nolo-cli 0.1.31 → 0.1.33

package/server/handlers/typecheckWorker.ts

@@ -1,54 +0,0 @@
-import type { TypeCheckResult } from "./applyLineEditsHandler";
-import { performTypeCheckInProcess } from "./applyLineEditsHandler";
-
-type TypeCheckWorkerPayload = {
-    filePath: string;
-    content: string;
-    originalContent?: string;
-};
-
-function isTypeCheckWorkerPayload(value: unknown): value is TypeCheckWorkerPayload {
-    if (!value || typeof value !== "object") return false;
-    const payload = value as Partial<TypeCheckWorkerPayload>;
-    return (
-        typeof payload.filePath === "string" &&
-        typeof payload.content === "string" &&
-        (payload.originalContent == null ||
-            typeof payload.originalContent === "string")
-    );
-}
-
-async function readStdinText(): Promise<string> {
-    return await new Promise<string>((resolve, reject) => {
-        let input = "";
-        process.stdin.setEncoding("utf8");
-        process.stdin.on("data", (chunk: string) => {
-            input += chunk;
-        });
-        process.stdin.on("end", () => resolve(input));
-        process.stdin.on("error", reject);
-    });
-}
-
-async function main() {
-    const rawInput = await readStdinText();
-    const parsed = rawInput ? JSON.parse(rawInput) : null;
-    if (!isTypeCheckWorkerPayload(parsed)) {
-        throw new Error("Invalid type check worker payload");
-    }
-
-    const result: TypeCheckResult = await performTypeCheckInProcess(
-        parsed.filePath,
-        parsed.content,
-        parsed.originalContent ?? ""
-    );
-
-    process.stdout.write(JSON.stringify(result));
-}
-
-void main().catch((error) => {
-    console.error(
-        `[typecheckWorker] ${error instanceof Error ? error.message : String(error)}`
-    );
-    process.exit(1);
-});

package/server/handlers/userEvents.ts

@@ -1,6 +0,0 @@
-import { registerEventChannelAuthorizer } from "./eventBus";
-
-registerEventChannelAuthorizer("user-", ({ userId, channel }) => {
-  const targetUserId = channel.slice("user-".length);
-  return Boolean(targetUserId) && targetUserId === userId;
-});

package/server/handlers/userSecretsHandler.ts

@@ -1,221 +0,0 @@
-// packages/server/handlers/userSecretsHandler.ts
-//
-// 用户密钥管理：存储 CF Token、第三方 API Key 等敏感凭证。
-//
-// 安全架构：
-//   - 每个 value 独立用 AES-256-GCM 加密（随机 12-byte IV），再存入 LevelDB。
-//   - 加密 key 由 SECRET_KEY 环境变量（与注册/登录共用）经 SHA-256 派生（32 bytes）。
-//   - 存储格式：enc:v1:{base64(iv)}:{base64(ciphertext+authtag)}
-//   - 未配置 SECRET_KEY 时明文存储并打 WARN 日志（仅开发环境可接受）。
-//   - 历史明文条目（无 enc:v1: 前缀）读取时自动识别，不会崩溃。
-//   - 前端展示时做掩码处理（前4后4，中间替换为 ****）。
-
-import { authenticateRequest, CORS_HEADERS_AUTH } from "../../auth/utils";
-import { getServerAuthorityStore } from "../../database/server/db";
-
-const SECRETS_KEY_PREFIX = "user-secrets-";
-const ENC_PREFIX = "enc:v1:";
-
-// ── 加密 Key 派生 ──────────────────────────────────────────
-// 复用注册/登录的 SECRET_KEY 作为加密密钥原料（两用途经各自 KDF 派生，互不干扰）
-const PLATFORM_SECRET_KEY = process.env.SECRET_KEY ?? "";
-const IS_PRODUCTION = process.env.NODE_ENV === "production";
-
-if (!PLATFORM_SECRET_KEY) {
-  if (IS_PRODUCTION) {
-    // 生产环境缺 SECRET_KEY 是严重配置错误，启动时立即 fail fast
-    throw new Error("[userSecrets] FATAL: SECRET_KEY 未配置，生产环境禁止以明文存储用户凭证。请设置 SECRET_KEY 环境变量后重启。");
-  }
-  console.warn("[userSecrets] SECRET_KEY 未配置，用户密钥将以明文存储。仅开发环境可接受。");
-}
-
-let _cryptoKey: CryptoKey | null = null;
-
-async function getCryptoKey(): Promise<CryptoKey | null> {
-  if (!PLATFORM_SECRET_KEY) return null;
-  if (_cryptoKey) return _cryptoKey;
-  const raw = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(PLATFORM_SECRET_KEY));
-  _cryptoKey = await crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
-  return _cryptoKey;
-}
-
-async function encryptValue(plaintext: string): Promise<string> {
-  const key = await getCryptoKey();
-  if (!key) {
-    // 仅开发环境到达此处（生产环境在模块加载时已 throw）
-    return plaintext;
-  }
-
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(plaintext));
-  const ivB64 = Buffer.from(iv).toString("base64");
-  const ctB64 = Buffer.from(new Uint8Array(ct)).toString("base64");
-  return `${ENC_PREFIX}${ivB64}:${ctB64}`;
