@rei-standard/amsg-server 2.5.3 → 2.6.0-next.0

package/dist/cloudflare-BwOfBtLF.d.cts

@@ -0,0 +1,2722 @@
+import { createDecipheriv, createHash, randomBytes as randomBytes$1, createCipheriv, randomUUID } from 'crypto';
+import { validateAvatarUrl, readReasoningContent, stripReasoningTags, buildReasoningPush, buildContentPush, toUint8, base64UrlToBytes, normalizeVapidSubject, concatBytes } from '@rei-standard/amsg-shared';
+
+/**
+ * Validation utility library (SDK version)
+ * ReiStandard SDK v2.0.1
+ */
+
+
+/**
+ * Validate ISO 8601 date string.
+ * @param {string} dateString
+ * @returns {boolean}
+ */
+function isValidISO8601(dateString) {
+  const date = new Date(dateString);
+  return date instanceof Date && !isNaN(date.getTime());
+}
+
+/**
+ * Validate URL format.
+ * @param {string} urlString
+ * @returns {boolean}
+ */
+function isValidUrl(urlString) {
+  try {
+    new URL(urlString);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Validate UUID format.
+ * @param {string} uuid
+ * @returns {boolean}
+ */
+function isValidUUID(uuid) {
+  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return uuidRegex.test(uuid);
+}
+
+/**
+ * Validate UUID v4 format.
+ * @param {string} uuid
+ * @returns {boolean}
+ */
+function isValidUUIDv4(uuid) {
+  const uuidV4Regex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+  return uuidV4Regex.test(uuid);
+}
+
+const VALID_LLM_MESSAGE_ROLES = new Set(['system', 'user', 'assistant', 'tool']);
+
+const SPLIT_PATTERN_MAX_LENGTH = 200;
+const SPLIT_PATTERN_MAX_ITEMS = 10;
+
+/**
+ * Validate the optional `splitPattern` field (amsg-server scheduled tasks
+ * only; amsg-instant 0.8.0 dropped its request-level `splitPattern`).
+ * Accepts `string`, `string[]`, or absent/null. Returns an error message
+ * string, or null when valid.
+ *
+ * Limits (per-item length ≤ 200, array ≤ 10 items, must compile via
+ * `new RegExp(item)`) are an **input-size guard**, NOT a ReDoS defense —
+ * a 6-character pattern like `(a+)+$` is enough to trigger catastrophic
+ * backtracking. The real backstop is Worker / runtime CPU limits + the
+ * fact that splitPattern is stored under the user's own encrypted task
+ * and matched against output from the user's own LLM API key, so the
+ * blast radius is self-inflicted only (no cross-tenant attack surface).
+ *
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+function validateSplitPattern(value) {
+  if (value === undefined || value === null) return null;
+  const isArray = Array.isArray(value);
+  const items = isArray ? value : [value];
+  if (isArray && items.length === 0) return null;          // empty array = use default
+  if (items.length > SPLIT_PATTERN_MAX_ITEMS) {
+    return `splitPattern 数组最多 ${SPLIT_PATTERN_MAX_ITEMS} 项`;
+  }
+  for (let i = 0; i < items.length; i++) {
+    const s = items[i];
+    const label = isArray ? `splitPattern[${i}]` : 'splitPattern';
+    if (typeof s !== 'string') return `${label} 必须是字符串`;
+    if (s.length > SPLIT_PATTERN_MAX_LENGTH) {
+      return `${label} 不能超过 ${SPLIT_PATTERN_MAX_LENGTH} 字符`;
+    }
+    try { new RegExp(s); }
+    catch (_) { return `${label} 不是有效正则表达式`; }
+  }
+  return null;
+}
+
+/**
+ * Validate an OpenAI-style messages array. Same shape contract as
+ * `@rei-standard/amsg-instant` (kept in lockstep on purpose — both packages
+ * end up forwarding this to the same LLM body).
+ *
+ * @param {unknown} messages
+ * @returns {string | null}   Error message, or null if valid.
+ */
+function validateLlmMessagesArray(messages) {
+  if (!Array.isArray(messages) || messages.length === 0) {
+    return 'messages must be a non-empty array';
+  }
+  for (let i = 0; i < messages.length; i++) {
+    const m = messages[i];
+    if (!m || typeof m !== 'object' || Array.isArray(m)) {
+      return `messages[${i}] must be an object`;
+    }
+    if (!VALID_LLM_MESSAGE_ROLES.has(m.role)) {
+      return `messages[${i}].role must be one of system / user / assistant / tool`;
+    }
+    if (typeof m.content === 'string') {
+      if (!m.content) return `messages[${i}].content must be a non-empty string`;
+    } else if (Array.isArray(m.content)) {
+      if (m.content.length === 0) return `messages[${i}].content array must be non-empty`;
+      // Element schema is intentionally not enforced — passed through to LLM as-is.
+    } else {
+      return `messages[${i}].content must be a non-empty string or a non-empty array`;
+    }
+  }
+  return null;
+}
+
+/**
+ * Validate the schedule-message request payload.
+ *
+ * @param {Object} payload
+ * @returns {{ valid: boolean, errorCode?: string, errorMessage?: string, details?: Object }}
+ */
+function validateScheduleMessagePayload(payload) {
+  if (!payload.contactName || typeof payload.contactName !== 'string') {
+    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { missingFields: ['contactName'] } };
+  }
+
+  if (!payload.messageType || !['fixed', 'prompted', 'auto', 'instant'].includes(payload.messageType)) {
+    return { valid: false, errorCode: 'INVALID_MESSAGE_TYPE', errorMessage: '消息类型无效', details: { providedType: payload.messageType, allowedTypes: ['fixed', 'prompted', 'auto', 'instant'] } };
+  }
+
+  if (!payload.firstSendTime || !isValidISO8601(payload.firstSendTime)) {
+    return { valid: false, errorCode: 'INVALID_TIMESTAMP', errorMessage: '时间格式无效', details: { field: 'firstSendTime' } };
+  }
+
+  if (payload.firstSendTime && new Date(payload.firstSendTime) <= new Date()) {
+    return { valid: false, errorCode: 'INVALID_TIMESTAMP', errorMessage: '时间必须在未来', details: { field: 'firstSendTime', reason: 'must be in the future' } };
+  }
+
+  if (!payload.pushSubscription || typeof payload.pushSubscription !== 'object') {
+    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { missingFields: ['pushSubscription'] } };
+  }
+
+  if (payload.recurrenceType && !['none', 'daily', 'weekly'].includes(payload.recurrenceType)) {
+    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['recurrenceType'] } };
+  }
+
+  if (
+    payload.maxTokens !== undefined &&
+    payload.maxTokens !== null &&
+    (!Number.isInteger(payload.maxTokens) || payload.maxTokens <= 0)
+  ) {
+    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['maxTokens'] } };
+  }
+
+  if (payload.messageType === 'fixed') {
+    if (!payload.userMessage) {
+      return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { missingFields: ['userMessage (required for fixed type)'] } };
+    }
+  }
+
+  // ─── Prompt schema (shared by prompted / auto / instant AI configs) ──
+  //
+  // Callers provide *exactly one of* `completePrompt` (string) or `messages`
+  // (OpenAI-style array). Same contract as @rei-standard/amsg-instant; the
+  // server's LLM path forwards either verbatim.
+  const promptCheck = (() => {
+    const hasCompletePrompt = payload.completePrompt !== undefined && payload.completePrompt !== null && payload.completePrompt !== '';
+    const hasMessages = payload.messages !== undefined && payload.messages !== null;
+    if (hasCompletePrompt && hasMessages) {
+      return {
+        error: { code: 'INVALID_PARAMETERS', message: 'exactly one of `completePrompt` or `messages` must be provided（两者不能同时出现）', details: { invalidFields: ['completePrompt', 'messages'] } },
+        hasCompletePrompt: true, hasMessages: true,
+      };
+    }
+    if (hasMessages) {
+      const err = validateLlmMessagesArray(payload.messages);
+      if (err) {
+        return {
+          error: { code: 'INVALID_PARAMETERS', message: err, details: { invalidFields: ['messages'] } },
+          hasCompletePrompt: false, hasMessages: true,
+        };
+      }
+    }
+    return { error: null, hasCompletePrompt, hasMessages };
+  })();
+
+  if (promptCheck.error) {
+    return { valid: false, errorCode: promptCheck.error.code, errorMessage: promptCheck.error.message, details: promptCheck.error.details };
+  }
+  const hasPrompt = promptCheck.hasCompletePrompt || promptCheck.hasMessages;
+
+  if (payload.messageType === 'prompted' || payload.messageType === 'auto') {
+    const missingAiFields = [];
+    if (!hasPrompt) missingAiFields.push('completePrompt or messages');
+    if (!payload.apiUrl) missingAiFields.push('apiUrl');
+    if (!payload.apiKey) missingAiFields.push('apiKey');
+    if (!payload.primaryModel) missingAiFields.push('primaryModel');
+    if (missingAiFields.length > 0) {
+      return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { missingFields: missingAiFields } };
+    }
+  }
+
+  if (payload.messageType === 'instant') {
+    if (payload.recurrenceType && payload.recurrenceType !== 'none') {
+      return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: 'instant 类型的 recurrenceType 必须为 none', details: { invalidFields: ['recurrenceType (must be "none" for instant type)'] } };
+    }
+    const hasAiConfig = hasPrompt && payload.apiUrl && payload.apiKey && payload.primaryModel;
+    const hasUserMessage = payload.userMessage;
+    if (!hasAiConfig && !hasUserMessage) {
+      return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: 'instant 类型必须提供 userMessage 或完整的 AI 配置', details: { missingFields: ['userMessage or ((completePrompt | messages) + apiUrl + apiKey + primaryModel)'] } };
+    }
+  }
+
+  if (
+    payload.temperature !== undefined &&
+    payload.temperature !== null &&
+    (typeof payload.temperature !== 'number' || !Number.isFinite(payload.temperature))
+  ) {
+    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['temperature (must be a finite number)'] } };
+  }
+
+  const avatarErr = validateAvatarUrl(payload.avatarUrl);
+  if (avatarErr) {
+    // Soft-strip: a bad avatarUrl (data: URI / oversized / malformed) used to
+    // 400 the whole schedule. Avatar is cosmetic — drop the field, log, and
+    // let the rest of the task ship. See standards §6.2.
+    console.warn('[amsg-server] avatarUrl 不合法，已置空：', avatarErr);
+    payload.avatarUrl = null;
+  }
+  if (payload.uuid && !isValidUUID(payload.uuid)) {
+    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['uuid (invalid UUID format)'] } };
+  }
+  // messageSubtype is a free-form string tag forwarded to SW-side push payload
+  // for classification. Only the type is enforced; the taxonomy is the
+  // consumer's call (previously the enum was chat/forum/moment).
+  if (
+    payload.messageSubtype !== undefined &&
+    payload.messageSubtype !== null &&
+    typeof payload.messageSubtype !== 'string'
+  ) {
+    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: '缺少必需参数或参数格式错误', details: { invalidFields: ['messageSubtype'] } };
+  }
+
+  const splitErr = validateSplitPattern(payload.splitPattern);
+  if (splitErr) {
+    return { valid: false, errorCode: 'INVALID_PARAMETERS', errorMessage: splitErr, details: { invalidFields: ['splitPattern'] } };
+  }
+
+  return { valid: true };
+}
+
+/**
+ * Request payload utilities.
+ * Keeps body parsing and shape validation consistent across handlers.
+ */
+
+const REQUEST_ERRORS = {
+  INVALID_JSON: { code: 'INVALID_JSON', message: '请求体不是有效的 JSON' },
+  INVALID_REQUEST_BODY: { code: 'INVALID_REQUEST_BODY', message: '请求体格式无效' },
+  INVALID_ENCRYPTED_PAYLOAD: { code: 'INVALID_ENCRYPTED_PAYLOAD', message: '加密数据格式错误' }
+};
+
+/**
+ * @typedef {{ code: string, message: string }} ValidationError
+ */
+
+/**
+ * @typedef {{
+ *   invalidJson?: ValidationError,
+ *   invalidType?: ValidationError
+ * }} ParseBodyOptions
+ */
+
+/**
+ * @typedef {{
+ *   ok: true,
+ *   data: Record<string, any>
+ * } | {
+ *   ok: false,
+ *   error: ValidationError
+ * }} ParseBodyResult
+ */
+
+/**
+ * Parse body into a JSON object.
+ *
+ * @param {unknown} body
+ * @param {ParseBodyOptions} [options]
+ * @returns {ParseBodyResult}
+ */
+function parseBodyAsObject(body, options = {}) {
+  const invalidJson = options.invalidJson || REQUEST_ERRORS.INVALID_JSON;
+  const invalidType = options.invalidType || REQUEST_ERRORS.INVALID_REQUEST_BODY;
+
+  let parsed = body;
+  if (typeof parsed === 'string') {
+    try {
+      parsed = JSON.parse(parsed);
+    } catch {
+      return { ok: false, error: invalidJson };
+    }
+  }
+
+  if (!isPlainObject(parsed)) {
+    return { ok: false, error: invalidType };
+  }
+
+  return { ok: true, data: parsed };
+}
+
+/**
+ * Parse a standard JSON object body.
