runService: container.resolve('dataSyncRunService'),\n      progressService: container.resolve('progressService'),\n      engine: ({ runService, progressService }) =>\n        createSyncEngine({\n          em,\n          syncRunService: runService as never,\n          integrationCredentialsService: container.resolve('integrationCredentialsService'),\n          integrationLogService: container.resolve('integrationLogService'),\n          integrationStateService: container.resolve('integrationStateService'),\n          progressService: progressService as never,\n        }),\n    }\n  },\n})\n\nexport function register(container: AppContainer) {\n  registerCore(container)\n  // Idempotent: the same handler objects every time, so re-registering is a no-op. The web\n  // process needs them to re-drive and cancel, the worker to run slices, and the reconciler to\n  // know whether a job has a handler at all.\n  for (const kind of KINDS) registry.register(kind)\n}\n\nexport default register\n"],
-  "mappings": "AASA,SAAS,YAAY,oBAAoB;AACzC,SAAS,wBAAwB;AACjC,SAAS,gBAAgB;AAEzB,SAAS,qBAAqB;AAc9B,MAAM,QAAQ,cAAc;AAAA,EAC1B,SAAS,YAAY;AACnB,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,WAAO;AAAA,MACL,YAAY,UAAU,QAAQ,oBAAoB;AAAA,MAClD,iBAAiB,UAAU,QAAQ,iBAAiB;AAAA,MACpD,QAAQ,CAAC,EAAE,YAAY,gBAAgB,MACrC,iBAAiB;AAAA,QACf;AAAA,QACA,gBAAgB;AAAA,QAChB,+BAA+B,UAAU,QAAQ,+BAA+B;AAAA,QAChF,uBAAuB,UAAU,QAAQ,uBAAuB;AAAA,QAChE,yBAAyB,UAAU,QAAQ,yBAAyB;AAAA,QACpE;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF;AACF,CAAC;AAEM,SAAS,SAAS,WAAyB;AAChD,eAAa,SAAS;AAItB,aAAW,QAAQ,MAAO,UAAS,SAAS,IAAI;AAClD;AAEA,IAAO,aAAQ;",
-  "names": []
+  "sourcesContent": ["// Core's DI, plus the two job kinds a run becomes.\n//\n// Core's registrations are reused as they are \u2014 the engine, the run service, the mapping and\n// schedule services are all core's, unchanged. The decoration that makes a run durable happens\n// per slice, inside the kind, not here (see docs/adr/0004): a container-level decoration would\n// apply to every caller of the engine, including ones not running under a lease.\n\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { register as registerCore } from '@open-mercato/core/modules/data_sync/di'\nimport { createSyncEngine } from '@open-mercato/core/modules/data_sync/lib/sync-engine'\nimport { getDataSyncAdapter, resolveProviderKey } from '@open-mercato/core/modules/data_sync/lib/adapter-registry'\nimport { emitDataSyncEvent } from '@open-mercato/core/modules/data_sync/events'\nimport { registry } from '@fullstackhouse/open-mercato-durable-work'\n\nimport { dataSyncKinds } from '../../kinds/data-sync-run'\n\n/**\n * Built once, at module scope, not once per container.\n *\n * `register` runs on every container build \u2014 which in a web process means every request \u2014 and\n * the registry refuses two different handlers under one kind id, because silently accepting\n * the second would make \"which code is running this job?\" depend on request ordering. Kinds\n * created per call would be a different handler every time, so the second request would throw.\n *\n * Each slice resolves its own container instead, which it needs anyway: slices run in the\n * worker process, outside any request, and each needs its own EntityManager rather than one\n * captured from whichever request happened to build the registry first.\n */\nconst KINDS = dataSyncKinds({\n  resolve: async () => {\n    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n    const container = await createRequestContainer()\n    const em = container.resolve<EntityManager>('em')\n    const progressService = container.resolve('progressService')\n    const integrationLogService = container.resolve('integrationLogService')\n    const integrationStateService = container.resolve('integrationStateService')\n    return {\n      runService: container.resolve('dataSyncRunService'),\n      progressService,\n      // Resolved from core's own registry and core's own event bus, so the replayed tail is\n      // core's behaviour rather than a second opinion about what it should have been.