@maiyunnet/kebab 8.6.5 → 9.0.0

package/sys/cmd.js

@@ -4,6 +4,8 @@
  * Last: 2020-3-7 23:51:18, 2022-07-22 14:14:09, 2022-9-27 14:52:19, 2023-5-23 21:42:46, 2024-7-2 15:12:28, 2026-2-23 13:08:11
  */
 import * as http from 'http';
+import * as childProcess from 'child_process';
+import { fileURLToPath } from 'url';
 import * as lFs from '#kebab/lib/fs.js';
 import * as lText from '#kebab/lib/text.js';
 import * as lTime from '#kebab/lib/time.js';
@@ -78,6 +80,7 @@ async function run() {
         config.max ??= 64;
         config.hosts ??= [];
         config.ind ??= [];
+        config.logFormat ??= 'jsonl';
         // --- config - set ---
         config.set ??= {};
         config.set.timezone ??= 8;
@@ -345,6 +348,156 @@ async function run() {
         // --- 退出进程 ---
         process.exit();
     }
+    if (cmds[0] === 'build') {
+        // --- 构建命令：使用 esbuild 打包入口 .tsx 文件为自包含 bundle ---
+        // --- 只打包「直属于指定目录」的 .tsx，子目录内的组件文件不会被打包 ---
+        // --- 推荐目录结构：stc/view/app.tsx（入口）+ stc/view/pages/home.tsx（子组件）---
+        // --- 用法：node ./source/main build [-d www/myapp/stc/view] ---
+        let targetDir = '';
+        for (let i = 1; i < cmds.length; i++) {
+            if ((cmds[i] === '-d' || cmds[i] === '--dir') && cmds[i + 1]) {
+                targetDir = cmds[i + 1];
+                i++;
+            }
+        }
+        /** --- 扫描目录下直属的 .tsx 文件（非递归），子目录内文件不作为打包入口 --- */
+        const entryPoints = [];
+        const scanDir = async (dir) => {
+            const items = await lFs.readDir(dir);
+            for (const item of items) {
+                if (item.name === '.' || item.name === '..') {
+                    continue;
+                }
+                if (!item.isDirectory() && item.name.endsWith('.tsx')) {
+                    entryPoints.push(`${dir}/${item.name}`);
+                }
+            }
+        };
+        if (targetDir) {
+            // --- 指定了目录，只扫描该目录下的直属 .tsx ---
+            const absTarget = targetDir.startsWith('/') || /^[A-Za-z]:/.test(targetDir)
+                ? targetDir
+                : kebab.ROOT_CWD + targetDir.replace(/^\//, '');
+            if (await lFs.isDir(absTarget)) {
+                await scanDir(absTarget);
+            }
+            else {
+                lCore.display('KEBAB', 'BUILD', '[DIR NOT FOUND]', absTarget);
+                process.exit();
+                return;
+            }
+        }
+        else {
+            // --- 未指定目录：扫描 www/*/stc/ 及其直接子目录下的 .tsx ---
+            // --- 即扫描 stc/*.tsx 和 stc/*/*.tsx（如 stc/view/app.tsx），不再深入 ---
+            const wwwItems = await lFs.readDir(kebab.WWW_CWD);
+            for (const wwwItem of wwwItems) {
+                if (wwwItem.name === '.' || wwwItem.name === '..' || !wwwItem.isDirectory()) {
+                    continue;
+                }
+                const stcPath = `${kebab.WWW_CWD}${wwwItem.name}/stc`;
+                if (!await lFs.isDir(stcPath)) {
+                    continue;
+                }
+                // --- 扫描 stc/ 直属文件 ---
+                await scanDir(stcPath);
+                // --- 扫描 stc/ 的直接子目录（如 view/），取其顶层 .tsx 作为入口 ---
+                const stcItems = await lFs.readDir(stcPath);
+                for (const stcItem of stcItems) {
+                    if (stcItem.name === '.' || stcItem.name === '..' || !stcItem.isDirectory()) {
+                        continue;
+                    }
+                    await scanDir(`${stcPath}/${stcItem.name}`);
+                }
+            }
+        }
+        if (entryPoints.length === 0) {
+            lCore.display('KEBAB', 'BUILD', 'No .tsx files found.');
