@open-mercato/core 0.8.1-develop.7295.1.d0e0e33014 → 0.8.1-develop.7297.1.67605e74f9

package/dist/modules/query_index/lib/stale.js

@@ -1,4 +1,9 @@
 import { sql } from "kysely";
+import { recordIndexerError } from "@open-mercato/shared/lib/indexers/error-log";
+async function searchTokensTableExists(db) {
+  const row = await db.selectFrom("information_schema.tables").select(sql`1`.as("one")).where("table_name", "=", "search_tokens").limit(1).executeTakeFirst();
+  return !!row;
+}
 async function purgeOrphans(db, options) {
   const { entityType, tenantId, partitionIndex, partitionCount, startedAt } = options;
   let q = db.deleteFrom("entity_indexes").where("entity_type", "=", entityType);
@@ -16,6 +21,43 @@ async function purgeOrphans(db, options) {
     q = q.where("entity_id", "not in", options.excludeRecordIds);
   }
   await q.execute();
+  try {
+    if (!await searchTokensTableExists(db)) return;
+    let tokens = db.deleteFrom("search_tokens").where("entity_type", "=", entityType);
+    if (tenantId !== void 0) {
+      tokens = tenantId === null ? tokens.where("tenant_id", "is", null) : tokens.where("tenant_id", "=", tenantId);
+    }
+    if (options.organizationId !== void 0) {
+      tokens = options.organizationId === null ? tokens.where("organization_id", "is", null) : tokens.where("organization_id", "=", options.organizationId);
+    }
+    if (partitionIndex != null && partitionCount != null) {
+      tokens = tokens.where(sql`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`);
+    }
+    tokens = tokens.where("created_at", "<", startedAt);
+    if (options.excludeRecordIds?.length) {
+      tokens = tokens.where("entity_id", "not in", options.excludeRecordIds);
+    }
+    tokens = tokens.where(sql`not exists (
+      select 1 from entity_indexes as surviving
+      where surviving.entity_type = ${entityType}
+        and surviving.entity_id = search_tokens.entity_id
+        and surviving.tenant_id is not distinct from search_tokens.tenant_id
+        and surviving.organization_id is not distinct from search_tokens.organization_id
+    )`);
+    await tokens.execute();
+  } catch (searchTokenError) {
+    await recordIndexerError(
+      { db },
+      {
+        source: "fulltext",
+        handler: "query_index:purge-orphans",
+        error: searchTokenError,
+        entityType,
+        tenantId: tenantId ?? null,
+        organizationId: options.organizationId ?? null
+      }
+    ).catch(() => void 0);
+  }
 }
 export {
   purgeOrphans

package/dist/modules/query_index/lib/stale.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/query_index/lib/stale.ts"],
-  "sourcesContent": ["import { type Kysely, sql } from 'kysely'\n\ntype PurgeOrphansOptions = {\n  entityType: string\n  tenantId?: string | null\n  organizationId?: string | null\n  partitionIndex: number | null\n  partitionCount: number | null\n  startedAt: Date\n  /**\n   * Records whose index rows must be preserved even though this run did not refresh\n   * them. A row that failed to be written still looks untouched to the `updated_at`\n   * predicate below, so without this the purge would delete the very entries the run\n   * failed to rebuild.\n   */\n  excludeRecordIds?: string[]\n}\n\nexport async function purgeOrphans(\n  db: Kysely<any>,\n  options: PurgeOrphansOptions,\n): Promise<void> {\n  const { entityType, tenantId, partitionIndex, partitionCount, startedAt } = options\n  let q = db.deleteFrom('entity_indexes' as any).where('entity_type' as any, '=', entityType)\n  if (tenantId !== undefined) {\n    q = q.where(sql<boolean>`tenant_id is not distinct from ${tenantId ?? null}`)\n  }\n  if (options.organizationId !== undefined) {\n    q = q.where(sql<boolean>`organization_id is not distinct from ${options.organizationId ?? null}`)\n  }\n  if (partitionIndex != null && partitionCount != null) {\n    q = q.where(sql<boolean>`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`)\n  }\n  q = q.where('updated_at' as any, '<', startedAt as any)\n  if (options.excludeRecordIds?.length) {\n    q = q.where('entity_id' as any, 'not in', options.excludeRecordIds)\n  }\n  await q.execute()\n}\n"],
