@bongos/core 1.21.174 → 1.21.176

package/scripts/gds/cutover-codemod.js

@@ -1,241 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/cutover-codemod.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/cutover-codemod.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// cutover-codemod.js — rewrite HOST files' core-internal require()s to the @bongos/core
-// package subpaths at cutover (R89 / task 2159 [F1], task 2161 [F3]).
-//
-// WHY. Post-split (task 1728) a host file lives at `<instance>/…` with NO co-located `src/`.
-// Its relative core require()s — `require('../../src/module-api')` (host modules, F1),
-// `require('./src/bongos/…')` (the game entrypoint server.js, F3) — point at the DELETED
-// instance `src/` → boot crash (the 2026-07-10 rehearsal, findings F1+F3:
-// docs/reviews/2026-07-10-example-decouple-r89-rehearsal.md). Core modules are UNAFFECTED:
-// they ship INSIDE @bongos/core, where `src/` sits next to `modules/`, so their identical
-// relative requires still resolve. The fix is to rewrite the host files' core requires to the
-// package's EXPORTED subpaths (`@bongos/core/module-api`, `@bongos/core/serve-internal`, …).
-//
-// WHY A CUTOVER TRANSFORM, NOT AN IN-PLACE MONOLITH EDIT. In the monolith `@bongos/core` is not
-// a dependency (the specifier resolves nowhere) and fitness's "modules import only
-// src/module-api.js" check would fail the rewritten form. So this must run AT CUTOVER on the
-// partitioned consumer tree — never on the committed monolith source. Mirrors the `.claude/hooks`
-// `_core-resolve.js` step (task 2139); `claude-materialize.js` rewrites `.claude/`, this rewrites
-// host-module + server.js source — the gap that rehearsal F1/F3 named.
-//
-// TWO GUARDS make it structurally impossible to corrupt the monolith:
-//   1. SCOPE ORACLE = publish-manifest. A file is rewritten only when `isPublishable(rel) === false`
-//      (host: game / art-pipeline / character-anim / demo + server.js). Core files (publishable)
-//      ship with the package and are left untouched — reusing the exact partition logic as the
-//      core-vs-host oracle, so this can never drift from what the cutover actually deletes/keeps.
-//   2. PRECONDITION = post-split consumer. Refuse unless the instance core doorway is gone
-//      (`src/module-api.js` absent at the root) — the definitive signal core was partitioned out.
-//      In the monolith that file exists, so the codemod refuses. `--force` overrides for a
-//      read-only preview only.
-//
-// The rewrite is TABLE-DRIVEN (CORE_INTERNAL_MAP), not a blind `src/X → @bongos/core/X` path swap,
-// because the core's export names do not all mirror the src layout: `src/bongos/serve-internal.js`
-// is exported as `./serve-internal`, not `./bongos/serve-internal`. The table encodes each mapping
-// so a rewrite can never produce a specifier the package doesn't export. Idempotent (a rewritten
-// `@bongos/core/*` require no longer matches the relative-into-src pattern) and quote-preserving.
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-const { isPublishable } = require('./publish-manifest');
-
-const CORE_PKG = '@bongos/core';
-
-// <subpath after `src/` in the relative require> → <the @bongos/core export subpath>.
-// The core exports map (scripts/gds/package-core.js buildPackageJson) MUST export every value
-// here, or the rewritten require won't resolve. Kept deliberately small + explicit.
-//   F1 (task 2159): the host-module doorway.
-//   F3 (task 2161): the six core internals the game entrypoint server.js wires — added there,
-//     in lockstep with widening the core exports map, so a rewrite never outruns an export.
-const CORE_INTERNAL_MAP = {
-  // F1 — every host module imports the core doorway; the ONLY core import a module is allowed.
-  'module-api': 'module-api',
-  // F3 (task 2161) — the six core internals the game entrypoint server.js wires. Each LHS is the
-  // subpath after `src/` in server.js's relative require; each RHS is the core's EXPORTED subpath
-  // (widened in package-core.js buildPackageJson in lockstep). Note the divergence: the file at
-  // `src/bongos/serve-internal.js` is exported as `./serve-internal` (a curated name), NOT
-  // `./bongos/serve-internal` — this table encodes that so the rewrite can't emit an unexported
-  // specifier. The other five mirror their src/ path.
