🚧 WIP: refactor useCertificate to use tanstack qeury

server/db/pg/schema/schema.ts

@@ -18,7 +18,7 @@ export const domains = pgTable("domains", {
     domainId: varchar("domainId").primaryKey(),
     baseDomain: varchar("baseDomain").notNull(),
     configManaged: boolean("configManaged").notNull().default(false),
-    type: varchar("type"), // "ns", "cname", "wildcard"
+    type: varchar("type").$type<"ns" | "cname" | "wildcard">(),
     verified: boolean("verified").notNull().default(false),
     failed: boolean("failed").notNull().default(false),
     tries: integer("tries").notNull().default(0),

server/db/sqlite/schema/schema.ts

@@ -15,7 +15,7 @@ export const domains = sqliteTable("domains", {
     configManaged: integer("configManaged", { mode: "boolean" })
         .notNull()
         .default(false),
-    type: text("type"), // "ns", "cname", "wildcard"
+    type: text("type").$type<"ns" | "cname" | "wildcard">(),
     verified: integer("verified", { mode: "boolean" }).notNull().default(false),
     failed: integer("failed", { mode: "boolean" }).notNull().default(false),
     tries: integer("tries").notNull().default(0),

server/lib/certificates.ts

@@ -5,7 +5,6 @@ export async function getValidCertificatesForDomains(
     Array<{
         id: number;
         domain: string;
-        queriedDomain: string;
         wildcard: boolean | null;
         certFile: string | null;
         keyFile: string | null;

server/lib/clientVersionChecks.ts

@@ -18,19 +18,3 @@ export function canCompress(
         return false;
     }
 }
-
-// Whether this newt client understands `tlsCertId` references into the
-// sync message's `certs` array, instead of requiring each target to carry
-// its own inline `tlsCert`/`tlsKey` PEM data. Bump the version floor here to
-// match whatever release first ships the newt-side support.
-export function supportsCertReferences(
-    clientVersion: string | null | undefined
-): boolean {
-    try {
-        if (!clientVersion) return false;
-        if (!semver.valid(clientVersion)) return false;
-        return semver.gte(clientVersion, "1.16.0");
-    } catch {
-        return false;
-    }
-}

server/lib/ip.ts

@@ -5,7 +5,6 @@ import config from "@server/lib/config";
 import z from "zod";
 import logger from "@server/logger";
 import semver from "semver";
-import { createHash } from "crypto";
 import { getValidCertificatesForDomains } from "#dynamic/lib/certificates";
 import { lockManager } from "#dynamic/lib/lock";
 
@@ -649,101 +648,21 @@ export type SubnetProxyTargetV2 = {
     httpTargets?: HTTPTarget[];
     tlsCert?: string;
     tlsKey?: string;
-    tlsCertId?: string; // references an entry in the sync message's top-level `certs` array instead of inlining tlsCert/tlsKey
 };
 
-export type CertRef = { id: string; cert: string; key: string };
-
-/**
- * Replaces each target's inline tlsCert/tlsKey with a tlsCertId reference
- * into a deduplicated certs array, so that many targets sharing the same
- * certificate (e.g. a wildcard cert used by thousands of site resources)
- * only need that certificate sent once per sync message.
- */
-export function dedupeCertsForTargets(
-    targetsV2: SubnetProxyTargetV2[]
-): { targets: SubnetProxyTargetV2[]; certs: CertRef[] } {
-    const idByContent = new Map<string, string>();
-    const certs: CertRef[] = [];
-
-    const targets = targetsV2.map((target) => {
-        if (!target.tlsCert || !target.tlsKey) {
-            return target;
-        }
-
-        const contentKey = `${target.tlsCert}|${target.tlsKey}`;
-        let id = idByContent.get(contentKey);
-        if (!id) {
-            id = createHash("sha1").update(contentKey).digest("hex").slice(0, 16);
-            idByContent.set(contentKey, id);
-            certs.push({ id, cert: target.tlsCert, key: target.tlsKey });
-        }
-
-        const { tlsCert, tlsKey, ...rest } = target;
-        return { ...rest, tlsCertId: id };
-    });
-
-    return { targets, certs };
-}
-
 export type HTTPTarget = {
     destAddr: string; // must be an IP or hostname
     destPort: number;
     scheme: "http" | "https";
 };
 
-export type CertByDomain = Map<string, { certFile: string; keyFile: string }>;
-
-/**
- * Fetches the TLS certificates for every enabled, SSL-enabled HTTP site
- * resource's fullDomain in a single batched call, instead of one call per
- * resource. Many resources commonly resolve to the very same certificate
- * (e.g. a wildcard covering the org's domain), so batching turns what would
- * be N concurrent DB/cache round-trips into one, and a lookup failure fails
- * loudly for the whole batch rather than silently dropping the cert on a
- * random subset of otherwise-identical resources under load.
- */
-export async function batchFetchCertsForSiteResources(
-    allSiteResources: SiteResource[]
-): Promise<CertByDomain> {
-    const domains = new Set(
-        allSiteResources
-            .filter((r) => r.enabled && r.mode === "http" && r.ssl && r.fullDomain)
-            .map((r) => r.fullDomain as string)
-    );
-
-    const certByDomain: CertByDomain = new Map();
-    if (domains.size === 0) {
-        return certByDomain;
-    }
-
-    try {
-        const certResults = await getValidCertificatesForDomains(domains, true);
-        for (const cert of certResults) {
-            if (cert.certFile && cert.keyFile) {
-                certByDomain.set(cert.queriedDomain, {
-                    certFile: cert.certFile,
-                    keyFile: cert.keyFile
-                });
-            }
-        }
-    } catch (err) {
-        logger.error(
-            `Failed to batch-retrieve certificates for ${domains.size} domain(s): ${err}`
-        );
-    }
-
-    return certByDomain;
-}
-
 export async function generateSubnetProxyTargetV2(
     siteResource: SiteResource,
     clients: {
         clientId: number;
         pubKey: string | null;
         subnet: string | null;
-    }[],
+    }[]
-    certByDomain?: CertByDomain
 ): Promise<SubnetProxyTargetV2[] | undefined> {
     if (!siteResource.enabled) {
         logger.debug(
@@ -831,40 +750,23 @@ export async function generateSubnetProxyTargetV2(
         let tlsKey: string | undefined;
 
         if (siteResource.ssl && siteResource.fullDomain) {
-            if (certByDomain) {
+            try {
-                // Caller batch-fetched certs for all resources up front (the
+                const certs = await getValidCertificatesForDomains(
-                // common, high-scale path) — just look up this resource's
+                    new Set([siteResource.fullDomain]),
-                // domain rather than issuing its own DB/cache round-trip.
+                    true
-                const cert = certByDomain.get(siteResource.fullDomain);
+                );
-                if (cert) {
+                if (certs.length > 0 && certs[0].certFile && certs[0].keyFile) {
-                    tlsCert = cert.certFile;
+                    tlsCert = certs[0].certFile;
-                    tlsKey = cert.keyFile;
+                    tlsKey = certs[0].keyFile;
                 } else {
                     logger.warn(
                         `No valid certificate found for SSL site resource ${siteResource.siteResourceId} with domain ${siteResource.fullDomain}`
                     );
                 }
-            } else {
+            } catch (err) {
-                // No batched map supplied by the caller — fall back to a
+                logger.error(
-                // single-domain lookup for this resource alone.
+                    `Failed to retrieve certificate for site resource ${siteResource.siteResourceId} domain ${siteResource.fullDomain}: ${err}`
-                try {
+                );
-                    const certs = await getValidCertificatesForDomains(
-                        new Set([siteResource.fullDomain]),
-                        true
-                    );
-                    if (certs.length > 0 && certs[0].certFile && certs[0].keyFile) {
-                        tlsCert = certs[0].certFile;
-                        tlsKey = certs[0].keyFile;
-                    } else {
-                        logger.warn(
-                            `No valid certificate found for SSL site resource ${siteResource.siteResourceId} with domain ${siteResource.fullDomain}`
-                        );
-                    }
-                } catch (err) {
-                    logger.error(
-                        `Failed to retrieve certificate for site resource ${siteResource.siteResourceId} domain ${siteResource.fullDomain}: ${err}`
-                    );
-                }
             }
         }
 

