asaihost-nodejs 0.0.1 → 0.0.3

package/dist/asaihost-nodejs.es.js

@@ -4,10 +4,10 @@ import {
   logSecurityConfigIntervention,
   logSessionTerminate,
   logUserRbacChange
-} from "./chunk-XBIN4C2V.es.js";
+} from "./chunk-SB23ESX2.es.js";
 import {
   InterventionLog_exports
-} from "./chunk-MCMADJQR.es.js";
+} from "./chunk-VUZO7DCA.es.js";
 import {
   LogStore_exports,
   archiveInterventionYear,
@@ -28,7 +28,7 @@ import {
   queryUnifiedLogs,
   readWebLogFromStore,
   searchUnifiedLogs
-} from "./chunk-LOMSUPPU.es.js";
+} from "./chunk-LTEP4XB2.es.js";
 import {
   W3C_ACCESS_FIELDS,
   W3C_SERVER_FIELDS,
@@ -38,7 +38,7 @@ import {
   formatW3CHeader,
   formatW3CServerRecord,
   parseCLF
-} from "./chunk-4WJDC4M4.es.js";
+} from "./chunk-NLZNIGNF.es.js";
 import {
   getNowTime
 } from "./chunk-UTKVJE7N.es.js";
@@ -48,7 +48,7 @@ import {
   secureCompare,
   validatePasswordChange,
   verifyPassword
-} from "./chunk-DROOHKB3.es.js";
+} from "./chunk-57UQJKSL.es.js";
 import {
   USER_LV,
   applySecretsToHostConfig,
@@ -60,8 +60,9 @@ import {
   resolveHttpsCertFromPaths,
   stripForbiddenSecretsFromHostConfig,
   validateAsaiSecrets
-} from "./chunk-E7V3EBDB.es.js";
+} from "./chunk-A6VJPLDD.es.js";
 import {
+  getDefaultResetPassword,
   getPasswordPolicy,
   getPermissionThreshold,
   getPublicSecurityConfig,
@@ -70,11 +71,12 @@ import {
   isValidUserLv,
   loadUserLevelConfig,
   resolveRoleForLevel,
-  saveUserLevelConfig
-} from "./chunk-EOGZPRML.es.js";
+  saveUserLevelConfig,
+  validatePasswordWithPolicy
+} from "./chunk-A5CDJGJI.es.js";
 import {
   getDataServerForAsDb
-} from "./chunk-KUZQ36IJ.es.js";
+} from "./chunk-ZQBHJRAO.es.js";
 import {
   __export,
   __name
@@ -210,7 +212,7 @@ ${reason.name}: ${reason.message}`;
     if (restartTimes.length > MAX_RESTARTS) {
       try {
         $asai.$log("NO_RESTART", "Process crashed too frequently, gracefully shutdown and wait for daemon restart.");
-        void import("./intervention-hooks-FI4EHOL5.es.js").then(
+        void import("./intervention-hooks-TCGIC4IV.es.js").then(
           ({ logProcessGuardEvent }) => logProcessGuardEvent($asai, {
             action: "crash_loop_shutdown",
             detail: `${restartTimes.length} crashes in ${RESTART_WINDOW}ms window`,
@@ -252,7 +254,7 @@ ${reason.name}: ${reason.message}`;
 }
 __name(initProcess, "initProcess");
 function gracefulShutdown($asai) {
-  void import("./intervention-hooks-FI4EHOL5.es.js").then(
+  void import("./intervention-hooks-TCGIC4IV.es.js").then(
     ({ logProcessGuardEvent }) => logProcessGuardEvent($asai, {
       action: "graceful_shutdown",
       detail: "SIGTERM/SIGINT or crash guard triggered",
@@ -395,7 +397,7 @@ var LogBuffer = class _LogBuffer {
   }
 };
 function saveLog($asai, src, logstr) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve6, reject) => {
     try {
       const bufferKey = `${$asai.id || "default"}_${src}`;
       let logBuffer = logBuffers.get(bufferKey);
@@ -404,7 +406,7 @@ function saveLog($asai, src, logstr) {
         logBuffers.set(bufferKey, logBuffer);
       }
       logBuffer.add(logstr);
-      resolve7();
+      resolve6();
     } catch (err) {
       console.error(err);
       reject(err);
@@ -424,7 +426,7 @@ async function ensureW3CHeader($asai, filePath, dateCur) {
   } catch {
   }
   const header = formatW3CHeader({
-    software: $asai.hostconfig.website?.title || "AsaiHost",
+    software: $asai.hostconfig.website?.title || "AsaiHostNodejs",
     version: $asai.hostconfig.website?.ver || "1.0.0.0",
     fields: [...W3C_SERVER_FIELDS],
     date: dateCur
@@ -507,7 +509,7 @@ async function ensureW3CAccessHeader($asai, filePath, dateCur) {
   } catch {
   }
   const header = formatW3CHeader({
-    software: $asai.hostconfig.website?.title || "AsaiHost",
+    software: $asai.hostconfig.website?.title || "AsaiHostNodejs",
     version: $asai.hostconfig.website?.ver || "1.0.0.0",
     fields: [...W3C_ACCESS_FIELDS],
     date: dateCur
@@ -843,7 +845,7 @@ function verifyConfigManifest(serverRoot) {
 __name(verifyConfigManifest, "verifyConfigManifest");
 
 // src/core/init.ts
-function initAsaiHost($asai, _opt) {
+function initAsaiHostNodejs($asai, _opt) {
   if (!$asai.hostconfig?.ip) {
     $asai.hostconfig.ip = getIp();
   }
@@ -870,7 +872,7 @@ function initAsaiHost($asai, _opt) {
       type: "CONFIG_WARN",
       detail: "Using dev-only password; set ASAI_HOST_PASSWORD for production (IEC 62443-4-2 CR 1.7)"
     });
-    void import("./intervention-hooks-FI4EHOL5.es.js").then(
+    void import("./intervention-hooks-TCGIC4IV.es.js").then(
       ({ logSecurityConfigIntervention: logSecurityConfigIntervention2 }) => logSecurityConfigIntervention2($asai, {
         section: "password",
         detail: "dev-default-password detected at startup"
@@ -890,13 +892,13 @@ function initAsaiHost($asai, _opt) {
     if (!ntp.ok) logSecurityEvent($asai, { type: "CONFIG_WARN", detail: `NTP: ${ntp.detail}` });
   });
 }
-__name(initAsaiHost, "initAsaiHost");
+__name(initAsaiHostNodejs, "initAsaiHostNodejs");
 function scheduleLogComplianceCheck($asai) {
   const hours = Number($asai?.hostconfig?.logger?.complianceIntervalHours) || 6;
   if (hours <= 0) return;
   const ms = hours * 3600 * 1e3;
   setInterval(() => {
-    void import("./LogStore-ECXX34WC.es.js").then(
+    void import("./LogStore-Q35YFNAY.es.js").then(
       ({ getComplianceReport: getComplianceReport2 }) => getComplianceReport2($asai, "prod")
     ).catch(() => void 0);
   }, ms);
@@ -947,16 +949,61 @@ function getWsUserinfo(req, $asai) {
   }
 }
 __name(getWsUserinfo, "getWsUserinfo");
+function listOnlineWsUsers($asai, hostdir) {
+  const users = [];
+  const map = $asai.connectionsws || {};
+  const dirs = hostdir ? [hostdir] : Object.keys(map);
+  for (const dir of dirs) {
+    for (const [us, ws2] of Object.entries(map[dir] || {})) {
+      if (!us || us === "asai") continue;
+      if (isWsStillActive(ws2)) {
+        users.push(us);
+      } else if (map[dir]?.[us] === ws2) {
+        delete map[dir][us];
+      }
+    }
+  }
+  return [...new Set(users)];
+}
+__name(listOnlineWsUsers, "listOnlineWsUsers");
 function isUserOnlineOnWs($asai, us, hostdir) {
   if (!us || us === "asai") return false;
   const map = $asai.connectionsws || {};
   const dirs = hostdir ? [hostdir] : Object.keys(map);
   for (const dir of dirs) {
-    if (map[dir]?.[us]) return true;
+    const ws2 = map[dir]?.[us];
+    if (!ws2) continue;
+    if (isWsStillActive(ws2)) return true;
+    if (map[dir]?.[us] === ws2) delete map[dir][us];
   }
   return false;
 }
 __name(isUserOnlineOnWs, "isUserOnlineOnWs");
+function kickUserWs($asai, us, hostdir) {
+  if (!us || us === "asai") return;
+  const map = $asai.connectionsws || {};
+  const dirs = hostdir ? [hostdir] : Object.keys(map);
+  for (const dir of dirs) {
+    const ws2 = map[dir]?.[us];
+    if (!ws2) continue;
+    try {
+      ws2.close();
+    } catch {
+    }
+    if (map[dir]?.[us] === ws2) delete map[dir][us];
+  }
+}
+__name(kickUserWs, "kickUserWs");
+async function removeSessionOnWsClose($asai, us, token) {
+  try {
+    const store = createUserStore($asai);
+    const sessions = await store.getSessions();
+    const match = sessions.find((s) => s.us === us && s.pub === token);
+    if (match) await store.removeSession(match.id);
+  } catch {
+  }
+}
+__name(removeSessionOnWsClose, "removeSessionOnWsClose");
 function isWsStillActive(ws2) {
   if (!ws2) return false;
   const state = ws2.readyState;
@@ -1039,8 +1086,11 @@ function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
 __name(isOkWs, "isOkWs");
 function loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage) {
   const [us] = ws2.Userinfo || [];
-  if (hostcfg.ckws && us) {
-    if (!ws2.tasksws) ws2.tasksws = {};
+  if (!$asai.connectionsws[hostdir]) {
+    $asai.connectionsws[hostdir] = {};
+  }
+  if (us && us !== "asai") {
+    if (hostcfg.ckws && !ws2.tasksws) ws2.tasksws = {};
     $asai.connectionsws[hostdir][us] = ws2;
   }
   ws2.on("message", (msg) => {
@@ -1048,12 +1098,14 @@ function loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage)
     wsWorkHandler?.(msg, ws2, hostdir, req);
   });
   ws2.on("close", () => {
-    if (hostcfg.ckws) {
-      if (ws2.tasksws) {
-        Object.values(ws2.tasksws).forEach((el) => el && clearInterval(el));
-        ws2.tasksws = void 0;
-      }
-      if (us && $asai.connectionsws[hostdir]?.[us] === ws2) delete $asai.connectionsws[hostdir][us];
+    const token = ws2.Userinfo?.[2];
+    if (hostcfg.ckws && ws2.tasksws) {
+      Object.values(ws2.tasksws).forEach((el) => el && clearInterval(el));
+      ws2.tasksws = void 0;
+    }
+    if (us && $asai.connectionsws[hostdir]?.[us] === ws2) delete $asai.connectionsws[hostdir][us];
+    if (us && token && !isUserOnlineOnWs($asai, us, hostdir)) {
+      void removeSessionOnWsClose($asai, us, String(token));
     }
     if (ws2.readyState !== WebSocket.CLOSED && ws2.readyState !== WebSocket.CLOSING) ws2.close();
   });
@@ -1406,11 +1458,11 @@ function createSkipChecker($asai) {
   }
   if (exact.size === 0 && prefixes.length === 0) return () => false;
   return (url) => {
-    const path8 = normalizeRequestPath(url);
-    if (!path8) return false;
-    if (exact.has(path8)) return true;
+    const path7 = normalizeRequestPath(url);
+    if (!path7) return false;
+    if (exact.has(path7)) return true;
     for (let i = 0; i < prefixes.length; i++) {
-      if (path8.startsWith(prefixes[i])) return true;
+      if (path7.startsWith(prefixes[i])) return true;
     }
     return false;
   };
@@ -1795,12 +1847,6 @@ __name(setupHttpConnectionMonitor, "setupHttpConnectionMonitor");
 import { execSync } from "child_process";
 import process2 from "process";
 var OWN_PID = process2.pid;
-function sleepMs(ms) {
-  const deadline = Date.now() + ms;
-  while (Date.now() < deadline) {
-  }
-}
-__name(sleepMs, "sleepMs");
 function findListeningPids(port) {
   if (!Number.isInteger(port) || port < 1 || port > 65535) return [];
   try {
@@ -1836,32 +1882,20 @@ function findListeningPids(port) {
   }
 }
 __name(findListeningPids, "findListeningPids");
-function killPid(pid) {
-  if (!pid || pid === OWN_PID || pid <= 4) return false;
-  try {
-    if (process2.platform === "win32") {
-      execSync(`taskkill /PID ${pid} /F`, { stdio: "ignore" });
-    } else {
-      execSync(`kill -9 ${pid}`, { stdio: "ignore" });
-    }
-    return true;
-  } catch {
-    return false;
-  }
+function formatOccupants(port, exclude) {
+  const occupants = findListeningPids(port).filter((p) => p !== exclude && p !== OWN_PID);
+  return [...new Set(occupants)].join(", ");
 }
-__name(killPid, "killPid");
+__name(formatOccupants, "formatOccupants");
 function releasePort(port, opts) {
   const exclude = opts?.excludePid ?? OWN_PID;
-  const occupants = findListeningPids(port).filter((p) => p !== exclude && p !== OWN_PID);
-  if (!occupants.length) return true;
+  const occupants = formatOccupants(port, exclude);
+  if (!occupants) return true;
   const label = opts?.label ? `[${opts.label}] ` : "";
-  console.warn(`[AsaiHost] ${label}\u7AEF\u53E3 ${port} \u88AB\u5360\u7528\uFF0C\u6B63\u5728\u7ED3\u675F\u8FDB\u7A0B: ${occupants.join(", ")}`);
-  for (const pid of occupants) {
-    killPid(pid);
-  }
-  sleepMs(500);
-  const remaining = findListeningPids(port).filter((p) => p !== exclude && p !== OWN_PID);
-  return remaining.length === 0;
+  console.warn(
+    `[AsaiHostNodejs] ${label}\u7AEF\u53E3 ${port} \u88AB\u5360\u7528\uFF08PID: ${occupants}\uFF09\uFF0C\u8BF7\u624B\u52A8\u7ED3\u675F\u5360\u7528\u8FDB\u7A0B\u540E\u91CD\u8BD5`
+  );
+  return false;
 }
 __name(releasePort, "releasePort");
 function collectStartupPorts($asai) {
@@ -2014,7 +2048,6 @@ function startHTTPServer($asai, hostdir) {
 ${err.stack}` : err);
         }
       });
-      releasePort(hostcfg.port, { excludePid: process.pid, label: hostdir });
       if ($asai.hostconfig.ip === "asai" || !hostcfg.ip && !$asai.hostconfig.ip) {
         server.listen(hostcfg.port, () => {
           console.log(`[${hostdir}] Start At ${getNowTime()}.`);
@@ -2066,19 +2099,13 @@ function asaiGuard($asai, failedHostdir = "asai") {
   const sameProcessOwner = findSameProcessPortOwner($asai, port, failedHostdir);
   if (sameProcessOwner) {
     console.error(
-      `[AsaiHost] \u7AEF\u53E3 ${port} \u5DF2\u88AB\u540C\u8FDB\u7A0B\u7AD9\u70B9 [${sameProcessOwner}] \u5360\u7528\uFF0C[${failedHostdir}] \u505C\u6B62\u91CD\u8BD5\uFF08\u8BF7\u68C0\u67E5 asaihost.json \u662F\u5426\u91CD\u590D\u914D\u7F6E port\uFF09`
