@rei-standard/amsg-server 2.5.2 → 2.6.0-next.0

package/dist/index.d.ts

@@ -1,5 +1,8 @@
-import { createDecipheriv, createHash, randomBytes, createCipheriv, randomUUID, timingSafeEqual, createHmac } from 'crypto';
-import { buildReasoningPush, buildContentPush } from '@rei-standard/amsg-shared';
+import { g as getHeader, p as parseJsonBody, i as isValidUUIDv4, r as runScheduledTick, c as createMessagesHandler, a as createCancelMessageHandler, b as createUpdateMessageHandler, d as createScheduleMessageHandler, e as createGetUserKeyHandler } from './cloudflare-BwOfBtLF.js';
+export { f as createD1Adapter, h as createSingleUserCloudflareWorker, j as createSingleUserServer, k as createWebCryptoWebPush, l as decryptFromStorage, m as decryptPayload, n as deriveUserEncryptionKey, o as encryptForStorage, q as isValidISO8601, s as isValidUUID, t as isValidUrl, v as validateLlmMessagesArray, u as validateScheduleMessagePayload, w as validateSplitPattern } from './cloudflare-BwOfBtLF.js';
+import { createHash, randomBytes, createCipheriv, createDecipheriv, timingSafeEqual, createHmac, randomUUID } from 'crypto';
+import { normalizeVapidSubject } from '@rei-standard/amsg-shared';
+export { validateAvatarUrl } from '@rei-standard/amsg-shared';
 
 /**
  * Adapter Factory
@@ -53,442 +56,6 @@ async function createAdapter(config) {
   }
 }
 
