nolo-cli 0.1.31 → 0.1.32

package/server/handlers/appSandboxHandler.ts

@@ -1,1076 +0,0 @@
-// packages/server/handlers/appSandboxHandler.ts
-// 在我们服务器用 Bun Worker 沙箱运行用户部署的应用代码
-// 路由: /apps/:appId/*  → 加载代码 → Worker 沙箱执行 → 返回 Response
-
-import { join } from "path";
-import { tmpdir } from "os";
-import { writeFile, unlink } from "fs/promises";
-import { pathToFileURL } from "node:url";
-import { getServerAuthorityStore } from "../../database/server/db";
-import { saveVersion } from "./versionStore";
-import type { BundleFile } from "../appBundler";
-import {
-  getSpaceRecord,
-  normalizeSpaceId,
-  resolveUserSpaceRole,
-  type SpaceRole,
-} from "./appSpaceAccess";
-import {
-  buildLegacyAppRouteKey,
-  buildOwnerScopedAppKey,
-} from "../../app/utils/appKeys";
-import { WEB_AUTH_TOKEN_COOKIE } from "../../auth/tokenCookie";
-import { buildTombstoneRecord, isTombstoneRecord } from "../../database/tombstones";
-
-const getAppSandboxStore = () => getServerAuthorityStore();
-const serverDb = {
-  get<T = any>(key: string) {
-    return getAppSandboxStore().get<T>(key);
-  },
-  put(key: string, value: unknown) {
-    return getAppSandboxStore().put(key, value);
-  },
-  del(key: string) {
-    return getAppSandboxStore().del(key);
-  },
-  iterator(options?: {
-    gte?: string;
-    lte?: string;
-    lt?: string;
-    reverse?: boolean;
-  }) {
-    return getAppSandboxStore().iterator(options);
-  },
-};
-
-// ── 存储 key ────────────────────────────────────────────────
-export const APP_CODE_PREFIX = "app-code-";
-
-export type AppVisibility = "private" | "unlisted" | "public";
-
-export type AppSourceSnapshot =
-  | {
-      kind: "worker-code";
-      code: string;
-    }
-  | {
-      kind: "worker-files";
-      files: BundleFile[];
-    }
-  | {
-      kind: "react-spa";
-      files: BundleFile[];
-      entryFile: string;
-      externalImports: string[];
-    };
-
-export interface AppRecord {
-  appId?: string;
-  appKey?: string;
-  code: string;
-  userId: string;
-  name: string;
-  scriptName?: string;
-  deployMode?: "platform";
-  visibility?: AppVisibility;
-  source?: AppSourceSnapshot;
-  framework?: "worker" | "react-spa";
-  customUrl?: string;
-  versionServerOrigin?: string;
-  spaceId?: string;
-  updatedAt: number;
-  createdAt?: number;
-}
-
-type StoredAppRecord = AppRecord & { appId: string; appKey: string };
-type RepairStoredAppRecordOptions = {
-  persist?: boolean;
-  source?: "legacy" | "scoped";
-};
-
-type RepairStoredAppRecordResult = {
-  record: StoredAppRecord | null;
-  repairedLegacyMirror: boolean;
-  createdScopedMirror: boolean;
-  updatedScopedMirror: boolean;
-};
-
-export type AppLegacyMirrorBackfillStats = {
-  scanned: number;
-  repairedLegacyMirror: number;
-  createdScopedMirror: number;
-  updatedScopedMirror: number;
-};
-
-type AppRuntimeContext = {
-  auth: {
-    provided: boolean;
-    authenticated: boolean;
-  };
-  app: {
-    id: string;
-    key: string;
-    name: string;
-    ownerId: string;
-    visibility: AppVisibility;
-    spaceId: string | null;
-  };
-  user: null | {
-    id: string;
-    isOwner: boolean;
-    isSpaceMember: boolean;
-    spaceRole: SpaceRole | null;
-  };
-  space: null | {
-    id: string;
-    isMember: boolean;
-    role: SpaceRole | null;
-  };
-};
-
-function hydrateAppRecord(appId: string, record: AppRecord | null): StoredAppRecord | null {
-  if (!record) return null;
-  if (isTombstoneRecord(record)) return null;
-  const normalizedUserId =
-    typeof record.userId === "string" && record.userId.trim()
-      ? record.userId.trim()
-      : null;
-  if (!normalizedUserId) return null;
-  const normalizedSpaceId = normalizeSpaceId(record.spaceId ?? null) ?? undefined;
