web-agent-bridge 3.4.0 → 3.9.0

package/server/services/ssl-ct-monitor.js

@@ -0,0 +1,224 @@
+/**
+ * server/services/ssl-ct-monitor.js
+ *
+ * Certificate Transparency monitor for the WAB Extended Trust Layer.
+ *
+ * Polls public CT logs (crt.sh) every WAB_CT_INTERVAL_HOURS (default 6h)
+ * for every host in `ssl_monitor` with `ct_monitor_enabled = 1`. When a
+ * new certificate fingerprint is observed, the row is appended to
+ * `cert_history` (source='ct_log'), `ct_pending_resign` is flagged, and
+ * the site owner is emailed. If `WAB_AUTO_RESIGN=true`, the wab.json is
+ * re-signed automatically by spawning `scripts/sign-wab-domain.js`.
+ *
+ * Disabled unless WAB_CT_MONITOR=true (off by default for safety).
+ */
+'use strict';
+
+const path = require('node:path');
+const { spawn } = require('node:child_process');
+const Database = require('better-sqlite3');
+
+const DATA_DIR = process.env.NODE_ENV === 'test'
+  ? path.join(__dirname, '..', '..', 'data-test')
+  : (process.env.DATA_DIR || path.join(__dirname, '..', '..', 'data'));
+const DB_FILE = process.env.NODE_ENV === 'test' ? 'wab-test.db' : 'wab.db';
+
+let _db = null;
+function db() {
+  if (!_db) _db = new Database(path.join(DATA_DIR, DB_FILE));
+  return _db;
+}
+
+const CT_API = process.env.WAB_CT_API_BASE || 'https://crt.sh';
+const REQUEST_TIMEOUT_MS = Number(process.env.WAB_CT_TIMEOUT_MS || 15000);
+const PER_HOST_DELAY_MS = Number(process.env.WAB_CT_DELAY_MS || 1500);
+
+// ---------- crt.sh fetch ---------------------------------------------------
+
+async function fetchLatestCert(host) {
+  const url = `${CT_API}/?q=${encodeURIComponent(host)}&output=json`;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), REQUEST_TIMEOUT_MS);
+  let res;
+  try {
+    res = await fetch(url, {
+      signal: ctrl.signal,
+      headers: { 'user-agent': 'WAB-CT-Monitor/1.0 (+https://www.webagentbridge.com)' },
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!res.ok) throw new Error(`crt.sh HTTP ${res.status}`);
+  const data = await res.json();
+  if (!Array.isArray(data) || data.length === 0) return null;
+  // crt.sh returns one row per identity in a cert; dedupe by serial+issuer and pick newest by not_before.
+  const sorted = data
+    .filter((c) => c && c.not_before)
+    .sort((a, b) => new Date(b.not_before) - new Date(a.not_before));
+  return sorted[0] || null;
+}
+
+// crt.sh does NOT return a SHA-256 fingerprint directly; we use a stable
+// composite identifier (serial + issuer + not_before) as the "thumbprint"
+// for change detection. ssl-inspector remains the source of truth for the
+// real fingerprint when re-signing locally.
+function ctThumbprint(cert) {
+  if (!cert) return null;
+  return [cert.serial_number || '', cert.issuer_name || '', cert.not_before || '']
+    .join('|')
+    .toLowerCase();
+}
+
+// ---------- per-host check -------------------------------------------------
+
+async function checkDomain(host) {
+  const row = db().prepare(
+    `SELECT host, ct_last_thumbprint, owner_user_id, fingerprint_sha256
+       FROM ssl_monitor WHERE host = ? AND ct_monitor_enabled = 1`
+  ).get(host);
+  if (!row) return { host, skipped: true };
+
+  const cert = await fetchLatestCert(host);
+  const now = new Date().toISOString();
+
+  if (!cert) {
+    db().prepare(`UPDATE ssl_monitor SET ct_last_checked = ? WHERE host = ?`).run(now, host);
+    return { host, found: false };
+  }
+
+  const tp = ctThumbprint(cert);
+  if (row.ct_last_thumbprint && row.ct_last_thumbprint === tp) {
+    db().prepare(`UPDATE ssl_monitor SET ct_last_checked = ? WHERE host = ?`).run(now, host);
+    return { host, changed: false };
+  }
+
+  // New certificate observed in CT logs.
