@rei-standard/amsg-server 2.6.0-next.2 → 2.6.0-next.21

package/dist/chunk-ZGGF4GMA.mjs

@@ -0,0 +1,135 @@
+// src/server/adapters/pg-shared.js
+async function claimTask(query, taskId, expectedNextSendAt, leaseUntil, serializeGroup = null) {
+  const grouped = typeof serializeGroup === "string" && serializeGroup.length > 0;
+  const params = [leaseUntil, taskId, expectedNextSendAt];
+  let setClause = "lease_until = $1, updated_at = NOW()";
+  let groupGuard = "";
+  if (grouped) {
+    params.push(serializeGroup);
+    setClause = "lease_until = $1, serialize_group = $4, updated_at = NOW()";
+    groupGuard = `
+        AND NOT EXISTS (
+          SELECT 1 FROM scheduled_messages busy
+           WHERE busy.serialize_group = $4 AND busy.id <> $2
+             AND busy.status = 'pending' AND busy.lease_until > NOW()
+        )`;
+  }
+  const rows = await query(
+    `UPDATE scheduled_messages
+        SET ${setClause}
+      WHERE id = $2 AND status = 'pending'
+        AND date_trunc('milliseconds', next_send_at)
+          = date_trunc('milliseconds', $3::timestamptz)
+        AND (lease_until IS NULL OR lease_until <= NOW())${groupGuard}
+     RETURNING id`,
+    params
+  );
+  if (rows.length === 0) return false;
+  if (!grouped) return true;
+  const conflict = await query(
+    `SELECT 1 FROM scheduled_messages busy
+      WHERE busy.serialize_group = $1 AND busy.id <> $2
+        AND busy.status = 'pending' AND busy.lease_until > NOW()
+      LIMIT 1`,
+    [serializeGroup, taskId]
+  );
+  if (conflict.length === 0) return true;
+  await query(
+    "UPDATE scheduled_messages SET lease_until = NULL, updated_at = NOW() WHERE id = $1",
+    [taskId]
+  );
+  return false;
+}
+async function renewTaskLease(query, taskId, leaseUntil) {
+  const rows = await query(
+    `UPDATE scheduled_messages SET lease_until = $1
+      WHERE id = $2 AND status = 'pending' AND lease_until IS NOT NULL
+     RETURNING id`,
+    [leaseUntil, taskId]
+  );
+  return rows.length > 0;
+}
+async function getTaskStatusInfo(query, uuid, userId) {
+  const rows = await query(
+    "SELECT status, last_error FROM scheduled_messages WHERE uuid = $1 AND user_id = $2 LIMIT 1",
+    [uuid, userId]
+  );
+  if (rows.length === 0) return null;
+  return { status: rows[0].status, last_error: rows[0].last_error ?? null };
+}
+async function getPushSubscription(query, userId) {
+  const rows = await query(
+    "SELECT subscription, updated_at FROM push_subscriptions WHERE user_id = $1 LIMIT 1",
+    [userId]
+  );
+  if (rows.length === 0) return null;
+  return { subscription: rows[0].subscription, updated_at: Number(rows[0].updated_at) };
+}
+async function upsertPushSubscription(query, userId, encryptedSubscription, updatedAt) {
+  const rows = await query(
+    `INSERT INTO push_subscriptions (user_id, subscription, updated_at)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (user_id) DO UPDATE SET
+       subscription = EXCLUDED.subscription,
+       updated_at = EXCLUDED.updated_at
+     RETURNING user_id`,
+    [userId, encryptedSubscription, updatedAt]
+  );
+  return rows.length > 0;
+}
+async function deletePushSubscription(query, userId) {
+  const rows = await query(
+    "DELETE FROM push_subscriptions WHERE user_id = $1 RETURNING user_id",
+    [userId]
+  );
+  return rows.length > 0;
+}
+async function upsertLlmCredentials(query, userId, entries, now) {
+  let upserted = 0;
+  for (const entry of entries) {
+    const rows = await query(
+      `INSERT INTO llm_credentials (user_id, cred_id, encrypted_value, created_at, updated_at)
+       VALUES ($1, $2, $3, $4, $4)
+       ON CONFLICT (user_id, cred_id) DO UPDATE SET
+         encrypted_value = EXCLUDED.encrypted_value,
+         updated_at = EXCLUDED.updated_at
+       RETURNING cred_id`,
+      [userId, entry.credId, entry.encryptedValue, now]
+    );
+    if (rows.length > 0) upserted++;
+  }
+  return upserted;
+}
+async function getLlmCredentials(query, userId, credIds) {
+  if (!credIds || credIds.length === 0) return [];
+  return query(
+    `SELECT cred_id, encrypted_value, updated_at
+     FROM llm_credentials
+     WHERE user_id = $1 AND cred_id = ANY($2)`,
+    [userId, credIds]
+  );
+}
+async function listLlmCredentials(query, userId) {
+  return query(
+    "SELECT cred_id, updated_at FROM llm_credentials WHERE user_id = $1 ORDER BY cred_id ASC",
+    [userId]
+  );
+}
+async function deleteLlmCredentials(query, userId, credIds = null) {
+  if (credIds !== null && credIds.length === 0) return 0;
+  const rows = credIds === null ? await query("DELETE FROM llm_credentials WHERE user_id = $1 RETURNING cred_id", [userId]) : await query("DELETE FROM llm_credentials WHERE user_id = $1 AND cred_id = ANY($2) RETURNING cred_id", [userId, credIds]);
+  return rows.length;
+}
+
+export {
+  claimTask,
+  renewTaskLease,
+  getTaskStatusInfo,
+  getPushSubscription,
+  upsertPushSubscription,
+  deletePushSubscription,
+  upsertLlmCredentials,
+  getLlmCredentials,
+  listLlmCredentials,
+  deleteLlmCredentials
+};

