asaihost-nodejs 0.0.5 → 0.0.8

package/dist/asaihost-nodejs.es.js

@@ -4,17 +4,19 @@ import {
   logSecurityConfigIntervention,
   logSessionTerminate,
   logUserRbacChange
-} from "./chunk-SB23ESX2.es.js";
+} from "./chunk-GCR56QH7.es.js";
 import {
   InterventionLog_exports
-} from "./chunk-VUZO7DCA.es.js";
+} from "./chunk-N6LBKGML.es.js";
 import {
+  AsPath_exports,
   LogStore_exports,
   archiveInterventionYear,
   exportLogContent,
   getComplianceReport,
   getEffectiveStoreType,
   getLogStoreMeta,
+  getPrimaryServerRoot,
   getUnifiedEntry,
   getUnifiedStats,
   groupsToInterventionFiles,
@@ -28,7 +30,7 @@ import {
   queryUnifiedLogs,
   readWebLogFromStore,
   searchUnifiedLogs
-} from "./chunk-LTEP4XB2.es.js";
+} from "./chunk-EC67M7RR.es.js";
 import {
   W3C_ACCESS_FIELDS,
   W3C_SERVER_FIELDS,
@@ -48,7 +50,7 @@ import {
   secureCompare,
   validatePasswordChange,
   verifyPassword
-} from "./chunk-57UQJKSL.es.js";
+} from "./chunk-OTL2B4WS.es.js";
 import {
   USER_LV,
   applySecretsToHostConfig,
@@ -60,7 +62,7 @@ import {
   resolveHttpsCertFromPaths,
   stripForbiddenSecretsFromHostConfig,
   validateAsaiSecrets
-} from "./chunk-A6VJPLDD.es.js";
+} from "./chunk-5WJQD4RZ.es.js";
 import {
   getDefaultResetPassword,
   getPasswordPolicy,
@@ -73,7 +75,7 @@ import {
   resolveRoleForLevel,
   saveUserLevelConfig,
   validatePasswordWithPolicy
-} from "./chunk-A5CDJGJI.es.js";
+} from "./chunk-BOIRAQXE.es.js";
 import {
   getDataServerForAsDb
 } from "./chunk-ZQBHJRAO.es.js";
@@ -212,7 +214,7 @@ ${reason.name}: ${reason.message}`;
     if (restartTimes.length > MAX_RESTARTS) {
       try {
         $asai.$log("NO_RESTART", "Process crashed too frequently, gracefully shutdown and wait for daemon restart.");
-        void import("./intervention-hooks-TCGIC4IV.es.js").then(
+        void import("./intervention-hooks-QNA4IZT7.es.js").then(
           ({ logProcessGuardEvent }) => logProcessGuardEvent($asai, {
             action: "crash_loop_shutdown",
             detail: `${restartTimes.length} crashes in ${RESTART_WINDOW}ms window`,
@@ -254,7 +256,7 @@ ${reason.name}: ${reason.message}`;
 }
 __name(initProcess, "initProcess");
 function gracefulShutdown($asai) {
-  void import("./intervention-hooks-TCGIC4IV.es.js").then(
+  void import("./intervention-hooks-QNA4IZT7.es.js").then(
     ({ logProcessGuardEvent }) => logProcessGuardEvent($asai, {
       action: "graceful_shutdown",
       detail: "SIGTERM/SIGINT or crash guard triggered",
@@ -872,7 +874,7 @@ function initAsaiHostNodejs($asai, _opt) {
       type: "CONFIG_WARN",
       detail: "Using dev-only password; set ASAI_HOST_PASSWORD for production (IEC 62443-4-2 CR 1.7)"
     });
-    void import("./intervention-hooks-TCGIC4IV.es.js").then(
+    void import("./intervention-hooks-QNA4IZT7.es.js").then(
       ({ logSecurityConfigIntervention: logSecurityConfigIntervention2 }) => logSecurityConfigIntervention2($asai, {
         section: "password",
         detail: "dev-default-password detected at startup"
@@ -898,7 +900,7 @@ function scheduleLogComplianceCheck($asai) {
   if (hours <= 0) return;
   const ms = hours * 3600 * 1e3;
   setInterval(() => {
-    void import("./LogStore-Q35YFNAY.es.js").then(
+    void import("./LogStore-DWIPPRCA.es.js").then(
       ({ getComplianceReport: getComplianceReport2 }) => getComplianceReport2($asai, "prod")
     ).catch(() => void 0);
   }, ms);
@@ -1458,11 +1460,11 @@ function createSkipChecker($asai) {
   }
   if (exact.size === 0 && prefixes.length === 0) return () => false;
   return (url) => {
-    const path7 = normalizeRequestPath(url);
-    if (!path7) return false;
-    if (exact.has(path7)) return true;
+    const path8 = normalizeRequestPath(url);
+    if (!path8) return false;
+    if (exact.has(path8)) return true;
     for (let i = 0; i < prefixes.length; i++) {
-      if (path7.startsWith(prefixes[i])) return true;
+      if (path8.startsWith(prefixes[i])) return true;
     }
     return false;
   };
@@ -1582,10 +1584,10 @@ function getStaticBaseDirs($asai) {
       bases.push(abs);
     }
   }, "add");
+  if ($asai.serverRoot) add($asai.serverRoot);
   if (Array.isArray($asai.runtimeBaseDirs)) {
     for (const b of $asai.runtimeBaseDirs) add(b);
   }
-  if ($asai.serverRoot) add($asai.serverRoot);
   if ($asai.pkgSnapshotDir) add($asai.pkgSnapshotDir);
   return bases;
 }
@@ -1652,6 +1654,11 @@ function parseUrlPath(requrl) {
 }
 __name(parseUrlPath, "parseUrlPath");
 var STATIC_ASSET_PREFIXES = ["/assets/", "/webmodel/", "/assets/entry/", "/assets/chunk/"];
+function isMutableWebmodelConfig(urlPath) {
+  const p = parseUrlPath(urlPath);
+  return /^\/webmodel\/sys\/setting\/[^/]+\.json$/i.test(p);
+}
+__name(isMutableWebmodelConfig, "isMutableWebmodelConfig");
 function isStaticAssetPath(urlPath, indexFile) {
   const p = parseUrlPath(urlPath);
   const base = p.split("/").pop() || "";
@@ -1660,9 +1667,10 @@ function isStaticAssetPath(urlPath, indexFile) {
   return /\.(css|js|mjs|cjs|json|png|jpe?g|gif|svg|ico|woff2?|ttf|map|wasm|zip)(\?|$)/i.test(p);
 }
