@rei-standard/amsg-server 2.6.0-next.19 → 2.6.0-next.20

package/dist/adapters/d1.d.ts

@@ -17,6 +17,38 @@ export class D1Adapter {
     private _now;
     /** @private */
     private _iso;
+    /**
+     * 组一组带 `IN (...)` 的语句：值多到一条塞不下时，按 D1 的绑定参数上限切成
+     * 几条（见 chunkForBoundParams）。
+     *
+     * 只有拿得到事务的绑定才切。没有 batch() 的绑定（测试 shim、自定义适配器，
+     * 都不是真实 D1）原样发一条不切的语句：切批是为 D1 那条上限服务的，这类绑
+     * 定不受它约束，切了反倒会因为没有事务而多出一个「写一半」的中间态。
+     *
+     * @private
+     * @param {(placeholders: string) => string} buildSql - 拿占位符串（`?, ?, ?`）组 SQL
+     * @param {unknown[]} leadingParams - IN 列表之前的固定参数，按出现顺序
+     * @param {unknown[]} values - IN 列表里的全部值
+     * @returns {any[]} 已经 bind 好的语句
+     */
+    private _prepareInClauseStatements;
+    /**
+     * 带 `IN (...)` 的批量写，切成几条也仍然是一次原子操作。
+     *
+     * 一条语句本来天然原子，拆开之后这份保证得自己补回来，否则就会多出「只删掉
+     * 前 99 个」「只 ack 了前 98 条」这类比原问题更难查的中间态。D1 的 batch()
+     * 是隐式事务——其中一条失败，整批回滚——正好接住这件事。
+     *
+     * 一条就够时照旧单发，跟切批以前走的是同一条路，常见调用（一次三五个 id）
+     * 的行为一个字节都没变。
+     *
+     * @private
+     * @param {(placeholders: string) => string} buildSql
+     * @param {unknown[]} leadingParams
+     * @param {unknown[]} values
+     * @returns {Promise<number>} 各批影响行数之和
+     */
+    private _runInClauseWrite;
     initSchema(): Promise<{
         columnsCreated: number;
         indexesCreated: number;

package/dist/{chunk-PRQHHRAK.mjs → chunk-HTGYGGUH.mjs}

@@ -931,6 +931,9 @@ function projectTask(row, decryptedPayload, options = {}) {
     // reason 'stale' 表示错过触发时刻太久被判定不再补发；其余是投递失败的
     // 错误信息。payload 里没有时退回行上的 last_error 列（同形状的脱敏摘要，
     // 等重试期间的失败也记在那里）。没有记录 → null。
+    // 记进去的字段整份带出来，不再挑一遍——`pushStatus`（410 = 订阅已注销，
+    // 404 = 端点不存在）这类机读标注就是给客户端看的，白名单挡在这一层的话，
+    // 客户端只能回去正则匹配 reason 那句人话。
     lastError: payload.lastError ?? parseRowLastError(row.last_error)
   };
 }
@@ -1784,6 +1787,7 @@ async function processSingleMessage(task, ctx, providedMasterKey, predecrypted =
       messagesSent: 0,
       error: error.message,
       errorCode: error.code || null,
+      pushStatusCode: Number.isInteger(error.statusCode) ? error.statusCode : null,
       permanent: isNonRetryableError(error)
     };
   }
@@ -2116,6 +2120,10 @@ var CLAIM_LEASE_MARGIN_MS = 2 * 60 * 1e3;
 var DEFAULT_LEASE_HEARTBEAT_MS = 30 * 1e3;
 var DEFAULT_HEARTBEAT_LEASE_TTL_MS = 90 * 1e3;
 var STALE_AFTER_MS = 60 * 60 * 1e3;
+var TERMINAL_PUSH_STATUSES = /* @__PURE__ */ new Set([404, 410]);
+function toPushStatus(value) {
+  return Number.isInteger(value) ? value : null;
+}
 function resolveStaleAfterMs(ctx) {
   return positiveNumber(ctx.staleAfterMs) || STALE_AFTER_MS;
 }
@@ -2298,27 +2306,30 @@ async function deliverTasks(ctx, tasks) {
       console.warn("[amsg-server] onStaleSkip hook \u629B\u9519\uFF08\u5DF2\u5FFD\u7565\uFF09:", hookError && hookError.message);
     }
   }
-  async function handleDeliveryFailure(task, reason, recurrenceType, decryptedPayload, userKey, errorCode = null, permanentFlag = false) {
+  async function handleDeliveryFailure(task, reason, recurrenceType, decryptedPayload, userKey, failure = {}) {
     results.failedCount++;
+    const errorCode = failure.errorCode ?? null;
+    const pushStatus = toPushStatus(failure.pushStatus);
     const tzId = decryptedPayload ? decryptedPayload.tzId ?? null : null;
-    const permanent = permanentFlag === true || errorCode === "PUSH_SUBSCRIPTION_MISSING" || errorCode === "PUSH_SUBSCRIPTION_STORE_UNSUPPORTED";
+    const permanent = failure.permanent === true || errorCode === "PUSH_SUBSCRIPTION_MISSING" || errorCode === "PUSH_SUBSCRIPTION_STORE_UNSUPPORTED" || TERMINAL_PUSH_STATUSES.has(pushStatus);
+    const errorExtra = pushStatus === null ? void 0 : { pushStatus };
     try {
       if (permanent || task.retry_count >= 3) {
-        const encrypted = await encryptPayloadWithLastError(task, decryptedPayload, userKey, reason);
+        const encrypted = await encryptPayloadWithLastError(task, decryptedPayload, userKey, reason, errorExtra);
         if (isRecurringType(recurrenceType)) {
           const nextSendAt = nextFutureOccurrence(Date.parse(task.next_send_at), recurrenceType, Date.now(), tzId);
           await updateAndRelease(task.id, {
             next_send_at: nextSendAt,
             retry_count: 0,
             ...encrypted ? { encrypted_payload: encrypted } : {},
-            ...supportsLastError ? { last_error: lastErrorJson(task, reason) } : {}
+            ...supportsLastError ? { last_error: lastErrorJson(task, reason, errorExtra) } : {}
           });
           results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count, status: "occurrence_skipped", nextSendAt, ...permanent ? { permanent: true } : {} });
         } else {
           await updateAndRelease(task.id, {
             status: "failed",
             ...encrypted ? { encrypted_payload: encrypted } : {},
-            ...supportsLastError ? { last_error: lastErrorJson(task, reason) } : {}
+            ...supportsLastError ? { last_error: lastErrorJson(task, reason, errorExtra) } : {}
           });
           results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count, status: "permanently_failed", ...permanent ? { permanent: true } : {} });
         }
@@ -2329,7 +2340,7 @@ async function deliverTasks(ctx, tasks) {
             retry_after: nextRetryTime.toISOString(),
             lease_until: null,
             retry_count: task.retry_count + 1,
-            ...supportsLastError ? { last_error: lastErrorJson(task, reason) } : {}
+            ...supportsLastError ? { last_error: lastErrorJson(task, reason, errorExtra) } : {}
           });
         } else {
           await db.updateTaskById(task.id, { next_send_at: nextRetryTime.toISOString(), retry_count: task.retry_count + 1 });
@@ -2474,8 +2485,7 @@ async function deliverTasks(ctx, tasks) {
         recurrenceType,
         decryptedPayload,
         userKey,
-        error.code || null,
-        error.permanent === true
+        { errorCode: error.code || null, permanent: error.permanent === true, pushStatus: error.statusCode }
       );
       return;
     }
@@ -2486,8 +2496,7 @@ async function deliverTasks(ctx, tasks) {
         recurrenceType,
         decryptedPayload,
         userKey,
-        sendResult.errorCode || null,
-        sendResult.permanent === true
+        { errorCode: sendResult.errorCode || null, permanent: sendResult.permanent === true, pushStatus: sendResult.pushStatusCode }
       );
       return;
     }
@@ -3286,8 +3295,35 @@ var SQLITE_REQUIRED_SCHEMA = Object.freeze({
 });
 