package/dist/cloudflare/single-user-worker.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @param {(env: Object) => Object|Promise<Object>} buildConfig
+ * @param {{ onError?: (info: { stage: 'config'|'request'|'tick', error: unknown, cause: import('../lib/errors.js').ErrorCause, path: string|null }) => void|Promise<void> }} [options]
+ *   `onError` 在 fetch 或 cron 出错时调一次（best-effort，自身抛错只记日志）。
+ *   cron 那条路上没有调用方能看到错误响应，这个 hook 是宿主唯一的出口。
+ */
+export function createSingleUserCloudflareWorker(buildConfig: (env: any) => any | Promise<any>, options?: {
+    onError?: (info: {
+        stage: "config" | "request" | "tick";
+        error: unknown;
+        cause: import("../lib/errors.js").ErrorCause;
+        path: string | null;
+    }) => void | Promise<void>;
+}): {
+    fetch: (request: any, env: any) => Promise<Response>;
+    scheduled: (event: any, env: any) => Promise<{
+        ok: true;
+        summary: any;
+    } | {
+        ok: false;
+        cause: import("../lib/errors.js").ErrorCause;
+    }>;
+    runTask: (uuid: string, env: any) => Promise<{
+        ran: false;
+        reason: "not_configured" | "not_found" | "already_settled" | "not_due" | "retry_pending";
+        status?: string;
+        nextSendAt?: string;
+        retryAfter?: string;
+    } | {
+        ran: true;
+        summary: any;
+    }>;
+    getSchemaVersion: (env: any) => Promise<import("../lib/schema-version.js").SchemaVersionResult>;
+    ensureSchema: (env: any) => Promise<import("../lib/schema-version.js").EnsureSchemaResult>;
+};
+export const CORS_ALLOW_HEADERS: "Content-Type, X-User-Id, X-Payload-Encrypted, X-Encryption-Version, X-Response-Encrypted, X-Client-Token";
+export const CORS_ALLOW_METHODS: "GET, POST, PUT, DELETE, OPTIONS";

package/dist/cloudflare.cjs

@@ -8,7 +8,6 @@
 
 
 
