@secondlayer/subgraphs 7.2.0 → 7.4.0

package/dist/runtime/emitter.d.ts

@@ -16,6 +16,7 @@ import { Kysely } from "kysely";
 */
 declare const MAX_WEBHOOK_TIMEOUT_MS: number;
 declare const LOCK_WINDOW_MS: number;
+declare function allowPrivateEgress(): boolean;
 interface ResolvedAddress {
 	address: string;
 	family: number;
@@ -105,4 +106,4 @@ interface StartEmitterOptions {
 	stopDrainDeadlineMs?: number;
 }
 declare function startEmitter(opts?: StartEmitterOptions): Promise<() => Promise<void>>;
-export { LOCK_WINDOW_MS, MAX_REDIRECT_HOPS, MAX_WEBHOOK_TIMEOUT_MS, StartEmitterOptions, __postToWebhookForTest, __setDnsLookupForTest, checkEgressAllowed, deliverTestEvent, startEmitter };
+export { LOCK_WINDOW_MS, MAX_REDIRECT_HOPS, MAX_WEBHOOK_TIMEOUT_MS, StartEmitterOptions, __postToWebhookForTest, __setDnsLookupForTest, allowPrivateEgress, checkEgressAllowed, deliverTestEvent, startEmitter };

package/dist/runtime/emitter.js

@@ -6,12 +6,12 @@ import {
   getTargetDb
 } from "@secondlayer/shared/db";
 import { getWebhookSigningSecret } from "@secondlayer/shared/db/queries/webhooks";
-import { logger as logger3 } from "@secondlayer/shared/logger";
+import { logger as logger4 } from "@secondlayer/shared/logger";
 import { listen, targetListenerUrl } from "@secondlayer/shared/queue/listener";
 import {
   webhookTimeoutMsCeiling
 } from "@secondlayer/shared/schemas/webhooks";
-import { sql } from "kysely";
+import { sql as sql2 } from "kysely";
 
 // src/runtime/formats/index.ts
 import { signSecondlayerWebhook } from "@secondlayer/shared/crypto/secondlayer-webhook";
@@ -194,6 +194,106 @@ function recordDelivery() {
   pending += 1;
 }
 
