@rei-standard/amsg-server 2.6.0-next.2 → 2.6.0-next.21

package/dist/index.d.cts

@@ -1,705 +1,9 @@
-import { g as getHeader, p as parseJsonBody, i as isValidUUIDv4, r as runScheduledTick, c as createMessagesHandler, a as createCancelMessageHandler, b as createUpdateMessageHandler, d as createScheduleMessageHandler, e as createGetUserKeyHandler } from './cloudflare-B-E51VjP.cjs';
-export { f as createD1Adapter, h as createSingleUserCloudflareWorker, j as createSingleUserServer, k as createWebCryptoWebPush, l as decryptFromStorage, m as decryptPayload, n as deriveUserEncryptionKey, o as encryptForStorage, q as isValidISO8601, s as isValidUUID, t as isValidUrl, v as validateLlmMessagesArray, u as validateScheduleMessagePayload, w as validateSplitPattern } from './cloudflare-B-E51VjP.cjs';
-import { createHash, randomBytes, createCipheriv, createDecipheriv, timingSafeEqual, createHmac, randomUUID } from 'crypto';
-import { normalizeVapidSubject } from '@rei-standard/amsg-shared';
-export { validateAvatarUrl } from '@rei-standard/amsg-shared';
-
-/**
- * Adapter Factory
- * ReiStandard SDK v2.0.1
- *
- * Creates a database adapter instance based on the supplied configuration.
- *
- * @typedef {'neon'|'pg'} DriverName
- *
- * @typedef {Object} AdapterConfig
- * @property {DriverName} driver  - Which database driver to use.
- * @property {string}     connectionString - Database connection URL.
- */
-
-/**
- * Create a database adapter.
- *
- * @param {AdapterConfig} config
- * @returns {Promise<import('./interface.js').DbAdapter>}
- */
-async function createAdapter(config) {
-  if (!config || !config.driver) {
-    throw new Error(
-      '[rei-standard-amsg-server] "driver" is required in the db config. ' +
-      'Supported drivers: neon, pg'
-    );
-  }
-
-  if (!config.connectionString) {
-    throw new Error(
-      '[rei-standard-amsg-server] "connectionString" is required in the db config.'
-    );
-  }
-
-  switch (config.driver) {
-    case 'neon': {
-      const { NeonAdapter } = await import('./neon-CJl66EGy.d.cts');
-      return new NeonAdapter(config.connectionString);
-    }
-
-    case 'pg': {
-      const { PgAdapter } = await import('./pg-07S-u_H4.d.cts');
-      return new PgAdapter(config.connectionString);
-    }
-
-    default:
-      throw new Error(
-        `[rei-standard-amsg-server] Unsupported driver "${config.driver}". ` +
-        'Supported drivers: neon, pg'
-      );
-  }
-}
-
-/**
- * Handler: init-tenant
- * ReiStandard SDK v2.0.1
- *
- * @param {Object} ctx - Server context.
- * @returns {{ POST: function }}
- */
-
-
-function createInitTenantHandler(ctx) {
-  async function POST(headers, body) {
-    const initSecret = getHeader(headers, 'x-init-secret');
-
-    // If initSecret is configured, require a matching X-Init-Secret.