 // src/server/adapters/d1.js
-function escapeLikePrefix(prefix) {
-  return prefix.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+function prefixRangeEnd(prefix) {
+  const points = Array.from(prefix);
+  while (points.length > 0) {
+    const cp = points[points.length - 1].codePointAt(0);
+    if (cp === 55295) {
+      points[points.length - 1] = String.fromCodePoint(57344);
+      return points.join("");
+    }
+    if (cp < 1114111) {
+      points[points.length - 1] = String.fromCodePoint(cp + 1);
+      return points.join("");
+    }
+    points.pop();
+  }
+  return "";
+}
+var D1_MAX_BOUND_PARAMS = 100;
+function chunkForBoundParams(values, fixedParams) {
+  const perStatement = D1_MAX_BOUND_PARAMS - fixedParams;
+  if (perStatement < 1) {
+    throw new Error(
+      `[amsg-server D1] \u56FA\u5B9A\u53C2\u6570\u5DF2\u5360\u6EE1 ${D1_MAX_BOUND_PARAMS} \u4E2A\u7ED1\u5B9A\u4F4D\uFF0CIN \u5217\u8868\u653E\u4E0D\u4E0B`
+    );
+  }
+  const batches = [];
+  for (let i = 0; i < values.length; i += perStatement) {
+    batches.push(values.slice(i, i + perStatement));
+  }
+  return batches;
 }
 var INTERNAL_TABLE_PREFIXES = ["sqlite_", "_cf_"];
 function isInternalTableName(name) {
@@ -3310,6 +3346,50 @@ var D1Adapter = class {
     }
     return d.toISOString();
   }
+  /**
+   * 组一组带 `IN (...)` 的语句：值多到一条塞不下时，按 D1 的绑定参数上限切成
+   * 几条（见 chunkForBoundParams）。
+   *
+   * 只有拿得到事务的绑定才切。没有 batch() 的绑定（测试 shim、自定义适配器，
+   * 都不是真实 D1）原样发一条不切的语句：切批是为 D1 那条上限服务的，这类绑
+   * 定不受它约束，切了反倒会因为没有事务而多出一个「写一半」的中间态。
+   *
+   * @private
+   * @param {(placeholders: string) => string} buildSql - 拿占位符串（`?, ?, ?`）组 SQL
+   * @param {unknown[]} leadingParams - IN 列表之前的固定参数，按出现顺序
+   * @param {unknown[]} values - IN 列表里的全部值
+   * @returns {any[]} 已经 bind 好的语句
+   */
+  _prepareInClauseStatements(buildSql, leadingParams, values) {
+    const batches = typeof this._db.batch === "function" ? chunkForBoundParams(values, leadingParams.length) : [values];
+    return batches.map((batch) => this._db.prepare(buildSql(batch.map(() => "?").join(", "))).bind(...leadingParams, ...batch));
+  }
+  /**
+   * 带 `IN (...)` 的批量写，切成几条也仍然是一次原子操作。
+   *
+   * 一条语句本来天然原子，拆开之后这份保证得自己补回来，否则就会多出「只删掉
+   * 前 99 个」「只 ack 了前 98 条」这类比原问题更难查的中间态。D1 的 batch()
+   * 是隐式事务——其中一条失败，整批回滚——正好接住这件事。
+   *
+   * 一条就够时照旧单发，跟切批以前走的是同一条路，常见调用（一次三五个 id）
+   * 的行为一个字节都没变。
+   *
+   * @private
+   * @param {(placeholders: string) => string} buildSql
+   * @param {unknown[]} leadingParams
+   * @param {unknown[]} values
+   * @returns {Promise<number>} 各批影响行数之和
+   */
+  async _runInClauseWrite(buildSql, leadingParams, values) {
+    const statements = this._prepareInClauseStatements(buildSql, leadingParams, values);
+    if (statements.length === 0) return 0;
+    if (statements.length === 1) {
+      const res = await statements[0].run();
+      return res.meta.changes || 0;
+    }
+    const results = await this._db.batch(statements);
+    return results.reduce((n, res) => n + (res.meta.changes || 0), 0);
+  }
   async initSchema() {
     await this._db.prepare(SQLITE_TABLE_SQL).run();
     await this._db.prepare(CLIENT_STATE_TABLE_SQL).run();
@@ -3693,11 +3773,11 @@ var D1Adapter = class {
          updated_at = excluded.updated_at
        WHERE excluded.updated_at >= client_state.updated_at`;
     const CLEANUP_PREFIX_SQL = `DELETE FROM client_state
-       WHERE user_id = ? AND namespace = ? AND key LIKE ? ESCAPE '\\' AND updated_at <= ?`;
+       WHERE user_id = ? AND namespace = ? AND key >= ? AND key < ? AND updated_at <= ?`;
     const CLEANUP_KEY_SQL = `DELETE FROM client_state
        WHERE user_id = ? AND namespace = ? AND key = ? AND updated_at <= ?`;
     const buildStatements = () => [
-      ...cleanups.map((c) => typeof c.key === "string" ? this._db.prepare(CLEANUP_KEY_SQL).bind(userId, c.namespace, c.key, c.updatedAt) : this._db.prepare(CLEANUP_PREFIX_SQL).bind(userId, c.namespace, `${escapeLikePrefix(c.keyPrefix)}%`, c.updatedAt)),
+      ...cleanups.map((c) => typeof c.key === "string" ? this._db.prepare(CLEANUP_KEY_SQL).bind(userId, c.namespace, c.key, c.updatedAt) : this._db.prepare(CLEANUP_PREFIX_SQL).bind(userId, c.namespace, c.keyPrefix, prefixRangeEnd(c.keyPrefix), c.updatedAt)),
       ...entries.map(
         (entry) => this._db.prepare(UPSERT_SQL).bind(userId, entry.namespace, entry.key, entry.value, entry.updatedAt)
       )
@@ -3826,13 +3906,19 @@ var D1Adapter = class {
    */
   async getLlmCredentials(userId, credIds) {
     if (!credIds || credIds.length === 0) return [];
-    const placeholders = credIds.map(() => "?").join(", ");
-    const res = await this._db.prepare(
-      `SELECT cred_id, encrypted_value, updated_at
-       FROM llm_credentials
-       WHERE user_id = ? AND cred_id IN (${placeholders})`
-    ).bind(userId, ...credIds).all();
-    return res.results || [];
+    const statements = this._prepareInClauseStatements(
+      (placeholders) => `SELECT cred_id, encrypted_value, updated_at
+         FROM llm_credentials
+         WHERE user_id = ? AND cred_id IN (${placeholders})`,
+      [userId],
+      credIds
+    );
+    const rows = [];
+    for (const stmt of statements) {
+      const res = await stmt.all();
+      rows.push(...res.results || []);
+    }
+    return rows;
   }
   /**
    * 这个用户名下所有凭据的对账清单（只有 cred_id 和 updated_at，密文不出
@@ -3858,18 +3944,17 @@ var D1Adapter = class {
    */
   async deleteLlmCredentials(userId, credIds = null) {
     if (credIds !== null && credIds.length === 0) return 0;
-    let res;
     if (credIds === null) {
-      res = await this._db.prepare(
+      const res = await this._db.prepare(
         "DELETE FROM llm_credentials WHERE user_id = ?"
       ).bind(userId).run();
-    } else {
-      const placeholders = credIds.map(() => "?").join(", ");
-      res = await this._db.prepare(
-        `DELETE FROM llm_credentials WHERE user_id = ? AND cred_id IN (${placeholders})`
-      ).bind(userId, ...credIds).run();
+      return res.meta.changes || 0;
     }
-    return res.meta.changes || 0;
+    return this._runInClauseWrite(
+      (placeholders) => `DELETE FROM llm_credentials WHERE user_id = ? AND cred_id IN (${placeholders})`,
+      [userId],
+      credIds
+    );
   }
   // ── message_outbox（服务端消息收件箱，客户端 ack）────────────────────────
   /**
@@ -3925,12 +4010,12 @@ var D1Adapter = class {
    */
   async markOutboxDelivered(userId, messageIds, deliveredAt) {
     if (!messageIds || messageIds.length === 0) return 0;
-    const placeholders = messageIds.map(() => "?").join(", ");
-    const res = await this._db.prepare(
-      `UPDATE message_outbox SET delivered_at = ?
-       WHERE user_id = ? AND message_id IN (${placeholders})`
-    ).bind(deliveredAt, userId, ...messageIds).run();
-    return res.meta.changes || 0;
+    return this._runInClauseWrite(
+      (placeholders) => `UPDATE message_outbox SET delivered_at = ?
+         WHERE user_id = ? AND message_id IN (${placeholders})`,
+      [deliveredAt, userId],
+      messageIds
+    );
   }
   /**
    * 未 ack 的行（id 升序，游标翻页）。payload 仍是密文，解密在 handler。
@@ -3962,12 +4047,12 @@ var D1Adapter = class {
    */
   async ackOutboxMessages(userId, messageIds, ackedAt) {
     if (!messageIds || messageIds.length === 0) return 0;
-    const placeholders = messageIds.map(() => "?").join(", ");
-    const res = await this._db.prepare(
-      `UPDATE message_outbox SET acked_at = ?
-       WHERE user_id = ? AND acked_at IS NULL AND message_id IN (${placeholders})`
-    ).bind(ackedAt, userId, ...messageIds).run();
-    return res.meta.changes || 0;
+    return this._runInClauseWrite(
+      (placeholders) => `UPDATE message_outbox SET acked_at = ?
+         WHERE user_id = ? AND acked_at IS NULL AND message_id IN (${placeholders})`,
+      [ackedAt, userId],
+      messageIds
+    );
   }
   /**
    * outbox 的例行清理（run-tick 每跳顺手调）：已 ack 的行留短一些，未 ack 的
@@ -4249,7 +4334,7 @@ function createClientStateHandler(ctx) {
 }
 
