asaihost-nodejs 0.0.6 → 0.0.8

package/dist/asaihost-nodejs.cjs

@@ -399,7 +399,7 @@ var LogBuffer = class _LogBuffer {
   }
 };
 function saveLog($asai, src, logstr) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     try {
       const bufferKey = `${$asai.id || "default"}_${src}`;
       let logBuffer = logBuffers.get(bufferKey);
@@ -408,7 +408,7 @@ function saveLog($asai, src, logstr) {
         logBuffers.set(bufferKey, logBuffer);
       }
       logBuffer.add(logstr);
-      resolve5();
+      resolve6();
     } catch (err) {
       console.error(err);
       reject(err);
@@ -815,7 +815,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, checkNtpOffset, "checkNtpOffset");
 // src/infra/config-integrity.ts
 var _crypto = require('crypto'); var _crypto2 = _interopRequireDefault(_crypto);
 var _fs = require('fs'); var fs3 = _interopRequireWildcard(_fs); var fs6 = _interopRequireWildcard(_fs); var fs4 = _interopRequireWildcard(_fs); var fs5 = _interopRequireWildcard(_fs); var fs8 = _interopRequireWildcard(_fs); var fs10 = _interopRequireWildcard(_fs);
-var _path = require('path'); var nodePath2 = _interopRequireWildcard(_path); var path2 = _interopRequireWildcard(_path); var nodePath = _interopRequireWildcard(_path); var nodePath3 = _interopRequireWildcard(_path); var path5 = _interopRequireWildcard(_path); var path6 = _interopRequireWildcard(_path);
+var _path = require('path'); var nodePath2 = _interopRequireWildcard(_path); var path2 = _interopRequireWildcard(_path); var nodePath = _interopRequireWildcard(_path); var nodePath3 = _interopRequireWildcard(_path); var path4 = _interopRequireWildcard(_path); var path6 = _interopRequireWildcard(_path); var path7 = _interopRequireWildcard(_path);
 function computeConfigHash(configPath) {
   try {
     const raw = fs3.default.readFileSync(configPath);
@@ -1460,11 +1460,11 @@ function createSkipChecker($asai) {
   }
   if (exact.size === 0 && prefixes.length === 0) return () => false;
   return (url) => {
-    const path7 = normalizeRequestPath(url);
-    if (!path7) return false;
-    if (exact.has(path7)) return true;
+    const path8 = normalizeRequestPath(url);
+    if (!path8) return false;
+    if (exact.has(path8)) return true;
     for (let i = 0; i < prefixes.length; i++) {
-      if (path7.startsWith(prefixes[i])) return true;
+      if (path8.startsWith(prefixes[i])) return true;
     }
     return false;
   };
@@ -2382,11 +2382,11 @@ function getSecurityConfig($asai) {
   return _optionalChain([$asai, 'optionalAccess', _269 => _269.hostconfig, 'optionalAccess', _270 => _270.security]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSecurityConfig, "getSecurityConfig");
-function pathMatchesPattern(path7, pattern) {
+function pathMatchesPattern(path8, pattern) {
   if (pattern.endsWith("*")) {
-    return path7.startsWith(pattern.slice(0, -1));
+    return path8.startsWith(pattern.slice(0, -1));
   }
-  return path7 === pattern;
+  return path8 === pattern;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, pathMatchesPattern, "pathMatchesPattern");
 function isAuthSkipped($asai, pathname) {
@@ -2535,7 +2535,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, isApiCorsAllowed, "isApiCorsAllowed");
 
 // src/common/server/Api.ts
 function readRequestBody(req, maxBody) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const chunks = [];
     let received = 0;
     let settled = false;
@@ -2543,7 +2543,7 @@ function readRequestBody(req, maxBody) {
       if (settled) return;
       settled = true;
       if (err) reject(err);
-      else resolve5(_nullishCoalesce(data, () => ( "")));
+      else resolve6(_nullishCoalesce(data, () => ( "")));
     }, "finish");
     req.on("data", (chunk) => {
       if (settled) return;
@@ -2673,83 +2673,95 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       const isTextPost = req.method === "POST" && req.url.indexOf("binary") === -1;
       const bodyPromise = isTextPost ? readRequestBody(req, maxBody) : null;
       void (async () => {
-        let authResult;
-        let rawBody = "";
         try {
-          [authResult, rawBody] = await Promise.all([
-            validateHttpAuthAsync(req, $asai, pathname),
-            _nullishCoalesce(bodyPromise, () => ( Promise.resolve("")))
-          ]);
-        } catch (err) {
-          releaseSlot();
-          if (_optionalChain([err, 'optionalAccess', _294 => _294.message]) === "PAYLOAD_TOO_LARGE") {
-            return sendError(res, 413, "Payload Too Large");
-          }
-          return sendError(res, 400, _optionalChain([err, 'optionalAccess', _295 => _295.message]) || "Bad Request");
-        }
-        if (!authResult.ok) {
-          releaseSlot();
-          return sendAuthError(res, authResult);
-        }
-        let apiFn = _optionalChain([$asai, 'access', _296 => _296.hostserverapi, 'access', _297 => _297[apiHandlerKey], 'optionalCall', _298 => _298($asai, query)]);
-        if (!apiFn) {
-          return sendError(res, 501, "Not Implemented");
-        }
-        res.setHeader("Content-Type", "application/json; charset=utf-8");
-        $asai.$log("API", req.method, urlParse.pathname, query);
-        let qrdata;
-        let postdata;
-        if (req.url.indexOf("binary") === -1) {
-          qrdata = query;
-          if (req.method === "POST") {
-            try {
-              const processed = processPostPayload($asai, req, rawBody, pm);
-              postdata = processed.postdata;
-              pm = processed.pm;
-              isAes = processed.isAes;
-            } catch (e35) {
-              return sendError(res, 400, "AES decrypt failed");
-            }
-            if (_optionalChain([apiFn, 'optionalAccess', _299 => _299.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _300 => _300.post]) === "function") {
-              const optTmp = { qrdata, data: postdata, pm };
-              if (isAes || _optionalChain([$asai, 'access', _301 => _301.$lib, 'access', _302 => _302.aesfns, 'optionalAccess', _303 => _303.allaes])) {
-                optTmp.resAES = _optionalChain([$asai, 'access', _304 => _304.$lib, 'access', _305 => _305.aesfns, 'optionalAccess', _306 => _306.resAES]);
-              }
-              apiFn.post(req, res, hostdir, optTmp);
-            } else {
-              res.end(typeof postdata === "string" ? postdata : JSON.stringify(_nullishCoalesce(postdata, () => ( ""))));
-            }
-          } else if (req.method === "GET") {
-            if (_optionalChain([apiFn, 'optionalAccess', _307 => _307.get]) && typeof _optionalChain([apiFn, 'optionalAccess', _308 => _308.get]) === "function") {
-              const optTmp = { qrdata, data: qrdata, pm };
-              if (isAes || _optionalChain([$asai, 'access', _309 => _309.$lib, 'access', _310 => _310.aesfns, 'optionalAccess', _311 => _311.allaes])) {
-                optTmp.resAES = _optionalChain([$asai, 'access', _312 => _312.$lib, 'access', _313 => _313.aesfns, 'optionalAccess', _314 => _314.resAES]);
-              }
-              apiFn.get(req, res, hostdir, optTmp);
-            } else {
-              res.end(JSON.stringify(qrdata));
+          let authResult;
+          let rawBody = "";
+          try {
+            [authResult, rawBody] = await Promise.all([
+              validateHttpAuthAsync(req, $asai, pathname),
+              _nullishCoalesce(bodyPromise, () => ( Promise.resolve("")))
+            ]);
+          } catch (err) {
+            releaseSlot();
+            if (_optionalChain([err, 'optionalAccess', _294 => _294.message]) === "PAYLOAD_TOO_LARGE") {
+              return sendError(res, 413, "Payload Too Large");
             }
+            return sendError(res, 400, _optionalChain([err, 'optionalAccess', _295 => _295.message]) || "Bad Request");
           }
-        } else {
-          if (_optionalChain([Object, 'access', _315 => _315.keys, 'call', _316 => _316(query), 'optionalAccess', _317 => _317.length])) {
-            qrdata = query;
+          if (!authResult.ok) {
+            releaseSlot();
+            return sendAuthError(res, authResult);
+          }
+          let apiFn = _optionalChain([$asai, 'access', _296 => _296.hostserverapi, 'access', _297 => _297[apiHandlerKey], 'optionalCall', _298 => _298($asai, query)]);
+          if (!apiFn) {
+            return sendError(res, 501, "Not Implemented");
           }
-          if (req.method === "POST") {
-            $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
-              if (_optionalChain([apiFn, 'optionalAccess', _318 => _318.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _319 => _319.post]) === "function") {
-                apiFn.post(req, res, hostdir, {
-                  qrdata,
-                  data: postdata2
-                });
+          res.setHeader("Content-Type", "application/json; charset=utf-8");
+          $asai.$log("API", req.method, urlParse.pathname, query);
+          let qrdata;
+          let postdata;
+          if (req.url.indexOf("binary") === -1) {
+            qrdata = query;
+            if (req.method === "POST") {
+              try {
+                const processed = processPostPayload($asai, req, rawBody, pm);
+                postdata = processed.postdata;
+                pm = processed.pm;
+                isAes = processed.isAes;
+              } catch (e35) {
+                return sendError(res, 400, "AES decrypt failed");
+              }
+              if (_optionalChain([apiFn, 'optionalAccess', _299 => _299.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _300 => _300.post]) === "function") {
+                const optTmp = { qrdata, data: postdata, pm };
+                if (isAes || _optionalChain([$asai, 'access', _301 => _301.$lib, 'access', _302 => _302.aesfns, 'optionalAccess', _303 => _303.allaes])) {
+                  optTmp.resAES = _optionalChain([$asai, 'access', _304 => _304.$lib, 'access', _305 => _305.aesfns, 'optionalAccess', _306 => _306.resAES]);
+                }
+                apiFn.post(req, res, hostdir, optTmp);
               } else {
-                res.end(postdata2);
+                res.end(typeof postdata === "string" ? postdata : JSON.stringify(_nullishCoalesce(postdata, () => ( ""))));
               }
-            }).catch((err) => {
-              return sendError(res, 400, "Invalid content type");
-            });
+            } else if (req.method === "GET") {
+              if (_optionalChain([apiFn, 'optionalAccess', _307 => _307.get]) && typeof _optionalChain([apiFn, 'optionalAccess', _308 => _308.get]) === "function") {
+                const optTmp = { qrdata, data: qrdata, pm };
+                if (isAes || _optionalChain([$asai, 'access', _309 => _309.$lib, 'access', _310 => _310.aesfns, 'optionalAccess', _311 => _311.allaes])) {
+                  optTmp.resAES = _optionalChain([$asai, 'access', _312 => _312.$lib, 'access', _313 => _313.aesfns, 'optionalAccess', _314 => _314.resAES]);
+                }
+                apiFn.get(req, res, hostdir, optTmp);
+              } else {
+                res.end(JSON.stringify(qrdata));
+              }
+            }
+          } else {
+            if (_optionalChain([Object, 'access', _315 => _315.keys, 'call', _316 => _316(query), 'optionalAccess', _317 => _317.length])) {
+              qrdata = query;
+            }
+            if (req.method === "POST") {
+              $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
+                if (_optionalChain([apiFn, 'optionalAccess', _318 => _318.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _319 => _319.post]) === "function") {
+                  apiFn.post(req, res, hostdir, {
+                    qrdata,
+                    data: postdata2
+                  });
+                } else {
+                  res.end(postdata2);
+                }
+              }).catch((err) => {
+                return sendError(res, 400, "Invalid content type");
+              });
+            }
           }
+        } catch (err) {
+          releaseSlot();
+          if (!res.headersSent) {
+            return sendError(res, 500, _optionalChain([err, 'optionalAccess', _320 => _320.message]) || "Internal Server Error");
+          }
+        }
+      })().catch((err) => {
+        releaseSlot();
+        if (!res.headersSent) {
+          sendError(res, 500, _optionalChain([err, 'optionalAccess', _321 => _321.message]) || "Internal Server Error");
         }
-      })();
+      });
     } else {
       $asai.$log("API", req.method, req.url);
     }
@@ -2760,12 +2772,12 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 
 // src/common/server/Ws.ts
 var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _320 => _320.fn, 'optionalCall', _321 => _321($asai)]);
+  _optionalChain([opt, 'optionalAccess', _322 => _322.fn, 'optionalCall', _323 => _323($asai)]);
   const wsHandlerCache = /* @__PURE__ */ new Map();
   const routeIndex = ensureWsRouteIndex($asai);
   function getWsHandler(handlerKey) {
     if (!wsHandlerCache.has(handlerKey)) {
-      wsHandlerCache.set(handlerKey, _optionalChain([$asai, 'access', _322 => _322.hostserverws, 'access', _323 => _323[handlerKey], 'optionalCall', _324 => _324($asai)]));
+      wsHandlerCache.set(handlerKey, _optionalChain([$asai, 'access', _324 => _324.hostserverws, 'access', _325 => _325[handlerKey], 'optionalCall', _326 => _326($asai)]));
     }
     return wsHandlerCache.get(handlerKey);
   }
@@ -2789,21 +2801,21 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
       let reqdata = parseMessage(msg);
       let handlerKey;
       if (reqdata === "ping") {
-        _optionalChain([ws2, 'access', _325 => _325.send, 'optionalCall', _326 => _326("pong")]);
+        _optionalChain([ws2, 'access', _327 => _327.send, 'optionalCall', _328 => _328("pong")]);
         return;
       } else {
         const reqdataisobj = typeof reqdata === "object" && reqdata !== null;
-        handlerKey = reqdataisobj ? routeIndex.matchTy(_optionalChain([reqdata, 'optionalAccess', _327 => _327.ty])) : routeIndex.matchString(reqdata);
-        if (!handlerKey && _optionalChain([$asai, 'access', _328 => _328.hostserverwss, 'optionalAccess', _329 => _329.length])) {
+        handlerKey = reqdataisobj ? routeIndex.matchTy(_optionalChain([reqdata, 'optionalAccess', _329 => _329.ty])) : routeIndex.matchString(reqdata);
+        if (!handlerKey && _optionalChain([$asai, 'access', _330 => _330.hostserverwss, 'optionalAccess', _331 => _331.length])) {
           handlerKey = $asai.hostserverwss.find((elp) => {
