@h-ai/reach 0.1.0-alpha.70 → 0.1.0-alpha.71

package/README.en.md

@@ -132,7 +132,7 @@ if (result.data.deferred) {
 }
 ```
 
-Queue columns `created_at`, `updated_at`, `locked_until`, and `next_attempt_at` store Unix milliseconds as `BIGINT` (64-bit `INTEGER` on SQLite). The Reach repository normalizes integer strings returned by drivers such as PostgreSQL into safe integer `number` values. Negative, fractional, or unsafe stored integers return `SEND_FAILED` instead of being silently rounded. Template creation/update `TIMESTAMP` fields map to `Date`. Update the complete table schema during deployment, including attempt counters, backoff policy, and failure classification; the framework does not migrate old tables automatically.
+Queue columns `created_at`, `updated_at`, `locked_until`, and `next_attempt_at` store Unix milliseconds as `BIGINT` (64-bit `INTEGER` on SQLite). The Reach repository normalizes integer strings returned by drivers such as PostgreSQL into safe integer `number` values. Negative, fractional, or unsafe stored integers return `SEND_FAILED` instead of being silently rounded. Template creation/update `TIMESTAMP` fields map to `Date`. Update the complete table schema during deployment, including attempt counters, backoff policy, and failure classification; module-owned versioned migrations handle supported legacy tables (below).
 
 #### Durable retry policy
 
@@ -211,6 +211,12 @@ Only the matching dead version is restored; concurrent/stale requests fail, and
 
 Production rejects console providers and requires SMTP, SMS or an actual API service. A log write is not a delivery receipt. Reconcile unknown outcomes from non-idempotent providers rather than claiming exactly-once delivery. Initialization checks apply when NODE_ENV or HAI_CORE_ENV is production; only explicit HAI_E2E=1/HAI_E2E_MOCK=1 tests are exempt. [State, concurrency and recovery (Chinese)](../../.agents/instructions/distributed-state.md)。
 
+## Credential notifications and upgrades
+
+Use `reach.send({ ..., sensitive: true, expiresAt, idempotencyKey })` for passwords, OTPs and reset tokens. expiresAt is Unix milliseconds; stable operation keys must contain no credentials. A shared ledger stores only metadata receipts/status and redacted destinations, never bodies, variables or credential hashes. There is no delayed credential queue. Success returns receiptId; DND/expired messages are not sent, and uncertain delivery is never automatically repeated. Explicit development console output is isolated from persistent observers. Production Console restrictions remain. Normal messages may use deferPolicy: reject to avoid a second queue.
+
+`migrateReach({ dryRun: true })` previews supported migrations, applied during repository initialization. Statuses/identifiers remain; legacy in-flight work becomes unknown. Legacy payloads are retired once and pending old payloads discarded. Back up and stop old writers before upgrading; never replay old credentials.
+
 ## Development and testing
 
 ```bash

package/README.ja.md

@@ -132,7 +132,7 @@ if (result.data.deferred) {
 }
 ```
 
-キューの `created_at`、`updated_at`、`locked_until`、`next_attempt_at` は Unix ミリ秒を `BIGINT`（SQLite では 64 ビット `INTEGER`）として保存します。Reach リポジトリーは PostgreSQL などのドライバーが返す整数文字列を安全な整数の `number` に変換します。負数、小数、JS の安全整数範囲外の保存値は丸めずに `SEND_FAILED` を返します。テンプレートの作成・更新 `TIMESTAMP` は `Date` に対応します。デプロイ時に試行回数・退避設定・失敗分類を含むテーブル構造も更新してください。旧テーブルの自動移行は行いません。
