@rei-standard/amsg-server 2.6.0-next.8 → 3.0.0

package/dist/cloudflare/single-user-worker.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @param {(env: Object) => Object|Promise<Object>} buildConfig
+ * @param {{ onError?: (info: { stage: 'config'|'request'|'tick'|'cloud-cleanup', error: unknown, cause: import('../lib/errors.js').ErrorCause, path: string|null }) => void|Promise<void> }} [options]
+ *   `onError` 在 fetch 或 cron 出错时调一次（best-effort，自身抛错只记日志）。
+ *   cron 那条路上没有调用方能看到错误响应，这个 hook 是宿主唯一的出口。
+ */
+export function createSingleUserCloudflareWorker(buildConfig: (env: any) => any | Promise<any>, options?: {
+    onError?: (info: {
+        stage: "config" | "request" | "tick" | "cloud-cleanup";
+        error: unknown;
+        cause: import("../lib/errors.js").ErrorCause;
+        path: string | null;
+    }) => void | Promise<void>;
+}): {
+    fetch: (request: any, env: any) => Promise<Response>;
+    scheduled: (event: any, env: any) => Promise<{
+        ok: true;
+        summary: any;
+        cloudCleanupCause?: import("../lib/errors.js").ErrorCause;
+    } | {
+        ok: false;
+        cause: import("../lib/errors.js").ErrorCause;
+        cloudCleanupCause?: import("../lib/errors.js").ErrorCause;
+    }>;
+    runTask: (uuid: string, env: any) => Promise<{
+        ran: false;
+        reason: "not_configured" | "not_found" | "already_settled" | "not_due" | "retry_pending";
+        status?: string;
+        nextSendAt?: string;
+        retryAfter?: string;
+    } | {
+        ran: true;
+        summary: any;
+    }>;
+    getSchemaVersion: (env: any) => Promise<import("../lib/schema-version.js").SchemaVersionResult>;
+    ensureSchema: (env: any) => Promise<import("../lib/schema-version.js").EnsureSchemaResult>;
+};
+export const CORS_ALLOW_HEADERS: "Content-Type, Content-Encoding, X-User-Id, X-Payload-Encrypted, X-Encryption-Version, X-Response-Encrypted, X-Client-Token";
+export const CORS_ALLOW_METHODS: "GET, POST, PUT, DELETE, OPTIONS";

package/dist/cloudflare.cjs

@@ -12,7 +12,6 @@
 
 
 
-var _chunkHQHRXSQAcjs = require('./chunk-HQHRXSQA.cjs');
 
 
 
@@ -27,4 +26,38 @@ var _chunkHQHRXSQAcjs = require('./chunk-HQHRXSQA.cjs');
 
 
 
