@jonathanleelx/meddle 0.5.0-beta.9 → 0.5.0

package/dist/server/rule-files.js

@@ -33,20 +33,35 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INVALID_RULE_CONTENT_FIELD = exports.INVALID_RULE_CONTENT_JSON = void 0;
+exports.getRulesDir = getRulesDir;
+exports.resolveRuleFileOrder = resolveRuleFileOrder;
+exports.syncActiveRuleFilesToOrder = syncActiveRuleFilesToOrder;
+exports.setRuleFileOrder = setRuleFileOrder;
 exports.getActiveRuleFileNames = getActiveRuleFileNames;
 exports.readRuleFileContent = readRuleFileContent;
 exports.writeRuleFileContent = writeRuleFileContent;
 exports.createRuleFile = createRuleFile;
 exports.setActiveRuleFileNames = setActiveRuleFileNames;
 exports.listRuleFiles = listRuleFiles;
+exports.getRuleFileDetail = getRuleFileDetail;
+exports.updateRuleFile = updateRuleFile;
+exports.deleteRuleFile = deleteRuleFile;
 exports.mergeActiveRules = mergeActiveRules;
 exports.buildRuleOverview = buildRuleOverview;
 exports.ensureRouteRules = ensureRouteRules;
 exports.registerRuleFilesRoutes = registerRuleFilesRoutes;
+exports.registerUiTokenRoute = registerUiTokenRoute;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const helpers_1 = require("../helpers");
+const ruleset_lock_1 = require("./ruleset-lock");
 const DEFAULT_RULE_NAME = '默认规则';
+/** PUT /api/rule-files/:name/content: body was not JSON. */
+exports.INVALID_RULE_CONTENT_JSON = '请求体不是合法的 JSON';
+/** PUT /api/rule-files/:name/content: `content` is missing or not a string. */
+exports.INVALID_RULE_CONTENT_FIELD = 'content 必须是字符串';
+/** Directory the server reads/writes route-rule files from (<MEDDLE_HOME>/route-rules). */
 function getRulesDir(ctx) {
     return path.join(ctx.meddleDir, 'route-rules');
 }
@@ -91,6 +106,107 @@ function setActiveFileNames(ctx, names) {
     settings.activeRuleFiles = names;
     saveSettings(ctx, settings);
 }
+function getStoredRuleFileOrder(ctx) {
+    const settings = loadSettings(ctx);
+    const arr = settings.ruleFileOrder;
+    return Array.isArray(arr) ? arr.filter((name) => typeof name === 'string') : [];
+}
+function setStoredRuleFileOrder(ctx, names) {
+    const settings = loadSettings(ctx);
+    settings.ruleFileOrder = names;
+    saveSettings(ctx, settings);
+}
+/**
+ * Resolve display/tab order for rule files.
+ * Prefer persisted ruleFileOrder; when empty, seed as activeRuleFiles then remaining disk names
+ * so existing merge order is preserved for enabled files.