+キューの `created_at`、`updated_at`、`locked_until`、`next_attempt_at` は Unix ミリ秒を `BIGINT`（SQLite では 64 ビット `INTEGER`）として保存します。Reach リポジトリーは PostgreSQL などのドライバーが返す整数文字列を安全な整数の `number` に変換します。負数、小数、JS の安全整数範囲外の保存値は丸めずに `SEND_FAILED` を返します。テンプレートの作成・更新 `TIMESTAMP` は `Date` に対応します。デプロイ時に試行回数・退避設定・失敗分類を含むテーブル構造も更新してください。対応する旧表はモジュール所有のバージョン移行で更新します（下記）。
 
 #### 永続化された再試行設定
 
@@ -211,6 +211,12 @@ if (state.data?.status === 'dead' && state.data.updatedAt !== undefined) {
 
 本番は console を拒否し、実際の SMTP・SMS・API サービスを必要とします。ログ書込は配信完了ではありません。冪等でないサービスの未知結果は照合が必要で、exactly-once は保証しません。 NODE_ENV または HAI_CORE_ENV が production の場合、初期化成功前に検証します。明示的な HAI_E2E=1/HAI_E2E_MOCK=1 テストのみ除外します。 [状態・並行制御・復旧範囲（中国語）](../../.agents/instructions/distributed-state.md)。
 
+## 認証情報の通知と更新
+
+パスワード、OTP、リセットトークンは `reach.send({ ..., sensitive: true, expiresAt, idempotencyKey })` を使います。expiresAt は Unix ミリ秒、操作キーに秘密値を含めません。共有台帳は本文・変数・認証値のハッシュを保存せず、脱機密化した宛先と受領状態のみを保持します。遅延キューに入れず、DND/期限切れは送信せず、不明な配信を自動再送しません。成功時は receiptId を返します。明示した開発用コンソール出力は永続観測から分離し、本番 Console 制限は維持します。通常通知は deferPolicy: reject で二重キューを防げます。
+
+`migrateReach({ dryRun: true })` で事前確認し、リポジトリー初期化で対応する移行を実行します。状態と識別子を保持し、旧処理中は unknown、旧ペイロードは一度廃棄し、旧待機ペイロードは discarded にします。更新前は旧書込を停止しバックアップし、古い認証情報を再送しないでください。
+
 ## 開発とテスト
 
 ```bash

package/README.md

@@ -132,7 +132,7 @@ if (result.data.deferred) {
 }
 ```
 
-队列的 `created_at`、`updated_at`、`locked_until`、`next_attempt_at` 统一保存 Unix 毫秒，列类型为 `BIGINT`（SQLite 映射为 64 位 `INTEGER`）。Reach 仓库将 PostgreSQL 等驱动返回的整数字符串归一化为安全整数 `number`；负数、非整数及超出 JS 安全整数范围的存储值返回 `SEND_FAILED`，不会静默舍入。模板仓库的 `TIMESTAMP` 创建/更新时间映射为 `Date`。部署时须同步表结构，包括次数、退避策略和失败分类列；框架不自动迁移旧表。
+队列的 `created_at`、`updated_at`、`locked_until`、`next_attempt_at` 统一保存 Unix 毫秒，列类型为 `BIGINT`（SQLite 映射为 64 位 `INTEGER`）。Reach 仓库将 PostgreSQL 等驱动返回的整数字符串归一化为安全整数 `number`；负数、非整数及超出 JS 安全整数范围的存储值返回 `SEND_FAILED`，不会静默舍入。模板仓库的 `TIMESTAMP` 创建/更新时间映射为 `Date`。部署时须同步表结构，包括次数、退避策略和失败分类列；旧表升级由模块维护的版本迁移负责，见下文。
 
 #### 可靠队列重试
 
@@ -211,6 +211,12 @@ if (state.data?.status === 'dead' && state.data.updatedAt !== undefined) {
 
 生产拒绝 console Provider，须配置真实 SMTP/短信/API 服务。console 的日志成功不是外部投递成功；非幂等服务的未知结果必须核对，不能自动重发证明 exactly-once。 NODE_ENV 或 HAI_CORE_ENV 为 production 时在初始化发布成功前校验；仅 HAI_E2E=1/HAI_E2E_MOCK=1 明确测试可豁免。 [状态、并发和恢复边界](../../.agents/instructions/distributed-state.md)。
 
+## 凭据通知与旧库升级
+
+发送密码、OTP 或重置令牌时使用 `reach.send({ ..., sensitive: true, expiresAt, idempotencyKey })`。expiresAt 是 Unix 毫秒，稳定操作键不可包含凭据。必须有共享发送账本：只持久化无载荷回执/状态，接收方脱敏，不存正文、变量或低熵凭据摘要，也不进入延迟队列。发送成功返回 receiptId；DND/过期不投递，异常或不明状态不自动重投。明确启用的开发控制台仍可显示业务允许的通知，持久采集观察器被隔离；生产 Console Provider 限制不变。普通通知可用 deferPolicy: reject 阻止二次排队。
+
+`migrateReach({ dryRun: true })` 预检；仓库初始化自动执行受支持步骤。升级保留发送状态与标识，旧在途转 unknown；旧正文/主题/模板变量/extra 一次性退役，待发旧载荷 discarded。生产需先备份停旧写入，不能恢复旧凭据重新投递。
+
 ## 开发测试
 
 ```bash

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 import { z } from 'zod';
 import * as _h_ai_core from '@h-ai/core';
 import { HaiResult } from '@h-ai/core';
+import * as _h_ai_reldb from '@h-ai/reldb';
+import { ReldbFunctions } from '@h-ai/reldb';
 
 /**
  * @h-ai/reach — 配置 Schema
@@ -411,6 +413,7 @@ declare const HaiReachError: {
     readonly UNSUPPORTED_TYPE: _h_ai_core.HaiErrorDef;
     readonly CONFIG_ERROR: _h_ai_core.HaiErrorDef;
     readonly DELIVERY_REJECTED: _h_ai_core.HaiErrorDef;
+    readonly MESSAGE_EXPIRED: _h_ai_core.HaiErrorDef;
 };
 /**
  * 渠道语义标签email/sms/api；消息路由实际使用配置中的Provider名称。
@@ -449,6 +452,12 @@ interface ReachMessage {
     extra?: Record<string, unknown>;
