@rei-standard/amsg-server 3.0.0 → 3.1.0-next.0

package/dist/{chunk-YBDQJVFQ.cjs → chunk-3NIYNYZY.cjs}

@@ -428,6 +428,9 @@ function taskPayloadByteLength(serializedPayload) {
   return taskPayloadEncoder.encode(serializedPayload).length;
 }
 function validateScheduleMessagePayload(payload) {
+  if (payload.taskInput != null && (typeof payload.taskInput !== "object" || Array.isArray(payload.taskInput))) {
+    return { valid: false, errorCode: "INVALID_TASK_INPUT", errorMessage: "taskInput must be an object or null" };
+  }
   if (!payload.contactName || typeof payload.contactName !== "string") {
     return { valid: false, errorCode: "INVALID_PARAMETERS", errorMessage: "\u7F3A\u5C11\u5FC5\u9700\u53C2\u6570\u6216\u53C2\u6570\u683C\u5F0F\u9519\u8BEF", details: { missingFields: ["contactName"] } };
   }
@@ -982,6 +985,40 @@ function createWebCryptoWebPush(vapid = {}, { ttl = SCHEDULED_DEFAULT_TTL } = {}
   };
 }
 
+// src/server/lib/attachments.js
+var ATTACHMENT_NAMESPACE = "amsg:attachments";
+var ATTACHMENT_RETENTION_DAYS = 30;
+var MAX_ATTACHMENT_TTL_MS = ATTACHMENT_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+function createAttachmentStore({ task, occurrenceMs, writeState, now }) {
+  return async function storeAttachment(value, { ttlMs = MAX_ATTACHMENT_TTL_MS, owner, kind = "attachment", ownerGeneration } = {}) {
+    if (typeof value !== "string") throw new TypeError("storeAttachment value must be a serialized string");
+    if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_ATTACHMENT_TTL_MS) {
+      throw new RangeError("storeAttachment ttlMs must be between 1 millisecond and 30 days");
+    }
+    if (typeof task.uuid !== "string" || !task.uuid || !Number.isFinite(occurrenceMs)) {
+      throw new TypeError("storeAttachment requires a task UUID and a valid occurrence");
+    }
+    const at = now();
+    const ref = { version: (
+      /** @type {1} */
+      1
+    ), namespace: ATTACHMENT_NAMESPACE, key: _amsgshared.randomUUID.call(void 0, ), taskUuid: task.uuid, occurrenceMs, expiresAt: at + ttlMs };
+    let result;
+    try {
+      result = await writeState(ATTACHMENT_NAMESPACE, [{ key: ref.key, value: JSON.stringify({ ...ref, owner, kind, ownerGeneration, value }), updatedAt: at, owner, kind, ownerGeneration }]);
+    } catch (error) {
+      if (_optionalChain([error, 'optionalAccess', _5 => _5.code]) === "AGENTIC_STATE_WRITE_UNSUPPORTED") {
+        throw new DeploymentConfigError("ATTACHMENT_STORAGE_UNSUPPORTED: attachments require a client_state adapter (built-in support: D1)", { code: "ATTACHMENT_STORAGE_UNSUPPORTED" });
+      }
+      throw error;
+    }
+    if (result.upserted !== 1 || result.skipped !== 0) {
+      throw new Error("ATTACHMENT_WRITE_INCOMPLETE: attachment was not stored");
+    }
+    return ref;
+  };
+}
+
 // src/server/lib/agentic-fire.js
 
 
@@ -1192,6 +1229,7 @@ async function writeClientStateEntries({ db, userId, userKey, entries, now }) {
   let upserted = 0;
   let skipped = 0;
   let deleted = 0;
+  let unknown = 0;
   const skippedEntries = [];
   if (Array.isArray(result.outcomes) && result.outcomes.length === physicalRows.length) {
     for (let i = 0; i < rootRowIndexes.length; i++) {
@@ -1203,9 +1241,10 @@ async function writeClientStateEntries({ db, userId, userKey, entries, now }) {
         skippedEntries.push({ namespace: entry.namespace, key: entry.key });
       }
     }
+  } else if (result.upserted === physicalRows.length && result.skipped === 0) {
+    upserted = rootRowIndexes.length;
   } else {
-    upserted = result.upserted;
-    skipped = result.skipped;
+    unknown = rootRowIndexes.length;
   }
   const cleanupOutcomes = Array.isArray(result.cleanupOutcomes) && result.cleanupOutcomes.length === cleanups.length ? result.cleanupOutcomes : null;
   for (const { cleanupIndex, entry } of deletions) {
@@ -1216,22 +1255,26 @@ async function writeClientStateEntries({ db, userId, userKey, entries, now }) {
       deleted++;
     }
   }
-  return { upserted, skipped, deleted, skippedEntries };
+  return { upserted, skipped, deleted, skippedEntries, ...unknown > 0 ? { unknown } : {} };
 }
 
 // src/server/lib/state-accessors.js
 function createStateAccessors({ db, userId, userKey, maxStateValueBytes, now }) {
   const nowFn = typeof now === "function" ? now : Date.now;
   const valueCeiling = Number.isInteger(maxStateValueBytes) && maxStateValueBytes > 0 ? maxStateValueBytes : DEFAULT_MAX_STATE_VALUE_BYTES;
-  const readState = async (namespace) => {
+  const readState = async (namespace, { key } = {}) => {
     if (typeof namespace !== "string" || !namespace.trim()) {
       throw new TypeError("readState(namespace) requires a non-empty string");
     }
+    if (key !== void 0 && (typeof key !== "string" || !key.trim() || key.length > MAX_KEY_CHARS || INTERNAL_STATE_CHAR_RE.test(key))) {
+      throw new TypeError(`readState key must be a non-empty string of at most ${MAX_KEY_CHARS} characters without control characters`);
+    }
     if (!db || typeof db.getClientState !== "function") return [];
-    const rows = await db.getClientState(userId, namespace);
+    const rows = await db.getClientState(userId, namespace, key === void 0 ? void 0 : { key });
     return resolveClientStateEntries(
-      rows,
-      () => db.getClientState(userId, chunkNamespaceFor(namespace)),
+      // 老适配器可能忽略第三个参数，仍在解密前过滤根行，保持返回契约。
+      key === void 0 ? rows : rows.filter((row) => row.key === key),
+      () => db.getClientState(userId, chunkNamespaceFor(namespace), key === void 0 ? void 0 : { keyPrefix: chunkKeyPrefixFor(key) }),
       (value) => decryptFromStorage(value, userKey)
     );
   };
@@ -1287,6 +1330,9 @@ function createStateAccessors({ db, userId, userKey, maxStateValueBytes, now })
         namespace,
         key: entry.key,
         value: entry.value,
+        owner: entry.owner,
+        kind: entry.kind,
+        ownerGeneration: entry.ownerGeneration,
         updatedAt: _nullishCoalesce(entry.updatedAt, () => ( at)),
         ...entry.version !== void 0 ? { version: entry.version } : {}
       };
@@ -1309,7 +1355,7 @@ async function appendPushesToOutbox({ db, userId, userKey, pushes }) {
     await db.appendOutboxMessages(userId, await toOutboxRows(pushes, userKey, Date.now()));
     return true;
   } catch (error) {
-    if (_optionalChain([error, 'optionalAccess', _5 => _5.code]) === "CLOUD_OWNER_RETIRED") throw error;
+    if (_optionalChain([error, 'optionalAccess', _6 => _6.code]) === "CLOUD_OWNER_RETIRED") throw error;
     console.warn("[amsg-server] outbox \u843D\u884C\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u6295\u9012\uFF09:", error && error.message);
     return false;
   }
@@ -1583,7 +1629,7 @@ async function sendResultPush({ db, task, userKey, decryptedPayload, webpush, pu
     await sendTaggedPush(webpush, subscription, JSON.stringify(push));
     return true;
   } catch (error) {
-    if (isTaskCancelledError(error) || _optionalChain([error, 'optionalAccess', _6 => _6.code]) === "CLOUD_OWNER_RETIRED") throw error;
+    if (isTaskCancelledError(error) || _optionalChain([error, 'optionalAccess', _7 => _7.code]) === "CLOUD_OWNER_RETIRED") throw error;
     console.warn(
       `[amsg-server] \u7ED3\u679C ${push.messageId} \u7684\u63A8\u9001\u6CA1\u53D1\u51FA\u53BB\uFF08\u5DF2\u843D\u8FDB\u6536\u4EF6\u7BB1\uFF0C\u7B49\u5BA2\u6237\u7AEF\u8865\u6536\uFF09:`,
       error && error.message
@@ -1618,7 +1664,7 @@ function projectTask(row, decryptedPayload, options = {}) {
     // 凭据引用只是名字（cred_id），本体在 llm_credentials 表里，凭据字段本身
     // 照旧被白名单挡在外面。
     credRefs: _nullishCoalesce(payload.credRefs, () => ( null)),
-    // 整份 metadata 只在单条查询里给（见上面的 includeMetadata）。
+    // 整份 metadata 由 includeMetadata 控制，单条查询与 hook 回执会带。
     ...options.includeMetadata ? { metadata: _nullishCoalesce(payload.metadata, () => ( null)) } : {},
     // 上一次没发出去的原因。reason 'stale' 表示错过触发时刻太久被判定不再补
     // 发；其余是投递失败的错误信息。没有记录 → null。
@@ -1709,6 +1755,9 @@ function normalizeBeforeFireResult(result) {
     return { messages: result };
   }
   if (result && typeof result === "object" && Array.isArray(result.messages)) {
