@oneuptime/common 12.0.5 → 12.0.6

package/Server/Services/DataSourceService.ts

@@ -0,0 +1,200 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/DataSource";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import DataSourceType, {
+  DataSourceTypeUtil,
+} from "../../Types/DataSource/DataSourceType";
+import { DataSourceConnectionSettings } from "../Utils/DataSource/Types";
+import Dictionary from "../../Types/Dictionary";
+import { JSONObject } from "../../Types/JSON";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * Per-type shape validation so a broken data source fails at save time
+   * with a clear message, not at first query with a connector error.
+   */
+  private validateDataSourceShape(data: {
+    dataSourceType?: DataSourceType | undefined;
+    url?: string | undefined;
+    databaseHost?: string | undefined;
+  }): void {
+    const dataSourceType: DataSourceType | undefined = data.dataSourceType;
+
+    if (!dataSourceType) {
+      return; // updates that don't touch the type/host/url skip validation.
+    }
+
+    if (!DataSourceTypeUtil.getAllDataSourceTypes().includes(dataSourceType)) {
+      throw new BadDataException(`Unknown data source type: ${dataSourceType}`);
+    }
+
+    if (DataSourceTypeUtil.isHttpBasedType(dataSourceType) && !data.url) {
+      throw new BadDataException(
+        `${dataSourceType} data sources require a URL.`,
+      );
+    }
+
+    if (
+      DataSourceTypeUtil.isDatabaseType(dataSourceType) &&
+      !data.databaseHost
+    ) {
+      throw new BadDataException(
+        `${dataSourceType} data sources require a database host.`,
+      );
+    }
+  }
+
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    this.validateDataSourceShape({
+      dataSourceType: createBy.data.dataSourceType,
+      url: createBy.data.url,
+      databaseHost: createBy.data.databaseHost,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    /*
+     * Only validate when the update touches the fields that participate in
+     * shape validation. Changing the TYPE of an existing source without
+     * also sending url/host can produce a source that fails validation on
+     * its own merits — so when dataSourceType changes, re-validate against
+     * the stored row's values merged with the update.
+     */
+    const data: {
+      dataSourceType?: DataSourceType | undefined;
+      url?: string | undefined;
+      databaseHost?: string | undefined;
+    } = updateBy.data as unknown as {
+      dataSourceType?: DataSourceType | undefined;
+      url?: string | undefined;
+      databaseHost?: string | undefined;
+    };
+
+    /*
+     * Presence check, not truthiness — an update that CLEARS url or
+     * databaseHost (null / empty string) must still be validated, or an
+     * HTTP source could be stripped of its URL and break at query time.
+     */
+    const updateData: Record<string, unknown> = updateBy.data as Record<
+      string,
+      unknown
+    >;
+    const touchesShape: boolean =
+      "dataSourceType" in updateData ||
+      "url" in updateData ||
+      "databaseHost" in updateData;
+
+    if (touchesShape) {
+      const existing: Model | null = await this.findOneBy({
+        query: updateBy.query,
+        select: {
+          _id: true,
+          dataSourceType: true,
+          url: true,
+          databaseHost: true,
+        },
+        props: { isRoot: true },
+      });
+
+      /*
+       * A field present in the update wins even when cleared (null/"" →
+       * undefined, which validation treats as missing); an absent field
+       * falls back to the stored row.
+       */
+      this.validateDataSourceShape({
+        dataSourceType: data.dataSourceType || existing?.dataSourceType,
+        url: "url" in updateData ? data.url || undefined : existing?.url,
+        databaseHost:
+          "databaseHost" in updateData
+            ? data.databaseHost || undefined
+            : existing?.databaseHost,
+      });
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  /*
+   * Decrypted connection settings for the server-side connector paths
+   * (/test and /query). ROOT read — the caller MUST have already performed
+   * a user-scoped access check on this id (the LlmProviderAPI two-phase
+   * pattern). The returned object holds plaintext secrets: never serialize
+   * it into a response or a log line.
+   */
+  @CaptureSpan()
+  public async getConnectionSettingsById(
+    dataSourceId: ObjectID,
+  ): Promise<DataSourceConnectionSettings | null> {
+    if (!ObjectID.isValidUUID(dataSourceId.toString())) {
+      /*
+       * A non-uuid string in a uuid column is a Postgres cast error, not
+       * an empty result — shape-check before querying.
+       */
+      return null;
+    }
+
+    const dataSource: Model | null = await this.findOneById({
+      id: dataSourceId,
+      select: {
+        _id: true,
+        projectId: true,
+        dataSourceType: true,
+        url: true,
+        databaseHost: true,
+        databasePort: true,
+        databaseName: true,
+        username: true,
+        password: true,
+        apiToken: true,
+        customHeaders: true,
+        additionalOptions: true,
+      },
+      props: { isRoot: true },
+    });
+
+    if (!dataSource || !dataSource.dataSourceType) {
+      return null;
+    }
+
+    let customHeaders: Dictionary<string> | undefined = undefined;
+    if (dataSource.customHeaders) {
+      customHeaders = {};
+      const headers: JSONObject = dataSource.customHeaders;
+      for (const key of Object.keys(headers)) {
+        if (headers[key] !== null && headers[key] !== undefined) {
+          customHeaders[key] = headers[key]!.toString();
+        }
+      }
+    }
+
+    return {
+      dataSourceType: dataSource.dataSourceType,
+      url: dataSource.url,
+      databaseHost: dataSource.databaseHost,
+      databasePort: dataSource.databasePort,
+      databaseName: dataSource.databaseName,
+      username: dataSource.username,
+      password: dataSource.password,
+      apiToken: dataSource.apiToken,
+      customHeaders: customHeaders,
+      additionalOptions: dataSource.additionalOptions,
+    };
+  }
+}
+
+export default new Service();