+      `[AsaiHostNodejs] \u7AEF\u53E3 ${port} \u5DF2\u88AB\u540C\u8FDB\u7A0B\u7AD9\u70B9 [${sameProcessOwner}] \u5360\u7528\uFF0C[${failedHostdir}] \u505C\u6B62\u91CD\u8BD5\uFF08\u8BF7\u68C0\u67E5 asaihost.json \u662F\u5426\u91CD\u590D\u914D\u7F6E port\uFF09`
     );
     return;
   }
-  const released = releasePort(port, { excludePid: process.pid, label: failedHostdir });
+  releasePort(port, { excludePid: process.pid, label: failedHostdir });
   $asai.hostconfig.asaiport = conflictPorts.filter((p) => p !== port);
-  if (released) {
-    console.warn(`[AsaiHost] \u7AEF\u53E3 ${port} \u5DF2\u91CA\u653E\uFF0C\u6B63\u5728\u91CD\u65B0\u542F\u52A8 [${failedHostdir}]`);
-    scheduleHttpRetry($asai, failedHostdir);
-    return;
-  }
-  console.error(`[AsaiHost] \u7AEF\u53E3 ${port} \u65E0\u6CD5\u91CA\u653E\uFF0C\u542F\u52A8\u5931\u8D25\uFF08netstat -ano | findstr :${port}\uFF09`);
-  process.exit(1);
+  scheduleHttpRetry($asai, failedHostdir);
 }
 __name(asaiGuard, "asaiGuard");
 
@@ -2179,21 +2206,17 @@ function startProxyServer($asai, proxyhostdir) {
       if (err.code === "EADDRINUSE") {
         $asai.$log("PROXY", `\x1B[41mPort ${proxycfg.proxyport} is already start!\x1B[0m`);
         delete $asai.serversproxy?.[proxyhostdir];
-        const released = releasePort(proxycfg.proxyport, {
+        releasePort(proxycfg.proxyport, {
           excludePid: process.pid,
           label: proxyhostdir
         });
-        if (released) {
-          console.warn(`[AsaiHost] \u4EE3\u7406\u7AEF\u53E3 ${proxycfg.proxyport} \u5DF2\u91CA\u653E\uFF0C\u6B63\u5728\u91CD\u65B0\u542F\u52A8 [${proxyhostdir}]`);
-          setTimeout(() => startProxyServer($asai, proxyhostdir), $asai.hostconfig.tm?.d || 2e3);
-        }
+        setTimeout(() => startProxyServer($asai, proxyhostdir), $asai.hostconfig.tm?.d || 2e3);
       } else {
         $asai.$log("PROXY", "Proxy server error:", err);
       }
     });
     if (!$asai.serversproxy) $asai.serversproxy = {};
     $asai.serversproxy[proxyhostdir] = proxyServer;
-    releasePort(proxycfg.proxyport, { excludePid: process.pid, label: proxyhostdir });
     const listenIp = getHostIP(proxycfg.proxyip, $asai);
     const listenCallback = /* @__PURE__ */ __name(() => {
       console.log(`[${proxyhostdir}] Start At ${getNowTime()}.`);
@@ -2223,8 +2246,8 @@ function src_default($asai, opt) {
   workHandlers.set("apiWork", opt.apiWork);
   workHandlers.set("wsWork", opt.wsWork);
   workHandlers.set("jsonpWork", opt.jsonpWork);
-  function StartAsaiHost() {
-    initAsaiHost($asai, opt);
+  function StartAsaiHostNodejs() {
+    initAsaiHostNodejs($asai, opt);
     console.log(`\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B`);
     releaseConfiguredPorts($asai);
     if ($asai.hostconfig?.hosts) {
@@ -2246,8 +2269,8 @@ function src_default($asai, opt) {
       });
     }
   }
-  __name(StartAsaiHost, "StartAsaiHost");
-  return { StartAsaiHost, asaiWs: ws };
+  __name(StartAsaiHostNodejs, "StartAsaiHostNodejs");
+  return { StartAsaiHostNodejs, asaiWs: ws };
 }
 __name(src_default, "default");
 
@@ -2319,7 +2342,7 @@ async function attachServerUserLevel(req, $asai) {
   if (!Array.isArray(userinfo) || !userinfo[0]) return;
   const us = String(userinfo[0]);
   try {
-    const { createUserStore: createUserStore2 } = await import("./user-store-J7LWEXSW.es.js");
+    const { createUserStore: createUserStore2 } = await import("./user-store-UC5URX3C.es.js");
     const user = await createUserStore2($asai).findByUsername(us);
     if (user && user.status === "active") {
       req._serverUser = { us: user.us, lv: user.lv, status: user.status };
@@ -2350,11 +2373,11 @@ function getSecurityConfig($asai) {
   return $asai?.hostconfig?.security || {};
 }
 __name(getSecurityConfig, "getSecurityConfig");
-function pathMatchesPattern(path8, pattern) {
+function pathMatchesPattern(path7, pattern) {
   if (pattern.endsWith("*")) {
-    return path8.startsWith(pattern.slice(0, -1));
+    return path7.startsWith(pattern.slice(0, -1));
   }
-  return path8 === pattern;
+  return path7 === pattern;
 }
 __name(pathMatchesPattern, "pathMatchesPattern");
 function isAuthSkipped($asai, pathname) {
@@ -2502,6 +2525,54 @@ function isApiCorsAllowed(origin, hostcfg, hostHeader) {
 __name(isApiCorsAllowed, "isApiCorsAllowed");
 
 // src/common/server/Api.ts
+function readRequestBody(req, maxBody) {
+  return new Promise((resolve6, reject) => {
+    const chunks = [];
+    let received = 0;
+    let settled = false;
+    const finish = /* @__PURE__ */ __name((err, data) => {
+      if (settled) return;
+      settled = true;
+      if (err) reject(err);
+      else resolve6(data ?? "");
+    }, "finish");
+    req.on("data", (chunk) => {
+      if (settled) return;
+      received += chunk.length;
+      if (received > maxBody) {
+        req.destroy();
+        finish(new Error("PAYLOAD_TOO_LARGE"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => finish(null, Buffer.concat(chunks).toString("utf8")));
+    req.on("error", (err) => finish(err));
+  });
+}
+__name(readRequestBody, "readRequestBody");
+function processPostPayload($asai, req, postdata, pm) {
+  let isAes = false;
+  let out = postdata;
+  if ($asai.$lib.aesfns && out?.startsWith?.('{"aes":')) {
+    isAes = true;
+    const aesData = JSON.parse(out);
+    out = $asai.$lib.aesfns.reqAES({ data: aesData });
+    if (aesData?.aes === 2 && typeof out === "string") {
+      try {
+        out = JSON.parse(out);
+      } catch {
+      }
+    }
+  }
+  const plainJson = typeof out === "string" && out.trimStart().startsWith("{");
+  if (req?.Userinfo?.[2] && !plainJson) {
+    pm = req.Userinfo[2];
+    out = $asai.$lib.AsCode.asdecode(out, pm);
+  }
+  return { postdata: out, pm, isAes };
+}
+__name(processPostPayload, "processPostPayload");
 var Api_default = /* @__PURE__ */ __name(($asai, opt = {}) => {
   opt?.fn?.($asai);
   function getHeader(req, key) {
@@ -2581,8 +2652,24 @@ var Api_default = /* @__PURE__ */ __name(($asai, opt = {}) => {
       const releaseSlot = /* @__PURE__ */ __name(() => releaseApiSlot(hostdir, clientIp), "releaseSlot");
       res.once("finish", releaseSlot);
       res.once("close", releaseSlot);
+      const maxBody = $asai.hostconfig?.maxbody || 100 * 1024 * 1024;
+      const isTextPost = req.method === "POST" && req.url.indexOf("binary") === -1;
+      const bodyPromise = isTextPost ? readRequestBody(req, maxBody) : null;
       void (async () => {
-        const authResult = await validateHttpAuthAsync(req, $asai, pathname);
+        let authResult;
+        let rawBody = "";
+        try {
+          [authResult, rawBody] = await Promise.all([
+            validateHttpAuthAsync(req, $asai, pathname),
+            bodyPromise ?? Promise.resolve("")
+          ]);
+        } catch (err) {
+          releaseSlot();
+          if (err?.message === "PAYLOAD_TOO_LARGE") {
+            return sendError(res, 413, "Payload Too Large");
+          }
+          return sendError(res, 400, err?.message || "Bad Request");
+        }
         if (!authResult.ok) {
           releaseSlot();
           return sendAuthError(res, authResult);
@@ -2596,52 +2683,25 @@ var Api_default = /* @__PURE__ */ __name(($asai, opt = {}) => {
         let qrdata;
         let postdata;
         if (req.url.indexOf("binary") === -1) {
-          postdata = "";
           qrdata = query;
           if (req.method === "POST") {
-            const chunks = [];
-            const maxBody = $asai.hostconfig?.maxbody || 100 * 1024 * 1024;
-            let received = 0;
-            let aborted = false;
-            req.on("data", (chunk) => {
-              if (aborted) return;
-              received += chunk.length;
-              if (received > maxBody) {
-                aborted = true;
-                sendError(res, 413, "Payload Too Large");
-                req.destroy();
-                return;
-              }
-              chunks.push(chunk);
-            });
-            req.on("end", () => {
-              if (aborted) return;
-              postdata = Buffer.concat(chunks).toString();
-              isAes = $asai.$lib.aesfns && postdata?.startsWith?.('{"aes":');
-              if (isAes) {
-                const aesData = JSON.parse(postdata);
-                postdata = $asai.$lib.aesfns.reqAES({ data: aesData });
-                if (aesData?.aes === 2) {
-                  try {
-                    postdata = JSON.parse(postdata);
-                  } catch (err) {
-                  }
-                }
-              }
-              if (req?.Userinfo && req?.Userinfo[2]) {
-                pm = req.Userinfo[2];
-                postdata = $asai.$lib.AsCode.asdecode(postdata, pm);
-              }
-              if (apiFn?.post && typeof apiFn?.post === "function") {
-                const optTmp = { qrdata, data: postdata, pm };
-                if (isAes || $asai.$lib.aesfns?.allaes) {
-                  optTmp.resAES = $asai.$lib.aesfns?.resAES;
-                }
-                apiFn.post(req, res, hostdir, optTmp);
-              } else {
-                res.end(postdata);
+            try {
+              const processed = processPostPayload($asai, req, rawBody, pm);
+              postdata = processed.postdata;
+              pm = processed.pm;
+              isAes = processed.isAes;
+            } catch {
+              return sendError(res, 400, "AES decrypt failed");
+            }
+            if (apiFn?.post && typeof apiFn?.post === "function") {
+              const optTmp = { qrdata, data: postdata, pm };
+              if (isAes || $asai.$lib.aesfns?.allaes) {
+                optTmp.resAES = $asai.$lib.aesfns?.resAES;
               }
-            });
+              apiFn.post(req, res, hostdir, optTmp);
+            } else {
+              res.end(typeof postdata === "string" ? postdata : JSON.stringify(postdata ?? ""));
+            }
           } else if (req.method === "GET") {
             if (apiFn?.get && typeof apiFn?.get === "function") {
               const optTmp = { qrdata, data: qrdata, pm };
@@ -2845,7 +2905,7 @@ var WsClient_default = /* @__PURE__ */ __name(($asai, wsname) => {
   }
   __name(getKeyByData, "getKeyByData");
   function clientwsInit() {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve6, reject) => {
       $asai.clientws[wsname].socket = new $asai.asaiWs(
         $asai.command.commandconfig.clientws[wsname]
       );
@@ -2875,7 +2935,7 @@ var WsClient_default = /* @__PURE__ */ __name(($asai, wsname) => {
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is open.`
         );
         $asai.clientws[wsname].open = 1;
-        resolve7();
+        resolve6();
       };
     });
   }
@@ -2905,7 +2965,7 @@ var WsClient_default = /* @__PURE__ */ __name(($asai, wsname) => {
   }
   __name(clientwsOnmessage, "clientwsOnmessage");
   function clientwsApi(messageData) {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve6, reject) => {
       if ($asai.clientws[wsname].open) {
         try {
           const taskOpt = {};
@@ -2917,7 +2977,7 @@ var WsClient_default = /* @__PURE__ */ __name(($asai, wsname) => {
             getKeyByData(messageData),
             {
               callback: /* @__PURE__ */ __name((res) => {
-                resolve7(res);
+                resolve6(res);
               }, "callback"),
               ...messageData,
               ...taskOpt
@@ -3434,7 +3494,7 @@ var unifiedlog_default = /* @__PURE__ */ __name(($asai) => {
     if (url.startsWith("/api/asailog/store/formats/")) {
       if (!await ensureLogReadAccess(req, $asai, getPermissionThreshold($asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const { getLogFormatTaxonomy } = await import("./log-formats-I5E32H5F.es.js");
+        const { getLogFormatTaxonomy } = await import("./log-formats-WW3TDUAK.es.js");
         return sendSuccess(res, getLogFormatTaxonomy($asai), opt);
       } catch (err) {
         return sendFail(res, err?.message || err, opt);
@@ -3798,7 +3858,7 @@ __name(buildSessionRecord, "buildSessionRecord");
 var API_ADMIN_PREFIXES = ["/api/user/login/admin/"];
 function getMinLevelForApiPath(pathname, $asai) {
   if (API_ADMIN_PREFIXES.some((p) => pathname.startsWith(p))) {
-    if (pathname.includes("/admin/update") || pathname.includes("/admin/kick") || pathname.includes("/admin/delete")) {
+    if (pathname.includes("/admin/update") || pathname.includes("/admin/kick") || pathname.includes("/admin/delete") || pathname.includes("/admin/resetpass")) {