+    if (result.allowedToolNames !== void 0 && (!Array.isArray(result.allowedToolNames) || result.allowedToolNames.some((name) => typeof name !== "string" || !name.trim()))) {
+      throw markPermanent(new TypeError("allowedToolNames must be an array of non-empty strings"), "AGENTIC_BAD_BEFORE_FIRE");
+    }
     return {
       messages: result.messages,
       maxToolIterations: result.maxToolIterations,
@@ -1717,7 +1766,8 @@ function normalizeBeforeFireResult(result) {
       // 用真值。真正决定请求体带不带 tools 的规则住在 llm.js 的
       // buildAiRequestBody（那边有测试钉着），这层只是不把空数组往下传。
       tools: Array.isArray(result.tools) && result.tools.length > 0 ? result.tools : void 0,
-      toolChoice: result.toolChoice
+      toolChoice: result.toolChoice,
+      allowedToolNames: result.allowedToolNames === void 0 ? void 0 : new Set(result.allowedToolNames)
     };
   }
   throw markPermanent(new TypeError(BAD_BEFORE_FIRE_MESSAGE), "AGENTIC_BAD_BEFORE_FIRE");
@@ -1737,7 +1787,7 @@ function firstPositiveNumber(values, fallback) {
 async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
   const hooks = ctx.hooks;
   const signal = ctx.signal || new AbortController().signal;
-  const isCancelled = () => signal.aborted || _optionalChain([ctx, 'access', _7 => _7.isTaskCancelled, 'optionalCall', _8 => _8()]) === true;
+  const isCancelled = () => signal.aborted || _optionalChain([ctx, 'access', _8 => _8.isTaskCancelled, 'optionalCall', _9 => _9()]) === true;
   const throwIfCancelled = () => {
     if (!isCancelled()) return;
     if (isTaskCancelledError(signal.reason)) throw signal.reason;
@@ -1769,6 +1819,8 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
   const sessionId = task.id != null ? `sess_task_${task.id}${occurrenceSuffix(task)}` : `sess_${_amsgshared.randomUUID.call(void 0, )}`;
   const messageIdBase = task.id != null ? `msg_task_${task.id}${occurrenceSuffix(task)}` : `msg_${_amsgshared.randomUUID.call(void 0, )}`;
   const occurrenceMs = occurrenceMsOf(task);
+  const storeAttachment = createAttachmentStore({ task, occurrenceMs, writeState, now: nowFn });
+  const storeSettledAttachment = createAttachmentStore({ task, occurrenceMs, writeState: writeSettledState, now: nowFn });
   const { emitResult } = createResultEmitter({
     db: ctx.db,
     task,
@@ -1791,17 +1843,37 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       const row = await ctx.db.getTaskByUuid(uuid, task.user_id);
       if (!row) return null;
       const payload = JSON.parse(await decryptFromStorage(row.encrypted_payload, userKey));
-      return projectTask(row, payload);
+      return projectTask(row, payload, { includeMetadata: true });
     } catch (error) {
       console.warn("[amsg-server] scheduleTask: \u8BFB\u53D6\u649E\u8F66\u4EFB\u52A1\u5931\u8D25\uFF08\u5DF2\u5FFD\u7565\uFF09:", error && error.message);
       return null;
     }
   }
+  const listTasks = async (options = {}) => {
+    throwIfCancelled();
+    const { status = "pending", limit = 100, offset = 0, includeMetadata = true } = options;
+    if (!["pending", "sent", "failed", "all"].includes(status) || !Number.isInteger(limit) || limit < 1 || limit > 100 || !Number.isInteger(offset) || offset < 0) {
+      throw new TypeError("listTasks requires a valid status, limit 1-100, and non-negative offset");
+    }
+    if (typeof _optionalChain([ctx, 'access', _10 => _10.db, 'optionalAccess', _11 => _11.listTasks]) !== "function") {
+      throw new DeploymentConfigError("AGENTIC_TASK_VIEW_UNSUPPORTED: adapter has no listTasks", { code: "AGENTIC_TASK_VIEW_UNSUPPORTED" });
+    }
+    const { tasks, total } = await ctx.db.listTasks(task.user_id, { status, limit, offset });
+    const projected = await Promise.all(tasks.map(async (row) => projectTask(
+      row,
+      JSON.parse(await decryptFromStorage(row.encrypted_payload, userKey)),
+      { includeMetadata }
+    )));
+    return { tasks: projected, pagination: { total, limit, offset, hasMore: offset + tasks.length < total } };
+  };
   const scheduleTask = async (options) => {
     throwIfCancelled();
     if (!options || typeof options !== "object" || Array.isArray(options)) {
       throw new TypeError("scheduleTask(options) \u9700\u8981\u4E00\u4E2A\u5BF9\u8C61\uFF0C\u81F3\u5C11\u5305\u542B { firstSendTime }");
     }
+    if (options.taskInput != null && (typeof options.taskInput !== "object" || Array.isArray(options.taskInput))) {
+      throw new TypeError("scheduleTask: taskInput must be an object or null");
+    }
     if (typeof options.firstSendTime !== "string" || !options.firstSendTime.trim()) {
       throw new RangeError("scheduleTask: firstSendTime \u5FC5\u586B\uFF0C\u4E14\u5FC5\u987B\u662F ISO 8601 \u5B57\u7B26\u4E32");
     }
@@ -1896,7 +1968,8 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       // 与凭据同列的投递配置：中转的非标准参数（thinking 之类）跟着任务走，
       // 自排的后续任务不该突然掉档。
       llmExtraBody: _nullishCoalesce(decryptedPayload.llmExtraBody, () => ( null)),
-      metadata
+      metadata,
+      taskInput: _nullishCoalesce(options.taskInput, () => ( null))
     };
     const serializedTaskData = JSON.stringify(fullTaskData);
     const sizeError = validateTaskPayloadSize(serializedTaskData);
@@ -1950,7 +2023,8 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       created: true,
       id: _nullishCoalesce(created.id, () => ( null)),
       uuid: _nullishCoalesce(created.uuid, () => ( uuid)),
-      nextSendAt: _nullishCoalesce(created.next_send_at, () => ( nextSendAt))
+      nextSendAt: _nullishCoalesce(created.next_send_at, () => ( nextSendAt)),
+      task: projectTask({ status: "pending", next_send_at: nextSendAt, ...created }, fullTaskData, { includeMetadata: true })
     };
   };
   const cancelTask = async (uuid) => {
@@ -2018,7 +2092,11 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       const stillPending = await ctx.db.getTaskByUuid(uuid, task.user_id);
       return { renewed: false, reason: stillPending ? "in_flight" : "not_found" };
     }
-    return { renewed: true, uuid, nextSendAt: nextSendAtIso };
+    return { renewed: true, uuid, nextSendAt: nextSendAtIso, task: projectTask(
+      { ...row, next_send_at: nextSendAtIso, retry_count: 0 },
+      payload,
+      { includeMetadata: true }
+    ) };
   };
   const resolveLlmCredential2 = async (credId) => {
     if (typeof credId !== "string" || !credId.trim()) {
@@ -2035,7 +2113,9 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
     readState,
     writeState,
     emitResult,
+    storeAttachment,
     scheduleTask,
+    listTasks,
     cancelTask,
     renewTask,
     resolveLlmCredential: resolveLlmCredential2,
@@ -2068,8 +2148,10 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       readState,
       writeState,
       emitResult,
+      storeAttachment,
       scratch,
       scheduleTask,
+      listTasks,
       cancelTask,
       renewTask,
       resolveLlmCredential: resolveLlmCredential2,
@@ -2128,7 +2210,8 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       scratch,
       readState,
       writeState: writeSettledState,
-      emitResult
+      emitResult,
+      storeAttachment: storeSettledAttachment
     });
   }
 }
@@ -2143,8 +2226,10 @@ async function runFireChain({
   readState,
   writeState,
   emitResult,
+  storeAttachment,
   scratch,
   scheduleTask,
+  listTasks,
   cancelTask,
   renewTask,
   resolveLlmCredential: resolveLlmCredential2,
@@ -2243,15 +2328,35 @@ async function runFireChain({
       readState,
       writeState,
       emitResult,
+      storeAttachment,
       scheduleTask,
+      listTasks,
       cancelTask,
       renewTask,
       resolveLlmCredential: resolveLlmCredential2
     });
     const decision = await hooks.onLLMOutput(sessionCtx);
     ctx.throwIfCancelled();
+    const rawCalls = _optionalChain([decision, 'optionalAccess', _12 => _12.decision]) === "tool-request" ? _amsgshared.extractToolCallsFromDecision.call(void 0, decision) : [];
+    const validId = (call) => typeof _optionalChain([call, 'optionalAccess', _13 => _13.id]) === "string" && call.id.trim().length > 0;