+// src/runtime/receiver-cert.ts
+import { isIP } from "node:net";
+import tls from "node:tls";
+import { logger as logger3 } from "@secondlayer/shared/logger";
+import { sql } from "kysely";
+var PROBE_TIMEOUT_MS = 5000;
+var RECHECK_AFTER_HOURS = 6;
+var BATCH_LIMIT = 50;
+async function probeCertExpiry(url, opts) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:")
+    return null;
+  if (!allowPrivateEgress()) {
+    let refusal;
+    try {
+      refusal = await checkEgressAllowed(url);
+    } catch {
+      return null;
+    }
+    if (refusal)
+      return null;
+  }
+  const raw = parsed.hostname;
+  const host = raw.startsWith("[") && raw.endsWith("]") ? raw.slice(1, -1) : raw;
+  const connect = opts?.connect ?? tls.connect;
+  const timeoutMs = opts?.timeoutMs ?? PROBE_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    const open = {};
+    let settled = false;
+    const finish = (expires) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        open.socket?.destroy();
+      } catch {}
+      resolve(expires);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    let probe;
+    try {
+      probe = connect({
+        host,
+        port: Number(parsed.port) || 443,
+        ...isIP(host) ? {} : { servername: host },
+        rejectUnauthorized: false
+      });
+    } catch {
+      finish(null);
+      return;
+    }
+    open.socket = probe;
+    probe.once("secureConnect", () => {
+      try {
+        const expires = new Date(probe.getPeerCertificate().valid_to);
+        finish(Number.isNaN(expires.getTime()) ? null : expires);
+      } catch {
+        finish(null);
+      }
+    });
+    probe.once("error", () => finish(null));
+  });
+}
+async function refreshReceiverCerts(db, opts) {
+  const probe = opts?.probe ?? probeCertExpiry;
+  const due = await db.selectFrom("webhooks").select(["id", "url"]).where("status", "=", "active").where("url", "like", "https:%").where((eb) => eb.or([
+    eb("receiver_cert_checked_at", "is", null),
+    eb("receiver_cert_checked_at", "<", sql`now() - make_interval(hours => ${RECHECK_AFTER_HOURS})`)
+  ])).orderBy(sql`receiver_cert_checked_at asc nulls first`).limit(BATCH_LIMIT).execute();
+  const idsByOrigin = new Map;
+  for (const { id, url } of due) {
+    let origin;
+    try {
+      origin = new URL(url).origin;
+    } catch {
+      continue;
+    }
+    const entry = idsByOrigin.get(origin) ?? { url, ids: [] };
+    entry.ids.push(id);
+    idsByOrigin.set(origin, entry);
+  }
+  for (const [origin, { url, ids }] of idsByOrigin) {
+    const expires = await probe(url);
+    await db.updateTable("webhooks").set({
+      receiver_cert_expires_at: expires,
+      receiver_cert_checked_at: new Date
+    }).where("id", "in", ids).execute();
+    logger3.debug("[emitter] receiver cert probed", {
+      origin,
+      expiresAt: expires?.toISOString() ?? null
+    });
+  }
+}
+
 // src/runtime/emitter.ts
 var BATCH_SIZE = 50;
 var LIVE_SHARE = 0.9;
@@ -288,6 +388,7 @@ function isPrivateEgress(url) {
     return true;
   return isPrivateIp(host);
 }
+var RECEIVER_CERT_INTERVAL_MS = 30 * 60000;
 function allowPrivateEgress() {
   return process.env.SECONDLAYER_ALLOW_PRIVATE_EGRESS === "true";
 }
@@ -345,7 +446,7 @@ async function postToWebhook(url, body, headers, timeoutMs) {
       if (!allowPrivateEgress()) {
         const refusal = await checkEgressAllowed(target);
         if (refusal) {
-          logger3.warn("[emitter] refused private egress", {
+          logger4.warn("[emitter] refused private egress", {
             url: target,
             reason: refusal
           });
@@ -485,7 +586,7 @@ async function settleDelivered(db, outboxRow) {
       locked_until: null
     }).where("id", "=", outboxRow.id).where("status", "=", "pending").executeTakeFirst();
     if (Number(result.numUpdatedRows ?? 0) === 0) {
-      logger3.info("webhook.settle.orphaned", {
+      logger4.info("webhook.settle.orphaned", {
         outboxId: outboxRow.id,
         webhookId: outboxRow.webhook_id,
         outcome: "delivered"
@@ -516,14 +617,14 @@ async function settleFailed(db, outboxRow, sub, errText) {
       locked_until: null
     }).where("id", "=", outboxRow.id).where("status", "=", "pending").executeTakeFirst();
     if (Number(result.numUpdatedRows ?? 0) === 0) {
-      logger3.info("webhook.settle.orphaned", {
+      logger4.info("webhook.settle.orphaned", {
         outboxId: outboxRow.id,
         webhookId: outboxRow.webhook_id,
         outcome: "failed"
       });
       return;
     }
-    const incResult = await sql`
+    const incResult = await sql2`
 			UPDATE webhooks
 			SET circuit_failures = circuit_failures + 1,
 				last_delivery_at = NOW(),
@@ -540,7 +641,7 @@ async function settleFailed(db, outboxRow, sub, errText) {
         circuit_opened_at: new Date,
         updated_at: new Date
       }).where("id", "=", sub.id).execute();
-      logger3.warn("Webhook circuit tripped — paused after consecutive failures", {
+      logger4.warn("Webhook circuit tripped — paused after consecutive failures", {
         webhook: sub.name,
         failures: newFailures
       });
@@ -585,23 +686,23 @@ async function claimAndDispatchOnce(db, state, emitterId, trigger) {
   const liveLimit = Math.max(1, Math.round(BATCH_SIZE * LIVE_SHARE));
   const replayLimit = BATCH_SIZE - liveLimit;
   const { combined, liveCount, replayCount } = await db.transaction().execute(async (tx) => {
-    const live = await sql`
+    const live = await sql2`
 					SELECT * FROM webhook_outbox