-/**
- * Validation utility library (SDK version)
- * ReiStandard SDK v2.0.1
- */
-
-/**
- * Validate ISO 8601 date string.
- * @param {string} dateString
- * @returns {boolean}
- */
-function isValidISO8601(dateString) {
-  const date = new Date(dateString);
-  return date instanceof Date && !isNaN(date.getTime());
-}
-
-/**
- * Validate URL format.
- * @param {string} urlString
- * @returns {boolean}
- */
-function isValidUrl(urlString) {
-  try {
-    new URL(urlString);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Validate UUID format.
- * @param {string} uuid
- * @returns {boolean}
- */
-function isValidUUID(uuid) {
-  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  return uuidRegex.test(uuid);
-}
-
-/**
- * Validate UUID v4 format.
- * @param {string} uuid
- * @returns {boolean}
- */
-function isValidUUIDv4(uuid) {
-  const uuidV4Regex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-  return uuidV4Regex.test(uuid);
-}
-
-const VALID_LLM_MESSAGE_ROLES = new Set(['system', 'user', 'assistant', 'tool']);
-
-const AVATAR_URL_MAX_LENGTH = 2048;
-
-/**
- * Validate the optional `avatarUrl` field. Rejects `data:` URIs (typically
- * base64-encoded inline images) and anything longer than 2048 chars, both
- * of which are the dominant trigger for downstream 413 / Web Push 4 KB
- * payload errors. Returns an error message string, or null when valid.
- *
- * Mirrors @rei-standard/amsg-instant's `validateAvatarUrl` (kept in lockstep
- * on purpose — both packages forward `avatarUrl` to the same SW push payload).
- *
- * @param {unknown} value
- * @returns {string | null}
- */
-function validateAvatarUrl(value) {
-  if (value === undefined || value === null) return null;
-  if (typeof value !== 'string') {
-    return 'avatarUrl 必须是字符串';
-  }
-  if (/^data:/i.test(value)) {
-    return '头像不支持传入 data: URI，请改为公网可访问的 https:// 图片 URL';
-  }
-  if (value.length > AVATAR_URL_MAX_LENGTH) {
-    return `头像 URL 长度 ${value.length} 字符超过 ${AVATAR_URL_MAX_LENGTH} 上限，请改为更短的图片 URL`;
-  }
-  if (!isValidUrl(value)) {
-    return 'avatarUrl 不是合法 URL';
-  }
-  return null;
-}
-
-const SPLIT_PATTERN_MAX_LENGTH = 200;
-const SPLIT_PATTERN_MAX_ITEMS = 10;
-
-/**
- * Validate the optional `splitPattern` field. Mirrors
- * @rei-standard/amsg-instant's `validateSplitPattern` (kept in lockstep).
- * Accepts `string`, `string[]`, or absent/null. Returns an error message
- * string, or null when valid.
- *
- * Limits (per-item length ≤ 200, array ≤ 10 items, must compile via
- * `new RegExp(item)`) are an **input-size guard**, NOT a ReDoS defense —
- * a 6-character pattern like `(a+)+$` is enough to trigger catastrophic
- * backtracking. The real backstop is Worker / runtime CPU limits + the
- * fact that splitPattern is stored under the user's own encrypted task
- * and matched against output from the user's own LLM API key, so the
- * blast radius is self-inflicted only (no cross-tenant attack surface).
- *
- * @param {unknown} value
- * @returns {string | null}
- */
-function validateSplitPattern(value) {
-  if (value === undefined || value === null) return null;
-  const isArray = Array.isArray(value);
-  const items = isArray ? value : [value];
-  if (isArray && items.length === 0) return null;          // empty array = use default
-  if (items.length > SPLIT_PATTERN_MAX_ITEMS) {
-    return `splitPattern 数组最多 ${SPLIT_PATTERN_MAX_ITEMS} 项`;
-  }
-  for (let i = 0; i < items.length; i++) {
-    const s = items[i];
-    const label = isArray ? `splitPattern[${i}]` : 'splitPattern';
-    if (typeof s !== 'string') return `${label} 必须是字符串`;
-    if (s.length > SPLIT_PATTERN_MAX_LENGTH) {
-      return `${label} 不能超过 ${SPLIT_PATTERN_MAX_LENGTH} 字符`;
-    }
-    try { new RegExp(s); }
-    catch (_) { return `${label} 不是有效正则表达式`; }
-  }
-  return null;
-}
-
-/**
- * Validate an OpenAI-style messages array. Same shape contract as
- * `@rei-standard/amsg-instant` (kept in lockstep on purpose — both packages
- * end up forwarding this to the same LLM body).
- *
- * @param {unknown} messages
- * @returns {string | null}   Error message, or null if valid.
- */
-function validateLlmMessagesArray(messages) {
-  if (!Array.isArray(messages) || messages.length === 0) {
-    return 'messages must be a non-empty array';
-  }
-  for (let i = 0; i < messages.length; i++) {
-    const m = messages[i];
-    if (!m || typeof m !== 'object' || Array.isArray(m)) {
-      return `messages[${i}] must be an object`;
-    }
-    if (!VALID_LLM_MESSAGE_ROLES.has(m.role)) {
-      return `messages[${i}].role must be one of system / user / assistant / tool`;
-    }
-    if (typeof m.content === 'string') {
-      if (!m.content) return `messages[${i}].content must be a non-empty string`;
-    } else if (Array.isArray(m.content)) {
-      if (m.content.length === 0) return `messages[${i}].content array must be non-empty`;
-      // Element schema is intentionally not enforced — passed through to LLM as-is.
-    } else {
-      return `messages[${i}].content must be a non-empty string or a non-empty array`;
-    }
-  }
-  return null;
-}
-
-/**
- * Validate the schedule-message request payload.
- *
- * @param {Object} payload
- * @returns {{ valid: boolean, errorCode?: string, errorMessage?: string, details?: Object }}
- */
-function validateScheduleMessagePayload(payload) {
-  if (!payload.contactName || typeof payload.contactName !== 'string') {
-    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { missingFields: ['contactName'] } };
-  }
-
-  if (!payload.messageType || !['fixed', 'prompted', 'auto', 'instant'].includes(payload.messageType)) {
-    return { valid: false, errorCode: 'INVALID_MESSAGE_TYPE', errorMessage: '消息类型无效', details: { providedType: payload.messageType, allowedTypes: ['fixed', 'prompted', 'auto', 'instant'] } };
-  }
-
-  if (!payload.firstSendTime || !isValidISO8601(payload.firstSendTime)) {
-    return { valid: false, errorCode: 'INVALID_TIMESTAMP', errorMessage: '时间格式无效', details: { field: 'firstSendTime' } };
-  }
-
-  if (payload.firstSendTime && new Date(payload.firstSendTime) <= new Date()) {
-    return { valid: false, errorCode: 'INVALID_TIMESTAMP', errorMessage: '时间必须在未来', details: { field: 'firstSendTime', reason: 'must be in the future' } };
-  }
-
-  if (!payload.pushSubscription || typeof payload.pushSubscription !== 'object') {
-    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { missingFields: ['pushSubscription'] } };
-  }
-
-  if (payload.recurrenceType && !['none', 'daily', 'weekly'].includes(payload.recurrenceType)) {
-    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['recurrenceType'] } };
-  }
-
-  if (
-    payload.maxTokens !== undefined &&
-    payload.maxTokens !== null &&
-    (!Number.isInteger(payload.maxTokens) || payload.maxTokens <= 0)
-  ) {
-    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['maxTokens'] } };
-  }
-
-  if (payload.messageType === 'fixed') {
-    if (!payload.userMessage) {
-      return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { missingFields: ['userMessage (required for fixed type)'] } };
-    }
-  }
-
-  // ─── Prompt schema (shared by prompted / auto / instant AI configs) ──
-  //
-  // Callers provide *exactly one of* `completePrompt` (string) or `messages`
-  // (OpenAI-style array). Same contract as @rei-standard/amsg-instant; the
-  // server's LLM path forwards either verbatim.
-  const promptCheck = (() => {
-    const hasCompletePrompt = payload.completePrompt !== undefined && payload.completePrompt !== null && payload.completePrompt !== '';
-    const hasMessages = payload.messages !== undefined && payload.messages !== null;
-    if (hasCompletePrompt && hasMessages) {
-      return {
-        error: { code: 'INVALID_PARAMETERS', message: 'exactly one of `completePrompt` or `messages` must be provided（两者不能同时出现）', details: { invalidFields: ['completePrompt', 'messages'] } },
-        hasCompletePrompt: true, hasMessages: true,
-      };
-    }
-    if (hasMessages) {
-      const err = validateLlmMessagesArray(payload.messages);
-      if (err) {
-        return {
-          error: { code: 'INVALID_PARAMETERS', message: err, details: { invalidFields: ['messages'] } },
-          hasCompletePrompt: false, hasMessages: true,
-        };
-      }
-    }
-    return { error: null, hasCompletePrompt, hasMessages };
-  })();
-
-  if (promptCheck.error) {
-    return { valid: false, errorCode: promptCheck.error.code, errorMessage: promptCheck.error.message, details: promptCheck.error.details };
-  }
-  const hasPrompt = promptCheck.hasCompletePrompt || promptCheck.hasMessages;
-
-  if (payload.messageType === 'prompted' || payload.messageType === 'auto') {
-    const missingAiFields = [];
-    if (!hasPrompt) missingAiFields.push('completePrompt or messages');
-    if (!payload.apiUrl) missingAiFields.push('apiUrl');
-    if (!payload.apiKey) missingAiFields.push('apiKey');
-    if (!payload.primaryModel) missingAiFields.push('primaryModel');
-    if (missingAiFields.length > 0) {
-      return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { missingFields: missingAiFields } };
-    }
-  }
-
-  if (payload.messageType === 'instant') {
-    if (payload.recurrenceType && payload.recurrenceType !== 'none') {
-      return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: 'instant 类型的 recurrenceType 必须为 none', details: { invalidFields: ['recurrenceType (must be "none" for instant type)'] } };
-    }
-    const hasAiConfig = hasPrompt && payload.apiUrl && payload.apiKey && payload.primaryModel;
-    const hasUserMessage = payload.userMessage;
-    if (!hasAiConfig && !hasUserMessage) {
-      return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: 'instant 类型必须提供 userMessage 或完整的 AI 配置', details: { missingFields: ['userMessage or ((completePrompt | messages) + apiUrl + apiKey + primaryModel)'] } };
-    }
-  }
-
-  if (
-    payload.temperature !== undefined &&
-    payload.temperature !== null &&
-    (typeof payload.temperature !== 'number' || !Number.isFinite(payload.temperature))
-  ) {
-    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['temperature (must be a finite number)'] } };
-  }
-
-  const avatarErr = validateAvatarUrl(payload.avatarUrl);
-  if (avatarErr) {
-    // Soft-strip: a bad avatarUrl (data: URI / oversized / malformed) used to
-    // 400 the whole schedule. Avatar is cosmetic — drop the field, log, and
-    // let the rest of the task ship. See standards §6.2.
-    console.warn('[amsg-server] avatarUrl 不合法，已置空：', avatarErr);
-    payload.avatarUrl = null;
-  }
-  if (payload.uuid && !isValidUUID(payload.uuid)) {
-    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['uuid (invalid UUID format)'] } };
-  }
-  // messageSubtype is a free-form string tag forwarded to SW-side push payload
-  // for classification. Only the type is enforced; the taxonomy is the
-  // consumer's call (previously the enum was chat/forum/moment).
-  if (
-    payload.messageSubtype !== undefined &&
-    payload.messageSubtype !== null &&
-    typeof payload.messageSubtype !== 'string'
-  ) {
-    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['messageSubtype'] } };
-  }
-
-  const splitErr = validateSplitPattern(payload.splitPattern);
-  if (splitErr) {
-    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: splitErr, details: { invalidFields: ['splitPattern'] } };
-  }
-
-  return { valid: true };
-}
-
-/**
- * Request payload utilities.
- * Keeps body parsing and shape validation consistent across handlers.
- */
-
-const REQUEST_ERRORS = {
-  INVALID_JSON: { code: 'INVALID_JSON', message: '请求体不是有效的 JSON' },
-  INVALID_REQUEST_BODY: { code: 'INVALID_REQUEST_BODY', message: '请求体格式无效' },
-  INVALID_ENCRYPTED_PAYLOAD: { code: 'INVALID_ENCRYPTED_PAYLOAD', message: '加密数据格式错误' }
-};
-
-/**
- * @typedef {{ code: string, message: string }} ValidationError
- */
-
-/**
- * @typedef {{
- *   invalidJson?: ValidationError,
- *   invalidType?: ValidationError
- * }} ParseBodyOptions
- */
-
-/**
- * @typedef {{
- *   ok: true,
- *   data: Record<string, any>
- * } | {
- *   ok: false,
- *   error: ValidationError
- * }} ParseBodyResult
- */
-
-/**
- * Parse body into a JSON object.
- *
- * @param {unknown} body
- * @param {ParseBodyOptions} [options]
- * @returns {ParseBodyResult}
- */
-function parseBodyAsObject(body, options = {}) {
-  const invalidJson = options.invalidJson || REQUEST_ERRORS.INVALID_JSON;
-  const invalidType = options.invalidType || REQUEST_ERRORS.INVALID_REQUEST_BODY;
-
-  let parsed = body;
-  if (typeof parsed === 'string') {
-    try {
-      parsed = JSON.parse(parsed);
-    } catch {
-      return { ok: false, error: invalidJson };
-    }
-  }
-
-  if (!isPlainObject(parsed)) {
-    return { ok: false, error: invalidType };
-  }
-
-  return { ok: true, data: parsed };
-}
-
-/**
- * Parse a standard JSON object body.
- *
- * @param {unknown} body
- * @returns {ParseBodyResult}
- */
-function parseJsonBody(body) {
-  return parseBodyAsObject(body, {
-    invalidJson: REQUEST_ERRORS.INVALID_JSON,
-    invalidType: REQUEST_ERRORS.INVALID_REQUEST_BODY
-  });
-}
-
-/**
- * Check if a value is a plain object (and not null/array).
- *
- * @param {unknown} value
- * @returns {value is Record<string, any>}
- */
-function isPlainObject(value) {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-/**
- * Check if an object follows the encrypted payload envelope shape.
- *
- * @param {unknown} payload
- * @returns {payload is { iv: string, authTag: string, encryptedData: string }}
- */
-function isEncryptedEnvelope(payload) {
-  if (!isPlainObject(payload)) return false;
-
-  return (
-    typeof payload.iv === 'string' &&
-    typeof payload.authTag === 'string' &&
-    typeof payload.encryptedData === 'string'
-  );
-}
-
-/**
- * Parse and validate an encrypted payload envelope.
- *
- * @param {unknown} body
- * @returns {ParseBodyResult}
- */
-function parseEncryptedBody(body) {
-  const parsedBody = parseBodyAsObject(body, {
-    invalidJson: REQUEST_ERRORS.INVALID_ENCRYPTED_PAYLOAD,
-    invalidType: REQUEST_ERRORS.INVALID_ENCRYPTED_PAYLOAD
-  });
-
-  if (!parsedBody.ok) {
-    return parsedBody;
-  }
-
-  if (!isEncryptedEnvelope(parsedBody.data)) {
-    return { ok: false, error: REQUEST_ERRORS.INVALID_ENCRYPTED_PAYLOAD };
-  }
-
-  return parsedBody;
-}
-
-/**
- * Read a header value case-insensitively.
- *
- * @param {Record<string, any>} headers
- * @param {string} name
- * @returns {string}
- */
-function getHeader(headers = {}, name) {
-  if (!headers || typeof headers !== 'object') {
-    return '';
-  }
-
-  const lowerName = String(name || '').toLowerCase();
-  if (!lowerName) return '';
-
-  for (const [key, value] of Object.entries(headers)) {
-    if (String(key).toLowerCase() === lowerName) {
-      return String(value || '').trim();
-    }
-  }
-
-  return '';
-}
-
 /**
  * Handler: init-tenant
  * ReiStandard SDK v2.0.1
@@ -527,1008 +94,99 @@ function createInitTenantHandler(ctx) {
       };
     }
 
