nolo-cli 0.1.26 → 0.1.29

package/server/handlers/tableToolHandlers.ts

@@ -0,0 +1,741 @@
+import serverDb, { ensureServerDbOpen } from "../../database/server/db";
+import { metaKey, rowKey } from "../../database/keys";
+import { ulid } from "../../database/utils/ulid";
+import { DataType } from "../../create/types";
+import { handleToken } from "../../auth/server/token";
+import {
+  applyRowFilters,
+  formatKnownColumns,
+  normalizeRowValues,
+  pickRowColumns,
+  sortRows,
+} from "../../render/table/toolValueUtils";
+import type { TableColumn, TableMeta } from "../../render/table/types";
+import { assertCanReadTableRows } from "./tableAccess";
+
+const CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "POST, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization",
+  "Content-Type": "application/json",
+};
+
+type ColumnType =
+  | "text"
+  | "number"
+  | "boolean"
+  | "date"
+  | "datetime"
+  | "select"
+  | "multi_select";
+
+type ToolTableColumnInput = {
+  name: string;
+  label?: string;
+  type?: ColumnType;
+  description?: string;
+  required?: boolean;
+  options?: string[];
+};
+
+function jsonResponse(body: unknown, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: CORS_HEADERS });
+}
+
+async function getAuthedUserId(req: Request): Promise<string> {
+  const authReq: any = {
+    headers: {
+      get: (name: string) => req.headers.get(name),
+    },
+  };
+  const user = await handleToken(authReq, {});
+  const userId = user?.userId;
+  if (!userId) {
+    throw new Error("Unauthorized: userId not found");
+  }
+  return userId;
+}
+
+async function getOptionalAuthedUserId(req: Request): Promise<string | null> {
+  const authHeader = req.headers.get("Authorization");
+  if (!authHeader) return null;
+
+  const authReq: any = {
+    headers: {
+      get: (name: string) => req.headers.get(name),
+    },
+  };
+  const user = await handleToken(authReq, {});
+  const userId = user?.userId;
+  return typeof userId === "string" && userId ? userId : null;
+}
+
+function sanitizeColumns(input: unknown): ToolTableColumnInput[] {
+  const columns = Array.isArray(input) ? input : [];
+  const seen = new Set<string>();
+  const sanitized: ToolTableColumnInput[] = [];
+
+  for (const col of columns) {
+    if (!col || typeof col !== "object" || Array.isArray(col)) continue;
+    const rawName = typeof (col as any).name === "string" ? (col as any).name.trim() : "";
+    if (!rawName || seen.has(rawName)) continue;
+    seen.add(rawName);
+
+    const item: ToolTableColumnInput = { name: rawName };
+    if (typeof (col as any).label === "string" && (col as any).label.trim()) {
+      item.label = (col as any).label.trim();
+    }
+    if (typeof (col as any).type === "string") {
+      item.type = (col as any).type as ColumnType;
+    } else {
+      item.type = "text";
+    }
+    if (typeof (col as any).description === "string" && (col as any).description.trim()) {
+      item.description = (col as any).description.trim();
+    }
+    if (typeof (col as any).required === "boolean") {
+      item.required = (col as any).required;
+    }
+    if (Array.isArray((col as any).options)) {
+      const options = (col as any).options
+        .map((value: unknown) => (typeof value === "string" ? value.trim() : ""))
+        .filter(Boolean);
+      if (options.length) item.options = options;
+    }
+    sanitized.push(item);
+  }
+
+  if (!sanitized.length) {
+    throw new Error("createTable.columns 中没有任何有效字段，请至少提供一个非空 name。");
+  }
+
+  return sanitized;
+}
+
+async function loadTableMetaOrThrow(tenantId: string, tableId: string): Promise<TableMeta> {
+  const tableMetaKey = metaKey(tenantId, tableId);
+  const tableMeta = await serverDb.get(tableMetaKey).catch(() => null);
+  if (!tableMeta) {
+    throw new Error(`Table not found: ${tableMetaKey}`);
+  }
+  return tableMeta as TableMeta;
+}
+
+function ensureTenantAccess(userId: string, tenantId: string) {
+  if (!tenantId) throw new Error("tenantId 必传。");
+  if (tenantId !== userId) {
+    throw new Error("Forbidden: tenantId mismatch");
+  }
+}
+
