@rei-standard/amsg-server 2.6.0-next.2 → 2.6.0-next.21

package/dist/lib/validation.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Validate ISO 8601 date string.
+ * @param {string} dateString
+ * @returns {boolean}
+ */
+export function isValidISO8601(dateString: string): boolean;
+/**
+ * Validate UUID format.
+ * @param {string} uuid
+ * @returns {boolean}
+ */
+export function isValidUUID(uuid: string): boolean;
+/**
+ * Validate UUID v4 format.
+ * @param {string} uuid
+ * @returns {boolean}
+ */
+export function isValidUUIDv4(uuid: string): boolean;
+/**
+ * Validate the optional `splitPattern` field (amsg-server scheduled tasks
+ * only; amsg-instant 0.8.0 dropped its request-level `splitPattern`).
+ * Accepts `string`, `string[]`, or absent/null. Returns an error message
+ * string, or null when valid.
+ *
+ * Limits (per-item length ≤ 200, array ≤ 10 items, must compile via
+ * `new RegExp(item)`) are an **input-size guard**, NOT a ReDoS defense —
+ * a 6-character pattern like `(a+)+$` is enough to trigger catastrophic
+ * backtracking. The real backstop is Worker / runtime CPU limits + the
+ * fact that splitPattern is stored under the user's own encrypted task
+ * and matched against output from the user's own LLM API key, so the
+ * blast radius is self-inflicted only (no cross-tenant attack surface).
+ *
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+export function validateSplitPattern(value: unknown): string | null;
+/**
+ * Validate an OpenAI-style messages array. 形状规则统一在
+ * `@rei-standard/amsg-shared` 的 `validateLlmMessagesShape`（amsg-instant
+ * 的 `validateMessagesArray` 走同一实现，两包接受的形状不会漂移）——
+ * 因此 agentic 会话回放（assistant 带 `tool_calls` 时 content 可空、
+ * `role:'tool'` 消息要求 `tool_call_id`）在这里同样合法。本函数只把
+ * 结构化错误码映射成本包既有的英文错误文案，返回形状不变。
+ *
+ * @param {unknown} messages
+ * @returns {string | null}   Error message, or null if valid.
+ */
+export function validateLlmMessagesArray(messages: unknown): string | null;
+/**
+ * 落库前量一次任务正文。合法返回 null，超限返回可以直接放进 400 响应体的
+ * error 对象——`POST /schedule-message` 与 `PUT /update-message` 共用同一个错
+ * 误码和同一套 details，下游判断读 `details.bytes` / `details.maxBytes`，不用
+ * 去解析那句人话。
+ *
+ * 按 UTF-8 字节算而不是字符数：D1 限的是字节，加密前也是先转 UTF-8，一段全中
+ * 文的正文字符数只有字节数的三分之一，用 `.length` 量等于把上限放大三倍。
+ *
+ * @param {string} serializedPayload - 将要交给 encryptForStorage 的那个字符串。
+ * @returns {{ code: string, message: string, details: { bytes: number, maxBytes: number } } | null}
+ */
+export function validateTaskPayloadSize(serializedPayload: string): {
+    code: string;
+    message: string;
+    details: {
+        bytes: number;
+        maxBytes: number;
+    };
+} | null;
+/**
+ * 任务正文的 UTF-8 字节数（与 {@link validateTaskPayloadSize} 同一把尺子）。
+ *
+ * `PUT /update-message` 拿它跟改动前的正文比大小：上限是后加的，比它更早建出来
+ * 的大任务不该因此连排期都改不了，只要这次改动没把它变得更大就放行。
+ *
+ * @param {string} serializedPayload
+ * @returns {number}
+ */
+export function taskPayloadByteLength(serializedPayload: string): number;
+/**
+ * Validate the schedule-message request payload.
+ *
+ * @param {Object} payload
+ * @returns {{ valid: boolean, errorCode?: string, errorMessage?: string, details?: Object }}
+ */
+export function validateScheduleMessagePayload(payload: any): {
+    valid: boolean;
+    errorCode?: string;
+    errorMessage?: string;
+    details?: any;
+};
+/**
+ * 一条任务正文（`JSON.stringify` 的结果）的明文上限，UTF-8 字节数。
+ * 客户端想在提交前自己预算就读这个数（从 `@rei-standard/amsg-server` 导出）。
+ */
+export const MAX_TASK_PAYLOAD_BYTES: number;
+import { isValidTimeZoneId } from './recurrence.js';
+export { isValidTimeZoneId, isValidUrl, validateAvatarUrl };