+ *
+ * @param {unknown} body
+ * @returns {ParseBodyResult}
+ */
+function parseJsonBody(body) {
+  return parseBodyAsObject(body, {
+    invalidJson: REQUEST_ERRORS.INVALID_JSON,
+    invalidType: REQUEST_ERRORS.INVALID_REQUEST_BODY
+  });
+}
+
+/**
+ * Check if a value is a plain object (and not null/array).
+ *
+ * @param {unknown} value
+ * @returns {value is Record<string, any>}
+ */
+function isPlainObject(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Check if an object follows the encrypted payload envelope shape.
+ *
+ * @param {unknown} payload
+ * @returns {payload is { iv: string, authTag: string, encryptedData: string }}
+ */
+function isEncryptedEnvelope(payload) {
+  if (!isPlainObject(payload)) return false;
+
+  return (
+    typeof payload.iv === 'string' &&
+    typeof payload.authTag === 'string' &&
+    typeof payload.encryptedData === 'string'
+  );
+}
+
+/**
+ * Parse and validate an encrypted payload envelope.
+ *
+ * @param {unknown} body
+ * @returns {ParseBodyResult}
+ */
+function parseEncryptedBody(body) {
+  const parsedBody = parseBodyAsObject(body, {
+    invalidJson: REQUEST_ERRORS.INVALID_ENCRYPTED_PAYLOAD,
+    invalidType: REQUEST_ERRORS.INVALID_ENCRYPTED_PAYLOAD
+  });
+
+  if (!parsedBody.ok) {
+    return parsedBody;
+  }
+
+  if (!isEncryptedEnvelope(parsedBody.data)) {
+    return { ok: false, error: REQUEST_ERRORS.INVALID_ENCRYPTED_PAYLOAD };
+  }
+
+  return parsedBody;
+}
+
+/**
+ * Read a header value case-insensitively.
+ *
+ * @param {Record<string, any>} headers
+ * @param {string} name
+ * @returns {string}
+ */
+function getHeader(headers = {}, name) {
+  if (!headers || typeof headers !== 'object') {
+    return '';
+  }
+
+  const lowerName = String(name || '').toLowerCase();
+  if (!lowerName) return '';
+
+  for (const [key, value] of Object.entries(headers)) {
+    if (String(key).toLowerCase() === lowerName) {
+      return String(value || '').trim();
+    }
+  }
+
+  return '';
+}
+
+/**
+ * Encryption utility library (SDK version)
+ * ReiStandard SDK v2.0.1
+ *
+ * Wraps AES-256-GCM operations for request/response and storage encryption.
+ */
+
+
+/**
+ * Derive a user-specific encryption key from the master key.
+ *
+ * @param {string} userId    - Unique user identifier.
+ * @param {string} masterKey - 64-char hex master key.
+ * @returns {string} 64-char hex key.
+ */
+function deriveUserEncryptionKey(userId, masterKey) {
+  return createHash('sha256')
+    .update(masterKey + userId)
+    .digest('hex')
+    .slice(0, 64);
+}
+
+/**
+ * Decrypt a client-encrypted request body (AES-256-GCM, base64 encoded).
+ *
+ * @param {{ iv: string, authTag: string, encryptedData: string }} encryptedPayload
+ * @param {string} encryptionKey - 64-char hex key.
+ * @returns {Object} Decrypted JSON object.
+ */
+function decryptPayload(encryptedPayload, encryptionKey) {
+  const { iv, authTag, encryptedData } = encryptedPayload;
+
+  const decipher = createDecipheriv(
+    'aes-256-gcm',
+    Buffer.from(encryptionKey, 'hex'),
+    Buffer.from(iv, 'base64')
+  );
+
+  decipher.setAuthTag(Buffer.from(authTag, 'base64'));
+
+  const decrypted = Buffer.concat([
+    decipher.update(Buffer.from(encryptedData, 'base64')),
+    decipher.final()
+  ]);
+
+  return JSON.parse(decrypted.toString('utf8'));
+}
+
+/**
+ * Encrypt a JSON payload for API transfer (AES-256-GCM, base64 encoded).
+ *
+ * @param {string|Object} payload
+ * @param {string} encryptionKey - 64-char hex key.
+ * @returns {{ iv: string, authTag: string, encryptedData: string }}
+ */
+function encryptPayload(payload, encryptionKey) {
+  const plaintext = typeof payload === 'string' ? payload : JSON.stringify(payload);
+  const iv = randomBytes$1(12);
+  const cipher = createCipheriv('aes-256-gcm', Buffer.from(encryptionKey, 'hex'), iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+
+  return {
+    iv: iv.toString('base64'),
+    authTag: authTag.toString('base64'),
+    encryptedData: encrypted.toString('base64')
+  };
+}
+
+/**
+ * Encrypt data for database storage (hex encoded, colon-separated).
+ *
+ * @param {string} text          - Plaintext string.
+ * @param {string} encryptionKey - 64-char hex key.
+ * @returns {string} Format: iv:authTag:encryptedData
+ */
+function encryptForStorage(text, encryptionKey) {
+  const iv = randomBytes$1(16);
+  const cipher = createCipheriv('aes-256-gcm', Buffer.from(encryptionKey, 'hex'), iv);
+  const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
+  const authTag = cipher.getAuthTag();
+  return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
+}
+
+/**
+ * Decrypt data from database storage format.
+ *
+ * @param {string} encryptedText - Format: iv:authTag:encryptedData
+ * @param {string} encryptionKey - 64-char hex key.
+ * @returns {string} Plaintext string.
+ */
+function decryptFromStorage(encryptedText, encryptionKey) {
+  const [ivHex, authTagHex, encryptedDataHex] = encryptedText.split(':');
+  const decipher = createDecipheriv(
+    'aes-256-gcm',
+    Buffer.from(encryptionKey, 'hex'),
+    Buffer.from(ivHex, 'hex')
+  );
+  decipher.setAuthTag(Buffer.from(authTagHex, 'hex'));
+  return decipher.update(encryptedDataHex, 'hex', 'utf8') + decipher.final('utf8');
+}
+
+/**
+ * Handler: get-user-key
+ * ReiStandard SDK v2.0.1
+ *
+ * @param {Object} ctx - Server context.
+ * @returns {{ GET: function }}
+ */
+
+
+function createGetUserKeyHandler(ctx) {
+  async function GET(url, headers) {
+    const effectiveHeaders = headers || url || {};
+    const tenantResult = await ctx.tenantManager.resolveTenant(effectiveHeaders);
+    if (!tenantResult.ok) {
+      return tenantResult.error;
+    }
+
+    const { masterKey } = tenantResult.context;
+    const userId = getHeader(effectiveHeaders, 'x-user-id');
+
+    if (!userId) {
+      return {
+        status: 400,
+        body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '缺少用户标识符' } }
+      };
+    }
+
+    if (!isValidUUIDv4(userId)) {
+      return {
+        status: 400,
+        body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } }
+      };
+    }
+
+    return {
+      status: 200,
+      body: {
+        success: true,
+        data: {
+          userKey: deriveUserEncryptionKey(userId, masterKey),
+          version: 1
+        }
+      }
+    };
+  }
+
+  return { GET };
+}
+
+/**
+ * Database error helpers.
+ */
+
+/**
+ * Check whether an error is caused by a unique-constraint violation.
+ *
+ * @param {unknown} error
+ * @returns {boolean}
+ */
+function isUniqueViolation(error) {
+  if (!error || typeof error !== 'object') return false;
+
+  const code = error.code;
+  if (code === '23505') return true;
+
+  const message = typeof error.message === 'string' ? error.message.toLowerCase() : '';
+  return message.includes('duplicate key') || message.includes('unique constraint');
+}
+
+/**
+ * Message Processor (SDK version)
+ * ReiStandard amsg-server v2.4.0
+ *
+ * Handles single message content generation and Web Push delivery for
+ * scheduled tasks (`fixed` / `prompted` / `auto`) and the
+ * in-server instant path (`messageType: 'instant'`).
+ *
+ * Push wire shape comes from `@rei-standard/amsg-shared`'s
+ * discriminated union (`AmsgPush`). The SW (`@rei-standard/amsg-sw`)
+ * routes on `messageKind`. Server-driven pushes always carry
+ * `source: 'instant'` (for the in-server instant path) or
+ * `source: 'scheduled'` (for everything else).
+ *
+ * v2.4.0: when the LLM response carries non-empty
+ * `choices[0].message.reasoning_content`, the processor now emits a
+ * standalone `ReasoningPush` **before** the `ContentPush` burst.
+ * `messagesSent` in the return value continues to reflect the sentence
+ * count only (reasoning is an auxiliary push, not a sentence).
+ */
+
+
+const DEFAULT_SPLIT_REGEX = /([。！？!?]+)/;
+
+// Pacing between consecutive Web Push deliveries (reasoning → content, and
+// between content sentences) so the client renders a natural typing cadence.
+// Kept equal to amsg-instant's SLEEP_BETWEEN_MESSAGES_MS default.
+const SLEEP_BETWEEN_MESSAGES_MS = 1500;
+
+/**
+ * Split a single chunk by one regex; on no-match return [chunk] so a later
+ * regex in a cascade can still take a swing at it.
+ */
+function splitOnceByRegex(chunk, regex) {
+  const out = chunk
+    .split(regex)
+    .reduce((acc, part, i, arr) => {
+      if (i % 2 === 0 && part.trim()) {
+        const punctuation = arr[i + 1] || '';
+        acc.push(part.trim() + punctuation);
+      }
+      return acc;
+    }, [])
+    .filter(s => s.length > 0);
+  return out.length > 0 ? out : [chunk];
+}
+
+/**
+ * Sentence splitter for amsg-server's scheduled `splitPattern` feature
+ * (see standards §6.1). Server-only: amsg-instant 0.8.0 dropped its
+ * request-level `splitPattern`, so there is no instant counterpart to keep
+ * in lockstep.
+ *
+ * @param {string} messageContent
+ * @param {string | string[] | null} [splitPattern=null]
+ * @returns {string[]}
+ */
+function splitMessageIntoSentences(messageContent, splitPattern = null) {
+  const sources =
+    splitPattern == null ? null :
+    Array.isArray(splitPattern) ? splitPattern :
+    [splitPattern];
+
+  const regexes = (sources && sources.length > 0)
+    ? sources.map(s => new RegExp(s))
+    : [DEFAULT_SPLIT_REGEX];
+
+  let chunks = [messageContent];
+  for (const regex of regexes) {
+    chunks = chunks.flatMap(c => splitOnceByRegex(c, regex));
+  }
+
+  return chunks.length > 0 ? chunks : [messageContent];
+}
+
+/**
+ * @typedef {Object} ProcessorContext
+ * @property {Object}  webpush           - The web-push module instance (already VAPID-configured).
+ * @property {Object}  vapid             - { email, publicKey, privateKey }
+ * @property {import('../adapters/interface.js').DbAdapter} db
+ */
+
+/**
+ * Process a single database task row: decrypt → generate content → push.
+ *
+ * @param {import('../adapters/interface.js').TaskRow} task
+ * @param {ProcessorContext} ctx
+ * @param {string} [providedMasterKey]
+ * @returns {Promise<{ success: boolean, messagesSent: number, error?: string }>}
+ */
+async function processSingleMessage(task, ctx, providedMasterKey) {
+  try {
+    const masterKey = providedMasterKey || ctx.masterKey;
+    if (!masterKey) {
+      return { success: false, messagesSent: 0, error: 'TENANT_MASTER_KEY_MISSING' };
+    }
+
+    const userKey = deriveUserEncryptionKey(task.user_id, masterKey);
+    const decryptedPayload = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
+
+    let messageContent;
+    /** @type {unknown} */
+    let llmResponse = null;
+
+    if (decryptedPayload.messageType === 'fixed') {
+      messageContent = decryptedPayload.userMessage;
+
+    } else if (decryptedPayload.messageType === 'instant') {
+      const hasPrompt = !!decryptedPayload.completePrompt
+        || (Array.isArray(decryptedPayload.messages) && decryptedPayload.messages.length > 0);
+      if (hasPrompt && decryptedPayload.apiUrl && decryptedPayload.apiKey && decryptedPayload.primaryModel) {
+        const aiResult = await _callAI(decryptedPayload);
+        messageContent = aiResult.content;
+        llmResponse = aiResult.response;
+      } else if (decryptedPayload.userMessage) {
+        messageContent = decryptedPayload.userMessage;
+      } else {
+        throw new Error('Invalid instant message: no content source available');
+      }
+
+    } else if (decryptedPayload.messageType === 'prompted' || decryptedPayload.messageType === 'auto') {
+      const aiResult = await _callAI(decryptedPayload);
+      messageContent = aiResult.content;
+      llmResponse = aiResult.response;
+    } else {
+      throw new Error('Invalid message configuration: no content source available');
+    }
+
+    // Auto-extract reasoning BEFORE the sentence split: when reasoning
+    // came from the `<think>` fallback inside message.content, the same
+    // span is still embedded in messageContent and would otherwise leak
+    // as raw markup into ContentPush.