+function resolveRowDbKey(tenantId: string, tableId: string, rowId?: string, dbKey?: string): string {
+  if (dbKey && dbKey.trim()) return dbKey.trim();
+  if (rowId && rowId.trim()) return rowKey.single(tenantId, tableId, rowId.trim());
+  throw new Error("需要提供 rowId 或 dbKey。");
+}
+
+async function loadTableRows(tenantId: string, tableId: string): Promise<any[]> {
+  const { gte, lte } = rowKey.range(tenantId, tableId);
+  const rows: any[] = [];
+  for await (const [, value] of serverDb.iterator({ gte, lte })) {
+    if (value?.type === DataType.TABLE_ROW && !value?.deletedAt) {
+      rows.push(value);
+    }
+  }
+  return rows;
+}
+
+async function loadRowOrThrow(tenantId: string, tableId: string, rowId?: string, dbKey?: string) {
+  const finalDbKey = resolveRowDbKey(tenantId, tableId, rowId, dbKey);
+  const row = await serverDb.get(finalDbKey).catch(() => null);
+  if (!row || row.deletedAt) {
+    throw new Error(`找不到要操作的行：${rowId || finalDbKey}`);
+  }
+  return row;
+}
+
+async function loadRowByDbKey(dbKey: unknown) {
+  const normalized = typeof dbKey === "string" && dbKey.trim() ? dbKey.trim() : "";
+  if (!normalized) return null;
+  const row = await serverDb.get(normalized).catch(() => null);
+  if (!row || row.deletedAt || row.type !== DataType.TABLE_ROW) return null;
+  return row;
+}
+
+function normalizeColumnInput(body: any): TableColumn {
+  const name = typeof body.name === "string" ? body.name.trim() : "";
+  if (!name) {
+    throw new Error("列名不能为空。");
+  }
+  return {
+    id: ulid(),
+    name,
+    label: typeof body.label === "string" && body.label.trim() ? body.label.trim() : name,
+    type: typeof body.type === "string" ? (body.type as ColumnType) : "text",
+    description:
+      typeof body.description === "string" && body.description.trim()
+        ? body.description.trim()
+        : undefined,
+    required: typeof body.required === "boolean" ? body.required : undefined,
+    options: Array.isArray(body.options)
+      ? body.options
+          .map((value: unknown) => (typeof value === "string" ? value.trim() : ""))
+          .filter(Boolean)
+      : undefined,
+  };
+}
+
+export async function handleCreateTable(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const columns = sanitizeColumns(body.columns);
+    const tableId = ulid();
+    const dbKey = metaKey(userId, tableId);
+    const now = new Date().toISOString();
+    const title =
+      typeof body.title === "string" && body.title.trim() ? body.title.trim() : "新建表格";
+    const description =
+      typeof body.description === "string" && body.description.trim()
+        ? body.description.trim()
+        : undefined;
+    const tags = Array.isArray(body.tags)
+      ? body.tags
+          .map((value: unknown) => (typeof value === "string" ? value.trim() : ""))
+          .filter(Boolean)
+      : undefined;
+    const categoryId =
+      typeof body.categoryId === "string" && body.categoryId.trim()
+        ? body.categoryId.trim()
+        : undefined;
+    const spaceId =
+      typeof body.spaceId === "string" && body.spaceId.trim() ? body.spaceId.trim() : null;
+
+    const tableMeta = {
+      dbKey,
+      tenantId: userId,
+      tableId,
+      spaceId,
+      displayName: title,
+      description,
+      tags,
+      schemaVersion: 1,
+      columns,
+      views: [],
+      triggers: [],
+      aiConfig: undefined,
+      createdAt: now,
+      updatedAt: now,
+      type: DataType.TABLE,
+      ...(categoryId ? { categoryId } : {}),
+    };
+
+    await serverDb.put(dbKey, tableMeta);
+
+    return jsonResponse({
+      rawData: tableMeta,
+      displayData:
+        `已创建新表「${title}」（tableId: ${tableId}）。\n` +
+        `tenantId=${userId}\n` +
+        `字段列表：${columns.map((column) => column.name).join(", ")}\n\n` +
+        `接下来调用 addTableRow 时，请传入：\n` +
+        `{\n` +
+        `  "tenantId": "${userId}",\n` +
+        `  "tableId": "${tableId}",\n` +
+        `  "values": {\n` +
+        `    "列名": "字段值"\n` +
+        `  }\n` +
+        `}`,
+    });
+  } catch (error: any) {
+    return jsonResponse(