\n      finalize: {\n        progressService,\n        integrationLogService,\n        integrationStateService,\n        operationalTelemetry: (integrationId: string) =>\n          getDataSyncAdapter(resolveProviderKey(integrationId))?.operationalTelemetry === true,\n        emitEvent: (name, payload) => emitDataSyncEvent(name as never, payload as never),\n      },\n      engine: ({ runService, progressService }) =>\n        createSyncEngine({\n          em,\n          syncRunService: runService as never,\n          integrationCredentialsService: container.resolve('integrationCredentialsService'),\n          integrationLogService,\n          integrationStateService,\n          progressService: progressService as never,\n        }),\n    }\n  },\n})\n\nexport function register(container: AppContainer) {\n  registerCore(container)\n  // Idempotent: the same handler objects every time, so re-registering is a no-op. The web\n  // process needs them to re-drive and cancel, the worker to run slices, and the reconciler to\n  // know whether a job has a handler at all.\n  for (const kind of KINDS) registry.register(kind)\n}\n\nexport default register\n"],
+  "mappings": "AASA,SAAS,YAAY,oBAAoB;AACzC,SAAS,wBAAwB;AACjC,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,yBAAyB;AAClC,SAAS,gBAAgB;AAEzB,SAAS,qBAAqB;AAc9B,MAAM,QAAQ,cAAc;AAAA,EAC1B,SAAS,YAAY;AACnB,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,wBAAwB,UAAU,QAAQ,uBAAuB;AACvE,UAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAC3E,WAAO;AAAA,MACL,YAAY,UAAU,QAAQ,oBAAoB;AAAA,MAClD;AAAA;AAAA;AAAA,MAGA,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,sBAAsB,CAAC,kBACrB,mBAAmB,mBAAmB,aAAa,CAAC,GAAG,yBAAyB;AAAA,QAClF,WAAW,CAAC,MAAM,YAAY,kBAAkB,MAAe,OAAgB;AAAA,MACjF;AAAA,MACA,QAAQ,CAAC,EAAE,YAAY,iBAAAA,iBAAgB,MACrC,iBAAiB;AAAA,QACf;AAAA,QACA,gBAAgB;AAAA,QAChB,+BAA+B,UAAU,QAAQ,+BAA+B;AAAA,QAChF;AAAA,QACA;AAAA,QACA,iBAAiBA;AAAA,MACnB,CAAC;AAAA,IACL;AAAA,EACF;AACF,CAAC;AAEM,SAAS,SAAS,WAAyB;AAChD,eAAa,SAAS;AAItB,aAAW,QAAQ,MAAO,UAAS,SAAS,IAAI;AAClD;AAEA,IAAO,aAAQ;",
+  "names": ["progressService"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fullstackhouse/open-mercato-data-sync-durable",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Drop-in replacement for Open Mercato's core data_sync module that runs sync runs as durable at-least-once work (via @fullstackhouse/open-mercato-durable-work): survives deploys and worker kills, resumes from the committed cursor, retries transient errors at the batch, never leaves a run 'running' forever. Same tables, API, adapter contract, events and UI as core; swap one line in modules.ts.",
   "type": "module",
   "main": "./dist/index.js",
@@ -32,7 +32,7 @@
     "gen:mirror": "node scripts/gen-mirror.mjs",
     "prebuild": "node scripts/gen-mirror.mjs --check",
     "build": "node build.mjs",
-    "prepack": "yarn build",
+    "prepack": "node scripts/gen-mirror.mjs --check && node build.mjs",
     "watch": "node watch.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -94,7 +94,7 @@
     }
   },
   "peerDependencies": {
-    "@fullstackhouse/open-mercato-durable-work": "^0.1.0",
+    "@fullstackhouse/open-mercato-durable-work": "^0.1.1",
     "@mikro-orm/core": ">=7.0.0",
     "@mikro-orm/migrations": ">=7.0.0",
     "@mikro-orm/postgresql": ">=7.0.0",
@@ -109,7 +109,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.0.0",
-    "@fullstackhouse/open-mercato-durable-work": "^0.1.0",
+    "@fullstackhouse/open-mercato-durable-work": "^0.1.1",
     "@mikro-orm/core": "^7.1.8",
     "@mikro-orm/migrations": "^7.1.8",
     "@mikro-orm/postgresql": "^7.1.8",