-  const appKey =
-    typeof record.appKey === "string" && record.appKey.trim()
-      ? record.appKey
-      : buildOwnerScopedAppKey({
-          userId: normalizedUserId,
-          appId,
-          spaceId: normalizedSpaceId,
-        });
-  return {
-    ...record,
-    userId: normalizedUserId,
-    appId,
-    appKey,
-    ...(normalizedSpaceId ? { spaceId: normalizedSpaceId } : {}),
-  };
-}
-
-function getRecordTimestamp(record: Partial<AppRecord> | null | undefined): number {
-  const value = Number(record?.updatedAt ?? record?.createdAt ?? 0);
-  return Number.isFinite(value) ? value : 0;
-}
-
-function comparableStoredAppRecord(record: StoredAppRecord | null | undefined) {
-  if (!record) return null;
-  return {
-    appId: record.appId,
-    appKey: record.appKey,
-    code: record.code,
-    userId: record.userId,
-    name: record.name,
-    scriptName: record.scriptName,
-    deployMode: record.deployMode,
-    visibility: record.visibility,
-    source: record.source,
-    framework: record.framework,
-    customUrl: record.customUrl,
-    spaceId: normalizeSpaceId(record.spaceId ?? null) ?? undefined,
-    updatedAt: record.updatedAt,
-    createdAt: record.createdAt,
-  };
-}
-
-function storedAppRecordsMatch(
-  left: StoredAppRecord | null | undefined,
-  right: StoredAppRecord | null | undefined
-): boolean {
-  return JSON.stringify(comparableStoredAppRecord(left)) === JSON.stringify(comparableStoredAppRecord(right));
-}
-
-async function repairStoredAppRecord(
-  appId: string,
-  record: AppRecord | null,
-  options: RepairStoredAppRecordOptions = {}
-): Promise<RepairStoredAppRecordResult> {
-  const persist = options.persist === true;
-  const source = options.source ?? "legacy";
-  const hydrated = hydrateAppRecord(appId, record);
-  if (!hydrated) {
-    return {
-      record: null,
-      repairedLegacyMirror: false,
-      createdScopedMirror: false,
-      updatedScopedMirror: false,
-    };
-  }
-
-  if (source === "scoped") {
-    return {
-      record: hydrated,
-      repairedLegacyMirror: false,
-      createdScopedMirror: false,
-      updatedScopedMirror: false,
-    };
-  }
-
-  const normalizedSpaceId = normalizeSpaceId(record?.spaceId ?? null);
-  const existingScoped = hydrateAppRecord(
-    appId,
-    (await serverDb.get(hydrated.appKey).catch(() => null)) as AppRecord | null
-  );
-  const hydratedTimestamp = getRecordTimestamp(hydrated);
-  const existingScopedTimestamp = getRecordTimestamp(existingScoped);
-  const shouldPreferScoped =
-    Boolean(existingScoped) && existingScopedTimestamp >= hydratedTimestamp;
-  const shouldRepairFromScoped =
-    shouldPreferScoped && existingScoped ? !storedAppRecordsMatch(hydrated, existingScoped) : false;
-  const resolvedRecord = shouldPreferScoped && existingScoped ? existingScoped : hydrated;
-  const repairedLegacyMirror =
-    record?.appId !== appId ||
-    record?.appKey !== hydrated.appKey ||
-    normalizedSpaceId !== (hydrated.spaceId ?? null) ||
-    shouldRepairFromScoped;
-  const shouldWriteScoped =
-    !existingScoped || existingScopedTimestamp < hydratedTimestamp;
-  const createdScopedMirror = !existingScoped && shouldWriteScoped;
-  const updatedScopedMirror = Boolean(existingScoped) && shouldWriteScoped;
-
-  const writes: Promise<unknown>[] = [];
-  if (persist && repairedLegacyMirror) {
-    writes.push(serverDb.put(`${APP_CODE_PREFIX}${appId}`, resolvedRecord));
-  }
-
-  if (persist && shouldWriteScoped) {
-    writes.push(serverDb.put(hydrated.appKey, resolvedRecord));
-  }
-
-  if (writes.length > 0) {
-    await Promise.all(writes);
-  }
-
-  return {
-    record: resolvedRecord,
