@aspalagin/openclaw-max 0.7.3 → 0.8.1

package/src/webhook-queue.ts

@@ -13,6 +13,9 @@
  */
 
 import type { MaxUpdate } from './api.js';
+import { isMaxGatewayDrainingError, waitForMaxDrainRetry } from './gateway-drain.js';
+import { runWithMaxTurnAdoption } from './turn-adoption.js';
+import type { MaxJournalEntry, MaxUpdateJournal } from './update-journal.js';
 
 /** Updates handled at once across chats; one chat is always sequential. */
 export const MAX_WEBHOOK_CHAT_CONCURRENCY = 4;
@@ -23,12 +26,62 @@ export const MAX_WEBHOOK_STOP_GRACE_MS = 3000;
 /** How long a restarted consumer waits for its predecessor's in-flight dispatches. */
 export const MAX_WEBHOOK_HANDOVER_WAIT_MS = 60_000;
 
+/** Default age past which updates the bot would answer are skipped (maxEventAgeMinutes). */
+export const MAX_EVENT_MAX_AGE_MINUTES = 60;
+
+/** Updates a late answer would confuse; registry updates (bot_added, …) are always handled. */
+const AGE_FENCED_UPDATE_TYPES = new Set([
+  'message_created',
+  'message_edited',
+  'message_callback',
+  'bot_started',
+]);
+
+/** maxEventAgeMinutes in ms; 0 (or less) turns the age fence off. */
+export function resolveMaxEventMaxAgeMs(minutes: number | undefined): number {
+  const value = minutes ?? MAX_EVENT_MAX_AGE_MINUTES;
+  return value > 0 ? value * 60_000 : 0;
+}
+
+/**
+ * Age of an update the bot would answer, when it is past `maxAgeMs`: MAX's
+ * event time, else when it was received. Undefined when fresh or not fenced.
+ */
+export function staleMaxUpdateAgeMs(
+  update: MaxUpdate,
+  maxAgeMs: number,
+  now: number,
+  receivedAt?: number,
+): number | undefined {
+  if (maxAgeMs <= 0 || !AGE_FENCED_UPDATE_TYPES.has(update.update_type)) return undefined;
+  const at = typeof update.timestamp === 'number' ? update.timestamp : receivedAt;
+  if (at === undefined) return undefined;
+  const age = now - at;
+  return age > maxAgeMs ? age : undefined;
+}
+
+/** The queue could not take an update: the route answers non-200 so MAX redelivers. */
+export class MaxWebhookQueueRejectedError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'MaxWebhookQueueRejectedError';
+  }
+}
+
+export type MaxWebhookAdmitResult = 'queued' | 'duplicate' | 'stale' | 'dropped';
+
 /** Serialization lane: the chat an update belongs to. */
 export function maxWebhookUpdateLane(update: MaxUpdate): string {
   return String(update.message?.recipient?.chat_id ?? update.chat_id ?? 'global');
 }
 
-type Handover = { updates: MaxUpdate[]; settled: Promise<void> };
+/**
+ * An update in memory; `entry` is its journal row when the queue is durable,
+ * `refusals` counts core's refusals of it while the gateway drains.
+ */
+type QueuedUpdate = { update: MaxUpdate; entry?: MaxJournalEntry; refusals?: number };
+
+type Handover = { updates: QueuedUpdate[]; settled: Promise<void> };
 
 /**
  * Updates acked to MAX but not dispatched when an account task stopped
@@ -37,11 +90,24 @@ type Handover = { updates: MaxUpdate[]; settled: Promise<void> };
  */
 const handovers = new Map<string, Handover>();
 /** Open queues per account: a stopping task hands leftovers to an overlapping successor. */
-const openQueues = new Map<string, Set<(update: MaxUpdate) => void>>();
+const openQueues = new Map<string, Set<(item: QueuedUpdate) => void>>();
 