+    const nativeCalls = Array.isArray(assistantMessage.tool_calls) ? assistantMessage.tool_calls : [];
+    const usedIds = new Set([...rawCalls, ...nativeCalls].filter(validId).map((call) => call.id));
+    const malformedIds = /* @__PURE__ */ new Set();
+    const toolCalls = rawCalls.map((call, index) => {
+      let id = validId(call) ? call.id : `call_${iteration + 1}_${index + 1}`;
+      if (!validId(call)) {
+        while (usedIds.has(id)) id += "_";
+        usedIds.add(id);
+      }
+      if (typeof _optionalChain([call, 'optionalAccess', _14 => _14.function, 'optionalAccess', _15 => _15.name]) !== "string" || !call.function.name.trim()) {
+        malformedIds.add(id);
+        return { id, type: "function", function: { name: "invalid_tool_call", arguments: "{}" } };
+      }
+      return { ...call, id };
+    });
+    const validationDecision = _optionalChain([decision, 'optionalAccess', _16 => _16.decision]) === "tool-request" && Array.isArray(decision.toolCalls) && decision.toolCalls.length > 0 ? { ...decision, toolCalls } : decision;
     try {
-      _amsgshared.assertValidDecision.call(void 0, decision, { inlineToolCalls: true });
+      _amsgshared.assertValidDecision.call(void 0, validationDecision, { inlineToolCalls: true });
     } catch (error) {
       throw markPermanent(error, "AGENTIC_BAD_DECISION");
     }
@@ -2282,14 +2387,19 @@ async function runFireChain({
       });
       return { handled: true, result: { success: true, messagesSent, status: "finished", iterations: iteration + 1 } };
     }
-    const toolCalls = _amsgshared.extractToolCallsFromDecision.call(void 0, decision);
     if (toolCalls.length === 0) {
       throw taggedRetryableError(
         "AGENTIC_EMPTY_TOOL_REQUEST: tool-request decision carried no toolCalls (neither decision.toolCalls nor pushPayloads[].toolCalls)",
         "AGENTIC_EMPTY_TOOL_REQUEST"
       );
     }
-    if (typeof hooks.executeToolCalls !== "function") {
+    const permittedCalls = toolCalls.filter((call) => !malformedIds.has(call.id) && (normalized.allowedToolNames === void 0 || normalized.allowedToolNames.has(call.function.name)));
+    const deniedResults = toolCalls.filter((call) => !permittedCalls.includes(call)).map((call) => ({
+      role: "tool",
+      tool_call_id: call.id,
+      content: JSON.stringify({ error: malformedIds.has(call.id) ? { code: "INVALID_TOOL_CALL", message: "Tool call requires a function name" } : { code: "TOOL_NOT_ALLOWED", message: "Tool execution is not allowed for this fire" } })
+    }));
+    if (permittedCalls.length > 0 && typeof hooks.executeToolCalls !== "function") {
       throw new DeploymentConfigError(
         "AGENTIC_CONFIG_ERROR: onLLMOutput returned tool-request but hooks.executeToolCalls is not configured",
         { code: "AGENTIC_CONFIG_ERROR" }
@@ -2301,7 +2411,7 @@ async function runFireChain({
     let toolResults;
     try {
       ctx.throwIfCancelled();
-      toolResults = await hooks.executeToolCalls(toolCalls, sessionCtx);
+      toolResults = permittedCalls.length > 0 ? await hooks.executeToolCalls(permittedCalls, sessionCtx) : [];
       ctx.throwIfCancelled();
       if (!Array.isArray(toolResults)) {
         throw new TypeError('executeToolCalls must resolve to an array of { tool_call_id, role: "tool", content }');
@@ -2309,16 +2419,17 @@ async function runFireChain({
     } catch (error) {
       ctx.throwIfCancelled();
       if (isTaskCancelledError(error)) throw error;
-      toolResults = toolCalls.map((toolCall) => ({
+      toolResults = permittedCalls.map((toolCall) => ({
         tool_call_id: toolCall && typeof toolCall === "object" && typeof toolCall.id === "string" ? toolCall.id : "",
         role: "tool",
-        content: `Tool execution failed: ${_nullishCoalesce(_optionalChain([error, 'optionalAccess', _9 => _9.message]), () => ( String(error)))}`
+        content: `Tool execution failed: ${_nullishCoalesce(_optionalChain([error, 'optionalAccess', _17 => _17.message]), () => ( String(error)))}`
       }));
     }
-    const nativeCalls = Array.isArray(assistantMessage.tool_calls) ? assistantMessage.tool_calls : [];
-    const nativeIds = new Set(nativeCalls.map((tc) => tc && tc.id));
-    const synthesized = toolCalls.filter((tc) => !nativeIds.has(tc && tc.id));
-    const assistantWithTools = synthesized.length === 0 ? assistantMessage : { ...assistantMessage, tool_calls: [...nativeCalls, ...synthesized] };
+    toolResults = [...toolResults, ...deniedResults];
+    const declared = nativeCalls.filter(validId).map((call) => toolCalls.find((item) => item.id === call.id) || call);
+    const nativeIds = new Set(declared.map((call) => call.id));
+    const synthesized = toolCalls.filter((call) => !nativeIds.has(call.id));
+    const assistantWithTools = { ...assistantMessage, tool_calls: [...declared, ...synthesized] };
     messages = [...messages.slice(0, -1), assistantWithTools, ...toolResults];
   }
   throw taggedRetryableError(
@@ -2497,7 +2608,7 @@ function validOwner(owner) {
   return owner && typeof owner.type === "string" && owner.type.trim().length > 0 && owner.type.length <= 100 && typeof owner.id === "string" && owner.id.trim().length > 0 && owner.id.length <= 300;
 }
 function validateGuard(guard) {
-  if (!validOwner(_optionalChain([guard, 'optionalAccess', _10 => _10.owner])))
+  if (!validOwner(_optionalChain([guard, 'optionalAccess', _18 => _18.owner])))
     throw guardError("INVALID_CLOUD_OWNER", "Cloud owner is invalid");
   if (!Number.isSafeInteger(guard.generation) || guard.generation < 0) {
     throw guardError(
@@ -2525,14 +2636,14 @@ async function assertCloudGuard(db, userId, guard) {
 }
 async function resolveMetadata(resolveOwner, input, explicit) {
   const resolved = typeof resolveOwner === "function" ? await resolveOwner(input) : null;
-  const owner = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _11 => _11.owner]), () => ( _optionalChain([explicit, 'optionalAccess', _12 => _12.metadata, 'optionalAccess', _13 => _13.cloudOwner]))), () => ( _optionalChain([resolved, 'optionalAccess', _14 => _14.owner]))), () => ( (validOwner(resolved) ? resolved : null)));
+  const owner = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _19 => _19.owner]), () => ( _optionalChain([explicit, 'optionalAccess', _20 => _20.metadata, 'optionalAccess', _21 => _21.cloudOwner]))), () => ( _optionalChain([resolved, 'optionalAccess', _22 => _22.owner]))), () => ( (validOwner(resolved) ? resolved : null)));
   if (owner !== null && !validOwner(owner))
     throw guardError("INVALID_CLOUD_OWNER", "Cloud owner is invalid");
-  return { owner, kind: _nullishCoalesce(_nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _15 => _15.kind]), () => ( _optionalChain([resolved, 'optionalAccess', _16 => _16.kind]))), () => ( null)) };
+  return { owner, kind: _nullishCoalesce(_nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _23 => _23.kind]), () => ( _optionalChain([resolved, 'optionalAccess', _24 => _24.kind]))), () => ( null)) };
 }
 async function captureCloudTaskGuard(db, userId, payload, resolveOwner, task) {
   if (!db.cloudDataManagement) return null;
-  if (_optionalChain([payload, 'optionalAccess', _17 => _17.__cloudOwnerGuard])) {
+  if (_optionalChain([payload, 'optionalAccess', _25 => _25.__cloudOwnerGuard])) {
     const guard2 = validateGuard(payload.__cloudOwnerGuard);
     await assertCloudGuard(db, userId, guard2);
     return guard2;
@@ -2545,7 +2656,7 @@ async function captureCloudTaskGuard(db, userId, payload, resolveOwner, task) {
   if (!owner) return null;
   const guard = validateGuard({
     owner,
-    generation: _nullishCoalesce(_optionalChain([payload, 'optionalAccess', _18 => _18.ownerGeneration]), () => ( 0))
+    generation: _nullishCoalesce(_optionalChain([payload, 'optionalAccess', _26 => _26.ownerGeneration]), () => ( 0))
   });
   await assertCloudGuard(db, userId, guard);
   return guard;
@@ -2597,7 +2708,7 @@ function createCloudGuardedAdapter(db, {
       }
       guard = inheritedGuard || validateGuard({
         owner: resolved.owner,
-        generation: _nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _19 => _19.ownerGeneration]), () => ( 0))