-    repairedLegacyMirror,
-    createdScopedMirror,
-    updatedScopedMirror,
-  };
-}
-
-export async function backfillOwnerScopedAppRecords(options: {
-  dryRun?: boolean;
-  limit?: number;
-} = {}): Promise<AppLegacyMirrorBackfillStats> {
-  const stats: AppLegacyMirrorBackfillStats = {
-    scanned: 0,
-    repairedLegacyMirror: 0,
-    createdScopedMirror: 0,
-    updatedScopedMirror: 0,
-  };
-  const limit =
-    typeof options.limit === "number" && Number.isFinite(options.limit) && options.limit > 0
-      ? Math.floor(options.limit)
-      : null;
-
-  for await (const [key, value] of serverDb.iterator({
-    gte: APP_CODE_PREFIX,
-    lte: APP_CODE_PREFIX + "\xff",
-  })) {
-    if (limit !== null && stats.scanned >= limit) break;
-    const appId = key.slice(APP_CODE_PREFIX.length);
-    const result = await repairStoredAppRecord(appId, value as AppRecord, {
-      persist: !options.dryRun,
-      source: "legacy",
-    });
-    if (!result.record) continue;
-    stats.scanned += 1;
-    if (result.repairedLegacyMirror) stats.repairedLegacyMirror += 1;
-    if (result.createdScopedMirror) stats.createdScopedMirror += 1;
-    if (result.updatedScopedMirror) stats.updatedScopedMirror += 1;
-  }
-
-  return stats;
-}
-
-export async function saveAppCode(
-  appId: string,
-  code: string,
-  meta: {
-    userId: string;
-    name: string;
-    deployMode?: "platform";
-    visibility?: AppVisibility;
-    source?: AppSourceSnapshot;
-    framework?: "worker" | "react-spa";
-    customUrl?: string;
-    versionServerOrigin?: string;
-    spaceId?: string | null;
-  }
-): Promise<StoredAppRecord> {
-  const legacyExistingRaw: AppRecord | null = await serverDb
-    .get(`${APP_CODE_PREFIX}${appId}`)
-    .catch(() => null);
-  const legacyExisting = legacyExistingRaw && !isTombstoneRecord(legacyExistingRaw)
-    ? legacyExistingRaw
-    : null;
-  const now = Date.now();
-  const spaceId = normalizeSpaceId(meta.spaceId ?? legacyExisting?.spaceId ?? null) ?? undefined;
-  const appKey = buildOwnerScopedAppKey({
-    userId: meta.userId,
-    appId,
-    spaceId,
-  });
-  const keyExistingRaw: AppRecord | null = await serverDb.get(appKey).catch(() => null);
-  const keyExisting = keyExistingRaw && !isTombstoneRecord(keyExistingRaw)
-    ? keyExistingRaw
-    : null;
-  const existing = keyExisting ?? legacyExisting;
-  const visibility = meta.visibility ?? existing?.visibility ?? "private";
-  const { scriptName: _legacyScriptName, ...existingWithoutLegacyScriptName } = existing ?? {};
-  const { spaceId: _ignoredSpaceId, ...restMeta } = meta;
-  const record = hydrateAppRecord(appId, {
-    ...existingWithoutLegacyScriptName,
-    appId,
-    appKey,
-    ...restMeta,
-    code,
-    visibility,
-    versionServerOrigin: existing?.versionServerOrigin ?? meta.versionServerOrigin,
-    updatedAt: now,
-    createdAt: existing?.createdAt ?? now,
-    ...(spaceId ? { spaceId } : {}),
-  })!;
-  await Promise.all([
-    serverDb.put(appKey, record),
-    serverDb.put(`${APP_CODE_PREFIX}${appId}`, record),
-  ]);
-
-  // 每次保存自动创建版本快照（异步，不阻塞部署响应）
-  saveVersion("app", appId, record, { createdBy: meta.userId }).catch(() => {});
-  return record;
-}
-
-export async function saveAppSourceSnapshot(
-  appId: string,
-  source: AppSourceSnapshot,
-  meta?: {
-    framework?: "worker" | "react-spa";
-    preserveUpdatedAt?: boolean;
-    versionServerOrigin?: string;
-  }
-): Promise<StoredAppRecord | null> {
-  const existing = await getAppRecord(appId);
-  if (!existing) return null;
-
-  const next = hydrateAppRecord(appId, {
-    ...existing,
-    source,
-    framework:
-      meta?.framework ??
-      existing.framework ??