 __name(isStaticAssetPath, "isStaticAssetPath");
-function sendStaticBuffer(req, res, data, mimeType, mtimeMs, $asai) {
+function sendStaticBuffer(req, res, data, mimeType, mtimeMs, $asai, urlPath = "") {
   const etag = `"${data.length}-${mtimeMs}"`;
-  if (req.headers["if-none-match"] === etag) {
+  const noCache = isMutableWebmodelConfig(urlPath);
+  if (!noCache && req.headers["if-none-match"] === etag) {
     res.writeHead(304);
     res.end();
     return;
@@ -1671,7 +1679,7 @@ function sendStaticBuffer(req, res, data, mimeType, mtimeMs, $asai) {
     res.writeHead(200, {
       "Content-Type": mimeType,
       "Content-Length": data.length,
-      "Cache-Control": "public, max-age=3600",
+      "Cache-Control": noCache ? "no-cache, must-revalidate" : "public, max-age=3600",
       ETag: etag,
       "Last-Modified": new Date(mtimeMs).toUTCString()
     });
@@ -1685,7 +1693,8 @@ function sendStaticBuffer(req, res, data, mimeType, mtimeMs, $asai) {
   }
 }
 __name(sendStaticBuffer, "sendStaticBuffer");
-function serveStaticFile(req, res, foundPath, mimeType, stat, $asai) {
+function serveStaticFile(req, res, foundPath, mimeType, stat, $asai, urlPath = "") {
+  const noCache = isMutableWebmodelConfig(urlPath);
   if (stat.size <= STATIC_READ_MAX) {
     fs6.readFile(foundPath, (err, data) => {
       if (err) {
@@ -1696,13 +1705,13 @@ function serveStaticFile(req, res, foundPath, mimeType, stat, $asai) {
         }
         return;
       }
-      sendStaticBuffer(req, res, data, mimeType, stat.mtimeMs, $asai);
+      sendStaticBuffer(req, res, data, mimeType, stat.mtimeMs, $asai, urlPath);
     });
     return;
   }
   const readStream = fs6.createReadStream(foundPath);
   const etag = `"${stat.size}-${stat.mtimeMs}"`;
-  if (req.headers["if-none-match"] === etag) {
+  if (!noCache && req.headers["if-none-match"] === etag) {
     readStream.destroy();
     res.writeHead(304);
     res.end();
@@ -1721,7 +1730,7 @@ function serveStaticFile(req, res, foundPath, mimeType, stat, $asai) {
   try {
     res.writeHead(200, {
       "Content-Type": mimeType,
-      "Cache-Control": "public, max-age=3600",
+      "Cache-Control": noCache ? "no-cache, must-revalidate" : "public, max-age=3600",
       ETag: etag,
       "Last-Modified": stat.mtime.toUTCString()
     });
@@ -1779,7 +1788,7 @@ function createStaticHandler(ctx) {
       return;
     }
     const mimeType = hostcfg.mimetypes?.[nodePath2.extname(found.filePath)] || "application/octet-stream";
-    serveStaticFile(req, res, found.filePath, mimeType, found.stat, $asai);
+    serveStaticFile(req, res, found.filePath, mimeType, found.stat, $asai, processedUrl);
   }, "showHostDirs");
   return (req, res, url) => {
     res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
@@ -2342,7 +2351,7 @@ async function attachServerUserLevel(req, $asai) {
   if (!Array.isArray(userinfo) || !userinfo[0]) return;
   const us = String(userinfo[0]);
   try {
-    const { createUserStore: createUserStore2 } = await import("./user-store-UC5URX3C.es.js");
+    const { createUserStore: createUserStore2 } = await import("./user-store-FXD2N55G.es.js");
     const user = await createUserStore2($asai).findByUsername(us);
     if (user && user.status === "active") {
       req._serverUser = { us: user.us, lv: user.lv, status: user.status };
@@ -2373,11 +2382,11 @@ function getSecurityConfig($asai) {
   return $asai?.hostconfig?.security || {};
 }
 __name(getSecurityConfig, "getSecurityConfig");
-function pathMatchesPattern(path7, pattern) {
+function pathMatchesPattern(path8, pattern) {
   if (pattern.endsWith("*")) {
-    return path7.startsWith(pattern.slice(0, -1));
+    return path8.startsWith(pattern.slice(0, -1));
   }
-  return path7 === pattern;
+  return path8 === pattern;
 }
 __name(pathMatchesPattern, "pathMatchesPattern");
 function isAuthSkipped($asai, pathname) {
@@ -2555,6 +2564,10 @@ function isRawUploadPost(url = "") {
   return /\/api\/asaifile\/manage\/up(?:base64|binary)(?:batch)?\//.test(url);
 }
 __name(isRawUploadPost, "isRawUploadPost");
+function isPlainSourcePost(url = "") {
+  return /\/api\/robotcode\//.test(url);
+}
+__name(isPlainSourcePost, "isPlainSourcePost");
 function processPostPayload($asai, req, postdata, pm) {
   let isAes = false;
   let out = postdata;
@@ -2570,7 +2583,7 @@ function processPostPayload($asai, req, postdata, pm) {
     }
   }
   const plainJson = typeof out === "string" && out.trimStart().startsWith("{");
-  if (req?.Userinfo?.[2] && !plainJson && !isRawUploadPost(req?.url)) {
+  if (req?.Userinfo?.[2] && !plainJson && !isRawUploadPost(req?.url) && !isPlainSourcePost(req?.url)) {
     pm = req.Userinfo[2];
     out = $asai.$lib.AsCode.asdecode(out, pm);
   }
@@ -2660,83 +2673,95 @@ var Api_default = /* @__PURE__ */ __name(($asai, opt = {}) => {
       const isTextPost = req.method === "POST" && req.url.indexOf("binary") === -1;
       const bodyPromise = isTextPost ? readRequestBody(req, maxBody) : null;
       void (async () => {
-        let authResult;
-        let rawBody = "";
         try {
-          [authResult, rawBody] = await Promise.all([