+ */
+function resolveRuleFileOrder(diskNames, storedOrder, activeNames) {
+    const diskSet = new Set(diskNames);
+    const ordered = [];
+    const seen = new Set();
+    const pushUnique = (name) => {
+        if (!diskSet.has(name) || seen.has(name))
+            return;
+        ordered.push(name);
+        seen.add(name);
+    };
+    if (storedOrder.length > 0) {
+        for (const name of storedOrder)
+            pushUnique(name);
+    }
+    else {
+        for (const name of activeNames)
+            pushUnique(name);
+    }
+    for (const name of diskNames)
+        pushUnique(name);
+    return ordered;
+}
+/** Keep activeRuleFiles relative order aligned with tab/file order. */
+function syncActiveRuleFilesToOrder(activeNames, fileOrder) {
+    const activeSet = new Set(activeNames);
+    const synced = fileOrder.filter((name) => activeSet.has(name));
+    for (const name of activeNames) {
+        if (!synced.includes(name))
+            synced.push(name);
+    }
+    return synced;
+}
+function readDiskRuleFileNames(ctx) {
+    const dir = getRulesDir(ctx);
+    ensureRulesDir(ctx);
+    return fs.readdirSync(dir)
+        .filter((f) => f.endsWith('.txt'))
+        .map((f) => f.replace(/\.txt$/, ''));
+}
+function ensureRuleFileInOrder(ctx, name) {
+    const diskNames = readDiskRuleFileNames(ctx);
+    const ordered = resolveRuleFileOrder(diskNames, getStoredRuleFileOrder(ctx), getActiveFileNames(ctx));
+    if (!ordered.includes(name))
+        ordered.push(name);
+    setStoredRuleFileOrder(ctx, ordered);
+    return ordered;
+}
+function renameRuleFileInOrder(ctx, oldName, newName) {
+    const diskNames = readDiskRuleFileNames(ctx);
+    const ordered = resolveRuleFileOrder(diskNames, getStoredRuleFileOrder(ctx), getActiveFileNames(ctx));
+    const next = [];
+    const seen = new Set();
+    for (const name of ordered) {
+        const resolved = name === oldName ? newName : name;
+        if (seen.has(resolved))
+            continue;
+        next.push(resolved);
+        seen.add(resolved);
+    }
+    if (!seen.has(newName))
+        next.push(newName);
+    setStoredRuleFileOrder(ctx, next);
+}
+function removeRuleFileFromOrder(ctx, name) {
+    const ordered = getStoredRuleFileOrder(ctx).filter((item) => item !== name);
+    setStoredRuleFileOrder(ctx, ordered);
+}
+function setRuleFileOrder(ctx, names) {
+    ensureRulesDir(ctx);
+    const diskNames = readDiskRuleFileNames(ctx);
+    const diskSet = new Set(diskNames);
+    const safeNames = names.map((name) => normalizeRuleFileName(name));
+    if (safeNames.length !== diskNames.length
+        || new Set(safeNames).size !== safeNames.length
+        || safeNames.some((name) => !diskSet.has(name))) {
+        throw new Error('规则文件顺序必须包含全部现有文件且无重复');
+    }
+    const activeNames = getActiveFileNames(ctx);
+    const syncedActive = syncActiveRuleFilesToOrder(activeNames, safeNames);
+    const settings = loadSettings(ctx);
+    settings.ruleFileOrder = safeNames;
+    settings.activeRuleFiles = syncedActive;
+    saveSettings(ctx, settings);
+    ctx.reloadAllRuleFiles();
+    return safeNames;
+}
 function getActiveRuleFileNames(ctx) {
     return getActiveFileNames(ctx);
 }
@@ -108,8 +224,9 @@ function writeRuleFileContent(ctx, name, content) {
     const safeName = normalizeRuleFileName(name);
     const filePath = ruleFilePath(ctx, safeName);
     if (!fs.existsSync(filePath)) {
-        throw new Error(`规则文件 "${safeName}" 不存在`);
+        throw ruleFileNotFound(safeName);
     }
+    (0, ruleset_lock_1.assertRuleFileWritable)(ctx, safeName);
     fs.writeFileSync(filePath, content, 'utf8');
     ctx.reloadAllRuleFiles();
 }
@@ -120,12 +237,15 @@ function createRuleFile(ctx, name, content = '', enabled = true) {
     if (fs.existsSync(filePath)) {
         throw new Error(`规则文件 "${safeName}" 已存在`);
     }
+    // Drop stale lock entries first so a new file never inherits an old lock.
+    (0, ruleset_lock_1.getReadonlyRuleFileNames)(ctx);
     fs.writeFileSync(filePath, content, 'utf8');
+    ensureRuleFileInOrder(ctx, safeName);
     if (enabled) {
         const activeNames = getActiveFileNames(ctx);
         if (!activeNames.includes(safeName)) {
-            activeNames.push(safeName);
-            setActiveFileNames(ctx, activeNames);
+            const fileOrder = resolveRuleFileOrder(readDiskRuleFileNames(ctx), getStoredRuleFileOrder(ctx), activeNames);
+            setActiveFileNames(ctx, syncActiveRuleFilesToOrder([...activeNames, safeName], fileOrder));
         }
     }
     ctx.reloadAllRuleFiles();
@@ -133,6 +253,7 @@ function createRuleFile(ctx, name, content = '', enabled = true) {
     return {
         name: safeName,
         enabled,
+        readonly: false,
         ruleCount: Object.keys(ruleMap).length,
         excludeCount: Object.values(excludeMap).reduce((total, exclusions) => total + exclusions.length, 0),
     };
@@ -144,7 +265,44 @@ function setActiveRuleFileNames(ctx, names) {
     if (missingNames.length > 0) {
         throw new Error(`规则文件不存在: ${missingNames.join(', ')}`);
     }
+    // A locked ruleset may not be switched on or off.