+        generation: _nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _27 => _27.ownerGeneration]), () => ( 0))
       });
     } else {
       guard = null;
@@ -2605,9 +2716,9 @@ function createCloudGuardedAdapter(db, {
     await assertCloudGuard(db, userId, inheritedGuard);
     await assertCloudGuard(db, userId, guard);
     const metadata = {
-      owner: _nullishCoalesce(_optionalChain([guard, 'optionalAccess', _20 => _20.owner]), () => ( resolved.owner)),
+      owner: _nullishCoalesce(_optionalChain([guard, 'optionalAccess', _28 => _28.owner]), () => ( resolved.owner)),
       kind: resolved.kind,
-      generation: _nullishCoalesce(_optionalChain([guard, 'optionalAccess', _21 => _21.generation]), () => ( 0))
+      generation: _nullishCoalesce(_optionalChain([guard, 'optionalAccess', _29 => _29.generation]), () => ( 0))
     };
     return {
       cloudGuard: guard,
@@ -2787,7 +2898,7 @@ function createCloudGuardedAdapter(db, {
         else delete payload[field];
       }
       if (payload.metadata && typeof payload.metadata === "object") {
-        if (_optionalChain([originalPayload, 'access', _22 => _22.metadata, 'optionalAccess', _23 => _23.cloudOwner]) !== void 0)
+        if (_optionalChain([originalPayload, 'access', _30 => _30.metadata, 'optionalAccess', _31 => _31.cloudOwner]) !== void 0)
           payload.metadata.cloudOwner = originalPayload.metadata.cloudOwner;
         else delete payload.metadata.cloudOwner;
       }
@@ -2979,11 +3090,11 @@ async function processSingleMessage(task, ctx, providedMasterKey, predecrypted =
     }
     const userKey = predecrypted && predecrypted.userKey || await deriveUserEncryptionKey(task.user_id, masterKey);
     const decryptedPayload = predecrypted && predecrypted.payload || JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
-    const cloudGuard = await captureCloudTaskGuard(ctx.db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _24 => _24.cloudData, 'optionalAccess', _25 => _25.resolveOwner]), task);
+    const cloudGuard = await captureCloudTaskGuard(ctx.db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _32 => _32.cloudData, 'optionalAccess', _33 => _33.resolveOwner]), task);
     if (cloudGuard) {
       await assertCloudGuard(ctx.db, task.user_id, cloudGuard);
       const originalWebpush = ctx.webpush;
-      const guardedDb = createCloudGuardedAdapter(ctx.db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _26 => _26.cloudData, 'optionalAccess', _27 => _27.resolveOwner]), guard: cloudGuard, userId: task.user_id });
+      const guardedDb = createCloudGuardedAdapter(ctx.db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _34 => _34.cloudData, 'optionalAccess', _35 => _35.resolveOwner]), guard: cloudGuard, userId: task.user_id });
       ctx = { ...ctx, db: guardedDb, webpush: originalWebpush && {
         ...originalWebpush,
         async sendNotification(...args) {
@@ -3179,8 +3290,8 @@ async function processMessagesByUuid(uuid, ctx, maxRetries = 2, userId, provided
       try {
         const userKey = await deriveUserEncryptionKey(task.user_id, masterKey);
         const payload = JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
-        const guard = await captureCloudTaskGuard(ctx.db, task.user_id, payload, _optionalChain([ctx, 'access', _28 => _28.cloudData, 'optionalAccess', _29 => _29.resolveOwner]), task);
-        if (guard) attemptDb = createCloudGuardedAdapter(ctx.db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _30 => _30.cloudData, 'optionalAccess', _31 => _31.resolveOwner]), guard, userId: task.user_id });
+        const guard = await captureCloudTaskGuard(ctx.db, task.user_id, payload, _optionalChain([ctx, 'access', _36 => _36.cloudData, 'optionalAccess', _37 => _37.resolveOwner]), task);
+        if (guard) attemptDb = createCloudGuardedAdapter(ctx.db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _38 => _38.cloudData, 'optionalAccess', _39 => _39.resolveOwner]), guard, userId: task.user_id });
       } catch (error) {
         return { success: false, error: { code: error.code || "PROCESSING_ERROR", message: error.message, retriesAttempted: retryCount } };
       }
@@ -3216,7 +3327,7 @@ async function processMessagesByUuid(uuid, ctx, maxRetries = 2, userId, provided
           })
         });
       } catch (_updateError) {
-        if (_optionalChain([_updateError, 'optionalAccess', _32 => _32.code]) === "CLOUD_OWNER_RETIRED") {
+        if (_optionalChain([_updateError, 'optionalAccess', _40 => _40.code]) === "CLOUD_OWNER_RETIRED") {
           return { success: false, error: { code: _updateError.code, message: _updateError.message, retriesAttempted: retryCount } };
         }
         try {
@@ -3392,6 +3503,9 @@ function createScheduleMessageHandler(ctx) {
       owner: payload.owner,
       kind: payload.kind,
       ownerGeneration: payload.ownerGeneration,
+      // Input is persisted with the task in the same create/supersede transaction.
+      // Shared credentials remain references and continue to resolve at fire time.
+      taskInput: _nullishCoalesce(payload.taskInput, () => ( null)),
       metadata: payload.metadata || {}
     };
     const serializedTaskData = JSON.stringify(fullTaskData);
@@ -3599,7 +3713,7 @@ async function runScheduledTick(ctx) {
 }
 async function cleanupExpiredClientState(ctx) {
   if (typeof ctx.db.cleanupClientState !== "function") return;
-  const targets = planClientStateCleanup(ctx.clientStateTtl, Date.now());
+  const targets = planClientStateCleanup({ [ATTACHMENT_NAMESPACE]: ATTACHMENT_RETENTION_DAYS, ...ctx.clientStateTtl }, Date.now());
   if (targets.length === 0) return;
   try {
     await ctx.db.cleanupClientState(targets);
@@ -3689,7 +3803,7 @@ async function deliverTasks(ctx, tasks) {
         const until = new Date(Date.now() + heartbeatLeaseTtlMs).toISOString();
         renewed = guard ? await db.renewTaskLease(task.id, until, guard) : await db.renewTaskLease(task.id, until);
       } catch (error) {
-        if (_optionalChain([error, 'optionalAccess', _33 => _33.code]) === "CLOUD_OWNER_RETIRED") renewed = false;
+        if (_optionalChain([error, 'optionalAccess', _41 => _41.code]) === "CLOUD_OWNER_RETIRED") renewed = false;
         else console.warn("[amsg-server] \u79DF\u7EA6\u7EED\u79DF\u5931\u8D25\uFF08\u4E0B\u4E2A\u5FC3\u8DF3\u518D\u8BD5\uFF09:", error && error.message);
       }
       if (renewed === false) {
@@ -3732,7 +3846,7 @@ async function deliverTasks(ctx, tasks) {
       lastErrorColumnSuspicions.delete(db);
       return result2;
     } catch (error) {
-      if (_optionalChain([error, 'optionalAccess', _34 => _34.code]) === "CLOUD_OWNER_RETIRED") throw error;
+      if (_optionalChain([error, 'optionalAccess', _42 => _42.code]) === "CLOUD_OWNER_RETIRED") throw error;
       combinedError = error;
     }
     const result = await updateLifecycleTask(taskId, stateFields);
@@ -3927,12 +4041,12 @@ async function deliverTasks(ctx, tasks) {
     let claimed;
     try {
       if (decrypted.ok) {
-        const guard = await captureCloudTaskGuard(db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _35 => _35.cloudData, 'optionalAccess', _36 => _36.resolveOwner]), task);
+        const guard = await captureCloudTaskGuard(db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _43 => _43.cloudData, 'optionalAccess', _44 => _44.resolveOwner]), task);
         if (guard) taskCloudGuards.set(task.id, guard);
       }
       claimed = await claimForThisTick(task, serializeGroup);
     } catch (error) {
-      if (_optionalChain([error, 'optionalAccess', _37 => _37.code]) === "CLOUD_OWNER_RETIRED") {
+      if (_optionalChain([error, 'optionalAccess', _45 => _45.code]) === "CLOUD_OWNER_RETIRED") {
         await recordCancelled(task, "owner_retired");
         return;
       }
@@ -3967,8 +4081,8 @@ async function deliverTasks(ctx, tasks) {
     const notOnFreshRetryChain = (task.retry_count || 0) === 0 || Number.isFinite(retryAfterMs) && Date.now() - retryAfterMs > staleAfterMs;
     const settleAsStale = async () => {
       try {
