@rei-standard/amsg-server 3.0.0 → 3.1.0-next.1

package/dist/{chunk-YBDQJVFQ.cjs → chunk-D4SKSCIY.cjs}

@@ -147,14 +147,33 @@ var _amsgshared = require('@rei-standard/amsg-shared');
 // src/server/lib/encryption.js
 var base64ToBytes = _amsgshared.base64UrlToBytes;
 var TAG_LENGTH_BYTES = 16;
+var AES_KEY_CACHE_MAX = 128;
+var aesKeyCache = /* @__PURE__ */ new Map();
 function importAesKey(hexKey, usage) {
-  return globalThis.crypto.subtle.importKey(
-    "raw",
-    _amsgshared.hexToBytes.call(void 0, hexKey),
-    { name: "AES-GCM" },
-    false,
-    [usage]
-  );
+  const cacheKey = `${usage}:${hexKey}`;
+  const cached = aesKeyCache.get(cacheKey);
+  if (cached) return cached;
+  let promise;
+  try {
+    promise = globalThis.crypto.subtle.importKey(
+      "raw",
+      _amsgshared.hexToBytes.call(void 0, hexKey),
+      { name: "AES-GCM" },
+      false,
+      [usage]
+    ).catch((err6) => {
+      aesKeyCache.delete(cacheKey);
+      throw err6;
+    });
+  } catch (err6) {
+    return Promise.reject(err6);
+  }
+  if (aesKeyCache.size >= AES_KEY_CACHE_MAX) {
+    const oldest = aesKeyCache.keys().next().value;
+    if (oldest !== void 0) aesKeyCache.delete(oldest);
+  }
+  aesKeyCache.set(cacheKey, promise);
+  return promise;
 }
 async function aesGcmSeal(hexKey, iv, plaintextBytes) {
   const key = await importAesKey(hexKey, "encrypt");
@@ -428,6 +447,9 @@ function taskPayloadByteLength(serializedPayload) {
   return taskPayloadEncoder.encode(serializedPayload).length;
 }
 function validateScheduleMessagePayload(payload) {
+  if (payload.taskInput != null && (typeof payload.taskInput !== "object" || Array.isArray(payload.taskInput))) {
+    return { valid: false, errorCode: "INVALID_TASK_INPUT", errorMessage: "taskInput must be an object or null" };
+  }
   if (!payload.contactName || typeof payload.contactName !== "string") {
     return { valid: false, errorCode: "INVALID_PARAMETERS", errorMessage: "\u7F3A\u5C11\u5FC5\u9700\u53C2\u6570\u6216\u53C2\u6570\u683C\u5F0F\u9519\u8BEF", details: { missingFields: ["contactName"] } };
   }
@@ -982,6 +1004,40 @@ function createWebCryptoWebPush(vapid = {}, { ttl = SCHEDULED_DEFAULT_TTL } = {}
   };
 }
 
+// src/server/lib/attachments.js
+var ATTACHMENT_NAMESPACE = "amsg:attachments";
+var ATTACHMENT_RETENTION_DAYS = 30;
+var MAX_ATTACHMENT_TTL_MS = ATTACHMENT_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+function createAttachmentStore({ task, occurrenceMs, writeState, now }) {
+  return async function storeAttachment(value, { ttlMs = MAX_ATTACHMENT_TTL_MS, owner, kind = "attachment", ownerGeneration } = {}) {
+    if (typeof value !== "string") throw new TypeError("storeAttachment value must be a serialized string");
+    if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > MAX_ATTACHMENT_TTL_MS) {
+      throw new RangeError("storeAttachment ttlMs must be between 1 millisecond and 30 days");
+    }
+    if (typeof task.uuid !== "string" || !task.uuid || !Number.isFinite(occurrenceMs)) {
+      throw new TypeError("storeAttachment requires a task UUID and a valid occurrence");
+    }
+    const at = now();
+    const ref = { version: (
+      /** @type {1} */
+      1
+    ), namespace: ATTACHMENT_NAMESPACE, key: _amsgshared.randomUUID.call(void 0, ), taskUuid: task.uuid, occurrenceMs, expiresAt: at + ttlMs };
+    let result;
+    try {
+      result = await writeState(ATTACHMENT_NAMESPACE, [{ key: ref.key, value: JSON.stringify({ ...ref, owner, kind, ownerGeneration, value }), updatedAt: at, owner, kind, ownerGeneration }]);
+    } catch (error) {
+      if (_optionalChain([error, 'optionalAccess', _5 => _5.code]) === "AGENTIC_STATE_WRITE_UNSUPPORTED") {
+        throw new DeploymentConfigError("ATTACHMENT_STORAGE_UNSUPPORTED: attachments require a client_state adapter (built-in support: D1)", { code: "ATTACHMENT_STORAGE_UNSUPPORTED" });
+      }
+      throw error;
+    }
+    if (result.upserted !== 1 || result.skipped !== 0) {
+      throw new Error("ATTACHMENT_WRITE_INCOMPLETE: attachment was not stored");
+    }
+    return ref;
+  };
+}
+
 // src/server/lib/agentic-fire.js
 
 
@@ -1192,6 +1248,7 @@ async function writeClientStateEntries({ db, userId, userKey, entries, now }) {
   let upserted = 0;
   let skipped = 0;
   let deleted = 0;
+  let unknown = 0;
   const skippedEntries = [];
   if (Array.isArray(result.outcomes) && result.outcomes.length === physicalRows.length) {
     for (let i = 0; i < rootRowIndexes.length; i++) {
@@ -1203,9 +1260,10 @@ async function writeClientStateEntries({ db, userId, userKey, entries, now }) {
         skippedEntries.push({ namespace: entry.namespace, key: entry.key });
       }
     }
+  } else if (result.upserted === physicalRows.length && result.skipped === 0) {
+    upserted = rootRowIndexes.length;
   } else {
-    upserted = result.upserted;
-    skipped = result.skipped;
+    unknown = rootRowIndexes.length;
   }
   const cleanupOutcomes = Array.isArray(result.cleanupOutcomes) && result.cleanupOutcomes.length === cleanups.length ? result.cleanupOutcomes : null;
   for (const { cleanupIndex, entry } of deletions) {
@@ -1216,22 +1274,26 @@ async function writeClientStateEntries({ db, userId, userKey, entries, now }) {
       deleted++;
     }
   }
-  return { upserted, skipped, deleted, skippedEntries };
+  return { upserted, skipped, deleted, skippedEntries, ...unknown > 0 ? { unknown } : {} };
 }
 
 // src/server/lib/state-accessors.js
 function createStateAccessors({ db, userId, userKey, maxStateValueBytes, now }) {
   const nowFn = typeof now === "function" ? now : Date.now;
   const valueCeiling = Number.isInteger(maxStateValueBytes) && maxStateValueBytes > 0 ? maxStateValueBytes : DEFAULT_MAX_STATE_VALUE_BYTES;
-  const readState = async (namespace) => {
+  const readState = async (namespace, { key } = {}) => {
     if (typeof namespace !== "string" || !namespace.trim()) {
       throw new TypeError("readState(namespace) requires a non-empty string");
     }
+    if (key !== void 0 && (typeof key !== "string" || !key.trim() || key.length > MAX_KEY_CHARS || INTERNAL_STATE_CHAR_RE.test(key))) {
+      throw new TypeError(`readState key must be a non-empty string of at most ${MAX_KEY_CHARS} characters without control characters`);
+    }
     if (!db || typeof db.getClientState !== "function") return [];
-    const rows = await db.getClientState(userId, namespace);
+    const rows = await db.getClientState(userId, namespace, key === void 0 ? void 0 : { key });
     return resolveClientStateEntries(
-      rows,
-      () => db.getClientState(userId, chunkNamespaceFor(namespace)),
+      // 老适配器可能忽略第三个参数，仍在解密前过滤根行，保持返回契约。
+      key === void 0 ? rows : rows.filter((row) => row.key === key),
+      () => db.getClientState(userId, chunkNamespaceFor(namespace), key === void 0 ? void 0 : { keyPrefix: chunkKeyPrefixFor(key) }),
       (value) => decryptFromStorage(value, userKey)
     );
   };
@@ -1287,6 +1349,9 @@ function createStateAccessors({ db, userId, userKey, maxStateValueBytes, now })
         namespace,
         key: entry.key,
         value: entry.value,
+        owner: entry.owner,
+        kind: entry.kind,
+        ownerGeneration: entry.ownerGeneration,
         updatedAt: _nullishCoalesce(entry.updatedAt, () => ( at)),
         ...entry.version !== void 0 ? { version: entry.version } : {}
       };
@@ -1309,7 +1374,7 @@ async function appendPushesToOutbox({ db, userId, userKey, pushes }) {
     await db.appendOutboxMessages(userId, await toOutboxRows(pushes, userKey, Date.now()));
     return true;
   } catch (error) {
-    if (_optionalChain([error, 'optionalAccess', _5 => _5.code]) === "CLOUD_OWNER_RETIRED") throw error;
+    if (_optionalChain([error, 'optionalAccess', _6 => _6.code]) === "CLOUD_OWNER_RETIRED") throw error;
     console.warn("[amsg-server] outbox \u843D\u884C\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u6295\u9012\uFF09:", error && error.message);
     return false;
   }
@@ -1583,7 +1648,7 @@ async function sendResultPush({ db, task, userKey, decryptedPayload, webpush, pu
     await sendTaggedPush(webpush, subscription, JSON.stringify(push));
     return true;
   } catch (error) {
-    if (isTaskCancelledError(error) || _optionalChain([error, 'optionalAccess', _6 => _6.code]) === "CLOUD_OWNER_RETIRED") throw error;
+    if (isTaskCancelledError(error) || _optionalChain([error, 'optionalAccess', _7 => _7.code]) === "CLOUD_OWNER_RETIRED") throw error;
     console.warn(
       `[amsg-server] \u7ED3\u679C ${push.messageId} \u7684\u63A8\u9001\u6CA1\u53D1\u51FA\u53BB\uFF08\u5DF2\u843D\u8FDB\u6536\u4EF6\u7BB1\uFF0C\u7B49\u5BA2\u6237\u7AEF\u8865\u6536\uFF09:`,
       error && error.message
@@ -1618,7 +1683,7 @@ function projectTask(row, decryptedPayload, options = {}) {
     // 凭据引用只是名字（cred_id），本体在 llm_credentials 表里，凭据字段本身
     // 照旧被白名单挡在外面。
     credRefs: _nullishCoalesce(payload.credRefs, () => ( null)),
-    // 整份 metadata 只在单条查询里给（见上面的 includeMetadata）。
+    // 整份 metadata 由 includeMetadata 控制，单条查询与 hook 回执会带。
     ...options.includeMetadata ? { metadata: _nullishCoalesce(payload.metadata, () => ( null)) } : {},
     // 上一次没发出去的原因。reason 'stale' 表示错过触发时刻太久被判定不再补
     // 发；其余是投递失败的错误信息。没有记录 → null。
@@ -1709,6 +1774,9 @@ function normalizeBeforeFireResult(result) {
     return { messages: result };
   }
   if (result && typeof result === "object" && Array.isArray(result.messages)) {
+    if (result.allowedToolNames !== void 0 && (!Array.isArray(result.allowedToolNames) || result.allowedToolNames.some((name) => typeof name !== "string" || !name.trim()))) {
+      throw markPermanent(new TypeError("allowedToolNames must be an array of non-empty strings"), "AGENTIC_BAD_BEFORE_FIRE");
+    }
     return {
       messages: result.messages,
       maxToolIterations: result.maxToolIterations,
@@ -1717,7 +1785,8 @@ function normalizeBeforeFireResult(result) {
       // 用真值。真正决定请求体带不带 tools 的规则住在 llm.js 的
       // buildAiRequestBody（那边有测试钉着），这层只是不把空数组往下传。
       tools: Array.isArray(result.tools) && result.tools.length > 0 ? result.tools : void 0,
-      toolChoice: result.toolChoice
+      toolChoice: result.toolChoice,
+      allowedToolNames: result.allowedToolNames === void 0 ? void 0 : new Set(result.allowedToolNames)