-exports.MAX_PUSH_PAYLOAD_BYTES = _chunkHQHRXSQAcjs.MAX_PUSH_PAYLOAD_BYTES; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = _chunkHQHRXSQAcjs.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.WEB_PUSH_MAX_BODY_BYTES = _chunkHQHRXSQAcjs.WEB_PUSH_MAX_BODY_BYTES; exports.createD1Adapter = _chunkHQHRXSQAcjs.createD1Adapter; exports.createSingleUserCloudflareWorker = _chunkHQHRXSQAcjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkHQHRXSQAcjs.createSingleUserServer; exports.createWebCryptoWebPush = _chunkHQHRXSQAcjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkHQHRXSQAcjs.decryptFromStorage; exports.decryptPayload = _chunkHQHRXSQAcjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkHQHRXSQAcjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkHQHRXSQAcjs.encryptForStorage; exports.measurePushPayload = _chunkHQHRXSQAcjs.measurePushPayload; exports.runScheduledTick = _chunkHQHRXSQAcjs.runScheduledTick;
+
+
+var _chunkYBDQJVFQcjs = require('./chunk-YBDQJVFQ.cjs');
+require('./chunk-7NMQFTDJ.cjs');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.DEFAULT_MAX_DELIVERY_RETRIES = _chunkYBDQJVFQcjs.DEFAULT_MAX_DELIVERY_RETRIES; exports.DEFAULT_MAX_REQUEST_BODY_BYTES = _chunkYBDQJVFQcjs.DEFAULT_MAX_REQUEST_BODY_BYTES; exports.MAX_DEFER_AFTER_MS = _chunkYBDQJVFQcjs.MAX_DEFER_AFTER_MS; exports.MAX_PUSH_PAYLOAD_BYTES = _chunkYBDQJVFQcjs.MAX_PUSH_PAYLOAD_BYTES; exports.NonRetryableError = _chunkYBDQJVFQcjs.NonRetryableError; exports.PUSH_ENVELOPE_RESERVED_BYTES = _chunkYBDQJVFQcjs.PUSH_ENVELOPE_RESERVED_BYTES; exports.SCHEMA_VERSION = _chunkYBDQJVFQcjs.SCHEMA_VERSION; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = _chunkYBDQJVFQcjs.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.WEB_PUSH_MAX_BODY_BYTES = _chunkYBDQJVFQcjs.WEB_PUSH_MAX_BODY_BYTES; exports.advanceOccurrence = _chunkYBDQJVFQcjs.advanceOccurrence; exports.createD1Adapter = _chunkYBDQJVFQcjs.createD1Adapter; exports.createSingleUserCloudflareWorker = _chunkYBDQJVFQcjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkYBDQJVFQcjs.createSingleUserServer; exports.createWebCryptoWebPush = _chunkYBDQJVFQcjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkYBDQJVFQcjs.decryptFromStorage; exports.decryptPayload = _chunkYBDQJVFQcjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkYBDQJVFQcjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkYBDQJVFQcjs.encryptForStorage; exports.ensureSchema = _chunkYBDQJVFQcjs.ensureSchema; exports.getSchemaVersion = _chunkYBDQJVFQcjs.getSchemaVersion; exports.isNonRetryableError = _chunkYBDQJVFQcjs.isNonRetryableError; exports.isValidTimeZoneId = _chunkYBDQJVFQcjs.isValidTimeZoneId; exports.measurePushPayload = _chunkYBDQJVFQcjs.measurePushPayload; exports.nextFutureOccurrence = _chunkYBDQJVFQcjs.nextFutureOccurrence; exports.planNextOccurrence = _chunkYBDQJVFQcjs.planNextOccurrence; exports.readRequestBody = _chunkYBDQJVFQcjs.readRequestBody; exports.runScheduledTick = _chunkYBDQJVFQcjs.runScheduledTick; exports.runTask = _chunkYBDQJVFQcjs.runTask; exports.summarizeErrorCause = _chunkYBDQJVFQcjs.summarizeErrorCause;

package/dist/cloudflare.d.ts

@@ -1,2 +1,11 @@
-export { M as MAX_PUSH_PAYLOAD_BYTES, W as WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES, f as WEB_PUSH_MAX_BODY_BYTES, h as createD1Adapter, j as createSingleUserCloudflareWorker, k as createSingleUserServer, l as createWebCryptoWebPush, m as decryptFromStorage, n as decryptPayload, o as deriveUserEncryptionKey, q as encryptForStorage, v as measurePushPayload, r as runScheduledTick } from './cloudflare-CH3dBl5b.js';
-import '@rei-standard/amsg-shared';
+export { createSingleUserCloudflareWorker } from "./cloudflare/single-user-worker.js";
+export { createSingleUserServer } from "./single-user.js";
+export { createD1Adapter } from "./adapters/d1.js";
+export { MAX_DEFER_AFTER_MS } from "./lib/agentic-fire.js";
+export { createWebCryptoWebPush, measurePushPayload, MAX_PUSH_PAYLOAD_BYTES, PUSH_ENVELOPE_RESERVED_BYTES, WEB_PUSH_MAX_BODY_BYTES, WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES } from "./lib/webpush-webcrypto.js";
+export { runScheduledTick, runTask, DEFAULT_MAX_DELIVERY_RETRIES } from "./lib/run-tick.js";
+export { getSchemaVersion, ensureSchema, SCHEMA_VERSION } from "./lib/schema-version.js";
+export { summarizeErrorCause, NonRetryableError, isNonRetryableError } from "./lib/errors.js";
+export { isValidTimeZoneId, advanceOccurrence, nextFutureOccurrence, planNextOccurrence } from "./lib/recurrence.js";
+export { readRequestBody, DEFAULT_MAX_REQUEST_BODY_BYTES } from "./lib/request.js";
+export { deriveUserEncryptionKey, decryptPayload, encryptForStorage, decryptFromStorage } from "./lib/encryption.js";