server/lib/statusHistory.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { db, logsDb, statusHistory } from "@server/db";
-import { and, eq, gte, lt, asc, desc } from "drizzle-orm";
+import { and, eq, gte, lt, asc, desc, inArray, max, sql } from "drizzle-orm";
 import { regionalCache as cache } from "#dynamic/lib/cache";
 
 const STATUS_HISTORY_CACHE_TTL = 60; // seconds
@@ -41,6 +41,7 @@ export async function getCachedStatusHistory(
         return cached;
     }
 
+    console.time(`[getCachedStatusHistory/${entityType}=${entityId}]`);
     // Anchor to local midnight (UTC when tzOffsetMinutes is 0) so the query
     // window aligns with stable calendar days for the requesting client
     const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
@@ -76,12 +77,14 @@ export async function getCachedStatusHistory(
 
     const priorStatus = lastKnownEvent?.status ?? null;
 
+    console.time(`[computeBuckets/${entityType}=${entityId}]`);
     const { buckets, totalDowntime } = computeBuckets(
         events,
         days,
         priorStatus,
         tzOffsetMinutes
     );
+    console.timeEnd(`[computeBuckets/${entityType}=${entityId}]`);
     const totalWindow = days * 86400;
     const overallUptime =
         totalWindow > 0
@@ -96,6 +99,7 @@ export async function getCachedStatusHistory(
         totalDowntimeSeconds: totalDowntime
     };
 
+    console.timeEnd(`[getCachedStatusHistory/${entityType}=${entityId}]`);
     await cache.set(cacheKey, result, STATUS_HISTORY_CACHE_TTL);
     return result;
 }
@@ -264,9 +268,7 @@ export function computeBuckets(
 
         // Shift by the client's offset before formatting so the label reflects
         // their local calendar date rather than the UTC date of dayStartSec
-        const dateStr = new Date(
+        const dateStr = new Date((dayStartSec + tzOffsetMinutes * 60) * 1000)
-            (dayStartSec + tzOffsetMinutes * 60) * 1000
-        )
             .toISOString()
             .slice(0, 10);
 
@@ -301,6 +303,133 @@ export function computeBuckets(
             status
         });
     }
-
     return { buckets, totalDowntime };
 }
+
+export type BatchedStatusHistoryResponse = Record<
+    string,
+    StatusHistoryResponse
+>;
+
+export async function getBatchedStatusHistory(
+    entityType: string,
+    entityIds: number[],
+    days: number,
+    tzOffsetMinutes: number = 0
+): Promise<BatchedStatusHistoryResponse> {
+    console.time(
+        `[getBatchedStatusHistory/${entityType}=(${entityIds.join(" ,")})]`
+    );
+
+    // Anchor to local midnight (UTC when tzOffsetMinutes is 0) so the query
+    // window aligns with stable calendar days for the requesting client
+    const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
+    const startSec = todayMidnightSec - days * 86400;
+
+    const events = await logsDb
+        .select()
+        .from(statusHistory)
+        .where(
+            and(
+                eq(statusHistory.entityType, entityType),
+                inArray(statusHistory.entityId, entityIds),
+                gte(statusHistory.timestamp, startSec)
+            )
+        )
+        .orderBy(asc(statusHistory.timestamp));
+
+    // Fetch the last known state before the window so that entities that
+    // haven't changed status recently still show the correct status rather
+    // than appearing as "no_data".
+
+    /**
+     * If we used only postgres, we would have used `SELECT DISTINCT ON` to get the
+     * latest event for each `entityId`,
+     * but it doesn't work on SQLite, so instead we use a subquery,
+     * the `ROW_NUMBER() OVER PARTITION` allows to assign a number
+     * to each row ordered by the timestamp, the number 1 is the first one appearing in
+     * the specified order, then the next and more, we only want the highest timestamp,
+     * so we get for `row_number=1`
+     */
+    const lastKnowEventsSub = logsDb
+        .select({
+            entityId: statusHistory.entityId,
+            status: statusHistory.status,
+            timestamp: statusHistory.timestamp,
+            row_number:
+                sql<number>`ROW_NUMBER() OVER (PARTITION BY ${statusHistory.entityId} ORDER BY ${statusHistory.timestamp} DESC)`.as(
+                    "row_number"
+                )
+        })
+        .from(statusHistory)
+        .where(
+            and(
+                eq(statusHistory.entityType, entityType),
+                inArray(statusHistory.entityId, entityIds),
+                lt(statusHistory.timestamp, startSec)
+            )
+        )
+        .as("sub");
+
+    const lastKnownEvents = await logsDb
+        .select({
+            entityId: lastKnowEventsSub.entityId,
+            status: lastKnowEventsSub.status,
+            timestamp: lastKnowEventsSub.timestamp
+        })
+        .from(lastKnowEventsSub)
+        .where(eq(lastKnowEventsSub.row_number, 1));
+
+    const eventStatusMap: Record<
+        number,
+        {
+            events: typeof events;
+            lastKnownEvent: (typeof lastKnownEvents)[number] | null;
+        }
+    > = {};
+
+    for (const entityId of entityIds) {
+        eventStatusMap[entityId] = {
+            events: events.filter((ev) => ev.entityId === entityId),
+            lastKnownEvent:
+                lastKnownEvents.find((ev) => ev.entityId === entityId) ?? null
+        };
+    }
+
+    const result: BatchedStatusHistoryResponse = {};
+
+    console.time(`[computeBuckets/${entityType}=(${entityIds.join(" ,")})]`);
+    for (const entityId in eventStatusMap) {
+        const event = eventStatusMap[Number(entityId)];
+        const priorStatus = event.lastKnownEvent?.status ?? null;
+
+        const { buckets, totalDowntime } = computeBuckets(
+            event.events,
+            days,
+            priorStatus,
+            tzOffsetMinutes
+        );
+        const totalWindow = days * 86400;
+        const overallUptime =
+            totalWindow > 0
+                ? Math.max(
+                      0,
+                      ((totalWindow - totalDowntime) / totalWindow) * 100
+                  )
+                : 100;
+
+        result[entityId] = {
+            entityType,
+            entityId: Number(entityId),
+            days: buckets,
+            overallUptimePercent: Math.round(overallUptime * 100) / 100,
+            totalDowntimeSeconds: totalDowntime
+        };
+    }
+    console.timeEnd(`[computeBuckets/${entityType}=(${entityIds.join(" ,")})]`);
+
+    console.timeEnd(
+        `[getBatchedStatusHistory/${entityType}=(${entityIds.join(" ,")})]`
+    );
+    return result;
+}