 export type MaxWebhookUpdateQueue = {
-  /** Called by the route handler (request context): enqueue only, never dispatch. */
+  /**
+   * Called by the route handler (request context) before it answers MAX:
+   * durably records (journal) and enqueues, never dispatches. Throws
+   * MaxWebhookQueueRejectedError (full, overflow "reject") or the journal
+   * write error — the route then answers 503 and MAX redelivers.
+   */
+  admit: (update: MaxUpdate, dedupeKey?: string) => Promise<MaxWebhookAdmitResult>;
+  /** In-memory enqueue (no journal); drops beyond the pending limit. */
   push: (update: MaxUpdate) => void;
+  /**
+   * Durable queue: take over entries an earlier process left in the journal,
+   * ahead of everything queued since. Stale ones (maxAgeMs) are completed
+   * without dispatch. Call before the route is registered.
+   */
+  recover: () => Promise<{ recovered: number; stale: number; unreadable: number }>;
   /**
    * Runs in the account task until abortSignal fires: dispatches updates in
    * order per chat, up to `concurrency` chats at once. Resolves after stop.
@@ -51,6 +117,7 @@ export type MaxWebhookUpdateQueue = {
     abortSignal: AbortSignal;
     onError: (err: unknown, update: MaxUpdate) => void;
     onWarn?: (message: string) => void;
+    onInfo?: (message: string) => void;
   }) => Promise<void>;
   /** Start failed before consume(): release the queue, keeping taken-over updates. */
   close: () => void;
@@ -62,8 +129,19 @@ export function createMaxWebhookUpdateQueue(params: {
   pendingLimit?: number;
   stopGraceMs?: number;
   handoverWaitMs?: number;
+  /** Durable mode: updates are journaled before the ack and survive restarts. */
+  journal?: MaxUpdateJournal;
+  /** Full queue: "reject" (default) answers MAX non-200 so it redelivers; "drop" acks and drops. */
+  overflow?: 'reject' | 'drop';
+  /** Skip updates the bot would answer when older than this; 0 = no limit. */
+  maxAgeMs?: number;
+  now?: () => number;
+  onWarn?: (message: string) => void;
 }): MaxWebhookUpdateQueue {
-  const { accountId } = params;
+  const { accountId, journal } = params;
+  const overflow = params.overflow ?? 'reject';
+  const maxAgeMs = params.maxAgeMs ?? 0;
+  const now = params.now ?? Date.now;
   const concurrency = Math.max(1, params.concurrency ?? MAX_WEBHOOK_CHAT_CONCURRENCY);
   const pendingLimit = params.pendingLimit ?? MAX_WEBHOOK_PENDING_LIMIT;
   const stopGraceMs = params.stopGraceMs ?? MAX_WEBHOOK_STOP_GRACE_MS;
@@ -72,42 +150,97 @@ export function createMaxWebhookUpdateQueue(params: {
   // Taken over at creation: updates pushed later must queue behind them.
   const previous = handovers.get(accountId);
   handovers.delete(accountId);
-  const inbox: MaxUpdate[] = previous ? [...previous.updates] : [];
+  const inbox: QueuedUpdate[] = previous ? [...previous.updates] : [];
   let pending = inbox.length;
   let closed = false;
   let wake: (() => void) | undefined;
-  let warn: ((message: string) => void) | undefined;
+  let warn: ((message: string) => void) | undefined = params.onWarn;
 
