@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.10

package/dist/db-backup/handlers/db-backup-sweep.handler.js

@@ -0,0 +1,539 @@
+"use strict";
+// =============================================================================
+// `db.backup.sweep` — the backup subsystem's housekeeping, as a queue job
+// (issue #353, epic #345)
+// =============================================================================
+//
+// TWO DUTIES, ONE JOB, AND THEY ARE ORDERED:
+//
+//   1. RELEASE STALE RUNS — a run whose executor went away is marked `stale`,
+//      which frees the single-active-run slot the partial unique index
+//      (`database_backup_runs_active_uniq_idx`) enforces.
+//   2. PRUNE BY RETENTION — `DatabaseBackupRetentionService.prune` deletes the
+//      archives and rows that `databaseBackup.retentionCount` (and the
+//      pre-restore age rule) say are expired.
+//
+// Both were already written and already tested; #353 did not change either
+// one\'s logic. What changed is WHO RUNS THEM, and that is the whole point of
+// this file — before it, duty 1 ran inline on the ten-minute scheduler tick and
+// duty 2 ran inline at the END OF EVERY SUCCESSFUL BACKUP, awaited inside
+// `DatabaseBackupRunnerService.completeRun`. Neither appeared in the admin job
+// list, neither held a worker slot, neither had a timeout, and a retention
+// prune that deleted forty archives against a slow bucket did it on whichever
+// thread had just finished a `pg_dump`.
+//
+// -----------------------------------------------------------------------------
+// ⚠ WHY THE PRUNE MOVED HERE RATHER THAN STAYING WHERE `completeRun` PUT IT
+// -----------------------------------------------------------------------------
+//
+// `completeRun`\'s comment gives three ordering constraints for the prune, and
+// ALL THREE SURVIVE THE MOVE — read them in that order, because the third is
+// the one that would have broken had this been done carelessly:
+//
+//   - AFTER VERIFICATION. Retention deletes older archives, and this one is
+//     only a replacement for them once it has been proven readable. The enqueue
+//     sits after the read-back, so the sweep cannot start before it.
+//   - AFTER THE `completed` UPDATE. The count rule keeps the newest N
+//     `completed` runs, so a prune racing the terminal write would not count
+//     the run that just finished and would evict one MORE old backup than
+//     retention asked for. The enqueue happens after that update commits, and a
+//     queued job cannot be claimed before the row it was enqueued after is
+//     visible.
+//   - ONLY ON SUCCESS. There is no enqueue on any failure path. A failed backup
+//     is exactly when the old archives matter most.
+//
+// And the fourth constraint that `completeRun` states — "storage housekeeping
+// must not be able to reach the failure path of the backup it is housekeeping
+// for" — is now STRUCTURAL rather than defended by a nested `try`. The prune
+// runs in a different job, on a different worker slot, after the backup\'s own
+// job has already settled. There is no longer any code path by which a
+// retention failure can reach the `catch` that deletes the archive.
+//
+// -----------------------------------------------------------------------------
+// ⚠ THE STALE RELEASE NOW COSTS ONE TICK OF LATENCY, AND THAT IS THE TRADE
+// -----------------------------------------------------------------------------
+//
+// `DatabaseBackupScheduleTask`\'s header used to argue that the sweep must run
+// BEFORE the fire in the same tick, because the sweep is what releases the slot
+// the fire needs: a zombie found at 02:00 was released at 02:00 and the backup
+// started in the same tick. That is no longer literally true. The tick now
+// enqueues this sweep and then evaluates the boundary, so a tick that finds a
+// zombie may still hit `already_running` and stand down.
+//
+// THE BACKUP IS DELAYED, NEVER LOST, AND BY AT MOST TEN MINUTES. The scheduler\'s
+// anti-double-fire rule is stateless and recomputed from the boundary every
+// tick ("a late tick still fires"), so the next tick — with the slot now free —
+// takes the backup. That property was designed for a process that was down at
+// 02:00; it covers this for the same reason. Ten minutes of latency on a
+// nightly dump, in the rare case where the previous executor died, is the price
+// of the dump\'s housekeeping being accounted for like everything else, and it
+// is a price this epic decided to pay everywhere.
+//
+// REJECTED: keeping the release inline "because it is only an `updateMany`". It
+// is not: it is a read, a per-candidate compare-and-swap, a notification per
+// released row and a best-effort object DELETE against a bucket, once per
+// candidate. That is exactly the shape of work this epic exists to account for.
+//
+// -----------------------------------------------------------------------------
+// SERVER-ONLY, AND NO EXECUTION PROFILE
+// -----------------------------------------------------------------------------
+//
+// Neither `nodeResultSchema` nor `persistNodeResult`, so
+// `JobHandlerRegistry.serverOnlyTypes()` derives server-only. Both duties are
+// sequences of statements against this application\'s own database plus deletes
+// against its own bucket credentials; there is nothing for a machine with no
+// database access to compute.