             if (reqdataisobj) {
-              return _optionalChain([reqdata, 'optionalAccess', _330 => _330.ty, 'optionalAccess', _331 => _331.startsWith, 'call', _332 => _332(elp)]);
+              return _optionalChain([reqdata, 'optionalAccess', _332 => _332.ty, 'optionalAccess', _333 => _333.startsWith, 'call', _334 => _334(elp)]);
             }
             return typeof reqdata === "string" && reqdata.startsWith(elp);
           });
         }
         if (!handlerKey) {
-          _optionalChain([$asai, 'access', _333 => _333.asaimock, 'optionalAccess', _334 => _334.wsWorkMock, 'call', _335 => _335({
+          _optionalChain([$asai, 'access', _335 => _335.asaimock, 'optionalAccess', _336 => _336.wsWorkMock, 'call', _337 => _337({
             msg,
             ws: ws2,
             hostdir,
@@ -2815,14 +2827,14 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
         }
       }
       if (!handlerKey) return;
-      _optionalChain([getWsHandler, 'call', _336 => _336(handlerKey), 'optionalAccess', _337 => _337.work, 'optionalCall', _338 => _338(reqdata, ws2, hostdir, req)]);
+      _optionalChain([getWsHandler, 'call', _338 => _338(handlerKey), 'optionalAccess', _339 => _339.work, 'optionalCall', _340 => _340(reqdata, ws2, hostdir, req)]);
     } catch (err) {
-      _optionalChain([($asai.$log || console.error), 'optionalCall', _339 => _339("WS", "handler error", err instanceof Error ? err.message : err)]);
+      _optionalChain([($asai.$log || console.error), 'optionalCall', _341 => _341("WS", "handler error", err instanceof Error ? err.message : err)]);
     }
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, wsWork, "wsWork");
   function _getMessage(msg) {
-    if (_optionalChain([msg, 'optionalAccess', _340 => _340.db, 'optionalAccess', _341 => _341.aes]) && _optionalChain([$asai, 'access', _342 => _342.$lib, 'optionalAccess', _343 => _343.aesfns, 'optionalAccess', _344 => _344.reqAES])) {
+    if (_optionalChain([msg, 'optionalAccess', _342 => _342.db, 'optionalAccess', _343 => _343.aes]) && _optionalChain([$asai, 'access', _344 => _344.$lib, 'optionalAccess', _345 => _345.aesfns, 'optionalAccess', _346 => _346.reqAES])) {
       msg.db = $asai.$lib.aesfns.reqAES({ data: msg.db });
     }
     return msg;
@@ -2849,12 +2861,12 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
 
 // src/common/server/Sys.ts
 var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _345 => _345.fn, 'optionalCall', _346 => _346($asai)]);
+  _optionalChain([opt, 'optionalAccess', _347 => _347.fn, 'optionalCall', _348 => _348($asai)]);
   let sysRouteCache = null;
   let sysRouteCacheLen = -1;
   function findSystemHandler(req) {
     const routes = $asai.hostserversyss;
-    if (!_optionalChain([routes, 'optionalAccess', _347 => _347.length])) return void 0;
+    if (!_optionalChain([routes, 'optionalAccess', _349 => _349.length])) return void 0;
     if (!sysRouteCache || sysRouteCacheLen !== routes.length) {
       sysRouteCache = routes.map((elp) => ({ key: elp, route: `/${elp}` }));
       sysRouteCacheLen = routes.length;
@@ -2883,27 +2895,28 @@ var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     }
     const urlPath = (req.url || "").split("?")[0];
     void (async () => {
-      const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
-      if (!authResult.ok) {
-        return sendAuthError(res, authResult);
-      }
-      const handler = _optionalChain([$asai, 'access', _348 => _348.hostserversys, 'access', _349 => _349[handlerKey], 'optionalCall', _350 => _350($asai)]);
-      if (!handler) {
-        return sendError(res, 500, "Handler Initialization Failed");
-      }
-      if (_optionalChain([handler, 'optionalAccess', _351 => _351.show]) && typeof _optionalChain([handler, 'optionalAccess', _352 => _352.show]) === "function") {
-        handler.show(req, res, hostdir);
-      } else {
-        res.end("postdata");
+      try {
+        const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
+        if (!authResult.ok) {
+          return sendAuthError(res, authResult);
+        }
+        const handler = _optionalChain([$asai, 'access', _350 => _350.hostserversys, 'access', _351 => _351[handlerKey], 'optionalCall', _352 => _352($asai)]);
+        if (!handler) {
+          return sendError(res, 500, "Handler Initialization Failed");
+        }
+        if (_optionalChain([handler, 'optionalAccess', _353 => _353.show]) && typeof _optionalChain([handler, 'optionalAccess', _354 => _354.show]) === "function") {
+          handler.show(req, res, hostdir);
+        } else {
+          res.end("postdata");
+        }
+      } catch (err) {
+        return sendError(res, 500, _optionalChain([err, 'optionalAccess', _355 => _355.message]) || "Internal Server Error");
       }
-      if (!handler) {
-        res.writeHead(404, {
-          "Content-Type": "application/json; charset=utf-8"
-        });
-        res.end(req.url);
-      } else {
+    })().catch((err) => {
+      if (!res.headersSent) {
+        sendError(res, 500, _optionalChain([err, 'optionalAccess', _356 => _356.message]) || "Internal Server Error");
       }
-    })();
+    });
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sysWork, "sysWork");
   return { sysWork };
@@ -2911,18 +2924,18 @@ var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 
 // src/common/server/WsClient.ts
 var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, wsname) => {
-  if (!_optionalChain([$asai, 'optionalAccess', _353 => _353.clientws])) {
+  if (!_optionalChain([$asai, 'optionalAccess', _357 => _357.clientws])) {
     $asai.clientws = {};
   }
   if (!$asai.clientws[wsname]) {
     $asai.clientws[wsname] = { tasks: /* @__PURE__ */ new Map() };
   }
   function getKeyByData(msgdata) {
-    return _optionalChain([msgdata, 'optionalAccess', _354 => _354.id]) || _optionalChain([msgdata, 'optionalAccess', _355 => _355.ty]);
+    return _optionalChain([msgdata, 'optionalAccess', _358 => _358.id]) || _optionalChain([msgdata, 'optionalAccess', _359 => _359.ty]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getKeyByData, "getKeyByData");
   function clientwsInit() {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       $asai.clientws[wsname].socket = new $asai.asaiWs(
         $asai.command.commandconfig.clientws[wsname]
       );
@@ -2931,7 +2944,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
       };
       $asai.clientws[wsname].socket.on("error", (err) => {
         $asai.clientws[wsname].open = 0;
-        _optionalChain([$asai, 'access', _356 => _356.hostconfig, 'access', _357 => _357.logger, 'optionalAccess', _358 => _358.lv, 'optionalAccess', _359 => _359.view]) && console.error(
+        _optionalChain([$asai, 'access', _360 => _360.hostconfig, 'access', _361 => _361.logger, 'optionalAccess', _362 => _362.lv, 'optionalAccess', _363 => _363.view]) && console.error(
           666.2203,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is error.`,
           err
@@ -2940,19 +2953,19 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
       });
       $asai.clientws[wsname].socket.on("close", () => {
         $asai.clientws[wsname].open = 0;
-        _optionalChain([$asai, 'access', _360 => _360.hostconfig, 'access', _361 => _361.logger, 'optionalAccess', _362 => _362.lv, 'optionalAccess', _363 => _363.view]) && console.error(
+        _optionalChain([$asai, 'access', _364 => _364.hostconfig, 'access', _365 => _365.logger, 'optionalAccess', _366 => _366.lv, 'optionalAccess', _367 => _367.view]) && console.error(
           666.2205,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is close.`
         );
         reject();
       });
       $asai.clientws[wsname].socket.onopen = () => {
-        _optionalChain([$asai, 'access', _364 => _364.hostconfig, 'access', _365 => _365.logger, 'optionalAccess', _366 => _366.lv, 'optionalAccess', _367 => _367.view]) && console.log(
+        _optionalChain([$asai, 'access', _368 => _368.hostconfig, 'access', _369 => _369.logger, 'optionalAccess', _370 => _370.lv, 'optionalAccess', _371 => _371.view]) && console.log(
           666.2201,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is open.`
         );
         $asai.clientws[wsname].open = 1;
-        resolve5();
+        resolve6();
       };
     });
   }
@@ -2970,7 +2983,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
         const key = getKeyByData(messageData);
         const task = $asai.clientws[wsname].tasks.get(key);
         if (task) {
-          _optionalChain([task, 'optionalAccess', _368 => _368.callback, 'call', _369 => _369(messageData)]);
+          _optionalChain([task, 'optionalAccess', _372 => _372.callback, 'call', _373 => _373(messageData)]);
           if (messageData.ty && !messageData.id) {
           } else {
             $asai.clientws[wsname].tasks.delete(key);
@@ -2982,7 +2995,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, clientwsOnmessage, "clientwsOnmessage");
   function clientwsApi(messageData) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       if ($asai.clientws[wsname].open) {
         try {
           const taskOpt = {};
@@ -2994,7 +3007,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
             getKeyByData(messageData),
             {
               callback: /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (res) => {
-                resolve5(res);
+                resolve6(res);
               }, "callback"),
               ...messageData,
               ...taskOpt
@@ -3024,7 +3037,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, clientwsWatch, "clientwsWatch");
   function clientwsWatchOff(messageData) {
-    if (_optionalChain([messageData, 'optionalAccess', _370 => _370.ty]) === "clear") {
+    if (_optionalChain([messageData, 'optionalAccess', _374 => _374.ty]) === "clear") {
       $asai.clientws[wsname].tasks = /* @__PURE__ */ new Map();
     } else {
       const key = getKeyByData(messageData);
@@ -3065,7 +3078,7 @@ var ping_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai)
 var web_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
   function chatBoard(msgdata, ws2, hostdir, req) {
     let room;
-    if (_optionalChain([msgdata, 'access', _371 => _371.db, 'optionalAccess', _372 => _372.room]) && typeof msgdata.db.room === "string") {
+    if (_optionalChain([msgdata, 'access', _375 => _375.db, 'optionalAccess', _376 => _376.room]) && typeof msgdata.db.room === "string") {
       room = msgdata.db.room;
       delete msgdata.db.room;
     } else {
@@ -3122,26 +3135,26 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     removeFile: removeFile2,
     resolvePathUnderBase: resolvePathUnderBase2
   } = $asai.$lib.AsFs;
-  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'access', _373 => _373.$lib, 'optionalAccess', _374 => _374.reqWork, 'optionalCall', _375 => _375($asai)]);
+  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'access', _377 => _377.$lib, 'optionalAccess', _378 => _378.reqWork, 'optionalCall', _379 => _379($asai)]);
   function mgLog(...arg) {
     mnLog("LOG", ...arg);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mgLog, "mgLog");
   function getDir(opt) {
-    let tmpDir = _optionalChain([opt, 'access', _376 => _376.qrdata, 'optionalAccess', _377 => _377.dir]) || _optionalChain([opt, 'access', _378 => _378.data, 'optionalAccess', _379 => _379.dir]);
+    let tmpDir = _optionalChain([opt, 'access', _380 => _380.qrdata, 'optionalAccess', _381 => _381.dir]) || _optionalChain([opt, 'access', _382 => _382.data, 'optionalAccess', _383 => _383.dir]);
     if (tmpDir) {
       tmpDir = decodeURIComponent(tmpDir);
     } else {
-      tmpDir = _optionalChain([opt, 'access', _380 => _380.qrdata, 'optionalAccess', _381 => _381.ty]) || _optionalChain([opt, 'access', _382 => _382.data, 'optionalAccess', _383 => _383.ty]);
+      tmpDir = _optionalChain([opt, 'access', _384 => _384.qrdata, 'optionalAccess', _385 => _385.ty]) || _optionalChain([opt, 'access', _386 => _386.data, 'optionalAccess', _387 => _387.ty]);
       if (tmpDir) {
         tmpDir = decodeURIComponent(tmpDir);
         if (tmpDir === "access-clf" || tmpDir === "access-w3c") {
-          tmpDir = _optionalChain([$asai, 'access', _384 => _384.hostconfig, 'access', _385 => _385.logger, 'optionalAccess', _386 => _386.path, 'optionalAccess', _387 => _387.access]) || "";
+          tmpDir = _optionalChain([$asai, 'access', _388 => _388.hostconfig, 'access', _389 => _389.logger, 'optionalAccess', _390 => _390.path, 'optionalAccess', _391 => _391.access]) || "";
         } else {
-          tmpDir = _optionalChain([$asai, 'access', _388 => _388.hostconfig, 'access', _389 => _389.logger, 'optionalAccess', _390 => _390.path, 'optionalAccess', _391 => _391[tmpDir]]) || "";
+          tmpDir = _optionalChain([$asai, 'access', _392 => _392.hostconfig, 'access', _393 => _393.logger, 'optionalAccess', _394 => _394.path, 'optionalAccess', _395 => _395[tmpDir]]) || "";
         }
       } else {
-        tmpDir = _optionalChain([$asai, 'access', _392 => _392.hostconfig, 'access', _393 => _393.logger, 'optionalAccess', _394 => _394.path, 'optionalAccess', _395 => _395.client]) || "";
+        tmpDir = _optionalChain([$asai, 'access', _396 => _396.hostconfig, 'access', _397 => _397.logger, 'optionalAccess', _398 => _398.path, 'optionalAccess', _399 => _399.client]) || "";
       }
     }
     return tmpDir;
@@ -3173,7 +3186,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       if (!await ensureLv(req, $asai, 3)) return sendFail(res, "Forbidden", opt);
       try {
         const baseDir = getDir(opt);
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _396 => _396.qrdata, 'optionalAccess', _397 => _397.path]) || _optionalChain([opt, 'access', _398 => _398.data, 'optionalAccess', _399 => _399.path]));
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _400 => _400.qrdata, 'optionalAccess', _401 => _401.path]) || _optionalChain([opt, 'access', _402 => _402.data, 'optionalAccess', _403 => _403.path]));
         const jsonpath = resolvePathUnderBase2(baseDir, relPath);
         await ensureFile2(jsonpath);
         mgLog("ENSURE", jsonpath);
@@ -3194,7 +3207,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     if (url.startsWith("/api/asailog/manage/selectlist/")) {
       if (!await ensureLv(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ty = decodeURIComponent(_optionalChain([opt, 'access', _400 => _400.qrdata, 'optionalAccess', _401 => _401.ty]) || _optionalChain([opt, 'access', _402 => _402.data, 'optionalAccess', _403 => _403.ty]) || "client");