-  'bongos/api-path-404': 'bongos/api-path-404',
-  'bongos/uptime-poller': 'bongos/uptime-poller',
-  'bongos/serve-internal': 'serve-internal',
-  'module-loader/loader': 'module-loader/loader',
-  'modules': 'modules',
-  'module-seams': 'module-seams',
-};
-
-// require('<./ or ../…>src/<key>')  — a RELATIVE require that reaches into a `src/` dir.
-// Group 1 = quote (preserved), group 2 = the `./`/`../…` prefix, group 3 = the key after `src/`.
-// An already-rewritten `require('@bongos/core/…')` has no `../src/` and never matches → idempotent.
-const REQUIRE_RE = /require\((['"])((?:\.\.?\/)+)src\/([^'"]+)\1\)/g;
-
-// Pure. Rewrite the core-internal require()s in one file's text per `map`.
-// Returns { text, changes:[{from,to,key}], unmapped:[{key,spec}] }.
-//   - changes: requires rewritten to `@bongos/core/<mapped>`.
-//   - unmapped: relative-into-`src/` requires whose key is NOT in the table — left UNCHANGED and
-//     surfaced so a new core internal a host file starts depending on can't be silently missed
-//     (it would still crash at boot; the codemod flags "add an export + a table entry").
-function rewriteCoreRequires(text, map = CORE_INTERNAL_MAP) {
-  const changes = [];
-  const unmapped = [];
-  const out = String(text == null ? '' : text).replace(REQUIRE_RE, (whole, q, _prefix, key) => {
-    const mapped = Object.prototype.hasOwnProperty.call(map, key) ? map[key] : null;
-    if (mapped == null) {
-      unmapped.push({ key, spec: whole });
-      return whole; // leave unknown core internals untouched — never guess a specifier
-    }
-    const to = `require(${q}${CORE_PKG}/${mapped}${q})`;
-    changes.push({ from: whole, to, key });
-    return to;
-  });
-  return { text: out, changes, unmapped };
-}
-
-// A file is in scope iff the partition classifies it HOST (not shipped in the core package).
-function isHostFile(rel, isPublishableFn = isPublishable) {
-  return isPublishableFn(rel) === false;
-}
-
-// Post-split consumer signal: the instance's own core doorway is gone. In the monolith
-// `src/module-api.js` exists, so this is false and the CLI refuses (protecting the monolith).
-function looksLikeConsumer(root, { existsFn = fs.existsSync } = {}) {
-  return !existsFn(path.join(root, 'src', 'module-api.js'));
-}
-
-// Skip vendored deps, VCS metadata, the `.claude/` topology surface (materialize's job), and
-// build output. `dist/` in particular holds an extracted @bongos/core tarball whose bundled
-// core modules carry the SAME `../../src/module-api` requires — scanning it would be noise
-// (it's gitignored throwaway, never part of the consumer).
-const SKIP_DIRS = new Set(['node_modules', '.git', '.claude', 'dist', 'coverage']);
-
-// Preferred source scope: git-TRACKED *.js files. A consumer tree is a git repo at cutover, and
-// tracking is the honest "source" oracle — it excludes every gitignored build artifact (dist/,
-// coverage/, …) without enumerating them. Returns repo-relative POSIX paths, or null when git is
-// unavailable / this isn't a repo (→ caller falls back to the filesystem walk).
-function gitTrackedJsFiles(root, { runGit } = {}) {
-  const run = runGit || ((args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }));
-  let out;
-  try { out = run(['ls-files', '-z', '*.js']); } catch { return null; }
-  if (typeof out !== 'string') return null;
-  return out.split('\0').filter(Boolean).map((p) => p.split(path.sep).join('/')).sort();
-}
-
-// Recursively collect *.js files under `root`, skipping SKIP_DIRS. Returns repo-relative POSIX
-// paths (what isPublishable expects). The fallback when git tracking is unavailable.