 // src/server/lib/version.js
-var SERVER_VERSION = true ? "2.6.0-next.19" : "0.0.0-dev";
+var SERVER_VERSION = true ? "2.6.0-next.20" : "0.0.0-dev";
 
 // src/server/handlers/capabilities.js
 var SERVER_FEATURES = Object.freeze([

package/dist/{chunk-XVJ7ZLZX.cjs → chunk-WOXSQBAM.cjs}

@@ -931,6 +931,9 @@ function projectTask(row, decryptedPayload, options = {}) {
     // reason 'stale' 表示错过触发时刻太久被判定不再补发；其余是投递失败的
     // 错误信息。payload 里没有时退回行上的 last_error 列（同形状的脱敏摘要，
     // 等重试期间的失败也记在那里）。没有记录 → null。
+    // 记进去的字段整份带出来，不再挑一遍——`pushStatus`（410 = 订阅已注销，
+    // 404 = 端点不存在）这类机读标注就是给客户端看的，白名单挡在这一层的话，
+    // 客户端只能回去正则匹配 reason 那句人话。
     lastError: _nullishCoalesce(payload.lastError, () => ( parseRowLastError(row.last_error)))
   };
 }
@@ -1784,6 +1787,7 @@ async function processSingleMessage(task, ctx, providedMasterKey, predecrypted =
       messagesSent: 0,
       error: error.message,
       errorCode: error.code || null,
+      pushStatusCode: Number.isInteger(error.statusCode) ? error.statusCode : null,
       permanent: isNonRetryableError(error)
     };
   }
@@ -2116,6 +2120,10 @@ var CLAIM_LEASE_MARGIN_MS = 2 * 60 * 1e3;
 var DEFAULT_LEASE_HEARTBEAT_MS = 30 * 1e3;
 var DEFAULT_HEARTBEAT_LEASE_TTL_MS = 90 * 1e3;
 var STALE_AFTER_MS = 60 * 60 * 1e3;
+var TERMINAL_PUSH_STATUSES = /* @__PURE__ */ new Set([404, 410]);
+function toPushStatus(value) {
+  return Number.isInteger(value) ? value : null;
+}
 function resolveStaleAfterMs(ctx) {
   return positiveNumber(ctx.staleAfterMs) || STALE_AFTER_MS;
 }
@@ -2298,27 +2306,30 @@ async function deliverTasks(ctx, tasks) {
       console.warn("[amsg-server] onStaleSkip hook \u629B\u9519\uFF08\u5DF2\u5FFD\u7565\uFF09:", hookError && hookError.message);
     }
   }
-  async function handleDeliveryFailure(task, reason, recurrenceType, decryptedPayload, userKey, errorCode = null, permanentFlag = false) {
+  async function handleDeliveryFailure(task, reason, recurrenceType, decryptedPayload, userKey, failure = {}) {
     results.failedCount++;
+    const errorCode = _nullishCoalesce(failure.errorCode, () => ( null));
+    const pushStatus = toPushStatus(failure.pushStatus);
     const tzId = decryptedPayload ? _nullishCoalesce(decryptedPayload.tzId, () => ( null)) : null;
-    const permanent = permanentFlag === true || errorCode === "PUSH_SUBSCRIPTION_MISSING" || errorCode === "PUSH_SUBSCRIPTION_STORE_UNSUPPORTED";
+    const permanent = failure.permanent === true || errorCode === "PUSH_SUBSCRIPTION_MISSING" || errorCode === "PUSH_SUBSCRIPTION_STORE_UNSUPPORTED" || TERMINAL_PUSH_STATUSES.has(pushStatus);
+    const errorExtra = pushStatus === null ? void 0 : { pushStatus };
     try {
       if (permanent || task.retry_count >= 3) {
-        const encrypted = await encryptPayloadWithLastError(task, decryptedPayload, userKey, reason);
+        const encrypted = await encryptPayloadWithLastError(task, decryptedPayload, userKey, reason, errorExtra);
         if (isRecurringType(recurrenceType)) {
           const nextSendAt = nextFutureOccurrence(Date.parse(task.next_send_at), recurrenceType, Date.now(), tzId);
           await updateAndRelease(task.id, {
             next_send_at: nextSendAt,
             retry_count: 0,
             ...encrypted ? { encrypted_payload: encrypted } : {},
-            ...supportsLastError ? { last_error: lastErrorJson(task, reason) } : {}
+            ...supportsLastError ? { last_error: lastErrorJson(task, reason, errorExtra) } : {}
           });
           results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count, status: "occurrence_skipped", nextSendAt, ...permanent ? { permanent: true } : {} });
         } else {
           await updateAndRelease(task.id, {
             status: "failed",
             ...encrypted ? { encrypted_payload: encrypted } : {},
-            ...supportsLastError ? { last_error: lastErrorJson(task, reason) } : {}
+            ...supportsLastError ? { last_error: lastErrorJson(task, reason, errorExtra) } : {}
           });
           results.failedTasks.push({ taskId: task.id, reason, retryCount: task.retry_count, status: "permanently_failed", ...permanent ? { permanent: true } : {} });
         }
@@ -2329,7 +2340,7 @@ async function deliverTasks(ctx, tasks) {
             retry_after: nextRetryTime.toISOString(),
             lease_until: null,
             retry_count: task.retry_count + 1,
-            ...supportsLastError ? { last_error: lastErrorJson(task, reason) } : {}
+            ...supportsLastError ? { last_error: lastErrorJson(task, reason, errorExtra) } : {}
           });
         } else {
           await db.updateTaskById(task.id, { next_send_at: nextRetryTime.toISOString(), retry_count: task.retry_count + 1 });
@@ -2474,8 +2485,7 @@ async function deliverTasks(ctx, tasks) {
         recurrenceType,
         decryptedPayload,
         userKey,
-        error.code || null,
-        error.permanent === true
+        { errorCode: error.code || null, permanent: error.permanent === true, pushStatus: error.statusCode }
       );
       return;
     }
@@ -2486,8 +2496,7 @@ async function deliverTasks(ctx, tasks) {
         recurrenceType,
         decryptedPayload,
         userKey,
-        sendResult.errorCode || null,
-        sendResult.permanent === true
+        { errorCode: sendResult.errorCode || null, permanent: sendResult.permanent === true, pushStatus: sendResult.pushStatusCode }
       );
       return;
     }
@@ -3286,8 +3295,35 @@ var SQLITE_REQUIRED_SCHEMA = Object.freeze({
 });
 