-      (source.kind === "react-spa" ? "react-spa" : "worker"),
-    versionServerOrigin: existing.versionServerOrigin ?? meta?.versionServerOrigin,
-    updatedAt: meta?.preserveUpdatedAt === false ? Date.now() : existing.updatedAt,
-  });
-  if (!next) return null;
-
-  await Promise.all([
-    serverDb.put(next.appKey, next),
-    serverDb.put(`${APP_CODE_PREFIX}${appId}`, next),
-  ]);
-  return next;
-}
-
-export async function setAppVisibility(appId: string, visibility: AppVisibility): Promise<boolean> {
-  try {
-    const existing = await getAppRecord(appId);
-    if (!existing) return false;
-    const next = {
-      ...existing,
-      visibility,
-      updatedAt: Date.now(),
-    };
-    await Promise.all([
-      serverDb.put(existing.appKey, next),
-      serverDb.put(`${APP_CODE_PREFIX}${appId}`, next),
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export async function setAppCustomUrl(
-  appId: string,
-  customUrl?: string | null
-): Promise<boolean> {
-  try {
-    const existing = await getAppRecord(appId);
-    if (!existing) return false;
-    const next = {
-      ...existing,
-      customUrl: customUrl?.trim() || undefined,
-      updatedAt: Date.now(),
-    };
-    await Promise.all([
-      serverDb.put(existing.appKey, next),
-      serverDb.put(`${APP_CODE_PREFIX}${appId}`, next),
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function findScopedAppRecordById(appId: string): Promise<AppRecord | null> {
-  for await (const [key, value] of serverDb.iterator({
-    gte: "app-",
-    lte: "app-\xff",
-  })) {
-    const stringKey = String(key);
-    if (stringKey.startsWith(APP_CODE_PREFIX)) continue;
-    const record = value as AppRecord | null;
-    if (record?.appId !== appId) continue;
-    return record;
-  }
-  return null;
-}
-
-export async function getAppRecord(appId: string): Promise<AppRecord | null> {
-  try {
-    const legacyRecord = await serverDb.get(`${APP_CODE_PREFIX}${appId}`).catch(() => null);
-    if (legacyRecord) {
-      return (
-        await repairStoredAppRecord(appId, legacyRecord as AppRecord, {
-          source: "legacy",
-        })
-      ).record;
-    }
-
-    const scopedRecord = await findScopedAppRecordById(appId);
-    if (!scopedRecord) return null;
-
-    const hydrated = hydrateAppRecord(appId, scopedRecord);
-    if (!hydrated) return null;
-    await serverDb.put(`${APP_CODE_PREFIX}${appId}`, hydrated).catch(() => {});
-    return hydrated;
-  } catch {
-    return null;
-  }
-}
-
-export async function getAppRecordByKey(appKey: string): Promise<AppRecord | null> {
-  if (!appKey) return null;
-  const direct = await serverDb.get(appKey).catch(() => null);
-  if (direct) {
-    const directAppId =
-      typeof (direct as AppRecord | null)?.appId === "string" &&
-      (direct as AppRecord).appId
-        ? (direct as AppRecord).appId!
-        : appKey;
-    return (
-      await repairStoredAppRecord(directAppId, direct as AppRecord, {
-        source: "scoped",
-      })
-    ).record;
-  }
-  const legacyFallbackId = appKey.startsWith("app-") ? appKey.slice("app-".length) : appKey;
-  const legacyRecord = await getAppRecord(legacyFallbackId);
-  if (legacyRecord) {
-    return legacyRecord;
-  }
-  for await (const [key, value] of serverDb.iterator({
-    gte: APP_CODE_PREFIX,
-    lte: APP_CODE_PREFIX + "\xff",
-  })) {
-    const appId = key.slice(APP_CODE_PREFIX.length);
-    const hydrated = (
-      await repairStoredAppRecord(appId, value as AppRecord, { source: "legacy" })
-    ).record;
-    if (!hydrated) continue;
-    const canonicalKey = buildOwnerScopedAppKey({
-      userId: hydrated.userId,
-      appId,
-      spaceId: hydrated.spaceId,
-    });
-    if (canonicalKey === appKey || buildLegacyAppRouteKey(appId) === appKey) {
-      return hydrated;
-    }
-  }
-  return null;
-}
-
-// 扫描所有 public app（用于社区列表）
-export async function listPublicApps(): Promise<any[]> {
-  const results: any[] = [];
-  for await (const [key, value] of serverDb.iterator({
-    gte: APP_CODE_PREFIX,
-    lte: APP_CODE_PREFIX + "\xff",
-  })) {
-    const appId = key.slice(APP_CODE_PREFIX.length);
-    const record = (
-      await repairStoredAppRecord(appId, value as AppRecord, { source: "legacy" })
-    ).record;
-    if (record?.visibility === "public") {