package/Server/Services/HostService.ts

@@ -11,6 +11,7 @@ import QueryHelper from "../Types/Database/QueryHelper";
 import OneUptimeDate from "../../Types/Date";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import GlobalCache from "../Infrastructure/GlobalCache";
+import InProcessMemo from "../Utils/InProcessMemo";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { canonicalizeEntityValue } from "../../Utils/Telemetry/EntityKey";
 import crypto from "crypto";
@@ -21,6 +22,46 @@ const LAST_SEEN_THROTTLE_SECONDS: number = 60;
 const LABELS_APPLIED_CACHE_NAMESPACE: string = "host-labels-applied";
 const LABELS_APPLIED_CACHE_TTL_SECONDS: number = 60;
 
+/*
+ * What `findOrCreateByHostIdentifier` memoizes: the resolved row's id plus
+ * the identifier it converged to. A flat shape rather than the Model itself
+ * so a memo hit hands every caller a FRESH Model instance — the resolving
+ * call and a memoed call must not share one mutable entity object.
+ */
+interface HostResolution {
+  hostIdStr: string;
+  hostIdentifier: string;
+}
+
+/*
+ * Per-process memo for `(projectId, canonical hostIdentifier) -> Host`.
+ *
+ * `findOrCreateByHostIdentifier` ran an unconditional Postgres SELECT per
+ * call, and the metrics ingest path calls it once per unique host per job
+ * (the host-enrichment aggregation loop) on top of `autoDiscoverHost`'s
+ * Redis-cache misses — for a fleet of workers chewing hostmetrics batches
+ * that is a steady stream of identical case-insensitive lookups for rows
+ * that change never. Same L1 shape as the service-resolution memo in
+ * OpenTelemetryIngestService: 60-second TTL, bounded because host
+ * identifiers arrive from collector-controlled resource attributes.
+ *
+ * ONLY positive resolutions (the host exists / was just created) are
+ * memoized, and only on success. There is deliberately no negative
+ * caching: the miss path must keep falling through to the create, so a
+ * create that loses a concurrent race still throws its unique-violation
+ * into the existing catch-and-refetch handling unchanged. Staleness is a
+ * non-issue for the id itself (ids are immutable); a deleted host keeps
+ * resolving for up to the TTL, which the 24-hour host-id Redis cache in
+ * OtelIngestBaseService already dwarfs.
+ */
+const HOST_RESOLUTION_MEMO_TTL_IN_MS: number = 60 * 1000;
+const HOST_RESOLUTION_MEMO_MAX_ENTRIES: number = 10_000;
+const hostResolutionInProcessMemo: InProcessMemo<HostResolution> =
+  new InProcessMemo<HostResolution>({
+    ttlInMs: HOST_RESOLUTION_MEMO_TTL_IN_MS,
+    maxEntries: HOST_RESOLUTION_MEMO_MAX_ENTRIES,
+  });
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -75,6 +116,24 @@ export class Service extends DatabaseService<Model> {
      */
     const hostIdentifier: string = canonicalizeEntityValue(data.hostIdentifier);
 
