feat(security): harden the API and lock synchronizations across instances

- Validate the environment at startup (src/config): required variables must be present, HIBOUTIK_BASE_URL must be HTTPS. - Global ValidationPipe (whitelist, forbidNonWhitelisted, transform). - Helmet, CORS disabled unless CORS_ORIGINS is set, TRUST_PROXY support, HTTP header/request timeouts, shutdown hooks. - Rate limiting: 60 req/min/IP globally, 5 req/min on POST /sync. - AllExceptionsFilter: unexpected errors are logged (message + stack, never the raw error object) and answered with a generic 500. - Postgres advisory lock (dedicated connection) so only one synchronization runs at a time across all instances; released by Postgres itself if the process dies. - Fix the Jest moduleNameMapper (unescaped dot also matched .cjs files). - Document the input validation and security rules in CLAUDE.md. - Add class-validator, class-transformer, helmet and @nestjs/throttler; npm audit fix refreshed package-lock.json. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
feat(sync): trust Hiboutik answers for deletions
2026-11-08 10:11:35 +01:00 · 2026-11-08 10:11:34 +01:00 · 2026-11-07 12:14:08 +00:00 · 2026-11-07 09:56:53 +00:00 · 2026-11-05 23:00:49 +01:00 · 2026-11-05 23:00:48 +01:00
82 changed files with 7411 additions and 1828 deletions
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -0,0 +1,17 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm run lint)",
+      "Bash(npm run build)",
+      "Bash(npm test)",
+      "Bash(npm run test:e2e)",
+      "Bash(npx jest:*)",
+      "Bash(npx prisma generate --config prisma7.config.ts)"
+    ],
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Bash(cat .env*)"
+    ]
+  }
+}
--- a/.gitattributes
+++ b/.gitattributes
@@ -0,0 +1 @@
+* text=auto eol=lf
--- a/.gitignore
+++ b/.gitignore
@@ -37,10 +37,8 @@ lerna-debug.log*

 # dotenv environment variable files
 .env
-.env.development.local
-.env.test.local
-.env.production.local
-.env.local
+.env.*
+!.env.example

 # temp directory
 .temp
@@ -54,3 +52,18 @@ pids

 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Prisma client (regenerated by `prisma generate`, run on npm install)
+/prisma/generated/
+
+# AI agent skills installed from skills-lock.json (keep skills-lock.json committed)
+/.agents/
+/.windsurf/
+/.claude/skills/
+# Claude Code personal settings (.claude/settings.json stays shareable)
+/.claude/settings.local.json
+
+# Postman (skills fetched by `postman init`, personal workspace binding)
+/postman/
+/.postman/
+/AGENTS.md
--- a/.prettierrc
+++ b/.prettierrc
@@ -1,4 +1,6 @@
 {
  "singleQuote": true,
-  "trailingComma": "all"
+  "trailingComma": "all",
+  "printWidth": 140,
+  "tabWidth": 2
 }
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -0,0 +1,90 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this is
+
+Backend of a K-pop online shop. The real shop (catalog, stock, customers, sales) lives in **Hiboutik**, a POS/e-commerce platform; Hiboutik stays the source of truth. This backend sits in front of it as a buffer: it mirrors Hiboutik data into its own database so the storefront does not hammer the Hiboutik API with requests. It is also the place to build shop features Hiboutik does not offer, on top of the mirrored data.
+
+Stack: NestJS 11, PostgreSQL via **Prisma 7**, Hiboutik REST API as the upstream.
+
+## Commands
+
+```bash
+npm run start:dev            # watch mode (port from PORT, default 3000)
+npm run build                # nest build -> dist/
+npm run lint                 # eslint --fix on src/test
+npm run format               # prettier (singleQuote, trailingComma all, printWidth 140)
+npm test                     # unit tests (*.spec.ts under src/)
+npx jest src/app.controller.spec.ts   # single test file
+npx jest -t "test name"               # single test by name
+npm run test:e2e             # e2e tests (test/jest-e2e.json)
+```
+
+Jest runs in CommonJS: its config (in `package.json` and `test/jest-e2e.json`) transpiles the ESM-only `@nestjs/config` (`transformIgnorePatterns`) and maps `./x.js` imports to `./x` (`moduleNameMapper`) for the generated Prisma client. Keep both configs in sync. Unit tests build services directly with mocked repositories; the e2e test boots `AppModule` with `PrismaService` and `HiboutikService` overridden, so it needs neither a database nor Hiboutik.
+
+Prisma: the config file is `prisma7.config.ts` (non-default name), so pass it explicitly:
+
+```bash
+npx prisma generate --config prisma7.config.ts
+npx prisma migrate dev --name <name> --config prisma7.config.ts
+```
+
+The client is generated into `prisma/generated/` (generator `prisma-client`, not the legacy `prisma-client-js`) and must be regenerated after any `schema.prisma` change. Code imports types from there, e.g. `prisma/generated/client` and `prisma/generated/models/<Model>` (`ProductCreateInput`, etc.).
+
+## Environment
+
+Read from `.env` (`@nestjs/config`, global): `DATABASE_URL` (used by Prisma and `PrismaService`), `HIBOUTIK_BASE_URL`, `HIBOUTIK_USERNAME`, `HIBOUTIK_PASSWORD` (HTTP Basic auth). HTTP calls to Hiboutik time out after 30 s (`HttpModule.register` in `AppModule`).
+
+The environment is validated at startup (`src/config/env.validation.ts`, wired in `ConfigModule.forRoot`): a missing or malformed required variable stops the app, and `HIBOUTIK_BASE_URL` must be HTTPS (Basic auth). Optional variables: `PORT`, `CORS_ORIGINS` (comma-separated; CORS stays disabled when unset) and `TRUST_PROXY` (number of reverse proxies, so rate limiting sees the real client IP). Any new variable goes in `EnvironmentVariables`; the e2e test gets dummy values from `test/setup-env.ts`.
+
+Security defaults in `main.ts`/`AppModule`: Helmet, global `ValidationPipe`, `ThrottlerGuard` on every route (60 req/min/IP; `@Throttle` for stricter limits, e.g. `POST /sync` at 5/min), `AllExceptionsFilter` (unexpected errors are logged with message + stack and answered with a generic 500; deliberate `HttpException`s and 4xx HTTP-layer errors pass through), HTTP header/request timeouts (15 s / 30 s), shutdown hooks. Long work must run in the background (like `POST /sync`), never inside a request.
+
+## Architecture
+
+Everything is registered as providers in a single `AppModule` (`src/app.module.ts`); new repositories/converters/services must be added there. `PrismaModule` (in `prisma/`, outside `src/`) is global.
+
+Sync pipeline, one entity per layer:
+
+1. **`src/hiboutik/*.hiboutik.repository.ts`** – fetch raw data from Hiboutik through `HiboutikClient` (`get`, and `getAllPages`, which walks the `p` page param until a page smaller than 250 results, Hiboutik's page size). `/suppliers` and `/stock_available/all_wh` are not paginated.
+2. **`src/models/hiboutikDTO/`** – snake_case types mirroring Hiboutik API payloads.
+3. **`src/models/converter/`** – classes extending abstract `Converter<Model, Dto>`; `fromHiboutik` maps a DTO to a Prisma `*CreateInput`. Relations use `connect: { hiboutikId }`.
+4. **`src/database/*.database.repository.ts`** – Prisma access, mainly `upsert` keyed on the unique `hiboutikId`.
+5. **`src/services/hiboutik/*.hiboutik.service.ts`** – per-entity sync orchestration; `HiboutikService.syncAll` runs them in dependency order: brands → categories → suppliers → products → customers (products `connect` to the first three by `hiboutikId`, so order matters).
+
+Domain notes:
+- Synced models carry a unique `hiboutikId` (join key with Hiboutik), except `Order` (nullable `hiboutikSaleId`), `ProductVersion` (unique `[productId, hiboutikSizeId]`) and `OrderLine`; the internal `id` is a UUID. Empty Hiboutik barcodes are stored as `null`. `ProductVersion.barcode` is indexed but **not unique** (Hiboutik may reuse a barcode).
+- Hiboutik is the source of truth: brands, categories, suppliers, products and customers missing from it are deleted. Hiboutik is trusted: a 2xx answer is the truth, even an empty list (everything is then deleted). Deletion only requires that the call did not fail: `HiboutikClient` throws on HTTP errors (4xx/5xx) and `getList`/`getAllPages` also throw on a 2xx body that is not a list (a 2xx without body is an empty list), so a failed step deletes nothing. List endpoints must go through `getList`/`getAllPages`, never a bare `get`. Products are deleted before the upserts (so a recreated product can reuse its barcode); their versions go by cascade, and versions missing from a product are deleted before its versions are upserted. Customer addresses go by cascade with their customer; other relations (product brand/category/supplier, sub-categories, order customer) are set to null and orders are kept.
+- Brands, categories and suppliers are upserted through `forEachSafely` (`src/utils/sync.ts`): a failing row is logged and skipped. Each sync step and each product/customer is in a try/catch: failures are logged, the sync goes on, and a summary is logged at the end.
+- Categories form a tree: parents are linked in a second pass (`setParent`). `enabled` mirrors `category_enabled` (POS), `webEnabled` mirrors `category_enabled_www`.
+- Products: `ProductVersion` rows come from `product_size_details` (barcode, price/discount overrides from `product_specific_rules`, stock from the stocks endpoint); no sizes means one version with `hiboutikSizeId: 0`. `globalStock` is the sum of available stock. `archived` mirrors `product_arch`.
+- `GET /customer/:id` embeds `addresses` and `sales` (typed in `customer.hiboutik.dto.ts`); `sales` only has headers, lines come from `GET /sales/:id` (`SaleHiboutikRepository`).
+- Addresses (from the embedded array): missing ones are deleted, the rest upserted via `forEachSafely`; no array means stored addresses are left untouched. Each has its own recipient fields, empty optional values stored as `null`. Company details (`taxNumber`, `companyNumber`, `legalStatus`) come from `GET /customers_addresses/:id`, only for addresses with a `company` (`null` otherwise, untouched if the call fails).
+- Orders come from the customer's `sales`: sales already stored as `COMPLETED` are skipped, the others are fetched and upserted on `hiboutikSaleId` (`source: STORE` on creation only). `status` is `COMPLETED` or `PENDING`, `orderedAt` is the completion date else the creation date. Lines are replaced on each upsert and snapshot name, version, barcode, price and Hiboutik ids; the `ProductVersion` link is optional (`SetNull`). `unitPrice` is the paid price, taxes and discount included. Quotations are skipped, anonymous sales are never synced (only customers' sales are read), and orders are never deleted.
+- Shared Prisma payload types (e.g. `ProductWithVersions`) live in `prisma/customObjects/`.
+
+## Input validation
+
+All data coming from API clients (`@Body()`, `@Query()`, `@Param()`) must be validated with NestJS `ValidationPipe` and `class-validator` DTO classes.
+
+- Register `ValidationPipe` globally in `main.ts` with `whitelist: true`, `forbidNonWhitelisted: true` and `transform: true` (no `if` checks by hand in controllers/services).
+- Every endpoint that reads a body, query string or route param takes a dedicated input DTO class decorated with `class-validator` rules (type, length, range, format). Cap pagination (`limit`/`take`) with `@Max`. For nested payloads use `@ValidateNested()` + `@Type()`.
+- Never use Prisma models or Hiboutik DTOs as input types: the `src/models/hiboutikDTO/` types describe data coming from Hiboutik, not from API clients.
+
+## Security rules
+
+- **Logs**: never log a raw error object, a request/response or an axios config: they carry the Hiboutik `Authorization` header (credentials). Log `(error as Error).message` and `.stack` only, as the sync services do. No personal data (emails, names, addresses, phone numbers, tax numbers) in logs: ids only.
+- **SQL**: use the Prisma query API. `$queryRaw`/`$executeRaw` are allowed only as tagged templates with parameters (`` $queryRaw`... ${value}` ``); never `$queryRawUnsafe`/`$executeRawUnsafe` nor string concatenation or interpolation into SQL text.
+- **Sync lock**: only one synchronization runs at a time across all instances. `HiboutikService.startSync` takes a Postgres advisory lock (`SyncLockDatabaseRepository`, dedicated `pg` connection held for the whole sync, released by Postgres itself if the process dies). Start syncs only through `startSync`, never call `syncAll` directly from a controller or a scheduler.
+
+## API
+
+If the Postman plugin is installed, load its `postman:api-engineer` skill before any non-trivial API engineering task (designing, implementing, mocking, testing, monitoring, documenting, deploying). Pure questions and trivial one-line edits do not need it. The local `postman/` and `.postman/` folders are generated by `postman init` and are git-ignored.
+
+## Git workflow
+
+The remote is a Gitea instance (`origin`). Use plain `git` or the Gitea CLI (`gt`) for pull requests and other Gitea operations.
+
+- Never commit or push directly to the integration branch: always push changes on a `feature/<name>` branch.
+- Merges go into `develop`. Until `develop` exists (early project phase), they go into `main`.
+- Commit messages follow Conventional Commits (`feat(sync): ...`, `fix(db): ...`).
--- a/README.md
+++ b/README.md
@@ -31,6 +31,14 @@
 $ npm install
 ```

+### AI agent skills (optional)
+
+The Prisma skills used by Claude Code are pinned in `skills-lock.json`; the skill folders themselves are not committed. Restore them with:
+
+```bash
+$ npx skills experimental_install
+```
+
 ## Compile and run the project

 ```bash
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -19,8 +19,9 @@ export default tseslint.config(
      },
      sourceType: 'commonjs',
      parserOptions: {
-        projectService: true,
+        //projectService: true,
        tsconfigRootDir: import.meta.dirname,
+        project: './tsconfig.json',
      },
    },
  },
@@ -29,7 +30,7 @@ export default tseslint.config(
      '@typescript-eslint/no-explicit-any': 'off',
      '@typescript-eslint/no-floating-promises': 'warn',
      '@typescript-eslint/no-unsafe-argument': 'warn',
-      "prettier/prettier": ["error", { endOfLine: "auto" }],
+      "prettier/prettier": "error",
    },
  },
 );
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -6,6 +6,7 @@
  "private": true,
  "license": "UNLICENSED",
  "scripts": {
+    "postinstall": "prisma generate --config prisma7.config.ts",
    "build": "nest build",
    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
    "start": "nest start",
@@ -22,21 +23,30 @@
  "dependencies": {
    "@nestjs/axios": "^4.0.1",
    "@nestjs/common": "^11.0.1",
+    "@nestjs/config": "^12.0.0",
    "@nestjs/core": "^11.0.1",
    "@nestjs/platform-express": "^11.0.1",
-    "axios": "^1.17.0",
+    "@nestjs/throttler": "^6.7.1",
+    "@prisma/adapter-pg": "^7.10.0",
+    "@prisma/client": "^7.10.0",
+    "axios": "1.20.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
+    "helmet": "^8.3.0",
+    "pg": "^8.23.0",
    "reflect-metadata": "^0.2.2",
    "rxjs": "^7.8.1"
  },
  "devDependencies": {
    "@eslint/eslintrc": "^3.2.0",
    "@eslint/js": "^9.18.0",
-    "@nestjs/cli": "^11.0.0",
+    "@nestjs/cli": "^12.0.11",
    "@nestjs/schematics": "^11.0.0",
    "@nestjs/testing": "^11.0.1",
    "@types/express": "^5.0.0",
    "@types/jest": "^30.0.0",
    "@types/node": "^24.0.0",
+    "@types/pg": "^8.23.1",
    "@types/supertest": "^7.0.0",
    "eslint": "^9.18.0",
    "eslint-config-prettier": "^10.0.1",
@@ -44,6 +54,7 @@
    "globals": "^17.0.0",
    "jest": "^30.0.0",
    "prettier": "^3.4.2",
+    "prisma": "^7.10.0",
    "source-map-support": "^0.5.21",
    "supertest": "^7.0.0",
    "ts-jest": "^29.2.5",
@@ -62,12 +73,33 @@
    "rootDir": "src",
    "testRegex": ".*\\.spec\\.ts$",
    "transform": {
-      "^.+\\.(t|j)s$": "ts-jest"
+      "^.+.ts$": "ts-jest",
+      "^.+.js$": [
+        "ts-jest",
+        {
+          "tsconfig": {
+            "allowJs": true,
+            "module": "commonjs",
+            "moduleResolution": "node"
+          }
+        }
+      ]
    },
    "collectCoverageFrom": [
      "**/*.(t|j)s"
    ],
    "coverageDirectory": "../coverage",
-    "testEnvironment": "node"
+    "testEnvironment": "node",
+    "transformIgnorePatterns": [
+      "/node_modules/(?!@nestjs/config/)"
+    ],
+    "moduleNameMapper": {
+      "^(\\.{1,2}/.*)\\.js$": "$1"
+    }
+  },
+  "allowScripts": {
+    "@parcel/watcher@2.6.0": true,
+    "@prisma/engines@7.10.1": true,
+    "prisma@7.10.1": true
  }
 }
--- a/prisma/customObjects/prisma.custom.object.ts
+++ b/prisma/customObjects/prisma.custom.object.ts
@@ -0,0 +1,12 @@
+import { Prisma } from '../generated/client';
+
+/** Product loaded with its versions (`include: { versions: true }`). */
+export type ProductWithVersions = Prisma.ProductGetPayload<{ include: { versions: true } }>;
+
+/**
+ * Order to save with its lines. Lines are kept apart from the nested Prisma input so that the repository can link
+ * them to the current catalog (`productVersion`) and replace them on update.
+ */
+export type OrderWithLinesInput = Omit<Prisma.OrderCreateInput, 'lines'> & {
+  lines: Prisma.OrderLineCreateWithoutOrderInput[];
+};
--- a/prisma/migrations/migration_lock.toml
+++ b/prisma/migrations/migration_lock.toml
@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (e.g., Git)
+provider = "postgresql"
--- a/prisma/prisma.module.ts
+++ b/prisma/prisma.module.ts
@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { PrismaService } from './prisma.service';
+
+@Global()
+@Module({
+  providers: [PrismaService],
+  exports: [PrismaService],
+})
+export class PrismaModule {}
--- a/prisma/prisma.service.ts
+++ b/prisma/prisma.service.ts
@@ -0,0 +1,20 @@
+import { Injectable, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { PrismaClient } from './generated/client';
+import { PrismaPg } from '@prisma/adapter-pg';
+
+/** Prisma client shared by the whole app (global PrismaModule), connected to `DATABASE_URL` through the pg driver adapter. */
+@Injectable()
+export class PrismaService extends PrismaClient implements OnModuleInit, OnModuleDestroy {
+  constructor() {
+    const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL });
+    super({ adapter });
+  }
+
+  async onModuleInit() {
+    await this.$connect();
+  }
+
+  async onModuleDestroy() {
+    await this.$disconnect();
+  }
+}
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -0,0 +1,229 @@
+// This is your Prisma schema file,
+// learn more about it in the docs: https://pris.ly/d/prisma-schema
+
+// Get a free hosted Postgres database in seconds: `npx create-db`
+
+generator client {
+  provider = "prisma-client"
+  output   = "./generated/"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+/// Product category, mirrored from Hiboutik. Categories form a tree (parent / children).
+model Category {
+  id        String   @id @default(uuid())
+  updatedAt DateTime @updatedAt
+
+  /// Enabled in the Hiboutik POS (category_enabled)
+  enabled    Boolean @default(true)
+  hiboutikId Int     @unique
+  name       String
+  /// Display order among its siblings (category_position)
+  position   Int     @default(0)
+  /// Displayed on the website (category_enabled_www)
+  webEnabled Boolean @default(true)
+
+  /// Null for a root category
+  parent   Category?  @relation("CategoryTree", fields: [parentId], references: [id], onDelete: SetNull)
+  parentId String?
+  children Category[] @relation("CategoryTree")
+
+  products Product[]
+
+  @@map("categories")
+}
+
+/// Product brand, mirrored from Hiboutik.
+model Brand {
+  id        String   @id @default(uuid())
+  updatedAt DateTime @updatedAt
+
+  enabled    Boolean @default(true)
+  hiboutikId Int     @unique
+  name       String
+
+  products Product[]
+
+  @@map("brands")
+}
+
+/// Product supplier, mirrored from Hiboutik.
+model Supplier {
+  id        String   @id @default(uuid())
+  updatedAt DateTime @updatedAt
+
+  enabled    Boolean @default(true)
+  hiboutikId Int     @unique
+  name       String
+
+  products Product[]
+
+  @@map("suppliers")
+}
+
+/// Product mirrored from Hiboutik. What is actually sold is one of its versions (sizes).
+model Product {
+  id        String   @id @default(uuid())
+  updatedAt DateTime @updatedAt
+
+  /// Archived in Hiboutik (product_arch)
+  archived          Boolean   @default(false)
+  barcode           String?
+  description       String
+  /// Null when the product has no discount
+  discountPrice     Decimal?  @db.Decimal(10, 2)
+  /// Displayed on the website (product_display_www)
+  enabled           Boolean   @default(true)
+  /// Sum of the available stock of all its versions
+  globalStock       Int       @default(0)
+  hiboutikId        Int       @unique
+  /// Last update in Hiboutik
+  hiboutikUpdatedAt DateTime?
+  name              String
+  price             Decimal   @db.Decimal(10, 2)
+
+  brand      Brand?    @relation(fields: [brandId], references: [id], onDelete: SetNull)
+  brandId    String?
+  category   Category? @relation(fields: [categoryId], references: [id], onDelete: SetNull)
+  categoryId String?
+  supplier   Supplier? @relation(fields: [supplierId], references: [id], onDelete: SetNull)
+  supplierId String?
+
+  versions ProductVersion[]
+
+  @@map("products")
+}
+
+/// Sellable version of a product: one per Hiboutik size, or a single one (hiboutikSizeId 0) for a product without sizes.
+model ProductVersion {
+  id        String   @id @default(uuid())
+  updatedAt DateTime @updatedAt
+
+  /// Not unique: Hiboutik is the source of truth and may hold the same barcode on several products
+  barcode        String?
+  /// Size-specific discount, null when none
+  discountPrice  Decimal? @db.Decimal(10, 2)
+  /// Hiboutik size id, 0 for a product without sizes
+  hiboutikSizeId Int
+  /// Size-specific price, null to use the product price (copy of the product price for a product without sizes)
+  price          Decimal? @db.Decimal(10, 2)
+  stock          Int      @default(0)
+  /// Size name, or the product name for a product without sizes
+  versionName    String
+
+  product   Product @relation(fields: [productId], references: [id], onDelete: Cascade, onUpdate: Restrict)
+  productId String
+
+  orderLines OrderLine[]
+
+  @@unique([productId, hiboutikSizeId])
+  @@index([barcode])
+  @@map("productVersions")
+}
+
+/// Customer mirrored from Hiboutik.
+model Customer {
+  id        String   @id @default(uuid())
+  updatedAt DateTime @updatedAt
+
+  dateOfBirth       DateTime?
+  /// Kept when removed in Hiboutik (an empty Hiboutik email does not erase it)
+  email             String?
+  firstName         String
+  hiboutikId        Int       @unique
+  /// Last update in Hiboutik
+  hiboutikUpdatedAt DateTime?
+  lastName          String
+  phone             String?
+
+  addresses CustomerAddress[]
+  orders    Order[]
+
+  @@index([email])
+  @@map("customers")
+}
+
+/// Address of a customer, mirrored from Hiboutik. Its recipient (name, company, phone) can differ from the customer.
+model CustomerAddress {
+  id        String   @id @default(uuid())
+  updatedAt DateTime @updatedAt
+
+  address       String
+  city          String
+  company       String?
+  /// Company registration number (SIRET...), only for an address with a company
+  companyNumber String?
+  country       String
+  firstName     String
+  hiboutikId    Int     @unique
+  isDefault     Boolean @default(false)
+  lastName      String
+  /// Company legal status (SAS, SARL...), only for an address with a company
+  legalStatus   String?
+  /// Free complement (building, floor, door code...)
+  other         String?
+  phone         String?
+  state         String?
+  /// Company VAT number, only for an address with a company
+  taxNumber     String?
+  zipCode       String
+
+  customer   Customer @relation(fields: [customerId], references: [id], onDelete: Cascade)
+  customerId String
+
+  @@map("customer_addresses")
+}
+
+/// Where an order was placed.
+enum OrderSource {
+  STORE // hiboutik
+  WEB // site
+}
+
+/// Order placed in store (Hiboutik sale) or on the website.
+model Order {
+  id        String   @id @default(uuid())
+  updatedAt DateTime @updatedAt
+
+  createdAt      DateTime    @default(now())
+  /// Null for a website order not (yet) sent to Hiboutik
+  hiboutikSaleId Int?        @unique
+  orderedAt      DateTime
+  source         OrderSource
+  status         String
+  total          Decimal     @db.Decimal(10, 2)
+
+  /// Null for an anonymous sale or a deleted customer
+  customer   Customer? @relation(fields: [customerId], references: [id], onDelete: SetNull)
+  customerId String?
+
+  lines OrderLine[]
+
+  @@map("orders")
+}
+
+/// Line of an order.
+model OrderLine {
+  id        String   @id @default(uuid())
+  updatedAt DateTime @updatedAt
+
+  // Snapshot of the product at order time: the catalog can change or be deleted afterwards
+  barcode           String?
+  hiboutikProductId Int
+  hiboutikSizeId    Int
+  productName       String
+  quantity          Int
+  unitPrice         Decimal @db.Decimal(10, 2)
+  versionName       String
+
+  order            Order           @relation(fields: [orderId], references: [id], onDelete: Cascade)
+  orderId          String
+  // Link to the current catalog, set to null when the version is deleted
+  productVersion   ProductVersion? @relation(fields: [productVersionId], references: [id], onDelete: SetNull)
+  productVersionId String?
+
+  @@map("order_lines")
+}
--- a/prisma7.config.ts
+++ b/prisma7.config.ts
@@ -0,0 +1,14 @@
+// This file was generated by Prisma, and assumes you have installed the following:
+// npm install --save-dev prisma dotenv
+import 'dotenv/config';
+import { defineConfig } from 'prisma/config';
+
+export default defineConfig({
+  schema: 'prisma/schema.prisma',
+  migrations: {
+    path: 'prisma/migrations',
+  },
+  datasource: {
+    url: process.env['DATABASE_URL'],
+  },
+});
--- a/skills-lock.json
+++ b/skills-lock.json
@@ -0,0 +1,59 @@
+{
+  "version": 1,
+  "skills": {
+    "prisma-cli": {
+      "source": "prisma/skills",
+      "sourceType": "github",
+      "skillPath": "prisma-cli/SKILL.md",
+      "computedHash": "b92e55aef78f6796d81433c44738a6733211a04c16e65cbad6d42c5f71092aab"
+    },
+    "prisma-client-api": {
+      "source": "prisma/skills",
+      "sourceType": "github",
+      "skillPath": "prisma-client-api/SKILL.md",
+      "computedHash": "5dcc0793337151efa73a444e5adbc7e1c24180778e83b4fe94c9109c391bd333"
+    },
+    "prisma-compute": {
+      "source": "prisma/skills",
+      "sourceType": "github",
+      "skillPath": "prisma-compute/SKILL.md",
+      "computedHash": "e5695a3c6f35428e96df30ae662716bd4c9d9074f72cc9334b3050445a1bd4e2"
+    },
+    "prisma-database-setup": {
+      "source": "prisma/skills",
+      "sourceType": "github",
+      "skillPath": "prisma-database-setup/SKILL.md",
+      "computedHash": "0911d9454bd48df3badd23a50fd90a280eabb15dcbd472c14e7b729075dadefb"
+    },
+    "prisma-driver-adapter-implementation": {
+      "source": "prisma/skills",
+      "sourceType": "github",
+      "skillPath": "prisma-driver-adapter-implementation/SKILL.md",
+      "computedHash": "07484627aea6cce4d0f94b4090ff9acc0caa7e104f9988b95abecf80132f4103"
+    },
+    "prisma-mongodb-upgrade": {
+      "source": "prisma/skills",
+      "sourceType": "github",
+      "skillPath": "prisma-mongodb-upgrade/SKILL.md",
+      "computedHash": "f9ba440e88ca4cec9801d04762296e29e99ca08cb8a8156e4f783ecf90279c8f"
+    },
+    "prisma-postgres": {
+      "source": "prisma/skills",
+      "sourceType": "github",
+      "skillPath": "prisma-postgres/SKILL.md",
+      "computedHash": "d669fbd0d8017d16c967f18b20e1c1345cd4a2a0076d762459bfef79f551f655"
+    },
+    "prisma-postgres-setup": {
+      "source": "prisma/skills",
+      "sourceType": "github",
+      "skillPath": "prisma-postgres-setup/SKILL.md",
+      "computedHash": "c89d3aa91285d8e4964fcaa5238c99a3d3c20b617e032e731cf632330a85a5a6"
+    },
+    "prisma-upgrade-v7": {
+      "source": "prisma/skills",
+      "sourceType": "github",
+      "skillPath": "prisma-upgrade-v7/SKILL.md",
+      "computedHash": "dcc6c71adca6b22f37c5bda5ac7fd63c3bb59495596a22e06a29c7c85371558f"
+    }
+  }
+}
--- a/src/app.controller.spec.ts
+++ b/src/app.controller.spec.ts
@@ -1,22 +1,29 @@
+import { ConflictException } from '@nestjs/common';
 import { Test, TestingModule } from '@nestjs/testing';
 import { AppController } from './app.controller';
-import { AppService } from './app.service';
+import { HiboutikService } from './services/hiboutik/hiboutik.service';