     /** API 接收端幂等键；直接发送可指定，队列投递固定使用持久化 queueId。 */
     idempotencyKey?: string;
+    /** 凭据通知只在内存中投递；正文、变量、收件人不持久化，不进入延迟或重投队列。 */
+    sensitive?: boolean;
+    /** sensitive=true 时必填的凭据截止时间（Unix 毫秒），不延长业务凭据有效期。 */
+    expiresAt?: number;
+    /** 遇到免打扰时交给 Reach 队列，或返回 DND_BLOCKED 让已有业务 outbox 延后；默认 queue。 */
+    deferPolicy?: 'queue' | 'reject';
 }
 /**
  * 发送或可靠入队结果；deferred=true只证明持久pending写入成功，queueId用于后续查询，不代表已送达。
@@ -480,6 +489,8 @@ interface ReachMessage {
  * ```
  */
 type SendResult = {
+    /** 无载荷凭据回执，可通过 queue.get 查询；不代表进入延迟队列。 */
+    receiptId?: string;
     /** 是否已完成 Provider 发送或可靠入队；具体状态同时检查 deferred。 */
     success: boolean;
     /** Provider 返回的消息 ID（如有） */
@@ -1298,4 +1309,16 @@ interface ReachFunctions extends SendOperations {
  */
 declare const reach: ReachFunctions;
 
-export { type AliyunSmsProviderConfig, AliyunSmsProviderConfigSchema, type ApiProviderConfig, ApiProviderConfigSchema, type ConsoleProviderConfig, ConsoleProviderConfigSchema, type DndConfig, DndConfigSchema, HaiReachError, type ProviderConfig, ProviderConfigSchema, type ReachChannel, type ReachConfig, type ReachConfigInput, ReachConfigSchema, type ReachDeadRequeue, ReachDeadRequeueSchema, type ReachFunctions, type ReachMessage, type ReachQueueConfig, ReachQueueConfigSchema, type ReachQueueEntry, type ReachQueueFailure, ReachQueueIdSchema, type ReachQueueListOptions, ReachQueueListSchema, type ReachQueueOperations, type ReachQueueStatus, type ReachTemplate, type ReachTemplateRegistry, type ReachUnknownResolution, ReachUnknownResolutionSchema, type RenderedTemplate, type SendOperations, type SendResult, type SmtpProviderConfig, SmtpProviderConfigSchema, type TemplateConfig, TemplateConfigSchema, reach };
+/**
+ * 预检或升级 Reach 队列。旧凭据相关载荷清除，待发凭据丢弃，保留发送状态和历史标识。
+ * @example
+ * ```ts
+ * import { migrateReach } from '@h-ai/reach'
+ * const plan = await migrateReach({ dryRun: true })
+ * ```
+ */
+declare function migrateReach(options?: {
+    dryRun?: boolean;
+}, db?: ReldbFunctions): Promise<_h_ai_core.HaiResult<_h_ai_reldb.SchemaMigrationPlan>>;
+
+export { type AliyunSmsProviderConfig, AliyunSmsProviderConfigSchema, type ApiProviderConfig, ApiProviderConfigSchema, type ConsoleProviderConfig, ConsoleProviderConfigSchema, type DndConfig, DndConfigSchema, HaiReachError, type ProviderConfig, ProviderConfigSchema, type ReachChannel, type ReachConfig, type ReachConfigInput, ReachConfigSchema, type ReachDeadRequeue, ReachDeadRequeueSchema, type ReachFunctions, type ReachMessage, type ReachQueueConfig, ReachQueueConfigSchema, type ReachQueueEntry, type ReachQueueFailure, ReachQueueIdSchema, type ReachQueueListOptions, ReachQueueListSchema, type ReachQueueOperations, type ReachQueueStatus, type ReachTemplate, type ReachTemplateRegistry, type ReachUnknownResolution, ReachUnknownResolutionSchema, type RenderedTemplate, type SendOperations, type SendResult, type SmtpProviderConfig, SmtpProviderConfigSchema, type TemplateConfig, TemplateConfigSchema, migrateReach, reach };

package/dist/index.js

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 import { core, err, ok } from '@h-ai/core';
 import process from 'process';
-import { reldb, BaseReldbCrudRepository } from '@h-ai/reldb';
-import { randomUUID, createHmac } from 'crypto';
+import { reldb, migrateSchema, schemaColumns, BaseReldbCrudRepository } from '@h-ai/reldb';
+import { randomUUID, createHash, createHmac } from 'crypto';
