@rei-standard/amsg-server 2.6.0-next.34 → 2.6.0-next.36

package/README.md

@@ -902,8 +902,8 @@ export default createSingleUserCloudflareWorker(buildConfig, {
 });
 ```
 
-- `onError` 放在工厂的第二个参数上，而不是 `buildConfig` 的返回值里：`buildConfig` 自己抛错时配置里的东西一个都读不到，而那恰恰是最需要被看见的一种故障。`stage` 在 cron 路径上是 `config`（配置构建失败 / VAPID 没配齐）或 `tick`（那一跳抛错）。VAPID 没配齐这一支没有异常对象，`error` 为 `null`、`cause.name` 是 `VapidNotConfigured`。
-- `scheduled()` 现在有返回值：`{ ok: true, summary }` 或 `{ ok: false, cause }`。Cloudflare 不看它，是给「自己包一层再转调 `scheduled`」的宿主和测试用的。
+- `onError` 放在工厂的第二个参数上，而不是 `buildConfig` 的返回值里：`buildConfig` 自己抛错时配置里的东西一个都读不到，而那恰恰是最需要被看见的一种故障。`stage` 在 cron 路径上是 `config`（配置构建失败 / VAPID 没配齐）、`tick`（那一跳抛错）或 `cloud-cleanup`（云端数据清理那一步抛错，这一跳的消息照常投递）。VAPID 没配齐这一支没有异常对象，`error` 为 `null`、`cause.name` 是 `VapidNotConfigured`。
+- `scheduled()` 现在有返回值：`{ ok: true, summary }` 或 `{ ok: false, cause }`，`ok` 只看消息投递这一段。云端数据清理那一步出错时，两种返回值上都会多一个 `cloudCleanupCause`。Cloudflare 不看它，是给「自己包一层再转调 `scheduled`」的宿主和测试用的。
 
 ## 导出 API（Exports）
 

package/dist/adapters/d1.d.ts

@@ -67,7 +67,7 @@ export class D1Adapter {
         data: any;
         updatedAt: any;
     }>;
-    putCloudDataRecord(userId: any, kind: any, id: any, data: any, { idempotencyKey, createOnly, leaseToken }?: {
+    putCloudDataRecord(userId: any, kind: any, id: any, data: any, { idempotencyKey, createOnly, leaseToken, work }?: {
         idempotencyKey?: any;
         createOnly?: boolean;
     }): Promise<{
@@ -105,8 +105,37 @@ export class D1Adapter {
     renewCloudDataRecordLease(userId: any, kind: any, id: any, leaseMs: any, leaseToken: any): Promise<boolean>;
     deleteCloudDataRecord(userId: any, kind: any, id: any): Promise<boolean>;
     cleanupCloudDataRecords(kind: any, beforeMs: any): Promise<any>;
-    /** Sidecars are indexes only. Remove them only while their backing row is absent. */
-    cleanupCloudResourceMetadata(userId?: any): Promise<any>;
+    listDueCloudDataOperations(now?: number, limit?: number): Promise<any[]>;
+    cleanupExpiredCloudDataRecords(now?: number, limit?: number): Promise<any>;
+    getCloudMaintenanceBatch(name: any, table: any, limit?: number): Promise<{
+        rows: any[];
+        completed: boolean;
+        upperBound?: undefined;
+        cursor?: undefined;
+    } | {
+        rows: any;
+        upperBound: any;
+        cursor: any;
+        completed: boolean;
+    }>;
+    finishCloudMaintenanceBatch(name: any, cursor: any, completed: any): Promise<void>;
+    /**
+     * Index a whole repair batch in one statement. Never overwrites an existing schedule, and
+     * skips a record that was rewritten after the batch was read.
+     */
+    indexCloudDataRecordWorkBatch(entries: any): Promise<void>;
+    /** Move an indexed record's schedule, unless the record was rewritten since the caller read it. */
+    rescheduleCloudDataRecordWork(userId: any, kind: any, id: any, work: any, expectedWriteToken?: any): Promise<boolean>;
+    readCloudMaintenanceRecord(row: any): Promise<{
+        id: any;
+        userId: any;
+        kind: any;
+        data: any;
+        updatedAt: any;
+    }>;
+    repairCloudResourceMetadata(limit?: number): Promise<void>;
+    /** One explicit repair, or a bounded upgrade batch; never called as a recurring sweep. */
+    cleanupCloudResourceMetadata(userId?: any, range?: any): Promise<any>;
     listCloudOwners(userId: any): Promise<any>;
     getCloudOwner(userId: any, owner: any): Promise<{
         active: boolean;
@@ -151,11 +180,12 @@ export class D1Adapter {
      * 构变了而老部署没跑过 initSchema 时，cron 会每分钟静默挂在缺的那一列上，
      * 界面上一切正常——这个方法就是让宿主查得出来。
      *
-     * @returns {Promise<{ tables: Record<string, string[]>, indexes: string[] }>}
+     * @returns {Promise<{ tables: Record<string, string[]>, indexes: string[], triggers: string[] }>}
      */
     describeSchema(): Promise<{
         tables: Record<string, string[]>;
         indexes: string[];
+        triggers: string[];
     }>;
     dropSchema(): Promise<void>;
     createTask(params: any, cloudGuard?: any): Promise<any>;

package/dist/adapters/interface.d.ts

@@ -42,13 +42,15 @@ export type DbAdapter = {
      */
     initSchema: () => Promise<InitSchemaResult>;
     /**
-     * （可选）活库里现在实际有哪些表 / 列 / 索引，只读不写。
+     * （可选）活库里现在实际有哪些表 / 列 / 索引 / 触发器，只读不写。`triggers`
+     * 可以不回，不回时触发器这一项不查。
      * `getSchemaVersion` / `ensureSchema`（lib/schema-version.js）拿它跟这一版
      * 需要的清单对照；不实现的适配器调那两个函数会抛错。内置只有 D1 实现。
      */
     describeSchema?: () => Promise<{
         tables: Record<string, string[]>;
         indexes: string[];
+        triggers?: string[];
     }>;
     /**
      *   Drop the scheduled_messages table (CASCADE).