 // src/server/adapters/d1.js
-function escapeLikePrefix(prefix) {
-  return prefix.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+function prefixRangeEnd(prefix) {
+  const points = Array.from(prefix);
+  while (points.length > 0) {
+    const cp = points[points.length - 1].codePointAt(0);
+    if (cp === 55295) {
+      points[points.length - 1] = String.fromCodePoint(57344);
+      return points.join("");
+    }
+    if (cp < 1114111) {
+      points[points.length - 1] = String.fromCodePoint(cp + 1);
+      return points.join("");
+    }
+    points.pop();
+  }
+  return "";
+}
+var D1_MAX_BOUND_PARAMS = 100;
+function chunkForBoundParams(values, fixedParams) {
+  const perStatement = D1_MAX_BOUND_PARAMS - fixedParams;
+  if (perStatement < 1) {
+    throw new Error(
+      `[amsg-server D1] \u56FA\u5B9A\u53C2\u6570\u5DF2\u5360\u6EE1 ${D1_MAX_BOUND_PARAMS} \u4E2A\u7ED1\u5B9A\u4F4D\uFF0CIN \u5217\u8868\u653E\u4E0D\u4E0B`
+    );
+  }
+  const batches = [];
+  for (let i = 0; i < values.length; i += perStatement) {
+    batches.push(values.slice(i, i + perStatement));
+  }
+  return batches;
 }
 var INTERNAL_TABLE_PREFIXES = ["sqlite_", "_cf_"];
 function isInternalTableName(name) {
@@ -3310,6 +3346,50 @@ var D1Adapter = class {
     }
     return d.toISOString();
   }
+  /**
+   * 组一组带 `IN (...)` 的语句：值多到一条塞不下时，按 D1 的绑定参数上限切成
+   * 几条（见 chunkForBoundParams）。
+   *
+   * 只有拿得到事务的绑定才切。没有 batch() 的绑定（测试 shim、自定义适配器，
+   * 都不是真实 D1）原样发一条不切的语句：切批是为 D1 那条上限服务的，这类绑
+   * 定不受它约束，切了反倒会因为没有事务而多出一个「写一半」的中间态。
+   *
+   * @private
+   * @param {(placeholders: string) => string} buildSql - 拿占位符串（`?, ?, ?`）组 SQL
+   * @param {unknown[]} leadingParams - IN 列表之前的固定参数，按出现顺序
+   * @param {unknown[]} values - IN 列表里的全部值
+   * @returns {any[]} 已经 bind 好的语句
+   */
+  _prepareInClauseStatements(buildSql, leadingParams, values) {
+    const batches = typeof this._db.batch === "function" ? chunkForBoundParams(values, leadingParams.length) : [values];
+    return batches.map((batch) => this._db.prepare(buildSql(batch.map(() => "?").join(", "))).bind(...leadingParams, ...batch));
+  }
+  /**
+   * 带 `IN (...)` 的批量写，切成几条也仍然是一次原子操作。
+   *
+   * 一条语句本来天然原子，拆开之后这份保证得自己补回来，否则就会多出「只删掉
+   * 前 99 个」「只 ack 了前 98 条」这类比原问题更难查的中间态。D1 的 batch()
+   * 是隐式事务——其中一条失败，整批回滚——正好接住这件事。
+   *
+   * 一条就够时照旧单发，跟切批以前走的是同一条路，常见调用（一次三五个 id）
+   * 的行为一个字节都没变。
+   *
+   * @private
+   * @param {(placeholders: string) => string} buildSql
+   * @param {unknown[]} leadingParams
+   * @param {unknown[]} values
+   * @returns {Promise<number>} 各批影响行数之和
+   */
+  async _runInClauseWrite(buildSql, leadingParams, values) {
+    const statements = this._prepareInClauseStatements(buildSql, leadingParams, values);
+    if (statements.length === 0) return 0;
+    if (statements.length === 1) {
+      const res = await statements[0].run();
+      return res.meta.changes || 0;
+    }
+    const results = await this._db.batch(statements);
+    return results.reduce((n, res) => n + (res.meta.changes || 0), 0);
+  }
   async initSchema() {
     await this._db.prepare(SQLITE_TABLE_SQL).run();
     await this._db.prepare(CLIENT_STATE_TABLE_SQL).run();
@@ -3693,11 +3773,11 @@ var D1Adapter = class {
          updated_at = excluded.updated_at
        WHERE excluded.updated_at >= client_state.updated_at`;
     const CLEANUP_PREFIX_SQL = `DELETE FROM client_state
-       WHERE user_id = ? AND namespace = ? AND key LIKE ? ESCAPE '\\' AND updated_at <= ?`;
+       WHERE user_id = ? AND namespace = ? AND key >= ? AND key < ? AND updated_at <= ?`;
     const CLEANUP_KEY_SQL = `DELETE FROM client_state
        WHERE user_id = ? AND namespace = ? AND key = ? AND updated_at <= ?`;
     const buildStatements = () => [
-      ...cleanups.map((c) => typeof c.key === "string" ? this._db.prepare(CLEANUP_KEY_SQL).bind(userId, c.namespace, c.key, c.updatedAt) : this._db.prepare(CLEANUP_PREFIX_SQL).bind(userId, c.namespace, `${escapeLikePrefix(c.keyPrefix)}%`, c.updatedAt)),
+      ...cleanups.map((c) => typeof c.key === "string" ? this._db.prepare(CLEANUP_KEY_SQL).bind(userId, c.namespace, c.key, c.updatedAt) : this._db.prepare(CLEANUP_PREFIX_SQL).bind(userId, c.namespace, c.keyPrefix, prefixRangeEnd(c.keyPrefix), c.updatedAt)),
       ...entries.map(
         (entry) => this._db.prepare(UPSERT_SQL).bind(userId, entry.namespace, entry.key, entry.value, entry.updatedAt)
       )
@@ -3826,13 +3906,19 @@ var D1Adapter = class {
    */
   async getLlmCredentials(userId, credIds) {
     if (!credIds || credIds.length === 0) return [];
-    const placeholders = credIds.map(() => "?").join(", ");
-    const res = await this._db.prepare(
-      `SELECT cred_id, encrypted_value, updated_at
-       FROM llm_credentials
-       WHERE user_id = ? AND cred_id IN (${placeholders})`
-    ).bind(userId, ...credIds).all();
-    return res.results || [];
+    const statements = this._prepareInClauseStatements(
+      (placeholders) => `SELECT cred_id, encrypted_value, updated_at
+         FROM llm_credentials
+         WHERE user_id = ? AND cred_id IN (${placeholders})`,
+      [userId],
+      credIds
+    );
+    const rows = [];
+    for (const stmt of statements) {
+      const res = await stmt.all();
+      rows.push(...res.results || []);
+    }
+    return rows;
   }
   /**
    * 这个用户名下所有凭据的对账清单（只有 cred_id 和 updated_at，密文不出
@@ -3858,18 +3944,17 @@ var D1Adapter = class {
    */
   async deleteLlmCredentials(userId, credIds = null) {
     if (credIds !== null && credIds.length === 0) return 0;
-    let res;
     if (credIds === null) {
-      res = await this._db.prepare(
+      const res = await this._db.prepare(
         "DELETE FROM llm_credentials WHERE user_id = ?"
       ).bind(userId).run();
-    } else {
-      const placeholders = credIds.map(() => "?").join(", ");
-      res = await this._db.prepare(
-        `DELETE FROM llm_credentials WHERE user_id = ? AND cred_id IN (${placeholders})`
-      ).bind(userId, ...credIds).run();
+      return res.meta.changes || 0;
     }
-    return res.meta.changes || 0;
+    return this._runInClauseWrite(
+      (placeholders) => `DELETE FROM llm_credentials WHERE user_id = ? AND cred_id IN (${placeholders})`,
+      [userId],
+      credIds
+    );
   }
   // ── message_outbox（服务端消息收件箱，客户端 ack）────────────────────────
   /**
@@ -3925,12 +4010,12 @@ var D1Adapter = class {
    */
   async markOutboxDelivered(userId, messageIds, deliveredAt) {
     if (!messageIds || messageIds.length === 0) return 0;
-    const placeholders = messageIds.map(() => "?").join(", ");
-    const res = await this._db.prepare(
-      `UPDATE message_outbox SET delivered_at = ?
-       WHERE user_id = ? AND message_id IN (${placeholders})`
-    ).bind(deliveredAt, userId, ...messageIds).run();
-    return res.meta.changes || 0;
+    return this._runInClauseWrite(
+      (placeholders) => `UPDATE message_outbox SET delivered_at = ?
+         WHERE user_id = ? AND message_id IN (${placeholders})`,
+      [deliveredAt, userId],
+      messageIds
+    );
   }
   /**
    * 未 ack 的行（id 升序，游标翻页）。payload 仍是密文，解密在 handler。
@@ -3962,12 +4047,12 @@ var D1Adapter = class {
    */
   async ackOutboxMessages(userId, messageIds, ackedAt) {
     if (!messageIds || messageIds.length === 0) return 0;
-    const placeholders = messageIds.map(() => "?").join(", ");
-    const res = await this._db.prepare(
-      `UPDATE message_outbox SET acked_at = ?
-       WHERE user_id = ? AND acked_at IS NULL AND message_id IN (${placeholders})`
-    ).bind(ackedAt, userId, ...messageIds).run();
-    return res.meta.changes || 0;
+    return this._runInClauseWrite(
+      (placeholders) => `UPDATE message_outbox SET acked_at = ?
+         WHERE user_id = ? AND acked_at IS NULL AND message_id IN (${placeholders})`,
+      [ackedAt, userId],
+      messageIds
+    );
   }
   /**
    * outbox 的例行清理（run-tick 每跳顺手调）：已 ack 的行留短一些，未 ack 的
@@ -4249,7 +4334,7 @@ function createClientStateHandler(ctx) {
 }
 