-    if (ctx.tenant.initSecret && initSecret !== ctx.tenant.initSecret) {
-      return {
-        status: 401,
-        body: {
-          success: false,
-          error: {
-            code: 'INVALID_INIT_AUTH',
-            message: '初始化鉴权失败'
-          }
-        }
-      };
-    }
-
-    const parsed = parseJsonBody(body);
-    if (!parsed.ok) {
-      return {
-        status: 400,
-        body: {
-          success: false,
-          error: parsed.error
-        }
-      };
-    }
-
-    const payload = parsed.data;
-    const tenantId = payload.tenantId || undefined;
-    const driver = payload.driver;
-    const databaseUrl = payload.databaseUrl || payload.connectionString;
-
-    if (tenantId && !isValidUUIDv4(tenantId)) {
-      return {
-        status: 400,
-        body: {
-          success: false,
-          error: {
-            code: 'INVALID_TENANT_ID',
-            message: 'tenantId 必须是 UUID v4 格式'
-          }
-        }
-      };
-    }
-
-    if (!databaseUrl || !driver) {
-      return {
-        status: 400,
-        body: {
-          success: false,
-          error: {
-            code: 'INVALID_PARAMETERS',
-            message: '缺少 driver 或 databaseUrl 参数'
-          }
-        }
-      };
-    }
-
-    try {
-      const result = await ctx.tenantManager.initializeTenant({
-        tenantId,
-        driver,
-        connectionString: databaseUrl
-      });
-
-      return {
-        status: 201,
-        body: {
-          success: true,
-          data: {
-            tenantId: result.tenantId,
-            tenantToken: result.tenantToken,
-            cronToken: result.cronToken,
-            cronWebhookUrl: result.cronWebhookUrl,
-            masterKeyFingerprint: result.masterKeyFingerprint
-          }
-        }
-      };
-    } catch (error) {
-      if (error.message === 'INVALID_DRIVER') {
-        return {
-          status: 400,
-          body: {
-            success: false,
-            error: {
-              code: 'INVALID_DRIVER',
-              message: 'driver 必须是 neon 或 pg'
-            }
-          }
-        };
-      }
-
-      if (error.message === 'INVALID_DATABASE_URL') {
-        return {
-          status: 400,
-          body: {
-            success: false,
-            error: {
-              code: 'INVALID_DATABASE_URL',
-              message: 'databaseUrl 不能为空'
-            }
-          }
-        };
-      }
-
-      if (error.message === 'TENANT_ALREADY_INITIALIZED') {
-        return {
-          status: 409,
-          body: {
-            success: false,
-            error: {
-              code: 'TENANT_ALREADY_INITIALIZED',
-              message: 'tenantId 已存在，不能重复初始化'
-            }
-          }
-        };
-      }
-
-      throw error;
-    }
-  }
-
-  return { POST };
-}
-
-/**
- * Handler: send-notifications
- * ReiStandard SDK v2.0.1
- *
- * @param {Object} ctx - Server context.
- * @returns {{ POST: function }}
- */
-
-
-function createSendNotificationsHandler(ctx) {
-  async function POST(urlOrHeaders, maybeHeaders) {
-    const url = typeof urlOrHeaders === 'string' ? urlOrHeaders : '';
-    const headers = maybeHeaders || (typeof urlOrHeaders === 'object' ? urlOrHeaders : {});
-
-    const tenantResult = await ctx.tenantManager.resolveTenant(headers, {
-      allowCronToken: true,
-      url
-    });
-    if (!tenantResult.ok) {
-      return tenantResult.error;
-    }
-
-    const tenantCtx = tenantResult.context;
-    const db = tenantCtx.db;
-    const masterKey = tenantCtx.masterKey;
-
-    if (!ctx.vapid.email || !ctx.vapid.publicKey || !ctx.vapid.privateKey) {
-      return {
-        status: 500,
-        body: {
-          success: false,
-          error: {
-            code: 'VAPID_CONFIG_ERROR',
-            message: 'VAPID 配置缺失，无法发送推送通知',