-var _chunkGN5QTMCLcjs = require('./chunk-GN5QTMCL.cjs');
 
 
 
@@ -19,4 +18,42 @@ var _chunkGN5QTMCLcjs = require('./chunk-GN5QTMCL.cjs');
 
 
 
-exports.createD1Adapter = _chunkGN5QTMCLcjs.createD1Adapter; exports.createSingleUserCloudflareWorker = _chunkGN5QTMCLcjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkGN5QTMCLcjs.createSingleUserServer; exports.createWebCryptoWebPush = _chunkGN5QTMCLcjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkGN5QTMCLcjs.decryptFromStorage; exports.decryptPayload = _chunkGN5QTMCLcjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkGN5QTMCLcjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkGN5QTMCLcjs.encryptForStorage; exports.runScheduledTick = _chunkGN5QTMCLcjs.runScheduledTick;
+
+
+
+
+
+
+
+
+var _chunkQHVID3V2cjs = require('./chunk-QHVID3V2.cjs');
+require('./chunk-7NMQFTDJ.cjs');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.DEFAULT_MAX_REQUEST_BODY_BYTES = _chunkQHVID3V2cjs.DEFAULT_MAX_REQUEST_BODY_BYTES; exports.MAX_PUSH_PAYLOAD_BYTES = _chunkQHVID3V2cjs.MAX_PUSH_PAYLOAD_BYTES; exports.NonRetryableError = _chunkQHVID3V2cjs.NonRetryableError; exports.PUSH_ENVELOPE_RESERVED_BYTES = _chunkQHVID3V2cjs.PUSH_ENVELOPE_RESERVED_BYTES; exports.SCHEMA_VERSION = _chunkQHVID3V2cjs.SCHEMA_VERSION; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = _chunkQHVID3V2cjs.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.WEB_PUSH_MAX_BODY_BYTES = _chunkQHVID3V2cjs.WEB_PUSH_MAX_BODY_BYTES; exports.advanceOccurrence = _chunkQHVID3V2cjs.advanceOccurrence; exports.createD1Adapter = _chunkQHVID3V2cjs.createD1Adapter; exports.createSingleUserCloudflareWorker = _chunkQHVID3V2cjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkQHVID3V2cjs.createSingleUserServer; exports.createWebCryptoWebPush = _chunkQHVID3V2cjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkQHVID3V2cjs.decryptFromStorage; exports.decryptPayload = _chunkQHVID3V2cjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkQHVID3V2cjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkQHVID3V2cjs.encryptForStorage; exports.ensureSchema = _chunkQHVID3V2cjs.ensureSchema; exports.getSchemaVersion = _chunkQHVID3V2cjs.getSchemaVersion; exports.isNonRetryableError = _chunkQHVID3V2cjs.isNonRetryableError; exports.isValidTimeZoneId = _chunkQHVID3V2cjs.isValidTimeZoneId; exports.measurePushPayload = _chunkQHVID3V2cjs.measurePushPayload; exports.nextFutureOccurrence = _chunkQHVID3V2cjs.nextFutureOccurrence; exports.planNextOccurrence = _chunkQHVID3V2cjs.planNextOccurrence; exports.readRequestBody = _chunkQHVID3V2cjs.readRequestBody; exports.runScheduledTick = _chunkQHVID3V2cjs.runScheduledTick; exports.runTask = _chunkQHVID3V2cjs.runTask; exports.summarizeErrorCause = _chunkQHVID3V2cjs.summarizeErrorCause;

