asaihost-nodejs 0.0.5 → 0.0.8

package/dist/asaihost-nodejs.cjs

@@ -4,10 +4,10 @@
 
 
 
-var _chunkRIRKIYETcjs = require('./chunk-RIRKIYET.cjs');
+var _chunkARHPHWT5cjs = require('./chunk-ARHPHWT5.cjs');
 
 
-var _chunk4E7Z5K5Ucjs = require('./chunk-4E7Z5K5U.cjs');
+var _chunkU2YJH2RWcjs = require('./chunk-U2YJH2RW.cjs');
 
 
 
@@ -28,7 +28,9 @@ var _chunk4E7Z5K5Ucjs = require('./chunk-4E7Z5K5U.cjs');
 
 
 
-var _chunkTKJAHTPOcjs = require('./chunk-TKJAHTPO.cjs');
+
+
+var _chunkHR5JKN7Ycjs = require('./chunk-HR5JKN7Y.cjs');
 
 
 
@@ -48,7 +50,7 @@ var _chunkO6LVLSNBcjs = require('./chunk-O6LVLSNB.cjs');
 
 
 
-var _chunkK2QPSQEVcjs = require('./chunk-K2QPSQEV.cjs');
+var _chunkWXW5DYNUcjs = require('./chunk-WXW5DYNU.cjs');
 
 
 
@@ -60,7 +62,7 @@ var _chunkK2QPSQEVcjs = require('./chunk-K2QPSQEV.cjs');
 
 
 
-var _chunkLXJMGLKWcjs = require('./chunk-LXJMGLKW.cjs');
+var _chunkZK4O4Z2Ocjs = require('./chunk-ZK4O4Z2O.cjs');
 
 
 
@@ -73,7 +75,7 @@ var _chunkLXJMGLKWcjs = require('./chunk-LXJMGLKW.cjs');
 
 
 
-var _chunkH3K33HBAcjs = require('./chunk-H3K33HBA.cjs');
+var _chunkGXOFLFFWcjs = require('./chunk-GXOFLFFW.cjs');
 
 
 var _chunk2BCIIKRGcjs = require('./chunk-2BCIIKRG.cjs');
@@ -212,7 +214,7 @@ ${reason.name}: ${reason.message}`;
     if (restartTimes.length > MAX_RESTARTS) {
       try {
         $asai.$log("NO_RESTART", "Process crashed too frequently, gracefully shutdown and wait for daemon restart.");
-        void Promise.resolve().then(() => _interopRequireWildcard(require("./intervention-hooks-KF3SNB5Q.cjs"))).then(
+        void Promise.resolve().then(() => _interopRequireWildcard(require("./intervention-hooks-4NAAAZK3.cjs"))).then(
           ({ logProcessGuardEvent }) => logProcessGuardEvent($asai, {
             action: "crash_loop_shutdown",
             detail: `${restartTimes.length} crashes in ${RESTART_WINDOW}ms window`,
@@ -254,7 +256,7 @@ ${reason.name}: ${reason.message}`;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, initProcess, "initProcess");
 function gracefulShutdown($asai) {
-  void Promise.resolve().then(() => _interopRequireWildcard(require("./intervention-hooks-KF3SNB5Q.cjs"))).then(
+  void Promise.resolve().then(() => _interopRequireWildcard(require("./intervention-hooks-4NAAAZK3.cjs"))).then(
     ({ logProcessGuardEvent }) => logProcessGuardEvent($asai, {
       action: "graceful_shutdown",
       detail: "SIGTERM/SIGINT or crash guard triggered",
@@ -379,7 +381,7 @@ var LogBuffer = class _LogBuffer {
       await _promises2.default.appendFile(this.filePath, logContent, "utf8");
       const src = this.filePath.includes("/client/") || this.filePath.includes("\\client\\") ? "client" : "server";
       const kind = logContent.includes("[SEC-AUDIT]") ? "sec" : src;
-      void _chunkTKJAHTPOcjs.mirrorWebLog.call(void 0, this.$asai, {
+      void _chunkHR5JKN7Ycjs.mirrorWebLog.call(void 0, this.$asai, {
         source: kind === "sec" ? "sec" : src,
         rawLine: logContent
       }).catch(() => void 0);
@@ -480,7 +482,7 @@ async function appendAccessLog($asai, clfLine, w3cLine) {
     await ensureW3CAccessHeader($asai, w3cPath, dateCur);
     await _promises2.default.appendFile(w3cPath, w3cLine, "utf8");
     const clfParsed = _chunkOCEBEEP5cjs.parseCLF.call(void 0, clfLine);
-    void _chunkTKJAHTPOcjs.mirrorAccessLog.call(void 0, $asai, {
+    void _chunkHR5JKN7Ycjs.mirrorAccessLog.call(void 0, $asai, {
       format: "clf",
       rawLine: clfLine,
       host: _optionalChain([clfParsed, 'optionalAccess', _42 => _42.host]),
@@ -488,7 +490,7 @@ async function appendAccessLog($asai, clfLine, w3cLine) {
       url: _optionalChain([clfParsed, 'optionalAccess', _44 => _44.url]),
       status: _optionalChain([clfParsed, 'optionalAccess', _45 => _45.status])
     }).catch(() => void 0);
-    void _chunkTKJAHTPOcjs.mirrorAccessLog.call(void 0, $asai, {
+    void _chunkHR5JKN7Ycjs.mirrorAccessLog.call(void 0, $asai, {
       format: "w3c",
       rawLine: w3cLine
     }).catch(() => void 0);
@@ -812,8 +814,8 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, checkNtpOffset, "checkNtpOffset");
 
 // src/infra/config-integrity.ts
 var _crypto = require('crypto'); var _crypto2 = _interopRequireDefault(_crypto);
-var _fs = require('fs'); var fs3 = _interopRequireWildcard(_fs); var fs6 = _interopRequireWildcard(_fs); var fs4 = _interopRequireWildcard(_fs); var fs5 = _interopRequireWildcard(_fs); var fs8 = _interopRequireWildcard(_fs); var fs10 = _interopRequireWildcard(_fs); var fs11 = _interopRequireWildcard(_fs);
-var _path = require('path'); var nodePath2 = _interopRequireWildcard(_path); var path2 = _interopRequireWildcard(_path); var nodePath = _interopRequireWildcard(_path); var nodePath3 = _interopRequireWildcard(_path); var nodePath4 = _interopRequireWildcard(_path); var path5 = _interopRequireWildcard(_path); var path6 = _interopRequireWildcard(_path);
+var _fs = require('fs'); var fs3 = _interopRequireWildcard(_fs); var fs6 = _interopRequireWildcard(_fs); var fs4 = _interopRequireWildcard(_fs); var fs5 = _interopRequireWildcard(_fs); var fs8 = _interopRequireWildcard(_fs); var fs10 = _interopRequireWildcard(_fs);
+var _path = require('path'); var nodePath2 = _interopRequireWildcard(_path); var path2 = _interopRequireWildcard(_path); var nodePath = _interopRequireWildcard(_path); var nodePath3 = _interopRequireWildcard(_path); var path4 = _interopRequireWildcard(_path); var path6 = _interopRequireWildcard(_path); var path7 = _interopRequireWildcard(_path);
 function computeConfigHash(configPath) {
   try {
     const raw = fs3.default.readFileSync(configPath);
@@ -867,12 +869,12 @@ function initAsaiHostNodejs($asai, _opt) {
       resAES
     };
   }
-  if (_chunkLXJMGLKWcjs.isDevDefaultPassword.call(void 0, _optionalChain([$asai, 'access', _102 => _102.hostconfig, 'optionalAccess', _103 => _103.password]) || "")) {
+  if (_chunkZK4O4Z2Ocjs.isDevDefaultPassword.call(void 0, _optionalChain([$asai, 'access', _102 => _102.hostconfig, 'optionalAccess', _103 => _103.password]) || "")) {
     logSecurityEvent($asai, {
       type: "CONFIG_WARN",
       detail: "Using dev-only password; set ASAI_HOST_PASSWORD for production (IEC 62443-4-2 CR 1.7)"
     });
-    void Promise.resolve().then(() => _interopRequireWildcard(require("./intervention-hooks-KF3SNB5Q.cjs"))).then(
+    void Promise.resolve().then(() => _interopRequireWildcard(require("./intervention-hooks-4NAAAZK3.cjs"))).then(
       ({ logSecurityConfigIntervention: logSecurityConfigIntervention2 }) => logSecurityConfigIntervention2($asai, {
         section: "password",
         detail: "dev-default-password detected at startup"
@@ -898,7 +900,7 @@ function scheduleLogComplianceCheck($asai) {
   if (hours <= 0) return;
   const ms = hours * 3600 * 1e3;
   setInterval(() => {
-    void Promise.resolve().then(() => _interopRequireWildcard(require("./LogStore-7MTUQA4G.cjs"))).then(
+    void Promise.resolve().then(() => _interopRequireWildcard(require("./LogStore-AP4T2CFD.cjs"))).then(
       ({ getComplianceReport: getComplianceReport2 }) => getComplianceReport2($asai, "prod")
     ).catch(() => void 0);
   }, ms);
@@ -996,7 +998,7 @@ function kickUserWs($asai, us, hostdir) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, kickUserWs, "kickUserWs");
 async function removeSessionOnWsClose($asai, us, token) {
   try {
-    const store = _chunkLXJMGLKWcjs.createUserStore.call(void 0, $asai);
+    const store = _chunkZK4O4Z2Ocjs.createUserStore.call(void 0, $asai);
     const sessions = await store.getSessions();
     const match = sessions.find((s) => s.us === us && s.pub === token);
     if (match) await store.removeSession(match.id);
@@ -1458,11 +1460,11 @@ function createSkipChecker($asai) {
   }
   if (exact.size === 0 && prefixes.length === 0) return () => false;
   return (url) => {
-    const path7 = normalizeRequestPath(url);
-    if (!path7) return false;
-    if (exact.has(path7)) return true;
+    const path8 = normalizeRequestPath(url);
+    if (!path8) return false;
+    if (exact.has(path8)) return true;
     for (let i = 0; i < prefixes.length; i++) {
-      if (path7.startsWith(prefixes[i])) return true;
+      if (path8.startsWith(prefixes[i])) return true;
     }
     return false;
   };
@@ -1582,10 +1584,10 @@ function getStaticBaseDirs($asai) {
       bases.push(abs);
     }
   }, "add");
+  if ($asai.serverRoot) add($asai.serverRoot);
   if (Array.isArray($asai.runtimeBaseDirs)) {
     for (const b of $asai.runtimeBaseDirs) add(b);
   }
-  if ($asai.serverRoot) add($asai.serverRoot);
   if ($asai.pkgSnapshotDir) add($asai.pkgSnapshotDir);
   return bases;
 }
@@ -1652,6 +1654,11 @@ function parseUrlPath(requrl) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, parseUrlPath, "parseUrlPath");
 var STATIC_ASSET_PREFIXES = ["/assets/", "/webmodel/", "/assets/entry/", "/assets/chunk/"];
+function isMutableWebmodelConfig(urlPath) {
+  const p = parseUrlPath(urlPath);
+  return /^\/webmodel\/sys\/setting\/[^/]+\.json$/i.test(p);
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, isMutableWebmodelConfig, "isMutableWebmodelConfig");
 function isStaticAssetPath(urlPath, indexFile) {
   const p = parseUrlPath(urlPath);
   const base = p.split("/").pop() || "";
@@ -1660,9 +1667,10 @@ function isStaticAssetPath(urlPath, indexFile) {
   return /\.(css|js|mjs|cjs|json|png|jpe?g|gif|svg|ico|woff2?|ttf|map|wasm|zip)(\?|$)/i.test(p);
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, isStaticAssetPath, "isStaticAssetPath");
-function sendStaticBuffer(req, res, data, mimeType, mtimeMs, $asai) {
+function sendStaticBuffer(req, res, data, mimeType, mtimeMs, $asai, urlPath = "") {
   const etag = `"${data.length}-${mtimeMs}"`;
-  if (req.headers["if-none-match"] === etag) {
+  const noCache = isMutableWebmodelConfig(urlPath);
+  if (!noCache && req.headers["if-none-match"] === etag) {
     res.writeHead(304);
     res.end();
     return;
@@ -1671,7 +1679,7 @@ function sendStaticBuffer(req, res, data, mimeType, mtimeMs, $asai) {
     res.writeHead(200, {
       "Content-Type": mimeType,
       "Content-Length": data.length,
-      "Cache-Control": "public, max-age=3600",
+      "Cache-Control": noCache ? "no-cache, must-revalidate" : "public, max-age=3600",
       ETag: etag,
       "Last-Modified": new Date(mtimeMs).toUTCString()
     });
@@ -1685,7 +1693,8 @@ function sendStaticBuffer(req, res, data, mimeType, mtimeMs, $asai) {
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, sendStaticBuffer, "sendStaticBuffer");
-function serveStaticFile(req, res, foundPath, mimeType, stat, $asai) {
+function serveStaticFile(req, res, foundPath, mimeType, stat, $asai, urlPath = "") {
+  const noCache = isMutableWebmodelConfig(urlPath);
   if (stat.size <= STATIC_READ_MAX) {
     fs6.readFile(foundPath, (err, data) => {
       if (err) {
@@ -1696,13 +1705,13 @@ function serveStaticFile(req, res, foundPath, mimeType, stat, $asai) {
         }
         return;
       }
-      sendStaticBuffer(req, res, data, mimeType, stat.mtimeMs, $asai);
+      sendStaticBuffer(req, res, data, mimeType, stat.mtimeMs, $asai, urlPath);
     });
     return;
   }
   const readStream = fs6.createReadStream(foundPath);
   const etag = `"${stat.size}-${stat.mtimeMs}"`;
-  if (req.headers["if-none-match"] === etag) {
+  if (!noCache && req.headers["if-none-match"] === etag) {
     readStream.destroy();
     res.writeHead(304);
     res.end();
@@ -1721,7 +1730,7 @@ function serveStaticFile(req, res, foundPath, mimeType, stat, $asai) {
   try {
     res.writeHead(200, {
       "Content-Type": mimeType,
-      "Cache-Control": "public, max-age=3600",
+      "Cache-Control": noCache ? "no-cache, must-revalidate" : "public, max-age=3600",
       ETag: etag,
       "Last-Modified": stat.mtime.toUTCString()
     });
@@ -1779,7 +1788,7 @@ function createStaticHandler(ctx) {
       return;
     }
     const mimeType = _optionalChain([hostcfg, 'access', _192 => _192.mimetypes, 'optionalAccess', _193 => _193[nodePath2.extname(found.filePath)]]) || "application/octet-stream";
-    serveStaticFile(req, res, found.filePath, mimeType, found.stat, $asai);
+    serveStaticFile(req, res, found.filePath, mimeType, found.stat, $asai, processedUrl);
   }, "showHostDirs");
   return (req, res, url) => {
     res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
@@ -2342,7 +2351,7 @@ async function attachServerUserLevel(req, $asai) {
   if (!Array.isArray(userinfo) || !userinfo[0]) return;
   const us = String(userinfo[0]);
   try {
-    const { createUserStore: createUserStore2 } = await Promise.resolve().then(() => _interopRequireWildcard(require("./user-store-6J2PSEIN.cjs")));
+    const { createUserStore: createUserStore2 } = await Promise.resolve().then(() => _interopRequireWildcard(require("./user-store-55HOLHEM.cjs")));
     const user = await createUserStore2($asai).findByUsername(us);
     if (user && user.status === "active") {
       req._serverUser = { us: user.us, lv: user.lv, status: user.status };
@@ -2373,11 +2382,11 @@ function getSecurityConfig($asai) {
   return _optionalChain([$asai, 'optionalAccess', _269 => _269.hostconfig, 'optionalAccess', _270 => _270.security]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSecurityConfig, "getSecurityConfig");
-function pathMatchesPattern(path7, pattern) {
+function pathMatchesPattern(path8, pattern) {
   if (pattern.endsWith("*")) {
-    return path7.startsWith(pattern.slice(0, -1));
+    return path8.startsWith(pattern.slice(0, -1));
   }
-  return path7 === pattern;
+  return path8 === pattern;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, pathMatchesPattern, "pathMatchesPattern");
 function isAuthSkipped($asai, pathname) {
@@ -2555,6 +2564,10 @@ function isRawUploadPost(url = "") {
   return /\/api\/asaifile\/manage\/up(?:base64|binary)(?:batch)?\//.test(url);
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, isRawUploadPost, "isRawUploadPost");
+function isPlainSourcePost(url = "") {
+  return /\/api\/robotcode\//.test(url);
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, isPlainSourcePost, "isPlainSourcePost");
 function processPostPayload($asai, req, postdata, pm) {
   let isAes = false;
   let out = postdata;
@@ -2570,7 +2583,7 @@ function processPostPayload($asai, req, postdata, pm) {
     }
   }
   const plainJson = typeof out === "string" && out.trimStart().startsWith("{");
-  if (_optionalChain([req, 'optionalAccess', _280 => _280.Userinfo, 'optionalAccess', _281 => _281[2]]) && !plainJson && !isRawUploadPost(_optionalChain([req, 'optionalAccess', _282 => _282.url]))) {
+  if (_optionalChain([req, 'optionalAccess', _280 => _280.Userinfo, 'optionalAccess', _281 => _281[2]]) && !plainJson && !isRawUploadPost(_optionalChain([req, 'optionalAccess', _282 => _282.url])) && !isPlainSourcePost(_optionalChain([req, 'optionalAccess', _283 => _283.url]))) {
     pm = req.Userinfo[2];
     out = $asai.$lib.AsCode.asdecode(out, pm);
   }
@@ -2578,7 +2591,7 @@ function processPostPayload($asai, req, postdata, pm) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, processPostPayload, "processPostPayload");
 var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _283 => _283.fn, 'optionalCall', _284 => _284($asai)]);
+  _optionalChain([opt, 'optionalAccess', _284 => _284.fn, 'optionalCall', _285 => _285($asai)]);
   function getHeader(req, key) {
     return req.headers[key.toLowerCase()] || "";
   }
@@ -2587,7 +2600,7 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   let apiRouteCacheLen = -1;
   function findApiHandler($asai2, pathname) {
     const apis = $asai2.hostserverapis;
-    if (!_optionalChain([apis, 'optionalAccess', _285 => _285.length])) return void 0;
+    if (!_optionalChain([apis, 'optionalAccess', _286 => _286.length])) return void 0;
     if (!apiRouteCache || apiRouteCacheLen !== apis.length) {
       apiRouteCache = apis.map((elp) => ({ key: elp, path: `/api/${elp}` }));
       apiRouteCacheLen = apis.length;
@@ -2635,9 +2648,9 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
           pm: decodeURIComponent(urlParse.search.substring(4))
         };
         if (req.url.indexOf("binary") === -1) {
-          if (_optionalChain([req, 'optionalAccess', _286 => _286.Userinfo]) && _optionalChain([req, 'optionalAccess', _287 => _287.Userinfo, 'access', _288 => _288[2]]) && _optionalChain([query, 'optionalAccess', _289 => _289.pm])) {
+          if (_optionalChain([req, 'optionalAccess', _287 => _287.Userinfo]) && _optionalChain([req, 'optionalAccess', _288 => _288.Userinfo, 'access', _289 => _289[2]]) && _optionalChain([query, 'optionalAccess', _290 => _290.pm])) {
             pm = req.Userinfo[2];
-            query = $asai.$lib.AsCode.asdecode(_optionalChain([query, 'optionalAccess', _290 => _290.pm]), pm);
+            query = $asai.$lib.AsCode.asdecode(_optionalChain([query, 'optionalAccess', _291 => _291.pm]), pm);
             query = Object.fromEntries(new URLSearchParams("?" + query).entries());
           }
         }
@@ -2656,87 +2669,99 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       const releaseSlot = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, () => releaseApiSlot(hostdir, clientIp), "releaseSlot");
       res.once("finish", releaseSlot);
       res.once("close", releaseSlot);
-      const maxBody = _optionalChain([$asai, 'access', _291 => _291.hostconfig, 'optionalAccess', _292 => _292.maxbody]) || 100 * 1024 * 1024;
+      const maxBody = _optionalChain([$asai, 'access', _292 => _292.hostconfig, 'optionalAccess', _293 => _293.maxbody]) || 100 * 1024 * 1024;
       const isTextPost = req.method === "POST" && req.url.indexOf("binary") === -1;
       const bodyPromise = isTextPost ? readRequestBody(req, maxBody) : null;
       void (async () => {
-        let authResult;
-        let rawBody = "";
         try {
-          [authResult, rawBody] = await Promise.all([
-            validateHttpAuthAsync(req, $asai, pathname),
-            _nullishCoalesce(bodyPromise, () => ( Promise.resolve("")))
-          ]);
-        } catch (err) {
-          releaseSlot();
-          if (_optionalChain([err, 'optionalAccess', _293 => _293.message]) === "PAYLOAD_TOO_LARGE") {
-            return sendError(res, 413, "Payload Too Large");
-          }
-          return sendError(res, 400, _optionalChain([err, 'optionalAccess', _294 => _294.message]) || "Bad Request");
-        }
-        if (!authResult.ok) {
-          releaseSlot();
-          return sendAuthError(res, authResult);
-        }
-        let apiFn = _optionalChain([$asai, 'access', _295 => _295.hostserverapi, 'access', _296 => _296[apiHandlerKey], 'optionalCall', _297 => _297($asai, query)]);
-        if (!apiFn) {
-          return sendError(res, 501, "Not Implemented");
-        }
-        res.setHeader("Content-Type", "application/json; charset=utf-8");
-        $asai.$log("API", req.method, urlParse.pathname, query);
-        let qrdata;
-        let postdata;
-        if (req.url.indexOf("binary") === -1) {
-          qrdata = query;
-          if (req.method === "POST") {
-            try {
-              const processed = processPostPayload($asai, req, rawBody, pm);
-              postdata = processed.postdata;
-              pm = processed.pm;
-              isAes = processed.isAes;
-            } catch (e35) {
-              return sendError(res, 400, "AES decrypt failed");
-            }
-            if (_optionalChain([apiFn, 'optionalAccess', _298 => _298.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _299 => _299.post]) === "function") {
-              const optTmp = { qrdata, data: postdata, pm };
-              if (isAes || _optionalChain([$asai, 'access', _300 => _300.$lib, 'access', _301 => _301.aesfns, 'optionalAccess', _302 => _302.allaes])) {
-                optTmp.resAES = _optionalChain([$asai, 'access', _303 => _303.$lib, 'access', _304 => _304.aesfns, 'optionalAccess', _305 => _305.resAES]);
-              }
-              apiFn.post(req, res, hostdir, optTmp);
-            } else {
-              res.end(typeof postdata === "string" ? postdata : JSON.stringify(_nullishCoalesce(postdata, () => ( ""))));
-            }
-          } else if (req.method === "GET") {
-            if (_optionalChain([apiFn, 'optionalAccess', _306 => _306.get]) && typeof _optionalChain([apiFn, 'optionalAccess', _307 => _307.get]) === "function") {
-              const optTmp = { qrdata, data: qrdata, pm };
-              if (isAes || _optionalChain([$asai, 'access', _308 => _308.$lib, 'access', _309 => _309.aesfns, 'optionalAccess', _310 => _310.allaes])) {
-                optTmp.resAES = _optionalChain([$asai, 'access', _311 => _311.$lib, 'access', _312 => _312.aesfns, 'optionalAccess', _313 => _313.resAES]);
-              }
-              apiFn.get(req, res, hostdir, optTmp);
-            } else {
-              res.end(JSON.stringify(qrdata));
+          let authResult;
+          let rawBody = "";
+          try {
+            [authResult, rawBody] = await Promise.all([
+              validateHttpAuthAsync(req, $asai, pathname),
+              _nullishCoalesce(bodyPromise, () => ( Promise.resolve("")))
+            ]);
+          } catch (err) {
+            releaseSlot();
+            if (_optionalChain([err, 'optionalAccess', _294 => _294.message]) === "PAYLOAD_TOO_LARGE") {
+              return sendError(res, 413, "Payload Too Large");
             }
+            return sendError(res, 400, _optionalChain([err, 'optionalAccess', _295 => _295.message]) || "Bad Request");
           }
-        } else {
-          if (_optionalChain([Object, 'access', _314 => _314.keys, 'call', _315 => _315(query), 'optionalAccess', _316 => _316.length])) {
-            qrdata = query;
+          if (!authResult.ok) {
+            releaseSlot();
+            return sendAuthError(res, authResult);
           }
-          if (req.method === "POST") {
-            $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
-              if (_optionalChain([apiFn, 'optionalAccess', _317 => _317.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _318 => _318.post]) === "function") {
-                apiFn.post(req, res, hostdir, {
-                  qrdata,
-                  data: postdata2
-                });
+          let apiFn = _optionalChain([$asai, 'access', _296 => _296.hostserverapi, 'access', _297 => _297[apiHandlerKey], 'optionalCall', _298 => _298($asai, query)]);
+          if (!apiFn) {
+            return sendError(res, 501, "Not Implemented");
+          }
+          res.setHeader("Content-Type", "application/json; charset=utf-8");
+          $asai.$log("API", req.method, urlParse.pathname, query);
+          let qrdata;
+          let postdata;
+          if (req.url.indexOf("binary") === -1) {
+            qrdata = query;
+            if (req.method === "POST") {
+              try {
+                const processed = processPostPayload($asai, req, rawBody, pm);
+                postdata = processed.postdata;
+                pm = processed.pm;
+                isAes = processed.isAes;
+              } catch (e35) {
+                return sendError(res, 400, "AES decrypt failed");
+              }
+              if (_optionalChain([apiFn, 'optionalAccess', _299 => _299.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _300 => _300.post]) === "function") {
+                const optTmp = { qrdata, data: postdata, pm };
+                if (isAes || _optionalChain([$asai, 'access', _301 => _301.$lib, 'access', _302 => _302.aesfns, 'optionalAccess', _303 => _303.allaes])) {
+                  optTmp.resAES = _optionalChain([$asai, 'access', _304 => _304.$lib, 'access', _305 => _305.aesfns, 'optionalAccess', _306 => _306.resAES]);
+                }
+                apiFn.post(req, res, hostdir, optTmp);
               } else {
-                res.end(postdata2);
+                res.end(typeof postdata === "string" ? postdata : JSON.stringify(_nullishCoalesce(postdata, () => ( ""))));
               }
-            }).catch((err) => {
-              return sendError(res, 400, "Invalid content type");
-            });
+            } else if (req.method === "GET") {
+              if (_optionalChain([apiFn, 'optionalAccess', _307 => _307.get]) && typeof _optionalChain([apiFn, 'optionalAccess', _308 => _308.get]) === "function") {
+                const optTmp = { qrdata, data: qrdata, pm };
+                if (isAes || _optionalChain([$asai, 'access', _309 => _309.$lib, 'access', _310 => _310.aesfns, 'optionalAccess', _311 => _311.allaes])) {
+                  optTmp.resAES = _optionalChain([$asai, 'access', _312 => _312.$lib, 'access', _313 => _313.aesfns, 'optionalAccess', _314 => _314.resAES]);
+                }
+                apiFn.get(req, res, hostdir, optTmp);
+              } else {
+                res.end(JSON.stringify(qrdata));
+              }
+            }
+          } else {
+            if (_optionalChain([Object, 'access', _315 => _315.keys, 'call', _316 => _316(query), 'optionalAccess', _317 => _317.length])) {
+              qrdata = query;
+            }
+            if (req.method === "POST") {
+              $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
+                if (_optionalChain([apiFn, 'optionalAccess', _318 => _318.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _319 => _319.post]) === "function") {
+                  apiFn.post(req, res, hostdir, {
+                    qrdata,
+                    data: postdata2
+                  });
+                } else {
+                  res.end(postdata2);
+                }
+              }).catch((err) => {
+                return sendError(res, 400, "Invalid content type");
+              });
+            }
+          }
+        } catch (err) {
+          releaseSlot();
+          if (!res.headersSent) {
+            return sendError(res, 500, _optionalChain([err, 'optionalAccess', _320 => _320.message]) || "Internal Server Error");
           }
         }
-      })();
+      })().catch((err) => {
+        releaseSlot();
+        if (!res.headersSent) {
+          sendError(res, 500, _optionalChain([err, 'optionalAccess', _321 => _321.message]) || "Internal Server Error");
+        }
+      });
     } else {
       $asai.$log("API", req.method, req.url);
     }
@@ -2747,12 +2772,12 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 
 // src/common/server/Ws.ts
 var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _319 => _319.fn, 'optionalCall', _320 => _320($asai)]);
+  _optionalChain([opt, 'optionalAccess', _322 => _322.fn, 'optionalCall', _323 => _323($asai)]);
   const wsHandlerCache = /* @__PURE__ */ new Map();
   const routeIndex = ensureWsRouteIndex($asai);
   function getWsHandler(handlerKey) {
     if (!wsHandlerCache.has(handlerKey)) {
-      wsHandlerCache.set(handlerKey, _optionalChain([$asai, 'access', _321 => _321.hostserverws, 'access', _322 => _322[handlerKey], 'optionalCall', _323 => _323($asai)]));
+      wsHandlerCache.set(handlerKey, _optionalChain([$asai, 'access', _324 => _324.hostserverws, 'access', _325 => _325[handlerKey], 'optionalCall', _326 => _326($asai)]));
     }
     return wsHandlerCache.get(handlerKey);
   }
@@ -2776,21 +2801,21 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
       let reqdata = parseMessage(msg);
       let handlerKey;
       if (reqdata === "ping") {
-        _optionalChain([ws2, 'access', _324 => _324.send, 'optionalCall', _325 => _325("pong")]);
+        _optionalChain([ws2, 'access', _327 => _327.send, 'optionalCall', _328 => _328("pong")]);
         return;
       } else {
         const reqdataisobj = typeof reqdata === "object" && reqdata !== null;
-        handlerKey = reqdataisobj ? routeIndex.matchTy(_optionalChain([reqdata, 'optionalAccess', _326 => _326.ty])) : routeIndex.matchString(reqdata);
-        if (!handlerKey && _optionalChain([$asai, 'access', _327 => _327.hostserverwss, 'optionalAccess', _328 => _328.length])) {
+        handlerKey = reqdataisobj ? routeIndex.matchTy(_optionalChain([reqdata, 'optionalAccess', _329 => _329.ty])) : routeIndex.matchString(reqdata);
+        if (!handlerKey && _optionalChain([$asai, 'access', _330 => _330.hostserverwss, 'optionalAccess', _331 => _331.length])) {
           handlerKey = $asai.hostserverwss.find((elp) => {
             if (reqdataisobj) {
-              return _optionalChain([reqdata, 'optionalAccess', _329 => _329.ty, 'optionalAccess', _330 => _330.startsWith, 'call', _331 => _331(elp)]);
+              return _optionalChain([reqdata, 'optionalAccess', _332 => _332.ty, 'optionalAccess', _333 => _333.startsWith, 'call', _334 => _334(elp)]);
             }
             return typeof reqdata === "string" && reqdata.startsWith(elp);
           });
         }
         if (!handlerKey) {
-          _optionalChain([$asai, 'access', _332 => _332.asaimock, 'optionalAccess', _333 => _333.wsWorkMock, 'call', _334 => _334({
+          _optionalChain([$asai, 'access', _335 => _335.asaimock, 'optionalAccess', _336 => _336.wsWorkMock, 'call', _337 => _337({
             msg,
             ws: ws2,
             hostdir,
@@ -2802,14 +2827,14 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
         }
       }
       if (!handlerKey) return;
-      _optionalChain([getWsHandler, 'call', _335 => _335(handlerKey), 'optionalAccess', _336 => _336.work, 'optionalCall', _337 => _337(reqdata, ws2, hostdir, req)]);
+      _optionalChain([getWsHandler, 'call', _338 => _338(handlerKey), 'optionalAccess', _339 => _339.work, 'optionalCall', _340 => _340(reqdata, ws2, hostdir, req)]);
     } catch (err) {
-      _optionalChain([($asai.$log || console.error), 'optionalCall', _338 => _338("WS", "handler error", err instanceof Error ? err.message : err)]);
+      _optionalChain([($asai.$log || console.error), 'optionalCall', _341 => _341("WS", "handler error", err instanceof Error ? err.message : err)]);
     }
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, wsWork, "wsWork");
   function _getMessage(msg) {
-    if (_optionalChain([msg, 'optionalAccess', _339 => _339.db, 'optionalAccess', _340 => _340.aes]) && _optionalChain([$asai, 'access', _341 => _341.$lib, 'optionalAccess', _342 => _342.aesfns, 'optionalAccess', _343 => _343.reqAES])) {
+    if (_optionalChain([msg, 'optionalAccess', _342 => _342.db, 'optionalAccess', _343 => _343.aes]) && _optionalChain([$asai, 'access', _344 => _344.$lib, 'optionalAccess', _345 => _345.aesfns, 'optionalAccess', _346 => _346.reqAES])) {
       msg.db = $asai.$lib.aesfns.reqAES({ data: msg.db });
     }
     return msg;
@@ -2836,12 +2861,12 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
 