+        const ty = decodeURIComponent(_optionalChain([opt, 'access', _404 => _404.qrdata, 'optionalAccess', _405 => _405.ty]) || _optionalChain([opt, 'access', _406 => _406.data, 'optionalAccess', _407 => _407.ty]) || "client");
         if (!_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
           const kind = ty === "sec" ? "sec" : "web";
           const groups = await _chunkHR5JKN7Ycjs.listUnifiedGroups.call(void 0, $asai, { kind, source: ty === "sec" ? "sec" : ty });
@@ -3222,8 +3235,8 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     if (url.startsWith("/api/asailog/manage/select/")) {
       if (!await ensureLv(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ty = decodeURIComponent(_optionalChain([opt, 'access', _404 => _404.qrdata, 'optionalAccess', _405 => _405.ty]) || _optionalChain([opt, 'access', _406 => _406.data, 'optionalAccess', _407 => _407.ty]) || "client");
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _408 => _408.qrdata, 'optionalAccess', _409 => _409.path]) || _optionalChain([opt, 'access', _410 => _410.data, 'optionalAccess', _411 => _411.path]));
+        const ty = decodeURIComponent(_optionalChain([opt, 'access', _408 => _408.qrdata, 'optionalAccess', _409 => _409.ty]) || _optionalChain([opt, 'access', _410 => _410.data, 'optionalAccess', _411 => _411.ty]) || "client");
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _412 => _412.qrdata, 'optionalAccess', _413 => _413.path]) || _optionalChain([opt, 'access', _414 => _414.data, 'optionalAccess', _415 => _415.path]));
         if (!_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
           const data2 = await _chunkHR5JKN7Ycjs.readWebLogFromStore.call(void 0, $asai, ty, relPath);
           if (data2) {
@@ -3251,7 +3264,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       if (!await ensureLv(req, $asai, 3)) return sendFail(res, "Forbidden", opt);
       try {
         const baseDir = getDir(opt);
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _412 => _412.qrdata, 'optionalAccess', _413 => _413.path]) || _optionalChain([opt, 'access', _414 => _414.data, 'optionalAccess', _415 => _415.path]));
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _416 => _416.qrdata, 'optionalAccess', _417 => _417.path]) || _optionalChain([opt, 'access', _418 => _418.data, 'optionalAccess', _419 => _419.path]));
         const fileName = relPath.split(/[/\\]/).pop() || relPath;
         if (_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai)) {
           await _chunkHR5JKN7Ycjs.purgeStoreEntriesForFile.call(void 0, $asai, fileName).catch(() => void 0);
@@ -3274,14 +3287,14 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
 
 // src/infra/siem-auth.ts
 function isSiemEnabled($asai) {
-  const cfg = _optionalChain([$asai, 'optionalAccess', _416 => _416.hostconfig, 'optionalAccess', _417 => _417.logger, 'optionalAccess', _418 => _418.siem]);
-  return !!(_optionalChain([cfg, 'optionalAccess', _419 => _419.enabled]) && getSiemToken($asai));
+  const cfg = _optionalChain([$asai, 'optionalAccess', _420 => _420.hostconfig, 'optionalAccess', _421 => _421.logger, 'optionalAccess', _422 => _422.siem]);
+  return !!(_optionalChain([cfg, 'optionalAccess', _423 => _423.enabled]) && getSiemToken($asai));
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, isSiemEnabled, "isSiemEnabled");
 function getSiemToken($asai) {
   const fromEnv = process.env.ASAI_SIEM_TOKEN;
   if (typeof fromEnv === "string" && fromEnv.trim()) return fromEnv.trim();
-  const fromCfg = _optionalChain([$asai, 'optionalAccess', _420 => _420.hostconfig, 'optionalAccess', _421 => _421.logger, 'optionalAccess', _422 => _422.siem, 'optionalAccess', _423 => _423.token]);
+  const fromCfg = _optionalChain([$asai, 'optionalAccess', _424 => _424.hostconfig, 'optionalAccess', _425 => _425.logger, 'optionalAccess', _426 => _426.siem, 'optionalAccess', _427 => _427.token]);
   return typeof fromCfg === "string" ? fromCfg.trim() : "";
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSiemToken, "getSiemToken");
@@ -3289,9 +3302,9 @@ function isSiemTokenValid($asai, req) {
   if (!isSiemEnabled($asai)) return false;
   const expected = getSiemToken($asai);
   if (!expected) return false;
-  const header = _optionalChain([req, 'optionalAccess', _424 => _424.headers, 'optionalAccess', _425 => _425["x-siem-token"]]) || _optionalChain([req, 'optionalAccess', _426 => _426.headers, 'optionalAccess', _427 => _427["x-api-key"]]);
+  const header = _optionalChain([req, 'optionalAccess', _428 => _428.headers, 'optionalAccess', _429 => _429["x-siem-token"]]) || _optionalChain([req, 'optionalAccess', _430 => _430.headers, 'optionalAccess', _431 => _431["x-api-key"]]);
   if (typeof header === "string" && header === expected) return true;
-  const q = _optionalChain([req, 'optionalAccess', _428 => _428.query]) || {};
+  const q = _optionalChain([req, 'optionalAccess', _432 => _432.query]) || {};
   const qToken = q.siem_token || q.token;
   return typeof qToken === "string" && qToken === expected;
 }
@@ -3315,20 +3328,20 @@ function getNs(raw) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getNs, "getNs");
 async function ensureServerUser(req, $asai) {
-  if (Array.isArray(_optionalChain([req, 'optionalAccess', _429 => _429.Userinfo])) && req.Userinfo[0]) {
+  if (Array.isArray(_optionalChain([req, 'optionalAccess', _433 => _433.Userinfo])) && req.Userinfo[0]) {
     await attachServerUserLevel(req, $asai);
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, ensureServerUser, "ensureServerUser");
 var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _430 => _430.$lib, 'optionalAccess', _431 => _431.reqWork, 'optionalCall', _432 => _432($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _434 => _434.$lib, 'optionalAccess', _435 => _435.reqWork, 'optionalCall', _436 => _436($asai)]) || {};
   const IL = $asai.$lib.InterventionLog;
   async function get(req, res, hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/asailog/intervention/selectlist/")) {
       if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ns = getNs(_optionalChain([opt, 'access', _433 => _433.qrdata, 'optionalAccess', _434 => _434.ns]) || _optionalChain([opt, 'access', _435 => _435.data, 'optionalAccess', _436 => _436.ns]));
+        const ns = getNs(_optionalChain([opt, 'access', _437 => _437.qrdata, 'optionalAccess', _438 => _438.ns]) || _optionalChain([opt, 'access', _439 => _439.data, 'optionalAccess', _440 => _440.ns]));
         let list = await IL.listInterventionFiles($asai, ns);
         if (_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && !_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai)) {
           const groups = await _chunkHR5JKN7Ycjs.listUnifiedGroups.call(void 0, $asai, { kind: "intervention", ns });
@@ -3340,19 +3353,19 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
         }
         return sendSuccess(res, { ns, files: list }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _437 => _437.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _441 => _441.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/intervention/select/")) {
       if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const name = decodeURIComponent(_optionalChain([opt, 'access', _438 => _438.qrdata, 'optionalAccess', _439 => _439.name]) || _optionalChain([opt, 'access', _440 => _440.data, 'optionalAccess', _441 => _441.name]) || "");
-        const ns = getNs(_optionalChain([opt, 'access', _442 => _442.qrdata, 'optionalAccess', _443 => _443.ns]) || _optionalChain([opt, 'access', _444 => _444.data, 'optionalAccess', _445 => _445.ns]));
+        const name = decodeURIComponent(_optionalChain([opt, 'access', _442 => _442.qrdata, 'optionalAccess', _443 => _443.name]) || _optionalChain([opt, 'access', _444 => _444.data, 'optionalAccess', _445 => _445.name]) || "");
+        const ns = getNs(_optionalChain([opt, 'access', _446 => _446.qrdata, 'optionalAccess', _447 => _447.ns]) || _optionalChain([opt, 'access', _448 => _448.data, 'optionalAccess', _449 => _449.ns]));
         if (!name) return sendFail(res, "name required", opt);
         const content = await IL.readInterventionFile($asai, name, ns);
         return sendSuccess(res, { ns, ...content }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _446 => _446.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _450 => _450.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/intervention/types/")) {
@@ -3360,7 +3373,7 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
       try {
         return sendSuccess(res, IL.getInterventionTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _447 => _447.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _451 => _451.message]) || err, opt);
       }
     }
   }
@@ -3390,7 +3403,7 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
         );
         return sendSuccess(res, { ns, ...result }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _448 => _448.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _452 => _452.message]) || err, opt);
       }
     }
   }
@@ -3409,7 +3422,7 @@ function parseQuery(opt) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, parseQuery, "parseQuery");
 function parseBody(opt) {
-  if (!_optionalChain([opt, 'optionalAccess', _449 => _449.data])) return {};
+  if (!_optionalChain([opt, 'optionalAccess', _453 => _453.data])) return {};
   if (typeof opt.data === "string") {
     try {
       return JSON.parse(opt.data);
@@ -3421,7 +3434,7 @@ function parseBody(opt) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, parseBody, "parseBody");
 var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _450 => _450.$lib, 'optionalAccess', _451 => _451.reqWork, 'optionalCall', _452 => _452($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _454 => _454.$lib, 'optionalAccess', _455 => _455.reqWork, 'optionalCall', _456 => _456($asai)]) || {};
   const IL = $asai.$lib.InterventionLog;
   async function get(req, res, hostdir, opt) {
     const url = req.url || "";
@@ -3431,7 +3444,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       try {
         return sendSuccess(res, _chunkHR5JKN7Ycjs.getLogStoreMeta.call(void 0, $asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _453 => _453.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _457 => _457.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/stats/")) {
@@ -3444,7 +3457,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const stats = await _chunkHR5JKN7Ycjs.getUnifiedStats.call(void 0, $asai);
         return sendSuccess(res, { store: storeType, stats, config: _chunkHR5JKN7Ycjs.getLogStoreMeta.call(void 0, $asai) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _454 => _454.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _458 => _458.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/compliance/")) {
@@ -3454,7 +3467,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const report = await _chunkHR5JKN7Ycjs.getComplianceReport.call(void 0, $asai, ns);
         return sendSuccess(res, report, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _455 => _455.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _459 => _459.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/search/")) {
@@ -3476,7 +3489,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, result, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _456 => _456.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _460 => _460.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/export/")) {
@@ -3497,7 +3510,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, payload, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _457 => _457.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _461 => _461.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/taxonomy/")) {
@@ -3505,7 +3518,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       try {
         return sendSuccess(res, IL.getInterventionTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _458 => _458.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _462 => _462.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/formats/")) {
@@ -3514,7 +3527,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const { getLogFormatTaxonomy } = await Promise.resolve().then(() => _interopRequireWildcard(require("./log-formats-TUXGMCCU.cjs")));
         return sendSuccess(res, getLogFormatTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _459 => _459.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _463 => _463.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/selectlist/")) {
@@ -3541,7 +3554,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         }
         return sendSuccess(res, { groups }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _460 => _460.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _464 => _464.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/select/")) {
@@ -3575,7 +3588,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, { entries: rows }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _461 => _461.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _465 => _465.message]) || err, opt);
       }
     }
   }
@@ -3597,7 +3610,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       });
       return sendSuccess(res, result, opt);
     } catch (err) {
-      return sendFail(res, _optionalChain([err, 'optionalAccess', _462 => _462.message]) || err, opt);
+      return sendFail(res, _optionalChain([err, 'optionalAccess', _466 => _466.message]) || err, opt);
     }
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, post, "post");
@@ -3609,7 +3622,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
 
 var registry = null;
 function resolveFilePath($asai) {
-  const root = _optionalChain([$asai, 'optionalAccess', _463 => _463.serverRoot]) || process.cwd();
+  const root = _optionalChain([$asai, 'optionalAccess', _467 => _467.serverRoot]) || process.cwd();
   return nodePath3.join(root, "websys/sys/errorcodes.json");
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveFilePath, "resolveFilePath");
@@ -3627,7 +3640,7 @@ function loadErrorCodes($asai) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, loadErrorCodes, "loadErrorCodes");
 function getError(ec) {
-  return _optionalChain([registry, 'optionalAccess', _464 => _464.errors, 'optionalAccess', _465 => _465[ec]]) || null;
+  return _optionalChain([registry, 'optionalAccess', _468 => _468.errors, 'optionalAccess', _469 => _469[ec]]) || null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getError, "getError");
