@open-mercato/core 0.8.1-develop.7241.1.fad7b2ce2a → 0.8.1-develop.7261.1.5d42353f61

package/src/modules/customers/components/formConfig.tsx

@@ -59,7 +59,7 @@ import {
   type CustomerDictionaryKind,
 } from '../lib/dictionaries'
 import { normalizeCustomFieldSubmitValue } from './detail/customFieldUtils'
-import { CUSTOMER_PHONE_INVALID_MESSAGE_KEY } from '../data/validators'
+import { CUSTOMER_PHONE_INVALID_MESSAGE_KEY, CUSTOMER_URL_INVALID_MESSAGE_KEY } from '../data/validators'
 
 export const metadata = {
   navHidden: true,
@@ -1199,7 +1199,7 @@ export const createCompanyFormSchema = () =>
       websiteUrl: z
         .string()
         .trim()
-        .url()
+        .url(CUSTOMER_URL_INVALID_MESSAGE_KEY)
         .optional()
         .or(z.literal(''))
         .transform((val) => (val === '' ? undefined : val))
@@ -1559,7 +1559,7 @@ const clearableUrlField = () =>
   z
     .string()
     .trim()
-    .url()
+    .url(CUSTOMER_URL_INVALID_MESSAGE_KEY)
     .optional()
     .or(z.literal(''))
     .transform((val) => (val === '' ? null : val))

package/src/modules/customers/data/validators.ts

@@ -6,6 +6,7 @@ import { dictionaryEntrySortModeSchema } from '@open-mercato/core/modules/dictio
 const uuid = () => z.string().uuid()
 
 export const CUSTOMER_PHONE_INVALID_MESSAGE_KEY = 'customers.people.form.primaryPhone.invalid'
+export const CUSTOMER_URL_INVALID_MESSAGE_KEY = 'customers.people.form.websiteUrl.invalid'
 export const ACTIVITY_DATE_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.dateRequired'
 export const ACTIVITY_TIME_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.timeRequired'
 export const ACTIVITY_PHONE_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.phoneRequired'
@@ -41,7 +42,7 @@ const clearableEmailSchema = z.preprocess(
 
 const clearableUrlSchema = z.preprocess(
   emptyStringToNull,
-  z.string().url().max(300).nullable().optional(),
+  z.string().url(CUSTOMER_URL_INVALID_MESSAGE_KEY).max(300).nullable().optional(),
 )
 
 // Domain is a plain (non-URL) string that maps to a nullable column, so blanking

package/src/modules/customers/i18n/de.json

@@ -2352,6 +2352,7 @@
   "customers.people.form.twitterUrl": "X / Twitter",
   "customers.people.form.twitterUrl.placeholder": "https://x.com/beispiel",
   "customers.people.form.updateSuccess": "Person aktualisiert.",
+  "customers.people.form.websiteUrl.invalid": "Geben Sie eine gültige URL ein (z. B. https://example.com)",
   "customers.people.list.actions.delete": "Löschen",
   "customers.people.list.actions.new": "Neue Person",
   "customers.people.list.actions.openInNewTab": "In neuem Tab öffnen",

package/src/modules/customers/i18n/en.json

@@ -2352,6 +2352,7 @@
   "customers.people.form.twitterUrl": "X / Twitter",
   "customers.people.form.twitterUrl.placeholder": "https://x.com/example",
   "customers.people.form.updateSuccess": "Person updated.",
+  "customers.people.form.websiteUrl.invalid": "Enter a valid URL (e.g. https://example.com)",
   "customers.people.list.actions.delete": "Delete",
   "customers.people.list.actions.new": "New Person",
   "customers.people.list.actions.openInNewTab": "Open in new tab",

package/src/modules/customers/i18n/es.json

@@ -2352,6 +2352,7 @@
   "customers.people.form.twitterUrl": "X / Twitter",
   "customers.people.form.twitterUrl.placeholder": "https://x.com/ejemplo",
   "customers.people.form.updateSuccess": "Persona actualizada.",
+  "customers.people.form.websiteUrl.invalid": "Introduce una URL válida (p. ej., https://example.com)",
   "customers.people.list.actions.delete": "Eliminar",
   "customers.people.list.actions.new": "Nueva persona",
   "customers.people.list.actions.openInNewTab": "Abrir en nueva pestaña",

package/src/modules/customers/i18n/ko.json

@@ -2352,6 +2352,7 @@
   "customers.people.form.twitterUrl": "X / Twitter",
   "customers.people.form.twitterUrl.placeholder": "https://x.com/example",
   "customers.people.form.updateSuccess": "연락처가 업데이트되었습니다.",
+  "customers.people.form.websiteUrl.invalid": "올바른 URL을 입력하세요 (예: https://example.com)",
   "customers.people.list.actions.delete": "삭제",
   "customers.people.list.actions.new": "새 연락처",
   "customers.people.list.actions.openInNewTab": "새 탭에서 열기",