+    const reasoning = readReasoningContent(llmResponse);
+    if (reasoning) {
+      messageContent = stripReasoningTags(messageContent);
+    }
+
+    // Sentence splitting (mirrors @rei-standard/amsg-instant
+    // splitMessageIntoSentences — keep in lockstep; do not drift). Caller may
+    // override the default regex via decryptedPayload.splitPattern (string
+    // for a single regex, string[] for a cascade). Validation already enforces
+    // length cap + RegExp compilability upstream.
+    const messages = splitMessageIntoSentences(messageContent, decryptedPayload.splitPattern ?? null);
+
+    if (!ctx.vapid.email || !ctx.vapid.publicKey || !ctx.vapid.privateKey) {
+      throw new Error('VAPID configuration missing - push notifications cannot be sent');
+    }
+
+    const pushSubscription = decryptedPayload.pushSubscription;
+    // sessionId is shared across the optional ReasoningPush and every
+    // ContentPush from this LLM round. Pin it to the task id when
+    // available (scheduled tasks) so retries reuse the same id;
+    // otherwise mint a UUID.
+    const sessionId = task.id != null
+      ? `sess_task_${task.id}`
+      : `sess_${randomUUID()}`;
+    const source = decryptedPayload.messageType === 'instant' ? 'instant' : 'scheduled';
+    const messageSubtype = decryptedPayload.messageSubtype || 'chat';
+    const avatarUrl = decryptedPayload.avatarUrl || null;
+    const metadata = decryptedPayload.metadata || {};
+
+    // `messageId` format — deterministic when we have a task.id so a
+    // retry produces the same id for the same (task, sentence) pair
+    // (downstream dedupers can key on it). Falls back to a UUID for
+    // the in-server instant path that has no row id.
+    const messageIdBase = task.id != null
+      ? `msg_task_${task.id}`
+      : `msg_${randomUUID()}_instant`;
+
+    // ReasoningPush — auto-emitted before the content burst when the
+    // LLM response carried non-empty reasoning_content. `fixed` and
+    // explicit-userMessage paths produce no LLM response, so this
+    // block is naturally skipped for them (llmResponse stays null).
+    if (reasoning) {
+      const reasoningPush = buildReasoningPush({
+        messageType: decryptedPayload.messageType,
+        source,
+        messageId: `${messageIdBase}_reasoning`,
+        sessionId,
+        reasoningContent: reasoning,
+        timestamp: new Date().toISOString(),
+        title: `来自 ${decryptedPayload.contactName}`,
+        contactName: decryptedPayload.contactName,
+        avatarUrl,
+        messageSubtype,
+        metadata,
+      });
+      await ctx.webpush.sendNotification(pushSubscription, JSON.stringify(reasoningPush));
+      await new Promise(resolve => setTimeout(resolve, SLEEP_BETWEEN_MESSAGES_MS));
+    }
+
+    for (let i = 0; i < messages.length; i++) {
+      const contentPush = buildContentPush({
+        messageType: decryptedPayload.messageType,
+        source,
+        messageId: `${messageIdBase}_${i}`,
+        sessionId,
+        message: messages[i],
+        timestamp: new Date().toISOString(),
+        title: `来自 ${decryptedPayload.contactName}`,
+        contactName: decryptedPayload.contactName,
+        avatarUrl,
+        messageSubtype,
+        messageIndex: i + 1,
+        totalMessages: messages.length,
+        taskId: task.id || null,
+        metadata,
+      });
+
+      await ctx.webpush.sendNotification(pushSubscription, JSON.stringify(contentPush));
+
+      if (i < messages.length - 1) {
+        await new Promise(resolve => setTimeout(resolve, SLEEP_BETWEEN_MESSAGES_MS));
+      }
+    }
+
+    return { success: true, messagesSent: messages.length };
+
+  } catch (error) {
+    return { success: false, messagesSent: 0, error: error.message };
+  }
+}
+
+/**
+ * Process a single message identified by UUID (used for instant type).
+ *
+ * @param {string} uuid
+ * @param {ProcessorContext} ctx
+ * @param {number} [maxRetries=2]
+ * @param {string} [userId]
+ * @param {string} [providedMasterKey]
+ * @returns {Promise<{ success: boolean, messagesSent?: number, retriesUsed?: number, error?: Object }>}
+ */
+async function processMessagesByUuid(uuid, ctx, maxRetries = 2, userId, providedMasterKey) {
+  let retryCount = 0;
+  const masterKey = providedMasterKey || ctx.masterKey;
+
+  if (!masterKey) {
+    return {
+      success: false,
+      error: { code: 'TENANT_MASTER_KEY_MISSING', message: '租户主密钥不存在或配置异常' }
+    };
+  }
+
+  while (retryCount <= maxRetries) {
+    let task;
+    try {
+      task = userId
+        ? await ctx.db.getTaskByUuid(uuid, userId)
+        : await ctx.db.getTaskByUuidOnly(uuid);
+    } catch (error) {
+      if (retryCount < maxRetries) {
+        retryCount++;
+        await new Promise(resolve => setTimeout(resolve, 1000 * retryCount));
+        continue;
+      }
+
+      return {
+        success: false,
+        error: { code: 'INTERNAL_ERROR', message: error.message, retriesAttempted: retryCount }
+      };
+    }
+
+    if (!task) {
+      return { success: false, error: { code: 'TASK_NOT_FOUND', message: '任务不存在或已处理' } };
+    }
+
+    const result = await processSingleMessage(task, ctx, masterKey);
+
+    if (!result.success) {
+      if (retryCount < maxRetries) {
+        retryCount++;
+        await new Promise(resolve => setTimeout(resolve, 1000 * retryCount));
+        continue;
+      }
+
+      try {
+        await ctx.db.updateTaskById(task.id, { status: 'failed', retry_count: retryCount });
+      } catch (_updateError) {
+        // best-effort status update; keep original processing error as primary signal
+      }
+
+      return {
+        success: false,
+        error: { code: 'PROCESSING_ERROR', message: result.error, retriesAttempted: retryCount }
+      };
+    }
+
+    try {
+      await ctx.db.deleteTaskById(task.id);
+    } catch (error) {
+      try {
+        await ctx.db.updateTaskById(task.id, { status: 'sent', retry_count: 0 });
+      } catch (_markSentError) {
+        // best effort: avoid re-sending if storage mutation partially fails
+      }
+
+      return {
+        success: false,
+        error: {
+          code: 'POST_SEND_CLEANUP_FAILED',
+          message: '消息已发送，但任务清理失败',
+          details: { error: error.message }
+        }
+      };
+    }
+
+    return { success: true, messagesSent: result.messagesSent, retriesUsed: retryCount };
+  }
+}
+
+/**
+ * Call an OpenAI-compatible API.
+ *
+ * Returns the full response object alongside the extracted (trimmed)
+ * `content` string. Callers that only need the text can ignore
+ * `response`; callers that want `reasoning_content` / `tool_calls`
+ * read from `response.choices[0].message`.
+ *
+ * @private
+ * @param {Object} payload
+ * @returns {Promise<{ response: unknown, content: string }>}
+ */
+async function _callAI(payload) {
+  const normalizedApiUrl = normalizeAiApiUrl(payload.apiUrl);
+  const requestBody = buildAiRequestBody(payload);
+
+  const aiResponse = await fetch(normalizedApiUrl, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${payload.apiKey}`
+    },
+    body: JSON.stringify(requestBody),
+    signal: AbortSignal.timeout(300000)
+  });
+
+  if (!aiResponse.ok) {
+    if (aiResponse.status === 405) {
+      throw new Error(
+        `AI API error: 405 Method Not Allowed. ` +
+        `apiUrl must point to a full chat endpoint (for example: /chat/completions). ` +
+        `Received: ${normalizedApiUrl}`
+      );
+    }
+
+    throw new Error(
+      `AI API error: ${aiResponse.status} ${aiResponse.statusText || 'Unknown Error'}. ` +
+      `Request URL: ${normalizedApiUrl}`
+    );
+  }
+
+  const aiData = await aiResponse.json();
+  const content = aiData?.choices?.[0]?.message?.content;
+  if (typeof content !== 'string' || !content.trim()) {
+    throw new Error('AI API error: response missing choices[0].message.content');
+  }
+
+  return { response: aiData, content: content.trim() };
+}
+
+/**
+ * Build OpenAI-compatible request body.
+ *
+ * `max_tokens` is optional:
+ * - include it only when payload.maxTokens is provided
+ * - omit it when payload.maxTokens is undefined / null
+ *
+ * @param {Object} payload
+ * @returns {Object}
+ */
+function buildAiRequestBody(payload) {
+  // messages mode (added in v2.2.0): forward the caller's OpenAI-style array
+  // verbatim — same contract as @rei-standard/amsg-instant 0.5.0+. No auto
+  // role injection, no concatenation back to a single user message. Lets
+  // the upstream app preserve system / multi-turn context byte-for-byte
+  // across the schedule-message path.
+  const llmMessages = Array.isArray(payload.messages) && payload.messages.length > 0
+    ? payload.messages
+    : [{ role: 'user', content: payload.completePrompt }];
+
+  const requestBody = {
+    model: payload.primaryModel,
+    messages: llmMessages,
+  };
+
+  // Match the instant package's behavior: only inject default temperature
+  // for the legacy completePrompt path; messages mode forwards whatever the
+  // upstream app set (or nothing) so behavior matches their main chat path.
+  if (payload.temperature !== undefined && payload.temperature !== null) {
+    requestBody.temperature = payload.temperature;
+  } else if (!Array.isArray(payload.messages)) {
+    requestBody.temperature = 0.8;
+  }
+
+  if (payload.maxTokens === undefined || payload.maxTokens === null) {
+    return requestBody;
+  }
+
+  if (!Number.isInteger(payload.maxTokens) || payload.maxTokens <= 0) {
+    throw new Error('Invalid maxTokens: maxTokens must be a positive integer when provided.');
+  }
+
+  requestBody.max_tokens = payload.maxTokens;
+  return requestBody;
+}
+
+/**
+ * Normalize AI API URL for OpenAI-compatible chat endpoints.
+ *
+ * **Keep in sync** with `@rei-standard/amsg-instant`'s
+ * `src/message-processor.js` `normalizeAiApiUrl` — same rules, same
+ * tests. The two packages share this logic but each carry their own copy
+ * to avoid an architectural dependency (server should not depend on the
+ * stateless worker package).
+ *
+ * @param {string} apiUrl
+ * @returns {string}
+ */
+function normalizeAiApiUrl(apiUrl) {
+  if (typeof apiUrl !== 'string' || !apiUrl.trim()) {
+    throw new Error(
+      'Invalid apiUrl: apiUrl is required. ' +
+      'Please provide a chat endpoint URL ' +
+      '(for example: https://api.openai.com or https://api.openai.com/v1/chat/completions).'
+    );
+  }
+
+  const trimmedApiUrl = apiUrl.trim();
+  let parsedUrl;
+
+  try {
+    parsedUrl = new URL(trimmedApiUrl);
+  } catch {
+    throw new Error(
+      `Invalid apiUrl: "${apiUrl}". Please provide a valid absolute URL.`
+    );
+  }
+
+  let path = parsedUrl.pathname.replace(/\/+$/, '') || '/';
+
+  if (/\/chat\/completions$/.test(path)) ; else if (path === '/') {
+    // Bare host → assume OpenAI shape.
+    path = '/v1/chat/completions';
+  } else if (/\/v\d+$/.test(path)) {
+    // Path ends in `/v1`, `/v2`, … — caller already versioned the URL.
+    // Append only `/chat/completions`; never re-add `/v1`.
+    path = `${path}/chat/completions`;
+  }
+  // Any other custom path is left untouched on purpose.
+
+  parsedUrl.pathname = path;
+  return parsedUrl.toString();
+}
+
+/**
+ * Handler: schedule-message
+ * ReiStandard SDK v2.0.1
+ *
+ * @param {Object} ctx - Server context.