 import { createRequire } from 'module';
 import { cache } from '@h-ai/cache';
 
@@ -50,7 +50,10 @@ var en_US_default = {
   reach_templateDeleteFailed: "Template delete failed: {error}",
   reach_queueRetryInvalid: "maxRetryDelayMs must be at least retryDelayMs",
   reach_deadRequeueFailed: "Dead message changed or does not exist; reload its state before restoring",
-  reach_productionProviderRequired: "Production requires a delivery provider; console is available only in development or explicit test mode"
+  reach_productionProviderRequired: "Production requires a delivery provider; console is available only in development or explicit test mode",
+  reach_sensitivePolicyRequired: "Credential notifications require a database receipt, stable idempotency key and expiry",
+  reach_sensitiveDeliveryUnconfirmed: "Credential delivery is unconfirmed and will not be retried automatically. Check the receipt or request new credentials.",
+  reach_messageExpired: "The credentials expired before delivery"
 };
 
 // messages/ja-JP.json
@@ -95,7 +98,10 @@ var ja_JP_default = {
   reach_templateDeleteFailed: "\u30C6\u30F3\u30D7\u30EC\u30FC\u30C8\u306E\u524A\u9664\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
   reach_queueRetryInvalid: "maxRetryDelayMs \u306F retryDelayMs \u4EE5\u4E0A\u306B\u3057\u3066\u304F\u3060\u3055\u3044",
   reach_deadRequeueFailed: "\u914D\u4FE1\u4E0D\u80FD\u30E1\u30C3\u30BB\u30FC\u30B8\u304C\u5909\u66F4\u3055\u308C\u305F\u304B\u3001\u5B58\u5728\u3057\u307E\u305B\u3093\u3002\u5FA9\u5143\u3059\u308B\u524D\u306B\u72B6\u614B\u3092\u518D\u8AAD\u307F\u8FBC\u307F\u3057\u3066\u304F\u3060\u3055\u3044",
-  reach_productionProviderRequired: "\u672C\u756A\u74B0\u5883\u306B\u306F\u914D\u4FE1\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u304C\u5FC5\u8981\u3067\u3059\u3002console \u306F\u958B\u767A\u74B0\u5883\u307E\u305F\u306F\u660E\u793A\u7684\u306A\u30C6\u30B9\u30C8\u30E2\u30FC\u30C9\u3067\u306E\u307F\u4F7F\u7528\u3067\u304D\u307E\u3059"
+  reach_productionProviderRequired: "\u672C\u756A\u74B0\u5883\u306B\u306F\u914D\u4FE1\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u304C\u5FC5\u8981\u3067\u3059\u3002console \u306F\u958B\u767A\u74B0\u5883\u307E\u305F\u306F\u660E\u793A\u7684\u306A\u30C6\u30B9\u30C8\u30E2\u30FC\u30C9\u3067\u306E\u307F\u4F7F\u7528\u3067\u304D\u307E\u3059",
+  reach_sensitivePolicyRequired: "\u8A8D\u8A3C\u60C5\u5831\u306E\u901A\u77E5\u306B\u306F\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9\u306E\u53D7\u9818\u8A18\u9332\u3001\u56FA\u5B9A\u306E\u51AA\u7B49\u30AD\u30FC\u3068\u6709\u52B9\u671F\u9650\u304C\u5FC5\u8981\u3067\u3059",
+  reach_sensitiveDeliveryUnconfirmed: "\u8A8D\u8A3C\u60C5\u5831\u306E\u914D\u4FE1\u3092\u78BA\u8A8D\u3067\u304D\u307E\u305B\u3093\u3002\u81EA\u52D5\u518D\u9001\u305B\u305A\u3001\u53D7\u9818\u8A18\u9332\u306E\u78BA\u8A8D\u307E\u305F\u306F\u8A8D\u8A3C\u60C5\u5831\u306E\u518D\u767A\u884C\u304C\u5FC5\u8981\u3067\u3059\u3002",
+  reach_messageExpired: "\u8A8D\u8A3C\u60C5\u5831\u306E\u671F\u9650\u304C\u5207\u308C\u305F\u305F\u3081\u914D\u4FE1\u3057\u307E\u305B\u3093\u3067\u3057\u305F"
 };
 
 // messages/zh-CN.json
@@ -140,7 +146,10 @@ var zh_CN_default = {
   reach_templateDeleteFailed: "\u6A21\u677F\u5220\u9664\u5931\u8D25: {error}",
   reach_queueRetryInvalid: "maxRetryDelayMs \u4E0D\u80FD\u5C0F\u4E8E retryDelayMs",
   reach_deadRequeueFailed: "\u6B7B\u4FE1\u5DF2\u53D8\u5316\u6216\u4E0D\u5B58\u5728\uFF0C\u8BF7\u91CD\u65B0\u67E5\u8BE2\u540E\u6062\u590D",