+      {
+        error: error?.message ?? "Failed to create table",
+      },
+      error?.message?.startsWith("Unauthorized") ? 401 : 500
+    );
+  }
+}
+
+export async function handleAddTableRow(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId =
+      typeof body.tenantId === "string" && body.tenantId.trim() ? body.tenantId.trim() : "";
+    const tableId =
+      typeof body.tableId === "string" && body.tableId.trim() ? body.tableId.trim() : "";
+    const values =
+      body.values && typeof body.values === "object" && !Array.isArray(body.values)
+        ? body.values
+        : null;
+
+    if (!tenantId || !tableId) {
+      throw new Error("addTableRow 需要显式传入 tenantId 和 tableId。");
+    }
+    if (tenantId !== userId) {
+      return jsonResponse({ error: "Forbidden: tenantId mismatch" }, 403);
+    }
+    if (!values || Object.keys(values).length === 0) {
+      throw new Error("addTableRow.values 不能为空，且必须是对象。");
+    }
+
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+    const normalized = normalizeRowValues(tableMeta.columns, values, { mode: "create" });
+    if (normalized.errors.length > 0) {
+      throw new Error(normalized.errors.join("\n"));
+    }
+    const sanitizedValues = normalized.sanitizedValues;
+    if (!Object.keys(sanitizedValues).length) throw new Error("addTableRow 提供的字段名都不在当前表中。");
+
+    const { dbKey, rowId } = rowKey.create(tenantId, tableId);
+    const now = new Date().toISOString();
+    const row = {
+      dbKey,
+      tenantId,
+      tableId,
+      rowId,
+      createdAt: now,
+      updatedAt: now,
+      type: DataType.TABLE_ROW as const,
+      ...sanitizedValues,
+    };
+
+    await serverDb.put(dbKey, row);
+
+    return jsonResponse({
+      rawData: row,
+      displayData:
+        `已在表「${(tableMeta as any).displayName || tableId}」中新增一行数据。\n` +
+        `rowId: ${rowId}\n` +
+        `字段数: ${Object.keys(sanitizedValues).length}`,
+    });
+  } catch (error: any) {
+    return jsonResponse(
+      {
+        error: error?.message ?? "Failed to add table row",
+      },
+      error?.message?.startsWith("Unauthorized") ? 401 : 500
+    );
+  }
+}
+
+export async function handleQueryTableRows(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    if (!tenantId) throw new Error("tenantId 必传。");
+    if (!tableId) throw new Error("tableId 必传。");
+
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+    await assertCanReadTableRows({ userId, tenantId, tableId, tableMeta });
+    const filters = body.filters && typeof body.filters === "object" && !Array.isArray(body.filters) ? body.filters : {};
+    const rows = await loadTableRows(tenantId, tableId);
+    const sortBy = typeof body.sortBy === "string" && body.sortBy.trim() ? body.sortBy.trim() : "updatedAt";
+    const sortOrder = body.sortOrder === "asc" ? "asc" : "desc";
+    const limit = Math.min(Math.max(Number(body.limit ?? 20), 1), 200);
+    const offset = Math.max(Number(body.offset ?? 0), 0);
+    const columns = Array.isArray(body.columns)
+      ? body.columns.filter((value: unknown): value is string => typeof value === "string" && value.trim().length > 0)
+      : undefined;
+    const includeBaseFields = body.includeBaseFields !== false;
+    const filtered = applyRowFilters(rows, filters);
+    const items = sortRows(filtered, sortBy, sortOrder)
+      .slice(offset, offset + limit)
+      .map((row) => pickRowColumns(row, columns, { includeBaseFields }));
+
+    return jsonResponse({
+      rawData: {
+        tenantId,
+        tableId,
+        total: filtered.length,
+        limit,
+        offset,
+        items,
+      },
+      displayData: `在表「${tableMeta.displayName || tableId}」中查询到 ${filtered.length} 行。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to query table rows";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleUpdateTableRow(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const rowFromDbKey = await loadRowByDbKey(body.dbKey);
+    const tenantId = typeof body.tenantId === "string" && body.tenantId.trim()
+      ? body.tenantId.trim()