-            validateHttpAuthAsync(req, $asai, pathname),
-            bodyPromise ?? Promise.resolve("")
-          ]);
-        } catch (err) {
-          releaseSlot();
-          if (err?.message === "PAYLOAD_TOO_LARGE") {
-            return sendError(res, 413, "Payload Too Large");
-          }
-          return sendError(res, 400, err?.message || "Bad Request");
-        }
-        if (!authResult.ok) {
-          releaseSlot();
-          return sendAuthError(res, authResult);
-        }
-        let apiFn = $asai.hostserverapi[apiHandlerKey]?.($asai, query);
-        if (!apiFn) {
-          return sendError(res, 501, "Not Implemented");
-        }
-        res.setHeader("Content-Type", "application/json; charset=utf-8");
-        $asai.$log("API", req.method, urlParse.pathname, query);
-        let qrdata;
-        let postdata;
-        if (req.url.indexOf("binary") === -1) {
-          qrdata = query;
-          if (req.method === "POST") {
-            try {
-              const processed = processPostPayload($asai, req, rawBody, pm);
-              postdata = processed.postdata;
-              pm = processed.pm;
-              isAes = processed.isAes;
-            } catch {
-              return sendError(res, 400, "AES decrypt failed");
-            }
-            if (apiFn?.post && typeof apiFn?.post === "function") {
-              const optTmp = { qrdata, data: postdata, pm };
-              if (isAes || $asai.$lib.aesfns?.allaes) {
-                optTmp.resAES = $asai.$lib.aesfns?.resAES;
-              }
-              apiFn.post(req, res, hostdir, optTmp);
-            } else {
-              res.end(typeof postdata === "string" ? postdata : JSON.stringify(postdata ?? ""));
-            }
-          } else if (req.method === "GET") {
-            if (apiFn?.get && typeof apiFn?.get === "function") {
-              const optTmp = { qrdata, data: qrdata, pm };
-              if (isAes || $asai.$lib.aesfns?.allaes) {
-                optTmp.resAES = $asai.$lib.aesfns?.resAES;
-              }
-              apiFn.get(req, res, hostdir, optTmp);
-            } else {
-              res.end(JSON.stringify(qrdata));
+          let authResult;
+          let rawBody = "";
+          try {
+            [authResult, rawBody] = await Promise.all([
+              validateHttpAuthAsync(req, $asai, pathname),
+              bodyPromise ?? Promise.resolve("")
+            ]);
+          } catch (err) {
+            releaseSlot();
+            if (err?.message === "PAYLOAD_TOO_LARGE") {
+              return sendError(res, 413, "Payload Too Large");
             }
+            return sendError(res, 400, err?.message || "Bad Request");
           }
-        } else {
-          if (Object.keys(query)?.length) {
-            qrdata = query;
+          if (!authResult.ok) {
+            releaseSlot();
+            return sendAuthError(res, authResult);
+          }
+          let apiFn = $asai.hostserverapi[apiHandlerKey]?.($asai, query);
+          if (!apiFn) {
+            return sendError(res, 501, "Not Implemented");
           }
-          if (req.method === "POST") {
-            $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
+          res.setHeader("Content-Type", "application/json; charset=utf-8");
+          $asai.$log("API", req.method, urlParse.pathname, query);
+          let qrdata;
+          let postdata;
+          if (req.url.indexOf("binary") === -1) {
+            qrdata = query;
+            if (req.method === "POST") {
+              try {
+                const processed = processPostPayload($asai, req, rawBody, pm);
+                postdata = processed.postdata;
+                pm = processed.pm;
+                isAes = processed.isAes;
+              } catch {
+                return sendError(res, 400, "AES decrypt failed");
+              }
               if (apiFn?.post && typeof apiFn?.post === "function") {
-                apiFn.post(req, res, hostdir, {
-                  qrdata,
-                  data: postdata2
-                });
+                const optTmp = { qrdata, data: postdata, pm };
+                if (isAes || $asai.$lib.aesfns?.allaes) {
+                  optTmp.resAES = $asai.$lib.aesfns?.resAES;
+                }
+                apiFn.post(req, res, hostdir, optTmp);
               } else {
-                res.end(postdata2);
+                res.end(typeof postdata === "string" ? postdata : JSON.stringify(postdata ?? ""));
               }
-            }).catch((err) => {
-              return sendError(res, 400, "Invalid content type");
-            });
+            } else if (req.method === "GET") {
+              if (apiFn?.get && typeof apiFn?.get === "function") {
+                const optTmp = { qrdata, data: qrdata, pm };
+                if (isAes || $asai.$lib.aesfns?.allaes) {
+                  optTmp.resAES = $asai.$lib.aesfns?.resAES;
+                }
+                apiFn.get(req, res, hostdir, optTmp);
+              } else {
+                res.end(JSON.stringify(qrdata));
+              }