-  reach_productionProviderRequired: "\u751F\u4EA7\u73AF\u5883\u5FC5\u987B\u914D\u7F6E\u771F\u5B9E\u89E6\u8FBE\u670D\u52A1\uFF1Bconsole \u4EC5\u53EF\u7528\u4E8E\u5F00\u53D1\u6216\u663E\u5F0F\u6D4B\u8BD5\u6A21\u5F0F"
+  reach_productionProviderRequired: "\u751F\u4EA7\u73AF\u5883\u5FC5\u987B\u914D\u7F6E\u771F\u5B9E\u89E6\u8FBE\u670D\u52A1\uFF1Bconsole \u4EC5\u53EF\u7528\u4E8E\u5F00\u53D1\u6216\u663E\u5F0F\u6D4B\u8BD5\u6A21\u5F0F",
+  reach_sensitivePolicyRequired: "\u51ED\u636E\u901A\u77E5\u9700\u8981\u6570\u636E\u5E93\u56DE\u6267\u3001\u7A33\u5B9A\u5E42\u7B49\u952E\u548C\u6709\u6548\u671F",
+  reach_sensitiveDeliveryUnconfirmed: "\u51ED\u636E\u6295\u9012\u5C1A\u672A\u786E\u8BA4\uFF1B\u4E0D\u4F1A\u81EA\u52A8\u91CD\u590D\u53D1\u9001\uFF0C\u8BF7\u67E5\u8BE2\u56DE\u6267\u6216\u7533\u8BF7\u65B0\u51ED\u636E",
+  reach_messageExpired: "\u51ED\u636E\u5DF2\u8FC7\u671F\uFF0C\u672A\u6295\u9012"
 };
 
 // src/reach-i18n.ts
@@ -272,7 +281,8 @@ var ReachErrorInfo = {
   NOT_INITIALIZED: "010:500",
   UNSUPPORTED_TYPE: "011:400",
   CONFIG_ERROR: "012:500",
-  DELIVERY_REJECTED: "020:422"
+  DELIVERY_REJECTED: "020:422",
+  MESSAGE_EXPIRED: "021:410"
 };
 var HaiReachError = core.error.buildHaiErrorsDef("reach", ReachErrorInfo);
 
@@ -427,7 +437,8 @@ function createApiProvider() {
           template: message.template,
           vars: message.vars,
           extra: message.extra,
-          idempotencyKey: message.idempotencyKey
+          idempotencyKey: message.idempotencyKey,
+          expiresAt: message.expiresAt
         };
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), apiConfig.timeout);
@@ -653,6 +664,66 @@ async function deliverClaimedMessage(row, owner, provider, repo, leaseMs = DEFAU
     return released;
   return err(HaiReachError.SEND_FAILED, reachM("reach_deliveryUnknown"), outcome.success ? void 0 : outcome.error);
 }
+function previousResult(row) {
+  return row.status === "sent" ? ok({ success: true, receiptId: row.queueId ?? void 0 }) : unconfirmed(row.queueId);
+}
+function unconfirmed(receiptId) {
+  return { success: false, error: { ...HaiReachError.SEND_FAILED, message: reachM("reach_sensitiveDeliveryUnconfirmed"), ext: { receiptId } } };
+}
+async function sendSensitive(message, provider, repo, blocked) {
+  if (!repo || !message.idempotencyKey?.trim() || message.idempotencyKey.length > 255 || !Number.isSafeInteger(message.expiresAt))
+    return err(HaiReachError.CONFIG_ERROR, reachM("reach_sensitivePolicyRequired"));
+  const hash = createHash("sha256").update(JSON.stringify([message.provider, message.to, message.idempotencyKey])).digest("hex");
+  const queueId = `${hash.slice(0, 8)}-${hash.slice(8, 12)}-5${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
+  const find = () => repo.findAll({ where: "queue_id = ?", params: [queueId], limit: 1 });
+  const existing = await find();
+  if (!existing.success)
+    return existing;
+  if (existing.data[0])
+    return previousResult(existing.data[0]);
+  const now = Date.now();
+  if (message.expiresAt <= now)
+    return err(HaiReachError.MESSAGE_EXPIRED, reachM("reach_messageExpired"));
+  const created = await repo.create({
+    queueId,
+    provider: message.provider,
+    toAddr: "[REDACTED]",
+    subject: null,
+    body: null,
+    template: null,
+    varsJson: null,
+    extraJson: null,
+    status: blocked ? "discarded" : "sending",
+    retrySafe: false,
+    createdAt: now,
+    updatedAt: now,
