@llm-dev-ops/agentics-cli 1.5.74 → 1.6.0

package/dist/pipeline/phase4/phases/erp-client-generator.js

@@ -34,28 +34,28 @@ const GENERATED_HEADER_RS = '// Generated by Phase 4 pipeline — do not edit ma
 function resolveErpClientNames(erpSystem) {
     const n = erpSystem.toLowerCase();
     if (n.includes('netsuite'))
-        return { className: 'NetSuiteClient', mapperName: 'NetSuiteMapper', wirePrefix: 'NetSuite', displayName: 'NetSuite' };
+        return { className: 'NetSuiteClient', mapperName: 'NetSuiteMapper', wirePrefix: 'NetSuite', displayName: 'NetSuite', envPrefix: 'NETSUITE' };
     if (n.includes('sap'))
-        return { className: 'SAPClient', mapperName: 'SAPMapper', wirePrefix: 'SAP', displayName: 'SAP' };
+        return { className: 'SAPClient', mapperName: 'SAPMapper', wirePrefix: 'SAP', displayName: 'SAP', envPrefix: 'SAP' };
     if (n.includes('dynamics'))
-        return { className: 'DynamicsClient', mapperName: 'DynamicsMapper', wirePrefix: 'Dynamics', displayName: 'Dynamics 365' };
+        return { className: 'DynamicsClient', mapperName: 'DynamicsMapper', wirePrefix: 'Dynamics', displayName: 'Dynamics 365', envPrefix: 'DYNAMICS' };
     if (n.includes('deltek') || n.includes('costpoint'))
-        return { className: 'DeltekClient', mapperName: 'DeltekMapper', wirePrefix: 'Deltek', displayName: 'Deltek Costpoint' };
+        return { className: 'DeltekClient', mapperName: 'DeltekMapper', wirePrefix: 'Deltek', displayName: 'Deltek Costpoint', envPrefix: 'DELTEK' };
     if (n.includes('guidewire'))
-        return { className: 'GuidewireClient', mapperName: 'GuidewireMapper', wirePrefix: 'Guidewire', displayName: 'Guidewire' };
+        return { className: 'GuidewireClient', mapperName: 'GuidewireMapper', wirePrefix: 'Guidewire', displayName: 'Guidewire', envPrefix: 'GUIDEWIRE' };
     if (n.includes('epicor'))
-        return { className: 'EpicorClient', mapperName: 'EpicorMapper', wirePrefix: 'Epicor', displayName: 'Epicor' };
+        return { className: 'EpicorClient', mapperName: 'EpicorMapper', wirePrefix: 'Epicor', displayName: 'Epicor', envPrefix: 'EPICOR' };
     if (n.includes('infor'))
-        return { className: 'InforClient', mapperName: 'InforMapper', wirePrefix: 'Infor', displayName: 'Infor' };
+        return { className: 'InforClient', mapperName: 'InforMapper', wirePrefix: 'Infor', displayName: 'Infor', envPrefix: 'INFOR' };
     if (n.includes('workday'))
-        return { className: 'WorkdayClient', mapperName: 'WorkdayMapper', wirePrefix: 'Workday', displayName: 'Workday' };
+        return { className: 'WorkdayClient', mapperName: 'WorkdayMapper', wirePrefix: 'Workday', displayName: 'Workday', envPrefix: 'WORKDAY' };
     if (n.includes('ifs'))
-        return { className: 'IFSClient', mapperName: 'IFSMapper', wirePrefix: 'IFS', displayName: 'IFS' };
+        return { className: 'IFSClient', mapperName: 'IFSMapper', wirePrefix: 'IFS', displayName: 'IFS', envPrefix: 'IFS' };
     if (n.includes('sage') || n.includes('intacct'))
-        return { className: 'SageClient', mapperName: 'SageMapper', wirePrefix: 'Sage', displayName: 'Sage Intacct' };
+        return { className: 'SageClient', mapperName: 'SageMapper', wirePrefix: 'Sage', displayName: 'Sage Intacct', envPrefix: 'SAGE' };
     if (n.includes('oracle'))
-        return { className: 'OracleERPClient', mapperName: 'OracleERPMapper', wirePrefix: 'OracleERP', displayName: 'Oracle ERP' };
-    return { className: 'ERPClient', mapperName: 'ERPMapper', wirePrefix: 'ERP', displayName: 'ERP' };
+        return { className: 'OracleERPClient', mapperName: 'OracleERPMapper', wirePrefix: 'OracleERP', displayName: 'Oracle ERP', envPrefix: 'ORACLE' };
+    return { className: 'ERPClient', mapperName: 'ERPMapper', wirePrefix: 'ERP', displayName: 'ERP', envPrefix: 'ERP' };
 }
 // ============================================================================
 // TypeScript Generation — ERP ACL
@@ -197,19 +197,25 @@ function tsTypes(erpSystem) {
         '  readonly audit_enabled: boolean;',