+  try {
+    db().prepare(`
+      INSERT OR IGNORE INTO cert_history
+        (host, fingerprint_sha256, issuer, subject, serial, valid_from, valid_to, source)
+      VALUES (?, ?, ?, ?, ?, ?, ?, 'ct_log')
+    `).run(
+      host,
+      tp,
+      cert.issuer_name || null,
+      cert.common_name || cert.name_value || null,
+      cert.serial_number || null,
+      cert.not_before || null,
+      cert.not_after || null,
+    );
+  } catch (_) { /* table may not exist in tests */ }
+
+  db().prepare(`
+    UPDATE ssl_monitor
+       SET ct_pending_resign = 1,
+           ct_last_checked   = ?,
+           ct_last_thumbprint = ?
+     WHERE host = ?
+  `).run(now, tp, host);
+
+  // Notify owner (best-effort).
+  await notifyOwner(host, row.owner_user_id, cert).catch(() => {});
+
+  // Optional auto re-sign.
+  if (String(process.env.WAB_AUTO_RESIGN).toLowerCase() === 'true') {
+    const ok = await runResign(host).catch(() => false);
+    if (ok) {
+      db().prepare(`UPDATE ssl_monitor SET ct_pending_resign = 0 WHERE host = ?`).run(host);
+    }
+  }
+
+  return { host, changed: true, thumbprint: tp };
+}
+
+// ---------- helpers --------------------------------------------------------
+
+async function notifyOwner(host, userId, cert) {
+  let to = process.env.WAB_SSL_ALERT_EMAIL;
+  try {
+    if (!to && userId) {
+      const u = db().prepare('SELECT email FROM users WHERE id = ?').get(userId);
+      if (u && u.email) to = u.email;
+    }
+  } catch (_) { /* no users table */ }
+  if (!to) return false;
+
+  try {
+    const { sendEmail } = require('./email');
+    await sendEmail({
+      to,
+      template: 'sslExpiringAlert', // re-use existing template; subject reflects re-sign
+      data: {
+        host,
+        daysLeft: cert.not_after
+          ? Math.max(0, Math.ceil((new Date(cert.not_after) - Date.now()) / 86400000))
+          : null,
+        validTo: cert.not_after,
+        issuer: cert.issuer_name,
+        fingerprint: cert.serial_number,
+        ctEvent: true,
+      },
+    });
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+function runResign(host) {
+  return new Promise((resolve) => {
+    const script = path.join(__dirname, '..', '..', 'scripts', 'sign-wab-domain.js');
+    const child = spawn(process.execPath, [script, host], { stdio: 'pipe' });
+    let killed = false;
+    const timer = setTimeout(() => { killed = true; child.kill('SIGKILL'); }, 60_000);
+    child.on('exit', (code) => {
+      clearTimeout(timer);
+      resolve(!killed && code === 0);
+    });
+    child.on('error', () => { clearTimeout(timer); resolve(false); });
+  });
+}
+
+// ---------- sweep ----------------------------------------------------------
+
+async function runCTMonitor() {
+  let hosts = [];
+  try {
+    hosts = db().prepare(
+      `SELECT host FROM ssl_monitor WHERE ct_monitor_enabled = 1 AND enabled = 1`
+    ).all();
+  } catch (_) {
+    return { error: 'ssl_monitor table missing' };
+  }
+  const results = [];
+  for (const { host } of hosts) {
+    try {
+      results.push(await checkDomain(host));
+    } catch (err) {
+      results.push({ host, error: err.message });
+    }
+    await new Promise((r) => setTimeout(r, PER_HOST_DELAY_MS));
+  }
+  return { count: results.length, results };
+}
+
+// ---------- cron -----------------------------------------------------------
+
+let _interval = null;
+function start() {
+  if (_interval) return;
+  if (process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID) return;
+  if (String(process.env.WAB_CT_MONITOR).toLowerCase() !== 'true') return;
+  const hours = Number(process.env.WAB_CT_INTERVAL_HOURS || 6);
+  console.log(`[ct-monitor] enabled, sweeping every ${hours}h`);
+  // Initial run after 60s so the server boot is unaffected.