 function hasError(ec) {
@@ -3636,11 +3649,11 @@ function hasError(ec) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, hasError, "hasError");
 function logError($asai, ec, params) {
   const entry = getError(ec);
-  const logFn = _optionalChain([$asai, 'optionalAccess', _466 => _466.$log]) || console.warn;
+  const logFn = _optionalChain([$asai, 'optionalAccess', _470 => _470.$log]) || console.warn;
   if (entry) {
-    logFn(`[EC:${ec}]`, entry.id || "", entry.detail || "", _optionalChain([params, 'optionalAccess', _467 => _467.length]) ? params : "");
+    logFn(`[EC:${ec}]`, entry.id || "", entry.detail || "", _optionalChain([params, 'optionalAccess', _471 => _471.length]) ? params : "");
   } else {
-    logFn(`[EC:${ec}]`, "(unregistered)", _optionalChain([params, 'optionalAccess', _468 => _468.length]) ? params : "");
+    logFn(`[EC:${ec}]`, "(unregistered)", _optionalChain([params, 'optionalAccess', _472 => _472.length]) ? params : "");
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, logError, "logError");
@@ -3668,14 +3681,14 @@ var ErrorCode_default = {
 
 // src/sysserver/api/common/errorcodes.ts
 var errorcodes_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _469 => _469.$lib, 'optionalAccess', _470 => _470.reqWork, 'optionalCall', _471 => _471($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _473 => _473.$lib, 'optionalAccess', _474 => _474.reqWork, 'optionalCall', _475 => _475($asai)]) || {};
   function get(req, res, _hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/sys/errorcodes/")) {
       try {
         return sendSuccess(res, loadErrorCodes($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _472 => _472.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _476 => _476.message]) || err, opt);
       }
     }
   }
@@ -3685,9 +3698,9 @@ var errorcodes_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
 
 // src/sysserver/api/common/sqlitemanage.ts
 var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'optionalAccess', _473 => _473.$lib, 'optionalAccess', _474 => _474.reqWork, 'optionalCall', _475 => _475($asai)]) || {};
+  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'optionalAccess', _477 => _477.$lib, 'optionalAccess', _478 => _478.reqWork, 'optionalCall', _479 => _479($asai)]) || {};
   function mgLog(...arg) {
-    _optionalChain([mnLog, 'optionalCall', _476 => _476("SQLite", ...arg)]);
+    _optionalChain([mnLog, 'optionalCall', _480 => _480("SQLite", ...arg)]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mgLog, "mgLog");
   return $asai.$lib.AsDb($asai, {
@@ -3705,7 +3718,7 @@ var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0,
       if (req.url.startsWith("/api/asaisqlite/manage/post")) {
         try {
           mgLog("POST", "custom handler triggered");
-          _optionalChain([sendSuccess, 'optionalCall', _477 => _477(res, { data: "post" }, opt)]);
+          _optionalChain([sendSuccess, 'optionalCall', _481 => _481(res, { data: "post" }, opt)]);
         } catch (err) {
           mgLog("ERROR", "post handler", err);
         }
@@ -3722,10 +3735,10 @@ var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0,
             table: dataObj.table
           });
           mgLog("SELECT", "completed");
-          _optionalChain([sendSuccess, 'optionalCall', _478 => _478(res, resdb, opt)]);
+          _optionalChain([sendSuccess, 'optionalCall', _482 => _482(res, resdb, opt)]);
         } catch (errdb) {
           mgLog("ERROR", "select", errdb);
-          _optionalChain([sendFail, 'optionalCall', _479 => _479(res, errdb, opt)]);
+          _optionalChain([sendFail, 'optionalCall', _483 => _483(res, errdb, opt)]);
         }
         return "ok";
       }
@@ -3741,7 +3754,7 @@ function promLine(name, value, labels) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, promLine, "promLine");
 var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _480 => _480.$lib, 'optionalAccess', _481 => _481.reqWork, 'optionalCall', _482 => _482($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _484 => _484.$lib, 'optionalAccess', _485 => _485.reqWork, 'optionalCall', _486 => _486($asai)]) || {};
   async function get(req, res, _hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/sys/health/metrics/")) {
@@ -3750,10 +3763,10 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
         let httpTotal = 0;
         let wsTotal = 0;
         for (const set of Object.values($asai.connectionshttp || {})) {
-          httpTotal += _optionalChain([set, 'optionalAccess', _483 => _483.size]) || 0;
+          httpTotal += _optionalChain([set, 'optionalAccess', _487 => _487.size]) || 0;
         }
         for (const set of Object.values($asai.connectionsws || {})) {
-          wsTotal += _optionalChain([set, 'optionalAccess', _484 => _484.size]) || 0;
+          wsTotal += _optionalChain([set, 'optionalAccess', _488 => _488.size]) || 0;
         }
         const lines = [
           "# HELP asai_uptime_seconds Process uptime",
@@ -3775,7 +3788,7 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
         return res.end(lines.join("\n") + "\n");
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _485 => _485.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _489 => _489.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/sys/health/status/")) {
@@ -3788,10 +3801,10 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
           memory: process.memoryUsage(),
           quota: {
             http: Object.fromEntries(
-              Object.entries($asai.connectionshttp || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _486 => _486.size]) || 0])
+              Object.entries($asai.connectionshttp || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _490 => _490.size]) || 0])
             ),
             ws: Object.fromEntries(
-              Object.entries($asai.connectionsws || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _487 => _487.size]) || 0])
+              Object.entries($asai.connectionsws || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _491 => _491.size]) || 0])
             )
           }
         },
@@ -3832,7 +3845,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, sanitizeString, "sanitizeString");
 // src/sysserver/api/login/service/session.ts
 
 function getSessionTtlMs($asai) {
-  const hours = _nullishCoalesce(_optionalChain([$asai, 'optionalAccess', _488 => _488.hostconfig, 'optionalAccess', _489 => _489.security, 'optionalAccess', _490 => _490.sessionTtlHours]), () => ( 24));
+  const hours = _nullishCoalesce(_optionalChain([$asai, 'optionalAccess', _492 => _492.hostconfig, 'optionalAccess', _493 => _493.security, 'optionalAccess', _494 => _494.sessionTtlHours]), () => ( 24));
   return Number(hours) * 3600 * 1e3;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSessionTtlMs, "getSessionTtlMs");
@@ -3849,7 +3862,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, generatePriKey, "generatePriKey");
 function createSessionKeys($asai) {
   const sessionId = _crypto.randomUUID.call(void 0, );
   const pri = generatePriKey();
-  const sn = _optionalChain([$asai, 'optionalAccess', _491 => _491.hostconfig, 'optionalAccess', _492 => _492.asaisn]);
+  const sn = _optionalChain([$asai, 'optionalAccess', _495 => _495.hostconfig, 'optionalAccess', _496 => _496.asaisn]);
   if (!sn) throw new Error("[session] ASAI_ASAISN \u672A\u914D\u7F6E");
   const pub = $asai.$lib.AsCode.asencode(pri, sn);
   return { pri, pub, sessionId };
@@ -3905,7 +3918,7 @@ function unwrapJsonString(value) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, unwrapJsonString, "unwrapJsonString");
 function parseAuthBody(opt) {
-  let raw = _optionalChain([opt, 'optionalAccess', _493 => _493.data]);
+  let raw = _optionalChain([opt, 'optionalAccess', _497 => _497.data]);
   if (raw == null || raw === "") return {};
   if (typeof raw === "string") {
     const text = raw.trim();
@@ -3981,7 +3994,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, purgeOfflineSessions, "purgeOfflineSession
 
 // src/sysserver/api/login/index.ts
 function getSecurity($asai) {
-  return _optionalChain([$asai, 'optionalAccess', _494 => _494.hostconfig, 'optionalAccess', _495 => _495.security]) || {};
+  return _optionalChain([$asai, 'optionalAccess', _498 => _498.hostconfig, 'optionalAccess', _499 => _499.security]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSecurity, "getSecurity");
 function getQuota2($asai) {
@@ -3994,7 +4007,7 @@ async function canLogin($asai, us, hostdir) {
   if (!quota.enabled) return { ok: true };
   const store = _chunkZK4O4Z2Ocjs.createUserStore.call(void 0, $asai);
   const total = await countOnlineSessions($asai, hostdir, store);
-  const maxLogin = _nullishCoalesce(_nullishCoalesce(quota.maxLoginSessions, () => ( _optionalChain([$asai, 'optionalAccess', _496 => _496.hostconfig, 'optionalAccess', _497 => _497.hosts, 'optionalAccess', _498 => _498.default, 'optionalAccess', _499 => _499.maxonline]))), () => ( 100));
+  const maxLogin = _nullishCoalesce(_nullishCoalesce(quota.maxLoginSessions, () => ( _optionalChain([$asai, 'optionalAccess', _500 => _500.hostconfig, 'optionalAccess', _501 => _501.hosts, 'optionalAccess', _502 => _502.default, 'optionalAccess', _503 => _503.maxonline]))), () => ( 100));
   if (total >= maxLogin) {
     return { ok: false, message: "LOGIN_QUOTA_FULL" };
   }
@@ -4027,7 +4040,7 @@ function ensureReady($asai) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, ensureReady, "ensureReady");
 var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail, sendErr } = _optionalChain([$asai, 'access', _500 => _500.$lib, 'optionalAccess', _501 => _501.reqWork, 'optionalCall', _502 => _502($asai)]) || {};
+  const { sendSuccess, sendFail, sendErr } = _optionalChain([$asai, 'access', _504 => _504.$lib, 'optionalAccess', _505 => _505.reqWork, 'optionalCall', _506 => _506($asai)]) || {};
   const store = _chunkZK4O4Z2Ocjs.createUserStore.call(void 0, $asai);
   async function checkAdmin(req, pathname, minOverride) {
     await attachServerUserLevel(req, $asai);
@@ -4068,7 +4081,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "password_changed" });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _503 => _503.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _507 => _507.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/register/")) {
@@ -4101,11 +4114,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "register_ok" });
         return sendSuccess(res, { user: publicUser($asai, user) }, opt);
       } catch (err) {
-        const msg = _optionalChain([err, 'optionalAccess', _504 => _504.message]) || String(err);
+        const msg = _optionalChain([err, 'optionalAccess', _508 => _508.message]) || String(err);
         if (msg.includes("exists") || msg.includes("\u5DF2\u5B58\u5728")) {
           return sendErr(res, "USER_ALREADY_EXISTS", void 0, opt);
         }
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _505 => _505.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _509 => _509.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/auth/")) {
@@ -4139,7 +4152,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         const policy = _chunkGXOFLFFWcjs.getPasswordPolicy.call(void 0, $asai);
         const mustChange = !!user.mustChangePassword || _chunkGXOFLFFWcjs.isPasswordExpired.call(void 0, user.passwordChangedAt, policy.maxAgeDays);
-        const hostcfg = _optionalChain([$asai, 'access', _506 => _506.getHost, 'optionalCall', _507 => _507(hostdir)]) || {};
+        const hostcfg = _optionalChain([$asai, 'access', _510 => _510.getHost, 'optionalCall', _511 => _511(hostdir)]) || {};
         if (hostcfg.ckws && isUserOnlineOnWs($asai, us, hostdir)) {
           kickUserWs($asai, us, hostdir);
         }
@@ -4164,13 +4177,13 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           opt
         );
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _508 => _508.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _512 => _512.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/logout/")) {
       try {
         const bodySid = body.sessionId ? sanitizeString(body.sessionId, 64) : "";
-        const us = _optionalChain([req, 'optionalAccess', _509 => _509.Userinfo, 'optionalAccess', _510 => _510[0]]);
+        const us = _optionalChain([req, 'optionalAccess', _513 => _513.Userinfo, 'optionalAccess', _514 => _514[0]]);
         if (bodySid) {
           if (!us) {
             return sendErr(res, "AUTH_MISSING", void 0, opt);
@@ -4184,7 +4197,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (us) logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: String(us), ip, detail: "logout" });
         return sendSuccess(res, "ok", opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _511 => _511.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _515 => _515.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/kick/")) {
@@ -4202,7 +4215,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         kickUserWs($asai, target.us, hostdir);
         await store.removeSession(sessionId);
-        const operator = String(_optionalChain([req, 'optionalAccess', _512 => _512.Userinfo, 'optionalAccess', _513 => _513[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _516 => _516.Userinfo, 'optionalAccess', _517 => _517[0]]) || "");
         await _chunkARHPHWT5cjs.logSessionTerminate.call(void 0, $asai, {
           operator,
           sessionId,
@@ -4211,7 +4224,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _514 => _514.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _518 => _518.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/delete/")) {
@@ -4223,11 +4236,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (!targetUs || targetUs === "admin") return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
         const ok = await store.deleteUser(targetUs);
         if (!ok) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        const operator = String(_optionalChain([req, 'optionalAccess', _515 => _515.Userinfo, 'optionalAccess', _516 => _516[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _519 => _519.Userinfo, 'optionalAccess', _520 => _520[0]]) || "");
         await _chunkARHPHWT5cjs.logAccountPurge.call(void 0, $asai, { operator, targetUs, ip });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _517 => _517.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _521 => _521.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/levels/")) {