         '  readonly pii_redaction: boolean;',
         '  readonly max_tokens_per_request: number;',
+        '  readonly subsidiary_id?: string; // ADR-071: parameterized — defaults to env ORACLE_SUBSIDIARY_ID or \'1\'',
         '}',
         '',
         '// ============================================================================',
         '// Sync Queue Types',
         '// ============================================================================',
         '',
+        '// ADR-072: Persistent sync queue entry — stored in PostgreSQL, not in-memory',
         'export interface SyncQueueEntry {',
         '  readonly id: string;',
         '  readonly operation: string;',
-        '  readonly payload: unknown;',
+        '  readonly payload: string; // JSON-serialized wire format',
+        '  readonly idempotency_key: string;',
+        '  readonly status: \'pending\' | \'in_flight\' | \'completed\' | \'failed\';',
         '  readonly created_at: string;',
+        '  readonly last_attempt_at: string | null;',
         '  readonly retry_count: number;',
-        '  readonly last_error: string | null;',
+        '  readonly error_message: string | null;',
+        '  readonly correlation_id: string;',
         '}',
         '',
         'export interface SyncStatus {',
@@ -276,6 +282,47 @@ function tsMapper(erpSystem) {
         '}',
         '',
         '// ============================================================================',
+        '// ADR-072: Wire Format Validation Schemas',
+        '// ============================================================================',
+        '',
+        "import { z } from 'zod';",
+        '',
+        `const ${wp}TransferOrderSchema = z.object({`,
+        "  subsidiary: z.object({ id: z.string().min(1) }),",
+        "  location: z.object({ id: z.string().min(1) }),",
+        "  transferLocation: z.object({ id: z.string().min(1) }),",
+        "  memo: z.string(),",
+        "  item: z.object({ items: z.array(z.object({ item: z.object({ id: z.string() }), quantity: z.number(), units: z.object({ id: z.string() }).optional() })) }),",
+        '});',
+        '',
+        `const ${wp}PurchaseOrderSchema = z.object({`,
+        "  entity: z.object({ id: z.string().min(1) }),",
+        "  subsidiary: z.object({ id: z.string().min(1) }),",
+        "  location: z.object({ id: z.string().min(1) }),",
+        "  memo: z.string(),",
+        "  item: z.object({ items: z.array(z.object({ item: z.object({ id: z.string() }), quantity: z.number() })) }),",
+        '});',
+        '',
+        `const ${wp}ItemReceiptSchema = z.object({`,
+        "  createdFrom: z.object({ id: z.string().min(1) }),",
+        "  subsidiary: z.object({ id: z.string().min(1) }),",
+        "  item: z.object({ items: z.array(z.object({ item: z.object({ id: z.string() }), quantity: z.number(), location: z.object({ id: z.string() }) })) }),",
+        '});',
+        '',
+        '/** ADR-072: Validate wire payload before queuing or sending to ERP */',
+        'function validateWirePayload(operation: string, payload: unknown): void {',
+        '  const schemas: Record<string, z.ZodSchema> = {',
+        `    createTransferOrder: ${wp}TransferOrderSchema,`,
+        `    createPurchaseOrder: ${wp}PurchaseOrderSchema,`,
+        `    updateItemReceipt: ${wp}ItemReceiptSchema,`,
+        '  };',
+        '  const schema = schemas[operation];',
+        '  if (schema) {',
+        '    schema.parse(payload); // Throws ZodError if invalid',
+        '  }',
+        '}',
+        '',
+        '// ============================================================================',
         `// ${names.mapperName} — Domain ↔ Wire Type Translation`,
         '// ============================================================================',
         '',
@@ -288,7 +335,7 @@ function tsMapper(erpSystem) {
         '',
         `  toTransferOrder(domain: DomainTransferOrder): ${wp}TransferOrder {`,
         `    const wire: ${wp}TransferOrder = {`,
-        '      subsidiary: { id: \'1\' },',