+//
+// No profile: both duties are idempotent — a run already `stale` is not a
+// candidate, an archive already deleted is not in the retention set — so the
+// deployment-wide timeout and attempt budget are right, and a retry is free.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var DatabaseBackupSweepHandler_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseBackupSweepHandler = exports.DB_BACKUP_SWEEP_TYPE = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const db_backup_constants_1 = require("../db-backup.constants");
+const index_1 = require("../../jobs/index");
+const index_2 = require("../../core/index");
+const ports_1 = require("../ports");
+const index_3 = require("../../settings/index");
+const index_4 = require("../../storage/index");
+const db_backup_retention_service_1 = require("../db-backup-retention.service");
+const backup_target_1 = require("../backup-target");
+const db_backup_events_1 = require("../db-backup-events");
+/**
+ * The handler key, and therefore the `Job.type` every backup-sweep row carries.
+ * PERMANENT — rows outlive handlers. Exported because three callers need the
+ * same string: the scheduling task, the runner\'s post-backup enqueue, and the
+ * tests that assert both.
+ *
+ * @stability experimental
+ */
+exports.DB_BACKUP_SWEEP_TYPE = 'db.backup.sweep';
+/** Anything thrown, as an `Error`. JavaScript lets you throw a string. */
+function toError(value) {
+    return value instanceof Error ? value : new Error(String(value));
+}
+/** @stability experimental */
+let DatabaseBackupSweepHandler = DatabaseBackupSweepHandler_1 = class DatabaseBackupSweepHandler {
+    registry;
+    prisma;
+    settings;
+    retention;
+    config;
+    notifications;
+    events;
+    logger = new common_1.Logger(DatabaseBackupSweepHandler_1.name);
+    type = exports.DB_BACKUP_SWEEP_TYPE;
+    label = 'Backup sweep';
+    constructor(registry, prisma, settings, retention, storage, config, notifications, target, mirrors, events) {
+        this.registry = registry;
+        this.prisma = prisma;
+        this.settings = settings;
+        this.retention = retention;
+        this.config = config;
+        this.notifications = notifications;
+        this.events = events;
+        this.target = target ?? new backup_target_1.StorageProviderBackupTarget(storage);
+        this.mirrors = mirrors ?? [];
+    }
+    target;
+    mirrors;
+    /** Self-registration — the only wiring a handler needs. */
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    /**
+     * Releases stale runs, then prunes by retention.
+     *
+     * ⚠ THE TWO DUTIES ARE SEPARATELY WRAPPED, AND THE ORDER IS LOAD-BEARING.
+     * The release goes first because it is what frees the active slot; the prune
+     * goes second because it is pure storage housekeeping that nothing waits on.
+     * A failure in either is recorded and the OTHER still runs — they are one job,
+     * not one transaction — and the job then THROWS so the queue records a
+     * `lastError` and retries. A handler that swallowed both would report a sweep
+     * that did nothing as `succeeded`, which is the failure mode
+     * `job-handler.interface.ts` calls far worse than a spurious retry.
+     */
+    async process(job) {
+        const policy = await this.settings.getDatabaseBackupPolicy();
+        // ONE `now` for the whole sweep, so every candidate is judged against the
+        // same instant and a test can pin it.
+        const now = new Date();
+        const failures = [];
+        try {
+            const released = await this.releaseStaleRuns(policy, now);
+            if (released > 0) {
+                this.logger.warn(`Database backup sweep ${job.id}: ${released} run(s) stopped heartbeating and ` +
+                    'were marked stale; the active slot is free again');
+            }
+        }
+        catch (error) {
+            failures.push(`the stale sweep failed: ${toError(error).message}`);
+        }
+        try {
+            const pruned = await this.retention.prune(now);
+            if (pruned.prunedByCount > 0 || pruned.prunedByAge > 0 || (pruned.prunedByMaxAge ?? 0) > 0) {
+                this.logger.log(`Database backup sweep ${job.id}: retention removed ${pruned.prunedByCount} ` +
+                    `expired backup(s), ${pruned.prunedByMaxAge ?? 0} backup(s) past their maximum age and ` +
+                    `${pruned.prunedByAge} expired pre-restore backup(s).`);
+            }
+        }
+        catch (error) {
+            failures.push(`the retention prune failed: ${toError(error).message}`);
+        }
+        if (failures.length > 0) {
+            throw new Error(`Database backup sweep incomplete: ${failures.join('; ')}`);
+        }
+    }
+    /**
+     * Gives up on runs whose heartbeat stopped, freeing the active slot.
+     *
+     * ⚠ `stale` IS TERMINAL AND NOTHING RE-QUEUES IT. Automatically restarting a
+     * multi-gigabyte dump that just OOM-killed its own process is not obviously
+     * right — it burns hours of I/O on a database that is probably already
+     * unwell, and it does it unattended, repeatedly, at whatever hour the first
+     * attempt died. The retry for a backup is the next scheduled run, which is
+     * the same answer the handler's `maxAttempts: 1` profile gives (#351).