     };
   }
   throw markPermanent(new TypeError(BAD_BEFORE_FIRE_MESSAGE), "AGENTIC_BAD_BEFORE_FIRE");
@@ -1737,7 +1806,7 @@ function firstPositiveNumber(values, fallback) {
 async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
   const hooks = ctx.hooks;
   const signal = ctx.signal || new AbortController().signal;
-  const isCancelled = () => signal.aborted || _optionalChain([ctx, 'access', _7 => _7.isTaskCancelled, 'optionalCall', _8 => _8()]) === true;
+  const isCancelled = () => signal.aborted || _optionalChain([ctx, 'access', _8 => _8.isTaskCancelled, 'optionalCall', _9 => _9()]) === true;
   const throwIfCancelled = () => {
     if (!isCancelled()) return;
     if (isTaskCancelledError(signal.reason)) throw signal.reason;
@@ -1769,6 +1838,8 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
   const sessionId = task.id != null ? `sess_task_${task.id}${occurrenceSuffix(task)}` : `sess_${_amsgshared.randomUUID.call(void 0, )}`;
   const messageIdBase = task.id != null ? `msg_task_${task.id}${occurrenceSuffix(task)}` : `msg_${_amsgshared.randomUUID.call(void 0, )}`;
   const occurrenceMs = occurrenceMsOf(task);
+  const storeAttachment = createAttachmentStore({ task, occurrenceMs, writeState, now: nowFn });
+  const storeSettledAttachment = createAttachmentStore({ task, occurrenceMs, writeState: writeSettledState, now: nowFn });
   const { emitResult } = createResultEmitter({
     db: ctx.db,
     task,
@@ -1791,17 +1862,37 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       const row = await ctx.db.getTaskByUuid(uuid, task.user_id);
       if (!row) return null;
       const payload = JSON.parse(await decryptFromStorage(row.encrypted_payload, userKey));
-      return projectTask(row, payload);
+      return projectTask(row, payload, { includeMetadata: true });
     } catch (error) {
       console.warn("[amsg-server] scheduleTask: \u8BFB\u53D6\u649E\u8F66\u4EFB\u52A1\u5931\u8D25\uFF08\u5DF2\u5FFD\u7565\uFF09:", error && error.message);
       return null;
     }
   }
+  const listTasks = async (options = {}) => {
+    throwIfCancelled();
+    const { status = "pending", limit = 100, offset = 0, includeMetadata = true } = options;
+    if (!["pending", "sent", "failed", "all"].includes(status) || !Number.isInteger(limit) || limit < 1 || limit > 100 || !Number.isInteger(offset) || offset < 0) {
+      throw new TypeError("listTasks requires a valid status, limit 1-100, and non-negative offset");
+    }
+    if (typeof _optionalChain([ctx, 'access', _10 => _10.db, 'optionalAccess', _11 => _11.listTasks]) !== "function") {
+      throw new DeploymentConfigError("AGENTIC_TASK_VIEW_UNSUPPORTED: adapter has no listTasks", { code: "AGENTIC_TASK_VIEW_UNSUPPORTED" });
+    }
+    const { tasks, total } = await ctx.db.listTasks(task.user_id, { status, limit, offset });
+    const projected = await Promise.all(tasks.map(async (row) => projectTask(
+      row,
+      JSON.parse(await decryptFromStorage(row.encrypted_payload, userKey)),
+      { includeMetadata }
+    )));
+    return { tasks: projected, pagination: { total, limit, offset, hasMore: offset + tasks.length < total } };
+  };
   const scheduleTask = async (options) => {
     throwIfCancelled();
     if (!options || typeof options !== "object" || Array.isArray(options)) {
       throw new TypeError("scheduleTask(options) \u9700\u8981\u4E00\u4E2A\u5BF9\u8C61\uFF0C\u81F3\u5C11\u5305\u542B { firstSendTime }");
     }
+    if (options.taskInput != null && (typeof options.taskInput !== "object" || Array.isArray(options.taskInput))) {
+      throw new TypeError("scheduleTask: taskInput must be an object or null");
+    }
     if (typeof options.firstSendTime !== "string" || !options.firstSendTime.trim()) {
       throw new RangeError("scheduleTask: firstSendTime \u5FC5\u586B\uFF0C\u4E14\u5FC5\u987B\u662F ISO 8601 \u5B57\u7B26\u4E32");
     }
@@ -1896,7 +1987,8 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       // 与凭据同列的投递配置：中转的非标准参数（thinking 之类）跟着任务走，
       // 自排的后续任务不该突然掉档。
       llmExtraBody: _nullishCoalesce(decryptedPayload.llmExtraBody, () => ( null)),
-      metadata
+      metadata,
+      taskInput: _nullishCoalesce(options.taskInput, () => ( null))
     };
     const serializedTaskData = JSON.stringify(fullTaskData);
     const sizeError = validateTaskPayloadSize(serializedTaskData);
@@ -1950,7 +2042,8 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       created: true,
       id: _nullishCoalesce(created.id, () => ( null)),
       uuid: _nullishCoalesce(created.uuid, () => ( uuid)),
-      nextSendAt: _nullishCoalesce(created.next_send_at, () => ( nextSendAt))
+      nextSendAt: _nullishCoalesce(created.next_send_at, () => ( nextSendAt)),
+      task: projectTask({ status: "pending", next_send_at: nextSendAt, ...created }, fullTaskData, { includeMetadata: true })
     };
   };
   const cancelTask = async (uuid) => {
@@ -2018,7 +2111,11 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       const stillPending = await ctx.db.getTaskByUuid(uuid, task.user_id);
       return { renewed: false, reason: stillPending ? "in_flight" : "not_found" };
     }
-    return { renewed: true, uuid, nextSendAt: nextSendAtIso };
+    return { renewed: true, uuid, nextSendAt: nextSendAtIso, task: projectTask(
+      { ...row, next_send_at: nextSendAtIso, retry_count: 0 },
+      payload,
+      { includeMetadata: true }
+    ) };
   };
   const resolveLlmCredential2 = async (credId) => {
     if (typeof credId !== "string" || !credId.trim()) {
@@ -2035,7 +2132,9 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
     readState,
     writeState,
     emitResult,
+    storeAttachment,
     scheduleTask,
+    listTasks,
     cancelTask,
     renewTask,
     resolveLlmCredential: resolveLlmCredential2,
@@ -2068,8 +2167,10 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       readState,
       writeState,
       emitResult,
+      storeAttachment,
       scratch,
       scheduleTask,
+      listTasks,
       cancelTask,
       renewTask,
       resolveLlmCredential: resolveLlmCredential2,
@@ -2128,7 +2229,8 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       scratch,
       readState,
       writeState: writeSettledState,
-      emitResult
+      emitResult,
+      storeAttachment: storeSettledAttachment
     });
   }
 }
@@ -2143,8 +2245,10 @@ async function runFireChain({
   readState,
   writeState,
   emitResult,
+  storeAttachment,
   scratch,
   scheduleTask,
+  listTasks,
   cancelTask,
   renewTask,
   resolveLlmCredential: resolveLlmCredential2,
@@ -2243,15 +2347,35 @@ async function runFireChain({
       readState,
       writeState,
       emitResult,
+      storeAttachment,
       scheduleTask,
+      listTasks,
       cancelTask,
       renewTask,
       resolveLlmCredential: resolveLlmCredential2
     });
     const decision = await hooks.onLLMOutput(sessionCtx);
     ctx.throwIfCancelled();
+    const rawCalls = _optionalChain([decision, 'optionalAccess', _12 => _12.decision]) === "tool-request" ? _amsgshared.extractToolCallsFromDecision.call(void 0, decision) : [];
+    const validId = (call) => typeof _optionalChain([call, 'optionalAccess', _13 => _13.id]) === "string" && call.id.trim().length > 0;
+    const nativeCalls = Array.isArray(assistantMessage.tool_calls) ? assistantMessage.tool_calls : [];
+    const usedIds = new Set([...rawCalls, ...nativeCalls].filter(validId).map((call) => call.id));
+    const malformedIds = /* @__PURE__ */ new Set();
+    const toolCalls = rawCalls.map((call, index) => {
+      let id = validId(call) ? call.id : `call_${iteration + 1}_${index + 1}`;
+      if (!validId(call)) {
+        while (usedIds.has(id)) id += "_";
+        usedIds.add(id);
+      }
+      if (typeof _optionalChain([call, 'optionalAccess', _14 => _14.function, 'optionalAccess', _15 => _15.name]) !== "string" || !call.function.name.trim()) {
+        malformedIds.add(id);
+        return { id, type: "function", function: { name: "invalid_tool_call", arguments: "{}" } };
+      }
+      return { ...call, id };
+    });
+    const validationDecision = _optionalChain([decision, 'optionalAccess', _16 => _16.decision]) === "tool-request" && Array.isArray(decision.toolCalls) && decision.toolCalls.length > 0 ? { ...decision, toolCalls } : decision;
     try {
-      _amsgshared.assertValidDecision.call(void 0, decision, { inlineToolCalls: true });
+      _amsgshared.assertValidDecision.call(void 0, validationDecision, { inlineToolCalls: true });
     } catch (error) {
       throw markPermanent(error, "AGENTIC_BAD_DECISION");
     }
@@ -2282,14 +2406,19 @@ async function runFireChain({
       });
       return { handled: true, result: { success: true, messagesSent, status: "finished", iterations: iteration + 1 } };
     }
-    const toolCalls = _amsgshared.extractToolCallsFromDecision.call(void 0, decision);
     if (toolCalls.length === 0) {
       throw taggedRetryableError(
         "AGENTIC_EMPTY_TOOL_REQUEST: tool-request decision carried no toolCalls (neither decision.toolCalls nor pushPayloads[].toolCalls)",
         "AGENTIC_EMPTY_TOOL_REQUEST"
       );
     }
-    if (typeof hooks.executeToolCalls !== "function") {
+    const permittedCalls = toolCalls.filter((call) => !malformedIds.has(call.id) && (normalized.allowedToolNames === void 0 || normalized.allowedToolNames.has(call.function.name)));
+    const deniedResults = toolCalls.filter((call) => !permittedCalls.includes(call)).map((call) => ({
+      role: "tool",
+      tool_call_id: call.id,
+      content: JSON.stringify({ error: malformedIds.has(call.id) ? { code: "INVALID_TOOL_CALL", message: "Tool call requires a function name" } : { code: "TOOL_NOT_ALLOWED", message: "Tool execution is not allowed for this fire" } })
+    }));
+    if (permittedCalls.length > 0 && typeof hooks.executeToolCalls !== "function") {
       throw new DeploymentConfigError(
         "AGENTIC_CONFIG_ERROR: onLLMOutput returned tool-request but hooks.executeToolCalls is not configured",
         { code: "AGENTIC_CONFIG_ERROR" }
@@ -2301,7 +2430,7 @@ async function runFireChain({
     let toolResults;
     try {
       ctx.throwIfCancelled();
-      toolResults = await hooks.executeToolCalls(toolCalls, sessionCtx);