-    const payload = parsed.data;
-    const tenantId = payload.tenantId || undefined;
-    const driver = payload.driver;
-    const databaseUrl = payload.databaseUrl || payload.connectionString;
-
-    if (tenantId && !isValidUUIDv4(tenantId)) {
-      return {
-        status: 400,
-        body: {
-          success: false,
-          error: {
-            code: 'INVALID_TENANT_ID',
-            message: 'tenantId 必须是 UUID v4 格式'
-          }
-        }
-      };
-    }
-
-    if (!databaseUrl || !driver) {
-      return {
-        status: 400,
-        body: {
-          success: false,
-          error: {
-            code: 'INVALID_PARAMETERS',
-            message: '缺少 driver 或 databaseUrl 参数'
-          }
-        }
-      };
-    }
-
-    try {
-      const result = await ctx.tenantManager.initializeTenant({
-        tenantId,
-        driver,
-        connectionString: databaseUrl
-      });
-
-      return {
-        status: 201,
-        body: {
-          success: true,
-          data: {
-            tenantId: result.tenantId,
-            tenantToken: result.tenantToken,
-            cronToken: result.cronToken,
-            cronWebhookUrl: result.cronWebhookUrl,
-            masterKeyFingerprint: result.masterKeyFingerprint
-          }
-        }
-      };
-    } catch (error) {
-      if (error.message === 'INVALID_DRIVER') {
-        return {
-          status: 400,
-          body: {
-            success: false,
-            error: {
-              code: 'INVALID_DRIVER',
-              message: 'driver 必须是 neon 或 pg'
-            }
-          }
-        };
-      }
-
-      if (error.message === 'INVALID_DATABASE_URL') {
-        return {
-          status: 400,
-          body: {
-            success: false,
-            error: {
-              code: 'INVALID_DATABASE_URL',
-              message: 'databaseUrl 不能为空'
-            }
-          }
-        };
-      }
-
-      if (error.message === 'TENANT_ALREADY_INITIALIZED') {
-        return {
-          status: 409,
-          body: {
-            success: false,
-            error: {
-              code: 'TENANT_ALREADY_INITIALIZED',
-              message: 'tenantId 已存在，不能重复初始化'
-            }
-          }
-        };
-      }
-
-      throw error;
-    }
-  }
-
-  return { POST };
-}
-
-/**
- * Encryption utility library (SDK version)
- * ReiStandard SDK v2.0.1
- *
- * Wraps AES-256-GCM operations for request/response and storage encryption.
- */
-
-
-/**
- * Derive a user-specific encryption key from the master key.
- *
- * @param {string} userId    - Unique user identifier.
- * @param {string} masterKey - 64-char hex master key.
- * @returns {string} 64-char hex key.
- */
-function deriveUserEncryptionKey(userId, masterKey) {
-  return createHash('sha256')
-    .update(masterKey + userId)
-    .digest('hex')
-    .slice(0, 64);
-}
-
-/**
- * Decrypt a client-encrypted request body (AES-256-GCM, base64 encoded).
- *
- * @param {{ iv: string, authTag: string, encryptedData: string }} encryptedPayload
- * @param {string} encryptionKey - 64-char hex key.
- * @returns {Object} Decrypted JSON object.
- */
-function decryptPayload(encryptedPayload, encryptionKey) {
-  const { iv, authTag, encryptedData } = encryptedPayload;
-
-  const decipher = createDecipheriv(
-    'aes-256-gcm',
-    Buffer.from(encryptionKey, 'hex'),
-    Buffer.from(iv, 'base64')
-  );
-
-  decipher.setAuthTag(Buffer.from(authTag, 'base64'));
-
-  const decrypted = Buffer.concat([
-    decipher.update(Buffer.from(encryptedData, 'base64')),
-    decipher.final()
-  ]);
-
-  return JSON.parse(decrypted.toString('utf8'));
-}
-
-/**
- * Encrypt a JSON payload for API transfer (AES-256-GCM, base64 encoded).
- *
- * @param {string|Object} payload
- * @param {string} encryptionKey - 64-char hex key.
- * @returns {{ iv: string, authTag: string, encryptedData: string }}
- */
-function encryptPayload(payload, encryptionKey) {
-  const plaintext = typeof payload === 'string' ? payload : JSON.stringify(payload);
-  const iv = randomBytes(12);
-  const cipher = createCipheriv('aes-256-gcm', Buffer.from(encryptionKey, 'hex'), iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-  const authTag = cipher.getAuthTag();
-
-  return {
-    iv: iv.toString('base64'),
-    authTag: authTag.toString('base64'),
-    encryptedData: encrypted.toString('base64')
-  };
-}
-
-/**
- * Encrypt data for database storage (hex encoded, colon-separated).
- *
- * @param {string} text          - Plaintext string.
- * @param {string} encryptionKey - 64-char hex key.
- * @returns {string} Format: iv:authTag:encryptedData
- */
-function encryptForStorage(text, encryptionKey) {
-  const iv = randomBytes(16);
-  const cipher = createCipheriv('aes-256-gcm', Buffer.from(encryptionKey, 'hex'), iv);
-  const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
-  const authTag = cipher.getAuthTag();
-  return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
-}
-
-/**
- * Decrypt data from database storage format.
- *
- * @param {string} encryptedText - Format: iv:authTag:encryptedData
- * @param {string} encryptionKey - 64-char hex key.
- * @returns {string} Plaintext string.
- */
-function decryptFromStorage(encryptedText, encryptionKey) {
-  const [ivHex, authTagHex, encryptedDataHex] = encryptedText.split(':');
-  const decipher = createDecipheriv(
-    'aes-256-gcm',
-    Buffer.from(encryptionKey, 'hex'),
-    Buffer.from(ivHex, 'hex')
-  );
-  decipher.setAuthTag(Buffer.from(authTagHex, 'hex'));
-  return decipher.update(encryptedDataHex, 'hex', 'utf8') + decipher.final('utf8');
-}
-
-/**
- * Handler: get-user-key
- * ReiStandard SDK v2.0.1
- *
- * @param {Object} ctx - Server context.
- * @returns {{ GET: function }}
- */
-
-
-function createGetUserKeyHandler(ctx) {
-  async function GET(url, headers) {
-    const effectiveHeaders = headers || url || {};
-    const tenantResult = await ctx.tenantManager.resolveTenant(effectiveHeaders);
-    if (!tenantResult.ok) {
-      return tenantResult.error;
-    }
-
-    const { masterKey } = tenantResult.context;
-    const userId = getHeader(effectiveHeaders, 'x-user-id');
-
-    if (!userId) {
-      return {
-        status: 400,
-        body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '缺少用户标识符' } }
-      };
-    }
-
-    if (!isValidUUIDv4(userId)) {
-      return {
-        status: 400,
-        body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } }
-      };
-    }
-
-    return {
-      status: 200,
-      body: {
-        success: true,
-        data: {
-          userKey: deriveUserEncryptionKey(userId, masterKey),
-          version: 1
-        }
-      }
-    };
-  }
-
-  return { GET };
-}
-
-/**
- * Database error helpers.
- */
-
-/**
- * Check whether an error is caused by a unique-constraint violation.
- *
- * @param {unknown} error
- * @returns {boolean}
- */
-function isUniqueViolation(error) {
-  if (!error || typeof error !== 'object') return false;
-
-  const code = error.code;
-  if (code === '23505') return true;
-
-  const message = typeof error.message === 'string' ? error.message.toLowerCase() : '';
-  return message.includes('duplicate key') || message.includes('unique constraint');
-}
-
-/**
- * Message Processor (SDK version)
- * ReiStandard amsg-server v2.4.0
- *
- * Handles single message content generation and Web Push delivery for
- * scheduled tasks (`fixed` / `prompted` / `auto`) and the
- * in-server instant path (`messageType: 'instant'`).
- *
- * Push wire shape comes from `@rei-standard/amsg-shared`'s
- * discriminated union (`AmsgPush`). The SW (`@rei-standard/amsg-sw`)
- * routes on `messageKind`. Server-driven pushes always carry
- * `source: 'instant'` (for the in-server instant path) or
- * `source: 'scheduled'` (for everything else).
- *
- * v2.4.0: when the LLM response carries non-empty
- * `choices[0].message.reasoning_content`, the processor now emits a
- * standalone `ReasoningPush` **before** the `ContentPush` burst.
- * `messagesSent` in the return value continues to reflect the sentence
- * count only (reasoning is an auxiliary push, not a sentence).
- */
-
-
-const DEFAULT_SPLIT_REGEX = /([。！？!?]+)/;
-
-/**
- * Split a single chunk by one regex; on no-match return [chunk] so a later
- * regex in a cascade can still take a swing at it.
- */
-function splitOnceByRegex(chunk, regex) {
-  const out = chunk
-    .split(regex)
-    .reduce((acc, part, i, arr) => {
-      if (i % 2 === 0 && part.trim()) {
-        const punctuation = arr[i + 1] || '';
-        acc.push(part.trim() + punctuation);
-      }
-      return acc;
-    }, [])
-    .filter(s => s.length > 0);
-  return out.length > 0 ? out : [chunk];
-}
-
-/**
- * Sentence splitter — kept byte-for-byte equivalent to
- * `@rei-standard/amsg-instant`'s `splitMessageIntoSentences`. Server carries
- * its own copy to avoid an architectural dependency on the instant package.
- * Name matches the instant export on purpose so cross-package grep finds
- * both copies; if you fix a bug here, fix it in the instant copy too.
- *
- * @param {string} messageContent
- * @param {string | string[] | null} [splitPattern=null]
- * @returns {string[]}
- */