package/dist/cloudflare.mjs

@@ -1,7 +1,14 @@
 import {
+  DEFAULT_MAX_DELIVERY_RETRIES,
+  DEFAULT_MAX_REQUEST_BODY_BYTES,
+  MAX_DEFER_AFTER_MS,
   MAX_PUSH_PAYLOAD_BYTES,
+  NonRetryableError,
+  PUSH_ENVELOPE_RESERVED_BYTES,
+  SCHEMA_VERSION,
   WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES,
   WEB_PUSH_MAX_BODY_BYTES,
+  advanceOccurrence,
   createD1Adapter,
   createSingleUserCloudflareWorker,
   createSingleUserServer,
@@ -10,13 +17,30 @@ import {
   decryptPayload,
   deriveUserEncryptionKey,
   encryptForStorage,
+  ensureSchema,
+  getSchemaVersion,
+  isNonRetryableError,
+  isValidTimeZoneId,
   measurePushPayload,
-  runScheduledTick
-} from "./chunk-LEE5KQ7Y.mjs";
+  nextFutureOccurrence,
+  planNextOccurrence,
+  readRequestBody,
+  runScheduledTick,
+  runTask,
+  summarizeErrorCause
+} from "./chunk-RL7V7VSS.mjs";
+import "./chunk-GN44PST5.mjs";
 export {
+  DEFAULT_MAX_DELIVERY_RETRIES,
+  DEFAULT_MAX_REQUEST_BODY_BYTES,
+  MAX_DEFER_AFTER_MS,
   MAX_PUSH_PAYLOAD_BYTES,
+  NonRetryableError,
+  PUSH_ENVELOPE_RESERVED_BYTES,
+  SCHEMA_VERSION,
   WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES,
   WEB_PUSH_MAX_BODY_BYTES,
+  advanceOccurrence,
   createD1Adapter,
   createSingleUserCloudflareWorker,
   createSingleUserServer,
@@ -25,6 +49,15 @@ export {
   decryptPayload,
   deriveUserEncryptionKey,
   encryptForStorage,
+  ensureSchema,
+  getSchemaVersion,
+  isNonRetryableError,
+  isValidTimeZoneId,
   measurePushPayload,
-  runScheduledTick
+  nextFutureOccurrence,
+  planNextOccurrence,
+  readRequestBody,
+  runScheduledTick,
+  runTask,
+  summarizeErrorCause
 };

package/dist/handlers/cancel-message.d.ts

@@ -0,0 +1,3 @@
+export function createCancelMessageHandler(ctx: any): {
+    DELETE: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/capabilities.d.ts

@@ -0,0 +1,4 @@
+export function createCapabilitiesHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+};
+export const SERVER_FEATURES: readonly string[];

package/dist/handlers/client-state-namespaces.d.ts

@@ -0,0 +1,5 @@
+export function createClientStateNamespacesHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+};
+/** 一次最多列几个命名空间（也是 `limit` 的上限）。 */
+export const MAX_CLIENT_STATE_NAMESPACES: 200;

package/dist/handlers/client-state.d.ts

@@ -0,0 +1,7 @@
+export function createClientStateHandler(ctx: any): {
+    PUT: (headers: any, body: any) => Promise<any>;
+    GET: (url: any, headers: any) => Promise<any>;
+    DELETE: (url: any, headers: any) => Promise<any>;
+};
+export const MAX_STATE_VALUE_BYTES: number;
+export const MAX_STATE_ENTRIES_PER_REQUEST: 200;

package/dist/handlers/cloud-data.d.ts

@@ -0,0 +1,4 @@
+export function createCloudDataHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+    POST: (url: any, headers: any, body: any) => Promise<any>;
+};

package/dist/handlers/get-message.d.ts

@@ -0,0 +1,3 @@
+export function createGetMessageHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/get-user-key.d.ts

@@ -0,0 +1,3 @@
+export function createGetUserKeyHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/init-tenant.d.ts

@@ -0,0 +1,23 @@
+export function createInitTenantHandler(ctx: any): {
+    POST: (headers: any, body: any) => Promise<{
+        status: number;
+        body: {
+            success: boolean;
+            error: any;
+            data?: undefined;
+        };
+    } | {
+        status: number;
+        body: {
+            success: boolean;
+            data: {
+                tenantId: any;
+                tenantToken: any;
+                cronToken: any;
+                cronWebhookUrl: any;
+                masterKeyFingerprint: any;
+            };
+            error?: undefined;
+        };
+    }>;
+};

package/dist/handlers/llm-credentials.d.ts

@@ -0,0 +1,5 @@
+export function createLlmCredentialsHandler(ctx: any): {
+    PUT: (headers: any, body: any) => Promise<any>;
+    GET: (url: any, headers: any) => Promise<any>;
+    DELETE: (url: any, headers: any, body: any) => Promise<any>;
+};

package/dist/handlers/messages.d.ts

@@ -0,0 +1,3 @@
+export function createMessagesHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/outbox.d.ts