 // src/common/server/Sys.ts
 var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _344 => _344.fn, 'optionalCall', _345 => _345($asai)]);
+  _optionalChain([opt, 'optionalAccess', _347 => _347.fn, 'optionalCall', _348 => _348($asai)]);
   let sysRouteCache = null;
   let sysRouteCacheLen = -1;
   function findSystemHandler(req) {
     const routes = $asai.hostserversyss;
-    if (!_optionalChain([routes, 'optionalAccess', _346 => _346.length])) return void 0;
+    if (!_optionalChain([routes, 'optionalAccess', _349 => _349.length])) return void 0;
     if (!sysRouteCache || sysRouteCacheLen !== routes.length) {
       sysRouteCache = routes.map((elp) => ({ key: elp, route: `/${elp}` }));
       sysRouteCacheLen = routes.length;
@@ -2870,27 +2895,28 @@ var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     }
     const urlPath = (req.url || "").split("?")[0];
     void (async () => {
-      const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
-      if (!authResult.ok) {
-        return sendAuthError(res, authResult);
-      }
-      const handler = _optionalChain([$asai, 'access', _347 => _347.hostserversys, 'access', _348 => _348[handlerKey], 'optionalCall', _349 => _349($asai)]);
-      if (!handler) {
-        return sendError(res, 500, "Handler Initialization Failed");
-      }
-      if (_optionalChain([handler, 'optionalAccess', _350 => _350.show]) && typeof _optionalChain([handler, 'optionalAccess', _351 => _351.show]) === "function") {
-        handler.show(req, res, hostdir);
-      } else {
-        res.end("postdata");
+      try {
+        const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
+        if (!authResult.ok) {
+          return sendAuthError(res, authResult);
+        }
+        const handler = _optionalChain([$asai, 'access', _350 => _350.hostserversys, 'access', _351 => _351[handlerKey], 'optionalCall', _352 => _352($asai)]);
+        if (!handler) {
+          return sendError(res, 500, "Handler Initialization Failed");
+        }
+        if (_optionalChain([handler, 'optionalAccess', _353 => _353.show]) && typeof _optionalChain([handler, 'optionalAccess', _354 => _354.show]) === "function") {
+          handler.show(req, res, hostdir);
+        } else {
+          res.end("postdata");
+        }
+      } catch (err) {
+        return sendError(res, 500, _optionalChain([err, 'optionalAccess', _355 => _355.message]) || "Internal Server Error");
       }
-      if (!handler) {
-        res.writeHead(404, {
-          "Content-Type": "application/json; charset=utf-8"
-        });
-        res.end(req.url);
-      } else {
+    })().catch((err) => {
+      if (!res.headersSent) {
+        sendError(res, 500, _optionalChain([err, 'optionalAccess', _356 => _356.message]) || "Internal Server Error");
       }
-    })();
+    });
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sysWork, "sysWork");
   return { sysWork };
@@ -2898,14 +2924,14 @@ var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 
 // src/common/server/WsClient.ts
 var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, wsname) => {
-  if (!_optionalChain([$asai, 'optionalAccess', _352 => _352.clientws])) {
+  if (!_optionalChain([$asai, 'optionalAccess', _357 => _357.clientws])) {
     $asai.clientws = {};
   }
   if (!$asai.clientws[wsname]) {
     $asai.clientws[wsname] = { tasks: /* @__PURE__ */ new Map() };
   }
   function getKeyByData(msgdata) {
-    return _optionalChain([msgdata, 'optionalAccess', _353 => _353.id]) || _optionalChain([msgdata, 'optionalAccess', _354 => _354.ty]);
+    return _optionalChain([msgdata, 'optionalAccess', _358 => _358.id]) || _optionalChain([msgdata, 'optionalAccess', _359 => _359.ty]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getKeyByData, "getKeyByData");
   function clientwsInit() {
@@ -2918,7 +2944,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
       };
       $asai.clientws[wsname].socket.on("error", (err) => {
         $asai.clientws[wsname].open = 0;
-        _optionalChain([$asai, 'access', _355 => _355.hostconfig, 'access', _356 => _356.logger, 'optionalAccess', _357 => _357.lv, 'optionalAccess', _358 => _358.view]) && console.error(
+        _optionalChain([$asai, 'access', _360 => _360.hostconfig, 'access', _361 => _361.logger, 'optionalAccess', _362 => _362.lv, 'optionalAccess', _363 => _363.view]) && console.error(
           666.2203,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is error.`,
           err
@@ -2927,14 +2953,14 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
       });
       $asai.clientws[wsname].socket.on("close", () => {
         $asai.clientws[wsname].open = 0;
-        _optionalChain([$asai, 'access', _359 => _359.hostconfig, 'access', _360 => _360.logger, 'optionalAccess', _361 => _361.lv, 'optionalAccess', _362 => _362.view]) && console.error(
+        _optionalChain([$asai, 'access', _364 => _364.hostconfig, 'access', _365 => _365.logger, 'optionalAccess', _366 => _366.lv, 'optionalAccess', _367 => _367.view]) && console.error(
           666.2205,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is close.`
         );
         reject();
       });
       $asai.clientws[wsname].socket.onopen = () => {
-        _optionalChain([$asai, 'access', _363 => _363.hostconfig, 'access', _364 => _364.logger, 'optionalAccess', _365 => _365.lv, 'optionalAccess', _366 => _366.view]) && console.log(
+        _optionalChain([$asai, 'access', _368 => _368.hostconfig, 'access', _369 => _369.logger, 'optionalAccess', _370 => _370.lv, 'optionalAccess', _371 => _371.view]) && console.log(
           666.2201,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is open.`
         );
@@ -2957,7 +2983,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
         const key = getKeyByData(messageData);
         const task = $asai.clientws[wsname].tasks.get(key);
         if (task) {
-          _optionalChain([task, 'optionalAccess', _367 => _367.callback, 'call', _368 => _368(messageData)]);
+          _optionalChain([task, 'optionalAccess', _372 => _372.callback, 'call', _373 => _373(messageData)]);
           if (messageData.ty && !messageData.id) {
           } else {
             $asai.clientws[wsname].tasks.delete(key);
@@ -3011,7 +3037,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, clientwsWatch, "clientwsWatch");
   function clientwsWatchOff(messageData) {
-    if (_optionalChain([messageData, 'optionalAccess', _369 => _369.ty]) === "clear") {
+    if (_optionalChain([messageData, 'optionalAccess', _374 => _374.ty]) === "clear") {
       $asai.clientws[wsname].tasks = /* @__PURE__ */ new Map();
     } else {
       const key = getKeyByData(messageData);
@@ -3052,7 +3078,7 @@ var ping_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai)
 var web_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
   function chatBoard(msgdata, ws2, hostdir, req) {
     let room;
-    if (_optionalChain([msgdata, 'access', _370 => _370.db, 'optionalAccess', _371 => _371.room]) && typeof msgdata.db.room === "string") {
+    if (_optionalChain([msgdata, 'access', _375 => _375.db, 'optionalAccess', _376 => _376.room]) && typeof msgdata.db.room === "string") {
       room = msgdata.db.room;
       delete msgdata.db.room;
     } else {
@@ -3109,26 +3135,26 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     removeFile: removeFile2,
     resolvePathUnderBase: resolvePathUnderBase2
   } = $asai.$lib.AsFs;
-  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'access', _372 => _372.$lib, 'optionalAccess', _373 => _373.reqWork, 'optionalCall', _374 => _374($asai)]);
+  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'access', _377 => _377.$lib, 'optionalAccess', _378 => _378.reqWork, 'optionalCall', _379 => _379($asai)]);
   function mgLog(...arg) {
     mnLog("LOG", ...arg);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mgLog, "mgLog");
   function getDir(opt) {
-    let tmpDir = _optionalChain([opt, 'access', _375 => _375.qrdata, 'optionalAccess', _376 => _376.dir]) || _optionalChain([opt, 'access', _377 => _377.data, 'optionalAccess', _378 => _378.dir]);
+    let tmpDir = _optionalChain([opt, 'access', _380 => _380.qrdata, 'optionalAccess', _381 => _381.dir]) || _optionalChain([opt, 'access', _382 => _382.data, 'optionalAccess', _383 => _383.dir]);
     if (tmpDir) {
       tmpDir = decodeURIComponent(tmpDir);
     } else {
-      tmpDir = _optionalChain([opt, 'access', _379 => _379.qrdata, 'optionalAccess', _380 => _380.ty]) || _optionalChain([opt, 'access', _381 => _381.data, 'optionalAccess', _382 => _382.ty]);
+      tmpDir = _optionalChain([opt, 'access', _384 => _384.qrdata, 'optionalAccess', _385 => _385.ty]) || _optionalChain([opt, 'access', _386 => _386.data, 'optionalAccess', _387 => _387.ty]);
       if (tmpDir) {
         tmpDir = decodeURIComponent(tmpDir);
         if (tmpDir === "access-clf" || tmpDir === "access-w3c") {
-          tmpDir = _optionalChain([$asai, 'access', _383 => _383.hostconfig, 'access', _384 => _384.logger, 'optionalAccess', _385 => _385.path, 'optionalAccess', _386 => _386.access]) || "";
+          tmpDir = _optionalChain([$asai, 'access', _388 => _388.hostconfig, 'access', _389 => _389.logger, 'optionalAccess', _390 => _390.path, 'optionalAccess', _391 => _391.access]) || "";
         } else {
-          tmpDir = _optionalChain([$asai, 'access', _387 => _387.hostconfig, 'access', _388 => _388.logger, 'optionalAccess', _389 => _389.path, 'optionalAccess', _390 => _390[tmpDir]]) || "";
+          tmpDir = _optionalChain([$asai, 'access', _392 => _392.hostconfig, 'access', _393 => _393.logger, 'optionalAccess', _394 => _394.path, 'optionalAccess', _395 => _395[tmpDir]]) || "";
         }
       } else {
-        tmpDir = _optionalChain([$asai, 'access', _391 => _391.hostconfig, 'access', _392 => _392.logger, 'optionalAccess', _393 => _393.path, 'optionalAccess', _394 => _394.client]) || "";
+        tmpDir = _optionalChain([$asai, 'access', _396 => _396.hostconfig, 'access', _397 => _397.logger, 'optionalAccess', _398 => _398.path, 'optionalAccess', _399 => _399.client]) || "";
       }
     }
     return tmpDir;
@@ -3146,7 +3172,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       return;
     }
     if (url.startsWith("/api/asailog/manage/add/")) {
-      if (!await ensureLv(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLv(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
         mgLog("add", "server:", opt.data);
         await $asai.$log("LOG", "ADD", opt.data);
@@ -3160,7 +3186,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       if (!await ensureLv(req, $asai, 3)) return sendFail(res, "Forbidden", opt);
       try {
         const baseDir = getDir(opt);
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _395 => _395.qrdata, 'optionalAccess', _396 => _396.path]) || _optionalChain([opt, 'access', _397 => _397.data, 'optionalAccess', _398 => _398.path]));
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _400 => _400.qrdata, 'optionalAccess', _401 => _401.path]) || _optionalChain([opt, 'access', _402 => _402.data, 'optionalAccess', _403 => _403.path]));
         const jsonpath = resolvePathUnderBase2(baseDir, relPath);
         await ensureFile2(jsonpath);
         mgLog("ENSURE", jsonpath);
@@ -3179,13 +3205,13 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
   async function get(req, res, hostdir, opt) {
     const url = req.url;
     if (url.startsWith("/api/asailog/manage/selectlist/")) {
-      if (!await ensureLv(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLv(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ty = decodeURIComponent(_optionalChain([opt, 'access', _399 => _399.qrdata, 'optionalAccess', _400 => _400.ty]) || _optionalChain([opt, 'access', _401 => _401.data, 'optionalAccess', _402 => _402.ty]) || "client");
-        if (!_chunkTKJAHTPOcjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkTKJAHTPOcjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
+        const ty = decodeURIComponent(_optionalChain([opt, 'access', _404 => _404.qrdata, 'optionalAccess', _405 => _405.ty]) || _optionalChain([opt, 'access', _406 => _406.data, 'optionalAccess', _407 => _407.ty]) || "client");
+        if (!_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
           const kind = ty === "sec" ? "sec" : "web";
-          const groups = await _chunkTKJAHTPOcjs.listUnifiedGroups.call(void 0, $asai, { kind, source: ty === "sec" ? "sec" : ty });
-          const children = _chunkTKJAHTPOcjs.groupsToManageChildren.call(void 0, groups);
+          const groups = await _chunkHR5JKN7Ycjs.listUnifiedGroups.call(void 0, $asai, { kind, source: ty === "sec" ? "sec" : ty });
+          const children = _chunkHR5JKN7Ycjs.groupsToManageChildren.call(void 0, groups);
           if (children.length) {
             mgLog("LIST", `store:${ty}`, children.length);
             return sendSuccess(res, { children, fromStore: true }, opt);
@@ -3207,12 +3233,12 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       return;
     }
     if (url.startsWith("/api/asailog/manage/select/")) {
-      if (!await ensureLv(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLv(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ty = decodeURIComponent(_optionalChain([opt, 'access', _403 => _403.qrdata, 'optionalAccess', _404 => _404.ty]) || _optionalChain([opt, 'access', _405 => _405.data, 'optionalAccess', _406 => _406.ty]) || "client");
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _407 => _407.qrdata, 'optionalAccess', _408 => _408.path]) || _optionalChain([opt, 'access', _409 => _409.data, 'optionalAccess', _410 => _410.path]));
-        if (!_chunkTKJAHTPOcjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkTKJAHTPOcjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
-          const data2 = await _chunkTKJAHTPOcjs.readWebLogFromStore.call(void 0, $asai, ty, relPath);
+        const ty = decodeURIComponent(_optionalChain([opt, 'access', _408 => _408.qrdata, 'optionalAccess', _409 => _409.ty]) || _optionalChain([opt, 'access', _410 => _410.data, 'optionalAccess', _411 => _411.ty]) || "client");
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _412 => _412.qrdata, 'optionalAccess', _413 => _413.path]) || _optionalChain([opt, 'access', _414 => _414.data, 'optionalAccess', _415 => _415.path]));
+        if (!_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
+          const data2 = await _chunkHR5JKN7Ycjs.readWebLogFromStore.call(void 0, $asai, ty, relPath);
           if (data2) {
             mgLog("READ", `store:${ty}/${relPath}`);
             return sendSuccess(res, data2, opt);
@@ -3238,10 +3264,10 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       if (!await ensureLv(req, $asai, 3)) return sendFail(res, "Forbidden", opt);
       try {
         const baseDir = getDir(opt);
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _411 => _411.qrdata, 'optionalAccess', _412 => _412.path]) || _optionalChain([opt, 'access', _413 => _413.data, 'optionalAccess', _414 => _414.path]));
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _416 => _416.qrdata, 'optionalAccess', _417 => _417.path]) || _optionalChain([opt, 'access', _418 => _418.data, 'optionalAccess', _419 => _419.path]));
         const fileName = relPath.split(/[/\\]/).pop() || relPath;
-        if (_chunkTKJAHTPOcjs.isLogStoreEnabled.call(void 0, $asai)) {
-          await _chunkTKJAHTPOcjs.purgeStoreEntriesForFile.call(void 0, $asai, fileName).catch(() => void 0);
+        if (_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai)) {
+          await _chunkHR5JKN7Ycjs.purgeStoreEntriesForFile.call(void 0, $asai, fileName).catch(() => void 0);
         }
         const filepath = resolvePathUnderBase2(baseDir, relPath);
         mgLog("DELETE", filepath);
@@ -3261,14 +3287,14 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
 