 // src/server/lib/version.js
-var SERVER_VERSION = true ? "2.6.0-next.19" : "0.0.0-dev";
+var SERVER_VERSION = true ? "2.6.0-next.20" : "0.0.0-dev";
 
 // src/server/handlers/capabilities.js
 var SERVER_FEATURES = Object.freeze([

package/dist/cloudflare.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkXVJ7ZLZXcjs = require('./chunk-XVJ7ZLZX.cjs');
+var _chunkWOXSQBAMcjs = require('./chunk-WOXSQBAM.cjs');
 require('./chunk-V6NZQ22S.cjs');
 
 
@@ -52,4 +52,4 @@ require('./chunk-V6NZQ22S.cjs');
 
 
 
-exports.MAX_PUSH_PAYLOAD_BYTES = _chunkXVJ7ZLZXcjs.MAX_PUSH_PAYLOAD_BYTES; exports.NonRetryableError = _chunkXVJ7ZLZXcjs.NonRetryableError; exports.PUSH_ENVELOPE_RESERVED_BYTES = _chunkXVJ7ZLZXcjs.PUSH_ENVELOPE_RESERVED_BYTES; exports.SCHEMA_VERSION = _chunkXVJ7ZLZXcjs.SCHEMA_VERSION; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = _chunkXVJ7ZLZXcjs.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.WEB_PUSH_MAX_BODY_BYTES = _chunkXVJ7ZLZXcjs.WEB_PUSH_MAX_BODY_BYTES; exports.advanceOccurrence = _chunkXVJ7ZLZXcjs.advanceOccurrence; exports.createD1Adapter = _chunkXVJ7ZLZXcjs.createD1Adapter; exports.createSingleUserCloudflareWorker = _chunkXVJ7ZLZXcjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkXVJ7ZLZXcjs.createSingleUserServer; exports.createWebCryptoWebPush = _chunkXVJ7ZLZXcjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkXVJ7ZLZXcjs.decryptFromStorage; exports.decryptPayload = _chunkXVJ7ZLZXcjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkXVJ7ZLZXcjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkXVJ7ZLZXcjs.encryptForStorage; exports.ensureSchema = _chunkXVJ7ZLZXcjs.ensureSchema; exports.getSchemaVersion = _chunkXVJ7ZLZXcjs.getSchemaVersion; exports.isNonRetryableError = _chunkXVJ7ZLZXcjs.isNonRetryableError; exports.isValidTimeZoneId = _chunkXVJ7ZLZXcjs.isValidTimeZoneId; exports.measurePushPayload = _chunkXVJ7ZLZXcjs.measurePushPayload; exports.nextFutureOccurrence = _chunkXVJ7ZLZXcjs.nextFutureOccurrence; exports.planNextOccurrence = _chunkXVJ7ZLZXcjs.planNextOccurrence; exports.runScheduledTick = _chunkXVJ7ZLZXcjs.runScheduledTick; exports.runTask = _chunkXVJ7ZLZXcjs.runTask; exports.summarizeErrorCause = _chunkXVJ7ZLZXcjs.summarizeErrorCause;
+exports.MAX_PUSH_PAYLOAD_BYTES = _chunkWOXSQBAMcjs.MAX_PUSH_PAYLOAD_BYTES; exports.NonRetryableError = _chunkWOXSQBAMcjs.NonRetryableError; exports.PUSH_ENVELOPE_RESERVED_BYTES = _chunkWOXSQBAMcjs.PUSH_ENVELOPE_RESERVED_BYTES; exports.SCHEMA_VERSION = _chunkWOXSQBAMcjs.SCHEMA_VERSION; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = _chunkWOXSQBAMcjs.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.WEB_PUSH_MAX_BODY_BYTES = _chunkWOXSQBAMcjs.WEB_PUSH_MAX_BODY_BYTES; exports.advanceOccurrence = _chunkWOXSQBAMcjs.advanceOccurrence; exports.createD1Adapter = _chunkWOXSQBAMcjs.createD1Adapter; exports.createSingleUserCloudflareWorker = _chunkWOXSQBAMcjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkWOXSQBAMcjs.createSingleUserServer; exports.createWebCryptoWebPush = _chunkWOXSQBAMcjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkWOXSQBAMcjs.decryptFromStorage; exports.decryptPayload = _chunkWOXSQBAMcjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkWOXSQBAMcjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkWOXSQBAMcjs.encryptForStorage; exports.ensureSchema = _chunkWOXSQBAMcjs.ensureSchema; exports.getSchemaVersion = _chunkWOXSQBAMcjs.getSchemaVersion; exports.isNonRetryableError = _chunkWOXSQBAMcjs.isNonRetryableError; exports.isValidTimeZoneId = _chunkWOXSQBAMcjs.isValidTimeZoneId; exports.measurePushPayload = _chunkWOXSQBAMcjs.measurePushPayload; exports.nextFutureOccurrence = _chunkWOXSQBAMcjs.nextFutureOccurrence; exports.planNextOccurrence = _chunkWOXSQBAMcjs.planNextOccurrence; exports.runScheduledTick = _chunkWOXSQBAMcjs.runScheduledTick; exports.runTask = _chunkWOXSQBAMcjs.runTask; exports.summarizeErrorCause = _chunkWOXSQBAMcjs.summarizeErrorCause;

package/dist/cloudflare.mjs

@@ -24,7 +24,7 @@ import {
   runScheduledTick,
   runTask,
   summarizeErrorCause
-} from "./chunk-PRQHHRAK.mjs";
+} from "./chunk-HTGYGGUH.mjs";
 import "./chunk-5FXVSC5O.mjs";
 export {
   MAX_PUSH_PAYLOAD_BYTES,

package/dist/index.cjs

@@ -67,7 +67,7 @@
 
 
 
-var _chunkXVJ7ZLZXcjs = require('./chunk-XVJ7ZLZX.cjs');
+var _chunkWOXSQBAMcjs = require('./chunk-WOXSQBAM.cjs');
 require('./chunk-V6NZQ22S.cjs');
 