-            details: {
-              missingKeys: [
-                !ctx.vapid.email && 'VAPID_EMAIL',
-                !ctx.vapid.publicKey && 'NEXT_PUBLIC_VAPID_PUBLIC_KEY',
-                !ctx.vapid.privateKey && 'VAPID_PRIVATE_KEY'
-              ].filter(Boolean)
-            }
-          }
-        }
-      };
-    }
-
-    const data = await runScheduledTick({ ...ctx, db, masterKey });
-    return { status: 200, body: { success: true, data } };
-  }
-
-  return { POST };
-}
-
-const inMemoryNamespaces = new Map();
-
-function base64UrlEncode$1(input) {
-  return Buffer.from(input)
-    .toString('base64')
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/g, '');
-}
-
-function base64UrlDecode$1(input) {
-  const normalized = input
-    .replace(/-/g, '+')
-    .replace(/_/g, '/');
-  const padLength = (4 - (normalized.length % 4)) % 4;
-  return Buffer.from(normalized + '='.repeat(padLength), 'base64');
-}
-
-function getKekBuffer(kek) {
-  const value = String(kek || '').trim();
-  if (!value) {
-    throw new Error('[rei-standard-amsg-server] tenant.kek is required');
-  }
-  return createHash('sha256').update(value).digest();
-}
-
-function encryptConfig(config, kekBuffer) {
-  const iv = randomBytes(12);
-  const cipher = createCipheriv('aes-256-gcm', kekBuffer, iv);
-  const plaintext = Buffer.from(JSON.stringify(config), 'utf8');
-  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-  const authTag = cipher.getAuthTag();
-
-  return `v1.${base64UrlEncode$1(iv)}.${base64UrlEncode$1(authTag)}.${base64UrlEncode$1(ciphertext)}`;
-}
-
-function decryptConfig(encrypted, kekBuffer) {
-  const parts = String(encrypted || '').split('.');
-  if (parts.length !== 4 || parts[0] !== 'v1') {
-    throw new Error('INVALID_TENANT_CONFIG');
-  }
-
-  const iv = base64UrlDecode$1(parts[1]);
-  const authTag = base64UrlDecode$1(parts[2]);
-  const ciphertext = base64UrlDecode$1(parts[3]);
-
-  const decipher = createDecipheriv('aes-256-gcm', kekBuffer, iv);
-  decipher.setAuthTag(authTag);
-  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
-  return JSON.parse(plaintext);
-}
-
-function createInMemoryStore(namespace) {
-  if (!inMemoryNamespaces.has(namespace)) {
-    inMemoryNamespaces.set(namespace, new Map());
-  }
-
-  const namespaceMap = inMemoryNamespaces.get(namespace);
-
-  return {
-    async get(key) {
-      return namespaceMap.has(key) ? namespaceMap.get(key) : null;
-    },
-    async set(key, value) {
-      namespaceMap.set(key, value);
-    },
-    async delete(key) {
-      namespaceMap.delete(key);
-    }
-  };
-}
-
-async function resolveBlobStore(namespace) {
-  if (globalThis.__REI_BLOB_STORE__ && typeof globalThis.__REI_BLOB_STORE__.get === 'function') {
-    return globalThis.__REI_BLOB_STORE__;
-  }
-
-  try {
-    const blobModule = await import('@netlify/blobs');
-    const getStore = blobModule.getStore || blobModule.default?.getStore;
-    if (typeof getStore === 'function') {
-      return getStore({ name: namespace });
-    }
-  } catch (_error) {
-    // Fall back to in-memory store for local tests / non-Netlify runtimes
-  }
-
-  return createInMemoryStore(namespace);
-}
-
-/**
- * @typedef {{
- *   tenantId: string,
- *   db: { driver: 'neon'|'pg', connectionString: string },
- *   masterKey: string,
- *   createdAt: string,
- *   updatedAt: string
- * }} TenantConfig
- */
-
-/**
- * @param {{ namespace?: string, kek: string }} options
- */
-function createTenantBlobStore(options) {
-  const namespace = String(options.namespace).trim() || 'rei-tenants';
-  const kekBuffer = getKekBuffer(options.kek);
-
-  function getTenantKey(tenantId) {
-    return `tenant/${tenantId}`;
-  }
-
-  return {
-    async getTenantConfig(tenantId) {