       return $asai ? getPermissionThreshold($asai, "adminWrite") : USER_LV.DEVELOPER;
     }
     return $asai ? getPermissionThreshold($asai, "adminRead") : USER_LV.ADMIN;
@@ -3811,19 +3871,98 @@ function hasLevel(userLevel, required) {
 }
 __name(hasLevel, "hasLevel");
 
-// src/sysserver/api/login/index.ts
-function parseBody2(opt) {
-  if (!opt?.data) return {};
-  if (typeof opt.data === "string") {
+// src/sysserver/api/login/service/request-body.ts
+function isAesEnvelope(body) {
+  return typeof body.data === "string" && typeof body.iv === "string" && typeof body.auth === "string" && body.aes != null && body.us == null && body.pass == null && body.password == null;
+}
+__name(isAesEnvelope, "isAesEnvelope");
+function unwrapJsonString(value) {
+  if (typeof value !== "string") return value;
+  const text = value.trim();
+  if (!text.startsWith("{") && !text.startsWith("[")) return value;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return value;
+  }
+}
+__name(unwrapJsonString, "unwrapJsonString");
+function parseAuthBody(opt) {
+  let raw = opt?.data;
+  if (raw == null || raw === "") return {};
+  if (typeof raw === "string") {
+    const text = raw.trim();
+    if (!text) return {};
     try {
-      return JSON.parse(opt.data);
+      raw = JSON.parse(text);
     } catch {
-      return {};
+      if (text.includes("=") && !text.startsWith("{") && !text.startsWith("[")) {
+        raw = Object.fromEntries(new URLSearchParams(text));
+      } else {
+        return {};
+      }
     }
+    raw = unwrapJsonString(raw);
   }
-  return typeof opt.data === "object" ? opt.data : {};
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const body = raw;
+  if (isAesEnvelope(body)) return {};
+  return body;
+}
+__name(parseAuthBody, "parseAuthBody");
+function pickAuthField(body, ...keys) {
+  for (const key of keys) {
+    const val = body[key];
+    if (val != null && String(val).length > 0) return String(val);
+  }
+  return "";
 }
-__name(parseBody2, "parseBody");
+__name(pickAuthField, "pickAuthField");
+
+// src/sysserver/api/login/service/online-sessions.ts
+function resolveOnlineSessions($asai, hostdir, allSessions) {
+  const onlineUsers = new Set(listOnlineWsUsers($asai, hostdir));
+  if (!onlineUsers.size) return [];
+  const byUser = /* @__PURE__ */ new Map();
+  for (const s of allSessions) {
+    if (!onlineUsers.has(s.us)) continue;
+    const prev = byUser.get(s.us);
+    const sTime = s.lastActivityAt ?? s.createdAt;
+    const prevTime = prev ? prev.lastActivityAt ?? prev.createdAt : 0;
+    if (!prev || sTime > prevTime) byUser.set(s.us, s);
+  }
+  return [...byUser.values()].sort((a, b) => b.createdAt - a.createdAt);
+}
+__name(resolveOnlineSessions, "resolveOnlineSessions");
+function isSessionUserOnline($asai, us, hostdir) {
+  if (!us) return false;
+  return isUserOnlineOnWs($asai, us, hostdir);
+}
+__name(isSessionUserOnline, "isSessionUserOnline");
+async function countOnlineSessions($asai, hostdir, store) {
+  const all = await store.getSessions();
+  return resolveOnlineSessions($asai, hostdir, all).length;
+}
+__name(countOnlineSessions, "countOnlineSessions");
+async function countOnlineSessionsByUser($asai, hostdir, store, us) {
+  const all = await store.getSessions();
+  return resolveOnlineSessions($asai, hostdir, all).filter((s) => s.us === us).length;
+}
+__name(countOnlineSessionsByUser, "countOnlineSessionsByUser");
+async function purgeOfflineSessions($asai, hostdir, store) {
+  const onlineUsers = new Set(listOnlineWsUsers($asai, hostdir));
+  const all = await store.getSessions();
+  let purged = 0;
+  for (const s of all) {
+    if (onlineUsers.has(s.us)) continue;
+    await store.removeSession(s.id);
+    purged += 1;
+  }
+  return purged;
+}
+__name(purgeOfflineSessions, "purgeOfflineSessions");
+
+// src/sysserver/api/login/index.ts
 function getSecurity($asai) {
   return $asai?.hostconfig?.security || {};
 }
@@ -3833,16 +3972,16 @@ function getQuota2($asai) {
   return sec.quota || {};
 }
 __name(getQuota2, "getQuota");
-async function canLogin($asai, us) {
+async function canLogin($asai, us, hostdir) {
   const quota = getQuota2($asai);
   if (!quota.enabled) return { ok: true };
   const store = createUserStore($asai);
-  const total = await store.countSessions();
+  const total = await countOnlineSessions($asai, hostdir, store);
   const maxLogin = quota.maxLoginSessions ?? $asai?.hostconfig?.hosts?.default?.maxonline ?? 100;
   if (total >= maxLogin) {
     return { ok: false, message: "LOGIN_QUOTA_FULL" };
   }
-  const perUser = await store.countSessionsByUser(us);
+  const perUser = await countOnlineSessionsByUser($asai, hostdir, store, us);
   const maxPerUser = quota.maxSessionsPerUser ?? 3;
   if (perUser >= maxPerUser) {
     return { ok: false, message: "USER_SESSION_LIMIT" };
@@ -3882,13 +4021,13 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
   async function post(req, res, hostdir, opt) {
     const url = req.url || "";
     const ip = getClientIp(req);
-    const body = parseBody2(opt);
+    const body = parseAuthBody(opt);
     if (url.startsWith("/api/user/login/changepass/")) {
       await ensureReady($asai);
       try {
-        const us = sanitizeString(body.us, 64);
-        const pass = sanitizeString(body.pass, 128);
-        const newPass = sanitizeString(body.newPass, 128);
+        const us = sanitizeString(pickAuthField(body, "us", "username"), 64);
+        const pass = sanitizeString(pickAuthField(body, "pass", "password", "pwd"), 128);
+        const newPass = sanitizeString(pickAuthField(body, "newPass", "newPassword", "newpass"), 128);
         if (!us || !pass || !newPass) return sendErr(res, "AUTH_CREDENTIALS_REQUIRED", void 0, opt);
         const user = await store.findByUsername(us);
         if (!user || !verifyPassword(pass, user.passHash, user.passSalt)) {
@@ -3922,9 +4061,11 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
         return sendErr(res, "AUTH_REG_DISABLED", void 0, opt);
       }
       try {
-        const us = sanitizeString(body.us, 64);
-        const pass = sanitizeString(body.pass, 128);
-        const email = body.email ? sanitizeString(body.email, 128) : void 0;
+        const us = sanitizeString(pickAuthField(body, "us", "username"), 64);
+        const pass = sanitizeString(pickAuthField(body, "pass", "password", "pwd"), 128);
+        const emailRaw = pickAuthField(body, "email");
+        const email = emailRaw ? sanitizeString(emailRaw, 128) : void 0;
+        if (!us || !pass) return sendErr(res, "AUTH_CREDENTIALS_REQUIRED", void 0, opt);
         const policyErr = validatePasswordChange(pass, $asai);
         if (policyErr === "PASSWORD_TOO_SHORT") {
           return sendErr(res, policyErr, [String(getPasswordPolicy($asai).minLength)], opt);
@@ -3953,8 +4094,8 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
     if (url.startsWith("/api/user/login/auth/")) {
       await ensureReady($asai);
       try {
-        const us = sanitizeString(body.us, 64);
-        const pass = sanitizeString(body.pass, 128);
+        const us = sanitizeString(pickAuthField(body, "us", "username"), 64);
+        const pass = sanitizeString(pickAuthField(body, "pass", "password", "pwd"), 128);
         if (!us || !pass) return sendErr(res, "AUTH_CREDENTIALS_REQUIRED", void 0, opt);
         const user = await store.findByUsername(us);
         if (!user || !verifyPassword(pass, user.passHash, user.passSalt)) {
@@ -3983,17 +4124,9 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
         const mustChange = !!user.mustChangePassword || isPasswordExpired(user.passwordChangedAt, policy.maxAgeDays);
         const hostcfg = $asai.getHost?.(hostdir) || {};
         if (hostcfg.ckws && isUserOnlineOnWs($asai, us, hostdir)) {
-          logSecurityEvent($asai, {
-            type: "AUTH_FAIL",
-            path: url,
-            method: "POST",
-            user: us,
-            ip,
-            detail: "user_already_online"
-          });
-          return sendErr(res, "USER_ALREADY_LOGGED", void 0, opt);
+          kickUserWs($asai, us, hostdir);
         }
-        const quotaCheck = await canLogin($asai, us);
+        const quotaCheck = await canLogin($asai, us, hostdir);
         if (!quotaCheck.ok) {
           logSecurityEvent($asai, { type: "RATE_LIMIT", path: url, method: "POST", user: us, ip, detail: quotaCheck.message });
           return sendErr(res, quotaCheck.message || "LOGIN_QUOTA_FULL", void 0, opt);
@@ -4037,12 +4170,17 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
         if (!sessionId) return sendErr(res, "AUTH_CREDENTIALS_REQUIRED", void 0, opt);
         const sessions = await store.getSessions();
         const target = sessions.find((s) => s.id === sessionId);
+        if (!target) return sendErr(res, "AUTH_SESSION_NOT_FOUND", void 0, opt);
+        if (!isSessionUserOnline($asai, target.us, hostdir)) {
+          return sendErr(res, "SESSION_NOT_ONLINE", void 0, opt);
+        }
+        kickUserWs($asai, target.us, hostdir);
         await store.removeSession(sessionId);
         const operator = String(req?.Userinfo?.[0] || "");
         await logSessionTerminate($asai, {
           operator,
           sessionId,
-          targetUs: target?.us,
+          targetUs: target.us,
           ip
         });
         return sendSuccess(res, { ok: true }, opt);
@@ -4074,10 +4212,16 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
         const levels = Array.isArray(body.levels) ? body.levels : void 0;
         const thresholds = body.thresholds && typeof body.thresholds === "object" ? body.thresholds : void 0;
         const routeRights = Array.isArray(body.routeRights) ? body.routeRights : void 0;
+        const defaultResetPassword = typeof body.defaultResetPassword === "string" ? body.defaultResetPassword : void 0;
         const operator = String(req?.Userinfo?.[0] || "");
         const cfg = await saveUserLevelConfig(
           $asai,
-          { levels, thresholds, routeRights },
+          {
+            levels,
+            thresholds,
+            routeRights,
+            defaultResetPassword
+          },
           operator
         );
         await logSecurityConfigIntervention($asai, {
@@ -4091,6 +4235,57 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
         return sendFail(res, err?.message || err, opt);
       }
     }
+    if (url.startsWith("/api/user/login/admin/resetpass/")) {
+      await ensureReady($asai);
+      if (!await checkAdmin(req, url, getPermissionThreshold($asai, "adminWrite"))) {
+        logSecurityEvent($asai, { type: "ACCESS_DENIED", path: url, method: "POST", ip });
+        return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
+      }
+      try {
+        const targetUs = sanitizeString(body.us, 64);
+        if (!targetUs) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
+        let newPass = sanitizeString(pickAuthField(body, "newPass", "newPassword", "newpass"), 128);
+        if (!newPass) newPass = getDefaultResetPassword($asai);
+        const policy = getPasswordPolicy($asai);
+        const policyErr = validatePasswordWithPolicy(newPass, policy);
+        if (policyErr === "PASSWORD_TOO_SHORT") {
+          return sendErr(res, policyErr, [String(policy.minLength)], opt);
+        }
+        if (policyErr) return sendErr(res, policyErr, void 0, opt);
+        const user = await store.findByUsername(targetUs);
+        if (!user) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
+        const { passHash, passSalt } = hashPassword(newPass);
+        const updated = await store.updateUser(targetUs, {
+          passHash,
+          passSalt,
+          mustChangePassword: 1,
+          passwordChangedAt: Date.now(),
+          failCount: 0,
+          status: "active",
+          lockedUntil: void 0,
+          passHistory: "[]"
+        });
+        if (!updated) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
+        const operator = String(req?.Userinfo?.[0] || "");
+        await logUserRbacChange($asai, {
+          operator,
+          targetUs,
+          patch: { resetPassword: true, mustChangePassword: 1 },
+          ip
+        });
+        logSecurityEvent($asai, {
+          type: "AUTH_FAIL",
+          path: url,
+          method: "POST",
+          user: targetUs,
+          ip,
+          detail: "admin_password_reset"
+        });