 // src/server/adapters/factory.js
@@ -101,7 +101,7 @@ async function createAdapter(config) {
 // src/server/handlers/init-tenant.js
 function createInitTenantHandler(ctx) {
   async function POST(headers, body) {
-    const initSecret = _chunkXVJ7ZLZXcjs.getHeader.call(void 0, headers, "x-init-secret");
+    const initSecret = _chunkWOXSQBAMcjs.getHeader.call(void 0, headers, "x-init-secret");
     if (ctx.tenant.initSecret && initSecret !== ctx.tenant.initSecret) {
       return {
         status: 401,
@@ -114,7 +114,7 @@ function createInitTenantHandler(ctx) {
         }
       };
     }
-    const parsed = _chunkXVJ7ZLZXcjs.parseJsonBody.call(void 0, body);
+    const parsed = _chunkWOXSQBAMcjs.parseJsonBody.call(void 0, body);
     if (!parsed.ok) {
       return {
         status: 400,
@@ -128,7 +128,7 @@ function createInitTenantHandler(ctx) {
     const tenantId = payload.tenantId || void 0;
     const driver = payload.driver;
     const databaseUrl = payload.databaseUrl || payload.connectionString;
-    if (tenantId && !_chunkXVJ7ZLZXcjs.isValidUUIDv4.call(void 0, tenantId)) {
+    if (tenantId && !_chunkWOXSQBAMcjs.isValidUUIDv4.call(void 0, tenantId)) {
       return {
         status: 400,
         body: {
@@ -248,7 +248,7 @@ function createSendNotificationsHandler(ctx) {
         }
       };
     }
-    const data = await _chunkXVJ7ZLZXcjs.runScheduledTick.call(void 0, { ...ctx, db, masterKey });
+    const data = await _chunkWOXSQBAMcjs.runScheduledTick.call(void 0, { ...ctx, db, masterKey });
     return { status: 200, body: { success: true, data } };
   }
   return { POST };
@@ -270,16 +270,16 @@ function encryptConfig(config, kekBuffer) {
   const plaintext = Buffer.from(JSON.stringify(config), "utf8");
   const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   const authTag = cipher.getAuthTag();
-  return `v1.${_chunkXVJ7ZLZXcjs.bytesToBase64Url.call(void 0, iv)}.${_chunkXVJ7ZLZXcjs.bytesToBase64Url.call(void 0, authTag)}.${_chunkXVJ7ZLZXcjs.bytesToBase64Url.call(void 0, ciphertext)}`;
+  return `v1.${_chunkWOXSQBAMcjs.bytesToBase64Url.call(void 0, iv)}.${_chunkWOXSQBAMcjs.bytesToBase64Url.call(void 0, authTag)}.${_chunkWOXSQBAMcjs.bytesToBase64Url.call(void 0, ciphertext)}`;
 }
 function decryptConfig(encrypted, kekBuffer) {
   const parts = String(encrypted || "").split(".");
   if (parts.length !== 4 || parts[0] !== "v1") {
     throw new Error("INVALID_TENANT_CONFIG");
   }
-  const iv = _chunkXVJ7ZLZXcjs.base64UrlToBytes.call(void 0, parts[1]);
-  const authTag = _chunkXVJ7ZLZXcjs.base64UrlToBytes.call(void 0, parts[2]);
-  const ciphertext = _chunkXVJ7ZLZXcjs.base64UrlToBytes.call(void 0, parts[3]);
+  const iv = _chunkWOXSQBAMcjs.base64UrlToBytes.call(void 0, parts[1]);
+  const authTag = _chunkWOXSQBAMcjs.base64UrlToBytes.call(void 0, parts[2]);
+  const ciphertext = _chunkWOXSQBAMcjs.base64UrlToBytes.call(void 0, parts[3]);
   const decipher = _crypto.createDecipheriv.call(void 0, "aes-256-gcm", kekBuffer, iv);
   decipher.setAuthTag(authTag);
   const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
@@ -347,7 +347,7 @@ function createTenantBlobStore(options) {
 // src/server/tenant/token.js
 
 function sign(input, secret) {
-  return _chunkXVJ7ZLZXcjs.bytesToBase64Url.call(void 0, _crypto.createHmac.call(void 0, "sha256", secret).update(input).digest());
+  return _chunkWOXSQBAMcjs.bytesToBase64Url.call(void 0, _crypto.createHmac.call(void 0, "sha256", secret).update(input).digest());
 }
 function nowEpochSeconds() {
   return Math.floor(Date.now() / 1e3);
@@ -363,8 +363,8 @@ function createTenantToken(params, secret) {
     v: 1
   };
   const header = { alg: "HS256", typ: "JWT" };
-  const encodedHeader = _chunkXVJ7ZLZXcjs.bytesToBase64Url.call(void 0, _chunkXVJ7ZLZXcjs.utf8.call(void 0, JSON.stringify(header)));
-  const encodedPayload = _chunkXVJ7ZLZXcjs.bytesToBase64Url.call(void 0, _chunkXVJ7ZLZXcjs.utf8.call(void 0, JSON.stringify(payload)));
+  const encodedHeader = _chunkWOXSQBAMcjs.bytesToBase64Url.call(void 0, _chunkWOXSQBAMcjs.utf8.call(void 0, JSON.stringify(header)));
+  const encodedPayload = _chunkWOXSQBAMcjs.bytesToBase64Url.call(void 0, _chunkWOXSQBAMcjs.utf8.call(void 0, JSON.stringify(payload)));
   const signingInput = `${encodedHeader}.${encodedPayload}`;
   const signature = sign(signingInput, secret);
   return `${signingInput}.${signature}`;
@@ -383,17 +383,17 @@ function verifyTenantToken(token, secret, options = {}) {
   let receivedBytes;
   let expectedBytes;
   try {
-    receivedBytes = _chunkXVJ7ZLZXcjs.base64UrlToBytes.call(void 0, receivedSignature);
-    expectedBytes = _chunkXVJ7ZLZXcjs.base64UrlToBytes.call(void 0, expectedSignature);
+    receivedBytes = _chunkWOXSQBAMcjs.base64UrlToBytes.call(void 0, receivedSignature);
+    expectedBytes = _chunkWOXSQBAMcjs.base64UrlToBytes.call(void 0, expectedSignature);
   } catch (e) {
     throw new Error("INVALID_TENANT_AUTH");
   }
-  if (!_chunkXVJ7ZLZXcjs.timingSafeEqualBytes.call(void 0, receivedBytes, expectedBytes)) {
+  if (!_chunkWOXSQBAMcjs.timingSafeEqualBytes.call(void 0, receivedBytes, expectedBytes)) {
     throw new Error("INVALID_TENANT_AUTH");
   }
   let payload;
   try {
-    payload = JSON.parse(_chunkXVJ7ZLZXcjs.utf8Decode.call(void 0, _chunkXVJ7ZLZXcjs.base64UrlToBytes.call(void 0, encodedPayload)));
+    payload = JSON.parse(_chunkWOXSQBAMcjs.utf8Decode.call(void 0, _chunkWOXSQBAMcjs.base64UrlToBytes.call(void 0, encodedPayload)));
   } catch (e2) {
     throw new Error("INVALID_TENANT_AUTH");
   }
@@ -613,15 +613,15 @@ async function createReiServer(config) {
   return {
     handlers: {
       initTenant: createInitTenantHandler(ctx),
-      getUserKey: _chunkXVJ7ZLZXcjs.createGetUserKeyHandler.call(void 0, ctx),
-      scheduleMessage: _chunkXVJ7ZLZXcjs.createScheduleMessageHandler.call(void 0, ctx),
+      getUserKey: _chunkWOXSQBAMcjs.createGetUserKeyHandler.call(void 0, ctx),
+      scheduleMessage: _chunkWOXSQBAMcjs.createScheduleMessageHandler.call(void 0, ctx),
       sendNotifications: createSendNotificationsHandler(ctx),
-      updateMessage: _chunkXVJ7ZLZXcjs.createUpdateMessageHandler.call(void 0, ctx),
-      cancelMessage: _chunkXVJ7ZLZXcjs.createCancelMessageHandler.call(void 0, ctx),
-      messages: _chunkXVJ7ZLZXcjs.createMessagesHandler.call(void 0, ctx),
-      getMessage: _chunkXVJ7ZLZXcjs.createGetMessageHandler.call(void 0, ctx),
-      pushSubscription: _chunkXVJ7ZLZXcjs.createPushSubscriptionHandler.call(void 0, ctx),
-      llmCredentials: _chunkXVJ7ZLZXcjs.createLlmCredentialsHandler.call(void 0, ctx)
+      updateMessage: _chunkWOXSQBAMcjs.createUpdateMessageHandler.call(void 0, ctx),
+      cancelMessage: _chunkWOXSQBAMcjs.createCancelMessageHandler.call(void 0, ctx),
+      messages: _chunkWOXSQBAMcjs.createMessagesHandler.call(void 0, ctx),
+      getMessage: _chunkWOXSQBAMcjs.createGetMessageHandler.call(void 0, ctx),
+      pushSubscription: _chunkWOXSQBAMcjs.createPushSubscriptionHandler.call(void 0, ctx),
+      llmCredentials: _chunkWOXSQBAMcjs.createLlmCredentialsHandler.call(void 0, ctx)
     }
   };
 }
@@ -683,4 +683,4 @@ async function createReiServer(config) {
 