-      const store = await resolveBlobStore(namespace);
-      const encrypted = await store.get(getTenantKey(tenantId), { type: 'text' });
-      if (!encrypted) return null;
-      return decryptConfig(encrypted, kekBuffer);
-    },
-
-    async setTenantConfig(config) {
-      const store = await resolveBlobStore(namespace);
-      const encrypted = encryptConfig(config, kekBuffer);
-      await store.set(getTenantKey(config.tenantId), encrypted);
-    },
-
-    async deleteTenantConfig(tenantId) {
-      const store = await resolveBlobStore(namespace);
-      await store.delete(getTenantKey(tenantId));
-    }
-  };
-}
-
-function base64UrlEncode(input) {
-  return Buffer.from(input)
-    .toString('base64')
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/g, '');
-}
-
-function base64UrlDecode(input) {
-  const normalized = input
-    .replace(/-/g, '+')
-    .replace(/_/g, '/');
-  const padLength = (4 - (normalized.length % 4)) % 4;
-  return Buffer.from(normalized + '='.repeat(padLength), 'base64');
-}
-
-function sign(input, secret) {
-  return base64UrlEncode(createHmac('sha256', secret).update(input).digest());
-}
-
-function nowEpochSeconds() {
-  return Math.floor(Date.now() / 1000);
-}
-
-/**
- * @typedef {'tenant'|'cron'} TokenType
- */
-
-/**
- * @param {{ tenantId: string, type: TokenType, expiresInSeconds?: number }} params
- * @param {string} secret
- */
-function createTenantToken(params, secret) {
-  const issuedAt = nowEpochSeconds();
-  const expiresInSeconds = Number(params.expiresInSeconds || 60 * 60 * 24 * 30);
-  const payload = {
-    tid: params.tenantId,
-    typ: params.type,
-    iat: issuedAt,
-    exp: issuedAt + expiresInSeconds,
-    v: 1
-  };
-
-  const header = { alg: 'HS256', typ: 'JWT' };
-  const encodedHeader = base64UrlEncode(JSON.stringify(header));
-  const encodedPayload = base64UrlEncode(JSON.stringify(payload));
-  const signingInput = `${encodedHeader}.${encodedPayload}`;
-  const signature = sign(signingInput, secret);
-  return `${signingInput}.${signature}`;
-}
-
-/**
- * @param {string} token
- * @param {string} secret
- * @param {{ expectedTypes?: TokenType[] }} [options]
- */
-function verifyTenantToken(token, secret, options = {}) {
-  if (!token || typeof token !== 'string') {
-    throw new Error('INVALID_TENANT_AUTH');
-  }
-
-  const parts = token.split('.');
-  if (parts.length !== 3) {
-    throw new Error('INVALID_TENANT_AUTH');
-  }
-
-  const [encodedHeader, encodedPayload, receivedSignature] = parts;
-  const signingInput = `${encodedHeader}.${encodedPayload}`;
-  const expectedSignature = sign(signingInput, secret);
-
-  // Compare raw HMAC bytes (decoded from base64url) rather than the
-  // encoded character bytes — semantically clearer and avoids the
-  // implicit-UTF-8 default of Buffer.from(string).
-  let receivedBuffer;
-  let expectedBuffer;
-  try {
-    receivedBuffer = base64UrlDecode(receivedSignature);
-    expectedBuffer = base64UrlDecode(expectedSignature);
-  } catch {
-    throw new Error('INVALID_TENANT_AUTH');
-  }
-  if (
-    receivedBuffer.length !== expectedBuffer.length ||
-    !timingSafeEqual(receivedBuffer, expectedBuffer)
-  ) {
-    throw new Error('INVALID_TENANT_AUTH');
-  }
-
-  let payload;
-  try {
-    payload = JSON.parse(base64UrlDecode(encodedPayload).toString('utf8'));
-  } catch {
-    throw new Error('INVALID_TENANT_AUTH');
-  }
-
-  if (!payload || typeof payload !== 'object' || payload.v !== 1) {
-    throw new Error('INVALID_TENANT_AUTH');
-  }
-
-  if (!payload.tid || !payload.typ || !payload.exp) {
-    throw new Error('INVALID_TENANT_AUTH');
-  }
-
-  if (payload.exp <= nowEpochSeconds()) {
-    throw new Error('INVALID_TENANT_AUTH');
-  }
-
-  const expectedTypes = options.expectedTypes || [];