-function splitMessageIntoSentences(messageContent, splitPattern = null) {
-  const sources =
-    splitPattern == null ? null :
-    Array.isArray(splitPattern) ? splitPattern :
-    [splitPattern];
-
-  const regexes = (sources && sources.length > 0)
-    ? sources.map(s => new RegExp(s))
-    : [DEFAULT_SPLIT_REGEX];
-
-  let chunks = [messageContent];
-  for (const regex of regexes) {
-    chunks = chunks.flatMap(c => splitOnceByRegex(c, regex));
-  }
-
-  return chunks.length > 0 ? chunks : [messageContent];
-}
-
-/**
- * Read `choices[0].message.reasoning_content` as a non-empty trimmed
- * string, or null when absent / empty. Mirrors
- * `amsg-instant/src/message-processor.js#readReasoningContent`.
- *
- * @param {unknown} llmResponse
- * @returns {string | null}
- */
-function readReasoningContent(llmResponse) {
-  if (!llmResponse || typeof llmResponse !== 'object') return null;
-  const choices = /** @type {{ choices?: unknown }} */ (llmResponse).choices;
-  if (!Array.isArray(choices) || choices.length === 0) return null;
-  const message = /** @type {{ message?: { reasoning_content?: unknown, content?: unknown } }} */ (choices[0])?.message;
-
-  const raw = message?.reasoning_content;
-  if (typeof raw === 'string') {
-    const trimmed = raw.trim();
-    if (trimmed.length > 0) return trimmed;
-  }
-
-  const content = message?.content;
-  if (typeof content === 'string') {
-    const match = content.match(REASONING_TAG_RE);
-    if (match) {
-      const trimmed = match[2].trim();
-      if (trimmed.length > 0) return trimmed;
-    }
-  }
-
-  return null;
-}
-
-const REASONING_TAG_RE = /<(think|thinking|thought)>([\s\S]*?)<\/\1>/i;
-const REASONING_TAG_RE_G = /<(think|thinking|thought)>[\s\S]*?<\/\1>/gi;
-
-/**
- * Mirrors `amsg-instant/src/message-processor.js#stripReasoningTags`.
- * Removes any private chain-of-thought markup leaking through
- * `message.content` so it does not also ship inside ContentPush.
- *
- * @param {string} content
- * @returns {string}
- */
-function stripReasoningTags(content) {
-  if (typeof content !== 'string' || !content.includes('<')) return content;
-  return content.replace(REASONING_TAG_RE_G, '').trim();
-}
-
-/**
- * @typedef {Object} ProcessorContext
- * @property {Object}  webpush           - The web-push module instance (already VAPID-configured).
- * @property {Object}  vapid             - { email, publicKey, privateKey }
- * @property {import('../adapters/interface.js').DbAdapter} db
- */
-
-/**
- * Process a single database task row: decrypt → generate content → push.
- *
- * @param {import('../adapters/interface.js').TaskRow} task
- * @param {ProcessorContext} ctx
- * @param {string} [providedMasterKey]
- * @returns {Promise<{ success: boolean, messagesSent: number, error?: string }>}
- */
-async function processSingleMessage(task, ctx, providedMasterKey) {
-  try {
-    const masterKey = providedMasterKey || ctx.masterKey;
-    if (!masterKey) {
-      return { success: false, messagesSent: 0, error: 'TENANT_MASTER_KEY_MISSING' };
-    }
-
-    const userKey = deriveUserEncryptionKey(task.user_id, masterKey);
-    const decryptedPayload = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
-
-    let messageContent;
-    /** @type {unknown} */
-    let llmResponse = null;
-
-    if (decryptedPayload.messageType === 'fixed') {
-      messageContent = decryptedPayload.userMessage;
-
-    } else if (decryptedPayload.messageType === 'instant') {
-      const hasPrompt = !!decryptedPayload.completePrompt
-        || (Array.isArray(decryptedPayload.messages) && decryptedPayload.messages.length > 0);
-      if (hasPrompt && decryptedPayload.apiUrl && decryptedPayload.apiKey && decryptedPayload.primaryModel) {
-        const aiResult = await _callAI(decryptedPayload);
-        messageContent = aiResult.content;
-        llmResponse = aiResult.response;
-      } else if (decryptedPayload.userMessage) {
-        messageContent = decryptedPayload.userMessage;
-      } else {
-        throw new Error('Invalid instant message: no content source available');
-      }
-
-    } else if (decryptedPayload.messageType === 'prompted' || decryptedPayload.messageType === 'auto') {
-      const aiResult = await _callAI(decryptedPayload);
-      messageContent = aiResult.content;
-      llmResponse = aiResult.response;
-    } else {
-      throw new Error('Invalid message configuration: no content source available');
-    }
-
-    // Auto-extract reasoning BEFORE the sentence split: when reasoning
-    // came from the `<think>` fallback inside message.content, the same
-    // span is still embedded in messageContent and would otherwise leak
-    // as raw markup into ContentPush.
-    const reasoning = readReasoningContent(llmResponse);
-    if (reasoning) {
-      messageContent = stripReasoningTags(messageContent);
-    }
-
-    // Sentence splitting (mirrors @rei-standard/amsg-instant
-    // splitMessageIntoSentences — keep in lockstep; do not drift). Caller may
-    // override the default regex via decryptedPayload.splitPattern (string
-    // for a single regex, string[] for a cascade). Validation already enforces
-    // length cap + RegExp compilability upstream.
-    const messages = splitMessageIntoSentences(messageContent, decryptedPayload.splitPattern ?? null);
-
-    if (!ctx.vapid.email || !ctx.vapid.publicKey || !ctx.vapid.privateKey) {
-      throw new Error('VAPID configuration missing - push notifications cannot be sent');
-    }
-
-    const pushSubscription = decryptedPayload.pushSubscription;
-    // sessionId is shared across the optional ReasoningPush and every
-    // ContentPush from this LLM round. Pin it to the task id when
-    // available (scheduled tasks) so retries reuse the same id;
-    // otherwise mint a UUID.
-    const sessionId = task.id != null
-      ? `sess_task_${task.id}`
-      : `sess_${randomUUID()}`;
-    const source = decryptedPayload.messageType === 'instant' ? 'instant' : 'scheduled';
-    const messageSubtype = decryptedPayload.messageSubtype || 'chat';
-    const avatarUrl = decryptedPayload.avatarUrl || null;
-    const metadata = decryptedPayload.metadata || {};
-
-    // `messageId` format — deterministic when we have a task.id so a
-    // retry produces the same id for the same (task, sentence) pair
-    // (downstream dedupers can key on it). Falls back to a UUID for
-    // the in-server instant path that has no row id.
-    const messageIdBase = task.id != null
-      ? `msg_task_${task.id}`
-      : `msg_${randomUUID()}_instant`;
-
-    // ReasoningPush — auto-emitted before the content burst when the
-    // LLM response carried non-empty reasoning_content. `fixed` and
-    // explicit-userMessage paths produce no LLM response, so this
-    // block is naturally skipped for them (llmResponse stays null).
-    if (reasoning) {
-      const reasoningPush = buildReasoningPush({
-        messageType: decryptedPayload.messageType,
-        source,
-        messageId: `${messageIdBase}_reasoning`,
-        sessionId,
-        reasoningContent: reasoning,
-        timestamp: new Date().toISOString(),
-        title: `来自 ${decryptedPayload.contactName}`,
-        contactName: decryptedPayload.contactName,
-        avatarUrl,
-        messageSubtype,
-        metadata,
-      });
-      await ctx.webpush.sendNotification(pushSubscription, JSON.stringify(reasoningPush));
-      await new Promise(resolve => setTimeout(resolve, 1500));
-    }
-
-    for (let i = 0; i < messages.length; i++) {
-      const contentPush = buildContentPush({
-        messageType: decryptedPayload.messageType,
-        source,
-        messageId: `${messageIdBase}_${i}`,
-        sessionId,
-        message: messages[i],
-        timestamp: new Date().toISOString(),
-        title: `来自 ${decryptedPayload.contactName}`,
-        contactName: decryptedPayload.contactName,
-        avatarUrl,
-        messageSubtype,
-        messageIndex: i + 1,
-        totalMessages: messages.length,
-        taskId: task.id || null,
-        metadata,
-      });
-
-      await ctx.webpush.sendNotification(pushSubscription, JSON.stringify(contentPush));
-
-      if (i < messages.length - 1) {
-        await new Promise(resolve => setTimeout(resolve, 1500));
-      }
-    }
-
-    return { success: true, messagesSent: messages.length };
-
-  } catch (error) {
-    return { success: false, messagesSent: 0, error: error.message };
-  }
-}
-
-/**
- * Process a single message identified by UUID (used for instant type).
- *
- * @param {string} uuid
- * @param {ProcessorContext} ctx
- * @param {number} [maxRetries=2]
- * @param {string} [userId]
- * @param {string} [providedMasterKey]
- * @returns {Promise<{ success: boolean, messagesSent?: number, retriesUsed?: number, error?: Object }>}
- */
-async function processMessagesByUuid(uuid, ctx, maxRetries = 2, userId, providedMasterKey) {
-  let retryCount = 0;
-  const masterKey = providedMasterKey || ctx.masterKey;
-
-  if (!masterKey) {
-    return {
-      success: false,
-      error: { code: 'TENANT_MASTER_KEY_MISSING', message: '租户主密钥不存在或配置异常' }
-    };
-  }
-
-  while (retryCount <= maxRetries) {
-    let task;
-    try {