+  setTimeout(() => runCTMonitor().catch(() => {}), 60_000);
+  _interval = setInterval(() => runCTMonitor().catch(() => {}), hours * 3600 * 1000);
+  if (_interval.unref) _interval.unref();
+}
+
+function stop() {
+  if (_interval) { clearInterval(_interval); _interval = null; }
+}
+
+module.exports = { runCTMonitor, checkDomain, fetchLatestCert, ctThumbprint, start, stop };

package/server/services/ssl-inspector.js

@@ -1,42 +1,42 @@
-/**
- * server/services/ssl-inspector.js
- * Live TLS certificate inspector — used by sign-wab-domain.js, cron monitor,
- * and shieldqr verifier. Returns { ok, fingerprint_sha256, valid_to,
- * days_until_expiry, issuer, subject, fingerprint_b64 }.
- */
-'use strict';
-
-const tls = require('node:tls');
-
-function inspect(host, port = 443, timeoutMs = 8000) {
-  return new Promise((resolve) => {
-    const socket = tls.connect({
-      host, port, servername: host, rejectUnauthorized: false, timeout: timeoutMs,
-    }, () => {
-      try {
-        const cert = socket.getPeerCertificate(false);
-        if (!cert || !cert.valid_to) { socket.end(); return resolve({ ok: false, error: 'no_cert' }); }
-        const validTo = new Date(cert.valid_to);
-        const daysLeft = Math.floor((validTo.getTime() - Date.now()) / (24 * 3600 * 1000));
-        const fpHex = (cert.fingerprint256 || '').replace(/:/g, '').toLowerCase();
-        const fpB64 = fpHex ? Buffer.from(fpHex, 'hex').toString('base64') : null;
-        socket.end();
-        resolve({
-          ok: true,
-          fingerprint_sha256: fpHex,
-          fingerprint_b64: fpB64,
-          valid_to: validTo.toISOString(),
-          valid_from: cert.valid_from ? new Date(cert.valid_from).toISOString() : null,
-          days_until_expiry: daysLeft,
-          issuer: cert.issuer && (cert.issuer.O || cert.issuer.CN) || null,
-          subject: cert.subject && cert.subject.CN || null,
-          serial: cert.serialNumber || null,
-        });
-      } catch (e) { try { socket.end(); } catch (_) {} resolve({ ok: false, error: e.message }); }
-    });
-    socket.on('error', (err) => resolve({ ok: false, error: err.message }));
-    socket.on('timeout', () => { try { socket.destroy(); } catch (_) {} resolve({ ok: false, error: 'timeout' }); });
-  });
-}
-
-module.exports = { inspect };
+/**
+ * server/services/ssl-inspector.js
+ * Live TLS certificate inspector — used by sign-wab-domain.js, cron monitor,
+ * and shieldqr verifier. Returns { ok, fingerprint_sha256, valid_to,
+ * days_until_expiry, issuer, subject, fingerprint_b64 }.