package/src/compat/seams.test.ts

@@ -59,6 +59,37 @@ describe('the seams the durable adopter decorates', () => {
     expect(engine).toMatch(/if \(run\.status !== status\) \{/)
   })
 
+  it('still ends finalizeRun with exactly the three side effects the adopter replays', () => {
+    // The skipped tail. Core stops at its "another worker already finalized this" branch on
+    // every durable run, so everything after it is ours to replay — the progress job, the
+    // operational writes and the lifecycle event (see `replayFinalize`).
+    //
+    // Asserted here because the failure mode is silent in both directions: a side effect
+    // upstream *adds* to this tail would simply never happen on a durable run, and nothing in
+    // a host would report it missing. That is precisely how the first three came to be dropped
+    // for a whole release.
+    const start = engine.indexOf('async function finalizeRun')
+    // Bounded at the next declaration: unbounded, this runs to the end of the file and sweeps
+    // up `runImport`/`runExport`, which make the same kinds of call for their own reasons.
+    const next = engine.indexOf('\n  return {', start + 1)
+    const tail = engine.slice(start, next === -1 ? undefined : next)
+
+    for (const call of ['progressService.completeJob(', 'progressService.failJob(', 'progressService.markCancelled(']) {
+      expect({ call, present: tail.includes(call) }).toEqual({ call, present: true })
+    }
+    expect(tail).toMatch(/emitDataSyncEvent\('data_sync\.run\.completed'/)
+    expect(tail).toMatch(/emitDataSyncEvent\('data_sync\.run\.failed'/)
+    expect(tail).toMatch(/emitDataSyncEvent\('data_sync\.run\.cancelled'/)
+
+    // The gate on the two operational writes, and deliberately not on the event.
+    expect(tail).toMatch(/enabled: operationalTelemetry/)
+
+    // A fourth kind of side effect in the tail means `replayFinalize` is now incomplete. The
+    // count is the tripwire: it is meant to be re-read, not bumped.
+    const awaited = tail.match(/await (progressService|updateOperationalState|writeOperationalLog|emitDataSyncEvent)\b/g) ?? []
+    expect(awaited.length).toBe(12)
+  })
+
   it('still asks whether to cancel at every batch boundary', () => {
     // The hand-back point. Without it a slice has nowhere to stop, and the mechanism's
     // headline property — a deploy does not kill a multi-day run — is gone.