server/private/routers/certificates/getBatchedCertificates.ts

@@ -0,0 +1,190 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+import { certificates, db, domains, orgDomains } from "@server/db";
+import response from "@server/lib/response";
+import logger from "@server/logger";
+import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
+import HttpCode from "@server/types/HttpCode";
+import { and, eq, inArray, or } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const getCertificateParamSchema = z.strictObject({
+    orgId: z.string()
+});
+
+const getCertificateQuerySchema = z.object({
+    domains: z.preprocess(
+        (val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            if (Array.isArray(val)) {
+                return val;
+            }
+            // the array is returned as this
+            if (typeof val === "string") {
+                return val.split(",");
+            }
+            return undefined;
+        },
+        z.array(z.string().min(1).max(255))
+    )
+});
+
+async function query(orgId: string, domainList: string[]) {
+    // Try to get CNAME certificates first
+    let existingCertificates = await db
+        .select({
+            certId: certificates.certId,
+            domain: certificates.domain,
+            wildcard: certificates.wildcard,
+            status: certificates.status,
+            expiresAt: certificates.expiresAt,
+            lastRenewalAttempt: certificates.lastRenewalAttempt,
+            createdAt: certificates.createdAt,
+            updatedAt: certificates.updatedAt,
+            errorMessage: certificates.errorMessage,
+            renewalCount: certificates.renewalCount,
+            domainId: domains.domainId,
+            domainType: domains.type
+        })
+        .from(certificates)
+        .innerJoin(domains, eq(certificates.domainId, domains.domainId))
+        .innerJoin(
+            orgDomains,
+            and(
+                eq(domains.domainId, orgDomains.domainId),
+                eq(orgDomains.orgId, orgId)
+            )
+        )
+        .where(and(inArray(certificates.domain, domainList)));
+
+    // All non resolved domain certificates might be `ns` or `wildcard`,
+    // which means exact domain certificates do not
+    const nonAvailableCertificates = existingCertificates
+        .filter((cert) => !domainList.includes(cert.domain))
+        .map((cert) => cert.domain);
+
+    if (nonAvailableCertificates.length > 0) {
+        const domainLevelDownSet = new Set<string>();
+        const wildcardDomainSet = new Set<string>();
+
+        for (const domain of nonAvailableCertificates) {
+            const domainLevelDown = domain.split(".").slice(1).join(".");
+            const wildcardPrefixed = `*.${domainLevelDown}`;
+            domainLevelDownSet.add(domainLevelDown);
+            wildcardDomainSet.add(wildcardPrefixed);
+        }
+
+        // Need to map the certificates to each domain
+        const wildcardCertificates = await db
+            .select({
+                certId: certificates.certId,
+                domain: certificates.domain,
+                wildcard: certificates.wildcard,
+                status: certificates.status,
+                expiresAt: certificates.expiresAt,
+                lastRenewalAttempt: certificates.lastRenewalAttempt,
+                createdAt: certificates.createdAt,
+                updatedAt: certificates.updatedAt,
+                errorMessage: certificates.errorMessage,
+                renewalCount: certificates.renewalCount,
+                domainId: domains.domainId,
+                domainType: domains.type
+            })
+            .from(certificates)
+            .innerJoin(domains, eq(certificates.domainId, domains.domainId))
+            .innerJoin(
+                orgDomains,
+                and(
+                    eq(domains.domainId, orgDomains.domainId),
+                    eq(orgDomains.orgId, orgId)
+                )
+            )
+            .where(
+                and(
+                    eq(certificates.wildcard, true),
+                    or(
+                        inArray(certificates.domain, [...domainLevelDownSet]),
+                        inArray(certificates.domain, [...wildcardDomainSet])
+                    )
+                )
+            );
+
+        existingCertificates.push(...wildcardCertificates);
+    }
+
+    const certificateMap: Record<string, any> = {};
+    for (const domain of domainList) {
+        const domainLevelDown = domain.split(".").slice(1).join(".");
+        const wildcardPrefixed = `*.${domainLevelDown}`;
+        certificateMap[domain] =
+            existingCertificates.find(
+                (cert) =>
+                    cert.domain === domain ||
+                    cert.domain === domainLevelDown ||
+                    cert.domain === wildcardPrefixed
+            ) ?? null;
+    }
+
+    return certificateMap;
+}
+
+export async function getBatchedCertificates(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = getCertificateParamSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+        const parsedQuery = getCertificateQuerySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+
+        const { domains } = parsedQuery.data;
+
+        const cert = await query(orgId, domains);
+
+        return response<GetBatchedCertificateResponse>(res, {
+            data: cert,
+            success: true,
+            error: false,
+            message: "Certificates retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/certificates/index.ts

@@ -14,3 +14,4 @@
 export * from "./getCertificate";
 export * from "./restartCertificate";
 export * from "./syncCertToNewts";
+export * from "./getBatchedCertificates";

server/private/routers/certificates/restartCertificate.ts

@@ -11,18 +11,16 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
 import { certificates, db } from "@server/db";
-import { sites } from "@server/db";
-import { eq, and } from "drizzle-orm";
 import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
 import logger from "@server/logger";
-import stoi from "@server/lib/stoi";
+import { registry } from "@server/openApi";
+import HttpCode from "@server/types/HttpCode";
+import { eq } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
 import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
 
 const restartCertificateParamsSchema = z.strictObject({
     certId: z.coerce.number().int().positive(),

server/private/routers/external.ts

@@ -175,6 +175,13 @@ authenticated.get(
     certificates.getCertificate
 );
 
+authenticated.get(
+    "/org/:orgId/batched-certificates",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.getCertificate),
+    certificates.getBatchedCertificates
+);
+
 authenticated.post(
     "/org/:orgId/certificate/:certId/restart",
     verifyValidLicense,
@@ -853,6 +860,14 @@ authenticated.get(
     healthChecks.getHealthCheckStatusHistory
 );
 
+authenticated.get(
+    "/org/:orgId/health-check-status-histories",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.getTarget),
+    healthChecks.getBatchedHealthCheckStatusHistory
+);
+
 authenticated.get(
     "/client/:clientId/verify-associations-cache",
     verifyClientAccess,

server/private/routers/healthChecks/getBatchedStatusHistory.ts

@@ -0,0 +1,96 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import response from "@server/lib/response";
+import {
+    getBatchedStatusHistory,
+    type BatchedStatusHistoryResponse
+} from "@server/lib/statusHistory";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const healthCheckIdParamsSchema = z.object({
+    days: z
+        .string()
+        .optional()
+        .transform((v) => (v ? parseInt(v, 10) : 90)),
+    // Minutes to add to UTC to get the requesting client's local time
+    // (e.g. Australia/Sydney standard time is 600). Optional and
+    // defaults to 0 (UTC) so older clients keep the prior behavior.
+    tzOffsetMinutes: z
+        .string()
+        .optional()
+        .transform((v) => (v ? parseInt(v, 10) : 0)),
+    healthCheckIds: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            const raw = Array.isArray(val) ? val : [val];
+            const nums = raw
+                .map((v) =>
+                    typeof v === "string" ? parseInt(v, 10) : Number(v)
+                )
+                .filter((n) => Number.isInteger(n) && n > 0);
+            const unique = [...new Set(nums)];
+            return unique.length ? unique : undefined;
+        }, z.array(z.number().int().positive()))
+        .openapi({
+            description: "Filter by healthCheckIds (repeat query param)"
+        })
+});
+
+export async function getBatchedHealthCheckStatusHistory(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = healthCheckIdParamsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+
+        const entityType = "health_check";
+        const { days, healthCheckIds, tzOffsetMinutes } = parsedQuery.data;
+
+        const data = await getBatchedStatusHistory(
+            entityType,
+            healthCheckIds,
+            days,
+            tzOffsetMinutes
+        );
+
+        return response<BatchedStatusHistoryResponse>(res, {
+            data,
+            success: true,
+            error: false,
+            message: "Status history retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/healthChecks/index.ts