-  "mappings": "AAAA,SAAsB,WAAW;AAkBjC,eAAsB,aACpB,IACA,SACe;AACf,QAAM,EAAE,YAAY,UAAU,gBAAgB,gBAAgB,UAAU,IAAI;AAC5E,MAAI,IAAI,GAAG,WAAW,gBAAuB,EAAE,MAAM,eAAsB,KAAK,UAAU;AAC1F,MAAI,aAAa,QAAW;AAC1B,QAAI,EAAE,MAAM,qCAA8C,YAAY,IAAI,EAAE;AAAA,EAC9E;AACA,MAAI,QAAQ,mBAAmB,QAAW;AACxC,QAAI,EAAE,MAAM,2CAAoD,QAAQ,kBAAkB,IAAI,EAAE;AAAA,EAClG;AACA,MAAI,kBAAkB,QAAQ,kBAAkB,MAAM;AACpD,QAAI,EAAE,MAAM,0CAAmD,cAAc,OAAO,cAAc,EAAE;AAAA,EACtG;AACA,MAAI,EAAE,MAAM,cAAqB,KAAK,SAAgB;AACtD,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,QAAI,EAAE,MAAM,aAAoB,UAAU,QAAQ,gBAAgB;AAAA,EACpE;AACA,QAAM,EAAE,QAAQ;AAClB;",
+  "sourcesContent": ["import { type Kysely, sql } from 'kysely'\nimport { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'\n\ntype PurgeOrphansOptions = {\n  entityType: string\n  tenantId?: string | null\n  organizationId?: string | null\n  partitionIndex: number | null\n  partitionCount: number | null\n  startedAt: Date\n  /**\n   * Records whose index rows must be preserved even though this run did not refresh\n   * them. A row that failed to be written still looks untouched to the `updated_at`\n   * predicate below, so without this the purge would delete the very entries the run\n   * failed to rebuild.\n   */\n  excludeRecordIds?: string[]\n}\n\n/**\n * `entity_indexes` ships in an earlier migration than `search_tokens`, so a deployment\n * running this code against a not-yet-migrated database has the projection table and not\n * the token table. The query engine probes the same way before reading the table\n * (`shared/lib/search/availability.ts`).\n */\nasync function searchTokensTableExists(db: Kysely<any>): Promise<boolean> {\n  const row = await db\n    .selectFrom('information_schema.tables' as any)\n    .select(sql<number>`1`.as('one') as any)\n    .where('table_name' as any, '=', 'search_tokens')\n    .limit(1)\n    .executeTakeFirst()\n  return !!row\n}\n\nexport async function purgeOrphans(\n  db: Kysely<any>,\n  options: PurgeOrphansOptions,\n): Promise<void> {\n  const { entityType, tenantId, partitionIndex, partitionCount, startedAt } = options\n\n  let q = db.deleteFrom('entity_indexes' as any).where('entity_type' as any, '=', entityType)\n  if (tenantId !== undefined) {\n    q = q.where(sql<boolean>`tenant_id is not distinct from ${tenantId ?? null}`)\n  }\n  if (options.organizationId !== undefined) {\n    q = q.where(sql<boolean>`organization_id is not distinct from ${options.organizationId ?? null}`)\n  }\n  if (partitionIndex != null && partitionCount != null) {\n    q = q.where(sql<boolean>`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`)\n  }\n  q = q.where('updated_at' as any, '<', startedAt as any)\n  if (options.excludeRecordIds?.length) {\n    q = q.where('entity_id' as any, 'not in', options.excludeRecordIds)\n  }\n  await q.execute()\n\n  // The token sweep runs as its own statement, after the projection delete has committed, and\n  // deliberately cannot fail the run. Its anti-join only needs those deletes to be *visible*,\n  // and a committed delete is as visible as an uncommitted one inside a shared transaction \u2014\n  // so wrapping the pair buys no correctness, only a new fatal path: `reindexer.ts` does not\n  // guard this call and marks the whole job failed on a throw, so a statement timeout on a\n  // large token delete would discard a rebuild whose projections all wrote successfully. The\n  // fallback is the pre-fix steady state: orphan tokens survive, benign, until the next run\n  // sweeps them. This matches how the module already treats token-side failures \u2014\n  // `batch.ts` records a failed token write via `recordIndexerError` rather than counting it\n  // as a write failure, and `indexer.ts` swallows the token delete outside a transaction.\n  try {\n    if (!