-function collectJsFiles(root, { fsImpl = fs } = {}) {
-  const found = [];
-  const walk = (absDir) => {
-    let entries;
-    try { entries = fsImpl.readdirSync(absDir, { withFileTypes: true }); } catch { return; }
-    for (const ent of entries) {
-      if (ent.isDirectory()) {
-        if (SKIP_DIRS.has(ent.name)) continue;
-        walk(path.join(absDir, ent.name));
-      } else if (ent.isFile() && ent.name.endsWith('.js')) {
-        found.push(path.relative(root, path.join(absDir, ent.name)).split(path.sep).join('/'));
-      }
-    }
-  };
-  walk(root);
-  return found.sort();
-}
-
-function underSkipDir(rel) {
-  return SKIP_DIRS.has(rel.split('/')[0]);
-}
-
-// The candidate *.js set to consider: git-tracked source when available, else the filesystem walk.
-// SKIP_DIRS is enforced on BOTH paths — git ls-files does not know about it, and `.claude/` in
-// particular is materialize's + _core-resolve.js's domain (task 2139), never the codemod's.
-function candidateJsFiles(root, { fsImpl = fs, runGit } = {}) {
-  const tracked = gitTrackedJsFiles(root, { runGit });
-  const list = tracked && tracked.length ? tracked : collectJsFiles(root, { fsImpl });
-  return list.filter((rel) => !underSkipDir(rel));
-}
-
-// Plan the codemod over a consumer `root`: which host files change, and any unmapped core requires.
-// Pure-ish (reads disk via injectable deps for tests). Does NOT write.
-function planCodemod({ root, fsImpl = fs, runGit, isPublishableFn = isPublishable, map = CORE_INTERNAL_MAP } = {}) {
-  const files = [];
-  const unmapped = [];
-  for (const rel of candidateJsFiles(root, { fsImpl, runGit })) {
-    if (!isHostFile(rel, isPublishableFn)) continue; // core file → ships with the package, leave it
-    let raw;
-    try { raw = fsImpl.readFileSync(path.join(root, rel), 'utf8'); } catch { continue; }
-    const res = rewriteCoreRequires(raw, map);
-    if (res.unmapped.length) for (const u of res.unmapped) unmapped.push({ rel, ...u });
-    if (res.changes.length) files.push({ rel, changes: res.changes, newText: res.text });
-  }
-  return { files, unmapped };
-}
-
-// ---- CLI -------------------------------------------------------------------
-function parseArgs(argv) {
-  const a = { root: process.cwd(), apply: false, force: false };
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] === '--root') a.root = argv[++i];
-    else if (argv[i] === '--apply') a.apply = true;
-    else if (argv[i] === '--force') a.force = true;
-  }
-  return a;
-}
-
-function main(argv = process.argv.slice(2), { log = console.log, err = console.error } = {}) {
-  const args = parseArgs(argv);
-  const root = path.resolve(args.root);
-
-  if (!looksLikeConsumer(root) && !args.force) {
-    err(`[cutover-codemod] REFUSING: ${path.join(root, 'src/module-api.js')} still exists — this looks like the monolith,`);
-    err('  not a post-split consumer. This codemod is a CUTOVER transform and must not edit the monolith');
-    err('  (there @bongos/core is not a dep and fitness would reject the rewrite). Run it after the partition,');
-    err('  or pass --force for a read-only preview only.');
-    return 2;
-  }
-
-  const plan = planCodemod({ root });
-
-  for (const u of plan.unmapped) {
-    err(`[cutover-codemod] WARNING ${u.rel}: unmapped core-internal require ${u.spec} — add a CORE_INTERNAL_MAP`);
-    err(`  entry + a matching core export before cutover, or this require will crash at boot.`);
-  }
-
-  if (!plan.files.length) {
-    log('[cutover-codemod] no host files need rewriting (already converted, or none present).');
-    return 0;
-  }
-
-  const verb = args.apply ? 'rewrote' : 'would rewrite';
-  for (const f of plan.files) {