@@ -16,3 +16,4 @@ export * from "./createHealthCheck";
 export * from "./updateHealthCheck";
 export * from "./deleteHealthCheck";
 export * from "./getStatusHistory";
+export * from "./getBatchedStatusHistory";

server/routers/certificates/types.ts

@@ -1,9 +1,11 @@
+import type { Domain } from "@server/db";
+
 export type GetCertificateResponse = {
     certId: number;
     domain: string;
     domainId: string;
     wildcard: boolean;
-    domainType: string;
+    domainType: Domain["type"];
     status: string; // pending, requested, valid, expired, failed
     expiresAt: string | null;
     lastRenewalAttempt: Date | null;
@@ -11,4 +13,9 @@ export type GetCertificateResponse = {
     updatedAt: number;
     errorMessage?: string | null;
     renewalCount: number;
-};
+};
+
+export type GetBatchedCertificateResponse = Record<
+    string,
+    GetCertificateResponse | null
+>;

server/routers/external.ts

@@ -319,6 +319,13 @@ authenticated.get(
     site.getSiteStatusHistory
 );
 
+authenticated.get(
+    "/org/:orgId/site-status-histories",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.listSites),
+    site.getBatchedSiteStatusHistory
+);
+
 // Site Resource endpoints
 authenticated.put(
     "/org/:orgId/site-resource",
@@ -469,6 +476,13 @@ authenticated.get(
     resource.getResourceStatusHistory
 );
 
+authenticated.get(
+    "/org/:orgId/resource-status-histories",
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.listResources),
+    resource.getBatchedResourceStatusHistory
+);
+
 authenticated.get(
     "/org/:orgId/resources",
     verifyOrgAccess,

server/routers/newt/buildConfiguration.ts

@@ -19,7 +19,6 @@ import { eq, and, inArray } from "drizzle-orm";
 import config from "@server/lib/config";
 import { decrypt } from "@server/lib/crypto";
 import {
-    batchFetchCertsForSiteResources,
     formatEndpoint,
     generateSubnetProxyTargetV2,
     SubnetProxyTargetV2
@@ -207,18 +206,11 @@ export async function buildClientConfigurationForNewtClient(
         });
     }
 
-    // Batch-fetch certs for every SSL-enabled HTTP resource's domain in one
-    // call rather than letting each resource fetch its own — with thousands
-    // of resources this avoids a concurrent DB/cache stampede for what is
-    // often the very same (e.g. wildcard) certificate.
-    const certByDomain = await batchFetchCertsForSiteResources(allSiteResources);
-
     const resourceTargetsArr = await Promise.all(
         allSiteResources.map((resource) =>
             generateSubnetProxyTargetV2(
                 resource,
-                clientsByResourceId.get(resource.siteResourceId) ?? [],
+                clientsByResourceId.get(resource.siteResourceId) ?? []
-                certByDomain
             )
         )
     );

server/routers/newt/certs.ts

@@ -1,75 +0,0 @@
-import { sendToClient } from "#dynamic/routers/ws";
-import logger from "@server/logger";
-import {
-    canCompress,
-    supportsCertReferences
-} from "@server/lib/clientVersionChecks";
-import { CertRef } from "@server/lib/ip";
-
-/**
- * Pushes an incremental set of certs to a newt client outside of a full
- * newt/sync or newt/wg/receive-config, e.g. after a certificate renewal so
- * that every target referencing it (by tlsCertId) picks up the new material
- * without waiting for the next full resync.
- */
-export async function sendCertsAdd(
-    newtId: string,
-    certs: CertRef[],
-    version?: string | null
-) {
-    if (certs.length === 0) {
-        return;
-    }
-
-    if (!supportsCertReferences(version)) {
-        logger.debug(
-            `Newt ${newtId} (version ${version}) does not support cert references, skipping certs/add`
-        );
-        return;
-    }
-
-    await sendToClient(
-        newtId,
-        {
-            type: "newt/certs/add",
-            data: certs
-        },
-        {
-            incrementConfigVersion: true,
-            compress: canCompress(version, "newt")
-        }
-    );
-}
-
-/**
- * Tells a newt client to drop the given cert IDs, e.g. once the server knows
- * no target references them anymore.
- */
-export async function sendCertsRemove(
-    newtId: string,
-    certIds: string[],
-    version?: string | null
-) {
-    if (certIds.length === 0) {
-        return;
-    }
-
-    if (!supportsCertReferences(version)) {
-        logger.debug(
-            `Newt ${newtId} (version ${version}) does not support cert references, skipping certs/remove`
-        );
-        return;
-    }
-
-    await sendToClient(
-        newtId,
-        {
-            type: "newt/certs/remove",
-            data: { ids: certIds }
-        },
-        {
-            incrementConfigVersion: true,
-            compress: canCompress(version, "newt")
-        }
-    );
-}

server/routers/newt/handleNewtGetConfigMessage.ts

@@ -7,11 +7,7 @@ import { eq } from "drizzle-orm";
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
 import { buildClientConfigurationForNewtClient } from "./buildConfiguration";
 import { convertTargetsIfNecessary } from "../client/targets";
-import {
+import { canCompress } from "@server/lib/clientVersionChecks";
-    canCompress,
-    supportsCertReferences
-} from "@server/lib/clientVersionChecks";
-import { dedupeCertsForTargets } from "@server/lib/ip";
 import config from "@server/lib/config";
 import { waitForSiteRebuildIdle } from "@server/lib/rebuildClientAssociations";
 
@@ -123,16 +119,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         exitNode
     );
 
-    // Older newt clients only understand inline tlsCert/tlsKey on each
+    const targetsToSend = await convertTargetsIfNecessary(newt.newtId, targets); // for backward compatibility with old newt versions that don't support the new target format
-    // target, so only switch to certId references once we know the client
-    // can resolve them.
-    let dedupedTargets = targets;
-    let certs: { id: string; cert: string; key: string }[] = [];
-    if (supportsCertReferences(newt.version)) {
-        ({ targets: dedupedTargets, certs } = dedupeCertsForTargets(targets));
-    }
-
-    const targetsToSend = await convertTargetsIfNecessary(newt.newtId, dedupedTargets); // for backward compatibility with old newt versions that don't support the new target format
 
     return {
         message: {
@@ -141,7 +128,6 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
                 ipAddress: site.address,
                 peers,
                 targets: targetsToSend,
-                certs,
                 chainId: chainId
             }
         },

server/routers/newt/sync.ts

@@ -6,11 +6,7 @@ import {
     buildClientConfigurationForNewtClient,
     buildTargetConfigurationForNewtClient
 } from "./buildConfiguration";
-import {
+import { canCompress } from "@server/lib/clientVersionChecks";
-    canCompress,
-    supportsCertReferences
-} from "@server/lib/clientVersionChecks";
-import { dedupeCertsForTargets } from "@server/lib/ip";
 