package/dist/adapters/schema.sqlite.d.ts

@@ -54,15 +54,27 @@ export const SQLITE_ALL_INDEXES: {
     critical: boolean;
 }[];
 export const CLOUD_DATA_TABLES_SQL: string[];
+export const CLOUD_DATA_WORK_TABLES_SQL: string[];
+export const CLOUD_DATA_WORK_INDEXES: {
+    name: string;
+    sql: string;
+    description: string;
+    critical: boolean;
+}[];
+export const CLOUD_DATA_DELETE_TRIGGERS: {
+    name: string;
+    sql: string;
+}[];
 /**
  * 这一版代码跑起来需要的表 / 列 / 索引。
  *
  * 索引只列 critical 的那几个（uidx_uuid 之类）：其余索引缺了只是慢，缺了它则
  * 是正确性问题。
  *
- * @type {{ tables: Record<string, string[]>, indexes: string[] }}
+ * @type {{ tables: Record<string, string[]>, indexes: string[], triggers: string[] }}
  */
 export const SQLITE_REQUIRED_SCHEMA: {
     tables: Record<string, string[]>;
     indexes: string[];
+    triggers: string[];
 };

package/dist/{chunk-BACG4KJQ.mjs → chunk-67RM2E46.mjs}

@@ -5070,6 +5070,66 @@ var CLOUD_DATA_TABLES_SQL = [
     lease_allowed INTEGER CONSTRAINT cloud_lease_guard CHECK (lease_allowed = 1)
   )`
 ];
+var CLOUD_DATA_WORK_TABLES_SQL = [
+  `CREATE TABLE IF NOT EXISTS cloud_data_work (
+    user_id TEXT NOT NULL, kind TEXT NOT NULL, id TEXT NOT NULL,
+    next_run_at INTEGER, expires_at INTEGER,
+    PRIMARY KEY (user_id, kind, id)
+  )`,
+  `CREATE TABLE IF NOT EXISTS cloud_data_maintenance (
+    name TEXT PRIMARY KEY, cursor INTEGER NOT NULL, upper_bound INTEGER NOT NULL,
+    completed INTEGER NOT NULL DEFAULT 0
+  )`
+];
+CLOUD_DATA_TABLES_SQL.push(...CLOUD_DATA_WORK_TABLES_SQL);
+var CLOUD_DATA_WORK_INDEXES = [
+  {
+    name: "idx_cloud_work_due",
+    sql: `CREATE INDEX IF NOT EXISTS idx_cloud_work_due
+      ON cloud_data_work (kind, next_run_at) WHERE next_run_at IS NOT NULL`,
+    description: "Only due cleanup operations",
+    critical: true
+  },
+  {
+    name: "idx_cloud_work_expiry",
+    sql: `CREATE INDEX IF NOT EXISTS idx_cloud_work_expiry
+      ON cloud_data_work (expires_at) WHERE expires_at IS NOT NULL`,
+    description: "Only expired management records",
+    critical: true
+  }
+];
+SQLITE_ALL_INDEXES.push(...CLOUD_DATA_WORK_INDEXES);
+var chunkPrefixSql = "char(31)||'amsg-chunks'||char(31)";
+var logicalNamespaceSql = `CASE WHEN substr(OLD.namespace,1,13)=${chunkPrefixSql}
+  THEN substr(OLD.namespace,14) ELSE OLD.namespace END`;
+var logicalKeySql = `CASE WHEN substr(OLD.namespace,1,13)=${chunkPrefixSql} AND instr(OLD.key,char(31))>0
+  THEN substr(OLD.key,1,instr(OLD.key,char(31))-1) ELSE OLD.key END`;
+var CLOUD_DATA_DELETE_TRIGGERS = [
+  ...[
+    ["scheduled_messages", "task", "uuid"],
+    ["llm_credentials", "credential", "cred_id"],
+    ["message_outbox", "outbox", "message_id"],
+    ["push_subscriptions", "subscription", "user_id"]
+  ].map(([table, type, column]) => ({
+    name: `trg_cloud_metadata_${type}_delete`,
+    sql: `CREATE TRIGGER IF NOT EXISTS trg_cloud_metadata_${type}_delete AFTER DELETE ON ${table}
+        BEGIN DELETE FROM cloud_resource_metadata WHERE user_id=OLD.user_id
+          AND resource_key=json_array('${type}'${column ? ",OLD." + column : ""}); END`
+  })),
+  { name: "trg_cloud_metadata_state_delete", sql: `CREATE TRIGGER IF NOT EXISTS trg_cloud_metadata_state_delete
+      AFTER DELETE ON client_state BEGIN
+      DELETE FROM cloud_resource_metadata WHERE user_id=OLD.user_id
+        AND resource_key=json_array('state',${logicalNamespaceSql},${logicalKeySql})
+        AND NOT EXISTS (SELECT 1 FROM client_state r WHERE r.user_id=OLD.user_id
+          AND r.namespace=(${logicalNamespaceSql}) AND r.key=(${logicalKeySql}))