+            }
+          } else {
+            if (Object.keys(query)?.length) {
+              qrdata = query;
+            }
+            if (req.method === "POST") {
+              $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
+                if (apiFn?.post && typeof apiFn?.post === "function") {
+                  apiFn.post(req, res, hostdir, {
+                    qrdata,
+                    data: postdata2
+                  });
+                } else {
+                  res.end(postdata2);
+                }
+              }).catch((err) => {
+                return sendError(res, 400, "Invalid content type");
+              });
+            }
           }
+        } catch (err) {
+          releaseSlot();
+          if (!res.headersSent) {
+            return sendError(res, 500, err?.message || "Internal Server Error");
+          }
+        }
+      })().catch((err) => {
+        releaseSlot();
+        if (!res.headersSent) {
+          sendError(res, 500, err?.message || "Internal Server Error");
         }
-      })();
+      });
     } else {
       $asai.$log("API", req.method, req.url);
     }
@@ -2870,27 +2895,28 @@ var Sys_default = /* @__PURE__ */ __name(($asai, opt = {}) => {
     }
     const urlPath = (req.url || "").split("?")[0];
     void (async () => {
-      const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
-      if (!authResult.ok) {
-        return sendAuthError(res, authResult);
-      }
-      const handler = $asai.hostserversys[handlerKey]?.($asai);
-      if (!handler) {
-        return sendError(res, 500, "Handler Initialization Failed");
-      }
-      if (handler?.show && typeof handler?.show === "function") {
-        handler.show(req, res, hostdir);
-      } else {
-        res.end("postdata");
+      try {
+        const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
+        if (!authResult.ok) {
+          return sendAuthError(res, authResult);
+        }
+        const handler = $asai.hostserversys[handlerKey]?.($asai);
+        if (!handler) {
+          return sendError(res, 500, "Handler Initialization Failed");
+        }
+        if (handler?.show && typeof handler?.show === "function") {
+          handler.show(req, res, hostdir);
+        } else {
+          res.end("postdata");
+        }
+      } catch (err) {
+        return sendError(res, 500, err?.message || "Internal Server Error");
       }
-      if (!handler) {
-        res.writeHead(404, {
-          "Content-Type": "application/json; charset=utf-8"
-        });
-        res.end(req.url);
-      } else {
+    })().catch((err) => {
+      if (!res.headersSent) {
+        sendError(res, 500, err?.message || "Internal Server Error");
       }
-    })();
+    });
   }
   __name(sysWork, "sysWork");
   return { sysWork };
@@ -4052,7 +4078,7 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
           passwordChangedAt: Date.now(),
           passHistory
         });
-        logSecurityEvent($asai, { type: "AUTH_FAIL", path: url, method: "POST", user: us, ip, detail: "password_changed" });
+        logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "password_changed" });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
         return sendFail(res, err?.message || err, opt);
@@ -4085,7 +4111,7 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
           passwordChangedAt: Date.now(),
           passHistory: "[]"
         });
-        logSecurityEvent($asai, { type: "AUTH_FAIL", path: url, method: "POST", user: us, ip, detail: "register_ok" });
+        logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "register_ok" });
         return sendSuccess(res, { user: publicUser($asai, user) }, opt);
       } catch (err) {
         const msg = err?.message || String(err);
@@ -4139,7 +4165,7 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
         const session = buildSessionRecord($asai, us, ip);
         session.lastActivityAt = Date.now();
         await store.addSession(session);
-        logSecurityEvent($asai, { type: "AUTH_FAIL", path: url, method: "POST", user: us, ip, detail: "login_ok" });
+        logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "login_ok" });
         return sendSuccess(
           res,
           {
@@ -4157,9 +4183,18 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
     if (url.startsWith("/api/user/login/logout/")) {
       try {
         const bodySid = body.sessionId ? sanitizeString(body.sessionId, 64) : "";
-        if (bodySid) await store.removeSession(bodySid);
         const us = req?.Userinfo?.[0];
-        if (us) logSecurityEvent($asai, { type: "AUTH_FAIL", path: url, method: "POST", user: String(us), ip, detail: "logout" });
+        if (bodySid) {
+          if (!us) {
+            return sendErr(res, "AUTH_MISSING", void 0, opt);
+          }
+          const sessions = await store.getSessions();
+          const target = sessions.find((s) => s.id === bodySid);
+          if (target && target.us === us) {
+            await store.removeSession(bodySid);
+          }
+        }