-      const appId = key.slice(APP_CODE_PREFIX.length);
-      results.push({ ...record, code: undefined });
-    }
-  }
-  return results;
-}
-
-export async function listUserApps(userId: string): Promise<any[]> {
-  const results = new Map<string, any>();
-  const scopedPrefix = `app-${userId}-`;
-  for await (const [key, value] of serverDb.iterator({
-    gte: scopedPrefix,
-    lte: `${scopedPrefix}\xff`,
-  })) {
-    const record = value as AppRecord;
-    if (record?.userId !== userId || !record?.name) continue;
-    const appId =
-      typeof record.appId === "string" && record.appId
-        ? record.appId
-        : String(key).slice(scopedPrefix.length);
-    const hydrated = hydrateAppRecord(appId, record);
-    if (!hydrated) continue;
-    results.set(appId, { ...hydrated, code: undefined });
-  }
-  for await (const [key, value] of serverDb.iterator({
-    gte: APP_CODE_PREFIX,
-    lte: APP_CODE_PREFIX + "\xff",
-  })) {
-    const record = value as AppRecord;
-    if (record?.userId !== userId) continue;
-    const appId = key.slice(APP_CODE_PREFIX.length);
-    if (results.has(appId)) continue;
-    const hydrated = (
-      await repairStoredAppRecord(appId, record, { persist: true, source: "legacy" })
-    ).record;
-    if (!hydrated) continue;
-    results.set(appId, { ...hydrated, code: undefined });
-  }
-  return [...results.values()];
-}
-
-export async function listSpaceApps(spaceId: string): Promise<any[]> {
-  const space = await getSpaceRecord(spaceId);
-  const contentKeys = new Set<string>();
-  for (const item of Object.values(space?.contents ?? {})) {
-    const content = item as { type?: string; contentKey?: string } | null;
-    if (!content || content.type?.toLowerCase() !== "app" || !content.contentKey) continue;
-    contentKeys.add(content.contentKey);
-  }
-
-  const directRecords = await Promise.all(
-    [...contentKeys].map(async (contentKey) => {
-      const record = await getAppRecordByKey(contentKey);
-      if (!record) return null;
-      return { ...(record as StoredAppRecord), code: undefined };
-    })
-  );
-  const resolvedDirectRecords = directRecords.filter(Boolean);
-  return resolvedDirectRecords;
-}
-
-// ── legacy 清理索引：仅用于删除旧的 app-script-* key ───────────────
-// 新的 app CRUD / deploy 主路径已经不再读写这类索引。
-// 当一次性 sweep 脚本确认线上旧 key 已清空后，可连同 APP_SCRIPT_PREFIX
-// 和 deleteAppScriptIndex 一起删除。
-const APP_SCRIPT_PREFIX = "app-script-";
-
-export async function deleteAppScriptIndex(scriptName: string): Promise<void> {
-  try {
-    await serverDb.del(`${APP_SCRIPT_PREFIX}${scriptName}`);
-  } catch {}
-}
-
-export async function deleteAppCode(
-  appId: string,
-  options?: { appKey?: string | null }
-): Promise<void> {
-  const record = await getAppRecord(appId);
-  const explicitAppKey =
-    typeof options?.appKey === "string" && options.appKey.trim()
-      ? options.appKey.trim()
-      : null;
-  const keyToDelete = explicitAppKey ?? record?.appKey ?? null;
-  const nowIso = new Date().toISOString();
-  await evictAppRuntime(appId);
-  await Promise.all([
-    serverDb.del(`${APP_CODE_PREFIX}${appId}`).catch(() => {}),
-    keyToDelete
-      ? serverDb
-          .put(
-            keyToDelete,
-            buildTombstoneRecord(
-              record
-                ? {
-                    ...record,
-                    appId,
-                    appKey: keyToDelete,
-                    type: "app",
-                    dbKey: keyToDelete,
-                  }
-                : {
-                    appId,
-                    appKey: keyToDelete,
-                    dbKey: keyToDelete,
-                    type: "app",
-                  },
-              nowIso
-            )
-          )
-          .catch(() => {})
-      : Promise.resolve(),
-  ]);
-}
-
-async function loadAppCode(appId: string): Promise<string | null> {
-  try {
-    const record = await serverDb.get(`${APP_CODE_PREFIX}${appId}`) as any;
-    return record?.code ?? null;
-  } catch {
-    return null;
-  }
-}
-
-// ── Worker 池：cacheKey → { worker, pending, lastUsed, tmpFiles } ─
-// cacheKey = `${appId}:${codeHash}`，代码变更后旧 Worker 自动失效
-interface PoolEntry {
-  worker: Worker;
-  pending: Map<number, { resolve: (v: any) => void; reject: (e: any) => void }>;
-  lastUsed: number;
-  tmpFiles: string[];