 describe('AppController', () => {
-  let appController: AppController;
+  let controller: AppController;
+  const hiboutikService = { startSync: jest.fn() };

  beforeEach(async () => {
-    const app: TestingModule = await Test.createTestingModule({
+    hiboutikService.startSync.mockReset();
+    const module: TestingModule = await Test.createTestingModule({
      controllers: [AppController],
-      providers: [AppService],
+      providers: [{ provide: HiboutikService, useValue: hiboutikService }],
    }).compile();
-
-    appController = app.get<AppController>(AppController);
+    controller = module.get(AppController);
  });

-  describe('root', () => {
-    it('should return "Hello World!"', () => {
-      expect(appController.getHello()).toBe('Hello World!');
-    });
+  it('starts a synchronization', async () => {
+    hiboutikService.startSync.mockResolvedValue(true);
+    await expect(controller.hiboutikSync()).resolves.toEqual({ message: 'Hiboutik synchronization started' });
+    expect(hiboutikService.startSync).toHaveBeenCalledTimes(1);
+  });
+
+  it('rejects a synchronization when one is already running', async () => {
+    hiboutikService.startSync.mockResolvedValue(false);
+    await expect(controller.hiboutikSync()).rejects.toThrow(ConflictException);
  });
 });
--- a/src/app.controller.ts
+++ b/src/app.controller.ts
@@ -1,12 +1,22 @@
-import { Controller, Get } from '@nestjs/common';
-import { AppService } from './app.service';
+import { ConflictException, Controller, HttpCode, HttpStatus, Post } from '@nestjs/common';
+import { Throttle } from '@nestjs/throttler';
+import { HiboutikService } from './services/hiboutik/hiboutik.service';

@Controller()
 export class AppController {
-  constructor(private readonly appService: AppService) {}
+  constructor(private readonly hiboutikService: HiboutikService) {}

-  @Get()
-  getHello(): string {
-    return this.appService.getHello();
+  /**
+   * Starts the synchronization in the background and answers immediately: 202, or 409 if one is already running.
+   * Rate limited to 5 calls per minute: each one can trigger thousands of Hiboutik API calls.
+   */
+  @Post('sync')
+  @Throttle({ default: { limit: 5, ttl: 60_000 } })
+  @HttpCode(HttpStatus.ACCEPTED)
+  async hiboutikSync() {
+    if (!(await this.hiboutikService.startSync())) {
+      throw new ConflictException('A Hiboutik synchronization is already in progress');
+    }
+    return { message: 'Hiboutik synchronization started' };
  }
 }
--- a/src/app.module.ts
+++ b/src/app.module.ts
@@ -1,10 +1,88 @@
 import { Module } from '@nestjs/common';
+import { APP_FILTER, APP_GUARD } from '@nestjs/core';
+import { AllExceptionsFilter } from './filters/all-exceptions.filter';
+import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 import { AppController } from './app.controller';
-import { AppService } from './app.service';
+import { ConfigModule } from '@nestjs/config';
+import { validateEnv } from './config/env.validation';
+import { HiboutikService } from './services/hiboutik/hiboutik.service';
+import { CategoryHiboutikRepository } from './hiboutik/category.hiboutik.repository';
+import { CategoryConverter } from './models/converter/category.converter';
+import { ProductHiboutikRepository } from './hiboutik/product.hiboutik.repository';
+import { HttpModule } from '@nestjs/axios';
+import { CategoryDatabaseRepository } from './database/category.database.repository';
+import { PrismaModule } from '../prisma/prisma.module';
+import { HiboutikClient } from './hiboutik/hiboutik.client';
+import { BrandHiboutikRepository } from './hiboutik/brand.hiboutik.repository';
+import { BrandDatabaseRepository } from './database/brand.database.repository';
+import { BrandConverter } from './models/converter/brand.converter';
+import { SupplierHiboutikRepository } from './hiboutik/supplier.hiboutik.repository';
+import { SupplierDatabaseRepository } from './database/supplier.database.repository';
+import { SupplierConverter } from './models/converter/supplier.converter';
+import { StockHiboutikRepository } from './hiboutik/stock.hiboutik.repository';
+import { ProductConverter } from './models/converter/product.converter';
+import { ProductDatabaseRepository } from './database/product.database.repository';
+import { ProductVersionDatabaseRepository } from './database/productVersion.database.repository';
+import { CustomerHiboutikRepository } from './hiboutik/customer.hiboutik.repository';
+import { CustomerDatabaseRepository } from './database/customer.database.repository';
+import { CustomerConverter } from './models/converter/customer.converter';
+import { OrderConverter } from './models/converter/order.converter';
+import { OrderDatabaseRepository } from './database/order.database.repository';
+import { SaleHiboutikRepository } from './hiboutik/sale.hiboutik.repository';
+import { CustomerAddressConverter } from './models/converter/customerAddress.converter';
+import { CustomerAddressDatabaseRepository } from './database/customerAddress.database.repository';
+import { BrandHiboutikService } from './services/hiboutik/brand.hiboutik.service';
+import { CategoryHiboutikService } from './services/hiboutik/category.hiboutik.service';
+import { CustomerHiboutikService } from './services/hiboutik/customer.hiboutik.service';
+import { SupplierHiboutikService } from './services/hiboutik/supplier.hiboutik.service';
+import { ProductHiboutikService } from './services/hiboutik/product.hiboutik.service';
+import { SyncLockDatabaseRepository } from './database/syncLock.database.repository';