+     *
+     * `stale` is also distinct from `failed` on purpose: nothing OBSERVED these
+     * runs fail. The process holding them disappeared, and an operator reading
+     * the list needs to be able to tell "the dump errored" from "the container
+     * went away mid-dump".
+     *
+     * Exposed as its own method so a test can drive it directly, without going
+     * through `process`.
+     *
+     * @returns how many rows this call actually transitioned.
+     */
+    async releaseStaleRuns(policy, now) {
+        const cutoff = new Date(now.getTime() - policy.runStaleMinutes * 60_000);
+        const candidates = await this.prisma.databaseBackupRun.findMany({
+            where: {
+                // ⚠ THREE ARMS, AND THE THIRD IS NEW IN #351. The predicate used to
+                // read `status: 'running'` with a note that "a future path that DOES
+                // insert a `pending` row must extend this predicate with it, or that
+                // row holds the active slot with no heartbeat that could ever age it
+                // out". `queueBackup` is that path — a queued backup's run row is
+                // written `pending` and stays that way until a worker claims its job —
+                // so the arm is now here.
+                OR: [
+                    // The ordinary case: it was beating and stopped.
+                    { status: 'running', lastHeartbeatAt: { lt: cutoff } },
+                    // THE ZOMBIE THAT NEVER BEAT — a process that died between the claim
+                    // and its first progress write. `NULL < cutoff` is NULL in SQL and
+                    // never true, so the first arm cannot see it, and without this arm
+                    // the row holds the active slot FOREVER. `startedAt` is the
+                    // substitute age, and the claim always sets it. Same two-armed
+                    // defence the queue's lease reaper uses.
+                    { status: 'running', lastHeartbeatAt: null, startedAt: { lt: cutoff } },
+                    // THE QUEUED BACKUP NOBODY EVER CLAIMED. `createdAt` is the age —
+                    // not `startedAt`, which is NULL by definition on a `pending` row,
+                    // and not `lastHeartbeatAt`, which is NULL for the same reason: this
+                    // row has never claimed anything started, and a sweep that inferred
+                    // an age from a column the row deliberately left empty would be
+                    // reading its own default.
+                    //
+                    // WHAT IT ACTUALLY CATCHES: a job an administrator deleted from
+                    // `GET /api/admin/jobs` (the FK's `SetNull` releases the link and
+                    // leaves this row `pending` forever), a job queued on a deployment
+                    // whose worker is off (`JOBS_WORKER_MODE=off`), and a job that
+                    // permanently failed before its handler ever ran. Each of those
+                    // leaves a row that HOLDS THE SINGLE ACTIVE SLOT with nothing coming
+                    // to settle it — which, under the tightened index, blocks every
+                    // backup this deployment would ever take again.
+                    //
+                    // The window is `runStaleMinutes` (120 by default), so an ordinary
+                    // queue delay never trips it: a backup that has sat unclaimed for two
+                    // hours is not a backup that is about to run.
+                    { status: 'pending', createdAt: { lt: cutoff } },
+                ],
+            },
+            // `startedAt` and `trigger` join the projection for #288: they are what
+            // `db_backup.backup_failed` renders, and reading them here — in the query
+            // the sweep was making anyway — is cheaper and less racy than a second
+            // read after the row has been rewritten. `status` joins it for #351: the
+            // compare-and-swap below has to re-assert THE STATUS THIS ROW WAS READ
+            // WITH, and a literal `'running'` there would silently skip every
+            // `pending` candidate the arm above just found.
+            select: {
+                id: true,
+                status: true,
+                storageKey: true,
+                startedAt: true,
+                trigger: true,
+                // #352: the run's job, so the sweep can ask whether an executor is
+                // still holding it. See `withLiveExecutor` for why this is not
+                // optional politeness.
+                jobId: true,
+                // PP-14.12: what `db_backup.run.completed` reports for a stale run.
+                storageProvider: true,
+                bytesWritten: true,
+                createdAt: true,
+            },
+        });
+        // ⚠ A RUN WHOSE JOB IS STILL LEASED IS NOT STALE, WHATEVER ITS HEARTBEAT
+        // SAYS (#352, epic #345).
+        //
+        // The heartbeat above is the liveness signal of a dump running IN THIS
+        // PROCESS: `executeRun` writes it every 20 seconds while `pg_dump`
+        // streams. A dump running ON A WORKER NODE cannot write it at all — a node
+        // has no database access, which is the entire premise of the node plane —
+        // so on that path the row's `lastHeartbeatAt` is written once, when the
+        // node asks for its upload target, and then never again.
+        //
+        // Without this filter the sweep would mark a perfectly healthy node-run
+        // backup `stale` after `runStaleMinutes`, DELETE THE ARCHIVE THE NODE IS
+        // STILL UPLOADING, and then refuse the node's result because the run had
+        // settled — a data-losing failure that only appears on the deployments
+        // slow enough to need node offload in the first place.