+        return sendSuccess(res, { user: publicUser($asai, updated) }, opt);
+      } catch (err) {
+        return sendFail(res, err?.message || err, opt);
+      }
+    }
     if (url.startsWith("/api/user/login/admin/update/")) {
       await ensureReady($asai);
       if (!await checkAdmin(req, url)) {
@@ -4136,11 +4331,12 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
       try {
         const user = await store.findByUsername(String(us));
         if (!user) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        if (body.newPass) {
-          const newPass = sanitizeString(body.newPass, 128);
+        if (pickAuthField(body, "newPass", "newPassword", "newpass")) {
+          const newPass = sanitizeString(pickAuthField(body, "newPass", "newPassword", "newpass"), 128);
           const policy = getPasswordPolicy($asai);
-          if (body.pass) {
-            if (!verifyPassword(String(body.pass), user.passHash, user.passSalt)) {
+          const oldPass = pickAuthField(body, "pass", "password", "pwd");
+          if (oldPass) {
+            if (!verifyPassword(oldPass, user.passHash, user.passSalt)) {
               return sendErr(res, "AUTH_INVALID_PASSWORD", void 0, opt);
             }
           } else if (!user.mustChangePassword) {
@@ -4152,7 +4348,7 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
           }
           if (policyErr) return sendErr(res, policyErr, void 0, opt);
           const { passHash, passSalt } = hashPassword(newPass);
-          const passHistory = nextPassHistory(String(body.pass || newPass), user.passHistory, policy.historyCount);
+          const passHistory = nextPassHistory(oldPass || newPass, user.passHistory, policy.historyCount);
           await store.updateUser(String(us), {
             passHash,
             passSalt,
@@ -4174,6 +4370,7 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
     const ip = getClientIp(req);
     if (url.startsWith("/api/user/login/config/")) {
       const lang = String(req?.headers?.["accept-language"] || opt?.headers?.["accept-language"] || "zh-CN").split(",")[0];
+      await loadUserLevelConfig($asai);
       return sendSuccess(res, getPublicSecurityConfig($asai, lang), opt);
     }
     if (url.startsWith("/api/user/login/admin/levels/")) {
@@ -4187,7 +4384,8 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
       if (!await checkAdmin(req, url)) {
         return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
       }
-      const sessions = await store.getSessions();
+      const allSessions = await store.getSessions();
+      const sessions = resolveOnlineSessions($asai, hostdir, allSessions);
       return sendSuccess(
         res,
         {
@@ -4197,7 +4395,8 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
             ip: s.ip,
             createdAt: s.createdAt,
             expiresAt: s.expiresAt,
-            lastActivityAt: s.lastActivityAt
+            lastActivityAt: s.lastActivityAt,
+            online: true
           }))
         },
         opt
@@ -4215,12 +4414,13 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
       if (!await checkAdmin(req, url)) {
         return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
       }
-      const sessions = await store.getSessions();
+      await purgeOfflineSessions($asai, hostdir, store);
+      const onlineCount = await countOnlineSessions($asai, hostdir, store);
       const quota = getQuota2($asai);
       return sendSuccess(
         res,
         {
-          sessions: sessions.length,
+          sessions: onlineCount,
           maxLoginSessions: quota.maxLoginSessions ?? 100,
           quotaEnabled: !!quota.enabled,
           http: $asai.connectionshttp,
@@ -4295,10 +4495,10 @@ var As_default = {
     return relativePath;
   },
   //创建多层文件夹 同步
-  ensureDir(fs13, relativePath) {
+  ensureDir(fs12, relativePath) {
     const absPathDir = this.toDirPath(relativePath);
     const absPath = this.toAbsolutePath(relativePath);
-    if (!fs13.existsSync(absPath)) {
+    if (!fs12.existsSync(absPath)) {
       let pathTmp = "";
       absPathDir.split("/").forEach((el) => {
         if (el) {
@@ -4306,8 +4506,8 @@ var As_default = {
             pathTmp += "/";
           }
           pathTmp += el;
-          if (!fs13.existsSync(pathTmp)) {
-            if (!fs13.mkdirSync(pathTmp, { recursive: true })) {
+          if (!fs12.existsSync(pathTmp)) {
+            if (!fs12.mkdirSync(pathTmp, { recursive: true })) {
               return absPath;
             }
           }
@@ -4316,11 +4516,11 @@ var As_default = {
     }
     return absPath;
   },
-  makeDir(fs13, filePaths) {
-    return new Promise((resolve7, reject) => {
+  makeDir(fs12, filePaths) {
+    return new Promise((resolve6, reject) => {
       try {
-        const newPath = this.ensureDir(fs13, filePaths);
-        resolve7(newPath);
+        const newPath = this.ensureDir(fs12, filePaths);
+        resolve6(newPath);
       } catch (err) {
         reject(err);
       }
@@ -4543,7 +4743,10 @@ var AsAES_default = /* @__PURE__ */ __name(($asai, cfg = null) => {
         return fn(reqData);
       }
     } catch (error) {
-      return reqData;
+      if (validateFields(reqData, ["data", "iv", "auth"])) {
+        throw error;
+      }
+      return fn(reqData);
     }
   }
   __name(reqAES, "reqAES");
@@ -4627,6 +4830,48 @@ var AsDb_default = /* @__PURE__ */ __name(($asai, cfg) => {
     return limittmp;
   }
   __name(reqlimit, "reqlimit");
+  function decodePathSegment(seg) {
+    try {
+      return decodeURIComponent(seg);
+    } catch {
+      return seg;
+    }
+  }
+  __name(decodePathSegment, "decodePathSegment");
+  function bareFileName(name) {
+    const base = String(name).replace(/\.json$/i, "");
+    const slash = base.lastIndexOf("/");
+    return slash > -1 ? base.substring(slash + 1) : base;
+  }
+  __name(bareFileName, "bareFileName");
+  function parseFileBody(raw) {
+    let body = raw;
+    if (typeof body === "string") {
+      try {
+        body = JSON.parse(body);
+      } catch {
+        return { content: body };
+      }
+    }
+    if (body && typeof body === "object" && !Array.isArray(body)) {
+      return {
+        name: body.name != null ? String(body.name) : void 0,
+        content: body.content !== void 0 ? body.content : body
+      };
+    }
+    return { content: body };
+  }
+  __name(parseFileBody, "parseFileBody");
+  function fileContentString(content) {
+    if (content == null) return "";
+    if (typeof content === "string") return content;
+    return JSON.stringify(content);
+  }
+  __name(fileContentString, "fileContentString");
+  function fileKeyFromSegment(seg, bodyName) {
+    return bareFileName(decodePathSegment(seg || bodyName || ""));
+  }
+  __name(fileKeyFromSegment, "fileKeyFromSegment");
   function getSqlParamsByUrl(req, opt) {
     let tmpSqlParams;
     const reqArr = req?.url?.split("?")[0]?.split("/") || [];
@@ -4640,8 +4885,10 @@ var AsDb_default = /* @__PURE__ */ __name(($asai, cfg) => {
       if (reqArr[4] === "insert") {
         tmpSqlParams.type = reqArr[4];
         if (cfg?.type === "file") {
+          const { name: bodyName, content } = parseFileBody(opt.data);
+          const fileKey = fileKeyFromSegment(reqArr[5], bodyName);
           tmpSqlParams.field = cfg.field.data;
-          tmpSqlParams.value = [[reqwherestr(reqArr[5]), reqwherestr(opt.data)]];
+          tmpSqlParams.value = [[fileKey, fileContentString(content)]];
         } else {
           tmpSqlParams.field = [];
           tmpSqlParams.value = [];
@@ -4661,9 +4908,12 @@ var AsDb_default = /* @__PURE__ */ __name(($asai, cfg) => {
         }
       } else if (reqArr[4] === "update") {
         tmpSqlParams.type = reqArr[4];
-        tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(reqArr[5])]];
+        const rowKey = cfg?.type === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
         if (cfg?.type === "file") {
-          tmpSqlParams.set = [[cfg.field.key, reqwherestr(opt.data)]];
+          const { content } = parseFileBody(opt.data);
+          const contentField = cfg.field.data?.[1] || "content";
+          tmpSqlParams.set = [[contentField, fileContentString(content)]];
         } else {
           tmpSqlParams.set = [];
           const dbData = typeof opt.data === "string" ? JSON.parse(opt.data) : opt.data;
@@ -4679,13 +4929,15 @@ var AsDb_default = /* @__PURE__ */ __name(($asai, cfg) => {
         }
       } else if (reqArr[4] === "delete") {
         tmpSqlParams.type = reqArr[4];
-        tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(reqArr[5])]];
+        const rowKey = cfg?.type === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       } else {
         if (cfg?.as > 1) {
           tmpSqlParams.as = +cfg.as - 1;
         }
         tmpSqlParams.field = cfg.field.data;
-        tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(reqArr[5])]];
+        const rowKey = cfg?.type === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       }
     } else {
       tmpSqlParams.as = cfg?.as;
@@ -4701,19 +4953,50 @@ var AsDb_default = /* @__PURE__ */ __name(($asai, cfg) => {
     if (req?.url?.includes("/selectlist/")) {
       const list = Array.isArray(resdb) ? resdb : resdb?.data;
       if (Array.isArray(list)) {
-        const mapped = list.map((el) => {
+        const names = list.map((el) => {
+          if (typeof el === "string") {
+            const dot2 = el.lastIndexOf(".");
+            return dot2 > -1 ? el.substring(0, dot2) : el;
+          }
           const rawName = el.name ?? el.file ?? "";
           let tmpName = String(rawName).substring(String(rawName).lastIndexOf("/") + 1);
           const dot = tmpName.lastIndexOf(".");
           return dot > -1 ? tmpName.substring(0, dot) : tmpName;
         });
-        if (Array.isArray(resdb)) return mapped;
-        resdb.data = mapped;
+        const children = names.map((name) => ({ name, path: name }));
+        if (Array.isArray(resdb)) return { children };
+        resdb.data = children;
+        return resdb;
       }
     }
     return resdb;
   }
   __name(dbFresh, "dbFresh");
+  function normalizeSelectResult(params, resdb) {
+    let data = resdb;
+    if (params?.where?.length && Array.isArray(data) && data.length === 1) {
+      data = data[0];
+    }
+    if (cfg?.type === "file" && data && typeof data === "object" && !Array.isArray(data)) {
+      const nameKey = cfg.field?.data?.[0] || "name";
+      const contentKey = cfg.field?.data?.[1] || "content";
+      if (data[nameKey] != null) {
+        data[nameKey] = bareFileName(String(data[nameKey]));
+      }
+      const raw = data[contentKey];
+      if (typeof raw === "string") {
+        const text = raw.trim();
+        if (text.startsWith("{") || text.startsWith("[")) {
+          try {
+            data[contentKey] = JSON.parse(text);
+          } catch {
+          }
+        }
+      }
+    }
+    return data;
+  }
+  __name(normalizeSelectResult, "normalizeSelectResult");
   function dbCodePm(req, resdb) {
     if (req?.Userinfo && req?.Userinfo[2]) {
       resdb.data = $asai.$lib.AsCode.asencode(JSON.stringify(resdb.data), req.Userinfo[2]);
@@ -4744,7 +5027,7 @@ var AsDb_default = /* @__PURE__ */ __name(($asai, cfg) => {
     if (params && typeof DataServer.sqlDb === "function") {
       try {
         DataServer.sqlDb(params).then((resdb) => {
-          let resData = dbFresh(req, resdb);
+          let resData = normalizeSelectResult(params, dbFresh(req, resdb));
           if (params?.as === 2 && params?.field?.length > 1) {
             let limitArr = [];
             if (params.limit?.split(",")?.length < 2) {
@@ -5055,19 +5338,31 @@ var lib_default = {
 };
 
 // src/sysserver/db/src/common.ts
+var common_exports = {};
+__export(common_exports, {
+  fieldHasId: () => fieldHasId,
+  isPathInside: () => isPathInside,
+  isTableMissingError: () => isTableMissingError,
+  joinTablePath: () => joinTablePath,
+  promisifySqlDb: () => promisifySqlDb,
+  toFieldArray: () => toFieldArray,
+  toInsertRows: () => toInsertRows,
+  toSetObject: () => toSetObject,
+  toWherePairs: () => toWherePairs
+});
 import * as path5 from "path";
 function promisifySqlDb(query, sql) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve6, reject) => {
     query(sql, (err, result) => {
       if (err) {
         reject(err);
         return;
       }
       if (!result || Array.isArray(result) && result.length === 0) {
-        resolve7("");
+        resolve6("");
