nolo-cli 0.1.23 → 0.1.29

package/server/handlers/typecheckWorker.ts

@@ -0,0 +1,54 @@
+import type { TypeCheckResult } from "./applyLineEditsHandler";
+import { performTypeCheckInProcess } from "./applyLineEditsHandler";
+
+type TypeCheckWorkerPayload = {
+    filePath: string;
+    content: string;
+    originalContent?: string;
+};
+
+function isTypeCheckWorkerPayload(value: unknown): value is TypeCheckWorkerPayload {
+    if (!value || typeof value !== "object") return false;
+    const payload = value as Partial<TypeCheckWorkerPayload>;
+    return (
+        typeof payload.filePath === "string" &&
+        typeof payload.content === "string" &&
+        (payload.originalContent == null ||
+            typeof payload.originalContent === "string")
+    );
+}
+
+async function readStdinText(): Promise<string> {
+    return await new Promise<string>((resolve, reject) => {
+        let input = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk: string) => {
+            input += chunk;
+        });
+        process.stdin.on("end", () => resolve(input));
+        process.stdin.on("error", reject);
+    });
+}
+
+async function main() {
+    const rawInput = await readStdinText();
+    const parsed = rawInput ? JSON.parse(rawInput) : null;
+    if (!isTypeCheckWorkerPayload(parsed)) {
+        throw new Error("Invalid type check worker payload");
+    }
+
+    const result: TypeCheckResult = await performTypeCheckInProcess(
+        parsed.filePath,
+        parsed.content,
+        parsed.originalContent ?? ""
+    );
+
+    process.stdout.write(JSON.stringify(result));
+}
+
+void main().catch((error) => {
+    console.error(
+        `[typecheckWorker] ${error instanceof Error ? error.message : String(error)}`
+    );
+    process.exit(1);
+});

package/server/handlers/userEvents.ts

@@ -0,0 +1,6 @@
+import { registerEventChannelAuthorizer } from "./eventBus";
+
+registerEventChannelAuthorizer("user-", ({ userId, channel }) => {
+  const targetUserId = channel.slice("user-".length);
+  return Boolean(targetUserId) && targetUserId === userId;
+});

package/server/handlers/userSecretsHandler.ts

@@ -0,0 +1,210 @@
+// packages/server/handlers/userSecretsHandler.ts
+//
+// 用户密钥管理：存储 CF Token、第三方 API Key 等敏感凭证。
+//
+// 安全架构：
+//   - 每个 value 独立用 AES-256-GCM 加密（随机 12-byte IV），再存入 LevelDB。
+//   - 加密 key 由 SECRET_KEY 环境变量（与注册/登录共用）经 SHA-256 派生（32 bytes）。
+//   - 存储格式：enc:v1:{base64(iv)}:{base64(ciphertext+authtag)}
+//   - 未配置 SECRET_KEY 时明文存储并打 WARN 日志（仅开发环境可接受）。
+//   - 历史明文条目（无 enc:v1: 前缀）读取时自动识别，不会崩溃。
+//   - 前端展示时做掩码处理（前4后4，中间替换为 ****）。
+
+import { authenticateRequest, CORS_HEADERS_AUTH } from "../../auth/utils";
+import serverDb from "../../database/server/db";
+
+const SECRETS_KEY_PREFIX = "user-secrets-";
+const ENC_PREFIX = "enc:v1:";
+
+// ── 加密 Key 派生 ──────────────────────────────────────────
+// 复用注册/登录的 SECRET_KEY 作为加密密钥原料（两用途经各自 KDF 派生，互不干扰）
+const PLATFORM_SECRET_KEY = process.env.SECRET_KEY ?? "";
+const IS_PRODUCTION = process.env.NODE_ENV === "production";
+
+if (!PLATFORM_SECRET_KEY) {
+  if (IS_PRODUCTION) {
+    // 生产环境缺 SECRET_KEY 是严重配置错误，启动时立即 fail fast
+    throw new Error("[userSecrets] FATAL: SECRET_KEY 未配置，生产环境禁止以明文存储用户凭证。请设置 SECRET_KEY 环境变量后重启。");
+  }
+  console.warn("[userSecrets] SECRET_KEY 未配置，用户密钥将以明文存储。仅开发环境可接受。");
+}
+
+let _cryptoKey: CryptoKey | null = null;
+
+async function getCryptoKey(): Promise<CryptoKey | null> {
+  if (!PLATFORM_SECRET_KEY) return null;
+  if (_cryptoKey) return _cryptoKey;
+  const raw = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(PLATFORM_SECRET_KEY));
+  _cryptoKey = await crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+  return _cryptoKey;
+}
+
+async function encryptValue(plaintext: string): Promise<string> {
+  const key = await getCryptoKey();
+  if (!key) {
+    // 仅开发环境到达此处（生产环境在模块加载时已 throw）
+    return plaintext;
+  }
+
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(plaintext));
+  const ivB64 = Buffer.from(iv).toString("base64");