 // src/infra/siem-auth.ts
 function isSiemEnabled($asai) {
-  const cfg = _optionalChain([$asai, 'optionalAccess', _415 => _415.hostconfig, 'optionalAccess', _416 => _416.logger, 'optionalAccess', _417 => _417.siem]);
-  return !!(_optionalChain([cfg, 'optionalAccess', _418 => _418.enabled]) && getSiemToken($asai));
+  const cfg = _optionalChain([$asai, 'optionalAccess', _420 => _420.hostconfig, 'optionalAccess', _421 => _421.logger, 'optionalAccess', _422 => _422.siem]);
+  return !!(_optionalChain([cfg, 'optionalAccess', _423 => _423.enabled]) && getSiemToken($asai));
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, isSiemEnabled, "isSiemEnabled");
 function getSiemToken($asai) {
   const fromEnv = process.env.ASAI_SIEM_TOKEN;
   if (typeof fromEnv === "string" && fromEnv.trim()) return fromEnv.trim();
-  const fromCfg = _optionalChain([$asai, 'optionalAccess', _419 => _419.hostconfig, 'optionalAccess', _420 => _420.logger, 'optionalAccess', _421 => _421.siem, 'optionalAccess', _422 => _422.token]);
+  const fromCfg = _optionalChain([$asai, 'optionalAccess', _424 => _424.hostconfig, 'optionalAccess', _425 => _425.logger, 'optionalAccess', _426 => _426.siem, 'optionalAccess', _427 => _427.token]);
   return typeof fromCfg === "string" ? fromCfg.trim() : "";
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSiemToken, "getSiemToken");
@@ -3276,9 +3302,9 @@ function isSiemTokenValid($asai, req) {
   if (!isSiemEnabled($asai)) return false;
   const expected = getSiemToken($asai);
   if (!expected) return false;
-  const header = _optionalChain([req, 'optionalAccess', _423 => _423.headers, 'optionalAccess', _424 => _424["x-siem-token"]]) || _optionalChain([req, 'optionalAccess', _425 => _425.headers, 'optionalAccess', _426 => _426["x-api-key"]]);
+  const header = _optionalChain([req, 'optionalAccess', _428 => _428.headers, 'optionalAccess', _429 => _429["x-siem-token"]]) || _optionalChain([req, 'optionalAccess', _430 => _430.headers, 'optionalAccess', _431 => _431["x-api-key"]]);
   if (typeof header === "string" && header === expected) return true;
-  const q = _optionalChain([req, 'optionalAccess', _427 => _427.query]) || {};
+  const q = _optionalChain([req, 'optionalAccess', _432 => _432.query]) || {};
   const qToken = q.siem_token || q.token;
   return typeof qToken === "string" && qToken === expected;
 }
@@ -3302,24 +3328,24 @@ function getNs(raw) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getNs, "getNs");
 async function ensureServerUser(req, $asai) {
-  if (Array.isArray(_optionalChain([req, 'optionalAccess', _428 => _428.Userinfo])) && req.Userinfo[0]) {
+  if (Array.isArray(_optionalChain([req, 'optionalAccess', _433 => _433.Userinfo])) && req.Userinfo[0]) {
     await attachServerUserLevel(req, $asai);
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, ensureServerUser, "ensureServerUser");
 var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _429 => _429.$lib, 'optionalAccess', _430 => _430.reqWork, 'optionalCall', _431 => _431($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _434 => _434.$lib, 'optionalAccess', _435 => _435.reqWork, 'optionalCall', _436 => _436($asai)]) || {};
   const IL = $asai.$lib.InterventionLog;
   async function get(req, res, hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/asailog/intervention/selectlist/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ns = getNs(_optionalChain([opt, 'access', _432 => _432.qrdata, 'optionalAccess', _433 => _433.ns]) || _optionalChain([opt, 'access', _434 => _434.data, 'optionalAccess', _435 => _435.ns]));
+        const ns = getNs(_optionalChain([opt, 'access', _437 => _437.qrdata, 'optionalAccess', _438 => _438.ns]) || _optionalChain([opt, 'access', _439 => _439.data, 'optionalAccess', _440 => _440.ns]));
         let list = await IL.listInterventionFiles($asai, ns);
-        if (_chunkTKJAHTPOcjs.isLogStoreEnabled.call(void 0, $asai) && !_chunkTKJAHTPOcjs.prefersDiskLogAccess.call(void 0, $asai)) {
-          const groups = await _chunkTKJAHTPOcjs.listUnifiedGroups.call(void 0, $asai, { kind: "intervention", ns });
-          const fromStore = _chunkTKJAHTPOcjs.groupsToInterventionFiles.call(void 0, groups, ns);
+        if (_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && !_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai)) {
+          const groups = await _chunkHR5JKN7Ycjs.listUnifiedGroups.call(void 0, $asai, { kind: "intervention", ns });
+          const fromStore = _chunkHR5JKN7Ycjs.groupsToInterventionFiles.call(void 0, groups, ns);
           const names = new Set(list.map((f) => f.name));
           for (const f of fromStore) {
             if (!names.has(f.name)) list.push(f);
@@ -3327,27 +3353,27 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
         }
         return sendSuccess(res, { ns, files: list }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _436 => _436.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _441 => _441.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/intervention/select/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const name = decodeURIComponent(_optionalChain([opt, 'access', _437 => _437.qrdata, 'optionalAccess', _438 => _438.name]) || _optionalChain([opt, 'access', _439 => _439.data, 'optionalAccess', _440 => _440.name]) || "");
-        const ns = getNs(_optionalChain([opt, 'access', _441 => _441.qrdata, 'optionalAccess', _442 => _442.ns]) || _optionalChain([opt, 'access', _443 => _443.data, 'optionalAccess', _444 => _444.ns]));
+        const name = decodeURIComponent(_optionalChain([opt, 'access', _442 => _442.qrdata, 'optionalAccess', _443 => _443.name]) || _optionalChain([opt, 'access', _444 => _444.data, 'optionalAccess', _445 => _445.name]) || "");
+        const ns = getNs(_optionalChain([opt, 'access', _446 => _446.qrdata, 'optionalAccess', _447 => _447.ns]) || _optionalChain([opt, 'access', _448 => _448.data, 'optionalAccess', _449 => _449.ns]));
         if (!name) return sendFail(res, "name required", opt);
         const content = await IL.readInterventionFile($asai, name, ns);
         return sendSuccess(res, { ns, ...content }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _445 => _445.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _450 => _450.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/intervention/types/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
         return sendSuccess(res, IL.getInterventionTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _446 => _446.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _451 => _451.message]) || err, opt);
       }
     }
   }
@@ -3355,7 +3381,7 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
   async function post(req, res, hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/asailog/intervention/delete/")) {
-      if (!await ensureLogWriteAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLogWriteAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) return sendFail(res, "Forbidden", opt);
       await ensureServerUser(req, $asai);
       const lv = getRequestUserLevel(req);
       const us = getRequestUsername(req);
@@ -3377,7 +3403,7 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
         );
         return sendSuccess(res, { ns, ...result }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _447 => _447.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _452 => _452.message]) || err, opt);
       }
     }
   }
@@ -3396,7 +3422,7 @@ function parseQuery(opt) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, parseQuery, "parseQuery");
 function parseBody(opt) {
-  if (!_optionalChain([opt, 'optionalAccess', _448 => _448.data])) return {};
+  if (!_optionalChain([opt, 'optionalAccess', _453 => _453.data])) return {};
   if (typeof opt.data === "string") {
     try {
       return JSON.parse(opt.data);
@@ -3408,47 +3434,47 @@ function parseBody(opt) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, parseBody, "parseBody");
 var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _449 => _449.$lib, 'optionalAccess', _450 => _450.reqWork, 'optionalCall', _451 => _451($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _454 => _454.$lib, 'optionalAccess', _455 => _455.reqWork, 'optionalCall', _456 => _456($asai)]) || {};
   const IL = $asai.$lib.InterventionLog;
   async function get(req, res, hostdir, opt) {
     const url = req.url || "";
     const q = parseQuery(opt);
     if (url.startsWith("/api/asailog/store/config/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        return sendSuccess(res, _chunkTKJAHTPOcjs.getLogStoreMeta.call(void 0, $asai), opt);
+        return sendSuccess(res, _chunkHR5JKN7Ycjs.getLogStoreMeta.call(void 0, $asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _452 => _452.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _457 => _457.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/stats/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
-      if (!_chunkTKJAHTPOcjs.isLogStoreEnabled.call(void 0, $asai)) {
-        return sendSuccess(res, { store: "disabled", message: "logger.store not configured", config: _chunkTKJAHTPOcjs.getLogStoreMeta.call(void 0, $asai) }, opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai)) {
+        return sendSuccess(res, { store: "disabled", message: "logger.store not configured", config: _chunkHR5JKN7Ycjs.getLogStoreMeta.call(void 0, $asai) }, opt);
       }
       try {
-        const storeType = _chunkTKJAHTPOcjs.getEffectiveStoreType.call(void 0, $asai);
-        const stats = await _chunkTKJAHTPOcjs.getUnifiedStats.call(void 0, $asai);
-        return sendSuccess(res, { store: storeType, stats, config: _chunkTKJAHTPOcjs.getLogStoreMeta.call(void 0, $asai) }, opt);
+        const storeType = _chunkHR5JKN7Ycjs.getEffectiveStoreType.call(void 0, $asai);
+        const stats = await _chunkHR5JKN7Ycjs.getUnifiedStats.call(void 0, $asai);
+        return sendSuccess(res, { store: storeType, stats, config: _chunkHR5JKN7Ycjs.getLogStoreMeta.call(void 0, $asai) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _453 => _453.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _458 => _458.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/compliance/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
         const ns = q.ns === "test" ? "test" : "prod";
-        const report = await _chunkTKJAHTPOcjs.getComplianceReport.call(void 0, $asai, ns);
+        const report = await _chunkHR5JKN7Ycjs.getComplianceReport.call(void 0, $asai, ns);
         return sendSuccess(res, report, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _454 => _454.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _459 => _459.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/search/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
-      if (!_chunkTKJAHTPOcjs.isLogStoreEnabled.call(void 0, $asai)) return sendFail(res, "Log store not enabled", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai)) return sendFail(res, "Log store not enabled", opt);
       try {
-        const result = await _chunkTKJAHTPOcjs.searchUnifiedLogs.call(void 0, $asai, {
+        const result = await _chunkHR5JKN7Ycjs.searchUnifiedLogs.call(void 0, $asai, {
           kind: q.kind ? q.kind : void 0,
           ns: q.ns ? q.ns : void 0,
           source: q.source || q.ty || void 0,
@@ -3463,11 +3489,11 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, result, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _455 => _455.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _460 => _460.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/export/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
         const kind = q.kind || "intervention";
         const format = q.format || "raw";
@@ -3475,7 +3501,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const ns = q.ns === "test" ? "test" : "prod";
         const source = q.source || q.ty || "server";
         if (!fileName && kind === "intervention") return sendFail(res, "name required", opt);
-        const payload = await _chunkTKJAHTPOcjs.exportLogContent.call(void 0, $asai, {
+        const payload = await _chunkHR5JKN7Ycjs.exportLogContent.call(void 0, $asai, {
           kind,
           ns: kind === "intervention" ? ns : void 0,
           fileName: fileName || void 0,
@@ -3484,36 +3510,36 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, payload, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _456 => _456.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _461 => _461.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/taxonomy/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
         return sendSuccess(res, IL.getInterventionTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _457 => _457.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _462 => _462.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/formats/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
         const { getLogFormatTaxonomy } = await Promise.resolve().then(() => _interopRequireWildcard(require("./log-formats-TUXGMCCU.cjs")));
         return sendSuccess(res, getLogFormatTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _458 => _458.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _463 => _463.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/selectlist/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
-      if (!_chunkTKJAHTPOcjs.isLogStoreEnabled.call(void 0, $asai)) return sendFail(res, "Log store not enabled", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai)) return sendFail(res, "Log store not enabled", opt);
       try {
         const kind = q.kind ? String(q.kind) : void 0;
         const ns = q.ns ? String(q.ns) : void 0;
         const source = q.source || q.ty ? String(q.source || q.ty) : void 0;
-        const groups = await _chunkTKJAHTPOcjs.listUnifiedGroups.call(void 0, $asai, { kind, ns, source });
+        const groups = await _chunkHR5JKN7Ycjs.listUnifiedGroups.call(void 0, $asai, { kind, ns, source });
         if (kind === "intervention" || ns) {
-          return sendSuccess(res, { files: _chunkTKJAHTPOcjs.groupsToInterventionFiles.call(void 0, groups, ns || "prod"), ns: ns || "prod" }, opt);
+          return sendSuccess(res, { files: _chunkHR5JKN7Ycjs.groupsToInterventionFiles.call(void 0, groups, ns || "prod"), ns: ns || "prod" }, opt);
         }
         if (kind === "web" || kind === "sec" || kind === "access" || source) {
           const children = kind === "access" ? groups.filter((g) => g.kind === "access").map((g) => ({
@@ -3523,21 +3549,21 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
             entryCount: g.entryCount,
             source: g.source,
             fromStore: true
-          })) : _chunkTKJAHTPOcjs.groupsToManageChildren.call(void 0, groups);
+          })) : _chunkHR5JKN7Ycjs.groupsToManageChildren.call(void 0, groups);
           return sendSuccess(res, { children, source }, opt);
         }
         return sendSuccess(res, { groups }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _459 => _459.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _464 => _464.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/select/")) {
-      if (!await ensureLogReadAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
-      if (!_chunkTKJAHTPOcjs.isLogStoreEnabled.call(void 0, $asai)) return sendFail(res, "Log store not enabled", opt);
+      if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
+      if (!_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai)) return sendFail(res, "Log store not enabled", opt);
       try {
         const id = q.id;
         if (id != null) {
-          const row = await _chunkTKJAHTPOcjs.getUnifiedEntry.call(void 0, $asai, id);
+          const row = await _chunkHR5JKN7Ycjs.getUnifiedEntry.call(void 0, $asai, id);
           if (!row) return sendFail(res, "not found", opt);
           return sendSuccess(res, { entry: row }, opt);
         }
@@ -3546,14 +3572,14 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const ns = q.ns ? String(q.ns) : "";
         const source = q.source || q.ty ? String(q.source || q.ty) : "server";
         if (kind === "web" || kind === "sec" || !kind && fileName.startsWith("log-")) {
-          const content = await _chunkTKJAHTPOcjs.readWebLogFromStore.call(void 0, $asai, source, fileName);
+          const content = await _chunkHR5JKN7Ycjs.readWebLogFromStore.call(void 0, $asai, source, fileName);
           return sendSuccess(res, content, opt);
         }
         if (kind === "intervention" || fileName.includes(".cef.log")) {
           const content = await IL.readInterventionFile($asai, fileName, ns === "test" ? "test" : "prod");
           return sendSuccess(res, { ns: ns || "prod", ...content, fromStore: true }, opt);
         }
-        const rows = await _chunkTKJAHTPOcjs.queryUnifiedLogs.call(void 0, $asai, {
+        const rows = await _chunkHR5JKN7Ycjs.queryUnifiedLogs.call(void 0, $asai, {
           kind,
           ns,
           source,
@@ -3562,7 +3588,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, { entries: rows }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _460 => _460.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _465 => _465.message]) || err, opt);
       }
     }
   }
@@ -3570,13 +3596,13 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
   async function post(req, res, hostdir, opt) {
     const url = req.url || "";
     if (!url.startsWith("/api/asailog/store/archive/")) return;
-    if (!await ensureLogWriteAccess(req, $asai, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) return sendFail(res, "Forbidden", opt);
+    if (!await ensureLogWriteAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) return sendFail(res, "Forbidden", opt);
     try {
       const body = parseBody(opt);
       const year = Number(body.year);
       if (!year || year < 2e3 || year > 2100) return sendFail(res, "invalid year", opt);
       const ns = body.ns === "test" ? "test" : "prod";
-      const result = await _chunkTKJAHTPOcjs.archiveInterventionYear.call(void 0, $asai, {
+      const result = await _chunkHR5JKN7Ycjs.archiveInterventionYear.call(void 0, $asai, {
         year,
         ns,
         dryRun: !!body.dryRun,
@@ -3584,7 +3610,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       });
       return sendSuccess(res, result, opt);
     } catch (err) {
-      return sendFail(res, _optionalChain([err, 'optionalAccess', _461 => _461.message]) || err, opt);
+      return sendFail(res, _optionalChain([err, 'optionalAccess', _466 => _466.message]) || err, opt);
     }
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, post, "post");
@@ -3596,7 +3622,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
 