+    /*
+     * L1: in-process memo. The canonical identifier is the memo key, so
+     * every casing of one host collapses onto the entry the previous batch
+     * wrote — the same folding the SQL predicate below performs. A hit
+     * skips the SELECT (and the already-converged identifier write) that
+     * the resolving call performed within the last minute.
+     */
+    const memoKey: string = `${data.projectId.toString()}:${hostIdentifier}`;
+    const memoedResolution: HostResolution | undefined =
+      hostResolutionInProcessMemo.get(memoKey);
+    if (memoedResolution) {
+      const memoedHost: Model = new Model();
+      memoedHost._id = memoedResolution.hostIdStr;
+      memoedHost.projectId = data.projectId;
+      memoedHost.hostIdentifier = memoedResolution.hostIdentifier;
+      return memoedHost;
+    }
+
     /*
      * Look up case-insensitively. The unique guard on name/hostIdentifier
      * (DatabaseService.checkUniqueColumnBy -> QueryHelper.findWithSameText)
@@ -131,6 +190,18 @@ export class Service extends DatabaseService<Model> {
         }
       }
 
+      /*
+       * Memoize the identifier the row ACTUALLY holds (post-convergence,
+       * or the legacy casing when the best-effort update failed) so a memo
+       * hit returns exactly what a repeated lookup would have.
+       */
+      if (existingHost._id) {
+        hostResolutionInProcessMemo.set(memoKey, {
+          hostIdStr: existingHost._id.toString(),
+          hostIdentifier: existingHost.hostIdentifier || hostIdentifier,
+        });
+      }
+
       return existingHost;
     }
 
@@ -149,6 +220,13 @@ export class Service extends DatabaseService<Model> {
         },
       });
 
+      if (createdHost._id) {
+        hostResolutionInProcessMemo.set(memoKey, {
+          hostIdStr: createdHost._id.toString(),
+          hostIdentifier: hostIdentifier,
+        });
+      }
+
       return createdHost;
     } catch {
       /*
@@ -173,6 +251,20 @@ export class Service extends DatabaseService<Model> {
       });
 
       if (reFetchedHost) {
+        /*
+         * The refetch after a lost create race emits the same SELECT as
+         * the cold lookup, and a first-contact stampede on a brand-new
+         * host is exactly when this branch runs hot — memoize it like the
+         * other two resolution paths (mirrors the service-resolution
+         * cache's create-race handling).
+         */
+        if (reFetchedHost._id) {
+          hostResolutionInProcessMemo.set(memoKey, {
+            hostIdStr: reFetchedHost._id.toString(),
+            hostIdentifier: reFetchedHost.hostIdentifier || hostIdentifier,
+          });
+        }
+
         return reFetchedHost;
       }
 

package/Server/Services/IncidentService.ts

@@ -56,6 +56,7 @@ import { MetricPointType } from "../../Models/AnalyticsModels/Metric";
 import ServiceType from "../../Types/Telemetry/ServiceType";
 import OneUptimeDate from "../../Types/Date";
 import TelemetryUtil from "../Utils/Telemetry/Telemetry";
+import MetricResourceAttributeUtil from "../../Utils/Metrics/MetricResourceAttributeUtil";
 import logger, { LogAttributes } from "../Utils/Logger";
 import ProductAnalytics from "../Utils/ProductAnalytics";
 import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
@@ -2063,6 +2064,18 @@ ${incident.remediationNotes || "No remediation notes provided."}
 