package/src/modules/customers/i18n/pl.json

@@ -2352,6 +2352,7 @@
   "customers.people.form.twitterUrl": "X / Twitter",
   "customers.people.form.twitterUrl.placeholder": "https://x.com/przyklad",
   "customers.people.form.updateSuccess": "Osoba została zaktualizowana.",
+  "customers.people.form.websiteUrl.invalid": "Podaj prawidłowy adres URL (np. https://example.com)",
   "customers.people.list.actions.delete": "Usuń",
   "customers.people.list.actions.new": "Nowa osoba",
   "customers.people.list.actions.openInNewTab": "Otwórz w nowej karcie",

package/src/modules/data_sync/AGENTS.md

@@ -288,7 +288,7 @@ Data sync providers can leverage the **Unified Module Extension System (UMES)**
 
 - `ProgressTopBar` and sync-run detail pages use `progress.job.*` SSE updates for live progress.
 - Create `ProgressJob` in `run`/`retry` endpoints; start/update/complete/fail in `sync-engine`.
-- The engine heartbeats (`touchJobHeartbeat`, forked-EM) on a timer while an adapter batch is being produced, because batches can outlast the 60s stale-job sweep — keep the `withHeartbeat` wrapper around `streamImport`/`streamExport` when touching the batch loops.
+- The engine heartbeats (`touchJobHeartbeat`, forked-EM) on a timer for the whole life of the batch stream — while an adapter batch is being produced AND while the per-batch consumer body commits progress, refreshes coverage snapshots and writes logs — because either side can outlast the 60s stale-job sweep. Keep the `withHeartbeat` wrapper around `streamImport`/`streamExport` when touching the batch loops, and keep its interval armed once per stream rather than restarted per read. Because that interval now fires during the consumer body, where `commitBatchProgress` holds the shared `EntityManager` inside `em.begin()`/`em.commit()`, **every callback on this timer MUST use a forked EM** — both `touchJobHeartbeat` and the `isCancellationRequested` poll do. Adding a third tick callback that reads on the shared EM would interleave with that open transaction, and the tick swallows its own errors, so the damage would surface somewhere else entirely.
 - On redelivery the progress counter is seeded from the progress job's own `processedCount` (`progressService.getJob`), mirroring how `committedBatches` resumes — never reset it to zero (`updateProgress` writes absolute counts) and never seed it from the run's `created/updated/skipped/failed` columns: those count emitted items, while progress counts source records (`batch.processedCount`), and adapters may emit several items per source record.
 - Include `progressJob` details in run detail response.
 - SSE DOM bridge forwards only events with `clientBroadcast: true`.

package/src/modules/data_sync/lib/sync-engine.ts

@@ -166,9 +166,6 @@ function applyExportCounters(batch: ExportBatch): SyncCounterDelta {
 // the per-interval round-trips for the whole life of a run.
 const HEARTBEAT_TICK_MS = (STALE_JOB_TIMEOUT_SECONDS * 1000) / 4
 
-// Runs `tick` on an interval only while the source iterator is pending, so heartbeats
-// stop the moment the producer dies and genuinely stale jobs still get swept. The outer
-// finally closes the adapter generator on early exits (cancellation, ownership conflict).
 // Our own abort, as opposed to a failure that merely coincided with one. Adapters are told to
 // return rather than throw, but `signal.throwIfAborted()` and an aborted `fetch` both surface as
 // this, and either is a cancellation rather than a fault.
@@ -182,21 +179,33 @@ function isAbortError(error: unknown): boolean {
   return typeof error === 'object' && error !== null && (error as { name?: unknown }).name === 'AbortError'
 }
 
+// The interval is armed once and spans the whole iteration, the `yield` included, rather than being
+// restarted around each `next()`. Producing a batch is not the only thing that can outlast the stale
+// sweep: the consumer body between `yield` and the next `next()` commits batch progress, refreshes
+// coverage snapshots, logs item failures and writes the operational log, and a coverage refresh over
+// a large query index is slow enough that a per-read timer left that window unheartbeated (#5370).
+// The generator body does not start until the first `next()`, so a stream nobody consumes still arms
+// nothing. Every way out of `forEachBatch` — drain, early close, a throwing read, a throwing consumer —
+// either completes this generator or calls `return()` on it, so the `finally` below always clears the
+// timer. That last part is a property of the consumer rather than of this helper: a consumer that
+// abandoned the generator mid-`yield` without closing it would leak the interval, which the old
+// per-read arming could not do. Any new consumer must honour `IteratorClose`.
+//
+// Every callback on this timer MUST use a forked EntityManager. The window now covers the consumer
+// body, where `commitBatchProgress` holds the shared EM inside `em.begin()`/`em.commit()`, so a tick
+// that read on the shared EM would issue a query into that open transaction and interleave with its
+// UnitOfWork — the shape `packages/core/AGENTS.md` bans and `withAtomicFlush` cannot guard against.
 async function* withHeartbeat<T>(source: AsyncIterable<T>, tick: () => void, intervalMs: number): AsyncGenerator<T, void, undefined> {
   const iterator = source[Symbol.asyncIterator]()
+  const timer = setInterval(tick, intervalMs)
   try {
     while (true) {
-      const timer = setInterval(tick, intervalMs)
-      let result: IteratorResult<T>
-      try {
-        result = await iterator.next()
-      } finally {
-        clearInterval(timer)
-      }
+      const result = await iterator.next()
       if (result.done) return
       yield result.value
     }
   } finally {
+    clearInterval(timer)
     await iterator.return?.()
   }
 }
@@ -271,8 +280,10 @@ export function createSyncEngine(deps: EngineDeps) {
 