(await searchTokensTableExists(db))) return\n\n    // Search tokens are written from the same (entity_type, entity_id, tenant_id,\n    // organization_id) tuple as the projection, but nothing above ever touched them, so\n    // every record this run stopped covering kept a queryable token with no presenter \u2014\n    // and token-only orphans left by earlier runs survived every rebuild since.\n    let tokens = db.deleteFrom('search_tokens' as any).where('entity_type' as any, '=', entityType)\n    // `= / is null` rather than the projection sweep's `is not distinct from`: these are bound\n    // constants, so the two spellings are semantically identical here, but only the former can\n    // serve as a btree index condition. Without it the delete uses just the `entity_type` prefix\n    // of `search_tokens_presence_idx (entity_type, tenant_id, organization_id)` and a\n    // tenant-scoped, unpartitioned run reads every tenant's tokens for that entity type \u2014\n    // the same planner trap `shared/lib/search/availability.ts` documents for this table (#4723).\n    // The anti-join below keeps the null-safe form: it compares columns, not constants.\n    if (tenantId !== undefined) {\n      tokens = tenantId === null\n        ? tokens.where('tenant_id' as any, 'is', null)\n        : tokens.where('tenant_id' as any, '=', tenantId)\n    }\n    if (options.organizationId !== undefined) {\n      tokens = options.organizationId === null\n        ? tokens.where('organization_id' as any, 'is', null)\n        : tokens.where('organization_id' as any, '=', options.organizationId)\n    }\n    if (partitionIndex != null && partitionCount != null) {\n      tokens = tokens.where(sql<boolean>`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`)\n    }\n    // Secondary guard only. `replaceSearchTokensForBatch` returns early for a record whose\n    // tokens are unchanged, so a perfectly current record keeps tokens older than this run\n    // \u2014 a timestamp-driven sweep would make live records unfindable. What this predicate\n    // does earn is the concurrent-writer case: a batch inserts tokens before the matching\n    // projection, so a token written during the run can outrun its own presenter.\n    tokens = tokens.where('created_at' as any, '<', startedAt as any)\n    if (options.excludeRecordIds?.length) {\n      tokens = tokens.where('entity_id' as any, 'not in', options.excludeRecordIds)\n    }\n    // The load-bearing predicate: a token survives while any projection for its own record\n    // and scope survives, soft-deleted ones included. `search_tokens` has a second writer \u2014\n    // `@open-mercato/search`'s token strategy writes rows for the same records under its own\n    // `field` spellings \u2014 and this sweep is safe for those rows only because that strategy\n    // draws its record set from the query engine, i.e. from the very projections consulted\n    // here. Changing where that strategy gets its records would make this delete eat its rows.\n    tokens = tokens.where(sql<boolean>`not exists (\n      select 1 from entity_indexes as surviving\n      where surviving.entity_type = ${entityType}\n        and surviving.entity_id = search_tokens.entity_id\n        and surviving.tenant_id is not distinct from search_tokens.tenant_id\n        and surviving.organization_id is not distinct from search_tokens.organization_id\n    )`)\n    await tokens.execute()\n  } catch (searchTokenError) {\n    await recordIndexerError(\n      { db },\n      {\n        source: 'fulltext',\n        handler: 'query_index:purge-orphans',\n        error: searchTokenError,\n        entityType,\n        tenantId: tenantId ?? null,\n        organizationId: options.organizationId ?? null,\n      },\n    ).catch(() => undefined)\n  }\n}\n"],