+        AND NOT EXISTS (SELECT 1 FROM client_state r WHERE r.user_id=OLD.user_id
+          AND r.namespace=${chunkPrefixSql}||(${logicalNamespaceSql})
+          AND r.key >= (${logicalKeySql})||char(31) AND r.key < (${logicalKeySql})||char(32)); END` },
+  { name: "trg_cloud_work_delete", sql: `CREATE TRIGGER IF NOT EXISTS trg_cloud_work_delete
+      AFTER DELETE ON cloud_data_records BEGIN
+      DELETE FROM cloud_data_work WHERE user_id=OLD.user_id AND kind=OLD.kind AND id=OLD.id;
+      DELETE FROM cloud_data_record_chunks WHERE user_id=OLD.user_id AND kind=OLD.kind AND id=OLD.id; END` }
+];
 function parseTableName(sql) {
   const match = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([A-Za-z_][A-Za-z0-9_]*)/i.exec(sql);
   return match ? match[1] : "";
@@ -5105,7 +5165,8 @@ var SQLITE_REQUIRED_SCHEMA = Object.freeze({
     describeTable(MESSAGE_OUTBOX_TABLE_SQL),
     ...CLOUD_DATA_TABLES_SQL.map(describeTable)
   ])),
-  indexes: Object.freeze(SQLITE_ALL_INDEXES.filter((index) => index.critical).map((index) => index.name))
+  indexes: Object.freeze(SQLITE_ALL_INDEXES.filter((index) => index.critical).map((index) => index.name)),
+  triggers: Object.freeze(CLOUD_DATA_DELETE_TRIGGERS.map((trigger) => trigger.name))
 });
 
 // src/server/adapters/d1.js
@@ -5304,7 +5365,7 @@ var D1Adapter = class {
     }
     return { id: row.id, userId: row.user_id, kind: row.kind, data, updatedAt: row.updated_at };
   }
-  async putCloudDataRecord(userId, kind, id, data, { idempotencyKey = null, createOnly = false, leaseToken } = {}) {
+  async putCloudDataRecord(userId, kind, id, data, { idempotencyKey = null, createOnly = false, leaseToken, work } = {}) {
     const slices = [];
     if (data.length > 200 * 1024) for (let offset = 0; offset < data.length; offset += 200 * 1024) slices.push(data.slice(offset, offset + 200 * 1024));
     const rootValue = slices.length ? "amsg-record" + slices.length : data;
@@ -5331,6 +5392,12 @@ var D1Adapter = class {
         SELECT ?,?,?,?,?,? WHERE ${rootGate}`
       ).bind(userId, kind, id, index, slices[index], writeToken, userId, kind, id, writeToken));
     }
+    const schedule = work ?? (["inventory", "plan"].includes(kind) ? { nextRunAt: null, expiresAt: now + 36e5 } : null);
+    if (schedule) statements.push(this._db.prepare(
+      `INSERT INTO cloud_data_work (user_id,kind,id,next_run_at,expires_at)
+      SELECT ?,?,?,?,? WHERE ${rootGate}
+      ON CONFLICT (user_id,kind,id) DO UPDATE SET next_run_at=excluded.next_run_at,expires_at=excluded.expires_at`
+    ).bind(userId, kind, id, schedule.nextRunAt ?? null, schedule.expiresAt ?? null, userId, kind, id, writeToken));
     if (!this.cloudDataManagement) throw new Error("Cloud management requires transactional batches");
     const results = await this._db.batch(statements);
     if (leaseToken !== void 0 && !results[0].meta.changes) throw Object.assign(new Error("Cloud operation processing lease was lost"), { code: "CLOUD_LEASE_LOST" });
@@ -5408,23 +5475,102 @@ var D1Adapter = class {
     ]);
     return results[1].meta.changes || 0;
   }
-  /** Sidecars are indexes only. Remove them only while their backing row is absent. */
-  async cleanupCloudResourceMetadata(userId = null) {
+  async listDueCloudDataOperations(now = Date.now(), limit = 25) {
+    const result = await this._db.prepare(`SELECT r.* FROM cloud_data_work w JOIN cloud_data_records r
+      ON r.user_id=w.user_id AND r.kind=w.kind AND r.id=w.id
+      WHERE w.kind='operation' AND w.next_run_at IS NOT NULL AND w.next_run_at<=?