 var registry = null;
 function resolveFilePath($asai) {
-  const root = _optionalChain([$asai, 'optionalAccess', _462 => _462.serverRoot]) || process.cwd();
+  const root = _optionalChain([$asai, 'optionalAccess', _467 => _467.serverRoot]) || process.cwd();
   return nodePath3.join(root, "websys/sys/errorcodes.json");
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveFilePath, "resolveFilePath");
@@ -3614,7 +3640,7 @@ function loadErrorCodes($asai) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, loadErrorCodes, "loadErrorCodes");
 function getError(ec) {
-  return _optionalChain([registry, 'optionalAccess', _463 => _463.errors, 'optionalAccess', _464 => _464[ec]]) || null;
+  return _optionalChain([registry, 'optionalAccess', _468 => _468.errors, 'optionalAccess', _469 => _469[ec]]) || null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getError, "getError");
 function hasError(ec) {
@@ -3623,11 +3649,11 @@ function hasError(ec) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, hasError, "hasError");
 function logError($asai, ec, params) {
   const entry = getError(ec);
-  const logFn = _optionalChain([$asai, 'optionalAccess', _465 => _465.$log]) || console.warn;
+  const logFn = _optionalChain([$asai, 'optionalAccess', _470 => _470.$log]) || console.warn;
   if (entry) {
-    logFn(`[EC:${ec}]`, entry.id || "", entry.detail || "", _optionalChain([params, 'optionalAccess', _466 => _466.length]) ? params : "");
+    logFn(`[EC:${ec}]`, entry.id || "", entry.detail || "", _optionalChain([params, 'optionalAccess', _471 => _471.length]) ? params : "");
   } else {
-    logFn(`[EC:${ec}]`, "(unregistered)", _optionalChain([params, 'optionalAccess', _467 => _467.length]) ? params : "");
+    logFn(`[EC:${ec}]`, "(unregistered)", _optionalChain([params, 'optionalAccess', _472 => _472.length]) ? params : "");
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, logError, "logError");
@@ -3655,14 +3681,14 @@ var ErrorCode_default = {
 
 // src/sysserver/api/common/errorcodes.ts
 var errorcodes_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _468 => _468.$lib, 'optionalAccess', _469 => _469.reqWork, 'optionalCall', _470 => _470($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _473 => _473.$lib, 'optionalAccess', _474 => _474.reqWork, 'optionalCall', _475 => _475($asai)]) || {};
   function get(req, res, _hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/sys/errorcodes/")) {
       try {
         return sendSuccess(res, loadErrorCodes($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _471 => _471.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _476 => _476.message]) || err, opt);
       }
     }
   }
@@ -3672,9 +3698,9 @@ var errorcodes_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
 
 // src/sysserver/api/common/sqlitemanage.ts
 var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'optionalAccess', _472 => _472.$lib, 'optionalAccess', _473 => _473.reqWork, 'optionalCall', _474 => _474($asai)]) || {};
+  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'optionalAccess', _477 => _477.$lib, 'optionalAccess', _478 => _478.reqWork, 'optionalCall', _479 => _479($asai)]) || {};
   function mgLog(...arg) {
-    _optionalChain([mnLog, 'optionalCall', _475 => _475("SQLite", ...arg)]);
+    _optionalChain([mnLog, 'optionalCall', _480 => _480("SQLite", ...arg)]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mgLog, "mgLog");
   return $asai.$lib.AsDb($asai, {
@@ -3692,7 +3718,7 @@ var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0,
       if (req.url.startsWith("/api/asaisqlite/manage/post")) {
         try {
           mgLog("POST", "custom handler triggered");
-          _optionalChain([sendSuccess, 'optionalCall', _476 => _476(res, { data: "post" }, opt)]);
+          _optionalChain([sendSuccess, 'optionalCall', _481 => _481(res, { data: "post" }, opt)]);
         } catch (err) {
           mgLog("ERROR", "post handler", err);
         }
@@ -3709,10 +3735,10 @@ var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0,
             table: dataObj.table
           });
           mgLog("SELECT", "completed");
-          _optionalChain([sendSuccess, 'optionalCall', _477 => _477(res, resdb, opt)]);
+          _optionalChain([sendSuccess, 'optionalCall', _482 => _482(res, resdb, opt)]);
         } catch (errdb) {
           mgLog("ERROR", "select", errdb);
-          _optionalChain([sendFail, 'optionalCall', _478 => _478(res, errdb, opt)]);
+          _optionalChain([sendFail, 'optionalCall', _483 => _483(res, errdb, opt)]);
         }
         return "ok";
       }
@@ -3728,7 +3754,7 @@ function promLine(name, value, labels) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, promLine, "promLine");
 var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _479 => _479.$lib, 'optionalAccess', _480 => _480.reqWork, 'optionalCall', _481 => _481($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _484 => _484.$lib, 'optionalAccess', _485 => _485.reqWork, 'optionalCall', _486 => _486($asai)]) || {};
   async function get(req, res, _hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/sys/health/metrics/")) {
@@ -3737,10 +3763,10 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
         let httpTotal = 0;
         let wsTotal = 0;
         for (const set of Object.values($asai.connectionshttp || {})) {
-          httpTotal += _optionalChain([set, 'optionalAccess', _482 => _482.size]) || 0;
+          httpTotal += _optionalChain([set, 'optionalAccess', _487 => _487.size]) || 0;
         }
         for (const set of Object.values($asai.connectionsws || {})) {
-          wsTotal += _optionalChain([set, 'optionalAccess', _483 => _483.size]) || 0;
+          wsTotal += _optionalChain([set, 'optionalAccess', _488 => _488.size]) || 0;
         }
         const lines = [
           "# HELP asai_uptime_seconds Process uptime",
@@ -3762,7 +3788,7 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
         return res.end(lines.join("\n") + "\n");
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _484 => _484.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _489 => _489.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/sys/health/status/")) {
@@ -3775,10 +3801,10 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
           memory: process.memoryUsage(),
           quota: {
             http: Object.fromEntries(
-              Object.entries($asai.connectionshttp || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _485 => _485.size]) || 0])
+              Object.entries($asai.connectionshttp || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _490 => _490.size]) || 0])
             ),
             ws: Object.fromEntries(
-              Object.entries($asai.connectionsws || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _486 => _486.size]) || 0])
+              Object.entries($asai.connectionsws || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _491 => _491.size]) || 0])
             )
           }
         },
@@ -3819,7 +3845,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, sanitizeString, "sanitizeString");
 // src/sysserver/api/login/service/session.ts
 
 function getSessionTtlMs($asai) {
-  const hours = _nullishCoalesce(_optionalChain([$asai, 'optionalAccess', _487 => _487.hostconfig, 'optionalAccess', _488 => _488.security, 'optionalAccess', _489 => _489.sessionTtlHours]), () => ( 24));
+  const hours = _nullishCoalesce(_optionalChain([$asai, 'optionalAccess', _492 => _492.hostconfig, 'optionalAccess', _493 => _493.security, 'optionalAccess', _494 => _494.sessionTtlHours]), () => ( 24));
   return Number(hours) * 3600 * 1e3;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSessionTtlMs, "getSessionTtlMs");
@@ -3836,7 +3862,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, generatePriKey, "generatePriKey");
 function createSessionKeys($asai) {
   const sessionId = _crypto.randomUUID.call(void 0, );
   const pri = generatePriKey();
-  const sn = _optionalChain([$asai, 'optionalAccess', _490 => _490.hostconfig, 'optionalAccess', _491 => _491.asaisn]);
+  const sn = _optionalChain([$asai, 'optionalAccess', _495 => _495.hostconfig, 'optionalAccess', _496 => _496.asaisn]);
   if (!sn) throw new Error("[session] ASAI_ASAISN \u672A\u914D\u7F6E");
   const pub = $asai.$lib.AsCode.asencode(pri, sn);
   return { pri, pub, sessionId };
@@ -3863,9 +3889,9 @@ var API_ADMIN_PREFIXES = ["/api/user/login/admin/"];
 function getMinLevelForApiPath(pathname, $asai) {
   if (API_ADMIN_PREFIXES.some((p) => pathname.startsWith(p))) {
     if (pathname.includes("/admin/update") || pathname.includes("/admin/kick") || pathname.includes("/admin/delete") || pathname.includes("/admin/resetpass")) {
-      return $asai ? _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite") : _chunkLXJMGLKWcjs.USER_LV.DEVELOPER;
+      return $asai ? _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite") : _chunkZK4O4Z2Ocjs.USER_LV.DEVELOPER;
     }
-    return $asai ? _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "adminRead") : _chunkLXJMGLKWcjs.USER_LV.ADMIN;
+    return $asai ? _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "adminRead") : _chunkZK4O4Z2Ocjs.USER_LV.ADMIN;
   }
   return 0;
 }
@@ -3892,7 +3918,7 @@ function unwrapJsonString(value) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, unwrapJsonString, "unwrapJsonString");
 function parseAuthBody(opt) {
-  let raw = _optionalChain([opt, 'optionalAccess', _492 => _492.data]);
+  let raw = _optionalChain([opt, 'optionalAccess', _497 => _497.data]);
   if (raw == null || raw === "") return {};
   if (typeof raw === "string") {
     const text = raw.trim();
@@ -3968,7 +3994,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, purgeOfflineSessions, "purgeOfflineSession
 