+            process.exit();
+            return;
+        }
+        lCore.display('KEBAB', 'BUILD', `Found ${entryPoints.length} file(s).`);
+        const esbuild = await import('esbuild');
+        for (const entry of entryPoints) {
+            const outfile = entry.replace(/\.tsx$/, '.bundle.js');
+            lCore.display('KEBAB', 'BUILD', entry.replace(kebab.ROOT_CWD, ''), '→', outfile.replace(kebab.ROOT_CWD, ''));
+            try {
+                /** --- 组件文件名（不含扩展名），用于生成 stdin 入口的 import 语句 --- */
+                const basename = entry.split('/').pop().replace(/\.tsx$/, '');
+                /** --- 组件所在目录，esbuild 以此为基准解析相对 import --- */
+                const resolveDir = entry.substring(0, entry.lastIndexOf('/'));
+                // --- stdin 入口：含水合逻辑，_routerBase 在 props 中时自动包裹 BrowserRouter ---
+                // --- React/react-dom/react-router-dom 全部打入 bundle，浏览器只加载一个 JS ---
+                const stdinContent = [
+                    `import{hydrateRoot}from'react-dom/client';`,
+                    `import{createElement}from'react';`,
+                    `import{BrowserRouter}from'react-router-dom';`,
+                    `import App from'./${basename}.tsx';`,
+                    `const el=document.getElementById('__kebab_props__');`,
+                    `if(el){`,
+                    `const p=JSON.parse(el.textContent??'{}');`,
+                    `if(typeof p._routerBase==='string'){`,
+                    `hydrateRoot(document,createElement(BrowserRouter,{basename:p._routerBase},createElement(App,p)));`,
+                    `}else{`,
+                    `hydrateRoot(document,createElement(App,p));`,
+                    `}`,
+                    `}`,
+                ].join('');
+                await esbuild.build({
+                    'stdin': {
+                        'contents': stdinContent,
+                        'resolveDir': resolveDir,
+                        'sourcefile': basename + '.hydrate.tsx',
+                        'loader': 'tsx',
+                    },
+                    'bundle': true,
+                    // --- 无 external：React 全部打入 bundle，生成自包含文件，浏览器只加载一个 JS ---
+                    'format': 'esm',
+                    'jsx': 'automatic',
+                    'jsxImportSource': 'react',
+                    'platform': 'browser',
+                    'target': 'es2022',
+                    'minify': true,
+                    'outfile': outfile,
+                });
+                lCore.display('KEBAB', 'BUILD', 'JS', outfile.replace(kebab.ROOT_CWD, ''));
+                // --- 构建 Tailwind CSS：生成同名 .css 文件 ---
+                const cssOut = entry.replace(/\.tsx$/, '.css');
+                /** --- 临时 CSS 输入文件，@source 扫描当前目录及子目录所有 tsx 文件 ---  */
+                const tmpCss = entry + '.__tw__.css';
+                await lFs.putContent(tmpCss, `@import "tailwindcss";\n@source "./**/*.tsx";\n`);
+                try {
+                    /** --- 直接用当前 Node.js 执行 CLI 的 JS 入口，跨平台无需 shell --- */
+                    const twJs = fileURLToPath(new URL('../node_modules/@tailwindcss/cli/dist/index.mjs', import.meta.url));
+                    await new Promise((resolve, reject) => {
+                        const proc = childProcess.spawn(process.execPath, [twJs, '-i', tmpCss, '-o', cssOut, '--minify'], { 'shell': false });
+                        const errLines = [];
+                        proc.stderr.on('data', (d) => errLines.push(d.toString()));
+                        proc.on('close', (code) => {
+                            if (code === 0) {
+                                resolve();
+                            }