+      toolResults = permittedCalls.length > 0 ? await hooks.executeToolCalls(permittedCalls, sessionCtx) : [];
       ctx.throwIfCancelled();
       if (!Array.isArray(toolResults)) {
         throw new TypeError('executeToolCalls must resolve to an array of { tool_call_id, role: "tool", content }');
@@ -2309,16 +2438,17 @@ async function runFireChain({
     } catch (error) {
       ctx.throwIfCancelled();
       if (isTaskCancelledError(error)) throw error;
-      toolResults = toolCalls.map((toolCall) => ({
+      toolResults = permittedCalls.map((toolCall) => ({
         tool_call_id: toolCall && typeof toolCall === "object" && typeof toolCall.id === "string" ? toolCall.id : "",
         role: "tool",
-        content: `Tool execution failed: ${_nullishCoalesce(_optionalChain([error, 'optionalAccess', _9 => _9.message]), () => ( String(error)))}`
+        content: `Tool execution failed: ${_nullishCoalesce(_optionalChain([error, 'optionalAccess', _17 => _17.message]), () => ( String(error)))}`
       }));
     }
-    const nativeCalls = Array.isArray(assistantMessage.tool_calls) ? assistantMessage.tool_calls : [];
-    const nativeIds = new Set(nativeCalls.map((tc) => tc && tc.id));
-    const synthesized = toolCalls.filter((tc) => !nativeIds.has(tc && tc.id));
-    const assistantWithTools = synthesized.length === 0 ? assistantMessage : { ...assistantMessage, tool_calls: [...nativeCalls, ...synthesized] };
+    toolResults = [...toolResults, ...deniedResults];
+    const declared = nativeCalls.filter(validId).map((call) => toolCalls.find((item) => item.id === call.id) || call);
+    const nativeIds = new Set(declared.map((call) => call.id));
+    const synthesized = toolCalls.filter((call) => !nativeIds.has(call.id));
+    const assistantWithTools = { ...assistantMessage, tool_calls: [...declared, ...synthesized] };
     messages = [...messages.slice(0, -1), assistantWithTools, ...toolResults];
   }
   throw taggedRetryableError(
@@ -2497,7 +2627,7 @@ function validOwner(owner) {
   return owner && typeof owner.type === "string" && owner.type.trim().length > 0 && owner.type.length <= 100 && typeof owner.id === "string" && owner.id.trim().length > 0 && owner.id.length <= 300;
 }
 function validateGuard(guard) {
-  if (!validOwner(_optionalChain([guard, 'optionalAccess', _10 => _10.owner])))
+  if (!validOwner(_optionalChain([guard, 'optionalAccess', _18 => _18.owner])))
     throw guardError("INVALID_CLOUD_OWNER", "Cloud owner is invalid");
   if (!Number.isSafeInteger(guard.generation) || guard.generation < 0) {
     throw guardError(
@@ -2525,14 +2655,14 @@ async function assertCloudGuard(db, userId, guard) {
 }
 async function resolveMetadata(resolveOwner, input, explicit) {
   const resolved = typeof resolveOwner === "function" ? await resolveOwner(input) : null;
-  const owner = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _11 => _11.owner]), () => ( _optionalChain([explicit, 'optionalAccess', _12 => _12.metadata, 'optionalAccess', _13 => _13.cloudOwner]))), () => ( _optionalChain([resolved, 'optionalAccess', _14 => _14.owner]))), () => ( (validOwner(resolved) ? resolved : null)));
+  const owner = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _19 => _19.owner]), () => ( _optionalChain([explicit, 'optionalAccess', _20 => _20.metadata, 'optionalAccess', _21 => _21.cloudOwner]))), () => ( _optionalChain([resolved, 'optionalAccess', _22 => _22.owner]))), () => ( (validOwner(resolved) ? resolved : null)));
   if (owner !== null && !validOwner(owner))
     throw guardError("INVALID_CLOUD_OWNER", "Cloud owner is invalid");
-  return { owner, kind: _nullishCoalesce(_nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _15 => _15.kind]), () => ( _optionalChain([resolved, 'optionalAccess', _16 => _16.kind]))), () => ( null)) };
+  return { owner, kind: _nullishCoalesce(_nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _23 => _23.kind]), () => ( _optionalChain([resolved, 'optionalAccess', _24 => _24.kind]))), () => ( null)) };
 }
 async function captureCloudTaskGuard(db, userId, payload, resolveOwner, task) {
   if (!db.cloudDataManagement) return null;
-  if (_optionalChain([payload, 'optionalAccess', _17 => _17.__cloudOwnerGuard])) {
+  if (_optionalChain([payload, 'optionalAccess', _25 => _25.__cloudOwnerGuard])) {
     const guard2 = validateGuard(payload.__cloudOwnerGuard);
     await assertCloudGuard(db, userId, guard2);
     return guard2;
@@ -2545,7 +2675,7 @@ async function captureCloudTaskGuard(db, userId, payload, resolveOwner, task) {
   if (!owner) return null;
   const guard = validateGuard({
     owner,
-    generation: _nullishCoalesce(_optionalChain([payload, 'optionalAccess', _18 => _18.ownerGeneration]), () => ( 0))
+    generation: _nullishCoalesce(_optionalChain([payload, 'optionalAccess', _26 => _26.ownerGeneration]), () => ( 0))
   });
   await assertCloudGuard(db, userId, guard);
   return guard;
@@ -2597,7 +2727,7 @@ function createCloudGuardedAdapter(db, {
       }
       guard = inheritedGuard || validateGuard({
         owner: resolved.owner,
-        generation: _nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _19 => _19.ownerGeneration]), () => ( 0))
+        generation: _nullishCoalesce(_optionalChain([explicit, 'optionalAccess', _27 => _27.ownerGeneration]), () => ( 0))
       });
     } else {
       guard = null;
@@ -2605,9 +2735,9 @@ function createCloudGuardedAdapter(db, {
     await assertCloudGuard(db, userId, inheritedGuard);
     await assertCloudGuard(db, userId, guard);
     const metadata = {
-      owner: _nullishCoalesce(_optionalChain([guard, 'optionalAccess', _20 => _20.owner]), () => ( resolved.owner)),
+      owner: _nullishCoalesce(_optionalChain([guard, 'optionalAccess', _28 => _28.owner]), () => ( resolved.owner)),
       kind: resolved.kind,
-      generation: _nullishCoalesce(_optionalChain([guard, 'optionalAccess', _21 => _21.generation]), () => ( 0))
+      generation: _nullishCoalesce(_optionalChain([guard, 'optionalAccess', _29 => _29.generation]), () => ( 0))
     };
     return {
       cloudGuard: guard,
@@ -2787,7 +2917,7 @@ function createCloudGuardedAdapter(db, {
         else delete payload[field];
       }
       if (payload.metadata && typeof payload.metadata === "object") {
-        if (_optionalChain([originalPayload, 'access', _22 => _22.metadata, 'optionalAccess', _23 => _23.cloudOwner]) !== void 0)
+        if (_optionalChain([originalPayload, 'access', _30 => _30.metadata, 'optionalAccess', _31 => _31.cloudOwner]) !== void 0)
           payload.metadata.cloudOwner = originalPayload.metadata.cloudOwner;
         else delete payload.metadata.cloudOwner;
       }
@@ -2979,11 +3109,11 @@ async function processSingleMessage(task, ctx, providedMasterKey, predecrypted =
     }
     const userKey = predecrypted && predecrypted.userKey || await deriveUserEncryptionKey(task.user_id, masterKey);
     const decryptedPayload = predecrypted && predecrypted.payload || JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
-    const cloudGuard = await captureCloudTaskGuard(ctx.db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _24 => _24.cloudData, 'optionalAccess', _25 => _25.resolveOwner]), task);
+    const cloudGuard = await captureCloudTaskGuard(ctx.db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _32 => _32.cloudData, 'optionalAccess', _33 => _33.resolveOwner]), task);
     if (cloudGuard) {
       await assertCloudGuard(ctx.db, task.user_id, cloudGuard);
       const originalWebpush = ctx.webpush;
-      const guardedDb = createCloudGuardedAdapter(ctx.db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _26 => _26.cloudData, 'optionalAccess', _27 => _27.resolveOwner]), guard: cloudGuard, userId: task.user_id });
+      const guardedDb = createCloudGuardedAdapter(ctx.db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _34 => _34.cloudData, 'optionalAccess', _35 => _35.resolveOwner]), guard: cloudGuard, userId: task.user_id });
       ctx = { ...ctx, db: guardedDb, webpush: originalWebpush && {
         ...originalWebpush,
         async sendNotification(...args) {
@@ -3179,8 +3309,8 @@ async function processMessagesByUuid(uuid, ctx, maxRetries = 2, userId, provided
       try {
         const userKey = await deriveUserEncryptionKey(task.user_id, masterKey);
         const payload = JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
-        const guard = await captureCloudTaskGuard(ctx.db, task.user_id, payload, _optionalChain([ctx, 'access', _28 => _28.cloudData, 'optionalAccess', _29 => _29.resolveOwner]), task);
-        if (guard) attemptDb = createCloudGuardedAdapter(ctx.db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _30 => _30.cloudData, 'optionalAccess', _31 => _31.resolveOwner]), guard, userId: task.user_id });
+        const guard = await captureCloudTaskGuard(ctx.db, task.user_id, payload, _optionalChain([ctx, 'access', _36 => _36.cloudData, 'optionalAccess', _37 => _37.resolveOwner]), task);
+        if (guard) attemptDb = createCloudGuardedAdapter(ctx.db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _38 => _38.cloudData, 'optionalAccess', _39 => _39.resolveOwner]), guard, userId: task.user_id });
       } catch (error) {
         return { success: false, error: { code: error.code || "PROCESSING_ERROR", message: error.message, retriesAttempted: retryCount } };
       }
@@ -3216,7 +3346,7 @@ async function processMessagesByUuid(uuid, ctx, maxRetries = 2, userId, provided
           })
         });
       } catch (_updateError) {
-        if (_optionalChain([_updateError, 'optionalAccess', _32 => _32.code]) === "CLOUD_OWNER_RETIRED") {
+        if (_optionalChain([_updateError, 'optionalAccess', _40 => _40.code]) === "CLOUD_OWNER_RETIRED") {
           return { success: false, error: { code: _updateError.code, message: _updateError.message, retriesAttempted: retryCount } };
         }
         try {
@@ -3392,6 +3522,9 @@ function createScheduleMessageHandler(ctx) {
       owner: payload.owner,
       kind: payload.kind,
       ownerGeneration: payload.ownerGeneration,
+      // Input is persisted with the task in the same create/supersede transaction.
+      // Shared credentials remain references and continue to resolve at fire time.