-}
-
-async function decryptValue(stored: string): Promise<string> {
-  if (!stored.startsWith(ENC_PREFIX)) return stored; // 历史明文条目，直接返回
-
-  const key = await getCryptoKey();
-  if (!key) {
-    // 有加密数据但没有密钥，无法解密（通常是密钥被删除）
-    throw new Error("无法解密用户密钥：SECRET_KEY 未配置或已更换");
-  }
-
-  const rest = stored.slice(ENC_PREFIX.length); // "{ivB64}:{ctB64}"
-  const sep = rest.indexOf(":");
-  if (sep === -1) throw new Error("加密数据格式损坏");
-
-  const iv = Buffer.from(rest.slice(0, sep), "base64");
-  const ct = Buffer.from(rest.slice(sep + 1), "base64");
-
-  const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ct);
-  return new TextDecoder().decode(plain);
-}
-
-// ── LevelDB 读写（内部操作均为明文 map）────────────────────
-
-function secretsKey(userId: string): string {
-  return `${SECRETS_KEY_PREFIX}${userId}`;
-}
-
-type EncryptedSecretsMap = Record<string, string>; // values 可能是 enc:v1:... 或历史明文
-
-const getUserSecretsStore = () => getServerAuthorityStore();
-
-function isSecretsNotFoundError(error: unknown): boolean {
-  const candidate = error as { code?: string; notFound?: boolean; message?: string } | null;
-  return (
-    candidate?.code === "LEVEL_NOT_FOUND" ||
-    candidate?.notFound === true ||
-    candidate?.message === "NotFound"
-  );
-}
-
-async function loadRawSecrets(userId: string): Promise<EncryptedSecretsMap> {
-  const store = getUserSecretsStore();
-  try {
-    return ((await store.get(secretsKey(userId))) as EncryptedSecretsMap) ?? {};
-  } catch (e: any) {
-    if (isSecretsNotFoundError(e)) return {};
-    throw e;
-  }
-}
-
-/** 加载并解密所有 secrets，返回明文 map（仅在服务端内部使用）*/
-async function loadSecrets(userId: string): Promise<Record<string, string>> {
-  const raw = await loadRawSecrets(userId);
-  const result: Record<string, string> = {};
-  for (const [k, v] of Object.entries(raw)) {
-    result[k] = await decryptValue(v);
-  }
-  return result;
-}
-
-// ── 工具函数 ──────────────────────────────────────────────
-
-/** 将 secret value 掩码：保留前4后4，中间替换为 **** */
-function maskValue(val: string): string {
-  if (val.length <= 8) return "****";
-  return val.slice(0, 4) + "****" + val.slice(-4);
-}
-
-function jsonError(status: number, message: string, code?: string): Response {
-  return new Response(JSON.stringify({ error: { message, code } }), {
-    status,
-    headers: { "Content-Type": "application/json", ...CORS_HEADERS_AUTH },
-  });
-}
-
-function jsonOk(data: any): Response {
-  return new Response(JSON.stringify(data), {
-    status: 200,
-    headers: { "Content-Type": "application/json", ...CORS_HEADERS_AUTH },
-  });
-}
-
-// ── HTTP Handlers ──────────────────────────────────────────
-
-/**
- * GET /api/user-secrets
- * 返回所有 key 列表，value 做掩码处理（前4后4）。
- */
-export async function handleGetUserSecrets(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const auth = await authenticateRequest(req);
-  if (auth instanceof Response) return auth;
-
-  const secrets = await loadSecrets(auth.userId);
-  const masked = Object.fromEntries(
-    Object.entries(secrets).map(([k, v]) => [k, maskValue(v)])
-  );
-
-  return jsonOk({ success: true, secrets: masked });
-}
-
-/**
- * POST /api/user-secrets/set
- * body: { key: string, value: string }
- * value 在服务端 AES-256-GCM 加密后存入 LevelDB。
- */
-export async function handleSetUserSecret(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const auth = await authenticateRequest(req);
-  if (auth instanceof Response) return auth;
-
-  let body: any;
-  try { body = await req.json(); } catch {
-    return jsonError(400, "请求体必须是合法的 JSON", "INVALID_JSON");
-  }
-
-  const { key, value } = body;
-  if (!key || typeof key !== "string") return jsonError(400, "缺少 key 参数", "MISSING_KEY");
-  if (!value || typeof value !== "string") return jsonError(400, "缺少 value 参数", "MISSING_VALUE");
-  if (!/^[A-Z0-9_]{1,64}$/.test(key)) {
-    return jsonError(400, "key 只允许大写字母、数字和下划线，最多64位", "INVALID_KEY");
-  }
-
-  const raw = await loadRawSecrets(auth.userId);
-  raw[key] = await encryptValue(value); // 加密后存储
-  await getUserSecretsStore().put(secretsKey(auth.userId), raw);
-
-  return jsonOk({ success: true, key, masked: maskValue(value) });
-}