+ */
+'use strict';
+
+const tls = require('node:tls');
+
+function inspect(host, port = 443, timeoutMs = 8000) {
+  return new Promise((resolve) => {
+    const socket = tls.connect({
+      host, port, servername: host, rejectUnauthorized: false, timeout: timeoutMs,
+    }, () => {
+      try {
+        const cert = socket.getPeerCertificate(false);
+        if (!cert || !cert.valid_to) { socket.end(); return resolve({ ok: false, error: 'no_cert' }); }
+        const validTo = new Date(cert.valid_to);
+        const daysLeft = Math.floor((validTo.getTime() - Date.now()) / (24 * 3600 * 1000));
+        const fpHex = (cert.fingerprint256 || '').replace(/:/g, '').toLowerCase();
+        const fpB64 = fpHex ? Buffer.from(fpHex, 'hex').toString('base64') : null;
+        socket.end();
+        resolve({
+          ok: true,
+          fingerprint_sha256: fpHex,
+          fingerprint_b64: fpB64,
+          valid_to: validTo.toISOString(),
+          valid_from: cert.valid_from ? new Date(cert.valid_from).toISOString() : null,
+          days_until_expiry: daysLeft,
+          issuer: cert.issuer && (cert.issuer.O || cert.issuer.CN) || null,
+          subject: cert.subject && cert.subject.CN || null,
+          serial: cert.serialNumber || null,
+        });
+      } catch (e) { try { socket.end(); } catch (_) {} resolve({ ok: false, error: e.message }); }
+    });
+    socket.on('error', (err) => resolve({ ok: false, error: err.message }));
+    socket.on('timeout', () => { try { socket.destroy(); } catch (_) {} resolve({ ok: false, error: 'timeout' }); });
+  });
+}
+
+module.exports = { inspect };

package/server/services/ssl-monitor.js

@@ -1,167 +1,167 @@
-/**
- * server/services/ssl-monitor.js
- * Extended Trust Layer — Certificate Companion & SSL Health Monitoring.
- *
- * Periodically inspects SSL certificates for every active site, persists state
- * in `ssl_monitor`, appends new certs to `cert_history` (CT log), and emails
- * the site owner when the certificate is within 7 days of expiry. The cron
- * runs once per day inside the main process; can be disabled via env
- * `WAB_SSL_MONITOR=off`.
- */
-'use strict';
-
-const path = require('node:path');
-const Database = require('better-sqlite3');
-const ssl = require('./ssl-inspector');
-
-const DATA_DIR = process.env.NODE_ENV === 'test'
-  ? path.join(__dirname, '..', '..', 'data-test')
-  : (process.env.DATA_DIR || path.join(__dirname, '..', '..', 'data'));
-const DB_FILE = process.env.NODE_ENV === 'test' ? 'wab-test.db' : 'wab.db';
-
-let _db = null;
-function db() {
-  if (!_db) { _db = new Database(path.join(DATA_DIR, DB_FILE)); }
-  return _db;
-}
-
-const ALERT_DAYS = Number(process.env.WAB_SSL_ALERT_DAYS || 7);
-const ALERT_REPEAT_HOURS = Number(process.env.WAB_SSL_ALERT_REPEAT_HOURS || 24);
-
-function classify(daysLeft) {
-  if (daysLeft == null) return 'error';
-  if (daysLeft < 0) return 'expired';
-  if (daysLeft <= ALERT_DAYS) return 'expiring';
-  return 'active';
-}
-
-/**
- * Inspect one host, persist state + CT log entry + alert if needed.
- * Returns { host, status, days_until_expiry, alerted }.
- */
-async function checkHost(host, opts = {}) {
-  const info = await ssl.inspect(host, 443);
-  const now = new Date().toISOString();
-
-  if (!info.ok) {
-    db().prepare(`
-      INSERT INTO ssl_monitor (host, status, error, last_checked_at, enabled, owner_user_id)
-      VALUES (?, 'error', ?, ?, 1, ?)