-}
-
-const POOL = new Map<string, PoolEntry>();
-// appId → 当前活跃的 cacheKey（用于代码更新时驱逐旧 Worker）
-const APP_CACHE_KEY = new Map<string, string>();
-const POOL_TTL_MS = 5 * 60 * 1000; // 5分钟无访问则驱逐
-let _reqId = 0;
-
-function codeHash(code: string): string {
-  let h = 0x811c9dc5;
-  for (let i = 0; i < code.length; i++) {
-    h ^= code.charCodeAt(i);
-    h = (h * 0x01000193) >>> 0;
-  }
-  return h.toString(36);
-}
-
-async function evictWorker(cacheKey: string): Promise<void> {
-  const entry = POOL.get(cacheKey);
-  if (entry) {
-    entry.worker.terminate();
-    POOL.delete(cacheKey);
-    await Promise.all(entry.tmpFiles.map((f) => unlink(f).catch(() => {})));
-  }
-  for (const [appId, activeCacheKey] of APP_CACHE_KEY.entries()) {
-    if (activeCacheKey === cacheKey) {
-      APP_CACHE_KEY.delete(appId);
-    }
-  }
-}
-
-export async function evictAppRuntime(appId: string): Promise<void> {
-  const cacheKey = APP_CACHE_KEY.get(appId);
-  if (!cacheKey) return;
-  await evictWorker(cacheKey);
-}
-
-// 定期清理空闲 Worker
-const workerPoolCleanupTimer = setInterval(() => {
-  const now = Date.now();
-  for (const [cacheKey, entry] of POOL) {
-    if (now - entry.lastUsed > POOL_TTL_MS) {
-      evictWorker(cacheKey);
-    }
-  }
-}, 60_000);
-
-// 允许一次性脚本 import 本模块后在完成工作时自然退出。
-if (typeof (workerPoolCleanupTimer as { unref?: () => void }).unref === "function") {
-  (workerPoolCleanupTimer as { unref: () => void }).unref();
-}
-
-async function getOrCreateWorker(appId: string, code: string): Promise<PoolEntry> {
-  const key = `${appId}:${codeHash(code)}`;
-
-  // 若代码变了，驱逐旧 Worker
-  const prevKey = APP_CACHE_KEY.get(appId);
-  if (prevKey && prevKey !== key) {
-    evictWorker(prevKey);
-  }
-
-  const existing = POOL.get(key);
-  if (existing) {
-    existing.lastUsed = Date.now();
-    return existing;
-  }
-
-  // 写用户代码到临时文件（ESM 格式）
-  // 文件名含 codeHash，避免同一 appId 并发新旧代码更新时互相覆盖临时文件
-  const hash = codeHash(code);
-  const userFile = join(tmpdir(), `nolo-app-${appId}-${hash}.mjs`);
-  const wrapperFile = join(tmpdir(), `nolo-wrap-${appId}-${hash}.mjs`);
-  const userFileUrl = pathToFileURL(userFile).href;
-  const wrapperFileUrl = pathToFileURL(wrapperFile);
-
-  // wrapper 负责：导入用户模块 + postMessage 桥接
-  const wrapperCode = `
-import userApp from "${userFileUrl}";
-
-let handler = null;
-if (userApp && typeof userApp.fetch === "function") {
-  handler = userApp;  // export { fetch }
-} else if (userApp && userApp.default && typeof userApp.default.fetch === "function") {
-  handler = userApp.default;  // export default { fetch }
-}
-
-self.onmessage = async (e) => {
-  const { id, method, url, headers, body, env: runtimeEnv } = e.data;
-  if (!handler) {
-    self.postMessage({ id, error: "Worker 未导出 fetch 处理器", status: 500 });
-    return;
-  }
-  try {
-    const req = new Request(url, {
-      method,
-      headers: new Headers(headers ?? {}),
-      body: body ?? null,
-    });
-    const env = runtimeEnv && typeof runtimeEnv === "object" ? runtimeEnv : {};
-    const resp = await handler.fetch(req, env);
-    const buf = await resp.arrayBuffer();
-    const uint8 = new Uint8Array(buf);
-    self.postMessage(
-      { id, status: resp.status, headers: [...resp.headers.entries()], body: uint8 },
-      [uint8.buffer]
-    );
-  } catch (err) {
-    self.postMessage({ id, error: String(err), status: 500 });
-  }
-};
-`;
-
-  await writeFile(userFile, code, "utf-8");
-  await writeFile(wrapperFile, wrapperCode, "utf-8");
-
-  const worker = new Worker(wrapperFileUrl, { type: "module" });
-  const pending = new Map<number, { resolve: (v: any) => void; reject: (e: any) => void }>();
-
-  worker.onmessage = (e: MessageEvent) => {
-    const { id, ...rest } = e.data;
-    const p = pending.get(id);
-    if (p) { pending.delete(id); p.resolve(rest); }
-  };
-  worker.onerror = (e: ErrorEvent) => {
-    for (const [, p] of pending) p.reject(new Error(e.message));
-    pending.clear();
-    POOL.delete(key);
-    APP_CACHE_KEY.delete(appId);
-    unlink(userFile).catch(() => {});
-    unlink(wrapperFile).catch(() => {});
-  };
-
-  const entry: PoolEntry = { worker, pending, lastUsed: Date.now(), tmpFiles: [userFile, wrapperFile] };
-  POOL.set(key, entry);
-  APP_CACHE_KEY.set(appId, key);
-  return entry;
-}
-
