@open-mercato/core 0.8.1-develop.7241.1.fad7b2ce2a → 0.8.1-develop.7254.1.ab24f26208

package/src/modules/customers/ai-tools/activities-tasks-pack.ts

@@ -77,41 +77,56 @@ async function loadDealForScope(
 /**
  * `CustomerDeal` does NOT carry a direct `entity` field — deals are linked
  * to people / companies via the `customer_deal_person_links` and
- * `customer_deal_company_links` tables. Comments however need a non-null
- * `entity_id` (the timeline owner) so this helper resolves the deal's
- * first linked person, then falls back to its first linked company. When
- * neither exists, the caller MUST instruct the operator to link a contact
- * before commenting on the deal.
+ * `customer_deal_company_links` tables. Comments and activities however need
+ * a non-null `entity_id` (the timeline owner) so this helper resolves the
+ * deal's primary linked person, then the oldest person, then the oldest company.
+ * When neither exists, the caller MUST instruct the operator to link a
+ * contact before writing to the deal.
+ *
+ * The relations are `CustomerDealPersonLink.person` and
+ * `CustomerDealCompanyLink.company` (#6119): populating them under any other
+ * name makes MikroORM reject the query, so every write failed even for a deal
+ * with linked contacts.
+ *
+ * The link tables carry no `tenant_id` / `organization_id` column either, so the
+ * deal id is the whole criterion — the same query `api/deals/[id]/route.ts` runs.
+ * Callers pass a deal already returned by `loadDealForScope`; that check is what
+ * keeps the lookup inside the caller's tenant and organization.
  */
-async function resolveDealCommentEntityId(
-  em: EntityManager,
-  ctx: CustomersToolContext,
-  tenantId: string,
-  dealId: string,
-): Promise<string | null> {
+async function resolveDealLinkedEntityId(em: EntityManager, dealId: string): Promise<string | null> {
   const personLink = await em.findOne(
     CustomerDealPersonLink,
-    { deal: dealId, tenantId } as never,
-    { populate: ['personEntity'] as never },
+    { deal: dealId } as never,
+    {
+      populate: ['person'] as never,
+      orderBy: { isPrimary: 'DESC', createdAt: 'ASC', id: 'ASC' },
+    },
   )
-  if (personLink) {
-    const linked = (personLink as unknown as { personEntity?: { id?: string | null } | null }).personEntity
-    if (linked && typeof linked === 'object' && typeof linked.id === 'string') return linked.id
-    const raw = (personLink as unknown as { personEntity?: unknown }).personEntity
-    if (typeof raw === 'string') return raw
-  }
+  const personId = linkedEntityIdOf(personLink, 'person')
+  if (personId) return personId
   const companyLink = await em.findOne(
     CustomerDealCompanyLink,
-    { deal: dealId, tenantId } as never,
-    { populate: ['companyEntity'] as never },
+    { deal: dealId } as never,
+    {
+      populate: ['company'] as never,
+      orderBy: { createdAt: 'ASC', id: 'ASC' },
+    },
   )
-  if (companyLink) {
-    const linked = (companyLink as unknown as { companyEntity?: { id?: string | null } | null }).companyEntity
-    if (linked && typeof linked === 'object' && typeof linked.id === 'string') return linked.id
-    const raw = (companyLink as unknown as { companyEntity?: unknown }).companyEntity
-    if (typeof raw === 'string') return raw
+  return linkedEntityIdOf(companyLink, 'company')
+}
+
+/** Id of a populated relation, or the raw foreign key when it was not loaded. */
+function linkedEntityIdOf(row: unknown, relation: 'person' | 'company'): string | null {
+  if (!row || typeof row !== 'object') return null
+  const value = (row as Record<string, unknown>)[relation]
+  if (value && typeof value === 'object' && typeof (value as { id?: unknown }).id === 'string') {
+    return (value as { id: string }).id
   }
-  return null
+  return typeof value === 'string' ? value : null
+}
+
+function dealHasNoLinkedContactMessage(dealId: string, what: 'comment' | 'activity'): string {
+  return `Deal "${dealId}" has no linked person or company. Link a contact to the deal in the backoffice before adding ${what === 'comment' ? 'a comment' : 'an activity'}, or post the ${what} directly on the person/company record instead.`
 }
 