 // src/sysserver/api/login/index.ts
 function getSecurity($asai) {
-  return _optionalChain([$asai, 'optionalAccess', _493 => _493.hostconfig, 'optionalAccess', _494 => _494.security]) || {};
+  return _optionalChain([$asai, 'optionalAccess', _498 => _498.hostconfig, 'optionalAccess', _499 => _499.security]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSecurity, "getSecurity");
 function getQuota2($asai) {
@@ -3979,9 +4005,9 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, getQuota2, "getQuota");
 async function canLogin($asai, us, hostdir) {
   const quota = getQuota2($asai);
   if (!quota.enabled) return { ok: true };
-  const store = _chunkLXJMGLKWcjs.createUserStore.call(void 0, $asai);
+  const store = _chunkZK4O4Z2Ocjs.createUserStore.call(void 0, $asai);
   const total = await countOnlineSessions($asai, hostdir, store);
-  const maxLogin = _nullishCoalesce(_nullishCoalesce(quota.maxLoginSessions, () => ( _optionalChain([$asai, 'optionalAccess', _495 => _495.hostconfig, 'optionalAccess', _496 => _496.hosts, 'optionalAccess', _497 => _497.default, 'optionalAccess', _498 => _498.maxonline]))), () => ( 100));
+  const maxLogin = _nullishCoalesce(_nullishCoalesce(quota.maxLoginSessions, () => ( _optionalChain([$asai, 'optionalAccess', _500 => _500.hostconfig, 'optionalAccess', _501 => _501.hosts, 'optionalAccess', _502 => _502.default, 'optionalAccess', _503 => _503.maxonline]))), () => ( 100));
   if (total >= maxLogin) {
     return { ok: false, message: "LOGIN_QUOTA_FULL" };
   }
@@ -3994,7 +4020,7 @@ async function canLogin($asai, us, hostdir) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, canLogin, "canLogin");
 function publicUser($asai, user) {
-  const role = user.role || _chunkH3K33HBAcjs.resolveRoleForLevel.call(void 0, $asai, user.lv).name;
+  const role = user.role || _chunkGXOFLFFWcjs.resolveRoleForLevel.call(void 0, $asai, user.lv).name;
   return {
     us: user.us,
     lv: user.lv,
@@ -4008,14 +4034,14 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, publicUser, "publicUser");
 var bootstrapPromise = null;
 function ensureReady($asai) {
   if (!bootstrapPromise) {
-    bootstrapPromise = Promise.all([_chunkLXJMGLKWcjs.ensureBootstrapAdmin.call(void 0, $asai), _chunkH3K33HBAcjs.loadUserLevelConfig.call(void 0, $asai)]).then(() => void 0);
+    bootstrapPromise = Promise.all([_chunkZK4O4Z2Ocjs.ensureBootstrapAdmin.call(void 0, $asai), _chunkGXOFLFFWcjs.loadUserLevelConfig.call(void 0, $asai)]).then(() => void 0);
   }
   return bootstrapPromise;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, ensureReady, "ensureReady");
 var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail, sendErr } = _optionalChain([$asai, 'access', _499 => _499.$lib, 'optionalAccess', _500 => _500.reqWork, 'optionalCall', _501 => _501($asai)]) || {};
-  const store = _chunkLXJMGLKWcjs.createUserStore.call(void 0, $asai);
+  const { sendSuccess, sendFail, sendErr } = _optionalChain([$asai, 'access', _504 => _504.$lib, 'optionalAccess', _505 => _505.reqWork, 'optionalCall', _506 => _506($asai)]) || {};
+  const store = _chunkZK4O4Z2Ocjs.createUserStore.call(void 0, $asai);
   async function checkAdmin(req, pathname, minOverride) {
     await attachServerUserLevel(req, $asai);
     const minLv = _nullishCoalesce(minOverride, () => ( getMinLevelForApiPath(pathname, $asai)));
@@ -4034,17 +4060,17 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const newPass = sanitizeString(pickAuthField(body, "newPass", "newPassword", "newpass"), 128);
         if (!us || !pass || !newPass) return sendErr(res, "AUTH_CREDENTIALS_REQUIRED", void 0, opt);
         const user = await store.findByUsername(us);
-        if (!user || !_chunkK2QPSQEVcjs.verifyPassword.call(void 0, pass, user.passHash, user.passSalt)) {
+        if (!user || !_chunkWXW5DYNUcjs.verifyPassword.call(void 0, pass, user.passHash, user.passSalt)) {
           return sendErr(res, "AUTH_INVALID_CREDENTIALS", void 0, opt);
         }
-        const policy = _chunkH3K33HBAcjs.getPasswordPolicy.call(void 0, $asai);
-        const policyErr = _chunkK2QPSQEVcjs.validatePasswordChange.call(void 0, newPass, $asai, user.passHistory);
+        const policy = _chunkGXOFLFFWcjs.getPasswordPolicy.call(void 0, $asai);
+        const policyErr = _chunkWXW5DYNUcjs.validatePasswordChange.call(void 0, newPass, $asai, user.passHistory);
         if (policyErr === "PASSWORD_TOO_SHORT") {
           return sendErr(res, policyErr, [String(policy.minLength)], opt);
         }
         if (policyErr) return sendErr(res, policyErr, void 0, opt);
-        const { passHash, passSalt } = _chunkK2QPSQEVcjs.hashPassword.call(void 0, newPass);
-        const passHistory = _chunkK2QPSQEVcjs.nextPassHistory.call(void 0, pass, user.passHistory, policy.historyCount);
+        const { passHash, passSalt } = _chunkWXW5DYNUcjs.hashPassword.call(void 0, newPass);
+        const passHistory = _chunkWXW5DYNUcjs.nextPassHistory.call(void 0, pass, user.passHistory, policy.historyCount);
         await store.updateUser(us, {
           passHash,
           passSalt,
@@ -4052,10 +4078,10 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           passwordChangedAt: Date.now(),
           passHistory
         });
-        logSecurityEvent($asai, { type: "AUTH_FAIL", path: url, method: "POST", user: us, ip, detail: "password_changed" });
+        logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "password_changed" });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _502 => _502.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _507 => _507.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/register/")) {
@@ -4070,12 +4096,12 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const emailRaw = pickAuthField(body, "email");
         const email = emailRaw ? sanitizeString(emailRaw, 128) : void 0;
         if (!us || !pass) return sendErr(res, "AUTH_CREDENTIALS_REQUIRED", void 0, opt);
-        const policyErr = _chunkK2QPSQEVcjs.validatePasswordChange.call(void 0, pass, $asai);
+        const policyErr = _chunkWXW5DYNUcjs.validatePasswordChange.call(void 0, pass, $asai);
         if (policyErr === "PASSWORD_TOO_SHORT") {
-          return sendErr(res, policyErr, [String(_chunkH3K33HBAcjs.getPasswordPolicy.call(void 0, $asai).minLength)], opt);
+          return sendErr(res, policyErr, [String(_chunkGXOFLFFWcjs.getPasswordPolicy.call(void 0, $asai).minLength)], opt);
         }
         if (policyErr) return sendErr(res, policyErr, void 0, opt);
-        const { passHash, passSalt } = _chunkK2QPSQEVcjs.hashPassword.call(void 0, pass);
+        const { passHash, passSalt } = _chunkWXW5DYNUcjs.hashPassword.call(void 0, pass);
         const user = await store.createUser({
           us,
           email,
@@ -4085,14 +4111,14 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           passwordChangedAt: Date.now(),
           passHistory: "[]"
         });
-        logSecurityEvent($asai, { type: "AUTH_FAIL", path: url, method: "POST", user: us, ip, detail: "register_ok" });
+        logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "register_ok" });
         return sendSuccess(res, { user: publicUser($asai, user) }, opt);
       } catch (err) {
-        const msg = _optionalChain([err, 'optionalAccess', _503 => _503.message]) || String(err);
+        const msg = _optionalChain([err, 'optionalAccess', _508 => _508.message]) || String(err);
         if (msg.includes("exists") || msg.includes("\u5DF2\u5B58\u5728")) {
           return sendErr(res, "USER_ALREADY_EXISTS", void 0, opt);
         }
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _504 => _504.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _509 => _509.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/auth/")) {
@@ -4102,7 +4128,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const pass = sanitizeString(pickAuthField(body, "pass", "password", "pwd"), 128);
         if (!us || !pass) return sendErr(res, "AUTH_CREDENTIALS_REQUIRED", void 0, opt);
         const user = await store.findByUsername(us);
-        if (!user || !_chunkK2QPSQEVcjs.verifyPassword.call(void 0, pass, user.passHash, user.passSalt)) {
+        if (!user || !_chunkWXW5DYNUcjs.verifyPassword.call(void 0, pass, user.passHash, user.passSalt)) {
           if (user) {
             const sec = getSecurity($asai);
             const lockoutMax = _nullishCoalesce(sec.lockoutMaxFails, () => ( 5));
@@ -4124,9 +4150,9 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (user.status === "locked" && user.lockedUntil && user.lockedUntil > Date.now()) {
           return sendErr(res, "AUTH_ACCOUNT_LOCKED", void 0, opt);
         }
-        const policy = _chunkH3K33HBAcjs.getPasswordPolicy.call(void 0, $asai);
-        const mustChange = !!user.mustChangePassword || _chunkH3K33HBAcjs.isPasswordExpired.call(void 0, user.passwordChangedAt, policy.maxAgeDays);
-        const hostcfg = _optionalChain([$asai, 'access', _505 => _505.getHost, 'optionalCall', _506 => _506(hostdir)]) || {};
+        const policy = _chunkGXOFLFFWcjs.getPasswordPolicy.call(void 0, $asai);
+        const mustChange = !!user.mustChangePassword || _chunkGXOFLFFWcjs.isPasswordExpired.call(void 0, user.passwordChangedAt, policy.maxAgeDays);
+        const hostcfg = _optionalChain([$asai, 'access', _510 => _510.getHost, 'optionalCall', _511 => _511(hostdir)]) || {};
         if (hostcfg.ckws && isUserOnlineOnWs($asai, us, hostdir)) {
           kickUserWs($asai, us, hostdir);
         }
@@ -4139,7 +4165,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const session = buildSessionRecord($asai, us, ip);
         session.lastActivityAt = Date.now();
         await store.addSession(session);
-        logSecurityEvent($asai, { type: "AUTH_FAIL", path: url, method: "POST", user: us, ip, detail: "login_ok" });
+        logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "login_ok" });
         return sendSuccess(
           res,
           {
@@ -4151,22 +4177,31 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           opt
         );
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _507 => _507.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _512 => _512.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/logout/")) {
       try {
         const bodySid = body.sessionId ? sanitizeString(body.sessionId, 64) : "";
-        if (bodySid) await store.removeSession(bodySid);
-        const us = _optionalChain([req, 'optionalAccess', _508 => _508.Userinfo, 'optionalAccess', _509 => _509[0]]);
-        if (us) logSecurityEvent($asai, { type: "AUTH_FAIL", path: url, method: "POST", user: String(us), ip, detail: "logout" });
+        const us = _optionalChain([req, 'optionalAccess', _513 => _513.Userinfo, 'optionalAccess', _514 => _514[0]]);
+        if (bodySid) {
+          if (!us) {
+            return sendErr(res, "AUTH_MISSING", void 0, opt);
+          }
+          const sessions = await store.getSessions();
+          const target = sessions.find((s) => s.id === bodySid);
+          if (target && target.us === us) {
+            await store.removeSession(bodySid);
+          }
+        }
+        if (us) logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: String(us), ip, detail: "logout" });
         return sendSuccess(res, "ok", opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _510 => _510.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _515 => _515.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/kick/")) {
-      if (!await checkAdmin(req, url, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) {
+      if (!await checkAdmin(req, url, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) {
         return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
       }
       try {
@@ -4180,8 +4215,8 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         kickUserWs($asai, target.us, hostdir);
         await store.removeSession(sessionId);
-        const operator = String(_optionalChain([req, 'optionalAccess', _511 => _511.Userinfo, 'optionalAccess', _512 => _512[0]]) || "");
-        await _chunkRIRKIYETcjs.logSessionTerminate.call(void 0, $asai, {
+        const operator = String(_optionalChain([req, 'optionalAccess', _516 => _516.Userinfo, 'optionalAccess', _517 => _517[0]]) || "");
+        await _chunkARHPHWT5cjs.logSessionTerminate.call(void 0, $asai, {
           operator,
           sessionId,
           targetUs: target.us,
@@ -4189,11 +4224,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _513 => _513.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _518 => _518.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/delete/")) {
-      if (!await checkAdmin(req, url, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) {
+      if (!await checkAdmin(req, url, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) {
         return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
       }
       try {
@@ -4201,15 +4236,15 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (!targetUs || targetUs === "admin") return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
         const ok = await store.deleteUser(targetUs);
         if (!ok) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        const operator = String(_optionalChain([req, 'optionalAccess', _514 => _514.Userinfo, 'optionalAccess', _515 => _515[0]]) || "");
-        await _chunkRIRKIYETcjs.logAccountPurge.call(void 0, $asai, { operator, targetUs, ip });
+        const operator = String(_optionalChain([req, 'optionalAccess', _519 => _519.Userinfo, 'optionalAccess', _520 => _520[0]]) || "");
+        await _chunkARHPHWT5cjs.logAccountPurge.call(void 0, $asai, { operator, targetUs, ip });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _516 => _516.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _521 => _521.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/levels/")) {
-      if (!await checkAdmin(req, url, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) {
+      if (!await checkAdmin(req, url, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) {
         return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
       }
       try {
@@ -4217,8 +4252,8 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const thresholds = body.thresholds && typeof body.thresholds === "object" ? body.thresholds : void 0;
         const routeRights = Array.isArray(body.routeRights) ? body.routeRights : void 0;
         const defaultResetPassword = typeof body.defaultResetPassword === "string" ? body.defaultResetPassword : void 0;
-        const operator = String(_optionalChain([req, 'optionalAccess', _517 => _517.Userinfo, 'optionalAccess', _518 => _518[0]]) || "");
-        const cfg = await _chunkH3K33HBAcjs.saveUserLevelConfig.call(void 0, 
+        const operator = String(_optionalChain([req, 'optionalAccess', _522 => _522.Userinfo, 'optionalAccess', _523 => _523[0]]) || "");
+        const cfg = await _chunkGXOFLFFWcjs.saveUserLevelConfig.call(void 0, 
           $asai,
           {
             levels,
@@ -4228,20 +4263,20 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           },
           operator
         );
-        await _chunkRIRKIYETcjs.logSecurityConfigIntervention.call(void 0, $asai, {
+        await _chunkARHPHWT5cjs.logSecurityConfigIntervention.call(void 0, $asai, {
           section: "user_levels",
-          detail: JSON.stringify({ levels: _optionalChain([levels, 'optionalAccess', _519 => _519.length]), thresholds: !!thresholds, routeRights: _optionalChain([routeRights, 'optionalAccess', _520 => _520.length]) }),
+          detail: JSON.stringify({ levels: _optionalChain([levels, 'optionalAccess', _524 => _524.length]), thresholds: !!thresholds, routeRights: _optionalChain([routeRights, 'optionalAccess', _525 => _525.length]) }),
           operator,
           ip
         });
         return sendSuccess(res, cfg, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _521 => _521.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _526 => _526.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/resetpass/")) {
       await ensureReady($asai);
-      if (!await checkAdmin(req, url, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) {
+      if (!await checkAdmin(req, url, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "adminWrite"))) {
         logSecurityEvent($asai, { type: "ACCESS_DENIED", path: url, method: "POST", ip });
         return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
       }
@@ -4249,16 +4284,16 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const targetUs = sanitizeString(body.us, 64);
         if (!targetUs) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
         let newPass = sanitizeString(pickAuthField(body, "newPass", "newPassword", "newpass"), 128);
-        if (!newPass) newPass = _chunkH3K33HBAcjs.getDefaultResetPassword.call(void 0, $asai);
-        const policy = _chunkH3K33HBAcjs.getPasswordPolicy.call(void 0, $asai);
-        const policyErr = _chunkH3K33HBAcjs.validatePasswordWithPolicy.call(void 0, newPass, policy);
+        if (!newPass) newPass = _chunkGXOFLFFWcjs.getDefaultResetPassword.call(void 0, $asai);
+        const policy = _chunkGXOFLFFWcjs.getPasswordPolicy.call(void 0, $asai);
+        const policyErr = _chunkGXOFLFFWcjs.validatePasswordWithPolicy.call(void 0, newPass, policy);
         if (policyErr === "PASSWORD_TOO_SHORT") {
           return sendErr(res, policyErr, [String(policy.minLength)], opt);
         }
         if (policyErr) return sendErr(res, policyErr, void 0, opt);
         const user = await store.findByUsername(targetUs);
         if (!user) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        const { passHash, passSalt } = _chunkK2QPSQEVcjs.hashPassword.call(void 0, newPass);
+        const { passHash, passSalt } = _chunkWXW5DYNUcjs.hashPassword.call(void 0, newPass);
         const updated = await store.updateUser(targetUs, {
           passHash,
           passSalt,
@@ -4270,8 +4305,8 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           passHistory: "[]"
         });
         if (!updated) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        const operator = String(_optionalChain([req, 'optionalAccess', _522 => _522.Userinfo, 'optionalAccess', _523 => _523[0]]) || "");
-        await _chunkRIRKIYETcjs.logUserRbacChange.call(void 0, $asai, {
+        const operator = String(_optionalChain([req, 'optionalAccess', _527 => _527.Userinfo, 'optionalAccess', _528 => _528[0]]) || "");
+        await _chunkARHPHWT5cjs.logUserRbacChange.call(void 0, $asai, {
           operator,
           targetUs,
           patch: { resetPassword: true, mustChangePassword: 1 },
@@ -4287,7 +4322,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         });
         return sendSuccess(res, { user: publicUser($asai, updated) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _524 => _524.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _529 => _529.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/update/")) {
@@ -4301,11 +4336,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const patch = {};
         if (body.lv != null) {
           const newLv = Number(body.lv);
-          if (!Number.isFinite(newLv) || !_chunkH3K33HBAcjs.isValidUserLv.call(void 0, $asai, newLv)) {
+          if (!Number.isFinite(newLv) || !_chunkGXOFLFFWcjs.isValidUserLv.call(void 0, $asai, newLv)) {
             return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
           }
           patch.lv = newLv;
-          patch.role = _chunkH3K33HBAcjs.resolveRoleForLevel.call(void 0, $asai, newLv).name;
+          patch.role = _chunkGXOFLFFWcjs.resolveRoleForLevel.call(void 0, $asai, newLv).name;
         }
         if (body.status) patch.status = sanitizeString(body.status, 16);
         if (body.resetLock) {
@@ -4317,8 +4352,8 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const updated = await store.updateUser(targetUs, patch);
         if (!updated) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
         if (Object.keys(patch).length) {
-          await _chunkRIRKIYETcjs.logUserRbacChange.call(void 0, $asai, {
-            operator: String(_optionalChain([req, 'optionalAccess', _525 => _525.Userinfo, 'optionalAccess', _526 => _526[0]]) || ""),
+          await _chunkARHPHWT5cjs.logUserRbacChange.call(void 0, $asai, {
+            operator: String(_optionalChain([req, 'optionalAccess', _530 => _530.Userinfo, 'optionalAccess', _531 => _531[0]]) || ""),
             targetUs,
             patch,
             ip
@@ -4326,33 +4361,33 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         return sendSuccess(res, { user: publicUser($asai, updated) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _527 => _527.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _532 => _532.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/profile/")) {
-      const us = _optionalChain([req, 'optionalAccess', _528 => _528.Userinfo, 'optionalAccess', _529 => _529[0]]);
+      const us = _optionalChain([req, 'optionalAccess', _533 => _533.Userinfo, 'optionalAccess', _534 => _534[0]]);
       if (!us) return sendErr(res, "AUTH_UNAUTHORIZED", void 0, opt);
       try {
         const user = await store.findByUsername(String(us));
         if (!user) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
         if (pickAuthField(body, "newPass", "newPassword", "newpass")) {
           const newPass = sanitizeString(pickAuthField(body, "newPass", "newPassword", "newpass"), 128);
-          const policy = _chunkH3K33HBAcjs.getPasswordPolicy.call(void 0, $asai);
+          const policy = _chunkGXOFLFFWcjs.getPasswordPolicy.call(void 0, $asai);
           const oldPass = pickAuthField(body, "pass", "password", "pwd");
           if (oldPass) {
-            if (!_chunkK2QPSQEVcjs.verifyPassword.call(void 0, oldPass, user.passHash, user.passSalt)) {
+            if (!_chunkWXW5DYNUcjs.verifyPassword.call(void 0, oldPass, user.passHash, user.passSalt)) {
               return sendErr(res, "AUTH_INVALID_PASSWORD", void 0, opt);
             }
           } else if (!user.mustChangePassword) {
             return sendErr(res, "AUTH_INVALID_PASSWORD", void 0, opt);
           }
-          const policyErr = _chunkK2QPSQEVcjs.validatePasswordChange.call(void 0, newPass, $asai, user.passHistory);
+          const policyErr = _chunkWXW5DYNUcjs.validatePasswordChange.call(void 0, newPass, $asai, user.passHistory);
           if (policyErr === "PASSWORD_TOO_SHORT") {
             return sendErr(res, policyErr, [String(policy.minLength)], opt);
           }
           if (policyErr) return sendErr(res, policyErr, void 0, opt);
-          const { passHash, passSalt } = _chunkK2QPSQEVcjs.hashPassword.call(void 0, newPass);
-          const passHistory = _chunkK2QPSQEVcjs.nextPassHistory.call(void 0, oldPass || newPass, user.passHistory, policy.historyCount);
+          const { passHash, passSalt } = _chunkWXW5DYNUcjs.hashPassword.call(void 0, newPass);
+          const passHistory = _chunkWXW5DYNUcjs.nextPassHistory.call(void 0, oldPass || newPass, user.passHistory, policy.historyCount);
           await store.updateUser(String(us), {
             passHash,
             passSalt,
@@ -4364,7 +4399,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const fresh = await store.findByUsername(String(us));
         return sendSuccess(res, { user: fresh ? publicUser($asai, fresh) : null }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _530 => _530.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _535 => _535.message]) || err, opt);
       }
     }
   }
@@ -4373,16 +4408,16 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     const url = req.url || "";
     const ip = getClientIp(req);
     if (url.startsWith("/api/user/login/config/")) {
-      const lang = String(_optionalChain([req, 'optionalAccess', _531 => _531.headers, 'optionalAccess', _532 => _532["accept-language"]]) || _optionalChain([opt, 'optionalAccess', _533 => _533.headers, 'optionalAccess', _534 => _534["accept-language"]]) || "zh-CN").split(",")[0];
-      await _chunkH3K33HBAcjs.loadUserLevelConfig.call(void 0, $asai);
-      return sendSuccess(res, _chunkH3K33HBAcjs.getPublicSecurityConfig.call(void 0, $asai, lang), opt);
+      const lang = String(_optionalChain([req, 'optionalAccess', _536 => _536.headers, 'optionalAccess', _537 => _537["accept-language"]]) || _optionalChain([opt, 'optionalAccess', _538 => _538.headers, 'optionalAccess', _539 => _539["accept-language"]]) || "zh-CN").split(",")[0];
+      await _chunkGXOFLFFWcjs.loadUserLevelConfig.call(void 0, $asai);
+      return sendSuccess(res, _chunkGXOFLFFWcjs.getPublicSecurityConfig.call(void 0, $asai, lang), opt);
     }
     if (url.startsWith("/api/user/login/admin/levels/")) {
-      if (!await checkAdmin(req, url, _chunkH3K33HBAcjs.getPermissionThreshold.call(void 0, $asai, "adminRead"))) {
+      if (!await checkAdmin(req, url, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "adminRead"))) {
         return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
       }
-      await _chunkH3K33HBAcjs.loadUserLevelConfig.call(void 0, $asai);
-      return sendSuccess(res, _chunkH3K33HBAcjs.getUserLevelConfigSync.call(void 0, $asai), opt);
+      await _chunkGXOFLFFWcjs.loadUserLevelConfig.call(void 0, $asai);
+      return sendSuccess(res, _chunkGXOFLFFWcjs.getUserLevelConfigSync.call(void 0, $asai), opt);
     }
     if (url.startsWith("/api/user/login/admin/sessions/")) {
       if (!await checkAdmin(req, url)) {
@@ -4434,7 +4469,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
       );
     }
     if (url.startsWith("/api/user/login/profile/")) {
-      const us = _optionalChain([req, 'optionalAccess', _535 => _535.Userinfo, 'optionalAccess', _536 => _536[0]]);
+      const us = _optionalChain([req, 'optionalAccess', _540 => _540.Userinfo, 'optionalAccess', _541 => _541[0]]);
       if (!us) return sendErr(res, "AUTH_UNAUTHORIZED", void 0, opt);
       const user = await store.findByUsername(String(us));
       return sendSuccess(res, { user: user ? publicUser($asai, user) : null }, opt);
@@ -4476,16 +4511,16 @@ var As_default = {
     return { code: 908, data: val };
   },
   ctxSuccess(val, opt = null) {
-    if (typeof _optionalChain([opt, 'optionalAccess', _537 => _537.resAES]) === "function") {
+    if (typeof _optionalChain([opt, 'optionalAccess', _542 => _542.resAES]) === "function") {
       val = opt.resAES(val);
     }
     return { code: 909, data: val };
   },
   getPath(str = "-") {
-    return _optionalChain([str, 'optionalAccess', _538 => _538.replace, 'call', _539 => _539(/[^a-zA-Z0-9.\-_\\\/]/g, "")]);
+    return _optionalChain([str, 'optionalAccess', _543 => _543.replace, 'call', _544 => _544(/[^a-zA-Z0-9.\-_\\\/]/g, "")]);
   },
   getName(str = "-") {
-    return _optionalChain([str, 'optionalAccess', _540 => _540.replace, 'call', _541 => _541(/[^a-zA-Z0-9.\-_]/g, "")]);
+    return _optionalChain([str, 'optionalAccess', _545 => _545.replace, 'call', _546 => _546(/[^a-zA-Z0-9.\-_]/g, "")]);
   },
   toDirPath(relativePath) {
     const pathArr = relativePath.split("/");
@@ -4499,10 +4534,10 @@ var As_default = {
     return relativePath;
   },
   //创建多层文件夹 同步
-  ensureDir(fs12, relativePath) {
+  ensureDir(fs11, relativePath) {
     const absPathDir = this.toDirPath(relativePath);
     const absPath = this.toAbsolutePath(relativePath);
-    if (!fs12.existsSync(absPath)) {
+    if (!fs11.existsSync(absPath)) {
       let pathTmp = "";
       absPathDir.split("/").forEach((el) => {
         if (el) {
@@ -4510,8 +4545,8 @@ var As_default = {
             pathTmp += "/";
           }
           pathTmp += el;
-          if (!fs12.existsSync(pathTmp)) {
-            if (!fs12.mkdirSync(pathTmp, { recursive: true })) {
+          if (!fs11.existsSync(pathTmp)) {
+            if (!fs11.mkdirSync(pathTmp, { recursive: true })) {
               return absPath;
             }
           }
@@ -4520,10 +4555,10 @@ var As_default = {
     }
     return absPath;
   },
-  makeDir(fs12, filePaths) {
+  makeDir(fs11, filePaths) {
     return new Promise((resolve6, reject) => {
       try {
-        const newPath = this.ensureDir(fs12, filePaths);
+        const newPath = this.ensureDir(fs11, filePaths);
         resolve6(newPath);
       } catch (err) {
         reject(err);
@@ -4556,7 +4591,7 @@ var As_default = {
   //     immediate: false,
   // });
   dtImmediate(fn, opt) {
-    if (_optionalChain([opt, 'optionalAccess', _542 => _542.immediate])) {
+    if (_optionalChain([opt, 'optionalAccess', _547 => _547.immediate])) {
       fn();
       opt.immediate = false;
     }
@@ -4578,7 +4613,7 @@ var As_default = {
     if (opt.endtime - opt.starttime < opt.wait) {
       this.dtClearTimeout(opt);
     }
-    if (!_optionalChain([opt, 'optionalAccess', _543 => _543.timeout])) {
+    if (!_optionalChain([opt, 'optionalAccess', _548 => _548.timeout])) {
       opt.starttime = opt.endtime;
       opt.timeout = this.dtSetTimeout(fn, opt);
     }
@@ -4586,7 +4621,7 @@ var As_default = {
   // 节流:指定长度时间内有多次触发，只fn最后一次触发
   throttle(fn, opt) {
     this.dtImmediate(fn, opt);
-    if (!_optionalChain([opt, 'optionalAccess', _544 => _544.timeout])) {
+    if (!_optionalChain([opt, 'optionalAccess', _549 => _549.timeout])) {
       opt.timeout = this.dtSetTimeout(fn, opt);
     }
   },
@@ -4622,8 +4657,8 @@ var As_default = {
 var AsCode_default = {
   // 加密
   asencode(str, keys) {
-    const strlen = _optionalChain([str, 'optionalAccess', _545 => _545.length]) || 0;
-    const keyslen = _optionalChain([keys, 'optionalAccess', _546 => _546.length]) || 0;
+    const strlen = _optionalChain([str, 'optionalAccess', _550 => _550.length]) || 0;
+    const keyslen = _optionalChain([keys, 'optionalAccess', _551 => _551.length]) || 0;
     let newstr = "";
     for (let i = 0; i < strlen; i++) {
       const rnum = Math.round(Math.random() * 1e3) % keyslen;
@@ -4648,7 +4683,7 @@ var AsCode_default = {
         const rnum = keys.indexOf(str[i + 3]);
         const rnumx = Number(rnum.toString().slice(-1)) + 1;
         const ylen = keyslen - rnumx;
-        newstr += _optionalChain([String, 'optionalAccess', _547 => _547.fromCodePoint, 'call', _548 => _548(
+        newstr += _optionalChain([String, 'optionalAccess', _552 => _552.fromCodePoint, 'call', _553 => _553(
           (keys.indexOf(str[i++]) - rnumx) * ylen * ylen + (keys.indexOf(str[i++]) - rnumx) * ylen + (keys.indexOf(str[i++]) - rnumx)
         )]);
       }
@@ -4731,7 +4766,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, decrypt, "decrypt");
   function validateFields(payload, fields) {
-    return fields.every((key) => typeof _optionalChain([payload, 'optionalAccess', _549 => _549[key]]) === "string" && payload[key].length > 0);
+    return fields.every((key) => typeof _optionalChain([payload, 'optionalAccess', _554 => _554[key]]) === "string" && payload[key].length > 0);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, validateFields, "validateFields");
   function reqAES(opt, fn = (data) => data) {
@@ -4739,7 +4774,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     try {
       if (validateFields(reqData, ["data", "iv", "auth"])) {
         let aesData = decrypt(reqData);
-        if (_optionalChain([reqData, 'optionalAccess', _550 => _550.aes]) === 2) {
+        if (_optionalChain([reqData, 'optionalAccess', _555 => _555.aes]) === 2) {
           aesData = JSON.parse(aesData);
         }
         return fn(aesData);
@@ -4773,24 +4808,24 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
 // src/sysserver/lib/common/AsDb.ts
 var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, cfg) => {
   const DataServer = _chunk2BCIIKRGcjs.getDataServerForAsDb.call(void 0, $asai, {
-    type: _optionalChain([cfg, 'optionalAccess', _551 => _551.type]) || "sqlite",
+    type: _optionalChain([cfg, 'optionalAccess', _556 => _556.type]) || "sqlite",
     opt: {
-      ..._optionalChain([cfg, 'optionalAccess', _552 => _552.opt]) || {
+      ..._optionalChain([cfg, 'optionalAccess', _557 => _557.opt]) || {
         database: "./webdata/webdb/sqlite/asaisqlite.db",
         create: 1
       }
     },
-    storeKey: _optionalChain([cfg, 'optionalAccess', _553 => _553.storeKey])
+    storeKey: _optionalChain([cfg, 'optionalAccess', _558 => _558.storeKey])
   });
   function reqwherestr(str) {
-    if (_optionalChain([cfg, 'optionalAccess', _554 => _554.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _555 => _555.type]) === "mysql") {
+    if (_optionalChain([cfg, 'optionalAccess', _559 => _559.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _560 => _560.type]) === "mysql") {
       return `'${str}'`;
     }
     return str;
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqwherestr, "reqwherestr");
   function reqfield(queryData) {
-    if (_optionalChain([queryData, 'optionalAccess', _556 => _556.fd])) {
+    if (_optionalChain([queryData, 'optionalAccess', _561 => _561.fd])) {
       return queryData.fd.split("-");
     }
     return cfg.field.data;
@@ -4798,14 +4833,14 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqfield, "reqfield");
   function reqwhere(queryData) {
     const wheretmp = [];
-    if ((_optionalChain([cfg, 'optionalAccess', _557 => _557.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _558 => _558.type]) === "mysql") && _optionalChain([queryData, 'optionalAccess', _559 => _559.wlv])) {
+    if ((_optionalChain([cfg, 'optionalAccess', _562 => _562.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _563 => _563.type]) === "mysql") && _optionalChain([queryData, 'optionalAccess', _564 => _564.wlv])) {
       const wlvarr = queryData.wlv.split("-");
       wheretmp.push([wlvarr[0], ">", Number(wlvarr[1] || 0)]);
     }
-    if (_optionalChain([queryData, 'optionalAccess', _560 => _560.fl])) {
+    if (_optionalChain([queryData, 'optionalAccess', _565 => _565.fl])) {
       wheretmp.push([cfg.field.class, "LIKE", reqwherestr(`${queryData.fl}%`)]);
     }
-    if (_optionalChain([queryData, 'optionalAccess', _561 => _561.ss]) && _optionalChain([queryData, 'optionalAccess', _562 => _562.ssty])) {
+    if (_optionalChain([queryData, 'optionalAccess', _566 => _566.ss]) && _optionalChain([queryData, 'optionalAccess', _567 => _567.ssty])) {
       wheretmp.push([queryData.ssty, "LIKE", reqwherestr(`%${queryData.ss}%`)]);
     }
     if (wheretmp.length > 1) {
@@ -4816,16 +4851,16 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqwhere, "reqwhere");
   function reqorder(queryData) {
     const ordertmp = [];
-    if (_optionalChain([queryData, 'optionalAccess', _563 => _563.sx])) {
-      ordertmp.push([queryData.sx, _optionalChain([queryData, 'optionalAccess', _564 => _564.sxty]) == 1 ? "DESC" : "ASC"]);
+    if (_optionalChain([queryData, 'optionalAccess', _568 => _568.sx])) {
+      ordertmp.push([queryData.sx, _optionalChain([queryData, 'optionalAccess', _569 => _569.sxty]) == 1 ? "DESC" : "ASC"]);
     }
     return ordertmp;
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqorder, "reqorder");
   function reqlimit(queryData) {
     let limittmp = "";
-    let limitps = _optionalChain([queryData, 'optionalAccess', _565 => _565.ps]);
-    if (_optionalChain([queryData, 'optionalAccess', _566 => _566.pg])) {
+    let limitps = _optionalChain([queryData, 'optionalAccess', _570 => _570.ps]);
+    if (_optionalChain([queryData, 'optionalAccess', _571 => _571.pg])) {
       limitps = limitps || 20;
       limittmp = `${(queryData.pg - 1) * limitps},${limitps}`;
     } else if (limitps) {
@@ -4878,8 +4913,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, fileKeyFromSegment, "fileKeyFromSegment");
   function getSqlParamsByUrl(req, opt) {
     let tmpSqlParams;
-    const reqArr = _optionalChain([req, 'optionalAccess', _567 => _567.url, 'optionalAccess', _568 => _568.split, 'call', _569 => _569("?"), 'access', _570 => _570[0], 'optionalAccess', _571 => _571.split, 'call', _572 => _572("/")]) || [];
-    const table = (_optionalChain([opt, 'optionalAccess', _573 => _573.qrdata, 'optionalAccess', _574 => _574.table]) || _optionalChain([opt, 'optionalAccess', _575 => _575.data, 'optionalAccess', _576 => _576.table]) || reqArr[3]).replaceAll("_", "/");
+    const reqArr = _optionalChain([req, 'optionalAccess', _572 => _572.url, 'optionalAccess', _573 => _573.split, 'call', _574 => _574("?"), 'access', _575 => _575[0], 'optionalAccess', _576 => _576.split, 'call', _577 => _577("/")]) || [];
+    const table = (_optionalChain([opt, 'optionalAccess', _578 => _578.qrdata, 'optionalAccess', _579 => _579.table]) || _optionalChain([opt, 'optionalAccess', _580 => _580.data, 'optionalAccess', _581 => _581.table]) || reqArr[3]).replaceAll("_", "/");
     if (!table) return tmpSqlParams;
     tmpSqlParams = {
       type: "select",
@@ -4888,7 +4923,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     if (reqArr[5]) {
       if (reqArr[4] === "insert") {
         tmpSqlParams.type = reqArr[4];
-        if (_optionalChain([cfg, 'optionalAccess', _577 => _577.type]) === "file") {
+        if (_optionalChain([cfg, 'optionalAccess', _582 => _582.type]) === "file") {
           const { name: bodyName, content } = parseFileBody(opt.data);
           const fileKey = fileKeyFromSegment(reqArr[5], bodyName);
           tmpSqlParams.field = cfg.field.data;
@@ -4912,11 +4947,11 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         }
       } else if (reqArr[4] === "update") {
         tmpSqlParams.type = reqArr[4];
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _578 => _578.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _583 => _583.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
-        if (_optionalChain([cfg, 'optionalAccess', _579 => _579.type]) === "file") {
+        if (_optionalChain([cfg, 'optionalAccess', _584 => _584.type]) === "file") {
           const { content } = parseFileBody(opt.data);
-          const contentField = _optionalChain([cfg, 'access', _580 => _580.field, 'access', _581 => _581.data, 'optionalAccess', _582 => _582[1]]) || "content";
+          const contentField = _optionalChain([cfg, 'access', _585 => _585.field, 'access', _586 => _586.data, 'optionalAccess', _587 => _587[1]]) || "content";
           tmpSqlParams.set = [[contentField, fileContentString(content)]];
         } else {
           tmpSqlParams.set = [];
@@ -4933,18 +4968,18 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         }
       } else if (reqArr[4] === "delete") {
         tmpSqlParams.type = reqArr[4];
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _583 => _583.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _588 => _588.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       } else {
-        if (_optionalChain([cfg, 'optionalAccess', _584 => _584.as]) > 1) {
+        if (_optionalChain([cfg, 'optionalAccess', _589 => _589.as]) > 1) {
           tmpSqlParams.as = +cfg.as - 1;
         }
         tmpSqlParams.field = cfg.field.data;
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _585 => _585.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _590 => _590.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       }
     } else {
-      tmpSqlParams.as = _optionalChain([cfg, 'optionalAccess', _586 => _586.as]);
+      tmpSqlParams.as = _optionalChain([cfg, 'optionalAccess', _591 => _591.as]);
       tmpSqlParams.field = reqfield(opt.data);
       tmpSqlParams.where = reqwhere(opt.data);
       tmpSqlParams.order = reqorder(opt.data);
@@ -4954,8 +4989,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getSqlParamsByUrl, "getSqlParamsByUrl");
   function dbFresh(req, resdb) {
-    if (_optionalChain([req, 'optionalAccess', _587 => _587.url, 'optionalAccess', _588 => _588.includes, 'call', _589 => _589("/selectlist/")])) {
-      const list = Array.isArray(resdb) ? resdb : _optionalChain([resdb, 'optionalAccess', _590 => _590.data]);
+    if (_optionalChain([req, 'optionalAccess', _592 => _592.url, 'optionalAccess', _593 => _593.includes, 'call', _594 => _594("/selectlist/")])) {
+      const list = Array.isArray(resdb) ? resdb : _optionalChain([resdb, 'optionalAccess', _595 => _595.data]);
       if (Array.isArray(list)) {
         const names = list.map((el) => {
           if (typeof el === "string") {
@@ -4976,14 +5011,42 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     return resdb;
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, dbFresh, "dbFresh");
+  function normalizeFileSelectRow(row) {
+    const nameKey = _optionalChain([cfg, 'access', _596 => _596.field, 'optionalAccess', _597 => _597.data, 'optionalAccess', _598 => _598[0]]) || "name";
+    const contentKey = _optionalChain([cfg, 'access', _599 => _599.field, 'optionalAccess', _600 => _600.data, 'optionalAccess', _601 => _601[1]]) || "content";
+    if (!row || typeof row !== "object") return row;
+    const out = { ...row };
+    if (out[nameKey] != null) {
+      out[nameKey] = bareFileName(String(out[nameKey]));
+    }
+    const raw = out[contentKey];
+    if (raw != null && typeof raw !== "string") {
+      out[contentKey] = JSON.stringify(raw);
+    }
+    return out;
+  }
+  _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeFileSelectRow, "normalizeFileSelectRow");
+  function isFileSingleNameSelect(params) {
+    return _optionalChain([cfg, 'optionalAccess', _602 => _602.type]) === "file" && _optionalChain([params, 'optionalAccess', _603 => _603.type]) === "select" && !!_optionalChain([params, 'optionalAccess', _604 => _604.where, 'optionalAccess', _605 => _605.length]);
+  }
+  _chunkSMVZ3ZDJcjs.__name.call(void 0, isFileSingleNameSelect, "isFileSingleNameSelect");
   function normalizeSelectResult(params, resdb) {
     let data = resdb;
-    if (_optionalChain([params, 'optionalAccess', _591 => _591.where, 'optionalAccess', _592 => _592.length]) && Array.isArray(data) && data.length === 1) {
+    if (isFileSingleNameSelect(params)) {
+      if (Array.isArray(data)) {
+        return data.map(normalizeFileSelectRow);
+      }
+      if (data && typeof data === "object") {
+        return [normalizeFileSelectRow(data)];
+      }
+      return data;
+    }
+    if (_optionalChain([params, 'optionalAccess', _606 => _606.where, 'optionalAccess', _607 => _607.length]) && Array.isArray(data) && data.length === 1) {
       data = data[0];
     }
-    if (_optionalChain([cfg, 'optionalAccess', _593 => _593.type]) === "file" && data && typeof data === "object" && !Array.isArray(data)) {
-      const nameKey = _optionalChain([cfg, 'access', _594 => _594.field, 'optionalAccess', _595 => _595.data, 'optionalAccess', _596 => _596[0]]) || "name";
-      const contentKey = _optionalChain([cfg, 'access', _597 => _597.field, 'optionalAccess', _598 => _598.data, 'optionalAccess', _599 => _599[1]]) || "content";
+    if (_optionalChain([cfg, 'optionalAccess', _608 => _608.type]) === "file" && data && typeof data === "object" && !Array.isArray(data)) {
+      const nameKey = _optionalChain([cfg, 'access', _609 => _609.field, 'optionalAccess', _610 => _610.data, 'optionalAccess', _611 => _611[0]]) || "name";
+      const contentKey = _optionalChain([cfg, 'access', _612 => _612.field, 'optionalAccess', _613 => _613.data, 'optionalAccess', _614 => _614[1]]) || "content";
       if (data[nameKey] != null) {
         data[nameKey] = bareFileName(String(data[nameKey]));
       }
@@ -5002,7 +5065,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeSelectResult, "normalizeSelectResult");
   function dbCodePm(req, resdb) {
-    if (_optionalChain([req, 'optionalAccess', _600 => _600.Userinfo]) && _optionalChain([req, 'optionalAccess', _601 => _601.Userinfo, 'access', _602 => _602[2]])) {
+    if (_optionalChain([req, 'optionalAccess', _615 => _615.Userinfo]) && _optionalChain([req, 'optionalAccess', _616 => _616.Userinfo, 'access', _617 => _617[2]])) {
       if (resdb != null && typeof resdb === "object") {
         resdb.data = $asai.$lib.AsCode.asencode(JSON.stringify(resdb.data), req.Userinfo[2]);
       }
@@ -5016,8 +5079,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       DataServer.sqlDb(params).then((resdb) => {
         res.end(JSON.stringify($asai.$lib.As.ctxSuccess(dbCodePm(req, dbFresh(req, resdb)), opt)));
       }).catch((errdb) => {
-        const msg = String(_optionalChain([errdb, 'optionalAccess', _603 => _603.message]) || errdb || "");
-        if (_optionalChain([params, 'optionalAccess', _604 => _604.type]) === "select" && msg.includes("no such table")) {
+        const msg = String(_optionalChain([errdb, 'optionalAccess', _618 => _618.message]) || errdb || "");
+        if (_optionalChain([params, 'optionalAccess', _619 => _619.type]) === "select" && msg.includes("no such table")) {
           res.end(JSON.stringify($asai.$lib.As.ctxSuccess([], opt)));
           return;
         }
@@ -5034,23 +5097,23 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       try {
         DataServer.sqlDb(params).then((resdb) => {
           let resData = normalizeSelectResult(params, dbFresh(req, resdb));
-          if (_optionalChain([params, 'optionalAccess', _605 => _605.as]) === 2 && _optionalChain([params, 'optionalAccess', _606 => _606.field, 'optionalAccess', _607 => _607.length]) > 1) {
+          if (_optionalChain([params, 'optionalAccess', _620 => _620.as]) === 2 && _optionalChain([params, 'optionalAccess', _621 => _621.field, 'optionalAccess', _622 => _622.length]) > 1) {
             let limitArr = [];
-            if (_optionalChain([params, 'access', _608 => _608.limit, 'optionalAccess', _609 => _609.split, 'call', _610 => _610(","), 'optionalAccess', _611 => _611.length]) < 2) {
-              limitArr = [0, +_optionalChain([params, 'access', _612 => _612.limit, 'optionalAccess', _613 => _613.split, 'call', _614 => _614(","), 'optionalAccess', _615 => _615[0]])];
+            if (_optionalChain([params, 'access', _623 => _623.limit, 'optionalAccess', _624 => _624.split, 'call', _625 => _625(","), 'optionalAccess', _626 => _626.length]) < 2) {
+              limitArr = [0, +_optionalChain([params, 'access', _627 => _627.limit, 'optionalAccess', _628 => _628.split, 'call', _629 => _629(","), 'optionalAccess', _630 => _630[0]])];
             } else {
               limitArr = params.limit.split(",");
               limitArr = [+limitArr[0], +limitArr[0] + +limitArr[1]];
             }
-            if (_optionalChain([resData, 'access', _616 => _616.data, 'optionalAccess', _617 => _617.length])) {
+            if (_optionalChain([resData, 'access', _631 => _631.data, 'optionalAccess', _632 => _632.length])) {
               resData.data = resData.data.slice(+limitArr[0], +limitArr[1]);
             }
           }
           resData = dbCodePm(req, resData);
           res.end(JSON.stringify($asai.$lib.As.ctxSuccess(resData, opt)));
         }).catch((errdb) => {
-          const msg = String(_optionalChain([errdb, 'optionalAccess', _618 => _618.message]) || errdb || "");
-          if (_optionalChain([params, 'optionalAccess', _619 => _619.type]) === "select" && msg.includes("no such table")) {
+          const msg = String(_optionalChain([errdb, 'optionalAccess', _633 => _633.message]) || errdb || "");
+          if (_optionalChain([params, 'optionalAccess', _634 => _634.type]) === "select" && msg.includes("no such table")) {
             res.end(JSON.stringify($asai.$lib.As.ctxSuccess([], opt)));
             return;
           }
@@ -5065,7 +5128,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, runDefaultGet, "runDefaultGet");
   function post(req, res, hostdir, opt) {
-    if (_optionalChain([cfg, 'optionalAccess', _620 => _620.post]) && typeof cfg.post === "function") {
+    if (_optionalChain([cfg, 'optionalAccess', _635 => _635.post]) && typeof cfg.post === "function") {
       Promise.resolve(cfg.post(req, res, hostdir, opt, DataServer)).then((reqstat) => {
         if (!reqstat) runDefaultPost(req, res, opt);
       }).catch((errdb) => {
@@ -5077,7 +5140,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, post, "post");
   function get(req, res, hostdir, opt) {
-    if (_optionalChain([cfg, 'optionalAccess', _621 => _621.get]) && typeof cfg.get === "function") {
+    if (_optionalChain([cfg, 'optionalAccess', _636 => _636.get]) && typeof cfg.get === "function") {
       Promise.resolve(cfg.get(req, res, hostdir, opt, DataServer)).then((reqstat) => {
         if (!reqstat) runDefaultGet(req, res, opt);
       }).catch((errdb) => {
@@ -5092,6 +5155,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 }, "default");
 