 					WHERE status = 'pending'
 						AND next_attempt_at <= NOW()
 						AND is_replay = FALSE
 					ORDER BY next_attempt_at ASC
 					FOR UPDATE SKIP LOCKED
-					LIMIT ${sql.lit(liveLimit)}
+					LIMIT ${sql2.lit(liveLimit)}
 				`.execute(tx);
-    const replay = await sql`
+    const replay = await sql2`
 					SELECT * FROM webhook_outbox
 					WHERE status = 'pending'
 						AND next_attempt_at <= NOW()
 						AND is_replay = TRUE
 					ORDER BY next_attempt_at ASC
 					FOR UPDATE SKIP LOCKED
-					LIMIT ${sql.lit(replayLimit)}
+					LIMIT ${sql2.lit(replayLimit)}
 				`.execute(tx);
     const rows = [...live.rows, ...replay.rows];
     if (rows.length === 0) {
@@ -654,7 +755,7 @@ async function claimAndDispatchOnce(db, state, emitterId, trigger) {
   const oldestCreatedAtMs = Math.min(...combined.map((r) => new Date(r.created_at).getTime()));
   const inFlight = subIds.reduce((sum, id) => sum + (state.subQueues.get(id)?.inFlight ?? 0), 0);
   const concurrency = subIds.reduce((sum, id) => sum + (subById.get(id)?.concurrency || 4), 0);
-  logger3.info("emitter claim cycle", {
+  logger4.info("emitter claim cycle", {
     event: "emitter_claim",
     trigger,
     claimed: combined.length,
@@ -709,7 +810,7 @@ async function runOne(db, state, sq, row) {
       await settleFailed(db, row, sq.sub, err);
     }
   } catch (err) {
-    logger3.error("Emitter dispatch crashed", {
+    logger4.error("Emitter dispatch crashed", {
       outboxId: row.id,
       error: err instanceof Error ? err.message : String(err)
     });
@@ -720,15 +821,15 @@ async function runOne(db, state, sq, row) {
   }
 }
 async function runRetention(db) {
-  await sql`
+  await sql2`
 		DELETE FROM webhook_outbox
 		WHERE status = 'delivered' AND delivered_at < NOW() - interval '7 days'
 	`.execute(db);
-  await sql`
+  await sql2`
 		DELETE FROM webhook_deliveries
 		WHERE dispatched_at < NOW() - interval '30 days'
 	`.execute(db);
-  await sql`
+  await sql2`
 		DELETE FROM webhook_outbox
 		WHERE status = 'dead' AND failed_at < NOW() - interval '90 days'
 	`.execute(db);
@@ -746,30 +847,30 @@ async function startEmitter(opts) {
   };
   const pollIntervalMs = opts?.pollIntervalMs ?? 120000;
   const retentionIntervalMs = opts?.retentionIntervalMs ?? 60 * 60000;
-  logger3.info("[emitter] started", { id: emitterId });
+  logger4.info("[emitter] started", { id: emitterId });
   const listenUrl = targetListenerUrl();
   const stopNew = await listen("webhooks:new_outbox", () => {
     if (!state.running)
       return;
-    claimAndDrain(db, state, emitterId, "notify").catch((err) => logger3.error("[emitter] claim failed", {
+    claimAndDrain(db, state, emitterId, "notify").catch((err) => logger4.error("[emitter] claim failed", {
       error: err instanceof Error ? err.message : String(err)
     }));
   }, { connectionString: listenUrl });
   const stopChanged = await listen("webhooks:changed", () => {
     if (!state.running)
       return;
-    claimAndDrain(db, state, emitterId, "changed").catch((err) => logger3.error("[emitter] claim failed", {
+    claimAndDrain(db, state, emitterId, "changed").catch((err) => logger4.error("[emitter] claim failed", {
       error: err instanceof Error ? err.message : String(err)
     }));
   }, { connectionString: listenUrl });
-  logger3.info("[emitter] wake listeners connected", {
+  logger4.info("[emitter] wake listeners connected", {
     channels: ["webhooks:new_outbox", "webhooks:changed"],
     db: describeDbUrl(listenUrl)
   });
   const poll = setInterval(() => {
     if (!state.running)
       return;
-    claimAndDrain(db, state, emitterId, "poll").catch((err) => logger3.error("[emitter] poll claim failed", {
+    claimAndDrain(db, state, emitterId, "poll").catch((err) => logger4.error("[emitter] poll claim failed", {
       error: err instanceof Error ? err.message : String(err)
     }));
   }, pollIntervalMs);
@@ -777,14 +878,22 @@ async function startEmitter(opts) {
   const retention = setInterval(() => {
     if (!state.running)
       return;
-    runRetention(db).catch((err) => logger3.error("[emitter] retention failed", {
+    runRetention(db).catch((err) => logger4.error("[emitter] retention failed", {
       error: err instanceof Error ? err.message : String(err)
     }));
   }, retentionIntervalMs);
+  const receiverCerts = setInterval(() => {
+    if (!state.running)
+      return;
+    refreshReceiverCerts(db).catch((err) => logger4.error("[emitter] receiver cert refresh failed", {
+      error: err instanceof Error ? err.message : String(err)
+    }));
+  }, RECEIVER_CERT_INTERVAL_MS);
   return async () => {
     state.running = false;
     clearInterval(poll);
     clearInterval(retention);
+    clearInterval(receiverCerts);
     await stopNew();
     await stopChanged();
     const pendingRuns = new Set(state.inFlightRuns);
@@ -804,7 +913,7 @@ async function startEmitter(opts) {
     clearTimeout(timer);
     const abandoned = timedOut ? state.inFlightRuns.size : 0;
     const drained = drainTarget - abandoned;
-    logger3.info("[emitter] stopped", {
+    logger4.info("[emitter] stopped", {
       id: emitterId,
       event: "emitter_stopped",
       drained,
@@ -818,10 +927,11 @@ export {
   MAX_WEBHOOK_TIMEOUT_MS,
   __postToWebhookForTest,
   __setDnsLookupForTest,
+  allowPrivateEgress,
   checkEgressAllowed,
   deliverTestEvent,
   startEmitter
 };
 
-//# debugId=CAA46708A06EDDEB64756E2164756E21
+//# debugId=C2E9CBDDCAC108F464756E2164756E21
 //# sourceMappingURL=emitter.js.map