npm - asaihost-nodejs - Versions diffs - 0.0.6 → 0.0.9 - Mend

asaihost-nodejs 0.0.6 → 0.0.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/asaihost-nodejs.cjs +591 -485
package/dist/asaihost-nodejs.cjs.map +1 -1
package/dist/asaihost-nodejs.es.js +280 -174
package/dist/asaihost-nodejs.es.js.map +1 -1
package/package.json +1 -1

package/dist/asaihost-nodejs.cjs CHANGED Viewed

@@ -399,7 +399,7 @@ var LogBuffer = class _LogBuffer {
   }
 };
 function saveLog($asai, src, logstr) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     try {
       const bufferKey = `${$asai.id || "default"}_${src}`;
       let logBuffer = logBuffers.get(bufferKey);
@@ -408,7 +408,7 @@ function saveLog($asai, src, logstr) {
         logBuffers.set(bufferKey, logBuffer);
       }
       logBuffer.add(logstr);
-      resolve5();
+      resolve6();
     } catch (err) {
       console.error(err);
       reject(err);
@@ -815,7 +815,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, checkNtpOffset, "checkNtpOffset");
 // src/infra/config-integrity.ts
 var _crypto = require('crypto'); var _crypto2 = _interopRequireDefault(_crypto);
 var _fs = require('fs'); var fs3 = _interopRequireWildcard(_fs); var fs6 = _interopRequireWildcard(_fs); var fs4 = _interopRequireWildcard(_fs); var fs5 = _interopRequireWildcard(_fs); var fs8 = _interopRequireWildcard(_fs); var fs10 = _interopRequireWildcard(_fs);
-var _path = require('path'); var nodePath2 = _interopRequireWildcard(_path); var path2 = _interopRequireWildcard(_path); var nodePath = _interopRequireWildcard(_path); var nodePath3 = _interopRequireWildcard(_path); var path5 = _interopRequireWildcard(_path); var path6 = _interopRequireWildcard(_path);
+var _path = require('path'); var nodePath2 = _interopRequireWildcard(_path); var path2 = _interopRequireWildcard(_path); var nodePath = _interopRequireWildcard(_path); var nodePath3 = _interopRequireWildcard(_path); var path4 = _interopRequireWildcard(_path); var path6 = _interopRequireWildcard(_path); var path7 = _interopRequireWildcard(_path);
 function computeConfigHash(configPath) {
   try {
     const raw = fs3.default.readFileSync(configPath);
@@ -940,13 +940,86 @@ function deUserInfoWithAsai(userinfo, $asai) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, deUserInfoWithAsai, "deUserInfoWithAsai");
+// src/ws/ws-probe.ts
+function isWsStillActive(ws2) {
+  if (!ws2) return false;
+  const state = ws2.readyState;
+  return state === _ws.WebSocket.CONNECTING || state === _ws.WebSocket.OPEN;
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, isWsStillActive, "isWsStillActive");
+function getWsProbeTimeoutMs($asai) {
+  return _optionalChain([$asai, 'optionalAccess', _109 => _109.hostconfig, 'optionalAccess', _110 => _110.tm, 'optionalAccess', _111 => _111.d]) || 3e3;
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, getWsProbeTimeoutMs, "getWsProbeTimeoutMs");
+function probeWsAlive($asai, wsclient, timeoutMs) {
+  const waitMs = _nullishCoalesce(timeoutMs, () => ( getWsProbeTimeoutMs($asai)));
+  return new Promise((resolve6) => {
+    if (!wsclient || !isWsStillActive(wsclient)) {
+      resolve6(false);
+      return;
+    }
+    let settled = false;
+    const finish = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (alive) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        _optionalChain([wsclient, 'access', _112 => _112.off, 'optionalCall', _113 => _113("message", onMessage)]);