+        '      subsidiary: { id: this.governance.subsidiary_id ?? process.env.ORACLE_SUBSIDIARY_ID ?? \'1\' }, // ADR-071: parameterized',
         '      location: { id: domain.from_facility },',
         '      transferLocation: { id: domain.to_facility },',
         '      memo: `Transfer ${domain.sku} — priority: ${domain.priority}`,',
@@ -309,7 +356,7 @@ function tsMapper(erpSystem) {
         `  toPurchaseOrder(domain: DomainPurchaseOrder): ${wp}PurchaseOrder {`,
         `    const wire: ${wp}PurchaseOrder = {`,
         '      entity: { id: domain.vendor_id },',
-        '      subsidiary: { id: \'1\' },',
+        '      subsidiary: { id: this.governance.subsidiary_id ?? process.env.ORACLE_SUBSIDIARY_ID ?? \'1\' }, // ADR-071: parameterized',
         '      location: { id: domain.facility_id },',
         '      memo: `PO for ${domain.sku} — qty: ${domain.quantity}`,',
         '      item: {',
@@ -328,7 +375,7 @@ function tsMapper(erpSystem) {
         `  toItemReceipt(domain: DomainItemReceipt, transferNsId: string): ${wp}ItemReceipt {`,
         '    return {',
         '      createdFrom: { id: transferNsId },',
-        '      subsidiary: { id: \'1\' },',
+        '      subsidiary: { id: this.governance.subsidiary_id ?? process.env.ORACLE_SUBSIDIARY_ID ?? \'1\' }, // ADR-071: parameterized',
         '      item: {',
         '        items: [{',
         '          item: { id: domain.sku },',
@@ -376,7 +423,7 @@ function tsClient(erpSystem, paths) {
         `  SyncStatus,`,
         `} from './types.js';`,
         `import { ${names.mapperName} } from './mapper.js';`,
-        `import { withRetry, CircuitBreaker } from './retry.js';`,
+        `import { withRetry, CircuitBreaker, TokenBucketRateLimiter, translateErpError } from './retry.js';`,
         '',
         'const GCP_METADATA_TOKEN_URL =',
         '  \'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity\';',
@@ -384,6 +431,35 @@ function tsClient(erpSystem, paths) {
         'const REQUEST_TIMEOUT_MS = parseInt(process.env.ERP_REQUEST_TIMEOUT_MS ?? \'30000\', 10);',
         'const BULK_TIMEOUT_MS = parseInt(process.env.ERP_BULK_TIMEOUT_MS ?? \'120000\', 10);',
         '',
+        '// ADR-076: Shield outbound scanning for ERP payloads',
+        'async function shieldScanOutbound(payload: unknown, operation: string, correlationId: string): Promise<void> {',
+        '  const shieldUrl = process.env.AGENTICS_SHIELD_URL;',
+        '  if (!shieldUrl) return; // Shield not configured — skip (log in dev)',
+        '  try {',
+        '    const response = await fetch(`${shieldUrl}/api/v1/scan`, {',
+        '      method: \'POST\',',
+        '      headers: { \'Content-Type\': \'application/json\', \'X-Correlation-ID\': correlationId },',
+        '      body: JSON.stringify({',
+        '        content: JSON.stringify(payload),',
+        '        checks: [\'pii\', \'secrets\', \'credential_exposure\'],',
+        '        context: { destination: \'erp_writeback\', operation },',
+        '      }),',
+        '      signal: AbortSignal.timeout(5_000),',
+        '    });',
+        '    if (response.ok) {',
+        '      const result = await response.json() as { blocked?: boolean; findings?: Array<{ type: string }> };',
+        '      if (result.blocked) {',
+        '        throw new Error(`ERP writeback blocked by Shield: ${result.findings?.map(f => f.type).join(\', \') ?? \'security policy violation\'}`);',
+        '      }',
+        '    }',
+        '  } catch (err) {',
+        '    // ADR-076: Shield is must-have for outbound ERP — rethrow to prevent unscanned writeback',
+        '    if (err instanceof Error && err.message.includes(\'blocked by Shield\')) throw err;',
+        '    console.error(JSON.stringify({ level: \'error\', type: \'SHIELD_OUTBOUND_UNAVAILABLE\', correlationId, operation, error: err instanceof Error ? err.message : String(err) }));',
+        '    throw new Error(\'Security scanning unavailable — cannot send unscanned payload to ERP\');',
+        '  }',
+        '}',