+      : typeof rowFromDbKey?.tenantId === "string"
+        ? rowFromDbKey.tenantId
+        : "";
+    const tableId = typeof body.tableId === "string" && body.tableId.trim()
+      ? body.tableId.trim()
+      : typeof rowFromDbKey?.tableId === "string"
+        ? rowFromDbKey.tableId
+        : "";
+    ensureTenantAccess(userId, tenantId);
+    if (!tableId) throw new Error("tableId 必传。");
+    if (!body.changes || typeof body.changes !== "object" || Array.isArray(body.changes)) {
+      throw new Error("changes 必须是对象。");
+    }
+
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+    const row = rowFromDbKey ?? await loadRowOrThrow(tenantId, tableId, body.rowId, body.dbKey);
+    const normalized = normalizeRowValues(tableMeta.columns, body.changes, { mode: "update" });
+    if (normalized.errors.length > 0) throw new Error(normalized.errors.join("\n"));
+    if (!Object.keys(normalized.sanitizedValues).length) {
+      throw new Error(`没有可更新的有效字段。已知字段：${formatKnownColumns(tableMeta)}`);
+    }
+    const updated = {
+      ...row,
+      ...normalized.sanitizedValues,
+      updatedAt: new Date().toISOString(),
+    };
+    await serverDb.put(row.dbKey, updated);
+    return jsonResponse({
+      rawData: updated,
+      displayData: `已更新行 ${row.rowId}。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to update table row";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleDeleteTableRow(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    ensureTenantAccess(userId, tenantId);
+    if (!tableId) throw new Error("tableId 必传。");
+    const row = await loadRowOrThrow(tenantId, tableId, body.rowId, body.dbKey);
+    const now = new Date().toISOString();
+    const deleted = { ...row, deletedAt: now, updatedAt: now };
+    await serverDb.put(row.dbKey, deleted);
+    return jsonResponse({
+      rawData: deleted,
+      displayData: `已删除行 ${row.rowId}。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to delete table row";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleAddTableRows(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getOptionalAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    // Same note as handleAddTableRow: batch append is also temporarily open for
+    // lightweight app forms until we add explicit table/app permission controls.
+    if (userId) {
+      ensureTenantAccess(userId, tenantId);
+    } else if (!tenantId) {
+      throw new Error("tenantId 必传。");
+    }
+    if (!tableId) throw new Error("tableId 必传。");
+    const rows = Array.isArray(body.rows) ? body.rows : [];
+    if (rows.length === 0) throw new Error("rows 至少需要包含一项。");
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+
+    const createdRows = [];
+    for (const item of rows) {
+      if (!item || typeof item !== "object" || Array.isArray(item)) {
+        throw new Error("rows 中的每一项都必须是对象。");
+      }
+      const normalized = normalizeRowValues(tableMeta.columns, item, { mode: "create" });
+      if (normalized.errors.length > 0) throw new Error(normalized.errors.join("\n"));
+      if (!Object.keys(normalized.sanitizedValues).length) {
+        throw new Error("存在一行没有任何有效字段。");
+      }
+      const { dbKey, rowId } = rowKey.create(tenantId, tableId);
+      const now = new Date().toISOString();
+      const row = {
+        dbKey,
+        tenantId,
+        tableId,
+        rowId,
+        createdAt: now,
+        updatedAt: now,
+        type: DataType.TABLE_ROW as const,
+        ...normalized.sanitizedValues,
+      };
+      await serverDb.put(dbKey, row);
+      createdRows.push(row);
+    }
+
+    return jsonResponse({
+      rawData: { count: createdRows.length, items: createdRows },
+      displayData: `已批量新增 ${createdRows.length} 行。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to add table rows";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleUpdateTableRows(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    ensureTenantAccess(userId, tenantId);
+    if (!tableId) throw new Error("tableId 必传。");
+    const updates = Array.isArray(body.updates) ? body.updates : [];