+                            else {
+                                reject(new Error(errLines.join('').trim() || `tailwindcss exit ${code ?? 'null'}`));
+                            }
+                        });
+                    });
+                    lCore.display('KEBAB', 'BUILD', 'CSS', cssOut.replace(kebab.ROOT_CWD, ''));
+                }
+                catch (e) {
+                    lCore.display('KEBAB', 'BUILD', 'CSS SKIP (tailwindcss not installed?)', e.message ?? '');
+                }
+                finally {
+                    await lFs.unlink(tmpCss);
+                }
+            }
+            catch (e) {
+                lCore.display('KEBAB', 'BUILD', 'FAILED', entry.replace(kebab.ROOT_CWD, ''), e.message ?? '');
+            }
+        }
+        lCore.display('DONE');
+        process.exit();
+    }
     // --- 读取配置文件 ---
     const configContent = await lFs.getContent(kebab.CONF_CWD + 'config.json', 'utf8');
     if (!configContent) {

package/sys/ctr.d.ts

@@ -154,6 +154,37 @@ export declare class Ctr {
      * @param data
      */
     protected _loadView(path: string, data?: kebab.Json): Promise<string>;
+    /**
+     * --- 加载 React 全页面进行 SSR 渲染，组件需渲染完整 HTML 文档（含 html/head/body），无需 EJS ---
+     * --- 框架自动注入 props：_urlBase/_urlFull/_urlStc/_staticVer/_staticPath/_staticPathFull ---
+     * --- 多语言：自动注入 _locale（当前语言名）和 _localeData（已载语言包的合并键值对） ---
+     * --- 组件内创建：const l = (key: string, ...args: string[]): string => { let i = 0; return (_localeData[key] ?? key).replace(/\?/g, () => args[i++] ?? ''); }; ---
+     * @param path 页面组件路径（相对于 stc/ 目录，不含扩展名，tsx 编译后的 .js）
+     * @param props 传入组件的 props，框架常量自动合并，整体序列化为内联 JSON 供客户端水合复用
+     * @param opt 可选配置
+     */
+    protected _loadReactPage(path: string, props?: Record<string, kebab.Json>, opt?: {
+        /** --- 是否注入客户端水合脚本（import map + hydrateRoot），默认 true --- */
+        'hydrate'?: boolean;
+        /** --- react/react-dom/react-router-dom 版本号，用于 esm.sh CDN，默认 19 --- */
+        'reactVer'?: string;
+        /**
+         * --- 路由模式，不传则不注入任何 Router，组件自行管理路由（如 MemoryRouter）或无路由 ---
+         * --- 'browser'：服务端用 StaticRouter，客户端用 BrowserRouter，地址栏与路由联动 ---
+         * --- 组件本身只需使用 Routes/Route/Link 等，不要包含任何 Router 包裹层 ---
+         */
+        'router'?: 'browser';
+        /**
+         * --- BrowserRouter 的 basename，相对于 urlBase，默认空字符串 ---
+         * --- 例如组件挂载在 /test/react-router-page，则填 'test/react-router-page' ---
+         */
+        'routerBase'?: string;
+        /**
+         * --- 静态资源基础路径，覆盖 config.set.staticPath，用于指定 CDN 或自定义路径 ---
+         * --- 影响 _staticPath prop 以及水合脚本中 JS 文件的 URL 前缀 ---
+         */
+        'staticPath'?: string;
+    }): Promise<string>;
     /**
      * --- 设置校验错误返回值 ---
      * @param rtn 返回值数组
@@ -195,12 +226,12 @@ export declare class Ctr {
     /** --- auth 对象，user, pwd --- */
     private _authorization;
     /**
-     * --- 通过 header 或 _auth 获取鉴权信息或 JWT 信息（不解析） ---
+     * --- 通过 header 或 _auth 获取 Basic Auth 鉴权信息 ---
      */
     getAuthorization(): {
         'user': string;
         'pwd': string;
-    } | false | string;
+    } | false;
     /**
      * --- 获取 data 数据 ---
      * @param path 文件路径（不含扩展名）
@@ -236,9 +267,19 @@ export declare class Ctr {
     protected _getLocale(): string;
     /**
      * --- 开启跨域请求 ---
-     * 返回 true 接续执行，返回 false 需要中断用户本次访问（options请求）
-     */
-    protected _cross(): boolean;
+     * @param opt 可选 CORS 配置
+     * 返回 true 接续执行，返回 false 需要中断用户本次访问（options 请求）
+     */
+    protected _cross(opt?: {
+        /** --- 允许的来源列表，留空为 '*' --- */
+        'origins'?: string[];
+        /** --- 允许的请求头 --- */
+        'headers'?: string;