-    log(`[cutover-codemod] ${verb} ${f.rel} (${f.changes.length} require${f.changes.length === 1 ? '' : 's'}):`);
-    for (const c of f.changes) log(`    ${c.from}  →  ${c.to}`);
-    if (args.apply) fs.writeFileSync(path.join(root, f.rel), f.newText);
-  }
-
-  const total = plan.files.reduce((n, f) => n + f.changes.length, 0);
-  if (args.apply) {
-    log(`[cutover-codemod] ✓ rewrote ${total} require(s) across ${plan.files.length} host file(s).`);
-  } else {
-    log(`[cutover-codemod] dry-run: ${total} require(s) across ${plan.files.length} host file(s). Re-run with --apply to write.`);
-  }
-  return 0;
-}
-
-module.exports = {
-  CORE_PKG,
-  CORE_INTERNAL_MAP,
-  REQUIRE_RE,
-  rewriteCoreRequires,
-  isHostFile,
-  looksLikeConsumer,
-  gitTrackedJsFiles,
-  collectJsFiles,
-  candidateJsFiles,
-  planCodemod,
-  parseArgs,
-  main,
-};
-
-if (require.main === module) {
-  process.exit(main());
-}
+require('../bongos/forwarder.js').forward(module, 'cutover-codemod.js');

package/scripts/gds/db-backup-nightly.sh

@@ -1,232 +1,8 @@
 #!/bin/bash
-# Nightly pg_dump of the GDS Postgres DB.
-#
-# Runs as the unit's User= (the plane's app account) via the gds-db-backup.timer systemd unit (see
-# scripts/gds/gds-db-backup.timer + .service in this repo). Output lands
-# in /var/backups/gds/ as <db>-YYYY-MM-DDTHHMMSSZ.sql.gz (UTC timestamp), and
-# files older than 30 days are pruned.
-#
-# Authentication: peer auth via the local Unix socket — the invoking unix
-# user owns the instance's Postgres role; pg_dump finds the socket at
-# /var/run/postgresql with no password needed. Matches the model in
-# src/db.js.
-#
-# Filed by #412 (V3.R62-precondition) — closes the "GDS DB has no
-# nightly backup" gap surfaced by ADR 0024. The OFFSITE copy of these
-# dumps is filed separately as #415 (V3.R62-offsite); this script only
-# handles the local-on-droplet half.
-#
-# Caveat: dumps land on the same physical disk as the live database
-# (/dev/vda1). That protects against corruption, accidental DROP, bad
-# migrations, and "oops I deleted a row" — but NOT whole-droplet loss.
-# #415 closes that remaining gap with a weekly offsite archive.
-#
-# Manual one-shot:
-#   /usr/local/sbin/gds-db-backup.sh
-#
-# Systemd:
-#   sudo systemctl start gds-db-backup.service   # one-shot
-#   sudo systemctl status gds-db-backup.timer    # check schedule
-#   journalctl -u gds-db-backup.service          # see history
-
-set -euo pipefail
-
-# ---- configuration ----------------------------------------------------------
-
-# Destination directory for dumps. Owned by that account and its primary group, mode 0750.
-BACKUP_DIR="${GDS_BACKUP_DIR:-/var/backups/gds}"
-
-# Database to dump: explicit GDS_BACKUP_DB wins, else the instance's own branding
-# pack names it — the SAME resolver as migrate.sh / pool.js, so the backup and the
-# running server can never disagree (task 1002757). Deliberately NO literal
-# fallback: this script ships to every instance, and a baked-in founder default
-# aimed another instance's nightly pg_dump at a database that is not its own.
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-DB_NAME="${GDS_BACKUP_DB:-}"
-if [ -z "$DB_NAME" ]; then
-  DB_NAME="$(node -e "process.stdout.write(require(process.argv[1]).instanceDbName() || '')" "$REPO_ROOT/src/bongos/pool" 2>/dev/null || true)"
-fi
-if [ -z "$DB_NAME" ]; then
-  echo "db-backup: cannot determine which database to dump. Set GDS_BACKUP_DB, or give this instance a db.database in config/branding.json. Refusing to guess (task 1002757)." >&2
-  exit 2
-fi
-
-# Retention in days. Files older than this (by mtime) are deleted at the
-# end of each successful run. 30 days = 30 daily dumps retained.