+    if (updates.length === 0) throw new Error("updates 至少需要包含一项。");
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+
+    const results = [];
+    for (const item of updates) {
+      if (!item || typeof item !== "object" || Array.isArray(item)) {
+        throw new Error("updates 中的每一项都必须是对象。");
+      }
+      const row = await loadRowOrThrow(tenantId, tableId, item.rowId, item.dbKey);
+      const normalized = normalizeRowValues(tableMeta.columns, item.changes ?? {}, { mode: "update" });
+      if (normalized.errors.length > 0) throw new Error(normalized.errors.join("\n"));
+      if (!Object.keys(normalized.sanitizedValues).length) {
+        throw new Error(`行 ${row.rowId} 没有可更新的有效字段。`);
+      }
+      const updated = {
+        ...row,
+        ...normalized.sanitizedValues,
+        updatedAt: new Date().toISOString(),
+      };
+      await serverDb.put(row.dbKey, updated);
+      results.push(updated);
+    }
+
+    return jsonResponse({
+      rawData: { count: results.length, items: results },
+      displayData: `已批量更新 ${results.length} 行。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to update table rows";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleDeleteTableRows(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    ensureTenantAccess(userId, tenantId);
+    if (!tableId) throw new Error("tableId 必传。");
+    const rowIds = Array.isArray(body.rowIds) ? body.rowIds : [];
+    const dbKeys = Array.isArray(body.dbKeys) ? body.dbKeys : [];
+    const targets = [
+      ...rowIds.map((rowId: string) => ({ rowId })),
+      ...dbKeys.map((dbKey: string) => ({ dbKey })),
+    ];
+    if (targets.length === 0) throw new Error("需要至少提供一个 rowId 或 dbKey。");
+
+    const results = [];
+    for (const target of targets) {
+      const row = await loadRowOrThrow(tenantId, tableId, target.rowId, target.dbKey);
+      const now = new Date().toISOString();
+      const deleted = { ...row, deletedAt: now, updatedAt: now };
+      await serverDb.put(row.dbKey, deleted);
+      results.push(deleted);
+    }
+
+    return jsonResponse({
+      rawData: { count: results.length, items: results },
+      displayData: `已批量删除 ${results.length} 行。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to delete table rows";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleAddTableColumn(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    ensureTenantAccess(userId, tenantId);
+    if (!tableId) throw new Error("tableId 必传。");
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+    const column = normalizeColumnInput(body);
+    if (tableMeta.columns.some((item) => item.name === column.name)) {
+      throw new Error(`字段 ${column.name} 已存在。`);
+    }
+    const updated = {
+      ...tableMeta,
+      columns: [...tableMeta.columns, column],
+      updatedAt: new Date().toISOString(),
+    };
+    await serverDb.put(tableMeta.dbKey, updated);
+    return jsonResponse({
+      rawData: updated,
+      displayData: `已新增字段 ${column.name}。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to add table column";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleDeleteTableColumn(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    const columnName = typeof body.columnName === "string" ? body.columnName.trim() : "";
+    ensureTenantAccess(userId, tenantId);
+    if (!tableId || !columnName) throw new Error("tableId 和 columnName 必传。");
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+    if (!tableMeta.columns.some((column) => column.name === columnName)) {
+      throw new Error(`字段 ${columnName} 不存在。`);
+    }
+    const rows = await loadTableRows(tenantId, tableId);
+    const updatedAt = new Date().toISOString();
+    for (const row of rows) {
+      if (Object.prototype.hasOwnProperty.call(row, columnName)) {
+        const { [columnName]: _removed, ...rest } = row;
+        await serverDb.put(row.dbKey, { ...rest, updatedAt });
+      }
+    }
+    const updated = {
+      ...tableMeta,
+      columns: tableMeta.columns.filter((column) => column.name !== columnName),
+      updatedAt,