+      } catch (e16) {
+      }
+      resolve6(alive);
+    }, "finish");
+    const onMessage = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, () => finish(true), "onMessage");
+    const timer = setTimeout(() => finish(false), waitMs);
+    try {
+      _optionalChain([wsclient, 'access', _114 => _114.once, 'optionalCall', _115 => _115("message", onMessage)]);
+      wsclient.send(JSON.stringify({ ty: "publish/web", db: "pong" }));
+    } catch (e17) {
+      finish(false);
+    }
+  });
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, probeWsAlive, "probeWsAlive");
+function terminateWs(wsclient) {
+  if (!wsclient) return;
+  try {
+    _optionalChain([wsclient, 'access', _116 => _116.terminate, 'optionalCall', _117 => _117()]);
+  } catch (e18) {
+  }
+  try {
+    _optionalChain([wsclient, 'access', _118 => _118.close, 'optionalCall', _119 => _119()]);
+  } catch (e19) {
+  }
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, terminateWs, "terminateWs");
+async function clearStaleWsIfDead($asai, hostdir, us, existingWs) {
+  if (!us || us === "asai") return true;
+  const map = _optionalChain([$asai, 'access', _120 => _120.connectionsws, 'optionalAccess', _121 => _121[hostdir]]);
+  if (!existingWs) {
+    if (_optionalChain([map, 'optionalAccess', _122 => _122[us]])) delete map[us];
+    return true;
+  }
+  if (!isWsStillActive(existingWs)) {
+    terminateWs(existingWs);
+    if (_optionalChain([map, 'optionalAccess', _123 => _123[us]]) === existingWs) delete map[us];
+    return true;
+  }
+  const alive = await probeWsAlive($asai, existingWs);
+  if (alive) return false;
+  terminateWs(existingWs);
+  if (_optionalChain([map, 'optionalAccess', _124 => _124[us]]) === existingWs) delete map[us];
+  return true;
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, clearStaleWsIfDead, "clearStaleWsIfDead");
 // src/ws/auth.ts
 function getWsUserinfo(req, $asai) {
   try {
-    const raw = _optionalChain([req, 'access', _109 => _109.headers, 'optionalAccess', _110 => _110["sec-websocket-protocol"]]);
+    const raw = _optionalChain([req, 'access', _125 => _125.headers, 'optionalAccess', _126 => _126["sec-websocket-protocol"]]);
     if (!raw) return null;
     return deUserInfoWithAsai(raw.split("##"), $asai);
-  } catch (e16) {
+  } catch (e20) {
     return null;
   }
 }
@@ -960,7 +1033,7 @@ function listOnlineWsUsers($asai, hostdir) {
       if (!us || us === "asai") continue;
       if (isWsStillActive(ws2)) {
         users.push(us);
-      } else if (_optionalChain([map, 'access', _111 => _111[dir], 'optionalAccess', _112 => _112[us]]) === ws2) {
+      } else if (_optionalChain([map, 'access', _127 => _127[dir], 'optionalAccess', _128 => _128[us]]) === ws2) {
         delete map[dir][us];
       }
     }
@@ -973,10 +1046,10 @@ function isUserOnlineOnWs($asai, us, hostdir) {
   const map = $asai.connectionsws || {};
   const dirs = hostdir ? [hostdir] : Object.keys(map);
   for (const dir of dirs) {
-    const ws2 = _optionalChain([map, 'access', _113 => _113[dir], 'optionalAccess', _114 => _114[us]]);
+    const ws2 = _optionalChain([map, 'access', _129 => _129[dir], 'optionalAccess', _130 => _130[us]]);
     if (!ws2) continue;
     if (isWsStillActive(ws2)) return true;
-    if (_optionalChain([map, 'access', _115 => _115[dir], 'optionalAccess', _116 => _116[us]]) === ws2) delete map[dir][us];