-  const push = (update: MaxUpdate): void => {
+  const enqueue = (item: QueuedUpdate): void => {
     if (closed) {
       // Route still selected this target while the task was stopping.
       const successor = [...siblings].at(-1);
-      if (successor) return successor(update);
+      if (successor) return successor(item);
       const handover = handovers.get(accountId);
-      if (handover) handover.updates.push(update);
-      else handovers.set(accountId, { updates: [update], settled: Promise.resolve() });
+      if (handover) handover.updates.push(item);
+      else handovers.set(accountId, { updates: [item], settled: Promise.resolve() });
       return;
     }
-    if (pending >= pendingLimit) {
+    pending += 1;
+    inbox.push(item);
+    wake?.();
+  };
+  const siblings = openQueues.get(accountId) ?? new Set();
+  siblings.add(enqueue);
+  openQueues.set(accountId, siblings);
+
+  const push = (update: MaxUpdate): void => {
+    if (!closed && pending >= pendingLimit) {
       warn?.(
         `[${accountId}] MAX webhook queue full (${pendingLimit}); dropping ${update.update_type}`,
       );
       return;
     }
-    pending += 1;
-    inbox.push(update);
-    wake?.();
+    enqueue({ update });
+  };
+
+  const admit: MaxWebhookUpdateQueue['admit'] = async (update, dedupeKey) => {
+    const staleMs = staleMaxUpdateAgeMs(update, maxAgeMs, now());
+    if (staleMs !== undefined) {
+      warn?.(
+        `[${accountId}] MAX webhook: ${update.update_type} from ${Math.round(staleMs / 60_000)} min ago skipped (older than maxEventAgeMinutes)`,
+      );
+      return 'stale';
+    }
+    if (journal && dedupeKey && journal.isDuplicate(dedupeKey)) return 'duplicate';
+    if (!closed && pending >= pendingLimit) {
+      if (overflow === 'reject') {
+        throw new MaxWebhookQueueRejectedError(
+          `MAX webhook queue full (${pendingLimit} pending); ${update.update_type} refused for redelivery`,
+        );
+      }
+      warn?.(
+        `[${accountId}] MAX webhook queue full (${pendingLimit}); dropping ${update.update_type}`,
+      );
+      return 'dropped';
+    }
+    const entry = journal ? await journal.append(update, dedupeKey) : undefined;
+    enqueue({ update, entry });
+    return 'queued';
+  };
+
+  const recover: MaxWebhookUpdateQueue['recover'] = async () => {
+    if (!journal) return { recovered: 0, stale: 0, unreadable: 0 };
+    const { entries, unreadable } = await journal.readPending();
+    const recovered: QueuedUpdate[] = [];
+    let stale = 0;
+    for (const entry of entries) {
+      if (staleMaxUpdateAgeMs(entry.update, maxAgeMs, now(), entry.receivedAt) !== undefined) {
+        stale += 1;
+        await journal.complete(entry);
+        continue;
+      }
+      recovered.push({ update: entry.update, entry });
+    }
+    if (recovered.length > 0) {
+      if (closed) {
+        for (const item of recovered) enqueue(item);
+      } else {
+        // An earlier process accepted these before anything queued here.
+        inbox.unshift(...recovered);
+        pending += recovered.length;
+        wake?.();
+      }
+    }
+    return { recovered: recovered.length, stale, unreadable };
   };
-  const siblings = openQueues.get(accountId) ?? new Set();
-  siblings.add(push);
-  openQueues.set(accountId, siblings);
 
   /** Stop accepting and pass undispatched updates (lanes first, then inbox) on. */
-  const close = (fromLanes: MaxUpdate[], settled: Promise<void>): void => {
+  const close = (fromLanes: QueuedUpdate[], settled: Promise<void>): void => {
     if (closed) return;
     closed = true;
     wake = undefined;
-    siblings.delete(push);
+    siblings.delete(enqueue);
     if (siblings.size === 0 && openQueues.get(accountId) === siblings) {
       openQueues.delete(accountId);
     }
@@ -118,7 +251,7 @@ export function createMaxWebhookUpdateQueue(params: {
     const successor = [...siblings].at(-1);
     if (successor) {
       // A newer task of this account is already consuming: queue there.
-      for (const update of leftover) successor(update);
+      for (const item of leftover) successor(item);
       warn?.(
         `[${accountId}] MAX webhook stopped with ${leftover.length} update(s) not dispatched; moved to the running successor`,
       );
@@ -136,33 +269,72 @@ export function createMaxWebhookUpdateQueue(params: {
     abortSignal,
     onError,
     onWarn,
+    onInfo,
   }) => {
-    warn = onWarn;
-    const lanes = new Map<string, MaxUpdate[]>();
+    if (onWarn) warn = onWarn;
+    const lanes = new Map<string, QueuedUpdate[]>();
     const ready: string[] = [];
     const active = new Set<string>();
     const inflight = new Set<Promise<void>>();
 