+        AND (r.lease_until IS NULL OR r.lease_until<=?)
+      ORDER BY w.next_run_at LIMIT ?`).bind(now, now, limit).all();
+    return Promise.all((result.results || []).map(async (row) => ({ ...await this._cloudRecordForList(row), writeToken: row.write_token })));
+  }
+  async cleanupExpiredCloudDataRecords(now = Date.now(), limit = 100) {
+    const result = await this._db.prepare(`DELETE FROM cloud_data_records WHERE rowid IN (
+      SELECT r.rowid FROM cloud_data_work w JOIN cloud_data_records r
+      ON r.user_id=w.user_id AND r.kind=w.kind AND r.id=w.id
+      WHERE w.expires_at IS NOT NULL AND w.expires_at<=?
+        AND (r.lease_until IS NULL OR r.lease_until<=?) ORDER BY w.expires_at LIMIT ?
+    )`).bind(now, now, limit).run();
+    return result.meta.changes || 0;
+  }
+  async getCloudMaintenanceBatch(name, table, limit = 100) {
+    if (!["cloud_resource_metadata", "cloud_data_records"].includes(table)) throw new Error("Invalid maintenance source");
+    let marker = await this._db.prepare("SELECT * FROM cloud_data_maintenance WHERE name=?").bind(name).first();
+    if (!marker) {
+      await this._db.prepare(`INSERT INTO cloud_data_maintenance (name,cursor,upper_bound,completed)
+        SELECT ?,0,COALESCE(MAX(rowid),0),0 FROM ${table} WHERE 1 ON CONFLICT (name) DO NOTHING`).bind(name).run();
+      marker = await this._db.prepare("SELECT * FROM cloud_data_maintenance WHERE name=?").bind(name).first();
+    }
+    if (marker.completed) return { rows: [], completed: true };
+    const columns = table === "cloud_data_records" ? "rowid AS maintenance_rowid,user_id,kind,id,updated_at,write_token,CASE WHEN kind='operation' THEN data END AS data" : "rowid AS maintenance_rowid";
+    const result = await this._db.prepare(`SELECT ${columns} FROM ${table}
+      WHERE rowid>? AND rowid<=? ORDER BY rowid LIMIT ?`).bind(marker.cursor, marker.upper_bound, limit).all();
+    return { rows: result.results || [], upperBound: marker.upper_bound, cursor: marker.cursor, completed: false };
+  }
+  async finishCloudMaintenanceBatch(name, cursor, completed) {
+    await this._db.prepare(`UPDATE cloud_data_maintenance SET cursor=MAX(cursor,?),completed=MAX(completed,?) WHERE name=?`).bind(cursor, completed ? 1 : 0, name).run();
+  }
+  /**
+   * Index a whole repair batch in one statement. Never overwrites an existing schedule, and
+   * skips a record that was rewritten after the batch was read.
+   */
+  async indexCloudDataRecordWorkBatch(entries) {
+    if (!entries.length) return;
+    const rows = entries.map(({ userId, kind, id, work, writeToken }) => [userId, kind, id, work.nextRunAt ?? null, work.expiresAt ?? null, writeToken ?? null]);
+    await this._db.prepare(`INSERT INTO cloud_data_work (user_id,kind,id,next_run_at,expires_at)
+      SELECT r.user_id,r.kind,r.id,json_extract(j.value,'$[3]'),json_extract(j.value,'$[4]')
+      FROM json_each(?) j JOIN cloud_data_records r ON r.user_id=json_extract(j.value,'$[0]')
+        AND r.kind=json_extract(j.value,'$[1]') AND r.id=json_extract(j.value,'$[2]')
+        AND r.write_token IS json_extract(j.value,'$[5]')
+      WHERE 1 ON CONFLICT (user_id,kind,id) DO NOTHING`).bind(JSON.stringify(rows)).run();
+  }
+  /** Move an indexed record's schedule, unless the record was rewritten since the caller read it. */
+  async rescheduleCloudDataRecordWork(userId, kind, id, work, expectedWriteToken = null) {
+    const result = await this._db.prepare(`UPDATE cloud_data_work SET next_run_at=?,expires_at=?