@@ -4239,7 +4252,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const thresholds = body.thresholds && typeof body.thresholds === "object" ? body.thresholds : void 0;
         const routeRights = Array.isArray(body.routeRights) ? body.routeRights : void 0;
         const defaultResetPassword = typeof body.defaultResetPassword === "string" ? body.defaultResetPassword : void 0;
-        const operator = String(_optionalChain([req, 'optionalAccess', _518 => _518.Userinfo, 'optionalAccess', _519 => _519[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _522 => _522.Userinfo, 'optionalAccess', _523 => _523[0]]) || "");
         const cfg = await _chunkGXOFLFFWcjs.saveUserLevelConfig.call(void 0, 
           $asai,
           {
@@ -4252,13 +4265,13 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         );
         await _chunkARHPHWT5cjs.logSecurityConfigIntervention.call(void 0, $asai, {
           section: "user_levels",
-          detail: JSON.stringify({ levels: _optionalChain([levels, 'optionalAccess', _520 => _520.length]), thresholds: !!thresholds, routeRights: _optionalChain([routeRights, 'optionalAccess', _521 => _521.length]) }),
+          detail: JSON.stringify({ levels: _optionalChain([levels, 'optionalAccess', _524 => _524.length]), thresholds: !!thresholds, routeRights: _optionalChain([routeRights, 'optionalAccess', _525 => _525.length]) }),
           operator,
           ip
         });
         return sendSuccess(res, cfg, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _522 => _522.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _526 => _526.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/resetpass/")) {
@@ -4292,7 +4305,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           passHistory: "[]"
         });
         if (!updated) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        const operator = String(_optionalChain([req, 'optionalAccess', _523 => _523.Userinfo, 'optionalAccess', _524 => _524[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _527 => _527.Userinfo, 'optionalAccess', _528 => _528[0]]) || "");
         await _chunkARHPHWT5cjs.logUserRbacChange.call(void 0, $asai, {
           operator,
           targetUs,
@@ -4309,7 +4322,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         });
         return sendSuccess(res, { user: publicUser($asai, updated) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _525 => _525.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _529 => _529.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/update/")) {
@@ -4340,7 +4353,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (!updated) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
         if (Object.keys(patch).length) {
           await _chunkARHPHWT5cjs.logUserRbacChange.call(void 0, $asai, {
-            operator: String(_optionalChain([req, 'optionalAccess', _526 => _526.Userinfo, 'optionalAccess', _527 => _527[0]]) || ""),
+            operator: String(_optionalChain([req, 'optionalAccess', _530 => _530.Userinfo, 'optionalAccess', _531 => _531[0]]) || ""),
             targetUs,
             patch,
             ip
@@ -4348,11 +4361,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         return sendSuccess(res, { user: publicUser($asai, updated) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _528 => _528.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _532 => _532.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/profile/")) {
-      const us = _optionalChain([req, 'optionalAccess', _529 => _529.Userinfo, 'optionalAccess', _530 => _530[0]]);
+      const us = _optionalChain([req, 'optionalAccess', _533 => _533.Userinfo, 'optionalAccess', _534 => _534[0]]);
       if (!us) return sendErr(res, "AUTH_UNAUTHORIZED", void 0, opt);
       try {
         const user = await store.findByUsername(String(us));
@@ -4386,7 +4399,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const fresh = await store.findByUsername(String(us));
         return sendSuccess(res, { user: fresh ? publicUser($asai, fresh) : null }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _531 => _531.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _535 => _535.message]) || err, opt);
       }
     }
   }
@@ -4395,7 +4408,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     const url = req.url || "";
     const ip = getClientIp(req);
     if (url.startsWith("/api/user/login/config/")) {
-      const lang = String(_optionalChain([req, 'optionalAccess', _532 => _532.headers, 'optionalAccess', _533 => _533["accept-language"]]) || _optionalChain([opt, 'optionalAccess', _534 => _534.headers, 'optionalAccess', _535 => _535["accept-language"]]) || "zh-CN").split(",")[0];
+      const lang = String(_optionalChain([req, 'optionalAccess', _536 => _536.headers, 'optionalAccess', _537 => _537["accept-language"]]) || _optionalChain([opt, 'optionalAccess', _538 => _538.headers, 'optionalAccess', _539 => _539["accept-language"]]) || "zh-CN").split(",")[0];
       await _chunkGXOFLFFWcjs.loadUserLevelConfig.call(void 0, $asai);
       return sendSuccess(res, _chunkGXOFLFFWcjs.getPublicSecurityConfig.call(void 0, $asai, lang), opt);
     }
@@ -4456,7 +4469,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
       );
     }
     if (url.startsWith("/api/user/login/profile/")) {
-      const us = _optionalChain([req, 'optionalAccess', _536 => _536.Userinfo, 'optionalAccess', _537 => _537[0]]);
+      const us = _optionalChain([req, 'optionalAccess', _540 => _540.Userinfo, 'optionalAccess', _541 => _541[0]]);
       if (!us) return sendErr(res, "AUTH_UNAUTHORIZED", void 0, opt);
       const user = await store.findByUsername(String(us));
       return sendSuccess(res, { user: user ? publicUser($asai, user) : null }, opt);
@@ -4498,16 +4511,16 @@ var As_default = {
     return { code: 908, data: val };
   },
   ctxSuccess(val, opt = null) {
-    if (typeof _optionalChain([opt, 'optionalAccess', _538 => _538.resAES]) === "function") {
+    if (typeof _optionalChain([opt, 'optionalAccess', _542 => _542.resAES]) === "function") {
       val = opt.resAES(val);
     }
     return { code: 909, data: val };
   },
   getPath(str = "-") {
-    return _optionalChain([str, 'optionalAccess', _539 => _539.replace, 'call', _540 => _540(/[^a-zA-Z0-9.\-_\\\/]/g, "")]);
+    return _optionalChain([str, 'optionalAccess', _543 => _543.replace, 'call', _544 => _544(/[^a-zA-Z0-9.\-_\\\/]/g, "")]);
   },
   getName(str = "-") {
-    return _optionalChain([str, 'optionalAccess', _541 => _541.replace, 'call', _542 => _542(/[^a-zA-Z0-9.\-_]/g, "")]);
+    return _optionalChain([str, 'optionalAccess', _545 => _545.replace, 'call', _546 => _546(/[^a-zA-Z0-9.\-_]/g, "")]);
   },
   toDirPath(relativePath) {
     const pathArr = relativePath.split("/");
@@ -4543,10 +4556,10 @@ var As_default = {
     return absPath;
   },
   makeDir(fs11, filePaths) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       try {
         const newPath = this.ensureDir(fs11, filePaths);
-        resolve5(newPath);
+        resolve6(newPath);
       } catch (err) {
         reject(err);
       }
@@ -4578,7 +4591,7 @@ var As_default = {
   //     immediate: false,
   // });
   dtImmediate(fn, opt) {
-    if (_optionalChain([opt, 'optionalAccess', _543 => _543.immediate])) {
+    if (_optionalChain([opt, 'optionalAccess', _547 => _547.immediate])) {
       fn();
       opt.immediate = false;
     }
@@ -4600,7 +4613,7 @@ var As_default = {
     if (opt.endtime - opt.starttime < opt.wait) {
       this.dtClearTimeout(opt);
     }
-    if (!_optionalChain([opt, 'optionalAccess', _544 => _544.timeout])) {
+    if (!_optionalChain([opt, 'optionalAccess', _548 => _548.timeout])) {
       opt.starttime = opt.endtime;
       opt.timeout = this.dtSetTimeout(fn, opt);
     }
@@ -4608,7 +4621,7 @@ var As_default = {
   // 节流:指定长度时间内有多次触发，只fn最后一次触发
   throttle(fn, opt) {
     this.dtImmediate(fn, opt);
-    if (!_optionalChain([opt, 'optionalAccess', _545 => _545.timeout])) {
+    if (!_optionalChain([opt, 'optionalAccess', _549 => _549.timeout])) {
       opt.timeout = this.dtSetTimeout(fn, opt);
     }
   },
@@ -4644,8 +4657,8 @@ var As_default = {
 var AsCode_default = {
   // 加密
   asencode(str, keys) {
-    const strlen = _optionalChain([str, 'optionalAccess', _546 => _546.length]) || 0;
-    const keyslen = _optionalChain([keys, 'optionalAccess', _547 => _547.length]) || 0;
+    const strlen = _optionalChain([str, 'optionalAccess', _550 => _550.length]) || 0;
+    const keyslen = _optionalChain([keys, 'optionalAccess', _551 => _551.length]) || 0;
     let newstr = "";
     for (let i = 0; i < strlen; i++) {
       const rnum = Math.round(Math.random() * 1e3) % keyslen;
@@ -4670,7 +4683,7 @@ var AsCode_default = {
         const rnum = keys.indexOf(str[i + 3]);
         const rnumx = Number(rnum.toString().slice(-1)) + 1;
         const ylen = keyslen - rnumx;
-        newstr += _optionalChain([String, 'optionalAccess', _548 => _548.fromCodePoint, 'call', _549 => _549(
+        newstr += _optionalChain([String, 'optionalAccess', _552 => _552.fromCodePoint, 'call', _553 => _553(
           (keys.indexOf(str[i++]) - rnumx) * ylen * ylen + (keys.indexOf(str[i++]) - rnumx) * ylen + (keys.indexOf(str[i++]) - rnumx)
         )]);
       }
@@ -4753,7 +4766,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, decrypt, "decrypt");
   function validateFields(payload, fields) {
-    return fields.every((key) => typeof _optionalChain([payload, 'optionalAccess', _550 => _550[key]]) === "string" && payload[key].length > 0);
+    return fields.every((key) => typeof _optionalChain([payload, 'optionalAccess', _554 => _554[key]]) === "string" && payload[key].length > 0);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, validateFields, "validateFields");
   function reqAES(opt, fn = (data) => data) {
@@ -4761,7 +4774,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     try {
       if (validateFields(reqData, ["data", "iv", "auth"])) {
         let aesData = decrypt(reqData);
-        if (_optionalChain([reqData, 'optionalAccess', _551 => _551.aes]) === 2) {
+        if (_optionalChain([reqData, 'optionalAccess', _555 => _555.aes]) === 2) {
           aesData = JSON.parse(aesData);
         }
         return fn(aesData);
@@ -4795,24 +4808,24 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
 // src/sysserver/lib/common/AsDb.ts
 var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, cfg) => {
   const DataServer = _chunk2BCIIKRGcjs.getDataServerForAsDb.call(void 0, $asai, {
-    type: _optionalChain([cfg, 'optionalAccess', _552 => _552.type]) || "sqlite",
+    type: _optionalChain([cfg, 'optionalAccess', _556 => _556.type]) || "sqlite",
     opt: {
-      ..._optionalChain([cfg, 'optionalAccess', _553 => _553.opt]) || {
+      ..._optionalChain([cfg, 'optionalAccess', _557 => _557.opt]) || {
         database: "./webdata/webdb/sqlite/asaisqlite.db",
         create: 1
       }
     },
-    storeKey: _optionalChain([cfg, 'optionalAccess', _554 => _554.storeKey])
+    storeKey: _optionalChain([cfg, 'optionalAccess', _558 => _558.storeKey])
   });
   function reqwherestr(str) {
-    if (_optionalChain([cfg, 'optionalAccess', _555 => _555.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _556 => _556.type]) === "mysql") {
+    if (_optionalChain([cfg, 'optionalAccess', _559 => _559.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _560 => _560.type]) === "mysql") {
       return `'${str}'`;
     }
     return str;
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqwherestr, "reqwherestr");
   function reqfield(queryData) {
-    if (_optionalChain([queryData, 'optionalAccess', _557 => _557.fd])) {
+    if (_optionalChain([queryData, 'optionalAccess', _561 => _561.fd])) {
       return queryData.fd.split("-");
     }
     return cfg.field.data;
@@ -4820,14 +4833,14 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqfield, "reqfield");
   function reqwhere(queryData) {
     const wheretmp = [];
-    if ((_optionalChain([cfg, 'optionalAccess', _558 => _558.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _559 => _559.type]) === "mysql") && _optionalChain([queryData, 'optionalAccess', _560 => _560.wlv])) {
+    if ((_optionalChain([cfg, 'optionalAccess', _562 => _562.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _563 => _563.type]) === "mysql") && _optionalChain([queryData, 'optionalAccess', _564 => _564.wlv])) {
       const wlvarr = queryData.wlv.split("-");
       wheretmp.push([wlvarr[0], ">", Number(wlvarr[1] || 0)]);
     }
-    if (_optionalChain([queryData, 'optionalAccess', _561 => _561.fl])) {
+    if (_optionalChain([queryData, 'optionalAccess', _565 => _565.fl])) {
       wheretmp.push([cfg.field.class, "LIKE", reqwherestr(`${queryData.fl}%`)]);
     }
-    if (_optionalChain([queryData, 'optionalAccess', _562 => _562.ss]) && _optionalChain([queryData, 'optionalAccess', _563 => _563.ssty])) {
+    if (_optionalChain([queryData, 'optionalAccess', _566 => _566.ss]) && _optionalChain([queryData, 'optionalAccess', _567 => _567.ssty])) {
       wheretmp.push([queryData.ssty, "LIKE", reqwherestr(`%${queryData.ss}%`)]);
     }
     if (wheretmp.length > 1) {
@@ -4838,16 +4851,16 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqwhere, "reqwhere");
   function reqorder(queryData) {
     const ordertmp = [];
-    if (_optionalChain([queryData, 'optionalAccess', _564 => _564.sx])) {
-      ordertmp.push([queryData.sx, _optionalChain([queryData, 'optionalAccess', _565 => _565.sxty]) == 1 ? "DESC" : "ASC"]);
+    if (_optionalChain([queryData, 'optionalAccess', _568 => _568.sx])) {
+      ordertmp.push([queryData.sx, _optionalChain([queryData, 'optionalAccess', _569 => _569.sxty]) == 1 ? "DESC" : "ASC"]);
     }
     return ordertmp;
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqorder, "reqorder");
   function reqlimit(queryData) {
     let limittmp = "";
-    let limitps = _optionalChain([queryData, 'optionalAccess', _566 => _566.ps]);
-    if (_optionalChain([queryData, 'optionalAccess', _567 => _567.pg])) {
+    let limitps = _optionalChain([queryData, 'optionalAccess', _570 => _570.ps]);
+    if (_optionalChain([queryData, 'optionalAccess', _571 => _571.pg])) {
       limitps = limitps || 20;
       limittmp = `${(queryData.pg - 1) * limitps},${limitps}`;
     } else if (limitps) {
@@ -4900,8 +4913,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, fileKeyFromSegment, "fileKeyFromSegment");
   function getSqlParamsByUrl(req, opt) {
     let tmpSqlParams;