@@ -0,0 +1,9 @@
+export function createOutboxHandler(ctx: any): {
+    GET: (url: any, headers: any) => Promise<any>;
+    POST: (headers: any, body: any) => Promise<any>;
+    DELETE: (url: any, headers: any, body: any) => Promise<any>;
+};
+export const MAX_OUTBOX_PAGE_SIZE: 100;
+export const DEFAULT_OUTBOX_PAGE_SIZE: 50;
+export const MAX_OUTBOX_ACK_IDS: 200;
+export const MAX_OUTBOX_DELETE_IDS: 200;

package/dist/handlers/push-subscription.d.ts

@@ -0,0 +1,5 @@
+export function createPushSubscriptionHandler(ctx: any): {
+    PUT: (headers: any, body: any) => Promise<any>;
+    GET: (url: any, headers: any) => Promise<any>;
+    DELETE: (url: any, headers: any) => Promise<any>;
+};

package/dist/handlers/schedule-message.d.ts

@@ -0,0 +1,3 @@
+export function createScheduleMessageHandler(ctx: any): {
+    POST: (headers: any, body: any) => Promise<any>;
+};

package/dist/handlers/send-notifications.d.ts

@@ -0,0 +1,3 @@
+export function createSendNotificationsHandler(ctx: any): {
+    POST: (urlOrHeaders: any, maybeHeaders: any) => Promise<any>;
+};

package/dist/handlers/single-user-init.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Handler: single-user-init
+ *
+ * Idempotent "just create the tables" endpoint for single-user deployments
+ * (the degenerate form of init-tenant). Reuses resolveTenant purely to enforce
+ * the optional shared secret, then runs initSchema. Issues no token.
+ *
+ * @param {Object} ctx - Single-user server context (ctx.tenantManager).
+ * @returns {{ POST: function }}
+ */
+export function createSingleUserInitHandler(ctx: any): {
+    POST: Function;
+};

package/dist/handlers/update-message.d.ts

@@ -0,0 +1,3 @@
+export function createUpdateMessageHandler(ctx: any): {
+    PUT: (url: any, headers: any, body: any) => Promise<any>;
+};

package/dist/handlers/vapid-public-key.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Handler: vapid-public-key
+ *
+ * Exposes this worker's own VAPID public key so a browser frontend can build a
+ * Web Push subscription (`applicationServerKey`) at runtime. Each self-hosted
+ * worker owns its keypair, so the key can't be baked into the frontend — it
+ * pulls it from here.
+ *
+ * Auth funnels through the same resolveTenant as every other endpoint, so with
+ * a serverToken configured this route requires `X-Client-Token` too (the
+ * all-or-nothing contract). The public key itself is not a secret; gating it
+ * just keeps every endpoint consistent.
+ *
+ * @param {Object} ctx - Server context ({ vapid, tenantManager, ... }).
+ * @returns {{ GET: function }}
+ */
+export function createVapidPublicKeyHandler(ctx: any): {
+    GET: Function;
+};

package/dist/index.cjs

@@ -27,7 +27,54 @@
 
 
 
-var _chunkHQHRXSQAcjs = require('./chunk-HQHRXSQA.cjs');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+var _chunkYBDQJVFQcjs = require('./chunk-YBDQJVFQ.cjs');
+require('./chunk-7NMQFTDJ.cjs');
 