+    const previous = new Set(getActiveFileNames(ctx));
+    const next = new Set(safeNames);
+    const changed = [...previous].filter((name) => !next.has(name)).concat(safeNames.filter((name) => !previous.has(name)));
+    (0, ruleset_lock_1.assertRuleFilesWritable)(ctx, changed);
     setActiveFileNames(ctx, safeNames);
+    // Keep tab order's enabled-file relative positions aligned with activeRuleFiles
+    const diskNames = readDiskRuleFileNames(ctx);
+    const currentOrder = resolveRuleFileOrder(diskNames, getStoredRuleFileOrder(ctx), safeNames);
+    const activeSet = new Set(safeNames);
+    let activeIndex = 0;
+    const nextOrder = currentOrder.map((name) => {
+        if (!activeSet.has(name))
+            return name;
+        const replacement = safeNames[activeIndex];
+        activeIndex += 1;
+        return replacement;
+    });
+    while (activeIndex < safeNames.length) {
+        nextOrder.push(safeNames[activeIndex]);
+        activeIndex += 1;
+    }
+    // Deduplicate while preserving first occurrence
+    const deduped = [];
+    const seen = new Set();
+    for (const name of nextOrder) {
+        if (seen.has(name))
+            continue;
+        deduped.push(name);
+        seen.add(name);
+    }
+    for (const name of diskNames) {
+        if (!seen.has(name)) {
+            deduped.push(name);
+            seen.add(name);
+        }
+    }
+    setStoredRuleFileOrder(ctx, deduped);
     ctx.reloadAllRuleFiles();
     return safeNames;
 }
@@ -152,13 +310,20 @@ function setActiveRuleFileNames(ctx, names) {
  * Scan the route-rules directory and return file info list.
  */
 function listRuleFiles(ctx) {
-    const dir = getRulesDir(ctx);
     ensureRulesDir(ctx);
     const activeNames = getActiveFileNames(ctx);
-    const files = fs.readdirSync(dir)
-        .filter(f => f.endsWith('.txt'))
-        .map(f => f.replace(/\.txt$/, ''));
-    return files.map(name => {
+    const files = readDiskRuleFileNames(ctx);
+    const orderedNames = resolveRuleFileOrder(files, getStoredRuleFileOrder(ctx), activeNames);
+    const readonlyNames = new Set((0, ruleset_lock_1.getReadonlyRuleFileNames)(ctx));
+    // Persist seeded order and newly discovered / deleted names so tabs stay stable
+    const stored = getStoredRuleFileOrder(ctx);
+    const needsPersist = stored.length === 0
+        || orderedNames.some((name) => !stored.includes(name))
+        || stored.some((name) => !orderedNames.includes(name));
+    if (needsPersist) {
+        setStoredRuleFileOrder(ctx, orderedNames);
+    }
+    return orderedNames.map(name => {
         const filePath = ruleFilePath(ctx, name);
         let ruleCount = 0;
         let excludeCount = 0;
@@ -175,11 +340,83 @@ function listRuleFiles(ctx) {
         return {
             name,
             enabled: activeNames.includes(name),
+            readonly: readonlyNames.has(name),
             ruleCount,
             excludeCount,
         };
     });
 }
+/** Detail of one ruleset (info + raw content). Read-only operation. */
+function getRuleFileDetail(ctx, name) {
+    const content = readRuleFileContent(ctx, name);
+    const safeName = normalizeRuleFileName(name);
+    const info = listRuleFiles(ctx).find((file) => file.name === safeName);
+    if (!info)
+        throw new Error(`规则文件 "${safeName}" 不存在`);
+    return { ...info, content };
+}
+function ruleFileNotFound(name) {
+    return Object.assign(new Error(`规则文件 "${name}" 不存在`), { status: 404 });
+}
+/**
+ * Enable / disable and / or rename a ruleset. A locked ruleset is rejected
+ * before anything changes (the web UI must unlock it first).