-    const reqArr = _optionalChain([req, 'optionalAccess', _568 => _568.url, 'optionalAccess', _569 => _569.split, 'call', _570 => _570("?"), 'access', _571 => _571[0], 'optionalAccess', _572 => _572.split, 'call', _573 => _573("/")]) || [];
-    const table = (_optionalChain([opt, 'optionalAccess', _574 => _574.qrdata, 'optionalAccess', _575 => _575.table]) || _optionalChain([opt, 'optionalAccess', _576 => _576.data, 'optionalAccess', _577 => _577.table]) || reqArr[3]).replaceAll("_", "/");
+    const reqArr = _optionalChain([req, 'optionalAccess', _572 => _572.url, 'optionalAccess', _573 => _573.split, 'call', _574 => _574("?"), 'access', _575 => _575[0], 'optionalAccess', _576 => _576.split, 'call', _577 => _577("/")]) || [];
+    const table = (_optionalChain([opt, 'optionalAccess', _578 => _578.qrdata, 'optionalAccess', _579 => _579.table]) || _optionalChain([opt, 'optionalAccess', _580 => _580.data, 'optionalAccess', _581 => _581.table]) || reqArr[3]).replaceAll("_", "/");
     if (!table) return tmpSqlParams;
     tmpSqlParams = {
       type: "select",
@@ -4910,7 +4923,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     if (reqArr[5]) {
       if (reqArr[4] === "insert") {
         tmpSqlParams.type = reqArr[4];
-        if (_optionalChain([cfg, 'optionalAccess', _578 => _578.type]) === "file") {
+        if (_optionalChain([cfg, 'optionalAccess', _582 => _582.type]) === "file") {
           const { name: bodyName, content } = parseFileBody(opt.data);
           const fileKey = fileKeyFromSegment(reqArr[5], bodyName);
           tmpSqlParams.field = cfg.field.data;
@@ -4934,11 +4947,11 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         }
       } else if (reqArr[4] === "update") {
         tmpSqlParams.type = reqArr[4];
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _579 => _579.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _583 => _583.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
-        if (_optionalChain([cfg, 'optionalAccess', _580 => _580.type]) === "file") {
+        if (_optionalChain([cfg, 'optionalAccess', _584 => _584.type]) === "file") {
           const { content } = parseFileBody(opt.data);
-          const contentField = _optionalChain([cfg, 'access', _581 => _581.field, 'access', _582 => _582.data, 'optionalAccess', _583 => _583[1]]) || "content";
+          const contentField = _optionalChain([cfg, 'access', _585 => _585.field, 'access', _586 => _586.data, 'optionalAccess', _587 => _587[1]]) || "content";
           tmpSqlParams.set = [[contentField, fileContentString(content)]];
         } else {
           tmpSqlParams.set = [];
@@ -4955,18 +4968,18 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         }
       } else if (reqArr[4] === "delete") {
         tmpSqlParams.type = reqArr[4];
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _584 => _584.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _588 => _588.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       } else {
-        if (_optionalChain([cfg, 'optionalAccess', _585 => _585.as]) > 1) {
+        if (_optionalChain([cfg, 'optionalAccess', _589 => _589.as]) > 1) {
           tmpSqlParams.as = +cfg.as - 1;
         }
         tmpSqlParams.field = cfg.field.data;
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _586 => _586.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _590 => _590.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       }
     } else {
-      tmpSqlParams.as = _optionalChain([cfg, 'optionalAccess', _587 => _587.as]);
+      tmpSqlParams.as = _optionalChain([cfg, 'optionalAccess', _591 => _591.as]);
       tmpSqlParams.field = reqfield(opt.data);
       tmpSqlParams.where = reqwhere(opt.data);
       tmpSqlParams.order = reqorder(opt.data);
@@ -4976,8 +4989,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getSqlParamsByUrl, "getSqlParamsByUrl");
   function dbFresh(req, resdb) {
-    if (_optionalChain([req, 'optionalAccess', _588 => _588.url, 'optionalAccess', _589 => _589.includes, 'call', _590 => _590("/selectlist/")])) {
-      const list = Array.isArray(resdb) ? resdb : _optionalChain([resdb, 'optionalAccess', _591 => _591.data]);
+    if (_optionalChain([req, 'optionalAccess', _592 => _592.url, 'optionalAccess', _593 => _593.includes, 'call', _594 => _594("/selectlist/")])) {
+      const list = Array.isArray(resdb) ? resdb : _optionalChain([resdb, 'optionalAccess', _595 => _595.data]);
       if (Array.isArray(list)) {
         const names = list.map((el) => {
           if (typeof el === "string") {
@@ -4999,8 +5012,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, dbFresh, "dbFresh");
   function normalizeFileSelectRow(row) {
-    const nameKey = _optionalChain([cfg, 'access', _592 => _592.field, 'optionalAccess', _593 => _593.data, 'optionalAccess', _594 => _594[0]]) || "name";
-    const contentKey = _optionalChain([cfg, 'access', _595 => _595.field, 'optionalAccess', _596 => _596.data, 'optionalAccess', _597 => _597[1]]) || "content";
+    const nameKey = _optionalChain([cfg, 'access', _596 => _596.field, 'optionalAccess', _597 => _597.data, 'optionalAccess', _598 => _598[0]]) || "name";
+    const contentKey = _optionalChain([cfg, 'access', _599 => _599.field, 'optionalAccess', _600 => _600.data, 'optionalAccess', _601 => _601[1]]) || "content";
     if (!row || typeof row !== "object") return row;
     const out = { ...row };
     if (out[nameKey] != null) {
@@ -5014,7 +5027,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeFileSelectRow, "normalizeFileSelectRow");
   function isFileSingleNameSelect(params) {
-    return _optionalChain([cfg, 'optionalAccess', _598 => _598.type]) === "file" && _optionalChain([params, 'optionalAccess', _599 => _599.type]) === "select" && !!_optionalChain([params, 'optionalAccess', _600 => _600.where, 'optionalAccess', _601 => _601.length]);
+    return _optionalChain([cfg, 'optionalAccess', _602 => _602.type]) === "file" && _optionalChain([params, 'optionalAccess', _603 => _603.type]) === "select" && !!_optionalChain([params, 'optionalAccess', _604 => _604.where, 'optionalAccess', _605 => _605.length]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, isFileSingleNameSelect, "isFileSingleNameSelect");
   function normalizeSelectResult(params, resdb) {
@@ -5028,12 +5041,12 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       }
       return data;
     }
-    if (_optionalChain([params, 'optionalAccess', _602 => _602.where, 'optionalAccess', _603 => _603.length]) && Array.isArray(data) && data.length === 1) {
+    if (_optionalChain([params, 'optionalAccess', _606 => _606.where, 'optionalAccess', _607 => _607.length]) && Array.isArray(data) && data.length === 1) {
       data = data[0];
     }
-    if (_optionalChain([cfg, 'optionalAccess', _604 => _604.type]) === "file" && data && typeof data === "object" && !Array.isArray(data)) {
-      const nameKey = _optionalChain([cfg, 'access', _605 => _605.field, 'optionalAccess', _606 => _606.data, 'optionalAccess', _607 => _607[0]]) || "name";
-      const contentKey = _optionalChain([cfg, 'access', _608 => _608.field, 'optionalAccess', _609 => _609.data, 'optionalAccess', _610 => _610[1]]) || "content";
+    if (_optionalChain([cfg, 'optionalAccess', _608 => _608.type]) === "file" && data && typeof data === "object" && !Array.isArray(data)) {
+      const nameKey = _optionalChain([cfg, 'access', _609 => _609.field, 'optionalAccess', _610 => _610.data, 'optionalAccess', _611 => _611[0]]) || "name";
+      const contentKey = _optionalChain([cfg, 'access', _612 => _612.field, 'optionalAccess', _613 => _613.data, 'optionalAccess', _614 => _614[1]]) || "content";
       if (data[nameKey] != null) {
         data[nameKey] = bareFileName(String(data[nameKey]));
       }
@@ -5052,7 +5065,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeSelectResult, "normalizeSelectResult");
   function dbCodePm(req, resdb) {
-    if (_optionalChain([req, 'optionalAccess', _611 => _611.Userinfo]) && _optionalChain([req, 'optionalAccess', _612 => _612.Userinfo, 'access', _613 => _613[2]])) {
+    if (_optionalChain([req, 'optionalAccess', _615 => _615.Userinfo]) && _optionalChain([req, 'optionalAccess', _616 => _616.Userinfo, 'access', _617 => _617[2]])) {
       if (resdb != null && typeof resdb === "object") {
         resdb.data = $asai.$lib.AsCode.asencode(JSON.stringify(resdb.data), req.Userinfo[2]);
       }
@@ -5066,8 +5079,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       DataServer.sqlDb(params).then((resdb) => {
         res.end(JSON.stringify($asai.$lib.As.ctxSuccess(dbCodePm(req, dbFresh(req, resdb)), opt)));
       }).catch((errdb) => {
-        const msg = String(_optionalChain([errdb, 'optionalAccess', _614 => _614.message]) || errdb || "");
-        if (_optionalChain([params, 'optionalAccess', _615 => _615.type]) === "select" && msg.includes("no such table")) {
+        const msg = String(_optionalChain([errdb, 'optionalAccess', _618 => _618.message]) || errdb || "");
+        if (_optionalChain([params, 'optionalAccess', _619 => _619.type]) === "select" && msg.includes("no such table")) {
           res.end(JSON.stringify($asai.$lib.As.ctxSuccess([], opt)));
           return;
         }
@@ -5084,23 +5097,23 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       try {
         DataServer.sqlDb(params).then((resdb) => {
           let resData = normalizeSelectResult(params, dbFresh(req, resdb));
-          if (_optionalChain([params, 'optionalAccess', _616 => _616.as]) === 2 && _optionalChain([params, 'optionalAccess', _617 => _617.field, 'optionalAccess', _618 => _618.length]) > 1) {
+          if (_optionalChain([params, 'optionalAccess', _620 => _620.as]) === 2 && _optionalChain([params, 'optionalAccess', _621 => _621.field, 'optionalAccess', _622 => _622.length]) > 1) {
             let limitArr = [];
-            if (_optionalChain([params, 'access', _619 => _619.limit, 'optionalAccess', _620 => _620.split, 'call', _621 => _621(","), 'optionalAccess', _622 => _622.length]) < 2) {
-              limitArr = [0, +_optionalChain([params, 'access', _623 => _623.limit, 'optionalAccess', _624 => _624.split, 'call', _625 => _625(","), 'optionalAccess', _626 => _626[0]])];
+            if (_optionalChain([params, 'access', _623 => _623.limit, 'optionalAccess', _624 => _624.split, 'call', _625 => _625(","), 'optionalAccess', _626 => _626.length]) < 2) {
+              limitArr = [0, +_optionalChain([params, 'access', _627 => _627.limit, 'optionalAccess', _628 => _628.split, 'call', _629 => _629(","), 'optionalAccess', _630 => _630[0]])];
             } else {
               limitArr = params.limit.split(",");
               limitArr = [+limitArr[0], +limitArr[0] + +limitArr[1]];
             }
-            if (_optionalChain([resData, 'access', _627 => _627.data, 'optionalAccess', _628 => _628.length])) {
+            if (_optionalChain([resData, 'access', _631 => _631.data, 'optionalAccess', _632 => _632.length])) {
               resData.data = resData.data.slice(+limitArr[0], +limitArr[1]);
             }
           }
           resData = dbCodePm(req, resData);
           res.end(JSON.stringify($asai.$lib.As.ctxSuccess(resData, opt)));
         }).catch((errdb) => {
-          const msg = String(_optionalChain([errdb, 'optionalAccess', _629 => _629.message]) || errdb || "");
-          if (_optionalChain([params, 'optionalAccess', _630 => _630.type]) === "select" && msg.includes("no such table")) {
+          const msg = String(_optionalChain([errdb, 'optionalAccess', _633 => _633.message]) || errdb || "");
+          if (_optionalChain([params, 'optionalAccess', _634 => _634.type]) === "select" && msg.includes("no such table")) {
             res.end(JSON.stringify($asai.$lib.As.ctxSuccess([], opt)));
             return;
           }
@@ -5115,7 +5128,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, runDefaultGet, "runDefaultGet");
   function post(req, res, hostdir, opt) {
-    if (_optionalChain([cfg, 'optionalAccess', _631 => _631.post]) && typeof cfg.post === "function") {
+    if (_optionalChain([cfg, 'optionalAccess', _635 => _635.post]) && typeof cfg.post === "function") {
       Promise.resolve(cfg.post(req, res, hostdir, opt, DataServer)).then((reqstat) => {
         if (!reqstat) runDefaultPost(req, res, opt);
       }).catch((errdb) => {
@@ -5127,7 +5140,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, post, "post");
   function get(req, res, hostdir, opt) {
-    if (_optionalChain([cfg, 'optionalAccess', _632 => _632.get]) && typeof cfg.get === "function") {
+    if (_optionalChain([cfg, 'optionalAccess', _636 => _636.get]) && typeof cfg.get === "function") {
       Promise.resolve(cfg.get(req, res, hostdir, opt, DataServer)).then((reqstat) => {
         if (!reqstat) runDefaultGet(req, res, opt);
       }).catch((errdb) => {
@@ -5142,6 +5155,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 }, "default");
 
 // src/sysserver/lib/common/reqWork.ts
+
 var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
   function hostDefault2(mod) {
     if (mod && typeof mod === "object" && "default" in mod) {
@@ -5152,17 +5166,30 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, hostDefault2, "hostDefault");
   function getPathFromOpt(opt) {
-    const rawPath = _optionalChain([opt, 'access', _633 => _633.qrdata, 'optionalAccess', _634 => _634.path]) || _optionalChain([opt, 'access', _635 => _635.data, 'optionalAccess', _636 => _636.path]);
+    const rawPath = _optionalChain([opt, 'access', _637 => _637.qrdata, 'optionalAccess', _638 => _638.path]) || _optionalChain([opt, 'access', _639 => _639.data, 'optionalAccess', _640 => _640.path]);
     if (!rawPath) {
       throw new Error("Missing path");
     }
     const decoded = decodeURIComponent(String(rawPath));
-    const roots = _optionalChain([$asai, 'optionalAccess', _637 => _637.asaihost, 'optionalAccess', _638 => _638.getHostAllowedRoots, 'optionalCall', _639 => _639(_optionalChain([$asai, 'optionalAccess', _640 => _640.hostconfig]))]) || [];
+    if (path4.isAbsolute(decoded)) {
+      return path4.normalize(decoded);
+    }
+    const rel = decoded.replace(/^\.(\/)?/, "");
+    const serverRoot = _optionalChain([$asai, 'optionalAccess', _641 => _641.serverRoot]);
+    if (serverRoot && rel) {
+      const absRoot = path4.resolve(serverRoot);
+      const abs = path4.resolve(absRoot, rel);
+      const relCheck = path4.relative(absRoot, abs);
+      if (relCheck === "" || !relCheck.startsWith("..") && !path4.isAbsolute(relCheck)) {
+        return abs;
+      }
+    }