+        '',
         '// ============================================================================',
         '// Audit Logger Interface',
         '// ============================================================================',
@@ -401,9 +477,10 @@ function tsClient(erpSystem, paths) {
         '  private readonly serviceAccountEmail: string;',
         `  private readonly mapper: ${names.mapperName};`,
         '  private readonly breaker: CircuitBreaker;',
+        '  private readonly rateLimiter: TokenBucketRateLimiter;',
         '  private readonly governance: GovernanceConfig;',
         '  private readonly audit: AuditLogger | null;',
-        '  private readonly syncQueue: SyncQueueEntry[] = [];',
+        '  private readonly db: { execute: (sql: string, params?: unknown[]) => Promise<void>; query: (sql: string, params?: unknown[]) => Promise<Record<string, unknown>[]> } | null;',
         '  private readonly recentErrors: Array<{ timestamp: string; operation: string; error: string }> = [];',
         '  private lastSuccessfulSync: string | null = null;',
         '',
@@ -412,9 +489,16 @@ function tsClient(erpSystem, paths) {
         '    serviceAccountEmail: string;',
         '    governance: GovernanceConfig;',
         '    audit?: AuditLogger;',
+        '    db?: { execute: (sql: string, params?: unknown[]) => Promise<void>; query: (sql: string, params?: unknown[]) => Promise<Record<string, unknown>[]> };',
         '    circuitBreakerThreshold?: number;',
         '    circuitBreakerResetMs?: number;',
+        '    rateLimitMaxTokens?: number;',
+        '    rateLimitRefillRate?: number;',
         '  }) {',
+        '    // ADR-084: Fail-fast on unconfigured ERP URL — no fallback to example.com',
+        '    if (!config.baseUrl || config.baseUrl.includes(\'example.com\')) {',
+        `      throw new Error('${names.displayName} base URL not configured. Set ${names.envPrefix}_BASE_URL to a valid endpoint — do not use example.com fallback.');`,
+        '    }',
         '    this.baseUrl = config.baseUrl.replace(/\\/$/, \'\');',
         '    this.serviceAccountEmail = config.serviceAccountEmail;',
         '    this.governance = config.governance;',
@@ -424,6 +508,29 @@ function tsClient(erpSystem, paths) {
         '      config.circuitBreakerResetMs ?? 60_000,',
         '    );',
         '    this.audit = config.audit ?? null;',
+        '    this.rateLimiter = new TokenBucketRateLimiter(config.rateLimitMaxTokens ?? 10, config.rateLimitRefillRate ?? 2);',
+        '    this.db = config.db ?? null;',
+        '  }',
+        '',
+        '  // ADR-072: Initialize persistent sync queue table',
+        '  async initSyncQueue(): Promise<void> {',
+        '    if (!this.db) return;',
+        '    await this.db.execute(`',
+        '      CREATE TABLE IF NOT EXISTS sync_queue (',
+        '        id TEXT PRIMARY KEY,',
+        '        operation TEXT NOT NULL,',
+        '        payload TEXT NOT NULL,',
+        '        idempotency_key TEXT UNIQUE NOT NULL,',
+        '        status TEXT NOT NULL DEFAULT \'pending\',',
+        '        retry_count INTEGER NOT NULL DEFAULT 0,',
+        '        created_at TEXT NOT NULL,',
+        '        last_attempt_at TEXT,',
+        '        error_message TEXT,',
+        '        correlation_id TEXT NOT NULL',
+        '      )',
+        '    `);',
+        '    await this.db.execute(\'CREATE INDEX IF NOT EXISTS idx_sync_queue_status ON sync_queue(status)\');',
+        '    await this.db.execute(\'CREATE INDEX IF NOT EXISTS idx_sync_queue_created ON sync_queue(created_at)\');',
         '  }',
         '',
         '  // --------------------------------------------------------------------------',
@@ -488,52 +595,92 @@ function tsClient(erpSystem, paths) {
         '  // Sync Queue & Status',
         '  // --------------------------------------------------------------------------',
         '',
-        '  getSyncStatus(): SyncStatus {',
+        '  async getSyncStatus(): Promise<SyncStatus> {',
+        '    let pendingDepth = 0;',