+        /** --- 允许的方法 --- */
+        'methods'?: string;
+        /** --- 是否允许发送凭据（cookie），默认 false --- */
+        'credentials'?: boolean;
+    }): boolean;
     /**
      * --- 获取语言包值 ---
      * @param key

package/sys/ctr.js

@@ -239,6 +239,117 @@ export class Ctr {
         };
         return lCore.purify(ejs.render(content, data, {}));
     }
+    /**
+     * --- 加载 React 全页面进行 SSR 渲染，组件需渲染完整 HTML 文档（含 html/head/body），无需 EJS ---
+     * --- 框架自动注入 props：_urlBase/_urlFull/_urlStc/_staticVer/_staticPath/_staticPathFull ---
+     * --- 多语言：自动注入 _locale（当前语言名）和 _localeData（已载语言包的合并键值对） ---
+     * --- 组件内创建：const l = (key: string, ...args: string[]): string => { let i = 0; return (_localeData[key] ?? key).replace(/\?/g, () => args[i++] ?? ''); }; ---
+     * @param path 页面组件路径（相对于 stc/ 目录，不含扩展名，tsx 编译后的 .js）
+     * @param props 传入组件的 props，框架常量自动合并，整体序列化为内联 JSON 供客户端水合复用
+     * @param opt 可选配置
+     */
+    async _loadReactPage(path, props = {}, opt = {}) {
+        // --- 组件 JS 从 stc 目录读取，浏览器同样通过 staticPath（支持 CDN）下载 ---
+        const componentPath = this._config.const.rootPath + 'stc/' + path + '.js';
+        if (!await lFs.isFile(componentPath)) {
+            return '';
+        }
+        try {
+            const reactDomServer = await import('react-dom/server');
+            const importPath = componentPath.startsWith('/')
+                ? componentPath
+                : `file:///${componentPath.replace(/\\/g, '/')}`;
+            const mod = await import(importPath);
+            const component = mod.default;
+            const react = await import('react');
+            // --- 语言包数据：合并所有已加载包的键值，供组件使用 _localeData 实现多语言 ---
+            const localeData = {};
+            for (const pkg in this._localeData) {
+                Object.assign(localeData, this._localeData[pkg]);
+            }
+            // --- 把框架常量合并进 props，与 _loadView 行为一致 ---
+            const staticPath = opt.staticPath ?? this._config.set.staticPath;
+            const fullProps = {
+                ...props,
+                '_urlBase': this._config.const.urlBase,
+                '_urlFull': this._config.const.urlFull,
+                '_urlStc': this._config.const.urlStc,
+                '_staticVer': this._config.set.staticVer,
+                '_staticPath': staticPath,
+                '_staticPathFull': this._config.set.staticPathFull,
+                '_locale': this._locale,
+                '_localeData': localeData,
+            };
+            if (opt.hydrate !== false) {
+                const reactVer = opt.reactVer ?? '19';
+                const esm = 'https://esm.sh/';
+                // --- 检查是否有 npx kebab build 生成的自包含预构建包 ---
+                const bundlePath = this._config.const.rootPath + 'stc/' + path + '.bundle.js';
+                const hasBundle = await lFs.isFile(bundlePath);
+                if (opt.router === 'browser') {
+                    // --- BrowserRouter 模式：_routerBase 注入 props，bundle 读取此值决定是否包裹 BrowserRouter ---
+                    const base = opt.routerBase ?? '';
+                    const routerBase = this._config.const.urlBase + base.replace(/^\//, '');
+                    fullProps['_routerBase'] = routerBase.replace(/\/$/, '');
+                }
+                if (hasBundle) {
+                    // --- bundle 模式：bundle 自包含 React + 水合逻辑，无需 import map，一个 JS 文件搞定 ---
+                    const clientUrl = `${staticPath}${path}.bundle.js?v=${this._config.set.staticVer}`;
+                    fullProps['_hydrateScript'] = `import'${clientUrl}';`;
+                }
+                else {
+                    // --- 开发模式（tsc 编译 .js）：通过 esm.sh import map 解析 bare import ---