         return;
       }
-      resolve7(result);
+      resolve6(result);
     });
   });
 }
@@ -5077,6 +5372,48 @@ function toFieldArray(field) {
   return typeof field === "string" ? field.split(",") : field;
 }
 __name(toFieldArray, "toFieldArray");
+function toWherePairs(where) {
+  if (!where || !Array.isArray(where)) return [];
+  const pairs = [];
+  for (const item of where) {
+    if (typeof item === "string") continue;
+    if (Array.isArray(item) && item.length >= 3) {
+      pairs.push([item[0], item[2]]);
+    }
+  }
+  return pairs;
+}
+__name(toWherePairs, "toWherePairs");
+function toSetObject(set) {
+  if (!set) return {};
+  if (typeof set === "string") return {};
+  const obj = {};
+  for (const item of set) {
+    if (typeof item === "string") continue;
+    if (Array.isArray(item)) {
+      if (item.length >= 3 && typeof item[1] === "string") {
+        obj[item[0]] = item[2];
+      } else if (item.length >= 2) {
+        obj[item[0]] = item[1];
+      }
+    }
+  }
+  return obj;
+}
+__name(toSetObject, "toSetObject");
+function toInsertRows(sql) {
+  const fields = toFieldArray(sql.field);
+  const values = sql.value;
+  if (!fields.length || !Array.isArray(values)) return [];
+  return values.map((row) => {
+    const rowObj = {};
+    fields.forEach((field, index) => {
+      rowObj[field] = row[index];
+    });
+    return rowObj;
+  });
+}
+__name(toInsertRows, "toInsertRows");
 function isPathInside(baseDir, targetPath) {
   const base = path5.resolve(baseDir);
   const target = path5.resolve(targetPath);
@@ -5262,936 +5599,426 @@ var Sql_default = {
   }
 };
 
-// src/sysserver/db/src/mysql/Index.ts
-import mysql from "mysql";
-var DbMySQL = class {
-  static {
-    __name(this, "DbMySQL");
-  }
-  constructor(config) {
-    this.config = config;
-    this.pool = mysql.createPool(config);
-  }
-  getErr(sql, err) {
-    if (this.config.create && isTableMissingError(err)) {
-      this.createTable(sql);
-    }
-    return err?.message || null;
-  }
-  getResult(rows) {
-    return rows ?? null;
-  }
-  query(sql, callback) {
-    this.pool.getConnection((error, connection) => {
-      if (error) {
-        callback(this.getErr(sql, error), this.getResult(null));
-        return;
-      }
-      connection.query(Sql_default.makeSql(sql), (err, rows) => {
-        try {
-          callback(this.getErr(sql, err), this.getResult(rows));
-        } finally {
-          connection.release();
-        }
-      });
-    });
-  }
-  sqlDb(sql) {
-    return promisifySqlDb(this.query.bind(this), sql);
-  }
-  /** 关闭连接池，释放所有连接 */
-  close(callback) {
-    this.pool.end(callback);
-  }
-  /** 表不存在时自动创建数据库与表（需 config.create 为 true） */
-  createTable(sql) {
-    if (!this.config.create) return;
-    const conn = mysql.createConnection({
-      host: this.config.host,
-      user: this.config.user,
-      password: this.config.password
-    });
-    conn.connect((err) => {
-      if (err) {
-        conn.end();
-        return;
-      }
-      conn.query(`CREATE DATABASE IF NOT EXISTS ${this.config.database};`, (dbErr) => {
-        if (dbErr) {
-          conn.end();
-          return;
-        }
-        this.pool = mysql.createPool(this.config);
-        this.pool.getConnection((poolErr, connection) => {
-          if (poolErr || !connection) {
-            conn.end();
-            return;
-          }
-          connection.query(Sql_default.createSql(sql, "mysql"), () => {
-            connection.release();
-            conn.end();
-          });
-        });
-      });
-    });
-  }
-};
-var Index_default2 = DbMySQL;
-
-// src/sysserver/db/src/sqlite/Index.ts
+// src/sysserver/db/src/file/Index.ts
 import * as fs11 from "fs";
 import * as path6 from "path";
-import sqlite3Import from "sqlite3";
-var sqlite3 = sqlite3Import.default ?? sqlite3Import;
-var DEFAULT_BUSY_TIMEOUT_MS = 1e4;
-var DEFAULT_ACQUIRE_TIMEOUT_MS = 15e3;
-function configureSqliteConnection(db, busyTimeoutMs = DEFAULT_BUSY_TIMEOUT_MS) {
-  const busyMs = Math.max(0, Math.floor(busyTimeoutMs));
-  return new Promise((resolve7, reject) => {
-    db.serialize(() => {
-      db.run("PRAGMA journal_mode = WAL");
-      db.run(`PRAGMA busy_timeout = ${busyMs}`);
-      db.run("PRAGMA synchronous = NORMAL", (err) => {
-        if (err) reject(err);
-        else resolve7();
-      });
-    });
-  });
-}
-__name(configureSqliteConnection, "configureSqliteConnection");
-var PooledConnection = class _PooledConnection {
-  static {
-    __name(this, "PooledConnection");
-  }
-  // 连接是否有效
-  constructor(db, config) {
-    this.db = db;
-    this.config = config;
-    this.lastUsed = Date.now();
-    this.inUse = false;
-    this.isValid = true;
-  }
-  /**
-   * 异步创建连接，确保目录存在并打开数据库
-   */
-  static async create(config) {
-    function dbLog(...args) {
-      (config?.$asai?.$log || console.log)("SQLITE", ...args);
-    }
-    __name(dbLog, "dbLog");
-    const absolutePath = path6.resolve(config.database);
-    const dir = path6.dirname(absolutePath);
-    if (!fs11.existsSync(dir)) {
-      fs11.mkdirSync(dir, { recursive: true });
-      dbLog("MKDIR", dir);
-    }
-    return new Promise((resolve7, reject) => {
-      const db = new sqlite3.Database(absolutePath, sqlite3.OPEN_READWRITE | sqlite3.OPEN_CREATE, async (err) => {
-        if (err) {
-          dbLog("open failed", "[ERROR] Failed to open database:", absolutePath, err.message);
-          reject(err);
-          return;
-        }
-        try {
-          await configureSqliteConnection(db, config.busyTimeout ?? DEFAULT_BUSY_TIMEOUT_MS);
-          dbLog("OPEN", absolutePath);
-          resolve7(new _PooledConnection(db, config));
-        } catch (pragmaErr) {
-          db.close(() => {
-          });
-          reject(pragmaErr);
-        }
-      });
-    });
-  }
-  /** 测试连接是否有效（执行 SELECT 1） */
-  async test() {
-    return new Promise((resolve7) => {
-      if (!this.isValid) return resolve7(false);
-      this.db.get("SELECT 1", (err) => {
-        this.isValid = !err;
-        resolve7(this.isValid);
-      });
-    });
-  }
-  /** 关闭连接 */
-  async close() {
-    return new Promise((resolve7, reject) => {
-      this.db.close((err) => {
-        if (err) reject(err);
-        else resolve7();
-      });
-    });
-  }
-  /** 标记连接为无效 */
-  invalidate() {
-    this.isValid = false;
-  }
-};
-var SQLitePool = class {
-  // 初始化完成 Promise
-  constructor(config) {
-    this.pool = [];
-    this.waitingQueue = [];
-    this.idleCheckerTimer = null;
-    this.isDestroyed = false;
-    this.config = {
-      database: config.database,
-      poolMin: config.poolMin ?? 1,
-      poolMax: config.poolMax ?? 1,
-      idleTimeout: config.idleTimeout ?? 3e4,
-      acquireTimeout: config.acquireTimeout ?? DEFAULT_ACQUIRE_TIMEOUT_MS,
-      busyTimeout: config.busyTimeout ?? DEFAULT_BUSY_TIMEOUT_MS,
-      enableCreateTable: config.enableCreateTable ?? true,
-      $asai: config.$asai ?? null
-    };
-    this.initPromise = this.initializePool();
-    this.startIdleChecker();
-  }
-  static {
-    __name(this, "SQLitePool");
-  }
-  /** 统一日志输出（前缀 ♣ 标识来自 SQLite 连接池模块） */
-  dbLog(...args) {
-    (this.config?.$asai?.$log || console.log)("sqlite", ...args);
-  }
-  /** 初始化连接池，创建最小连接数 */
-  async initializePool() {
-    const promises = [];
-    for (let i = 0; i < this.config.poolMin; i++) {
-      promises.push(this.createConnection());
-    }
-    const results = await Promise.allSettled(promises);
-    const successCount = results.filter((r) => r.status === "fulfilled").length;
-    if (successCount === 0) {
-      this.dbLog("Initialization failed", "[POOL] Initialization failed: no connections created");
-    } else {
-      this.dbLog("Initialized", "[POOL] Initialized, size:", this.pool.length);
-    }
-  }
-  /** 创建一个新连接并加入池中 */
-  async createConnection() {
-    if (this.pool.length >= this.config.poolMax) return;
-    try {
-      const conn = await PooledConnection.create(this.config);
-      const isValid = await conn.test();
-      if (isValid) {
-        this.pool.push(conn);
-      } else {
-        await conn.close().catch(() => {
-        });
-        throw new Error("Connection test failed");
+function dbDriver(opt = {}) {
+  const { Sql, DbCommon } = opt;
+  const { isPathInside: isPathInside2, joinTablePath: joinTablePath2 } = DbCommon;
+  class DbFile {
+    static {
+      __name(this, "DbFile");
+    }
+    constructor(config) {
+      this.config = config;
+      this.fileExt = config.ext === ".*" ? "" : config.ext || "";
+      this.fileDel = (config.del || 0) !== 0;
+      this.createDir = config.create || false;
+      this.baseDirAbs = path6.resolve(process.cwd(), config.dir);
+    }
+    dbLog(...args) {
+      (this.config?.$asai?.$log || console.log)("FILE", ...args);
+    }
+    checkFile(file) {
+      return fs11.existsSync(this.getAbsPath(file, false));
+    }
+    /** 解析相对路径并限制在数据根目录内，防止路径穿越（跨平台） */
+    resolvePath(relPath) {
+      if (!relPath) {
+        return this.baseDirAbs;
+      }
+      const abs = path6.isAbsolute(relPath) ? path6.normalize(relPath) : path6.resolve(this.baseDirAbs, relPath);
+      if (!isPathInside2(this.baseDirAbs, abs)) {
+        return this.baseDirAbs;
+      }
+      return abs;
+    }
+    /** 将 table 与文件名片段拼为平台无关相对路径 */
+    tableFilePath(table, ...segments) {
+      return joinTablePath2(table, ...segments);
+    }
+    normalizeRelPath(relPath) {
+      if (!relPath) {
+        return "";
       }
-    } catch (err) {
-      this.dbLog("Database create failed", "[CONN] Failed to create connection:", err.message);
-      throw err;
+      return path6.isAbsolute(relPath) ? path6.relative(this.baseDirAbs, relPath) : relPath;
     }
-  }
-  /**
-   * 获取一个可用连接
-   * - 优先返回空闲连接
-   * - 若连接数未达上限则创建新连接
-   * - 否则进入等待队列
-   */
-  async acquire() {
-    await this.initPromise;
-    if (this.isDestroyed) {
-      throw new Error("Pool has been destroyed");
+    ensureDir(relPath) {
+      const relative4 = this.normalizeRelPath(relPath);
+      const dirPath = path6.dirname(relative4);
+      const absDir = this.resolvePath(dirPath === "." ? "" : dirPath);
+      if (this.createDir && !fs11.existsSync(absDir)) {
+        this.dbLog("mkdir", "[MKDIR]", absDir);
+        fs11.mkdirSync(absDir, { recursive: true });
+      }
+      return absDir;
     }
-    const now = Date.now();
-    const staleCheckMs = Math.min(this.config.idleTimeout, 5e3);
-    for (const conn of this.pool) {
-      if (!conn.inUse) {
-        if (now - conn.lastUsed > staleCheckMs) {
-          const isValid = await conn.test();
-          if (!isValid) {
-            this.removeConnection(conn);
-            continue;
-          }
-        }
-        conn.inUse = true;
-        conn.lastUsed = now;
-        return conn;
+    getAbsPath(file, autoCreateDir = true) {
+      let rel = file;
+      if (this.fileExt && !rel.endsWith(this.fileExt)) {
+        rel += this.fileExt;
       }
+      if (autoCreateDir) {
+        this.ensureDir(rel);
+      }
+      return this.resolvePath(rel);
     }
-    if (this.pool.length < this.config.poolMax) {
-      try {
-        const conn = await PooledConnection.create(this.config);
-        const isValid = await conn.test();
-        if (isValid) {
-          conn.inUse = true;
-          conn.lastUsed = Date.now();
-          this.pool.push(conn);
-          return conn;
+    deldir(relativePath) {
+      const absPath = this.resolvePath(relativePath);
+      if (!fs11.existsSync(absPath)) {
+        return;
+      }
+      this.dbLog("delete", "[RMDIR]", absPath);
+      const entries = fs11.readdirSync(absPath, { withFileTypes: true });
+      for (const entry of entries) {
+        const current = path6.join(absPath, entry.name);
+        if (entry.isDirectory()) {
+          this.deldir(path6.join(relativePath, entry.name));
         } else {
-          await conn.close().catch(() => {
-          });
+          this.dbLog("delete", "[UNLINK]", current);
+          fs11.unlinkSync(current);
         }
-      } catch (e) {
-        this.dbLog("create failed", "[ACQUIRE] Failed to create new connection, waiting:", e.message);
       }
+      fs11.rmdirSync(absPath);
     }
-    return new Promise((resolve7, reject) => {
-      const timer = setTimeout(() => {
-        const idx = this.waitingQueue.findIndex((item) => item.timer === timer);
-        if (idx !== -1) {
-          this.waitingQueue.splice(idx, 1);
-        }
-        reject(new Error(`Acquire timeout (${this.config.acquireTimeout}ms)`));