 export async function sendNewtSyncMessage(newt: Newt, site: Site) {
     const {
@@ -32,16 +28,6 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
         site,
         exitNode
     );
-
-    // Older newt clients only understand inline tlsCert/tlsKey on each
-    // target, so only switch to certId references once we know the client
-    // can resolve them.
-    let clientTargets = targets;
-    let certs: { id: string; cert: string; key: string }[] = [];
-    if (supportsCertReferences(newt.version)) {
-        ({ targets: clientTargets, certs } = dedupeCertsForTargets(targets));
-    }
-
     await sendToClient(
         newt.newtId,
         {
@@ -53,8 +39,7 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
                 },
                 healthCheckTargets: validHealthCheckTargets,
                 peers: peers,
-                clientTargets: clientTargets,
+                clientTargets: targets,
-                certs: certs,
                 browserGatewayTargets: browserGatewayTargets,
                 remoteExitNodeSubnets: remoteExitNodeSubnets
             }

server/routers/resource/getBatchedStatusHistory.ts

@@ -0,0 +1,83 @@
+import response from "@server/lib/response";
+import {
+    getBatchedStatusHistory,
+    type BatchedStatusHistoryResponse
+} from "@server/lib/statusHistory";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const resourceIdParamsSchema = z.object({
+    days: z
+        .string()
+        .optional()
+        .transform((v) => (v ? parseInt(v, 10) : 90)),
+    // Minutes to add to UTC to get the requesting client's local time
+    // (e.g. Australia/Sydney standard time is 600). Optional and
+    // defaults to 0 (UTC) so older clients keep the prior behavior.
+    tzOffsetMinutes: z
+        .string()
+        .optional()
+        .transform((v) => (v ? parseInt(v, 10) : 0)),
+    resourceIds: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            const raw = Array.isArray(val) ? val : [val];
+            const nums = raw
+                .map((v) =>
+                    typeof v === "string" ? parseInt(v, 10) : Number(v)
+                )
+                .filter((n) => Number.isInteger(n) && n > 0);
+            const unique = [...new Set(nums)];
+            return unique.length ? unique : undefined;
+        }, z.array(z.number().int().positive()))
+        .openapi({
+            description: "Filter by resourceIds (repeat query param)"
+        })
+});
+
+export async function getBatchedResourceStatusHistory(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = resourceIdParamsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+
+        const entityType = "resource";
+        const { days, resourceIds, tzOffsetMinutes } = parsedQuery.data;
+
+        const data = await getBatchedStatusHistory(
+            entityType,
+            resourceIds,
+            days,
+            tzOffsetMinutes
+        );
+
+        return response<BatchedStatusHistoryResponse>(res, {
+            data,
+            success: true,
+            error: false,
+            message: "Status history retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/index.ts

@@ -33,4 +33,5 @@ export * from "./removeUserFromResource";
 export * from "./listAllResourceNames";
 export * from "./removeEmailFromResourceWhitelist";
 export * from "./getStatusHistory";
+export * from "./getBatchedStatusHistory";
 export * from "./getResourcePolicies";

server/routers/site/getBatchedStatusHistory.ts

@@ -0,0 +1,83 @@
+import response from "@server/lib/response";
+import {
+    getBatchedStatusHistory,
+    type BatchedStatusHistoryResponse
+} from "@server/lib/statusHistory";
+import logger from "@server/logger";
+import HttpCode from "@server/types/HttpCode";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+
+const siteIdParamsSchema = z.object({
+    days: z
+        .string()
+        .optional()
+        .transform((v) => (v ? parseInt(v, 10) : 90)),
+    // Minutes to add to UTC to get the requesting client's local time
+    // (e.g. Australia/Sydney standard time is 600). Optional and
+    // defaults to 0 (UTC) so older clients keep the prior behavior.
+    tzOffsetMinutes: z
+        .string()
+        .optional()
+        .transform((v) => (v ? parseInt(v, 10) : 0)),
+    siteIds: z
+        .preprocess((val) => {
+            if (val === undefined || val === null || val === "") {
+                return undefined;
+            }
+            const raw = Array.isArray(val) ? val : [val];
+            const nums = raw
+                .map((v) =>
+                    typeof v === "string" ? parseInt(v, 10) : Number(v)
+                )
+                .filter((n) => Number.isInteger(n) && n > 0);
+            const unique = [...new Set(nums)];
+            return unique.length ? unique : undefined;
+        }, z.array(z.number().int().positive()))
+        .openapi({
+            description: "Filter by siteIds (repeat query param)"
+        })
+});
+
+export async function getBatchedSiteStatusHistory(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = siteIdParamsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+
+        const entityType = "site";
+        const { days, siteIds, tzOffsetMinutes } = parsedQuery.data;
+
+        const data = await getBatchedStatusHistory(
+            entityType,
+            siteIds,
+            days,
+            tzOffsetMinutes
+        );
+
+        return response<BatchedStatusHistoryResponse>(res, {
+            data,
+            success: true,
+            error: false,
+            message: "Status history retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/site/index.ts

@@ -1,5 +1,6 @@
 export * from "./getSite";
 export * from "./getStatusHistory";
+export * from "./getBatchedStatusHistory";
 export * from "./createSite";
 export * from "./deleteSite";
 export * from "./updateSite";

src/components/HealthChecksTable.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import UptimeMiniBar from "@app/components/UptimeMiniBar";
+import { UptimeMiniBar } from "@app/components/UptimeMiniBar";
 
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import HealthCheckCredenza, {
@@ -51,6 +51,8 @@ import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { cn } from "@app/lib/cn";
 import { dataTableFilterPopoverContentClassName } from "@app/lib/dataTableFilterPopover";
+import { orgQueries } from "@app/lib/queries";
+import { useQuery } from "@tanstack/react-query";
 
 type StandaloneHealthChecksTableProps = {
     orgId: string;
@@ -81,6 +83,8 @@ function formatTarget(row: HealthCheckRow): string {
     return `${scheme}://${host}${port}${path}`;
 }
 
+const HEALTH_CHECK_STATUS_HISTORY_DAYS = 30;
+
 export default function HealthChecksTable({
     orgId,
     healthChecks,
@@ -157,6 +161,20 @@ export default function HealthChecksTable({
 
     const rows = healthChecks;
 
+    const healthCheckIds = useMemo(
+        () => rows.map((r) => r.targetHealthCheckId),
+        [rows]
+    );
+
+    const statusHistoryQuery = useQuery({
+        ...orgQueries.batchedHealthCheckStatusHistory({
+            orgId,
+            healthCheckIds,
+            days: HEALTH_CHECK_STATUS_HISTORY_DAYS
+        }),
+        enabled: healthCheckIds.length > 0
+    });
+
     function refreshList() {
         startRefresh(() => {
             router.refresh();
@@ -547,9 +565,13 @@ export default function HealthChecksTable({
             cell: ({ row }) => {
                 return (
                     <UptimeMiniBar
-                        orgId={orgId}
+                        isLoading={statusHistoryQuery.isLoading}
-                        healthCheckId={row.original.targetHealthCheckId}
+                        data={
-                        days={30}
+                            statusHistoryQuery.data?.[
+                                row.original.targetHealthCheckId
+                            ]
+                        }
+                        days={HEALTH_CHECK_STATUS_HISTORY_DAYS}
                     />
                 );
             }