+        if (us) logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: String(us), ip, detail: "logout" });
         return sendSuccess(res, "ok", opt);
       } catch (err) {
         return sendFail(res, err?.message || err, opt);
@@ -4499,10 +4534,10 @@ var As_default = {
     return relativePath;
   },
   //创建多层文件夹 同步
-  ensureDir(fs12, relativePath) {
+  ensureDir(fs11, relativePath) {
     const absPathDir = this.toDirPath(relativePath);
     const absPath = this.toAbsolutePath(relativePath);
-    if (!fs12.existsSync(absPath)) {
+    if (!fs11.existsSync(absPath)) {
       let pathTmp = "";
       absPathDir.split("/").forEach((el) => {
         if (el) {
@@ -4510,8 +4545,8 @@ var As_default = {
             pathTmp += "/";
           }
           pathTmp += el;
-          if (!fs12.existsSync(pathTmp)) {
-            if (!fs12.mkdirSync(pathTmp, { recursive: true })) {
+          if (!fs11.existsSync(pathTmp)) {
+            if (!fs11.mkdirSync(pathTmp, { recursive: true })) {
               return absPath;
             }
           }
@@ -4520,10 +4555,10 @@ var As_default = {
     }
     return absPath;
   },
-  makeDir(fs12, filePaths) {
+  makeDir(fs11, filePaths) {
     return new Promise((resolve6, reject) => {
       try {
-        const newPath = this.ensureDir(fs12, filePaths);
+        const newPath = this.ensureDir(fs11, filePaths);
         resolve6(newPath);
       } catch (err) {
         reject(err);
@@ -4976,8 +5011,36 @@ var AsDb_default = /* @__PURE__ */ __name(($asai, cfg) => {
     return resdb;
   }
   __name(dbFresh, "dbFresh");
+  function normalizeFileSelectRow(row) {
+    const nameKey = cfg.field?.data?.[0] || "name";
+    const contentKey = cfg.field?.data?.[1] || "content";
+    if (!row || typeof row !== "object") return row;
+    const out = { ...row };
+    if (out[nameKey] != null) {
+      out[nameKey] = bareFileName(String(out[nameKey]));
+    }
+    const raw = out[contentKey];
+    if (raw != null && typeof raw !== "string") {
+      out[contentKey] = JSON.stringify(raw);
+    }
+    return out;
+  }
+  __name(normalizeFileSelectRow, "normalizeFileSelectRow");
+  function isFileSingleNameSelect(params) {
+    return cfg?.type === "file" && params?.type === "select" && !!params?.where?.length;
+  }
+  __name(isFileSingleNameSelect, "isFileSingleNameSelect");
   function normalizeSelectResult(params, resdb) {
     let data = resdb;
+    if (isFileSingleNameSelect(params)) {
+      if (Array.isArray(data)) {
+        return data.map(normalizeFileSelectRow);
+      }
+      if (data && typeof data === "object") {
+        return [normalizeFileSelectRow(data)];
+      }
+      return data;
+    }
     if (params?.where?.length && Array.isArray(data) && data.length === 1) {
       data = data[0];
     }
@@ -5092,6 +5155,7 @@ var AsDb_default = /* @__PURE__ */ __name(($asai, cfg) => {
 }, "default");
 
 // src/sysserver/lib/common/reqWork.ts
+import * as path4 from "path";
 var reqWork_default = /* @__PURE__ */ __name(($asai) => {
   function hostDefault2(mod) {
     if (mod && typeof mod === "object" && "default" in mod) {
@@ -5103,7 +5167,32 @@ var reqWork_default = /* @__PURE__ */ __name(($asai) => {
   __name(hostDefault2, "hostDefault");
   function getPathFromOpt(opt) {
     const rawPath = opt.qrdata?.path || opt.data?.path;
-    return decodeURIComponent(rawPath);
+    if (!rawPath) {
+      throw new Error("Missing path");
+    }
+    const decoded = decodeURIComponent(String(rawPath));
+    if (path4.isAbsolute(decoded)) {
+      return path4.normalize(decoded);
+    }
+    const rel = decoded.replace(/^\.(\/)?/, "");
+    const serverRoot = $asai?.serverRoot;
+    if (serverRoot && rel) {
+      const absRoot = path4.resolve(serverRoot);
+      const abs = path4.resolve(absRoot, rel);
+      const relCheck = path4.relative(absRoot, abs);
+      if (relCheck === "" || !relCheck.startsWith("..") && !path4.isAbsolute(relCheck)) {
+        return abs;
+      }
+    }
+    const roots = $asai?.asaihost?.getHostAllowedRoots?.($asai?.hostconfig) || [];
+    if (!roots.length) {
+      const fallback = $asai?.serverRoot || process.cwd();
+      if (fallback) roots.push(fallback);
+    }
+    if (!$asai?.asaihost?.resolvePathUnderRoots) {
+      throw new Error("Path resolver unavailable");
+    }
+    return $asai.asaihost.resolvePathUnderRoots(decoded, roots);
   }
   __name(getPathFromOpt, "getPathFromOpt");
   function sendSuccess(res, data, opt) {
@@ -5152,17 +5241,17 @@ __export(AsFs_exports, {
   writeJson: () => writeJson
 });
 import fs9 from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 async function ensureFile(filePath) {
-  const normalized = path4.normalize(filePath);
-  await fs9.mkdir(path4.dirname(normalized), { recursive: true });
+  const normalized = path5.normalize(filePath);
+  await fs9.mkdir(path5.dirname(normalized), { recursive: true });
   const fh = await fs9.open(normalized, "a");
   await fh.close();
 }
 __name(ensureFile, "ensureFile");
 async function pathExists(filePath) {
   try {
-    await fs9.access(path4.normalize(filePath));