+ */
+function updateRuleFile(ctx, rawName, changes) {
+    const name = normalizeRuleFileName(rawName);
+    const filePath = ruleFilePath(ctx, name);
+    if (!fs.existsSync(filePath))
+        throw ruleFileNotFound(name);
+    (0, ruleset_lock_1.assertRuleFileWritable)(ctx, name);
+    const { enabled, newName } = changes;
+    let currentName = name;
+    const activeNames = getActiveFileNames(ctx);
+    if (newName && newName.trim() && newName.trim() !== name) {
+        const safeName = normalizeRuleFileName(newName);
+        const newPath = ruleFilePath(ctx, safeName);
+        if (fs.existsSync(newPath)) {
+            throw Object.assign(new Error(`规则文件 "${safeName}" 已存在`), { status: 409 });
+        }
+        // Drop stale lock entries so the new name does not inherit an old lock.
+        (0, ruleset_lock_1.getReadonlyRuleFileNames)(ctx);
+        fs.renameSync(filePath, newPath);
+        const idx = activeNames.indexOf(name);
+        if (idx !== -1)
+            activeNames[idx] = safeName;
+        currentName = safeName;
+        renameRuleFileInOrder(ctx, name, safeName);
+    }
+    if (enabled !== undefined) {
+        const idx = activeNames.indexOf(currentName);
+        if (enabled && idx === -1) {
+            activeNames.push(currentName);
+        }
+        else if (!enabled && idx !== -1) {
+            activeNames.splice(idx, 1);
+        }
+    }
+    const fileOrder = resolveRuleFileOrder(readDiskRuleFileNames(ctx), getStoredRuleFileOrder(ctx), activeNames);
+    setActiveFileNames(ctx, syncActiveRuleFilesToOrder(activeNames, fileOrder));
+    ctx.reloadAllRuleFiles();
+    return { name: currentName };
+}
+/** Delete a ruleset. A locked ruleset is rejected and stays on disk. */
+function deleteRuleFile(ctx, rawName) {
+    const name = normalizeRuleFileName(rawName);
+    const filePath = ruleFilePath(ctx, name);
+    if (!fs.existsSync(filePath))
+        throw ruleFileNotFound(name);
+    (0, ruleset_lock_1.assertRuleFileWritable)(ctx, name);
+    fs.unlinkSync(filePath);
+    const activeNames = getActiveFileNames(ctx);
+    const idx = activeNames.indexOf(name);
+    if (idx !== -1) {
+        activeNames.splice(idx, 1);
+        setActiveFileNames(ctx, activeNames);
+    }
+    removeRuleFileFromOrder(ctx, name);
+    ctx.reloadAllRuleFiles();
+}
 /**
  * 按启用文件顺序合并路由规则；匹配时按 rules 数组顺序逐条验证。
  */
@@ -303,13 +540,17 @@ function ensureRouteRules(ctx) {
         fs.writeFileSync(defaultPath, '', 'utf8');
     }
     let activeNames = getActiveFileNames(ctx);
+    const allFiles = readDiskRuleFileNames(ctx);
     if (activeNames.length === 0) {
-        const allFiles = fs.readdirSync(dir).filter(f => f.endsWith('.txt')).map(f => f.replace(/\.txt$/, ''));
         if (allFiles.length > 0) {
             activeNames = [allFiles[0]];
             setActiveFileNames(ctx, activeNames);
         }
     }
+    const ordered = resolveRuleFileOrder(allFiles, getStoredRuleFileOrder(ctx), activeNames);
+    if (getStoredRuleFileOrder(ctx).length === 0 && ordered.length > 0) {
+        setStoredRuleFileOrder(ctx, ordered);
+    }
     return activeNames;
 }
 function registerRuleFilesRoutes(app, ctx) {
@@ -325,6 +566,26 @@ function registerRuleFilesRoutes(app, ctx) {
         res.write(JSON.stringify(buildRuleOverview(ctx)));
         res.end();
     });
+    // PUT /api/rule-files/order - 持久化 Tab / 文件顺序，并同步启用文件合并顺序
+    app.put('/api/rule-files/order', (req, res) => {
+        res.setHeader('Content-Type', 'application/json');
+        try {
+            const order = req.body?.order;
+            if (!Array.isArray(order) || order.some((name) => typeof name !== 'string')) {
+                res.statusCode = 400;
+                res.write(JSON.stringify({ error: '缺少有效的 order 数组' }));
+                res.end();
+                return;
+            }
+            const nextOrder = setRuleFileOrder(ctx, order);
+            res.write(JSON.stringify({ status: 'success', order: nextOrder }));
+        }
+        catch (err) {