 // src/server/adapters/factory.js
 async function createAdapter(config) {
@@ -43,11 +90,11 @@ async function createAdapter(config) {
   }
   switch (config.driver) {
     case "neon": {
-      const { NeonAdapter } = await Promise.resolve().then(() => _interopRequireWildcard(require("./neon-V4VOH55N.cjs")));
+      const { NeonAdapter } = await Promise.resolve().then(() => _interopRequireWildcard(require("./neon-XHPJZESV.cjs")));
       return new NeonAdapter(config.connectionString);
     }
     case "pg": {
-      const { PgAdapter } = await Promise.resolve().then(() => _interopRequireWildcard(require("./pg-6X74HKMX.cjs")));
+      const { PgAdapter } = await Promise.resolve().then(() => _interopRequireWildcard(require("./pg-FHXQ6BJP.cjs")));
       return new PgAdapter(config.connectionString);
     }
     default:
@@ -60,7 +107,7 @@ async function createAdapter(config) {
 // src/server/handlers/init-tenant.js
 function createInitTenantHandler(ctx) {
   async function POST(headers, body) {
-    const initSecret = _chunkHQHRXSQAcjs.getHeader.call(void 0, headers, "x-init-secret");
+    const initSecret = _chunkYBDQJVFQcjs.getHeader.call(void 0, headers, "x-init-secret");
     if (ctx.tenant.initSecret && initSecret !== ctx.tenant.initSecret) {
       return {
         status: 401,
@@ -73,7 +120,7 @@ function createInitTenantHandler(ctx) {
         }
       };
     }
-    const parsed = _chunkHQHRXSQAcjs.parseJsonBody.call(void 0, body);
+    const parsed = _chunkYBDQJVFQcjs.parseJsonBody.call(void 0, body);
     if (!parsed.ok) {
       return {
         status: 400,
@@ -87,7 +134,7 @@ function createInitTenantHandler(ctx) {
     const tenantId = payload.tenantId || void 0;
     const driver = payload.driver;
     const databaseUrl = payload.databaseUrl || payload.connectionString;
-    if (tenantId && !_chunkHQHRXSQAcjs.isValidUUIDv4.call(void 0, tenantId)) {
+    if (tenantId && !_chunkYBDQJVFQcjs.isValidUUIDv4.call(void 0, tenantId)) {
       return {
         status: 400,
         body: {
@@ -207,7 +254,7 @@ function createSendNotificationsHandler(ctx) {
         }
       };
     }
-    const data = await _chunkHQHRXSQAcjs.runScheduledTick.call(void 0, { ...ctx, db, masterKey });
+    const data = await _chunkYBDQJVFQcjs.runScheduledTick.call(void 0, { ...ctx, db, masterKey });
     return { status: 200, body: { success: true, data } };
   }
   return { POST };
@@ -216,14 +263,6 @@ function createSendNotificationsHandler(ctx) {
 // src/server/tenant/blob-store.js
 var _crypto = require('crypto');
 var inMemoryNamespaces = /* @__PURE__ */ new Map();
-function base64UrlEncode(input) {
-  return Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function base64UrlDecode(input) {
-  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padLength = (4 - normalized.length % 4) % 4;
-  return Buffer.from(normalized + "=".repeat(padLength), "base64");
-}
 function getKekBuffer(kek) {
   const value = String(kek || "").trim();
   if (!value) {
@@ -237,16 +276,16 @@ function encryptConfig(config, kekBuffer) {
   const plaintext = Buffer.from(JSON.stringify(config), "utf8");
   const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   const authTag = cipher.getAuthTag();
-  return `v1.${base64UrlEncode(iv)}.${base64UrlEncode(authTag)}.${base64UrlEncode(ciphertext)}`;
+  return `v1.${_chunkYBDQJVFQcjs.bytesToBase64Url.call(void 0, iv)}.${_chunkYBDQJVFQcjs.bytesToBase64Url.call(void 0, authTag)}.${_chunkYBDQJVFQcjs.bytesToBase64Url.call(void 0, ciphertext)}`;
 }
 function decryptConfig(encrypted, kekBuffer) {
   const parts = String(encrypted || "").split(".");
   if (parts.length !== 4 || parts[0] !== "v1") {
     throw new Error("INVALID_TENANT_CONFIG");
   }
-  const iv = base64UrlDecode(parts[1]);
-  const authTag = base64UrlDecode(parts[2]);
-  const ciphertext = base64UrlDecode(parts[3]);
+  const iv = _chunkYBDQJVFQcjs.base64UrlToBytes.call(void 0, parts[1]);
+  const authTag = _chunkYBDQJVFQcjs.base64UrlToBytes.call(void 0, parts[2]);
+  const ciphertext = _chunkYBDQJVFQcjs.base64UrlToBytes.call(void 0, parts[3]);
   const decipher = _crypto.createDecipheriv.call(void 0, "aes-256-gcm", kekBuffer, iv);
   decipher.setAuthTag(authTag);
   const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
@@ -313,16 +352,8 @@ function createTenantBlobStore(options) {
 