@Module({
-  imports: [],
+  imports: [
+    ConfigModule.forRoot({
+      isGlobal: true,
+      validate: validateEnv,
+    }),
+    // Default rate limit for every route: 60 requests per minute per IP (stricter limits via @Throttle)
+    ThrottlerModule.forRoot([{ ttl: 60_000, limit: 60 }]),
+    HttpModule.register({ timeout: 30_000 }),
+    PrismaModule,
+  ],
  controllers: [AppController],
-  providers: [AppService],
+  providers: [
+    { provide: APP_GUARD, useClass: ThrottlerGuard },
+    { provide: APP_FILTER, useClass: AllExceptionsFilter },
+    BrandConverter,
+    BrandDatabaseRepository,
+    BrandHiboutikRepository,
+    BrandHiboutikService,
+    CategoryConverter,
+    CategoryDatabaseRepository,
+    CategoryHiboutikRepository,
+    CategoryHiboutikService,
+    CustomerAddressConverter,
+    CustomerAddressDatabaseRepository,
+    CustomerHiboutikRepository,
+    CustomerDatabaseRepository,
+    CustomerConverter,
+    CustomerHiboutikService,
+    HiboutikClient,
+    HiboutikService,
+    OrderConverter,
+    OrderDatabaseRepository,
+    ProductConverter,
+    ProductDatabaseRepository,
+    ProductHiboutikRepository,
+    ProductHiboutikService,
+    ProductVersionDatabaseRepository,
+    SaleHiboutikRepository,
+    StockHiboutikRepository,
+    SupplierConverter,
+    SupplierDatabaseRepository,
+    SyncLockDatabaseRepository,
+    SupplierHiboutikRepository,
+    SupplierHiboutikService,
+  ],
 })
 export class AppModule {}
--- a/src/app.service.ts
+++ b/src/app.service.ts
@@ -1,8 +0,0 @@
-import { Injectable } from '@nestjs/common';
-
-@Injectable()
-export class AppService {
-  getHello(): string {
-    return 'Hello World!';
-  }
-}
--- a/src/config/env.validation.spec.ts
+++ b/src/config/env.validation.spec.ts
@@ -0,0 +1,39 @@
+import 'reflect-metadata';
+import { validateEnv } from './env.validation';
+
+describe('validateEnv', () => {
+  const valid = {
+    DATABASE_URL: 'postgresql://user:secret@localhost:5432/db',
+    HIBOUTIK_BASE_URL: 'https://shop.hiboutik.com/api',
+    HIBOUTIK_USERNAME: 'user',
+    HIBOUTIK_PASSWORD: 'secret-password',
+  };
+
+  it('accepts a valid configuration and keeps every variable', () => {
+    const env = { ...valid, PORT: '3000', CORS_ORIGINS: 'https://shop.example.com', TRUST_PROXY: '1', OTHER: 'x' };
+    expect(validateEnv(env)).toBe(env);
+  });
+
+  it('rejects a missing required variable, naming it', () => {
+    expect(() => validateEnv({ ...valid, HIBOUTIK_PASSWORD: undefined })).toThrow(/HIBOUTIK_PASSWORD/);
+  });
+
+  it('rejects a non-HTTPS Hiboutik URL', () => {
+    expect(() => validateEnv({ ...valid, HIBOUTIK_BASE_URL: 'http://shop.hiboutik.com/api' })).toThrow(/HIBOUTIK_BASE_URL/);
+  });
+
+  it('rejects an invalid port', () => {
+    expect(() => validateEnv({ ...valid, PORT: 'abc' })).toThrow(/PORT/);
+    expect(() => validateEnv({ ...valid, PORT: '70000' })).toThrow(/PORT/);
+  });
+
+  it('never puts secret values in the error message', () => {
+    expect.assertions(2);
+    try {
+      validateEnv({ ...valid, HIBOUTIK_BASE_URL: 'http://insecure', DATABASE_URL: '' });
+    } catch (error) {
+      expect((error as Error).message).not.toContain('secret-password');
+      expect((error as Error).message).not.toContain('secret');
+    }
+  });
+});
--- a/src/config/env.validation.ts
+++ b/src/config/env.validation.ts
@@ -0,0 +1,51 @@
+import { plainToInstance } from 'class-transformer';
+import { IsInt, IsNotEmpty, IsOptional, IsString, IsUrl, Max, Min, validateSync } from 'class-validator';
+
+/** Environment variables read by the app. A missing or malformed required one stops the startup. */
+export class EnvironmentVariables {
+  @IsString()
+  @IsNotEmpty()
+  DATABASE_URL!: string;
+
+  /** HTTPS only: the Hiboutik credentials are sent with HTTP Basic auth. */
+  @IsUrl({ protocols: ['https'], require_protocol: true })
+  HIBOUTIK_BASE_URL!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  HIBOUTIK_USERNAME!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  HIBOUTIK_PASSWORD!: string;
+
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  @Max(65535)
+  PORT?: number;
+
+  /** Comma-separated list of origins allowed by CORS. Empty or unset: CORS stays disabled. */
+  @IsOptional()
+  @IsString()
+  CORS_ORIGINS?: string;
+
+  /** Number of reverse proxies in front of the app (so the real client IP is used for rate limiting). Unset: no proxy. */
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  @Max(10)
+  TRUST_PROXY?: number;
+}
+
+/** `ConfigModule` validation hook: fails fast with the names of the faulty variables (never their values, they may be secrets). */
+export function validateEnv(config: Record<string, unknown>): Record<string, unknown> {
+  const validated = plainToInstance(EnvironmentVariables, config, { enableImplicitConversion: true });
+  const errors = validateSync(validated, { whitelist: false });
+
+  if (errors.length > 0) {
+    const details = errors.map((error) => `${error.property}: ${Object.values(error.constraints ?? {}).join(', ')}`).join('\n  ');
+    throw new Error(`Invalid environment configuration:\n  ${details}`);
+  }
+  return config;
+}
--- a/src/database/brand.database.repository.ts
+++ b/src/database/brand.database.repository.ts
@@ -0,0 +1,36 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { Brand } from '../../prisma/generated/client';
+import { BrandCreateInput } from '../../prisma/generated/models/Brand';
+
+/** Database access to brands. Rows are matched with Hiboutik by `hiboutikId`. */
+@Injectable()
+export class BrandDatabaseRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async getAll(): Promise<Brand[]> {
+    return this.prisma.brand.findMany({
+      orderBy: { hiboutikId: 'asc' },
+    });
+  }
+
+  /** Creates or updates the brand with the same `hiboutikId`. */
+  async upsert(brand: BrandCreateInput): Promise<Brand> {
+    return this.prisma.brand.upsert({
+      where: { hiboutikId: brand.hiboutikId },
+      create: brand,
+      update: brand,
+    });
+  }
+
+  /**
+   * Deletes the brands that no longer exist in Hiboutik.
+   * Their products are kept: the relation is set to null (onDelete: SetNull).
+   */
+  async deleteMissing(keptHiboutikIds: number[]): Promise<number> {
+    const result = await this.prisma.brand.deleteMany({
+      where: { hiboutikId: { notIn: keptHiboutikIds } },
+    });
+    return result.count;
+  }
+}
--- a/src/database/category.database.repository.ts
+++ b/src/database/category.database.repository.ts
@@ -0,0 +1,44 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { Category } from '../../prisma/generated/client';
+import { CategoryCreateInput } from '../../prisma/generated/models/Category';
+
+/** Database access to categories. Rows are matched with Hiboutik by `hiboutikId`. */
+@Injectable()
+export class CategoryDatabaseRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async getAll(): Promise<Category[]> {
+    return this.prisma.category.findMany({
+      orderBy: { hiboutikId: 'asc' },
+    });
+  }
+
+  /** Creates or updates the category with the same `hiboutikId`. */
+  async upsert(category: CategoryCreateInput): Promise<Category> {
+    return this.prisma.category.upsert({
+      where: { hiboutikId: category.hiboutikId },
+      create: category,
+      update: category,
+    });
+  }
+
+  /** Links a category to its parent (null for a root category). Both must already exist. */
+  async setParent(hiboutikId: number, parentHiboutikId: number | null): Promise<Category> {
+    return this.prisma.category.update({
+      where: { hiboutikId },
+      data: { parent: parentHiboutikId ? { connect: { hiboutikId: parentHiboutikId } } : { disconnect: true } },
+    });
+  }
+
+  /**
+   * Deletes the categories that no longer exist in Hiboutik.
+   * Their products and sub-categories are kept: the relation is set to null (onDelete: SetNull).
+   */
+  async deleteMissing(keptHiboutikIds: number[]): Promise<number> {
+    const result = await this.prisma.category.deleteMany({
+      where: { hiboutikId: { notIn: keptHiboutikIds } },
+    });
+    return result.count;
+  }
+}
--- a/src/database/customer.database.repository.ts
+++ b/src/database/customer.database.repository.ts
@@ -0,0 +1,36 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { Customer } from '../../prisma/generated/client';
+import { CustomerCreateInput } from '../../prisma/generated/models/Customer';
+
+/** Database access to customers. Rows are matched with Hiboutik by `hiboutikId`. */
+@Injectable()
+export class CustomerDatabaseRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async getAll(): Promise<Customer[]> {
+    return this.prisma.customer.findMany({
+      orderBy: { hiboutikId: 'asc' },
+    });
+  }
+
+  /** Creates or updates the customer with the same `hiboutikId`. */
+  async upsert(customer: CustomerCreateInput): Promise<Customer> {
+    return this.prisma.customer.upsert({
+      where: { hiboutikId: customer.hiboutikId },
+      create: customer,
+      update: customer,
+    });
+  }
+
+  /**
+   * Deletes the customers that no longer exist in Hiboutik.
+   * Their addresses are deleted (onDelete: Cascade), their orders are kept with no customer (onDelete: SetNull).
+   */
+  async deleteMissing(keptHiboutikIds: number[]): Promise<number> {
+    const result = await this.prisma.customer.deleteMany({
+      where: { hiboutikId: { notIn: keptHiboutikIds } },
+    });
+    return result.count;
+  }
+}
--- a/src/database/customerAddress.database.repository.ts
+++ b/src/database/customerAddress.database.repository.ts
@@ -0,0 +1,27 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { CustomerAddress } from '../../prisma/generated/client';
+import { CustomerAddressCreateInput } from '../../prisma/generated/models/CustomerAddress';
+
+/** Database access to customer addresses. Rows are matched with Hiboutik by `hiboutikId`. */
+@Injectable()
+export class CustomerAddressDatabaseRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  /** Creates or updates the address with the same `hiboutikId`. */
+  async upsert(address: CustomerAddressCreateInput): Promise<CustomerAddress> {
+    return this.prisma.customerAddress.upsert({
+      where: { hiboutikId: address.hiboutikId },
+      create: address,
+      update: address,
+    });
+  }
+
+  /** Deletes the addresses of a customer that no longer exist in Hiboutik (all of them if `keptHiboutikIds` is empty). */
+  async deleteMissing(customerId: string, keptHiboutikIds: number[]): Promise<number> {
+    const result = await this.prisma.customerAddress.deleteMany({
+      where: { customerId, hiboutikId: { notIn: keptHiboutikIds } },
+    });
+    return result.count;
+  }
+}
--- a/src/database/order.database.repository.ts
+++ b/src/database/order.database.repository.ts
@@ -0,0 +1,61 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { Order } from '../../prisma/generated/client';
+import { OrderWithLinesInput } from '../../prisma/customObjects/prisma.custom.object';
+import { OrderStatus } from '../models/orderStatus';
+
+/** Database access to orders. Hiboutik sales are matched by `hiboutikSaleId`. */
+@Injectable()
+export class OrderDatabaseRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  /** Among `hiboutikSaleIds`, the ones already stored as completed orders. */
+  async getCompletedSaleIds(hiboutikSaleIds: number[]): Promise<Set<number>> {
+    if (hiboutikSaleIds.length === 0) return new Set();
+
+    const orders = await this.prisma.order.findMany({
+      where: { hiboutikSaleId: { in: hiboutikSaleIds }, status: OrderStatus.COMPLETED },
+      select: { hiboutikSaleId: true },
+    });
+    return new Set(orders.map((order) => order.hiboutikSaleId).filter((id): id is number => id !== null));
+  }
+
+  /**
+   * Creates or updates the order with the same `hiboutikSaleId`, replacing all its lines (atomically).
+   * Each line is linked to the current product version matching its Hiboutik product and size, if it still exists.
+   * On update, `source` is kept: a website order sent to Hiboutik stays WEB.
+   */
+  async upsert(order: OrderWithLinesInput): Promise<Order> {
+    if (order.hiboutikSaleId == null) throw new Error('Cannot upsert an order without hiboutikSaleId');
+
+    const { lines, source, ...orderFields } = order;
+    const linkedLines = await this.linkToProductVersions(lines);
+    return this.prisma.order.upsert({
+      where: { hiboutikSaleId: order.hiboutikSaleId },
+      create: { ...orderFields, source, lines: { create: linkedLines } },
+      update: {
+        ...orderFields,
+        // an undefined relation is ignored by Prisma on update: explicitly unlink a customer removed from the sale
+        customer: orderFields.customer ?? { disconnect: true },
+        lines: { deleteMany: {}, create: linkedLines },
+      },
+    });
+  }
+
+  private async linkToProductVersions(lines: OrderWithLinesInput['lines']): Promise<OrderWithLinesInput['lines']> {
+    if (lines.length === 0) return lines;
+
+    const versions = await this.prisma.productVersion.findMany({
+      where: {
+        OR: lines.map((line) => ({ hiboutikSizeId: line.hiboutikSizeId, product: { hiboutikId: line.hiboutikProductId } })),
+      },
+      select: { id: true, hiboutikSizeId: true, product: { select: { hiboutikId: true } } },
+    });
+    const versionIds = new Map(versions.map((version) => [`${version.product.hiboutikId}:${version.hiboutikSizeId}`, version.id]));
+
+    return lines.map((line) => {
+      const versionId = versionIds.get(`${line.hiboutikProductId}:${line.hiboutikSizeId}`);
+      return versionId ? { ...line, productVersion: { connect: { id: versionId } } } : line;
+    });
+  }
+}
--- a/src/database/product.database.repository.ts
+++ b/src/database/product.database.repository.ts
@@ -0,0 +1,44 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { Product } from '../../prisma/generated/client';
+import { ProductCreateInput } from '../../prisma/generated/models/Product';
+
+/** Database access to products. Rows are matched with Hiboutik by `hiboutikId`. */
+@Injectable()
+export class ProductDatabaseRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async getAll(): Promise<Product[]> {
+    return this.prisma.product.findMany({
+      orderBy: { hiboutikId: 'asc' },
+    });
+  }
+
+  /** Creates or updates the product with the same `hiboutikId`. On update, the relations missing from the input are unlinked. */
+  async upsert(product: ProductCreateInput): Promise<Product> {
+    return this.prisma.product.upsert({
+      where: { hiboutikId: product.hiboutikId },
+      create: product,
+      update: {
+        ...product,
+        // an undefined relation is ignored by Prisma on update: explicitly unlink relations removed in Hiboutik
+        brand: product.brand ?? { disconnect: true },
+        category: product.category ?? { disconnect: true },
+        supplier: product.supplier ?? { disconnect: true },
+      },
+    });
+  }
+
+  /**
+   * Deletes products (and their versions, by cascade).
+   * Order lines keep their own snapshot of the product, their link is set to null.
+   */
+  async deleteAll(productIds: string[]): Promise<number> {
+    if (productIds.length === 0) return 0;
+
+    const result = await this.prisma.product.deleteMany({
+      where: { id: { in: productIds } },
+    });
+    return result.count;
+  }
+}
--- a/src/database/productVersion.database.repository.ts
+++ b/src/database/productVersion.database.repository.ts
@@ -0,0 +1,36 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { ProductVersion } from '../../prisma/generated/client';
+import { ProductVersionCreateInput } from '../../prisma/generated/models/ProductVersion';
+
+/** Database access to product versions (one per Hiboutik size), identified by their product and `hiboutikSizeId`. */
+@Injectable()
+export class ProductVersionDatabaseRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async getAll(): Promise<ProductVersion[]> {
+    return this.prisma.productVersion.findMany({
+      orderBy: { hiboutikSizeId: 'asc' },
+    });
+  }
+
+  /** Creates or updates the version of `productId` with the same `hiboutikSizeId`. */
+  async upsert(productId: string, productVersion: ProductVersionCreateInput): Promise<ProductVersion> {
+    return this.prisma.productVersion.upsert({
+      where: { productId_hiboutikSizeId: { productId: productId, hiboutikSizeId: productVersion.hiboutikSizeId } },
+      create: productVersion,
+      update: productVersion,
+    });
+  }
+
+  /**
+   * Deletes the versions of a product that no longer exist in Hiboutik.
+   * Order lines keep their own snapshot of the product, their link is set to null.
+   */
+  async deleteMissing(productId: string, keptHiboutikSizeIds: number[]): Promise<number> {
+    const result = await this.prisma.productVersion.deleteMany({
+      where: { productId, hiboutikSizeId: { notIn: keptHiboutikSizeIds } },
+    });
+    return result.count;
+  }
+}
--- a/src/database/supplier.database.repository.ts
+++ b/src/database/supplier.database.repository.ts
@@ -0,0 +1,36 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { Supplier } from '../../prisma/generated/client';
+import { SupplierCreateInput } from '../../prisma/generated/models/Supplier';
+
+/** Database access to suppliers. Rows are matched with Hiboutik by `hiboutikId`. */
+@Injectable()
+export class SupplierDatabaseRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async getAll(): Promise<Supplier[]> {
+    return this.prisma.supplier.findMany({
+      orderBy: { hiboutikId: 'asc' },
+    });
+  }
+
+  /** Creates or updates the supplier with the same `hiboutikId`. */
+  async upsert(supplier: SupplierCreateInput): Promise<Supplier> {
+    return this.prisma.supplier.upsert({
+      where: { hiboutikId: supplier.hiboutikId },
+      create: supplier,
+      update: supplier,
+    });
+  }
+
+  /**
+   * Deletes the suppliers that no longer exist in Hiboutik.
+   * Their products are kept: the relation is set to null (onDelete: SetNull).
+   */
+  async deleteMissing(keptHiboutikIds: number[]): Promise<number> {
+    const result = await this.prisma.supplier.deleteMany({
+      where: { hiboutikId: { notIn: keptHiboutikIds } },
+    });
+    return result.count;
+  }
+}
--- a/src/database/syncLock.database.repository.spec.ts
+++ b/src/database/syncLock.database.repository.spec.ts
@@ -0,0 +1,74 @@
+import { Logger } from '@nestjs/common';
+import { Client } from 'pg';
+import { SyncLockDatabaseRepository } from './syncLock.database.repository';
+
+jest.mock('pg', () => ({ Client: jest.fn() }));
+
+describe('SyncLockDatabaseRepository', () => {
+  const client = { on: jest.fn(), connect: jest.fn(), query: jest.fn(), end: jest.fn() };
+  const configService = { get: jest.fn().mockReturnValue('postgresql://user:pass@localhost:5432/db') };
+  let repository: SyncLockDatabaseRepository;
+
+  beforeAll(() => {
+    jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
+    jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (Client as unknown as jest.Mock).mockImplementation(() => client);
+    client.connect.mockResolvedValue(undefined);
+    client.end.mockResolvedValue(undefined);
+    client.query.mockResolvedValue({ rows: [{ locked: true }] });
+    repository = new SyncLockDatabaseRepository(configService as never);
+  });
+
+  it('takes the advisory lock on a dedicated connection and keeps it open', async () => {
+    const release = await repository.tryAcquire();
+
+    expect(release).toEqual(expect.any(Function));
+    expect(Client).toHaveBeenCalledWith({ connectionString: 'postgresql://user:pass@localhost:5432/db' });
+    expect(client.query).toHaveBeenCalledWith('SELECT pg_try_advisory_lock($1) AS locked', [expect.any(Number)]);
+    expect(client.end).not.toHaveBeenCalled();
+  });
+
+  it('returns null and closes the connection when the lock is already held', async () => {
+    client.query.mockResolvedValue({ rows: [{ locked: false }] });
+
+    await expect(repository.tryAcquire()).resolves.toBeNull();
+
+    expect(client.end).toHaveBeenCalledTimes(1);
+  });
+
+  it('unlocks then closes the connection on release', async () => {
+    const release = await repository.tryAcquire();
+
+    await release!();
+
+    expect(client.query).toHaveBeenLastCalledWith('SELECT pg_advisory_unlock($1)', [expect.any(Number)]);
+    expect(client.end).toHaveBeenCalledTimes(1);
+  });
+
+  it('still closes the connection, and does not throw, when the explicit unlock fails', async () => {
+    const release = await repository.tryAcquire();
+    client.query.mockRejectedValueOnce(new Error('connection lost'));
+
+    await expect(release!()).resolves.toBeUndefined();
+
+    expect(client.end).toHaveBeenCalledTimes(1);
+  });
+
+  it('closes the connection and rethrows when the lock query fails', async () => {
+    client.query.mockRejectedValue(new Error('boom'));
+
+    await expect(repository.tryAcquire()).rejects.toThrow('boom');
+
+    expect(client.end).toHaveBeenCalledTimes(1);
+  });
+
+  it('logs connection errors instead of leaving them unhandled', async () => {
+    await repository.tryAcquire();
+
+    expect(client.on).toHaveBeenCalledWith('error', expect.any(Function));
+  });
+});
--- a/src/database/syncLock.database.repository.ts
+++ b/src/database/syncLock.database.repository.ts
@@ -0,0 +1,52 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Client } from 'pg';
+
+/** Arbitrary constant identifying the Hiboutik synchronization among the Postgres advisory locks of the database. */
+const SYNC_LOCK_KEY = 727_001;
+
+/** Function releasing a lock acquired with `tryAcquire`. Never throws. */
+export type ReleaseLock = () => Promise<void>;
+
+/**
+ * Cross-instance lock for the synchronization, based on a Postgres session-level advisory lock.
+ * It lives on its own dedicated connection (not the Prisma pool, where lock and unlock could land on different
+ * connections) kept open for as long as the lock is held. If the process dies, Postgres closes the connection and
+ * releases the lock by itself: there is never a stale lock to clean up.
+ */
+@Injectable()
+export class SyncLockDatabaseRepository {
+  private readonly logger = new Logger('SyncLockDatabaseRepository');
+
+  constructor(private readonly configService: ConfigService) {}
+
+  /** @returns the function releasing the lock, or `null` if another instance (or process) already holds it. */
+  async tryAcquire(): Promise<ReleaseLock | null> {
+    const client = new Client({ connectionString: this.configService.get<string>('DATABASE_URL') });
+    // A lost connection means Postgres released the lock: log it instead of crashing the process on an unhandled 'error'
+    client.on('error', (error) => this.logger.error(`Synchronization lock connection error: ${error.message}`));
+    await client.connect();
+
+    try {
+      const { rows } = await client.query<{ locked: boolean }>('SELECT pg_try_advisory_lock($1) AS locked', [SYNC_LOCK_KEY]);
+      if (!rows[0]?.locked) {
+        await client.end();
+        return null;
+      }
+    } catch (error) {
+      await client.end().catch(() => undefined);
+      throw error;
+    }
+
+    return async () => {
+      try {
+        await client.query('SELECT pg_advisory_unlock($1)', [SYNC_LOCK_KEY]);
+      } catch (error) {
+        // Ending the connection below releases the lock anyway
+        this.logger.warn(`Failed to unlock the synchronization lock explicitly: ${(error as Error)?.message}`);
+      } finally {
+        await client.end().catch(() => undefined);
+      }
+    };
+  }
+}
--- a/src/filters/all-exceptions.filter.spec.ts
+++ b/src/filters/all-exceptions.filter.spec.ts
@@ -0,0 +1,58 @@
+import { BadRequestException, Logger } from '@nestjs/common';
+import { AllExceptionsFilter } from './all-exceptions.filter';
+
+describe('AllExceptionsFilter', () => {
+  const applicationRef = { reply: jest.fn(), isHeadersSent: jest.fn().mockReturnValue(false), end: jest.fn() };
+  const response = {};
+  const host = { getArgByIndex: jest.fn().mockReturnValue(response) };
+  let filter: AllExceptionsFilter;
+  let logError: jest.SpyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    logError = jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
+    filter = new AllExceptionsFilter(applicationRef as never);
+  });
+
+  it('answers a generic 500 for an unexpected error, without leaking its message', () => {
+    filter.catch(new Error('relation "customer" does not exist'), host as never);
+
+    expect(applicationRef.reply).toHaveBeenCalledTimes(1);
+    const [, body, status] = applicationRef.reply.mock.calls[0] as [unknown, { message: string }, number];
+    expect(status).toBe(500);
+    expect(JSON.stringify(body)).not.toContain('customer');
+  });
+
+  it('logs the message and stack of an unexpected error, never the raw object', () => {
+    const error = Object.assign(new Error('boom'), { config: { headers: { Authorization: 'Basic c2VjcmV0' } } });
+
+    filter.catch(error, host as never);
+
+    expect(logError).toHaveBeenCalledWith('Unhandled exception: boom', error.stack);
+    expect(JSON.stringify(logError.mock.calls)).not.toContain('c2VjcmV0');
+  });
+
+  it('keeps the status and body of deliberate HTTP exceptions', () => {
+    filter.catch(new BadRequestException('limit must be an integer'), host as never);
+
+    const [, body, status] = applicationRef.reply.mock.calls[0] as [unknown, { message: string }, number];
+    expect(status).toBe(400);
+    expect(body.message).toBe('limit must be an integer');
+    expect(logError).not.toHaveBeenCalled();
+  });
+
+  it('keeps the 4xx of HTTP-layer errors such as a payload too large', () => {
+    filter.catch(Object.assign(new Error('request entity too large'), { statusCode: 413 }), host as never);
+
+    const [, , status] = applicationRef.reply.mock.calls[0] as [unknown, unknown, number];
+    expect(status).toBe(413);
+  });
+
+  it('treats a 5xx HTTP-layer error as an unexpected one', () => {
+    filter.catch(Object.assign(new Error('upstream detail'), { statusCode: 502 }), host as never);
+
+    const [, body, status] = applicationRef.reply.mock.calls[0] as [unknown, unknown, number];
+    expect(status).toBe(500);
+    expect(JSON.stringify(body)).not.toContain('upstream');
+  });
+});
--- a/src/filters/all-exceptions.filter.ts
+++ b/src/filters/all-exceptions.filter.ts
@@ -0,0 +1,29 @@
+import { ArgumentsHost, Catch, HttpException, InternalServerErrorException, Logger } from '@nestjs/common';
+import { BaseExceptionFilter } from '@nestjs/core';
+
+/** Errors raised by the HTTP layer itself (malformed JSON, payload too large...) carry a 4xx `statusCode` but are not `HttpException`s. */
+function isClientHttpError(exception: unknown): boolean {
+  const statusCode = (exception as { statusCode?: unknown } | null)?.statusCode;
+  return typeof statusCode === 'number' && statusCode >= 400 && statusCode < 500;
+}
+
+/**
+ * Last line of defence: anything that is not a deliberate HTTP error (Prisma, axios, bug...) is logged with its stack
+ * (message and stack only, never the raw error object: it may carry credentials) and answered with a generic 500,
+ * so no internal detail (SQL, table names, URLs, stack) ever reaches the client.
+ */
+@Catch()
+export class AllExceptionsFilter extends BaseExceptionFilter {
+  private readonly logger = new Logger('ExceptionsFilter');
+
+  catch(exception: unknown, host: ArgumentsHost): void {
+    if (exception instanceof HttpException || isClientHttpError(exception)) {
+      super.catch(exception, host);
+      return;
+    }
+
+    const error = exception as Error | undefined;
+    this.logger.error(`Unhandled exception: ${error?.message}`, error?.stack);
+    super.catch(new InternalServerErrorException(), host);
+  }
+}
--- a/src/hiboutik/brand.hiboutik.repository.ts
+++ b/src/hiboutik/brand.hiboutik.repository.ts
@@ -0,0 +1,16 @@
+import { Injectable } from '@nestjs/common';
+import { HiboutikClient } from './hiboutik.client';
+import { BrandHiboutikDto } from '../models/hiboutikDTO/brand.hiboutik.dto';
+
+/** Reads brands from the Hiboutik API. */
+@Injectable()
+export class BrandHiboutikRepository {
+  constructor(private readonly hiboutikClient: HiboutikClient) {}
+
+  async getBrands(): Promise<BrandHiboutikDto[]> {
+    return this.hiboutikClient.getAllPages<BrandHiboutikDto>('/brands', {
+      order_by: 'brand_id',
+      sort: 'ASC',
+    });
+  }
+}
--- a/src/hiboutik/category.hiboutik.repository.ts
+++ b/src/hiboutik/category.hiboutik.repository.ts
@@ -0,0 +1,17 @@
+import { Injectable } from '@nestjs/common';
+import { CategoryHiboutikDto } from '../models/hiboutikDTO/category.hiboutik.dto';
+import { HiboutikClient } from './hiboutik.client';
+
+/** Reads categories from the Hiboutik API. */
+@Injectable()
+export class CategoryHiboutikRepository {
+  constructor(private readonly hiboutikClient: HiboutikClient) {}
+
+  /** Sorted by parent id, which does not guarantee that a parent comes before its children. */
+  async getCategories(): Promise<CategoryHiboutikDto[]> {
+    return this.hiboutikClient.getAllPages<CategoryHiboutikDto>('/categories', {
+      order_by: 'category_id_parent',
+      sort: 'ASC',
+    });
+  }
+}
--- a/src/hiboutik/customer.hiboutik.repository.ts
+++ b/src/hiboutik/customer.hiboutik.repository.ts
@@ -0,0 +1,40 @@
+import { Injectable } from '@nestjs/common';
+import { HiboutikClient } from './hiboutik.client';
+import {
+  CustomerAddressDetailsHiboutikDto,
+  CustomerHiboutikDto,
+  FullCustomerHiboutikDto,
+} from '../models/hiboutikDTO/customer.hiboutik.dto';
+
+/** Reads customers from the Hiboutik API. */
+@Injectable()
+export class CustomerHiboutikRepository {
+  constructor(private readonly hiboutikClient: HiboutikClient) {}
+
+  /** Customer summaries only: use {@link getCustomerById} for addresses and sales. */
+  async getCustomers(): Promise<CustomerHiboutikDto[]> {
+    return this.hiboutikClient.getAllPages<CustomerHiboutikDto>('/customers');
+  }
+
+  /**
+   * Full customer, with its addresses and sales (Hiboutik answers with a one-element array).
+   * @throws if the customer does not exist.
+   */
+  async getCustomerById(id: number): Promise<FullCustomerHiboutikDto> {
+    const data = await this.hiboutikClient.get<FullCustomerHiboutikDto[]>('/customer/' + String(id));
+    const customer = data[0];
+    if (!customer) throw new Error(`Hiboutik customer ${id} not found`);
+    return customer;
+  }
+
+  /**
+   * Address with its company details (Hiboutik answers with a one-element array).
+   * @throws if the address does not exist.
+   */
+  async getAddressById(id: number): Promise<CustomerAddressDetailsHiboutikDto> {
+    const data = await this.hiboutikClient.get<CustomerAddressDetailsHiboutikDto[]>('/customers_addresses/' + String(id));
+    const address = data[0];
+    if (!address) throw new Error(`Hiboutik address ${id} not found`);
+    return address;
+  }
+}
--- a/src/hiboutik/hiboutik.client.spec.ts
+++ b/src/hiboutik/hiboutik.client.spec.ts
@@ -0,0 +1,66 @@
+import { of, throwError } from 'rxjs';
+import { HiboutikClient } from './hiboutik.client';
+
+describe('HiboutikClient', () => {
+  const httpService = { get: jest.fn() };
+  const configService = { get: jest.fn((key: string) => (key === 'HIBOUTIK_BASE_URL' ? 'https://shop.hiboutik.test/api' : 'x')) };
+  let client: HiboutikClient;
+
+  const answer = (data: unknown) => of({ data });
+  const page = (size: number) => Array.from({ length: size }, (_, index) => ({ id: index }));
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    client = new HiboutikClient(httpService as never, configService as never);
+  });
+
+  describe('getList', () => {
+    it('returns the list of a 2xx answer, empty or not', async () => {
+      httpService.get.mockReturnValueOnce(answer([{ id: 1 }])).mockReturnValueOnce(answer([]));
+
+      await expect(client.getList('/x')).resolves.toEqual([{ id: 1 }]);
+      await expect(client.getList('/x')).resolves.toEqual([]);
+    });
+
+    it('treats a 2xx answer without body as an empty list', async () => {
+      httpService.get.mockReturnValueOnce(answer('')).mockReturnValueOnce(answer(null));
+
+      await expect(client.getList('/x')).resolves.toEqual([]);
+      await expect(client.getList('/x')).resolves.toEqual([]);
+    });
+
+    it('rejects a 2xx answer that is not a list, without leaking its content', async () => {
+      httpService.get.mockReturnValueOnce(answer({ error: 'secret details' }));
+
+      const result = client.getList('/x');
+
+      await expect(result).rejects.toThrow('a list was expected');
+      await expect(result).rejects.not.toThrow('secret details');
+    });
+
+    it('lets HTTP errors through', async () => {
+      httpService.get.mockReturnValueOnce(throwError(() => new Error('Request failed with status code 500')));
+
+      await expect(client.getList('/x')).rejects.toThrow('500');
+    });
+  });
+
+  describe('getAllPages', () => {
+    it('walks the pages until a short one', async () => {
+      httpService.get.mockReturnValueOnce(answer(page(250))).mockReturnValueOnce(answer(page(10)));
+
+      const results = await client.getAllPages('/x');
+
+      expect(results).toHaveLength(260);
+      expect(httpService.get).toHaveBeenCalledTimes(2);
+    });
+
+    it('fails as a whole when a later page fails, instead of returning a truncated list', async () => {
+      httpService.get
+        .mockReturnValueOnce(answer(page(250)))
+        .mockReturnValueOnce(throwError(() => new Error('Request failed with status code 502')));
+
+      await expect(client.getAllPages('/x')).rejects.toThrow('502');
+    });
+  });
+});
--- a/src/hiboutik/hiboutik.client.ts
+++ b/src/hiboutik/hiboutik.client.ts
@@ -0,0 +1,66 @@
+import { Injectable } from '@nestjs/common';
+import { HttpService } from '@nestjs/axios';
+import { ConfigService } from '@nestjs/config';
+import { firstValueFrom } from 'rxjs';
+
+/** Results per page of every paginated Hiboutik endpoint (see "Results per page" in the API docs). */
+const HIBOUTIK_PAGE_SIZE = 250;
+
+/** Low-level HTTP client for the Hiboutik REST API: base URL and Basic auth credentials come from the environment. */
+@Injectable()
+export class HiboutikClient {
+  private readonly baseUrl: string;
+  private readonly authHeader: string;
+
+  constructor(
+    private readonly httpService: HttpService,
+    private readonly configService: ConfigService,
+  ) {
+    const username = this.configService.get<string>('HIBOUTIK_USERNAME') ?? '';
+    const password = this.configService.get<string>('HIBOUTIK_PASSWORD') ?? '';
+    this.authHeader = `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
+    this.baseUrl = this.configService.get<string>('HIBOUTIK_BASE_URL') ?? '';
+  }
+
+  /** GET on a Hiboutik path (relative to `HIBOUTIK_BASE_URL`), returns the response body. */
+  async get<T>(path: string, params?: Record<string, unknown>): Promise<T> {
+    const response = await firstValueFrom(
+      this.httpService.get<T>(`${this.baseUrl}${path}`, {
+        headers: { Authorization: this.authHeader },
+        params,
+      }),
+    );
+    return response.data;
+  }
+
+  /**
+   * GET on a list endpoint. HTTP errors (4xx/5xx) throw, a 2xx answer without body is an empty list, and any other
+   * non-list body throws: an empty list triggers deletions in the sync, so it must never be inferred from a malformed answer.
+   */
+  async getList<T>(path: string, params?: Record<string, unknown>): Promise<T[]> {
+    const data = await this.get<T[] | '' | null | undefined>(path, params);
+    if (data === '' || data == null) return [];
+    if (!Array.isArray(data)) throw new Error(`Unexpected answer from Hiboutik ${path}: a list was expected`);
+    return data;
+  }
+
+  /**
+   * Fetches every page of a paginated endpoint (`p` param, starting at 1) and concatenates the results.
+   * Only for paginated endpoints: on a non-paginated one, a full first page would loop forever on the same results.
+   */
+  async getAllPages<T>(path: string, baseParams: Record<string, unknown> = {}): Promise<T[]> {
+    const results: T[] = [];
+    let page = 1;
+
+    while (true) {
+      const pageData = await this.getList<T>(path, { ...baseParams, p: page });
+      if (pageData.length === 0) break;
+      results.push(...pageData);
+      // A page smaller than the page size is the last one: no need to request an empty page
+      if (pageData.length < HIBOUTIK_PAGE_SIZE) break;
+      page++;
+    }
+
+    return results;
+  }
+}
--- a/src/hiboutik/product.hiboutik.repository.ts
+++ b/src/hiboutik/product.hiboutik.repository.ts
@@ -0,0 +1,17 @@
+import { Injectable } from '@nestjs/common';
+import { HiboutikClient } from './hiboutik.client';
+import { ProductHiboutikDto } from '../models/hiboutikDTO/product.hiboutik.dto';
+
+/** Reads products from the Hiboutik API. */
+@Injectable()
+export class ProductHiboutikRepository {
+  constructor(private readonly hiboutikClient: HiboutikClient) {}
+
+  /** All products, archived ones included, with their sizes and per-size rules. */
+  async getProducts(): Promise<ProductHiboutikDto[]> {
+    return this.hiboutikClient.getAllPages<ProductHiboutikDto>('/products', {
+      order_by: 'product_id',
+      sort: 'ASC',
+    });
+  }
+}
--- a/src/hiboutik/sale.hiboutik.repository.ts
+++ b/src/hiboutik/sale.hiboutik.repository.ts
@@ -0,0 +1,20 @@
+import { Injectable } from '@nestjs/common';
+import { HiboutikClient } from './hiboutik.client';
+import { SaleHiboutikDto } from '../models/hiboutikDTO/sale.hiboutik.dto';
+
+/** Reads sales from the Hiboutik API. */
+@Injectable()
+export class SaleHiboutikRepository {
+  constructor(private readonly hiboutikClient: HiboutikClient) {}
+
+  /**
+   * Full sale, with its lines (Hiboutik answers with a one-element array).
+   * @throws if the sale does not exist.
+   */
+  async getSaleById(id: number): Promise<SaleHiboutikDto> {
+    const data = await this.hiboutikClient.get<SaleHiboutikDto[]>('/sales/' + String(id));
+    const sale = data[0];
+    if (!sale) throw new Error(`Hiboutik sale ${id} not found`);
+    return sale;
+  }
+}
--- a/src/hiboutik/stock.hiboutik.repository.ts
+++ b/src/hiboutik/stock.hiboutik.repository.ts
@@ -0,0 +1,20 @@
+import { Injectable } from '@nestjs/common';
+import { HiboutikClient } from './hiboutik.client';
+import { StockHiboutikDto } from '../models/hiboutikDTO/stock.hiboutik.dto';
+
+/** Reads available stocks from the Hiboutik API. */
+@Injectable()
+export class StockHiboutikRepository {
+  constructor(private readonly hiboutikClient: HiboutikClient) {}
+
+  /** Stock of every product and size, all warehouses combined. Not paginated. */
+  async getStocks(): Promise<StockHiboutikDto[]> {
+    const stocks = await this.hiboutikClient.getList<StockHiboutikDto>('/stock_available/all_wh', {});
+    // Hiboutik may return ids as strings: normalize them so strict comparisons work downstream
+    return stocks.map((stock) => ({
+      ...stock,
+      product_id: Number(stock.product_id),
+      product_size: Number(stock.product_size),
+    }));
+  }
+}
--- a/src/hiboutik/supplier.hiboutik.repository.ts
+++ b/src/hiboutik/supplier.hiboutik.repository.ts
@@ -0,0 +1,17 @@
+import { Injectable } from '@nestjs/common';
+import { HiboutikClient } from './hiboutik.client';
+import { SupplierHiboutikDto } from '../models/hiboutikDTO/supplier.hiboutik.dto';
+
+/** Reads suppliers from the Hiboutik API. */
+@Injectable()
+export class SupplierHiboutikRepository {
+  constructor(private readonly hiboutikClient: HiboutikClient) {}
+
+  /** `/suppliers` is not paginated: everything comes in one call. */
+  async getSuppliers(): Promise<SupplierHiboutikDto[]> {
+    return this.hiboutikClient.getList<SupplierHiboutikDto>('/suppliers', {
+      order_by: 'supplier_id',
+      sort: 'ASC',
+    });
+  }
+}
--- a/src/main.ts
+++ b/src/main.ts
@@ -1,8 +1,36 @@
+import { ValidationPipe } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
 import { NestFactory } from '@nestjs/core';
+import { NestExpressApplication } from '@nestjs/platform-express';
+import helmet from 'helmet';
 import { AppModule } from './app.module';