+            res.statusCode = 400;
+            res.write(JSON.stringify({ error: err.message }));
+        }
+        res.end();
+    });
     // POST /api/rule-files - 创建新规则文件
     app.post('/api/rule-files', (req, res) => {
         res.setHeader('Content-Type', 'application/json');
@@ -336,30 +597,18 @@ function registerRuleFilesRoutes(app, ctx) {
                 res.end();
                 return;
             }
-            const safeName = name.trim().replace(/[/\\:*?"<>|]/g, '_');
-            const filePath = ruleFilePath(ctx, safeName);
-            if (fs.existsSync(filePath)) {
+            const ruleFile = createRuleFile(ctx, name, content, enabled !== false);
+            res.write(JSON.stringify({ status: 'success', ruleFile: { name: ruleFile.name, enabled: ruleFile.enabled, ruleCount: ruleFile.ruleCount } }));
+        }
+        catch (err) {
+            const message = err.message;
+            if (message.includes('已存在')) {
                 res.statusCode = 409;
-                res.write(JSON.stringify({ error: `规则文件 "${safeName}" 已存在` }));
-                res.end();
-                return;
             }
-            ensureRulesDir(ctx);
-            fs.writeFileSync(filePath, content, 'utf8');
-            if (enabled) {
-                const activeNames = getActiveFileNames(ctx);
-                if (!activeNames.includes(safeName)) {
-                    activeNames.push(safeName);
-                    setActiveFileNames(ctx, activeNames);
-                }
+            else {
+                res.statusCode = 500;
             }
-            ctx.reloadAllRuleFiles();
-            const ruleCount = Object.keys((0, helpers_1.parseEprcWithExclusions)(content).ruleMap).length;
-            res.write(JSON.stringify({ status: 'success', ruleFile: { name: safeName, enabled, ruleCount } }));
-        }
-        catch (err) {
-            res.statusCode = 500;
-            res.write(JSON.stringify({ error: err.message }));
+            res.write(JSON.stringify({ error: message }));
         }
         res.end();
     });
@@ -375,108 +624,147 @@ function registerRuleFilesRoutes(app, ctx) {
             return;
         }
         res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+        res.setHeader('X-Meddle-Ruleset-Readonly', (0, ruleset_lock_1.isRuleFileReadonly)(ctx, name) ? 'true' : 'false');
         res.write(fs.readFileSync(filePath, 'utf8'));
         res.end();
     });
-    // PUT /api/rule-files/:name/content - 保存规则文件内容
-    app.put('/api/rule-files/:name/content', (req, res) => {
-        res.setHeader('Content-Type', 'application/json');
+    // GET /api/rule-files/:name - 规则集详情（含 readonly 与内容）
+    app.get('/api/rule-files/:name', (req, res) => {
         const name = decodeURIComponent(req.params.name);
-        const filePath = ruleFilePath(ctx, name);
-        if (!fs.existsSync(filePath)) {
-            res.statusCode = 404;
-            res.write(JSON.stringify({ error: '规则文件不存在' }));
-            res.end();
+        if (!fs.existsSync(ruleFilePath(ctx, name))) {
+            sendJson(res, 404, { error: '规则文件不存在' });
             return;
         }
         try {
-            const text = typeof req.body === 'string' ? req.body : (req.body.content ?? '');
-            fs.writeFileSync(filePath, text, 'utf8');
-            ctx.reloadAllRuleFiles();
-            res.write(JSON.stringify({ status: 'success' }));
+            sendJson(res, 200, getRuleFileDetail(ctx, name));
         }
         catch (err) {
-            res.statusCode = 500;
-            res.write(JSON.stringify({ error: err.message }));
+            sendError(res, err);
         }
-        res.end();
     });
-    // PUT /api/rule-files/:name - 更新规则文件属性（启用/禁用、重命名）
-    app.put('/api/rule-files/:name', (req, res) => {
-        res.setHeader('Content-Type', 'application/json');
+    // PUT /api/rule-files/:name/content - 保存规则文件内容（锁住时拒绝）
+    // A missing or non-string `content` used to fall through to '' and empty the file.