package/dist/lib/version.d.ts

@@ -0,0 +1,7 @@
+/**
+ * 构建期注入的包版本。tsup 用 define 把 __AMSG_SERVER_VERSION__ 替换成
+ * package.json 的 version（见 tsup.config.js），发布产物里是真实版本号；
+ * 直接跑 src（node --test / 本地调试）没有这个替换，typeof 守卫落到
+ * '0.0.0-dev'。
+ */
+export const SERVER_VERSION: any;

package/dist/lib/webcrypto-utils.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/webpush-webcrypto.d.ts

@@ -0,0 +1,78 @@
+/**
+ * 组 payload 前做预算用：先量骨架有多大，剩下多少字节才是能塞附加数据的额度。
+ *
+ * @example
+ * // hook 里组 push：把库要补的信封字段先扣掉
+ * const { remainingBytes } = measurePushPayload(
+ *   JSON.stringify({ ...basePush, message: '' }),
+ *   { reserveEnvelope: true }
+ * );
+ * const excerpt = remainingBytes > 0 ? text.slice(0, remainingBytes) : '';
+ *
+ * @param {string} payload - 待发送的 payload 字符串（通常是 JSON.stringify 的结果）。
+ * @param {{ reserveEnvelope?: boolean }} [options]
+ *   `reserveEnvelope: true` → 额度里扣掉 {@link PUSH_ENVELOPE_RESERVED_BYTES}，
+ *   也就是「库补完字段之后还装得下」的口径。fire-time hook 组 payload 时用这个。
+ *   默认 false = 量这个字符串本身对上限的占用。
+ * @returns {{ bytes: number, maxBytes: number, remainingBytes: number, withinLimit: boolean, envelopeReservedBytes: number }}
+ *   `bytes` 是 payload 的 UTF-8 字节数；`maxBytes` 是本次口径下的上限；
+ *   `remainingBytes` 是还能加多少字节（已超限时为负）；`withinLimit` 为 false
+ *   时（不留信封的口径下）sendWebPush 会抛 `PUSH_PAYLOAD_TOO_LARGE`。
+ */
+export function measurePushPayload(payload: string, options?: {
+    reserveEnvelope?: boolean;
+}): {
+    bytes: number;
+    maxBytes: number;
+    remainingBytes: number;
+    withinLimit: boolean;
+    envelopeReservedBytes: number;
+};
+/**
+ * Send a single Web Push notification. 委托 shared 的 `sendWebPush`（参数、
+ * 返回值与之完全一致），只在加密前多做一步 payload 大小护栏——超限的
+ * payload 发出去只会被推送服务 413 掉，用户什么也收不到。加密之前就拦下
+ * 来，让调用方拿到一个说得清的错误（宿主可以退回一条短消息 + 引用键）。
+ *
+ * @param {Object} args - 同 shared `sendWebPush`：{ subscription, payload, vapid, ttl, fetch }。
+ * @returns {Promise<{ statusCode: number, body: string, headers: Headers }>}
+ * @throws  {Error}  err.code = 'PUSH_PAYLOAD_TOO_LARGE' when the payload
+ *                   exceeds MAX_PUSH_PAYLOAD_BYTES (nothing is sent);
+ *                   err.code = 'PUSH_SEND_FAILED' on push-service error.
+ */
+export function sendWebPush(args: any): Promise<{
+    statusCode: number;
+    body: string;
+    headers: Headers;
+}>;
+/**
+ * web-push-compatible sender backed by the shared Web Crypto implementation.
+ * message-processor calls `ctx.webpush.sendNotification(subscription, payloadString)`,
+ * so we only need that one method. VAPID keys are baked in at construction.
+ *
+ * @param {{ email: string, publicKey: string, privateKey: string }} [vapid]
+ * @param {{ ttl?: number }} [options] - Push TTL in seconds; defaults to 4 weeks
+ *   (matches the web-push backend) so scheduled pushes outlive an offline device.
+ * @returns {{ sendNotification: (subscription: Object, payload: string) => Promise<any> }}
+ */
+export function createWebCryptoWebPush(vapid?: {
+    email: string;
+    publicKey: string;
+    privateKey: string;
+}, { ttl }?: {
+    ttl?: number;
+}): {
+    sendNotification: (subscription: any, payload: string) => Promise<any>;
+};
+/** 推送服务对加密后 body 的上限（字节）。 */
+export const WEB_PUSH_MAX_BODY_BYTES: 4096;
+/** aes128gcm 固定开销：header 86 + 填充分隔符 1 + GCM tag 16。 */
+export const WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES: number;
+/** 一条 push 的明文（JSON 字符串）上限，UTF-8 字节数。 */
+export const MAX_PUSH_PAYLOAD_BYTES: number;
+/**
+ * 库在 hook 交还 payload 之后还要补的那批字段占的字节数上界。
+ * 组 payload 时按 `MAX_PUSH_PAYLOAD_BYTES - PUSH_ENVELOPE_RESERVED_BYTES`
+ * 预算，或者直接用 `measurePushPayload(s, { reserveEnvelope: true })`。
+ */
+export const PUSH_ENVELOPE_RESERVED_BYTES: 384;