 async function bootstrap() {
-  const app = await NestFactory.create(AppModule);
-  await app.listen(process.env.PORT ?? 3000);
+  const app = await NestFactory.create<NestExpressApplication>(AppModule);
+  const config = app.get(ConfigService);
+
+  // Security headers (also removes X-Powered-By)
+  app.use(helmet());
+
+  // Behind a reverse proxy, trust its X-Forwarded-For so rate limiting sees the real client IP
+  const trustProxy = config.get<number>('TRUST_PROXY');
+  if (trustProxy) app.set('trust proxy', trustProxy);
+
+  // CORS is disabled unless origins are explicitly allowed
+  const origins = (config.get<string>('CORS_ORIGINS') ?? '')
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+  if (origins.length > 0) app.enableCors({ origin: origins });
+
+  app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }));
+
+  // Disconnect Prisma cleanly on SIGTERM/SIGINT
+  app.enableShutdownHooks();
+
+  const server = await app.listen(config.get<number>('PORT') ?? 3000);
+  // Drop slow clients holding sockets open (Slowloris): every endpoint answers fast, POST /sync runs in the background
+  server.headersTimeout = 15_000;
+  server.requestTimeout = 30_000;
 }
-bootstrap();
+void bootstrap();
--- a/src/models/converter/brand.converter.ts
+++ b/src/models/converter/brand.converter.ts
@@ -0,0 +1,19 @@
+import { Injectable } from '@nestjs/common';
+import { Converter } from './converter';
+import { BrandHiboutikDto } from '../hiboutikDTO/brand.hiboutik.dto';
+import { BrandCreateInput } from '../../../prisma/generated/models/Brand';
+
+@Injectable()
+export class BrandConverter extends Converter<BrandCreateInput, BrandHiboutikDto> {
+  fromHiboutik(dto: BrandHiboutikDto): BrandCreateInput {
+    return {
+      hiboutikId: dto.brand_id,
+      name: dto.brand_name,
+      enabled: dto.brand_enabled == 1,
+    };
+  }
+
+  toHiboutik(): BrandHiboutikDto {
+    throw new Error('Method not implemented.');
+  }
+}
--- a/src/models/converter/category.converter.ts
+++ b/src/models/converter/category.converter.ts
@@ -0,0 +1,22 @@
+import { Injectable } from '@nestjs/common';
+import { CategoryHiboutikDto } from '../hiboutikDTO/category.hiboutik.dto';
+import { Converter } from './converter';
+import { CategoryCreateInput } from '../../../prisma/generated/models/Category';
+
+@Injectable()
+export class CategoryConverter extends Converter<CategoryCreateInput, CategoryHiboutikDto> {
+  /** The parent is not set here: it is linked afterwards, once every category exists (see CategoryHiboutikService). */
+  fromHiboutik(hiboutikDto: CategoryHiboutikDto): CategoryCreateInput {
+    return {
+      hiboutikId: hiboutikDto.category_id,
+      name: hiboutikDto.category_name,
+      enabled: hiboutikDto.category_enabled == 1,
+      position: Number(hiboutikDto.category_position) || 0,
+      webEnabled: hiboutikDto.category_enabled_www == 1,
+    };
+  }
+
+  toHiboutik(): CategoryHiboutikDto {
+    throw new Error('Method not implemented.');
+  }
+}
--- a/src/models/converter/converter.ts
+++ b/src/models/converter/converter.ts
@@ -0,0 +1,29 @@
+/**
+ * Maps a Hiboutik DTO to a Prisma input, and back. One implementation per synced entity.
+ * @typeParam Model Prisma `*CreateInput` of the entity.
+ * @typeParam Dto Hiboutik payload of the entity.
+ */
+export abstract class Converter<Model, Dto> {
+  /**
+   * Builds the Prisma input from a Hiboutik DTO. It is used for both create and update (upsert):
+   * a field set to `undefined` keeps its stored value on update, `null` erases it.
+   */
+  abstract fromHiboutik(dto: Dto): Model;
+
+  /** Not implemented yet: nothing is written back to Hiboutik. */
+  abstract toHiboutik(model: Model): Dto;
+
+  /** Returns [] for a missing or non-array input. */
+  toHiboutikList(models: Model[]): Dto[] {
+    if (!models || !Array.isArray(models)) return [];
+
+    return models.map((model) => this.toHiboutik(model));
+  }
+
+  /** Returns [] for a missing or non-array input. */
+  fromHiboutikList(hiboutikDtos: Dto[]): Model[] {
+    if (!hiboutikDtos || !Array.isArray(hiboutikDtos)) return [];
+
+    return hiboutikDtos.map((hiboutikDto) => this.fromHiboutik(hiboutikDto));
+  }
+}
--- a/src/models/converter/customer.converter.spec.ts
+++ b/src/models/converter/customer.converter.spec.ts
@@ -0,0 +1,44 @@
+import { CustomerConverter } from './customer.converter';
+import { FullCustomerHiboutikDto } from '../hiboutikDTO/customer.hiboutik.dto';
+
+const hiboutikCustomer = (overrides: Partial<FullCustomerHiboutikDto> = {}): FullCustomerHiboutikDto =>
+  ({
+    customers_id: 42,
+    first_name: 'Jane',
+    last_name: 'Doe',
+    email: 'jane@example.com',
+    phone: '0600000000',
+    date_of_birth: '1990-05-12',
+    updated_at: '2026-06-28 17:02:55',
+    ...overrides,
+  }) as FullCustomerHiboutikDto;
+
+describe('CustomerConverter', () => {
+  const converter = new CustomerConverter();
+
+  it('maps a Hiboutik customer', () => {
+    expect(converter.fromHiboutik(hiboutikCustomer())).toEqual({
+      dateOfBirth: new Date('1990-05-12'),
+      email: 'jane@example.com',
+      firstName: 'Jane',
+      hiboutikId: 42,
+      hiboutikUpdatedAt: new Date('2026-06-28T17:02:55'),
+      lastName: 'Doe',
+      phone: '0600000000',
+    });
+  });
+
+  it('ignores an invalid date of birth', () => {
+    expect(converter.fromHiboutik(hiboutikCustomer({ date_of_birth: '0000-00-00' })).dateOfBirth).toBeUndefined();
+  });
+
+  it('keeps the stored email when Hiboutik has none (undefined)', () => {
+    expect(converter.fromHiboutik(hiboutikCustomer({ email: '' })).email).toBeUndefined();
+    expect(converter.fromHiboutik(hiboutikCustomer({ email: null as unknown as string })).email).toBeUndefined();
+  });
+
+  it('erases the phone when Hiboutik has none (null)', () => {
+    expect(converter.fromHiboutik(hiboutikCustomer({ phone: '' })).phone).toBeNull();
+    expect(converter.fromHiboutik(hiboutikCustomer({ phone: null as unknown as string })).phone).toBeNull();
+  });
+});
--- a/src/models/converter/customer.converter.ts
+++ b/src/models/converter/customer.converter.ts
@@ -0,0 +1,25 @@
+import { Injectable } from '@nestjs/common';
+import { Converter } from './converter';
+import { CustomerCreateInput } from '../../../prisma/generated/models/Customer';
+import { FullCustomerHiboutikDto } from '../hiboutikDTO/customer.hiboutik.dto';
+import { parseHiboutikDate } from '../../utils/date';
+
+@Injectable()
+export class CustomerConverter extends Converter<CustomerCreateInput, FullCustomerHiboutikDto> {
+  fromHiboutik(dto: FullCustomerHiboutikDto): CustomerCreateInput {
+    return {
+      dateOfBirth: parseHiboutikDate(dto.date_of_birth),
+      // undefined (not null) on purpose: an email removed in Hiboutik must not erase the one stored in database
+      email: dto.email?.trim() || undefined,
+      firstName: dto.first_name,
+      hiboutikId: dto.customers_id,
+      hiboutikUpdatedAt: parseHiboutikDate(dto.updated_at),
+      lastName: dto.last_name,
+      // null (not undefined) so that a phone removed in Hiboutik is also removed in database
+      phone: dto.phone?.trim() || null,
+    };
+  }
+  toHiboutik(): FullCustomerHiboutikDto {
+    throw new Error('Method not implemented.');
+  }
+}
--- a/src/models/converter/customerAddress.converter.spec.ts
+++ b/src/models/converter/customerAddress.converter.spec.ts
@@ -0,0 +1,89 @@
+import { CustomerAddressConverter } from './customerAddress.converter';
+import { CustomerAddressHiboutikDto } from '../hiboutikDTO/customer.hiboutik.dto';
+
+const hiboutikAddress = (overrides: Partial<CustomerAddressHiboutikDto> = {}): CustomerAddressHiboutikDto =>
+  ({
+    address_id: 7,
+    customers_id: 42,
+    first_name: 'Jane',
+    last_name: 'Doe',
+    company: 'ACME',
+    phone: '0600000000',
+    address: ' 1 rue de la Paix ',
+    zip_code: '75002',
+    city: 'Paris',
+    state: '',
+    country: 'FRA',
+    other: 'Bât. B',
+    default: 1,
+    ...overrides,
+  }) as CustomerAddressHiboutikDto;
+
+describe('CustomerAddressConverter', () => {
+  const converter = new CustomerAddressConverter();
+
+  it('maps a Hiboutik address', () => {
+    expect(converter.fromHiboutik(hiboutikAddress())).toEqual({
+      address: '1 rue de la Paix',
+      city: 'Paris',
+      company: 'ACME',
+      country: 'FRA',
+      firstName: 'Jane',
+      hiboutikId: 7,
+      isDefault: true,
+      lastName: 'Doe',
+      other: 'Bât. B',
+      phone: '0600000000',
+      state: null,
+      zipCode: '75002',
+      customer: { connect: { hiboutikId: 42 } },
+    });
+  });
+
+  it('accepts ids and flags sent as strings', () => {
+    const address = converter.fromHiboutik(hiboutikAddress({ address_id: '8', customers_id: '43', default: '0' } as never));
+    expect(address.hiboutikId).toBe(8);
+    expect(address.isDefault).toBe(false);
+    expect(address.customer).toEqual({ connect: { hiboutikId: 43 } });
+  });
+
+  it('erases empty optional fields (null) and defaults empty required ones to ""', () => {
+    const address = converter.fromHiboutik(
+      hiboutikAddress({ company: ' ', phone: null as unknown as string, other: '', first_name: null as unknown as string }),
+    );
+    expect(address.company).toBeNull();
+    expect(address.phone).toBeNull();
+    expect(address.other).toBeNull();
+    expect(address.firstName).toBe('');
+  });
+
+  describe('company details', () => {
+    const details = { tax_number: ' FR123 ', company_number: '12345678900012', legal_status: 'SAS', updated_at: '2026-11-01 10:00:00' };
+
+    it('maps them when fetched for an address with a company', () => {
+      const address = converter.fromHiboutik({ ...hiboutikAddress(), ...details });
+      expect(address.taxNumber).toBe('FR123');
+      expect(address.companyNumber).toBe('12345678900012');
+      expect(address.legalStatus).toBe('SAS');
+    });
+
+    it('erases empty fetched values (null)', () => {
+      const address = converter.fromHiboutik({ ...hiboutikAddress(), ...details, tax_number: '' });
+      expect(address.taxNumber).toBeNull();
+    });
+
+    it('keeps the stored ones when not fetched (undefined)', () => {
+      const address = converter.fromHiboutik(hiboutikAddress());
+      expect(address.taxNumber).toBeUndefined();
+      expect(address.companyNumber).toBeUndefined();
+      expect(address.legalStatus).toBeUndefined();
+    });
+
+    it('erases them when the address has no company (null)', () => {
+      const address = converter.fromHiboutik({ ...hiboutikAddress({ company: '' }), ...details });
+      expect(address.taxNumber).toBeNull();
+      expect(address.companyNumber).toBeNull();
+      expect(address.legalStatus).toBeNull();
+    });
+  });
+});
--- a/src/models/converter/customerAddress.converter.ts
+++ b/src/models/converter/customerAddress.converter.ts
@@ -0,0 +1,49 @@
+import { Injectable } from '@nestjs/common';
+import { Converter } from './converter';
+import { CustomerAddressCreateInput } from '../../../prisma/generated/models/CustomerAddress';
+import { CustomerAddressDetailsHiboutikDto, CustomerAddressHiboutikDto } from '../hiboutikDTO/customer.hiboutik.dto';
+
+/** Trimmed value, `null` when empty so that a value removed in Hiboutik is also removed in database. */
+const optional = (value: string | null | undefined): string | null => value?.trim() || null;
+const required = (value: string | null | undefined): string => value?.trim() ?? '';
+
+/**
+ * Maps an address. Company details (tax/company number, legal status) are:
+ * - `null` when the address has no company,
+ * - mapped when `dto` comes from `GET /customers_addresses/:id` ({@link CustomerAddressDetailsHiboutikDto}),
+ * - `undefined` (stored values kept) when the details were not fetched.
+ */
+@Injectable()
+export class CustomerAddressConverter extends Converter<
+  CustomerAddressCreateInput,
+  CustomerAddressHiboutikDto | CustomerAddressDetailsHiboutikDto
+> {
+  fromHiboutik(dto: CustomerAddressHiboutikDto | CustomerAddressDetailsHiboutikDto): CustomerAddressCreateInput {
+    const company = optional(dto.company);
+    const hasDetails = 'tax_number' in dto;
+    const companyDetail = (value: string | null | undefined) => (!company ? null : hasDetails ? optional(value) : undefined);
+    const details = dto as Partial<CustomerAddressDetailsHiboutikDto>;
+
+    return {
+      address: required(dto.address),
+      city: required(dto.city),
+      company,
+      companyNumber: companyDetail(details.company_number),
+      country: required(dto.country),
+      firstName: required(dto.first_name),
+      hiboutikId: Number(dto.address_id),
+      isDefault: Number(dto.default) === 1,
+      lastName: required(dto.last_name),
+      legalStatus: companyDetail(details.legal_status),
+      other: optional(dto.other),
+      phone: optional(dto.phone),
+      state: optional(dto.state),
+      taxNumber: companyDetail(details.tax_number),
+      zipCode: required(dto.zip_code),
+      customer: { connect: { hiboutikId: Number(dto.customers_id) } },
+    };
+  }
+  toHiboutik(): CustomerAddressHiboutikDto {
+    throw new Error('Method not implemented.');
+  }
+}
--- a/src/models/converter/order.converter.spec.ts
+++ b/src/models/converter/order.converter.spec.ts
@@ -0,0 +1,80 @@
+import { OrderConverter } from './order.converter';
+import { SaleHiboutikDto, SaleLineHiboutikDto } from '../hiboutikDTO/sale.hiboutik.dto';
+
+const hiboutikLine = (overrides: Partial<SaleLineHiboutikDto> = {}): SaleLineHiboutikDto => ({
+  line_item_id: 3,
+  product_id: 746,
+  product_size: 1,
+  quantity: 2,
+  product_model: 'KATSEYE - WILD',
+  product_barcode: '2430010007467',
+  size_name: 'Daniela',
+  item_unit_gross_wo_discount: '19.00',
+  item_unit_gross: '17.10',
+  ...overrides,
+});
+
+const hiboutikSale = (overrides: Partial<SaleHiboutikDto> = {}): SaleHiboutikDto =>
+  ({
+    sale_id: 5,
+    created_at: '2026-10-18 11:00:21',
+    completed_at: '2026-10-18 11:01:04',
+    customer_id: 1,
+    total: '34.20',
+    quotation: 0,
+    line_items: [hiboutikLine()],
+    ...overrides,
+  }) as SaleHiboutikDto;
+
+describe('OrderConverter', () => {
+  const converter = new OrderConverter();
+
+  it('maps a completed Hiboutik sale with its lines', () => {
+    expect(converter.fromHiboutik(hiboutikSale())).toEqual({
+      hiboutikSaleId: 5,
+      orderedAt: new Date('2026-10-18T11:01:04'),
+      source: 'STORE',
+      status: 'COMPLETED',
+      total: '34.20',
+      customer: { connect: { hiboutikId: 1 } },
+      lines: [
+        {
+          barcode: '2430010007467',
+          hiboutikProductId: 746,
+          hiboutikSizeId: 1,
+          productName: 'KATSEYE - WILD',
+          quantity: 2,
+          unitPrice: '17.10',
+          versionName: 'Daniela',
+        },
+      ],
+    });
+  });
+
+  it('maps a sale not completed yet as PENDING, ordered at its creation date', () => {
+    const order = converter.fromHiboutik(hiboutikSale({ completed_at: '0000-00-00 00:00:00' }));
+    expect(order.status).toBe('PENDING');
+    expect(order.orderedAt).toEqual(new Date('2026-10-18T11:00:21'));
+  });
+
+  it('throws when the sale has no valid date', () => {
+    expect(() => converter.fromHiboutik(hiboutikSale({ completed_at: '0000-00-00 00:00:00', created_at: '' }))).toThrow();
+  });
+
+  it('leaves an anonymous sale without customer', () => {
+    expect(converter.fromHiboutik(hiboutikSale({ customer_id: 0 })).customer).toBeUndefined();
+  });
+
+  it('uses the product name as version name and null barcode for a product without sizes', () => {
+    const [line] = converter.fromHiboutik(
+      hiboutikSale({ line_items: [hiboutikLine({ product_size: 0, size_name: '', product_barcode: '' })] }),
+    ).lines;
+    expect(line.versionName).toBe('KATSEYE - WILD');
+    expect(line.barcode).toBeNull();
+    expect(line.hiboutikSizeId).toBe(0);
+  });
+
+  it('accepts a sale without lines', () => {
+    expect(converter.fromHiboutik(hiboutikSale({ line_items: undefined as never })).lines).toEqual([]);
+  });
+});
--- a/src/models/converter/order.converter.ts
+++ b/src/models/converter/order.converter.ts
@@ -0,0 +1,49 @@
+import { Injectable } from '@nestjs/common';
+import { Converter } from './converter';
+import { OrderSource } from '../../../prisma/generated/client';
+import { OrderWithLinesInput } from '../../../prisma/customObjects/prisma.custom.object';
+import { SaleHiboutikDto, SaleLineHiboutikDto } from '../hiboutikDTO/sale.hiboutik.dto';
+import { parseHiboutikDate } from '../../utils/date';
+import { OrderStatus } from '../orderStatus';
+
+@Injectable()
+export class OrderConverter extends Converter<OrderWithLinesInput, SaleHiboutikDto> {
+  /**
+   * Maps a Hiboutik sale to an order (source STORE) with a snapshot of its lines.
+   * @throws if the sale has neither a valid completion date nor a valid creation date.
+   */
+  fromHiboutik(dto: SaleHiboutikDto): OrderWithLinesInput {
+    const completedAt = parseHiboutikDate(dto.completed_at);
+    const orderedAt = completedAt ?? parseHiboutikDate(dto.created_at);
+    if (!orderedAt) throw new Error(`Hiboutik sale ${dto.sale_id} has no valid date`);
+
+    const customerId = Number(dto.customer_id);
+    return {
+      hiboutikSaleId: Number(dto.sale_id),
+      orderedAt,
+      source: OrderSource.STORE,
+      status: completedAt ? OrderStatus.COMPLETED : OrderStatus.PENDING,
+      total: dto.total,
+      // 0 for an anonymous sale
+      customer: customerId > 0 ? { connect: { hiboutikId: customerId } } : undefined,
+      lines: (dto.line_items ?? []).map((line) => this.lineFromHiboutik(line)),
+    };
+  }
+
+  private lineFromHiboutik(line: SaleLineHiboutikDto): OrderWithLinesInput['lines'][number] {
+    return {
+      barcode: line.product_barcode?.trim() || null,
+      hiboutikProductId: Number(line.product_id),
+      hiboutikSizeId: Number(line.product_size),
+      productName: line.product_model,
+      quantity: Number(line.quantity),
+      unitPrice: line.item_unit_gross,
+      // same rule as ProductVersion: the product name for a product without sizes
+      versionName: line.size_name?.trim() || line.product_model,
+    };
+  }
+
+  toHiboutik(): SaleHiboutikDto {
+    throw new Error('Method not implemented.');
+  }
+}
--- a/src/models/converter/product.converter.spec.ts
+++ b/src/models/converter/product.converter.spec.ts
@@ -0,0 +1,59 @@
+import { ProductConverter } from './product.converter';
+import { ProductHiboutikDto } from '../hiboutikDTO/product.hiboutik.dto';
+
+const hiboutikProduct = (overrides: Partial<ProductHiboutikDto> = {}): ProductHiboutikDto => ({
+  product_id: 1,
+  product_model: 'BOUTEILLE MÉTAL ISOTHERME 260ML BT21',
+  product_barcode: '8435497280048',
+  product_brand: 1,
+  product_supplier: 2,
+  product_price: '13.99',
+  product_discount_price: '0.00',
+  product_supply_price: '7.49',
+  product_category: 19,
+  product_display_www: 0,
+  product_arch: 0,
+  products_desc: '',
+  updated_at: '2026-06-28 17:02:55',
+  product_specific_rules: [],
+  ...overrides,
+});
+
+describe('ProductConverter', () => {
+  const converter = new ProductConverter();
+
+  it('maps a Hiboutik product', () => {
+    expect(converter.fromHiboutik(hiboutikProduct())).toEqual({
+      archived: false,
+      barcode: '8435497280048',
+      brand: { connect: { hiboutikId: 1 } },
+      category: { connect: { hiboutikId: 19 } },
+      description: '',
+      discountPrice: null,
+      hiboutikId: 1,
+      hiboutikUpdatedAt: new Date('2026-06-28T17:02:55'),
+      name: 'BOUTEILLE MÉTAL ISOTHERME 260ML BT21',
+      price: '13.99',
+      enabled: false,
+      supplier: { connect: { hiboutikId: 2 } },
+    });
+  });
+
+  it('maps archived, web display and discount price', () => {
+    const product = converter.fromHiboutik(hiboutikProduct({ product_arch: 1, product_display_www: 1, product_discount_price: '9.99' }));
+    expect(product.archived).toBe(true);
+    expect(product.enabled).toBe(true);
+    expect(product.discountPrice).toBe('9.99');
+  });
+
+  it('stores an empty barcode as null', () => {
+    expect(converter.fromHiboutik(hiboutikProduct({ product_barcode: '' })).barcode).toBeNull();
+  });
+
+  it('does not link missing relations', () => {
+    const product = converter.fromHiboutik(hiboutikProduct({ product_brand: 0, product_category: 0, product_supplier: 0 }));
+    expect(product.brand).toBeUndefined();
+    expect(product.category).toBeUndefined();
+    expect(product.supplier).toBeUndefined();
+  });
+});
--- a/src/models/converter/product.converter.ts
+++ b/src/models/converter/product.converter.ts
@@ -0,0 +1,31 @@
+import { Injectable } from '@nestjs/common';
+import { Converter } from './converter';
+import { ProductHiboutikDto } from '../hiboutikDTO/product.hiboutik.dto';
+import { ProductCreateInput } from '../../../prisma/generated/models/Product';
+import { parseHiboutikDate } from '../../utils/date';
+import { parseOptionalHiboutikPrice } from '../../utils/price';