+      WHERE user_id=? AND kind=? AND id=? AND EXISTS (SELECT 1 FROM cloud_data_records r
+        WHERE r.user_id=cloud_data_work.user_id AND r.kind=cloud_data_work.kind AND r.id=cloud_data_work.id AND r.write_token IS ?)`).bind(work.nextRunAt ?? null, work.expiresAt ?? null, userId, kind, id, expectedWriteToken).run();
+    return result.meta.changes > 0;
+  }
+  async readCloudMaintenanceRecord(row) {
+    return this._cloudRecordForList(row);
+  }
+  async repairCloudResourceMetadata(limit = 100) {
+    const name = "metadata-sidecars-v1";
+    const batch = await this.getCloudMaintenanceBatch(name, "cloud_resource_metadata", limit);
+    if (batch.completed) return;
+    const cursor = batch.rows.at(-1)?.maintenance_rowid ?? batch.upperBound;
+    if (batch.rows.length) await this.cleanupCloudResourceMetadata(null, { after: batch.cursor, through: cursor });
+    await this.finishCloudMaintenanceBatch(name, cursor, batch.rows.length < limit || cursor >= batch.upperBound);
+  }
+  /** One explicit repair, or a bounded upgrade batch; never called as a recurring sweep. */
+  async cleanupCloudResourceMetadata(userId = null, range = null) {
     const targets = {
-      task: `SELECT 1 FROM scheduled_messages r WHERE r.user_id=m.user_id AND r.uuid=json_extract(m.resource_key,'$[1]')`,
-      state: `SELECT 1 FROM client_state r WHERE r.user_id=m.user_id AND
-        ((r.namespace=json_extract(m.resource_key,'$[1]') AND r.key=json_extract(m.resource_key,'$[2]')) OR
-        (r.namespace=char(31)||'amsg-chunks'||char(31)||json_extract(m.resource_key,'$[1]')
+      task: [`SELECT 1 FROM scheduled_messages r WHERE r.user_id=m.user_id AND r.uuid=json_extract(m.resource_key,'$[1]')`],
+      state: [
+        `SELECT 1 FROM client_state r WHERE r.user_id=m.user_id
+          AND r.namespace=json_extract(m.resource_key,'$[1]') AND r.key=json_extract(m.resource_key,'$[2]')`,
+        `SELECT 1 FROM client_state r WHERE r.user_id=m.user_id
+          AND r.namespace=char(31)||'amsg-chunks'||char(31)||json_extract(m.resource_key,'$[1]')
           AND r.key >= json_extract(m.resource_key,'$[2]')||char(31)
-          AND r.key < json_extract(m.resource_key,'$[2]')||char(32)))`,
-      credential: `SELECT 1 FROM llm_credentials r WHERE r.user_id=m.user_id AND r.cred_id=json_extract(m.resource_key,'$[1]')`,
-      outbox: `SELECT 1 FROM message_outbox r WHERE r.user_id=m.user_id AND r.message_id=json_extract(m.resource_key,'$[1]')`,
-      subscription: `SELECT 1 FROM push_subscriptions r WHERE r.user_id=m.user_id`
+          AND r.key < json_extract(m.resource_key,'$[2]')||char(32)`
+      ],
+      credential: [`SELECT 1 FROM llm_credentials r WHERE r.user_id=m.user_id AND r.cred_id=json_extract(m.resource_key,'$[1]')`],
+      outbox: [`SELECT 1 FROM message_outbox r WHERE r.user_id=m.user_id AND r.message_id=json_extract(m.resource_key,'$[1]')`],
+      subscription: [`SELECT 1 FROM push_subscriptions r WHERE r.user_id=m.user_id`]
     };
-    const statements = Object.entries(targets).map(([type, exists]) => this._db.prepare(
-      `DELETE FROM cloud_resource_metadata AS m WHERE (? IS NULL OR user_id=?) AND json_valid(resource_key)
-        AND json_extract(resource_key,'$[0]')=? AND NOT EXISTS (${exists})`
-    ).bind(userId, userId, type));
+    const statements = Object.entries(targets).map(([type, exists]) => {
+      const conditions = ["json_valid(resource_key)", "json_extract(resource_key,'$[0]')=?"];
+      const args = [type];
+      if (userId !== null) {
+        conditions.unshift("user_id=?");
+        args.unshift(userId);
+      }
+      if (range) {
+        conditions.unshift("m.rowid>? AND m.rowid<=?");
+        args.unshift(range.after, range.through);
+      }
+      return this._db.prepare(`DELETE FROM cloud_resource_metadata AS m WHERE ${conditions.join(" AND ")}
+        AND ${exists.map((sql) => `NOT EXISTS (${sql})`).join(" AND ")}`).bind(...args);
+    });
     const results = await this._cloudBatch(statements, userId);
     return results.reduce((sum, result) => sum + (result.meta.changes || 0), 0);
   }
@@ -5564,6 +5710,7 @@ var D1Adapter = class {
         indexResults.push({ name: index.name, status: "failed", description: index.description, critical: !!index.critical, error: error.message });
       }
     }
+    for (const trigger of CLOUD_DATA_DELETE_TRIGGERS) await this._db.prepare(trigger.sql).run();
     const criticalFailures = indexResults.filter((i) => i.critical && i.status === "failed");
     if (criticalFailures.length > 0) {
       const names = criticalFailures.map((i) => i.name).join(", ");
@@ -5587,7 +5734,7 @@ var D1Adapter = class {