+ * @returns {{ POST: function }}
+ */
+
+
+function createScheduleMessageHandler(ctx) {
+  async function POST(headers, body) {
+    const tenantResult = await ctx.tenantManager.resolveTenant(headers);
+    if (!tenantResult.ok) {
+      return tenantResult.error;
+    }
+
+    const tenantCtx = tenantResult.context;
+    const db = tenantCtx.db;
+    const masterKey = tenantCtx.masterKey;
+    const isEncrypted = getHeader(headers, 'x-payload-encrypted') === 'true';
+    const encryptionVersion = getHeader(headers, 'x-encryption-version');
+    const userId = getHeader(headers, 'x-user-id');
+
+    if (!isEncrypted) {
+      return { status: 400, body: { success: false, error: { code: 'ENCRYPTION_REQUIRED', message: '请求体必须加密' } } };
+    }
+    if (!userId) {
+      return { status: 400, body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '缺少用户标识符' } } };
+    }
+    if (!isValidUUIDv4(userId)) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } } };
+    }
+    if (encryptionVersion !== '1') {
+      return { status: 400, body: { success: false, error: { code: 'UNSUPPORTED_ENCRYPTION_VERSION', message: '加密版本不支持' } } };
+    }
+
+    // Decrypt request body
+    const parsedBody = parseEncryptedBody(body);
+    if (!parsedBody.ok) {
+      return { status: 400, body: { success: false, error: parsedBody.error } };
+    }
+
+    const encryptedBody = parsedBody.data;
+
+    let payload;
+    try {
+      const userKey = deriveUserEncryptionKey(userId, masterKey);
+      payload = decryptPayload(encryptedBody, userKey);
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        return { status: 400, body: { success: false, error: { code: 'INVALID_PAYLOAD_FORMAT', message: '解密后的数据不是有效 JSON' } } };
+      }
+
+      const message = typeof error.message === 'string' ? error.message : '';
+      if (message.includes('auth') || message.includes('Unsupported state')) {
+        return { status: 400, body: { success: false, error: { code: 'DECRYPTION_FAILED', message: '请求体解密失败' } } };
+      }
+
+      return { status: 400, body: { success: false, error: { code: 'DECRYPTION_FAILED', message: '请求体解密失败' } } };
+    }
+
+    if (!isPlainObject(payload)) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_PAYLOAD_FORMAT', message: '解密后的数据必须是 JSON 对象' } } };
+    }
+
+    // Validate
+    const validationResult = validateScheduleMessagePayload(payload);
+    if (!validationResult.valid) {
+      return { status: 400, body: { success: false, error: { code: validationResult.errorCode, message: validationResult.errorMessage, details: validationResult.details } } };
+    }
+
+    const taskUuid = payload.uuid || randomUUID();
+    const userKey = deriveUserEncryptionKey(userId, masterKey);
+
+    const fullTaskData = {
+      contactName: payload.contactName,
+      avatarUrl: payload.avatarUrl || null,
+      messageType: payload.messageType,
+      messageSubtype: payload.messageSubtype || 'chat',
+      userMessage: payload.userMessage || null,
+      firstSendTime: payload.firstSendTime,
+      recurrenceType: payload.recurrenceType || 'none',
+      apiUrl: payload.apiUrl || null,
+      apiKey: payload.apiKey || null,
+      primaryModel: payload.primaryModel || null,
+      // Prompt is one-of: legacy completePrompt (string) OR messages (OpenAI-
+      // style array). Validation has already enforced exactly-one-of, so
+      // exactly one of these will be non-null when an AI config is provided.
+      completePrompt: payload.completePrompt || null,
+      messages: Array.isArray(payload.messages) ? payload.messages : null,
+      maxTokens: payload.maxTokens ?? null,
+      temperature: payload.temperature ?? null,
+      // 0.6.0+: optional caller-provided regex (string or string[]) used by
+      // the message processor to chunk LLM output into individual pushes.
+      // null → processor falls back to the default /([。！？!?]+)/ regex.
+      splitPattern: payload.splitPattern ?? null,
+      pushSubscription: payload.pushSubscription,
+      metadata: payload.metadata || {}
+    };
+
+    const encryptedPayload = encryptForStorage(JSON.stringify(fullTaskData), userKey);
+
+    /**
+     * In-server instant path. Delivers an instant message through this
+     * server's own task queue (create task → process by UUID → delete task).
+     * The task is written to the database before processing, so delivery is
+     * not tied to the request connection: even if the client disconnects, the
+     * row stays and the generation keeps running (and can be retried) for as
+     * long as it needs. Use this when you have a database and want long or
+     * guaranteed-complete generations with no dropped messages.
+     *
+     * The stateless alternative is `@rei-standard/amsg-instant`: it streams
+     * over SSE with a Web Push backup and needs no database, which makes it a
+     * good fit for edge runtimes (e.g. Cloudflare Workers). Its work rides the
+     * response connection, so after the client disconnects it only has the
+     * platform's brief grace window to finish (≈20-30s observed on Deno
+     * Deploy) — ideal for short instant messages that complete quickly.
+     */
+    // Instant type: check VAPID before creating the task to avoid orphaned rows
+    if (payload.messageType === 'instant') {
+      if (!ctx.vapid.email || !ctx.vapid.publicKey || !ctx.vapid.privateKey) {
+        return {
+          status: 500,
+          body: {
+            success: false,
+            error: {
+              code: 'VAPID_CONFIG_ERROR',
+              message: 'VAPID 配置缺失，无法发送即时消息',
+              details: {
+                missingKeys: [
+                  !ctx.vapid.email && 'VAPID_EMAIL',
+                  !ctx.vapid.publicKey && 'NEXT_PUBLIC_VAPID_PUBLIC_KEY',
+                  !ctx.vapid.privateKey && 'VAPID_PRIVATE_KEY'
+                ].filter(Boolean)
+              }
+            }
+          }
+        };
+      }
+    }
+
+    // Insert into database
+    let dbResult;
+    try {
+      dbResult = await db.createTask({
+        user_id: userId,
+        uuid: taskUuid,
+        encrypted_payload: encryptedPayload,
+        next_send_at: payload.firstSendTime,
+        message_type: payload.messageType
+      });
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        return {
+          status: 409,
+          body: {
+            success: false,
+            error: {
+              code: 'TASK_UUID_CONFLICT',
+              message: '任务 UUID 已存在，请使用新的 uuid 重新提交'
+            }
+          }
+        };
+      }
+      throw error;
+    }
+
+    if (!dbResult) {
+      return { status: 500, body: { success: false, error: { code: 'TASK_CREATE_FAILED', message: '创建任务失败' } } };
+    }
+
+    /**
+     * In-server instant path. Delivers an instant message through this
+     * server's own task queue (create task → process by UUID → delete task).
+     * The task is written to the database before processing, so delivery is
+     * not tied to the request connection: even if the client disconnects, the
+     * row stays and the generation keeps running (and can be retried) for as
+     * long as it needs. Use this when you have a database and want long or
+     * guaranteed-complete generations with no dropped messages.
+     *
+     * The stateless alternative is `@rei-standard/amsg-instant`: it streams
+     * over SSE with a Web Push backup and needs no database, which makes it a
+     * good fit for edge runtimes (e.g. Cloudflare Workers). Its work rides the
+     * response connection, so after the client disconnects it only has the
+     * platform's brief grace window to finish (≈20-30s observed on Deno
+     * Deploy) — ideal for short instant messages that complete quickly.
+     */
+    // Instant type: send immediately
+    if (payload.messageType === 'instant') {
+      try {
+        const sendResult = await processMessagesByUuid(taskUuid, {
+          ...ctx,
+          db,
+          masterKey
+        }, 2, userId, masterKey);
+
+        if (!sendResult.success) {
+          return { status: 500, body: { success: false, error: { code: 'MESSAGE_SEND_FAILED', message: '消息发送失败', details: sendResult.error } } };
+        }
+
+        return {
+          status: 200,
+          body: {
+            success: true,
+            data: {
+              uuid: taskUuid,
+              contactName: payload.contactName,
+              messagesSent: sendResult.messagesSent,
+              sentAt: new Date().toISOString(),
+              status: 'sent',
+              retriesUsed: sendResult.retriesUsed || 0
+            }
+          }
+        };
+      } catch (error) {
+        return { status: 500, body: { success: false, error: { code: 'MESSAGE_SEND_FAILED', message: '消息发送失败', details: { error: error.message } } } };
+      }
+    }
+
+    // Non-instant: return scheduled response
+    return {
+      status: 201,
+      body: {
+        success: true,
+        data: {
+          id: dbResult.id,
+          uuid: dbResult.uuid,
+          contactName: payload.contactName,
+          nextSendAt: dbResult.next_send_at,
+          status: dbResult.status,
+          createdAt: dbResult.created_at
+        }
+      }
+    };
+  }
+
+  return { POST };
+}
+
+/**
+ * Scheduled tick core: fetch due tasks, deliver, reschedule/retry, cleanup.
+ * Extracted verbatim from the send-notifications handler so both the HTTP
+ * handler (multi-tenant) and the CF scheduled() path (single-user) share it.
+ *
+ * @param {Object} ctx - { db, masterKey, vapid, webpush }
+ * @returns {Promise<Object>} summary { totalTasks, successCount, failedCount, processedAt, executionTime, details }
+ */
+
+
+async function runScheduledTick(ctx) {
+  const db = ctx.db;
+  const masterKey = ctx.masterKey;
+
+  const startTime = Date.now();
+  const tasks = await db.getPendingTasks(50);
+
+  const MAX_CONCURRENT = 8;
+  const results = {
+    totalTasks: tasks.length,
+    successCount: 0,
+    failedCount: 0,
+    deletedOnceOffTasks: 0,
+    updatedRecurringTasks: 0,
+    failedTasks: []
+  };
+
+  async function handleDeliveryFailure(task, reason) {
+    results.failedCount++;
+    try {
+      if (task.retry_count >= 3) {
+        await db.updateTaskById(task.id, { status: 'failed' });
+        results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count, status: 'permanently_failed' });
+      } else {
+        const nextRetryTime = new Date(Date.now() + (task.retry_count + 1) * 2 * 60 * 1000);
+        await db.updateTaskById(task.id, { next_send_at: nextRetryTime.toISOString(), retry_count: task.retry_count + 1 });
+        results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count + 1, nextRetryAt: nextRetryTime.toISOString() });
+      }
+    } catch (updateError) {
+      results.failedTasks.push({ taskId: task.id, reason, status: 'retry_update_failed', updateError: updateError.message });
+    }
+  }
+
+  async function handlePostSendPersistenceFailure(task, reason) {
+    results.failedCount++;
+    let markedSent = false;
+    try {
+      await db.updateTaskById(task.id, { status: 'sent', retry_count: 0 });
+      markedSent = true;
+    } catch (_markSentError) {
+      markedSent = false;
+    }
+    results.failedTasks.push({
+      taskId: task.id,
+      reason,
+      status: markedSent ? 'post_send_cleanup_failed_marked_sent' : 'post_send_cleanup_failed',
+      messageDelivered: true
+    });
+  }
+
+  async function processTask(task) {
+    let sendResult;
+    try {
+      sendResult = await processSingleMessage(task, { ...ctx, db, masterKey }, masterKey);
+    } catch (error) {
+      await handleDeliveryFailure(task, error.message || '消息发送失败');
+      return;
+    }
+
+    if (!sendResult.success) {
+      await handleDeliveryFailure(task, sendResult.error || '消息发送失败');
+      return;
+    }
+
+    try {
+      const userKey = deriveUserEncryptionKey(task.user_id, masterKey);
+      const decryptedPayload = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
+
+      if (decryptedPayload.recurrenceType === 'none') {
+        await db.deleteTaskById(task.id);
+        results.deletedOnceOffTasks++;
+      } else {
+        let nextSendAt;
+        const currentSendAt = new Date(task.next_send_at);
+        if (decryptedPayload.recurrenceType === 'daily') {
+          nextSendAt = new Date(currentSendAt.getTime() + 24 * 60 * 60 * 1000);
+        } else if (decryptedPayload.recurrenceType === 'weekly') {
+          nextSendAt = new Date(currentSendAt.getTime() + 7 * 24 * 60 * 60 * 1000);
+        }
+        await db.updateTaskById(task.id, { next_send_at: nextSendAt.toISOString(), retry_count: 0 });
+        results.updatedRecurringTasks++;
+      }
+
+      results.successCount++;
+    } catch (error) {
+      await handlePostSendPersistenceFailure(task, error.message || '发送后状态更新失败');
+    }
+  }
+
+  const taskQueue = [...tasks];
+  const processing = [];
+
+  while (taskQueue.length > 0 || processing.length > 0) {
+    while (processing.length < MAX_CONCURRENT && taskQueue.length > 0) {
+      const task = taskQueue.shift();
+      const promise = processTask(task);
+      processing.push(promise);
+      promise.finally(() => {
+        const index = processing.indexOf(promise);
+        if (index > -1) processing.splice(index, 1);
+      });
+    }
+    if (processing.length > 0) {
+      await Promise.race(processing);
+    }
+  }
+
+  await db.cleanupOldTasks(7);
+
+  const executionTime = Date.now() - startTime;
+
+  return {
+    totalTasks: results.totalTasks,
+    successCount: results.successCount,
+    failedCount: results.failedCount,
+    processedAt: new Date().toISOString(),
+    executionTime,
+    details: {
+      deletedOnceOffTasks: results.deletedOnceOffTasks,
+      updatedRecurringTasks: results.updatedRecurringTasks,
+      failedTasks: results.failedTasks
+    }
+  };
+}
+
+/**
+ * Handler: update-message
+ * ReiStandard SDK v2.0.1
+ *
+ * @param {Object} ctx - Server context.