+    app.put('/api/rule-files/:name/content', (req, res) => {
         const name = decodeURIComponent(req.params.name);
-        const filePath = ruleFilePath(ctx, name);
-        if (!fs.existsSync(filePath)) {
-            res.statusCode = 404;
-            res.write(JSON.stringify({ error: '规则文件不存在' }));
-            res.end();
+        const contentType = String(req.headers['content-type'] || '').toLowerCase();
+        if (!contentType.includes('application/json')) {
+            sendJson(res, 400, { error: exports.INVALID_RULE_CONTENT_JSON });
+            return;
+        }
+        if (req.body == null || typeof req.body !== 'object' || Array.isArray(req.body) || typeof req.body.content !== 'string') {
+            sendJson(res, 400, { error: exports.INVALID_RULE_CONTENT_FIELD });
             return;
         }
         try {
-            const { enabled, newName } = req.body;
-            let currentName = name;
-            const activeNames = getActiveFileNames(ctx);
-            if (newName && newName.trim() && newName.trim() !== name) {
-                const safeName = newName.trim().replace(/[/\\:*?"<>|]/g, '_');
-                const newPath = ruleFilePath(ctx, safeName);
-                if (fs.existsSync(newPath)) {
-                    res.statusCode = 409;
-                    res.write(JSON.stringify({ error: `规则文件 "${safeName}" 已存在` }));
-                    res.end();
-                    return;
-                }
-                fs.renameSync(filePath, newPath);
-                const idx = activeNames.indexOf(name);
-                if (idx !== -1)
-                    activeNames[idx] = safeName;
-                currentName = safeName;
-            }
-            if (enabled !== undefined) {
-                const idx = activeNames.indexOf(currentName);
-                if (enabled && idx === -1) {
-                    activeNames.push(currentName);
-                }
-                else if (!enabled && idx !== -1) {
-                    activeNames.splice(idx, 1);
-                }
-            }
-            setActiveFileNames(ctx, activeNames);
-            ctx.reloadAllRuleFiles();
-            res.write(JSON.stringify({ status: 'success', name: currentName }));
+            writeRuleFileContent(ctx, name, req.body.content);
+            sendJson(res, 200, { status: 'success' });
         }
         catch (err) {
-            res.statusCode = 500;
-            res.write(JSON.stringify({ error: err.message }));
+            sendError(res, err);
         }
-        res.end();
     });
-    // DELETE /api/rule-files/:name - 删除规则文件
-    app.delete('/api/rule-files/:name', (req, res) => {
-        res.setHeader('Content-Type', 'application/json');
-        const name = decodeURIComponent(req.params.name);
-        const filePath = ruleFilePath(ctx, name);
-        if (!fs.existsSync(filePath)) {
-            res.statusCode = 404;
-            res.write(JSON.stringify({ error: '规则文件不存在' }));
-            res.end();
+    // PUT /api/rule-files/:name/readonly - 加锁 / 解锁（仅 Web 界面：页面令牌 + 同源）
+    app.put('/api/rule-files/:name/readonly', (req, res) => {
+        const rawName = decodeURIComponent(req.params.name);
+        if (!(0, ruleset_lock_1.isSameOriginRequest)(req)) {
+            sendJson(res, 403, { error: '只能在 Meddle 界面中加锁或解锁', code: 'UI_ORIGIN_REQUIRED' });
+            return;
+        }
+        if (!(0, ruleset_lock_1.hasValidUiToken)(req, ctx)) {
+            sendJson(res, 403, { error: '界面令牌无效，请刷新 Meddle 页面后重试', code: 'UI_TOKEN_INVALID' });
+            return;
+        }
+        const readonly = req.body?.readonly;
+        if (typeof readonly !== 'boolean') {
+            sendJson(res, 400, { error: '缺少 readonly 布尔值' });
             return;
         }
         try {
-            fs.unlinkSync(filePath);