-RETENTION_DAYS="${GDS_BACKUP_RETENTION_DAYS:-30}"
-
-# Timestamp format. UTC so dumps sort sanely regardless of TZ.
-TS=$(date -u +"%Y-%m-%dT%H%M%SZ")
-OUT="${BACKUP_DIR}/${DB_NAME}-${TS}.sql.gz"
-# Exactly the name above. Every project's unit shares BACKUP_DIR, so a looser
-# `${DB_NAME}-*` would let `test` prune and count `test-nk`'s dumps (task 1003948).
-D='[0-9]'
-DUMP_GLOB="${DB_NAME}-${D}${D}${D}${D}-${D}${D}-${D}${D}T${D}${D}${D}${D}${D}${D}Z.sql.gz"
-
-# ---- preconditions ----------------------------------------------------------
-
-if [ ! -d "$BACKUP_DIR" ]; then
-  echo "ERROR: backup dir $BACKUP_DIR does not exist." >&2
-  echo "       Create it with:" >&2
-  echo "         sudo install -d -o $(id -un) -g $(id -gn) -m 0750 $BACKUP_DIR" >&2
-  exit 2
-fi
-
-if [ ! -w "$BACKUP_DIR" ]; then
-  echo "ERROR: backup dir $BACKUP_DIR is not writable by $(whoami)." >&2
-  exit 2
-fi
-
-# Confirm pg_dump is reachable. Cheap fail-loudly so a missing pg or a
-# misconfigured PATH doesn't silently skip a night.
-if ! command -v pg_dump >/dev/null 2>&1; then
-  echo "ERROR: pg_dump not on PATH." >&2
-  exit 2
-fi
-
-# ---- the dump ---------------------------------------------------------------
-
-echo "[$(date -u +%FT%TZ)] gds-db-backup: dumping ${DB_NAME} → ${OUT}"
-
-# -Fc would give a custom-format dump (recommended for selective restore),
-# but plain SQL + gzip is easier for an Archon to eyeball and easier for the
-# restore-drill to verify.
-#
-# We dump everything with --clean so a restore into a fresh DB drops
-# existing objects first. --if-exists tolerates the no-existing-objects
-# case. --no-owner + --no-privileges keep the dump portable across role
-# names (useful if we ever restore into staging under a different user).
-#
-# --exclude-table-data=search_chunks (#973 review): search_chunks (migration
-# 103, the /recall lexical index) is REGENERABLE derived data — chunked copies
-# of DB prose (already dumped as tasks/learnings/… rows) and repo markdown
-# (already in git). Dumping its rows roughly duplicates the prose corpus and
-# was the dump's dominant growth vector as docs accumulated. Excluding only its
-# DATA keeps the CREATE TABLE + GIN indexes in the dump, so a restore recreates
-# the table empty and the index rebuilds from source: search-ingest-md.js on the
-# next deploy (doc chunks) + search-ingest-db.js nightly (DB prose) — or run both
-# by hand for immediate recall (see docs/recipes/gds-db-backup.md restore drill).
-# The tsv column is GENERATED (never dumped) and the GIN indexes are CREATE-INDEX
-# statements (not data), so the only thing dropped is the duplicated body text.
-#
-# stderr is deliberately NOT filtered (incident 2026-07-02, task 1711). A prior
-# `--verbose 2> >(grep -v "^pg_dump:" >&2)` threw away pg_dump's OWN error lines
-# too (they are `pg_dump: error:`-prefixed) — so a `permission denied` on one
-# orphaned table (credit_log_backup_task1317) failed EVERY dump silently for 12
-# days. Let pg_dump's stderr flow straight to journald; `set -o pipefail` still
-# aborts on a real failure, now visibly in `systemctl status` /
-# `journalctl -u gds-db-backup.service`.