-      ON CONFLICT(host) DO UPDATE SET
-        status='error', error=excluded.error, last_checked_at=excluded.last_checked_at
-    `).run(host, info.error || 'unknown', now, opts.userId || null);
-    return { host, status: 'error', error: info.error };
-  }
-
-  const status = classify(info.days_until_expiry);
-
-  db().prepare(`
-    INSERT INTO ssl_monitor (host, fingerprint_sha256, issuer, valid_to, days_until_expiry,
-                             status, error, last_checked_at, enabled, owner_user_id)
-    VALUES (?, ?, ?, ?, ?, ?, NULL, ?, 1, ?)
-    ON CONFLICT(host) DO UPDATE SET
-      fingerprint_sha256=excluded.fingerprint_sha256,
-      issuer=excluded.issuer,
-      valid_to=excluded.valid_to,
-      days_until_expiry=excluded.days_until_expiry,
-      status=excluded.status,
-      error=NULL,
-      last_checked_at=excluded.last_checked_at
-  `).run(host, info.fingerprint_sha256, info.issuer, info.valid_to,
-         info.days_until_expiry, status, now, opts.userId || null);
-
-  // Append to CT log if fingerprint not seen for this host yet.
-  try {
-    db().prepare(`
-      INSERT OR IGNORE INTO cert_history
-        (host, fingerprint_sha256, issuer, subject, serial, valid_from, valid_to, source)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(host, info.fingerprint_sha256, info.issuer, info.subject, info.serial,
-           info.valid_from, info.valid_to, opts.source || 'monitor');
-  } catch (_) { /* table may not exist yet */ }
-
-  let alerted = false;
-  if (status === 'expiring' || status === 'expired') {
-    alerted = await maybeSendAlert(host, info, status, opts);
-  }
-
-  return { host, status, days_until_expiry: info.days_until_expiry, alerted };
-}
-
-async function maybeSendAlert(host, info, status, opts) {
-  const row = db().prepare(`SELECT last_alert_at, owner_user_id FROM ssl_monitor WHERE host = ?`).get(host);
-  if (row && row.last_alert_at) {
-    const last = new Date(row.last_alert_at).getTime();
-    if (Date.now() - last < ALERT_REPEAT_HOURS * 3600 * 1000) return false;
-  }
-
-  let to = opts.alertEmail || process.env.WAB_SSL_ALERT_EMAIL;
-  try {
-    if (!to && row && row.owner_user_id) {
-      const u = db().prepare('SELECT email FROM users WHERE id = ?').get(row.owner_user_id);
-      if (u && u.email) to = u.email;
-    }
-  } catch (_) { /* users table may not exist in tests */ }
-
-  if (!to) return false;
-
-  try {
-    const { sendEmail } = require('./email');
-    await sendEmail({
-      to, template: 'sslExpiringAlert',
-      data: {
-        host,
-        daysLeft: Math.max(0, info.days_until_expiry),
-        validTo: info.valid_to,
-        issuer: info.issuer,
-        fingerprint: info.fingerprint_sha256,
-      },
-    });
-    db().prepare(`UPDATE ssl_monitor SET last_alert_at = ? WHERE host = ?`)
-      .run(new Date().toISOString(), host);
-    return true;
-  } catch (_) { return false; }
-}
-
-/** Run a sweep across every active site domain (and optional extra hosts). */
-async function runSweep({ extraHosts = [] } = {}) {
-  let hosts = [...extraHosts];
-  try {
-    const rows = db().prepare(
-      "SELECT DISTINCT LOWER(REPLACE(domain, 'http://', '')) AS host, user_id FROM sites WHERE active = 1"
-    ).all();
-    for (const r of rows) {
-      const h = (r.host || '').replace(/^https?:\/\//, '').replace(/\/.*$/, '').replace(/^www\./, 'www.');
-      if (!h) continue;
-      hosts.push({ host: h, userId: r.user_id });
-    }
-  } catch (_) { /* sites table may not exist */ }
-
-  const results = [];
-  for (const item of hosts) {
-    const host = typeof item === 'string' ? item : item.host;
-    const userId = typeof item === 'string' ? null : item.userId;
-    try {
-      results.push(await checkHost(host, { userId }));
-    } catch (e) {
-      results.push({ host, status: 'error', error: e.message });
-    }
-  }
-  return results;
-}
-
-let _interval = null;
-function start() {
-  if (_interval || process.env.WAB_SSL_MONITOR === 'off') return;
-  if (process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID) return;
-  // Run immediately, then once per day.