+
+@Injectable()
+export class ProductConverter extends Converter<ProductCreateInput, ProductHiboutikDto> {
+  /** `globalStock` and versions are not set here: they depend on the stocks endpoint (see ProductHiboutikService). */
+  fromHiboutik(dto: ProductHiboutikDto): ProductCreateInput {
+    return {
+      archived: dto.product_arch == 1,
+      barcode: dto.product_barcode || null,
+      brand: dto.product_brand ? { connect: { hiboutikId: dto.product_brand } } : undefined,
+      category: dto.product_category ? { connect: { hiboutikId: dto.product_category } } : undefined,
+      description: dto.products_desc,
+      discountPrice: parseOptionalHiboutikPrice(dto.product_discount_price),
+      hiboutikId: dto.product_id,
+      hiboutikUpdatedAt: parseHiboutikDate(dto.updated_at),
+      name: dto.product_model,
+      price: dto.product_price,
+      enabled: dto.product_display_www == 1,
+      supplier: dto.product_supplier ? { connect: { hiboutikId: dto.product_supplier } } : undefined,
+    };
+  }
+
+  toHiboutik(): ProductHiboutikDto {
+    throw new Error('Method not implemented.');
+  }
+}
--- a/src/models/converter/supplier.converter.ts
+++ b/src/models/converter/supplier.converter.ts
@@ -0,0 +1,19 @@
+import { Injectable } from '@nestjs/common';
+import { SupplierHiboutikDto } from '../hiboutikDTO/supplier.hiboutik.dto';
+import { Converter } from './converter';
+import { SupplierCreateInput } from '../../../prisma/generated/models/Supplier';
+
+@Injectable()
+export class SupplierConverter extends Converter<SupplierCreateInput, SupplierHiboutikDto> {
+  fromHiboutik(dto: SupplierHiboutikDto): SupplierCreateInput {
+    return {
+      hiboutikId: dto.supplier_id,
+      name: dto.supplier_name,
+      enabled: dto.supplier_enabled == 1,
+    };
+  }
+
+  toHiboutik(): SupplierHiboutikDto {
+    throw new Error('Method not implemented.');
+  }
+}
--- a/src/models/hiboutikDTO/brand.hiboutik.dto.ts
+++ b/src/models/hiboutikDTO/brand.hiboutik.dto.ts
@@ -0,0 +1,7 @@
+/** Brand as returned by Hiboutik `GET /brands`. */
+export interface BrandHiboutikDto {
+  brand_id: number;
+  brand_name: string;
+  /** 1 = enabled, 0 = disabled. */
+  brand_enabled: number;
+}
--- a/src/models/hiboutikDTO/category.hiboutik.dto.ts
+++ b/src/models/hiboutikDTO/category.hiboutik.dto.ts
@@ -0,0 +1,18 @@
+/** Category as returned by Hiboutik `GET /categories`. */
+export interface CategoryHiboutikDto {
+  category_id: number;
+  category_name: string;
+  /** Id of the parent category, 0 for a root category. */
+  category_id_parent: number;
+  /** Enabled in the POS: 1 = yes, 0 = no. */
+  category_enabled: number;
+  /** Displayed on the website: 1 = yes, 0 = no. */
+  category_enabled_www: number;
+  /** Display order among its siblings. */
+  category_position: number;
+  category_bck_color: string;
+  category_color: string;
+  category_desc: string;
+  accounting_account: string;
+  category_ref_ext: string;
+}
--- a/src/models/hiboutikDTO/customer.hiboutik.dto.ts
+++ b/src/models/hiboutikDTO/customer.hiboutik.dto.ts
@@ -0,0 +1,91 @@
+/** Customer summary as returned by Hiboutik `GET /customers` (no addresses nor sales). */
+export interface CustomerHiboutikDto {
+  customers_id: number;
+  last_name: string;
+  first_name: string;
+  company: string;
+  email: string;
+  phone: string;
+  vat: string;
+  country: string;
+  /** "YYYY-MM-DD", "0000-00-00" when unknown. */
+  date_of_birth: string;
+  customers_code: string;
+  loyalty_points: number;
+  intial_loyalty_points: number;
+  validity: string;
+  prepaid_purchases: string;
+  store_credit: string;
+  turnover: string;
+  orders: number;
+  customer_ref_ext: string;
+  last_order_date: string;
+  /** Local time, "YYYY-MM-DD HH:mm:ss". */
+  updated_at: string;
+}
+
+/** Full customer as returned by Hiboutik `GET /customer/:customers_id`, with its addresses and sales. */
+export interface FullCustomerHiboutikDto extends CustomerHiboutikDto {
+  gender: number;
+  comments: string;
+  customers_id_referrer: number;
+  customers_misc: string;
+  accounting_account: string;
+  addresses: CustomerAddressHiboutikDto[];
+  sales: CustomerSaleHiboutikDto[];
+  tags: unknown[];
+  customers_referee: unknown[];
+}
+
+/** Address of a customer, embedded in {@link FullCustomerHiboutikDto}. Name and phone can differ from the customer's. */
+export interface CustomerAddressHiboutikDto {
+  address_id: number;
+  gender: string;
+  first_name: string;
+  last_name: string;
+  creation_date: string;
+  email: string;
+  phone: string;
+  company: string;
+  address: string;
+  zip_code: string;
+  city: string;
+  state: string;
+  country: string;
+  customers_id: number;
+  display: number;
+  editable: number;
+  /** 1 for the customer's default address. */
+  default: number;
+  other: string;
+}
+
+/**
+ * Address as returned by Hiboutik `GET /customers_addresses/:address_id`: the embedded address plus the company
+ * details and its last update. One API call per address, so only fetched for addresses with a company.
+ */
+export interface CustomerAddressDetailsHiboutikDto extends CustomerAddressHiboutikDto {
+  tax_number: string;
+  company_number: string;
+  legal_status: string;
+  /** Local time, "YYYY-MM-DD HH:mm:ss". */
+  updated_at: string;
+}
+
+/** Sale header embedded in {@link FullCustomerHiboutikDto}: no sale lines, they come from `GET /sales/:sale_id`. */
+export interface CustomerSaleHiboutikDto {
+  sale_id: number;
+  created_at: string;
+  completed_at: string;
+  date_z: number;
+  store_id: number;
+  vendor_id: number;
+  unique_sale_id: string;
+  customer_id: number;
+  currency: string;
+  /** Decimal as a string. */
+  total: string;
+  points: number;
+  billing_address: number;
+  shipping_address: number;
+}
--- a/src/models/hiboutikDTO/product.hiboutik.dto.ts
+++ b/src/models/hiboutikDTO/product.hiboutik.dto.ts
@@ -0,0 +1,46 @@
+/** Product as returned by Hiboutik `GET /products` (archived products included). */
+export interface ProductHiboutikDto {
+  product_id: number;
+  /** Product name. */
+  product_model: string;
+  /** Empty string when the product has no barcode. */
+  product_barcode: string;
+  /** Brand id, 0 when none. */
+  product_brand: number;
+  /** Supplier id, 0 when none. */
+  product_supplier: number;
+  /** Decimal as a string, e.g. "13.99". */
+  product_price: string;
+  /** "0.00" when the product has no discount. */
+  product_discount_price: string;
+  product_supply_price: string;
+  /** Category id, 0 when none. */
+  product_category: number;
+  /** Displayed on the website: 1 = yes, 0 = no. */
+  product_display_www: number;
+  /** Archived: 1 = yes, 0 = no. */
+  product_arch: number;
+  products_desc: string;
+  /** Local time, "YYYY-MM-DD HH:mm:ss". */
+  updated_at: string;
+  /** Per-size overrides of the product's price, discount and barcode. */
+  product_specific_rules: ProductSpecificRulesHiboutikDto[];
+  /** Sizes of the product; missing or empty for a product without sizes. */
+  product_size_details?: ProductSizeDetailsHiboutikDto[];
+}
+
+/** Override of a product's values for one size. Prices are "0.00" (or missing) when not overridden. */
+export interface ProductSpecificRulesHiboutikDto {
+  size_id: number;
+  barcode: string;
+  product_price?: string;
+  product_discount_price?: string;
+}
+
+/** One size of a product (e.g. "S", "M"). */
+export interface ProductSizeDetailsHiboutikDto {
+  size_id: number;
+  size_name: string;
+  /** Empty string when the size has no barcode. */
+  barcode: string;
+}
--- a/src/models/hiboutikDTO/sale.hiboutik.dto.ts
+++ b/src/models/hiboutikDTO/sale.hiboutik.dto.ts
@@ -0,0 +1,40 @@
+/**
+ * Sale as returned by Hiboutik `GET /sales/:sale_id`, with its lines.
+ * Only the fields used by the sync are typed: the payload also carries many computed copies (dates split in parts,
+ * totals by tax, customer and store details...).
+ */
+export interface SaleHiboutikDto {
+  sale_id: number;
+  /** Local time, "YYYY-MM-DD HH:mm:ss". */
+  created_at: string;
+  /** Local time, "0000-00-00 00:00:00" while the sale is not completed. */
+  completed_at: string;
+  store_id: number;
+  customer_id: number;
+  currency: string;
+  /** Decimal as a string, taxes included. */
+  total: string;
+  /** Payment type code, e.g. "CB", "ESP", "WEB". */
+  payment: string;
+  /** 1 for a quotation. */
+  quotation: number;
+  line_items: SaleLineHiboutikDto[];
+}
+
+/** Line of a {@link SaleHiboutikDto}: a snapshot of the product at sale time. */
+export interface SaleLineHiboutikDto {
+  line_item_id: number;
+  product_id: number;
+  /** Hiboutik size id, 0 for a product without sizes. */
+  product_size: number;
+  /** Negative for a returned item. */
+  quantity: number;
+  product_model: string;
+  product_barcode: string;
+  /** Size name, empty for a product without sizes. */
+  size_name: string;
+  /** Unit price before discount, taxes included (decimal as a string). */
+  item_unit_gross_wo_discount: string;
+  /** Unit price actually paid, discount deducted, taxes included (decimal as a string). */
+  item_unit_gross: string;
+}
--- a/src/models/hiboutikDTO/stock.hiboutik.dto.ts
+++ b/src/models/hiboutikDTO/stock.hiboutik.dto.ts
@@ -0,0 +1,10 @@
+/** Available stock of one product size, as returned by Hiboutik `GET /stock_available/all_wh` (all warehouses). */
+export interface StockHiboutikDto {
+  product_id: number;
+  /** Size id, 0 for a product without sizes. */
+  product_size: number;
+  /** Decimal as a string, e.g. "3". Stays at 0 while stock management is disabled in Hiboutik. */
+  stock_available: string;
+  product_barcode: string;
+  product_supplier_reference: string;
+}
--- a/src/models/hiboutikDTO/supplier.hiboutik.dto.ts
+++ b/src/models/hiboutikDTO/supplier.hiboutik.dto.ts
@@ -0,0 +1,7 @@
+/** Supplier as returned by Hiboutik `GET /suppliers`. */
+export interface SupplierHiboutikDto {
+  supplier_id: number;
+  supplier_name: string;
+  /** 1 = enabled, 0 = disabled. */
+  supplier_enabled: number;
+}
--- a/src/models/orderStatus.ts
+++ b/src/models/orderStatus.ts
@@ -0,0 +1,9 @@
+/** Values of `Order.status`. */
+export const OrderStatus = {
+  /** Hiboutik sale not completed (cart in progress, awaiting payment...). */
+  PENDING: 'PENDING',
+  /** Hiboutik sale completed: it no longer changes, so the sync does not fetch it again. */
+  COMPLETED: 'COMPLETED',
+} as const;
+
+export type OrderStatus = (typeof OrderStatus)[keyof typeof OrderStatus];
--- a/src/services/hiboutik/brand.hiboutik.service.ts
+++ b/src/services/hiboutik/brand.hiboutik.service.ts
@@ -0,0 +1,34 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { BrandHiboutikRepository } from '../../hiboutik/brand.hiboutik.repository';
+import { BrandDatabaseRepository } from '../../database/brand.database.repository';
+import { BrandConverter } from '../../models/converter/brand.converter';
+import { forEachSafely } from '../../utils/sync';
+
+@Injectable()
+export class BrandHiboutikService {
+  private readonly logger = new Logger('BrandHiboutikService');
+
+  constructor(
+    private readonly brandHiboutikRepository: BrandHiboutikRepository,
+    private readonly brandDatabaseRepository: BrandDatabaseRepository,
+    private readonly brandConverter: BrandConverter,
+  ) {}
+
+  /** Mirrors Hiboutik brands: upserts each of them, then deletes the brands missing from Hiboutik. */
+  async syncBrands() {
+    const hiboutikBrands = await this.brandHiboutikRepository.getBrands();
+    // One upsert per brand: an invalid brand must not prevent the others from being saved
+    const nbFailed = await forEachSafely(
+      this.brandConverter.fromHiboutikList(hiboutikBrands),
+      (brand) => this.brandDatabaseRepository.upsert(brand),
+      this.logger,
+      (brand) => `Hiboutik brand ${brand.hiboutikId}`,
+    );
+
+    // Hiboutik is trusted: a successful (2xx) answer, even an empty list, is the truth. An HTTP error throws before this point.
+    const nbDeleted = await this.brandDatabaseRepository.deleteMissing(hiboutikBrands.map((dto) => Number(dto.brand_id)));
+    this.logger.log(
+      `Brands sync ended: ${hiboutikBrands.length - nbFailed}/${hiboutikBrands.length} synced, ${nbFailed} failed, ${nbDeleted} deleted.`,
+    );
+  }
+}
--- a/src/services/hiboutik/category.hiboutik.service.spec.ts
+++ b/src/services/hiboutik/category.hiboutik.service.spec.ts
@@ -0,0 +1,97 @@
+import { Logger } from '@nestjs/common';
+import { CategoryHiboutikService } from './category.hiboutik.service';
+import { CategoryConverter } from '../../models/converter/category.converter';
+import { CategoryHiboutikDto } from '../../models/hiboutikDTO/category.hiboutik.dto';
+
+const hiboutikCategory = (id: number, parentId: number, overrides: Partial<CategoryHiboutikDto> = {}): CategoryHiboutikDto =>
+  ({
+    category_id: id,
+    category_name: `Category ${id}`,
+    category_id_parent: parentId,
+    category_enabled: 1,
+    category_enabled_www: 0,
+    category_position: 3,
+    ...overrides,
+  }) as CategoryHiboutikDto;
+
+describe('CategoryHiboutikService', () => {
+  const categoryHiboutikRepository = { getCategories: jest.fn() };
+  const categoryDatabaseRepository = { upsert: jest.fn(), setParent: jest.fn(), deleteMissing: jest.fn() };
+  let service: CategoryHiboutikService;
+  let calls: string[];
+
+  beforeAll(() => {
+    jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
+    jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
+    jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    calls = [];
+    categoryDatabaseRepository.upsert.mockImplementation((category: { hiboutikId: number }) => {
+      calls.push(`upsert ${category.hiboutikId}`);
+      return Promise.resolve({});
+    });
+    categoryDatabaseRepository.setParent.mockImplementation((id: number) => {
+      calls.push(`parent ${id}`);
+      return Promise.resolve({});
+    });
+    categoryDatabaseRepository.deleteMissing.mockResolvedValue(0);
+    service = new CategoryHiboutikService(
+      categoryHiboutikRepository as never,
+      categoryDatabaseRepository as never,
+      new CategoryConverter(),
+    );
+  });
+
+  it('stores position and web visibility', async () => {
+    categoryHiboutikRepository.getCategories.mockResolvedValue([hiboutikCategory(1, 0)]);
+
+    await service.syncCategories();
+
+    expect(categoryDatabaseRepository.upsert).toHaveBeenCalledWith({
+      hiboutikId: 1,
+      name: 'Category 1',
+      enabled: true,
+      position: 3,
+      webEnabled: false,
+    });
+  });
+
+  it('links parents once every category is saved, a child being listed before its parent', async () => {
+    categoryHiboutikRepository.getCategories.mockResolvedValue([hiboutikCategory(2, 3), hiboutikCategory(3, 0)]);
+
+    await service.syncCategories();
+
+    expect(calls).toEqual(['upsert 2', 'upsert 3', 'parent 2', 'parent 3']);
+    expect(categoryDatabaseRepository.setParent).toHaveBeenCalledWith(2, 3);
+    expect(categoryDatabaseRepository.setParent).toHaveBeenCalledWith(3, null);
+  });
+
+  it('keeps syncing the other categories when one fails, then deletes the missing ones', async () => {
+    categoryHiboutikRepository.getCategories.mockResolvedValue([hiboutikCategory(1, 0), hiboutikCategory(2, 0)]);
+    categoryDatabaseRepository.upsert.mockRejectedValueOnce(new Error('boom'));
+
+    await expect(service.syncCategories()).resolves.toBeUndefined();
+
+    expect(categoryDatabaseRepository.upsert).toHaveBeenCalledTimes(2);
+    expect(categoryDatabaseRepository.deleteMissing).toHaveBeenCalledWith([1, 2]);
+  });
+
+  it('deletes every category when Hiboutik answers with an empty list', async () => {
+    categoryHiboutikRepository.getCategories.mockResolvedValue([]);
+
+    await service.syncCategories();
+
+    expect(categoryDatabaseRepository.deleteMissing).toHaveBeenCalledWith([]);
+  });
+
+  it('deletes nothing when the Hiboutik call fails', async () => {
+    categoryHiboutikRepository.getCategories.mockRejectedValue(new Error('Request failed with status code 500'));
+
+    await expect(service.syncCategories()).rejects.toThrow('500');
+
+    expect(categoryDatabaseRepository.deleteMissing).not.toHaveBeenCalled();
+  });
+});
--- a/src/services/hiboutik/category.hiboutik.service.ts
+++ b/src/services/hiboutik/category.hiboutik.service.ts
@@ -0,0 +1,47 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { CategoryHiboutikRepository } from '../../hiboutik/category.hiboutik.repository';
+import { CategoryDatabaseRepository } from '../../database/category.database.repository';
+import { CategoryConverter } from '../../models/converter/category.converter';
+import { forEachSafely } from '../../utils/sync';
+
+@Injectable()
+export class CategoryHiboutikService {
+  private readonly logger = new Logger('CategoryHiboutikService');
+
+  constructor(
+    private readonly categoryHiboutikRepository: CategoryHiboutikRepository,
+    private readonly categoryDatabaseRepository: CategoryDatabaseRepository,
+    private readonly categoryConverter: CategoryConverter,
+  ) {}
+
+  /**
+   * Mirrors Hiboutik categories and their tree: upserts each of them, links them to their parent,
+   * then deletes the categories missing from Hiboutik.
+   */
+  async syncCategories() {
+    const hiboutikCategories = await this.categoryHiboutikRepository.getCategories();
+
+    // Pass 1: categories themselves. One upsert per category: an invalid category must not prevent the others from being saved
+    const nbFailed = await forEachSafely(
+      this.categoryConverter.fromHiboutikList(hiboutikCategories),
+      (category) => this.categoryDatabaseRepository.upsert(category),
+      this.logger,
+      (category) => `Hiboutik category ${category.hiboutikId}`,
+    );
+
+    // Pass 2: parent links, once every category exists (a child can come before its parent in Hiboutik's list)
+    const nbParentsFailed = await forEachSafely(
+      hiboutikCategories,
+      (dto) => this.categoryDatabaseRepository.setParent(Number(dto.category_id), Number(dto.category_id_parent) || null),
+      this.logger,
+      (dto) => `parent of Hiboutik category ${dto.category_id}`,
+    );
+
+    // Hiboutik is trusted: a successful (2xx) answer, even an empty list, is the truth. An HTTP error throws before this point.
+    const nbDeleted = await this.categoryDatabaseRepository.deleteMissing(hiboutikCategories.map((dto) => Number(dto.category_id)));
+    this.logger.log(
+      `Categories sync ended: ${hiboutikCategories.length - nbFailed}/${hiboutikCategories.length} synced, ${nbFailed} failed, ` +
+        `${nbParentsFailed} parent links failed, ${nbDeleted} deleted.`,
+    );
+  }
+}
--- a/src/services/hiboutik/customer.hiboutik.service.spec.ts
+++ b/src/services/hiboutik/customer.hiboutik.service.spec.ts
@@ -0,0 +1,214 @@
+import { Logger } from '@nestjs/common';
+import { CustomerHiboutikService } from './customer.hiboutik.service';
+
+describe('CustomerHiboutikService', () => {
+  const customerHiboutikRepository = { getCustomers: jest.fn(), getCustomerById: jest.fn(), getAddressById: jest.fn() };
+  const customerDatabaseRepository = { upsert: jest.fn(), deleteMissing: jest.fn() };
+  const customerConverter = { fromHiboutik: jest.fn() };
+  const customerAddressDatabaseRepository = { upsert: jest.fn(), deleteMissing: jest.fn() };
+  const customerAddressConverter = { fromHiboutik: jest.fn((dto: unknown) => dto) };
+  const saleHiboutikRepository = { getSaleById: jest.fn() };
+  const orderDatabaseRepository = { upsert: jest.fn(), getCompletedSaleIds: jest.fn() };
+  const orderConverter = { fromHiboutik: jest.fn((dto: unknown) => dto) };
+  let service: CustomerHiboutikService;
+
+  beforeAll(() => {
+    jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
+    jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
+    jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    customerHiboutikRepository.getCustomers.mockResolvedValue([]);
+    customerHiboutikRepository.getCustomerById.mockResolvedValue({ customers_id: 1, addresses: [] });
+    customerDatabaseRepository.upsert.mockResolvedValue({ id: 'customer-uuid' });
+    customerDatabaseRepository.deleteMissing.mockResolvedValue(0);
+    customerAddressDatabaseRepository.deleteMissing.mockResolvedValue(0);
+    orderDatabaseRepository.getCompletedSaleIds.mockResolvedValue(new Set());
+    saleHiboutikRepository.getSaleById.mockImplementation((id: number) => Promise.resolve({ sale_id: id, quotation: 0 }));
+    service = new CustomerHiboutikService(
+      customerHiboutikRepository as never,
+      customerDatabaseRepository as never,
+      customerConverter as never,
+      customerAddressDatabaseRepository as never,
+      customerAddressConverter as never,
+      saleHiboutikRepository as never,
+      orderDatabaseRepository as never,
+      orderConverter as never,
+    );
+  });
+
+  it('deletes customers missing from Hiboutik', async () => {