-pg_dump \
-  --dbname="$DB_NAME" \
-  --format=plain \
-  --clean \
-  --if-exists \
-  --no-owner \
-  --no-privileges \
-  --exclude-table-data=search_chunks \
-  | gzip -9 > "$OUT.partial"
-
-# Atomic rename — only flip to the real filename once gzip finishes.
-# A SIGKILL mid-stream leaves a .partial that the next run will overwrite.
-mv "$OUT.partial" "$OUT"
-
-# Size in bytes via POSIX `wc -c`, not `stat -c '%s'`: that is GNU-only, and BSD/macOS
-# stat refuses it outright, so every run on a Mac died here (task 1004170). tr drops the
-# padding BSD wc prints in front of the number.
-BYTES=$(wc -c < "$OUT" | tr -d '[:space:]')
-echo "[$(date -u +%FT%TZ)] gds-db-backup: wrote ${OUT} (${BYTES} bytes)"
-
-# Completeness guard (incident 2026-07-02, task 1711; task 1003925). pipefail already
-# aborts on a pg_dump error; this is belt-and-suspenders against a dump cut short. A
-# plain-format dump always closes with pg_dump's own "dump complete" comment (patched
-# servers append a \unrestrict line after it), whatever its size. The fixed 1 MiB floor
-# this replaces was sized for the platform database and failed — and deleted — every
-# valid dump of a small project (~36 KB gzipped). Fail loudly and delete a broken dump
-# so it can never masquerade as a good one.
-DUMP_TAIL=$(gzip -dc "$OUT" 2>/dev/null | tail -n 10) || DUMP_TAIL=''
-FAIL_REASON=''
-case "$DUMP_TAIL" in
-  *'-- PostgreSQL database dump complete'*) ;;
-  *) FAIL_REASON="(${BYTES} bytes) is incomplete — no pg_dump completion line" ;;
-esac
-
-# Optional operator floor. Unset means none: no single size fits every instance.
-MIN_BYTES="${GDS_BACKUP_MIN_BYTES:-0}"
-if [ -z "$FAIL_REASON" ] && [ "$BYTES" -lt "$MIN_BYTES" ]; then
-  FAIL_REASON="is only ${BYTES} bytes (< ${MIN_BYTES} floor)"
-fi
-if [ -n "$FAIL_REASON" ]; then
-  echo "[$(date -u +%FT%TZ)] gds-db-backup: ERROR latest dump ${FAIL_REASON} — treating as FAILED." >&2
-  rm -f "$OUT"
-  exit 1
-fi
-
-# Size-threshold guard (#973 review). With search_chunks data excluded above the
-# dump stays sub-MB, so a gzipped dump past this threshold means something else
-# grew unexpectedly (a new large table, or the exclusion silently stopped
-# matching after a rename). WARN loudly to journald — never fail the backup, just
-# flag it for a review. Generous default (25 MiB gzipped vs the current sub-1 MB);
-# tune via GDS_BACKUP_WARN_BYTES once real post-exclusion sizes are observed.
-WARN_BYTES="${GDS_BACKUP_WARN_BYTES:-26214400}"
-if [ "$BYTES" -gt "$WARN_BYTES" ]; then
-  echo "[$(date -u +%FT%TZ)] gds-db-backup: WARN latest dump is ${BYTES} bytes (> ${WARN_BYTES} threshold) — review what grew; is it a regenerable table excludable like search_chunks?" >&2
-fi
-
-# ---- bug attachments (task 1003918) -----------------------------------------
-
-# The DB dump above is not the whole state. Re-hosted #bugs screenshots live on
-# disk under var/bug-attachments, outside Postgres and outside git, and they are
-# the one artefact here that CANNOT be regenerated: the Discord CDN URL they were
-# copied from is signed and expires in about a day, so our copy IS the image.
-#
-# Nothing backed them up. All five this instance ever stored are gone — the
-# 2026-07-05 droplet move carried the database and not var/ — and every task
-# description embedding one now renders a broken image in the hall.