-        const cloudGuard = await captureCloudTaskGuard(db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _38 => _38.cloudData, 'optionalAccess', _39 => _39.resolveOwner]), task);
-        const guardedDb = createCloudGuardedAdapter(db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _40 => _40.cloudData, 'optionalAccess', _41 => _41.resolveOwner]), guard: cloudGuard, userId: task.user_id });
+        const cloudGuard = await captureCloudTaskGuard(db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _46 => _46.cloudData, 'optionalAccess', _47 => _47.resolveOwner]), task);
+        const guardedDb = createCloudGuardedAdapter(db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _48 => _48.cloudData, 'optionalAccess', _49 => _49.resolveOwner]), guard: cloudGuard, userId: task.user_id });
         const guardedWebpush = cloudGuard && ctx.webpush ? {
           ...ctx.webpush,
           async sendNotification(...args) {
@@ -4259,6 +4373,9 @@ function createUpdateMessageHandler(ctx) {
     if (!isPlainObject(updates)) {
       return { status: 400, body: { success: false, error: { code: "INVALID_UPDATE_DATA", message: "\u66F4\u65B0\u6570\u636E\u683C\u5F0F\u9519\u8BEF" } } };
     }
+    if (Object.prototype.hasOwnProperty.call(updates, "taskInput")) {
+      return { status: 400, body: { success: false, error: { code: "INVALID_UPDATE_DATA", message: "taskInput \u53EA\u80FD\u5728\u521B\u5EFA\u6216\u66FF\u6362\u4EFB\u52A1\u65F6\u8BBE\u7F6E", details: { invalidFields: ["taskInput"] } } } };
+    }
     if (updates.nextSendAt && !isValidISO8601(updates.nextSendAt)) {
       return { status: 400, body: { success: false, error: { code: "INVALID_UPDATE_DATA", message: "\u66F4\u65B0\u6570\u636E\u683C\u5F0F\u9519\u8BEF", details: { invalidFields: ["nextSendAt"] } } } };
     }
@@ -5270,7 +5387,7 @@ var D1Adapter = class {
     return typeof this._db.batch === "function";
   }
   _cloudGuardPredicate(userId, guard) {
-    if (!_optionalChain([guard, 'optionalAccess', _42 => _42.owner]) || !Number.isSafeInteger(guard.generation) || guard.generation < 0) {
+    if (!_optionalChain([guard, 'optionalAccess', _50 => _50.owner]) || !Number.isSafeInteger(guard.generation) || guard.generation < 0) {
       throw new Error("Invalid cloud owner guard");
     }
     return {
@@ -5297,7 +5414,7 @@ var D1Adapter = class {
       indexes.push(expanded.length);
       expanded.push(statements[i]);
       const item = metadata.get(i);
-      if (_optionalChain([item, 'optionalAccess', _43 => _43.value])) {
+      if (_optionalChain([item, 'optionalAccess', _51 => _51.value])) {
         expanded.push(this._db.prepare(
           `INSERT INTO cloud_resource_metadata
           (user_id, resource_key, encrypted_value) SELECT ?, ?, ? WHERE changes() > 0
@@ -5332,7 +5449,7 @@ var D1Adapter = class {
   }
   async getCloudResourceMetadata(userId, resourceKey) {
     const row = await this._db.prepare("SELECT encrypted_value FROM cloud_resource_metadata WHERE user_id=? AND resource_key=?").bind(userId, resourceKey).first();
-    return _nullishCoalesce(_optionalChain([row, 'optionalAccess', _44 => _44.encrypted_value]), () => ( null));
+    return _nullishCoalesce(_optionalChain([row, 'optionalAccess', _52 => _52.encrypted_value]), () => ( null));
   }
   async listCloudResourceRows(userId) {
     const tables = { task: "scheduled_messages", state: "client_state", credential: "llm_credentials", outbox: "message_outbox", subscription: "push_subscriptions", metadata: "cloud_resource_metadata" };
@@ -5537,7 +5654,7 @@ var D1Adapter = class {
     const name = "metadata-sidecars-v1";
     const batch = await this.getCloudMaintenanceBatch(name, "cloud_resource_metadata", limit);
     if (batch.completed) return;
-    const cursor = _nullishCoalesce(_optionalChain([batch, 'access', _45 => _45.rows, 'access', _46 => _46.at, 'call', _47 => _47(-1), 'optionalAccess', _48 => _48.maintenance_rowid]), () => ( batch.upperBound));
+    const cursor = _nullishCoalesce(_optionalChain([batch, 'access', _53 => _53.rows, 'access', _54 => _54.at, 'call', _55 => _55(-1), 'optionalAccess', _56 => _56.maintenance_rowid]), () => ( batch.upperBound));
     if (batch.rows.length) await this.cleanupCloudResourceMetadata(null, { after: batch.cursor, through: cursor });
     await this.finishCloudMaintenanceBatch(name, cursor, batch.rows.length < limit || cursor >= batch.upperBound);
   }
@@ -5611,7 +5728,7 @@ var D1Adapter = class {
     if (!guard) return true;
     const condition = this._cloudGuardPredicate(userId, guard);
     const row = await this._db.prepare(`SELECT ${condition.sql} AS valid`).bind(...condition.args).first();
-    return !!_optionalChain([row, 'optionalAccess', _49 => _49.valid]);
+    return !!_optionalChain([row, 'optionalAccess', _57 => _57.valid]);
   }
   /** Delete only the exact physical snapshot; no untrusted SQL identifiers. */
   async deleteCloudResourceRows(userId, locators, { operationId, leaseToken } = {}) {
@@ -5864,7 +5981,7 @@ var D1Adapter = class {
     ).bind(...values);
     const ownerUser = cloudGuard ? await this._db.prepare("SELECT user_id FROM scheduled_messages WHERE id=?").bind(taskId).first() : null;
     if (cloudGuard && !ownerUser) return null;
-    await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _50 => _50.user_id]), [cloudGuard]);
+    await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _58 => _58.user_id]), [cloudGuard]);
     return this._db.prepare("SELECT * FROM scheduled_messages WHERE id = ?").bind(taskId).first();
   }
   /**
@@ -5989,7 +6106,7 @@ var D1Adapter = class {
     ).bind(...values);
     const ownerUser = cloudGuard ? await this._db.prepare("SELECT user_id FROM scheduled_messages WHERE id=?").bind(taskId).first() : null;
     if (cloudGuard && !ownerUser) return false;
-    const [res] = await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _51 => _51.user_id]), [cloudGuard]);
+    const [res] = await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _59 => _59.user_id]), [cloudGuard]);
     return (res.meta.changes || 0) > 0;
   }
   /**
@@ -6008,7 +6125,7 @@ var D1Adapter = class {
     ).bind(this._iso(leaseUntil), taskId);
     const ownerUser = cloudGuard ? await this._db.prepare("SELECT user_id FROM scheduled_messages WHERE id=?").bind(taskId).first() : null;
     if (cloudGuard && !ownerUser) return false;
-    const [res] = await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _52 => _52.user_id]), [cloudGuard]);
+    const [res] = await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _60 => _60.user_id]), [cloudGuard]);
     return (res.meta.changes || 0) > 0;
   }
   async listTasks(userId, opts = {}) {
@@ -6169,30 +6286,39 @@ var D1Adapter = class {
       result.cleanupOutcomes = probeIndexes.map((probeAt) => {
         if (probeAt === null) return null;
         const row = results[probeAt] && Array.isArray(results[probeAt].results) ? results[probeAt].results[0] : null;
-        return Number(_nullishCoalesce(_optionalChain([row, 'optionalAccess', _53 => _53.n]), () => ( 0))) === 0;
+        return Number(_nullishCoalesce(_optionalChain([row, 'optionalAccess', _61 => _61.n]), () => ( 0))) === 0;
       });
     }
     return result;
   }
   /**
-   * All entries of one namespace (values still encrypted).
+   * Entries of one namespace (values still encrypted); optional exact/prefix selection.
    *
    * @param {string} userId
    * @param {string} namespace
    * @returns {Promise<Array<{ namespace: string, key: string, value: string, updated_at: number }>>}
    */
-  async getClientState(userId, namespace) {
+  async getClientState(userId, namespace, options = {}) {
+    const params = [userId, namespace];
+    let selector = "";
+    if (options.key !== void 0) {
+      selector = " AND key = ?";
+      params.push(options.key);
+    } else if (options.keyPrefix !== void 0) {
+      selector = " AND key >= ? AND key < ?";
+      params.push(options.keyPrefix, prefixRangeEnd(options.keyPrefix));
+    }
     const res = await this._db.prepare(
       `SELECT namespace, key, value, updated_at
        FROM client_state
-       WHERE user_id = ? AND namespace = ?