+  const ctB64 = Buffer.from(new Uint8Array(ct)).toString("base64");
+  return `${ENC_PREFIX}${ivB64}:${ctB64}`;
+}
+
+async function decryptValue(stored: string): Promise<string> {
+  if (!stored.startsWith(ENC_PREFIX)) return stored; // 历史明文条目，直接返回
+
+  const key = await getCryptoKey();
+  if (!key) {
+    // 有加密数据但没有密钥，无法解密（通常是密钥被删除）
+    throw new Error("无法解密用户密钥：SECRET_KEY 未配置或已更换");
+  }
+
+  const rest = stored.slice(ENC_PREFIX.length); // "{ivB64}:{ctB64}"
+  const sep = rest.indexOf(":");
+  if (sep === -1) throw new Error("加密数据格式损坏");
+
+  const iv = Buffer.from(rest.slice(0, sep), "base64");
+  const ct = Buffer.from(rest.slice(sep + 1), "base64");
+
+  const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ct);
+  return new TextDecoder().decode(plain);
+}
+
+// ── LevelDB 读写（内部操作均为明文 map）────────────────────
+
+function secretsKey(userId: string): string {
+  return `${SECRETS_KEY_PREFIX}${userId}`;
+}
+
+type EncryptedSecretsMap = Record<string, string>; // values 可能是 enc:v1:... 或历史明文
+
+async function loadRawSecrets(userId: string): Promise<EncryptedSecretsMap> {
+  try {
+    return (await serverDb.get(secretsKey(userId))) as EncryptedSecretsMap ?? {};
+  } catch (e: any) {
+    if (e.code === "LEVEL_NOT_FOUND") return {};
+    throw e;
+  }
+}
+
+/** 加载并解密所有 secrets，返回明文 map（仅在服务端内部使用）*/
+async function loadSecrets(userId: string): Promise<Record<string, string>> {
+  const raw = await loadRawSecrets(userId);
+  const result: Record<string, string> = {};
+  for (const [k, v] of Object.entries(raw)) {
+    result[k] = await decryptValue(v);
+  }
+  return result;
+}
+
+// ── 工具函数 ──────────────────────────────────────────────
+
+/** 将 secret value 掩码：保留前4后4，中间替换为 **** */
+function maskValue(val: string): string {
+  if (val.length <= 8) return "****";
+  return val.slice(0, 4) + "****" + val.slice(-4);
+}
+
+function jsonError(status: number, message: string, code?: string): Response {
+  return new Response(JSON.stringify({ error: { message, code } }), {
+    status,
+    headers: { "Content-Type": "application/json", ...CORS_HEADERS_AUTH },
+  });
+}
+
+function jsonOk(data: any): Response {
+  return new Response(JSON.stringify(data), {
+    status: 200,
+    headers: { "Content-Type": "application/json", ...CORS_HEADERS_AUTH },
+  });
+}
+
+// ── HTTP Handlers ──────────────────────────────────────────
+
+/**
+ * GET /api/user-secrets
+ * 返回所有 key 列表，value 做掩码处理（前4后4）。
+ */
+export async function handleGetUserSecrets(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const auth = await authenticateRequest(req);
+  if (auth instanceof Response) return auth;
+
+  const secrets = await loadSecrets(auth.userId);
+  const masked = Object.fromEntries(
+    Object.entries(secrets).map(([k, v]) => [k, maskValue(v)])
+  );
+
+  return jsonOk({ success: true, secrets: masked });
+}
+
+/**
+ * POST /api/user-secrets/set
+ * body: { key: string, value: string }
+ * value 在服务端 AES-256-GCM 加密后存入 LevelDB。
+ */
+export async function handleSetUserSecret(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const auth = await authenticateRequest(req);
+  if (auth instanceof Response) return auth;
+
+  let body: any;
+  try { body = await req.json(); } catch {
+    return jsonError(400, "请求体必须是合法的 JSON", "INVALID_JSON");
+  }
+
+  const { key, value } = body;
+  if (!key || typeof key !== "string") return jsonError(400, "缺少 key 参数", "MISSING_KEY");
+  if (!value || typeof value !== "string") return jsonError(400, "缺少 value 参数", "MISSING_VALUE");
+  if (!/^[A-Z0-9_]{1,64}$/.test(key)) {
+    return jsonError(400, "key 只允许大写字母、数字和下划线，最多64位", "INVALID_KEY");
+  }
+
+  const raw = await loadRawSecrets(auth.userId);
+  raw[key] = await encryptValue(value); // 加密后存储
+  await serverDb.put(secretsKey(auth.userId), raw);
+
+  return jsonOk({ success: true, key, masked: maskValue(value) });
+}
+
+/**
+ * POST /api/user-secrets/delete
+ * body: { key: string }
+ */