+                    const clientUrl = `${staticPath}${path}.js?v=${this._config.set.staticVer}`;
+                    fullProps['_importMapJson'] = lText.stringifyJson({
+                        'imports': {
+                            'react': `${esm}react@${reactVer}`,
+                            'react-dom': `${esm}react-dom@${reactVer}`,
+                            'react-dom/client': `${esm}react-dom@${reactVer}/client`,
+                            'react/jsx-runtime': `${esm}react@${reactVer}/jsx-runtime`,
+                            'react-router-dom': `${esm}react-router-dom@7?external=react,react-dom`,
+                        },
+                    });
+                    if (opt.router === 'browser') {
+                        fullProps['_hydrateScript'] =
+                            `import{hydrateRoot}from'react-dom/client';` +
+                                `import{createElement}from'react';` +
+                                `import{BrowserRouter}from'react-router-dom';` +
+                                `import App from'${clientUrl}';` +
+                                `const p=JSON.parse(document.getElementById('__kebab_props__').textContent);` +
+                                `hydrateRoot(document,createElement(BrowserRouter,{basename:p._routerBase},createElement(App,p)));`;
+                    }
+                    else {
+                        fullProps['_hydrateScript'] =
+                            `import{hydrateRoot}from'react-dom/client';` +
+                                `import{createElement}from'react';` +
+                                `import App from'${clientUrl}';` +
+                                `const p=JSON.parse(document.getElementById('__kebab_props__').textContent);` +
+                                `hydrateRoot(document,createElement(App,p));`;
+                    }
+                }
+                // --- _propsJson 序列化当前 fullProps（不含 _propsJson 本身，避免循环引用）---
+                // --- 客户端水合时读取此 JSON，_propsJson 缺失，suppressHydrationWarning 处理差异 ---
+                fullProps['_propsJson'] = lText.stringifyJson(fullProps).replace(/<\/script>/gi, '<\\/script>');
+            }
+            // --- BrowserRouter 模式：服务端用 StaticRouter 渲染，与客户端的 BrowserRouter 等价 ---
+            // --- component 来自动态 import，TypeScript 无法精确推断，需要明确限定 element 类型 ---
+            let element = react.createElement(component, fullProps);
+            if (opt.router === 'browser') {
+                // --- StaticRouter 在 react-router-dom v7 中从主包直接导出，无需 /server 子路径 ---
+                const lReactRouter = await import('react-router-dom');
+                const reqUrl = this._req.url ?? '/';
+                element = react.createElement(lReactRouter.StaticRouter, {
+                    'location': reqUrl,
+                    'basename': fullProps['_routerBase'],
+                }, react.createElement(component, fullProps));
+            }
+            return '<!DOCTYPE html>' + reactDomServer.renderToString(element);
+        }
+        catch (e) {
+            lCore.debug(`[CTR][_loadReactPage] ${e.message ?? ''}`);
+            return '';
+        }
+    }
     /**
      * --- 设置校验错误返回值 ---
      * @param rtn 返回值数组
@@ -484,7 +595,7 @@ export class Ctr {
     /** --- auth 对象，user, pwd --- */
     _authorization = null;
     /**
-     * --- 通过 header 或 _auth 获取鉴权信息或 JWT 信息（不解析） ---
+     * --- 通过 header 或 _auth 获取 Basic Auth 鉴权信息 ---
      */
     getAuthorization() {
         if (this._authorization !== null) {
@@ -507,10 +618,6 @@ export class Ctr {
         if (authArr[1] === undefined) {
             return false;
         }