src/components/PublicResourcesTable.tsx

@@ -31,10 +31,13 @@ import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { cn } from "@app/lib/cn";
 import { dataTableFilterPopoverContentClassName } from "@app/lib/dataTableFilterPopover";
+import { durationToMs } from "@app/lib/durationToMs";
+import { orgQueries } from "@app/lib/queries";
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
 import { build } from "@server/build";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { UpdateResourceResponse } from "@server/routers/resource";
+import { useQuery } from "@tanstack/react-query";
 import type { PaginationState } from "@tanstack/react-table";
 import { AxiosResponse } from "axios";
 import {
@@ -69,7 +72,7 @@ import { useDebouncedCallback } from "use-debounce";
 import z from "zod";
 import { ColumnFilterButton } from "./ColumnFilterButton";
 import { ControlledDataTable } from "./ui/controlled-data-table";
-import UptimeMiniBar from "./UptimeMiniBar";
+import { UptimeMiniBar } from "./UptimeMiniBar";
 import { type SelectedLabel } from "./labels-selector";
 import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
 import { useLocalLabels } from "@app/hooks/useLocalLabels";
@@ -127,6 +130,8 @@ const booleanSearchFilterSchema = z
     .optional()
     .catch(undefined);
 
+const RESOURCE_STATUS_HISTORY_DAYS = 30;
+
 export default function PublicResourcesTable({
     resources,
     orgId,
@@ -155,6 +160,35 @@ export default function PublicResourcesTable({
     const [isRefreshing, startTransition] = useTransition();
     const [isNavigatingToAddPage, startNavigation] = useTransition();
 
+    // Only http resources show an uptime bar, so don't ask for the others
+    const statusHistoryResourceIds = useMemo(
+        () => resources.filter((r) => r.mode === "http").map((r) => r.id),
+        [resources]
+    );
+
+    // Domain list
+    const resourceDomains = useMemo(
+        () => resources.map((r) => r.fullDomain).filter(Boolean) as string[],
+        [resources]
+    );
+
+    const statusHistoryQuery = useQuery({
+        ...orgQueries.batchedResourceStatusHistory({
+            orgId,
+            resourceIds: statusHistoryResourceIds,
+            days: RESOURCE_STATUS_HISTORY_DAYS
+        }),
+        enabled: statusHistoryResourceIds.length > 0
+    });
+
+    const domainCertificatesQuery = useQuery({
+        ...orgQueries.batchedDomainCertificates({
+            orgId,
+            domains: resourceDomains
+        }),
+        enabled: resourceDomains.length > 0
+    });
+
     const refreshData = () => {
         startTransition(() => {
             try {
@@ -407,7 +441,11 @@ export default function PublicResourcesTable({
                         return <span>-</span>;
                     }
                     return (
-                        <UptimeMiniBar resourceId={resourceRow.id} days={30} />
+                        <UptimeMiniBar
+                            isLoading={statusHistoryQuery.isLoading}
+                            data={statusHistoryQuery.data?.[resourceRow.id]}
+                            days={RESOURCE_STATUS_HISTORY_DAYS}
+                        />
                     );
                 }
             },
@@ -625,7 +663,13 @@ export default function PublicResourcesTable({
         ];
 
         return cols;
-    }, [orgId, t, searchParams]);
+    }, [
+        orgId,
+        t,
+        searchParams,
+        statusHistoryQuery.data,
+        statusHistoryQuery.isLoading
+    ]);
 
     function handleFilterChange(
         column: string,

src/components/ResourceAccessCertIndicator.tsx

@@ -22,6 +22,7 @@ type ResourceAccessCertIndicatorProps = {
     orgId: string;
     domainId: string;
     fullDomain: string;
+    initialCertValue?: any;
 };
 
 function getStatusColor(status: string) {

src/components/SitesTable.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import UptimeMiniBar from "@app/components/UptimeMiniBar";
+import { UptimeMiniBar } from "@app/components/UptimeMiniBar";
 
 import {
     Credenza,
@@ -52,12 +52,12 @@ import {
 } from "./ui/controlled-data-table";
 
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { durationToMs } from "@app/lib/durationToMs";
+import { orgQueries, productUpdatesQueries } from "@app/lib/queries";
+import { useQuery } from "@tanstack/react-query";
+import semver from "semver";
 import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
 import { LabelsTableCell } from "./LabelsTableCell";
-import { useQuery } from "@tanstack/react-query";
-import { productUpdatesQueries } from "@app/lib/queries";
-import semver from "semver";
 
 export type SiteRow = {
     id: number;
@@ -89,6 +89,8 @@ type SitesTableProps = {
     rowCount: number;
 };
 
+const SITE_STATUS_HISTORY_DAYS = 30;
+
 export default function SitesTable({
     sites,
     orgId,
@@ -112,7 +114,16 @@ export default function SitesTable({
     const [isRefreshing, startTransition] = useTransition();
     const [isNavigatingToAddPage, startNavigation] = useTransition();
 
-    const { isPaidUser } = usePaidStatus();
+    const siteIds = sites.map((s) => s.id);
+
+    const statusHistoryQuery = useQuery({
+        ...orgQueries.batchedSiteStatusHistory({
+            orgId,
+            siteIds,
+            days: SITE_STATUS_HISTORY_DAYS
+        }),
+        enabled: siteIds.length > 0
+    });
 
     const api = createApiClient(useEnvContext());
     const t = useTranslations();
@@ -296,7 +307,14 @@ export default function SitesTable({
                     if (originalRow.type == "local") {
                         return <span>-</span>;
                     }
-                    return <UptimeMiniBar siteId={originalRow.id} days={30} />;
+                    const data = statusHistoryQuery.data?.[row.original.id];
+                    return (
+                        <UptimeMiniBar
+                            isLoading={statusHistoryQuery.isLoading}
+                            data={data}
+                            days={SITE_STATUS_HISTORY_DAYS}
+                        />
+                    );
                 }
             },
             {
@@ -359,14 +377,11 @@ export default function SitesTable({
                 cell: ({ row }) => {
                     const originalRow = row.original;
 
-                    let updateAvailable = Boolean(
+                    const updateAvailable = Boolean(
                         latestNewtVersion &&
-                            originalRow.newtVersion &&
+                        originalRow.newtVersion &&
-                            semver.valid(originalRow.newtVersion) &&
+                        semver.valid(originalRow.newtVersion) &&
-                            semver.lt(
+                        semver.lt(originalRow.newtVersion, latestNewtVersion)
-                                originalRow.newtVersion,
-                                latestNewtVersion
-                            )
                     );
 
                     if (originalRow.type === "newt") {

src/components/UptimeMiniBar.tsx

@@ -1,15 +1,14 @@
 "use client";
 
-import { useQuery } from "@tanstack/react-query";
-import { orgQueries } from "@app/lib/queries";
 import {
     Tooltip,
     TooltipContent,
     TooltipTrigger
 } from "@app/components/ui/tooltip";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { createApiClient } from "@app/lib/api";
 import { cn } from "@app/lib/cn";
+import { orgQueries } from "@app/lib/queries";
+import type { StatusHistoryResponse } from "@server/lib/statusHistory";
+import { useQuery } from "@tanstack/react-query";
 import { useTranslations } from "next-intl";
 
 function formatDuration(seconds: number): string {
@@ -46,21 +45,16 @@ type UptimeMiniBarProps = {
     days?: number;
 };
 