+        '    if (this.db) {',
+        '      const rows = await this.db.query("SELECT COUNT(*) as cnt FROM sync_queue WHERE status IN (\'pending\', \'in_flight\')", []);',
+        '      pendingDepth = Number(rows[0]?.[\'cnt\'] ?? 0);',
+        '    }',
         '    return {',
         '      last_successful_sync: this.lastSuccessfulSync,',
-        '      pending_queue_depth: this.syncQueue.length,',
+        '      pending_queue_depth: pendingDepth,',
         '      circuit_breaker_state: this.breaker.state,',
         '      recent_errors: this.recentErrors.slice(-20),',
         '    };',
         '  }',
         '',
-        '  getPendingQueue(): ReadonlyArray<SyncQueueEntry> {',
-        '    return this.syncQueue;',
+        '  async getPendingQueue(): Promise<ReadonlyArray<SyncQueueEntry>> {',
+        '    if (!this.db) return [];',
+        '    const rows = await this.db.query("SELECT * FROM sync_queue WHERE status IN (\'pending\', \'failed\') ORDER BY created_at ASC", []);',
+        '    return rows.map(r => ({',
+        '      id: String(r[\'id\']),',
+        '      operation: String(r[\'operation\']),',
+        '      payload: String(r[\'payload\']),',
+        '      idempotency_key: String(r[\'idempotency_key\']),',
+        '      status: String(r[\'status\']) as SyncQueueEntry[\'status\'],',
+        '      created_at: String(r[\'created_at\']),',
+        '      last_attempt_at: r[\'last_attempt_at\'] ? String(r[\'last_attempt_at\']) : null,',
+        '      retry_count: Number(r[\'retry_count\'] ?? 0),',
+        '      error_message: r[\'error_message\'] ? String(r[\'error_message\']) : null,',
+        '      correlation_id: String(r[\'correlation_id\']),',
+        '    })) as SyncQueueEntry[];',
         '  }',
         '',
         '  async drainSyncQueue(): Promise<{ processed: number; failed: number }> {',
         '    // ADR-049: Governance check — drainSyncQueue must respect read_only mode',
         '    this.assertWriteAllowed(\'drainSyncQueue\');',
         '',
+        '    if (!this.db) return { processed: 0, failed: 0 };',
+        '',
+        '    // ADR-072: Read pending entries from database',
+        '    const pending = await this.db.query(',
+        '      "SELECT * FROM sync_queue WHERE status IN (\'pending\', \'failed\') AND retry_count < 10 ORDER BY created_at ASC",',
+        '      [],',
+        '    );',
+        '',
         '    let processed = 0;',
         '    let failed = 0;',
-        '    const remaining: SyncQueueEntry[] = [];',
         '',
-        '    for (const entry of this.syncQueue) {',
+        '    for (const row of pending) {',
+        '      const entryId = String(row[\'id\']);',
+        '      const operation = String(row[\'operation\']);',
+        '      const payload = JSON.parse(String(row[\'payload\']));',
+        '      const retryCount = Number(row[\'retry_count\'] ?? 0);',
+        '      const correlationId = String(row[\'correlation_id\']);',
+        '      const now = new Date().toISOString();',
+        '',
+        '      // Mark as in_flight',
+        '      await this.db.execute(',
+        '        "UPDATE sync_queue SET status = \'in_flight\', last_attempt_at = :1 WHERE id = :2",',
+        '        [now, entryId],',
+        '      );',
+        '',
         '      try {',
         '        await this.breaker.execute(() =>',
         '          withRetry(() =>',
-        '            this.post(this.operationToPath(entry.operation), entry.payload, entry.id),',
+        '            this.post(this.operationToPath(operation), payload, correlationId),',
         '          ),',
         '        );',
         '        processed++;',
-        '        this.lastSuccessfulSync = new Date().toISOString();',
-        '        // ADR-049: Audit successful drain',
-        '        await this.auditAfter(entry.operation, entry.id, entry.id, { status: \'drained\', retry_count: entry.retry_count });',
+        '        this.lastSuccessfulSync = now;',
+        '        // ADR-072: Mark as completed in database',