+  "mappings": "AAAA,SAAsB,WAAW;AACjC,SAAS,0BAA0B;AAwBnC,eAAe,wBAAwB,IAAmC;AACxE,QAAM,MAAM,MAAM,GACf,WAAW,2BAAkC,EAC7C,OAAO,OAAe,GAAG,KAAK,CAAQ,EACtC,MAAM,cAAqB,KAAK,eAAe,EAC/C,MAAM,CAAC,EACP,iBAAiB;AACpB,SAAO,CAAC,CAAC;AACX;AAEA,eAAsB,aACpB,IACA,SACe;AACf,QAAM,EAAE,YAAY,UAAU,gBAAgB,gBAAgB,UAAU,IAAI;AAE5E,MAAI,IAAI,GAAG,WAAW,gBAAuB,EAAE,MAAM,eAAsB,KAAK,UAAU;AAC1F,MAAI,aAAa,QAAW;AAC1B,QAAI,EAAE,MAAM,qCAA8C,YAAY,IAAI,EAAE;AAAA,EAC9E;AACA,MAAI,QAAQ,mBAAmB,QAAW;AACxC,QAAI,EAAE,MAAM,2CAAoD,QAAQ,kBAAkB,IAAI,EAAE;AAAA,EAClG;AACA,MAAI,kBAAkB,QAAQ,kBAAkB,MAAM;AACpD,QAAI,EAAE,MAAM,0CAAmD,cAAc,OAAO,cAAc,EAAE;AAAA,EACtG;AACA,MAAI,EAAE,MAAM,cAAqB,KAAK,SAAgB;AACtD,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,QAAI,EAAE,MAAM,aAAoB,UAAU,QAAQ,gBAAgB;AAAA,EACpE;AACA,QAAM,EAAE,QAAQ;AAYhB,MAAI;AACF,QAAI,CAAE,MAAM,wBAAwB,EAAE,EAAI;AAM1C,QAAI,SAAS,GAAG,WAAW,eAAsB,EAAE,MAAM,eAAsB,KAAK,UAAU;AAQ9F,QAAI,aAAa,QAAW;AAC1B,eAAS,aAAa,OAClB,OAAO,MAAM,aAAoB,MAAM,IAAI,IAC3C,OAAO,MAAM,aAAoB,KAAK,QAAQ;AAAA,IACpD;AACA,QAAI,QAAQ,mBAAmB,QAAW;AACxC,eAAS,QAAQ,mBAAmB,OAChC,OAAO,MAAM,mBAA0B,MAAM,IAAI,IACjD,OAAO,MAAM,mBAA0B,KAAK,QAAQ,cAAc;AAAA,IACxE;AACA,QAAI,kBAAkB,QAAQ,kBAAkB,MAAM;AACpD,eAAS,OAAO,MAAM,0CAAmD,cAAc,OAAO,cAAc,EAAE;AAAA,IAChH;AAMA,aAAS,OAAO,MAAM,cAAqB,KAAK,SAAgB;AAChE,QAAI,QAAQ,kBAAkB,QAAQ;AACpC,eAAS,OAAO,MAAM,aAAoB,UAAU,QAAQ,gBAAgB;AAAA,IAC9E;AAOA,aAAS,OAAO,MAAM;AAAA;AAAA,sCAEY,UAAU;AAAA;AAAA;AAAA;AAAA,MAI1C;AACF,UAAM,OAAO,QAAQ;AAAA,EACvB,SAAS,kBAAkB;AACzB,UAAM;AAAA,MACJ,EAAE,GAAG;AAAA,MACL;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,OAAO;AAAA,QACP;AAAA,QACA,UAAU,YAAY;AAAA,QACtB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA,IACF,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AACF;",
   "names": []
 }

package/dist/modules/workflows/lib/activity-executor.js

@@ -460,11 +460,12 @@ async function executeActivityByType(em, container, activity, context, signal) {
     signal
   });
 }
-async function executeSendEmail(config, context, container) {
+async function executeSendEmail(config, context, container, signal) {
   const { to, subject, template, templateData, body } = config;
   if (!to || !subject) {
     throw new Error('SEND_EMAIL requires "to" and "subject" fields');
   }
+  throwIfAborted(signal);
   logger.info("Send email activity invoked", { component: "SEND_EMAIL", subject });
   let emailService;
   try {
@@ -473,19 +474,26 @@ async function executeSendEmail(config, context, container) {
     emailService = void 0;
   }
   if (emailService && typeof emailService.send === "function") {
-    await emailService.send({
-      to,
-      subject,
-      template,
-      templateData,
-      body
-    });
+    await raceAbortable(
+      Promise.resolve(
+        emailService.send({
+          to,
+          subject,
+          template,
+          templateData,
+          body,
+          signal
+        })
+      ),
+      signal
+    );
+    throwIfAborted(signal);
     return { sent: true, to, subject, via: "emailService" };
   }
   logger.warn("SEND_EMAIL has no registered email service; email was not sent", { component: "SEND_EMAIL", subject });
   return { sent: false, simulated: true, to, subject, via: "console", reason: "no-email-service" };
 }
-async function executeEmitEvent(config, context, container) {
+async function executeEmitEvent(config, context, container, signal) {
   const { eventName, payload } = config;
   if (!eventName) {
     throw new Error('EMIT_EVENT requires "eventName" field');
@@ -499,6 +507,7 @@ async function executeEmitEvent(config, context, container) {
       `EMIT_EVENT payload contains unresolved template variables for: ${unresolvedPayloadKeys.join(", ")}. Check that the workflow context provides these keys.`
     );
   }
+  throwIfAborted(signal);
   const eventBus = container.resolve("eventBus");
   if (!eventBus || typeof eventBus.emitEvent !== "function") {
     throw new Error("Event bus not available in container");
@@ -512,10 +521,16 @@ async function executeEmitEvent(config, context, container) {
       organizationId: context.workflowInstance.organizationId
     }
   };
-  await eventBus.emitEvent(eventName, enrichedPayload, {
-    tenantId: context.workflowInstance.tenantId,
-    organizationId: context.workflowInstance.organizationId
-  });
+  await raceAbortable(
+    Promise.resolve(
+      eventBus.emitEvent(eventName, enrichedPayload, {
+        tenantId: context.workflowInstance.tenantId,
+        organizationId: context.workflowInstance.organizationId
+      })
+    ),
+    signal
+  );
+  throwIfAborted(signal);