-export default function UptimeMiniBar({
+export default function UptimeMiniBarWrapper({
     orgId,
     siteId,
     resourceId,
     healthCheckId,
     days = 30
 }: UptimeMiniBarProps) {
-    const t = useTranslations();
-    const api = createApiClient(useEnvContext());
-
     const siteQuery = useQuery({
         ...orgQueries.siteStatusHistory({ siteId: siteId ?? 0, days }),
-        enabled: siteId != null,
+        enabled: siteId != null
-        meta: { api },
-        staleTime: 5 * 60 * 1000
     });
 
     const hcQuery = useQuery({
@@ -69,16 +63,12 @@ export default function UptimeMiniBar({
             healthCheckId: healthCheckId ?? 0,
             days
         }),
-        enabled: healthCheckId != null && siteId == null && resourceId == null,
+        enabled: healthCheckId != null && siteId == null && resourceId == null
-        meta: { api },
-        staleTime: 5 * 60 * 1000
     });
 
     const resourceQuery = useQuery({
         ...orgQueries.resourceStatusHistory({ resourceId, days }),
-        enabled: resourceId != null && siteId == null && healthCheckId == null,
+        enabled: resourceId != null && siteId == null && healthCheckId == null
-        meta: { api },
-        staleTime: 5 * 60 * 1000
     });
 
     const { data, isLoading } =
@@ -88,6 +78,22 @@ export default function UptimeMiniBar({
               ? resourceQuery
               : hcQuery;
 
+    return <UptimeMiniBar data={data} isLoading={isLoading} days={days} />;
+}
+
+type UptimeMiniBarUIProps = {
+    data?: StatusHistoryResponse;
+    isLoading?: boolean;
+    days?: number;
+};
+
+export function UptimeMiniBar({
+    data,
+    isLoading,
+    days = 30
+}: UptimeMiniBarUIProps) {
+    const t = useTranslations();
+
     if (isLoading) {
         return (
             <div className="flex items-center gap-2">
@@ -138,7 +144,8 @@ export default function UptimeMiniBar({
                                 {formatDate(day.date)}
                             </div>
                             <div className="text-xs text-primary-foreground/80">
-                                {day.status === "no_data" || day.status === "unknown"
+                                {day.status === "no_data" ||
+                                day.status === "unknown"
                                     ? t("uptimeNoData")
                                     : `${day.uptimePercent.toFixed(1)}% ${t("uptimeSuffix")}`}
                             </div>
@@ -159,4 +166,4 @@ export default function UptimeMiniBar({
             </span>
         </div>
     );
-}
+}

src/hooks/useCertificate.ts

@@ -5,6 +5,8 @@ import { AxiosResponse } from "axios";
 import { GetCertificateResponse } from "@server/routers/certificates/types";
 import { createApiClient } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useQuery } from "@tanstack/react-query";
+import { domainQueries } from "@app/lib/queries";
 
 type UseCertificateProps = {
     orgId: string;
@@ -13,6 +15,7 @@ type UseCertificateProps = {
     autoFetch?: boolean;
     polling?: boolean;
     pollingInterval?: number;
+    initialCertValue?: GetCertificateResponse | null;
 };
 
 type UseCertificateReturn = {
@@ -22,51 +25,63 @@ type UseCertificateReturn = {
     refreshing: boolean;
     fetchCert: (showLoading?: boolean) => Promise<void>;
     refreshCert: () => Promise<void>;
-    clearCert: () => void;
+    // clearCert: () => void;
 };
 
 export function useCertificate({
     orgId,
     domainId,
     fullDomain,
+    initialCertValue = null,
     autoFetch = true,
     polling = false,
     pollingInterval = 5000
 }: UseCertificateProps): UseCertificateReturn {
     const api = createApiClient(useEnvContext());
 
-    const [cert, setCert] = useState<GetCertificateResponse | null>(null);
+    // const [cert, setCert] = useState<GetCertificateResponse | null>(
-    const [certLoading, setCertLoading] = useState(false);
+    //     initialCertValue
+    // );
+    // const [certLoading, setCertLoading] = useState(false);
     const [certError, setCertError] = useState<string | null>(null);
     const [refreshing, setRefreshing] = useState(false);
 
-    const fetchCert = useCallback(
+    const query = useQuery({
-        async (showLoading = true) => {
+        ...domainQueries.getCertificate({
-            if (!orgId || !domainId || !fullDomain) return;
+            orgId,
+            domainId,
+            domain: fullDomain
+        }),
+        initialData: initialCertValue
+    });
 
-            if (showLoading) {
+    // const fetchCert = useCallback(
-                setCertLoading(true);
+    //     async (showLoading = true) => {
-            }
+    //         if (!orgId || !domainId || !fullDomain) return;
-            try {
+
-                const res = await api.get<
+    //         if (showLoading) {
-                    AxiosResponse<GetCertificateResponse>
+    //             setCertLoading(true);
-                >(`/org/${orgId}/certificate/${domainId}/${fullDomain}`);
+    //         }
-                const certData = res.data.data;
+    //         try {
-                if (certData) {
+    //             const res = await api.get<
-                    setCertError(null);
+    //                 AxiosResponse<GetCertificateResponse>
-                    setCert(certData);
+    //             >(`/org/${orgId}/certificate/${domainId}/${fullDomain}`);
-                }
+    //             const certData = res.data.data;
-            } catch (error: any) {
+    //             if (certData) {
-                console.error("Failed to fetch certificate:", error);
+    //                 setCertError(null);
-                setCertError("Failed");
+    //                 setCert(certData);
-            } finally {
+    //             }
-                if (showLoading) {
+    //         } catch (error: any) {
-                    setCertLoading(false);
+    //             console.error("Failed to fetch certificate:", error);
-                }
+    //             setCertError("Failed");
-            }
+    //         } finally {
-        },
+    //             if (showLoading) {
-        [api, orgId, domainId, fullDomain]
+    //                 setCertLoading(false);
-    );
+    //             }
+    //         }
+    //     },
+    //     [api, orgId, domainId, fullDomain]
+    // );
 
     const refreshCert = useCallback(async () => {
         if (!cert) return;
@@ -96,11 +111,11 @@ export function useCertificate({
     }, []);
 
     // Auto-fetch on mount if enabled
-    useEffect(() => {
+    // useEffect(() => {
-        if (autoFetch && orgId && domainId && fullDomain) {
+    //     if (autoFetch && orgId && domainId && fullDomain) {
-            fetchCert();
+    //         fetchCert();
-        }
+    //     }
-    }, [autoFetch, orgId, domainId, fullDomain, fetchCert]);
+    // }, [autoFetch, orgId, domainId, fullDomain, fetchCert]);
 
     useEffect(() => {
         if (!polling || !orgId || !domainId || !fullDomain) return;
@@ -132,12 +147,12 @@ export function useCertificate({
     }, [polling, orgId, domainId, fullDomain, pollingInterval, fetchCert]);
 
     return {
-        cert,
+        cert: query.data,
-        certLoading,
+        certLoading: query.isLoading,
         certError,
         refreshing,
-        fetchCert,
+        fetchCert: query.refetch,
-        refreshCert,
+        refreshCert
-        clearCert
+        // clearCert
     };
 }

src/hooks/useOptimisticLabels.ts

@@ -95,10 +95,7 @@ export function useOptimisticLabels({
     }
 
     async function refresh() {
-        // Only refresh if the labels have been modified
+        router.refresh();
-        if (pendingActions.length > 0) {
-            router.refresh();
-        }
         setPendingActions([]);
     }
 