package/dist/{neon-BFUS25UX.cjs → neon-KP2CPA57.cjs}

@@ -3,7 +3,25 @@
 
 
 
-var _chunkRGECD4OHcjs = require('./chunk-RGECD4OH.cjs');
+
+
+
+
+
+
+var _chunkE7OWP3VLcjs = require('./chunk-E7OWP3VL.cjs');
+
+
+
+
+
+
+
+
+
+
+
+var _chunk7NMQFTDJcjs = require('./chunk-7NMQFTDJ.cjs');
 
 // src/server/adapters/neon.js
 var _serverless = require('@neondatabase/serverless');
@@ -13,7 +31,13 @@ var NeonAdapter = class {
     this._connectionString = connectionString;
     this._sql = null;
   }
-  /** @private */
+  /**
+   * neon() 的 HTTP 驱动：一次查询一个 fetch，两次查询之间不留连接。所以它没有
+   * pg 那种「空闲连接被服务端掐断」的问题——连接层面的错误只会让当次调用的
+   * Promise 失败，落在调用方的 try/catch 里，不会变成进程级未捕获异常。
+   *
+   * @private
+   */
   _getSql() {
     if (!this._sql) {
       this._sql = _serverless.neon.call(void 0, this._connectionString);
@@ -22,9 +46,14 @@ var NeonAdapter = class {
   }
   async initSchema() {
     const sql = this._getSql();
-    await sql.query(_chunkRGECD4OHcjs.TABLE_SQL);
+    await sql.query(_chunk7NMQFTDJcjs.TABLE_SQL);
+    await sql.query(_chunk7NMQFTDJcjs.PUSH_SUBSCRIPTION_TABLE_SQL);
+    await sql.query(_chunk7NMQFTDJcjs.LLM_CREDENTIALS_TABLE_SQL);
+    for (const migration of _chunk7NMQFTDJcjs.MIGRATIONS) {
+      await sql.query(migration.sql);
+    }
     const indexResults = [];
-    for (const index of _chunkRGECD4OHcjs.INDEXES) {
+    for (const index of _chunk7NMQFTDJcjs.INDEXES) {
       try {
         await sql.query(index.sql);
         indexResults.push({
@@ -50,11 +79,11 @@ var NeonAdapter = class {
         `Critical index creation failed (${failedNames}). Please remove duplicate UUID rows and run initSchema again.`
       );
     }
-    const tableCheck = await sql.query(_chunkRGECD4OHcjs.VERIFY_TABLE_SQL);
+    const tableCheck = await sql.query(_chunk7NMQFTDJcjs.VERIFY_TABLE_SQL);
     if (tableCheck.length === 0) {
       throw new Error("Table creation verification failed");
     }
-    const columns = await sql.query(_chunkRGECD4OHcjs.COLUMNS_SQL);
+    const columns = await sql.query(_chunk7NMQFTDJcjs.COLUMNS_SQL);
     return {
       columnsCreated: columns.length,
       indexesCreated: indexResults.filter((r) => r.status === "success").length,
@@ -68,6 +97,8 @@ var NeonAdapter = class {
   async dropSchema() {
     const sql = this._getSql();
     await sql.query("DROP TABLE IF EXISTS scheduled_messages CASCADE");
+    await sql.query("DROP TABLE IF EXISTS push_subscriptions CASCADE");
+    await sql.query("DROP TABLE IF EXISTS llm_credentials CASCADE");
   }
   async createTask(params) {
     const sql = this._getSql();
@@ -83,7 +114,7 @@ var NeonAdapter = class {
   async getTaskByUuid(uuid, userId) {
     const sql = this._getSql();
     const rows = await sql.query(
-      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