-function callWorker(entry: PoolEntry, payload: object): Promise<any> {
-  return new Promise((resolve, reject) => {
-    const id = ++_reqId;
-    entry.pending.set(id, { resolve, reject });
-    entry.worker.postMessage({ id, ...payload });
-    // 30s 超时
-    setTimeout(() => {
-      if (entry.pending.has(id)) {
-        entry.pending.delete(id);
-        reject(new Error("Worker 响应超时"));
-      }
-    }, 30_000);
-  });
-}
-
-function isHtmlNavigationRequest(req: Request): boolean {
-  const accept = (req.headers.get("accept") ?? req.headers.get("Accept") ?? "").toLowerCase();
-  const secFetchDest = (req.headers.get("sec-fetch-dest") ?? req.headers.get("Sec-Fetch-Dest") ?? "").toLowerCase();
-  const secFetchMode = (req.headers.get("sec-fetch-mode") ?? req.headers.get("Sec-Fetch-Mode") ?? "").toLowerCase();
-
-  return (
-    accept.includes("text/html") ||
-    secFetchDest === "document" ||
-    secFetchMode === "navigate"
-  );
-}
-
-function createJsonErrorResponse(status: number, message: string): Response {
-  return new Response(JSON.stringify({ error: message }), {
-    status,
-    headers: { "Content-Type": "application/json; charset=utf-8" },
-  });
-}
-
-function createSpaceMemberGatePageResponse(): Response {
-  return new Response(
-    `<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="UTF-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>访问受限 - nolo.chat</title>
-  <style>
-    :root {
-      color-scheme: light;
-      --bg: #f6f7fb;
-      --card: #ffffff;
-      --text: #111827;
-      --muted: #6b7280;
-      --border: #e5e7eb;
-      --primary: #111827;
-      --primary-hover: #000000;
-      --secondary-bg: #ffffff;
-      --secondary-hover: #f9fafb;
-    }
-    * { box-sizing: border-box; }
-    body {
-      margin: 0;
-      min-height: 100vh;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      padding: 24px;
-      font-family: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-      background: radial-gradient(circle at top, #ffffff 0%, var(--bg) 58%);
-      color: var(--text);
-    }
-    .card {
-      width: 100%;
-      max-width: 560px;
-      background: var(--card);
-      border: 1px solid var(--border);
-      border-radius: 20px;
-      box-shadow: 0 20px 60px rgba(17, 24, 39, 0.08);
-      padding: 32px;
-    }
-    .brand {
-      font-size: 14px;
-      font-weight: 700;
-      letter-spacing: 0.08em;
-      text-transform: uppercase;
-      color: var(--muted);
-      margin-bottom: 16px;
-    }
-    h1 {
-      margin: 0 0 12px;
-      font-size: 28px;
-      line-height: 1.25;
-    }
-    p {
-      margin: 0;
-      color: var(--muted);
-      line-height: 1.7;
-      font-size: 15px;
-    }
-    .actions {
-      display: flex;
-      flex-wrap: wrap;
-      gap: 12px;
-      margin-top: 28px;
-    }
-    .button {
-      display: inline-flex;
-      align-items: center;
-      justify-content: center;
-      min-height: 44px;
-      padding: 0 18px;
-      border-radius: 12px;
-      border: 1px solid var(--border);
-      text-decoration: none;
-      font-weight: 600;
-      font-size: 14px;
-      transition: all 0.15s ease;
-    }
-    .button-primary {
-      background: var(--primary);
-      color: #ffffff;
-      border-color: var(--primary);
-    }
-    .button-primary:hover {
-      background: var(--primary-hover);
-      border-color: var(--primary-hover);
-    }
-    .button-secondary {
-      background: var(--secondary-bg);
-      color: var(--text);
-    }
-    .button-secondary:hover {
-      background: var(--secondary-hover);
-    }
-    .hint {
-      margin-top: 18px;
-      font-size: 13px;
-      color: var(--muted);
-    }
-    @media (max-width: 640px) {
-      .card { padding: 24px; border-radius: 16px; }
-      h1 { font-size: 24px; }
-      .actions { flex-direction: column; }
-      .button { width: 100%; }
-    }
-  </style>
-</head>
-<body>
-  <main class="card">
-    <div class="brand">nolo.chat</div>
-    <h1>这个演示应用仅对空间成员开放</h1>
-    <p>请先登录或注册 nolo.chat 账号，再由分享者将你加入对应空间后访问此应用。</p>
-    <div class="actions">
-      <a class="button button-primary" href="/login">登录</a>
-      <a class="button button-secondary" href="/signup">注册</a>
-      <a class="button button-secondary" href="/">返回首页</a>
-    </div>
-    <div class="hint">如果你认为自己应该有权限，请联系分享者为你开通空间访问权限。</div>