+        //
+        // The right liveness signal for a remotely executed run is the one the
+        // executor is already maintaining: THE JOB'S LEASE (#347). A node renews
+        // it on a ticker for exactly as long as it is working, and the queue's own
+        // reaper is what handles an executor that stops. So the sweep asks the job
+        // — and it asks for BOTH executors, not just nodes, because "an executor
+        // still holds this work" is the same fact whoever holds it: an in-process
+        // dump whose heartbeat was starved by a lock wait is equally not abandoned
+        // while its worker is renewing.
+        //
+        // REJECTED: having the node heartbeat the run through a new endpoint. That
+        // is a second liveness clock for the same fact, and two clocks disagree —
+        // the node would be renewing a lease AND poking a heartbeat, and the day
+        // one of them failed the other would say everything was fine.
+        // REJECTED: skipping only `pending` rows with a live job. It would leave
+        // the far worse case — a node that has started dumping, so the row says
+        // `running` — exposed for exactly as long as the dump takes.
+        const live = await this.withLiveExecutor(candidates, now);
+        // ONE COPY OF THE EXPLANATION PER CASE, written to the row AND carried
+        // into the notification (#288). Two copies of either would be two places
+        // to reword, and the email quoting something the row does not say is worse
+        // than no email.
+        //
+        // ⚠ TWO MESSAGES, NOT ONE, because the two states fail for genuinely
+        // different reasons and an operator fixes them in different places: a
+        // `running` row was executing somewhere and that somewhere went away; a
+        // `pending` row was never picked up at all, which is a statement about the
+        // QUEUE (no worker, a deleted job) and not about any dump. Flattening them
+        // into "stopped heartbeating" would send somebody looking through
+        // `pg_dump` logs for a process that never existed.
+        const staleMessage = (status) => status === 'pending'
+            ? `The run was queued but no worker claimed its job within ` +
+                `${policy.runStaleMinutes} minute(s) (databaseBackup.runStaleMinutes), so it was ` +
+                'given up on to free the single active backup slot. No dump was ever started. ' +
+                'Check that a worker is running (JOBS_WORKER_MODE) and that the job was not ' +
+                'deleted; the next scheduled backup is the retry.'
+            : `The run stopped heartbeating for more than ${policy.runStaleMinutes} ` +
+                'minute(s) (databaseBackup.runStaleMinutes) and was given up on. Nothing ' +
+                'observed it fail: the process executing it went away. It is not retried ' +
+                'automatically; the next scheduled backup is the retry.';
+        let released = 0;
+        for (const candidate of candidates) {
+            if (candidate.jobId !== null && live.has(candidate.jobId)) {
+                this.logger.debug(`Database backup run ${candidate.id} has not heartbeated, but its job ` +
+                    `${candidate.jobId} is still held under a live lease; leaving it alone. This is ` +
+                    'the ordinary shape of a backup being taken by a worker node, which cannot write ' +
+                    'to this database at all.');
+                continue;
+            }
+            const message = staleMessage(candidate.status);
+            // ⚠ THE ROW TRANSITION HAPPENS FIRST, AND THE ROW *IS* THE GUARD.
+            //
+            // A conditional `updateMany` re-asserting `status: 'running'`, not an
+            // `update` by id: the read above and this write are not atomic, and the
+            // interesting case is the run that FINISHED in between — a dump whose
+            // heartbeat was starved by a lock wait, that then completed normally two
+            // seconds later. `count === 0` means exactly that, and it must NOT be
+            // stomped: overwriting a `completed` row with `stale` would discard a
+            // perfectly good verified backup's record, and (worse) the object
+            // cleanup below would then delete the archive it points at.
+            //
+            // ⚠ `candidate.status`, NOT THE LITERAL `'running'` IT USED TO BE. The
+            // guard's job is to re-assert the state the row was READ in, so that a
+            // row which moved on since is left alone — and since #351 that state can
+            // be `pending` as well. A hard-coded `'running'` here would make every
+            // `pending` candidate `count === 0` and the sweep would quietly free
+            // nothing, which is the failure mode that looks exactly like working.
+            const { count } = await this.prisma.databaseBackupRun.updateMany({
+                where: { id: candidate.id, status: candidate.status },
+                data: {
+                    status: 'stale',
+                    finishedAt: now,
+                    lastError: message,
+                },
+            });
+            if (count === 0) {
+                this.logger.debug(`Database backup run ${candidate.id} settled between the stale sweep's read ` +
+                    'and its write; leaving it alone.');
+                continue;
+            }
+            released += 1;
+            // ⚠ AFTER THE `stale` ROW HAS COMMITTED, and only on the branch where
+            // THIS process is the one that transitioned it (`count === 1` — the
+            // `continue` above covers the replica that lost the race). One settled run
+            // raises exactly one notification however many replicas are sweeping.
+            //
+            // Before the object cleanup below, deliberately: the delete is
+            // best-effort and may take a while against a slow bucket, and the report
+            // of the failure should not wait on the tidying-up of a partial archive.
+            // `notifyPermissionHolders` is detached and never rejects, so this costs
+            // the sweep nothing and cannot fail it.
+            this.announceStale(candidate, message, now);
+            // The event of a run that ended without a word from its executor: after
+            // the `stale` row committed, never inside a transaction, never throwing.