+export async function handleDeleteUserSecret(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const auth = await authenticateRequest(req);
+  if (auth instanceof Response) return auth;
+
+  let body: any;
+  try { body = await req.json(); } catch {
+    return jsonError(400, "请求体必须是合法的 JSON", "INVALID_JSON");
+  }
+
+  const { key } = body;
+  if (!key) return jsonError(400, "缺少 key 参数", "MISSING_KEY");
+
+  const raw = await loadRawSecrets(auth.userId);
+  if (!(key in raw)) return jsonError(404, `密钥 "${key}" 不存在`, "NOT_FOUND");
+
+  delete raw[key];
+  await serverDb.put(secretsKey(auth.userId), raw);
+
+  return jsonOk({ success: true, deleted: key });
+}
+
+/**
+ * 内部工具：供 appDeployHandler 等服务端模块读取用户明文密钥。
+ * 自动解密，调用方拿到的是原始值。
+ */
+export async function getUserSecret(userId: string, key: string): Promise<string | null> {
+  const secrets = await loadSecrets(userId);
+  return secrets[key] ?? null;
+}
+

package/server/handlers/versionHandler.ts

@@ -0,0 +1,281 @@
+// packages/server/handlers/versionHandler.ts
+// 版本管理 REST API
+//   POST   /api/version/save     { type, entityId, snapshot, label? }
+//   GET    /api/version/list?type=app&entityId=xxx
+//   GET    /api/version/get?type=app&entityId=xxx&versionId=yyy
+//   POST   /api/version/restore  { type, entityId, versionId }
+//   DELETE /api/version/delete   { type, entityId, versionId }
+//   POST   /api/version/pin      { type, entityId, versionId, pinned }
+//   PATCH  /api/version/label    { type, entityId, versionId, label }
+
+import { authenticateRequest, CORS_HEADERS_AUTH } from "../../auth/utils";
+import { getUser } from "../../auth/server/getUser";
+import {
+  listVersions,
+  getVersion,
+  saveVersion,
+  deleteVersion,
+  pinVersion,
+  versionKey,
+  type VersionEntityType,
+} from "./versionStore";
+import { saveAppCode, getAppRecord } from "./appSandboxHandler";
+import serverDb from "../../database/server/db";
+
+const jsonOk = (data: any) =>
+  new Response(JSON.stringify(data), {
+    status: 200,
+    headers: { "content-type": "application/json", ...CORS_HEADERS_AUTH },
+  });
+
+const jsonError = (status: number, message: string, code?: string) =>
+  new Response(JSON.stringify({ error: message, code }), {
+    status,
+    headers: { "content-type": "application/json", ...CORS_HEADERS_AUTH },
+  });
+
+const VALID_TYPES: VersionEntityType[] = ["app", "doc", "agent"];
+
+async function getAuthUserId(req: Request): Promise<string | Response> {
+  const tokenPayload = await authenticateRequest(req);
+  if (!tokenPayload?.userId) return jsonError(401, "未登录", "UNAUTHORIZED");
+  const user = await getUser(tokenPayload.userId).catch(() => null);
+  if (!user) return jsonError(401, "用户不存在", "UNAUTHORIZED");
+  return tokenPayload.userId;
+}
+
+async function checkOwnership(
+  userId: string,
+  type: VersionEntityType,
+  entityId: string
+): Promise<Response | null> {
+  if (type === "app") {
+    const record = await getAppRecord(entityId);
+    if (!record) return jsonError(404, "应用不存在", "NOT_FOUND");
+    if (record.userId !== userId) return jsonError(403, "无权限", "FORBIDDEN");
+  } else if (type === "agent") {
+    const agentKey = `agent-${userId}-${entityId}`;
+    const agentRecord = await serverDb.get(agentKey).catch(() => null);
+    if (!agentRecord) return jsonError(404, "Agent 不存在或无权限", "NOT_FOUND");
+  }
+  // doc: 前端自己知道 entityId，只要登录即可
+  return null;
+}
+
+// ── POST /api/version/save ─────────────────────────────────
+// 前端显式调用，在保存 agent/doc/app 后触发
+export async function handleVersionSave(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const userIdOrError = await getAuthUserId(req);
+  if (userIdOrError instanceof Response) return userIdOrError;
+  const userId = userIdOrError;
+
+  let body: any;
+  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
+
+  const { type, entityId, snapshot, label, pinned, versionId, createdAt } = body ?? {};
+  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
+  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