 async function loadCommentForScope(
@@ -493,11 +508,9 @@ const manageDealCommentTool: CustomersAiToolDefinition = {
       // people/companies via two link tables. Resolve the first available
       // person, then fall back to the first linked company. Only fail the
       // operation when the deal has no linked contacts at all.
-      const dealEntityId = await resolveDealCommentEntityId(em, ctx, tenantId, deal.id)
+      const dealEntityId = await resolveDealLinkedEntityId(em, deal.id)
       if (!dealEntityId) {
-        throw new Error(
-          `Deal "${deal.id}" has no linked person or company. Link a contact to the deal in the backoffice before adding a comment, or post the comment directly on the person/company record instead.`,
-        )
+        throw new Error(dealHasNoLinkedContactMessage(deal.id, 'comment'))
       }
       const body: Record<string, unknown> = {
         tenantId,
@@ -656,15 +669,12 @@ const manageDealActivityTool: CustomersAiToolDefinition = {
       if (!deal) throw new Error(`Deal "${input.dealId}" is not accessible to the caller.`)
       const organizationId = deal.organizationId
       if (!organizationId) throw new Error(`Deal "${deal.id}" has no organization scope.`)
-      const dealEntity = (deal as unknown as { entity?: unknown }).entity
-      const entityId =
-        dealEntity && typeof dealEntity === 'object'
-          ? (dealEntity as { id?: string | null }).id ?? null
-          : typeof dealEntity === 'string'
-            ? dealEntity
-            : null
+      // Same rule as the comment tool (#6119): `CustomerDeal` has no `.entity`,
+      // the activity's timeline owner is the deal's first linked person, then
+      // its first linked company.
+      const entityId = await resolveDealLinkedEntityId(em, deal.id)
       if (!entityId) {
-        throw new Error(`Deal "${deal.id}" has no associated person/company; cannot attach an activity.`)
+        throw new Error(dealHasNoLinkedContactMessage(deal.id, 'activity'))
       }
       const body: Record<string, unknown> = {
         tenantId,

package/src/modules/customers/commands/companies.ts

@@ -1035,6 +1035,14 @@ const deleteCompanyCommand: CommandHandler<{ body?: Record<string, unknown>; que
         }
 
         await em.nativeUpdate(CustomerPersonProfile, { company: record }, { company: null })
+        // Soft-deleted person links keep their `company_entity_id` foreign key, so the hard
+        // delete below would violate it. The guard above already proved no active link
+        // remains, and restricting the filter to `deletedAt != null` keeps that guarantee.
+        await em.nativeDelete(CustomerPersonCompanyLink, {
+          company: record,
+          deletedAt: { $ne: null },
+          ...dependentScope,
+        })
         await em.nativeDelete(CustomerDealCompanyLink, { company: record })
         await em.nativeDelete(CustomerActivity, { entity: record, organizationId: record.organizationId, tenantId: record.tenantId })
         await em.nativeDelete(CustomerInteraction, { entity: record, organizationId: record.organizationId, tenantId: record.tenantId })

package/src/modules/data_sync/AGENTS.md

@@ -288,7 +288,7 @@ Data sync providers can leverage the **Unified Module Extension System (UMES)**
 