+ * @returns {{ PUT: function }}
+ */
+
+
+function createUpdateMessageHandler(ctx) {
+  async function PUT(url, headers, body) {
+    const tenantResult = await ctx.tenantManager.resolveTenant(headers, { url });
+    if (!tenantResult.ok) {
+      return tenantResult.error;
+    }
+
+    const tenantCtx = tenantResult.context;
+    const db = tenantCtx.db;
+    const masterKey = tenantCtx.masterKey;
+    const u = new URL(url, 'https://dummy');
+    const taskUuid = u.searchParams.get('id');
+
+    if (!taskUuid) {
+      return { status: 400, body: { success: false, error: { code: 'TASK_ID_REQUIRED', message: '缺少任务ID' } } };
+    }
+
+    const userId = getHeader(headers, 'x-user-id');
+    if (!userId) {
+      return { status: 400, body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '缺少用户标识符' } } };
+    }
+    if (!isValidUUIDv4(userId)) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } } };
+    }
+
+    const isEncrypted = getHeader(headers, 'x-payload-encrypted') === 'true';
+    const encryptionVersion = getHeader(headers, 'x-encryption-version');
+
+    if (!isEncrypted) {
+      return { status: 400, body: { success: false, error: { code: 'ENCRYPTION_REQUIRED', message: '请求体必须加密' } } };
+    }
+
+    if (encryptionVersion !== '1') {
+      return { status: 400, body: { success: false, error: { code: 'UNSUPPORTED_ENCRYPTION_VERSION', message: '加密版本不支持' } } };
+    }
+
+    const parsedBody = parseEncryptedBody(body);
+    if (!parsedBody.ok) {
+      return { status: 400, body: { success: false, error: parsedBody.error } };
+    }
+
+    const encryptedBody = parsedBody.data;
+    const userKey = deriveUserEncryptionKey(userId, masterKey);
+    let updates;
+
+    try {
+      updates = decryptPayload(encryptedBody, userKey);
+    } catch (_error) {
+      return { status: 400, body: { success: false, error: { code: 'DECRYPTION_FAILED', message: '请求体解密失败' } } };
+    }
+
+    if (!isPlainObject(updates)) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误' } } };
+    }
+
+    if (updates.nextSendAt && !isValidISO8601(updates.nextSendAt)) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误', details: { invalidFields: ['nextSendAt'] } } } };
+    }
+
+    if (updates.recurrenceType && !['none', 'daily', 'weekly'].includes(updates.recurrenceType)) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误', details: { invalidFields: ['recurrenceType'] } } } };
+    }
+
+    if (
+      Object.prototype.hasOwnProperty.call(updates, 'maxTokens') &&
+      updates.maxTokens !== null &&
+      (!Number.isInteger(updates.maxTokens) || updates.maxTokens <= 0)
+    ) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误', details: { invalidFields: ['maxTokens'] } } } };
+    }
+
+    // Reject updates that try to set both completePrompt and messages at
+    // once. We don't enforce one-of-required here (callers may patch other
+    // fields), but the two prompt sources are mutually exclusive and must
+    // stay that way in storage too.
+    if (
+      updates.completePrompt &&
+      updates.messages !== undefined && updates.messages !== null
+    ) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: 'completePrompt 与 messages 不能同时更新（二选一）', details: { invalidFields: ['completePrompt', 'messages'] } } } };
+    }
+    if (updates.messages !== undefined && updates.messages !== null) {
+      const msgErr = validateLlmMessagesArray(updates.messages);
+      if (msgErr) {
+        return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: msgErr, details: { invalidFields: ['messages'] } } } };
+      }
+    }
+    if (
+      Object.prototype.hasOwnProperty.call(updates, 'temperature') &&
+      updates.temperature !== null &&
+      (typeof updates.temperature !== 'number' || !Number.isFinite(updates.temperature))
+    ) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: '更新数据格式错误', details: { invalidFields: ['temperature'] } } } };
+    }
+    if (Object.prototype.hasOwnProperty.call(updates, 'splitPattern')) {
+      const splitErr = validateSplitPattern(updates.splitPattern);
+      if (splitErr) {
+        return { status: 400, body: { success: false, error: { code: 'INVALID_UPDATE_DATA', message: splitErr, details: { invalidFields: ['splitPattern'] } } } };
+      }
+    }
+    if (Object.prototype.hasOwnProperty.call(updates, 'avatarUrl')) {
+      const avatarErr = validateAvatarUrl(updates.avatarUrl);
+      if (avatarErr) {
+        // Soft-strip: drop the bad avatarUrl from the patch (keeps the
+        // existing stored avatar untouched) and continue applying the rest
+        // of the update. See standards §6.2.
+        console.warn('[amsg-server] update-message avatarUrl 不合法，已忽略：', avatarErr);
+        delete updates.avatarUrl;
+      }
+    }
+
+    // Fetch existing task
+    const existingTask = await db.getTaskByUuid(taskUuid, userId);
+
+    if (!existingTask) {
+      const taskStatus = await db.getTaskStatus(taskUuid, userId);
+      if (!taskStatus) {
+        return { status: 404, body: { success: false, error: { code: 'TASK_NOT_FOUND', message: '指定的任务不存在或已被删除' } } };
+      }
+      return { status: 409, body: { success: false, error: { code: 'TASK_ALREADY_COMPLETED', message: '任务已完成或已失败，无法更新' } } };
+    }
+
+    const existingData = JSON.parse(decryptFromStorage(existingTask.encrypted_payload, userKey));
+
+    // When the caller switches prompt source (completePrompt ↔ messages),
+    // null out the other so storage stays one-of (matches schedule-message
+    // shape and prevents buildAiRequestBody from accidentally seeing both).
+    const promptUpdates = {};
+    if (updates.completePrompt) {
+      promptUpdates.completePrompt = updates.completePrompt;
+      promptUpdates.messages = null;
+    } else if (updates.messages !== undefined && updates.messages !== null) {
+      promptUpdates.messages = updates.messages;
+      promptUpdates.completePrompt = null;
+    }
+
+    const updatedData = {
+      ...existingData,
+      ...promptUpdates,
+      ...(updates.userMessage && { userMessage: updates.userMessage }),
+      ...(updates.recurrenceType && { recurrenceType: updates.recurrenceType }),
+      ...(updates.avatarUrl && { avatarUrl: updates.avatarUrl }),
+      ...(updates.metadata && { metadata: updates.metadata }),
+      ...(Object.prototype.hasOwnProperty.call(updates, 'maxTokens') && { maxTokens: updates.maxTokens ?? null }),
+      ...(Object.prototype.hasOwnProperty.call(updates, 'temperature') && { temperature: updates.temperature ?? null }),
+      // splitPattern: hasOwnProperty so that explicit `null` (= revert to
+      // default) doesn't get swallowed by truthy-spread the way the optional
+      // string fields above are.
+      ...(Object.prototype.hasOwnProperty.call(updates, 'splitPattern') && { splitPattern: updates.splitPattern ?? null })
+    };
+
+    const encryptedPayload = encryptForStorage(JSON.stringify(updatedData), userKey);
+    const extraFields = updates.nextSendAt ? { next_send_at: updates.nextSendAt } : undefined;
+
+    const result = await db.updateTaskByUuid(taskUuid, userId, encryptedPayload, extraFields);
+
+    if (!result) {
+      return { status: 409, body: { success: false, error: { code: 'UPDATE_CONFLICT', message: '任务更新失败，任务可能已被修改或删除' } } };
+    }
+
+    return {
+      status: 200,
+      body: {
+        success: true,
+        data: {
+          uuid: taskUuid,
+          updatedFields: Object.keys(updates),
+          updatedAt: result.updated_at
+        }
+      }
+    };
+  }
+
+  return { PUT };
+}
+
+/**
+ * Handler: cancel-message
+ * ReiStandard SDK v2.0.1
+ *
+ * @param {Object} ctx - Server context.
+ * @returns {{ DELETE: function }}
+ */
+
+
+function createCancelMessageHandler(ctx) {
+  async function DELETE(url, headers) {
+    const tenantResult = await ctx.tenantManager.resolveTenant(headers, { url });
+    if (!tenantResult.ok) {
+      return tenantResult.error;
+    }
+
+    const db = tenantResult.context.db;
+    const u = new URL(url, 'https://dummy');
+    const taskUuid = u.searchParams.get('id');
+
+    if (!taskUuid) {
+      return { status: 400, body: { success: false, error: { code: 'TASK_ID_REQUIRED', message: '缺少任务ID' } } };
+    }
+
+    const userId = getHeader(headers, 'x-user-id');
+    if (!userId) {
+      return { status: 400, body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '缺少用户标识符' } } };
+    }
+    if (!isValidUUIDv4(userId)) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } } };
+    }
+
+    const deleted = await db.deleteTaskByUuid(taskUuid, userId);
+
+    if (!deleted) {
+      return {
+        status: 404,
+        body: { success: false, error: { code: 'TASK_NOT_FOUND', message: '指定的任务不存在或已被删除' } }
+      };
+    }
+
+    return {
+      status: 200,
+      body: {
+        success: true,
+        data: { uuid: taskUuid, message: '任务已成功取消', deletedAt: new Date().toISOString() }
+      }
+    };
+  }
+
+  return { DELETE };
+}
+
+/**
+ * Handler: messages
+ * ReiStandard SDK v2.0.1
+ *
+ * @param {Object} ctx - Server context.
+ * @returns {{ GET: function }}
+ */
+
+
+function createMessagesHandler(ctx) {
+  async function GET(url, headers) {
+    const tenantResult = await ctx.tenantManager.resolveTenant(headers, { url });
+    if (!tenantResult.ok) {
+      return tenantResult.error;
+    }
+
+    const tenantCtx = tenantResult.context;
+    const db = tenantCtx.db;
+    const masterKey = tenantCtx.masterKey;
+    const userId = getHeader(headers, 'x-user-id');
+
+    if (!userId) {
+      return {
+        status: 400,
+        body: { success: false, error: { code: 'USER_ID_REQUIRED', message: '必须提供 X-User-Id 请求头' } }
+      };
+    }
+    if (!isValidUUIDv4(userId)) {
+      return {
+        status: 400,
+        body: { success: false, error: { code: 'INVALID_USER_ID_FORMAT', message: 'X-User-Id 必须是 UUID v4 格式' } }
+      };
+    }
+
+    const u = new URL(url, 'https://dummy');
+    const status = u.searchParams.get('status') || 'all';
+    const limit = Math.min(parseInt(u.searchParams.get('limit') || '20', 10), 100);
+    const offset = parseInt(u.searchParams.get('offset') || '0', 10);
+
+    if (isNaN(limit) || limit < 1) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_PARAMETERS', message: 'limit 参数无效，必须为正整数' } } };
+    }
+
+    if (isNaN(offset) || offset < 0) {
+      return { status: 400, body: { success: false, error: { code: 'INVALID_PARAMETERS', message: 'offset 参数无效，必须为非负整数' } } };
+    }
+
+    const { tasks, total } = await db.listTasks(userId, { status, limit, offset });
+
+    const userKey = deriveUserEncryptionKey(userId, masterKey);
+
+    const decryptedTasks = tasks.map(task => {
+      const decrypted = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
+      return {
+        id: task.id,
+        uuid: task.uuid,
+        contactName: decrypted.contactName,
+        messageType: task.message_type,
+        messageSubtype: decrypted.messageSubtype,
+        nextSendAt: task.next_send_at,
+        recurrenceType: decrypted.recurrenceType,
+        status: task.status,
+        retryCount: task.retry_count,
+        createdAt: task.created_at,
+        updatedAt: task.updated_at
+      };
+    });
+
+    const responsePayload = {
+      tasks: decryptedTasks,
+      pagination: { total, limit, offset, hasMore: offset + limit < total }
+    };
+    const encryptedResponse = encryptPayload(responsePayload, userKey);
+
+    return {
+      status: 200,
+      body: {
+        success: true,
+        encrypted: true,
+        version: 1,
+        data: encryptedResponse
+      }
+    };
+  }
+
+  return { GET };
+}
+
+/**
+ * SQLite (Cloudflare D1) dialect schema for scheduled_messages.
+ *
+ * Differences from the Postgres schema (adapters/schema.js):
+ *   - id: INTEGER PRIMARY KEY AUTOINCREMENT (vs SERIAL)
+ *   - timestamps stored as TEXT ISO8601 UTC (vs TIMESTAMP WITH TIME ZONE)
+ *   - no NOW()/DEFAULT; the adapter always writes timestamps explicitly
+ *   - retry_count is NOT NULL here (Postgres omits NOT NULL); every write path
+ *     sets it explicitly, so the tighter constraint just documents that intent
+ * Partial indexes and CHECK constraints are native to SQLite, so they carry over.
+ * Index entries mirror the Postgres INDEXES shape ({ name, sql, description,
+ * critical }) so both adapters' initSchema() return the same index metadata.