+      taskInput: _nullishCoalesce(payload.taskInput, () => ( null)),
       metadata: payload.metadata || {}
     };
     const serializedTaskData = JSON.stringify(fullTaskData);
@@ -3599,7 +3732,7 @@ async function runScheduledTick(ctx) {
 }
 async function cleanupExpiredClientState(ctx) {
   if (typeof ctx.db.cleanupClientState !== "function") return;
-  const targets = planClientStateCleanup(ctx.clientStateTtl, Date.now());
+  const targets = planClientStateCleanup({ [ATTACHMENT_NAMESPACE]: ATTACHMENT_RETENTION_DAYS, ...ctx.clientStateTtl }, Date.now());
   if (targets.length === 0) return;
   try {
     await ctx.db.cleanupClientState(targets);
@@ -3689,7 +3822,7 @@ async function deliverTasks(ctx, tasks) {
         const until = new Date(Date.now() + heartbeatLeaseTtlMs).toISOString();
         renewed = guard ? await db.renewTaskLease(task.id, until, guard) : await db.renewTaskLease(task.id, until);
       } catch (error) {
-        if (_optionalChain([error, 'optionalAccess', _33 => _33.code]) === "CLOUD_OWNER_RETIRED") renewed = false;
+        if (_optionalChain([error, 'optionalAccess', _41 => _41.code]) === "CLOUD_OWNER_RETIRED") renewed = false;
         else console.warn("[amsg-server] \u79DF\u7EA6\u7EED\u79DF\u5931\u8D25\uFF08\u4E0B\u4E2A\u5FC3\u8DF3\u518D\u8BD5\uFF09:", error && error.message);
       }
       if (renewed === false) {
@@ -3732,7 +3865,7 @@ async function deliverTasks(ctx, tasks) {
       lastErrorColumnSuspicions.delete(db);
       return result2;
     } catch (error) {
-      if (_optionalChain([error, 'optionalAccess', _34 => _34.code]) === "CLOUD_OWNER_RETIRED") throw error;
+      if (_optionalChain([error, 'optionalAccess', _42 => _42.code]) === "CLOUD_OWNER_RETIRED") throw error;
       combinedError = error;
     }
     const result = await updateLifecycleTask(taskId, stateFields);
@@ -3927,12 +4060,12 @@ async function deliverTasks(ctx, tasks) {
     let claimed;
     try {
       if (decrypted.ok) {
-        const guard = await captureCloudTaskGuard(db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _35 => _35.cloudData, 'optionalAccess', _36 => _36.resolveOwner]), task);
+        const guard = await captureCloudTaskGuard(db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _43 => _43.cloudData, 'optionalAccess', _44 => _44.resolveOwner]), task);
         if (guard) taskCloudGuards.set(task.id, guard);
       }
       claimed = await claimForThisTick(task, serializeGroup);
     } catch (error) {
-      if (_optionalChain([error, 'optionalAccess', _37 => _37.code]) === "CLOUD_OWNER_RETIRED") {
+      if (_optionalChain([error, 'optionalAccess', _45 => _45.code]) === "CLOUD_OWNER_RETIRED") {
         await recordCancelled(task, "owner_retired");
         return;
       }
@@ -3967,8 +4100,8 @@ async function deliverTasks(ctx, tasks) {
     const notOnFreshRetryChain = (task.retry_count || 0) === 0 || Number.isFinite(retryAfterMs) && Date.now() - retryAfterMs > staleAfterMs;
     const settleAsStale = async () => {
       try {
-        const cloudGuard = await captureCloudTaskGuard(db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _38 => _38.cloudData, 'optionalAccess', _39 => _39.resolveOwner]), task);
-        const guardedDb = createCloudGuardedAdapter(db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _40 => _40.cloudData, 'optionalAccess', _41 => _41.resolveOwner]), guard: cloudGuard, userId: task.user_id });
+        const cloudGuard = await captureCloudTaskGuard(db, task.user_id, decryptedPayload, _optionalChain([ctx, 'access', _46 => _46.cloudData, 'optionalAccess', _47 => _47.resolveOwner]), task);
+        const guardedDb = createCloudGuardedAdapter(db, { masterKey, resolveOwner: _optionalChain([ctx, 'access', _48 => _48.cloudData, 'optionalAccess', _49 => _49.resolveOwner]), guard: cloudGuard, userId: task.user_id });
         const guardedWebpush = cloudGuard && ctx.webpush ? {
           ...ctx.webpush,
           async sendNotification(...args) {
@@ -4259,6 +4392,9 @@ function createUpdateMessageHandler(ctx) {
     if (!isPlainObject(updates)) {
       return { status: 400, body: { success: false, error: { code: "INVALID_UPDATE_DATA", message: "\u66F4\u65B0\u6570\u636E\u683C\u5F0F\u9519\u8BEF" } } };
     }
+    if (Object.prototype.hasOwnProperty.call(updates, "taskInput")) {
+      return { status: 400, body: { success: false, error: { code: "INVALID_UPDATE_DATA", message: "taskInput \u53EA\u80FD\u5728\u521B\u5EFA\u6216\u66FF\u6362\u4EFB\u52A1\u65F6\u8BBE\u7F6E", details: { invalidFields: ["taskInput"] } } } };
+    }
     if (updates.nextSendAt && !isValidISO8601(updates.nextSendAt)) {
       return { status: 400, body: { success: false, error: { code: "INVALID_UPDATE_DATA", message: "\u66F4\u65B0\u6570\u636E\u683C\u5F0F\u9519\u8BEF", details: { invalidFields: ["nextSendAt"] } } } };
     }
@@ -5270,7 +5406,7 @@ var D1Adapter = class {
     return typeof this._db.batch === "function";
   }
   _cloudGuardPredicate(userId, guard) {
-    if (!_optionalChain([guard, 'optionalAccess', _42 => _42.owner]) || !Number.isSafeInteger(guard.generation) || guard.generation < 0) {
+    if (!_optionalChain([guard, 'optionalAccess', _50 => _50.owner]) || !Number.isSafeInteger(guard.generation) || guard.generation < 0) {
       throw new Error("Invalid cloud owner guard");
     }
     return {
@@ -5297,7 +5433,7 @@ var D1Adapter = class {
       indexes.push(expanded.length);
       expanded.push(statements[i]);
       const item = metadata.get(i);
-      if (_optionalChain([item, 'optionalAccess', _43 => _43.value])) {
+      if (_optionalChain([item, 'optionalAccess', _51 => _51.value])) {
         expanded.push(this._db.prepare(
           `INSERT INTO cloud_resource_metadata
           (user_id, resource_key, encrypted_value) SELECT ?, ?, ? WHERE changes() > 0
@@ -5332,14 +5468,39 @@ var D1Adapter = class {
   }
   async getCloudResourceMetadata(userId, resourceKey) {
     const row = await this._db.prepare("SELECT encrypted_value FROM cloud_resource_metadata WHERE user_id=? AND resource_key=?").bind(userId, resourceKey).first();
-    return _nullishCoalesce(_optionalChain([row, 'optionalAccess', _44 => _44.encrypted_value]), () => ( null));
+    return _nullishCoalesce(_optionalChain([row, 'optionalAccess', _52 => _52.encrypted_value]), () => ( null));
+  }
+  async getOutboxPayload(userId, messageId) {
+    const row = await this._db.prepare(
+      "SELECT payload FROM message_outbox WHERE user_id = ? AND message_id = ? LIMIT 1"
+    ).bind(userId, messageId).first();
+    return _nullishCoalesce(_optionalChain([row, 'optionalAccess', _53 => _53.payload]), () => ( null));
   }
   async listCloudResourceRows(userId) {
-    const tables = { task: "scheduled_messages", state: "client_state", credential: "llm_credentials", outbox: "message_outbox", subscription: "push_subscriptions", metadata: "cloud_resource_metadata" };
+    const queries = {
+      task: "SELECT * FROM scheduled_messages WHERE user_id = ?",
+      state: `SELECT user_id, namespace, key,
+        CASE WHEN LENGTH(value) <= 1024 THEN value ELSE NULL END AS value,
+        LENGTH(CAST(value AS BLOB)) AS byte_size,
+        substr(value, 1, 128) AS value_prefix,
+        CASE WHEN LENGTH(value) > 128 THEN substr(value, -64) ELSE '' END AS value_suffix,
+        updated_at
+        FROM client_state WHERE user_id = ?`,
+      credential: "SELECT * FROM llm_credentials WHERE user_id = ?",
+      outbox: `SELECT id, user_id, message_id, task_uuid, session_id, message_index, total_messages,
+        CASE WHEN LENGTH(payload) <= 1024 THEN payload ELSE NULL END AS payload,
+        LENGTH(CAST(payload AS BLOB)) AS byte_size,
+        substr(payload, 1, 128) AS payload_prefix,
+        CASE WHEN LENGTH(payload) > 128 THEN substr(payload, -64) ELSE '' END AS payload_suffix,
+        created_at, delivered_at, acked_at
+        FROM message_outbox WHERE user_id = ?`,
+      subscription: "SELECT * FROM push_subscriptions WHERE user_id = ?",
+      metadata: "SELECT * FROM cloud_resource_metadata WHERE user_id = ?"