package/dist/cloudflare.d.ts

@@ -1,2 +1,10 @@
-export { f as createD1Adapter, h as createSingleUserCloudflareWorker, j as createSingleUserServer, k as createWebCryptoWebPush, l as decryptFromStorage, m as decryptPayload, n as deriveUserEncryptionKey, o as encryptForStorage, r as runScheduledTick } from './cloudflare-B-E51VjP.js';
-import '@rei-standard/amsg-shared';
+export { createSingleUserCloudflareWorker } from "./cloudflare/single-user-worker.js";
+export { createSingleUserServer } from "./single-user.js";
+export { createD1Adapter } from "./adapters/d1.js";
+export { createWebCryptoWebPush, measurePushPayload, MAX_PUSH_PAYLOAD_BYTES, PUSH_ENVELOPE_RESERVED_BYTES, WEB_PUSH_MAX_BODY_BYTES, WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES } from "./lib/webpush-webcrypto.js";
+export { runScheduledTick, runTask } from "./lib/run-tick.js";
+export { getSchemaVersion, ensureSchema, SCHEMA_VERSION } from "./lib/schema-version.js";
+export { summarizeErrorCause, NonRetryableError, isNonRetryableError } from "./lib/errors.js";
+export { isValidTimeZoneId, advanceOccurrence, nextFutureOccurrence, planNextOccurrence } from "./lib/recurrence.js";
+export { readRequestBody, DEFAULT_MAX_REQUEST_BODY_BYTES } from "./lib/request.js";
+export { deriveUserEncryptionKey, decryptPayload, encryptForStorage, decryptFromStorage } from "./lib/encryption.js";

package/dist/cloudflare.mjs

@@ -1,4 +1,12 @@
 import {
+  DEFAULT_MAX_REQUEST_BODY_BYTES,
+  MAX_PUSH_PAYLOAD_BYTES,
+  NonRetryableError,
+  PUSH_ENVELOPE_RESERVED_BYTES,
+  SCHEMA_VERSION,
+  WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES,
+  WEB_PUSH_MAX_BODY_BYTES,
+  advanceOccurrence,
   createD1Adapter,
   createSingleUserCloudflareWorker,
   createSingleUserServer,
@@ -7,9 +15,28 @@ import {
   decryptPayload,
   deriveUserEncryptionKey,
   encryptForStorage,
-  runScheduledTick
-} from "./chunk-PVNLB6TF.mjs";
+  ensureSchema,
+  getSchemaVersion,
+  isNonRetryableError,
+  isValidTimeZoneId,
+  measurePushPayload,
+  nextFutureOccurrence,
+  planNextOccurrence,
+  readRequestBody,
+  runScheduledTick,
+  runTask,
+  summarizeErrorCause
+} from "./chunk-KOJQVOYS.mjs";
+import "./chunk-GN44PST5.mjs";
 export {
+  DEFAULT_MAX_REQUEST_BODY_BYTES,
+  MAX_PUSH_PAYLOAD_BYTES,
+  NonRetryableError,
+  PUSH_ENVELOPE_RESERVED_BYTES,
+  SCHEMA_VERSION,
+  WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES,
+  WEB_PUSH_MAX_BODY_BYTES,
+  advanceOccurrence,
   createD1Adapter,
   createSingleUserCloudflareWorker,
   createSingleUserServer,
@@ -18,5 +45,15 @@ export {
   decryptPayload,
   deriveUserEncryptionKey,
   encryptForStorage,
-  runScheduledTick
+  ensureSchema,
+  getSchemaVersion,
+  isNonRetryableError,
+  isValidTimeZoneId,
+  measurePushPayload,
+  nextFutureOccurrence,
+  planNextOccurrence,
+  readRequestBody,
+  runScheduledTick,
+  runTask,
+  summarizeErrorCause
 };

package/dist/handlers/cancel-message.d.ts

@@ -0,0 +1,3 @@
+export function createCancelMessageHandler(ctx: any): {
+    DELETE: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/capabilities.d.ts

@@ -0,0 +1,4 @@
+export function createCapabilitiesHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+};
+export const SERVER_FEATURES: readonly string[];

package/dist/handlers/client-state.d.ts

@@ -0,0 +1,7 @@
+export function createClientStateHandler(ctx: any): {
+    PUT: (headers: any, body: any) => Promise<any>;
+    GET: (url: any, headers: any) => Promise<any>;
+    DELETE: (url: any, headers: any) => Promise<any>;
+};
+export const MAX_STATE_VALUE_BYTES: number;
+export const MAX_STATE_ENTRIES_PER_REQUEST: 200;

package/dist/handlers/get-message.d.ts

@@ -0,0 +1,3 @@
+export function createGetMessageHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/get-user-key.d.ts