-  setTimeout(() => runSweep().catch(() => {}), 30_000);
-  _interval = setInterval(() => runSweep().catch(() => {}), 24 * 3600 * 1000);
-  if (_interval.unref) _interval.unref();
-}
-
-function stop() {
-  if (_interval) { clearInterval(_interval); _interval = null; }
-}
-
-module.exports = { checkHost, runSweep, classify, start, stop };
+/**
+ * server/services/ssl-monitor.js
+ * Extended Trust Layer — Certificate Companion & SSL Health Monitoring.
+ *
+ * Periodically inspects SSL certificates for every active site, persists state
+ * in `ssl_monitor`, appends new certs to `cert_history` (CT log), and emails
+ * the site owner when the certificate is within 7 days of expiry. The cron
+ * runs once per day inside the main process; can be disabled via env
+ * `WAB_SSL_MONITOR=off`.
+ */
+'use strict';
+
+const path = require('node:path');
+const Database = require('better-sqlite3');
+const ssl = require('./ssl-inspector');
+
+const DATA_DIR = process.env.NODE_ENV === 'test'
+  ? path.join(__dirname, '..', '..', 'data-test')
+  : (process.env.DATA_DIR || path.join(__dirname, '..', '..', 'data'));
+const DB_FILE = process.env.NODE_ENV === 'test' ? 'wab-test.db' : 'wab.db';
+
+let _db = null;
+function db() {
+  if (!_db) { _db = new Database(path.join(DATA_DIR, DB_FILE)); }
+  return _db;
+}
+
+const ALERT_DAYS = Number(process.env.WAB_SSL_ALERT_DAYS || 7);
+const ALERT_REPEAT_HOURS = Number(process.env.WAB_SSL_ALERT_REPEAT_HOURS || 24);
+
+function classify(daysLeft) {
+  if (daysLeft == null) return 'error';
+  if (daysLeft < 0) return 'expired';
+  if (daysLeft <= ALERT_DAYS) return 'expiring';
+  return 'active';
+}
+
+/**
+ * Inspect one host, persist state + CT log entry + alert if needed.
+ * Returns { host, status, days_until_expiry, alerted }.
+ */
+async function checkHost(host, opts = {}) {
+  const info = await ssl.inspect(host, 443);
+  const now = new Date().toISOString();
+
+  if (!info.ok) {
+    db().prepare(`
+      INSERT INTO ssl_monitor (host, status, error, last_checked_at, enabled, owner_user_id)
+      VALUES (?, 'error', ?, ?, 1, ?)
+      ON CONFLICT(host) DO UPDATE SET
+        status='error', error=excluded.error, last_checked_at=excluded.last_checked_at
+    `).run(host, info.error || 'unknown', now, opts.userId || null);
+    return { host, status: 'error', error: info.error };
+  }
+
+  const status = classify(info.days_until_expiry);
+
+  db().prepare(`
+    INSERT INTO ssl_monitor (host, fingerprint_sha256, issuer, valid_to, days_until_expiry,
+                             status, error, last_checked_at, enabled, owner_user_id)
+    VALUES (?, ?, ?, ?, ?, ?, NULL, ?, 1, ?)
+    ON CONFLICT(host) DO UPDATE SET
+      fingerprint_sha256=excluded.fingerprint_sha256,
+      issuer=excluded.issuer,
+      valid_to=excluded.valid_to,
+      days_until_expiry=excluded.days_until_expiry,
+      status=excluded.status,
+      error=NULL,
+      last_checked_at=excluded.last_checked_at
+  `).run(host, info.fingerprint_sha256, info.issuer, info.valid_to,
+         info.days_until_expiry, status, now, opts.userId || null);
+
+  // Append to CT log if fingerprint not seen for this host yet.