   // Rides the heartbeat timer, which is the only thing that runs while the adapter is still
   // producing a batch — the engine's own cancellation check sits in the batch handler and is
-  // reached only after a yield. Swallows its own errors because it runs on a timer, where an
-  // unhandled rejection is fatal, and stops polling once it has aborted.
+  // reached only after a yield. Since that timer now spans the consumer body too, a cancel is
+  // also observed during the per-batch bookkeeping rather than waiting out the next read.
+  // Swallows its own errors because it runs on a timer, where an unhandled rejection is fatal,
+  // and stops polling once it has aborted.
   function makeCancellationTick(progressJobId: string | null | undefined, scope: SyncScope, controller: AbortController): () => void {
     if (!progressJobId) return () => {}
     let inFlight = false

package/src/modules/data_sync/lib/sync-schedule-service.ts

@@ -3,8 +3,12 @@ import type { AwilixContainer } from 'awilix'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { findAndCountWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { enforceCommandOptimisticLockWithGuards, enforceRecordGoneIsConflict } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { SyncSchedule } from '../data/entities'
 
+const logger = createLogger('data_sync').child({ component: 'sync-schedule-service' })
+
 type SyncScope = {
   organizationId: string
   tenantId: string
@@ -236,11 +240,58 @@ export function createSyncScheduleService(em: EntityManager, schedulerService?:
       }
 
       const scheduledJobId = row.scheduledJobId ?? row.id
+      const wasEnabled = row.isEnabled
       await requireScheduler().unregister(scheduledJobId)
 
-      row.deletedAt = new Date()
-      row.isEnabled = false
-      await em.flush()
+      try {
+        row.deletedAt = new Date()
+        row.isEnabled = false
+        await em.flush()
+      } catch (error) {
+        try {
+          await requireScheduler().register({
+            id: scheduledJobId,
+            name: buildScheduleName(row),
+            description: buildScheduleDescription(row),
+            scopeType: 'organization',
+            organizationId: scope.organizationId,
+            tenantId: scope.tenantId,
+            scheduleType: row.scheduleType,
+            scheduleValue: row.scheduleValue,
+            timezone: row.timezone,
+            targetType: 'queue',
+            targetQueue: 'data-sync-scheduled',
+            targetPayload: {
+              scheduleId: row.id,
+              scope,
+            },
+            requireFeature: 'data_sync.run',
+            sourceType: 'module',
+            sourceModule: 'data_sync',
+            isEnabled: wasEnabled,
+          })
+        } catch (compensationError) {
+          logger.error('Failed to restore scheduled job after a failed schedule delete', {
+            scheduledJobId,
+            scheduleId: row.id,
+            organizationId: scope.organizationId,
+            tenantId: scope.tenantId,
+            error: compensationError instanceof Error ? compensationError.message : String(compensationError),
+          })
+          getTelemetryRuntime()?.reportError(compensationError, {
+            module: 'data_sync',
+            code: 'data_sync.schedule_delete_compensation_failed',
+            attributes: {
+              scheduledJobId,
+              scheduleId: row.id,
+              organizationId: scope.organizationId,
+              tenantId: scope.tenantId,
+            },
+          })
+        }
+        throw error
+      }
+
       return true
     },
   }

package/src/modules/progress/lib/progressServiceImpl.ts

@@ -634,10 +634,16 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     },
 
     async isCancellationRequested(jobId, tenantId, organizationId) {
+      // Forked EM, for the same reason touchJobHeartbeat forks: this is polled from the
+      // keepalive timer, which spans the producer's own transactional writes on the shared
+      // EM, so an unawaited poll would issue a SELECT into an open em.begin()/em.commit()
+      // window and interleave with its UnitOfWork. Every caller only reads the flag, so a
+      // fork costs nothing and no caller depends on joining an ambient transaction.
+      //
       // disableIdentityMap forces a fresh read: a managed copy of the job in this
       // EntityManager (loaded by updateProgress) must never mask a cancellation
       // requested from another process.
-      const job = await findOneWithDecryption(em, ProgressJob, {
+      const job = await findOneWithDecryption(em.fork(), ProgressJob, {
         id: jobId,
         tenantId,
         ...(organizationId ? { organizationId } : {}),