+    };
     const result = { gaps: [] };
-    await Promise.all(Object.entries(tables).map(async ([type, table]) => {
+    await Promise.all(Object.entries(queries).map(async ([type, sql]) => {
       try {
-        const response = await this._db.prepare(`SELECT * FROM ${table} WHERE user_id = ?`).bind(userId).all();
+        const response = await this._db.prepare(sql).bind(userId).all();
         result[type] = response.results || [];
       } catch (e4) {
         result[type] = [];
@@ -5404,7 +5565,10 @@ var D1Adapter = class {
     if (idempotencyKey) {
       return this._cloudRecord(await this._db.prepare(`SELECT * FROM cloud_data_records WHERE user_id=? AND kind=? AND idempotency_key=?`).bind(userId, kind, idempotencyKey).first());
     }
-    return this.getCloudDataRecord(userId, kind, id);
+    if (createOnly) {
+      return this.getCloudDataRecord(userId, kind, id);
+    }
+    return { id, userId, kind, data, updatedAt: now };
   }
   async getCloudDataRecord(userId, kind, id) {
     return this._cloudRecord(await this._db.prepare("SELECT * FROM cloud_data_records WHERE user_id=? AND kind=? AND id=?").bind(userId, kind, id).first());
@@ -5537,7 +5701,7 @@ var D1Adapter = class {
     const name = "metadata-sidecars-v1";
     const batch = await this.getCloudMaintenanceBatch(name, "cloud_resource_metadata", limit);
     if (batch.completed) return;
-    const cursor = _nullishCoalesce(_optionalChain([batch, 'access', _45 => _45.rows, 'access', _46 => _46.at, 'call', _47 => _47(-1), 'optionalAccess', _48 => _48.maintenance_rowid]), () => ( batch.upperBound));
+    const cursor = _nullishCoalesce(_optionalChain([batch, 'access', _54 => _54.rows, 'access', _55 => _55.at, 'call', _56 => _56(-1), 'optionalAccess', _57 => _57.maintenance_rowid]), () => ( batch.upperBound));
     if (batch.rows.length) await this.cleanupCloudResourceMetadata(null, { after: batch.cursor, through: cursor });
     await this.finishCloudMaintenanceBatch(name, cursor, batch.rows.length < limit || cursor >= batch.upperBound);
   }
@@ -5611,7 +5775,30 @@ var D1Adapter = class {
     if (!guard) return true;
     const condition = this._cloudGuardPredicate(userId, guard);
     const row = await this._db.prepare(`SELECT ${condition.sql} AS valid`).bind(...condition.args).first();
-    return !!_optionalChain([row, 'optionalAccess', _49 => _49.valid]);
+    return !!_optionalChain([row, 'optionalAccess', _58 => _58.valid]);
+  }
+  _rowSnapshotMatch(spec, row) {
+    const clauses = [];
+    const args = [];
+    for (const column of spec.columns) {
+      if (!Object.hasOwn(row, column)) continue;
+      if ((column === "value" || column === "payload") && row[column] === null && typeof row.byte_size === "number") {
+        clauses.push(
+          `LENGTH(CAST(${column} AS BLOB)) IS ?`,
+          `substr(${column}, 1, 128) IS ?`,
+          `(CASE WHEN LENGTH(${column}) > 128 THEN substr(${column}, -64) ELSE '' END) IS ?`
+        );
+        args.push(
+          row.byte_size,
+          _nullishCoalesce(row[`${column}_prefix`], () => ( null)),
+          _nullishCoalesce(row[`${column}_suffix`], () => ( ""))
+        );
+      } else {
+        clauses.push(`${column} IS ?`);
+        args.push(row[column]);
+      }
+    }
+    return { predicate: clauses.join(" AND "), values: args };
   }
   /** Delete only the exact physical snapshot; no untrusted SQL identifiers. */
   async deleteCloudResourceRows(userId, locators, { operationId, leaseToken } = {}) {
@@ -5660,9 +5847,7 @@ var D1Adapter = class {
         ).bind(userId, namespace, key, "amsg-chunks" + namespace, key + "", key + " ", identities));
       }
       for (const row of locator.rows) {
-        const columns = spec.columns.filter((column) => Object.hasOwn(row, column));
-        const predicate = columns.map((column) => `${column} IS ?`).join(" AND ");
-        const values = columns.map((column) => row[column]);
+        const { predicate, values } = this._rowSnapshotMatch(spec, row);
         const identity = spec.keys.map((column) => `${column} IS ?`).join(" AND ");
         statements.push(this._db.prepare(
           `INSERT INTO cloud_guard_assertions (allowed)
@@ -5671,8 +5856,8 @@ var D1Adapter = class {
         ).bind(...spec.keys.map((column) => row[column]), ...values));
       }
       for (const row of locator.rows) {
-        const columns = spec.columns.filter((column) => Object.hasOwn(row, column));
-        statements.push(this._db.prepare(`DELETE FROM ${spec.table} WHERE ${columns.map((column) => `${column} IS ?`).join(" AND ")}`).bind(...columns.map((column) => row[column])));
+        const { predicate, values } = this._rowSnapshotMatch(spec, row);
+        statements.push(this._db.prepare(`DELETE FROM ${spec.table} WHERE ${predicate}`).bind(...values));
       }
       if (locator.metadataKey) statements.push(this._db.prepare("DELETE FROM cloud_resource_metadata WHERE user_id=? AND resource_key=?").bind(userId, locator.metadataKey));
       try {
@@ -5864,7 +6049,7 @@ var D1Adapter = class {
     ).bind(...values);
     const ownerUser = cloudGuard ? await this._db.prepare("SELECT user_id FROM scheduled_messages WHERE id=?").bind(taskId).first() : null;
     if (cloudGuard && !ownerUser) return null;
-    await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _50 => _50.user_id]), [cloudGuard]);
+    await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _59 => _59.user_id]), [cloudGuard]);
     return this._db.prepare("SELECT * FROM scheduled_messages WHERE id = ?").bind(taskId).first();
   }
   /**
@@ -5989,7 +6174,7 @@ var D1Adapter = class {
     ).bind(...values);
     const ownerUser = cloudGuard ? await this._db.prepare("SELECT user_id FROM scheduled_messages WHERE id=?").bind(taskId).first() : null;
     if (cloudGuard && !ownerUser) return false;
-    const [res] = await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _51 => _51.user_id]), [cloudGuard]);
+    const [res] = await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _60 => _60.user_id]), [cloudGuard]);
     return (res.meta.changes || 0) > 0;
   }
   /**
@@ -6008,7 +6193,7 @@ var D1Adapter = class {
     ).bind(this._iso(leaseUntil), taskId);
     const ownerUser = cloudGuard ? await this._db.prepare("SELECT user_id FROM scheduled_messages WHERE id=?").bind(taskId).first() : null;
     if (cloudGuard && !ownerUser) return false;
-    const [res] = await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _52 => _52.user_id]), [cloudGuard]);
+    const [res] = await this._cloudBatch([statement], _optionalChain([ownerUser, 'optionalAccess', _61 => _61.user_id]), [cloudGuard]);
     return (res.meta.changes || 0) > 0;
   }
   async listTasks(userId, opts = {}) {
@@ -6169,30 +6354,39 @@ var D1Adapter = class {
       result.cleanupOutcomes = probeIndexes.map((probeAt) => {
         if (probeAt === null) return null;
         const row = results[probeAt] && Array.isArray(results[probeAt].results) ? results[probeAt].results[0] : null;
-        return Number(_nullishCoalesce(_optionalChain([row, 'optionalAccess', _53 => _53.n]), () => ( 0))) === 0;
+        return Number(_nullishCoalesce(_optionalChain([row, 'optionalAccess', _62 => _62.n]), () => ( 0))) === 0;
       });
     }
     return result;
   }
   /**
-   * All entries of one namespace (values still encrypted).
+   * Entries of one namespace (values still encrypted); optional exact/prefix selection.
    *
    * @param {string} userId
    * @param {string} namespace
    * @returns {Promise<Array<{ namespace: string, key: string, value: string, updated_at: number }>>}
    */
-  async getClientState(userId, namespace) {
+  async getClientState(userId, namespace, options = {}) {
+    const params = [userId, namespace];
+    let selector = "";
+    if (options.key !== void 0) {
+      selector = " AND key = ?";
+      params.push(options.key);
+    } else if (options.keyPrefix !== void 0) {
+      selector = " AND key >= ? AND key < ?";
+      params.push(options.keyPrefix, prefixRangeEnd(options.keyPrefix));
+    }
     const res = await this._db.prepare(
       `SELECT namespace, key, value, updated_at
        FROM client_state
-       WHERE user_id = ? AND namespace = ?
+       WHERE user_id = ? AND namespace = ?${selector}
        ORDER BY key ASC`
-    ).bind(userId, namespace).all();
+    ).bind(...params).all();
     return res.results || [];
   }
   /**
    * 例行清理：把指定命名空间下太久没更新的条目删掉（run-tick 每跳顺手调，
-   * 宿主配了 `clientStateTtl` 才会调）。
+   * 附件默认保留 30 天，宿主 `clientStateTtl` 可覆盖或配置其他命名空间）。
    *
    * 不限用户——「这个命名空间只留最近 N 天」是命名空间级的约定，单用户部署
    * 下也就是这一个用户的行。指令由 lib/client-state-store.js 的
@@ -6924,8 +7118,9 @@ function createClientStateHandler(ctx) {
     if (typeof db.upsertClientState !== "function") {
       return err3(501, "CLIENT_STATE_NOT_SUPPORTED", "\u5F53\u524D\u6570\u636E\u5E93\u9002\u914D\u5668\u4E0D\u652F\u6301 client_state");
     }
-    const { upserted, skipped, deleted, skippedEntries } = await writeClientStateEntries({ db, userId, userKey, entries: accepted });
+    const { upserted, skipped, deleted, skippedEntries, unknown } = await writeClientStateEntries({ db, userId, userKey, entries: accepted });
     const data = { upserted, skipped };
+    if (unknown > 0) data.unknown = unknown;
     if (deleted > 0) data.deleted = deleted;
     if (skippedEntries.length > 0) data.skippedEntries = skippedEntries;
     if (rejected.length > 0) data.rejected = rejected;
@@ -6938,7 +7133,12 @@ function createClientStateHandler(ctx) {
     const gate = requireUserId(headers);
     if (gate.error) return gate.error;
     const { userId } = gate;
-    const namespace = new URL(url, "https://dummy").searchParams.get("namespace") || "";
+    const query = new URL(url, "https://dummy").searchParams;
+    const namespace = query.get("namespace") || "";
+    const key = query.get("key");
+    if (key !== null && (!key.trim() || key.length > MAX_KEY_CHARS || INTERNAL_STATE_CHAR_RE.test(key))) {
+      return err3(400, "INVALID_STATE_KEY", "key must be non-empty, at most 256 characters, without control characters");
+    }
     if (!namespace.trim()) return err3(400, "NAMESPACE_REQUIRED", "\u5FC5\u987B\u63D0\u4F9B namespace \u67E5\u8BE2\u53C2\u6570");
     if (INTERNAL_STATE_CHAR_RE.test(namespace)) {
       return err3(400, "INVALID_STATE_NAMESPACE", "namespace \u4E0D\u80FD\u5305\u542B\u63A7\u5236\u5B57\u7B26\uFF08\\u0000-\\u001f \u4E3A\u5E93\u5185\u90E8\u4FDD\u7559\uFF09");
@@ -6947,10 +7147,10 @@ function createClientStateHandler(ctx) {
       return err3(501, "CLIENT_STATE_NOT_SUPPORTED", "\u5F53\u524D\u6570\u636E\u5E93\u9002\u914D\u5668\u4E0D\u652F\u6301 client_state");
     }
     const userKey = await deriveUserEncryptionKey(userId, masterKey);
-    const rows = await db.getClientState(userId, namespace);
+    const rows = await db.getClientState(userId, namespace, key === null ? void 0 : { key });
     const decrypted = await resolveClientStateEntries(
-      rows,
-      () => db.getClientState(userId, chunkNamespaceFor(namespace)),
+      key === null ? rows : rows.filter((row) => row.key === key),