-    const route = (update: MaxUpdate): void => {
-      const lane = maxWebhookUpdateLane(update);
+    const route = (item: QueuedUpdate): void => {
+      const lane = maxWebhookUpdateLane(item.update);
       const queued = lanes.get(lane);
-      if (queued) queued.push(update);
-      else lanes.set(lane, [update]);
+      if (queued) queued.push(item);
+      else lanes.set(lane, [item]);
       if (!active.has(lane) && !ready.includes(lane)) ready.push(lane);
     };
 
+    /** Back to the head of its lane, ahead of the chat's later updates; after the stop, passed on. */
+    const requeueFirst = (lane: string, item: QueuedUpdate): void => {
+      if (closed) return enqueue(item);
+      pending += 1;
+      const queued = lanes.get(lane);
+      if (queued) queued.unshift(item);
+      else lanes.set(lane, [item]);
+    };
+
     const runLane = async (lane: string): Promise<void> => {
       try {
         for (;;) {
           if (abortSignal.aborted) return;
-          const update = lanes.get(lane)?.shift();
-          if (!update) return;
+          const item = lanes.get(lane)?.shift();
+          if (!item) return;
           pending -= 1;
+          const { entry } = item;
+          let completion: Promise<void> | undefined;
+          // At core's turn adoption (core then owns crash recovery) or when the
+          // dispatch returns, whichever is first. A failed turn is not replayed.
+          const complete = (): Promise<void> =>
+            (completion ??= entry && journal ? journal.complete(entry) : Promise.resolve());
           try {
-            await dispatch(update);
+            await (entry
+              ? runWithMaxTurnAdoption(complete, () => dispatch(item.update))
+              : dispatch(item.update));
+            if (item.refusals) {
+              onInfo?.(
+                `[${accountId}] MAX webhook: ${item.update.update_type} accepted after ${item.refusals} refusal(s) of the draining gateway`,
+              );
+            }
           } catch (err) {
-            onError(err, update);
+            // Refused by the draining gateway before core adopted the turn: the
+            // turn never started. The update stays at the head of its chat and
+            // is retried after a pause; a stop meanwhile hands it over with the
+            // leftovers and its journal row stays on disk for the next process.
+            if (entry && !completion && isMaxGatewayDrainingError(err)) {
+              item.refusals = (item.refusals ?? 0) + 1;
+              if (item.refusals === 1) {
+                warn?.(
+                  `[${accountId}] MAX webhook: the gateway is draining and refused ${item.update.update_type}; kept queued, retried until accepted or the channel stops (then after the restart)`,
+                );
+              }
+              requeueFirst(lane, item);
+              await waitForMaxDrainRetry(item.refusals, abortSignal);
+              continue;
+            }
+            onError(err, item.update);
           }
+          await complete();
         }
       } finally {
         active.delete(lane);
@@ -200,14 +372,14 @@ export function createMaxWebhookUpdateQueue(params: {
         await waitAtMost(previous.settled, handoverWaitMs, abortSignal);
       }
       while (!abortSignal.aborted) {
-        while (inbox.length > 0) route(inbox.shift() as MaxUpdate);
+        while (inbox.length > 0) route(inbox.shift() as QueuedUpdate);
         pump();
         await nextWake();
         wake = undefined;
       }
     } finally {
       abortSignal.removeEventListener('abort', onAbort);
-      const leftover: MaxUpdate[] = [];
+      const leftover: QueuedUpdate[] = [];
       for (const queued of lanes.values()) leftover.push(...queued);
       lanes.clear();
       const settled = Promise.allSettled([...inflight]).then(() => undefined);
@@ -216,7 +388,7 @@ export function createMaxWebhookUpdateQueue(params: {
     }
   };
 
-  return { push, consume, close: () => close([], Promise.resolve()) };
+  return { admit, push, recover, consume, close: () => close([], Promise.resolve()) };
 }
 