 
 
-exports.CORS_ALLOW_HEADERS = _chunkXVJ7ZLZXcjs.CORS_ALLOW_HEADERS; exports.CORS_ALLOW_METHODS = _chunkXVJ7ZLZXcjs.CORS_ALLOW_METHODS; exports.CRED_ID_MAX_LENGTH = _chunkXVJ7ZLZXcjs.CRED_ID_MAX_LENGTH; exports.CRED_PUT_BATCH_MAX = _chunkXVJ7ZLZXcjs.CRED_PUT_BATCH_MAX; exports.CRED_REFS_MAX_ENTRIES = _chunkXVJ7ZLZXcjs.CRED_REFS_MAX_ENTRIES; exports.CRED_ROWS_PER_USER_MAX = _chunkXVJ7ZLZXcjs.CRED_ROWS_PER_USER_MAX; exports.DEFAULT_CLAIM_LEASE_MS = _chunkXVJ7ZLZXcjs.DEFAULT_CLAIM_LEASE_MS; exports.DEFAULT_HEARTBEAT_LEASE_TTL_MS = _chunkXVJ7ZLZXcjs.DEFAULT_HEARTBEAT_LEASE_TTL_MS; exports.DEFAULT_LEASE_HEARTBEAT_MS = _chunkXVJ7ZLZXcjs.DEFAULT_LEASE_HEARTBEAT_MS; exports.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE = _chunkXVJ7ZLZXcjs.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE; exports.DEFAULT_MAX_TOOL_ITERATIONS = _chunkXVJ7ZLZXcjs.DEFAULT_MAX_TOOL_ITERATIONS; exports.DEFAULT_TOTAL_TIMEOUT_MS = _chunkXVJ7ZLZXcjs.DEFAULT_TOTAL_TIMEOUT_MS; exports.MAX_PUSH_PAYLOAD_BYTES = _chunkXVJ7ZLZXcjs.MAX_PUSH_PAYLOAD_BYTES; exports.MIN_SCHEDULE_LEAD_MS = _chunkXVJ7ZLZXcjs.MIN_SCHEDULE_LEAD_MS; exports.NonRetryableError = _chunkXVJ7ZLZXcjs.NonRetryableError; exports.PUSH_ENVELOPE_RESERVED_BYTES = _chunkXVJ7ZLZXcjs.PUSH_ENVELOPE_RESERVED_BYTES; exports.SCHEMA_VERSION = _chunkXVJ7ZLZXcjs.SCHEMA_VERSION; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = _chunkXVJ7ZLZXcjs.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.WEB_PUSH_MAX_BODY_BYTES = _chunkXVJ7ZLZXcjs.WEB_PUSH_MAX_BODY_BYTES; exports.advanceOccurrence = _chunkXVJ7ZLZXcjs.advanceOccurrence; exports.createAdapter = createAdapter; exports.createD1Adapter = _chunkXVJ7ZLZXcjs.createD1Adapter; exports.createReiServer = createReiServer; exports.createSingleUserCloudflareWorker = _chunkXVJ7ZLZXcjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkXVJ7ZLZXcjs.createSingleUserServer; exports.createTenantToken = createTenantToken; exports.createWebCryptoWebPush = _chunkXVJ7ZLZXcjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkXVJ7ZLZXcjs.decryptFromStorage; exports.decryptPayload = _chunkXVJ7ZLZXcjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkXVJ7ZLZXcjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkXVJ7ZLZXcjs.encryptForStorage; exports.ensureSchema = _chunkXVJ7ZLZXcjs.ensureSchema; exports.getSchemaVersion = _chunkXVJ7ZLZXcjs.getSchemaVersion; exports.hasChatCredRef = _chunkXVJ7ZLZXcjs.hasChatCredRef; exports.isNonRetryableError = _chunkXVJ7ZLZXcjs.isNonRetryableError; exports.isValidCredId = _chunkXVJ7ZLZXcjs.isValidCredId; exports.isValidISO8601 = _chunkXVJ7ZLZXcjs.isValidISO8601; exports.isValidTimeZoneId = _chunkXVJ7ZLZXcjs.isValidTimeZoneId; exports.isValidUUID = _chunkXVJ7ZLZXcjs.isValidUUID; exports.isValidUUIDv4 = _chunkXVJ7ZLZXcjs.isValidUUIDv4; exports.isValidUrl = _chunkXVJ7ZLZXcjs.isValidUrl; exports.measurePushPayload = _chunkXVJ7ZLZXcjs.measurePushPayload; exports.nextFutureOccurrence = _chunkXVJ7ZLZXcjs.nextFutureOccurrence; exports.planNextOccurrence = _chunkXVJ7ZLZXcjs.planNextOccurrence; exports.resolveLlmCredential = _chunkXVJ7ZLZXcjs.resolveLlmCredential; exports.runScheduledTick = _chunkXVJ7ZLZXcjs.runScheduledTick; exports.runTask = _chunkXVJ7ZLZXcjs.runTask; exports.sanitizeErrorSummary = _chunkXVJ7ZLZXcjs.sanitizeErrorSummary; exports.summarizeErrorCause = _chunkXVJ7ZLZXcjs.summarizeErrorCause; exports.supportsLlmCredentialsStore = _chunkXVJ7ZLZXcjs.supportsLlmCredentialsStore; exports.validateAvatarUrl = _chunkXVJ7ZLZXcjs.validateAvatarUrl; exports.validateCredRefs = _chunkXVJ7ZLZXcjs.validateCredRefs; exports.validateCredValue = _chunkXVJ7ZLZXcjs.validateCredValue; exports.validateLlmMessagesArray = _chunkXVJ7ZLZXcjs.validateLlmMessagesArray; exports.validateScheduleMessagePayload = _chunkXVJ7ZLZXcjs.validateScheduleMessagePayload; exports.validateSplitPattern = _chunkXVJ7ZLZXcjs.validateSplitPattern; exports.verifyTenantToken = verifyTenantToken;
+exports.CORS_ALLOW_HEADERS = _chunkWOXSQBAMcjs.CORS_ALLOW_HEADERS; exports.CORS_ALLOW_METHODS = _chunkWOXSQBAMcjs.CORS_ALLOW_METHODS; exports.CRED_ID_MAX_LENGTH = _chunkWOXSQBAMcjs.CRED_ID_MAX_LENGTH; exports.CRED_PUT_BATCH_MAX = _chunkWOXSQBAMcjs.CRED_PUT_BATCH_MAX; exports.CRED_REFS_MAX_ENTRIES = _chunkWOXSQBAMcjs.CRED_REFS_MAX_ENTRIES; exports.CRED_ROWS_PER_USER_MAX = _chunkWOXSQBAMcjs.CRED_ROWS_PER_USER_MAX; exports.DEFAULT_CLAIM_LEASE_MS = _chunkWOXSQBAMcjs.DEFAULT_CLAIM_LEASE_MS; exports.DEFAULT_HEARTBEAT_LEASE_TTL_MS = _chunkWOXSQBAMcjs.DEFAULT_HEARTBEAT_LEASE_TTL_MS; exports.DEFAULT_LEASE_HEARTBEAT_MS = _chunkWOXSQBAMcjs.DEFAULT_LEASE_HEARTBEAT_MS; exports.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE = _chunkWOXSQBAMcjs.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE; exports.DEFAULT_MAX_TOOL_ITERATIONS = _chunkWOXSQBAMcjs.DEFAULT_MAX_TOOL_ITERATIONS; exports.DEFAULT_TOTAL_TIMEOUT_MS = _chunkWOXSQBAMcjs.DEFAULT_TOTAL_TIMEOUT_MS; exports.MAX_PUSH_PAYLOAD_BYTES = _chunkWOXSQBAMcjs.MAX_PUSH_PAYLOAD_BYTES; exports.MIN_SCHEDULE_LEAD_MS = _chunkWOXSQBAMcjs.MIN_SCHEDULE_LEAD_MS; exports.NonRetryableError = _chunkWOXSQBAMcjs.NonRetryableError; exports.PUSH_ENVELOPE_RESERVED_BYTES = _chunkWOXSQBAMcjs.PUSH_ENVELOPE_RESERVED_BYTES; exports.SCHEMA_VERSION = _chunkWOXSQBAMcjs.SCHEMA_VERSION; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = _chunkWOXSQBAMcjs.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.WEB_PUSH_MAX_BODY_BYTES = _chunkWOXSQBAMcjs.WEB_PUSH_MAX_BODY_BYTES; exports.advanceOccurrence = _chunkWOXSQBAMcjs.advanceOccurrence; exports.createAdapter = createAdapter; exports.createD1Adapter = _chunkWOXSQBAMcjs.createD1Adapter; exports.createReiServer = createReiServer; exports.createSingleUserCloudflareWorker = _chunkWOXSQBAMcjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkWOXSQBAMcjs.createSingleUserServer; exports.createTenantToken = createTenantToken; exports.createWebCryptoWebPush = _chunkWOXSQBAMcjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkWOXSQBAMcjs.decryptFromStorage; exports.decryptPayload = _chunkWOXSQBAMcjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkWOXSQBAMcjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkWOXSQBAMcjs.encryptForStorage; exports.ensureSchema = _chunkWOXSQBAMcjs.ensureSchema; exports.getSchemaVersion = _chunkWOXSQBAMcjs.getSchemaVersion; exports.hasChatCredRef = _chunkWOXSQBAMcjs.hasChatCredRef; exports.isNonRetryableError = _chunkWOXSQBAMcjs.isNonRetryableError; exports.isValidCredId = _chunkWOXSQBAMcjs.isValidCredId; exports.isValidISO8601 = _chunkWOXSQBAMcjs.isValidISO8601; exports.isValidTimeZoneId = _chunkWOXSQBAMcjs.isValidTimeZoneId; exports.isValidUUID = _chunkWOXSQBAMcjs.isValidUUID; exports.isValidUUIDv4 = _chunkWOXSQBAMcjs.isValidUUIDv4; exports.isValidUrl = _chunkWOXSQBAMcjs.isValidUrl; exports.measurePushPayload = _chunkWOXSQBAMcjs.measurePushPayload; exports.nextFutureOccurrence = _chunkWOXSQBAMcjs.nextFutureOccurrence; exports.planNextOccurrence = _chunkWOXSQBAMcjs.planNextOccurrence; exports.resolveLlmCredential = _chunkWOXSQBAMcjs.resolveLlmCredential; exports.runScheduledTick = _chunkWOXSQBAMcjs.runScheduledTick; exports.runTask = _chunkWOXSQBAMcjs.runTask; exports.sanitizeErrorSummary = _chunkWOXSQBAMcjs.sanitizeErrorSummary; exports.summarizeErrorCause = _chunkWOXSQBAMcjs.summarizeErrorCause; exports.supportsLlmCredentialsStore = _chunkWOXSQBAMcjs.supportsLlmCredentialsStore; exports.validateAvatarUrl = _chunkWOXSQBAMcjs.validateAvatarUrl; exports.validateCredRefs = _chunkWOXSQBAMcjs.validateCredRefs; exports.validateCredValue = _chunkWOXSQBAMcjs.validateCredValue; exports.validateLlmMessagesArray = _chunkWOXSQBAMcjs.validateLlmMessagesArray; exports.validateScheduleMessagePayload = _chunkWOXSQBAMcjs.validateScheduleMessagePayload; exports.validateSplitPattern = _chunkWOXSQBAMcjs.validateSplitPattern; exports.verifyTenantToken = verifyTenantToken;