+      () => db.getClientState(userId, chunkNamespaceFor(namespace), key === null ? void 0 : { keyPrefix: chunkKeyPrefixFor(key) }),
       (value) => decryptFromStorage(value, userKey)
     );
     const encryptedResponse = await encryptPayload({ namespace, entries: decrypted }, userKey);
@@ -7028,7 +7228,7 @@ function createClientStateNamespacesHandler(ctx) {
 }
 
 // src/server/lib/version.js
-var SERVER_VERSION = true ? "3.0.0" : "0.0.0-dev";
+var SERVER_VERSION = true ? "3.1.0-next.1" : "0.0.0-dev";
 
 // src/server/handlers/capabilities.js
 var SERVER_FEATURES = Object.freeze([
@@ -7144,7 +7344,12 @@ var SERVER_FEATURES = Object.freeze([
   "max-generation-retries",
   // onBeforeFire 认 { defer: { afterMs } }：这次不生成，过一会儿再来问（不占重试
   // 次数）；onFireSettled 的 status 多一种 'deferred'，带 retryAfter。
-  "before-fire-defer"
+  "before-fire-defer",
+  "task-input",
+  "client-state-key",
+  "agentic-list-tasks",
+  "agentic-tool-allowlist",
+  "attachments"
 ]);
 function createCapabilitiesHandler(ctx) {
   async function GET(url, headers) {
@@ -7191,6 +7396,39 @@ function objectOrText(value) {
     return value;
   }
 }
+function utf8ByteLength(text) {
+  if (typeof text !== "string" || text.length === 0) return 0;
+  return /[^\x00-\x7f]/.test(text) ? encoder.encode(text).length : text.length;
+}
+function rowByteSize(row) {
+  if (typeof row.byte_size === "number") return row.byte_size;
+  return utf8ByteLength(
+    String(
+      _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(row.value, () => ( row.encrypted_payload)), () => ( row.encrypted_value)), () => ( row.payload)), () => ( row.subscription)), () => ( ""))
+    )
+  );
+}
+var STORAGE_PREFIX_RE = /^[0-9a-f]{32}:[0-9a-f]{24,32}:[0-9a-f]*$/i;
+var HEX_RE = /^[0-9a-f]*$/i;
+function isValidStorageCiphertext(fullText, prefix, suffix, byteSize) {
+  if (typeof fullText === "string") {
+    if (!STORAGE_PREFIX_RE.test(fullText)) return false;
+    const secondColon = fullText.indexOf(":", 33);
+    return secondColon > 32 && (fullText.length - secondColon - 1) % 2 === 0;
+  }
+  if (typeof prefix === "string" && typeof byteSize === "number") {
+    if (!STORAGE_PREFIX_RE.test(prefix)) return false;
+    if (typeof suffix === "string" && !HEX_RE.test(suffix)) return false;
+    const secondColon = prefix.indexOf(":", 33);
+    return secondColon > 32 && (byteSize - secondColon - 1) % 2 === 0;
+  }
+  return false;
+}
+function hasCompleteStoredMetadata(stored) {
+  return Boolean(
+    stored && safeOwner(stored.owner) !== null && typeof stored.kind === "string" && stored.kind.length > 0
+  );
+}
 async function buildCloudDataInventory({
   db,
   userId,
@@ -7203,6 +7441,20 @@ async function buildCloudDataInventory({
   const metadata = new Map(
     (raw.metadata || []).map((row) => [row.resource_key, row.encrypted_value])
   );
+  const readStoredMetadata = async (metadataKey) => {
+    const encryptedMetadata = metadata.get(metadataKey) || null;
+    if (!encryptedMetadata) {
+      return { encryptedMetadata: null, stored: null, unreadable: false };
+    }
+    try {
+      const stored = JSON.parse(
+        await decryptFromStorage(encryptedMetadata, userKey)
+      );
+      return { encryptedMetadata, stored, unreadable: false };
+    } catch (e6) {
+      return { encryptedMetadata, stored: null, unreadable: true };
+    }
+  };
   const taskPayloads = /* @__PURE__ */ new Map();
   const taskByUuid = /* @__PURE__ */ new Map();
   for (const row of raw.task || []) {
@@ -7212,7 +7464,7 @@ async function buildCloudDataInventory({
       );
       taskPayloads.set(row.id, payload);
       if (row.uuid) taskByUuid.set(row.uuid, payload);
-    } catch (e6) {
+    } catch (e7) {
     }
   }
   const tasks = (raw.task || []).filter((row) => taskPayloads.has(row.id)).map((row) => ({ ...taskPayloads.get(row.id), uuid: row.uuid }));
@@ -7227,23 +7479,19 @@ async function buildCloudDataInventory({
     status = null,
     namespace,
     key,
-    credId
+    credId,
+    metadataInfo
   }) => {
     const metadataKey = JSON.stringify([type, ...identity]);
     const id = await cloudDataHash(JSON.stringify([userId, metadataKey]));
-    let stored = null;
-    const encryptedMetadata = metadata.get(metadataKey);
-    if (encryptedMetadata) {
-      try {
-        stored = JSON.parse(
-          await decryptFromStorage(encryptedMetadata, userKey)
-        );
-      } catch (e7) {
-        unreadable = true;
-      }
-    }
+    const {
+      encryptedMetadata,
+      stored,
+      unreadable: metadataUnreadable
+    } = await _asyncNullishCoalesce(metadataInfo, async () => ( await readStoredMetadata(metadataKey)));
+    if (metadataUnreadable) unreadable = true;
     let resolved = null;
-    if (resolveOwner) {
+    if (resolveOwner && !hasCompleteStoredMetadata(stored)) {
       try {
         resolved = await resolveOwner({
           type,
@@ -7263,17 +7511,10 @@ async function buildCloudDataInventory({
         });
       }
     }
-    const owner = safeOwner(_optionalChain([stored, 'optionalAccess', _54 => _54.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _55 => _55.__cloudOwnerGuard, 'optionalAccess', _56 => _56.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _57 => _57.metadata, 'optionalAccess', _58 => _58.cloudOwner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _59 => _59.metadata, 'optionalAccess', _60 => _60.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _61 => _61.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _62 => _62.__cloudOwnerGuard, 'optionalAccess', _63 => _63.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _64 => _64.metadata, 'optionalAccess', _65 => _65.cloudOwner])) || safeOwner(_optionalChain([task, 'optionalAccess', _66 => _66.metadata, 'optionalAccess', _67 => _67.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _68 => _68.owner])) || safeOwner(_optionalChain([resolved, 'optionalAccess', _69 => _69.owner]));
-    const kind = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([stored, 'optionalAccess', _70 => _70.kind]), () => ( _optionalChain([payload, 'optionalAccess', _71 => _71.metadata, 'optionalAccess', _72 => _72.kind]))), () => ( _optionalChain([payload, 'optionalAccess', _73 => _73.kind]))), () => ( _optionalChain([resolved, 'optionalAccess', _74 => _74.kind]))), () => ( null));
+    const owner = safeOwner(_optionalChain([stored, 'optionalAccess', _63 => _63.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _64 => _64.__cloudOwnerGuard, 'optionalAccess', _65 => _65.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _66 => _66.metadata, 'optionalAccess', _67 => _67.cloudOwner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _68 => _68.metadata, 'optionalAccess', _69 => _69.owner])) || safeOwner(_optionalChain([payload, 'optionalAccess', _70 => _70.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _71 => _71.__cloudOwnerGuard, 'optionalAccess', _72 => _72.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _73 => _73.metadata, 'optionalAccess', _74 => _74.cloudOwner])) || safeOwner(_optionalChain([task, 'optionalAccess', _75 => _75.metadata, 'optionalAccess', _76 => _76.owner])) || safeOwner(_optionalChain([task, 'optionalAccess', _77 => _77.owner])) || safeOwner(_optionalChain([resolved, 'optionalAccess', _78 => _78.owner]));
+    const kind = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([stored, 'optionalAccess', _79 => _79.kind]), () => ( _optionalChain([payload, 'optionalAccess', _80 => _80.metadata, 'optionalAccess', _81 => _81.kind]))), () => ( _optionalChain([payload, 'optionalAccess', _82 => _82.kind]))), () => ( _optionalChain([resolved, 'optionalAccess', _83 => _83.kind]))), () => ( null));
     const times = rows.map((row) => timestamp(_nullishCoalesce(row.updated_at, () => ( row.created_at)))).filter((time) => time !== null);
-    const byteSize = rows.reduce(
-      (sum, row) => sum + encoder.encode(
-        String(
-          _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_nullishCoalesce(row.value, () => ( row.encrypted_payload)), () => ( row.encrypted_value)), () => ( row.payload)), () => ( row.subscription)), () => ( ""))
-        )
-      ).length,
-      0
-    );
+    const byteSize = rows.reduce((sum, row) => sum + rowByteSize(row), 0);
     const label = type === "state" ? `${namespace}/${key}` : type === "credential" ? credId : type === "task" ? rows[0].uuid || `task row ${rows[0].id}` : type === "outbox" ? rows[0].message_id : "Web Push subscription";
     entries.push({
       resource: {
@@ -7328,22 +7569,75 @@ async function buildCloudDataInventory({
     const slices = chunks.get(group) || [];
     chunks.delete(group);
     const rows = [row, ...slices.sort((a, b) => a.key.localeCompare(b.key))];
-    let value, unreadable = false;
+    const metadataKey = JSON.stringify(["state", row.namespace, row.key]);
+    const metadataInfo = await readStoredMetadata(metadataKey);
+    const skipFullDecrypt = !metadataInfo.unreadable && hasCompleteStoredMetadata(metadataInfo.stored);
+    let value, unreadable = metadataInfo.unreadable;
     try {
-      const count = parseChunkedRootCount(row.value);
-      if (count === null) value = await decryptFromStorage(row.value, userKey);
-      else {
+      const rootMarker = _nullishCoalesce(_nullishCoalesce(row.value, () => ( row.value_prefix)), () => ( ""));
+      const count = parseChunkedRootCount(rootMarker);
+      if (count === null) {
+        if (typeof row.value === "string" && (!skipFullDecrypt || row.value.length <= 1024)) {
+          value = await decryptFromStorage(row.value, userKey);
+        } else if (skipFullDecrypt) {
+          if (!isValidStorageCiphertext(
+            row.value,
+            row.value_prefix,
+            row.value_suffix,
+            row.byte_size
+          )) {
+            throw new Error("Invalid state ciphertext");
+          }
+        } else {
+          const fetched = typeof db.getClientState === "function" ? await db.getClientState(userId, row.namespace, { key: row.key }) : [];
+          const rawValue = _optionalChain([fetched, 'optionalAccess', _84 => _84[0], 'optionalAccess', _85 => _85.value]);
+          if (typeof rawValue !== "string") {
+            throw new Error("Missing state value");
+          }
+          value = await decryptFromStorage(rawValue, userKey);
+        }
+      } else {
         if (count > slices.length) throw new Error("Missing state chunks");
-        const parts = [];
+        const sliceByKey = new Map(
+          slices.map((candidate) => [candidate.key, candidate])
+        );
+        const orderedSlices = [];
         for (let i = 0; i < count; i++) {
-          const slice = slices.find(
-            (candidate) => candidate.key === chunkKeyFor(row.key, i)
-          );
+          const slice = sliceByKey.get(chunkKeyFor(row.key, i));
           if (!slice || slice.updated_at !== row.updated_at)
             throw new Error("Mismatched state chunks");
-          parts.push(await decryptFromStorage(slice.value, userKey));
+          if (!isValidStorageCiphertext(
+            slice.value,