+    await fs9.access(path5.normalize(filePath));
     return true;
   } catch {
     return false;
@@ -5170,7 +5259,7 @@ async function pathExists(filePath) {
 }
 __name(pathExists, "pathExists");
 async function readJson(filePath) {
-  const raw = await fs9.readFile(path4.normalize(filePath), "utf8");
+  const raw = await fs9.readFile(path5.normalize(filePath), "utf8");
   return JSON.parse(raw);
 }
 __name(readJson, "readJson");
@@ -5181,26 +5270,26 @@ function resolvePathUnderBase(baseDir, relPath) {
   if (relPath.includes("\0")) {
     throw new Error("Invalid path");
   }
-  const base = path4.resolve(baseDir);
-  const target = path4.resolve(base, relPath.replace(/\\/g, "/"));
-  const rel = path4.relative(base, target);
-  if (rel.startsWith("..") || path4.isAbsolute(rel)) {
+  const base = path5.resolve(baseDir);
+  const target = path5.resolve(base, relPath.replace(/\\/g, "/"));
+  const rel = path5.relative(base, target);
+  if (rel.startsWith("..") || path5.isAbsolute(rel)) {
     throw new Error("Path not allowed");
   }
   return target;
 }
 __name(resolvePathUnderBase, "resolvePathUnderBase");
 async function readLogDir(dir) {
-  const resolved = path4.resolve(dir);
+  const resolved = path5.resolve(dir);
   const stats = await fs9.stat(resolved);
   if (!stats.isDirectory()) {
     throw new Error("Not a directory");
   }
-  const dirName = path4.basename(resolved);
+  const dirName = path5.basename(resolved);
   const entries = await fs9.readdir(resolved, { withFileTypes: true });
   const children = await Promise.all(
     entries.map(async (entry) => {
-      const fullPath = path4.join(resolved, entry.name);
+      const fullPath = path5.join(resolved, entry.name);
       const st = await fs9.stat(fullPath);
       const dot = entry.name.lastIndexOf(".");
       const type = entry.isDirectory() ? "dir" : dot > -1 ? entry.name.substring(dot) : "file";
@@ -5208,7 +5297,7 @@ async function readLogDir(dir) {
         name: entry.name,
         size: st.size,
         time: st.mtime.toISOString(),
-        path: path4.normalize(fullPath),
+        path: path5.normalize(fullPath),
         type,
         created: st.birthtime.toISOString(),
         permissions: st.mode.toString(8).slice(-3)
@@ -5219,7 +5308,7 @@ async function readLogDir(dir) {
     name: dirName,
     size: stats.size,
     time: stats.mtime.toISOString(),
-    path: path4.normalize(resolved),
+    path: path5.normalize(resolved),
     type: "dir",
     created: stats.birthtime.toISOString(),
     permissions: stats.mode.toString(8).slice(-3),
@@ -5229,7 +5318,7 @@ async function readLogDir(dir) {
 __name(readLogDir, "readLogDir");
 async function removeFile(filePath) {
   try {
-    await fs9.unlink(path4.normalize(filePath));
+    await fs9.unlink(path5.normalize(filePath));
   } catch (err) {
     if (err?.code !== "ENOENT") throw err;
   }
@@ -5237,13 +5326,13 @@ async function removeFile(filePath) {
 __name(removeFile, "removeFile");
 var remove = removeFile;
 async function write(filePath, content) {
-  const normalized = path4.normalize(filePath);
-  await fs9.mkdir(path4.dirname(normalized), { recursive: true });
+  const normalized = path5.normalize(filePath);
+  await fs9.mkdir(path5.dirname(normalized), { recursive: true });
   await fs9.writeFile(normalized, content, "utf8");
 }
 __name(write, "write");
 async function read(filePath) {
-  return fs9.readFile(path4.normalize(filePath), "utf8");
+  return fs9.readFile(path5.normalize(filePath), "utf8");
 }
 __name(read, "read");
 async function writeJson(filePath, data) {
@@ -5251,83 +5340,6 @@ async function writeJson(filePath, data) {
 }
 __name(writeJson, "writeJson");
 
-// src/sysserver/lib/common/AsPath.ts
-var AsPath_exports = {};
-__export(AsPath_exports, {
-  getEntryDir: () => getEntryDir,
-  getExecDir: () => getExecDir,
-  getPkgSnapshotDir: () => getPkgSnapshotDir,
-  getPrimaryServerRoot: () => getPrimaryServerRoot,
-  getRuntimeBaseDirs: () => getRuntimeBaseDirs,
-  isPkgRuntime: () => isPkgRuntime
-});
-import * as fs10 from "fs";
-import * as nodePath4 from "path";
-function isPkgRuntime() {
-  return typeof process.pkg !== "undefined";
-}
-__name(isPkgRuntime, "isPkgRuntime");
-function getPkgSnapshotDir() {
-  if (!isPkgRuntime()) return void 0;
-  const entry = process.pkg?.entrypoint ?? process.pkg?.defaultEntrypoint;
-  if (!entry) return void 0;
-  return nodePath4.resolve(nodePath4.dirname(entry));
-}
-__name(getPkgSnapshotDir, "getPkgSnapshotDir");
-function getEntryDir() {
-  const snapshot = getPkgSnapshotDir();
-  if (snapshot) return snapshot;
-  const entry = process.argv[1];
-  if (!entry) {
-    return nodePath4.dirname(process.execPath);
-  }
-  return nodePath4.resolve(nodePath4.dirname(entry));
-}
-__name(getEntryDir, "getEntryDir");
-function getExecDir() {
-  return nodePath4.dirname(process.execPath);
-}
-__name(getExecDir, "getExecDir");
-function getRuntimeBaseDirs() {
-  const bases = [];
-  const seen = /* @__PURE__ */ new Set();
-  const add = /* @__PURE__ */ __name((p) => {
-    if (!p) return;
-    const abs = nodePath4.resolve(p);