+       WHERE user_id = ? AND namespace = ?${selector}
        ORDER BY key ASC`
-    ).bind(userId, namespace).all();
+    ).bind(...params).all();
     return res.results || [];
   }
   /**
    * 例行清理：把指定命名空间下太久没更新的条目删掉（run-tick 每跳顺手调，
-   * 宿主配了 `clientStateTtl` 才会调）。
+   * 附件默认保留 30 天，宿主 `clientStateTtl` 可覆盖或配置其他命名空间）。
    *
    * 不限用户——「这个命名空间只留最近 N 天」是命名空间级的约定，单用户部署
    * 下也就是这一个用户的行。指令由 lib/client-state-store.js 的
@@ -6924,8 +7050,9 @@ function createClientStateHandler(ctx) {
     if (typeof db.upsertClientState !== "function") {
       return err3(501, "CLIENT_STATE_NOT_SUPPORTED", "\u5F53\u524D\u6570\u636E\u5E93\u9002\u914D\u5668\u4E0D\u652F\u6301 client_state");
     }
-    const { upserted, skipped, deleted, skippedEntries } = await writeClientStateEntries({ db, userId, userKey, entries: accepted });
+    const { upserted, skipped, deleted, skippedEntries, unknown } = await writeClientStateEntries({ db, userId, userKey, entries: accepted });
     const data = { upserted, skipped };
+    if (unknown > 0) data.unknown = unknown;
     if (deleted > 0) data.deleted = deleted;
     if (skippedEntries.length > 0) data.skippedEntries = skippedEntries;
     if (rejected.length > 0) data.rejected = rejected;
@@ -6938,7 +7065,12 @@ function createClientStateHandler(ctx) {
     const gate = requireUserId(headers);
     if (gate.error) return gate.error;
     const { userId } = gate;
-    const namespace = new URL(url, "https://dummy").searchParams.get("namespace") || "";
+    const query = new URL(url, "https://dummy").searchParams;
+    const namespace = query.get("namespace") || "";
+    const key = query.get("key");
+    if (key !== null && (!key.trim() || key.length > MAX_KEY_CHARS || INTERNAL_STATE_CHAR_RE.test(key))) {
+      return err3(400, "INVALID_STATE_KEY", "key must be non-empty, at most 256 characters, without control characters");
+    }
     if (!namespace.trim()) return err3(400, "NAMESPACE_REQUIRED", "\u5FC5\u987B\u63D0\u4F9B namespace \u67E5\u8BE2\u53C2\u6570");
     if (INTERNAL_STATE_CHAR_RE.test(namespace)) {
       return err3(400, "INVALID_STATE_NAMESPACE", "namespace \u4E0D\u80FD\u5305\u542B\u63A7\u5236\u5B57\u7B26\uFF08\\u0000-\\u001f \u4E3A\u5E93\u5185\u90E8\u4FDD\u7559\uFF09");
@@ -6947,10 +7079,10 @@ function createClientStateHandler(ctx) {
       return err3(501, "CLIENT_STATE_NOT_SUPPORTED", "\u5F53\u524D\u6570\u636E\u5E93\u9002\u914D\u5668\u4E0D\u652F\u6301 client_state");
     }
     const userKey = await deriveUserEncryptionKey(userId, masterKey);
-    const rows = await db.getClientState(userId, namespace);
+    const rows = await db.getClientState(userId, namespace, key === null ? void 0 : { key });
     const decrypted = await resolveClientStateEntries(
-      rows,
-      () => db.getClientState(userId, chunkNamespaceFor(namespace)),
+      key === null ? rows : rows.filter((row) => row.key === key),
+      () => db.getClientState(userId, chunkNamespaceFor(namespace), key === null ? void 0 : { keyPrefix: chunkKeyPrefixFor(key) }),
       (value) => decryptFromStorage(value, userKey)
     );
     const encryptedResponse = await encryptPayload({ namespace, entries: decrypted }, userKey);
@@ -7028,7 +7160,7 @@ function createClientStateNamespacesHandler(ctx) {
 }
 
 // src/server/lib/version.js
-var SERVER_VERSION = true ? "3.0.0" : "0.0.0-dev";
+var SERVER_VERSION = true ? "3.1.0-next.0" : "0.0.0-dev";
 
 // src/server/handlers/capabilities.js
 var SERVER_FEATURES = Object.freeze([
@@ -7144,7 +7276,12 @@ var SERVER_FEATURES = Object.freeze([
   "max-generation-retries",
   // onBeforeFire 认 { defer: { afterMs } }：这次不生成，过一会儿再来问（不占重试
   // 次数）；onFireSettled 的 status 多一种 'deferred'，带 retryAfter。
-  "before-fire-defer"
+  "before-fire-defer",
+  "task-input",
+  "client-state-key",
+  "agentic-list-tasks",
+  "agentic-tool-allowlist",
+  "attachments"
 ]);
 function createCapabilitiesHandler(ctx) {
   async function GET(url, headers) {
@@ -7263,8 +7400,8 @@ async function buildCloudDataInventory({
         });
       }
     }
-    const owner = safeOwner(_optionalChain([stored, 'optionalAccess', _54 => _54.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _55 => _55.__cloudOwnerGuard, 'optionalAccess', _56 => _56.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _57 => _57.metadata, 'optionalAccess', _58 => _58.cloudOwner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _59 => _59.metadata, 'optionalAccess', _60 => _60.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _61 => _61.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _62 => _62.__cloudOwnerGuard, 'optionalAccess', _63 => _63.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _64 => _64.metadata, 'optionalAccess', _65 => _65.cloudOwner])) || safeOwner(_optionalChain([task, 'optionalAccess', _66 => _66.metadata, 'optionalAccess', _67 => _67.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _68 => _68.owner])) || safeOwner(_optionalChain([resolved, 'optionalAccess', _69 => _69.owner]));
-    const kind = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([stored, 'optionalAccess', _70 => _70.kind]), () => ( _optionalChain([payload, 'optionalAccess', _71 => _71.metadata, 'optionalAccess', _72 => _72.kind]))), () => ( _optionalChain([payload, 'optionalAccess', _73 => _73.kind]))), () => ( _optionalChain([resolved, 'optionalAccess', _74 => _74.kind]))), () => ( null));
+    const owner = safeOwner(_optionalChain([stored, 'optionalAccess', _62 => _62.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _63 => _63.__cloudOwnerGuard, 'optionalAccess', _64 => _64.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _65 => _65.metadata, 'optionalAccess', _66 => _66.cloudOwner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _67 => _67.metadata, 'optionalAccess', _68 => _68.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _69 => _69.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _70 => _70.__cloudOwnerGuard, 'optionalAccess', _71 => _71.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _72 => _72.metadata, 'optionalAccess', _73 => _73.cloudOwner])) || safeOwner(_optionalChain([task, 'optionalAccess', _74 => _74.metadata, 'optionalAccess', _75 => _75.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _76 => _76.owner])) || safeOwner(_optionalChain([resolved, 'optionalAccess', _77 => _77.owner]));
+    const kind = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([stored, 'optionalAccess', _78 => _78.kind]), () => ( _optionalChain([payload, 'optionalAccess', _79 => _79.metadata, 'optionalAccess', _80 => _80.kind]))), () => ( _optionalChain([payload, 'optionalAccess', _81 => _81.kind]))), () => ( _optionalChain([resolved, 'optionalAccess', _82 => _82.kind]))), () => ( null));
     const times = rows.map((row) => timestamp(_nullishCoalesce(row.updated_at, () => ( row.created_at)))).filter((time) => time !== null);
     const byteSize = rows.reduce(
       (sum, row) => sum + encoder.encode(
@@ -7407,7 +7544,7 @@ async function buildCloudDataInventory({
   const ownerLabels = /* @__PURE__ */ new Map();
   for (const { resource } of entries) {
     const owner = resource.owner;
-    if (!_optionalChain([owner, 'optionalAccess', _75 => _75.label, 'optionalAccess', _76 => _76.trim, 'call', _77 => _77()])) continue;
+    if (!_optionalChain([owner, 'optionalAccess', _83 => _83.label, 'optionalAccess', _84 => _84.trim, 'call', _85 => _85()])) continue;