 // src/sysserver/lib/common/reqWork.ts
+
 var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
   function hostDefault2(mod) {
     if (mod && typeof mod === "object" && "default" in mod) {
@@ -5102,8 +5166,33 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, hostDefault2, "hostDefault");
   function getPathFromOpt(opt) {
-    const rawPath = _optionalChain([opt, 'access', _622 => _622.qrdata, 'optionalAccess', _623 => _623.path]) || _optionalChain([opt, 'access', _624 => _624.data, 'optionalAccess', _625 => _625.path]);
-    return decodeURIComponent(rawPath);
+    const rawPath = _optionalChain([opt, 'access', _637 => _637.qrdata, 'optionalAccess', _638 => _638.path]) || _optionalChain([opt, 'access', _639 => _639.data, 'optionalAccess', _640 => _640.path]);
+    if (!rawPath) {
+      throw new Error("Missing path");
+    }
+    const decoded = decodeURIComponent(String(rawPath));
+    if (path4.isAbsolute(decoded)) {
+      return path4.normalize(decoded);
+    }
+    const rel = decoded.replace(/^\.(\/)?/, "");
+    const serverRoot = _optionalChain([$asai, 'optionalAccess', _641 => _641.serverRoot]);
+    if (serverRoot && rel) {
+      const absRoot = path4.resolve(serverRoot);
+      const abs = path4.resolve(absRoot, rel);
+      const relCheck = path4.relative(absRoot, abs);
+      if (relCheck === "" || !relCheck.startsWith("..") && !path4.isAbsolute(relCheck)) {
+        return abs;
+      }
+    }
+    const roots = _optionalChain([$asai, 'optionalAccess', _642 => _642.asaihost, 'optionalAccess', _643 => _643.getHostAllowedRoots, 'optionalCall', _644 => _644(_optionalChain([$asai, 'optionalAccess', _645 => _645.hostconfig]))]) || [];
+    if (!roots.length) {
+      const fallback = _optionalChain([$asai, 'optionalAccess', _646 => _646.serverRoot]) || process.cwd();
+      if (fallback) roots.push(fallback);
+    }
+    if (!_optionalChain([$asai, 'optionalAccess', _647 => _647.asaihost, 'optionalAccess', _648 => _648.resolvePathUnderRoots])) {
+      throw new Error("Path resolver unavailable");
+    }
+    return $asai.asaihost.resolvePathUnderRoots(decoded, roots);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getPathFromOpt, "getPathFromOpt");
   function sendSuccess(res, data, opt) {
@@ -5112,18 +5201,18 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendSuccess, "sendSuccess");
   function sendErr(res, ec, params, opt) {
-    const ErrorCode = _optionalChain([$asai, 'access', _626 => _626.$lib, 'optionalAccess', _627 => _627.ErrorCode]);
-    _optionalChain([ErrorCode, 'optionalAccess', _628 => _628.loadErrorCodes, 'optionalCall', _629 => _629($asai)]);
-    _optionalChain([ErrorCode, 'optionalAccess', _630 => _630.logError, 'optionalCall', _631 => _631($asai, ec, Array.isArray(params) ? params.map(String) : params != null ? [String(params)] : void 0)]);
+    const ErrorCode = _optionalChain([$asai, 'access', _649 => _649.$lib, 'optionalAccess', _650 => _650.ErrorCode]);
+    _optionalChain([ErrorCode, 'optionalAccess', _651 => _651.loadErrorCodes, 'optionalCall', _652 => _652($asai)]);
+    _optionalChain([ErrorCode, 'optionalAccess', _653 => _653.logError, 'optionalCall', _654 => _654($asai, ec, Array.isArray(params) ? params.map(String) : params != null ? [String(params)] : void 0)]);
     const response = $asai.$lib.As.ctxErr(ec, params, opt);
     res.end(JSON.stringify(response));
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendErr, "sendErr");
   function sendFail(res, err, opt) {
-    const ErrorCode = _optionalChain([$asai, 'access', _632 => _632.$lib, 'optionalAccess', _633 => _633.ErrorCode]);
-    _optionalChain([ErrorCode, 'optionalAccess', _634 => _634.loadErrorCodes, 'optionalCall', _635 => _635($asai)]);
-    const normalized = _optionalChain([ErrorCode, 'optionalAccess', _636 => _636.normalizeErrPayload, 'optionalCall', _637 => _637(err)]);
-    if (_optionalChain([normalized, 'optionalAccess', _638 => _638.ec])) {
+    const ErrorCode = _optionalChain([$asai, 'access', _655 => _655.$lib, 'optionalAccess', _656 => _656.ErrorCode]);
+    _optionalChain([ErrorCode, 'optionalAccess', _657 => _657.loadErrorCodes, 'optionalCall', _658 => _658($asai)]);
+    const normalized = _optionalChain([ErrorCode, 'optionalAccess', _659 => _659.normalizeErrPayload, 'optionalCall', _660 => _660(err)]);
+    if (_optionalChain([normalized, 'optionalAccess', _661 => _661.ec])) {
       return sendErr(res, normalized.ec, normalized.pm, opt);
     }
     const response = $asai.$lib.As.ctxFail(err);
@@ -5131,7 +5220,7 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendFail, "sendFail");
   function mnLog(...arg) {
-    (_optionalChain([$asai, 'optionalAccess', _639 => _639.$log]) || console.log)(...arg);
+    (_optionalChain([$asai, 'optionalAccess', _662 => _662.$log]) || console.log)(...arg);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mnLog, "mnLog");
   return { hostDefault: hostDefault2, getPathFromOpt, sendSuccess, sendFail, sendErr, mnLog };
@@ -5231,7 +5320,7 @@ async function removeFile(filePath) {
   try {
     await _promises2.default.unlink(nodePath2.default.normalize(filePath));
   } catch (err) {
-    if (_optionalChain([err, 'optionalAccess', _640 => _640.code]) !== "ENOENT") throw err;
+    if (_optionalChain([err, 'optionalAccess', _663 => _663.code]) !== "ENOENT") throw err;
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, removeFile, "removeFile");
@@ -5251,83 +5340,6 @@ async function writeJson(filePath, data) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, writeJson, "writeJson");
 