-    if (!seen.has(abs)) {
-      seen.add(abs);
-      bases.push(abs);
-    }
-  }, "add");
-  add(process.cwd());
-  add(getExecDir());
-  if (isPkgRuntime()) {
-    add(getPkgSnapshotDir());
-  } else {
-    const entryDir = getEntryDir();
-    if (entryDir !== getExecDir()) {
-      add(entryDir);
-    }
-  }
-  return bases;
-}
-__name(getRuntimeBaseDirs, "getRuntimeBaseDirs");
-function getPrimaryServerRoot() {
-  for (const base of getRuntimeBaseDirs()) {
-    try {
-      if (fs10.statSync(nodePath4.join(base, "websys")).isDirectory()) {
-        return base;
-      }
-    } catch {
-    }
-  }
-  if (isPkgRuntime()) {
-    return getExecDir();
-  }
-  return getEntryDir();
-}
-__name(getPrimaryServerRoot, "getPrimaryServerRoot");
-
 // src/sysserver/lib/index.ts
 var lib_default = {
   As: As_default,
@@ -5356,7 +5368,7 @@ __export(common_exports, {
   toSetObject: () => toSetObject,
   toWherePairs: () => toWherePairs
 });
-import * as path5 from "path";
+import * as path6 from "path";
 function promisifySqlDb(query, sql) {
   return new Promise((resolve6, reject) => {
     query(sql, (err, result) => {
@@ -5421,11 +5433,11 @@ function toInsertRows(sql) {
 }
 __name(toInsertRows, "toInsertRows");
 function isPathInside(baseDir, targetPath) {
-  const base = path5.resolve(baseDir);
-  const target = path5.resolve(targetPath);
-  const relative4 = path5.relative(base, target);
-  if (!relative4) return true;
-  return !relative4.startsWith("..") && !path5.isAbsolute(relative4);
+  const base = path6.resolve(baseDir);
+  const target = path6.resolve(targetPath);
+  const relative5 = path6.relative(base, target);
+  if (!relative5) return true;
+  return !relative5.startsWith("..") && !path6.isAbsolute(relative5);
 }
 __name(isPathInside, "isPathInside");
 function joinTablePath(table, ...segments) {
@@ -5606,8 +5618,8 @@ var Sql_default = {
 };
 
 // src/sysserver/db/src/file/Index.ts
-import * as fs11 from "fs";
-import * as path6 from "path";
+import * as fs10 from "fs";
+import * as path7 from "path";
 function dbDriver(opt = {}) {
   const { Sql, DbCommon } = opt;
   const { isPathInside: isPathInside2, joinTablePath: joinTablePath2 } = DbCommon;
@@ -5620,22 +5632,23 @@ function dbDriver(opt = {}) {
       this.fileExt = config.ext === ".*" ? "" : config.ext || "";
       this.fileDel = (config.del || 0) !== 0;
       this.createDir = config.create || false;
-      this.baseDirAbs = path6.resolve(process.cwd(), config.dir);
+      const root = config.$asai?.serverRoot || getPrimaryServerRoot();
+      this.baseDirAbs = path7.resolve(root, config.dir);
     }
     dbLog(...args) {
       (this.config?.$asai?.$log || console.log)("FILE", ...args);
     }
     checkFile(file) {
-      return fs11.existsSync(this.getAbsPath(file, false));
+      return fs10.existsSync(this.getAbsPath(file, false));
     }
     /** 解析相对路径并限制在数据根目录内，防止路径穿越（跨平台） */
     resolvePath(relPath) {
       if (!relPath) {
         return this.baseDirAbs;
       }
-      const abs = path6.isAbsolute(relPath) ? path6.normalize(relPath) : path6.resolve(this.baseDirAbs, relPath);
+      const abs = path7.isAbsolute(relPath) ? path7.normalize(relPath) : path7.resolve(this.baseDirAbs, relPath);
       if (!isPathInside2(this.baseDirAbs, abs)) {
-        return this.baseDirAbs;
+        throw new Error("Path not allowed");
       }
       return abs;
     }
@@ -5647,15 +5660,15 @@ function dbDriver(opt = {}) {
       if (!relPath) {
         return "";
       }
-      return path6.isAbsolute(relPath) ? path6.relative(this.baseDirAbs, relPath) : relPath;
+      return path7.isAbsolute(relPath) ? path7.relative(this.baseDirAbs, relPath) : relPath;
     }
     ensureDir(relPath) {
-      const relative4 = this.normalizeRelPath(relPath);
-      const dirPath = path6.dirname(relative4);
+      const relative5 = this.normalizeRelPath(relPath);
+      const dirPath = path7.dirname(relative5);
       const absDir = this.resolvePath(dirPath === "." ? "" : dirPath);
-      if (this.createDir && !fs11.existsSync(absDir)) {
+      if (this.createDir && !fs10.existsSync(absDir)) {
         this.dbLog("mkdir", "[MKDIR]", absDir);
-        fs11.mkdirSync(absDir, { recursive: true });
+        fs10.mkdirSync(absDir, { recursive: true });
       }
       return absDir;
     }
@@ -5671,34 +5684,34 @@ function dbDriver(opt = {}) {
     }
     deldir(relativePath) {
       const absPath = this.resolvePath(relativePath);
-      if (!fs11.existsSync(absPath)) {
+      if (!fs10.existsSync(absPath)) {
         return;
       }
       this.dbLog("delete", "[RMDIR]", absPath);
-      const entries = fs11.readdirSync(absPath, { withFileTypes: true });
+      const entries = fs10.readdirSync(absPath, { withFileTypes: true });
       for (const entry of entries) {
-        const current = path6.join(absPath, entry.name);
+        const current = path7.join(absPath, entry.name);
         if (entry.isDirectory()) {
-          this.deldir(path6.join(relativePath, entry.name));
+          this.deldir(path7.join(relativePath, entry.name));