 // src/server/tenant/token.js
 
-function base64UrlEncode2(input) {
-  return Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function base64UrlDecode2(input) {
-  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padLength = (4 - normalized.length % 4) % 4;
-  return Buffer.from(normalized + "=".repeat(padLength), "base64");
-}
 function sign(input, secret) {
-  return base64UrlEncode2(_crypto.createHmac.call(void 0, "sha256", secret).update(input).digest());
+  return _chunkYBDQJVFQcjs.bytesToBase64Url.call(void 0, _crypto.createHmac.call(void 0, "sha256", secret).update(input).digest());
 }
 function nowEpochSeconds() {
   return Math.floor(Date.now() / 1e3);
@@ -338,8 +369,8 @@ function createTenantToken(params, secret) {
     v: 1
   };
   const header = { alg: "HS256", typ: "JWT" };
-  const encodedHeader = base64UrlEncode2(JSON.stringify(header));
-  const encodedPayload = base64UrlEncode2(JSON.stringify(payload));
+  const encodedHeader = _chunkYBDQJVFQcjs.bytesToBase64Url.call(void 0, _chunkYBDQJVFQcjs.utf8.call(void 0, JSON.stringify(header)));
+  const encodedPayload = _chunkYBDQJVFQcjs.bytesToBase64Url.call(void 0, _chunkYBDQJVFQcjs.utf8.call(void 0, JSON.stringify(payload)));
   const signingInput = `${encodedHeader}.${encodedPayload}`;
   const signature = sign(signingInput, secret);
   return `${signingInput}.${signature}`;
@@ -355,20 +386,20 @@ function verifyTenantToken(token, secret, options = {}) {
   const [encodedHeader, encodedPayload, receivedSignature] = parts;
   const signingInput = `${encodedHeader}.${encodedPayload}`;
   const expectedSignature = sign(signingInput, secret);
-  let receivedBuffer;
-  let expectedBuffer;
+  let receivedBytes;
+  let expectedBytes;
   try {
-    receivedBuffer = base64UrlDecode2(receivedSignature);
-    expectedBuffer = base64UrlDecode2(expectedSignature);
+    receivedBytes = _chunkYBDQJVFQcjs.base64UrlToBytes.call(void 0, receivedSignature);
+    expectedBytes = _chunkYBDQJVFQcjs.base64UrlToBytes.call(void 0, expectedSignature);
   } catch (e) {
     throw new Error("INVALID_TENANT_AUTH");
   }
-  if (receivedBuffer.length !== expectedBuffer.length || !_crypto.timingSafeEqual.call(void 0, receivedBuffer, expectedBuffer)) {
+  if (!_chunkYBDQJVFQcjs.timingSafeEqualBytes.call(void 0, receivedBytes, expectedBytes)) {
     throw new Error("INVALID_TENANT_AUTH");
   }
   let payload;
   try {
-    payload = JSON.parse(base64UrlDecode2(encodedPayload).toString("utf8"));
+    payload = JSON.parse(_chunkYBDQJVFQcjs.utf8Decode.call(void 0, _chunkYBDQJVFQcjs.base64UrlToBytes.call(void 0, encodedPayload)));
   } catch (e2) {
     throw new Error("INVALID_TENANT_AUTH");
   }
@@ -442,8 +473,17 @@ function createTenantContextManager(options) {
   async function getOrCreateAdapter(dbConfig) {
     const cacheKey = `${dbConfig.driver}:${dbConfig.connectionString}`;
     if (!adapterCache.has(cacheKey)) {
-      const adapter = await adapterFactory(dbConfig);
-      adapterCache.set(cacheKey, adapter);
+      const created = (async () => {
+        const adapter = await adapterFactory(dbConfig);
+        if (typeof adapter.initSchema === "function") {
+          await adapter.initSchema();
+        }
+        return adapter;
+      })().catch((error) => {
+        adapterCache.delete(cacheKey);
+        throw error;
+      });
+      adapterCache.set(cacheKey, created);
     }
     return adapterCache.get(cacheKey);
   }
@@ -571,6 +611,14 @@ async function createReiServer(config) {
       privateKey: vapid.privateKey || ""
     },
     webpush: webpushModule,
+    // 分片传输的限额（与 installReiSW 的 multipart 同一份）。instant 消息在
+    // schedule-message 里就地投递、定时消息走 send-notifications 的 tick，两条路
+    // 都从这个 ctx 展开，所以配一次两边都认。
+    multipart: config.multipart || null,
+    // 定时任务投递失败后的重试次数上限（默认 3），send-notifications 展开 ctx
+    // 时带进 runScheduledTick。
+    maxGenerationRetries: config.maxGenerationRetries,
+    maxDeliveryRetries: config.maxDeliveryRetries,
     tenant: {
       initSecret
     },
@@ -579,12 +627,15 @@ async function createReiServer(config) {
   return {
     handlers: {
       initTenant: createInitTenantHandler(ctx),
-      getUserKey: _chunkHQHRXSQAcjs.createGetUserKeyHandler.call(void 0, ctx),
-      scheduleMessage: _chunkHQHRXSQAcjs.createScheduleMessageHandler.call(void 0, ctx),
+      getUserKey: _chunkYBDQJVFQcjs.createGetUserKeyHandler.call(void 0, ctx),
+      scheduleMessage: _chunkYBDQJVFQcjs.createScheduleMessageHandler.call(void 0, ctx),
       sendNotifications: createSendNotificationsHandler(ctx),
-      updateMessage: _chunkHQHRXSQAcjs.createUpdateMessageHandler.call(void 0, ctx),
-      cancelMessage: _chunkHQHRXSQAcjs.createCancelMessageHandler.call(void 0, ctx),
-      messages: _chunkHQHRXSQAcjs.createMessagesHandler.call(void 0, ctx)
+      updateMessage: _chunkYBDQJVFQcjs.createUpdateMessageHandler.call(void 0, ctx),
+      cancelMessage: _chunkYBDQJVFQcjs.createCancelMessageHandler.call(void 0, ctx),
+      messages: _chunkYBDQJVFQcjs.createMessagesHandler.call(void 0, ctx),
+      getMessage: _chunkYBDQJVFQcjs.createGetMessageHandler.call(void 0, ctx),
+      pushSubscription: _chunkYBDQJVFQcjs.createPushSubscriptionHandler.call(void 0, ctx),
+      llmCredentials: _chunkYBDQJVFQcjs.createLlmCredentialsHandler.call(void 0, ctx)
     }
   };
 }
@@ -614,4 +665,42 @@ async function createReiServer(config) {
 