+      `SELECT ${_chunk7NMQFTDJcjs.TASK_DETAIL_COLUMNS}
        FROM scheduled_messages
        WHERE uuid = $1 AND user_id = $2 AND status = 'pending'
        LIMIT 1`,
@@ -94,7 +125,7 @@ var NeonAdapter = class {
   async getTaskByUuidOnly(uuid) {
     const sql = this._getSql();
     const rows = await sql.query(
-      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
+      `SELECT ${_chunk7NMQFTDJcjs.TASK_DELIVERY_COLUMNS}
        FROM scheduled_messages
        WHERE uuid = $1 AND status = 'pending'
        LIMIT 1`,
@@ -102,12 +133,30 @@ var NeonAdapter = class {
     );
     return rows[0] || null;
   }
+  /**
+   * 这条 uuid 现在是什么状态——不限用户，也不限状态（上面那个只看 pending
+   * 行）。`runTask` 用它把「这条已经跑完了」和「压根没这条」分开回报。
+   *
+   * @param {string} uuid
+   * @returns {Promise<{ status: string }|null>}
+   */
+  async getTaskStatusByUuidOnly(uuid) {
+    const sql = this._getSql();
+    const rows = await sql.query(
+      `SELECT status FROM scheduled_messages WHERE uuid = $1 LIMIT 1`,
+      [uuid]
+    );
+    return rows[0] ? { status: rows[0].status } : null;
+  }
   async updateTaskById(taskId, updates) {
     const sql = this._getSql();
     const sets = [];
     const values = [];
     let idx = 1;
     for (const [key, value] of Object.entries(updates)) {
+      if (!_chunk7NMQFTDJcjs.UPDATABLE_COLUMNS.has(key)) {
+        throw new Error(`[amsg-server neon] rejected unknown update column: ${key}`);
+      }
       sets.push(`${key} = $${idx}`);
       values.push(value);
       idx++;
@@ -127,6 +176,9 @@ var NeonAdapter = class {
     let idx = 2;
     if (extraFields) {
       for (const [key, value] of Object.entries(extraFields)) {
+        if (!_chunk7NMQFTDJcjs.UPDATABLE_COLUMNS.has(key)) {
+          throw new Error(`[amsg-server neon] rejected unknown update column: ${key}`);
+        }
         sets.push(`${key} = $${idx}`);
         values.push(value);
         idx++;
@@ -157,14 +209,27 @@ var NeonAdapter = class {
   async getPendingTasks(limit = 50) {
     const sql = this._getSql();
     return sql.query(
-      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
+      `SELECT ${_chunk7NMQFTDJcjs.TASK_DELIVERY_COLUMNS}
        FROM scheduled_messages
        WHERE status = 'pending' AND next_send_at <= NOW()
+         AND (lease_until IS NULL OR lease_until <= NOW())
+         AND (retry_after IS NULL OR retry_after <= NOW())
        ORDER BY next_send_at ASC
        LIMIT $1`,
       [limit]
     );
   }
+  // 领取一条到点的任务。SQL 与并发语义在 pg-shared.js（pg / neon 共用一份，
+  // 语义说明也在那里）。
+  async claimTask(taskId, expectedNextSendAt, leaseUntil, serializeGroup = null) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.claimTask.call(void 0, (text, params) => sql.query(text, params), taskId, expectedNextSendAt, leaseUntil, serializeGroup);