package/src/engine/durable-run.ts

@@ -85,8 +85,10 @@ export function recordSlice(
        * Core's `finalizeRun` compares what comes back to what it asked for, and stays silent
        * when they differ — the branch it has for "another worker already finalized this". So
        * this both captures the outcome and suppresses the progress write, the operational log
-       * and the lifecycle event, leaving all three to the durable terminal transition, which
-       * writes them in the same transaction as the job's own terminal state.
+       * and the lifecycle event. The run's terminal status is then written by `onTransition`,
+       * in the same transaction as the job's own; the three suppressed side effects are
+       * replayed by `replayFinalize` after that commit, since an event inside a transaction
+       * that can still roll back is a lie waiting to happen.
        */
       async markStatus(runId, status, scope, error) {
         if (status === 'completed' || status === 'failed' || status === 'cancelled') {
@@ -229,3 +231,138 @@ export async function reopenRun(tx: SqlExecutor, runId: string): Promise<{ match
   )
   return { matched: result.rowCount }
 }
+
+/**
+ * The services core's `finalizeRun` reaches for once the status is written.
+ *
+ * Named separately from the slice's dependencies because these are needed at a different
+ * moment: the slice runs under a lease, this runs after the job's terminal transition has
+ * committed, on whatever worker got there.
+ */
+export type FinalizeDeps = {
+  progressService: ProgressServiceLike
+  integrationLogService: { write(entry: Record<string, unknown>, scope: SyncScope): Promise<unknown> }
+  integrationStateService?: {
+    upsert(integrationId: string, patch: Record<string, unknown>, scope: SyncScope): Promise<unknown>
+  } | null
+  /** `adapter.operationalTelemetry === true`, which is core's own gate on the two writes below. */
+  operationalTelemetry(integrationId: string): boolean
+  emitEvent(name: string, payload: Record<string, unknown>): Promise<void>
+}
+
+/** The run fields core's tail reads. */
+export type FinalizedRun = {
+  id: string
+  integrationId: string
+  entityType: string
+  direction: string
+  progressJobId?: string | null
+  createdCount?: number
+  updatedCount?: number
+  skippedCount?: number
+  failedCount?: number
+  batchesCompleted?: number
+}
+
+/**
+ * Everything core's `finalizeRun` does after the status write, done here instead.
+ *
+ * Core stops at its "another worker already finalized this" branch on every durable run — that
+ * is deliberate, and it is what lets the durable transition own the terminal state (see
+ * `markStatus` above). But stopping there also skips the three things that came after it: the
+ * progress job is never resolved, the operational log never written, and the lifecycle event
+ * never emitted. Left unreplayed, a host loses the progress indicator an operator watches, the
+ * integration health state, and `data_sync.run.completed` — which is dispatched to tenant
+ * webhooks, so its absence is visible outside the app entirely.
+ *
+ * This runs after the commit, not inside it: events and enqueues must not sit in a transaction
+ * that can still roll back, and the mechanism gives after-commit hooks at-most-once semantics
+ * for exactly this. A throw here is logged and dropped rather than retried — the same standing