@@ -0,0 +1,3 @@
+export function createGetUserKeyHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/init-tenant.d.ts

@@ -0,0 +1,23 @@
+export function createInitTenantHandler(ctx: any): {
+    POST: (headers: any, body: any) => Promise<{
+        status: number;
+        body: {
+            success: boolean;
+            error: any;
+            data?: undefined;
+        };
+    } | {
+        status: number;
+        body: {
+            success: boolean;
+            data: {
+                tenantId: any;
+                tenantToken: any;
+                cronToken: any;
+                cronWebhookUrl: any;
+                masterKeyFingerprint: any;
+            };
+            error?: undefined;
+        };
+    }>;
+};

package/dist/handlers/llm-credentials.d.ts

@@ -0,0 +1,5 @@
+export function createLlmCredentialsHandler(ctx: any): {
+    PUT: (headers: any, body: any) => Promise<any>;
+    GET: (url: any, headers: any) => Promise<any>;
+    DELETE: (url: any, headers: any, body: any) => Promise<any>;
+};

package/dist/handlers/messages.d.ts

@@ -0,0 +1,3 @@
+export function createMessagesHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/outbox.d.ts

@@ -0,0 +1,7 @@
+export function createOutboxHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+    POST: (headers: any, body: any) => Promise<any>;
+};
+export const MAX_OUTBOX_PAGE_SIZE: 100;
+export const DEFAULT_OUTBOX_PAGE_SIZE: 50;
+export const MAX_OUTBOX_ACK_IDS: 200;

package/dist/handlers/push-subscription.d.ts

@@ -0,0 +1,5 @@
+export function createPushSubscriptionHandler(ctx: any): {
+    PUT: (headers: any, body: any) => Promise<any>;
+    GET: (url: any, headers: any) => Promise<any>;
+    DELETE: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/schedule-message.d.ts

@@ -0,0 +1,3 @@
+export function createScheduleMessageHandler(ctx: any): {
+    POST: (headers: any, body: any) => Promise<any>;
+};

package/dist/handlers/send-notifications.d.ts

@@ -0,0 +1,3 @@
+export function createSendNotificationsHandler(ctx: any): {
+    POST: (urlOrHeaders: any, maybeHeaders: any) => Promise<any>;
+};

package/dist/handlers/single-user-init.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Handler: single-user-init
+ *
+ * Idempotent "just create the tables" endpoint for single-user deployments
+ * (the degenerate form of init-tenant). Reuses resolveTenant purely to enforce
+ * the optional shared secret, then runs initSchema. Issues no token.
+ *
+ * @param {Object} ctx - Single-user server context (ctx.tenantManager).
+ * @returns {{ POST: function }}
+ */
+export function createSingleUserInitHandler(ctx: any): {
+    POST: Function;
+};

package/dist/handlers/update-message.d.ts

@@ -0,0 +1,3 @@
+export function createUpdateMessageHandler(ctx: any): {
+    PUT: (url: any, headers: any, body: any) => Promise<any>;
+};

package/dist/handlers/vapid-public-key.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Handler: vapid-public-key
+ *
+ * Exposes this worker's own VAPID public key so a browser frontend can build a
+ * Web Push subscription (`applicationServerKey`) at runtime. Each self-hosted
+ * worker owns its keypair, so the key can't be baked into the frontend — it
+ * pulls it from here.
+ *
+ * Auth funnels through the same resolveTenant as every other endpoint, so with
+ * a serverToken configured this route requires `X-Client-Token` too (the
+ * all-or-nothing contract). The public key itself is not a secret; gating it
+ * just keeps every endpoint consistent.
+ *
+ * @param {Object} ctx - Server context ({ vapid, tenantManager, ... }).
+ * @returns {{ GET: function }}
+ */
+export function createVapidPublicKeyHandler(ctx: any): {
+    GET: Function;
+};