+  }
+  // 投递期间的租约续期（run-tick 心跳；语义见 pg-shared.js）。
+  async renewTaskLease(taskId, leaseUntil) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.renewTaskLease.call(void 0, (text, params) => sql.query(text, params), taskId, leaseUntil);
+  }
   async listTasks(userId, opts = {}) {
     const sql = this._getSql();
     const { status = "all", limit = 20, offset = 0 } = opts;
@@ -184,7 +249,7 @@ var NeonAdapter = class {
     const total = parseInt(countRows[0].count, 10);
     const taskParams = [...params, limit, offset];
     const tasks = await sql.query(
-      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count, created_at, updated_at
+      `SELECT ${_chunk7NMQFTDJcjs.TASK_DETAIL_COLUMNS}
        FROM scheduled_messages
        WHERE ${where}
        ORDER BY next_send_at ASC
@@ -213,6 +278,41 @@ var NeonAdapter = class {
     );
     return rows.length > 0 ? rows[0].status : null;
   }
+  // 状态 + 失败摘要（GET /message 对已失败的行透出原因；语义见 pg-shared.js）。
+  async getTaskStatusInfo(uuid, userId) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.getTaskStatusInfo.call(void 0, (text, params) => sql.query(text, params), uuid, userId);
+  }
+  // ── push_subscriptions（实现见 pg-shared.js，pg / neon 共用一份）─────────
+  async getPushSubscription(userId) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.getPushSubscription.call(void 0, (text, params) => sql.query(text, params), userId);
+  }
+  async upsertPushSubscription(userId, encryptedSubscription, updatedAt) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.upsertPushSubscription.call(void 0, (text, params) => sql.query(text, params), userId, encryptedSubscription, updatedAt);
+  }
+  async deletePushSubscription(userId) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.deletePushSubscription.call(void 0, (text, params) => sql.query(text, params), userId);
+  }
+  // ── llm_credentials（实现见 pg-shared.js，pg / neon 共用一份）───────────
+  async upsertLlmCredentials(userId, entries) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.upsertLlmCredentials.call(void 0, (text, params) => sql.query(text, params), userId, entries, (/* @__PURE__ */ new Date()).toISOString());
+  }
+  async getLlmCredentials(userId, credIds) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.getLlmCredentials.call(void 0, (text, params) => sql.query(text, params), userId, credIds);
+  }
+  async listLlmCredentials(userId) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.listLlmCredentials.call(void 0, (text, params) => sql.query(text, params), userId);
+  }
+  async deleteLlmCredentials(userId, credIds = null) {
+    const sql = this._getSql();
+    return _chunkE7OWP3VLcjs.deleteLlmCredentials.call(void 0, (text, params) => sql.query(text, params), userId, credIds);
+  }
 };
 