   return { emitted: true, eventName, payload: enrichedPayload };
 }
 const UNRESOLVED_TEMPLATE_PATTERN = /\{\{[^}]+\}\}/;
@@ -533,7 +548,7 @@ function findUnresolvedTemplateKeys(value, path = "") {
   }
   return [];
 }
-async function executeUpdateEntity(em, config, context, container) {
+async function executeUpdateEntity(em, config, context, container, signal) {
   const { commandId, input, statusDictionary } = config;
   if (!commandId) {
     throw new Error('UPDATE_ENTITY requires "commandId" field (e.g., "sales.documents.update")');
@@ -546,6 +561,7 @@ async function executeUpdateEntity(em, config, context, container) {
     container,
     context.workflowInstance.tenantId
   );
+  throwIfAborted(signal);
   if (!isWorkflowCommandEnabled(workflowSafeCommand, commandPolicy)) {
     throw new Error("UPDATE_ENTITY command is not enabled for this tenant");
   }
@@ -563,6 +579,7 @@ async function executeUpdateEntity(em, config, context, container) {
     context.workflowInstance.tenantId,
     context.workflowInstance.organizationId
   );
+  throwIfAborted(signal);
   if (!authorized) {
     throw new Error("UPDATE_ENTITY command is not authorized");
   }
@@ -585,6 +602,7 @@ async function executeUpdateEntity(em, config, context, container) {
       context.workflowInstance.tenantId,
       context.workflowInstance.organizationId
     );
+    throwIfAborted(signal);
     if (statusEntryId) {
       finalInput.statusEntryId = statusEntryId;
     }
@@ -602,10 +620,17 @@ async function executeUpdateEntity(em, config, context, container) {
     selectedOrganizationId: context.workflowInstance.organizationId,
     organizationIds: context.workflowInstance.organizationId ? [context.workflowInstance.organizationId] : null
   };
-  const { result, logEntry } = await commandBus.execute(commandId, {
-    input: finalInput,
-    ctx
-  });
+  throwIfAborted(signal);
+  const { result, logEntry } = await raceAbortable(
+    Promise.resolve(
+      commandBus.execute(commandId, {
+        input: finalInput,
+        ctx
+      })
+    ),
+    signal
+  );
+  throwIfAborted(signal);
   return {
     executed: true,
     commandId,
@@ -705,18 +730,23 @@ async function executeCallWebhook(config, context, deps = {}) {
     result
   };
 }
-async function executeFunction(config, context, container) {
+async function executeFunction(config, context, container, signal) {
   const { functionName, args = {} } = config;
   if (!functionName) {
     throw new Error('EXECUTE_FUNCTION requires "functionName" field');
   }
+  throwIfAborted(signal);
   const fnKey = `workflowFunction:${functionName}`;
   try {
     const fn = container.resolve(fnKey);
     if (typeof fn !== "function") {
       throw new Error(`Registered workflow function "${functionName}" is not a function`);
     }
-    const result = await fn(args, context);
+    const result = await raceAbortable(
+      Promise.resolve(fn(args, context, signal)),
+      signal
+    );
+    throwIfAborted(signal);
     return { executed: true, functionName, result };
   } catch (error) {
     if (error instanceof Error && error.message.includes("not registered")) {
@@ -1168,6 +1198,43 @@ async function executeWithTimeout(executor, timeoutMs) {
     clearTimeout(timeoutId);
   }
 }
+function createActivityAbortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  try {
+    return new DOMException("The operation was aborted", "AbortError");
+  } catch {
+    const error = new Error("The operation was aborted");
+    error.name = "AbortError";
+    return error;
+  }
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) {
+    throw createActivityAbortError(signal);
+  }
+}
+function raceAbortable(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) {
+    return Promise.reject(createActivityAbortError(signal));
+  }
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      reject(createActivityAbortError(signal));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      }
+    );
+  });
+}
 bindActivityExecutor({
   executeSendEmail,
   executeEmitEvent,