 /** Resolves when `promise` settles, `ms` elapse or `signal` aborts — whichever is first. */

package/src/webhook-runner.ts

@@ -18,14 +18,16 @@ import {
   type MaxStatusPatch,
 } from './monitor-types.js';
 import type { MaxStateStore } from './state.js';
+import { type MaxUpdateJournal, openMaxUpdateJournal } from './update-journal.js';
 import {
+  maxUpdateDedupeKey,
   type MaxWebhookTarget,
   registerMaxWebhookRoute,
   registerMaxWebhookTarget,
   resolveMaxWebhookPath,
   subscribeMaxWebhook,
 } from './webhook.js';
-import { createMaxWebhookUpdateQueue } from './webhook-queue.js';
+import { createMaxWebhookUpdateQueue, resolveMaxEventMaxAgeMs } from './webhook-queue.js';
 
 /** MAX secret format (SubscriptionRequestBody.secret): 5–256 of [A-Za-z0-9_-]. */
 const MAX_WEBHOOK_SECRET_PATTERN = /^[\w-]{5,256}$/;
@@ -48,6 +50,9 @@ export async function resolveMaxWebhookSecret(
     return secret;
   };
 
+  // A webhookSecret SecretRef that did not resolve never falls back to the
+  // file or a generated secret.
+  if (account.secretErrors?.webhookSecret) throw new Error(account.secretErrors.webhookSecret);
   const configured = account.config.webhookSecret?.trim();
   if (configured) return validate(configured, 'webhookSecret');
 
@@ -203,11 +208,34 @@ export async function startMaxWebhook(opts: MaxMonitorOptions): Promise<void> {
   } as MaxStatusPatch);
 
   // MAX requires HTTP 200 within 30s while agent runs regularly take minutes.
-  // The route handler acks and only enqueues; this account task dispatches
-  // (see webhook-queue.ts: dispatching from the request context fails with
-  // GatewayDrainingError once the request's work admission is released).
-  const queue = createMaxWebhookUpdateQueue({ accountId: account.accountId });
-  const onUpdate = (update: MaxUpdate): Promise<void> => {
+  // The route handler records and enqueues before the ack; this account task
+  // dispatches (see webhook-queue.ts: dispatching from the request context
+  // fails with GatewayDrainingError once the request's work admission is
+  // released).
+  const journal = await openWebhookJournal(opts);
+  const queueConfig = account.config.webhookQueue;
+  const queue = createMaxWebhookUpdateQueue({
+    accountId: account.accountId,
+    journal,
+    pendingLimit: queueConfig?.maxPending,
+    overflow: queueConfig?.overflow,
+    maxAgeMs: resolveMaxEventMaxAgeMs(account.config.maxEventAgeMinutes),
+    onWarn: (message) => log?.warn(message),
+  });
+  if (journal) {
+    // Before the route exists: what an earlier process accepted goes first.
+    try {
+      const { recovered, stale, unreadable } = await queue.recover();
+      if (recovered + stale + unreadable > 0) {
+        log?.warn(
+          `[${account.accountId}] MAX webhook queue: ${recovered} update(s) accepted before the restart queued again, ${stale} stale skipped (maxEventAgeMinutes), ${unreadable} unreadable dropped`,
+        );
+      }
+    } catch (err) {
+      log?.error(`[${account.accountId}] MAX webhook queue recovery failed: ${String(err)}`);
+    }
+  }
+  const onUpdate = async (update: MaxUpdate): Promise<void> => {
     const at = Date.now();
     statusSink?.(
       channelReadyPatch({
@@ -216,8 +244,10 @@ export async function startMaxWebhook(opts: MaxMonitorOptions): Promise<void> {
         mode: 'webhook',
       }) as MaxStatusPatch,
     );
-    queue.push(update);
-    return Promise.resolve();
+    const result = await queue.admit(update, maxUpdateDedupeKey(update));
+    if (result === 'duplicate') {
+      log?.debug?.(`[${account.accountId}] MAX webhook: duplicate ${update.update_type} skipped`);
+    }
   };
 
   const target: MaxWebhookTarget = {
@@ -277,6 +307,7 @@ export async function startMaxWebhook(opts: MaxMonitorOptions): Promise<void> {
         `[${account.accountId}] Webhook update dispatch failed (${update.update_type}): ${String(err)}`,
       ),
     onWarn: (message) => log?.warn(message),
+    onInfo: (message) => log?.info(message),
   });
   stopSubscriptionWatch();
 