+    customerHiboutikRepository.getCustomers.mockResolvedValue([{ customers_id: 1 }, { customers_id: '2' }]);
+
+    await service.syncCustomers();
+
+    expect(customerDatabaseRepository.deleteMissing).toHaveBeenCalledWith([1, 2]);
+    expect(customerDatabaseRepository.upsert).toHaveBeenCalledTimes(2);
+  });
+
+  it('deletes every customer when Hiboutik answers with an empty list', async () => {
+    await service.syncCustomers();
+
+    expect(customerDatabaseRepository.deleteMissing).toHaveBeenCalledWith([]);
+  });
+
+  it('deletes nothing when the Hiboutik call fails', async () => {
+    customerHiboutikRepository.getCustomers.mockRejectedValue(new Error('Request failed with status code 500'));
+
+    await expect(service.syncCustomers()).rejects.toThrow('500');
+
+    expect(customerDatabaseRepository.deleteMissing).not.toHaveBeenCalled();
+  });
+
+  it('keeps syncing the other customers when one fails', async () => {
+    customerHiboutikRepository.getCustomers.mockResolvedValue([{ customers_id: 1 }, { customers_id: 2 }]);
+    customerHiboutikRepository.getCustomerById.mockRejectedValueOnce(new Error('boom'));
+
+    await expect(service.syncCustomers()).resolves.toBeUndefined();
+
+    expect(customerDatabaseRepository.upsert).toHaveBeenCalledTimes(1);
+  });
+
+  describe('addresses', () => {
+    beforeEach(() => {
+      customerHiboutikRepository.getCustomers.mockResolvedValue([{ customers_id: 1 }]);
+    });
+
+    it('deletes the missing addresses of the customer, then upserts the others linked to it', async () => {
+      customerHiboutikRepository.getCustomerById.mockResolvedValue({
+        customers_id: 1,
+        addresses: [
+          { address_id: 10, customers_id: 1 },
+          { address_id: '11', customers_id: 999 },
+        ],
+      });
+
+      await service.syncCustomers();
+
+      expect(customerAddressDatabaseRepository.deleteMissing).toHaveBeenCalledWith('customer-uuid', [10, 11]);
+      expect(customerAddressDatabaseRepository.upsert).toHaveBeenCalledTimes(2);
+      expect(customerAddressConverter.fromHiboutik).toHaveBeenLastCalledWith({ address_id: '11', customers_id: 1 });
+      expect(customerAddressDatabaseRepository.deleteMissing.mock.invocationCallOrder[0]).toBeLessThan(
+        customerAddressDatabaseRepository.upsert.mock.invocationCallOrder[0],
+      );
+    });
+
+    it('deletes all the addresses of a customer that has none left', async () => {
+      await service.syncCustomers();
+
+      expect(customerAddressDatabaseRepository.deleteMissing).toHaveBeenCalledWith('customer-uuid', []);
+      expect(customerAddressDatabaseRepository.upsert).not.toHaveBeenCalled();
+    });
+
+    it('keeps the stored addresses when the payload has no addresses array', async () => {
+      customerHiboutikRepository.getCustomerById.mockResolvedValue({ customers_id: 1 });
+
+      await service.syncCustomers();
+
+      expect(customerAddressDatabaseRepository.deleteMissing).not.toHaveBeenCalled();
+      expect(customerAddressDatabaseRepository.upsert).not.toHaveBeenCalled();
+    });
+
+    it('fetches the company details of addresses with a company only', async () => {
+      customerHiboutikRepository.getCustomerById.mockResolvedValue({
+        customers_id: 1,
+        addresses: [
+          { address_id: 10, company: 'ACME' },
+          { address_id: 11, company: ' ' },
+        ],
+      });
+      customerHiboutikRepository.getAddressById.mockResolvedValue({
+        address_id: 10,
+        tax_number: 'FR123',
+        company_number: '123',
+        legal_status: 'SAS',
+        updated_at: '2026-11-01 10:00:00',
+      });
+
+      await service.syncCustomers();
+
+      expect(customerHiboutikRepository.getAddressById).toHaveBeenCalledTimes(1);
+      expect(customerHiboutikRepository.getAddressById).toHaveBeenCalledWith(10);
+      expect(customerAddressConverter.fromHiboutik).toHaveBeenCalledWith({
+        address_id: 10,
+        company: 'ACME',
+        customers_id: 1,
+        tax_number: 'FR123',
+        company_number: '123',
+        legal_status: 'SAS',
+        updated_at: '2026-11-01 10:00:00',
+      });
+    });
+
+    it('still syncs an address whose company details cannot be fetched', async () => {
+      customerHiboutikRepository.getCustomerById.mockResolvedValue({ customers_id: 1, addresses: [{ address_id: 10, company: 'ACME' }] });
+      customerHiboutikRepository.getAddressById.mockRejectedValue(new Error('boom'));
+
+      await service.syncCustomers();
+
+      expect(customerAddressConverter.fromHiboutik).toHaveBeenCalledWith({ address_id: 10, company: 'ACME', customers_id: 1 });
+      expect(customerAddressDatabaseRepository.upsert).toHaveBeenCalledTimes(1);
+    });
+
+    it('keeps syncing the other addresses when one fails', async () => {
+      customerHiboutikRepository.getCustomerById.mockResolvedValue({
+        customers_id: 1,
+        addresses: [{ address_id: 10 }, { address_id: 11 }],
+      });
+      customerAddressDatabaseRepository.upsert.mockRejectedValueOnce(new Error('boom'));
+
+      await service.syncCustomers();
+
+      expect(customerAddressDatabaseRepository.upsert).toHaveBeenCalledTimes(2);
+    });
+  });
+
+  describe('orders', () => {
+    beforeEach(() => {
+      customerHiboutikRepository.getCustomers.mockResolvedValue([{ customers_id: 1 }]);
+      customerHiboutikRepository.getCustomerById.mockResolvedValue({
+        customers_id: 1,
+        addresses: [],
+        sales: [{ sale_id: 5 }, { sale_id: '6' }, { sale_id: 7 }],
+      });
+    });
+
+    it('fetches and upserts the sales not yet stored as completed, linked to the customer', async () => {
+      orderDatabaseRepository.getCompletedSaleIds.mockResolvedValue(new Set([6]));
+
+      await service.syncCustomers();
+
+      expect(orderDatabaseRepository.getCompletedSaleIds).toHaveBeenCalledWith([5, 6, 7]);
+      expect(saleHiboutikRepository.getSaleById.mock.calls.map((call: unknown[]) => call[0])).toEqual([5, 7]);
+      expect(orderDatabaseRepository.upsert).toHaveBeenCalledTimes(2);
+      expect(orderConverter.fromHiboutik).toHaveBeenCalledWith({ sale_id: 5, quotation: 0, customer_id: 1 });
+    });
+
+    it('ignores quotations', async () => {
+      saleHiboutikRepository.getSaleById.mockResolvedValueOnce({ sale_id: 5, quotation: 1 });
+
+      await service.syncCustomers();
+
+      expect(orderDatabaseRepository.upsert).toHaveBeenCalledTimes(2);
+    });
+
+    it('keeps syncing the other sales when one fails', async () => {
+      saleHiboutikRepository.getSaleById.mockRejectedValueOnce(new Error('boom'));
+
+      await service.syncCustomers();
+
+      expect(orderDatabaseRepository.upsert).toHaveBeenCalledTimes(2);
+    });
+
+    it('skips orders when the payload has no sales array', async () => {
+      customerHiboutikRepository.getCustomerById.mockResolvedValue({ customers_id: 1, addresses: [] });
+
+      await service.syncCustomers();
+
+      expect(saleHiboutikRepository.getSaleById).not.toHaveBeenCalled();
+      expect(orderDatabaseRepository.upsert).not.toHaveBeenCalled();
+    });
+  });
+});
--- a/src/services/hiboutik/customer.hiboutik.service.ts
+++ b/src/services/hiboutik/customer.hiboutik.service.ts
@@ -0,0 +1,145 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { CustomerHiboutikRepository } from '../../hiboutik/customer.hiboutik.repository';
+import { CustomerDatabaseRepository } from '../../database/customer.database.repository';
+import { CustomerConverter } from '../../models/converter/customer.converter';
+import { CustomerAddressDatabaseRepository } from '../../database/customerAddress.database.repository';
+import { CustomerAddressConverter } from '../../models/converter/customerAddress.converter';
+import {
+  CustomerAddressDetailsHiboutikDto,
+  CustomerAddressHiboutikDto,
+  FullCustomerHiboutikDto,
+} from '../../models/hiboutikDTO/customer.hiboutik.dto';
+import { forEachSafely } from '../../utils/sync';
+import { SaleHiboutikRepository } from '../../hiboutik/sale.hiboutik.repository';
+import { OrderDatabaseRepository } from '../../database/order.database.repository';
+import { OrderConverter } from '../../models/converter/order.converter';
+
+@Injectable()
+export class CustomerHiboutikService {
+  private readonly logger = new Logger('CustomerHiboutikService');
+
+  constructor(
+    private readonly customerHiboutikRepository: CustomerHiboutikRepository,
+    private readonly customerDatabaseRepository: CustomerDatabaseRepository,
+    private readonly customerConverter: CustomerConverter,
+    private readonly customerAddressDatabaseRepository: CustomerAddressDatabaseRepository,
+    private readonly customerAddressConverter: CustomerAddressConverter,
+    private readonly saleHiboutikRepository: SaleHiboutikRepository,
+    private readonly orderDatabaseRepository: OrderDatabaseRepository,
+    private readonly orderConverter: OrderConverter,
+  ) {}
+
+  /**
+   * Mirrors Hiboutik customers: deletes the customers missing from Hiboutik, then fetches and upserts each of them
+   * with its addresses and orders (one API call per customer, as the list endpoint lacks addresses and sales, plus one
+   * per sale not yet stored as completed).
+   */
+  async syncCustomers() {
+    const hiboutikCustomers = await this.customerHiboutikRepository.getCustomers();
+
+    // Hiboutik is trusted: a successful (2xx) answer, even an empty list, is the truth. An HTTP error throws before this point.
+    const nbDeleted = await this.customerDatabaseRepository.deleteMissing(hiboutikCustomers.map((dto) => Number(dto.customers_id)));
+
+    let nbFailed = 0;
+    let nbFailedAddresses = 0;
+    let nbFailedOrders = 0;
+    for (const hiboutikCustomer of hiboutikCustomers) {
+      try {
+        const hiboutikFullCustomer = await this.customerHiboutikRepository.getCustomerById(hiboutikCustomer.customers_id);
+        const customer = await this.customerDatabaseRepository.upsert(this.customerConverter.fromHiboutik(hiboutikFullCustomer));
+        nbFailedAddresses += await this.syncAddresses(customer.id, hiboutikFullCustomer);
+        nbFailedOrders += await this.syncOrders(hiboutikFullCustomer);
+      } catch (error) {
+        nbFailed++;
+        this.logger.error(`Failed to sync Hiboutik customer ${hiboutikCustomer.customers_id}`, (error as Error)?.stack);
+      }
+    }
+    this.logger.log(
+      `Customers sync ended: ${hiboutikCustomers.length - nbFailed}/${hiboutikCustomers.length} synced, ${nbFailed} failed, ${nbDeleted} deleted, ${nbFailedAddresses} addresses failed, ${nbFailedOrders} orders failed.`,
+    );
+  }
+
+  /**
+   * Mirrors the addresses embedded in a full Hiboutik customer: deletes the ones missing from Hiboutik, then upserts
+   * each of them (a failing address is logged and skipped).
+   * @returns the number of failed addresses.
+   */
+  private async syncAddresses(customerId: string, hiboutikCustomer: FullCustomerHiboutikDto): Promise<number> {
+    // A missing array means an unexpected payload, not a customer without addresses: keep the stored ones
+    if (!Array.isArray(hiboutikCustomer.addresses)) {
+      this.logger.warn(`Hiboutik customer ${hiboutikCustomer.customers_id} has no addresses array: addresses sync skipped.`);
+      return 0;
+    }
+
+    await this.customerAddressDatabaseRepository.deleteMissing(
+      customerId,
+      hiboutikCustomer.addresses.map((dto) => Number(dto.address_id)),
+    );
+    return forEachSafely(
+      hiboutikCustomer.addresses,
+      // Linked to the parent customer, whatever the embedded customers_id says
+      async (dto) => {
+        const address = dto.company?.trim() ? await this.withCompanyDetails(dto) : dto;
+        await this.customerAddressDatabaseRepository.upsert(
+          this.customerAddressConverter.fromHiboutik({ ...address, customers_id: hiboutikCustomer.customers_id }),
+        );
+      },
+      this.logger,
+      (dto) => `Hiboutik address ${dto.address_id} of customer ${hiboutikCustomer.customers_id}`,
+    );
+  }
+
+  /**
+   * Completes an embedded address with its company details (one API call). On failure, the embedded address is returned
+   * as is, so the address is still synced and its stored company details are kept.
+   */
+  private async withCompanyDetails(
+    dto: CustomerAddressHiboutikDto,
+  ): Promise<CustomerAddressHiboutikDto | CustomerAddressDetailsHiboutikDto> {
+    try {
+      const details = await this.customerHiboutikRepository.getAddressById(dto.address_id);
+      return {
+        ...dto,
+        tax_number: details.tax_number,
+        company_number: details.company_number,
+        legal_status: details.legal_status,
+        updated_at: details.updated_at,
+      };
+    } catch (error) {
+      this.logger.warn(`Failed to fetch company details of Hiboutik address ${dto.address_id}: ${(error as Error)?.message}`);
+      return dto;
+    }
+  }
+
+  /**
+   * Mirrors the sales of a full Hiboutik customer as orders: each sale not yet stored as completed is fetched (for its
+   * lines) and upserted (a failing sale is logged and skipped). Quotations are ignored. Orders are never deleted.
+   * @returns the number of failed sales.
+   */
+  private async syncOrders(hiboutikCustomer: FullCustomerHiboutikDto): Promise<number> {
+    if (!Array.isArray(hiboutikCustomer.sales)) {
+      this.logger.warn(`Hiboutik customer ${hiboutikCustomer.customers_id} has no sales array: orders sync skipped.`);
+      return 0;
+    }
+
+    // A completed sale no longer changes in Hiboutik: no need to fetch it again
+    const completedSaleIds = await this.orderDatabaseRepository.getCompletedSaleIds(
+      hiboutikCustomer.sales.map((dto) => Number(dto.sale_id)),
+    );
+    const salesToSync = hiboutikCustomer.sales.filter((dto) => !completedSaleIds.has(Number(dto.sale_id)));
+
+    return forEachSafely(
+      salesToSync,
+      async (dto) => {
+        const sale = await this.saleHiboutikRepository.getSaleById(dto.sale_id);
+        if (Number(sale.quotation) === 1) return;
+        // Linked to the parent customer, whatever the sale says
+        await this.orderDatabaseRepository.upsert(
+          this.orderConverter.fromHiboutik({ ...sale, customer_id: hiboutikCustomer.customers_id }),
+        );
+      },
+      this.logger,
+      (dto) => `Hiboutik sale ${dto.sale_id} of customer ${hiboutikCustomer.customers_id}`,
+    );
+  }
+}
--- a/src/services/hiboutik/hiboutik.service.spec.ts
+++ b/src/services/hiboutik/hiboutik.service.spec.ts
@@ -0,0 +1,120 @@
+import { Logger } from '@nestjs/common';
+import { HiboutikService } from './hiboutik.service';
+
+describe('HiboutikService', () => {
+  const brandService = { syncBrands: jest.fn() };
+  const categoryService = { syncCategories: jest.fn() };
+  const supplierService = { syncSuppliers: jest.fn() };
+  const productService = { syncProducts: jest.fn() };
+  const customerService = { syncCustomers: jest.fn() };
+  const syncLock = { tryAcquire: jest.fn() };
+  const release = jest.fn();
+  let service: HiboutikService;
+  const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+  beforeAll(() => {
+    jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
+    jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
+    jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    brandService.syncBrands.mockResolvedValue(undefined);
+    categoryService.syncCategories.mockResolvedValue(undefined);
+    supplierService.syncSuppliers.mockResolvedValue(undefined);
+    productService.syncProducts.mockResolvedValue(undefined);
+    customerService.syncCustomers.mockResolvedValue(undefined);
+    release.mockResolvedValue(undefined);
+    syncLock.tryAcquire.mockResolvedValue(release);
+    service = new HiboutikService(
+      brandService as never,
+      categoryService as never,
+      customerService as never,
+      productService as never,
+      supplierService as never,
+      syncLock as never,
+    );
+  });
+
+  it('runs the steps in dependency order', async () => {
+    const order: string[] = [];
+    brandService.syncBrands.mockImplementation(() => Promise.resolve(order.push('brands')));
+    categoryService.syncCategories.mockImplementation(() => Promise.resolve(order.push('categories')));
+    supplierService.syncSuppliers.mockImplementation(() => Promise.resolve(order.push('suppliers')));
+    productService.syncProducts.mockImplementation(() => Promise.resolve(order.push('products')));
+    customerService.syncCustomers.mockImplementation(() => Promise.resolve(order.push('customers')));
+
+    await service.syncAll();
+
+    expect(order).toEqual(['brands', 'categories', 'suppliers', 'products', 'customers']);
+  });
+
+  it('continues with the next steps when one fails', async () => {
+    brandService.syncBrands.mockRejectedValue(new Error('boom'));
+
+    await service.syncAll();
+
+    expect(productService.syncProducts).toHaveBeenCalled();
+    expect(customerService.syncCustomers).toHaveBeenCalled();
+  });
+
+  it('refuses a second synchronization while one is running, and unlocks at the end', async () => {
+    let finishBrands: () => void = () => undefined;
+    brandService.syncBrands.mockReturnValue(new Promise<void>((resolve) => (finishBrands = resolve)));
+
+    await expect(service.startSync()).resolves.toBe(true);
+    expect(service.isSyncInProgress).toBe(true);
+    await expect(service.startSync()).resolves.toBe(false);
+    expect(syncLock.tryAcquire).toHaveBeenCalledTimes(1);
+    expect(release).not.toHaveBeenCalled();
+
+    finishBrands();
+    await flush();
+    expect(release).toHaveBeenCalledTimes(1);
+    expect(service.isSyncInProgress).toBe(false);
+  });
+
+  it('refuses concurrent calls on the same instance while the lock is being requested', async () => {
+    let grantLock: (value: typeof release) => void = () => undefined;
+    syncLock.tryAcquire.mockReturnValue(new Promise((resolve) => (grantLock = resolve)));
+
+    const first = service.startSync();
+    await expect(service.startSync()).resolves.toBe(false);
+
+    grantLock(release);
+    await expect(first).resolves.toBe(true);
+    await flush();
+    expect(syncLock.tryAcquire).toHaveBeenCalledTimes(1);
+  });
+
+  it('starts nothing when another instance holds the lock', async () => {
+    syncLock.tryAcquire.mockResolvedValue(null);
+
+    await expect(service.startSync()).resolves.toBe(false);
+
+    expect(service.isSyncInProgress).toBe(false);
+    expect(brandService.syncBrands).not.toHaveBeenCalled();
+    expect(release).not.toHaveBeenCalled();
+  });
+
+  it('starts nothing and can be retried when the lock cannot be requested', async () => {
+    syncLock.tryAcquire.mockRejectedValueOnce(new Error('database unreachable'));
+
+    await expect(service.startSync()).rejects.toThrow('database unreachable');
+    expect(service.isSyncInProgress).toBe(false);
+
+    await expect(service.startSync()).resolves.toBe(true);
+    await flush();
+  });
+
+  it('releases the lock even when the synchronization crashes', async () => {
+    jest.spyOn(service, 'syncAll').mockRejectedValue(new Error('crash'));
+
+    await expect(service.startSync()).resolves.toBe(true);
+    await flush();
+
+    expect(release).toHaveBeenCalledTimes(1);
+    expect(service.isSyncInProgress).toBe(false);
+  });
+});
--- a/src/services/hiboutik/hiboutik.service.ts
+++ b/src/services/hiboutik/hiboutik.service.ts
@@ -0,0 +1,96 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { BrandHiboutikService } from './brand.hiboutik.service';
+import { CategoryHiboutikService } from './category.hiboutik.service';
+import { CustomerHiboutikService } from './customer.hiboutik.service';
+import { SupplierHiboutikService } from './supplier.hiboutik.service';
+import { ProductHiboutikService } from './product.hiboutik.service';
+import { ReleaseLock, SyncLockDatabaseRepository } from '../../database/syncLock.database.repository';
+
+/** Entry point of the Hiboutik → database synchronization: runs each entity sync in dependency order. */
+@Injectable()
+export class HiboutikService {
+  private readonly logger = new Logger('HiboutikService');
+  /** Cheap in-process guard, checked before the database lock (which is the one that holds across instances). */
+  private syncInProgress = false;
+
+  constructor(
+    private readonly brandHiboutikService: BrandHiboutikService,
+    private readonly categoryHiboutikService: CategoryHiboutikService,
+    private readonly customerHiboutikService: CustomerHiboutikService,
+    private readonly productHiboutikService: ProductHiboutikService,
+    private readonly supplierHiboutikService: SupplierHiboutikService,
+    private readonly syncLock: SyncLockDatabaseRepository,
+  ) {}
+
+  get isSyncInProgress(): boolean {
+    return this.syncInProgress;
+  }
+
+  /**
+   * Starts a full synchronization in the background, if no other one is running on this instance or any other
+   * (Postgres advisory lock, held until the synchronization ends).