             // only emit if the incident has been resolved
             if (resolvedTimeline && resolvedTimeline.startsAt) {
+              /*
+               * Same dimension set as every other incident metric — including
+               * oneuptime.label.* / oneuptime.customField.* — so a dashboard
+               * grouped by a label does not silently lose this series.
+               */
+              const {
+                baseMetricAttributes,
+              }: { baseMetricAttributes: JSONObject } =
+                await this.getIncidentMetricContext({
+                  incidentId: incidentId,
+                });
+
               const postmortemMetric: MutableMetric = new MutableMetric();
               postmortemMetric.projectId = projectId;
               postmortemMetric.primaryEntityId = incidentId;
@@ -2076,6 +2089,7 @@ ${incident.remediationNotes || "No remediation notes provided."}
                 resolvedTimeline.startsAt,
               );
               postmortemMetric.attributes = {
+                ...baseMetricAttributes,
                 incidentId: incidentId.toString(),
                 projectId: projectId.toString(),
               };
@@ -2356,6 +2370,18 @@ ${incidentSeverity.name}
 
             // emit severity change metric
             try {
+              /*
+               * Same dimension set as every other incident metric — including
+               * oneuptime.label.* / oneuptime.customField.* — so "severity
+               * churn by product" is answerable from the metric store.
+               */
+              const {
+                baseMetricAttributes,
+              }: { baseMetricAttributes: JSONObject } =
+                await this.getIncidentMetricContext({
+                  incidentId: incidentId,
+                });
+
               const severityChangeMetric: MutableMetric = new MutableMetric();
               severityChangeMetric.projectId = projectId;
               severityChangeMetric.primaryEntityId = incidentId;
@@ -2364,6 +2390,7 @@ ${incidentSeverity.name}
               severityChangeMetric.metricPointId = `severity-change:${ObjectID.generate().toString()}`;
               severityChangeMetric.value = 1;
               severityChangeMetric.attributes = {
+                ...baseMetricAttributes,
                 incidentId: incidentId.toString(),
                 projectId: projectId.toString(),
                 newIncidentSeverityId: incidentSeverity._id?.toString() || "",
@@ -3008,6 +3035,16 @@ ${incidentSeverity.name}
           _id: true,
           name: true,
         },
+        /*
+         * A project's own taxonomy. Both become metric attributes below so
+         * dashboards can group MTTA/MTTR by the dimensions the project
+         * actually thinks in.
+         */
+        labels: {
+          _id: true,
+          name: true,
+        },
+        customFields: true,
       },
       props: {
         isRoot: true,
@@ -3121,6 +3158,14 @@ ${incidentSeverity.name}
       ownerUserNames: ownerUserNames.join(", "),
       ownerTeamIds: ownerTeamIds.join(", "),
       ownerTeamNames: ownerTeamNames.join(", "),
+      /*
+       * oneuptime.label.* / oneuptime.customField.* — namespaced, so they can
+       * never collide with the unprefixed dimensions above.
+       */
+      ...MetricResourceAttributeUtil.getResourceAttributes({
+        labels: incident.labels,
+        customFields: incident.customFields,
+      }),
     };
 
     return { incident, baseMetricAttributes };

package/Server/Services/Index.ts

@@ -70,6 +70,7 @@ import CephClusterOwnerRuleService from "./CephClusterOwnerRuleService";
 import CephClusterOwnerTeamService from "./CephClusterOwnerTeamService";
 import CephClusterOwnerUserService from "./CephClusterOwnerUserService";
 import LlmProviderService from "./LlmProviderService";
+import DataSourceService from "./DataSourceService";
 import AuditLogService from "./AuditLogService";
 import LogService from "./LogService";
 import MailService from "./MailService";
@@ -369,6 +370,7 @@ const services: Array<BaseService> = [
   CephClusterOwnerTeamService,
   CephClusterOwnerUserService,
   LlmProviderService,
+  DataSourceService,
 