 

package/dist/{neon-CU5N3CSW.mjs → neon-ZIMHALYI.mjs}

@@ -1,9 +1,27 @@
+import {
+  claimTask,
+  deleteLlmCredentials,
+  deletePushSubscription,
+  getLlmCredentials,
+  getPushSubscription,
+  getTaskStatusInfo,
+  listLlmCredentials,
+  renewTaskLease,
+  upsertLlmCredentials,
+  upsertPushSubscription
+} from "./chunk-ZGGF4GMA.mjs";
 import {
   COLUMNS_SQL,
   INDEXES,
+  LLM_CREDENTIALS_TABLE_SQL,
+  MIGRATIONS,
+  PUSH_SUBSCRIPTION_TABLE_SQL,
   TABLE_SQL,
+  TASK_DELIVERY_COLUMNS,
+  TASK_DETAIL_COLUMNS,
+  UPDATABLE_COLUMNS,
   VERIFY_TABLE_SQL
-} from "./chunk-5ENJGVZX.mjs";
+} from "./chunk-GN44PST5.mjs";
 
 // src/server/adapters/neon.js
 import { neon } from "@neondatabase/serverless";
@@ -13,7 +31,13 @@ var NeonAdapter = class {
     this._connectionString = connectionString;
     this._sql = null;
   }
-  /** @private */
+  /**
+   * neon() 的 HTTP 驱动：一次查询一个 fetch，两次查询之间不留连接。所以它没有
+   * pg 那种「空闲连接被服务端掐断」的问题——连接层面的错误只会让当次调用的
+   * Promise 失败，落在调用方的 try/catch 里，不会变成进程级未捕获异常。
+   *
+   * @private
+   */
   _getSql() {
     if (!this._sql) {
       this._sql = neon(this._connectionString);
@@ -23,6 +47,11 @@ var NeonAdapter = class {
   async initSchema() {
     const sql = this._getSql();
     await sql.query(TABLE_SQL);
+    await sql.query(PUSH_SUBSCRIPTION_TABLE_SQL);
+    await sql.query(LLM_CREDENTIALS_TABLE_SQL);
+    for (const migration of MIGRATIONS) {
+      await sql.query(migration.sql);
+    }
     const indexResults = [];
     for (const index of INDEXES) {
       try {
@@ -68,6 +97,8 @@ var NeonAdapter = class {
   async dropSchema() {
     const sql = this._getSql();
     await sql.query("DROP TABLE IF EXISTS scheduled_messages CASCADE");
+    await sql.query("DROP TABLE IF EXISTS push_subscriptions CASCADE");
+    await sql.query("DROP TABLE IF EXISTS llm_credentials CASCADE");
   }
   async createTask(params) {
     const sql = this._getSql();
@@ -83,7 +114,7 @@ var NeonAdapter = class {
   async getTaskByUuid(uuid, userId) {
     const sql = this._getSql();
     const rows = await sql.query(
-      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
+      `SELECT ${TASK_DETAIL_COLUMNS}
        FROM scheduled_messages
        WHERE uuid = $1 AND user_id = $2 AND status = 'pending'
        LIMIT 1`,
@@ -94,7 +125,7 @@ var NeonAdapter = class {
   async getTaskByUuidOnly(uuid) {
     const sql = this._getSql();
     const rows = await sql.query(
-      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
+      `SELECT ${TASK_DELIVERY_COLUMNS}
        FROM scheduled_messages
        WHERE uuid = $1 AND status = 'pending'
        LIMIT 1`,
@@ -102,12 +133,30 @@ var NeonAdapter = class {
     );
     return rows[0] || null;
   }
+  /**
+   * 这条 uuid 现在是什么状态——不限用户，也不限状态（上面那个只看 pending
+   * 行）。`runTask` 用它把「这条已经跑完了」和「压根没这条」分开回报。
+   *
+   * @param {string} uuid
+   * @returns {Promise<{ status: string }|null>}
+   */
+  async getTaskStatusByUuidOnly(uuid) {
+    const sql = this._getSql();
+    const rows = await sql.query(
+      `SELECT status FROM scheduled_messages WHERE uuid = $1 LIMIT 1`,
+      [uuid]
+    );
+    return rows[0] ? { status: rows[0].status } : null;
+  }
   async updateTaskById(taskId, updates) {
     const sql = this._getSql();
     const sets = [];
     const values = [];
     let idx = 1;
     for (const [key, value] of Object.entries(updates)) {
+      if (!UPDATABLE_COLUMNS.has(key)) {
+        throw new Error(`[amsg-server neon] rejected unknown update column: ${key}`);
+      }
       sets.push(`${key} = $${idx}`);
       values.push(value);
       idx++;
@@ -127,6 +176,9 @@ var NeonAdapter = class {
     let idx = 2;
     if (extraFields) {
       for (const [key, value] of Object.entries(extraFields)) {