+    if (_optionalChain([map, 'access', _131 => _131[dir], 'optionalAccess', _132 => _132[us]]) === ws2) delete map[dir][us];
   }
   return false;
 }
@@ -986,13 +1059,13 @@ function kickUserWs($asai, us, hostdir) {
   const map = $asai.connectionsws || {};
   const dirs = hostdir ? [hostdir] : Object.keys(map);
   for (const dir of dirs) {
-    const ws2 = _optionalChain([map, 'access', _117 => _117[dir], 'optionalAccess', _118 => _118[us]]);
+    const ws2 = _optionalChain([map, 'access', _133 => _133[dir], 'optionalAccess', _134 => _134[us]]);
     if (!ws2) continue;
     try {
       ws2.close();
-    } catch (e17) {
+    } catch (e21) {
     }
-    if (_optionalChain([map, 'access', _119 => _119[dir], 'optionalAccess', _120 => _120[us]]) === ws2) delete map[dir][us];
+    if (_optionalChain([map, 'access', _135 => _135[dir], 'optionalAccess', _136 => _136[us]]) === ws2) delete map[dir][us];
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, kickUserWs, "kickUserWs");
@@ -1002,42 +1075,36 @@ async function removeSessionOnWsClose($asai, us, token) {
     const sessions = await store.getSessions();
     const match = sessions.find((s) => s.us === us && s.pub === token);
     if (match) await store.removeSession(match.id);
-  } catch (e18) {
+  } catch (e22) {
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, removeSessionOnWsClose, "removeSessionOnWsClose");
-function isWsStillActive(ws2) {
-  if (!ws2) return false;
-  const state = ws2.readyState;
-  return state === _ws.WebSocket.CONNECTING || state === _ws.WebSocket.OPEN;
-}
-_chunkSMVZ3ZDJcjs.__name.call(void 0, isWsStillActive, "isWsStillActive");
 function rejectIncomingWs(ws2, db) {
   const payload = JSON.stringify({ ty: "publish/web", db: { exit: 1, type: "err", ...db } });
   try {
     ws2.send(payload, () => {
       try {
         ws2.close();
-      } catch (e19) {
+      } catch (e23) {
       }
     });
-  } catch (e20) {
+  } catch (e24) {
     try {
       ws2.close();
-    } catch (e21) {
+    } catch (e25) {
     }
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, rejectIncomingWs, "rejectIncomingWs");
-function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
+async function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
   const [us, , tk] = ws2.Userinfo || [];
   if (!us) {
     ws2.close();
     return false;
   }
-  if (us !== "asai" && _optionalChain([$asai, 'access', _121 => _121.connectionsws, 'access', _122 => _122[hostdir], 'optionalAccess', _123 => _123[us]])) {
+  if (us !== "asai" && _optionalChain([$asai, 'access', _137 => _137.connectionsws, 'access', _138 => _138[hostdir], 'optionalAccess', _139 => _139[us]])) {
     const existingWs = $asai.connectionsws[hostdir][us];
-    if (_optionalChain([existingWs, 'optionalAccess', _124 => _124.Userinfo, 'optionalAccess', _125 => _125[2]]) === tk) {
+    if (_optionalChain([existingWs, 'optionalAccess', _140 => _140.Userinfo, 'optionalAccess', _141 => _141[2]]) === tk) {
       if (isWsStillActive(existingWs)) {
         rejectIncomingWs(ws2, {
           lang: "pageworking",
@@ -1048,22 +1115,26 @@ function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
       }
       try {
         existingWs.close();
-      } catch (e22) {
+      } catch (e26) {
       }
       delete $asai.connectionsws[hostdir][us];
       return true;
     }
-    rejectIncomingWs(ws2, {
-      lang: "logged",
-      langpm: `${us}`,
-      con: `${us} logged in!`
-    });