+    const roots = _optionalChain([$asai, 'optionalAccess', _642 => _642.asaihost, 'optionalAccess', _643 => _643.getHostAllowedRoots, 'optionalCall', _644 => _644(_optionalChain([$asai, 'optionalAccess', _645 => _645.hostconfig]))]) || [];
     if (!roots.length) {
-      const fallback = _optionalChain([$asai, 'optionalAccess', _641 => _641.serverRoot]) || process.cwd();
+      const fallback = _optionalChain([$asai, 'optionalAccess', _646 => _646.serverRoot]) || process.cwd();
       if (fallback) roots.push(fallback);
     }
-    if (!_optionalChain([$asai, 'optionalAccess', _642 => _642.asaihost, 'optionalAccess', _643 => _643.resolvePathUnderRoots])) {
+    if (!_optionalChain([$asai, 'optionalAccess', _647 => _647.asaihost, 'optionalAccess', _648 => _648.resolvePathUnderRoots])) {
       throw new Error("Path resolver unavailable");
     }
     return $asai.asaihost.resolvePathUnderRoots(decoded, roots);
@@ -5174,18 +5201,18 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendSuccess, "sendSuccess");
   function sendErr(res, ec, params, opt) {
-    const ErrorCode = _optionalChain([$asai, 'access', _644 => _644.$lib, 'optionalAccess', _645 => _645.ErrorCode]);
-    _optionalChain([ErrorCode, 'optionalAccess', _646 => _646.loadErrorCodes, 'optionalCall', _647 => _647($asai)]);
-    _optionalChain([ErrorCode, 'optionalAccess', _648 => _648.logError, 'optionalCall', _649 => _649($asai, ec, Array.isArray(params) ? params.map(String) : params != null ? [String(params)] : void 0)]);
+    const ErrorCode = _optionalChain([$asai, 'access', _649 => _649.$lib, 'optionalAccess', _650 => _650.ErrorCode]);
+    _optionalChain([ErrorCode, 'optionalAccess', _651 => _651.loadErrorCodes, 'optionalCall', _652 => _652($asai)]);
+    _optionalChain([ErrorCode, 'optionalAccess', _653 => _653.logError, 'optionalCall', _654 => _654($asai, ec, Array.isArray(params) ? params.map(String) : params != null ? [String(params)] : void 0)]);
     const response = $asai.$lib.As.ctxErr(ec, params, opt);
     res.end(JSON.stringify(response));
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendErr, "sendErr");
   function sendFail(res, err, opt) {
-    const ErrorCode = _optionalChain([$asai, 'access', _650 => _650.$lib, 'optionalAccess', _651 => _651.ErrorCode]);
-    _optionalChain([ErrorCode, 'optionalAccess', _652 => _652.loadErrorCodes, 'optionalCall', _653 => _653($asai)]);
-    const normalized = _optionalChain([ErrorCode, 'optionalAccess', _654 => _654.normalizeErrPayload, 'optionalCall', _655 => _655(err)]);
-    if (_optionalChain([normalized, 'optionalAccess', _656 => _656.ec])) {
+    const ErrorCode = _optionalChain([$asai, 'access', _655 => _655.$lib, 'optionalAccess', _656 => _656.ErrorCode]);
+    _optionalChain([ErrorCode, 'optionalAccess', _657 => _657.loadErrorCodes, 'optionalCall', _658 => _658($asai)]);
+    const normalized = _optionalChain([ErrorCode, 'optionalAccess', _659 => _659.normalizeErrPayload, 'optionalCall', _660 => _660(err)]);
+    if (_optionalChain([normalized, 'optionalAccess', _661 => _661.ec])) {
       return sendErr(res, normalized.ec, normalized.pm, opt);
     }
     const response = $asai.$lib.As.ctxFail(err);
@@ -5193,7 +5220,7 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendFail, "sendFail");
   function mnLog(...arg) {
-    (_optionalChain([$asai, 'optionalAccess', _657 => _657.$log]) || console.log)(...arg);
+    (_optionalChain([$asai, 'optionalAccess', _662 => _662.$log]) || console.log)(...arg);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mnLog, "mnLog");
   return { hostDefault: hostDefault2, getPathFromOpt, sendSuccess, sendFail, sendErr, mnLog };
@@ -5293,7 +5320,7 @@ async function removeFile(filePath) {
   try {
     await _promises2.default.unlink(nodePath2.default.normalize(filePath));
   } catch (err) {
-    if (_optionalChain([err, 'optionalAccess', _658 => _658.code]) !== "ENOENT") throw err;
+    if (_optionalChain([err, 'optionalAccess', _663 => _663.code]) !== "ENOENT") throw err;
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, removeFile, "removeFile");
@@ -5343,17 +5370,17 @@ _chunkSMVZ3ZDJcjs.__export.call(void 0, common_exports, {
 });
 
 function promisifySqlDb(query, sql) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     query(sql, (err, result) => {
       if (err) {
         reject(err);
         return;
       }
       if (!result || Array.isArray(result) && result.length === 0) {
-        resolve5("");
+        resolve6("");
         return;
       }
-      resolve5(result);
+      resolve6(result);
     });
   });
 }
@@ -5406,11 +5433,11 @@ function toInsertRows(sql) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, toInsertRows, "toInsertRows");
 function isPathInside(baseDir, targetPath) {
-  const base = path5.resolve(baseDir);
-  const target = path5.resolve(targetPath);
-  const relative4 = path5.relative(base, target);
-  if (!relative4) return true;
-  return !relative4.startsWith("..") && !path5.isAbsolute(relative4);
+  const base = path6.resolve(baseDir);
+  const target = path6.resolve(targetPath);
+  const relative5 = path6.relative(base, target);
+  if (!relative5) return true;
+  return !relative5.startsWith("..") && !path6.isAbsolute(relative5);
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, isPathInside, "isPathInside");
 function joinTablePath(table, ...segments) {
@@ -5605,11 +5632,11 @@ function dbDriver(opt = {}) {
       this.fileExt = config.ext === ".*" ? "" : config.ext || "";
       this.fileDel = (config.del || 0) !== 0;
       this.createDir = config.create || false;
-      const root = _optionalChain([config, 'access', _659 => _659.$asai, 'optionalAccess', _660 => _660.serverRoot]) || _chunkHR5JKN7Ycjs.getPrimaryServerRoot.call(void 0, );
-      this.baseDirAbs = path6.resolve(root, config.dir);
+      const root = _optionalChain([config, 'access', _664 => _664.$asai, 'optionalAccess', _665 => _665.serverRoot]) || _chunkHR5JKN7Ycjs.getPrimaryServerRoot.call(void 0, );
+      this.baseDirAbs = path7.resolve(root, config.dir);
     }
     dbLog(...args) {
-      (_optionalChain([this, 'access', _661 => _661.config, 'optionalAccess', _662 => _662.$asai, 'optionalAccess', _663 => _663.$log]) || console.log)("FILE", ...args);
+      (_optionalChain([this, 'access', _666 => _666.config, 'optionalAccess', _667 => _667.$asai, 'optionalAccess', _668 => _668.$log]) || console.log)("FILE", ...args);
     }
     checkFile(file) {
       return fs10.existsSync(this.getAbsPath(file, false));
@@ -5619,9 +5646,9 @@ function dbDriver(opt = {}) {
       if (!relPath) {
         return this.baseDirAbs;
       }
-      const abs = path6.isAbsolute(relPath) ? path6.normalize(relPath) : path6.resolve(this.baseDirAbs, relPath);
+      const abs = path7.isAbsolute(relPath) ? path7.normalize(relPath) : path7.resolve(this.baseDirAbs, relPath);
       if (!isPathInside2(this.baseDirAbs, abs)) {
-        return this.baseDirAbs;
+        throw new Error("Path not allowed");
       }
       return abs;
     }
@@ -5633,11 +5660,11 @@ function dbDriver(opt = {}) {
       if (!relPath) {
         return "";
       }
-      return path6.isAbsolute(relPath) ? path6.relative(this.baseDirAbs, relPath) : relPath;
+      return path7.isAbsolute(relPath) ? path7.relative(this.baseDirAbs, relPath) : relPath;
     }
     ensureDir(relPath) {
-      const relative4 = this.normalizeRelPath(relPath);
-      const dirPath = path6.dirname(relative4);
+      const relative5 = this.normalizeRelPath(relPath);
+      const dirPath = path7.dirname(relative5);
       const absDir = this.resolvePath(dirPath === "." ? "" : dirPath);
       if (this.createDir && !fs10.existsSync(absDir)) {
         this.dbLog("mkdir", "[MKDIR]", absDir);
@@ -5663,9 +5690,9 @@ function dbDriver(opt = {}) {
       this.dbLog("delete", "[RMDIR]", absPath);
       const entries = fs10.readdirSync(absPath, { withFileTypes: true });
       for (const entry of entries) {
-        const current = path6.join(absPath, entry.name);
+        const current = path7.join(absPath, entry.name);
         if (entry.isDirectory()) {
-          this.deldir(path6.join(relativePath, entry.name));
+          this.deldir(path7.join(relativePath, entry.name));
         } else {
           this.dbLog("delete", "[UNLINK]", current);
           fs10.unlinkSync(current);
@@ -5675,9 +5702,9 @@ function dbDriver(opt = {}) {
     }
     getReadPath(file, sql) {
       const candidates = [];
-      if (_optionalChain([sql, 'optionalAccess', _664 => _664.filename])) {
-        candidates.push({ dir: path6.join(file, sql.filename) });
-        candidates.push({ dir: path6.join(file + ".delete" + this.fileExt, sql.filename) });
+      if (_optionalChain([sql, 'optionalAccess', _669 => _669.filename])) {
+        candidates.push({ dir: path7.join(file, sql.filename) });
+        candidates.push({ dir: path7.join(file + ".delete" + this.fileExt, sql.filename) });
       } else {
         candidates.push({ dir: file });
         candidates.push({ dir: file + this.fileExt + ".delete" });
@@ -5695,20 +5722,20 @@ function dbDriver(opt = {}) {
       if (!read2.path) {
         return { path: "", dir: read2.dir };
       }
-      if (_optionalChain([sql, 'optionalAccess', _665 => _665.filename])) {
-        return { path: path6.dirname(read2.path), dir: path6.dirname(read2.dir) };
+      if (_optionalChain([sql, 'optionalAccess', _670 => _670.filename])) {
+        return { path: path7.dirname(read2.path), dir: path7.dirname(read2.dir) };
       }
       return { path: read2.path, dir: read2.dir };
     }
     getNewPath(file, sql) {
-      if (_optionalChain([sql, 'optionalAccess', _666 => _666.filename])) {
-        return this.getAbsPath(path6.join(file, sql.filename), true);
+      if (_optionalChain([sql, 'optionalAccess', _671 => _671.filename])) {
+        return this.getAbsPath(path7.join(file, sql.filename), true);
       }
       return this.getAbsPath(file, true);
     }
     write(file, data, sql) {
       try {
-        const filePath = _optionalChain([sql, 'optionalAccess', _667 => _667.type]) === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
+        const filePath = _optionalChain([sql, 'optionalAccess', _672 => _672.type]) === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
         this.dbLog("write", "[WRITE]", filePath);
         fs10.writeFileSync(filePath, data, "utf8");
         return "ok";
@@ -5738,11 +5765,11 @@ function dbDriver(opt = {}) {
         if (!del.path) {
           return "";
         }
-        if (this.fileDel && _optionalChain([sql, 'optionalAccess', _668 => _668.deltrue])) {
+        if (this.fileDel && _optionalChain([sql, 'optionalAccess', _673 => _673.deltrue])) {
           const target = del.path + ".delete" + this.fileExt;
           this.dbLog("soft delete", "[SOFT DELETE]", `${del.path} -> ${target}`);
           fs10.renameSync(del.path, target);
-        } else if (_optionalChain([sql, 'optionalAccess', _669 => _669.filename])) {
+        } else if (_optionalChain([sql, 'optionalAccess', _674 => _674.filename])) {
           this.deldir(del.dir);
         } else {
           this.dbLog("delete", "[DELETE]", del.path);
@@ -5785,7 +5812,7 @@ function dbDriver(opt = {}) {
         try {
           entries = fs10.readdirSync(absDir, { withFileTypes: true });
         } catch (e46) {
-          return _optionalChain([sql, 'optionalAccess', _670 => _670.list]) ? { open: [], delete: [] } : [];
+          return _optionalChain([sql, 'optionalAccess', _675 => _675.list]) ? { open: [], delete: [] } : [];
         }
         const result = { open: [], delete: [] };
         const deleteSuffix = ".delete" + this.fileExt;
@@ -5795,19 +5822,19 @@ function dbDriver(opt = {}) {
           const isDelete = fileName.endsWith(deleteSuffix);
           const baseName = isDelete ? fileName.slice(0, -deleteSuffix.length) : fileName;
           if (this.fileExt && !baseName.endsWith(this.fileExt)) continue;
-          const fullPath = path6.join(absDir, fileName);
+          const fullPath = path7.join(absDir, fileName);
           try {
             const data = fs10.readFileSync(fullPath, "utf8");
             const entryData = { data, file: baseName };
             if (isDelete) {
-              if (_optionalChain([sql, 'optionalAccess', _671 => _671.list])) result.delete.push(entryData);
+              if (_optionalChain([sql, 'optionalAccess', _676 => _676.list])) result.delete.push(entryData);
             } else {
               result.open.push(entryData);
             }
           } catch (e47) {
           }
         }
-        return _optionalChain([sql, 'optionalAccess', _672 => _672.list]) ? result : result.open;
+        return _optionalChain([sql, 'optionalAccess', _677 => _677.list]) ? result : result.open;
       } catch (e) {
         this.dbLog("list failed", "[LIST ERROR]", e);
         return e;
@@ -5817,14 +5844,14 @@ function dbDriver(opt = {}) {
     getFileNameFromWhere(where) {
       if (!where || !Array.isArray(where)) return "";
       const first = where.find((item) => Array.isArray(item));
-      const raw = _optionalChain([first, 'optionalAccess', _673 => _673[2]]);
+      const raw = _optionalChain([first, 'optionalAccess', _678 => _678[2]]);
       if (typeof raw === "string") {
         return raw.replace(/^'+|'+$/g, "");
       }
       return String(_nullishCoalesce(raw, () => ( "")));
     }
     sqlDb(sql) {
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve6, reject) => {
         try {
           let result;
           const tableDir = this.tableFilePath(sql.table);
@@ -5842,15 +5869,15 @@ function dbDriver(opt = {}) {
             const data = sql.set[0][1];
             result = this.write(this.tableFilePath(sql.table, file), data, sql);
           } else if (sql.type === "select") {
-            if (_optionalChain([sql, 'optionalAccess', _674 => _674.where, 'optionalAccess', _675 => _675.length]) && _optionalChain([sql, 'optionalAccess', _676 => _676.as]) !== 2) {
+            if (_optionalChain([sql, 'optionalAccess', _679 => _679.where, 'optionalAccess', _680 => _680.length]) && _optionalChain([sql, 'optionalAccess', _681 => _681.as]) !== 2) {
               const file = this.getFileNameFromWhere(sql.where);
               const readRes = this.read(this.tableFilePath(sql.table, file), sql);
               const resObj = {};
-              if (_optionalChain([readRes, 'optionalAccess', _677 => _677[0], 'optionalAccess', _678 => _678.file]) && !readRes.error) {