-
-/**
- * POST /api/user-secrets/delete
- * body: { key: string }
- */
-export async function handleDeleteUserSecret(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const auth = await authenticateRequest(req);
-  if (auth instanceof Response) return auth;
-
-  let body: any;
-  try { body = await req.json(); } catch {
-    return jsonError(400, "请求体必须是合法的 JSON", "INVALID_JSON");
-  }
-
-  const { key } = body;
-  if (!key) return jsonError(400, "缺少 key 参数", "MISSING_KEY");
-
-  const raw = await loadRawSecrets(auth.userId);
-  if (!(key in raw)) return jsonError(404, `密钥 "${key}" 不存在`, "NOT_FOUND");
-
-  delete raw[key];
-  await getUserSecretsStore().put(secretsKey(auth.userId), raw);
-
-  return jsonOk({ success: true, deleted: key });
-}
-
-/**
- * 内部工具：供 appDeployHandler 等服务端模块读取用户明文密钥。
- * 自动解密，调用方拿到的是原始值。
- */
-export async function getUserSecret(userId: string, key: string): Promise<string | null> {
-  const secrets = await loadSecrets(userId);
-  return secrets[key] ?? null;
-}

package/server/handlers/versionHandler.ts

@@ -1,286 +0,0 @@
-// packages/server/handlers/versionHandler.ts
-// 版本管理 REST API
-//   POST   /api/version/save     { type, entityId, snapshot, label? }
-//   GET    /api/version/list?type=app&entityId=xxx
-//   GET    /api/version/get?type=app&entityId=xxx&versionId=yyy
-//   POST   /api/version/restore  { type, entityId, versionId }
-//   DELETE /api/version/delete   { type, entityId, versionId }
-//   POST   /api/version/pin      { type, entityId, versionId, pinned }
-//   PATCH  /api/version/label    { type, entityId, versionId, label }
-
-import { authenticateRequest, CORS_HEADERS_AUTH } from "../../auth/utils";
-import { getUser } from "../../auth/server/getUser";
-import {
-  listVersions,
-  getVersion,
-  saveVersion,
-  deleteVersion,
-  pinVersion,
-  versionKey,
-  type VersionEntityType,
-} from "./versionStore";
-import { saveAppCode, getAppRecord } from "./appSandboxHandler";
-import { getServerAuthorityStore } from "../../database/server/db";
-
-const jsonOk = (data: any) =>
-  new Response(JSON.stringify(data), {
-    status: 200,
-    headers: { "content-type": "application/json", ...CORS_HEADERS_AUTH },
-  });
-
-const jsonError = (status: number, message: string, code?: string) =>
-  new Response(JSON.stringify({ error: message, code }), {
-    status,
-    headers: { "content-type": "application/json", ...CORS_HEADERS_AUTH },
-  });
-
-const VALID_TYPES: VersionEntityType[] = ["app", "doc", "agent"];
-
-const getVersionHandlerStore = () => getServerAuthorityStore();
-
-async function getAuthUserId(req: Request): Promise<string | Response> {
-  const tokenPayload = await authenticateRequest(req);
-  if (!tokenPayload?.userId) return jsonError(401, "未登录", "UNAUTHORIZED");
-  const user = await getUser(tokenPayload.userId).catch(() => null);
-  if (!user) return jsonError(401, "用户不存在", "UNAUTHORIZED");
-  return tokenPayload.userId;
-}
-
-async function checkOwnership(
-  userId: string,
-  type: VersionEntityType,
-  entityId: string
-): Promise<Response | null> {
-  const store = getVersionHandlerStore();
-  if (type === "app") {
-    const record = await getAppRecord(entityId);
-    if (!record) return jsonError(404, "应用不存在", "NOT_FOUND");
-    if (record.userId !== userId) return jsonError(403, "无权限", "FORBIDDEN");
-  } else if (type === "agent") {
-    const agentKey = `agent-${userId}-${entityId}`;
-    const agentRecord = await store.get(agentKey).catch(() => null);
-    if (!agentRecord) return jsonError(404, "Agent 不存在或无权限", "NOT_FOUND");
-  }
-  // doc: 前端自己知道 entityId，只要登录即可
-  return null;
-}
-
-// ── POST /api/version/save ─────────────────────────────────
-// 前端显式调用，在保存 agent/doc/app 后触发
-export async function handleVersionSave(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const userIdOrError = await getAuthUserId(req);
-  if (userIdOrError instanceof Response) return userIdOrError;
-  const userId = userIdOrError;
-
-  let body: any;
-  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
-
-  const { type, entityId, snapshot, label, pinned, versionId, createdAt } = body ?? {};
-  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