-  if (expectedTypes.length > 0 && !expectedTypes.includes(payload.typ)) {
-    throw new Error('INVALID_TENANT_AUTH');
-  }
-
-  return payload;
-}
-
-/**
- * @param {Record<string, any>} headers
- * @returns {string}
- */
-function extractBearerToken(headers = {}) {
-  let authorization = '';
-  for (const [key, value] of Object.entries(headers || {})) {
-    if (String(key).toLowerCase() === 'authorization') {
-      authorization = String(value || '').trim();
-      break;
-    }
-  }
-  if (!authorization.toLowerCase().startsWith('bearer ')) {
-    return '';
-  }
-  return authorization.slice(7).trim();
-}
-
-function fingerprint(masterKey) {
-  return createHash('sha256').update(masterKey).digest('hex').slice(0, 16);
-}
-
-function sanitizeDbConfig(driver, connectionString) {
-  const normalizedDriver = String(driver || '').trim();
-  const normalizedConnectionString = String(connectionString || '').trim();
-
-  if (!['neon', 'pg'].includes(normalizedDriver)) {
-    throw new Error('INVALID_DRIVER');
-  }
-  if (!normalizedConnectionString) {
-    throw new Error('INVALID_DATABASE_URL');
-  }
-
-  return {
-    driver: normalizedDriver,
-    connectionString: normalizedConnectionString
-  };
-}
-
-function parseTokenFromUrl(url) {
-  if (!url || typeof url !== 'string') {
-    return '';
-  }
-
-  try {
-    const parsed = new URL(url, 'https://dummy.local');
-    return String(parsed.searchParams.get('token') || '').trim();
-  } catch {
-    return '';
-  }
-}
-
-/**
- * @param {{
- *   tenantStore: ReturnType<import('./blob-store.js').createTenantBlobStore>,
- *   tokenSigningKey: string,
- *   publicBaseUrl?: string
- * }} options
- */
-function createTenantContextManager(options) {
-  const tenantStore = options.tenantStore;
-  const tokenSigningKey = String(options.tokenSigningKey || '').trim();
-  const publicBaseUrl = String(options.publicBaseUrl || '').replace(/\/$/, '');
-  const adapterFactory = options.adapterFactory || createAdapter;
-  const adapterCache = new Map();
-
-  if (!tokenSigningKey) {
-    throw new Error('[rei-standard-amsg-server] tenant.tokenSigningKey is required');
-  }
-
-  async function getOrCreateAdapter(dbConfig) {
-    const cacheKey = `${dbConfig.driver}:${dbConfig.connectionString}`;
-    if (!adapterCache.has(cacheKey)) {
-      const adapter = await adapterFactory(dbConfig);
-      adapterCache.set(cacheKey, adapter);
-    }
-    return adapterCache.get(cacheKey);
-  }
-
-  async function initializeTenant({ driver, connectionString, tenantId: providedTenantId }) {
-    const dbConfig = sanitizeDbConfig(driver, connectionString);
-    const tenantId = String(providedTenantId || randomUUID()).trim();
-
-    const existing = await tenantStore.getTenantConfig(tenantId);
-    if (existing) {
-      throw new Error('TENANT_ALREADY_INITIALIZED');
-    }
-
-    const adapter = await getOrCreateAdapter(dbConfig);
-    await adapter.initSchema();
-
-    const masterKey = randomBytes(32).toString('hex');
-    const now = new Date().toISOString();
-
-    await tenantStore.setTenantConfig({
-      tenantId,
-      db: dbConfig,
-      masterKey,
-      createdAt: now,
-      updatedAt: now
-    });
-
-    const tenantToken = createTenantToken({ tenantId, type: 'tenant' }, tokenSigningKey);
-    const cronToken = createTenantToken({ tenantId, type: 'cron' }, tokenSigningKey);
-
-    return {
-      tenantId,
-      masterKeyFingerprint: fingerprint(masterKey),
-      tenantToken,
-      cronToken,
-      cronWebhookUrl: publicBaseUrl ? `${publicBaseUrl}/api/v1/send-notifications?token=${cronToken}` : ''
-    };
-  }
-
-  async function resolveTenant(headers, options = {}) {
-    const allowCronToken = options.allowCronToken === true;
-    const url = options.url || '';
-
-    const bearerToken = extractBearerToken(headers);