-    return false;
+    const cleared = await clearStaleWsIfDead($asai, hostdir, us, existingWs);
+    if (!cleared) {
+      rejectIncomingWs(ws2, {
+        lang: "logged",
+        langpm: `${us}`,
+        con: `${us} logged in!`
+      });
+      return false;
+    }
+    return true;
   }
   if (us !== "asai") {
     const connections = $asai.connectionsws[hostdir] || {};
     const sameTkWs = Object.values(connections).find(
-      (item) => _optionalChain([item, 'access', _126 => _126.Userinfo, 'optionalAccess', _127 => _127[2]]) === tk && _optionalChain([item, 'access', _128 => _128.Userinfo, 'optionalAccess', _129 => _129[0]]) !== us
+      (item) => _optionalChain([item, 'access', _142 => _142.Userinfo, 'optionalAccess', _143 => _143[2]]) === tk && _optionalChain([item, 'access', _144 => _144.Userinfo, 'optionalAccess', _145 => _145[0]]) !== us
     );
     const maxOnline = hostcfg.maxonline || 100;
     if (sameTkWs) {
@@ -1097,15 +1168,15 @@ function loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage)
   }
   ws2.on("message", (msg) => {
     if (logWsMessage) $asai.$log("WS", "message", msg.toString());
-    _optionalChain([wsWorkHandler, 'optionalCall', _130 => _130(msg, ws2, hostdir, req)]);
+    _optionalChain([wsWorkHandler, 'optionalCall', _146 => _146(msg, ws2, hostdir, req)]);
   });
   ws2.on("close", () => {
-    const token = _optionalChain([ws2, 'access', _131 => _131.Userinfo, 'optionalAccess', _132 => _132[2]]);
+    const token = _optionalChain([ws2, 'access', _147 => _147.Userinfo, 'optionalAccess', _148 => _148[2]]);
     if (hostcfg.ckws && ws2.tasksws) {
       Object.values(ws2.tasksws).forEach((el) => el && clearInterval(el));
       ws2.tasksws = void 0;
     }
-    if (us && _optionalChain([$asai, 'access', _133 => _133.connectionsws, 'access', _134 => _134[hostdir], 'optionalAccess', _135 => _135[us]]) === ws2) delete $asai.connectionsws[hostdir][us];
+    if (us && _optionalChain([$asai, 'access', _149 => _149.connectionsws, 'access', _150 => _150[hostdir], 'optionalAccess', _151 => _151[us]]) === ws2) delete $asai.connectionsws[hostdir][us];
     if (us && token && !isUserOnlineOnWs($asai, us, hostdir)) {
       void removeSessionOnWsClose($asai, us, String(token));
     }
@@ -1129,7 +1200,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, clearWsServerTasks, "clearWsServerTasks");
 function resWsMsg(msg, $asai) {
   if (msg === "ping" || msg === "pong") return msg;
   if (typeof msg !== "object" || msg === null) return msg;
-  if ((_optionalChain([msg, 'optionalAccess', _136 => _136.aes]) || _optionalChain([$asai, 'access', _137 => _137.$lib, 'access', _138 => _138.aesfns, 'optionalAccess', _139 => _139.allaes])) && _optionalChain([msg, 'optionalAccess', _140 => _140.db]) && _optionalChain([$asai, 'access', _141 => _141.$lib, 'optionalAccess', _142 => _142.aesfns, 'optionalAccess', _143 => _143.resAES])) {
+  if ((_optionalChain([msg, 'optionalAccess', _152 => _152.aes]) || _optionalChain([$asai, 'access', _153 => _153.$lib, 'access', _154 => _154.aesfns, 'optionalAccess', _155 => _155.allaes])) && _optionalChain([msg, 'optionalAccess', _156 => _156.db]) && _optionalChain([$asai, 'access', _157 => _157.$lib, 'optionalAccess', _158 => _158.aesfns, 'optionalAccess', _159 => _159.resAES])) {
     msg.db = $asai.$lib.aesfns.resAES(msg.db);
   }
   return JSON.stringify(msg);
@@ -1151,7 +1222,7 @@ function attachWssHelpers(wss, $asai) {