-  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
-  if (!snapshot) return jsonError(400, "缺少 snapshot", "MISSING_SNAPSHOT");
-
-  const ownerError = await checkOwnership(userId, type, entityId);
-  if (ownerError) return ownerError;
-
-  const savedVersionId = await saveVersion(type, entityId, snapshot, {
-    createdBy: userId,
-    label,
-    pinned: pinned === true,
-    versionId: typeof versionId === "string" && versionId ? versionId : undefined,
-    createdAt: typeof createdAt === "number" && Number.isFinite(createdAt) ? createdAt : undefined,
-  });
-  return jsonOk({ success: true, versionId: savedVersionId });
-}
-
-// ── GET /api/version/list ──────────────────────────────────
-export async function handleVersionList(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const userIdOrError = await getAuthUserId(req);
-  if (userIdOrError instanceof Response) return userIdOrError;
-  const userId = userIdOrError;
-
-  const url = new URL(req.url);
-  const type = url.searchParams.get("type") as VersionEntityType | null;
-  const entityId = url.searchParams.get("entityId");
-
-  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
-  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
-
-  const ownerError = await checkOwnership(userId, type, entityId);
-  if (ownerError) return ownerError;
-
-  const versions = await listVersions(type, entityId);
-  return jsonOk({ success: true, versions });
-}
-
-// ── GET /api/version/get ───────────────────────────────────
-export async function handleVersionGet(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const userIdOrError = await getAuthUserId(req);
-  if (userIdOrError instanceof Response) return userIdOrError;
-  const userId = userIdOrError;
-
-  const url = new URL(req.url);
-  const type = url.searchParams.get("type") as VersionEntityType | null;
-  const entityId = url.searchParams.get("entityId");
-  const versionId = url.searchParams.get("versionId");
-
-  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
-  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
-  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
-
-  const ownerError = await checkOwnership(userId, type, entityId);
-  if (ownerError) return ownerError;
-
-  const record = await getVersion(type, entityId, versionId);
-  if (!record) return jsonError(404, "版本不存在", "NOT_FOUND");
-
-  return jsonOk({ success: true, version: record });
-}
-
-// ── POST /api/version/restore ──────────────────────────────
-export async function handleVersionRestore(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const userIdOrError = await getAuthUserId(req);
-  if (userIdOrError instanceof Response) return userIdOrError;
-  const userId = userIdOrError;
-
-  let body: any;
-  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
-
-  const { type, entityId, versionId } = body ?? {};
-  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
-  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
-  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
-
-  const ownerError = await checkOwnership(userId, type, entityId);
-  if (ownerError) return ownerError;
-
-  const record = await getVersion(type, entityId, versionId);
-  if (!record) return jsonError(404, "版本不存在", "NOT_FOUND");
-
-  const restoreLabel = `↩ 恢复自 ${new Date(record.createdAt).toLocaleString("zh-CN", { month: "numeric", day: "numeric", hour: "2-digit", minute: "2-digit" })}`;
-
-  if (type === "app") {
-    const snap = record.snapshot;
-    const existingAppRecord = await getAppRecord(entityId);
-    await saveAppCode(entityId, snap.code, {
-      userId: snap.userId ?? userId,
-      name: snap.name,
-      deployMode: snap.deployMode,
-      visibility: snap.visibility,
-      source: snap.source,
-      framework: snap.framework,
-      customUrl: snap.customUrl,
-      versionServerOrigin: existingAppRecord?.versionServerOrigin ?? new URL(req.url).origin,
-      spaceId: snap.spaceId,
-    });
-    // 记录恢复点
-    saveVersion(type, entityId, snap, { createdBy: userId, label: restoreLabel }).catch(() => {});
-    return jsonOk({ success: true, message: `已恢复到版本 ${versionId}` });