 - `ProgressTopBar` and sync-run detail pages use `progress.job.*` SSE updates for live progress.
 - Create `ProgressJob` in `run`/`retry` endpoints; start/update/complete/fail in `sync-engine`.
-- The engine heartbeats (`touchJobHeartbeat`, forked-EM) on a timer while an adapter batch is being produced, because batches can outlast the 60s stale-job sweep — keep the `withHeartbeat` wrapper around `streamImport`/`streamExport` when touching the batch loops.
+- The engine heartbeats (`touchJobHeartbeat`, forked-EM) on a timer for the whole life of the batch stream — while an adapter batch is being produced AND while the per-batch consumer body commits progress, refreshes coverage snapshots and writes logs — because either side can outlast the 60s stale-job sweep. Keep the `withHeartbeat` wrapper around `streamImport`/`streamExport` when touching the batch loops, and keep its interval armed once per stream rather than restarted per read. Because that interval now fires during the consumer body, where `commitBatchProgress` holds the shared `EntityManager` inside `em.begin()`/`em.commit()`, **every callback on this timer MUST use a forked EM** — both `touchJobHeartbeat` and the `isCancellationRequested` poll do. Adding a third tick callback that reads on the shared EM would interleave with that open transaction, and the tick swallows its own errors, so the damage would surface somewhere else entirely.
 - On redelivery the progress counter is seeded from the progress job's own `processedCount` (`progressService.getJob`), mirroring how `committedBatches` resumes — never reset it to zero (`updateProgress` writes absolute counts) and never seed it from the run's `created/updated/skipped/failed` columns: those count emitted items, while progress counts source records (`batch.processedCount`), and adapters may emit several items per source record.
 - Include `progressJob` details in run detail response.
 - SSE DOM bridge forwards only events with `clientBroadcast: true`.

package/src/modules/data_sync/lib/sync-engine.ts

@@ -166,9 +166,6 @@ function applyExportCounters(batch: ExportBatch): SyncCounterDelta {
 // the per-interval round-trips for the whole life of a run.
 const HEARTBEAT_TICK_MS = (STALE_JOB_TIMEOUT_SECONDS * 1000) / 4
 
-// Runs `tick` on an interval only while the source iterator is pending, so heartbeats
-// stop the moment the producer dies and genuinely stale jobs still get swept. The outer
-// finally closes the adapter generator on early exits (cancellation, ownership conflict).
 // Our own abort, as opposed to a failure that merely coincided with one. Adapters are told to
 // return rather than throw, but `signal.throwIfAborted()` and an aborted `fetch` both surface as
 // this, and either is a cancellation rather than a fault.
@@ -182,21 +179,33 @@ function isAbortError(error: unknown): boolean {
   return typeof error === 'object' && error !== null && (error as { name?: unknown }).name === 'AbortError'
 }
 
+// The interval is armed once and spans the whole iteration, the `yield` included, rather than being
+// restarted around each `next()`. Producing a batch is not the only thing that can outlast the stale
+// sweep: the consumer body between `yield` and the next `next()` commits batch progress, refreshes
+// coverage snapshots, logs item failures and writes the operational log, and a coverage refresh over
+// a large query index is slow enough that a per-read timer left that window unheartbeated (#5370).
+// The generator body does not start until the first `next()`, so a stream nobody consumes still arms
+// nothing. Every way out of `forEachBatch` — drain, early close, a throwing read, a throwing consumer —
+// either completes this generator or calls `return()` on it, so the `finally` below always clears the
+// timer. That last part is a property of the consumer rather than of this helper: a consumer that
+// abandoned the generator mid-`yield` without closing it would leak the interval, which the old
+// per-read arming could not do. Any new consumer must honour `IteratorClose`.
+//
+// Every callback on this timer MUST use a forked EntityManager. The window now covers the consumer
+// body, where `commitBatchProgress` holds the shared EM inside `em.begin()`/`em.commit()`, so a tick
+// that read on the shared EM would issue a query into that open transaction and interleave with its
+// UnitOfWork — the shape `packages/core/AGENTS.md` bans and `withAtomicFlush` cannot guard against.
 async function* withHeartbeat<T>(source: AsyncIterable<T>, tick: () => void, intervalMs: number): AsyncGenerator<T, void, undefined> {
   const iterator = source[Symbol.asyncIterator]()
+  const timer = setInterval(tick, intervalMs)
   try {
     while (true) {
-      const timer = setInterval(tick, intervalMs)
-      let result: IteratorResult<T>
-      try {
-        result = await iterator.next()
-      } finally {
-        clearInterval(timer)
-      }
+      const result = await iterator.next()
       if (result.done) return
       yield result.value
     }
   } finally {
+    clearInterval(timer)
     await iterator.return?.()
   }
 }
@@ -271,8 +280,10 @@ export function createSyncEngine(deps: EngineDeps) {
 