package/dist/index.mjs

@@ -67,7 +67,7 @@ import {
   validateLlmMessagesArray,
   validateScheduleMessagePayload,
   validateSplitPattern
-} from "./chunk-PRQHHRAK.mjs";
+} from "./chunk-HTGYGGUH.mjs";
 import "./chunk-5FXVSC5O.mjs";
 
 // src/server/adapters/factory.js

package/dist/lib/message-processor.d.ts

@@ -12,7 +12,8 @@
  * @param {string} [providedMasterKey]
  * @param {{ userKey: string, payload: Object } | null} [predecrypted] - 调用方
  *   （run-tick 的预扫描）已经解好的 payload；传了就不再解第二遍。
- * @returns {Promise<{ success: boolean, messagesSent: number, error?: string, errorCode?: string|null }>}
+ * @returns {Promise<{ success: boolean, messagesSent: number, error?: string, errorCode?: string|null, pushStatusCode?: number|null, permanent?: boolean }>}
+ *   失败时 `pushStatusCode` 是推送服务回的 HTTP 状态码（不是推送阶段炸的 → null）。
  */
 export function processSingleMessage(task: import("../adapters/interface.js").TaskRow, ctx: ProcessorContext, providedMasterKey?: string, predecrypted?: {
     userKey: string;
@@ -22,6 +23,8 @@ export function processSingleMessage(task: import("../adapters/interface.js").Ta
     messagesSent: number;
     error?: string;
     errorCode?: string | null;
+    pushStatusCode?: number | null;
+    permanent?: boolean;
 }>;
 /**
  * Process a single message identified by UUID (used for instant type).

package/dist/lib/task-projection.d.ts

@@ -26,7 +26,8 @@
  * @property {string|null}  clientTaskId  - 取自 metadata.amsgClientTaskId
  * @property {Object|null}  credRefs      - 凭据引用（{ <purpose>: <cred_id> }）；引用不是机密，客户端对账要看。没带 → null
  * @property {Object|null}  [metadata]    - 只有 includeMetadata 时才有，见下
- * @property {{ at: string, occurrence: string, reason: string }|null} lastError
+ * @property {{ at: string, occurrence: string, reason: string, pushStatus?: number }|null} lastError
+ *   `pushStatus` 只在投递失败于推送这一步时出现，值是推送服务回的 HTTP 状态码。
  */
 /**
  * @param {Object} row - 数据库任务行
@@ -74,9 +75,13 @@ export type TaskProjection = {
      * - 只有 includeMetadata 时才有，见下
      */
     metadata?: any | null;
+    /**
+     *   `pushStatus` 只在投递失败于推送这一步时出现，值是推送服务回的 HTTP 状态码。
+     */
     lastError: {
         at: string;
         occurrence: string;
         reason: string;
+        pushStatus?: number;
     } | null;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rei-standard/amsg-server",
-  "version": "2.6.0-next.19",
+  "version": "2.6.0-next.20",
   "description": "ReiStandard Active Messaging server SDK with pluggable database adapters. Three-axis push schema (messageKind / messageType / messageSubtype) from @rei-standard/amsg-shared. Auto-emits ReasoningPush when the LLM response carries reasoning_content.",
   "repository": {
     "type": "git",