-  </main>
-</body>
-</html>`,
-    {
-      status: 403,
-      headers: { "Content-Type": "text/html; charset=utf-8" },
-    }
-  );
-}
-
-function createSpaceMemberForbiddenResponse(req: Request): Response {
-  if (isHtmlNavigationRequest(req)) {
-    return createSpaceMemberGatePageResponse();
-  }
-  return createJsonErrorResponse(403, "此应用仅限空间成员访问");
-}
-
-async function resolveSandboxRuntimeContext(
-  req: Request,
-  record: StoredAppRecord
-): Promise<AppRuntimeContext | Response> {
-  const authHeader = req.headers.get("authorization") ?? req.headers.get("Authorization") ?? "";
-  const cookieHeader = req.headers.get("cookie") ?? req.headers.get("Cookie") ?? "";
-  const authProvided =
-    /^Bearer\s+.+$/i.test(authHeader) ||
-    cookieHeader.includes(`${WEB_AUTH_TOKEN_COOKIE}=`);
-  let authUserId: string | null = null;
-
-  if (authProvided) {
-    const { authenticateRequest } = await import("../../auth/utils");
-    const auth = await authenticateRequest(req);
-    if (!(auth instanceof Response)) {
-      authUserId = auth.userId;
-    } else if (record.spaceId && record.visibility === "private") {
-      return createSpaceMemberForbiddenResponse(req);
-    }
-  } else if (record.spaceId && record.visibility === "private") {
-    return createSpaceMemberForbiddenResponse(req);
-  }
-
-  const spaceRole =
-    authUserId && record.spaceId
-      ? await resolveUserSpaceRole(authUserId, record.spaceId)
-      : null;
-
-  if (record.spaceId && record.visibility === "private" && !spaceRole) {
-    return createSpaceMemberForbiddenResponse(req);
-  }
-
-  return {
-    auth: {
-      provided: authProvided,
-      authenticated: Boolean(authUserId),
-    },
-    app: {
-      id: record.appId,
-      key: record.appKey,
-      name: record.name,
-      ownerId: record.userId,
-      visibility: record.visibility ?? "private",
-      spaceId: record.spaceId ?? null,
-    },
-    user: authUserId
-      ? {
-          id: authUserId,
-          isOwner: authUserId === record.userId,
-          isSpaceMember: Boolean(spaceRole),
-          spaceRole,
-        }
-      : null,
-    space: record.spaceId
-      ? {
-          id: record.spaceId,
-          isMember: Boolean(spaceRole),
-          role: spaceRole,
-        }
-      : null,
-  };
-}
-
-// ── 主 handler ───────────────────────────────────────────────
-// GET/POST/... /apps/:appId/*
-export async function handleAppSandbox(req: Request): Promise<Response> {
-  const url = new URL(req.url);
-  // 从路径提取 appId: /apps/{appId}/...
-  const match = url.pathname.match(/^\/apps\/([^/]+)(\/.*)?$/);
-  if (!match) return new Response("Not Found", { status: 404 });
-
-  const appId = match[1];
-
-  const record = await getAppRecord(appId);
-  const code = record?.code ?? null;
-  if (!code || !record) {
-    return createJsonErrorResponse(404, "应用不存在或未部署");
-  }
-  const runtimeContext = await resolveSandboxRuntimeContext(req, record as StoredAppRecord);
-  if (runtimeContext instanceof Response) return runtimeContext;
-
-  let entry: PoolEntry;
-  try {
-    entry = await getOrCreateWorker(appId, code);
-  } catch (err) {
-    return createJsonErrorResponse(500, `沙箱启动失败: ${err}`);
-  }
-
-  // 读取请求 body
-  let body: ArrayBuffer | null = null;
-  if (req.method !== "GET" && req.method !== "HEAD") {
-    try { body = await req.arrayBuffer(); } catch { body = null; }
-  }
-
-  const headersObj = Object.fromEntries(req.headers.entries());
-
-  // 剥去 /apps/{appId} 前缀，让应用代码看到与 CF Workers 一致的干净路径
-  // 平台模式: /apps/{appId}/about → /about
-  // CF 模式:  /about            → /about（代码无需改动，两端一致）
-  const workerUrl = new URL(req.url);
-  workerUrl.pathname = workerUrl.pathname.replace(`/apps/${appId}`, "") || "/";
-
-  let result: any;
-  try {
-    result = await callWorker(entry, {
-      method: req.method,
-      url: workerUrl.toString(),
-      headers: headersObj,
-      body,
-      env: { context: runtimeContext },
-    });
-  } catch (err) {
-    return createJsonErrorResponse(500, String(err));
-  }
-
-  if (result.error) {
-    return createJsonErrorResponse(result.status ?? 500, result.error);
-  }
-
-  const respHeaders = new Headers(result.headers ?? []);
-  return new Response(result.body, {
-    status: result.status ?? 200,
-    headers: respHeaders,
-  });
-}