   MailService,
   MonitorCustomFieldService,

package/Server/Services/MonitorService.ts

@@ -3,6 +3,8 @@ import {
   AllowedActiveMonitorCountInFreePlan,
   IsBillingEnabled,
 } from "../EnvironmentConfig";
+import { UpdateResult } from "typeorm";
+import { QueryDeepPartialEntity } from "typeorm/query-builder/QueryPartialEntity";
 import { ActiveMonitoringMeteredPlan } from "../Types/Billing/MeteredPlan/AllMeteredPlans";
 import CreateBy from "../Types/Database/CreateBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
@@ -2263,5 +2265,52 @@ ${createdItem.description?.trim() || "No description provided."}
 
     return monitor.name || "";
   }
+
+  /**
+   * Repoints the currentMonitorStatusId of ALREADY SOFT-DELETED monitor rows
+   * away from monitor statuses that are about to be hard-deleted.
+   *
+   * A soft-deleted monitor keeps its physical row - and therefore its
+   * currentMonitorStatusId foreign key, which is ON DELETE NO ACTION - so a
+   * status that a since-deleted monitor last pointed at cannot be removed
+   * until that dangling reference is cleared. This surfaced as an intermittent
+   * "Monitor records still reference it" failure when Terraform destroyed a
+   * fixture that deleted its monitors and then the custom statuses those
+   * monitors had adopted.
+   *
+   * Only soft-deleted rows are touched: deleting a status that a LIVE monitor
+   * is currently in still surfaces the referential-integrity guard, so a user
+   * is never silently robbed of a monitor's visible status. Returns the number
+   * of dead rows repointed.
+   */
+  @CaptureSpan()
+  public async repointDeletedMonitorsAwayFromStatuses(data: {
+    fromMonitorStatusIds: Array<ObjectID>;
+    toMonitorStatusId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<number> {
+    if (data.fromMonitorStatusIds.length === 0) {
+      return 0;
+    }
+
+    const result: UpdateResult = await this.getRepository()
+      .createQueryBuilder()
+      .update(Model)
+      .set({
+        currentMonitorStatusId: data.toMonitorStatusId.toString(),
+      } as unknown as QueryDeepPartialEntity<Model>)
+      .where('"projectId" = :projectId', {
+        projectId: data.projectId.toString(),
+      })
+      .andWhere('"deletedAt" IS NOT NULL')
+      .andWhere('"currentMonitorStatusId" IN (:...fromIds)', {
+        fromIds: data.fromMonitorStatusIds.map((id: ObjectID) => {
+          return id.toString();
+        }),
+      })
+      .execute();
+
+    return result.affected || 0;
+  }
 }
 export default new Service();

package/Server/Services/MonitorStatusService.ts

@@ -11,6 +11,14 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import Model from "../../Models/DatabaseModels/MonitorStatus";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+/*
+ * Statically imported despite the MonitorService <-> MonitorStatusService
+ * cycle: both modules reference each other only from method bodies (never at
+ * module-init time), so the default binding is always resolved by the time
+ * these methods run. A dynamic import() cannot be used here - the App build's
+ * TypeScript module target rejects it (TS1323).
+ */
+import MonitorService from "./MonitorService";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -51,6 +59,17 @@ export class Service extends DatabaseService<Model> {
       );
     }
 