+              if (_optionalChain([readRes, 'optionalAccess', _682 => _682[0], 'optionalAccess', _683 => _683.file]) && !readRes.error) {
                 if (sql.as === 1) {
                   try {
                     const parsed = JSON.parse(readRes[0].data);
-                    if (_optionalChain([sql, 'access', _679 => _679.field, 'optionalAccess', _680 => _680.length])) {
+                    if (_optionalChain([sql, 'access', _684 => _684.field, 'optionalAccess', _685 => _685.length])) {
                       sql.field.forEach((f) => {
                         resObj[f] = _nullishCoalesce(parsed[f], () => ( ""));
                       });
@@ -5871,7 +5898,7 @@ function dbDriver(opt = {}) {
             } else {
               const listRes = this.list(tableDir, sql);
               if (listRes && !listRes.error) {
-                if (_optionalChain([sql, 'optionalAccess', _681 => _681.list])) {
+                if (_optionalChain([sql, 'optionalAccess', _686 => _686.list])) {
                   const mapEntry = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (el) => {
                     const fields = sql.field;
                     const item = { [fields[0]]: el.file };
@@ -5882,9 +5909,9 @@ function dbDriver(opt = {}) {
                   if (listRes.delete) listRes.delete = listRes.delete.map(mapEntry);
                   result = listRes;
                 } else {
-                  if (_optionalChain([sql, 'optionalAccess', _682 => _682.as]) === 2) {
+                  if (_optionalChain([sql, 'optionalAccess', _687 => _687.as]) === 2) {
                     let items = listRes;
-                    if (_optionalChain([sql, 'access', _683 => _683.where, 'optionalAccess', _684 => _684.length])) {
+                    if (_optionalChain([sql, 'access', _688 => _688.where, 'optionalAccess', _689 => _689.length])) {
                       const where = sql.where;
                       const whereType = typeof where[0] === "string" ? where[0] : "and";
                       items = items.filter((el) => {
@@ -5916,7 +5943,7 @@ function dbDriver(opt = {}) {
                       const obj = {};
                       try {
                         const parsed = JSON.parse(el.data);
-                        if (_optionalChain([sql, 'access', _685 => _685.field, 'optionalAccess', _686 => _686.length])) {
+                        if (_optionalChain([sql, 'access', _690 => _690.field, 'optionalAccess', _691 => _691.length])) {
                           sql.field.forEach((f) => {
                             obj[f] = _nullishCoalesce(parsed[f], () => ( ""));
                           });
@@ -5927,7 +5954,7 @@ function dbDriver(opt = {}) {
                       }
                       return obj;
                     });
-                    if (_optionalChain([sql, 'access', _687 => _687.order, 'optionalAccess', _688 => _688.length])) {
+                    if (_optionalChain([sql, 'access', _692 => _692.order, 'optionalAccess', _693 => _693.length])) {
                       const orderField = sql.order[0];
                       const orderFieldName = typeof orderField === "string" ? orderField : orderField[0];
                       const direction = typeof orderField === "string" ? "ASC" : String(orderField[1]).toUpperCase();
@@ -5948,12 +5975,12 @@ function dbDriver(opt = {}) {
                   }
                 }
               } else {
-                result = _optionalChain([sql, 'optionalAccess', _689 => _689.list]) ? { open: [], delete: [] } : [];
+                result = _optionalChain([sql, 'optionalAccess', _694 => _694.list]) ? { open: [], delete: [] } : [];
               }
             }
           }
           if (result !== void 0) {
-            resolve5(result);
+            resolve6(result);
           } else {
             reject("");
           }
@@ -6004,7 +6031,7 @@ function sysserver($asai, opt = {}) {
   if (!$asai.$lib) $asai.$lib = {};
   $asai.$lib = { ...lib_default, ...$asai.$lib, ...opt || {} };
   $asai.dataserver = db_default;
-  _optionalChain([$asai, 'access', _690 => _690.$lib, 'access', _691 => _691.ErrorCode, 'optionalAccess', _692 => _692.loadErrorCodes, 'optionalCall', _693 => _693($asai)]);
+  _optionalChain([$asai, 'access', _695 => _695.$lib, 'access', _696 => _696.ErrorCode, 'optionalAccess', _697 => _697.loadErrorCodes, 'optionalCall', _698 => _698($asai)]);
   if (!$asai.$lib.api) $asai.$lib.api = {};
   $asai.$lib.api = { ...api_default, ...$asai.$lib.api };
   if (!$asai.$lib.ws) $asai.$lib.ws = {};
@@ -6197,7 +6224,7 @@ function normalizeDataStoresConfig(cfg) {
     }
     if (userStore.opt.create == null) userStore.opt.create = 1;
   }
-  if (!stores.log && _optionalChain([cfg, 'access', _694 => _694.logger, 'optionalAccess', _695 => _695.store])) {
+  if (!stores.log && _optionalChain([cfg, 'access', _699 => _699.logger, 'optionalAccess', _700 => _700.store])) {
     const s = cfg.logger.store;
     stores.log = {
       type: s.type || "file",
@@ -6261,13 +6288,13 @@ function validateHostConfig(cfg) {
   if (cfg.asaisn != null) {
     errors.push("asaisn \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_ASAISN");
   }
-  if (_optionalChain([cfg, 'access', _696 => _696.aes, 'optionalAccess', _697 => _697.keybase64]) != null) {
+  if (_optionalChain([cfg, 'access', _701 => _701.aes, 'optionalAccess', _702 => _702.keybase64]) != null) {
     errors.push("aes.keybase64 \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_AES_KEYBASE64");
   }
-  if (_optionalChain([cfg, 'access', _698 => _698.httpscert, 'optionalAccess', _699 => _699.key]) != null || _optionalChain([cfg, 'access', _700 => _700.httpscert, 'optionalAccess', _701 => _701.cert]) != null) {
+  if (_optionalChain([cfg, 'access', _703 => _703.httpscert, 'optionalAccess', _704 => _704.key]) != null || _optionalChain([cfg, 'access', _705 => _705.httpscert, 'optionalAccess', _706 => _706.cert]) != null) {
     errors.push("httpscert.key/cert \u7981\u6B62\u5185\u8054\u4E8E asaihost.json\uFF0C\u8BF7\u4F7F\u7528 keyPath/certPath \u6216\u73AF\u5883\u53D8\u91CF");
   }
-  if (_optionalChain([cfg, 'access', _702 => _702.security, 'optionalAccess', _703 => _703.sessionSecret]) != null) {
+  if (_optionalChain([cfg, 'access', _707 => _707.security, 'optionalAccess', _708 => _708.sessionSecret]) != null) {
     errors.push("security.sessionSecret \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_SESSION_SECRET");
   }
   if (Array.isArray(cfg.wssec) && typeof cfg.wssec[0] === "string" && cfg.wssec[0].length > 0) {
@@ -6322,10 +6349,10 @@ function validateHostConfig(cfg) {
       validateHostSiteLimits(name, h, errors);
     }
   }
-  if (_optionalChain([cfg, 'access', _704 => _704.logger, 'optionalAccess', _705 => _705.sample]) && typeof cfg.logger.sample !== "object") {
+  if (_optionalChain([cfg, 'access', _709 => _709.logger, 'optionalAccess', _710 => _710.sample]) && typeof cfg.logger.sample !== "object") {
     errors.push('logger.sample \u5FC5\u987B\u4E3A\u5BF9\u8C61\uFF08\u5982 { "REQ_OTHER": 0.1 }\uFF09');
   }
-  if (_optionalChain([cfg, 'access', _706 => _706.logger, 'optionalAccess', _707 => _707.skip]) != null && !Array.isArray(cfg.logger.skip)) {
+  if (_optionalChain([cfg, 'access', _711 => _711.logger, 'optionalAccess', _712 => _712.skip]) != null && !Array.isArray(cfg.logger.skip)) {
     errors.push('logger.skip \u5FC5\u987B\u4E3A\u5B57\u7B26\u4E32\u6570\u7EC4\uFF08\u5982 ["/sys/info/metrics"]\uFF09');
   }
   if (cfg.proxyhosts && typeof cfg.proxyhosts === "object") {
@@ -6359,7 +6386,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, validateHostSiteLimits, "validateHostSiteL
 function validateProductionSecurity(cfg) {
   const errors = [];
   if (process.env.NODE_ENV !== "production") return errors;
-  const sec = _optionalChain([cfg, 'optionalAccess', _708 => _708.security]);
+  const sec = _optionalChain([cfg, 'optionalAccess', _713 => _713.security]);
   if (!sec || typeof sec !== "object") {
     errors.push("\u751F\u4EA7\u73AF\u5883\u5FC5\u987B\u914D\u7F6E security \u5BF9\u8C61");
     return errors;
@@ -6370,7 +6397,7 @@ function validateProductionSecurity(cfg) {
   if (sec.allowRegister === 1) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.allowRegister \u5E94\u4E3A 0\uFF08CR 1.3 \u7981\u6B62\u5F00\u653E\u6CE8\u518C\uFF09");
   }
-  if (!_optionalChain([sec, 'access', _709 => _709.quota, 'optionalAccess', _710 => _710.enabled])) {
+  if (!_optionalChain([sec, 'access', _714 => _714.quota, 'optionalAccess', _715 => _715.enabled])) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.quota.enabled \u5E94\u4E3A 1\uFF08CR 7.1 \u8D44\u6E90\u9650\u5236\uFF09");
   }
   if (sec.csp !== 1) {
@@ -6379,7 +6406,7 @@ function validateProductionSecurity(cfg) {
   if (typeof sec.minUserLevel !== "number" || sec.minUserLevel < 0) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.minUserLevel \u5E94\u663E\u5F0F\u914D\u7F6E");
   }
-  if (sec.forceWss === 1 && !_optionalChain([cfg, 'optionalAccess', _711 => _711.httpscert, 'optionalAccess', _712 => _712.keyPath]) && !_optionalChain([cfg, 'optionalAccess', _713 => _713.httpscert, 'optionalAccess', _714 => _714.key])) {
+  if (sec.forceWss === 1 && !_optionalChain([cfg, 'optionalAccess', _716 => _716.httpscert, 'optionalAccess', _717 => _717.keyPath]) && !_optionalChain([cfg, 'optionalAccess', _718 => _718.httpscert, 'optionalAccess', _719 => _719.key])) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.forceWss=1 \u65F6\u9700\u914D\u7F6E HTTPS \u8BC1\u4E66");
   }
   return errors;
@@ -6398,12 +6425,12 @@ var DEFAULT_RECONNECT = {
   rs485: { enabled: true, maxRetries: 60, initialDelay: 3e3, maxDelay: 3e4, factor: 2 }
 };
 function getTransportBlock(cfg, kind) {
-  const block = _optionalChain([cfg, 'optionalAccess', _715 => _715[kind]]);
+  const block = _optionalChain([cfg, 'optionalAccess', _720 => _720[kind]]);
   return block && typeof block === "object" ? block : null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getTransportBlock, "getTransportBlock");
 function getTransportDefault(cfg, kind) {
-  const def = _optionalChain([getTransportBlock, 'call', _716 => _716(cfg, kind), 'optionalAccess', _717 => _717.default]);
+  const def = _optionalChain([getTransportBlock, 'call', _721 => _721(cfg, kind), 'optionalAccess', _722 => _722.default]);
   return def && typeof def === "object" ? def : null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getTransportDefault, "getTransportDefault");
@@ -6413,7 +6440,7 @@ function hasTransportDefault(cfg, kind) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, hasTransportDefault, "hasTransportDefault");
 function getDefaultConnId(cfg, kind) {
   const def = getTransportDefault(cfg, kind);
-  const id = _optionalChain([def, 'optionalAccess', _718 => _718.id]);
+  const id = _optionalChain([def, 'optionalAccess', _723 => _723.id]);
   return typeof id === "string" && id.length > 0 ? id : DEFAULT_CONN_ID[kind];
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getDefaultConnId, "getDefaultConnId");
@@ -6424,14 +6451,14 @@ function shouldAutoConnect(def) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, shouldAutoConnect, "shouldAutoConnect");
 function resolveReconnectOptions(def, kind, cfg) {
   const base = DEFAULT_RECONNECT[kind];
-  const rc = _optionalChain([def, 'optionalAccess', _719 => _719.reconnect]);
-  const tmMaxTry = _optionalChain([cfg, 'optionalAccess', _720 => _720.tm, 'optionalAccess', _721 => _721.maxtry]);
+  const rc = _optionalChain([def, 'optionalAccess', _724 => _724.reconnect]);
+  const tmMaxTry = _optionalChain([cfg, 'optionalAccess', _725 => _725.tm, 'optionalAccess', _726 => _726.maxtry]);
   return {
-    enabled: _optionalChain([rc, 'optionalAccess', _722 => _722.enabled]) !== false && base.enabled !== false,
-    maxRetries: _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _723 => _723.maxRetries]), () => ( tmMaxTry)), () => ( base.maxRetries)), () => ( 60)),
-    initialDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _724 => _724.initialDelay]), () => ( base.initialDelay)), () => ( 1e3)),
-    maxDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _725 => _725.maxDelay]), () => ( base.maxDelay)), () => ( 3e4)),
-    factor: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _726 => _726.factor]), () => ( base.factor)), () => ( 2))
+    enabled: _optionalChain([rc, 'optionalAccess', _727 => _727.enabled]) !== false && base.enabled !== false,
+    maxRetries: _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _728 => _728.maxRetries]), () => ( tmMaxTry)), () => ( base.maxRetries)), () => ( 60)),
+    initialDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _729 => _729.initialDelay]), () => ( base.initialDelay)), () => ( 1e3)),
+    maxDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _730 => _730.maxDelay]), () => ( base.maxDelay)), () => ( 3e4)),
+    factor: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _731 => _731.factor]), () => ( base.factor)), () => ( 2))
   };
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveReconnectOptions, "resolveReconnectOptions");
@@ -6484,13 +6511,13 @@ function createTransportDataHandler($asai, manager) {
       } catch (e51) {
       }
     }
-    if (_optionalChain([event, 'access', _727 => _727.data, 'optionalAccess', _728 => _728.id])) {
+    if (_optionalChain([event, 'access', _732 => _732.data, 'optionalAccess', _733 => _733.id])) {
       manager.watch(event.id, event.data);
       return;
     }
     try {
-      const wsKey = _optionalChain([$asai, 'optionalAccess', _729 => _729.command, 'optionalAccess', _730 => _730.commandconfig, 'optionalAccess', _731 => _731.config, 'optionalAccess', _732 => _732.commandclient]);
-      _optionalChain([$asai, 'access', _733 => _733.serversws, 'optionalAccess', _734 => _734[wsKey], 'optionalAccess', _735 => _735.broadws, 'optionalCall', _736 => _736(event.data)]);
+      const wsKey = _optionalChain([$asai, 'optionalAccess', _734 => _734.command, 'optionalAccess', _735 => _735.commandconfig, 'optionalAccess', _736 => _736.config, 'optionalAccess', _737 => _737.commandclient]);
+      _optionalChain([$asai, 'access', _738 => _738.serversws, 'optionalAccess', _739 => _739[wsKey], 'optionalAccess', _740 => _740.broadws, 'optionalCall', _741 => _741(event.data)]);
     } catch (e52) {
     }
   };
@@ -6563,7 +6590,7 @@ var initAsaiHostNodejs2 = {
   createTransportDataHandler,
   wireTransportConnectionLogs
 };
-var PLUGIN_VERSION = true ? "0.0.6" : "0.0.1";
+var PLUGIN_VERSION = true ? "0.0.8" : "0.0.1";
 var index_default = initAsaiHostNodejs2;