+            slice.value_prefix,
+            slice.value_suffix,
+            slice.byte_size
+          )) {
+            throw new Error("Corrupt state chunk");
+          }
+          orderedSlices.push(slice);
+        }
+        if (!skipFullDecrypt) {
+          let fetchedByKey = null;
+          if (orderedSlices.some((slice) => typeof slice.value !== "string")) {
+            const fetchedSlices = typeof db.getClientState === "function" ? await db.getClientState(
+              userId,
+              CHUNK_NAMESPACE_PREFIX + row.namespace,
+              { keyPrefix: `${row.key}` }
+            ) : [];
+            fetchedByKey = new Map(
+              fetchedSlices.map((candidate) => [candidate.key, candidate.value])
+            );
+          }
+          const parts = [];
+          for (const slice of orderedSlices) {
+            const rawSliceValue = typeof slice.value === "string" ? slice.value : _optionalChain([fetchedByKey, 'optionalAccess', _86 => _86.get, 'call', _87 => _87(slice.key)]);
+            if (typeof rawSliceValue !== "string") {
+              throw new Error("Missing state chunk value");
+            }
+            parts.push(await decryptFromStorage(rawSliceValue, userKey));
+          }
+          value = parts.join("");
         }
-        value = parts.join("");
       }
     } catch (e9) {
       unreadable = true;
@@ -7356,7 +7650,8 @@ async function buildCloudDataInventory({
       rows,
       value,
       unreadable,
-      status: null
+      status: null,
+      metadataInfo
     });
   }
   for (const [group, rows] of chunks) {
@@ -7380,9 +7675,29 @@ async function buildCloudDataInventory({
     });
   }
   for (const row of raw.outbox || []) {
-    let payload, unreadable = false;
+    const metadataKey = JSON.stringify(["outbox", row.message_id]);
+    const metadataInfo = await readStoredMetadata(metadataKey);
+    const skipFullDecrypt = !metadataInfo.unreadable && hasCompleteStoredMetadata(metadataInfo.stored);
+    let payload, unreadable = metadataInfo.unreadable;
     try {
-      payload = objectOrText(await decryptFromStorage(row.payload, userKey));
+      if (typeof row.payload === "string" && (!skipFullDecrypt || row.payload.length <= 1024)) {
+        payload = objectOrText(await decryptFromStorage(row.payload, userKey));
+      } else if (skipFullDecrypt) {
+        if (!isValidStorageCiphertext(
+          row.payload,
+          row.payload_prefix,
+          row.payload_suffix,
+          row.byte_size
+        )) {
+          throw new Error("Invalid outbox ciphertext");
+        }
+      } else {
+        const rawPayload = typeof db.getOutboxPayload === "function" ? await db.getOutboxPayload(userId, row.message_id) : null;
+        if (typeof rawPayload !== "string") {
+          throw new Error("Missing outbox payload");
+        }
+        payload = objectOrText(await decryptFromStorage(rawPayload, userKey));
+      }
     } catch (e10) {
       unreadable = true;
     }
@@ -7393,7 +7708,8 @@ async function buildCloudDataInventory({
       payload,
       task: taskByUuid.get(row.task_uuid),
       unreadable,
-      status: row.acked_at != null ? "acked" : row.delivered_at != null ? "delivered" : "pending"
+      status: row.acked_at != null ? "acked" : row.delivered_at != null ? "delivered" : "pending",
+      metadataInfo
     });
   }
   for (const row of raw.subscription || []) {
@@ -7407,7 +7723,7 @@ async function buildCloudDataInventory({
   const ownerLabels = /* @__PURE__ */ new Map();
   for (const { resource } of entries) {
     const owner = resource.owner;
-    if (!_optionalChain([owner, 'optionalAccess', _75 => _75.label, 'optionalAccess', _76 => _76.trim, 'call', _77 => _77()])) continue;
+    if (!_optionalChain([owner, 'optionalAccess', _88 => _88.label, 'optionalAccess', _89 => _89.trim, 'call', _90 => _90()])) continue;
     const identity = JSON.stringify([owner.type, owner.id]);
     const current = ownerLabels.get(identity);
     if (!current || (_nullishCoalesce(resource.updatedAt, () => ( 0))) > current.updatedAt) {
@@ -7419,7 +7735,7 @@ async function buildCloudDataInventory({
   }
   for (const { resource } of entries) {
     const owner = resource.owner;
-    if (!owner || _optionalChain([owner, 'access', _78 => _78.label, 'optionalAccess', _79 => _79.trim, 'call', _80 => _80()])) continue;
+    if (!owner || _optionalChain([owner, 'access', _91 => _91.label, 'optionalAccess', _92 => _92.trim, 'call', _93 => _93()])) continue;
     const known = ownerLabels.get(JSON.stringify([owner.type, owner.id]));
     if (known) resource.owner = { ...owner, label: known.label };
   }
@@ -7447,7 +7763,7 @@ async function cloudInventory(ctx, db, userId, userKey) {
     db,
     userId,
     userKey,
-    resolveOwner: _optionalChain([ctx, 'access', _81 => _81.cloudData, 'optionalAccess', _82 => _82.resolveOwner])
+    resolveOwner: _optionalChain([ctx, 'access', _94 => _94.cloudData, 'optionalAccess', _95 => _95.resolveOwner])
   });
 }
 function operationWork(operation) {
@@ -7504,7 +7820,7 @@ async function makeCleanupPlan(ctx, db, userId, key, input) {
     throw cloudError("INVALID_CLEANUP_SELECTION", "\u8BF7\u9009\u62E9\u81F3\u5C11\u4E00\u9879\u8D44\u6E90");
   if (types !== void 0 && (!Array.isArray(types) || !types.length || types.some((type) => !CLOUD_RESOURCE_TYPES.includes(type))))
     throw cloudError("INVALID_CLEANUP_SELECTION", "\u8D44\u6E90\u7C7B\u522B\u65E0\u6548");
-  if (mode === "purge" && !owner && !_optionalChain([resourceIds, 'optionalAccess', _83 => _83.length]))
+  if (mode === "purge" && !owner && !_optionalChain([resourceIds, 'optionalAccess', _96 => _96.length]))
     throw cloudError("INVALID_CLEANUP_SELECTION", "\u6E05\u7406\u9700\u8981\u660E\u786E\u8D44\u6E90\u6216\u5F52\u5C5E");
   if (mode === "retire-owner" && (resourceIds || types))
     throw cloudError("INVALID_CLEANUP_SELECTION", "\u5F7B\u5E95\u79FB\u9664\u4E0D\u80FD\u9650\u5236\u8D44\u6E90\u7C7B\u522B");
@@ -7516,10 +7832,12 @@ async function makeCleanupPlan(ctx, db, userId, key, input) {
       "\u4E91\u7AEF\u6E05\u5355\u4E0D\u5B8C\u6574\uFF0C\u6682\u4E0D\u80FD\u751F\u6210\u6E05\u7406\u8BA1\u5212",
       409
     );
+  const resourceIdSet = resourceIds ? new Set(resourceIds) : null;
+  const typeSet = types ? new Set(types) : null;
   const entries = inventory.entries.filter(
-    (e) => (!owner || ownerEquals(e.resource.owner, owner)) && (!resourceIds || resourceIds.includes(e.resource.id)) && (!types || types.includes(e.resource.type))
+    (e) => (!owner || ownerEquals(e.resource.owner, owner)) && (!resourceIdSet || resourceIdSet.has(e.resource.id)) && (!typeSet || typeSet.has(e.resource.type))
   );
-  if (resourceIds && new Set(resourceIds).size !== entries.length)
+  if (resourceIdSet && resourceIdSet.size !== entries.length)
     throw cloudError(
       "CLOUD_RESOURCE_NOT_FOUND",
       "\u90E8\u5206\u9009\u4E2D\u8D44\u6E90\u4E0D\u5B58\u5728\u6216\u4E0D\u5C5E\u4E8E\u5F53\u524D\u8303\u56F4",
@@ -7677,6 +7995,7 @@ async function advanceCleanup(ctx, db, userId, key, operation) {
     if (operation.status === "completed" || operation.status === "failed")
       return operation;
     operation.status = "running";
+    let retirementInventory = null;
     if (operation.mode === "retire-owner") {
       if (operation.fencedGeneration == null) {
         const state = await db.setCloudOwnerActive(
@@ -7704,6 +8023,7 @@ async function advanceCleanup(ctx, db, userId, key, operation) {
           "\u65E0\u6CD5\u786E\u8BA4\u5F85\u6E05\u7406\u8D44\u6E90",
           503
         );
+      retirementInventory = inventory;
       const known = new Set(operation.knownResourceIds || []);
       operation.knownResourceVersions ||= {};
       operation.entries = inventory.entries.filter((entry) => {
@@ -7730,7 +8050,7 @@ async function advanceCleanup(ctx, db, userId, key, operation) {
         ).length;
       await save(db, userId, key, "operation", operation, { leaseToken });
     }
-    const beforeBatch = await cloudInventory(ctx, db, userId, key);
+    const beforeBatch = await _asyncNullishCoalesce(retirementInventory, async () => ( await cloudInventory(ctx, db, userId, key)));
     if (!beforeBatch.complete)
       throw cloudError("CLOUD_INVENTORY_INCOMPLETE", "\u65E0\u6CD5\u786E\u8BA4\u5F85\u6E05\u7406\u8D44\u6E90", 503);
     const currentById = new Map(
@@ -7768,7 +8088,6 @@ async function advanceCleanup(ctx, db, userId, key, operation) {
       delete entry.locator;
       operation.cursor++;
       operation.updatedAt = Date.now();
-      await save(db, userId, key, "operation", operation, { leaseToken });
     }
     await renewLease();
     const current = await cloudInventory(ctx, db, userId, key);
@@ -7779,8 +8098,9 @@ async function advanceCleanup(ctx, db, userId, key, operation) {
         503
       );
     const selected = new Set(operation.entries.map((e) => e.resource.id));
+    const knownIds = new Set(operation.knownResourceIds || []);
     const remaining = current.entries.filter(
-      (e) => operation.mode === "retire-owner" ? ownerEquals(e.resource.owner, operation.owner) || (operation.knownResourceIds || []).includes(e.resource.id) : selected.has(e.resource.id)
+      (e) => operation.mode === "retire-owner" ? ownerEquals(e.resource.owner, operation.owner) || knownIds.has(e.resource.id) : selected.has(e.resource.id)
     );
     for (const count of operation.counts)
       count.remaining = remaining.filter(
@@ -7869,12 +8189,12 @@ async function repairLegacyWorkIndex(ctx) {
     entries.push({ userId: row.user_id, kind: row.kind, id: row.id, work, writeToken: row.write_token });
   }
   await db.indexCloudDataRecordWorkBatch(entries);
-  const cursor = _nullishCoalesce(_optionalChain([batch, 'access', _84 => _84.rows, 'access', _85 => _85.at, 'call', _86 => _86(-1), 'optionalAccess', _87 => _87.maintenance_rowid]), () => ( batch.upperBound));
+  const cursor = _nullishCoalesce(_optionalChain([batch, 'access', _97 => _97.rows, 'access', _98 => _98.at, 'call', _99 => _99(-1), 'optionalAccess', _100 => _100.maintenance_rowid]), () => ( batch.upperBound));
   await db.finishCloudMaintenanceBatch(name, cursor, batch.rows.length < 100 || cursor >= batch.upperBound);
 }
 async function resumeCloudDataCleanups(ctx) {
   const db = ctx.db;
-  if (!_optionalChain([db, 'optionalAccess', _88 => _88.cloudDataManagement])) return;
+  if (!_optionalChain([db, 'optionalAccess', _101 => _101.cloudDataManagement])) return;
   const indexed = WORK_INDEX_METHODS.every((method) => typeof db[method] === "function");
   let rows;
   if (indexed) {
@@ -7906,7 +8226,7 @@ async function resumeCloudDataCleanups(ctx) {
       }
     } catch (error) {
       console.warn("[amsg] A cloud cleanup operation could not be resumed");
-      if (!indexed || _optionalChain([error, 'optionalAccess', _89 => _89.code]) === "CLOUD_LEASE_LOST") continue;
+      if (!indexed || _optionalChain([error, 'optionalAccess', _102 => _102.code]) === "CLOUD_LEASE_LOST") continue;
       await db.rescheduleCloudDataRecordWork(
         row.userId,
         "operation",