-      task = userId
-        ? await ctx.db.getTaskByUuid(uuid, userId)
-        : await ctx.db.getTaskByUuidOnly(uuid);
-    } catch (error) {
-      if (retryCount < maxRetries) {
-        retryCount++;
-        await new Promise(resolve => setTimeout(resolve, 1000 * retryCount));
-        continue;
-      }
-
-      return {
-        success: false,
-        error: { code: 'INTERNAL_ERROR', message: error.message, retriesAttempted: retryCount }
-      };
-    }
-
-    if (!task) {
-      return { success: false, error: { code: 'TASK_NOT_FOUND', message: '任务不存在或已处理' } };
-    }
-
-    const result = await processSingleMessage(task, ctx, masterKey);
-
-    if (!result.success) {
-      if (retryCount < maxRetries) {
-        retryCount++;
-        await new Promise(resolve => setTimeout(resolve, 1000 * retryCount));
-        continue;
-      }
-
-      try {
-        await ctx.db.updateTaskById(task.id, { status: 'failed', retry_count: retryCount });
-      } catch (_updateError) {
-        // best-effort status update; keep original processing error as primary signal
-      }
-
-      return {
-        success: false,
-        error: { code: 'PROCESSING_ERROR', message: result.error, retriesAttempted: retryCount }
-      };
-    }
-
-    try {
-      await ctx.db.deleteTaskById(task.id);
-    } catch (error) {
-      try {
-        await ctx.db.updateTaskById(task.id, { status: 'sent', retry_count: 0 });
-      } catch (_markSentError) {
-        // best effort: avoid re-sending if storage mutation partially fails
-      }
-
-      return {
-        success: false,
-        error: {
-          code: 'POST_SEND_CLEANUP_FAILED',
-          message: '消息已发送，但任务清理失败',
-          details: { error: error.message }
-        }
-      };
-    }
-
-    return { success: true, messagesSent: result.messagesSent, retriesUsed: retryCount };
-  }
-}
-
-/**
- * Call an OpenAI-compatible API.
- *
- * Returns the full response object alongside the extracted (trimmed)
- * `content` string. Callers that only need the text can ignore
- * `response`; callers that want `reasoning_content` / `tool_calls`
- * read from `response.choices[0].message`.
- *
- * @private
- * @param {Object} payload
- * @returns {Promise<{ response: unknown, content: string }>}
- */
-async function _callAI(payload) {
-  const normalizedApiUrl = normalizeAiApiUrl(payload.apiUrl);
-  const requestBody = buildAiRequestBody(payload);
-
-  const aiResponse = await fetch(normalizedApiUrl, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      'Authorization': `Bearer ${payload.apiKey}`
-    },
-    body: JSON.stringify(requestBody),
-    signal: AbortSignal.timeout(300000)
-  });
-
-  if (!aiResponse.ok) {
-    if (aiResponse.status === 405) {
-      throw new Error(
-        `AI API error: 405 Method Not Allowed. ` +
-        `apiUrl must point to a full chat endpoint (for example: /chat/completions). ` +
-        `Received: ${normalizedApiUrl}`
-      );
-    }
-
-    throw new Error(
-      `AI API error: ${aiResponse.status} ${aiResponse.statusText || 'Unknown Error'}. ` +
-      `Request URL: ${normalizedApiUrl}`
-    );
-  }
-
-  const aiData = await aiResponse.json();
-  const content = aiData?.choices?.[0]?.message?.content;
-  if (typeof content !== 'string' || !content.trim()) {
-    throw new Error('AI API error: response missing choices[0].message.content');
-  }
-
-  return { response: aiData, content: content.trim() };
-}
-
-/**
- * Build OpenAI-compatible request body.
- *
- * `max_tokens` is optional:
- * - include it only when payload.maxTokens is provided
- * - omit it when payload.maxTokens is undefined / null
- *
- * @param {Object} payload
- * @returns {Object}
- */
-function buildAiRequestBody(payload) {
-  // messages mode (added in v2.2.0): forward the caller's OpenAI-style array
-  // verbatim — same contract as @rei-standard/amsg-instant 0.5.0+. No auto
-  // role injection, no concatenation back to a single user message. Lets
-  // the upstream app preserve system / multi-turn context byte-for-byte
-  // across the schedule-message path.
-  const llmMessages = Array.isArray(payload.messages) && payload.messages.length > 0
-    ? payload.messages
-    : [{ role: 'user', content: payload.completePrompt }];
-
-  const requestBody = {
-    model: payload.primaryModel,
-    messages: llmMessages,
-  };
-
-  // Match the instant package's behavior: only inject default temperature
-  // for the legacy completePrompt path; messages mode forwards whatever the
-  // upstream app set (or nothing) so behavior matches their main chat path.
-  if (payload.temperature !== undefined && payload.temperature !== null) {
-    requestBody.temperature = payload.temperature;
-  } else if (!Array.isArray(payload.messages)) {
-    requestBody.temperature = 0.8;
-  }
-
-  if (payload.maxTokens === undefined || payload.maxTokens === null) {
-    return requestBody;
-  }
-
-  if (!Number.isInteger(payload.maxTokens) || payload.maxTokens <= 0) {
-    throw new Error('Invalid maxTokens: maxTokens must be a positive integer when provided.');
-  }
-
-  requestBody.max_tokens = payload.maxTokens;
-  return requestBody;
-}
-
-/**
- * Normalize AI API URL for OpenAI-compatible chat endpoints.
- *
- * **Keep in sync** with `@rei-standard/amsg-instant`'s
- * `src/message-processor.js` `normalizeAiApiUrl` — same rules, same
- * tests. The two packages share this logic but each carry their own copy
- * to avoid an architectural dependency (server should not depend on the
- * stateless worker package).
- *
- * @param {string} apiUrl
- * @returns {string}
- */
-function normalizeAiApiUrl(apiUrl) {
-  if (typeof apiUrl !== 'string' || !apiUrl.trim()) {
-    throw new Error(
-      'Invalid apiUrl: apiUrl is required. ' +
-      'Please provide a chat endpoint URL ' +
-      '(for example: https://api.openai.com or https://api.openai.com/v1/chat/completions).'
-    );
-  }
-
-  const trimmedApiUrl = apiUrl.trim();
-  let parsedUrl;
-
-  try {
-    parsedUrl = new URL(trimmedApiUrl);
-  } catch {
-    throw new Error(
-      `Invalid apiUrl: "${apiUrl}". Please provide a valid absolute URL.`
-    );
-  }
-
-  let path = parsedUrl.pathname.replace(/\/+$/, '') || '/';
-
-  if (/\/chat\/completions$/.test(path)) ; else if (path === '/') {
-    // Bare host → assume OpenAI shape.
-    path = '/v1/chat/completions';
-  } else if (/\/v\d+$/.test(path)) {
-    // Path ends in `/v1`, `/v2`, … — caller already versioned the URL.
-    // Append only `/chat/completions`; never re-add `/v1`.
-    path = `${path}/chat/completions`;
-  }
-  // Any other custom path is left untouched on purpose.
-
-  parsedUrl.pathname = path;
-  return parsedUrl.toString();
-}
-
-/**
- * Handler: schedule-message
- * ReiStandard SDK v2.0.1
- *
- * @param {Object} ctx - Server context.
- * @returns {{ POST: function }}
- */
-
-
-function createScheduleMessageHandler(ctx) {
-  async function POST(headers, body) {
-    const tenantResult = await ctx.tenantManager.resolveTenant(headers);
-    if (!tenantResult.ok) {
-      return tenantResult.error;
-    }
-
-    const tenantCtx = tenantResult.context;
-    const db = tenantCtx.db;
-    const masterKey = tenantCtx.masterKey;
-    const isEncrypted = getHeader(headers, 'x-payload-encrypted') === 'true';
-    const encryptionVersion = getHeader(headers, 'x-encryption-version');
-    const userId = getHeader(headers, 'x-user-id');
-
-    if (!isEncrypted) {
-      return { status: 400, body: { success: false, error: { code: 'ENCRYPTION_REQUIRED', message: '请求体必须加密' } } };
-    }
-    if (!userId) {
-      return { status: 400, body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '缺少用户标识符' } } };
-    }
-    if (!isValidUUIDv4(userId)) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } } };
-    }
-    if (encryptionVersion !== '1') {
-      return { status: 400, body: { success: false, error: { code: 'UNSUPPORTED_ENCRYPTION_VERSION', message: '加密版本不支持' } } };
-    }
-
-    // Decrypt request body
-    const parsedBody = parseEncryptedBody(body);
-    if (!parsedBody.ok) {
-      return { status: 400, body: { success: false, error: parsedBody.error } };
-    }
-
-    const encryptedBody = parsedBody.data;
-
-    let payload;
-    try {
-      const userKey = deriveUserEncryptionKey(userId, masterKey);
-      payload = decryptPayload(encryptedBody, userKey);
-    } catch (error) {
-      if (error instanceof SyntaxError) {
-        return { status: 400, body: { success: false, error: { code: 'INVALID_PAYLOAD_FORMAT', message: '解密后的数据不是有效 JSON' } } };
-      }
-
-      const message = typeof error.message === 'string' ? error.message : '';
-      if (message.includes('auth') || message.includes('Unsupported state')) {
-        return { status: 400, body: { success: false, error: { code: 'DECRYPTION_FAILED', message: '请求体解密失败' } } };
-      }
-
-      return { status: 400, body: { success: false, error: { code: 'DECRYPTION_FAILED', message: '请求体解密失败' } } };
-    }
+    const payload = parsed.data;
+    const tenantId = payload.tenantId || undefined;
+    const driver = payload.driver;
+    const databaseUrl = payload.databaseUrl || payload.connectionString;
 