    * 构变了而老部署没跑过 initSchema 时，cron 会每分钟静默挂在缺的那一列上，
    * 界面上一切正常——这个方法就是让宿主查得出来。
    *
-   * @returns {Promise<{ tables: Record<string, string[]>, indexes: string[] }>}
+   * @returns {Promise<{ tables: Record<string, string[]>, indexes: string[], triggers: string[] }>}
    */
   async describeSchema() {
     const tableRes = await this._db.prepare(
@@ -5604,7 +5751,8 @@ var D1Adapter = class {
     const indexRes = await this._db.prepare(
       `SELECT name FROM sqlite_master WHERE type = 'index' AND name IS NOT NULL`
     ).all();
-    return { tables, indexes: (indexRes.results || []).map((row) => row.name) };
+    const triggerRes = await this._db.prepare("SELECT name FROM sqlite_master WHERE type = 'trigger'").all();
+    return { tables, indexes: (indexRes.results || []).map((row) => row.name), triggers: (triggerRes.results || []).map((row) => row.name) };
   }
   async dropSchema() {
     await this._db.prepare("DROP TABLE IF EXISTS scheduled_messages").run();
@@ -5612,7 +5760,7 @@ var D1Adapter = class {
     await this._db.prepare("DROP TABLE IF EXISTS push_subscriptions").run();
     await this._db.prepare("DROP TABLE IF EXISTS llm_credentials").run();
     await this._db.prepare("DROP TABLE IF EXISTS message_outbox").run();
-    for (const table of ["cloud_data_record_chunks", "cloud_data_records", "cloud_data_owners", "cloud_resource_metadata", "cloud_guard_assertions"]) {
+    for (const table of ["cloud_data_work", "cloud_data_maintenance", "cloud_data_record_chunks", "cloud_data_records", "cloud_data_owners", "cloud_resource_metadata", "cloud_guard_assertions"]) {
       await this._db.prepare(`DROP TABLE IF EXISTS ${table}`).run();
     }
   }
@@ -5890,7 +6038,8 @@ var D1Adapter = class {
     const cutoff = new Date(Date.now() - safeDays * 24 * 60 * 60 * 1e3).toISOString();
     const res = await this._db.prepare(
       `DELETE FROM scheduled_messages
-       WHERE status IN ('sent', 'failed') AND updated_at < ?`
+       WHERE rowid IN (SELECT rowid FROM scheduled_messages
+         WHERE status IN ('sent', 'failed') AND updated_at < ? LIMIT 100)`
     ).bind(cutoff).run();
     return res.meta.changes || 0;
   }
@@ -6056,7 +6205,7 @@ var D1Adapter = class {
    */
   async cleanupClientState(targets = []) {
     if (!Array.isArray(targets) || targets.length === 0) return 0;
-    const SQL = "DELETE FROM client_state WHERE namespace = ? AND updated_at < ?";
+    const SQL = "DELETE FROM client_state WHERE rowid IN (SELECT rowid FROM client_state WHERE namespace = ? AND updated_at < ? LIMIT 100)";
     const statements = targets.map(
       (target) => this._db.prepare(SQL).bind(target.namespace, target.updatedBefore)
     );
@@ -6552,13 +6701,13 @@ var D1Adapter = class {
     let deleted = 0;
     if (Number.isFinite(ackedBeforeMs)) {
       const res = await this._db.prepare(
-        "DELETE FROM message_outbox WHERE acked_at IS NOT NULL AND acked_at < ?"
+        "DELETE FROM message_outbox WHERE rowid IN (SELECT rowid FROM message_outbox WHERE acked_at IS NOT NULL AND acked_at < ? LIMIT 100)"
       ).bind(ackedBeforeMs).run();
       deleted += res.meta.changes || 0;
     }
     if (Number.isFinite(allBeforeMs)) {
       const res = await this._db.prepare(
-        "DELETE FROM message_outbox WHERE created_at < ?"
+        "DELETE FROM message_outbox WHERE rowid IN (SELECT rowid FROM message_outbox WHERE created_at < ? LIMIT 100)"
       ).bind(allBeforeMs).run();
       deleted += res.meta.changes || 0;
     }
@@ -6879,7 +7028,7 @@ function createClientStateNamespacesHandler(ctx) {
 }
 
 // src/server/lib/version.js
-var SERVER_VERSION = true ? "2.6.0-next.34" : "0.0.0-dev";
+var SERVER_VERSION = true ? "2.6.0-next.36" : "0.0.0-dev";
 
 // src/server/handlers/capabilities.js
 var SERVER_FEATURES = Object.freeze([
@@ -7301,6 +7450,15 @@ async function cloudInventory(ctx, db, userId, userKey) {
     resolveOwner: ctx.cloudData?.resolveOwner
   });
 }
+function operationWork(operation) {
+  if (["pending", "running"].includes(operation.status)) {
+    return { nextRunAt: Number(operation.nextAttemptAt) || 0, expiresAt: null };
+  }
+  if (["completed", "failed"].includes(operation.status)) {
+    return { nextRunAt: null, expiresAt: Number(operation.updatedAt) + 30 * 864e5 };
+  }
+  return { nextRunAt: null, expiresAt: null };
+}
 async function save(db, userId, key, kind, value, options) {
   return db.putCloudDataRecord(
     userId,
@@ -7313,7 +7471,7 @@ async function save(db, userId, key, kind, value, options) {
       }),
       key
     ),
-    options
+    { ...options, ...kind === "operation" ? { work: operationWork(value) } : {} }
   );
 }