   wss.broadws = (msg) => {
     const data = resWsMsg(msg, $asai);
     wss.clients.forEach((client) => {
-      if (_optionalChain([client, 'optionalAccess', _144 => _144.readyState]) === _ws.WebSocket.OPEN) client.send(data);
+      if (_optionalChain([client, 'optionalAccess', _160 => _160.readyState]) === _ws.WebSocket.OPEN) client.send(data);
     });
   };
 }
@@ -1164,7 +1235,7 @@ var apiPerIp = /* @__PURE__ */ new Map();
 var apiRatePerIp = /* @__PURE__ */ new Map();
 var wsPerIp = /* @__PURE__ */ new Map();
 function getQuota($asai) {
-  return _optionalChain([$asai, 'optionalAccess', _145 => _145.hostconfig, 'optionalAccess', _146 => _146.security, 'optionalAccess', _147 => _147.quota]) || {};
+  return _optionalChain([$asai, 'optionalAccess', _161 => _161.hostconfig, 'optionalAccess', _162 => _162.security, 'optionalAccess', _163 => _163.quota]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getQuota, "getQuota");
 function isEnabled($asai) {
@@ -1254,7 +1325,7 @@ function getMaxWebConnections($asai, hostcfg) {
   const q = getQuota($asai);
   const fromQuota = Number(q.maxWebConnections);
   if (fromQuota > 0) return fromQuota;
-  return Number(_optionalChain([hostcfg, 'optionalAccess', _148 => _148.maxws])) > 0 ? Number(hostcfg.maxws) : 100;
+  return Number(_optionalChain([hostcfg, 'optionalAccess', _164 => _164.maxws])) > 0 ? Number(hostcfg.maxws) : 100;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getMaxWebConnections, "getMaxWebConnections");
 function countActiveWsConnections(wss, incoming, $asai, hostdir, hostcfg, userinfo) {
@@ -1264,12 +1335,12 @@ function countActiveWsConnections(wss, incoming, $asai, hostdir, hostcfg, userin
     if (client === incoming) continue;
     if (client.readyState === _ws.WebSocket.CLOSED || client.readyState === _ws.WebSocket.CLOSING) continue;
     const cInfo = client.Userinfo;
-    const cUs = _optionalChain([cInfo, 'optionalAccess', _149 => _149[0]]);
-    const cTk = _optionalChain([cInfo, 'optionalAccess', _150 => _150[2]]);
+    const cUs = _optionalChain([cInfo, 'optionalAccess', _165 => _165[0]]);
+    const cTk = _optionalChain([cInfo, 'optionalAccess', _166 => _166[2]]);
     if (us && tk && cUs === us && cTk === tk) continue;
-    if (_optionalChain([hostcfg, 'optionalAccess', _151 => _151.ckws]) && us && tk) {
-      const existing = _optionalChain([$asai, 'optionalAccess', _152 => _152.connectionsws, 'optionalAccess', _153 => _153[hostdir], 'optionalAccess', _154 => _154[us]]);
-      if (existing === client && _optionalChain([existing, 'optionalAccess', _155 => _155.Userinfo, 'optionalAccess', _156 => _156[2]]) === tk) continue;
+    if (_optionalChain([hostcfg, 'optionalAccess', _167 => _167.ckws]) && us && tk) {
+      const existing = _optionalChain([$asai, 'optionalAccess', _168 => _168.connectionsws, 'optionalAccess', _169 => _169[hostdir], 'optionalAccess', _170 => _170[us]]);
+      if (existing === client && _optionalChain([existing, 'optionalAccess', _171 => _171.Userinfo, 'optionalAccess', _172 => _172[2]]) === tk) continue;
     }
     count += 1;
   }
@@ -1281,7 +1352,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, countActiveWsConnections, "countActiveWsCo
 function createWSHost($asai, hostdir) {
   const hostcfg = getHostCFG(hostdir, $asai);
   const wsWorkHandler = getWorkHandler("wsWork");