+        '        await this.db.execute(',
+        '          "UPDATE sync_queue SET status = \'completed\', last_attempt_at = :1 WHERE id = :2",',
+        '          [now, entryId],',
+        '        );',
+        '        await this.auditAfter(operation, entryId, correlationId, { status: \'drained\', retry_count: retryCount });',
         '      } catch (err) {',
         '        failed++;',
-        '        // ADR-049: Audit failed drain attempt',
-        '        await this.auditAfter(entry.operation, entry.id, entry.id, { status: \'drain_failed\', error: err instanceof Error ? err.message : String(err), retry_count: entry.retry_count + 1 });',
-        '        remaining.push({',
-        '          ...entry,',
-        '          retry_count: entry.retry_count + 1,',
-        '          last_error: err instanceof Error ? err.message : String(err),',
-        '        });',
+        '        const errorMsg = err instanceof Error ? err.message : String(err);',
+        '        // ADR-072: Update retry count and error in database',
+        '        await this.db.execute(',
+        '          "UPDATE sync_queue SET status = \'failed\', retry_count = :1, error_message = :2, last_attempt_at = :3 WHERE id = :4",',
+        '          [retryCount + 1, errorMsg, now, entryId],',
+        '        );',
+        '        await this.auditAfter(operation, entryId, correlationId, { status: \'drain_failed\', error: errorMsg, retry_count: retryCount + 1 });',
         '      }',
         '    }',
         '',
-        '    this.syncQueue.length = 0;',
-        '    this.syncQueue.push(...remaining);',
         '    return { processed, failed };',
         '  }',
         '',
@@ -542,6 +689,8 @@ function tsClient(erpSystem, paths) {
         '  // --------------------------------------------------------------------------',
         '',
         '  private async post(path: string, body: unknown, correlationId: string): Promise<ErpSurfaceResponse> {',
+        '    // ADR-084: Rate limit before making external call',
+        '    await this.rateLimiter.acquire();',
         '    const token = await this.getIdentityToken();',
         '    const controller = new AbortController();',
         '    const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);',
@@ -561,7 +710,9 @@ function tsClient(erpSystem, paths) {
         '      });',
         '',
         '      if (!response.ok) {',
-        `        throw new Error(\`${names.displayName} returned HTTP \${response.status}: \${await response.text()}\`);`,
+        '        // ADR-084: Translate ERP-specific error codes to domain exceptions',
+        '        const responseBody = await response.text();',
+        '        throw translateErpError(response.status, responseBody, path);',
         '      }',
         '      return response.json() as Promise<ErpSurfaceResponse>;',
         '    } finally {',
@@ -570,6 +721,8 @@ function tsClient(erpSystem, paths) {
         '  }',
         '',
         '  private async get(path: string, correlationId: string): Promise<ErpSurfaceResponse> {',
+        '    // ADR-084: Rate limit before making external call',
+        '    await this.rateLimiter.acquire();',
         '    const token = await this.getIdentityToken();',
         '    const controller = new AbortController();',
         '    const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);',
@@ -585,7 +738,8 @@ function tsClient(erpSystem, paths) {
         '      });',
         '',
         '      if (!response.ok) {',
-        `        throw new Error(\`${names.displayName} returned HTTP \${response.status}: \${await response.text()}\`);`,
+        '        const responseBody = await response.text();',
+        '        throw translateErpError(response.status, responseBody, path);',
         '      }',
         '      return response.json() as Promise<ErpSurfaceResponse>;',
         '    } finally {',
@@ -627,6 +781,10 @@ function tsClient(erpSystem, paths) {
         '    fn: () => Promise<ErpSurfaceResponse>,',