+    lockedUntil: Math.min(message.expiresAt, now + 6e5),
+    nextAttemptAt: 0
+  });
+  if (!created.success || created.data.changes !== 1) {
+    const previous = await find();
+    if (previous.success && previous.data[0])
+      return previousResult(previous.data[0]);
+    return unconfirmed(queueId);
+  }
+  if (blocked)
+    return err(HaiReachError.DND_BLOCKED, reachM("reach_dndBlocked"));
+  if (Date.now() >= message.expiresAt) {
+    await repo.settleSensitive(queueId, "discarded");
+    return err(HaiReachError.MESSAGE_EXPIRED, reachM("reach_messageExpired"));
+  }
+  let delivered;
+  try {
+    delivered = await core.context.run({ suppressLogObservers: true }, () => provider.send(message));
+  } catch {
+    delivered = err(HaiReachError.SEND_FAILED, reachM("reach_sensitiveDeliveryUnconfirmed"));
+  }
+  const success = delivered.success && delivered.data.success && !delivered.data.deferred;
+  const settled = await repo.settleSensitive(queueId, success ? "sent" : "unknown");
+  if (!settled.success || !success)
+    return unconfirmed(queueId);
+  return ok({ success: true, receiptId: queueId });
+}
 
 // src/reach-send.ts
 var logger6 = core.logger.child({ module: "reach", scope: "send" });
@@ -880,7 +951,11 @@ async function executeSend(message, providers2, templateRegistry2, dndConfig2, r
       reachM("reach_providerNotFound", { params: { provider: providerName } })
     );
   }
+  if (preprocessed.data.sensitive)
+    return sendSensitive(preprocessed.data, providers2.get(providerName), repo, isDndBlocked(dndConfig2));
   if (isDndBlocked(dndConfig2)) {
+    if (message.deferPolicy === "reject")
+      return err(HaiReachError.DND_BLOCKED, reachM("reach_dndBlocked"));
     const strategy = dndConfig2?.strategy ?? "discard";
     if (strategy === "delay") {
       if (!repo)
@@ -1019,6 +1094,113 @@ function createTemplateRegistry(repo) {
     }
   };
 }
+function migrateReach(options = {}, db = reldb) {
+  const definitions = { queue_id: db.config?.type === "mysql" ? "VARCHAR(255)" : "TEXT", retry_safe: "BOOLEAN NOT NULL DEFAULT FALSE", attempt_count: "BIGINT NOT NULL DEFAULT 0", max_attempts: "BIGINT NOT NULL DEFAULT 5", next_attempt_at: "BIGINT NOT NULL DEFAULT 0", retry_delay_ms: "BIGINT NOT NULL DEFAULT 60000", max_retry_delay_ms: "BIGINT NOT NULL DEFAULT 3600000", last_failure: "TEXT" };
+  const steps = [{
+    version: 1,
+    name: "durable-delivery-ledger",
+    async needed(sql) {
+      const found = await schemaColumns(db, "hai_reach_send_log", sql);
+      return found.success ? ok(found.data.length > 0 && Object.keys(definitions).some((name) => !found.data.includes(name))) : found;
+    },
+    async apply(sql) {
+      const found = await schemaColumns(db, "hai_reach_send_log", sql);
+      if (!found.success)
+        return found;
+      for (const [name, definition] of Object.entries(definitions)) {
+        if (found.data.includes(name))
+          continue;
+        const added = await sql.execute(`ALTER TABLE hai_reach_send_log ADD COLUMN ${name} ${definition}`);
+        if (!added.success)
+          return added;
+      }
+      return ok(void 0);
+    }
+  }, {
+    version: 2,
+    name: "legacy-delivery-isolation",
+    async needed(sql) {
+      const found = await schemaColumns(db, "hai_reach_send_log", sql);
+      if (!found.success || !found.data.length)
+        return found.success ? ok(false) : found;
+      if (!found.data.includes("queue_id"))