-        if (authArr[1].includes('.')) {
-            // --- 不解析，解析使用 JWT 类解析 ---
-            return authArr[1];
-        }
         if (!(auth = lCrypto.base64Decode(authArr[1]))) {
             return false;
         }
@@ -625,12 +732,29 @@ export class Ctr {
     }
     /**
      * --- 开启跨域请求 ---
-     * 返回 true 接续执行，返回 false 需要中断用户本次访问（options请求）
-     */
-    _cross() {
-        this._res.setHeader('access-control-allow-origin', '*');
-        this._res.setHeader('access-control-allow-headers', '*');
-        this._res.setHeader('access-control-allow-methods', '*');
+     * @param opt 可选 CORS 配置
+     * 返回 true 接续执行，返回 false 需要中断用户本次访问（options 请求）
+     */
+    _cross(opt = {}) {
+        if (opt.origins?.length) {
+            const reqOrigin = this._headers['origin'] ?? '';
+            if (opt.origins.includes(reqOrigin)) {
+                this._res.setHeader('access-control-allow-origin', reqOrigin);
+                this._res.setHeader('vary', 'Origin');
+            }
+            else {
+                this._res.setHeader('access-control-allow-origin', opt.origins[0]);
+                this._res.setHeader('vary', 'Origin');
+            }
+        }
+        else {
+            this._res.setHeader('access-control-allow-origin', '*');
+        }
+        this._res.setHeader('access-control-allow-headers', opt.headers ?? '*');
+        this._res.setHeader('access-control-allow-methods', opt.methods ?? '*');
+        if (opt.credentials) {
+            this._res.setHeader('access-control-allow-credentials', 'true');
+        }
         if (this._req.method === 'OPTIONS') {
             this._res.setHeader('access-control-max-age', '3600');
             this._httpCode = 204;

package/sys/master.js

@@ -1,10 +1,11 @@
 /**
  * Project: Kebab, User: JianSuoQiYue
  * Date: 2019-5-2 21:03:42
- * Last: 2020-3-7 10:33:17, 2022-07-22 13:40:10, 2022-09-06 22:40:58, 2024-2-7 01:44:59, 2024-7-2 15:17:09, 2025-6-13 13:06:43, 2025-12-5 13:15:03
+ * Last: 2020-3-7 10:33:17, 2022-07-22 13:40:10, 2022-09-06 22:40:58, 2024-2-7 01:44:59, 2024-7-2 15:17:09, 2025-6-13 13:06:43, 2025-12-5 13:15:03, 2026-3-22 00:00:00
  */
 import cluster from 'cluster';
 import * as os from 'os';
+import * as fs from 'fs';
 import * as http from 'http';
 // --- 库和定义 ---
 import * as kebab from '#kebab/index.js';
@@ -32,17 +33,21 @@ async function run() {
         ],
     });
     // --- 读取配置文件 ---
+    await lCore.loadEnv(kebab.ROOT_CWD);
     const configContent = await lFs.getContent(kebab.CONF_CWD + 'config.json', 'utf8');
     if (!configContent) {
         throw `File '${kebab.CONF_CWD}config.json' not found.`;
     }
     /** --- 系统 config.json --- */
     const config = lText.parseJson(configContent);
+    lCore.resolveEnvVars(config);
     for (const key in config) {
         lCore.globalConfig[key] = config[key];
     }
     // --- 监听 RPC 命令 ---
     createRpcListener();
+    // --- 开发模式下启用文件监听自动重载 ---
+    startFileWatcher();
     // --- 30 秒检测一次是否有丢失的子进程 ---
     setInterval(function () {
         checkWorkerLost().catch(function (e) {
@@ -281,7 +286,9 @@ function createRpcListener() {
                 }
                 case 'log': {
                     // --- 获取日志信息 ---
-                    const path = kebab.LOG_CWD + msg.hostname + (msg.fend ?? '') + '/' + msg.path + '.csv';
+                    const format = lCore.globalConfig.logFormat ?? 'jsonl';
+                    const ext = format === 'jsonl' ? '.jsonl' : '.csv';
+                    const path = kebab.LOG_CWD + msg.hostname + (msg.fend ?? '') + '/' + msg.path + ext;
                     if (!await lFs.isFile(path)) {
                         res.end(lText.stringifyJson({