-    if (!isPlainObject(payload)) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_PAYLOAD_FORMAT', message: '解密后的数据必须是 JSON 对象' } } };
+    if (tenantId && !isValidUUIDv4(tenantId)) {
+      return {
+        status: 400,
+        body: {
+          success: false,
+          error: {
+            code: 'INVALID_TENANT_ID',
+            message: 'tenantId 必须是 UUID v4 格式'
+          }
+        }
+      };
     }
 
-    // Validate
-    const validationResult = validateScheduleMessagePayload(payload);
-    if (!validationResult.valid) {
-      return { status: 400, body: { success: false, error: { code: validationResult.errorCode, message: validationResult.errorMessage, details: validationResult.details } } };
+    if (!databaseUrl || !driver) {
+      return {
+        status: 400,
+        body: {
+          success: false,
+          error: {
+            code: 'INVALID_PARAMETERS',
+            message: '缺少 driver 或 databaseUrl 参数'
+          }
+        }
+      };
     }
 
-    const taskUuid = payload.uuid || randomUUID();
-    const userKey = deriveUserEncryptionKey(userId, masterKey);
-
-    const fullTaskData = {
-      contactName: payload.contactName,
-      avatarUrl: payload.avatarUrl || null,
-      messageType: payload.messageType,
-      messageSubtype: payload.messageSubtype || 'chat',
-      userMessage: payload.userMessage || null,
-      firstSendTime: payload.firstSendTime,
-      recurrenceType: payload.recurrenceType || 'none',
-      apiUrl: payload.apiUrl || null,
-      apiKey: payload.apiKey || null,
-      primaryModel: payload.primaryModel || null,
-      // Prompt is one-of: legacy completePrompt (string) OR messages (OpenAI-
-      // style array). Validation has already enforced exactly-one-of, so
-      // exactly one of these will be non-null when an AI config is provided.
-      completePrompt: payload.completePrompt || null,
-      messages: Array.isArray(payload.messages) ? payload.messages : null,
-      maxTokens: payload.maxTokens ?? null,
-      temperature: payload.temperature ?? null,
-      // 0.6.0+: optional caller-provided regex (string or string[]) used by
-      // the message processor to chunk LLM output into individual pushes.
-      // null → processor falls back to the default /([。！？!?]+)/ regex.
-      splitPattern: payload.splitPattern ?? null,
-      pushSubscription: payload.pushSubscription,
-      metadata: payload.metadata || {}
-    };
+    try {
+      const result = await ctx.tenantManager.initializeTenant({
+        tenantId,
+        driver,
+        connectionString: databaseUrl
+      });
 
-    const encryptedPayload = encryptForStorage(JSON.stringify(fullTaskData), userKey);
-
-    /**
-     * In-server instant path. Delivers an instant message through this
-     * server's own task queue (create task → process by UUID → delete task).
-     * The task is written to the database before processing, so delivery is
-     * not tied to the request connection: even if the client disconnects, the
-     * row stays and the generation keeps running (and can be retried) for as
-     * long as it needs. Use this when you have a database and want long or
-     * guaranteed-complete generations with no dropped messages.
-     *
-     * The stateless alternative is `@rei-standard/amsg-instant`: it streams
-     * over SSE with a Web Push backup and needs no database, which makes it a
-     * good fit for edge runtimes (e.g. Cloudflare Workers). Its work rides the
-     * response connection, so after the client disconnects it only has the
-     * platform's brief grace window to finish (≈20-30s observed on Deno
-     * Deploy) — ideal for short instant messages that complete quickly.
-     */
-    // Instant type: check VAPID before creating the task to avoid orphaned rows
-    if (payload.messageType === 'instant') {
-      if (!ctx.vapid.email || !ctx.vapid.publicKey || !ctx.vapid.privateKey) {
+      return {
+        status: 201,
+        body: {
+          success: true,
+          data: {
+            tenantId: result.tenantId,
+            tenantToken: result.tenantToken,
+            cronToken: result.cronToken,
+            cronWebhookUrl: result.cronWebhookUrl,
+            masterKeyFingerprint: result.masterKeyFingerprint
+          }
+        }
+      };
+    } catch (error) {
+      if (error.message === 'INVALID_DRIVER') {
         return {
-          status: 500,
+          status: 400,
           body: {
             success: false,
             error: {
-              code: 'VAPID_CONFIG_ERROR',
-              message: 'VAPID 配置缺失，无法发送即时消息',
-              details: {
-                missingKeys: [
-                  !ctx.vapid.email && 'VAPID_EMAIL',
-                  !ctx.vapid.publicKey && 'NEXT_PUBLIC_VAPID_PUBLIC_KEY',
-                  !ctx.vapid.privateKey && 'VAPID_PRIVATE_KEY'
-                ].filter(Boolean)
-              }
+              code: 'INVALID_DRIVER',
+              message: 'driver 必须是 neon 或 pg'
             }
           }
         };
       }
-    }
 
-    // Insert into database
-    let dbResult;
-    try {
-      dbResult = await db.createTask({
-        user_id: userId,
-        uuid: taskUuid,
-        encrypted_payload: encryptedPayload,
-        next_send_at: payload.firstSendTime,
-        message_type: payload.messageType
-      });
-    } catch (error) {
-      if (isUniqueViolation(error)) {
+      if (error.message === 'INVALID_DATABASE_URL') {
         return {
-          status: 409,
+          status: 400,
           body: {
             success: false,
             error: {
-              code: 'TASK_UUID_CONFLICT',
-              message: '任务 UUID 已存在，请使用新的 uuid 重新提交'
+              code: 'INVALID_DATABASE_URL',
+              message: 'databaseUrl 不能为空'
             }
           }
         };
       }
-      throw error;
-    }
-
-    if (!dbResult) {
-      return { status: 500, body: { success: false, error: { code: 'TASK_CREATE_FAILED', message: '创建任务失败' } } };
-    }
-
-    /**
-     * In-server instant path. Delivers an instant message through this
-     * server's own task queue (create task → process by UUID → delete task).
-     * The task is written to the database before processing, so delivery is
-     * not tied to the request connection: even if the client disconnects, the
-     * row stays and the generation keeps running (and can be retried) for as
-     * long as it needs. Use this when you have a database and want long or
-     * guaranteed-complete generations with no dropped messages.
-     *
-     * The stateless alternative is `@rei-standard/amsg-instant`: it streams
-     * over SSE with a Web Push backup and needs no database, which makes it a
-     * good fit for edge runtimes (e.g. Cloudflare Workers). Its work rides the
-     * response connection, so after the client disconnects it only has the
-     * platform's brief grace window to finish (≈20-30s observed on Deno
-     * Deploy) — ideal for short instant messages that complete quickly.
-     */
-    // Instant type: send immediately
-    if (payload.messageType === 'instant') {
-      try {
-        const sendResult = await processMessagesByUuid(taskUuid, {
-          ...ctx,
-          db,
-          masterKey
-        }, 2, userId, masterKey);
-
-        if (!sendResult.success) {
-          return { status: 500, body: { success: false, error: { code: 'MESSAGE_SEND_FAILED', message: '消息发送失败', details: sendResult.error } } };
-        }
 
+      if (error.message === 'TENANT_ALREADY_INITIALIZED') {
         return {
-          status: 200,
+          status: 409,
           body: {
-            success: true,
-            data: {
-              uuid: taskUuid,
-              contactName: payload.contactName,
-              messagesSent: sendResult.messagesSent,
-              sentAt: new Date().toISOString(),
-              status: 'sent',
-              retriesUsed: sendResult.retriesUsed || 0
+            success: false,
+            error: {
+              code: 'TENANT_ALREADY_INITIALIZED',
+              message: 'tenantId 已存在，不能重复初始化'
             }
           }
         };
-      } catch (error) {
-        return { status: 500, body: { success: false, error: { code: 'MESSAGE_SEND_FAILED', message: '消息发送失败', details: { error: error.message } } } };
       }
-    }
 