+  if (!snapshot) return jsonError(400, "缺少 snapshot", "MISSING_SNAPSHOT");
+
+  const ownerError = await checkOwnership(userId, type, entityId);
+  if (ownerError) return ownerError;
+
+  const savedVersionId = await saveVersion(type, entityId, snapshot, {
+    createdBy: userId,
+    label,
+    pinned: pinned === true,
+    versionId: typeof versionId === "string" && versionId ? versionId : undefined,
+    createdAt: typeof createdAt === "number" && Number.isFinite(createdAt) ? createdAt : undefined,
+  });
+  return jsonOk({ success: true, versionId: savedVersionId });
+}
+
+// ── GET /api/version/list ──────────────────────────────────
+export async function handleVersionList(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const userIdOrError = await getAuthUserId(req);
+  if (userIdOrError instanceof Response) return userIdOrError;
+  const userId = userIdOrError;
+
+  const url = new URL(req.url);
+  const type = url.searchParams.get("type") as VersionEntityType | null;
+  const entityId = url.searchParams.get("entityId");
+
+  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
+  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
+
+  const ownerError = await checkOwnership(userId, type, entityId);
+  if (ownerError) return ownerError;
+
+  const versions = await listVersions(type, entityId);
+  return jsonOk({ success: true, versions });
+}
+
+// ── GET /api/version/get ───────────────────────────────────
+export async function handleVersionGet(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const userIdOrError = await getAuthUserId(req);
+  if (userIdOrError instanceof Response) return userIdOrError;
+  const userId = userIdOrError;
+
+  const url = new URL(req.url);
+  const type = url.searchParams.get("type") as VersionEntityType | null;
+  const entityId = url.searchParams.get("entityId");
+  const versionId = url.searchParams.get("versionId");
+
+  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
+  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
+  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
+
+  const ownerError = await checkOwnership(userId, type, entityId);
+  if (ownerError) return ownerError;
+
+  const record = await getVersion(type, entityId, versionId);
+  if (!record) return jsonError(404, "版本不存在", "NOT_FOUND");
+
+  return jsonOk({ success: true, version: record });
+}
+
+// ── POST /api/version/restore ──────────────────────────────
+export async function handleVersionRestore(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const userIdOrError = await getAuthUserId(req);
+  if (userIdOrError instanceof Response) return userIdOrError;
+  const userId = userIdOrError;
+
+  let body: any;
+  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
+
+  const { type, entityId, versionId } = body ?? {};
+  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
+  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
+  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
+
+  const ownerError = await checkOwnership(userId, type, entityId);
+  if (ownerError) return ownerError;
+
+  const record = await getVersion(type, entityId, versionId);
+  if (!record) return jsonError(404, "版本不存在", "NOT_FOUND");
+
+  const restoreLabel = `↩ 恢复自 ${new Date(record.createdAt).toLocaleString("zh-CN", { month: "numeric", day: "numeric", hour: "2-digit", minute: "2-digit" })}`;
+
+  if (type === "app") {
+    const snap = record.snapshot;
+    const existingAppRecord = await getAppRecord(entityId);
+    await saveAppCode(entityId, snap.code, {
+      userId: snap.userId ?? userId,
+      name: snap.name,
+      deployMode: snap.deployMode,
+      visibility: snap.visibility,
+      source: snap.source,
+      framework: snap.framework,
+      customUrl: snap.customUrl,
+      versionServerOrigin: existingAppRecord?.versionServerOrigin ?? new URL(req.url).origin,
+      spaceId: snap.spaceId,
+    });
+    // 记录恢复点
+    saveVersion(type, entityId, snap, { createdBy: userId, label: restoreLabel }).catch(() => {});