+   * @returns false if a synchronization is already running (nothing is started).
+   * @throws if the lock cannot be requested (e.g. database unreachable).
+   */
+  async startSync(): Promise<boolean> {
+    if (this.syncInProgress) return false;
+    // Set before the first await so that concurrent calls on this instance are refused while the lock is requested
+    this.syncInProgress = true;
+
+    let release: ReleaseLock | null;
+    try {
+      release = await this.syncLock.tryAcquire();
+    } catch (error) {
+      this.syncInProgress = false;
+      throw error;
+    }
+    if (!release) {
+      this.syncInProgress = false;
+      return false;
+    }
+
+    void this.runLocked(release);
+    return true;
+  }
+
+  /** Runs the synchronization, then always releases the lock. */
+  private async runLocked(release: ReleaseLock): Promise<void> {
+    try {
+      await this.syncAll();
+    } catch (error) {
+      this.logger.error('Global Hiboutik synchronization crashed', (error as Error)?.stack);
+    } finally {
+      await release();
+      this.syncInProgress = false;
+    }
+  }
+
+  /** Runs every sync step in order. A failing step is logged and does not stop the next ones. */
+  async syncAll() {
+    this.logger.log('Starting global Hiboutik synchronization');
+    // Order matters: products connect to brands, categories and suppliers by hiboutikId.
+    const steps: [string, () => Promise<void>][] = [
+      ['brands', () => this.brandHiboutikService.syncBrands()],
+      ['categories', () => this.categoryHiboutikService.syncCategories()],
+      ['suppliers', () => this.supplierHiboutikService.syncSuppliers()],
+      ['products', () => this.productHiboutikService.syncProducts()],
+      ['customers', () => this.customerHiboutikService.syncCustomers()],
+    ];
+
+    const failedSteps: string[] = [];
+    for (const [name, step] of steps) {
+      try {
+        await step();
+      } catch (error) {
+        failedSteps.push(name);
+        this.logger.error(`Hiboutik ${name} sync failed`, (error as Error)?.stack);
+      }
+    }
+
+    if (failedSteps.length > 0) {
+      this.logger.warn(`Global Hiboutik synchronization ended with errors (failed steps: ${failedSteps.join(', ')})`);
+    } else {
+      this.logger.log('Global Hiboutik synchronization ended successfully');
+    }
+  }
+}
--- a/src/services/hiboutik/product.hiboutik.service.spec.ts
+++ b/src/services/hiboutik/product.hiboutik.service.spec.ts
@@ -0,0 +1,171 @@
+import { Logger } from '@nestjs/common';
+import { ProductHiboutikService } from './product.hiboutik.service';
+import { ProductConverter } from '../../models/converter/product.converter';
+import { ProductHiboutikDto } from '../../models/hiboutikDTO/product.hiboutik.dto';
+import { StockHiboutikDto } from '../../models/hiboutikDTO/stock.hiboutik.dto';
+
+const hiboutikProduct = (id: number, overrides: Partial<ProductHiboutikDto> = {}): ProductHiboutikDto => ({
+  product_id: id,
+  product_model: `Product ${id}`,
+  product_barcode: `barcode-${id}`,
+  product_brand: 0,
+  product_supplier: 0,
+  product_price: '10.00',
+  product_discount_price: '0.00',
+  product_supply_price: '5.00',
+  product_category: 0,
+  product_display_www: 1,
+  product_arch: 0,
+  products_desc: '',
+  updated_at: '2026-06-28 17:02:55',
+  product_specific_rules: [],
+  ...overrides,
+});
+
+const stock = (productId: number, size: number, available: string): StockHiboutikDto => ({
+  product_id: productId,
+  product_size: size,
+  stock_available: available,
+  product_barcode: '',
+  product_supplier_reference: '',
+});
+
+describe('ProductHiboutikService', () => {
+  let service: ProductHiboutikService;
+  let calls: string[];
+  const productHiboutikRepository = { getProducts: jest.fn() };
+  const stockHiboutikRepository = { getStocks: jest.fn() };
+  const productDatabaseRepository = { getAll: jest.fn(), upsert: jest.fn(), deleteAll: jest.fn() };
+  const productVersionDatabaseRepository = { upsert: jest.fn(), deleteMissing: jest.fn() };
+
+  beforeAll(() => {
+    jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
+    jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
+    jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    calls = [];
+    stockHiboutikRepository.getStocks.mockResolvedValue([]);
+    productDatabaseRepository.getAll.mockResolvedValue([]);
+    productDatabaseRepository.deleteAll.mockImplementation((ids: string[]) => {
+      calls.push('deleteProducts');
+      return Promise.resolve(ids.length);
+    });
+    // the saved product mirrors what was upserted, like the database would
+    productDatabaseRepository.upsert.mockImplementation((product: { hiboutikId: number }) => {
+      calls.push('upsertProduct');
+      return Promise.resolve({ ...product, id: `uuid-${product.hiboutikId}` });
+    });
+    productVersionDatabaseRepository.deleteMissing.mockImplementation(() => {
+      calls.push('deleteVersions');
+      return Promise.resolve(0);
+    });
+    productVersionDatabaseRepository.upsert.mockImplementation(() => {
+      calls.push('upsertVersion');
+      return Promise.resolve({});
+    });
+
+    service = new ProductHiboutikService(
+      productHiboutikRepository as never,
+      productDatabaseRepository as never,
+      productVersionDatabaseRepository as never,
+      new ProductConverter(),
+      stockHiboutikRepository as never,
+    );
+  });
+
+  it('deletes products missing from Hiboutik, before upserting', async () => {
+    productHiboutikRepository.getProducts.mockResolvedValue([hiboutikProduct(1)]);
+    productDatabaseRepository.getAll.mockResolvedValue([
+      { id: 'uuid-1', hiboutikId: 1 },
+      { id: 'uuid-2', hiboutikId: 2 },
+    ]);
+
+    await service.syncProducts();
+
+    expect(productDatabaseRepository.deleteAll).toHaveBeenCalledWith(['uuid-2']);
+    expect(calls[0]).toBe('deleteProducts');
+  });
+
+  it('deletes every product when Hiboutik answers with an empty list', async () => {
+    productHiboutikRepository.getProducts.mockResolvedValue([]);
+    productDatabaseRepository.getAll.mockResolvedValue([{ id: 'uuid-1', hiboutikId: 1 }]);
+
+    await service.syncProducts();
+
+    expect(productDatabaseRepository.deleteAll).toHaveBeenCalledWith(['uuid-1']);
+  });
+
+  it('deletes nothing when the Hiboutik call fails', async () => {
+    productHiboutikRepository.getProducts.mockRejectedValue(new Error('Request failed with status code 500'));
+    productDatabaseRepository.getAll.mockResolvedValue([{ id: 'uuid-1', hiboutikId: 1 }]);
+
+    await expect(service.syncProducts()).rejects.toThrow('500');
+
+    expect(productDatabaseRepository.deleteAll).not.toHaveBeenCalled();
+  });
+
+  it('creates a single version for a product without sizes', async () => {
+    productHiboutikRepository.getProducts.mockResolvedValue([hiboutikProduct(1)]);
+    stockHiboutikRepository.getStocks.mockResolvedValue([stock(1, 0, '4'), stock(2, 0, '99')]);
+
+    await service.syncProducts();
+
+    expect(productDatabaseRepository.upsert).toHaveBeenCalledWith(expect.objectContaining({ hiboutikId: 1, globalStock: 4 }));
+    expect(productVersionDatabaseRepository.deleteMissing).toHaveBeenCalledWith('uuid-1', [0]);
+    expect(productVersionDatabaseRepository.upsert).toHaveBeenCalledTimes(1);
+    expect(productVersionDatabaseRepository.upsert).toHaveBeenCalledWith(
+      'uuid-1',
+      expect.objectContaining({ hiboutikSizeId: 0, barcode: 'barcode-1', stock: 4, versionName: 'Product 1', discountPrice: null }),
+    );
+  });
+
+  it('creates one version per size, with specific rules and stocks, after deleting removed sizes', async () => {
+    productHiboutikRepository.getProducts.mockResolvedValue([
+      hiboutikProduct(1, {
+        product_size_details: [
+          { size_id: 10, size_name: 'S', barcode: 'b-s' },
+          { size_id: 11, size_name: 'M', barcode: '' },
+        ],
+        product_specific_rules: [{ size_id: 10, barcode: 'b-s', product_price: '12.00', product_discount_price: '0.00' }],
+      }),
+    ]);
+    stockHiboutikRepository.getStocks.mockResolvedValue([stock(1, 10, '3'), stock(1, 11, '2')]);
+
+    await service.syncProducts();
+
+    expect(productDatabaseRepository.upsert).toHaveBeenCalledWith(expect.objectContaining({ globalStock: 5 }));
+    expect(productVersionDatabaseRepository.deleteMissing).toHaveBeenCalledWith('uuid-1', [10, 11]);
+    expect(calls).toEqual(['deleteProducts', 'upsertProduct', 'deleteVersions', 'upsertVersion', 'upsertVersion']);
+    expect(productVersionDatabaseRepository.upsert).toHaveBeenNthCalledWith(1, 'uuid-1', {
+      barcode: 'b-s',
+      discountPrice: null,
+      hiboutikSizeId: 10,
+      price: '12.00',
+      product: { connect: { id: 'uuid-1' } },
+      stock: 3,
+      versionName: 'S',
+    });
+    expect(productVersionDatabaseRepository.upsert).toHaveBeenNthCalledWith(2, 'uuid-1', {
+      barcode: null,
+      discountPrice: null,
+      hiboutikSizeId: 11,
+      price: null,
+      product: { connect: { id: 'uuid-1' } },
+      stock: 2,
+      versionName: 'M',
+    });
+  });
+
+  it('keeps syncing the other products when one fails', async () => {
+    productHiboutikRepository.getProducts.mockResolvedValue([hiboutikProduct(1), hiboutikProduct(2)]);
+    productDatabaseRepository.upsert.mockRejectedValueOnce(new Error('boom'));
+
+    await expect(service.syncProducts()).resolves.toBeUndefined();
+
+    expect(productDatabaseRepository.upsert).toHaveBeenCalledTimes(2);
+    expect(productVersionDatabaseRepository.upsert).toHaveBeenCalledTimes(1);
+  });
+});
--- a/src/services/hiboutik/product.hiboutik.service.ts
+++ b/src/services/hiboutik/product.hiboutik.service.ts
@@ -0,0 +1,125 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ProductHiboutikRepository } from '../../hiboutik/product.hiboutik.repository';
+import { ProductDatabaseRepository } from '../../database/product.database.repository';
+import { ProductVersionDatabaseRepository } from '../../database/productVersion.database.repository';
+import { ProductConverter } from '../../models/converter/product.converter';
+import { StockHiboutikRepository } from '../../hiboutik/stock.hiboutik.repository';
+import { ProductHiboutikDto } from '../../models/hiboutikDTO/product.hiboutik.dto';
+import { StockHiboutikDto } from '../../models/hiboutikDTO/stock.hiboutik.dto';
+import { Product } from '../../../prisma/generated/client';
+import { ProductVersionCreateInput } from '../../../prisma/generated/models/ProductVersion';
+import { parseOptionalHiboutikPrice } from '../../utils/price';
+
+/** Version id used for products that have no sizes in Hiboutik. */
+const NO_SIZE_ID = 0;
+
+@Injectable()
+export class ProductHiboutikService {
+  private readonly logger = new Logger('ProductHiboutikService');
+
+  constructor(
+    private readonly productHiboutikRepository: ProductHiboutikRepository,
+    private readonly productDatabaseRepository: ProductDatabaseRepository,
+    private readonly productVersionDatabaseRepository: ProductVersionDatabaseRepository,
+    private readonly productConverter: ProductConverter,
+    private readonly stockHiboutikRepository: StockHiboutikRepository,
+  ) {}
+
+  /** Mirrors Hiboutik products, their versions (sizes) and stocks. Products missing from Hiboutik are deleted. */
+  async syncProducts() {
+    const [productsHiboutik, hiboutikStocks, existingProducts] = await Promise.all([
+      this.productHiboutikRepository.getProducts(),
+      this.stockHiboutikRepository.getStocks(),
+      this.productDatabaseRepository.getAll(),
+    ]);
+
+    // Deletion happens before upserts so that a product recreated in Hiboutik (new id, same barcode)
+    // does not collide with the old one on the unique barcode.
+    const nbDeleted = await this.deleteMissingProducts(productsHiboutik, existingProducts);
+
+    let nbFailed = 0;
+    for (const productHiboutik of productsHiboutik) {
+      const hiboutikProductStocks = hiboutikStocks.filter((stock) => stock.product_id === Number(productHiboutik.product_id));
+      try {
+        await this.updateProduct(productHiboutik, hiboutikProductStocks);
+      } catch (error) {
+        nbFailed++;
+        this.logger.error(`Failed to sync Hiboutik product ${productHiboutik.product_id}`, (error as Error)?.stack);
+      }
+    }
+
+    this.logger.log(
+      `Products sync ended: ${productsHiboutik.length - nbFailed}/${productsHiboutik.length} synced, ${nbFailed} failed, ${nbDeleted} deleted.`,
+    );
+  }
+
+  /** @returns the number of deleted products. */
+  private async deleteMissingProducts(productsHiboutik: ProductHiboutikDto[], existingProducts: Product[]): Promise<number> {
+    // Hiboutik is trusted: a successful (2xx) answer, even an empty list, is the truth. An HTTP error throws before this point.
+    const hiboutikIds = new Set(productsHiboutik.map((product) => Number(product.product_id)));
+    const missingProductIds = existingProducts.filter((product) => !hiboutikIds.has(product.hiboutikId)).map((product) => product.id);
+    return this.productDatabaseRepository.deleteAll(missingProductIds);
+  }
+
+  /** Upserts a product with its global stock, then replaces its versions. */
+  private async updateProduct(productHiboutik: ProductHiboutikDto, productStocks: StockHiboutikDto[]): Promise<void> {
+    const newProduct = this.productConverter.fromHiboutik(productHiboutik);
+    newProduct.globalStock = productStocks.map((stock) => Number(stock.stock_available)).reduce((sum, stock) => sum + stock, 0);
+
+    const savedProduct: Product = await this.productDatabaseRepository.upsert(newProduct);
+    const versions = this.buildVersions(productHiboutik, productStocks, savedProduct);
+
+    // Same reason as for products: delete removed versions first to free their barcodes
+    await this.productVersionDatabaseRepository.deleteMissing(
+      savedProduct.id,
+      versions.map((version) => version.hiboutikSizeId),
+    );
+    for (const version of versions) {
+      await this.productVersionDatabaseRepository.upsert(savedProduct.id, version);
+    }
+  }
+
+  /**
+   * Builds the versions of a product: one per Hiboutik size, or a single {@link NO_SIZE_ID} version
+   * copying the product's barcode, prices and stock when it has no sizes.
+   */
+  private buildVersions(
+    productHiboutik: ProductHiboutikDto,
+    productStocks: StockHiboutikDto[],
+    savedProduct: Product,
+  ): ProductVersionCreateInput[] {
+    const specificRules = productHiboutik.product_specific_rules ?? [];
+    const sizesDetails = productHiboutik.product_size_details ?? [];
+
+    if (sizesDetails.length === 0) {
+      return [
+        {
+          barcode: savedProduct.barcode,
+          discountPrice: savedProduct.discountPrice,
+          hiboutikSizeId: NO_SIZE_ID,
+          price: savedProduct.price,
+          product: { connect: { id: savedProduct.id } },
+          stock: savedProduct.globalStock,
+          versionName: savedProduct.name,
+        },
+      ];
+    }
+
+    return sizesDetails.map((sizeDetails) => {
+      const sizeId = Number(sizeDetails.size_id);
+      const specificRule = specificRules.find((rule) => Number(rule.size_id) === sizeId);
+      const stock = productStocks.find((stock) => stock.product_size === sizeId);
+      // Values are always set explicitly (null / 0 rather than undefined), otherwise Prisma would keep
+      // the previous value on update when a rule or a stock is removed in Hiboutik.
+      return {
+        barcode: sizeDetails.barcode || null,
+        discountPrice: parseOptionalHiboutikPrice(specificRule?.product_discount_price),
+        hiboutikSizeId: sizeId,
+        price: parseOptionalHiboutikPrice(specificRule?.product_price),
+        product: { connect: { id: savedProduct.id } },
+        stock: stock ? Number(stock.stock_available) : 0,
+        versionName: sizeDetails.size_name,
+      };
+    });
+  }
+}
--- a/src/services/hiboutik/supplier.hiboutik.service.ts
+++ b/src/services/hiboutik/supplier.hiboutik.service.ts
@@ -0,0 +1,34 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { SupplierHiboutikRepository } from '../../hiboutik/supplier.hiboutik.repository';
+import { SupplierDatabaseRepository } from '../../database/supplier.database.repository';
+import { SupplierConverter } from '../../models/converter/supplier.converter';
+import { forEachSafely } from '../../utils/sync';
+
+@Injectable()
+export class SupplierHiboutikService {
+  private readonly logger = new Logger('SupplierHiboutikService');
+
+  constructor(
+    private readonly supplierHiboutikRepository: SupplierHiboutikRepository,
+    private readonly supplierDatabaseRepository: SupplierDatabaseRepository,
+    private readonly supplierConverter: SupplierConverter,
+  ) {}
+
+  /** Mirrors Hiboutik suppliers: upserts each of them, then deletes the suppliers missing from Hiboutik. */
+  async syncSuppliers() {
+    const hiboutikSuppliers = await this.supplierHiboutikRepository.getSuppliers();
+    // One upsert per supplier: an invalid supplier must not prevent the others from being saved
+    const nbFailed = await forEachSafely(
+      this.supplierConverter.fromHiboutikList(hiboutikSuppliers),
+      (supplier) => this.supplierDatabaseRepository.upsert(supplier),
+      this.logger,
+      (supplier) => `Hiboutik supplier ${supplier.hiboutikId}`,
+    );
+
+    // Hiboutik is trusted: a successful (2xx) answer, even an empty list, is the truth. An HTTP error throws before this point.
+    const nbDeleted = await this.supplierDatabaseRepository.deleteMissing(hiboutikSuppliers.map((dto) => Number(dto.supplier_id)));
+    this.logger.log(
+      `Suppliers sync ended: ${hiboutikSuppliers.length - nbFailed}/${hiboutikSuppliers.length} synced, ${nbFailed} failed, ${nbDeleted} deleted.`,
+    );
+  }
+}
--- a/src/utils/date.spec.ts
+++ b/src/utils/date.spec.ts
@@ -0,0 +1,15 @@
+import { parseHiboutikDate } from './date';
+
+describe('parseHiboutikDate', () => {
+  it('parses a Hiboutik datetime', () => {
+    expect(parseHiboutikDate('2026-06-28 17:02:55')).toEqual(new Date('2026-06-28T17:02:55'));
+  });
+
+  it('parses a date without time', () => {
+    expect(parseHiboutikDate('1990-05-12')).toEqual(new Date('1990-05-12'));
+  });
+
+  it.each(['', '0000-00-00', '0000-00-00 00:00:00', 'not a date', null, undefined])('returns undefined for %p', (value) => {
+    expect(parseHiboutikDate(value)).toBeUndefined();
+  });
+});
--- a/src/utils/date.ts
+++ b/src/utils/date.ts
@@ -0,0 +1,10 @@
+/**
+ * Parses a Hiboutik date ("YYYY-MM-DD HH:mm:ss" or "YYYY-MM-DD").
+ * Returns undefined for empty or invalid dates (e.g. "0000-00-00").
+ */
+export function parseHiboutikDate(value: string | null | undefined): Date | undefined {
+  if (!value) return undefined;
+
+  const date = new Date(value.trim().replace(' ', 'T'));
+  return isNaN(date.getTime()) ? undefined : date;
+}
--- a/src/utils/price.spec.ts
+++ b/src/utils/price.spec.ts
@@ -0,0 +1,11 @@
+import { parseOptionalHiboutikPrice } from './price';
+
+describe('parseOptionalHiboutikPrice', () => {
+  it('keeps a positive price', () => {
+    expect(parseOptionalHiboutikPrice('12.50')).toBe('12.50');
+  });
+
+  it.each(['0.00', '0', '', 'abc', '-1.00', null, undefined])('returns null for %p', (value) => {
+    expect(parseOptionalHiboutikPrice(value)).toBeNull();
+  });
+});
--- a/src/utils/price.ts
+++ b/src/utils/price.ts
@@ -0,0 +1,10 @@
+/**
+ * Parses an optional Hiboutik price (discount price, size price override).
+ * Hiboutik sends "0.00" when the value is not set: returns null for empty, zero or invalid values.
+ */
+export function parseOptionalHiboutikPrice(value: string | null | undefined): string | null {
+  if (!value) return null;
+
+  const price = Number(value);
+  return Number.isFinite(price) && price > 0 ? value : null;
+}
--- a/src/utils/sync.ts
+++ b/src/utils/sync.ts
@@ -0,0 +1,24 @@
+import { Logger } from '@nestjs/common';
+
+/**
+ * Runs `action` on each item, one at a time: a failing item is logged and skipped, the others are still processed.
+ * @param describe label of an item in the error log, e.g. "Hiboutik brand 12".
+ * @returns the number of failed items.
+ */
+export async function forEachSafely<T>(
+  items: T[],
+  action: (item: T) => Promise<unknown>,
+  logger: Logger,
+  describe: (item: T) => string,
+): Promise<number> {
+  let nbFailed = 0;
+  for (const item of items) {
+    try {
+      await action(item);
+    } catch (error) {
+      nbFailed++;
+      logger.error(`Failed to sync ${describe(item)}`, (error as Error)?.stack);
+    }
+  }
+  return nbFailed;
+}
--- a/test/app.e2e-spec.ts
+++ b/test/app.e2e-spec.ts
@@ -3,24 +3,37 @@ import { INestApplication } from '@nestjs/common';
 import request from 'supertest';
 import { App } from 'supertest/types';
 import { AppModule } from './../src/app.module';
+import { HiboutikService } from './../src/services/hiboutik/hiboutik.service';
+import { PrismaService } from './../prisma/prisma.service';