-    const tokenFromQuery = allowCronToken ? parseTokenFromUrl(url) : '';
-    const token = bearerToken || tokenFromQuery;
-
-    if (!token) {
-      return {
-        ok: false,
-        error: {
-          status: 401,
-          body: { success: false, error: { code: 'INVALID_TENANT_AUTH', message: '缺少租户鉴权信息' } }
-        }
-      };
-    }
-
-    let payload;
-    try {
-      payload = verifyTenantToken(token, tokenSigningKey, {
-        expectedTypes: allowCronToken ? ['cron'] : ['tenant']
-      });
-    } catch (_error) {
-      return {
-        ok: false,
-        error: {
-          status: 401,
-          body: { success: false, error: { code: 'INVALID_TENANT_AUTH', message: '租户令牌无效或已过期' } }
-        }
-      };
-    }
-
-    const tenantConfig = await tenantStore.getTenantConfig(payload.tid);
-    if (!tenantConfig) {
-      return {
-        ok: false,
-        error: {
-          status: 401,
-          body: { success: false, error: { code: 'INVALID_TENANT_AUTH', message: '租户配置不存在或已失效' } }
-        }
-      };
-    }
-
-    const adapter = await getOrCreateAdapter(tenantConfig.db);
-
-    return {
-      ok: true,
-      context: {
-        tenantId: tenantConfig.tenantId,
-        tokenType: payload.typ,
-        db: adapter,
-        masterKey: tenantConfig.masterKey
-      }
-    };
-  }
-
-  return {
-    initializeTenant,
-    resolveTenant
-  };
-}
-
-/**
- * ReiStandard Server SDK Entry Point
- * v2.0.1
- *
- * Usage:
- *   import { createReiServer } from '@rei-standard/amsg-server';
- *
- *   const rei = await createReiServer({
- *     vapid: {
- *       email: process.env.VAPID_EMAIL,
- *       publicKey: process.env.NEXT_PUBLIC_VAPID_PUBLIC_KEY,
- *       privateKey: process.env.VAPID_PRIVATE_KEY,
- *     },
- *     tenant: {
- *       blobNamespace: 'rei-tenants',
- *       kek: process.env.TENANT_CONFIG_KEK,
- *       tokenSigningKey: process.env.TENANT_TOKEN_SIGNING_KEY,
- *       initSecret: process.env.INIT_SECRET,
- *       publicBaseUrl: process.env.PUBLIC_BASE_URL
- *     }
- *   });
- */
-
-
 /**
  * @typedef {Object} VapidConfig
  * @property {string} [email]      - VAPID contact email (e.g. mailto:…).
  * @property {string} [publicKey]  - VAPID public key.
  * @property {string} [privateKey] - VAPID private key.
  */
-
 /**
  * @typedef {Object} TenantServerConfig
  * @property {string} [blobNamespace]  - Netlify Blob namespace.
@@ -710,13 +14,16 @@ function createTenantContextManager(options) {
  * @property {(db: {driver:'neon'|'pg', connectionString:string}) => Promise<any>} [adapterFactory]
  *   Optional adapter factory override (mainly for tests).
  */
-
 /**
  * @typedef {Object} ReiServerConfig
  * @property {VapidConfig} [vapid]   - VAPID keys for Web Push.
  * @property {TenantServerConfig} tenant - Tenant config & auth settings.
+ * @property {{ maxChunkBytes?: number, maxChunks?: number, maxTotalBytes?: number, ttlMs?: number }} [multipart]
+ *   分片传输的限额，跟传给 `installReiSW` 的那一份保持一致（同名同键，原样传过来
+ *   即可）。一条 push 装不下的思考过程要切片发，切多大、最多几片、重组窗口多长由
+ *   接收端说了算——发送端不知道这份配置的话，切出来的分片到了那边会被逐片拒收，
+ *   或者整批没能在重组窗口内发完，一条也拼不回来。不配 = 两边都用默认值。
  */
-
 /**
  * @typedef {Object} ReiHandlers
  * @property {{ POST: function }} initTenant
@@ -726,82 +33,140 @@ function createTenantContextManager(options) {
  * @property {{ PUT: function }} updateMessage
  * @property {{ DELETE: function }} cancelMessage
  * @property {{ GET: function }} messages
+ * @property {{ GET: function }} getMessage
+ * @property {{ PUT: function, GET: function, DELETE: function }} pushSubscription
+ * @property {{ PUT: function, GET: function, DELETE: function }} llmCredentials
  */
-
 /**
  * @typedef {Object} ReiServer
  * @property {ReiHandlers} handlers - Standard API route handler objects.