 async function readCloudRecord(db, userId, key, kind, id) {
@@ -7675,33 +7833,104 @@ async function advanceCleanup(ctx, db, userId, key, operation) {
   }
   return operation;
 }
+var WORK_INDEX_METHODS = [
+  "listDueCloudDataOperations",
+  "cleanupExpiredCloudDataRecords",
+  "rescheduleCloudDataRecordWork",
+  "getCloudMaintenanceBatch",
+  "finishCloudMaintenanceBatch",
+  "readCloudMaintenanceRecord",
+  "indexCloudDataRecordWorkBatch",
+  "repairCloudResourceMetadata"
+];
+var UNREADABLE_RETRY_MS = 15 * 6e4;
+async function repairLegacyWorkIndex(ctx) {
+  const db = ctx.db;
+  const name = "management-work-v1";
+  const batch = await db.getCloudMaintenanceBatch(name, "cloud_data_records", 100);
+  if (batch.completed) return;
+  const entries = [];
+  for (const row of batch.rows) {
+    let work;
+    if (["inventory", "plan"].includes(row.kind)) {
+      work = { nextRunAt: null, expiresAt: row.updated_at + 36e5 };
+    } else if (row.kind === "operation") {
+      try {
+        const record = await db.readCloudMaintenanceRecord(row);
+        const key = await deriveUserEncryptionKey(row.user_id, ctx.masterKey);
+        work = operationWork(JSON.parse(await decryptFromStorage(record.data, key)));
+      } catch {
+        console.warn("[amsg] Legacy cleanup operation could not be read; queued for retry");
+        work = { nextRunAt: 0, expiresAt: null };
+      }
+    } else continue;
+    entries.push({ userId: row.user_id, kind: row.kind, id: row.id, work, writeToken: row.write_token });
+  }
+  await db.indexCloudDataRecordWorkBatch(entries);
+  const cursor = batch.rows.at(-1)?.maintenance_rowid ?? batch.upperBound;
+  await db.finishCloudMaintenanceBatch(name, cursor, batch.rows.length < 100 || cursor >= batch.upperBound);
+}
 async function resumeCloudDataCleanups(ctx) {
   const db = ctx.db;
   if (!db?.cloudDataManagement) return;
-  const rows = await db.listCloudDataRecordsAcrossUsers("operation");
-  await db.cleanupCloudDataRecords("inventory", Date.now() - 36e5);
-  await db.cleanupCloudDataRecords("plan", Date.now() - 36e5);
-  await db.cleanupCloudResourceMetadata();
-  let processed = 0;
+  const indexed = WORK_INDEX_METHODS.every((method) => typeof db[method] === "function");
+  let rows;
+  if (indexed) {
+    await repairLegacyWorkIndex(ctx);
+    await db.repairCloudResourceMetadata(100);
+    await db.cleanupExpiredCloudDataRecords(Date.now(), 100);
+    rows = await db.listDueCloudDataOperations(Date.now(), 25);
+  } else {
+    await db.cleanupCloudDataRecords("inventory", Date.now() - 36e5);
+    await db.cleanupCloudDataRecords("plan", Date.now() - 36e5);
+    rows = await db.listCloudDataRecordsAcrossUsers("operation");
+  }
   for (const row of rows) {
     try {
       const key = await deriveUserEncryptionKey(row.userId, ctx.masterKey);
       const operation = JSON.parse(await decryptFromStorage(row.data, key));
-      if (["completed", "failed"].includes(operation.status) && operation.updatedAt < Date.now() - 30 * 864e5) {
-        await db.deleteCloudDataRecord(row.userId, "operation", operation.id);
+      const work = operationWork(operation);
+      if (indexed) {
+        if (work.nextRunAt === null || work.nextRunAt > Date.now()) {
+          await db.rescheduleCloudDataRecordWork(row.userId, "operation", row.id, work, row.writeToken);
+          continue;
+        }
+      } else if (work.expiresAt !== null && work.expiresAt <= Date.now()) {
+        await db.deleteCloudDataRecord(row.userId, "operation", row.id);
         continue;
       }
       if (["pending", "running"].includes(operation.status)) {
         await advanceCleanup(ctx, db, row.userId, key, operation);
-        if (++processed >= 100) break;
       }
-    } catch {
+    } catch (error) {
       console.warn("[amsg] A cloud cleanup operation could not be resumed");
+      if (!indexed || error?.code === "CLOUD_LEASE_LOST") continue;
+      await db.rescheduleCloudDataRecordWork(
+        row.userId,
+        "operation",
+        row.id,
+        { nextRunAt: Date.now() + UNREADABLE_RETRY_MS, expiresAt: null },
+        row.writeToken
+      ).catch(() => {
+      });
     }
   }
 }
 
 // src/server/handlers/cloud-data.js
+function inventorySummary(inventory) {
+  const resources = inventory.entries.map((entry) => entry.resource);
+  return {
+    total: resources.length,
+    counts: CLOUD_RESOURCE_TYPES.map((type) => ({
+      type,
+      count: resources.filter((resource) => resource.type === type).length,
+      byteSize: resources.filter((resource) => resource.type === type).reduce((sum, resource) => sum + (resource.byteSize || 0), 0)
+    })),
+    complete: inventory.complete,