@@ -290,6 +321,32 @@ export async function startMaxWebhook(opts: MaxMonitorOptions): Promise<void> {
   log?.info(`[${account.accountId}] MAX webhook mode stopped (subscription kept)`);
 }
 
+/**
+ * The account's durable webhook journal, or undefined for the in-memory queue
+ * (webhookQueue.mode "memory", or the state directory is not writable).
+ */
+async function openWebhookJournal(opts: MaxMonitorOptions): Promise<MaxUpdateJournal | undefined> {
+  const { account, log } = opts;
+  if (account.config.webhookQueue?.mode === 'memory') {
+    log?.info(
+      `[${account.accountId}] MAX webhook queue in memory (webhookQueue.mode "memory"): updates acknowledged but not yet handled are lost on restart`,
+    );
+    return undefined;
+  }
+  try {
+    return await openMaxUpdateJournal({
+      accountId: account.accountId,
+      warn: (message) => log?.warn(`[${account.accountId}] ${message}`),
+    });
+  } catch (err) {
+    const code = (err as { code?: unknown })?.code;
+    log?.warn(
+      `[${account.accountId}] MAX webhook durable queue unavailable (${typeof code === 'string' ? code : String(err)}); using the in-memory queue — updates acknowledged but not yet handled are lost on restart`,
+    );
+    return undefined;
+  }
+}
+
 /** MAX webhook secret: 5–256 chars of [A-Za-z0-9-]. */
 function generateWebhookSecret(): string {
   return randomBytes(24).toString('base64url').replace(/_/g, '-');

package/src/webhook.ts

@@ -46,6 +46,10 @@ export type MaxWebhookTarget = {
   config: OpenClawConfig;
   path: string;
   secret?: string;
+  /**
+   * Awaited before MAX gets its 200: must only record/enqueue (never dispatch).
+   * A rejection answers 503 so MAX redelivers the update.
+   */
   onUpdate: (update: MaxUpdate) => Promise<void>;
   log?: (message: string) => void;
   error?: (message: string) => void;
@@ -116,11 +120,22 @@ export function maxUpdateDedupeKey(update: MaxUpdate): string | undefined {
   const id =
     update.callback?.callback_id ??
     update.message?.body?.mid ??
-    (typeof update.message_id === 'string' ? update.message_id : undefined);
+    // A forward-only message has no body; its link carries the original mid.
+    update.message?.link?.message?.mid ??
+    (typeof update.message_id === 'string' ? update.message_id : undefined) ??
+    // Registry updates (bot_started, bot_added, …) carry no message: their chat
+    // and user tell apart two of them in the same millisecond.
+    registryUpdateId(update);
   if (!id && update.timestamp == null) return undefined;
   return `${update.update_type}:${update.timestamp ?? ''}:${id ?? ''}`;
 }
 
+function registryUpdateId(update: MaxUpdate): string | undefined {
+  const userId = update.user?.user_id ?? update.user_id;
+  const parts = [update.chat_id, userId].filter((part) => part != null);
+  return parts.length > 0 ? parts.join('/') : undefined;
+}
+
 /** Returns true when the key was already seen (LRU bounded by DEDUPE_CAPACITY). */
 function rememberUpdate(seen: Map<string, true>, key: string): boolean {
   if (seen.has(key)) {
@@ -197,32 +212,38 @@ export async function handleMaxWebhookRequest(
 
   const update = raw as MaxUpdate;
 