+ * core's own tail has, where a failed webhook has never un-completed a run.
+ */
+export async function replayFinalize(
+  deps: FinalizeDeps,
+  run: FinalizedRun,
+  status: SyncTerminalStatus,
+  errorMessage: string | null,
+  scope: SyncScope,
+  userId: string | null,
+): Promise<void> {
+  const progressScope = { tenantId: scope.tenantId, organizationId: scope.organizationId, userId: userId ?? undefined }
+  const enabled = deps.operationalTelemetry(run.integrationId)
+
+  if (run.progressJobId) {
+    const progress = deps.progressService as unknown as Record<string, ((...args: unknown[]) => Promise<unknown>) | undefined>
+    if (status === 'completed') {
+      await progress.completeJob?.(
+        run.progressJobId,
+        {
+          resultSummary: {
+            createdCount: run.createdCount,
+            updatedCount: run.updatedCount,
+            skippedCount: run.skippedCount,
+            failedCount: run.failedCount,
+            batchesCompleted: run.batchesCompleted,
+          },
+        },
+        progressScope,
+      )
+    } else if (status === 'failed') {
+      await progress.failJob?.(run.progressJobId, { errorMessage: errorMessage ?? 'Sync run failed' }, progressScope)
+    } else {
+      await progress.markCancelled?.(run.progressJobId, progressScope)
+    }
+  }
+
+  const health = status === 'completed' ? 'healthy' : status === 'cancelled' ? 'degraded' : 'unhealthy'
+  if (enabled && deps.integrationStateService) {
+    await deps.integrationStateService.upsert(
+      run.integrationId,
+      { lastHealthStatus: health, lastHealthCheckedAt: new Date() },
+      scope,
+    )
+  }
+
+  if (enabled) {
+    const log =
+      status === 'completed'
+        ? {
+            level: 'info',
+            message: 'Sync run completed',
+            payload: {
+              operationalStatus: 'completed',
+              summary: `Sync completed with ${run.createdCount ?? 0} created, ${run.updatedCount ?? 0} updated, ${run.failedCount ?? 0} failed.`,
+              createdCount: run.createdCount,
+              updatedCount: run.updatedCount,
+              skippedCount: run.skippedCount,
+              failedCount: run.failedCount,
+              batchesCompleted: run.batchesCompleted,
+            },
+          }
+        : status === 'cancelled'
+          ? {
+              level: 'warn',
+              message: 'Sync run cancelled',
+              payload: { operationalStatus: 'cancelled', summary: 'The sync run was cancelled before completion.' },
+            }
+          : {
+              level: 'error',
+              message: errorMessage ?? 'Sync run failed',
+              payload: { operationalStatus: 'failed', summary: errorMessage ?? 'The sync run failed.' },
+            }
+
+    await deps.integrationLogService.write({ integrationId: run.integrationId, runId: run.id, ...log }, scope)
+  }
+
+  await deps.emitEvent(`data_sync.run.${status}`, {
+    runId: run.id,
+    integrationId: run.integrationId,
+    entityType: run.entityType,
+    direction: run.direction,
+    // Only the failure event carries this, and a subscriber that switches on it would see
+    // every durable failure as an unexplained one if it were dropped.
+    ...(status === 'failed' ? { error: errorMessage ?? null } : {}),
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  })
+}