-  const logWsMessage = !!_optionalChain([$asai, 'access', _157 => _157.hostconfig, 'access', _158 => _158.logger, 'optionalAccess', _159 => _159.lv, 'optionalAccess', _160 => _160.view]);
+  const logWsMessage = !!_optionalChain([$asai, 'access', _173 => _173.hostconfig, 'access', _174 => _174.logger, 'optionalAccess', _175 => _175.lv, 'optionalAccess', _176 => _176.view]);
   try {
     if ($asai.serversws[hostdir]) return;
     if (hostcfg.ckws && !$asai.connectionsws[hostdir]) {
@@ -1293,14 +1364,14 @@ function createWSHost($asai, hostdir) {
     wss.on("error", (err) => {
       clearWsServerTasks($asai, hostdir);
       $asai.$log("WS", "WS    Server error!", err);
-      _optionalChain([wss, 'access', _161 => _161.close, 'optionalCall', _162 => _162(() => {
+      _optionalChain([wss, 'access', _177 => _177.close, 'optionalCall', _178 => _178(() => {
         $asai.$log("WS", "WS    Server closed");
         delete $asai.serversws[hostdir];
       })]);
     });
     wss.on("close", (code, reason) => {
       try {
-        $asai.$log("WS", `WebSocket closed, server ${hostdir}, code: ${code}, reason: ${_optionalChain([reason, 'optionalAccess', _163 => _163.toString, 'call', _164 => _164()])}`);
+        $asai.$log("WS", `WebSocket closed, server ${hostdir}, code: ${code}, reason: ${_optionalChain([reason, 'optionalAccess', _179 => _179.toString, 'call', _180 => _180()])}`);
         clearWsServerTasks($asai, hostdir);
       } catch (err) {
         $asai.$log("WS", "WS close handler error:", err);
@@ -1331,12 +1402,14 @@ function createWSHost($asai, hostdir) {
         ws2.send(wsmsg, () => ws2.close(1013, "Server busy"));
         return;
       }
-      const isOpen = !hostcfg.ckws || isOkWs($asai, hostdir, ws2, req, hostcfg);
-      if (isOpen) {
-        loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage);
-      } else {
-        ws2.close();
-      }
+      void (async () => {
+        const isOpen = !hostcfg.ckws || await isOkWs($asai, hostdir, ws2, req, hostcfg);
+        if (isOpen) {
+          loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage);
+        } else {
+          ws2.close();
+        }
+      })();
     });
     $asai.serversws[hostdir] = wss;
   } catch (err) {
@@ -1388,7 +1461,7 @@ var StaticPathCache = class {
       const stat = fs3.statSync(entry.filePath);
       if (!stat.isFile() || stat.mtimeMs !== entry.mtimeMs) return null;
       return stat;
-    } catch (e23) {
+    } catch (e27) {
       return null;
     }
   }
@@ -1407,8 +1480,8 @@ function applySecurityHeaders(res, isHttps = false, hostconfig) {
   if (isHttps) {
     res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
   }
-  const sec = _optionalChain([hostconfig, 'optionalAccess', _165 => _165.security]);
-  if (_optionalChain([sec, 'optionalAccess', _166 => _166.csp])) {
+  const sec = _optionalChain([hostconfig, 'optionalAccess', _181 => _181.security]);
+  if (_optionalChain([sec, 'optionalAccess', _182 => _182.csp])) {
     const csp = typeof sec.cspPolicy === "string" && sec.cspPolicy.length > 0 ? sec.cspPolicy : DEFAULT_CSP;
     res.setHeader("Content-Security-Policy", csp);
   }
@@ -1416,9 +1489,9 @@ function applySecurityHeaders(res, isHttps = false, hostconfig) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, applySecurityHeaders, "applySecurityHeaders");
 function getHttpUserinfo(req, $asai) {
   try {
-    const userinfo = _optionalChain([req, 'access', _167 => _167.headers, 'optionalAccess', _168 => _168["userinfo"], 'optionalAccess', _169 => _169.split, 'call', _170 => _170("##")]);