-      }, this.config.acquireTimeout);
-      this.waitingQueue.push({ resolve: resolve7, reject, timer });
-    });
-  }
-  /** 释放连接回池中 */
-  release(conn) {
-    if (!conn) return;
-    conn.inUse = false;
-    conn.lastUsed = Date.now();
-    if (this.waitingQueue.length > 0) {
-      const next = this.waitingQueue.shift();
-      clearTimeout(next.timer);
-      conn.inUse = true;
-      conn.lastUsed = Date.now();
-      next.resolve(conn);
-    }
-  }
-  /** 从池中移除并关闭指定连接 */
-  removeConnection(conn) {
-    const index = this.pool.indexOf(conn);
-    if (index !== -1) {
-      this.pool.splice(index, 1);
-      conn.close().catch(() => {
-      });
-    }
-  }
-  /** 启动空闲连接回收定时器（每 60 秒检查一次） */
-  startIdleChecker() {
-    this.idleCheckerTimer = setInterval(async () => {
-      if (this.isDestroyed) return;
-      const now = Date.now();
-      const toRemove = [];
-      for (const conn of this.pool) {
-        if (!conn.inUse && now - conn.lastUsed > this.config.idleTimeout && this.pool.length > this.config.poolMin) {
-          toRemove.push(conn);
+    getReadPath(file, sql) {
+      const candidates = [];
+      if (sql?.filename) {
+        candidates.push({ dir: path6.join(file, sql.filename) });
+        candidates.push({ dir: path6.join(file + ".delete" + this.fileExt, sql.filename) });
+      } else {
+        candidates.push({ dir: file });
+        candidates.push({ dir: file + this.fileExt + ".delete" });
+      }
+      for (const candidate of candidates) {
+        const abs = this.getAbsPath(candidate.dir, false);
+        if (fs11.existsSync(abs)) {
+          return { path: abs, dir: candidate.dir };
         }
       }
-      for (const conn of toRemove) {
-        this.removeConnection(conn);
+      return { path: "", dir: "" };
+    }
+    getDelPath(file, sql) {
+      const read2 = this.getReadPath(file, sql);
+      if (!read2.path) {
+        return { path: "", dir: read2.dir };
       }
-      if (toRemove.length > 0) {
-        this.dbLog("Reclaimed", "[IDLE] Reclaimed", toRemove.length, "idle connections, current pool size:", this.pool.length);
+      if (sql?.filename) {
+        return { path: path6.dirname(read2.path), dir: path6.dirname(read2.dir) };
       }
-    }, 6e4);
-  }
-  /** 获取连接池当前状态 */
-  getStatus() {
-    const inUse = this.pool.filter((c) => c.inUse).length;
-    return {
-      total: this.pool.length,
-      inUse,
-      idle: this.pool.length - inUse,
-      waiting: this.waitingQueue.length,
-      min: this.config.poolMin,
-      max: this.config.poolMax
-    };
-  }
-  /** 销毁连接池，释放所有资源 */
-  async destroy() {
-    if (this.isDestroyed) return;
-    this.isDestroyed = true;
-    if (this.idleCheckerTimer) {
-      clearInterval(this.idleCheckerTimer);
-      this.idleCheckerTimer = null;
-    }
-    for (const waiter of this.waitingQueue) {
-      clearTimeout(waiter.timer);
-      waiter.reject(new Error("Pool has been closed"));
+      return { path: read2.path, dir: read2.dir };
     }
-    this.waitingQueue = [];
-    await Promise.allSettled(this.pool.map((conn) => conn.close()));
-    this.pool = [];
-    this.dbLog("Destroyed", "[POOL] Destroyed");
-  }
-};
-var DbSQLite3 = class {
-  constructor(config) {
-    this.pool = null;
-    this.singleDb = null;
-    this.singleDbReady = null;
-    /** 串行化同库 CRUD，避免 node-sqlite3 回调并发导致锁等待与连接泄漏 */
-    this.opChain = Promise.resolve();
-    this.config = config;
-    const verbose = sqlite3.verbose();
-    if (config.usePool === true) {
-      this.pool = new SQLitePool({
-        database: config.database,
-        poolMin: config.poolMin ?? 1,
-        poolMax: config.poolMax ?? 1,
-        idleTimeout: config.idleTimeout,
-        acquireTimeout: config.acquireTimeout ?? DEFAULT_ACQUIRE_TIMEOUT_MS,
-        busyTimeout: config.busyTimeout ?? DEFAULT_BUSY_TIMEOUT_MS,
-        enableCreateTable: config.create,
-        $asai: config.$asai
-      });
-    } else {
-      this.singleDbReady = this.initSingleConnection(config.database, verbose);
+    getNewPath(file, sql) {
+      if (sql?.filename) {
+        return this.getAbsPath(path6.join(file, sql.filename), true);
+      }
+      return this.getAbsPath(file, true);
     }
-  }
-  static {
-    __name(this, "DbSQLite3");
-  }
-  runSerialized(task) {
-    const run = this.opChain.then(() => task());
-    this.opChain = run.then(
-      () => void 0,
-      () => void 0
-    );
-    return run;
-  }
-  dbLog(...args) {
-    (this.config?.$asai?.$log || console.log)("sqlite", ...args);
-  }
-  async initSingleConnection(databasePath, verbose) {
-    const absolutePath = path6.resolve(databasePath);
-    const dir = path6.dirname(absolutePath);
-    if (!fs11.existsSync(dir)) {
-      fs11.mkdirSync(dir, { recursive: true });
-      this.dbLog("mkdir", "[MKDIR]", dir);
-    }
-    return new Promise((resolve7, reject) => {
-      this.singleDb = new verbose.Database(absolutePath, sqlite3.OPEN_READWRITE | sqlite3.OPEN_CREATE, async (err) => {
-        if (err) {
-          this.dbLog("open failed", "[ERROR] Failed to open single connection:", absolutePath, err.message);
-          reject(err);
-          return;
-        }
-        try {
-          await configureSqliteConnection(this.singleDb, this.config.busyTimeout ?? DEFAULT_BUSY_TIMEOUT_MS);
-          this.dbLog("open", "[OPEN] Single connection:", absolutePath);
-          resolve7();
-        } catch (pragmaErr) {
-          this.singleDb.close(() => {
-          });
-          reject(pragmaErr);
-        }
-      });
-    });
-  }
-  getErr(_sql, err) {
-    return err?.message || null;
-  }
-  getResult(rows) {
-    return rows ?? "OK";
-  }
-  /**
-   * 执行 SQL 查询（回调风格）
-   */
-  query(sql, callback) {
-    const sqlStr = Sql_default.makeSql(sql);
-    const executeQuery = /* @__PURE__ */ __name((db, release) => {
-      const finish = /* @__PURE__ */ __name((err, rows) => {
-        release?.();
-        callback(this.getErr(sql, err), this.getResult(rows));
-      }, "finish");
+    write(file, data, sql) {
       try {
-        if (sql.type === "select") {
-          db.all(sqlStr, finish);
-        } else {
-          db.run(sqlStr, (err) => {
-            finish(err, "OK");
-          });
-        }
+        const filePath = sql?.type === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
+        this.dbLog("write", "[WRITE]", filePath);
+        fs11.writeFileSync(filePath, data, "utf8");
+        return "ok";
       } catch (e) {
-        release?.();
-        callback(this.getErr(sql, e), this.getResult("sql error"));
-      }
-    }, "executeQuery");
-    if (this.pool) {
-      this.pool.acquire().then((conn) => {
-        executeQuery(conn.db, () => this.pool.release(conn));
-      }).catch((err) => {
-        callback(this.getErr(sql, err), this.getResult("pool error"));
-      });
-    } else {
-      (this.singleDbReady || Promise.resolve()).then(() => {
-        executeQuery(this.singleDb);
-      }).catch((err) => {
-        callback(this.getErr(sql, err), this.getResult("connection error"));
-      });
-    }
-  }
-  /** 执行 SQL 操作（Promise 风格，串行 + 缺表时自动建表并重试一次） */
-  sqlDb(sql) {
-    return this.runSerialized(() => this.executeSqlDb(sql));
-  }
-  async executeSqlDb(sql) {
-    try {
-      return await promisifySqlDb(this.query.bind(this), sql);
-    } catch (err) {
-      const errObj = { message: String(err?.message || err || "") };
-      if (this.config.create && sql.type === "insert" && isTableMissingError(errObj)) {
-        await this.createTable(sql);
-        return promisifySqlDb(this.query.bind(this), sql);
+        this.dbLog("write failed", "[WRITE ERROR]", e);
+        return e;
       }
-      throw err;
     }
-  }
-  /**
-   * 自动建表（当表不存在时触发）
-   */
-  async createTable(sql) {
-    const createSql = Sql_default.createSql(sql, "sqlite");
-    if (!createSql) return;
-    if (this.pool) {
-      let conn = null;
+    read(file, sql, encoding = "utf8") {
       try {
-        conn = await this.pool.acquire();
-        await new Promise((resolve7, reject) => {
-          conn.db.run(createSql, (err) => {
-            if (err) reject(err);
-            else resolve7();
-          });
-        });
-        this.dbLog("Created", "[TABLE] Created:", createSql);
+        const read2 = this.getReadPath(file, sql);
+        if (!read2.path) {
+          return { error: "empty" };
+        }
+        this.dbLog("read", "[READ]", read2.path);
+        const data = fs11.readFileSync(read2.path, { encoding }) || "";
+        const fileName = this.fileExt && read2.dir.endsWith(this.fileExt) ? read2.dir : read2.dir + this.fileExt;
+        return [{ data, file: fileName }];
       } catch (e) {
-        this.dbLog("Creation failed", "[TABLE] Creation failed:", e);
-      } finally {
-        if (conn) this.pool.release(conn);
-      }
-    } else {
-      await this.singleDbReady;
-      await new Promise((resolve7, reject) => {
-        this.singleDb.run(createSql, (err) => {
-          if (err) reject(err);
-          else resolve7();
-        });
-      });
-    }
-  }
-  /** 获取连接池状态（仅连接池模式有效） */
-  getPoolStatus() {
-    if (this.pool) {
-      return this.pool.getStatus();
-    }
-    return { mode: "single-connection" };
-  }
-  /** 关闭所有连接 */
-  async close() {
-    if (this.pool) {
-      await this.pool.destroy();
-    } else if (this.singleDb) {
-      await new Promise((resolve7, reject) => {
-        this.singleDb.close((err) => {
-          if (err) reject(err);
-          else resolve7();
-        });
-      });
-    }
-  }
-};
-var Index_default3 = DbSQLite3;
-
-// src/sysserver/db/src/file/Index.ts
-import * as fs12 from "fs";
-import * as path7 from "path";
-var DbFile = class {
-  static {
-    __name(this, "DbFile");
-  }
-  constructor(config) {
-    this.config = config;
-    this.fileExt = config.ext === ".*" ? "" : config.ext || "";
-    this.fileDel = (config.del || 0) !== 0;
-    this.createDir = config.create || false;
-    this.baseDirAbs = path7.resolve(process.cwd(), config.dir);
-  }
-  dbLog(...args) {
-    (this.config?.$asai?.$log || console.log)("FILE", ...args);
-  }
-  checkFile(file) {
-    return fs12.existsSync(this.getAbsPath(file, false));
-  }
-  /** 解析相对路径并限制在数据根目录内，防止路径穿越（跨平台） */
-  resolvePath(relPath) {
-    if (!relPath) {
-      return this.baseDirAbs;
-    }
-    const abs = path7.isAbsolute(relPath) ? path7.normalize(relPath) : path7.resolve(this.baseDirAbs, relPath);
-    if (!isPathInside(this.baseDirAbs, abs)) {
-      return this.baseDirAbs;
-    }
-    return abs;
-  }
-  /** 将 table 与文件名片段拼为平台无关相对路径 */
-  tableFilePath(table, ...segments) {
-    return joinTablePath(table, ...segments);
-  }
-  normalizeRelPath(relPath) {
-    if (!relPath) {
-      return "";
-    }
-    return path7.isAbsolute(relPath) ? path7.relative(this.baseDirAbs, relPath) : relPath;
-  }
-  ensureDir(relPath) {
-    const relative4 = this.normalizeRelPath(relPath);
-    const dirPath = path7.dirname(relative4);
-    const absDir = this.resolvePath(dirPath === "." ? "" : dirPath);
-    if (this.createDir && !fs12.existsSync(absDir)) {
-      this.dbLog("mkdir", "[MKDIR]", absDir);
-      fs12.mkdirSync(absDir, { recursive: true });
-    }
-    return absDir;
-  }
-  getAbsPath(file, autoCreateDir = true) {
-    let rel = file;
-    if (this.fileExt && !rel.endsWith(this.fileExt)) {
-      rel += this.fileExt;
-    }
-    if (autoCreateDir) {
-      this.ensureDir(rel);
-    }
-    return this.resolvePath(rel);
-  }
-  deldir(relativePath) {
-    const absPath = this.resolvePath(relativePath);
-    if (!fs12.existsSync(absPath)) {
-      return;
-    }
-    this.dbLog("delete", "[RMDIR]", absPath);
-    const entries = fs12.readdirSync(absPath, { withFileTypes: true });
-    for (const entry of entries) {
-      const current = path7.join(absPath, entry.name);
-      if (entry.isDirectory()) {
-        this.deldir(path7.join(relativePath, entry.name));
-      } else {
-        this.dbLog("delete", "[UNLINK]", current);
-        fs12.unlinkSync(current);
+        this.dbLog("read failed", "[READ ERROR]", e);
+        return e;
       }
     }
-    fs12.rmdirSync(absPath);
-  }
-  getReadPath(file, sql) {
-    const candidates = [];
-    if (sql?.filename) {
-      candidates.push({ dir: path7.join(file, sql.filename) });
-      candidates.push({ dir: path7.join(file + ".delete" + this.fileExt, sql.filename) });
-    } else {
-      candidates.push({ dir: file });
-      candidates.push({ dir: file + this.fileExt + ".delete" });
-    }