                             'result': 1,
@@ -496,6 +503,20 @@ async function createChildProcess(cpu) {
                     workerList[msg.pid].hbtime = Date.now();
                     break;
                 }
+                case 'ws-broadcast': {
+                    // --- 将 WebSocket 广播消息转发给所有其他子进程 ---
+                    for (const pid in workerList) {
+                        if (workerList[pid].worker === worker) {
+                            continue;
+                        }
+                        workerList[pid].worker.send({
+                            'action': 'ws-broadcast',
+                            'channel': msg.channel,
+                            'data': msg.data,
+                        });
+                    }
+                    break;
+                }
             }
         })().catch(function (e) {
             lCore.display('[createChildProcess] [message]', e);
@@ -510,6 +531,79 @@ async function createChildProcess(cpu) {
         });
     }
 }
+/**
+ * --- 开发模式下的文件监听自动重载（HMR），仅在 debug: true 时启用 ---
+ */
+function startFileWatcher() {
+    if (!lCore.globalConfig.debug) {
+        return;
+    }
+    /** --- 防抖定时器 --- */
+    let debounceTimer = null;
+    /** --- 是否正在重启中 --- */
+    let restarting = false;
+    /**
+     * --- 监听指定目录的文件变化 ---
+     * @param dir 要监听的目录路径
+     */
+    const watchDir = (dir) => {
+        try {
+            fs.watch(dir, { 'recursive': true }, (eventType, filename) => {
+                if (!filename) {
+                    return;
+                }
+                // --- 仅关注 .js 文件和 .json 配置文件的变更 ---
+                if (!filename.endsWith('.js') &&
+                    !filename.endsWith('.json')) {
+                    return;
+                }
+                // --- 忽略日志目录和临时目录 ---
+                if (filename.includes('log/') || filename.includes('ftmp/') || filename.includes('node_modules/')) {
+                    return;
+                }
+                // --- 防抖：500ms 内多次变化只触发一次 ---
+                if (debounceTimer) {
+                    clearTimeout(debounceTimer);
+                }
+                debounceTimer = setTimeout(() => {
+                    debounceTimer = null;
+                    if (restarting) {
+                        return;
+                    }
+                    restarting = true;
+                    lCore.display(`[HMR] File changed: ${filename}, reloading workers...`);
+                    (async () => {
+                        // --- 为所有子进程发送 stop 信息并重启 ---
+                        for (const pid in workerList) {
+                            workerList[pid].worker.send({
+                                'action': 'stop'
+                            });
+                            await createChildProcess(workerList[pid].cpu);
+                            delete workerList[pid];
+                        }
+                        restarting = false;
+                        lCore.display('[HMR] All workers reloaded.');
+                    })().catch((e) => {
+                        restarting = false;
+                        lCore.display('[HMR] Reload error:', e);
+                    });
+                }, 500);
+            });
+            lCore.display(`[HMR] Watching directory: ${dir}`);
+        }
+        catch {
+            lCore.display(`[HMR] Cannot watch directory: ${dir}`);
+        }
+    };
+    // --- 监听 www/ 目录（用户项目代码）---
+    watchDir(kebab.WWW_CWD);
+    // --- 监听 ind/ 目录（独立任务代码）---
+    watchDir(kebab.IND_CWD);
+    // --- 监听 lib/ 目录（用户自定义库）---
+    watchDir(kebab.LIB_CWD);
+    // --- 监听 mod/ 目录（用户模型）---