 
 
-exports.MAX_PUSH_PAYLOAD_BYTES = _chunkHQHRXSQAcjs.MAX_PUSH_PAYLOAD_BYTES; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = _chunkHQHRXSQAcjs.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.WEB_PUSH_MAX_BODY_BYTES = _chunkHQHRXSQAcjs.WEB_PUSH_MAX_BODY_BYTES; exports.createAdapter = createAdapter; exports.createD1Adapter = _chunkHQHRXSQAcjs.createD1Adapter; exports.createReiServer = createReiServer; exports.createSingleUserCloudflareWorker = _chunkHQHRXSQAcjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkHQHRXSQAcjs.createSingleUserServer; exports.createTenantToken = createTenantToken; exports.createWebCryptoWebPush = _chunkHQHRXSQAcjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkHQHRXSQAcjs.decryptFromStorage; exports.decryptPayload = _chunkHQHRXSQAcjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkHQHRXSQAcjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkHQHRXSQAcjs.encryptForStorage; exports.isValidISO8601 = _chunkHQHRXSQAcjs.isValidISO8601; exports.isValidUUID = _chunkHQHRXSQAcjs.isValidUUID; exports.isValidUUIDv4 = _chunkHQHRXSQAcjs.isValidUUIDv4; exports.isValidUrl = _chunkHQHRXSQAcjs.isValidUrl; exports.measurePushPayload = _chunkHQHRXSQAcjs.measurePushPayload; exports.runScheduledTick = _chunkHQHRXSQAcjs.runScheduledTick; exports.validateAvatarUrl = _chunkHQHRXSQAcjs.validateAvatarUrl; exports.validateLlmMessagesArray = _chunkHQHRXSQAcjs.validateLlmMessagesArray; exports.validateScheduleMessagePayload = _chunkHQHRXSQAcjs.validateScheduleMessagePayload; exports.validateSplitPattern = _chunkHQHRXSQAcjs.validateSplitPattern; exports.verifyTenantToken = verifyTenantToken;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.CORS_ALLOW_HEADERS = _chunkYBDQJVFQcjs.CORS_ALLOW_HEADERS; exports.CORS_ALLOW_METHODS = _chunkYBDQJVFQcjs.CORS_ALLOW_METHODS; exports.CRED_ID_MAX_LENGTH = _chunkYBDQJVFQcjs.CRED_ID_MAX_LENGTH; exports.CRED_PUT_BATCH_MAX = _chunkYBDQJVFQcjs.CRED_PUT_BATCH_MAX; exports.CRED_REFS_MAX_ENTRIES = _chunkYBDQJVFQcjs.CRED_REFS_MAX_ENTRIES; exports.CRED_ROWS_PER_USER_MAX = _chunkYBDQJVFQcjs.CRED_ROWS_PER_USER_MAX; exports.DEFAULT_CLAIM_LEASE_MS = _chunkYBDQJVFQcjs.DEFAULT_CLAIM_LEASE_MS; exports.DEFAULT_HEARTBEAT_LEASE_TTL_MS = _chunkYBDQJVFQcjs.DEFAULT_HEARTBEAT_LEASE_TTL_MS; exports.DEFAULT_LEASE_HEARTBEAT_MS = _chunkYBDQJVFQcjs.DEFAULT_LEASE_HEARTBEAT_MS; exports.DEFAULT_MAX_DELIVERY_RETRIES = _chunkYBDQJVFQcjs.DEFAULT_MAX_DELIVERY_RETRIES; exports.DEFAULT_MAX_REQUEST_BODY_BYTES = _chunkYBDQJVFQcjs.DEFAULT_MAX_REQUEST_BODY_BYTES; exports.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE = _chunkYBDQJVFQcjs.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE; exports.DEFAULT_MAX_TOOL_ITERATIONS = _chunkYBDQJVFQcjs.DEFAULT_MAX_TOOL_ITERATIONS; exports.DEFAULT_TOTAL_TIMEOUT_MS = _chunkYBDQJVFQcjs.DEFAULT_TOTAL_TIMEOUT_MS; exports.DeploymentConfigError = _chunkYBDQJVFQcjs.DeploymentConfigError; exports.MAX_DEFER_AFTER_MS = _chunkYBDQJVFQcjs.MAX_DEFER_AFTER_MS; exports.MAX_PUSH_PAYLOAD_BYTES = _chunkYBDQJVFQcjs.MAX_PUSH_PAYLOAD_BYTES; exports.MAX_TASK_PAYLOAD_BYTES = _chunkYBDQJVFQcjs.MAX_TASK_PAYLOAD_BYTES; exports.MIN_SCHEDULE_LEAD_MS = _chunkYBDQJVFQcjs.MIN_SCHEDULE_LEAD_MS; exports.NonRetryableError = _chunkYBDQJVFQcjs.NonRetryableError; exports.PUSH_ENVELOPE_RESERVED_BYTES = _chunkYBDQJVFQcjs.PUSH_ENVELOPE_RESERVED_BYTES; exports.SCHEMA_VERSION = _chunkYBDQJVFQcjs.SCHEMA_VERSION; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = _chunkYBDQJVFQcjs.