  */
-
 /**
  * Initialise the ReiStandard server.
  *
  * @param {ReiServerConfig} config
  * @returns {Promise<ReiServer>}
  */
-async function createReiServer(config) {
-  if (!config) throw new Error('[rei-standard-amsg-server] config is required');
-  if (!config.tenant) throw new Error('[rei-standard-amsg-server] tenant config is required');
-
-  // web-push is a hard dependency for ReiStandard server features
-  let webpushModule;
-  try {
-    const webpushImport = await import('web-push');
-    webpushModule = webpushImport.default || webpushImport;
-  } catch (_err) {
-    throw new Error(
-      '[rei-standard-amsg-server] web-push is required. Install it with: npm install web-push'
-    );
-  }
-
-  const vapid = config.vapid || {};
-
-  if (vapid.email && vapid.publicKey && vapid.privateKey) {
-    webpushModule.setVapidDetails(
-      normalizeVapidSubject(vapid.email),
-      vapid.publicKey,
-      vapid.privateKey
-    );
-  }
-
-  const tenantStore = createTenantBlobStore({
-    namespace: config.tenant.blobNamespace || 'rei-tenants',
-    kek: config.tenant.kek
-  });
-
-  const tenantManager = createTenantContextManager({
-    tenantStore,
-    tokenSigningKey: config.tenant.tokenSigningKey,
-    publicBaseUrl: config.tenant.publicBaseUrl,
-    adapterFactory: config.tenant.adapterFactory
-  });
-
-  const initSecret = String(config.tenant.initSecret || '').trim();
-
-  const ctx = {
-    vapid: {
-      email: vapid.email || '',
-      publicKey: vapid.publicKey || '',
-      privateKey: vapid.privateKey || ''
-    },
-    webpush: webpushModule,
-    tenant: {
-      initSecret
-    },
-    tenantManager
-  };
-
-  return {
-    handlers: {
-      initTenant: createInitTenantHandler(ctx),
-      getUserKey: createGetUserKeyHandler(ctx),
-      scheduleMessage: createScheduleMessageHandler(ctx),
-      sendNotifications: createSendNotificationsHandler(ctx),
-      updateMessage: createUpdateMessageHandler(ctx),
-      cancelMessage: createCancelMessageHandler(ctx),
-      messages: createMessagesHandler(ctx)
-    }
-  };
-}
-
-export { createAdapter, createReiServer, createTenantToken, isValidUUIDv4, runScheduledTick, verifyTenantToken };
+export function createReiServer(config: ReiServerConfig): Promise<ReiServer>;
+export { createAdapter } from "./adapters/factory.js";
+export { createD1Adapter } from "./adapters/d1.js";
+export { createSingleUserServer } from "./single-user.js";
+export type VapidConfig = {
+    /**
+     * - VAPID contact email (e.g. mailto:…).
+     */
+    email?: string;
+    /**
+     * - VAPID public key.
+     */
+    publicKey?: string;
+    /**
+     * - VAPID private key.
+     */
+    privateKey?: string;
+};
+export type TenantServerConfig = {
+    /**
+     * - Netlify Blob namespace.
+     */
+    blobNamespace?: string;
+    /**
+     * - KEK used to encrypt tenant config in blobs.
+     */
+    kek: string;
+    /**
+     * - HMAC key used to sign tenant/cron tokens.
+     */
+    tokenSigningKey: string;
+    /**
+     * - Optional secret for /init-tenant bootstrap endpoint.
+     */
+    initSecret?: string;
+    /**
+     * - Optional base URL for generated cron webhook.
+     */
+    publicBaseUrl?: string;
+    /**
+     * Optional adapter factory override (mainly for tests).
+     */
+    adapterFactory?: (db: {
+        driver: "neon" | "pg";
+        connectionString: string;
+    }) => Promise<any>;
+};
+export type ReiServerConfig = {
+    /**
+     * - VAPID keys for Web Push.