-    for (const candidate of candidates) {
-      const abs = this.getAbsPath(candidate.dir, false);
-      if (fs12.existsSync(abs)) {
-        return { path: abs, dir: candidate.dir };
-      }
-    }
-    return { path: "", dir: "" };
-  }
-  getDelPath(file, sql) {
-    const read2 = this.getReadPath(file, sql);
-    if (!read2.path) {
-      return { path: "", dir: read2.dir };
-    }
-    if (sql?.filename) {
-      return { path: path7.dirname(read2.path), dir: path7.dirname(read2.dir) };
-    }
-    return { path: read2.path, dir: read2.dir };
-  }
-  getNewPath(file, sql) {
-    if (sql?.filename) {
-      return this.getAbsPath(path7.join(file, sql.filename), true);
-    }
-    return this.getAbsPath(file, true);
-  }
-  write(file, data, sql) {
-    try {
-      const filePath = sql?.type === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
-      this.dbLog("write", "[WRITE]", filePath);
-      fs12.writeFileSync(filePath, data, "utf8");
-      return "ok";
-    } catch (e) {
-      this.dbLog("write failed", "[WRITE ERROR]", e);
-      return e;
-    }
-  }
-  read(file, sql, encoding = "utf8") {
-    try {
-      const read2 = this.getReadPath(file, sql);
-      if (!read2.path) {
-        return { error: "empty" };
-      }
-      this.dbLog("read", "[READ]", read2.path);
-      const data = fs12.readFileSync(read2.path, { encoding }) || "";
-      const fileName = this.fileExt && read2.dir.endsWith(this.fileExt) ? read2.dir : read2.dir + this.fileExt;
-      return [{ data, file: fileName }];
-    } catch (e) {
-      this.dbLog("read failed", "[READ ERROR]", e);
-      return e;
-    }
-  }
-  del(file, sql) {
-    try {
-      const del = this.getDelPath(file, sql);
-      if (!del.path) {
-        return "";
-      }
-      if (this.fileDel && sql?.deltrue) {
-        const target = del.path + ".delete" + this.fileExt;
-        this.dbLog("soft delete", "[SOFT DELETE]", `${del.path} -> ${target}`);
-        fs12.renameSync(del.path, target);
-      } else if (sql?.filename) {
-        this.deldir(del.dir);
-      } else {
-        this.dbLog("delete", "[DELETE]", del.path);
-        fs12.unlinkSync(del.path);
+    del(file, sql) {
+      try {
+        const del = this.getDelPath(file, sql);
+        if (!del.path) {
+          return "";
+        }
+        if (this.fileDel && sql?.deltrue) {
+          const target = del.path + ".delete" + this.fileExt;
+          this.dbLog("soft delete", "[SOFT DELETE]", `${del.path} -> ${target}`);
+          fs11.renameSync(del.path, target);
+        } else if (sql?.filename) {
+          this.deldir(del.dir);
+        } else {
+          this.dbLog("delete", "[DELETE]", del.path);
+          fs11.unlinkSync(del.path);
+        }
+        return "ok";
+      } catch (e) {
+        this.dbLog("delete failed", "[DELETE ERROR]", e);
+        return e;
       }
-      return "ok";
-    } catch (e) {
-      this.dbLog("delete failed", "[DELETE ERROR]", e);
-      return e;
     }
-  }
-  re(file, sql) {
-    try {
-      const del = this.getDelPath(file, sql);
-      if (!del.path) {
-        return "";
-      }
-      if (this.fileDel) {
-        const extPattern = this.fileExt ? this.fileExt.replace(/\./g, "\\.") : "";
-        const original = del.path.replace(new RegExp(`.delete${extPattern}$`), "");
-        if (original !== del.path) {
-          this.dbLog("restore", "[RESTORE]", `${del.path} -> ${original}`);
-          fs12.renameSync(del.path, original);
+    re(file, sql) {
+      try {
+        const del = this.getDelPath(file, sql);
+        if (!del.path) {
+          return "";
         }
-      } else {
-        this.dbLog("force delete", "[FORCE DELETE]", del.path);
-        fs12.unlinkSync(del.path);
+        if (this.fileDel) {
+          const extPattern = this.fileExt ? this.fileExt.replace(/\./g, "\\.") : "";
+          const original = del.path.replace(new RegExp(`.delete${extPattern}$`), "");
+          if (original !== del.path) {
+            this.dbLog("restore", "[RESTORE]", `${del.path} -> ${original}`);
+            fs11.renameSync(del.path, original);
+          }
+        } else {
+          this.dbLog("force delete", "[FORCE DELETE]", del.path);
+          fs11.unlinkSync(del.path);
+        }
+        return "ok";
+      } catch (e) {
+        this.dbLog("restore failed", "[RESTORE ERROR]", e);
+        return e;
       }
-      return "ok";
-    } catch (e) {
-      this.dbLog("restore failed", "[RESTORE ERROR]", e);
-      return e;
     }
-  }
-  list(dir, sql) {
-    try {
-      const absDir = this.resolvePath(dir);
-      this.dbLog("list", "[LIST]", absDir);
-      let entries;
+    list(dir, sql) {
       try {
-        entries = fs12.readdirSync(absDir, { withFileTypes: true });
-      } catch {
-        return sql?.list ? { open: [], delete: [] } : [];
-      }
-      const result = { open: [], delete: [] };
-      const deleteSuffix = ".delete" + this.fileExt;
-      for (const entry of entries) {
-        if (!entry.isFile()) continue;
-        const fileName = entry.name;
-        const isDelete = fileName.endsWith(deleteSuffix);
-        const baseName = isDelete ? fileName.slice(0, -deleteSuffix.length) : fileName;
-        if (this.fileExt && !baseName.endsWith(this.fileExt)) continue;
-        const fullPath = path7.join(absDir, fileName);
+        const absDir = this.resolvePath(dir);
+        this.dbLog("list", "[LIST]", absDir);
+        let entries;
         try {
-          const data = fs12.readFileSync(fullPath, "utf8");
-          const entryData = { data, file: baseName };
-          if (isDelete) {
-            if (sql?.list) result.delete.push(entryData);
-          } else {
-            result.open.push(entryData);
-          }
+          entries = fs11.readdirSync(absDir, { withFileTypes: true });
         } catch {
+          return sql?.list ? { open: [], delete: [] } : [];
+        }
+        const result = { open: [], delete: [] };
+        const deleteSuffix = ".delete" + this.fileExt;
+        for (const entry of entries) {
+          if (!entry.isFile()) continue;
+          const fileName = entry.name;
+          const isDelete = fileName.endsWith(deleteSuffix);
+          const baseName = isDelete ? fileName.slice(0, -deleteSuffix.length) : fileName;
+          if (this.fileExt && !baseName.endsWith(this.fileExt)) continue;
+          const fullPath = path6.join(absDir, fileName);
+          try {
+            const data = fs11.readFileSync(fullPath, "utf8");
+            const entryData = { data, file: baseName };
+            if (isDelete) {
+              if (sql?.list) result.delete.push(entryData);
+            } else {
+              result.open.push(entryData);
+            }
+          } catch {
+          }
         }
+        return sql?.list ? result : result.open;
+      } catch (e) {
+        this.dbLog("list failed", "[LIST ERROR]", e);
+        return e;
       }
-      return sql?.list ? result : result.open;
-    } catch (e) {
-      this.dbLog("list failed", "[LIST ERROR]", e);
-      return e;
     }
-  }
-  /** 从 where 首条条件中提取文件名（去掉 SQL 风格引号） */
-  getFileNameFromWhere(where) {
-    if (!where || !Array.isArray(where)) return "";
-    const first = where.find((item) => Array.isArray(item));
-    const raw = first?.[2];
-    if (typeof raw === "string") {
-      return raw.replace(/^'+|'+$/g, "");
+    /** 从 where 首条条件中提取文件名（去掉 SQL 风格引号） */
+    getFileNameFromWhere(where) {
+      if (!where || !Array.isArray(where)) return "";
+      const first = where.find((item) => Array.isArray(item));
+      const raw = first?.[2];
+      if (typeof raw === "string") {
+        return raw.replace(/^'+|'+$/g, "");
+      }
+      return String(raw ?? "");
     }
-    return String(raw ?? "");
-  }
-  sqlDb(sql) {
-    return new Promise((resolve7, reject) => {
-      try {
-        let result;
-        const tableDir = this.tableFilePath(sql.table);
-        if (sql.type === "insert") {
-          const [file, data] = sql.value[0];
-          result = this.write(this.tableFilePath(sql.table, file), data, sql);
-        } else if (sql.type === "delete") {
-          const file = this.getFileNameFromWhere(sql.where);
-          result = this.del(this.tableFilePath(sql.table, file), sql);
-        } else if (sql.type === "re") {
-          const file = this.getFileNameFromWhere(sql.where);
-          result = this.re(this.tableFilePath(sql.table, file), sql);
-        } else if (sql.type === "update") {
-          const file = this.getFileNameFromWhere(sql.where);
-          const data = sql.set[0][1];
-          result = this.write(this.tableFilePath(sql.table, file), data, sql);
-        } else if (sql.type === "select") {
-          if (sql?.where?.length && sql?.as !== 2) {
+    sqlDb(sql) {
+      return new Promise((resolve6, reject) => {
+        try {
+          let result;
+          const tableDir = this.tableFilePath(sql.table);
+          if (sql.type === "insert") {
+            const [file, data] = sql.value[0];
+            result = this.write(this.tableFilePath(sql.table, file), data, sql);
+          } else if (sql.type === "delete") {
             const file = this.getFileNameFromWhere(sql.where);
-            const readRes = this.read(this.tableFilePath(sql.table, file), sql);
-            const resObj = {};
-            if (readRes?.[0]?.file && !readRes.error) {
-              if (sql.as === 1) {
-                try {
-                  const parsed = JSON.parse(readRes[0].data);
-                  if (sql.field?.length) {
-                    sql.field.forEach((f) => {
-                      resObj[f] = parsed[f] ?? "";
-                    });
-                  } else {
-                    Object.assign(resObj, parsed);
+            result = this.del(this.tableFilePath(sql.table, file), sql);
+          } else if (sql.type === "re") {
+            const file = this.getFileNameFromWhere(sql.where);
+            result = this.re(this.tableFilePath(sql.table, file), sql);
+          } else if (sql.type === "update") {
+            const file = this.getFileNameFromWhere(sql.where);
+            const data = sql.set[0][1];
+            result = this.write(this.tableFilePath(sql.table, file), data, sql);
+          } else if (sql.type === "select") {
+            if (sql?.where?.length && sql?.as !== 2) {
+              const file = this.getFileNameFromWhere(sql.where);
+              const readRes = this.read(this.tableFilePath(sql.table, file), sql);
+              const resObj = {};
+              if (readRes?.[0]?.file && !readRes.error) {
+                if (sql.as === 1) {
+                  try {
+                    const parsed = JSON.parse(readRes[0].data);
+                    if (sql.field?.length) {
+                      sql.field.forEach((f) => {
+                        resObj[f] = parsed[f] ?? "";
+                      });
+                    } else {
+                      Object.assign(resObj, parsed);
+                    }
+                  } catch {
+                  }
+                } else {
+                  const fields = sql.field;
+                  resObj[fields[0]] = readRes[0].file;
+                  if (fields[1]) {
+                    resObj[fields[1]] = readRes[0].data;
                   }
-                } catch {
-                }
-              } else {
-                const fields = sql.field;
-                resObj[fields[0]] = readRes[0].file;
-                if (fields[1]) {
-                  resObj[fields[1]] = readRes[0].data;
                 }
               }
-            }
-            result = [resObj];
-          } else {
-            const listRes = this.list(tableDir, sql);
-            if (listRes && !listRes.error) {
-              if (sql?.list) {
-                const mapEntry = /* @__PURE__ */ __name((el) => {
-                  const fields = sql.field;
-                  const item = { [fields[0]]: el.file };
-                  if (fields[1]) item[fields[1]] = el.data;
-                  return item;
-                }, "mapEntry");
-                if (listRes.open) listRes.open = listRes.open.map(mapEntry);
-                if (listRes.delete) listRes.delete = listRes.delete.map(mapEntry);
-                result = listRes;
-              } else {
-                if (sql?.as === 2) {
-                  let items = listRes;
-                  if (sql.where?.length) {
-                    const where = sql.where;
-                    const whereType = typeof where[0] === "string" ? where[0] : "and";