         '    payload: unknown,',
         '  ): Promise<ErpSurfaceResponse> {',
+        '    // ADR-072: Validate wire payload before sending or queuing',
+        '    validateWirePayload(operation, payload);',
+        '    // ADR-076: Shield outbound scan — block if PII, secrets, or credentials detected',
+        '    await shieldScanOutbound(payload, operation, correlationId);',
         '    await this.auditBefore(operation, entityId, correlationId, payload);',
         '    try {',
         '      const result = await this.breaker.execute(() => withRetry(fn));',
@@ -635,19 +793,24 @@ function tsClient(erpSystem, paths) {
         '      return result;',
         '    } catch (err) {',
         '      this.recordError(operation, err);',
+        '      const errorMsg = err instanceof Error ? err.message : String(err);',
         '      // ADR-049: Audit the failure before queuing',
-        '      await this.auditAfter(operation, entityId, correlationId, { status: \'queued\', error: err instanceof Error ? err.message : String(err) });',
-        '      // ADR-056: Deduplicate before queuing — prevent duplicate entries for same operation+correlationId',
-        '      const isDuplicate = this.syncQueue.some(e => e.operation === operation && e.id === correlationId);',
-        '      if (!isDuplicate) {',
-        '        this.syncQueue.push({',
-        '          id: correlationId,',
-        '          operation,',
-        '          payload,',
-        '          created_at: new Date().toISOString(),',
-        '          retry_count: 0,',
-        '          last_error: err instanceof Error ? err.message : String(err),',
-        '        });',
+        '      await this.auditAfter(operation, entityId, correlationId, { status: \'queued\', error: errorMsg });',
+        '      // ADR-072: Persist to sync_queue table (survives instance restarts)',
+        '      if (this.db) {',
+        '        const { randomUUID } = await import(\'node:crypto\');',
+        '        const idempotencyKey = `${correlationId}-${operation}`;',
+        '        try {',
+        '          await this.db.execute(',
+        '            \'INSERT INTO sync_queue (id, operation, payload, idempotency_key, status, created_at, error_message, correlation_id) VALUES (:1, :2, :3, :4, :5, :6, :7, :8)\',',
+        '            [randomUUID(), operation, JSON.stringify(payload), idempotencyKey, \'pending\', new Date().toISOString(), errorMsg, correlationId],',
+        '          );',
+        '        } catch (dbErr) {',
+        '          // ADR-072: idempotency_key UNIQUE constraint prevents duplicates',
+        '          if (!(dbErr instanceof Error && dbErr.message.includes(\'UNIQUE\'))) {',
+        '            console.error(JSON.stringify({ level: \'error\', type: \'SYNC_QUEUE_INSERT_FAILED\', correlationId, error: dbErr instanceof Error ? dbErr.message : String(dbErr) }));',
+        '          }',
+        '        }',
         '      }',
         '      // Return a queued response so domain services can continue',
         '      return {',
@@ -779,6 +942,38 @@ function tsRetry() {
         '      this.failures++;',
         '      if (this.failures >= this.threshold) {',
         '        this.openedAt = Date.now();',
+        '        // ADR-077: Alert Sentinel when circuit breaker opens',
+        '        const sentinelUrl = process.env.AGENTICS_SENTINEL_URL;',
+        '        if (sentinelUrl) {',
+        '          fetch(`${sentinelUrl}/api/v1/alert`, {',
+        '            method: \'POST\',',
+        '            headers: { \'Content-Type\': \'application/json\' },',
+        '            body: JSON.stringify({',
+        '              type: \'circuit_breaker_open\',',
+        '              service: \'erp\',',
+        '              threshold: this.threshold,',
+        '              failures: this.failures,',
+        '              timestamp: new Date().toISOString(),',
+        '            }),',
+        '            signal: AbortSignal.timeout(5_000),',