-// src/sysserver/lib/common/AsPath.ts
-var AsPath_exports = {};
-_chunkSMVZ3ZDJcjs.__export.call(void 0, AsPath_exports, {
-  getEntryDir: () => getEntryDir,
-  getExecDir: () => getExecDir,
-  getPkgSnapshotDir: () => getPkgSnapshotDir,
-  getPrimaryServerRoot: () => getPrimaryServerRoot,
-  getRuntimeBaseDirs: () => getRuntimeBaseDirs,
-  isPkgRuntime: () => isPkgRuntime
-});
-
-
-function isPkgRuntime() {
-  return typeof process.pkg !== "undefined";
-}
-_chunkSMVZ3ZDJcjs.__name.call(void 0, isPkgRuntime, "isPkgRuntime");
-function getPkgSnapshotDir() {
-  if (!isPkgRuntime()) return void 0;
-  const entry = _nullishCoalesce(_optionalChain([process, 'access', _641 => _641.pkg, 'optionalAccess', _642 => _642.entrypoint]), () => ( _optionalChain([process, 'access', _643 => _643.pkg, 'optionalAccess', _644 => _644.defaultEntrypoint])));
-  if (!entry) return void 0;
-  return nodePath4.resolve(nodePath4.dirname(entry));
-}
-_chunkSMVZ3ZDJcjs.__name.call(void 0, getPkgSnapshotDir, "getPkgSnapshotDir");
-function getEntryDir() {
-  const snapshot = getPkgSnapshotDir();
-  if (snapshot) return snapshot;
-  const entry = process.argv[1];
-  if (!entry) {
-    return nodePath4.dirname(process.execPath);
-  }
-  return nodePath4.resolve(nodePath4.dirname(entry));
-}
-_chunkSMVZ3ZDJcjs.__name.call(void 0, getEntryDir, "getEntryDir");
-function getExecDir() {
-  return nodePath4.dirname(process.execPath);
-}
-_chunkSMVZ3ZDJcjs.__name.call(void 0, getExecDir, "getExecDir");
-function getRuntimeBaseDirs() {
-  const bases = [];
-  const seen = /* @__PURE__ */ new Set();
-  const add = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (p) => {
-    if (!p) return;
-    const abs = nodePath4.resolve(p);
-    if (!seen.has(abs)) {
-      seen.add(abs);
-      bases.push(abs);
-    }
-  }, "add");
-  add(process.cwd());
-  add(getExecDir());
-  if (isPkgRuntime()) {
-    add(getPkgSnapshotDir());
-  } else {
-    const entryDir = getEntryDir();
-    if (entryDir !== getExecDir()) {
-      add(entryDir);
-    }
-  }
-  return bases;
-}
-_chunkSMVZ3ZDJcjs.__name.call(void 0, getRuntimeBaseDirs, "getRuntimeBaseDirs");
-function getPrimaryServerRoot() {
-  for (const base of getRuntimeBaseDirs()) {
-    try {
-      if (fs10.statSync(nodePath4.join(base, "websys")).isDirectory()) {
-        return base;
-      }
-    } catch (e46) {
-    }
-  }
-  if (isPkgRuntime()) {
-    return getExecDir();
-  }
-  return getEntryDir();
-}
-_chunkSMVZ3ZDJcjs.__name.call(void 0, getPrimaryServerRoot, "getPrimaryServerRoot");
-
 // src/sysserver/lib/index.ts
 var lib_default = {
   As: As_default,
@@ -5335,12 +5347,12 @@ var lib_default = {
   AsAES: AsAES_default,
   AsDb: AsDb_default,
   AsFs: AsFs_exports,
-  AsPath: AsPath_exports,
+  AsPath: _chunkHR5JKN7Ycjs.AsPath_exports,
   reqWork: reqWork_default,
   ErrorCode: ErrorCode_default,
-  InterventionLog: _chunk4E7Z5K5Ucjs.InterventionLog_exports,
-  LogStore: _chunkTKJAHTPOcjs.LogStore_exports,
-  InterventionHooks: _chunkRIRKIYETcjs.intervention_hooks_exports
+  InterventionLog: _chunkU2YJH2RWcjs.InterventionLog_exports,
+  LogStore: _chunkHR5JKN7Ycjs.LogStore_exports,
+  InterventionHooks: _chunkARHPHWT5cjs.intervention_hooks_exports
 };
 