-                    items = items.filter((el) => {
-                      let match = whereType === "and";
-                      for (let i = 0; i < where.length; i++) {
-                        if (typeof where[i] === "string") continue;
-                        const cond = where[i];
-                        if (!cond) continue;
-                        const field = cond[0];
-                        const searchVal = String(cond[2]).replace(/%/g, "");
-                        let fieldVal = "";
-                        try {
-                          fieldVal = JSON.parse(el.data)[field] ?? "";
-                        } catch {
+              result = [resObj];
+            } else {
+              const listRes = this.list(tableDir, sql);
+              if (listRes && !listRes.error) {
+                if (sql?.list) {
+                  const mapEntry = /* @__PURE__ */ __name((el) => {
+                    const fields = sql.field;
+                    const item = { [fields[0]]: el.file };
+                    if (fields[1]) item[fields[1]] = el.data;
+                    return item;
+                  }, "mapEntry");
+                  if (listRes.open) listRes.open = listRes.open.map(mapEntry);
+                  if (listRes.delete) listRes.delete = listRes.delete.map(mapEntry);
+                  result = listRes;
+                } else {
+                  if (sql?.as === 2) {
+                    let items = listRes;
+                    if (sql.where?.length) {
+                      const where = sql.where;
+                      const whereType = typeof where[0] === "string" ? where[0] : "and";
+                      items = items.filter((el) => {
+                        let match = whereType === "and";
+                        for (let i = 0; i < where.length; i++) {
+                          if (typeof where[i] === "string") continue;
+                          const cond = where[i];
+                          if (!cond) continue;
+                          const field = cond[0];
+                          const searchVal = String(cond[2]).replace(/%/g, "");
+                          let fieldVal = "";
+                          try {
+                            fieldVal = JSON.parse(el.data)[field] ?? "";
+                          } catch {
+                          }
+                          const condMatch = String(fieldVal).includes(searchVal);
+                          if (whereType === "and") {
+                            match = match && condMatch;
+                            if (!match) break;
+                          } else {
+                            match = match || condMatch;
+                            if (match) break;
+                          }
                         }
-                        const condMatch = String(fieldVal).includes(searchVal);
-                        if (whereType === "and") {
-                          match = match && condMatch;
-                          if (!match) break;
+                        return match;
+                      });
+                    }
+                    items = items.map((el) => {
+                      const obj = {};
+                      try {
+                        const parsed = JSON.parse(el.data);
+                        if (sql.field?.length) {
+                          sql.field.forEach((f) => {
+                            obj[f] = parsed[f] ?? "";
+                          });
                         } else {
-                          match = match || condMatch;
-                          if (match) break;
+                          Object.assign(obj, parsed);
                         }
+                      } catch {
                       }
-                      return match;
+                      return obj;
                     });
-                  }
-                  items = items.map((el) => {
-                    const obj = {};
-                    try {
-                      const parsed = JSON.parse(el.data);
-                      if (sql.field?.length) {
-                        sql.field.forEach((f) => {
-                          obj[f] = parsed[f] ?? "";
-                        });
-                      } else {
-                        Object.assign(obj, parsed);
-                      }
-                    } catch {
+                    if (sql.order?.length) {
+                      const orderField = sql.order[0];
+                      const orderFieldName = typeof orderField === "string" ? orderField : orderField[0];
+                      const direction = typeof orderField === "string" ? "ASC" : String(orderField[1]).toUpperCase();
+                      items.sort((a, b) => {
+                        const valA = String(a[orderFieldName] ?? "");
+                        const valB = String(b[orderFieldName] ?? "");
+                        const cmp = valA.localeCompare(valB);
+                        return direction === "DESC" ? -cmp : cmp;
+                      });
                     }
-                    return obj;
-                  });
-                  if (sql.order?.length) {
-                    const orderField = sql.order[0];
-                    const orderFieldName = typeof orderField === "string" ? orderField : orderField[0];
-                    const direction = typeof orderField === "string" ? "ASC" : String(orderField[1]).toUpperCase();
-                    items.sort((a, b) => {
-                      const valA = String(a[orderFieldName] ?? "");
-                      const valB = String(b[orderFieldName] ?? "");
-                      const cmp = valA.localeCompare(valB);
-                      return direction === "DESC" ? -cmp : cmp;
-                    });
+                    result = items;
+                  } else {
+                    const fields = sql.field;
+                    result = listRes.map((el) => ({
+                      [fields[0]]: el.file,
+                      ...fields[1] ? { [fields[1]]: el.data } : {}
+                    }));
                   }
-                  result = items;
-                } else {
-                  const fields = sql.field;
-                  result = listRes.map((el) => ({
-                    [fields[0]]: el.file,
-                    ...fields[1] ? { [fields[1]]: el.data } : {}
-                  }));
                 }
+              } else {
+                result = sql?.list ? { open: [], delete: [] } : [];
               }
-            } else {
-              result = sql?.list ? { open: [], delete: [] } : [];
             }
           }
+          if (result !== void 0) {
+            resolve6(result);
+          } else {
+            reject("");
+          }
+        } catch (e) {
+          reject(e);
         }
-        if (result !== void 0) {
-          resolve7(result);
-        } else {
-          reject("");
-        }
-      } catch (e) {
-        reject(e);
-      }
-    });
+      });
+    }
   }
-};
-var Index_default4 = DbFile;
+  return DbFile;
+}
+__name(dbDriver, "dbDriver");
+var Index_default2 = dbDriver;
 
 // src/sysserver/db/db.ts
-var DRIVERS = {
-  mysql: Index_default2,
-  sqlite: Index_default3,
-  file: Index_default4
-};
-function initDb(type = "file", config = {}) {
-  const Driver = DRIVERS[type];
-  if (Driver) {
-    return new Driver(config);
+var BUILTIN_FILE = "file";
+function buildFileDriver() {
+  return Index_default2({ IdbType: {}, Sql: Sql_default, DbCommon: common_exports });
+}
+__name(buildFileDriver, "buildFileDriver");
+function resolveDriver(type, dbDrivers) {
+  if (type === BUILTIN_FILE) {
+    return buildFileDriver();
+  }
+  const factory = dbDrivers[type];
+  if (typeof factory !== "function") {
+    return null;
   }
-  return {};
+  return factory({ IdbType: {}, Sql: Sql_default, DbCommon: common_exports });
 }
-__name(initDb, "initDb");
+__name(resolveDriver, "resolveDriver");
+var initDb = /* @__PURE__ */ __name((type = BUILTIN_FILE, config = {}, dbDrivers = {}) => {
+  let Driver = resolveDriver(type, dbDrivers);
+  if (!Driver) {
+    if (type !== BUILTIN_FILE) {
+      console.warn(
+        `[initDb] \u672A\u6CE8\u518C\u9A71\u52A8 "${type}"\uFF08\u8BF7\u5728 sysserver($asai, { db: { ${type}: driver } }) \u6302\u8F7D\uFF09\uFF0C\u5DF2\u56DE\u9000 file \u5B58\u50A8`
+      );
+    }
+    Driver = buildFileDriver();
+  }
+  return new Driver(config);
+}, "initDb");
 var db_default = initDb;
 
 // src/sysserver/index.ts
-var sysserver_default = /* @__PURE__ */ __name(($asai) => {
+function sysserver($asai, opt = {}) {
   if (!$asai.$lib) $asai.$lib = {};
+  $asai.$lib = { ...lib_default, ...$asai.$lib, ...opt || {} };
   $asai.dataserver = db_default;
-  $asai.$lib = { ...lib_default, ...$asai.$lib };
-  if (!$asai.asaifs) {
-    $asai.asaifs = $asai.$lib.AsFs;
-  }
   $asai.$lib.ErrorCode?.loadErrorCodes?.($asai);
   if (!$asai.$lib.api) $asai.$lib.api = {};
   $asai.$lib.api = { ...api_default, ...$asai.$lib.api };
   if (!$asai.$lib.ws) $asai.$lib.ws = {};
   $asai.$lib.ws = { ...ws_default, ...$asai.$lib.ws };
-}, "default");
+}
+__name(sysserver, "sysserver");
 
 // src/config/validate.ts
 function normalizeHostConfig(cfg) {
@@ -6306,6 +6133,12 @@ function normalizeUserStoreConfig(cfg) {
   } else if (store.type === "sqlite") {
     if (!store.opt.database) store.opt.database = "./webdata/webdb/users/users.db";
     if (store.opt.create == null) store.opt.create = 1;
+  } else if (store.type === "mysql") {
+    if (!store.opt.host) store.opt.host = "127.0.0.1";
+    if (!store.opt.user) store.opt.user = "root";
+    if (store.opt.password == null) store.opt.password = "";
+    if (!store.opt.database) store.opt.database = "asai";
+    if (store.opt.create == null) store.opt.create = 1;
   }
 }
 __name(normalizeUserStoreConfig, "normalizeUserStoreConfig");
@@ -6348,6 +6181,30 @@ function normalizeDataStoresConfig(cfg) {
   if (!stores.user && cfg.userStore) {
     stores.user = { type: cfg.userStore.type || "file", opt: { ...cfg.userStore.opt || {} } };
   }
+  if (!stores.user) {
+    stores.user = {
+      type: "file",
+      opt: { dir: "webdata/webdb/users/", ext: ".json", create: 1 }
+    };
+  }
+  if (stores.user && typeof stores.user === "object") {
+    const userStore = stores.user;
+    const userType = userStore.type || "file";
+    if (!userStore.type) userStore.type = "file";
+    if (!userStore.opt || typeof userStore.opt !== "object") userStore.opt = {};
+    if (userType === "file") {
+      if (!userStore.opt.dir) userStore.opt.dir = "webdata/webdb/users/";
+      if (!userStore.opt.ext) userStore.opt.ext = ".json";
+    } else if (userType === "sqlite") {
+      if (!userStore.opt.database) userStore.opt.database = "./webdata/webdb/users/users.db";
+    } else if (userType === "mysql") {
+      if (!userStore.opt.host) userStore.opt.host = "127.0.0.1";
+      if (!userStore.opt.user) userStore.opt.user = "root";
+      if (userStore.opt.password == null) userStore.opt.password = "";
+      if (!userStore.opt.database) userStore.opt.database = "asai";
+    }
+    if (userStore.opt.create == null) userStore.opt.create = 1;
+  }
   if (!stores.log && cfg.logger?.store) {
     const s = cfg.logger.store;
     stores.log = {
@@ -6674,10 +6531,10 @@ function hostDefault(mod) {
 }
 __name(hostDefault, "hostDefault");
 var hostMain = hostDefault(src_default);
-var initAsaiHost2 = {
+var initAsaiHostNodejs2 = {
   name: PLUGIN_NAME,
   fn: /* @__PURE__ */ __name(($asai, opt) => hostMain($asai, opt), "fn"),
-  sysserver: sysserver_default,
+  sysserver,
   AsaiCommon: Index_default,
   AsaiUtils: utils_exports,
   normalizeHostConfig,
@@ -6714,8 +6571,8 @@ var initAsaiHost2 = {
   createTransportDataHandler,
   wireTransportConnectionLogs
 };
-var PLUGIN_VERSION = true ? "0.0.1" : "0.0.1";
-var index_default = initAsaiHost2;
+var PLUGIN_VERSION = true ? "0.0.3" : "0.0.1";
+var index_default = initAsaiHostNodejs2;
 export {
   Index_default as AsaiCommon,
   utils_exports as AsaiUtils,
@@ -6730,7 +6587,7 @@ export {
   getTransportBlock,
   getTransportDefault,
   hasTransportDefault,
-  initAsaiHost2 as initAsaiHost,
+  initAsaiHostNodejs2 as initAsaiHostNodejs,
   initHostserverApi,
   initHostserverWs,
   initTransportBridge,
@@ -6751,7 +6608,7 @@ export {
   stripForbiddenSecretsFromHostConfig,
   syncApiRouteKeys,
   syncWsRouteKeys,
-  sysserver_default as sysserver,
+  sysserver,
   validateAsaiSecrets,
   validateHostConfig,
   validateHttpAuth,