+ */
+
+const SQLITE_TABLE_SQL = `
+  CREATE TABLE IF NOT EXISTS scheduled_messages (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    uuid TEXT,
+    encrypted_payload TEXT NOT NULL,
+    message_type TEXT NOT NULL CHECK (message_type IN ('fixed', 'prompted', 'auto', 'instant')),
+    next_send_at TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'sent', 'failed')),
+    retry_count INTEGER NOT NULL DEFAULT 0,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  )
+`;
+
+const SQLITE_INDEXES = [
+  {
+    name: 'idx_pending_tasks_optimized',
+    sql: `CREATE INDEX IF NOT EXISTS idx_pending_tasks_optimized
+          ON scheduled_messages (status, next_send_at, id, retry_count)
+          WHERE status = 'pending'`,
+    description: 'Main query index (Cron Job finds pending tasks)',
+    critical: false
+  },
+  {
+    name: 'idx_cleanup_completed',
+    sql: `CREATE INDEX IF NOT EXISTS idx_cleanup_completed
+          ON scheduled_messages (status, updated_at)
+          WHERE status IN ('sent', 'failed')`,
+    description: 'Cleanup query index',
+    critical: false
+  },
+  {
+    name: 'idx_failed_retry',
+    sql: `CREATE INDEX IF NOT EXISTS idx_failed_retry
+          ON scheduled_messages (status, retry_count, next_send_at)
+          WHERE status = 'failed' AND retry_count < 3`,
+    description: 'Failed retry index',
+    critical: false
+  },
+  {
+    name: 'idx_user_id',
+    sql: `CREATE INDEX IF NOT EXISTS idx_user_id
+          ON scheduled_messages (user_id)`,
+    description: 'User task query index',
+    critical: false
+  },
+  {
+    name: 'uidx_uuid',
+    sql: `CREATE UNIQUE INDEX IF NOT EXISTS uidx_uuid
+          ON scheduled_messages (uuid)
+          WHERE uuid IS NOT NULL`,
+    description: 'UUID uniqueness guard',
+    critical: true
+  }
+];
+
+/**
+ * Cloudflare D1 (SQLite) Database Adapter.
+ *
+ * @implements {import('./interface.js').DbAdapter}
+ *
+ * Timestamps are stored as ISO8601 UTC TEXT. Every timestamp is normalized
+ * with new Date(v).toISOString() before store/compare so lexical ordering
+ * equals chronological ordering (mixed offsets like +08:00 vs Z are unified).
+ */
+
+
+// Update methods build a dynamic SET clause from object keys. Callers pass only
+// hardcoded column names today, but enforcing a whitelist keeps a future caller
+// from ever turning a caller-supplied key into interpolated SQL.
+const UPDATABLE_COLUMNS = new Set([
+  'user_id', 'uuid', 'encrypted_payload', 'message_type',
+  'next_send_at', 'status', 'retry_count', 'created_at', 'updated_at'
+]);
+
+class D1Adapter {
+  /** @param {{ prepare: (sql: string) => any }} db - Cloudflare D1 binding */
+  constructor(db) {
+    /** @private */
+    this._db = db;
+  }
+
+  /** @private */
+  _now() {
+    return new Date().toISOString();
+  }
+
+  /** @private */
+  _iso(value) {
+    const d = new Date(value);
+    if (Number.isNaN(d.getTime())) {
+      throw new Error(`[amsg-server D1] invalid timestamp: ${value}`);
+    }
+    return d.toISOString();
+  }
+
+  async initSchema() {
+    await this._db.prepare(SQLITE_TABLE_SQL).run();
+
+    const indexResults = [];
+    for (const index of SQLITE_INDEXES) {
+      try {
+        await this._db.prepare(index.sql).run();
+        indexResults.push({ name: index.name, status: 'success', description: index.description, critical: !!index.critical });
+      } catch (error) {
+        indexResults.push({ name: index.name, status: 'failed', description: index.description, critical: !!index.critical, error: error.message });
+      }
+    }
+
+    const criticalFailures = indexResults.filter((i) => i.critical && i.status === 'failed');
+    if (criticalFailures.length > 0) {
+      const names = criticalFailures.map((i) => i.name).join(', ');
+      throw new Error(
+        `Critical index creation failed (${names}). ` +
+        'Please remove duplicate UUID rows and run initSchema again.'
+      );
+    }
+
+    return {
+      columnsCreated: 10,
+      indexesCreated: indexResults.filter((r) => r.status === 'success').length,
+      indexesFailed: indexResults.filter((r) => r.status === 'failed').length,
+      columns: [],
+      indexes: indexResults
+    };
+  }
+
+  async dropSchema() {
+    await this._db.prepare('DROP TABLE IF EXISTS scheduled_messages').run();
+  }
+
+  async createTask(params) {
+    const now = this._now();
+    const nextSendAt = this._iso(params.next_send_at);
+    const res = await this._db.prepare(
+      `INSERT INTO scheduled_messages
+        (user_id, uuid, encrypted_payload, next_send_at, message_type, status, retry_count, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, 'pending', 0, ?, ?)`
+    ).bind(params.user_id, params.uuid, params.encrypted_payload, nextSendAt, params.message_type, now, now).run();
+
+    const id = res.meta.last_row_id;
+    return this._db.prepare(
+      `SELECT id, uuid, next_send_at, status, created_at FROM scheduled_messages WHERE id = ?`
+    ).bind(id).first();
+  }
+
+  async getTaskByUuid(uuid, userId) {
+    return this._db.prepare(
+      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
+       FROM scheduled_messages
+       WHERE uuid = ? AND user_id = ? AND status = 'pending'
+       LIMIT 1`
+    ).bind(uuid, userId).first();
+  }
+
+  async getTaskByUuidOnly(uuid) {
+    return this._db.prepare(
+      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
+       FROM scheduled_messages
+       WHERE uuid = ? AND status = 'pending'
+       LIMIT 1`
+    ).bind(uuid).first();
+  }
+
+  async updateTaskById(taskId, updates) {
+    const sets = [];
+    const values = [];
+    for (const [key, value] of Object.entries(updates)) {
+      if (!UPDATABLE_COLUMNS.has(key)) {
+        throw new Error(`[amsg-server D1] rejected unknown update column: ${key}`);
+      }
+      sets.push(`${key} = ?`);
+      values.push(key === 'next_send_at' ? this._iso(value) : value);
+    }
+    // Callers may pass updated_at explicitly (tests); otherwise stamp now.
+    if (!Object.prototype.hasOwnProperty.call(updates, 'updated_at')) {
+      sets.push('updated_at = ?');
+      values.push(this._now());
+    }
+    values.push(taskId);
+
+    await this._db.prepare(
+      `UPDATE scheduled_messages SET ${sets.join(', ')} WHERE id = ?`
+    ).bind(...values).run();
+
+    return this._db.prepare('SELECT * FROM scheduled_messages WHERE id = ?').bind(taskId).first();
+  }
+
+  async updateTaskByUuid(uuid, userId, encryptedPayload, extraFields) {
+    const now = this._now();
+    const sets = ['encrypted_payload = ?', 'updated_at = ?'];
+    const values = [encryptedPayload, now];
+    if (extraFields) {
+      for (const [key, value] of Object.entries(extraFields)) {
+        if (!UPDATABLE_COLUMNS.has(key)) {
+          throw new Error(`[amsg-server D1] rejected unknown update column: ${key}`);
+        }
+        sets.push(`${key} = ?`);
+        values.push(key === 'next_send_at' ? this._iso(value) : value);
+      }
+    }
+    values.push(uuid, userId);
+
+    const res = await this._db.prepare(
+      `UPDATE scheduled_messages SET ${sets.join(', ')}
+       WHERE uuid = ? AND user_id = ? AND status = 'pending'`
+    ).bind(...values).run();
+
+    if (!res.meta.changes) return null;
+    return { uuid, updated_at: now };
+  }
+
+  async deleteTaskById(taskId) {
+    const res = await this._db.prepare('DELETE FROM scheduled_messages WHERE id = ?').bind(taskId).run();
+    return res.meta.changes > 0;
+  }
+
+  async deleteTaskByUuid(uuid, userId) {
+    const res = await this._db.prepare(
+      'DELETE FROM scheduled_messages WHERE uuid = ? AND user_id = ?'
+    ).bind(uuid, userId).run();
+    return res.meta.changes > 0;
+  }
+
+  async getPendingTasks(limit = 50) {
+    const res = await this._db.prepare(
+      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
+       FROM scheduled_messages
+       WHERE status = 'pending' AND next_send_at <= ?
+       ORDER BY next_send_at ASC
+       LIMIT ?`
+    ).bind(this._now(), limit).all();
+    return res.results || [];
+  }
+
+  async listTasks(userId, opts = {}) {
+    const { status = 'all', limit = 20, offset = 0 } = opts;
+    const conditions = ['user_id = ?'];
+    const params = [userId];
+    if (status !== 'all') {
+      conditions.push('status = ?');
+      params.push(status);
+    }
+    const where = conditions.join(' AND ');
+
+    const countRow = await this._db.prepare(
+      `SELECT COUNT(*) as count FROM scheduled_messages WHERE ${where}`
+    ).bind(...params).first();
+    const total = Number(countRow.count) || 0;
+
+    const res = await this._db.prepare(
+      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count, created_at, updated_at
+       FROM scheduled_messages
+       WHERE ${where}
+       ORDER BY next_send_at ASC
+       LIMIT ? OFFSET ?`
+    ).bind(...params, limit, offset).all();
+
+    return { tasks: res.results || [], total };
+  }
+
+  async cleanupOldTasks(days = 7) {
+    const safeDays = Math.max(1, Math.floor(Number(days)));
+    const cutoff = new Date(Date.now() - safeDays * 24 * 60 * 60 * 1000).toISOString();
+    const res = await this._db.prepare(
+      `DELETE FROM scheduled_messages
+       WHERE status IN ('sent', 'failed') AND updated_at < ?`
+    ).bind(cutoff).run();
+    return res.meta.changes || 0;
+  }
+
+  async getTaskStatus(uuid, userId) {
+    const row = await this._db.prepare(
+      'SELECT status FROM scheduled_messages WHERE uuid = ? AND user_id = ? LIMIT 1'
+    ).bind(uuid, userId).first();
+    return row ? row.status : null;
+  }
+}
+
+/**
+ * Create a D1 adapter from a Cloudflare D1 binding (env.DB).
+ * @param {{ prepare: (sql: string) => any }} db
+ * @returns {import('./interface.js').DbAdapter}
+ */
+function createD1Adapter(db) {
+  if (!db || typeof db.prepare !== 'function') {
+    throw new Error('[amsg-server] createD1Adapter requires a D1 database binding (env.DB)');
+  }
+  return new D1Adapter(db);
+}
+
+/**
+ * Portable constant-time string comparison.
+ *
+ * Runs identically on Node (tests) and Cloudflare Workers (prod). We avoid
+ * both node:crypto's timingSafeEqual (undefined on Workers historically) and
+ * crypto.subtle.timingSafeEqual (absent on Node). Instead we HMAC-SHA256 both
+ * inputs under one fresh random key, then compare the two digests. Because the
+ * key is random per call, an attacker can't precompute or replay a stable
+ * timing oracle; digests are a fixed 32 bytes, so the XOR-accumulate compare
+ * runs the same number of steps regardless of input length, with no early-out.
+ *
+ * globalThis.crypto (Web Crypto) is available on Node >= 20 and on Workers.
+ */
+async function constantTimeEqual(a, b) {
+  const enc = new TextEncoder();
+  const keyBytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
+  const key = await globalThis.crypto.subtle.importKey(
+    'raw',
+    keyBytes,
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign']
+  );
+  const da = new Uint8Array(await globalThis.crypto.subtle.sign('HMAC', key, enc.encode(String(a))));
+  const db = new Uint8Array(await globalThis.crypto.subtle.sign('HMAC', key, enc.encode(String(b))));
+
+  let diff = 0;
+  for (let i = 0; i < da.length; i++) {
+    diff |= da[i] ^ db[i];
+  }
+  return diff === 0;
+}
+
+/**
+ * Single-user tenant context manager.
+ *
+ * Interface-compatible with createTenantContextManager (resolveTenant /
+ * initializeTenant), so the existing business handlers reuse it unchanged.
+ * No blob registry, no tenant token — db and masterKey come from the caller
+ * (the Worker resolves them from env + D1 binding per request).
+ */
+
+
+function createSingleUserContextManager({ db, masterKey, serverToken } = {}) {
+  if (!db) throw new Error('[amsg-server single-user] db (adapter) is required');
+  if (!masterKey) throw new Error('[amsg-server single-user] masterKey is required');
+  const token = String(serverToken || '').trim();
+
+  async function isAuthorized(headers) {
+    if (!token) return true; // open when no shared secret configured
+    const provided = getHeader(headers, 'x-client-token');
+    if (!provided) return false;
+    return constantTimeEqual(provided, token);
+  }
+
+  async function resolveTenant(headers) {
+    if (!(await isAuthorized(headers))) {
+      return {
+        ok: false,
+        error: {
+          status: 401,
+          body: { success: false, error: { code: 'INVALID_CLIENT_TOKEN', message: '共享密钥无效或缺失' } }
+        }
+      };
+    }
+    return {
+      ok: true,
+      context: { tenantId: 'single', tokenType: 'tenant', db, masterKey }
+    };
+  }
+
+  async function initializeTenant() {
+    const schema = await db.initSchema();
+    return { tenantId: 'single', schema };
+  }
+
+  return { resolveTenant, initializeTenant };
+}
+
+/**
+ * Handler: single-user-init
+ *
+ * Idempotent "just create the tables" endpoint for single-user deployments
+ * (the degenerate form of init-tenant). Reuses resolveTenant purely to enforce
+ * the optional shared secret, then runs initSchema. Issues no token.