     const identity = JSON.stringify([owner.type, owner.id]);
     const current = ownerLabels.get(identity);
     if (!current || (_nullishCoalesce(resource.updatedAt, () => ( 0))) > current.updatedAt) {
@@ -7419,7 +7556,7 @@ async function buildCloudDataInventory({
   }
   for (const { resource } of entries) {
     const owner = resource.owner;
-    if (!owner || _optionalChain([owner, 'access', _78 => _78.label, 'optionalAccess', _79 => _79.trim, 'call', _80 => _80()])) continue;
+    if (!owner || _optionalChain([owner, 'access', _86 => _86.label, 'optionalAccess', _87 => _87.trim, 'call', _88 => _88()])) continue;
     const known = ownerLabels.get(JSON.stringify([owner.type, owner.id]));
     if (known) resource.owner = { ...owner, label: known.label };
   }
@@ -7447,7 +7584,7 @@ async function cloudInventory(ctx, db, userId, userKey) {
     db,
     userId,
     userKey,
-    resolveOwner: _optionalChain([ctx, 'access', _81 => _81.cloudData, 'optionalAccess', _82 => _82.resolveOwner])
+    resolveOwner: _optionalChain([ctx, 'access', _89 => _89.cloudData, 'optionalAccess', _90 => _90.resolveOwner])
   });
 }
 function operationWork(operation) {
@@ -7504,7 +7641,7 @@ async function makeCleanupPlan(ctx, db, userId, key, input) {
     throw cloudError("INVALID_CLEANUP_SELECTION", "\u8BF7\u9009\u62E9\u81F3\u5C11\u4E00\u9879\u8D44\u6E90");
   if (types !== void 0 && (!Array.isArray(types) || !types.length || types.some((type) => !CLOUD_RESOURCE_TYPES.includes(type))))
     throw cloudError("INVALID_CLEANUP_SELECTION", "\u8D44\u6E90\u7C7B\u522B\u65E0\u6548");
-  if (mode === "purge" && !owner && !_optionalChain([resourceIds, 'optionalAccess', _83 => _83.length]))
+  if (mode === "purge" && !owner && !_optionalChain([resourceIds, 'optionalAccess', _91 => _91.length]))
     throw cloudError("INVALID_CLEANUP_SELECTION", "\u6E05\u7406\u9700\u8981\u660E\u786E\u8D44\u6E90\u6216\u5F52\u5C5E");
   if (mode === "retire-owner" && (resourceIds || types))
     throw cloudError("INVALID_CLEANUP_SELECTION", "\u5F7B\u5E95\u79FB\u9664\u4E0D\u80FD\u9650\u5236\u8D44\u6E90\u7C7B\u522B");
@@ -7869,12 +8006,12 @@ async function repairLegacyWorkIndex(ctx) {
     entries.push({ userId: row.user_id, kind: row.kind, id: row.id, work, writeToken: row.write_token });
   }
   await db.indexCloudDataRecordWorkBatch(entries);
-  const cursor = _nullishCoalesce(_optionalChain([batch, 'access', _84 => _84.rows, 'access', _85 => _85.at, 'call', _86 => _86(-1), 'optionalAccess', _87 => _87.maintenance_rowid]), () => ( batch.upperBound));
+  const cursor = _nullishCoalesce(_optionalChain([batch, 'access', _92 => _92.rows, 'access', _93 => _93.at, 'call', _94 => _94(-1), 'optionalAccess', _95 => _95.maintenance_rowid]), () => ( batch.upperBound));
   await db.finishCloudMaintenanceBatch(name, cursor, batch.rows.length < 100 || cursor >= batch.upperBound);
 }
 async function resumeCloudDataCleanups(ctx) {
   const db = ctx.db;
-  if (!_optionalChain([db, 'optionalAccess', _88 => _88.cloudDataManagement])) return;
+  if (!_optionalChain([db, 'optionalAccess', _96 => _96.cloudDataManagement])) return;
   const indexed = WORK_INDEX_METHODS.every((method) => typeof db[method] === "function");
   let rows;
   if (indexed) {
@@ -7906,7 +8043,7 @@ async function resumeCloudDataCleanups(ctx) {
       }
     } catch (error) {
       console.warn("[amsg] A cloud cleanup operation could not be resumed");
-      if (!indexed || _optionalChain([error, 'optionalAccess', _89 => _89.code]) === "CLOUD_LEASE_LOST") continue;
+      if (!indexed || _optionalChain([error, 'optionalAccess', _97 => _97.code]) === "CLOUD_LEASE_LOST") continue;
       await db.rescheduleCloudDataRecordWork(
         row.userId,
         "operation",
@@ -8014,7 +8151,7 @@ function createCloudDataHandler(ctx) {
               summary: inventorySummary(inventory),
               expiresAt: Date.now() + 15 * 60 * 1e3,
               resources: inventory.entries.map((e) => e.resource).filter(
-                (r) => (!type || r.type === type) && (!ownerId || _optionalChain([r, 'access', _90 => _90.owner, 'optionalAccess', _91 => _91.type]) === ownerType && r.owner.id === ownerId)
+                (r) => (!type || r.type === type) && (!ownerId || _optionalChain([r, 'access', _98 => _98.owner, 'optionalAccess', _99 => _99.type]) === ownerType && r.owner.id === ownerId)
               ),
               complete: inventory.complete,
               gaps: inventory.gaps
@@ -8097,7 +8234,7 @@ function createCloudDataHandler(ctx) {
           const rows = await db.listCloudDataRecords(userId, "operation");
           for (const row of rows) {
             const op = JSON.parse(await decryptFromStorage(row.data, key));
-            if (op.mode === "retire-owner" && _optionalChain([op, 'access', _92 => _92.owner, 'optionalAccess', _93 => _93.type]) === owner.type && _optionalChain([op, 'access', _94 => _94.owner, 'optionalAccess', _95 => _95.id]) === owner.id && ["pending", "running"].includes(op.status))
+            if (op.mode === "retire-owner" && _optionalChain([op, 'access', _100 => _100.owner, 'optionalAccess', _101 => _101.type]) === owner.type && _optionalChain([op, 'access', _102 => _102.owner, 'optionalAccess', _103 => _103.id]) === owner.id && ["pending", "running"].includes(op.status))
               throw cloudError(
                 "CLOUD_CLEANUP_IN_PROGRESS",
                 "\u6E05\u7406\u5B8C\u6210\u540E\u624D\u80FD\u91CD\u65B0\u542F\u7528",
@@ -8315,7 +8452,7 @@ function createSingleUserServer(config) {
   if (!config.masterKey) throw new Error("[amsg-server single-user] config.masterKey is required");
   const vapid = config.vapid || {};
   const tenantManager = createSingleUserContextManager({
-    db: createCloudGuardedAdapter(config.db, { masterKey: config.masterKey, resolveOwner: _optionalChain([config, 'access', _96 => _96.cloudData, 'optionalAccess', _97 => _97.resolveOwner]) }),
+    db: createCloudGuardedAdapter(config.db, { masterKey: config.masterKey, resolveOwner: _optionalChain([config, 'access', _104 => _104.cloudData, 'optionalAccess', _105 => _105.resolveOwner]) }),
     masterKey: config.masterKey,
     serverToken: config.serverToken
   });
@@ -8401,7 +8538,7 @@ async function getSchemaVersion(db) {
   for (const index of SQLITE_REQUIRED_SCHEMA.indexes) {
     if (!liveIndexes.has(index)) missing.push(`index:${index}`);
   }
-  if (Array.isArray(_optionalChain([live, 'optionalAccess', _98 => _98.triggers]))) {
+  if (Array.isArray(_optionalChain([live, 'optionalAccess', _106 => _106.triggers]))) {
     const liveTriggers = new Set(live.triggers);
     for (const name of SQLITE_REQUIRED_SCHEMA.triggers) {
       if (!liveTriggers.has(name)) missing.push(`trigger:${name}`);
@@ -8781,4 +8918,5 @@ function createSingleUserCloudflareWorker(buildConfig, options = {}) {
 
 
 