-  }
-
-  if (type === "agent") {
-    const store = getVersionHandlerStore();
-    const agentKey = `agent-${userId}-${entityId}`;
-    const restored = { ...record.snapshot, updatedAt: Date.now() };
-    await store.put(agentKey, restored);
-    saveVersion(type, entityId, restored, { createdBy: userId, label: restoreLabel }).catch(() => {});
-    return jsonOk({ success: true, message: `Agent 已恢复到版本 ${versionId}` });
-  }
-
-  if (type === "doc") {
-    const store = getVersionHandlerStore();
-    const restored = { ...record.snapshot, updatedAt: Date.now() };
-    await store.put(entityId, restored);
-    saveVersion(type, entityId, restored, { createdBy: userId, label: restoreLabel }).catch(() => {});
-    return jsonOk({ success: true, message: `文档已恢复到版本 ${versionId}` });
-  }
-
-  return jsonError(500, "不支持的类型", "UNSUPPORTED_TYPE");
-}
-
-// ── DELETE /api/version/delete ─────────────────────────────
-export async function handleVersionDelete(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const userIdOrError = await getAuthUserId(req);
-  if (userIdOrError instanceof Response) return userIdOrError;
-  const userId = userIdOrError;
-
-  let body: any;
-  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
-
-  const { type, entityId, versionId } = body ?? {};
-  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
-  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
-  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
-
-  const ownerError = await checkOwnership(userId, type, entityId);
-  if (ownerError) return ownerError;
-
-  await deleteVersion(type, entityId, versionId);
-  return jsonOk({ success: true });
-}
-
-// ── POST /api/version/pin ──────────────────────────────────
-export async function handleVersionPin(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const userIdOrError = await getAuthUserId(req);
-  if (userIdOrError instanceof Response) return userIdOrError;
-  const userId = userIdOrError;
-
-  let body: any;
-  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
-
-  const { type, entityId, versionId, pinned } = body ?? {};
-  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
-  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
-  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
-  if (typeof pinned !== "boolean") return jsonError(400, "pinned 必须是 boolean", "INVALID_PINNED");
-
-  const ownerError = await checkOwnership(userId, type, entityId);
-  if (ownerError) return ownerError;
-
-  const result = await pinVersion(type, entityId, versionId, pinned);
-  if (!result.ok) {
-    if (result.reason === "NOT_FOUND") return jsonError(404, "版本不存在", "NOT_FOUND");
-    if (result.reason === "PIN_LIMIT_EXCEEDED") return jsonError(400, `Pin 上限 10 个`, "PIN_LIMIT_EXCEEDED");
-    return jsonError(500, "操作失败", result.reason);
-  }
-  return jsonOk({ success: true, pinned });
-}
-
-// ── PATCH /api/version/label ───────────────────────────────
-export async function handleVersionLabel(req: Request): Promise<Response> {
-  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
-
-  const userIdOrError = await getAuthUserId(req);
-  if (userIdOrError instanceof Response) return userIdOrError;
-  const userId = userIdOrError;
-
-  let body: any;
-  try { body = await req.json(); } catch { return jsonError(400, "invalid_json", "INVALID_JSON"); }
-
-  const { type, entityId, versionId, label } = body ?? {};
-  if (!type || !VALID_TYPES.includes(type)) return jsonError(400, "无效的 type", "INVALID_TYPE");
-  if (!entityId) return jsonError(400, "缺少 entityId", "MISSING_ENTITY_ID");
-  if (!versionId) return jsonError(400, "缺少 versionId", "MISSING_VERSION_ID");
-  if (typeof label !== "string") return jsonError(400, "label 必须是字符串", "INVALID_LABEL");
-
-  const ownerError = await checkOwnership(userId, type, entityId);
-  if (ownerError) return ownerError;
-
-  const record = await getVersion(type, entityId, versionId);
-  if (!record) return jsonError(404, "版本不存在", "NOT_FOUND");
-
-  await serverDb.put(versionKey(type, entityId, versionId), { ...record, label: label.trim() });
-  return jsonOk({ success: true, label: label.trim() });
-}