         } else {
           this.dbLog("delete", "[UNLINK]", current);
-          fs11.unlinkSync(current);
+          fs10.unlinkSync(current);
         }
       }
-      fs11.rmdirSync(absPath);
+      fs10.rmdirSync(absPath);
     }
     getReadPath(file, sql) {
       const candidates = [];
       if (sql?.filename) {
-        candidates.push({ dir: path6.join(file, sql.filename) });
-        candidates.push({ dir: path6.join(file + ".delete" + this.fileExt, sql.filename) });
+        candidates.push({ dir: path7.join(file, sql.filename) });
+        candidates.push({ dir: path7.join(file + ".delete" + this.fileExt, sql.filename) });
       } else {
         candidates.push({ dir: file });
         candidates.push({ dir: file + this.fileExt + ".delete" });
       }
       for (const candidate of candidates) {
         const abs = this.getAbsPath(candidate.dir, false);
-        if (fs11.existsSync(abs)) {
+        if (fs10.existsSync(abs)) {
           return { path: abs, dir: candidate.dir };
         }
       }
@@ -5710,13 +5723,13 @@ function dbDriver(opt = {}) {
         return { path: "", dir: read2.dir };
       }
       if (sql?.filename) {
-        return { path: path6.dirname(read2.path), dir: path6.dirname(read2.dir) };
+        return { path: path7.dirname(read2.path), dir: path7.dirname(read2.dir) };
       }
       return { path: read2.path, dir: read2.dir };
     }
     getNewPath(file, sql) {
       if (sql?.filename) {
-        return this.getAbsPath(path6.join(file, sql.filename), true);
+        return this.getAbsPath(path7.join(file, sql.filename), true);
       }
       return this.getAbsPath(file, true);
     }
@@ -5724,7 +5737,7 @@ function dbDriver(opt = {}) {
       try {
         const filePath = sql?.type === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
         this.dbLog("write", "[WRITE]", filePath);
-        fs11.writeFileSync(filePath, data, "utf8");
+        fs10.writeFileSync(filePath, data, "utf8");
         return "ok";
       } catch (e) {
         this.dbLog("write failed", "[WRITE ERROR]", e);
@@ -5738,7 +5751,7 @@ function dbDriver(opt = {}) {
           return { error: "empty" };
         }
         this.dbLog("read", "[READ]", read2.path);
-        const data = fs11.readFileSync(read2.path, { encoding }) || "";
+        const data = fs10.readFileSync(read2.path, { encoding }) || "";
         const fileName = this.fileExt && read2.dir.endsWith(this.fileExt) ? read2.dir : read2.dir + this.fileExt;
         return [{ data, file: fileName }];
       } catch (e) {
@@ -5755,12 +5768,12 @@ function dbDriver(opt = {}) {
         if (this.fileDel && sql?.deltrue) {
           const target = del.path + ".delete" + this.fileExt;
           this.dbLog("soft delete", "[SOFT DELETE]", `${del.path} -> ${target}`);
-          fs11.renameSync(del.path, target);
+          fs10.renameSync(del.path, target);
         } else if (sql?.filename) {
           this.deldir(del.dir);
         } else {
           this.dbLog("delete", "[DELETE]", del.path);
-          fs11.unlinkSync(del.path);
+          fs10.unlinkSync(del.path);
         }
         return "ok";
       } catch (e) {
@@ -5779,11 +5792,11 @@ function dbDriver(opt = {}) {
           const original = del.path.replace(new RegExp(`.delete${extPattern}$`), "");
           if (original !== del.path) {
             this.dbLog("restore", "[RESTORE]", `${del.path} -> ${original}`);
-            fs11.renameSync(del.path, original);
+            fs10.renameSync(del.path, original);
           }
         } else {
           this.dbLog("force delete", "[FORCE DELETE]", del.path);
-          fs11.unlinkSync(del.path);
+          fs10.unlinkSync(del.path);
         }
         return "ok";
       } catch (e) {
@@ -5797,7 +5810,7 @@ function dbDriver(opt = {}) {
         this.dbLog("list", "[LIST]", absDir);
         let entries;
         try {
-          entries = fs11.readdirSync(absDir, { withFileTypes: true });
+          entries = fs10.readdirSync(absDir, { withFileTypes: true });
         } catch {
           return sql?.list ? { open: [], delete: [] } : [];
         }
@@ -5809,9 +5822,9 @@ function dbDriver(opt = {}) {
           const isDelete = fileName.endsWith(deleteSuffix);
           const baseName = isDelete ? fileName.slice(0, -deleteSuffix.length) : fileName;
           if (this.fileExt && !baseName.endsWith(this.fileExt)) continue;
-          const fullPath = path6.join(absDir, fileName);
+          const fullPath = path7.join(absDir, fileName);
           try {
-            const data = fs11.readFileSync(fullPath, "utf8");
+            const data = fs10.readFileSync(fullPath, "utf8");
             const entryData = { data, file: baseName };
             if (isDelete) {
               if (sql?.list) result.delete.push(entryData);
@@ -6577,7 +6590,7 @@ var initAsaiHostNodejs2 = {
   createTransportDataHandler,
   wireTransportConnectionLogs
 };
-var PLUGIN_VERSION = true ? "0.0.5" : "0.0.1";
+var PLUGIN_VERSION = true ? "0.0.8" : "0.0.1";
 var index_default = initAsaiHostNodejs2;
 export {
   Index_default as AsaiCommon,