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.WEB_PUSH_MAX_BODY_BYTES = _chunkYBDQJVFQcjs.WEB_PUSH_MAX_BODY_BYTES; exports.advanceOccurrence = _chunkYBDQJVFQcjs.advanceOccurrence; exports.createAdapter = createAdapter; exports.createD1Adapter = _chunkYBDQJVFQcjs.createD1Adapter; exports.createReiServer = createReiServer; exports.createSingleUserCloudflareWorker = _chunkYBDQJVFQcjs.createSingleUserCloudflareWorker; exports.createSingleUserServer = _chunkYBDQJVFQcjs.createSingleUserServer; exports.createTenantToken = createTenantToken; exports.createWebCryptoWebPush = _chunkYBDQJVFQcjs.createWebCryptoWebPush; exports.decryptFromStorage = _chunkYBDQJVFQcjs.decryptFromStorage; exports.decryptPayload = _chunkYBDQJVFQcjs.decryptPayload; exports.deriveUserEncryptionKey = _chunkYBDQJVFQcjs.deriveUserEncryptionKey; exports.encryptForStorage = _chunkYBDQJVFQcjs.encryptForStorage; exports.ensureSchema = _chunkYBDQJVFQcjs.ensureSchema; exports.getSchemaVersion = _chunkYBDQJVFQcjs.getSchemaVersion; exports.hasChatCredRef = _chunkYBDQJVFQcjs.hasChatCredRef; exports.isNonRetryableError = _chunkYBDQJVFQcjs.isNonRetryableError; exports.isValidCredId = _chunkYBDQJVFQcjs.isValidCredId; exports.isValidISO8601 = _chunkYBDQJVFQcjs.isValidISO8601; exports.isValidTimeZoneId = _chunkYBDQJVFQcjs.isValidTimeZoneId; exports.isValidUUID = _chunkYBDQJVFQcjs.isValidUUID; exports.isValidUUIDv4 = _chunkYBDQJVFQcjs.isValidUUIDv4; exports.isValidUrl = _chunkYBDQJVFQcjs.isValidUrl; exports.measurePushPayload = _chunkYBDQJVFQcjs.measurePushPayload; exports.nextFutureOccurrence = _chunkYBDQJVFQcjs.nextFutureOccurrence; exports.planNextOccurrence = _chunkYBDQJVFQcjs.planNextOccurrence; exports.readRequestBody = _chunkYBDQJVFQcjs.readRequestBody; exports.resolveLlmCredential = _chunkYBDQJVFQcjs.resolveLlmCredential; exports.runScheduledTick = _chunkYBDQJVFQcjs.runScheduledTick; exports.runTask = _chunkYBDQJVFQcjs.runTask; exports.sanitizeErrorSummary = _chunkYBDQJVFQcjs.sanitizeErrorSummary; exports.summarizeErrorCause = _chunkYBDQJVFQcjs.summarizeErrorCause; exports.supportsLlmCredentialsStore = _chunkYBDQJVFQcjs.supportsLlmCredentialsStore; exports.validateAvatarUrl = _chunkYBDQJVFQcjs.validateAvatarUrl; exports.validateCredRefs = _chunkYBDQJVFQcjs.validateCredRefs; exports.validateCredValue = _chunkYBDQJVFQcjs.validateCredValue; exports.validateLlmMessagesArray = _chunkYBDQJVFQcjs.validateLlmMessagesArray; exports.validateScheduleMessagePayload = _chunkYBDQJVFQcjs.validateScheduleMessagePayload; exports.validateSplitPattern = _chunkYBDQJVFQcjs.validateSplitPattern; exports.verifyTenantToken = verifyTenantToken;