+    return jsonOk({ success: true, message: `已恢复到版本 ${versionId}` });
+  }
+
+  if (type === "agent") {
+    const agentKey = `agent-${userId}-${entityId}`;
+    const restored = { ...record.snapshot, updatedAt: Date.now() };
+    await serverDb.put(agentKey, restored);
+    saveVersion(type, entityId, restored, { createdBy: userId, label: restoreLabel }).catch(() => {});
+    return jsonOk({ success: true, message: `Agent 已恢复到版本 ${versionId}` });
+  }
+
+  if (type === "doc") {
+    const restored = { ...record.snapshot, updatedAt: Date.now() };
+    await serverDb.put(entityId, restored);
+    saveVersion(type, entityId, restored, { createdBy: userId, label: restoreLabel }).catch(() => {});
+    return jsonOk({ success: true, message: `文档已恢复到版本 ${versionId}` });
+  }
+
+  return jsonError(500, "不支持的类型", "UNSUPPORTED_TYPE");
+}
+
+// ── DELETE /api/version/delete ─────────────────────────────
+export async function handleVersionDelete(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const userIdOrError = await getAuthUserId(req);
+  if (userIdOrError instanceof Response) return userIdOrError;
+  const userId = userIdOrError;
+
+  let body: any;
+  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
+
+  const { type, entityId, versionId } = body ?? {};
+  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
+  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
+  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
+
+  const ownerError = await checkOwnership(userId, type, entityId);
+  if (ownerError) return ownerError;
+
+  await deleteVersion(type, entityId, versionId);
+  return jsonOk({ success: true });
+}
+
+// ── POST /api/version/pin ──────────────────────────────────
+export async function handleVersionPin(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const userIdOrError = await getAuthUserId(req);
+  if (userIdOrError instanceof Response) return userIdOrError;
+  const userId = userIdOrError;
+
+  let body: any;
+  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
+
+  const { type, entityId, versionId, pinned } = body ?? {};
+  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
+  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
+  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
+  if (typeof pinned !== "boolean") return jsonError(400, "pinned 必须是 boolean", "INVALID_PINNED");
+
+  const ownerError = await checkOwnership(userId, type, entityId);
+  if (ownerError) return ownerError;
+
+  const result = await pinVersion(type, entityId, versionId, pinned);
+  if (!result.ok) {
+    if (result.reason === "NOT_FOUND") return jsonError(404, "版本不存在", "NOT_FOUND");
+    if (result.reason === "PIN_LIMIT_EXCEEDED") return jsonError(400, `Pin 上限 10 个`, "PIN_LIMIT_EXCEEDED");
+    return jsonError(500, "操作失败", result.reason);
+  }
+  return jsonOk({ success: true, pinned });
+}
+
+// ── PATCH /api/version/label ───────────────────────────────
+export async function handleVersionLabel(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+
+  const userIdOrError = await getAuthUserId(req);
+  if (userIdOrError instanceof Response) return userIdOrError;
+  const userId = userIdOrError;
+
+  let body: any;
+  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
+
+  const { type, entityId, versionId, label } = body ?? {};
+  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
+  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
+  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
+  if (typeof label !== "string") return jsonError(400, "label 必须是字符串", "INVALID_LABEL");
+
+  const ownerError = await checkOwnership(userId, type, entityId);
+  if (ownerError) return ownerError;
+
+  const record = await getVersion(type, entityId, versionId);
+  if (!record) return jsonError(404, "版本不存在", "NOT_FOUND");
+
+  await serverDb.put(versionKey(type, entityId, versionId), { ...record, label: label.trim() });
+  return jsonOk({ success: true, label: label.trim() });
+}