   // Rides the heartbeat timer, which is the only thing that runs while the adapter is still
   // producing a batch — the engine's own cancellation check sits in the batch handler and is
-  // reached only after a yield. Swallows its own errors because it runs on a timer, where an
-  // unhandled rejection is fatal, and stops polling once it has aborted.
+  // reached only after a yield. Since that timer now spans the consumer body too, a cancel is
+  // also observed during the per-batch bookkeeping rather than waiting out the next read.
+  // Swallows its own errors because it runs on a timer, where an unhandled rejection is fatal,
+  // and stops polling once it has aborted.
   function makeCancellationTick(progressJobId: string | null | undefined, scope: SyncScope, controller: AbortController): () => void {
     if (!progressJobId) return () => {}
     let inFlight = false

package/src/modules/data_sync/lib/sync-schedule-service.ts

@@ -3,8 +3,12 @@ import type { AwilixContainer } from 'awilix'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { findAndCountWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { enforceCommandOptimisticLockWithGuards, enforceRecordGoneIsConflict } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { SyncSchedule } from '../data/entities'
 
+const logger = createLogger('data_sync').child({ component: 'sync-schedule-service' })
+
 type SyncScope = {
   organizationId: string
   tenantId: string
@@ -236,11 +240,58 @@ export function createSyncScheduleService(em: EntityManager, schedulerService?:
       }
 
       const scheduledJobId = row.scheduledJobId ?? row.id
+      const wasEnabled = row.isEnabled
       await requireScheduler().unregister(scheduledJobId)
 
-      row.deletedAt = new Date()
-      row.isEnabled = false
-      await em.flush()
+      try {
+        row.deletedAt = new Date()
+        row.isEnabled = false
+        await em.flush()
+      } catch (error) {
+        try {
+          await requireScheduler().register({
+            id: scheduledJobId,
+            name: buildScheduleName(row),
+            description: buildScheduleDescription(row),
+            scopeType: 'organization',
+            organizationId: scope.organizationId,
+            tenantId: scope.tenantId,
+            scheduleType: row.scheduleType,
+            scheduleValue: row.scheduleValue,
+            timezone: row.timezone,
+            targetType: 'queue',
+            targetQueue: 'data-sync-scheduled',
+            targetPayload: {
+              scheduleId: row.id,
+              scope,
+            },
+            requireFeature: 'data_sync.run',
+            sourceType: 'module',
+            sourceModule: 'data_sync',
+            isEnabled: wasEnabled,
+          })
+        } catch (compensationError) {
+          logger.error('Failed to restore scheduled job after a failed schedule delete', {
+            scheduledJobId,
+            scheduleId: row.id,
+            organizationId: scope.organizationId,
+            tenantId: scope.tenantId,
+            error: compensationError instanceof Error ? compensationError.message : String(compensationError),
+          })
+          getTelemetryRuntime()?.reportError(compensationError, {
+            module: 'data_sync',
+            code: 'data_sync.schedule_delete_compensation_failed',
+            attributes: {
+              scheduledJobId,
+              scheduleId: row.id,
+              organizationId: scope.organizationId,
+              tenantId: scope.tenantId,
+            },
+          })
+        }
+        throw error
+      }
+
       return true
     },
   }

package/src/modules/progress/lib/progressServiceImpl.ts

@@ -634,10 +634,16 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     },
 
     async isCancellationRequested(jobId, tenantId, organizationId) {
+      // Forked EM, for the same reason touchJobHeartbeat forks: this is polled from the
+      // keepalive timer, which spans the producer's own transactional writes on the shared
+      // EM, so an unawaited poll would issue a SELECT into an open em.begin()/em.commit()
+      // window and interleave with its UnitOfWork. Every caller only reads the flag, so a
+      // fork costs nothing and no caller depends on joining an ambient transaction.
+      //
       // disableIdentityMap forces a fresh read: a managed copy of the job in this
       // EntityManager (loaded by updateProgress) must never mask a cancellation
       // requested from another process.
-      const job = await findOneWithDecryption(em, ProgressJob, {
+      const job = await findOneWithDecryption(em.fork(), ProgressJob, {
         id: jobId,
         tenantId,
         ...(organizationId ? { organizationId } : {}),