-exports.isValidTimeZoneId = isValidTimeZoneId; exports.advanceOccurrence = advanceOccurrence; exports.planNextOccurrence = planNextOccurrence; exports.nextFutureOccurrence = nextFutureOccurrence; exports.base64UrlToBytes = _amsgshared.base64UrlToBytes; exports.utf8 = _amsgshared.utf8; exports.utf8Decode = _amsgshared.utf8Decode; exports.bytesToBase64Url = _amsgshared.bytesToBase64Url; exports.timingSafeEqualBytes = _amsgshared.timingSafeEqualBytes; exports.deriveUserEncryptionKey = deriveUserEncryptionKey; exports.decryptPayload = decryptPayload; exports.encryptForStorage = encryptForStorage; exports.decryptFromStorage = decryptFromStorage; exports.CRED_ID_MAX_LENGTH = CRED_ID_MAX_LENGTH; exports.CRED_PUT_BATCH_MAX = CRED_PUT_BATCH_MAX; exports.CRED_ROWS_PER_USER_MAX = CRED_ROWS_PER_USER_MAX; exports.CRED_REFS_MAX_ENTRIES = CRED_REFS_MAX_ENTRIES; exports.supportsLlmCredentialsStore = supportsLlmCredentialsStore; exports.isValidCredId = isValidCredId; exports.validateCredValue = validateCredValue; exports.validateCredRefs = validateCredRefs; exports.hasChatCredRef = hasChatCredRef; exports.resolveLlmCredential = resolveLlmCredential; exports.isValidUrl = _amsgshared.isValidUrl; exports.validateAvatarUrl = _amsgshared.validateAvatarUrl; exports.isValidISO8601 = isValidISO8601; exports.isValidUUID = isValidUUID; exports.isValidUUIDv4 = isValidUUIDv4; exports.validateSplitPattern = validateSplitPattern; exports.validateLlmMessagesArray = validateLlmMessagesArray; exports.MAX_TASK_PAYLOAD_BYTES = MAX_TASK_PAYLOAD_BYTES; exports.validateScheduleMessagePayload = validateScheduleMessagePayload; exports.DEFAULT_MAX_REQUEST_BODY_BYTES = DEFAULT_MAX_REQUEST_BODY_BYTES; exports.readRequestBody = readRequestBody; exports.parseJsonBody = parseJsonBody; exports.getHeader = getHeader; exports.createGetUserKeyHandler = createGetUserKeyHandler; exports.NonRetryableError = NonRetryableError; exports.isNonRetryableError = isNonRetryableError; exports.DeploymentConfigError = DeploymentConfigError; exports.sanitizeErrorSummary = sanitizeErrorSummary; exports.summarizeErrorCause = summarizeErrorCause; exports.DEFAULT_MAX_DELIVERY_RETRIES = DEFAULT_MAX_DELIVERY_RETRIES; exports.WEB_PUSH_MAX_BODY_BYTES = WEB_PUSH_MAX_BODY_BYTES; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.MAX_PUSH_PAYLOAD_BYTES = MAX_PUSH_PAYLOAD_BYTES; exports.PUSH_ENVELOPE_RESERVED_BYTES = PUSH_ENVELOPE_RESERVED_BYTES; exports.measurePushPayload = measurePushPayload; exports.createWebCryptoWebPush = createWebCryptoWebPush; exports.DEFAULT_MAX_TOOL_ITERATIONS = DEFAULT_MAX_TOOL_ITERATIONS; exports.DEFAULT_TOTAL_TIMEOUT_MS = DEFAULT_TOTAL_TIMEOUT_MS; exports.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE = DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE; exports.MIN_SCHEDULE_LEAD_MS = MIN_SCHEDULE_LEAD_MS; exports.MAX_DEFER_AFTER_MS = MAX_DEFER_AFTER_MS; exports.createScheduleMessageHandler = createScheduleMessageHandler; exports.DEFAULT_CLAIM_LEASE_MS = DEFAULT_CLAIM_LEASE_MS; exports.DEFAULT_LEASE_HEARTBEAT_MS = DEFAULT_LEASE_HEARTBEAT_MS; exports.DEFAULT_HEARTBEAT_LEASE_TTL_MS = DEFAULT_HEARTBEAT_LEASE_TTL_MS; exports.runScheduledTick = runScheduledTick; exports.runTask = runTask; exports.createUpdateMessageHandler = createUpdateMessageHandler; exports.createCancelMessageHandler = createCancelMessageHandler; exports.createMessagesHandler = createMessagesHandler; exports.createGetMessageHandler = createGetMessageHandler; exports.createPushSubscriptionHandler = createPushSubscriptionHandler; exports.createLlmCredentialsHandler = createLlmCredentialsHandler; exports.createD1Adapter = createD1Adapter; exports.createSingleUserServer = createSingleUserServer; exports.SCHEMA_VERSION = SCHEMA_VERSION; exports.getSchemaVersion = getSchemaVersion; exports.ensureSchema = ensureSchema; exports.CORS_ALLOW_HEADERS = CORS_ALLOW_HEADERS; exports.CORS_ALLOW_METHODS = CORS_ALLOW_METHODS; exports.createSingleUserCloudflareWorker = createSingleUserCloudflareWorker;
+
+exports.isValidTimeZoneId = isValidTimeZoneId; exports.advanceOccurrence = advanceOccurrence; exports.planNextOccurrence = planNextOccurrence; exports.nextFutureOccurrence = nextFutureOccurrence; exports.base64UrlToBytes = _amsgshared.base64UrlToBytes; exports.utf8 = _amsgshared.utf8; exports.utf8Decode = _amsgshared.utf8Decode; exports.bytesToBase64Url = _amsgshared.bytesToBase64Url; exports.timingSafeEqualBytes = _amsgshared.timingSafeEqualBytes; exports.deriveUserEncryptionKey = deriveUserEncryptionKey; exports.decryptPayload = decryptPayload; exports.encryptPayload = encryptPayload; exports.encryptForStorage = encryptForStorage; exports.decryptFromStorage = decryptFromStorage; exports.CRED_ID_MAX_LENGTH = CRED_ID_MAX_LENGTH; exports.CRED_PUT_BATCH_MAX = CRED_PUT_BATCH_MAX; exports.CRED_ROWS_PER_USER_MAX = CRED_ROWS_PER_USER_MAX; exports.CRED_REFS_MAX_ENTRIES = CRED_REFS_MAX_ENTRIES; exports.supportsLlmCredentialsStore = supportsLlmCredentialsStore; exports.isValidCredId = isValidCredId; exports.validateCredValue = validateCredValue; exports.validateCredRefs = validateCredRefs; exports.hasChatCredRef = hasChatCredRef; exports.resolveLlmCredential = resolveLlmCredential; exports.isValidUrl = _amsgshared.isValidUrl; exports.validateAvatarUrl = _amsgshared.validateAvatarUrl; exports.isValidISO8601 = isValidISO8601; exports.isValidUUID = isValidUUID; exports.isValidUUIDv4 = isValidUUIDv4; exports.validateSplitPattern = validateSplitPattern; exports.validateLlmMessagesArray = validateLlmMessagesArray; exports.MAX_TASK_PAYLOAD_BYTES = MAX_TASK_PAYLOAD_BYTES; exports.validateScheduleMessagePayload = validateScheduleMessagePayload; exports.DEFAULT_MAX_REQUEST_BODY_BYTES = DEFAULT_MAX_REQUEST_BODY_BYTES; exports.readRequestBody = readRequestBody; exports.parseJsonBody = parseJsonBody; exports.getHeader = getHeader; exports.createGetUserKeyHandler = createGetUserKeyHandler; exports.NonRetryableError = NonRetryableError; exports.isNonRetryableError = isNonRetryableError; exports.DeploymentConfigError = DeploymentConfigError; exports.sanitizeErrorSummary = sanitizeErrorSummary; exports.summarizeErrorCause = summarizeErrorCause; exports.DEFAULT_MAX_DELIVERY_RETRIES = DEFAULT_MAX_DELIVERY_RETRIES; exports.WEB_PUSH_MAX_BODY_BYTES = WEB_PUSH_MAX_BODY_BYTES; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.MAX_PUSH_PAYLOAD_BYTES = MAX_PUSH_PAYLOAD_BYTES; exports.PUSH_ENVELOPE_RESERVED_BYTES = PUSH_ENVELOPE_RESERVED_BYTES; exports.measurePushPayload = measurePushPayload; exports.createWebCryptoWebPush = createWebCryptoWebPush; exports.DEFAULT_MAX_TOOL_ITERATIONS = DEFAULT_MAX_TOOL_ITERATIONS; exports.DEFAULT_TOTAL_TIMEOUT_MS = DEFAULT_TOTAL_TIMEOUT_MS; exports.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE = DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE; exports.MIN_SCHEDULE_LEAD_MS = MIN_SCHEDULE_LEAD_MS; exports.MAX_DEFER_AFTER_MS = MAX_DEFER_AFTER_MS; exports.createScheduleMessageHandler = createScheduleMessageHandler; exports.DEFAULT_CLAIM_LEASE_MS = DEFAULT_CLAIM_LEASE_MS; exports.DEFAULT_LEASE_HEARTBEAT_MS = DEFAULT_LEASE_HEARTBEAT_MS; exports.DEFAULT_HEARTBEAT_LEASE_TTL_MS = DEFAULT_HEARTBEAT_LEASE_TTL_MS; exports.runScheduledTick = runScheduledTick; exports.runTask = runTask; exports.createUpdateMessageHandler = createUpdateMessageHandler; exports.createCancelMessageHandler = createCancelMessageHandler; exports.createMessagesHandler = createMessagesHandler; exports.createGetMessageHandler = createGetMessageHandler; exports.createPushSubscriptionHandler = createPushSubscriptionHandler; exports.createLlmCredentialsHandler = createLlmCredentialsHandler; exports.createD1Adapter = createD1Adapter; exports.createSingleUserServer = createSingleUserServer; exports.SCHEMA_VERSION = SCHEMA_VERSION; exports.getSchemaVersion = getSchemaVersion; exports.ensureSchema = ensureSchema; exports.CORS_ALLOW_HEADERS = CORS_ALLOW_HEADERS; exports.CORS_ALLOW_METHODS = CORS_ALLOW_METHODS; exports.createSingleUserCloudflareWorker = createSingleUserCloudflareWorker;