+        if (!UPDATABLE_COLUMNS.has(key)) {
+          throw new Error(`[amsg-server neon] rejected unknown update column: ${key}`);
+        }
         sets.push(`${key} = $${idx}`);
         values.push(value);
         idx++;
@@ -157,14 +209,27 @@ var NeonAdapter = class {
   async getPendingTasks(limit = 50) {
     const sql = this._getSql();
     return sql.query(
-      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count
+      `SELECT ${TASK_DELIVERY_COLUMNS}
        FROM scheduled_messages
        WHERE status = 'pending' AND next_send_at <= NOW()
+         AND (lease_until IS NULL OR lease_until <= NOW())
+         AND (retry_after IS NULL OR retry_after <= NOW())
        ORDER BY next_send_at ASC
        LIMIT $1`,
       [limit]
     );
   }
+  // 领取一条到点的任务。SQL 与并发语义在 pg-shared.js（pg / neon 共用一份，
+  // 语义说明也在那里）。
+  async claimTask(taskId, expectedNextSendAt, leaseUntil, serializeGroup = null) {
+    const sql = this._getSql();
+    return claimTask((text, params) => sql.query(text, params), taskId, expectedNextSendAt, leaseUntil, serializeGroup);
+  }
+  // 投递期间的租约续期（run-tick 心跳；语义见 pg-shared.js）。
+  async renewTaskLease(taskId, leaseUntil) {
+    const sql = this._getSql();
+    return renewTaskLease((text, params) => sql.query(text, params), taskId, leaseUntil);
+  }
   async listTasks(userId, opts = {}) {
     const sql = this._getSql();
     const { status = "all", limit = 20, offset = 0 } = opts;
@@ -184,7 +249,7 @@ var NeonAdapter = class {
     const total = parseInt(countRows[0].count, 10);
     const taskParams = [...params, limit, offset];
     const tasks = await sql.query(
-      `SELECT id, user_id, uuid, encrypted_payload, message_type, next_send_at, status, retry_count, created_at, updated_at
+      `SELECT ${TASK_DETAIL_COLUMNS}
        FROM scheduled_messages
        WHERE ${where}
        ORDER BY next_send_at ASC
@@ -213,6 +278,41 @@ var NeonAdapter = class {
     );
     return rows.length > 0 ? rows[0].status : null;
   }
+  // 状态 + 失败摘要（GET /message 对已失败的行透出原因；语义见 pg-shared.js）。
+  async getTaskStatusInfo(uuid, userId) {
+    const sql = this._getSql();
+    return getTaskStatusInfo((text, params) => sql.query(text, params), uuid, userId);
+  }
+  // ── push_subscriptions（实现见 pg-shared.js，pg / neon 共用一份）─────────
+  async getPushSubscription(userId) {
+    const sql = this._getSql();
+    return getPushSubscription((text, params) => sql.query(text, params), userId);
+  }
+  async upsertPushSubscription(userId, encryptedSubscription, updatedAt) {
+    const sql = this._getSql();
+    return upsertPushSubscription((text, params) => sql.query(text, params), userId, encryptedSubscription, updatedAt);
+  }
+  async deletePushSubscription(userId) {
+    const sql = this._getSql();
+    return deletePushSubscription((text, params) => sql.query(text, params), userId);
+  }
+  // ── llm_credentials（实现见 pg-shared.js，pg / neon 共用一份）───────────
+  async upsertLlmCredentials(userId, entries) {
+    const sql = this._getSql();
+    return upsertLlmCredentials((text, params) => sql.query(text, params), userId, entries, (/* @__PURE__ */ new Date()).toISOString());
+  }
+  async getLlmCredentials(userId, credIds) {
+    const sql = this._getSql();
+    return getLlmCredentials((text, params) => sql.query(text, params), userId, credIds);
+  }
+  async listLlmCredentials(userId) {
+    const sql = this._getSql();
+    return listLlmCredentials((text, params) => sql.query(text, params), userId);
+  }
+  async deleteLlmCredentials(userId, credIds = null) {
+    const sql = this._getSql();
+    return deleteLlmCredentials((text, params) => sql.query(text, params), userId, credIds);
+  }
 };
 export {
   NeonAdapter