-    // Non-instant: return scheduled response
-    return {
-      status: 201,
-      body: {
-        success: true,
-        data: {
-          id: dbResult.id,
-          uuid: dbResult.uuid,
-          contactName: payload.contactName,
-          nextSendAt: dbResult.next_send_at,
-          status: dbResult.status,
-          createdAt: dbResult.created_at
-        }
-      }
-    };
+      throw error;
+    }
   }
 
   return { POST };
@@ -1580,476 +238,13 @@ function createSendNotificationsHandler(ctx) {
       };
     }
 
-    const startTime = Date.now();
-    const tasks = await db.getPendingTasks(50);
-
-    const MAX_CONCURRENT = 8;
-    const results = {
-      totalTasks: tasks.length,
-      successCount: 0,
-      failedCount: 0,
-      deletedOnceOffTasks: 0,
-      updatedRecurringTasks: 0,
-      failedTasks: []
-    };
-
-    async function handleDeliveryFailure(task, reason) {
-      results.failedCount++;
-
-      try {
-        if (task.retry_count >= 3) {
-          await db.updateTaskById(task.id, { status: 'failed' });
-          results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count, status: 'permanently_failed' });
-        } else {
-          const nextRetryTime = new Date(Date.now() + (task.retry_count + 1) * 2 * 60 * 1000);
-          await db.updateTaskById(task.id, { next_send_at: nextRetryTime.toISOString(), retry_count: task.retry_count + 1 });
-          results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count + 1, nextRetryAt: nextRetryTime.toISOString() });
-        }
-      } catch (updateError) {
-        results.failedTasks.push({
-          taskId: task.id,
-          reason,
-          status: 'retry_update_failed',
-          updateError: updateError.message
-        });
-      }
-    }
-
-    async function handlePostSendPersistenceFailure(task, reason) {
-      results.failedCount++;
-
-      let markedSent = false;
-      try {
-        await db.updateTaskById(task.id, { status: 'sent', retry_count: 0 });
-        markedSent = true;
-      } catch (_markSentError) {
-        markedSent = false;
-      }
-
-      results.failedTasks.push({
-        taskId: task.id,
-        reason,
-        status: markedSent ? 'post_send_cleanup_failed_marked_sent' : 'post_send_cleanup_failed',
-        messageDelivered: true
-      });
-    }
-
-    async function processTask(task) {
-      let sendResult;
-      try {
-        sendResult = await processSingleMessage(task, {
-          ...ctx,
-          db,
-          masterKey
-        }, masterKey);
-      } catch (error) {
-        await handleDeliveryFailure(task, error.message || '消息发送失败');
-        return;
-      }
-
-      if (!sendResult.success) {
-        await handleDeliveryFailure(task, sendResult.error || '消息发送失败');
-        return;
-      }
-
-      try {
-        const userKey = deriveUserEncryptionKey(task.user_id, masterKey);
-        const decryptedPayload = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
-
-        if (decryptedPayload.recurrenceType === 'none') {
-          await db.deleteTaskById(task.id);
-          results.deletedOnceOffTasks++;
-        } else {
-          let nextSendAt;
-          const currentSendAt = new Date(task.next_send_at);
-          if (decryptedPayload.recurrenceType === 'daily') {
-            nextSendAt = new Date(currentSendAt.getTime() + 24 * 60 * 60 * 1000);
-          } else if (decryptedPayload.recurrenceType === 'weekly') {
-            nextSendAt = new Date(currentSendAt.getTime() + 7 * 24 * 60 * 60 * 1000);
-          }
-          await db.updateTaskById(task.id, { next_send_at: nextSendAt.toISOString(), retry_count: 0 });
-          results.updatedRecurringTasks++;
-        }
-
-        results.successCount++;
-      } catch (error) {
-        await handlePostSendPersistenceFailure(task, error.message || '发送后状态更新失败');
-      }
-    }
-
-    // Dynamic task pool
-    const taskQueue = [...tasks];
-    const processing = [];
-
-    while (taskQueue.length > 0 || processing.length > 0) {
-      while (processing.length < MAX_CONCURRENT && taskQueue.length > 0) {
-        const task = taskQueue.shift();
-        const promise = processTask(task);
-        processing.push(promise);
-        promise.finally(() => {
-          const index = processing.indexOf(promise);
-          if (index > -1) processing.splice(index, 1);
-        });
-      }
-      if (processing.length > 0) {
-        await Promise.race(processing);
-      }
-    }
-
-    // Cleanup old tasks
-    await db.cleanupOldTasks(7);
-
-    const executionTime = Date.now() - startTime;
-
-    return {
-      status: 200,
-      body: {
-        success: true,
-        data: {
-          totalTasks: results.totalTasks,
-          successCount: results.successCount,
-          failedCount: results.failedCount,
-          processedAt: new Date().toISOString(),
-          executionTime,
-          details: {
-            deletedOnceOffTasks: results.deletedOnceOffTasks,
-            updatedRecurringTasks: results.updatedRecurringTasks,
-            failedTasks: results.failedTasks
-          }
-        }
-      }
-    };
+    const data = await runScheduledTick({ ...ctx, db, masterKey });
+    return { status: 200, body: { success: true, data } };
   }
 