+     */
+    vapid?: VapidConfig;
+    /**
+     * - Tenant config & auth settings.
+     */
+    tenant: TenantServerConfig;
+    /**
+     * 分片传输的限额，跟传给 `installReiSW` 的那一份保持一致（同名同键，原样传过来
+     * 即可）。一条 push 装不下的思考过程要切片发，切多大、最多几片、重组窗口多长由
+     * 接收端说了算——发送端不知道这份配置的话，切出来的分片到了那边会被逐片拒收，
+     * 或者整批没能在重组窗口内发完，一条也拼不回来。不配 = 两边都用默认值。
+     */
+    multipart?: {
+        maxChunkBytes?: number;
+        maxChunks?: number;
+        maxTotalBytes?: number;
+        ttlMs?: number;
+    };
+};
+export type ReiHandlers = {
+    initTenant: {
+        POST: Function;
+    };
+    getUserKey: {
+        GET: Function;
+    };
+    scheduleMessage: {
+        POST: Function;
+    };
+    sendNotifications: {
+        POST: Function;
+    };
+    updateMessage: {
+        PUT: Function;
+    };
+    cancelMessage: {
+        DELETE: Function;
+    };
+    messages: {
+        GET: Function;
+    };
+    getMessage: {
+        GET: Function;
+    };
+    pushSubscription: {
+        PUT: Function;
+        GET: Function;
+        DELETE: Function;
+    };
+    llmCredentials: {
+        PUT: Function;
+        GET: Function;
+        DELETE: Function;
+    };
+};
+export type ReiServer = {
+    /**
+     * - Standard API route handler objects.
+     */
+    handlers: ReiHandlers;
+};
+export { runScheduledTick, runTask, DEFAULT_CLAIM_LEASE_MS, DEFAULT_LEASE_HEARTBEAT_MS, DEFAULT_HEARTBEAT_LEASE_TTL_MS, sanitizeErrorSummary } from "./lib/run-tick.js";
+export { NonRetryableError, DeploymentConfigError, isNonRetryableError, summarizeErrorCause } from "./lib/errors.js";
+export { getSchemaVersion, ensureSchema, SCHEMA_VERSION } from "./lib/schema-version.js";
+export { DEFAULT_MAX_TOOL_ITERATIONS, DEFAULT_TOTAL_TIMEOUT_MS, DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE, MIN_SCHEDULE_LEAD_MS } from "./lib/agentic-fire.js";
+export { CORS_ALLOW_HEADERS, CORS_ALLOW_METHODS, createSingleUserCloudflareWorker } from "./cloudflare/single-user-worker.js";
+export { createWebCryptoWebPush, measurePushPayload, MAX_PUSH_PAYLOAD_BYTES, PUSH_ENVELOPE_RESERVED_BYTES, WEB_PUSH_MAX_BODY_BYTES, WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES } from "./lib/webpush-webcrypto.js";
+export { deriveUserEncryptionKey, decryptPayload, encryptForStorage, decryptFromStorage } from "./lib/encryption.js";
+export { validateScheduleMessagePayload, validateLlmMessagesArray, validateSplitPattern, validateAvatarUrl, isValidISO8601, isValidUrl, isValidUUID, isValidUUIDv4, isValidTimeZoneId, MAX_TASK_PAYLOAD_BYTES } from "./lib/validation.js";
+export { readRequestBody, DEFAULT_MAX_REQUEST_BODY_BYTES } from "./lib/request.js";
+export { supportsLlmCredentialsStore, isValidCredId, validateCredRefs, validateCredValue, hasChatCredRef, resolveLlmCredential, CRED_ID_MAX_LENGTH, CRED_PUT_BATCH_MAX, CRED_ROWS_PER_USER_MAX, CRED_REFS_MAX_ENTRIES } from "./lib/llm-credentials-store.js";
+export { advanceOccurrence, nextFutureOccurrence, planNextOccurrence } from "./lib/recurrence.js";
+export { createTenantToken, verifyTenantToken } from "./tenant/token.js";