package/src/engine/replay-finalize.test.ts

@@ -0,0 +1,131 @@
+// What core's `finalizeRun` does after the status write, and what we do instead.
+//
+// These exist because the gap they close was invisible for a whole release: core's engine skips
+// its own tail on every durable run — deliberately, that is the seam this package rests on — and
+// nothing noticed that the three side effects it skipped were never replayed. The e2e specs
+// asserted that a run *becomes* a durable job; none drove one to terminal, so the progress job
+// left dangling and the undelivered `data_sync.run.completed` webhook showed up nowhere.
+
+import { describe, expect, it, vi } from 'vitest'
+
+import { replayFinalize, type FinalizeDeps, type FinalizedRun } from './durable-run'
+
+const run: FinalizedRun = {
+  id: 'run-1',
+  integrationId: 'example_sync',
+  entityType: 'example.record',
+  direction: 'import',
+  progressJobId: 'pj-1',
+  createdCount: 3,
+  updatedCount: 2,
+  skippedCount: 1,
+  failedCount: 0,
+  batchesCompleted: 4,
+}
+
+const scope = { tenantId: 't1', organizationId: 'o1' }
+
+function deps(overrides: Partial<FinalizeDeps> = {}) {
+  const progressService = {
+    completeJob: vi.fn().mockResolvedValue(undefined),
+    failJob: vi.fn().mockResolvedValue(undefined),
+    markCancelled: vi.fn().mockResolvedValue(undefined),
+    isCancellationRequested: vi.fn().mockResolvedValue(false),
+  }
+  const integrationLogService = { write: vi.fn().mockResolvedValue(undefined) }
+  const integrationStateService = { upsert: vi.fn().mockResolvedValue(undefined) }
+  const emitEvent = vi.fn().mockResolvedValue(undefined)
+  const value: FinalizeDeps = {
+    progressService: progressService as never,
+    integrationLogService,
+    integrationStateService,
+    operationalTelemetry: () => true,
+    emitEvent,
+    ...overrides,
+  }
+  return { deps: value, progressService, integrationLogService, integrationStateService, emitEvent }
+}
+
+describe('replayFinalize', () => {
+  it('resolves the progress job, records health and emits the lifecycle event on completion', async () => {
+    const d = deps()
+    await replayFinalize(d.deps, run, 'completed', null, scope, 'user-1')
+
+    // The progress job is what an operator watches in the top bar. Left pending, a finished
+    // backfill reads as still running forever.
+    expect(d.progressService.completeJob).toHaveBeenCalledWith(
+      'pj-1',
+      { resultSummary: { createdCount: 3, updatedCount: 2, skippedCount: 1, failedCount: 0, batchesCompleted: 4 } },
+      { tenantId: 't1', organizationId: 'o1', userId: 'user-1' },
+    )
+    expect(d.integrationStateService.upsert).toHaveBeenCalledWith(
+      'example_sync',
+      expect.objectContaining({ lastHealthStatus: 'healthy' }),
+      scope,
+    )
+    // Dispatched to tenant webhooks, so its absence is visible outside the app entirely.
+    expect(d.emitEvent).toHaveBeenCalledWith('data_sync.run.completed', expect.objectContaining({ runId: 'run-1' }))
+  })
+
+  it('fails the progress job and reports the error on failure', async () => {
+    const d = deps()
+    await replayFinalize(d.deps, run, 'failed', 'batch 39: timeout', scope, null)
+
+    expect(d.progressService.failJob).toHaveBeenCalledWith(
+      'pj-1',
+      { errorMessage: 'batch 39: timeout' },
+      expect.objectContaining({ userId: undefined }),
+    )
+    expect(d.integrationStateService.upsert).toHaveBeenCalledWith(
+      'example_sync',
+      expect.objectContaining({ lastHealthStatus: 'unhealthy' }),
+      scope,
+    )
+    expect(d.integrationLogService.write).toHaveBeenCalledWith(
+      expect.objectContaining({ level: 'error', message: 'batch 39: timeout', runId: 'run-1' }),
+      scope,
+    )
+    // Only the failure event carries `error`; a subscriber switching on it would otherwise see
+    // every durable failure as an unexplained one.
+    expect(d.emitEvent).toHaveBeenCalledWith(
+      'data_sync.run.failed',
+      expect.objectContaining({ runId: 'run-1', error: 'batch 39: timeout' }),
+    )
+  })
+
+  it('marks the progress job cancelled and degrades health on cancellation', async () => {
+    const d = deps()
+    await replayFinalize(d.deps, run, 'cancelled', null, scope, null)
+
+    expect(d.progressService.markCancelled).toHaveBeenCalledWith('pj-1', expect.anything())
+    expect(d.integrationStateService.upsert).toHaveBeenCalledWith(
+      'example_sync',
+      expect.objectContaining({ lastHealthStatus: 'degraded' }),
+      scope,
+    )
+    expect(d.emitEvent).toHaveBeenCalledWith('data_sync.run.cancelled', expect.anything())
+  })
+
+  it('honours the adapter opt-out for the operational writes, but never for the event', async () => {
+    // `operationalTelemetry` is an adapter's choice about how chatty its log is. It has never
+    // been a choice about whether the run's completion is observable, and core gates only the
+    // two operational writes on it — so the event must still go out.
+    const d = deps({ operationalTelemetry: () => false })
+    await replayFinalize(d.deps, run, 'completed', null, scope, null)
+
+    expect(d.integrationLogService.write).not.toHaveBeenCalled()
+    expect(d.integrationStateService.upsert).not.toHaveBeenCalled()
+    expect(d.progressService.completeJob).toHaveBeenCalled()
+    expect(d.emitEvent).toHaveBeenCalledWith('data_sync.run.completed', expect.anything())
+  })
+
+  it('does nothing with a progress job when the run never had one', async () => {
+    // `createProgressJob: false` is a supported way to start a run, and core guards its whole
+    // progress branch on `run.progressJobId`.
+    const d = deps()
+    await replayFinalize(d.deps, { ...run, progressJobId: null }, 'completed', null, scope, null)
+
+    expect(d.progressService.completeJob).not.toHaveBeenCalled()
+    expect(d.emitEvent).toHaveBeenCalled()
+  })
+})