   return { POST };
 }
 
-/**
- * Handler: update-message
- * ReiStandard SDK v2.0.1
- *
- * @param {Object} ctx - Server context.
- * @returns {{ PUT: function }}
- */
-
-
-function createUpdateMessageHandler(ctx) {
-  async function PUT(url, headers, body) {
-    const tenantResult = await ctx.tenantManager.resolveTenant(headers, { url });
-    if (!tenantResult.ok) {
-      return tenantResult.error;
-    }
-
-    const tenantCtx = tenantResult.context;
-    const db = tenantCtx.db;
-    const masterKey = tenantCtx.masterKey;
-    const u = new URL(url, 'https://dummy');
-    const taskUuid = u.searchParams.get('id');
-
-    if (!taskUuid) {
-      return { status: 400, body: { success: false, error: { code: 'TASK_ID_REQUIRED', message: '缺少任务ID' } } };
-    }
-
-    const userId = getHeader(headers, 'x-user-id');
-    if (!userId) {
-      return { status: 400, body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '缺少用户标识符' } } };
-    }
-    if (!isValidUUIDv4(userId)) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } } };
-    }
-
-    const isEncrypted = getHeader(headers, 'x-payload-encrypted') === 'true';
-    const encryptionVersion = getHeader(headers, 'x-encryption-version');
-
-    if (!isEncrypted) {
-      return { status: 400, body: { success: false, error: { code: 'ENCRYPTION_REQUIRED', message: '请求体必须加密' } } };
-    }
-
-    if (encryptionVersion !== '1') {
-      return { status: 400, body: { success: false, error: { code: 'UNSUPPORTED_ENCRYPTION_VERSION', message: '加密版本不支持' } } };
-    }
-
-    const parsedBody = parseEncryptedBody(body);
-    if (!parsedBody.ok) {
-      return { status: 400, body: { success: false, error: parsedBody.error } };
-    }
-
-    const encryptedBody = parsedBody.data;
-    const userKey = deriveUserEncryptionKey(userId, masterKey);
-    let updates;
-
-    try {
-      updates = decryptPayload(encryptedBody, userKey);
-    } catch (_error) {
-      return { status: 400, body: { success: false, error: { code: 'DECRYPTION_FAILED', message: '请求体解密失败' } } };
-    }
-
-    if (!isPlainObject(updates)) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误' } } };
-    }
-
-    if (updates.nextSendAt && !isValidISO8601(updates.nextSendAt)) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误', details: { invalidFields: ['nextSendAt'] } } } };
-    }
-
-    if (updates.recurrenceType && !['none', 'daily', 'weekly'].includes(updates.recurrenceType)) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误', details: { invalidFields: ['recurrenceType'] } } } };
-    }
-
-    if (
-      Object.prototype.hasOwnProperty.call(updates, 'maxTokens') &&
-      updates.maxTokens !== null &&
-      (!Number.isInteger(updates.maxTokens) || updates.maxTokens <= 0)
-    ) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误', details: { invalidFields: ['maxTokens'] } } } };
-    }
-
-    // Reject updates that try to set both completePrompt and messages at
-    // once. We don't enforce one-of-required here (callers may patch other
-    // fields), but the two prompt sources are mutually exclusive and must
-    // stay that way in storage too.
-    if (
-      updates.completePrompt &&
-      updates.messages !== undefined && updates.messages !== null
-    ) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: 'completePrompt 与 messages 不能同时更新（二选一）', details: { invalidFields: ['completePrompt', 'messages'] } } } };
-    }
-    if (updates.messages !== undefined && updates.messages !== null) {
-      const msgErr = validateLlmMessagesArray(updates.messages);
-      if (msgErr) {
-        return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: msgErr, details: { invalidFields: ['messages'] } } } };
-      }
-    }
-    if (
-      Object.prototype.hasOwnProperty.call(updates, 'temperature') &&
-      updates.temperature !== null &&
-      (typeof updates.temperature !== 'number' || !Number.isFinite(updates.temperature))
-    ) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误', details: { invalidFields: ['temperature'] } } } };
-    }
-    if (Object.prototype.hasOwnProperty.call(updates, 'splitPattern')) {
-      const splitErr = validateSplitPattern(updates.splitPattern);
-      if (splitErr) {
-        return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: splitErr, details: { invalidFields: ['splitPattern'] } } } };
-      }
-    }
-    if (Object.prototype.hasOwnProperty.call(updates, 'avatarUrl')) {
-      const avatarErr = validateAvatarUrl(updates.avatarUrl);
-      if (avatarErr) {
-        // Soft-strip: drop the bad avatarUrl from the patch (keeps the
-        // existing stored avatar untouched) and continue applying the rest
-        // of the update. See standards §6.2.
-        console.warn('[amsg-server] update-message avatarUrl 不合法，已忽略：', avatarErr);
-        delete updates.avatarUrl;
-      }
-    }
-
-    // Fetch existing task
-    const existingTask = await db.getTaskByUuid(taskUuid, userId);
-
-    if (!existingTask) {
-      const taskStatus = await db.getTaskStatus(taskUuid, userId);
-      if (!taskStatus) {
-        return { status: 404, body: { success: false, error: { code: 'TASK_NOT_FOUND', message: '指定的任务不存在或已被删除' } } };
-      }
-      return { status: 409, body: { success: false, error: { code: 'TASK_ALREADY_COMPLETED', message: '任务已完成或已失败，无法更新' } } };
-    }
-
-    const existingData = JSON.parse(decryptFromStorage(existingTask.encrypted_payload, userKey));
-
-    // When the caller switches prompt source (completePrompt ↔ messages),
-    // null out the other so storage stays one-of (matches schedule-message
-    // shape and prevents buildAiRequestBody from accidentally seeing both).
-    const promptUpdates = {};
-    if (updates.completePrompt) {
-      promptUpdates.completePrompt = updates.completePrompt;
-      promptUpdates.messages = null;
-    } else if (updates.messages !== undefined && updates.messages !== null) {
-      promptUpdates.messages = updates.messages;
-      promptUpdates.completePrompt = null;
-    }
-
-    const updatedData = {
-      ...existingData,
-      ...promptUpdates,
-      ...(updates.userMessage && { userMessage: updates.userMessage }),
-      ...(updates.recurrenceType && { recurrenceType: updates.recurrenceType }),
-      ...(updates.avatarUrl && { avatarUrl: updates.avatarUrl }),
-      ...(updates.metadata && { metadata: updates.metadata }),
-      ...(Object.prototype.hasOwnProperty.call(updates, 'maxTokens') && { maxTokens: updates.maxTokens ?? null }),
-      ...(Object.prototype.hasOwnProperty.call(updates, 'temperature') && { temperature: updates.temperature ?? null }),
-      // splitPattern: hasOwnProperty so that explicit `null` (= revert to
-      // default) doesn't get swallowed by truthy-spread the way the optional
-      // string fields above are.
-      ...(Object.prototype.hasOwnProperty.call(updates, 'splitPattern') && { splitPattern: updates.splitPattern ?? null })
-    };
-
-    const encryptedPayload = encryptForStorage(JSON.stringify(updatedData), userKey);
-    const extraFields = updates.nextSendAt ? { next_send_at: updates.nextSendAt } : undefined;
-
-    const result = await db.updateTaskByUuid(taskUuid, userId, encryptedPayload, extraFields);
-
-    if (!result) {
-      return { status: 409, body: { success: false, error: { code: 'UPDATE_CONFLICT', message: '任务更新失败，任务可能已被修改或删除' } } };
-    }
-
-    return {
-      status: 200,
-      body: {
-        success: true,
-        data: {
-          uuid: taskUuid,
-          updatedFields: Object.keys(updates),
-          updatedAt: result.updated_at
-        }
-      }
-    };
-  }
-
-  return { PUT };
-}
-
-/**
- * Handler: cancel-message
- * ReiStandard SDK v2.0.1
- *
- * @param {Object} ctx - Server context.
- * @returns {{ DELETE: function }}
- */
-
-
-function createCancelMessageHandler(ctx) {
-  async function DELETE(url, headers) {
-    const tenantResult = await ctx.tenantManager.resolveTenant(headers, { url });
-    if (!tenantResult.ok) {
-      return tenantResult.error;
-    }
-
-    const db = tenantResult.context.db;
-    const u = new URL(url, 'https://dummy');
-    const taskUuid = u.searchParams.get('id');
-
-    if (!taskUuid) {
-      return { status: 400, body: { success: false, error: { code: 'TASK_ID_REQUIRED', message: '缺少任务ID' } } };
-    }
-
-    const userId = getHeader(headers, 'x-user-id');
-    if (!userId) {
-      return { status: 400, body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '缺少用户标识符' } } };
-    }
-    if (!isValidUUIDv4(userId)) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } } };
-    }
-
-    const deleted = await db.deleteTaskByUuid(taskUuid, userId);
-
-    if (!deleted) {
-      return {
-        status: 404,
-        body: { success: false, error: { code: 'TASK_NOT_FOUND', message: '指定的任务不存在或已被删除' } }
-      };
-    }
-
-    return {
-      status: 200,
-      body: {
-        success: true,
-        data: { uuid: taskUuid, message: '任务已成功取消', deletedAt: new Date().toISOString() }
-      }
-    };
-  }
-
-  return { DELETE };
-}
-
-/**
- * Handler: messages
- * ReiStandard SDK v2.0.1
- *
- * @param {Object} ctx - Server context.
- * @returns {{ GET: function }}
- */
-
-
-function createMessagesHandler(ctx) {
-  async function GET(url, headers) {
-    const tenantResult = await ctx.tenantManager.resolveTenant(headers, { url });
-    if (!tenantResult.ok) {
-      return tenantResult.error;
-    }
-
-    const tenantCtx = tenantResult.context;
-    const db = tenantCtx.db;
-    const masterKey = tenantCtx.masterKey;
-    const userId = getHeader(headers, 'x-user-id');
-
-    if (!userId) {
-      return {
-        status: 400,
-        body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '必须提供 X-User-Id 请求头' } }
-      };
-    }
-    if (!isValidUUIDv4(userId)) {
-      return {
-        status: 400,
-        body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } }
-      };
-    }
-
-    const u = new URL(url, 'https://dummy');
-    const status = u.searchParams.get('status') || 'all';
-    const limit = Math.min(parseInt(u.searchParams.get('limit') || '20', 10), 100);
-    const offset = parseInt(u.searchParams.get('offset') || '0', 10);
-
-    if (isNaN(limit) || limit < 1) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_PARAMETERS', message: 'limit 参数无效，必须为正整数' } } };
-    }
-
-    if (isNaN(offset) || offset < 0) {
-      return { status: 400, body: { success: false, error: { code: 'INVALID_PARAMETERS', message: 'offset 参数无效，必须为非负整数' } } };
-    }
-
-    const { tasks, total } = await db.listTasks(userId, { status, limit, offset });
-
-    const userKey = deriveUserEncryptionKey(userId, masterKey);
-
-    const decryptedTasks = tasks.map(task => {
-      const decrypted = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
-      return {
-        id: task.id,
-        uuid: task.uuid,
-        contactName: decrypted.contactName,
-        messageType: task.message_type,
-        messageSubtype: decrypted.messageSubtype,
-        nextSendAt: task.next_send_at,
-        recurrenceType: decrypted.recurrenceType,
-        status: task.status,
-        retryCount: task.retry_count,
-        createdAt: task.created_at,
-        updatedAt: task.updated_at
-      };
-    });
-
-    const responsePayload = {
-      tasks: decryptedTasks,
-      pagination: { total, limit, offset, hasMore: offset + limit < total }
-    };
-    const encryptedResponse = encryptPayload(responsePayload, userKey);
-
-    return {
-      status: 200,
-      body: {
-        success: true,
-        encrypted: true,
-        version: 1,
-        data: encryptedResponse
-      }
-    };
-  }
-
-  return { GET };
-}
-
 const inMemoryNamespaces = new Map();
 
 function base64UrlEncode$1(input) {
@@ -2498,12 +693,6 @@ function createTenantContextManager(options) {
  */
 
 
-function normalizeVapidSubject(email) {
-  const trimmedEmail = String(email || '').trim();
-  if (!trimmedEmail) return '';
-  return /^mailto:/i.test(trimmedEmail) ? trimmedEmail : `mailto:${trimmedEmail}`;
-}
-
 /**
  * @typedef {Object} VapidConfig
  * @property {string} [email]      - VAPID contact email (e.g. mailto:…).
@@ -2615,4 +804,4 @@ async function createReiServer(config) {
   };
 }
 
-export { createAdapter, createReiServer, createTenantToken, decryptFromStorage, decryptPayload, deriveUserEncryptionKey, encryptForStorage, isValidISO8601, isValidUUID, isValidUUIDv4, isValidUrl, validateAvatarUrl, validateLlmMessagesArray, validateScheduleMessagePayload, validateSplitPattern, verifyTenantToken };
+export { createAdapter, createReiServer, createTenantToken, isValidUUIDv4, runScheduledTick, verifyTenantToken };