@@ -8014,7 +8334,7 @@ function createCloudDataHandler(ctx) {
               summary: inventorySummary(inventory),
               expiresAt: Date.now() + 15 * 60 * 1e3,
               resources: inventory.entries.map((e) => e.resource).filter(
-                (r) => (!type || r.type === type) && (!ownerId || _optionalChain([r, 'access', _90 => _90.owner, 'optionalAccess', _91 => _91.type]) === ownerType && r.owner.id === ownerId)
+                (r) => (!type || r.type === type) && (!ownerId || _optionalChain([r, 'access', _103 => _103.owner, 'optionalAccess', _104 => _104.type]) === ownerType && r.owner.id === ownerId)
               ),
               complete: inventory.complete,
               gaps: inventory.gaps
@@ -8097,7 +8417,7 @@ function createCloudDataHandler(ctx) {
           const rows = await db.listCloudDataRecords(userId, "operation");
           for (const row of rows) {
             const op = JSON.parse(await decryptFromStorage(row.data, key));
-            if (op.mode === "retire-owner" && _optionalChain([op, 'access', _92 => _92.owner, 'optionalAccess', _93 => _93.type]) === owner.type && _optionalChain([op, 'access', _94 => _94.owner, 'optionalAccess', _95 => _95.id]) === owner.id && ["pending", "running"].includes(op.status))
+            if (op.mode === "retire-owner" && _optionalChain([op, 'access', _105 => _105.owner, 'optionalAccess', _106 => _106.type]) === owner.type && _optionalChain([op, 'access', _107 => _107.owner, 'optionalAccess', _108 => _108.id]) === owner.id && ["pending", "running"].includes(op.status))
               throw cloudError(
                 "CLOUD_CLEANUP_IN_PROGRESS",
                 "\u6E05\u7406\u5B8C\u6210\u540E\u624D\u80FD\u91CD\u65B0\u542F\u7528",
@@ -8315,7 +8635,7 @@ function createSingleUserServer(config) {
   if (!config.masterKey) throw new Error("[amsg-server single-user] config.masterKey is required");
   const vapid = config.vapid || {};
   const tenantManager = createSingleUserContextManager({
-    db: createCloudGuardedAdapter(config.db, { masterKey: config.masterKey, resolveOwner: _optionalChain([config, 'access', _96 => _96.cloudData, 'optionalAccess', _97 => _97.resolveOwner]) }),
+    db: createCloudGuardedAdapter(config.db, { masterKey: config.masterKey, resolveOwner: _optionalChain([config, 'access', _109 => _109.cloudData, 'optionalAccess', _110 => _110.resolveOwner]) }),
     masterKey: config.masterKey,
     serverToken: config.serverToken
   });
@@ -8401,7 +8721,7 @@ async function getSchemaVersion(db) {
   for (const index of SQLITE_REQUIRED_SCHEMA.indexes) {
     if (!liveIndexes.has(index)) missing.push(`index:${index}`);
   }
-  if (Array.isArray(_optionalChain([live, 'optionalAccess', _98 => _98.triggers]))) {
+  if (Array.isArray(_optionalChain([live, 'optionalAccess', _111 => _111.triggers]))) {
     const liveTriggers = new Set(live.triggers);
     for (const name of SQLITE_REQUIRED_SCHEMA.triggers) {
       if (!liveTriggers.has(name)) missing.push(`trigger:${name}`);
@@ -8781,4 +9101,5 @@ function createSingleUserCloudflareWorker(buildConfig, options = {}) {
 
 
 
-exports.isValidTimeZoneId = isValidTimeZoneId; exports.advanceOccurrence = advanceOccurrence; exports.planNextOccurrence = planNextOccurrence; exports.nextFutureOccurrence = nextFutureOccurrence; exports.base64UrlToBytes = _amsgshared.base64UrlToBytes; exports.utf8 = _amsgshared.utf8; exports.utf8Decode = _amsgshared.utf8Decode; exports.bytesToBase64Url = _amsgshared.bytesToBase64Url; exports.timingSafeEqualBytes = _amsgshared.timingSafeEqualBytes; exports.deriveUserEncryptionKey = deriveUserEncryptionKey; exports.decryptPayload = decryptPayload; exports.encryptForStorage = encryptForStorage; exports.decryptFromStorage = decryptFromStorage; exports.CRED_ID_MAX_LENGTH = CRED_ID_MAX_LENGTH; exports.CRED_PUT_BATCH_MAX = CRED_PUT_BATCH_MAX; exports.CRED_ROWS_PER_USER_MAX = CRED_ROWS_PER_USER_MAX; exports.CRED_REFS_MAX_ENTRIES = CRED_REFS_MAX_ENTRIES; exports.supportsLlmCredentialsStore = supportsLlmCredentialsStore; exports.isValidCredId = isValidCredId; exports.validateCredValue = validateCredValue; exports.validateCredRefs = validateCredRefs; exports.hasChatCredRef = hasChatCredRef; exports.resolveLlmCredential = resolveLlmCredential; exports.isValidUrl = _amsgshared.isValidUrl; exports.validateAvatarUrl = _amsgshared.validateAvatarUrl; exports.isValidISO8601 = isValidISO8601; exports.isValidUUID = isValidUUID; exports.isValidUUIDv4 = isValidUUIDv4; exports.validateSplitPattern = validateSplitPattern; exports.validateLlmMessagesArray = validateLlmMessagesArray; exports.MAX_TASK_PAYLOAD_BYTES = MAX_TASK_PAYLOAD_BYTES; exports.validateScheduleMessagePayload = validateScheduleMessagePayload; exports.DEFAULT_MAX_REQUEST_BODY_BYTES = DEFAULT_MAX_REQUEST_BODY_BYTES; exports.readRequestBody = readRequestBody; exports.parseJsonBody = parseJsonBody; exports.getHeader = getHeader; exports.createGetUserKeyHandler = createGetUserKeyHandler; exports.NonRetryableError = NonRetryableError; exports.isNonRetryableError = isNonRetryableError; exports.DeploymentConfigError = DeploymentConfigError; exports.sanitizeErrorSummary = sanitizeErrorSummary; exports.summarizeErrorCause = summarizeErrorCause; exports.DEFAULT_MAX_DELIVERY_RETRIES = DEFAULT_MAX_DELIVERY_RETRIES; exports.WEB_PUSH_MAX_BODY_BYTES = WEB_PUSH_MAX_BODY_BYTES; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.MAX_PUSH_PAYLOAD_BYTES = MAX_PUSH_PAYLOAD_BYTES; exports.PUSH_ENVELOPE_RESERVED_BYTES = PUSH_ENVELOPE_RESERVED_BYTES; exports.measurePushPayload = measurePushPayload; exports.createWebCryptoWebPush = createWebCryptoWebPush; exports.DEFAULT_MAX_TOOL_ITERATIONS = DEFAULT_MAX_TOOL_ITERATIONS; exports.DEFAULT_TOTAL_TIMEOUT_MS = DEFAULT_TOTAL_TIMEOUT_MS; exports.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE = DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE; exports.MIN_SCHEDULE_LEAD_MS = MIN_SCHEDULE_LEAD_MS; exports.MAX_DEFER_AFTER_MS = MAX_DEFER_AFTER_MS; exports.createScheduleMessageHandler = createScheduleMessageHandler; exports.DEFAULT_CLAIM_LEASE_MS = DEFAULT_CLAIM_LEASE_MS; exports.DEFAULT_LEASE_HEARTBEAT_MS = DEFAULT_LEASE_HEARTBEAT_MS; exports.DEFAULT_HEARTBEAT_LEASE_TTL_MS = DEFAULT_HEARTBEAT_LEASE_TTL_MS; exports.runScheduledTick = runScheduledTick; exports.runTask = runTask; exports.createUpdateMessageHandler = createUpdateMessageHandler; exports.createCancelMessageHandler = createCancelMessageHandler; exports.createMessagesHandler = createMessagesHandler; exports.createGetMessageHandler = createGetMessageHandler; exports.createPushSubscriptionHandler = createPushSubscriptionHandler; exports.createLlmCredentialsHandler = createLlmCredentialsHandler; exports.createD1Adapter = createD1Adapter; exports.createSingleUserServer = createSingleUserServer; exports.SCHEMA_VERSION = SCHEMA_VERSION; exports.getSchemaVersion = getSchemaVersion; exports.ensureSchema = ensureSchema; exports.CORS_ALLOW_HEADERS = CORS_ALLOW_HEADERS; exports.CORS_ALLOW_METHODS = CORS_ALLOW_METHODS; exports.createSingleUserCloudflareWorker = createSingleUserCloudflareWorker;
+
+exports.isValidTimeZoneId = isValidTimeZoneId; exports.advanceOccurrence = advanceOccurrence; exports.planNextOccurrence = planNextOccurrence; exports.nextFutureOccurrence = nextFutureOccurrence; exports.base64UrlToBytes = _amsgshared.base64UrlToBytes; exports.utf8 = _amsgshared.utf8; exports.utf8Decode = _amsgshared.utf8Decode; exports.bytesToBase64Url = _amsgshared.bytesToBase64Url; exports.timingSafeEqualBytes = _amsgshared.timingSafeEqualBytes; exports.deriveUserEncryptionKey = deriveUserEncryptionKey; exports.decryptPayload = decryptPayload; exports.encryptPayload = encryptPayload; exports.encryptForStorage = encryptForStorage; exports.decryptFromStorage = decryptFromStorage; exports.CRED_ID_MAX_LENGTH = CRED_ID_MAX_LENGTH; exports.CRED_PUT_BATCH_MAX = CRED_PUT_BATCH_MAX; exports.CRED_ROWS_PER_USER_MAX = CRED_ROWS_PER_USER_MAX; exports.CRED_REFS_MAX_ENTRIES = CRED_REFS_MAX_ENTRIES; exports.supportsLlmCredentialsStore = supportsLlmCredentialsStore; exports.isValidCredId = isValidCredId; exports.validateCredValue = validateCredValue; exports.validateCredRefs = validateCredRefs; exports.hasChatCredRef = hasChatCredRef; exports.resolveLlmCredential = resolveLlmCredential; exports.isValidUrl = _amsgshared.isValidUrl; exports.validateAvatarUrl = _amsgshared.validateAvatarUrl; exports.isValidISO8601 = isValidISO8601; exports.isValidUUID = isValidUUID; exports.isValidUUIDv4 = isValidUUIDv4; exports.validateSplitPattern = validateSplitPattern; exports.validateLlmMessagesArray = validateLlmMessagesArray; exports.MAX_TASK_PAYLOAD_BYTES = MAX_TASK_PAYLOAD_BYTES; exports.validateScheduleMessagePayload = validateScheduleMessagePayload; exports.DEFAULT_MAX_REQUEST_BODY_BYTES = DEFAULT_MAX_REQUEST_BODY_BYTES; exports.readRequestBody = readRequestBody; exports.parseJsonBody = parseJsonBody; exports.getHeader = getHeader; exports.createGetUserKeyHandler = createGetUserKeyHandler; exports.NonRetryableError = NonRetryableError; exports.isNonRetryableError = isNonRetryableError; exports.DeploymentConfigError = DeploymentConfigError; exports.sanitizeErrorSummary = sanitizeErrorSummary; exports.summarizeErrorCause = summarizeErrorCause; exports.DEFAULT_MAX_DELIVERY_RETRIES = DEFAULT_MAX_DELIVERY_RETRIES; exports.WEB_PUSH_MAX_BODY_BYTES = WEB_PUSH_MAX_BODY_BYTES; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.MAX_PUSH_PAYLOAD_BYTES = MAX_PUSH_PAYLOAD_BYTES; exports.PUSH_ENVELOPE_RESERVED_BYTES = PUSH_ENVELOPE_RESERVED_BYTES; exports.measurePushPayload = measurePushPayload; exports.createWebCryptoWebPush = createWebCryptoWebPush; exports.DEFAULT_MAX_TOOL_ITERATIONS = DEFAULT_MAX_TOOL_ITERATIONS; exports.DEFAULT_TOTAL_TIMEOUT_MS = DEFAULT_TOTAL_TIMEOUT_MS; exports.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE = DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE; exports.MIN_SCHEDULE_LEAD_MS = MIN_SCHEDULE_LEAD_MS; exports.MAX_DEFER_AFTER_MS = MAX_DEFER_AFTER_MS; exports.createScheduleMessageHandler = createScheduleMessageHandler; exports.DEFAULT_CLAIM_LEASE_MS = DEFAULT_CLAIM_LEASE_MS; exports.DEFAULT_LEASE_HEARTBEAT_MS = DEFAULT_LEASE_HEARTBEAT_MS; exports.DEFAULT_HEARTBEAT_LEASE_TTL_MS = DEFAULT_HEARTBEAT_LEASE_TTL_MS; exports.runScheduledTick = runScheduledTick; exports.runTask = runTask; exports.createUpdateMessageHandler = createUpdateMessageHandler; exports.createCancelMessageHandler = createCancelMessageHandler; exports.createMessagesHandler = createMessagesHandler; exports.createGetMessageHandler = createGetMessageHandler; exports.createPushSubscriptionHandler = createPushSubscriptionHandler; exports.createLlmCredentialsHandler = createLlmCredentialsHandler; exports.createD1Adapter = createD1Adapter; exports.createSingleUserServer = createSingleUserServer; exports.SCHEMA_VERSION = SCHEMA_VERSION; exports.getSchemaVersion = getSchemaVersion; exports.ensureSchema = ensureSchema; exports.CORS_ALLOW_HEADERS = CORS_ALLOW_HEADERS; exports.CORS_ALLOW_METHODS = CORS_ALLOW_METHODS; exports.createSingleUserCloudflareWorker = createSingleUserCloudflareWorker;