+ *
+ * @param {Object} ctx - Single-user server context (ctx.tenantManager).
+ * @returns {{ POST: function }}
+ */
+function createSingleUserInitHandler(ctx) {
+  async function POST(headers /* , body */) {
+    const auth = await ctx.tenantManager.resolveTenant(headers || {});
+    if (!auth.ok) {
+      return auth.error;
+    }
+    try {
+      const result = await ctx.tenantManager.initializeTenant();
+      return {
+        status: 200,
+        body: { success: true, data: { tenantId: result.tenantId, schema: result.schema } }
+      };
+    } catch (error) {
+      return {
+        status: 500,
+        body: { success: false, error: { code: 'INIT_FAILED', message: error.message } }
+      };
+    }
+  }
+
+  return { POST };
+}
+
+/**
+ * Single-user ReiStandard server assembly.
+ *
+ * Same shape as createReiServer ({ handlers }), but wired for a single user:
+ *   - tenant context comes from createSingleUserContextManager (db + masterKey
+ *     supplied by the caller; no blob registry, no tenant token)
+ *   - only the 5 business handlers + an idempotent init route are exposed
+ *   - send-notifications is NOT exposed over HTTP (cron runs via CF scheduled())
+ *
+ * @param {Object} config
+ * @param {import('./adapters/interface.js').DbAdapter} config.db
+ * @param {string} config.masterKey
+ * @param {string} [config.serverToken]  - optional shared secret (X-Client-Token)
+ * @param {{ email?: string, publicKey?: string, privateKey?: string }} [config.vapid]
+ * @param {{ sendNotification: function }} [config.webpush] - web-push-compatible sender
+ * @returns {{ handlers: Object, ctx: Object }}
+ */
+
+
+function createSingleUserServer(config) {
+  if (!config || !config.db) throw new Error('[amsg-server single-user] config.db is required');
+  if (!config.masterKey) throw new Error('[amsg-server single-user] config.masterKey is required');
+
+  const vapid = config.vapid || {};
+  const tenantManager = createSingleUserContextManager({
+    db: config.db,
+    masterKey: config.masterKey,
+    serverToken: config.serverToken
+  });
+
+  const ctx = {
+    vapid: {
+      email: vapid.email || '',
+      publicKey: vapid.publicKey || '',
+      privateKey: vapid.privateKey || ''
+    },
+    webpush: config.webpush || null,
+    tenantManager
+  };
+
+  return {
+    ctx,
+    handlers: {
+      init: createSingleUserInitHandler(ctx),
+      getUserKey: createGetUserKeyHandler(ctx),
+      scheduleMessage: createScheduleMessageHandler(ctx),
+      updateMessage: createUpdateMessageHandler(ctx),
+      cancelMessage: createCancelMessageHandler(ctx),
+      messages: createMessagesHandler(ctx)
+    }
+  };
+}
+
+/**
+ * Runtime-neutral crypto + encoding helpers.
+ *
+ * Everything in here is implemented on top of WHATWG-standard primitives
+ * (`globalThis.crypto.subtle`, `TextEncoder`, `Uint8Array`) so the package
+ * runs on Cloudflare Workers, Vercel Edge, Netlify Edge, Deno, Bun, and
+ * Node ≥ 19 with zero polyfills. The Node adapter polyfills
+ * `globalThis.crypto` for Node 18 deployments before any of these are
+ * touched.
+ */
+
+const TEXT_ENCODER = new TextEncoder();
+new TextDecoder('utf-8', { fatal: false });
+
+/** UTF-8 encode a string into a Uint8Array. */
+function utf8(str) {
+  return TEXT_ENCODER.encode(String(str));
+}
+
+
+/** Encode bytes as base64url (no padding). */
+function bytesToBase64Url(buf) {
+  const bytes = toUint8(buf);
+  let bin = '';
+  for (let i = 0; i < bytes.length; i++) {
+    bin += String.fromCharCode(bytes[i]);
+  }
+  // btoa is available in all Web Crypto runtimes (browsers, Workers, Node 16+).
+  const b64 = (typeof btoa === 'function')
+    ? btoa(bin)
+    : Buffer.from(bin, 'binary').toString('base64');
+  return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+
+
+/** Encode a JSON-serializable value as base64url (UTF-8 JSON). */
+function jsonToBase64Url(value) {
+  return bytesToBase64Url(utf8(JSON.stringify(value)));
+}
+
+/** Cryptographically random bytes. */
+function randomBytes(n) {
+  const out = new Uint8Array(n);
+  globalThis.crypto.getRandomValues(out);
+  return out;
+}
+
+/**
+ * Web Push — RFC 8030 (transport) + RFC 8291 (aes128gcm payload encryption)
+ *           + RFC 8292 (VAPID).
+ *
+ * Pure-WebCrypto implementation. Zero runtime dependencies. Runs natively on
+ * Cloudflare Workers, Vercel Edge, Netlify Edge, Deno, Bun, and Node ≥ 19.
+ * Node 18 deployments must go through the `adapters/node` entry which
+ * polyfills `globalThis.crypto` from `node:crypto.webcrypto`.
+ *
+ * The wire format produced here is byte-identical to the `web-push` npm
+ * package and to the Push API in any modern browser, so amsg-sw and any
+ * existing Web Push subscriptions keep working untouched.
+ */
+
+
+// RFC 8291 fixed labels (each followed by a NUL byte per HKDF "info" framing).
+const KEY_INFO_PREFIX = utf8('WebPush: info\0');
+const CEK_INFO = utf8('Content-Encoding: aes128gcm\0');
+const NONCE_INFO = utf8('Content-Encoding: nonce\0');
+
+const VAPID_DEFAULT_TTL = 60;          // seconds — short, matches single-shot instant.
+const VAPID_TOKEN_LIFETIME = 12 * 3600; // 12h — comfortably under the 24h RFC 8292 cap.
+const RECORD_SIZE = 4096;               // arbitrary — must be ≥ ciphertext length.
+
+/**
+ * Send a single Web Push notification.
+ *
+ * @param {Object}   args
+ * @param {Object}   args.subscription  - Standard PushSubscription JSON.
+ * @param {string}   args.subscription.endpoint
+ * @param {Object}   args.subscription.keys
+ * @param {string}   args.subscription.keys.p256dh - base64url, 65 B uncompressed P-256 point.
+ * @param {string}   args.subscription.keys.auth   - base64url, 16 B auth secret.
+ * @param {string}   args.payload       - Already-stringified JSON to deliver.
+ * @param {Object}   args.vapid
+ * @param {string}   args.vapid.email      - VAPID `sub` (mailto: auto-prepended if missing).
+ * @param {string}   args.vapid.publicKey  - base64url, 65 B uncompressed P-256 point.
+ * @param {string}   args.vapid.privateKey - base64url, 32 B scalar.
+ * @param {number}  [args.ttl=60]       - Push service TTL header, seconds.
+ * @param {typeof fetch} [args.fetch]   - Override fetch impl (testing / proxy).
+ * @returns {Promise<{ statusCode: number, body: string, headers: Headers }>}
+ * @throws  {Error}  err.code = 'PUSH_SEND_FAILED' on push-service error.
+ */
+async function sendWebPush({ subscription, payload, vapid, ttl, fetch: fetchImpl }) {
+  if (!subscription || typeof subscription.endpoint !== 'string') {
+    throw new Error('sendWebPush: invalid subscription');
+  }
+  if (typeof payload !== 'string') {
+    throw new Error('sendWebPush: payload must be a string');
+  }
+  if (!vapid || !vapid.email || !vapid.publicKey || !vapid.privateKey) {
+    throw new Error('VAPID_CONFIG_MISSING');
+  }
+
+  const subscriptionKeys = subscription.keys || {};
+  if (typeof subscriptionKeys.p256dh !== 'string' || typeof subscriptionKeys.auth !== 'string') {
+    throw new Error('sendWebPush: subscription.keys.p256dh and .auth are required');
+  }
+
+  const encryptedBody = await encryptPushPayload({
+    plaintext: utf8(payload),
+    uaPublicKey: base64UrlToBytes(subscriptionKeys.p256dh),
+    authSecret: base64UrlToBytes(subscriptionKeys.auth),
+  });
+
+  const jwt = await buildVapidJwt({
+    audience: originOf(subscription.endpoint),
+    subject: normalizeVapidSubject(vapid.email),
+    publicKey: vapid.publicKey,
+    privateKey: vapid.privateKey,
+  });
+
+  const fetchFn = fetchImpl || globalThis.fetch;
+  if (typeof fetchFn !== 'function') {
+    throw new Error('sendWebPush: no fetch implementation available');
+  }
+
+  const res = await fetchFn(subscription.endpoint, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/octet-stream',
+      'Content-Encoding': 'aes128gcm',
+      'TTL': String(Number.isFinite(ttl) ? ttl : VAPID_DEFAULT_TTL),
+      'Authorization': `vapid t=${jwt}, k=${vapid.publicKey}`,
+    },
+    body: encryptedBody,
+  });
+
+  // Push services return 201 (RFC 8030) or 200/202 depending on implementation.
+  if (!res.ok) {
+    const text = await safeReadText(res);
+    const err = new Error(
+      `Web Push delivery failed: ${res.status} ${res.statusText || ''}${text ? ` — ${text}` : ''}`
+    );
+    err.code = 'PUSH_SEND_FAILED';
+    err.statusCode = res.status;
+    throw err;
+  }
+
+  return {
+    statusCode: res.status,
+    body: await safeReadText(res),
+    headers: res.headers,
+  };
+}
+
+// ─── RFC 8291: aes128gcm payload encryption ────────────────────────────
+
+/**
+ * @param {Object} args
+ * @param {Uint8Array} args.plaintext
+ * @param {Uint8Array} args.uaPublicKey  - recipient p256dh, 65 B uncompressed.
+ * @param {Uint8Array} args.authSecret   - recipient auth, 16 B.
+ * @returns {Promise<Uint8Array>} encryption header || ciphertext
+ */
+async function encryptPushPayload({ plaintext, uaPublicKey, authSecret }) {
+  // 1. Ephemeral ECDH key pair (as = "application server" per RFC 8291).
+  const asKeyPair = await globalThis.crypto.subtle.generateKey(
+    { name: 'ECDH', namedCurve: 'P-256' },
+    true,
+    ['deriveBits']
+  );
+  const asPublicRaw = new Uint8Array(
+    await globalThis.crypto.subtle.exportKey('raw', asKeyPair.publicKey)
+  );
+
+  // 2. ECDH shared secret with recipient's p256dh.
+  const uaPublicCryptoKey = await globalThis.crypto.subtle.importKey(
+    'raw',
+    uaPublicKey,
+    { name: 'ECDH', namedCurve: 'P-256' },
+    false,
+    []
+  );
+  const ecdhSecret = new Uint8Array(
+    await globalThis.crypto.subtle.deriveBits(
+      { name: 'ECDH', public: uaPublicCryptoKey },
+      asKeyPair.privateKey,
+      256
+    )
+  );
+
+  // 3. IKM = HKDF-SHA256(salt=auth_secret, ikm=ecdh_secret,
+  //                     info="WebPush: info\0" || ua_public || as_public, L=32)
+  const keyInfo = concatBytes(KEY_INFO_PREFIX, uaPublicKey, asPublicRaw);
+  const ikm = await hkdfSha256(authSecret, ecdhSecret, keyInfo, 32);
+
+  // 4. encryption_salt (random, 16 B). Goes into the header so the recipient
+  //    can re-derive CEK / NONCE.
+  const salt = randomBytes(16);
+
+  // 5. CEK = HKDF-SHA256(salt, ikm, "Content-Encoding: aes128gcm\0", 16)
+  const cekBytes = await hkdfSha256(salt, ikm, CEK_INFO, 16);
+  const cek = await globalThis.crypto.subtle.importKey(
+    'raw',
+    cekBytes,
+    { name: 'AES-GCM' },
+    false,
+    ['encrypt']
+  );
+
+  // 6. NONCE = HKDF-SHA256(salt, ikm, "Content-Encoding: nonce\0", 12)
+  const nonce = await hkdfSha256(salt, ikm, NONCE_INFO, 12);
+
+  // 7. Single-record AES-128-GCM. Padding delimiter 0x02 marks the final
+  //    (and only) record per RFC 8188 §2.
+  const padded = concatBytes(plaintext, new Uint8Array([0x02]));
+  const ciphertext = new Uint8Array(
+    await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce }, cek, padded)
+  );
+
+  // 8. aes128gcm content-encoding framing (RFC 8188 §2.1):
+  //      salt(16) || rs(4 BE) || idlen(1) || keyid(idlen) || ciphertext
+  //    For Web Push, keyid is the application-server public key (65 B).