 // src/sysserver/db/src/common.ts
@@ -5421,11 +5433,11 @@ function toInsertRows(sql) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, toInsertRows, "toInsertRows");
 function isPathInside(baseDir, targetPath) {
-  const base = path5.resolve(baseDir);
-  const target = path5.resolve(targetPath);
-  const relative4 = path5.relative(base, target);
-  if (!relative4) return true;
-  return !relative4.startsWith("..") && !path5.isAbsolute(relative4);
+  const base = path6.resolve(baseDir);
+  const target = path6.resolve(targetPath);
+  const relative5 = path6.relative(base, target);
+  if (!relative5) return true;
+  return !relative5.startsWith("..") && !path6.isAbsolute(relative5);
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, isPathInside, "isPathInside");
 function joinTablePath(table, ...segments) {
@@ -5620,22 +5632,23 @@ function dbDriver(opt = {}) {
       this.fileExt = config.ext === ".*" ? "" : config.ext || "";
       this.fileDel = (config.del || 0) !== 0;
       this.createDir = config.create || false;
-      this.baseDirAbs = path6.resolve(process.cwd(), config.dir);
+      const root = _optionalChain([config, 'access', _664 => _664.$asai, 'optionalAccess', _665 => _665.serverRoot]) || _chunkHR5JKN7Ycjs.getPrimaryServerRoot.call(void 0, );
+      this.baseDirAbs = path7.resolve(root, config.dir);
     }
     dbLog(...args) {
-      (_optionalChain([this, 'access', _645 => _645.config, 'optionalAccess', _646 => _646.$asai, 'optionalAccess', _647 => _647.$log]) || console.log)("FILE", ...args);
+      (_optionalChain([this, 'access', _666 => _666.config, 'optionalAccess', _667 => _667.$asai, 'optionalAccess', _668 => _668.$log]) || console.log)("FILE", ...args);
     }
     checkFile(file) {
-      return fs11.existsSync(this.getAbsPath(file, false));
+      return fs10.existsSync(this.getAbsPath(file, false));
     }
     /** 解析相对路径并限制在数据根目录内，防止路径穿越（跨平台） */
     resolvePath(relPath) {
       if (!relPath) {
         return this.baseDirAbs;
       }
-      const abs = path6.isAbsolute(relPath) ? path6.normalize(relPath) : path6.resolve(this.baseDirAbs, relPath);
+      const abs = path7.isAbsolute(relPath) ? path7.normalize(relPath) : path7.resolve(this.baseDirAbs, relPath);
       if (!isPathInside2(this.baseDirAbs, abs)) {
-        return this.baseDirAbs;
+        throw new Error("Path not allowed");
       }
       return abs;
     }
@@ -5647,15 +5660,15 @@ function dbDriver(opt = {}) {
       if (!relPath) {
         return "";
       }
-      return path6.isAbsolute(relPath) ? path6.relative(this.baseDirAbs, relPath) : relPath;
+      return path7.isAbsolute(relPath) ? path7.relative(this.baseDirAbs, relPath) : relPath;
     }
     ensureDir(relPath) {
-      const relative4 = this.normalizeRelPath(relPath);
-      const dirPath = path6.dirname(relative4);
+      const relative5 = this.normalizeRelPath(relPath);
+      const dirPath = path7.dirname(relative5);
       const absDir = this.resolvePath(dirPath === "." ? "" : dirPath);
-      if (this.createDir && !fs11.existsSync(absDir)) {
+      if (this.createDir && !fs10.existsSync(absDir)) {
         this.dbLog("mkdir", "[MKDIR]", absDir);
-        fs11.mkdirSync(absDir, { recursive: true });
+        fs10.mkdirSync(absDir, { recursive: true });
       }
       return absDir;
     }
@@ -5671,34 +5684,34 @@ function dbDriver(opt = {}) {
     }
     deldir(relativePath) {
       const absPath = this.resolvePath(relativePath);
-      if (!fs11.existsSync(absPath)) {
+      if (!fs10.existsSync(absPath)) {
         return;
       }
       this.dbLog("delete", "[RMDIR]", absPath);
-      const entries = fs11.readdirSync(absPath, { withFileTypes: true });
+      const entries = fs10.readdirSync(absPath, { withFileTypes: true });
       for (const entry of entries) {
-        const current = path6.join(absPath, entry.name);
+        const current = path7.join(absPath, entry.name);
         if (entry.isDirectory()) {
-          this.deldir(path6.join(relativePath, entry.name));
+          this.deldir(path7.join(relativePath, entry.name));
         } else {
           this.dbLog("delete", "[UNLINK]", current);
-          fs11.unlinkSync(current);
+          fs10.unlinkSync(current);
         }
       }
-      fs11.rmdirSync(absPath);
+      fs10.rmdirSync(absPath);
     }
     getReadPath(file, sql) {
       const candidates = [];
-      if (_optionalChain([sql, 'optionalAccess', _648 => _648.filename])) {
-        candidates.push({ dir: path6.join(file, sql.filename) });
-        candidates.push({ dir: path6.join(file + ".delete" + this.fileExt, sql.filename) });
+      if (_optionalChain([sql, 'optionalAccess', _669 => _669.filename])) {
+        candidates.push({ dir: path7.join(file, sql.filename) });
+        candidates.push({ dir: path7.join(file + ".delete" + this.fileExt, sql.filename) });
       } else {
         candidates.push({ dir: file });
         candidates.push({ dir: file + this.fileExt + ".delete" });
       }
       for (const candidate of candidates) {
         const abs = this.getAbsPath(candidate.dir, false);
-        if (fs11.existsSync(abs)) {
+        if (fs10.existsSync(abs)) {
           return { path: abs, dir: candidate.dir };
         }
       }
@@ -5709,22 +5722,22 @@ function dbDriver(opt = {}) {
       if (!read2.path) {
         return { path: "", dir: read2.dir };
       }
-      if (_optionalChain([sql, 'optionalAccess', _649 => _649.filename])) {
-        return { path: path6.dirname(read2.path), dir: path6.dirname(read2.dir) };
+      if (_optionalChain([sql, 'optionalAccess', _670 => _670.filename])) {
+        return { path: path7.dirname(read2.path), dir: path7.dirname(read2.dir) };
       }
       return { path: read2.path, dir: read2.dir };
     }
     getNewPath(file, sql) {
-      if (_optionalChain([sql, 'optionalAccess', _650 => _650.filename])) {
-        return this.getAbsPath(path6.join(file, sql.filename), true);
+      if (_optionalChain([sql, 'optionalAccess', _671 => _671.filename])) {
+        return this.getAbsPath(path7.join(file, sql.filename), true);
       }
       return this.getAbsPath(file, true);
     }
     write(file, data, sql) {
       try {
-        const filePath = _optionalChain([sql, 'optionalAccess', _651 => _651.type]) === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
+        const filePath = _optionalChain([sql, 'optionalAccess', _672 => _672.type]) === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
         this.dbLog("write", "[WRITE]", filePath);
-        fs11.writeFileSync(filePath, data, "utf8");
+        fs10.writeFileSync(filePath, data, "utf8");
         return "ok";
       } catch (e) {
         this.dbLog("write failed", "[WRITE ERROR]", e);
@@ -5738,7 +5751,7 @@ function dbDriver(opt = {}) {
           return { error: "empty" };
         }
         this.dbLog("read", "[READ]", read2.path);
-        const data = fs11.readFileSync(read2.path, { encoding }) || "";
+        const data = fs10.readFileSync(read2.path, { encoding }) || "";
         const fileName = this.fileExt && read2.dir.endsWith(this.fileExt) ? read2.dir : read2.dir + this.fileExt;
         return [{ data, file: fileName }];
       } catch (e) {
@@ -5752,15 +5765,15 @@ function dbDriver(opt = {}) {
         if (!del.path) {
           return "";
         }
-        if (this.fileDel && _optionalChain([sql, 'optionalAccess', _652 => _652.deltrue])) {
+        if (this.fileDel && _optionalChain([sql, 'optionalAccess', _673 => _673.deltrue])) {
           const target = del.path + ".delete" + this.fileExt;
           this.dbLog("soft delete", "[SOFT DELETE]", `${del.path} -> ${target}`);
-          fs11.renameSync(del.path, target);
-        } else if (_optionalChain([sql, 'optionalAccess', _653 => _653.filename])) {
+          fs10.renameSync(del.path, target);
+        } else if (_optionalChain([sql, 'optionalAccess', _674 => _674.filename])) {
           this.deldir(del.dir);
         } else {
           this.dbLog("delete", "[DELETE]", del.path);
-          fs11.unlinkSync(del.path);
+          fs10.unlinkSync(del.path);
         }
         return "ok";
       } catch (e) {
@@ -5779,11 +5792,11 @@ function dbDriver(opt = {}) {
           const original = del.path.replace(new RegExp(`.delete${extPattern}$`), "");
           if (original !== del.path) {
             this.dbLog("restore", "[RESTORE]", `${del.path} -> ${original}`);
-            fs11.renameSync(del.path, original);
+            fs10.renameSync(del.path, original);
           }
         } else {
           this.dbLog("force delete", "[FORCE DELETE]", del.path);
-          fs11.unlinkSync(del.path);
+          fs10.unlinkSync(del.path);
         }
         return "ok";
       } catch (e) {
@@ -5797,9 +5810,9 @@ function dbDriver(opt = {}) {
         this.dbLog("list", "[LIST]", absDir);
         let entries;
         try {
-          entries = fs11.readdirSync(absDir, { withFileTypes: true });
-        } catch (e47) {
-          return _optionalChain([sql, 'optionalAccess', _654 => _654.list]) ? { open: [], delete: [] } : [];
+          entries = fs10.readdirSync(absDir, { withFileTypes: true });
+        } catch (e46) {
+          return _optionalChain([sql, 'optionalAccess', _675 => _675.list]) ? { open: [], delete: [] } : [];
         }
         const result = { open: [], delete: [] };
         const deleteSuffix = ".delete" + this.fileExt;
@@ -5809,19 +5822,19 @@ function dbDriver(opt = {}) {
           const isDelete = fileName.endsWith(deleteSuffix);
           const baseName = isDelete ? fileName.slice(0, -deleteSuffix.length) : fileName;
           if (this.fileExt && !baseName.endsWith(this.fileExt)) continue;
-          const fullPath = path6.join(absDir, fileName);
+          const fullPath = path7.join(absDir, fileName);
           try {
-            const data = fs11.readFileSync(fullPath, "utf8");
+            const data = fs10.readFileSync(fullPath, "utf8");
             const entryData = { data, file: baseName };
             if (isDelete) {
-              if (_optionalChain([sql, 'optionalAccess', _655 => _655.list])) result.delete.push(entryData);
+              if (_optionalChain([sql, 'optionalAccess', _676 => _676.list])) result.delete.push(entryData);
             } else {
               result.open.push(entryData);
             }
-          } catch (e48) {
+          } catch (e47) {
           }
         }
-        return _optionalChain([sql, 'optionalAccess', _656 => _656.list]) ? result : result.open;
+        return _optionalChain([sql, 'optionalAccess', _677 => _677.list]) ? result : result.open;
       } catch (e) {
         this.dbLog("list failed", "[LIST ERROR]", e);
         return e;
@@ -5831,7 +5844,7 @@ function dbDriver(opt = {}) {
     getFileNameFromWhere(where) {
       if (!where || !Array.isArray(where)) return "";
       const first = where.find((item) => Array.isArray(item));
-      const raw = _optionalChain([first, 'optionalAccess', _657 => _657[2]]);
+      const raw = _optionalChain([first, 'optionalAccess', _678 => _678[2]]);
       if (typeof raw === "string") {
         return raw.replace(/^'+|'+$/g, "");
       }
@@ -5856,22 +5869,22 @@ function dbDriver(opt = {}) {
             const data = sql.set[0][1];
             result = this.write(this.tableFilePath(sql.table, file), data, sql);
           } else if (sql.type === "select") {
-            if (_optionalChain([sql, 'optionalAccess', _658 => _658.where, 'optionalAccess', _659 => _659.length]) && _optionalChain([sql, 'optionalAccess', _660 => _660.as]) !== 2) {
+            if (_optionalChain([sql, 'optionalAccess', _679 => _679.where, 'optionalAccess', _680 => _680.length]) && _optionalChain([sql, 'optionalAccess', _681 => _681.as]) !== 2) {
               const file = this.getFileNameFromWhere(sql.where);
               const readRes = this.read(this.tableFilePath(sql.table, file), sql);
               const resObj = {};
-              if (_optionalChain([readRes, 'optionalAccess', _661 => _661[0], 'optionalAccess', _662 => _662.file]) && !readRes.error) {
+              if (_optionalChain([readRes, 'optionalAccess', _682 => _682[0], 'optionalAccess', _683 => _683.file]) && !readRes.error) {
                 if (sql.as === 1) {
                   try {
                     const parsed = JSON.parse(readRes[0].data);
-                    if (_optionalChain([sql, 'access', _663 => _663.field, 'optionalAccess', _664 => _664.length])) {
+                    if (_optionalChain([sql, 'access', _684 => _684.field, 'optionalAccess', _685 => _685.length])) {
                       sql.field.forEach((f) => {
                         resObj[f] = _nullishCoalesce(parsed[f], () => ( ""));
                       });
                     } else {
                       Object.assign(resObj, parsed);
                     }
-                  } catch (e49) {
+                  } catch (e48) {
                   }
                 } else {
                   const fields = sql.field;
@@ -5885,7 +5898,7 @@ function dbDriver(opt = {}) {
             } else {
               const listRes = this.list(tableDir, sql);
               if (listRes && !listRes.error) {
-                if (_optionalChain([sql, 'optionalAccess', _665 => _665.list])) {
+                if (_optionalChain([sql, 'optionalAccess', _686 => _686.list])) {
                   const mapEntry = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (el) => {
                     const fields = sql.field;
                     const item = { [fields[0]]: el.file };
@@ -5896,9 +5909,9 @@ function dbDriver(opt = {}) {
                   if (listRes.delete) listRes.delete = listRes.delete.map(mapEntry);
                   result = listRes;
                 } else {
-                  if (_optionalChain([sql, 'optionalAccess', _666 => _666.as]) === 2) {
+                  if (_optionalChain([sql, 'optionalAccess', _687 => _687.as]) === 2) {
                     let items = listRes;
-                    if (_optionalChain([sql, 'access', _667 => _667.where, 'optionalAccess', _668 => _668.length])) {
+                    if (_optionalChain([sql, 'access', _688 => _688.where, 'optionalAccess', _689 => _689.length])) {
                       const where = sql.where;
                       const whereType = typeof where[0] === "string" ? where[0] : "and";
                       items = items.filter((el) => {
@@ -5912,7 +5925,7 @@ function dbDriver(opt = {}) {
                           let fieldVal = "";
                           try {
                             fieldVal = _nullishCoalesce(JSON.parse(el.data)[field], () => ( ""));
-                          } catch (e50) {
+                          } catch (e49) {
                           }
                           const condMatch = String(fieldVal).includes(searchVal);
                           if (whereType === "and") {
@@ -5930,18 +5943,18 @@ function dbDriver(opt = {}) {
                       const obj = {};
                       try {
                         const parsed = JSON.parse(el.data);
-                        if (_optionalChain([sql, 'access', _669 => _669.field, 'optionalAccess', _670 => _670.length])) {
+                        if (_optionalChain([sql, 'access', _690 => _690.field, 'optionalAccess', _691 => _691.length])) {
                           sql.field.forEach((f) => {
                             obj[f] = _nullishCoalesce(parsed[f], () => ( ""));
                           });
                         } else {
                           Object.assign(obj, parsed);
                         }
-                      } catch (e51) {
+                      } catch (e50) {
                       }
                       return obj;
                     });
-                    if (_optionalChain([sql, 'access', _671 => _671.order, 'optionalAccess', _672 => _672.length])) {
+                    if (_optionalChain([sql, 'access', _692 => _692.order, 'optionalAccess', _693 => _693.length])) {
                       const orderField = sql.order[0];
                       const orderFieldName = typeof orderField === "string" ? orderField : orderField[0];
                       const direction = typeof orderField === "string" ? "ASC" : String(orderField[1]).toUpperCase();
@@ -5962,7 +5975,7 @@ function dbDriver(opt = {}) {
                   }
                 }
               } else {
-                result = _optionalChain([sql, 'optionalAccess', _673 => _673.list]) ? { open: [], delete: [] } : [];
+                result = _optionalChain([sql, 'optionalAccess', _694 => _694.list]) ? { open: [], delete: [] } : [];
               }
             }
           }
@@ -6018,7 +6031,7 @@ function sysserver($asai, opt = {}) {
   if (!$asai.$lib) $asai.$lib = {};
   $asai.$lib = { ...lib_default, ...$asai.$lib, ...opt || {} };
   $asai.dataserver = db_default;
-  _optionalChain([$asai, 'access', _674 => _674.$lib, 'access', _675 => _675.ErrorCode, 'optionalAccess', _676 => _676.loadErrorCodes, 'optionalCall', _677 => _677($asai)]);
+  _optionalChain([$asai, 'access', _695 => _695.$lib, 'access', _696 => _696.ErrorCode, 'optionalAccess', _697 => _697.loadErrorCodes, 'optionalCall', _698 => _698($asai)]);
   if (!$asai.$lib.api) $asai.$lib.api = {};
   $asai.$lib.api = { ...api_default, ...$asai.$lib.api };
   if (!$asai.$lib.ws) $asai.$lib.ws = {};
@@ -6211,7 +6224,7 @@ function normalizeDataStoresConfig(cfg) {
     }
     if (userStore.opt.create == null) userStore.opt.create = 1;
   }
-  if (!stores.log && _optionalChain([cfg, 'access', _678 => _678.logger, 'optionalAccess', _679 => _679.store])) {
+  if (!stores.log && _optionalChain([cfg, 'access', _699 => _699.logger, 'optionalAccess', _700 => _700.store])) {
     const s = cfg.logger.store;
     stores.log = {
       type: s.type || "file",
@@ -6275,13 +6288,13 @@ function validateHostConfig(cfg) {
   if (cfg.asaisn != null) {
     errors.push("asaisn \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_ASAISN");
   }
-  if (_optionalChain([cfg, 'access', _680 => _680.aes, 'optionalAccess', _681 => _681.keybase64]) != null) {
+  if (_optionalChain([cfg, 'access', _701 => _701.aes, 'optionalAccess', _702 => _702.keybase64]) != null) {
     errors.push("aes.keybase64 \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_AES_KEYBASE64");
   }
-  if (_optionalChain([cfg, 'access', _682 => _682.httpscert, 'optionalAccess', _683 => _683.key]) != null || _optionalChain([cfg, 'access', _684 => _684.httpscert, 'optionalAccess', _685 => _685.cert]) != null) {
+  if (_optionalChain([cfg, 'access', _703 => _703.httpscert, 'optionalAccess', _704 => _704.key]) != null || _optionalChain([cfg, 'access', _705 => _705.httpscert, 'optionalAccess', _706 => _706.cert]) != null) {
     errors.push("httpscert.key/cert \u7981\u6B62\u5185\u8054\u4E8E asaihost.json\uFF0C\u8BF7\u4F7F\u7528 keyPath/certPath \u6216\u73AF\u5883\u53D8\u91CF");
   }
-  if (_optionalChain([cfg, 'access', _686 => _686.security, 'optionalAccess', _687 => _687.sessionSecret]) != null) {
+  if (_optionalChain([cfg, 'access', _707 => _707.security, 'optionalAccess', _708 => _708.sessionSecret]) != null) {
     errors.push("security.sessionSecret \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_SESSION_SECRET");
   }
   if (Array.isArray(cfg.wssec) && typeof cfg.wssec[0] === "string" && cfg.wssec[0].length > 0) {
@@ -6336,10 +6349,10 @@ function validateHostConfig(cfg) {
       validateHostSiteLimits(name, h, errors);
     }
   }
-  if (_optionalChain([cfg, 'access', _688 => _688.logger, 'optionalAccess', _689 => _689.sample]) && typeof cfg.logger.sample !== "object") {
+  if (_optionalChain([cfg, 'access', _709 => _709.logger, 'optionalAccess', _710 => _710.sample]) && typeof cfg.logger.sample !== "object") {
     errors.push('logger.sample \u5FC5\u987B\u4E3A\u5BF9\u8C61\uFF08\u5982 { "REQ_OTHER": 0.1 }\uFF09');
   }
-  if (_optionalChain([cfg, 'access', _690 => _690.logger, 'optionalAccess', _691 => _691.skip]) != null && !Array.isArray(cfg.logger.skip)) {
+  if (_optionalChain([cfg, 'access', _711 => _711.logger, 'optionalAccess', _712 => _712.skip]) != null && !Array.isArray(cfg.logger.skip)) {
     errors.push('logger.skip \u5FC5\u987B\u4E3A\u5B57\u7B26\u4E32\u6570\u7EC4\uFF08\u5982 ["/sys/info/metrics"]\uFF09');
   }
   if (cfg.proxyhosts && typeof cfg.proxyhosts === "object") {
@@ -6373,7 +6386,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, validateHostSiteLimits, "validateHostSiteL
 function validateProductionSecurity(cfg) {
   const errors = [];
   if (process.env.NODE_ENV !== "production") return errors;
-  const sec = _optionalChain([cfg, 'optionalAccess', _692 => _692.security]);
+  const sec = _optionalChain([cfg, 'optionalAccess', _713 => _713.security]);
   if (!sec || typeof sec !== "object") {
     errors.push("\u751F\u4EA7\u73AF\u5883\u5FC5\u987B\u914D\u7F6E security \u5BF9\u8C61");
     return errors;
@@ -6384,7 +6397,7 @@ function validateProductionSecurity(cfg) {
   if (sec.allowRegister === 1) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.allowRegister \u5E94\u4E3A 0\uFF08CR 1.3 \u7981\u6B62\u5F00\u653E\u6CE8\u518C\uFF09");
   }
-  if (!_optionalChain([sec, 'access', _693 => _693.quota, 'optionalAccess', _694 => _694.enabled])) {
+  if (!_optionalChain([sec, 'access', _714 => _714.quota, 'optionalAccess', _715 => _715.enabled])) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.quota.enabled \u5E94\u4E3A 1\uFF08CR 7.1 \u8D44\u6E90\u9650\u5236\uFF09");
   }
   if (sec.csp !== 1) {
@@ -6393,7 +6406,7 @@ function validateProductionSecurity(cfg) {
   if (typeof sec.minUserLevel !== "number" || sec.minUserLevel < 0) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.minUserLevel \u5E94\u663E\u5F0F\u914D\u7F6E");
   }
-  if (sec.forceWss === 1 && !_optionalChain([cfg, 'optionalAccess', _695 => _695.httpscert, 'optionalAccess', _696 => _696.keyPath]) && !_optionalChain([cfg, 'optionalAccess', _697 => _697.httpscert, 'optionalAccess', _698 => _698.key])) {
+  if (sec.forceWss === 1 && !_optionalChain([cfg, 'optionalAccess', _716 => _716.httpscert, 'optionalAccess', _717 => _717.keyPath]) && !_optionalChain([cfg, 'optionalAccess', _718 => _718.httpscert, 'optionalAccess', _719 => _719.key])) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.forceWss=1 \u65F6\u9700\u914D\u7F6E HTTPS \u8BC1\u4E66");
   }
   return errors;
@@ -6412,12 +6425,12 @@ var DEFAULT_RECONNECT = {
   rs485: { enabled: true, maxRetries: 60, initialDelay: 3e3, maxDelay: 3e4, factor: 2 }
 };
 function getTransportBlock(cfg, kind) {
-  const block = _optionalChain([cfg, 'optionalAccess', _699 => _699[kind]]);
+  const block = _optionalChain([cfg, 'optionalAccess', _720 => _720[kind]]);
   return block && typeof block === "object" ? block : null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getTransportBlock, "getTransportBlock");
 function getTransportDefault(cfg, kind) {
-  const def = _optionalChain([getTransportBlock, 'call', _700 => _700(cfg, kind), 'optionalAccess', _701 => _701.default]);
+  const def = _optionalChain([getTransportBlock, 'call', _721 => _721(cfg, kind), 'optionalAccess', _722 => _722.default]);
   return def && typeof def === "object" ? def : null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getTransportDefault, "getTransportDefault");
@@ -6427,7 +6440,7 @@ function hasTransportDefault(cfg, kind) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, hasTransportDefault, "hasTransportDefault");
 function getDefaultConnId(cfg, kind) {
   const def = getTransportDefault(cfg, kind);
-  const id = _optionalChain([def, 'optionalAccess', _702 => _702.id]);
+  const id = _optionalChain([def, 'optionalAccess', _723 => _723.id]);
   return typeof id === "string" && id.length > 0 ? id : DEFAULT_CONN_ID[kind];
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getDefaultConnId, "getDefaultConnId");
@@ -6438,14 +6451,14 @@ function shouldAutoConnect(def) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, shouldAutoConnect, "shouldAutoConnect");
 function resolveReconnectOptions(def, kind, cfg) {
   const base = DEFAULT_RECONNECT[kind];
-  const rc = _optionalChain([def, 'optionalAccess', _703 => _703.reconnect]);
-  const tmMaxTry = _optionalChain([cfg, 'optionalAccess', _704 => _704.tm, 'optionalAccess', _705 => _705.maxtry]);
+  const rc = _optionalChain([def, 'optionalAccess', _724 => _724.reconnect]);
+  const tmMaxTry = _optionalChain([cfg, 'optionalAccess', _725 => _725.tm, 'optionalAccess', _726 => _726.maxtry]);
   return {
-    enabled: _optionalChain([rc, 'optionalAccess', _706 => _706.enabled]) !== false && base.enabled !== false,
-    maxRetries: _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _707 => _707.maxRetries]), () => ( tmMaxTry)), () => ( base.maxRetries)), () => ( 60)),
-    initialDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _708 => _708.initialDelay]), () => ( base.initialDelay)), () => ( 1e3)),
-    maxDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _709 => _709.maxDelay]), () => ( base.maxDelay)), () => ( 3e4)),
-    factor: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _710 => _710.factor]), () => ( base.factor)), () => ( 2))
+    enabled: _optionalChain([rc, 'optionalAccess', _727 => _727.enabled]) !== false && base.enabled !== false,
+    maxRetries: _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _728 => _728.maxRetries]), () => ( tmMaxTry)), () => ( base.maxRetries)), () => ( 60)),
+    initialDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _729 => _729.initialDelay]), () => ( base.initialDelay)), () => ( 1e3)),
+    maxDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _730 => _730.maxDelay]), () => ( base.maxDelay)), () => ( 3e4)),
+    factor: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _731 => _731.factor]), () => ( base.factor)), () => ( 2))
   };
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveReconnectOptions, "resolveReconnectOptions");
@@ -6495,17 +6508,17 @@ function createTransportDataHandler($asai, manager) {
     if (typeof event.data === "string") {
       try {
         event.data = JSON.parse(event.data);
-      } catch (e52) {
+      } catch (e51) {
       }
     }
-    if (_optionalChain([event, 'access', _711 => _711.data, 'optionalAccess', _712 => _712.id])) {
+    if (_optionalChain([event, 'access', _732 => _732.data, 'optionalAccess', _733 => _733.id])) {
       manager.watch(event.id, event.data);
       return;
     }
     try {
-      const wsKey = _optionalChain([$asai, 'optionalAccess', _713 => _713.command, 'optionalAccess', _714 => _714.commandconfig, 'optionalAccess', _715 => _715.config, 'optionalAccess', _716 => _716.commandclient]);
-      _optionalChain([$asai, 'access', _717 => _717.serversws, 'optionalAccess', _718 => _718[wsKey], 'optionalAccess', _719 => _719.broadws, 'optionalCall', _720 => _720(event.data)]);
-    } catch (e53) {
+      const wsKey = _optionalChain([$asai, 'optionalAccess', _734 => _734.command, 'optionalAccess', _735 => _735.commandconfig, 'optionalAccess', _736 => _736.config, 'optionalAccess', _737 => _737.commandclient]);
+      _optionalChain([$asai, 'access', _738 => _738.serversws, 'optionalAccess', _739 => _739[wsKey], 'optionalAccess', _740 => _740.broadws, 'optionalCall', _741 => _741(event.data)]);
+    } catch (e52) {
     }
   };
 }
@@ -6552,20 +6565,20 @@ var initAsaiHostNodejs2 = {
   initHostserverWs,
   syncApiRouteKeys,
   syncWsRouteKeys,
-  secureCompare: _chunkK2QPSQEVcjs.secureCompare,
+  secureCompare: _chunkWXW5DYNUcjs.secureCompare,
   resolvePathUnderRoots,
   getHostAllowedRoots,
   logSecurityEvent,
   sanitizeString,
   validateHttpAuth,
   normalizeSecurityConfig,
-  stripForbiddenSecretsFromHostConfig: _chunkLXJMGLKWcjs.stripForbiddenSecretsFromHostConfig,
-  loadAsaiSecrets: _chunkLXJMGLKWcjs.loadAsaiSecrets,
-  loadDotEnvFile: _chunkLXJMGLKWcjs.loadDotEnvFile,
-  applySecretsToHostConfig: _chunkLXJMGLKWcjs.applySecretsToHostConfig,
-  resolveHttpsCertFromPaths: _chunkLXJMGLKWcjs.resolveHttpsCertFromPaths,
-  validateAsaiSecrets: _chunkLXJMGLKWcjs.validateAsaiSecrets,
-  isDevDefaultPassword: _chunkLXJMGLKWcjs.isDevDefaultPassword,
+  stripForbiddenSecretsFromHostConfig: _chunkZK4O4Z2Ocjs.stripForbiddenSecretsFromHostConfig,
+  loadAsaiSecrets: _chunkZK4O4Z2Ocjs.loadAsaiSecrets,
+  loadDotEnvFile: _chunkZK4O4Z2Ocjs.loadDotEnvFile,
+  applySecretsToHostConfig: _chunkZK4O4Z2Ocjs.applySecretsToHostConfig,
+  resolveHttpsCertFromPaths: _chunkZK4O4Z2Ocjs.resolveHttpsCertFromPaths,
+  validateAsaiSecrets: _chunkZK4O4Z2Ocjs.validateAsaiSecrets,
+  isDevDefaultPassword: _chunkZK4O4Z2Ocjs.isDevDefaultPassword,
   getTransportBlock,
   getTransportDefault,
   hasTransportDefault,
@@ -6577,7 +6590,7 @@ var initAsaiHostNodejs2 = {
   createTransportDataHandler,
   wireTransportConnectionLogs
 };
-var PLUGIN_VERSION = true ? "0.0.5" : "0.0.1";
+var PLUGIN_VERSION = true ? "0.0.8" : "0.0.1";
 var index_default = initAsaiHostNodejs2;
 
 
@@ -6620,5 +6633,5 @@ var index_default = initAsaiHostNodejs2;
 
 
 
-exports.AsaiCommon = Index_default; exports.AsaiUtils = utils_exports; exports.PLUGIN_NAME = PLUGIN_NAME; exports.PLUGIN_VERSION = PLUGIN_VERSION; exports.applySecretsToHostConfig = _chunkLXJMGLKWcjs.applySecretsToHostConfig; exports.createTransportDataHandler = createTransportDataHandler; exports.default = index_default; exports.ensureDefaultConnection = ensureDefaultConnection; exports.getDefaultConnId = getDefaultConnId; exports.getHostAllowedRoots = getHostAllowedRoots; exports.getTransportBlock = getTransportBlock; exports.getTransportDefault = getTransportDefault; exports.hasTransportDefault = hasTransportDefault; exports.initAsaiHostNodejs = initAsaiHostNodejs2; exports.initHostserverApi = initHostserverApi; exports.initHostserverWs = initHostserverWs; exports.initTransportBridge = initTransportBridge; exports.isDevDefaultPassword = _chunkLXJMGLKWcjs.isDevDefaultPassword; exports.loadAsaiSecrets = _chunkLXJMGLKWcjs.loadAsaiSecrets; exports.loadDotEnvFile = _chunkLXJMGLKWcjs.loadDotEnvFile; exports.logSecurityEvent = logSecurityEvent; exports.normalizeHostConfig = normalizeHostConfig; exports.normalizeSecurityConfig = normalizeSecurityConfig; exports.registerApi = registerApi; exports.registerWs = registerWs; exports.resolveHttpsCertFromPaths = _chunkLXJMGLKWcjs.resolveHttpsCertFromPaths; exports.resolvePathUnderRoots = resolvePathUnderRoots; exports.resolveReconnectOptions = resolveReconnectOptions; exports.sanitizeString = sanitizeString; exports.secureCompare = _chunkK2QPSQEVcjs.secureCompare; exports.shouldAutoConnect = shouldAutoConnect; exports.stripForbiddenSecretsFromHostConfig = _chunkLXJMGLKWcjs.stripForbiddenSecretsFromHostConfig; exports.syncApiRouteKeys = syncApiRouteKeys; exports.syncWsRouteKeys = syncWsRouteKeys; exports.sysserver = sysserver; exports.validateAsaiSecrets = _chunkLXJMGLKWcjs.validateAsaiSecrets; exports.validateHostConfig = validateHostConfig; exports.validateHttpAuth = validateHttpAuth; exports.validateProductionSecurity = validateProductionSecurity; exports.wireTransportConnectionLogs = wireTransportConnectionLogs;
+exports.AsaiCommon = Index_default; exports.AsaiUtils = utils_exports; exports.PLUGIN_NAME = PLUGIN_NAME; exports.PLUGIN_VERSION = PLUGIN_VERSION; exports.applySecretsToHostConfig = _chunkZK4O4Z2Ocjs.applySecretsToHostConfig; exports.createTransportDataHandler = createTransportDataHandler; exports.default = index_default; exports.ensureDefaultConnection = ensureDefaultConnection; exports.getDefaultConnId = getDefaultConnId; exports.getHostAllowedRoots = getHostAllowedRoots; exports.getTransportBlock = getTransportBlock; exports.getTransportDefault = getTransportDefault; exports.hasTransportDefault = hasTransportDefault; exports.initAsaiHostNodejs = initAsaiHostNodejs2; exports.initHostserverApi = initHostserverApi; exports.initHostserverWs = initHostserverWs; exports.initTransportBridge = initTransportBridge; exports.isDevDefaultPassword = _chunkZK4O4Z2Ocjs.isDevDefaultPassword; exports.loadAsaiSecrets = _chunkZK4O4Z2Ocjs.loadAsaiSecrets; exports.loadDotEnvFile = _chunkZK4O4Z2Ocjs.loadDotEnvFile; exports.logSecurityEvent = logSecurityEvent; exports.normalizeHostConfig = normalizeHostConfig; exports.normalizeSecurityConfig = normalizeSecurityConfig; exports.registerApi = registerApi; exports.registerWs = registerWs; exports.resolveHttpsCertFromPaths = _chunkZK4O4Z2Ocjs.resolveHttpsCertFromPaths; exports.resolvePathUnderRoots = resolvePathUnderRoots; exports.resolveReconnectOptions = resolveReconnectOptions; exports.sanitizeString = sanitizeString; exports.secureCompare = _chunkWXW5DYNUcjs.secureCompare; exports.shouldAutoConnect = shouldAutoConnect; exports.stripForbiddenSecretsFromHostConfig = _chunkZK4O4Z2Ocjs.stripForbiddenSecretsFromHostConfig; exports.syncApiRouteKeys = syncApiRouteKeys; exports.syncWsRouteKeys = syncWsRouteKeys; exports.sysserver = sysserver; exports.validateAsaiSecrets = _chunkZK4O4Z2Ocjs.validateAsaiSecrets; exports.validateHostConfig = validateHostConfig; exports.validateHttpAuth = validateHttpAuth; exports.validateProductionSecurity = validateProductionSecurity; exports.wireTransportConnectionLogs = wireTransportConnectionLogs;
 //# sourceMappingURL=asaihost-nodejs.cjs.map