+// Boots the real AppModule wiring, without database nor Hiboutik calls
 describe('AppController (e2e)', () => {
  let app: INestApplication<App>;
+  const hiboutikService = { startSync: jest.fn() };

  beforeEach(async () => {
+    hiboutikService.startSync.mockReset();
    const moduleFixture: TestingModule = await Test.createTestingModule({
      imports: [AppModule],
-    }).compile();
+    })
+      .overrideProvider(PrismaService)
+      .useValue({})
+      .overrideProvider(HiboutikService)
+      .useValue(hiboutikService)
+      .compile();

    app = moduleFixture.createNestApplication();
    await app.init();
  });

-  it('/ (GET)', () => {
-    return request(app.getHttpServer())
-      .get('/')
-      .expect(200)
-      .expect('Hello World!');
+  it('POST /sync starts a synchronization (202)', () => {
+    hiboutikService.startSync.mockResolvedValue(true);
+    return request(app.getHttpServer()).post('/sync').expect(202).expect({ message: 'Hiboutik synchronization started' });
+  });
+
+  it('POST /sync answers 409 when a synchronization is already running', () => {
+    hiboutikService.startSync.mockResolvedValue(false);
+    return request(app.getHttpServer()).post('/sync').expect(409);
  });

  afterEach(async () => {
--- a/test/jest-e2e.json
+++ b/test/jest-e2e.json
@@ -3,7 +3,22 @@
  "rootDir": ".",
  "testEnvironment": "node",
  "testRegex": ".e2e-spec.ts$",
+  "setupFiles": ["<rootDir>/setup-env.ts"],
  "transform": {
-    "^.+\\.(t|j)s$": "ts-jest"
+    "^.+.ts$": "ts-jest",
+    "^.+.js$": [
+      "ts-jest",
+      {
+        "tsconfig": {
+          "allowJs": true,
+          "module": "commonjs",
+          "moduleResolution": "node"
+        }
+      }
+    ]
+  },
+  "transformIgnorePatterns": ["/node_modules/(?!@nestjs/config/)"],
+  "moduleNameMapper": {
+    "^(\\.{1,2}/.*)\\.js$": "$1"
  }
 }
--- a/test/setup-env.ts
+++ b/test/setup-env.ts
@@ -0,0 +1,5 @@
+// The e2e test needs neither a database nor Hiboutik, but the app validates its environment at startup: provide dummy values.
+process.env.DATABASE_URL ??= 'postgresql://test:test@localhost:5432/test';
+process.env.HIBOUTIK_BASE_URL ??= 'https://example.hiboutik.test/api';
+process.env.HIBOUTIK_USERNAME ??= 'test';
+process.env.HIBOUTIK_PASSWORD ??= 'test';
Author	SHA1	Message	Date
MastersGame	05911f4230	feat(security): harden the API and lock synchronizations across instances - Validate the environment at startup (src/config): required variables must be present, HIBOUTIK_BASE_URL must be HTTPS. - Global ValidationPipe (whitelist, forbidNonWhitelisted, transform). - Helmet, CORS disabled unless CORS_ORIGINS is set, TRUST_PROXY support, HTTP header/request timeouts, shutdown hooks. - Rate limiting: 60 req/min/IP globally, 5 req/min on POST /sync. - AllExceptionsFilter: unexpected errors are logged (message + stack, never the raw error object) and answered with a generic 500. - Postgres advisory lock (dedicated connection) so only one synchronization runs at a time across all instances; released by Postgres itself if the process dies. - Fix the Jest moduleNameMapper (unescaped dot also matched .cjs files). - Document the input validation and security rules in CLAUDE.md. - Add class-validator, class-transformer, helmet and @nestjs/throttler; npm audit fix refreshed package-lock.json. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 10:11:35 +01:00
MastersGame	30c56f9330	feat(sync): trust Hiboutik answers for deletions A successful (2xx) answer from Hiboutik is now the truth, even an empty list: records missing from it are deleted. The "empty list means API issue" safety nets are removed. Deletion stays safe because a failed call deletes nothing: HTTP errors throw, and the new HiboutikClient.getList (used by getAllPages and the non-paginated lists) also throws on a 2xx body that is not a list, so a malformed answer is never mistaken for an empty list. A 2xx without body is an empty list. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 10:11:34 +01:00
quentin_duwa	8b341c4933	chore: add Claude Code configuration (#2 ) ## Summary - Add `CLAUDE.md`: project description (K-pop shop backend, buffer in front of Hiboutik), architecture, domain notes, git workflow. - Add shared `.claude/settings.json` (allowed dev commands, `.env` read protection). - Pin the Prisma agent skills in `skills-lock.json` (restore with `npx skills experimental_install`, documented in the README). - Update `.gitignore` (generated skills, local settings, Postman skills) and add `.gitattributes` (LF line endings). ## Note This branch is based on `feat/customer-addresses-orders`, so the PR also contains the 3 feature commits (addresses, company details, orders) that `CLAUDE.md` describes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: MastersGame <quentin.duwa1210@gmail.com> Reviewed-on: #2	2026-11-07 12:14:08 +00:00
quentin_duwa	9dddf7562a	feat(sync): synchronize customer adresses and orders from Hiboutik sales (#1 ) Co-authored-by: MastersGame <quentin.duwa1210@gmail.com> Reviewed-on: #1	2026-11-07 09:56:53 +00:00
MastersGame	c5f65dcb62	feat(sync): synchronize Hiboutik data through POST /sync POST /sync starts the full synchronization in the background (202, or 409 when one is already running). Entities are synced in dependency order: brands, categories, suppliers, products (with versions and stocks), customers. Each row is synced independently so that a failure is logged without stopping the rest. Replaces the default AppService.	2026-11-05 23:00:49 +01:00
MastersGame	27d0e0149d	feat(db): add database repositories Upserts keyed on hiboutikId and deletion of the rows that no longer exist in Hiboutik.	2026-11-05 23:00:48 +01:00
MastersGame	db699822f9	feat(sync): add converters from Hiboutik DTOs to Prisma inputs Includes helpers for Hiboutik dates ("0000-00-00" is ignored) and optional prices ("0.00" means no value).	2026-11-05 23:00:48 +01:00
MastersGame	2424a086e0	feat(hiboutik): add Hiboutik API client, repositories and DTOs HiboutikClient handles Basic auth and walks paginated endpoints. One read-only repository per entity (brands, categories, suppliers, products, stocks, customers).	2026-11-05 23:00:47 +01:00
MastersGame	8f377a1fe9	feat(db): add Prisma schema and global PrismaModule Models mirror Hiboutik entities (categories tree, brands, suppliers, products and their versions, customers) plus addresses and orders for the upcoming sync. Every synced model is matched with Hiboutik through a unique hiboutikId. The generated client is ignored by git and env files other than .env.example are ignored.	2026-11-05 23:00:46 +01:00
MastersGame	a0ddef240c	build: add Prisma 7, PostgreSQL driver and @nestjs/config Generate the Prisma client on postinstall. Jest now transpiles the ESM-only @nestjs/config and maps the .js imports of the generated Prisma client, in both the unit and e2e configurations.	2026-11-05 23:00:45 +01:00
MastersGame	24b699cfc4	chore: update prettier and eslint configuration Use a 140 characters print width and let typescript-eslint resolve types through tsconfig.json.	2026-11-05 23:00:44 +01:00