+    gaps: inventory.gaps
+  };
+}
 function createCloudDataHandler(ctx) {
   async function run(url, headers, body, method) {
     const tenant = await ctx.tenantManager.resolveTenant(headers);
@@ -7748,17 +7977,7 @@ function createCloudDataHandler(ctx) {
         const filter = { ownerType, ownerId, type };
         if (path.endsWith("/summary")) {
           const inventory = await cloudInventory(ctx, db, userId, key);
-          const resources = inventory.entries.map((e) => e.resource);
-          data = {
-            total: resources.length,
-            counts: CLOUD_RESOURCE_TYPES.map((type2) => ({
-              type: type2,
-              count: resources.filter((r) => r.type === type2).length,
-              byteSize: resources.filter((r) => r.type === type2).reduce((sum, r) => sum + (r.byteSize || 0), 0)
-            })),
-            complete: inventory.complete,
-            gaps: inventory.gaps
-          };
+          data = inventorySummary(inventory);
         } else {
           const limit = Number(params.get("limit") || 50);
           if (!Number.isInteger(limit) || limit < 1 || limit > 200)
@@ -7790,6 +8009,7 @@ function createCloudDataHandler(ctx) {
             snapshot = {
               id: crypto.randomUUID(),
               filter,
+              summary: inventorySummary(inventory),
               expiresAt: Date.now() + 15 * 60 * 1e3,
               resources: inventory.entries.map((e) => e.resource).filter(
                 (r) => (!type || r.type === type) && (!ownerId || r.owner?.type === ownerType && r.owner.id === ownerId)
@@ -7806,6 +8026,7 @@ function createCloudDataHandler(ctx) {
           }
           data = {
             resources: snapshot.resources.slice(offset, offset + limit),
+            ...snapshot.summary ? { summary: snapshot.summary } : {},
             nextCursor: offset + limit < snapshot.resources.length ? `${snapshot.id}:${offset + limit}` : null,
             complete: snapshot.complete,
             gaps: snapshot.gaps
@@ -8150,7 +8371,7 @@ function createSingleUserServer(config) {
 }
 
 // src/server/lib/schema-version.js
-var SCHEMA_VERSION = "2.6.0-cloud-data.1";
+var SCHEMA_VERSION = "2.6.0-cloud-data.2";
 function requireIntrospection(db) {
   if (!db || typeof db.describeSchema !== "function") {
     throw new Error(
@@ -8178,6 +8399,12 @@ async function getSchemaVersion(db) {
   for (const index of SQLITE_REQUIRED_SCHEMA.indexes) {
     if (!liveIndexes.has(index)) missing.push(`index:${index}`);
   }
+  if (Array.isArray(live?.triggers)) {
+    const liveTriggers = new Set(live.triggers);
+    for (const name of SQLITE_REQUIRED_SCHEMA.triggers) {
+      if (!liveTriggers.has(name)) missing.push(`trigger:${name}`);
+    }
+  }
   const ok = missing.length === 0;
   return { current: ok ? SCHEMA_VERSION : null, required: SCHEMA_VERSION, ok, missing };
 }
@@ -8434,12 +8661,13 @@ function createSingleUserCloudflareWorker(buildConfig, options = {}) {
       await reportError({ stage: "config", error, cause, path: null });
       return { ok: false, cause };
     }
+    const cleanup = {};
     try {
       await resumeCloudDataCleanups(buildTickContext(cfg));
     } catch (error) {
-      const cause = summarizeErrorCause(error, "cloud-cleanup");
-      await reportError({ stage: "cloud-cleanup", error, cause, path: null });
-      return { ok: false, cause };
+      console.error("[amsg single-user] scheduled(): cloud cleanup failed:", error && error.message);
+      cleanup.cloudCleanupCause = summarizeErrorCause(error, "cloud-cleanup");
+      await reportError({ stage: "cloud-cleanup", error, cause: cleanup.cloudCleanupCause, path: null });
     }
     if (!pushConfigured(cfg)) {
       console.error("[amsg single-user] scheduled(): VAPID/webpush not configured; skipping tick");
@@ -8448,16 +8676,16 @@ function createSingleUserCloudflareWorker(buildConfig, options = {}) {
         "config"
       );
       await reportError({ stage: "config", error: null, cause, path: null });
-      return { ok: false, cause };
+      return { ok: false, cause, ...cleanup };
     }
     try {
       const summary = await runScheduledTick(buildTickContext(cfg));
-      return { ok: true, summary };
+      return { ok: true, summary, ...cleanup };
     } catch (error) {
       console.error("[amsg single-user] scheduled(): tick failed:", error && error.message);
       const cause = summarizeErrorCause(error, "tick");
       await reportError({ stage: "tick", error, cause, path: null });
-      return { ok: false, cause };
+      return { ok: false, cause, ...cleanup };
     }
   }
   async function runTask2(uuid, env) {