+        return ok(true);
+      const row = await sql.get("SELECT id FROM hai_reach_send_log WHERE queue_id IS NULL AND status IN ('pending','processing','unknown') LIMIT 1");
+      return row.success ? ok(Boolean(row.data)) : row;
+    },
+    async apply(sql) {
+      const isolated = await sql.execute("UPDATE hai_reach_send_log SET status='unknown',processing_owner=NULL,locked_until=NULL WHERE status='processing' AND queue_id IS NULL");
+      if (!isolated.success)
+        return isolated;
+      while (true) {
+        const rows = await sql.query("SELECT id FROM hai_reach_send_log WHERE queue_id IS NULL AND status IN ('pending','unknown') ORDER BY id LIMIT 100");
+        if (!rows.success)
+          return rows;
+        for (const row of rows.data) {
+          const saved = await sql.execute("UPDATE hai_reach_send_log SET queue_id=? WHERE id=? AND queue_id IS NULL", [randomUUID(), row.id]);
+          if (!saved.success)
+            return saved;
+        }
+        if (rows.data.length < 100)
+          return ok(void 0);
+      }
+    }
+  }, {
+    version: 3,
+    name: "credential-payload-retirement",
+    async needed(sql) {
+      const found = await schemaColumns(db, "hai_reach_send_log", sql);
+      if (!found.success || !found.data.length)
+        return found.success ? ok(false) : found;
+      const ledger = await schemaColumns(db, "hai_schema_migrations", sql);
+      if (!ledger.success)
+        return ledger;
+      const version = ledger.data.length ? await sql.get("SELECT version FROM hai_schema_migrations WHERE module=?", ["reach"]) : ok(null);
+      if (!version.success)
+        return version;
+      if (Number(version.data?.version ?? 0) >= 3)
+        return ok(false);
+      const row = await sql.get("SELECT id FROM hai_reach_send_log WHERE subject IS NOT NULL OR body IS NOT NULL OR template IS NOT NULL OR vars_json IS NOT NULL OR extra_json IS NOT NULL LIMIT 1");
+      return row.success ? ok(Boolean(row.data)) : row;
+    },
+    async apply(sql) {
+      return sql.execute("UPDATE hai_reach_send_log SET body=NULL,subject=NULL,vars_json=NULL,extra_json=NULL,template=NULL,status=CASE WHEN status IN ('pending','processing') THEN 'discarded' WHEN status='sending' THEN 'unknown' ELSE status END,processing_owner=NULL,locked_until=NULL WHERE subject IS NOT NULL OR body IS NOT NULL OR template IS NOT NULL OR vars_json IS NOT NULL OR extra_json IS NOT NULL");
+    }
+  }, {
+    version: 4,
+    name: "unique-operation-receipts",
+    async needed(sql) {
+      const columns = await schemaColumns(db, "hai_reach_send_log", sql);
+      if (!columns.success || !columns.data.length)
+        return columns.success ? ok(false) : columns;
+      if (!columns.data.includes("queue_id"))
+        return ok(true);
+      if (db.config?.type === "sqlite") {
+        const indexes = await sql.query("PRAGMA index_list(hai_reach_send_log)");
+        if (!indexes.success)
+          return indexes;
+        for (const index of indexes.data) {
+          if (!index.unique || !/^\w+$/.test(index.name))
+            continue;
+          const fields = await sql.query(`PRAGMA index_info(${index.name})`);
+          if (!fields.success)
+            return fields;
+          if (fields.data.length === 1 && fields.data[0]?.name === "queue_id")
+            return ok(false);
+        }
+        return ok(true);
+      }