+            this.events?.runCompleted({
+                runId: candidate.id,
+                status: 'stale',
+                targetId: candidate.storageProvider ?? this.target.id,
+                sizeBytes: (0, db_backup_events_1.eventBytes)(candidate.bytesWritten),
+                durationMs: Math.max(0, now.getTime() - (candidate.startedAt ?? candidate.createdAt ?? now).getTime()),
+            });
+            // ⚠ AND OBJECT CLEANUP FOLLOWS, NEVER PRECEDES.
+            //
+            // Same ordering as the runner's failure path and the retention sweep,
+            // for the same reason read the other way round: if the delete went first
+            // and this process died before the row was transitioned, the row would
+            // still say `running` and still point at an object that no longer
+            // exists — and it would keep holding the active slot. With the row
+            // first, a failed delete leaves a VISIBLE `stale` row naming an orphaned
+            // object an operator can find and remove, rather than an invisible
+            // billable one nothing points at.
+            //
+            // Best-effort, and it never fails the sweep: the slot is already free,
+            // which is the part that had to happen.
+            for (const target of [this.target, ...this.mirrors]) {
+                try {
+                    await target.delete(candidate.storageKey);
+                }
+                catch (error) {
+                    this.logger.warn(`Marked database backup run ${candidate.id} stale but could not delete its ` +
+                        `partial object "${candidate.storageKey}" on "${target.id}"; it may need removing by hand: ` +
+                        `${toError(error).message}`);
+                }
+            }
+        }
+        return released;
+    }
+    /**
+     * Of these candidates' jobs, the ids that an executor still holds under a
+     * LIVE lease.
+     *
+     * ONE QUERY FOR THE WHOLE BATCH, and it reads the queue's own columns rather
+     * than re-deriving anything: `status: 'running'` plus `leaseExpiresAt > now`
+     * is precisely what `JobLeaseService` means by "held", and it is the same
+     * predicate the queue's reaper uses to decide the opposite question. A
+     * second definition of "leased" here would be a second thing to keep in
+     * step with #347.
+     *
+     * Returns an EMPTY SET when nothing qualifies — including when no candidate
+     * has a job at all, in which case there is no query to make. Every run that
+     * predates #351, and every `pre_restore` dump, has `jobId === null` and is
+     * swept exactly as it always was.
+     */
+    async withLiveExecutor(candidates, now) {
+        // `typeof`, not `!== null`: the column is `string | null` on a real row,
+        // and this stays total for any caller passing a projection that simply has
+        // not selected it — a missing job id must mean "ask nothing", never "ask
+        // about undefined".
+        const jobIds = candidates
+            .map((candidate) => candidate.jobId)
+            .filter((jobId) => typeof jobId === 'string' && jobId.length > 0);
+        if (jobIds.length === 0)
+            return new Set();
+        const held = await this.prisma.job.findMany({
+            where: {
+                id: { in: jobIds },
+                status: 'running',
+                leaseExpiresAt: { gt: now },
+            },
+            select: { id: true },
+        });
+        return new Set(held.map((job) => job.id));
+    }
+    /**
+     * Raise `db_backup.backup_failed` for a run this sweep gave up on. Never
+     * throws.
+     *
+     * ⚠ `outcome: 'stale'` AND NOT `'failed'`, and the distinction is the whole
+     * reason the field exists. A `failed` run reported an error: something
+     * observed it break and wrote down what. A `stale` run reported nothing —
+     * the process executing it went away, and the sweep is inferring the failure
+     * from silence. An operator chasing the two looks in completely different
+     * places (a dump's stderr versus a host that disappeared), so the message
+     * says which it is rather than flattening both into "backup failed".
+     *
+     * SYNCHRONOUS AND FIRE-AND-FORGET: `notifyPermissionHolders` schedules the
+     * audience query and the sends and returns, so a ten-minute cron never waits
+     * on a mail server, and the try/catch means a notifier bug cannot abort a
+     * sweep that has already freed the active slot.
+     */
+    announceStale(run, reason, settledAt) {
+        try {
+            // ANNOTATED WITH THE TEMPLATE'S TYPE: `notifyPermissionHolders` takes
+            // `data: unknown`, so this is the only place the shape is checked.
+            const payload = {
+                runId: run.id,
+                outcome: 'stale',
+                error: reason,
+                startedAt: run.startedAt,
+                failedAt: settledAt,
+                trigger: run.trigger,
+                appUrl: this.appUrl(),
+            };
+            // `db_backup:read` — the exact string `db-backup.controller.ts` enforces,
+            // and the same one the runner's own failure path uses.
+            // ⚠ `.catch()` DESPITE THE DISPATCHER CONTRACTING NEVER TO REJECT — same
+            // reason as everywhere else this event is raised: an unhandled rejection
+            // inside a `@Cron` tick has no caller, and the `try/catch` around this
+            // block cannot see one.