package/src/kinds/data-sync-run.ts

@@ -13,6 +13,8 @@ import {
   outcomeOf,
   recordSlice,
   reopenRun,
+  replayFinalize,
+  type FinalizeDeps,
   type ProgressServiceLike,
   type SyncRunServiceLike,
   type SyncScope,
@@ -40,6 +42,8 @@ export type DataSyncKindDeps = {
     engine: (services: { runService: SyncRunServiceLike; progressService: ProgressServiceLike }) => SyncEngineLike
     runService: SyncRunServiceLike
     progressService: ProgressServiceLike
+    /** What core's `finalizeRun` would have done after the status write. */
+    finalize: FinalizeDeps
   }>
 }
 
@@ -84,6 +88,33 @@ export function dataSyncKinds(deps: DataSyncKindDeps): KindDefinition<SyncRunInp
     async onRedrive(job: { input: unknown }, _scope: unknown, tx: SqlExecutor) {
       return reopenRun(tx, (job.input as SyncRunInput).runId)
     },
+
+    /**
+     * The rest of core's `finalizeRun`, which core itself skips on every durable run.
+     *
+     * Without this a host is told the run is over by the `sync_runs` row alone: the progress
+     * job an operator watches never resolves, the integration's health state never moves, and
+     * `data_sync.run.completed` — a tenant webhook — is never dispatched. The decoration that
+     * makes a run durable is supposed to be invisible to a host, and those three are exactly
+     * how a host would notice.
+     *
+     * At-most-once and best-effort by the mechanism's contract, which is the same standing
+     * these have in core: a webhook that fails there has never un-completed a run either.
+     */
+    async onAfterTransition(job: { id: string; input: unknown; status: string; errorMessage: string | null; createdBy: string | null }, scope: { tenantId: string; organizationId: string | null }) {
+      const { runId } = job.input as SyncRunInput
+      const status = job.status === 'completed' ? 'completed' : job.status === 'cancelled' ? 'cancelled' : 'failed'
+      const { runService, finalize } = await deps.resolve()
+
+      const run = (await runService.getRun(runId, scope)) as
+        | (Parameters<typeof replayFinalize>[1] & Record<string, unknown>)
+        | null
+      // A run that has been hard-deleted since the job finished is not an error to report:
+      // there is nothing left to resolve, and the job's own terminal state is already correct.
+      if (!run) return
+
+      await replayFinalize(finalize, run, status, job.errorMessage, scope, job.createdBy)
+    },
   }
 
   return [

package/src/modules/data_sync/di.ts

@@ -9,6 +9,8 @@ import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { register as registerCore } from '@open-mercato/core/modules/data_sync/di'
 import { createSyncEngine } from '@open-mercato/core/modules/data_sync/lib/sync-engine'
+import { getDataSyncAdapter, resolveProviderKey } from '@open-mercato/core/modules/data_sync/lib/adapter-registry'
+import { emitDataSyncEvent } from '@open-mercato/core/modules/data_sync/events'
 import { registry } from '@fullstackhouse/open-mercato-durable-work'
 
 import { dataSyncKinds } from '../../kinds/data-sync-run'
@@ -30,16 +32,29 @@ const KINDS = dataSyncKinds({
     const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
     const container = await createRequestContainer()
     const em = container.resolve<EntityManager>('em')
+    const progressService = container.resolve('progressService')
+    const integrationLogService = container.resolve('integrationLogService')
+    const integrationStateService = container.resolve('integrationStateService')
     return {
       runService: container.resolve('dataSyncRunService'),
-      progressService: container.resolve('progressService'),
+      progressService,
+      // Resolved from core's own registry and core's own event bus, so the replayed tail is
+      // core's behaviour rather than a second opinion about what it should have been.
+      finalize: {
+        progressService,
+        integrationLogService,
+        integrationStateService,
+        operationalTelemetry: (integrationId: string) =>
+          getDataSyncAdapter(resolveProviderKey(integrationId))?.operationalTelemetry === true,
+        emitEvent: (name, payload) => emitDataSyncEvent(name as never, payload as never),
+      },
       engine: ({ runService, progressService }) =>
         createSyncEngine({
           em,
           syncRunService: runService as never,
           integrationCredentialsService: container.resolve('integrationCredentialsService'),
-          integrationLogService: container.resolve('integrationLogService'),
-          integrationStateService: container.resolve('integrationStateService'),
+          integrationLogService,
+          integrationStateService,
           progressService: progressService as never,
         }),
     }

package/dist/modules/data_sync/lib/abandoned-run.js

@@ -1,6 +0,0 @@
-export * from "@open-mercato/core/modules/data_sync/lib/abandoned-run";
-import { failAbandonedRun } from "@open-mercato/core/modules/data_sync/lib/abandoned-run";
-export {
-  failAbandonedRun
-};
-//# sourceMappingURL=abandoned-run.js.map

package/dist/modules/data_sync/lib/abandoned-run.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/data_sync/lib/abandoned-run.ts"],
-  "sourcesContent": ["// GENERATED by scripts/gen-mirror.mjs from @open-mercato/core@0.7.1-develop.7135.1.19bf969756 (lib/abandoned-run.ts). Do not edit.\n// This package mirrors core's data_sync module file-for-file; see docs/adr/0006-drop-in-data-sync.md.\nexport * from '@open-mercato/core/modules/data_sync/lib/abandoned-run'\nexport { failAbandonedRun } from '@open-mercato/core/modules/data_sync/lib/abandoned-run'\n"],
-  "mappings": "AAEA,cAAc;AACd,SAAS,wBAAwB;",
-  "names": []
-}