+    };
+    await serverDb.put(tableMeta.dbKey, updated);
+    return jsonResponse({
+      rawData: updated,
+      displayData: `已删除字段 ${columnName}。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to delete table column";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleRenameTableColumn(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    const oldName = typeof body.oldName === "string" ? body.oldName.trim() : "";
+    const newName = typeof body.newName === "string" ? body.newName.trim() : "";
+    ensureTenantAccess(userId, tenantId);
+    if (!tableId || !oldName || !newName) throw new Error("tableId、oldName、newName 必传。");
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+    if (!tableMeta.columns.some((column) => column.name === oldName)) {
+      throw new Error(`字段 ${oldName} 不存在。`);
+    }
+    if (tableMeta.columns.some((column) => column.name === newName)) {
+      throw new Error(`字段 ${newName} 已存在。`);
+    }
+    const rows = await loadTableRows(tenantId, tableId);
+    const updatedAt = new Date().toISOString();
+    for (const row of rows) {
+      if (Object.prototype.hasOwnProperty.call(row, oldName)) {
+        const { [oldName]: oldValue, ...rest } = row;
+        await serverDb.put(row.dbKey, { ...rest, [newName]: oldValue, updatedAt });
+      }
+    }
+    const updated = {
+      ...tableMeta,
+      columns: tableMeta.columns.map((column) =>
+        column.name === oldName ? { ...column, name: newName } : column
+      ),
+      updatedAt,
+    };
+    await serverDb.put(tableMeta.dbKey, updated);
+    return jsonResponse({
+      rawData: updated,
+      displayData: `已将字段 ${oldName} 重命名为 ${newName}。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to rename table column";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleRenameTableColumnLabel(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    const columnName = typeof body.columnName === "string" ? body.columnName.trim() : "";
+    const newLabel = typeof body.newLabel === "string" ? body.newLabel.trim() : "";
+    ensureTenantAccess(userId, tenantId);
+    if (!tableId || !columnName || !newLabel) throw new Error("tableId、columnName、newLabel 必传。");
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+    if (!tableMeta.columns.some((column) => column.name === columnName)) {
+      throw new Error(`字段 ${columnName} 不存在。`);
+    }
+    const updated = {
+      ...tableMeta,
+      columns: tableMeta.columns.map((column) =>
+        column.name === columnName ? { ...column, label: newLabel } : column
+      ),
+      updatedAt: new Date().toISOString(),
+    };
+    await serverDb.put(tableMeta.dbKey, updated);
+    return jsonResponse({
+      rawData: updated,
+      displayData: `已将字段 ${columnName} 的显示名改为 ${newLabel}。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to rename table column label";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}
+
+export async function handleRenameTable(req: Request): Promise<Response> {
+  try {
+    await ensureServerDbOpen();
+    const userId = await getAuthedUserId(req);
+    const body = await req.json().catch(() => ({} as any));
+    const tenantId = typeof body.tenantId === "string" ? body.tenantId.trim() : "";
+    const tableId = typeof body.tableId === "string" ? body.tableId.trim() : "";
+    const newName = typeof body.newName === "string" ? body.newName.trim() : "";
+    ensureTenantAccess(userId, tenantId);
+    if (!tableId || !newName) throw new Error("tableId 和 newName 必传。");
+    const tableMeta = await loadTableMetaOrThrow(tenantId, tableId);
+    const updated = {
+      ...tableMeta,
+      displayName: newName,
+      updatedAt: new Date().toISOString(),
+    };
+    await serverDb.put(tableMeta.dbKey, updated);
+    return jsonResponse({
+      rawData: updated,
+      displayData: `已将表名改为「${newName}」。`,
+    });
+  } catch (error: any) {
+    const message = error?.message ?? "Failed to rename table";
+    return jsonResponse({ error: message }, message.startsWith("Unauthorized") ? 401 : message.startsWith("Forbidden") ? 403 : 500);
+  }
+}