+            void this.notifications
+                .notifyPermissionHolders('db_backup.backup_failed', db_backup_constants_1.PERMISSIONS.DB_BACKUP_READ, payload)
+                .catch((error) => {
+                this.logger.error(`Dispatching 'db_backup.backup_failed' for run ${run.id} rejected, ` +
+                    `which the dispatcher contracts never to do: ${toError(error).message}`);
+            });
+        }
+        catch (error) {
+            this.logger.error(`Could not raise 'db_backup.backup_failed' for run ${run.id}; the run is ` +
+                `still marked stale and its slot is free: ${toError(error).message}`);
+        }
+    }
+    /**
+     * The application root, trailing slashes trimmed, or `undefined`.
+     *
+     * Same shape as `UsersService.appUrl()`; `undefined` makes the template omit
+     * its CTA rather than render a button that goes nowhere.
+     */
+    appUrl() {
+        const appUrl = this.config.get('appUrl');
+        return appUrl ? appUrl.replace(/\/+$/, '') : undefined;
+    }
+};
+exports.DatabaseBackupSweepHandler = DatabaseBackupSweepHandler;
+exports.DatabaseBackupSweepHandler = DatabaseBackupSweepHandler = DatabaseBackupSweepHandler_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(index_2.PLATFORM_PRISMA)),
+    __param(4, (0, common_1.Inject)(index_4.STORAGE_PROVIDER)),
+    __param(6, (0, common_1.Inject)(ports_1.DB_BACKUP_NOTIFIER)),
+    __param(7, (0, common_1.Optional)()),
+    __param(7, (0, common_1.Inject)(backup_target_1.DB_BACKUP_TARGET)),
+    __param(8, (0, common_1.Optional)()),
+    __param(8, (0, common_1.Inject)(backup_target_1.DB_BACKUP_MIRROR_TARGETS)),
+    __param(9, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [index_1.JobHandlerRegistry, Object, index_3.SystemSettingsService,
+        db_backup_retention_service_1.DatabaseBackupRetentionService, Object, config_1.ConfigService, Object, Object, Array, db_backup_events_1.DbBackupEvents])
+], DatabaseBackupSweepHandler);
+//# sourceMappingURL=db-backup-sweep.handler.js.map

package/dist/db-backup/handlers/db-backup-sweep.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-backup-sweep.handler.js","sourceRoot":"","sources":["../../../src/db-backup/handlers/db-backup-sweep.handler.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,0EAA0E;AAC1E,0BAA0B;AAC1B,gFAAgF;AAChF,EAAE;AACF,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,0DAA0D;AAC1D,+EAA+E;AAC/E,uEAAuE;AACvE,8CAA8C;AAC9C,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,0EAA0E;AAC1E,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,wCAAwC;AACxC,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,gEAAgE;AAChE,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,qEAAqE;AACrE,sEAAsE;AACtE,6EAA6E;AAC7E,0EAA0E;AAC1E,gFAAgF;AAChF,2EAA2E;AAC3E,eAAe;AACf,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,uEAAuE;AACvE,oEAAoE;AACpE,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,yDAAyD;AACzD,EAAE;AACF,kFAAkF;AAClF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,+EAA+E;AAC/E,kDAAkD;AAClD,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,0EAA0E;AAC1E,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,wCAAwC;AACxC,gFAAgF;AAChF,EAAE;AACF,yDAAyD;AACzD,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,8BAA8B;AAC9B,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAAoF;AACpF,2CAA+C;AAI/C,gEAAqD;AAIrD,4CAAsD;AACtD,4CAAmD;AAEnD,oCAAqE;AACrE,gDAA6D;AAC7D,+CAG6B;AAC7B,gFAAgF;AAChF,oDAK0B;AAC1B,0DAAiE;AAEjE;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD,0EAA0E;AAC1E,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,8BAA8B;AAEvB,IAAM,0BAA0B,kCAAhC,MAAM,0BAA0B;IAQlB;IACyB;IACzB;IACA;IAEA;IAM4B;IAOhB;IAzBd,MAAM,GAAG,IAAI,eAAM,CAAC,4BAA0B,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,GAAG,4BAAoB,CAAC;IAE5B,KAAK,GAAG,cAAc,CAAC;IAEhC,YACmB,QAA4B,EACH,MAAsB,EAC/C,QAA+B,EAC/B,SAAyC,EAChC,OAAwB,EACjC,MAAqB,EAMO,aAA+B,EAKtC,MAAqB,EACb,OAAiC,EAClD,MAAuB;QAlBnC,aAAQ,GAAR,QAAQ,CAAoB;QACH,WAAM,GAAN,MAAM,CAAgB;QAC/C,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,cAAS,GAAT,SAAS,CAAgC;QAEzC,WAAM,GAAN,MAAM,CAAe;QAMO,kBAAa,GAAb,aAAa,CAAkB;QAO/C,WAAM,GAAN,MAAM,CAAiB;QAEpD,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,2CAA2B,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,EAAE,CAAC;IAC/B,CAAC;IAEgB,MAAM,CAAe;IAErB,OAAO,CAA0B;IAElD,2DAA2D;IAC3D,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAO,CAAC,GAAQ;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC;QAE7D,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAE1D,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,GAAG,CAAC,EAAE,KAAK,QAAQ,mCAAmC;oBAC7E,kDAAkD,CACrD,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAE/C,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3F,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,yBAAyB,GAAG,CAAC,EAAE,uBAAuB,MAAM,CAAC,aAAa,GAAG;oBAC3E,sBAAsB,MAAM,CAAC,cAAc,IAAI,CAAC,wCAAwC;oBACxF,GAAG,MAAM,CAAC,WAAW,iCAAiC,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,+BAA+B,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAiC,EAAE,GAAS;QACjE,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,CAAC;QAEzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YAC9D,KAAK,EAAE;gBACL,oEAAoE;gBACpE,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,kEAAkE;gBAClE,uEAAuE;gBACvE,0BAA0B;gBAC1B,EAAE,EAAE;oBACF,iDAAiD;oBACjD,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;oBACtD,qEAAqE;oBACrE,mEAAmE;oBACnE,mEAAmE;oBACnE,4DAA4D;oBAC5D,+DAA+D;oBAC/D,yCAAyC;oBACzC,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;oBACvE,kEAAkE;oBAClE,mEAAmE;oBACnE,qEAAqE;oBACrE,oEAAoE;oBACpE,gEAAgE;oBAChE,2BAA2B;oBAC3B,EAAE;oBACF,gEAAgE;oBAChE,kEAAkE;oBAClE,mEAAmE;oBACnE,+DAA+D;oBAC/D,gEAAgE;oBAChE,qEAAqE;oBACrE,gEAAgE;oBAChE,gDAAgD;oBAChD,EAAE;oBACF,mEAAmE;oBACnE,sEAAsE;oBACtE,8CAA8C;oBAC9C,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;iBACjD;aACF;YACD,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,uEAAuE;YACvE,kEAAkE;YAClE,gDAAgD;YAChD,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,IAAI;gBACb,mEAAmE;gBACnE,+DAA+D;gBAC/D,uBAAuB;gBACvB,KAAK,EAAE,IAAI;gBACX,oEAAoE;gBACpE,eAAe,EAAE,IAAI;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;aAChB;SACF,CAAC,CAAC;QAEH,yEAAyE;QACzE,0BAA0B;QAC1B,EAAE;QACF,uEAAuE;QACvE,mEAAmE;QACnE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,yDAAyD;QACzD,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,uDAAuD;QACvD,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,gCAAgC;QAChC,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,yEAAyE;QACzE,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAE1D,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,iBAAiB;QACjB,EAAE;QACF,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,kEAAkE;QAClE,mDAAmD;QACnD,MAAM,YAAY,GAAG,CAAC,MAA4B,EAAU,EAAE,CAC5D,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,0DAA0D;gBAC1D,GAAG,MAAM,CAAC,eAAe,yDAAyD;gBAClF,+EAA+E;gBAC/E,6EAA6E;gBAC7E,kDAAkD;YACpD,CAAC,CAAC,8CAA8C,MAAM,CAAC,eAAe,GAAG;gBACvE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,wDAAwD,CAAC;QAE/D,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uBAAuB,SAAS,CAAC,EAAE,oCAAoC;oBACrE,GAAG,SAAS,CAAC,KAAK,+DAA+D;oBACjF,kFAAkF;oBAClF,0BAA0B,CAC7B,CAAC;gBAEF,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/C,kEAAkE;YAClE,EAAE;YACF,sEAAsE;YACtE,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,4DAA4D;YAC5D,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC;gBAC/D,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;gBACrD,IAAI,EAAE;oBACJ,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,GAAG;oBACf,SAAS,EAAE,OAAO;iBACnB;aACF,CAAC,CAAC;YAEH,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uBAAuB,SAAS,CAAC,EAAE,0CAA0C;oBAC3E,kCAAkC,CACrC,CAAC;gBAEF,SAAS;YACX,CAAC;YAED,QAAQ,IAAI,CAAC,CAAC;YAEd,sEAAsE;YACtE,oEAAoE;YACpE,2EAA2E;YAC3E,sEAAsE;YACtE,EAAE;YACF,+DAA+D;YAC/D,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,wCAAwC;YACxC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAE5C,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;gBACxB,KAAK,EAAE,SAAS,CAAC,EAAE;gBACnB,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE;gBACrD,SAAS,EAAE,IAAA,6BAAU,EAAC,SAAS,CAAC,YAAY,CAAC;gBAC7C,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;aACvG,CAAC,CAAC;YAEH,gDAAgD;YAChD,EAAE;YACF,sEAAsE;YACtE,yEAAyE;YACzE,uEAAuE;YACvE,kEAAkE;YAClE,mEAAmE;YACnE,yEAAyE;YACzE,mEAAmE;YACnE,kCAAkC;YAClC,EAAE;YACF,uEAAuE;YACvE,wCAAwC;YACxC,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBAC5C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8BAA8B,SAAS,CAAC,EAAE,kCAAkC;wBAC1E,mBAAmB,SAAS,CAAC,UAAU,SAAS,MAAM,CAAC,EAAE,mCAAmC;wBAC5F,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAC9B,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,gBAAgB,CAC5B,UAA2D,EAC3D,GAAS;QAET,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,oBAAoB;QACpB,MAAM,MAAM,GAAG,UAAU;aACtB,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;aACnC