+    /*
+     * Clear dangling currentMonitorStatusId references held by ALREADY
+     * soft-deleted monitors before the hard-delete runs. A soft-deleted
+     * monitor keeps its row and its currentMonitorStatusId foreign key
+     * (ON DELETE NO ACTION), so a status a since-deleted monitor last adopted
+     * cannot be removed while that reference lingers - the intermittent
+     * "Monitor records still reference it" failure. Live monitors are left
+     * untouched (see repointDeletedMonitorsAwayFromStatuses).
+     */
+    await this.clearDeletedMonitorReferences(deleteBy.query);
+
     let monitorStatus: Model | null = null;
 
     if (!deleteBy.props.isRoot) {
@@ -72,6 +91,153 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  /**
+   * Repoints soft-deleted monitors that still reference the statuses matched
+   * by `query` to each project's default (lowest-priority) operational status,
+   * falling back to any other remaining status when no operational status
+   * survives. This keeps the Monitor.currentMonitorStatusId foreign key from
+   * blocking a monitor-status delete on dead rows.
+   */
+  private async clearDeletedMonitorReferences(
+    query: DeleteBy<Model>["query"],
+  ): Promise<void> {
+    const statusesBeingDeleted: Array<Model> = await this.findBy({
+      query: query,
+      select: {
+        _id: true,
+        projectId: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    // Group the statuses being deleted by project.
+    const byProject: Map<
+      string,
+      { projectId: ObjectID; statusIds: Array<ObjectID> }
+    > = new Map();
+
+    for (const status of statusesBeingDeleted) {
+      if (!status.id || !status.projectId) {
+        continue;
+      }
+
+      const key: string = status.projectId.toString();
+
+      if (!byProject.has(key)) {
+        byProject.set(key, { projectId: status.projectId, statusIds: [] });
+      }
+
+      byProject.get(key)!.statusIds.push(status.id);
+    }
+
+    if (byProject.size === 0) {
+      return;
+    }
+
+    for (const { projectId, statusIds } of byProject.values()) {
+      const deletedSet: Set<string> = new Set(
+        statusIds.map((id: ObjectID) => {
+          return id.toString();
+        }),
+      );
+
+      const fallbackStatusId: ObjectID | undefined =
+        await this.findFallbackStatusId(projectId, deletedSet);
+
+      if (!fallbackStatusId) {
+        // Nothing valid to repoint to - leave the referential guard in place.
+        continue;
+      }
+
+      await MonitorService.repointDeletedMonitorsAwayFromStatuses({
+        fromMonitorStatusIds: statusIds,
+        toMonitorStatusId: fallbackStatusId,
+        projectId: projectId,
+      });
+    }
+  }
+
+  /**
+   * Picks the status a repointed monitor should fall back to: the project's
+   * default (lowest-priority) operational status that is not itself being
+   * deleted, or - if none survives - any other remaining status.
+   */
+  private async findFallbackStatusId(
+    projectId: ObjectID,
+    deletedStatusIds: Set<string>,
+  ): Promise<ObjectID | undefined> {
+    const operationalStatuses: Array<Model> = await this.findBy({
+      query: {
+        projectId: projectId,
+        isOperationalState: true,
+      },
+      select: {
+        _id: true,
+      },
+      sort: {
+        priority: SortOrder.Ascending,
+        createdAt: SortOrder.Ascending,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const operationalFallback: ObjectID | undefined = this.firstSurvivingId(
+      operationalStatuses,
+      deletedStatusIds,
+    );
+
+    if (operationalFallback) {
+      return operationalFallback;
+    }
+
+    // No operational status survives - repoint to any other remaining status.
+    const anyStatuses: Array<Model> = await this.findBy({
+      query: {
+        projectId: projectId,
+      },
+      select: {
+        _id: true,
+      },
+      sort: {
+        priority: SortOrder.Ascending,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return this.firstSurvivingId(anyStatuses, deletedStatusIds);
+  }
+
+  /**
+   * Returns the id of the first status in `statuses` (already priority-sorted)
+   * that is not in `deletedStatusIds`, or undefined when none survives.
+   */
+  private firstSurvivingId(
+    statuses: Array<Model>,
+    deletedStatusIds: Set<string>,
+  ): ObjectID | undefined {
+    for (const status of statuses) {
+      const id: ObjectID | null | undefined = status.id;
+
+      if (id && !deletedStatusIds.has(id.toString())) {
+        return id;
+      }
+    }
+
+    return undefined;
+  }
+
   @CaptureSpan()
   protected override async onDeleteSuccess(
     onDelete: OnDelete<Model>,