+  try {
+    db().prepare(`
+      INSERT OR IGNORE INTO cert_history
+        (host, fingerprint_sha256, issuer, subject, serial, valid_from, valid_to, source)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(host, info.fingerprint_sha256, info.issuer, info.subject, info.serial,
+           info.valid_from, info.valid_to, opts.source || 'monitor');
+  } catch (_) { /* table may not exist yet */ }
+
+  let alerted = false;
+  if (status === 'expiring' || status === 'expired') {
+    alerted = await maybeSendAlert(host, info, status, opts);
+  }
+
+  return { host, status, days_until_expiry: info.days_until_expiry, alerted };
+}
+
+async function maybeSendAlert(host, info, status, opts) {
+  const row = db().prepare(`SELECT last_alert_at, owner_user_id FROM ssl_monitor WHERE host = ?`).get(host);
+  if (row && row.last_alert_at) {
+    const last = new Date(row.last_alert_at).getTime();
+    if (Date.now() - last < ALERT_REPEAT_HOURS * 3600 * 1000) return false;
+  }
+
+  let to = opts.alertEmail || process.env.WAB_SSL_ALERT_EMAIL;
+  try {
+    if (!to && row && row.owner_user_id) {
+      const u = db().prepare('SELECT email FROM users WHERE id = ?').get(row.owner_user_id);
+      if (u && u.email) to = u.email;
+    }
+  } catch (_) { /* users table may not exist in tests */ }
+
+  if (!to) return false;
+
+  try {
+    const { sendEmail } = require('./email');
+    await sendEmail({
+      to, template: 'sslExpiringAlert',
+      data: {
+        host,
+        daysLeft: Math.max(0, info.days_until_expiry),
+        validTo: info.valid_to,
+        issuer: info.issuer,
+        fingerprint: info.fingerprint_sha256,
+      },
+    });
+    db().prepare(`UPDATE ssl_monitor SET last_alert_at = ? WHERE host = ?`)
+      .run(new Date().toISOString(), host);
+    return true;
+  } catch (_) { return false; }
+}
+
+/** Run a sweep across every active site domain (and optional extra hosts). */
+async function runSweep({ extraHosts = [] } = {}) {
+  let hosts = [...extraHosts];
+  try {
+    const rows = db().prepare(
+      "SELECT DISTINCT LOWER(REPLACE(domain, 'http://', '')) AS host, user_id FROM sites WHERE active = 1"
+    ).all();
+    for (const r of rows) {
+      const h = (r.host || '').replace(/^https?:\/\//, '').replace(/\/.*$/, '').replace(/^www\./, 'www.');
+      if (!h) continue;
+      hosts.push({ host: h, userId: r.user_id });
+    }
+  } catch (_) { /* sites table may not exist */ }
+
+  const results = [];
+  for (const item of hosts) {
+    const host = typeof item === 'string' ? item : item.host;
+    const userId = typeof item === 'string' ? null : item.userId;
+    try {
+      results.push(await checkHost(host, { userId }));
+    } catch (e) {
+      results.push({ host, status: 'error', error: e.message });
+    }
+  }
+  return results;
+}
+
+let _interval = null;
+function start() {
+  if (_interval || process.env.WAB_SSL_MONITOR === 'off') return;
+  if (process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID) return;
+  // Run immediately, then once per day.
+  setTimeout(() => runSweep().catch(() => {}), 30_000);
+  _interval = setInterval(() => runSweep().catch(() => {}), 24 * 3600 * 1000);
+  if (_interval.unref) _interval.unref();
+}
+
+function stop() {
+  if (_interval) { clearInterval(_interval); _interval = null; }
+}
+
+module.exports = { checkHost, runSweep, classify, start, stop };