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAErF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAE1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1C,KAAK,EAAE;gBACL,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBAClB,MAAM,EAAE,SAAS;gBACjB,cAAc,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;aAC5B;YACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QAEH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,aAAa,CACnB,GAA2E,EAC3E,MAAc,EACd,SAAe;QAEf,IAAI,CAAC;YACH,sEAAsE;YACtE,mEAAmE;YACnE,MAAM,OAAO,GAA0B;gBACrC,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,OAAO,EAAE,OAAO;gBAChB,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACtB,CAAC;YAEF,0EAA0E;YAC1E,uDAAuD;YACvD,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,wBAAwB;YACxB,KAAK,IAAI,CAAC,aAAa;iBACpB,uBAAuB,CACtB,yBAAyB,EACzB,iCAAW,CAAC,cAAc,EAC1B,OAAO,CACR;iBACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,iDAAiD,GAAG,CAAC,EAAE,aAAa;oBAClE,+CAA+C,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAC1E,CAAC;YACJ,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qDAAqD,GAAG,CAAC,EAAE,eAAe;gBACxE,4CAA4C,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,QAAQ,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;CACF,CAAA;AAvcY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;IAUR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IAGvB,WAAA,IAAA,eAAM,EAAC,wBAAgB,CAAC,CAAA;IAOxB,WAAA,IAAA,eAAM,EAAC,0BAAkB,CAAC,CAAA;IAK1B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,gCAAgB,CAAC,CAAA;IACpC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,wCAAwB,CAAC,CAAA;IAC5C,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAlBgB,0BAAkB,UAElB,6BAAqB;QACpB,4DAA8B,UAEjC,sBAAa,yBAaA,iCAAc;GA1B3C,0BAA0B,CAuctC"}

package/dist/db-backup/handlers/db-restore-old-db-drop.handler.d.ts

@@ -0,0 +1,40 @@
+import { OnModuleInit } from '@nestjs/common';
+import type { Job } from '../../jobs/index';
+import { JobHandler } from '../../jobs/index';
+import { JobHandlerRegistry } from '../../jobs/index';
+import { SystemSettingsService } from '../../settings/index';
+import { DatabaseRestoreService } from '../database-restore.service';
+/**
+ * The handler key, and therefore the `Job.type` every old-database-drop row
+ * carries. PERMANENT — rows outlive handlers. Exported so the scheduling task
+ * asks about the same string it queues.
+ *
+ * @stability experimental
+ */
+export declare const DB_RESTORE_OLD_DB_DROP_TYPE = "db.restore.old-db-drop";
+/** @stability experimental */
+export declare class DatabaseRestoreOldDbDropHandler implements JobHandler, OnModuleInit {
+    private readonly registry;
+    private readonly settings;
+    private readonly restore;
+    private readonly logger;
+    readonly type = "db.restore.old-db-drop";
+    readonly label = "Restore cleanup";
+    constructor(registry: JobHandlerRegistry, settings: SystemSettingsService, restore: DatabaseRestoreService);
+    /** Self-registration — the only wiring a handler needs. */
+    onModuleInit(): void;
+    /**
+     * Drops every `<live>_old_<ts>` database past its retention window.
+     *
+     * THROWS TO FAIL. The cron this replaced caught and logged, because a throw
+     * out of a `@Cron` handler is an unhandled rejection; here the worker above
+     * turns a rejection into `lastError` plus a retry, and swallowing would report
+     * a sweep that never ran as `succeeded`. Note that a SINGLE database that
+     * could not be dropped is not a failure — the service swallows those per row
+     * and the next sweep retries them — so a throw out of here means the settings
+     * read or the admin connection failed, which is exactly what an operator
+     * should see.
+     */
+    process(job: Job): Promise<void>;
+}
+//# sourceMappingURL=db-restore-old-db-drop.handler.d.ts.map

package/dist/db-backup/handlers/db-restore-old-db-drop.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-restore-old-db-drop.handler.d.ts","sourceRoot":"","sources":["../../../src/db-backup/handlers/db-restore-old-db-drop.handler.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE,8BAA8B;AAC9B,qBACa,+BAAgC,YAAW,UAAU,EAAE,YAAY;IAQ5E,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoD;IAE3E,QAAQ,CAAC,IAAI,4BAA+B;IAE5C,QAAQ,CAAC,KAAK,qBAAqB;gBAGhB,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,qBAAqB,EAC/B,OAAO,EAAE,sBAAsB;IAGlD,2DAA2D;IAC3D,YAAY,IAAI,IAAI;IAIpB;;;;;;;;;;;OAWG;IACG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBvC"}