+      const found = db.config?.type === "mysql" ? await sql.get("SELECT index_name FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name=? AND non_unique=0 GROUP BY index_name HAVING COUNT(*)=1 AND MAX(column_name)=?", ["hai_reach_send_log", "queue_id"]) : await sql.get("SELECT i.indexrelid FROM pg_index i JOIN pg_class t ON t.oid=i.indrelid JOIN pg_namespace n ON n.oid=t.relnamespace JOIN pg_attribute a ON a.attrelid=t.oid AND a.attnum=ANY(i.indkey) WHERE t.relname=? AND n.nspname=current_schema() AND i.indisunique AND i.indnatts=1 AND a.attname=?", ["hai_reach_send_log", "queue_id"]);
+      return found.success ? ok(!found.data) : found;
+    },
+    async apply(sql) {
+      return sql.execute("CREATE UNIQUE INDEX uq_hai_reach_queue_v1 ON hai_reach_send_log(queue_id)");
+    }
+  }];
+  return migrateSchema(db, "reach", steps, options);
+}
+
+// src/repositories/reach-repository-send-log.ts
 var TABLE_NAME = "hai_reach_send_log";
 var DEFAULT_CLAIM_BATCH_SIZE = 100;
 var DEFAULT_CLAIM_LOCK_MS = 10 * 60 * 1e3;
@@ -1218,6 +1400,9 @@ function resetSendLogRepoSingleton() {
 async function createSendLogRepository(db) {
   if (sendLogRepoInstance && sendLogRepoSqlOps === db.sql)
     return ok(sendLogRepoInstance);
+  const migration = await migrateReach({}, db);
+  if (!migration.success)
+    return migration;
   const repo = new DbSendLogRepository(db);
   const initResult = await repo.count();
   if (!initResult.success) {
@@ -1232,6 +1417,15 @@ async function createSendLogRepository(db) {
   return ok(repo);
 }
 var DbSendLogRepository = class extends BaseReldbCrudRepository {
+  async settleSensitive(queueId, status, messageId) {
+    const settled = await this.sql().execute(
+      `UPDATE ${TABLE_NAME} SET status = ?, message_id = ?, locked_until = NULL, updated_at = ? WHERE queue_id = ? AND status = 'sending' AND body IS NULL AND vars_json IS NULL AND retry_safe = FALSE`,
+      [status, messageId ?? null, Date.now(), queueId]
+    );
+    if (!settled.success)
+      return settled;
+    return settled.data.changes === 1 ? ok(void 0) : buildSendLogError(reachM("reach_sensitiveDeliveryUnconfirmed"));
+  }
   constructor(db) {
     super(db, {
       table: TABLE_NAME,
@@ -1929,7 +2123,8 @@ var reach = {
     if (providers.size === 0) {
       return notInitialized.result();
     }
-    return executeSend(message, providers, templateRegistry, dndConfig, sendLogRepo, currentConfig.queue);
+    const send = () => executeSend(message, providers, templateRegistry, dndConfig, sendLogRepo, currentConfig.queue);
+    return message.sensitive ? core.context.run({ suppressLogObservers: true }, send) : send();
   },
   get template() {
     return templateRegistry;
@@ -1945,6 +2140,6 @@ var reach = {
   }
 };
 
-export { AliyunSmsProviderConfigSchema, ApiProviderConfigSchema, ConsoleProviderConfigSchema, DndConfigSchema, HaiReachError, ProviderConfigSchema, ReachConfigSchema, ReachDeadRequeueSchema, ReachQueueConfigSchema, ReachQueueIdSchema, ReachQueueListSchema, ReachUnknownResolutionSchema, SmtpProviderConfigSchema, TemplateConfigSchema, reach };
+export { AliyunSmsProviderConfigSchema, ApiProviderConfigSchema, ConsoleProviderConfigSchema, DndConfigSchema, HaiReachError, ProviderConfigSchema, ReachConfigSchema, ReachDeadRequeueSchema, ReachQueueConfigSchema, ReachQueueIdSchema, ReachQueueListSchema, ReachUnknownResolutionSchema, SmtpProviderConfigSchema, TemplateConfigSchema, migrateReach, reach };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map