+        '          }).catch(() => { /* operational tier */ });',
+        '        }',
+        '        // ADR-079: Escalate circuit breaker open to Incident-Manager',
+        '        const incidentUrl = process.env.AGENTICS_INCIDENT_URL;',
+        '        if (incidentUrl) {',
+        '          fetch(`${incidentUrl}/api/v1/escalate`, {',
+        '            method: \'POST\',',
+        '            headers: { \'Content-Type\': \'application/json\' },',
+        '            body: JSON.stringify({',
+        '              severity: \'high\',',
+        '              type: \'circuit_breaker_open\',',
+        '              service: \'erp\',',
+        '              context: { threshold: this.threshold, failures: this.failures },',
+        '              timestamp: new Date().toISOString(),',
+        '            }),',
+        '            signal: AbortSignal.timeout(5_000),',
+        '          }).catch(() => { /* operational tier */ });',
+        '        }',
         '      }',
         '      throw err;',
         '    }',
@@ -790,6 +985,62 @@ function tsRetry() {
         '  }',
         '}',
         '',
+        '// ADR-084: Token bucket rate limiter for ERP API quota protection',
+        'export class TokenBucketRateLimiter {',
+        '  private tokens: number;',
+        '  private lastRefill: number;',
+        '',
+        '  constructor(',
+        '    private readonly maxTokens: number = 10,',
+        '    private readonly refillRate: number = 2, // tokens per second',
+        '  ) {',
+        '    this.tokens = maxTokens;',
+        '    this.lastRefill = Date.now();',
+        '  }',
+        '',
+        '  async acquire(): Promise<void> {',
+        '    this.refill();',
+        '    if (this.tokens < 1) {',
+        '      const waitMs = (1 / this.refillRate) * 1000;',
+        '      await new Promise(resolve => setTimeout(resolve, waitMs));',
+        '      this.refill();',
+        '    }',
+        '    this.tokens--;',
+        '  }',
+        '',
+        '  private refill(): void {',
+        '    const now = Date.now();',
+        '    const elapsed = (now - this.lastRefill) / 1000;',
+        '    this.tokens = Math.min(this.maxTokens, this.tokens + elapsed * this.refillRate);',
+        '    this.lastRefill = now;',
+        '  }',
+        '}',
+        '',
+        '// ADR-084: ERP error translator — maps vendor error codes to domain exceptions',
+        'export function translateErpError(status: number, body: string, operation: string): Error {',
+        '  try {',
+        '    const parsed = JSON.parse(body);',
+        "    const code = parsed?.error?.code ?? parsed?.code ?? '';",
+        "    const message = parsed?.error?.message ?? parsed?.message ?? body;",
+        '',
+        '    const knownErrors: Record<string, { status: number; domain: string }> = {',
+        "      'INVALID_SEARCH_FILTER': { status: 400, domain: 'Invalid query parameters' },",
+        "      'INSUFFICIENT_PERMISSION': { status: 403, domain: 'ERP permission denied' },",
+        "      'RECORD_LOCKED': { status: 409, domain: 'Record locked by another user' },",
+        "      'RECORD_NOT_FOUND': { status: 404, domain: 'ERP record not found' },",
+        "      'RATE_LIMIT_EXCEEDED': { status: 429, domain: 'ERP rate limit exceeded — retry later' },",
+        "      'CONCURRENCY_VIOLATION': { status: 409, domain: 'Record modified by another user' },",
+        "      'INVALID_KEY_OR_REF': { status: 400, domain: 'Invalid reference or foreign key' },",
+        '    };',
+        '',
+        '    const known = knownErrors[code];',
+        '    if (known) return new Error(`[ERP-${known.status}] ${known.domain}: ${message}`);',
+        '    return new Error(`[ERP-${status}] ${operation} failed: ${message}`);',
+        '  } catch {',
+        '    return new Error(`[ERP-${status}] ${operation} failed: ${body.slice(0, 200)}`);',
+        '  }',
+        '}',
+        '',
     ].join('\n');
 }
 // ============================================================================