-  // MAX needs 200 within 30 s while an agent turn can take minutes: ack first,
-  // then hand the update to the account task. Errors are logged, never turned
-  // into a non-200 (that would only make MAX redeliver and eventually
-  // unsubscribe the bot). onUpdate must only enqueue: this request's work
-  // admission is released when the handler returns, so agent/session work
-  // started from here would fail with GatewayDrainingError.
-  res.statusCode = 200;
-  res.setHeader('Content-Type', 'application/json');
-  res.end(JSON.stringify({ ok: true }));
-
   const dedupeKey = maxUpdateDedupeKey(update);
   if (dedupeKey && rememberUpdate(matchedTarget.seen, dedupeKey)) {
     matchedTarget.log?.(
       `[${matchedTarget.account.accountId}] MAX webhook: duplicate ${dedupeKey} skipped`,
     );
+    res.statusCode = 200;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({ ok: true }));
     return true;
   }
 
-  void Promise.resolve()
-    .then(() => matchedTarget.onUpdate(update))
-    .catch((err: unknown) => {
-      matchedTarget.error?.(
-        `[${matchedTarget.account.accountId}] Webhook update processing failed: ${String(err)}`,
-      );
-    });
+  // MAX needs 200 within 30 s while an agent turn can take minutes: onUpdate
+  // only records the update (durable journal) and enqueues it for the account
+  // task, then MAX gets its 200. It must not dispatch: this request's work
+  // admission is released when the handler returns, so agent/session work
+  // started from here would fail with GatewayDrainingError. When the update
+  // could not be recorded, 503 makes MAX redeliver it instead of losing it.
+  try {
+    await matchedTarget.onUpdate(update);
+  } catch (err) {
+    if (dedupeKey) matchedTarget.seen.delete(dedupeKey);
+    matchedTarget.error?.(
+      `[${matchedTarget.account.accountId}] MAX webhook: ${update.update_type} not queued, answering 503 for redelivery: ${String(err)}`,
+    );
+    res.statusCode = 503;
+    res.end('Service Unavailable');
+    return true;
+  }
 
+  res.statusCode = 200;
+  res.setHeader('Content-Type', 'application/json');
+  res.end(JSON.stringify({ ok: true }));
   return true;
 }
 

package/scripts/check-cycles.mjs

@@ -1,38 +0,0 @@
-// Fails when src/*.ts local imports form a cycle. Type-only imports count too
-// (pass --runtime to ignore them).
-import { readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const runtimeOnly = process.argv.includes("--runtime");
-const dir = new URL("../src/", import.meta.url).pathname;
-const files = readdirSync(dir).filter((f) => f.endsWith(".ts") && !f.endsWith(".test.ts"));
-const graph = new Map();
-const importRe = /^\s*(import|export)\s+(type\s+)?[^;]*?from\s+["']\.\/([\w.-]+)\.js["']/gms;
-for (const file of files) {
-  const text = readFileSync(join(dir, file), "utf8");
-  const deps = new Set();
-  for (const m of text.matchAll(importRe)) {
-    if (runtimeOnly && m[2]) continue;
-    deps.add(`${m[3]}.ts`);
-  }
-  graph.set(file, [...deps].filter((d) => files.includes(d)));
-}
-const cycles = [];
-const state = new Map();
-const stack = [];
-const visit = (node) => {
-  state.set(node, 1);
-  stack.push(node);
-  for (const dep of graph.get(node) ?? []) {
-    if (state.get(dep) === 1) cycles.push([...stack.slice(stack.indexOf(dep)), dep].join(" → "));
-    else if (!state.has(dep)) visit(dep);
-  }
-  stack.pop();
-  state.set(node, 2);
-};
-for (const file of files) if (!state.has(file)) visit(file);
-if (cycles.length) {
-  console.error(`import cycles (${runtimeOnly ? "runtime" : "all"} imports):\n${cycles.join("\n")}`);
-  process.exit(1);
-}
-console.log(`no import cycles among ${files.length} modules (${runtimeOnly ? "runtime" : "all"} imports)`);