+    watchDir(kebab.MOD_CWD);
+}
 run().catch(function (e) {
     lCore.display('[master] ------ [Process fatal Error] ------');
     lCore.display(e);

package/sys/route.d.ts

@@ -61,6 +61,7 @@ export declare function getPost(req: http2.Http2ServerRequest | http.IncomingMes
  * --- 获取 formdata 的 post ---
  * @param req 请求头
  * @param events 文件处理情况
+ * @param limits 文件上传限制
  */
 export declare function getFormData(req: http2.Http2ServerRequest | http.IncomingMessage, events?: {
     /**
@@ -71,6 +72,11 @@ export declare function getFormData(req: http2.Http2ServerRequest | http.Incomin
     onfiledata?: (chunk: Buffer) => void;
     /** --- 文件上传结束时触发，仅 start 返回 true 时触发 --- */
     onfileend?: () => void;
+}, limits?: {
+    /** --- 单个文件最大字节数 --- */
+    'maxFileSize'?: number;
+    /** --- 允许的文件扩展名（含点号），如 ['.jpg', '.png', '.pdf'] --- */
+    'allowedExts'?: string[];
 }): Promise<{
     'post': Record<string, kebab.Json>;
     'files': Record<string, kebab.IPostFile | kebab.IPostFile[]>;

package/sys/route.js

@@ -864,8 +864,9 @@ export function getPost(req) {
  * --- 获取 formdata 的 post ---
  * @param req 请求头
  * @param events 文件处理情况
+ * @param limits 文件上传限制
  */
-export function getFormData(req, events = {}) {
+export function getFormData(req, events = {}, limits = {}) {
     return new Promise(function (resolve) {
         if (req.readableEnded) {
             resolve({ 'post': {}, 'files': {} });
@@ -947,6 +948,16 @@ export function getFormData(req, events = {}) {
                             ++writeFileLength;
                             state = EState.FILE;
                             fileName = match[1];
+                            // --- 检查文件扩展名限制 ---
+                            if (limits.allowedExts?.length) {
+                                const extIo = fileName.lastIndexOf('.');
+                                const ext = extIo !== -1 ? fileName.slice(extIo).toLowerCase() : '';
+                                if (!limits.allowedExts.includes(ext)) {
+                                    // --- 扩展名不允许，跳过该文件 ---
+                                    ftmpName = '';
+                                    break;
+                                }
+                            }
                             const fr = events.onfilestart?.(name);
                             if (fr !== true) {
                                 // --- 创建文件流 ---
@@ -996,8 +1007,18 @@ export function getFormData(req, events = {}) {
                             // --- 没找到结束标语，将预留 boundary 长度之前的写入到文件 ---
                             const writeBuffer = buffer.subarray(0, -boundary.length - 4);
                             if (ftmpName) {
-                                ftmpStream.write(writeBuffer);
-                                ftmpSize += Buffer.byteLength(writeBuffer);
+                                // --- 检查文件大小限制 ---
+                                if (limits.maxFileSize &&
+                                    (ftmpSize + Buffer.byteLength(writeBuffer) > limits.maxFileSize)) {
+                                    ftmpStream.destroy();
+                                    lFs.unlink(kebab.FTMP_CWD + ftmpName).catch(() => { });
+                                    ftmpName = '';
+                                    --writeFileLength;
+                                }
+                                else {
+                                    ftmpStream.write(writeBuffer);
+                                    ftmpSize += Buffer.byteLength(writeBuffer);
+                                }
                             }
                             else {
                                 // --- 跳过该文件 ---