+  const header = new Uint8Array(16 + 4 + 1 + asPublicRaw.byteLength);
+  header.set(salt, 0);
+  writeUint32BE(header, 16, RECORD_SIZE);
+  header[20] = asPublicRaw.byteLength;
+  header.set(asPublicRaw, 21);
+
+  return concatBytes(header, ciphertext);
+}
+
+/**
+ * HKDF-SHA-256 (extract-then-expand) via WebCrypto.
+ *
+ * @param {Uint8Array} salt
+ * @param {Uint8Array} ikm
+ * @param {Uint8Array} info
+ * @param {number}     length  - desired output length in bytes (≤ 32 in our usage).
+ * @returns {Promise<Uint8Array>}
+ */
+async function hkdfSha256(salt, ikm, info, length) {
+  const baseKey = await globalThis.crypto.subtle.importKey(
+    'raw',
+    toUint8(ikm),
+    { name: 'HKDF' },
+    false,
+    ['deriveBits']
+  );
+  const bits = await globalThis.crypto.subtle.deriveBits(
+    {
+      name: 'HKDF',
+      hash: 'SHA-256',
+      salt: toUint8(salt),
+      info: toUint8(info),
+    },
+    baseKey,
+    length * 8
+  );
+  return new Uint8Array(bits);
+}
+
+// ─── RFC 8292: VAPID JWT ───────────────────────────────────────────────
+
+/**
+ * Build a VAPID `Authorization` JWT for a single push.
+ *
+ * @param {Object} args
+ * @param {string} args.audience    - Origin of the push endpoint (e.g. https://fcm.googleapis.com).
+ * @param {string} args.subject     - VAPID `sub` claim, typically `mailto:you@example.com`.
+ * @param {string} args.publicKey   - base64url, 65 B uncompressed P-256 point.
+ * @param {string} args.privateKey  - base64url, 32 B scalar.
+ * @returns {Promise<string>} compact JWS (three base64url segments).
+ */
+async function buildVapidJwt({ audience, subject, publicKey, privateKey }) {
+  const header = jsonToBase64Url({ typ: 'JWT', alg: 'ES256' });
+  const payload = jsonToBase64Url({
+    aud: audience,
+    exp: Math.floor(Date.now() / 1000) + VAPID_TOKEN_LIFETIME,
+    sub: subject,
+  });
+
+  const signingInput = utf8(`${header}.${payload}`);
+
+  const pubBytes = base64UrlToBytes(publicKey);
+  const privBytes = base64UrlToBytes(privateKey);
+  if (pubBytes.length !== 65 || pubBytes[0] !== 0x04) {
+    throw new Error('VAPID publicKey must be a 65-byte uncompressed P-256 point (base64url).');
+  }
+  if (privBytes.length !== 32) {
+    throw new Error('VAPID privateKey must be a 32-byte scalar (base64url).');
+  }
+
+  // Import as JWK so we can supply both private scalar (d) and public point
+  // (x, y) in one step — required by WebCrypto for ECDSA signing.
+  const jwk = {
+    kty: 'EC',
+    crv: 'P-256',
+    d: bytesToBase64Url(privBytes),
+    x: bytesToBase64Url(pubBytes.subarray(1, 33)),
+    y: bytesToBase64Url(pubBytes.subarray(33, 65)),
+    ext: true,
+  };
+  const key = await globalThis.crypto.subtle.importKey(
+    'jwk',
+    jwk,
+    { name: 'ECDSA', namedCurve: 'P-256' },
+    false,
+    ['sign']
+  );
+
+  // WebCrypto ECDSA produces a raw 64-byte (r || s) signature — exactly the
+  // wire format JOSE/JWS expects, so no DER unwrapping is needed.
+  const sig = await globalThis.crypto.subtle.sign(
+    { name: 'ECDSA', hash: 'SHA-256' },
+    key,
+    signingInput
+  );
+
+  return `${header}.${payload}.${bytesToBase64Url(sig)}`;
+}
+
+// ─── Helpers ───────────────────────────────────────────────────────────
+
+function originOf(endpoint) {
+  return new URL(endpoint).origin;
+}
+
+function writeUint32BE(buf, offset, value) {
+  buf[offset] = (value >>> 24) & 0xff;
+  buf[offset + 1] = (value >>> 16) & 0xff;
+  buf[offset + 2] = (value >>> 8) & 0xff;
+  buf[offset + 3] = value & 0xff;
+}
+
+async function safeReadText(res) {
+  try {
+    return await res.text();
+  } catch {
+    return '';
+  }
+}
+
+// Scheduled reminders must survive an offline device, so default to the same
+// 4-week TTL the web-push npm backend applies. sendWebPush's module-level
+// VAPID_DEFAULT_TTL (60s) is tuned for single-shot instant pushes; using it for
+// durable schedules would drop any reminder whose device was offline > 1 min.
+const SCHEDULED_DEFAULT_TTL = 2419200; // 4 weeks, in seconds
+
+/**
+ * web-push-compatible sender backed by the Web Crypto implementation above.
+ * message-processor calls `ctx.webpush.sendNotification(subscription, payloadString)`,
+ * so we only need that one method. VAPID keys are baked in at construction.
+ *
+ * @param {{ email: string, publicKey: string, privateKey: string }} [vapid]
+ * @param {{ ttl?: number }} [options] - Push TTL in seconds; defaults to 4 weeks
+ *   (matches the web-push backend) so scheduled pushes outlive an offline device.
+ * @returns {{ sendNotification: (subscription: Object, payload: string) => Promise<any> }}
+ */
+function createWebCryptoWebPush(vapid = {}, { ttl = SCHEDULED_DEFAULT_TTL } = {}) {
+  return {
+    async sendNotification(subscription, payload) {
+      return sendWebPush({
+        subscription,
+        payload,
+        ttl,
+        vapid: {
+          email: vapid.email,
+          publicKey: vapid.publicKey,
+          privateKey: vapid.privateKey
+        },
+        fetch: globalThis.fetch
+      });
+    }
+  };
+}
+
+/**
+ * Cloudflare Worker factory for the single-user amsg-server.
+ *
+ * Mirrors instant's createCloudflareWorker: you pass a buildConfig(env) that
+ * returns the single-user config; we build the server per request (cheap) and
+ * dispatch. Returns { fetch, scheduled } for `export default`.
+ *
+ * Routes (server endpoints only — NO /send-notifications; cron is scheduled()):
+ *   POST /init-tenant       → build tables (idempotent)
+ *   GET  /get-user-key      → derive user key
+ *   POST /schedule-message  → create task
+ *   GET  /messages          → list
+ *   PUT  /update-message    → patch
+ *   DELETE /cancel-message  → delete
+ *
+ * CORS is opt-in: pass `cors: { origin }` in the config (a fixed origin, '*', or
+ * an (origin) => allowedOrigin function) to answer OPTIONS preflights and echo
+ * Access-Control-* on responses. With no `cors` the Worker stays same-origin.
+ */
+
+
+function headersToObject(h) {
+  const out = {};
+  for (const [k, v] of h) out[k] = v;
+  return out;
+}
+
+function jsonResponse(status, body, extraHeaders) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'Content-Type': 'application/json; charset=utf-8', ...(extraHeaders || {}) }
+  });
+}
+
+// The custom headers the amsg-client sends; browsers preflight any request
+// carrying them, so cross-origin callers need them echoed in the CORS response.
+const CORS_ALLOW_HEADERS =
+  'Content-Type, X-User-Id, X-Payload-Encrypted, X-Encryption-Version, X-Response-Encrypted, X-Client-Token';
+const CORS_ALLOW_METHODS = 'GET, POST, PUT, DELETE, OPTIONS';
+
+/**
+ * Resolve the CORS response headers for a request, or null when CORS is off.
+ * Opt-in: with no `cors` config the Worker stays same-origin (no headers, and
+ * OPTIONS falls through to 404) — so nothing is exposed unless asked for.
+ *
+ * @param {undefined | { origin: string | ((requestOrigin: string) => string|null|undefined), allowHeaders?: string, maxAge?: number }} cors
+ * @param {string} requestOrigin - the request's Origin header (may be '')
+ */
+function corsHeadersFor(cors, requestOrigin) {
+  if (!cors || cors.origin == null) return null;
+  const allowOrigin = typeof cors.origin === 'function'
+    ? cors.origin(requestOrigin) || null
+    : cors.origin; // e.g. '*' or a fixed origin like 'https://app.example.com'
+  if (!allowOrigin) return null;
+
+  const headers = {
+    'Access-Control-Allow-Origin': allowOrigin,
+    'Access-Control-Allow-Methods': CORS_ALLOW_METHODS,
+    'Access-Control-Allow-Headers': cors.allowHeaders || CORS_ALLOW_HEADERS,
+    'Access-Control-Max-Age': String(cors.maxAge ?? 86400)
+  };
+  // A per-origin echo must vary the cache by Origin; '*' does not.
+  if (allowOrigin !== '*') headers['Vary'] = 'Origin';
+  return headers;
+}
+
+function createSingleUserCloudflareWorker(buildConfig) {
+  async function resolveConfig(env) {
+    const cfg = await buildConfig(env);
+    if (!cfg.db) cfg.db = createD1Adapter(env.DB);
+    return cfg;
+  }
+
+  async function fetch(request, env /* , ctx */) {
+    // Error boundary: a handler (or config build) may throw — e.g.
+    // schedule-message re-throws a non-unique DB error. Keep the client-facing
+    // contract consistent (a JSON envelope, not the runtime's HTML error page).
+    try {
+      const cfg = await resolveConfig(env);
+      const cors = corsHeadersFor(cfg.cors, request.headers.get('origin') || '');
+      const method = request.method.toUpperCase();
+
+      // CORS preflight: answer OPTIONS directly when CORS is configured.
+      if (method === 'OPTIONS') {
+        return cors
+          ? new Response(null, { status: 204, headers: cors })
+          : jsonResponse(404, { success: false, error: { code: 'NOT_FOUND', message: 'Unknown route' } });
+      }
+
+      const server = createSingleUserServer(cfg);
+
+      const url = request.url;
+      // Strip trailing slash(es) so `/init-tenant/` routes like `/init-tenant`
+      // (endsWith matching is kept so a prefixed mount still resolves).
+      const pathname = new URL(url).pathname.replace(/\/+$/, '') || '/';
+      const headers = headersToObject(request.headers);
+
+      let result;
+      if (method === 'POST' && pathname.endsWith('/init-tenant')) {
+        result = await server.handlers.init.POST(headers, await request.text());
+      } else if (method === 'GET' && pathname.endsWith('/get-user-key')) {
+        result = await server.handlers.getUserKey.GET(url, headers);
+      } else if (method === 'POST' && pathname.endsWith('/schedule-message')) {
+        result = await server.handlers.scheduleMessage.POST(headers, await request.text());
+      } else if (method === 'GET' && pathname.endsWith('/messages')) {
+        result = await server.handlers.messages.GET(url, headers);
+      } else if (method === 'PUT' && pathname.endsWith('/update-message')) {
+        result = await server.handlers.updateMessage.PUT(url, headers, await request.text());
+      } else if (method === 'DELETE' && pathname.endsWith('/cancel-message')) {
+        result = await server.handlers.cancelMessage.DELETE(url, headers);
+      } else {
+        result = { status: 404, body: { success: false, error: { code: 'NOT_FOUND', message: 'Unknown route' } } };
+      }
+
+      return jsonResponse(result.status, result.body, cors);
+    } catch (error) {
+      console.error('[amsg single-user] fetch() unhandled error:', error && error.message);
+      return jsonResponse(500, { success: false, error: { code: 'INTERNAL_ERROR', message: '服务器内部错误' } });
+    }
+  }
+
+  async function scheduled(event, env /* , ctx */) {
+    const cfg = await resolveConfig(env);
+    const vapid = cfg.vapid || {};
+    if (!cfg.webpush || !vapid.email || !vapid.publicKey || !vapid.privateKey) {
+      console.error('[amsg single-user] scheduled(): VAPID/webpush not configured; skipping tick');
+      return;
+    }
+    // Swallow tick failures: pending tasks stay pending, so the next cron tick
+    // retries them. Logging keeps the failure visible in the tail log.
+    try {
+      await runScheduledTick({ db: cfg.db, masterKey: cfg.masterKey, vapid, webpush: cfg.webpush });
+    } catch (error) {
+      console.error('[amsg single-user] scheduled(): tick failed:', error && error.message);
+    }
+  }
+
+  return { fetch, scheduled };
+}
+
+export { createCancelMessageHandler as a, createUpdateMessageHandler as b, createMessagesHandler as c, createScheduleMessageHandler as d, createGetUserKeyHandler as e, createD1Adapter as f, getHeader as g, createSingleUserCloudflareWorker as h, isValidUUIDv4 as i, createSingleUserServer as j, createWebCryptoWebPush as k, decryptFromStorage as l, decryptPayload as m, deriveUserEncryptionKey as n, encryptForStorage as o, parseJsonBody as p, isValidISO8601 as q, runScheduledTick as r, isValidUUID as s, isValidUrl as t, validateScheduleMessagePayload as u, validateLlmMessagesArray as v, validateSplitPattern as w };