-            const activeNames = getActiveFileNames(ctx);
-            const idx = activeNames.indexOf(name);
-            if (idx !== -1) {
-                activeNames.splice(idx, 1);
-                setActiveFileNames(ctx, activeNames);
-            }
-            ctx.reloadAllRuleFiles();
-            res.write(JSON.stringify({ status: 'success' }));
+            const name = normalizeRuleFileName(rawName);
+            if (!fs.existsSync(ruleFilePath(ctx, name)))
+                throw ruleFileNotFound(name);
+            (0, ruleset_lock_1.setRuleFileReadonly)(ctx, name, readonly);
+            sendJson(res, 200, { status: 'success', name, readonly });
         }
         catch (err) {
-            res.statusCode = 500;
-            res.write(JSON.stringify({ error: err.message }));
+            sendError(res, err);
         }
-        res.end();
+    });
+    // PUT /api/rule-files/:name - 更新规则文件属性（启用/禁用、重命名；锁住时拒绝）
+    app.put('/api/rule-files/:name', (req, res) => {
+        const name = decodeURIComponent(req.params.name);
+        try {
+            const { enabled, newName } = req.body || {};
+            const result = updateRuleFile(ctx, name, { enabled, newName });
+            sendJson(res, 200, { status: 'success', name: result.name });
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    // DELETE /api/rule-files/:name - 删除规则文件（锁住时拒绝）
+    app.delete('/api/rule-files/:name', (req, res) => {
+        const name = decodeURIComponent(req.params.name);
+        try {
+            deleteRuleFile(ctx, name);
+            sendJson(res, 200, { status: 'success' });
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    // express.json() rejects invalid JSON before this route runs and would
+    // otherwise answer with an HTML 400. A non-JSON content type never reaches
+    // that parser, so the route itself rejects it before any write.
+    app.use((err, req, res, next) => {
+        if (isRuleFileContentPut(req) && isJsonParseFailure(err)) {
+            if (res.headersSent) {
+                next(err);
+                return;
+            }
+            sendJson(res, 400, { error: exports.INVALID_RULE_CONTENT_JSON });
+            return;
+        }
+        next(err);
+    });
+}
+function isRuleFileContentPut(req) {
+    if (req.method !== 'PUT')
+        return false;
+    const pathOnly = String(req.path || req.url || '').split('?')[0];
+    return /^\/api\/rule-files\/[^/]+\/content$/.test(pathOnly);
+}
+function isJsonParseFailure(err) {
+    if (!err)
+        return false;
+    const status = err.status || err.statusCode;
+    if (status !== 400)
+        return false;
+    return err.type === 'entity.parse.failed' || err instanceof SyntaxError;
+}
+function sendJson(res, status, body) {
+    res.statusCode = status;
+    res.setHeader('Content-Type', 'application/json');
+    res.write(JSON.stringify(body));
+    res.end();
+}
+function sendError(res, err) {
+    if ((0, ruleset_lock_1.isRulesetReadonlyError)(err)) {
+        sendJson(res, ruleset_lock_1.RULESET_READONLY_STATUS, (0, ruleset_lock_1.rulesetReadonlyBody)(err));
+        return;
+    }
+    const status = typeof err?.status === 'number' ? err.status : 500;
+    sendJson(res, status, { error: err.message });
+}
+/** Page bootstrap for the UI token (fallback when index.html was not served by Meddle, e.g. Vite dev). */
+function registerUiTokenRoute(app, ctx) {
+    app.get('/api/ui-token', (req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        if (!(0, ruleset_lock_1.isSameOriginRequest)(req)) {
+            sendJson(res, 403, { error: '只能在 Meddle 界面中获取', code: 'UI_ORIGIN_REQUIRED' });
+            return;
+        }
+        sendJson(res, 200, { token: (0, ruleset_lock_1.getUiToken)(ctx) });
     });
 }
 //# sourceMappingURL=rule-files.js.map