src/lib/queries.ts

@@ -47,7 +47,10 @@ import { remote } from "./api";
 import { durationToMs } from "./durationToMs";
 import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
 import { ListHealthChecksResponse } from "@server/routers/healthChecks/types";
-import { StatusHistoryResponse } from "@server/lib/statusHistory";
+import {
+    StatusHistoryResponse,
+    type BatchedStatusHistoryResponse
+} from "@server/lib/statusHistory";
 import type { ListResourcePoliciesResponse } from "@server/routers/resource/types";
 import type { GetResourcePolicyResponse } from "@server/routers/policy";
 import type {
@@ -66,6 +69,7 @@ import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getRe
 import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
 import type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 import { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
+import type { GetCertificateResponse } from "@server/routers/certificates/types";
 
 export type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 export { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
@@ -640,6 +644,143 @@ export const orgQueries = {
                 };
             }
         }),
+    batchedSiteStatusHistory: ({
+        siteIds,
+        orgId,
+        days = 90
+    }: {
+        orgId: string;
+        siteIds: number[];
+        days?: number;
+    }) =>
+        queryOptions({
+            queryKey: [
+                "ORG",
+                orgId,
+                "BATCHED_SITE_STATUS_HISTORY",
+                siteIds,
+                days
+            ] as const,
+            queryFn: async ({ signal, meta }) => {
+                // Negated because getTimezoneOffset() returns UTC - local,
+                // while the API expects minutes to add to UTC to get local
+                const tzOffsetMinutes = -new Date().getTimezoneOffset();
+                const sp = new URLSearchParams([
+                    ["days", days.toString()],
+                    ["tzOffsetMinutes", tzOffsetMinutes.toString()],
+                    ...siteIds.map((id) => ["siteIds", id.toString()])
+                ]);
+
+                const res = await meta!.api.get<
+                    AxiosResponse<BatchedStatusHistoryResponse>
+                >(`/org/${orgId}/site-status-histories?${sp.toString()}`, {
+                    signal
+                });
+                return res.data.data;
+            },
+            staleTime: durationToMs(5, "seconds")
+        }),
+    batchedHealthCheckStatusHistory: ({
+        healthCheckIds,
+        orgId,
+        days = 90
+    }: {
+        orgId: string;
+        healthCheckIds: number[];
+        days?: number;
+    }) =>
+        queryOptions({
+            queryKey: [
+                "ORG",
+                orgId,
+                "BATCHED_HEALTH_CHECK_STATUS_HISTORY",
+                healthCheckIds,
+                days
+            ] as const,
+            queryFn: async ({ signal, meta }) => {
+                // Negated because getTimezoneOffset() returns UTC - local,
+                // while the API expects minutes to add to UTC to get local
+                const tzOffsetMinutes = -new Date().getTimezoneOffset();
+                const sp = new URLSearchParams([
+                    ["days", days.toString()],
+                    ["tzOffsetMinutes", tzOffsetMinutes.toString()],
+                    ...healthCheckIds.map((id) => [
+                        "healthCheckIds",
+                        id.toString()
+                    ])
+                ]);
+
+                const res = await meta!.api.get<
+                    AxiosResponse<BatchedStatusHistoryResponse>
+                >(
+                    `/org/${orgId}/health-check-status-histories?${sp.toString()}`,
+                    { signal }
+                );
+                return res.data.data;
+            },
+            staleTime: durationToMs(5, "seconds")
+        }),
+    batchedDomainCertificates: ({
+        domains,
+        orgId
+    }: {
+        orgId: string;
+        domains: string[];
+    }) =>
+        queryOptions({
+            queryKey: ["ORG", orgId, "BATCHED_CERTIFICATES", domains] as const,
+            queryFn: async ({ signal, meta }) => {
+                // Negated because getTimezoneOffset() returns UTC - local,
+                // while the API expects minutes to add to UTC to get local
+                const sp = new URLSearchParams([
+                    ...domains.map((domain) => ["domains", domain.toString()])
+                ]);
+
+                const res = await meta!.api.get<
+                    AxiosResponse<BatchedStatusHistoryResponse>
+                >(`/org/${orgId}/batched-certificates?${sp.toString()}`, {
+                    signal
+                });
+                return res.data.data;
+            },
+            staleTime: durationToMs(5, "seconds")
+        }),
+    batchedResourceStatusHistory: ({
+        resourceIds,
+        orgId,
+        days = 90
+    }: {
+        orgId: string;
+        resourceIds: number[];
+        days?: number;
+    }) =>
+        queryOptions({
+            queryKey: [
+                "ORG",
+                orgId,
+                "BATCHED_RESOURCE_STATUS_HISTORY",
+                resourceIds,
+                days
+            ] as const,
+            queryFn: async ({ signal, meta }) => {
+                // Negated because getTimezoneOffset() returns UTC - local,
+                // while the API expects minutes to add to UTC to get local
+                const tzOffsetMinutes = -new Date().getTimezoneOffset();
+                const sp = new URLSearchParams([
+                    ["days", days.toString()],
+                    ["tzOffsetMinutes", tzOffsetMinutes.toString()],
+                    ...resourceIds.map((id) => ["resourceIds", id.toString()])
+                ]);
+
+                const res = await meta!.api.get<
+                    AxiosResponse<BatchedStatusHistoryResponse>
+                >(`/org/${orgId}/resource-status-histories?${sp.toString()}`, {
+                    signal
+                });
+                return res.data.data;
+            },
+            staleTime: durationToMs(5, "seconds")
+        }),
     siteStatusHistory: ({
         siteId,
         days = 90
@@ -649,6 +790,7 @@ export const orgQueries = {
     }) =>
         queryOptions({
             queryKey: ["SITE_STATUS_HISTORY", siteId, days] as const,
+            staleTime: durationToMs(5, "seconds"),
             queryFn: async ({ signal, meta }) => {
                 const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
@@ -670,6 +812,7 @@ export const orgQueries = {
     }) =>
         queryOptions({
             queryKey: ["RESOURCE_STATUS_HISTORY", resourceId, days] as const,
+            staleTime: durationToMs(5, "seconds"),
             queryFn: async ({ signal, meta }) => {
                 const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
@@ -692,6 +835,7 @@ export const orgQueries = {
         days?: number;
     }) =>
         queryOptions({
+            staleTime: durationToMs(5, "seconds"),
             queryKey: [
                 "HC_STATUS_HISTORY",
                 orgId,
@@ -1237,6 +1381,34 @@ export const approvalQueries = {
 };
 
 export const domainQueries = {
+    getCertificate: ({
+        orgId,
+        domainId,
+        domain
+    }: {
+        orgId: string;
+        domainId: string;
+        domain: string;
+    }) =>
+        queryOptions({
+            queryKey: [
+                "ORG",
+                orgId,
+                "DOMAIN",
+                domainId,
+                "CERTIFICATE"
+            ] as const,
+            queryFn: async ({ signal, meta }) => {
+                const res = await meta!.api.get<
+                    AxiosResponse<GetCertificateResponse | null>
+                >(`/org/${orgId}/certificate/${domainId}/${domain}`, {
+                    signal
+                });
+                if (res.status === 404) return null;
+                return res.data.data;
+            },
+            staleTime: durationToMs(1, "minutes")
+        }),
     getDomain: ({ orgId, domainId }: { orgId: string; domainId: string }) =>
         queryOptions({
             queryKey: ["ORG", orgId, "DOMAIN", domainId] as const,