-#
-# Tarred beside the dump, same timestamp, same retention, so a restore drill that
-# picks a date gets the database and the images that go with it. Best-effort by
-# design: a missing or empty attachments dir is the ordinary case on a fresh
-# instance and must never fail a night of database backup.
-ATTACH_DIR="${BUG_ATTACHMENTS_DIR:-$REPO_ROOT/var/bug-attachments}"
-ATTACH_OUT="${BACKUP_DIR}/${DB_NAME}-attachments-${TS}.tar.gz"
-ATTACH_GLOB="${DB_NAME}-attachments-${D}${D}${D}${D}-${D}${D}-${D}${D}T${D}${D}${D}${D}${D}${D}Z.tar.gz"
-
-if [ -d "$ATTACH_DIR" ]; then
-  # Every count here goes through tr for the same reason as BYTES: BSD wc pads it, which
-  # put "pruned        1 dump(s)" in a Mac's log where Linux writes "pruned 1 dump(s)".
-  ATTACH_COUNT=$(find "$ATTACH_DIR" -maxdepth 1 -type f | wc -l | tr -d '[:space:]')
-  if [ "$ATTACH_COUNT" -gt 0 ]; then
-    if tar -czf "$ATTACH_OUT.partial" -C "$ATTACH_DIR" . 2>/dev/null; then
-      mv "$ATTACH_OUT.partial" "$ATTACH_OUT"
-      echo "[$(date -u +%FT%TZ)] gds-db-backup: wrote ${ATTACH_OUT} (${ATTACH_COUNT} attachment(s))"
-    else
-      rm -f "$ATTACH_OUT.partial"
-      echo "[$(date -u +%FT%TZ)] gds-db-backup: WARN could not archive ${ATTACH_DIR} — database dump is unaffected" >&2
-    fi
-  else
-    echo "[$(date -u +%FT%TZ)] gds-db-backup: no bug attachments to archive"
-  fi
-else
-  echo "[$(date -u +%FT%TZ)] gds-db-backup: no bug-attachment dir at ${ATTACH_DIR} — nothing to archive"
-fi
-
-# ---- retention prune --------------------------------------------------------
-
-# Delete dumps older than RETENTION_DAYS. -mtime +N means strictly older
-# than N days (so RETENTION_DAYS=30 keeps the most recent ~30 dumps).
-# Done AFTER the new dump lands so a streak of failed runs can't erase
-# everything: we never delete on a day we didn't successfully dump.
-PRUNED=$(find "$BACKUP_DIR" -maxdepth 1 -type f \
-    \( -name "$DUMP_GLOB" -o -name "$ATTACH_GLOB" \) \
-    -mtime +"${RETENTION_DAYS}" \
-    -print -delete | wc -l | tr -d '[:space:]')
-
-if [ "$PRUNED" -gt 0 ]; then
-  echo "[$(date -u +%FT%TZ)] gds-db-backup: pruned ${PRUNED} dump(s) older than ${RETENTION_DAYS}d"
-fi
-
-# ---- emit a one-line summary for journald + monitoring ---------------------
-
-REMAINING=$(find "$BACKUP_DIR" -maxdepth 1 -type f -name "$DUMP_GLOB" | wc -l | tr -d '[:space:]')
-echo "[$(date -u +%FT%TZ)] gds-db-backup: ok · ${REMAINING} dump(s) retained · ${BYTES} bytes latest"
+# scripts/gds/db-backup-nightly.sh — @bongos-forwarder (task 1004848). Generated by
+# scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+# The real script is scripts/bongos/db-backup-nightly.sh. This forwarder keeps callers that still name
+# the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if [ -z "${BONGOS_FORWARDER_WARNED:-}" ]; then echo "[bongos] scripts/gds/db-backup-nightly.sh has moved to scripts/bongos/db-backup-nightly.sh. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release." >&2; fi
+export BONGOS_FORWARDER_WARNED=1
+exec bash "$(dirname "$0")/../bongos/db-backup-nightly.sh" "$@"