+    const userinfo = _optionalChain([req, 'access', _183 => _183.headers, 'optionalAccess', _184 => _184["userinfo"], 'optionalAccess', _185 => _185.split, 'call', _186 => _186("##")]);
     return deUserInfoWithAsai(userinfo, $asai);
-  } catch (e24) {
+  } catch (e28) {
     return "";
   }
 }
@@ -1449,7 +1522,7 @@ function normalizeRequestPath(url) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeRequestPath, "normalizeRequestPath");
 function createSkipChecker($asai) {
-  const skip = _optionalChain([$asai, 'access', _171 => _171.hostconfig, 'optionalAccess', _172 => _172.logger, 'optionalAccess', _173 => _173.skip]);
+  const skip = _optionalChain([$asai, 'access', _187 => _187.hostconfig, 'optionalAccess', _188 => _188.logger, 'optionalAccess', _189 => _189.skip]);
   if (!Array.isArray(skip) || skip.length === 0) return () => false;
   const exact = /* @__PURE__ */ new Set();
   const prefixes = [];
@@ -1460,11 +1533,11 @@ function createSkipChecker($asai) {
   }
   if (exact.size === 0 && prefixes.length === 0) return () => false;
   return (url) => {
-    const path7 = normalizeRequestPath(url);
-    if (!path7) return false;
-    if (exact.has(path7)) return true;
+    const path8 = normalizeRequestPath(url);
+    if (!path8) return false;
+    if (exact.has(path8)) return true;
     for (let i = 0; i < prefixes.length; i++) {
-      if (path7.startsWith(prefixes[i])) return true;
+      if (path8.startsWith(prefixes[i])) return true;
     }
     return false;
   };
@@ -1485,7 +1558,7 @@ function attachAccessLog($asai, req, res, logType) {
     try {
       const entry = _chunkOCEBEEP5cjs.buildAccessEntry.call(void 0, req, res, logType);
       void $asai.appendAccessLog(_chunkOCEBEEP5cjs.formatCLF.call(void 0, entry), _chunkOCEBEEP5cjs.formatW3CAccessRecord.call(void 0, entry));
-    } catch (e25) {
+    } catch (e29) {
     }
   }, "onFinish");
   if (res.writableEnded || res.finished) onFinish();
@@ -1544,7 +1617,7 @@ function findExistingFileUnderRoots(requestedPath, allowedRoots) {
       if (stat.isFile()) {
         return { filePath: absTarget, stat };
       }
-    } catch (e26) {
+    } catch (e30) {
     }
   }
   return null;
@@ -1557,13 +1630,13 @@ function getHostAllowedRoots(hostconfig) {
     try {
       const abs = path2.resolve("./" + dir.replace(/\\/g, "/"));
       if (fs4.existsSync(abs)) roots.add(abs);
-    } catch (e27) {
+    } catch (e31) {
     }
   }, "push");
-  for (const dir of _optionalChain([hostconfig, 'optionalAccess', _174 => _174.hostdirs]) || []) push(dir);
+  for (const dir of _optionalChain([hostconfig, 'optionalAccess', _190 => _190.hostdirs]) || []) push(dir);
   push("webdata");
   push("websys");
-  if (_optionalChain([hostconfig, 'optionalAccess', _175 => _175.weburls, 'optionalAccess', _176 => _176.webdir])) push(hostconfig.weburls.webdir);
+  if (_optionalChain([hostconfig, 'optionalAccess', _191 => _191.weburls, 'optionalAccess', _192 => _192.webdir])) push(hostconfig.weburls.webdir);
   const result = [];
   roots.forEach((r) => result.push(r));
   return result;
@@ -1594,7 +1667,7 @@ function getStaticBaseDirs($asai) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getStaticBaseDirs, "getStaticBaseDirs");
 function shouldForceHostdirs($asai) {
   if ($asai.pkgSnapshotDir) return true;
-  return _optionalChain([$asai, 'access', _177 => _177.hostconfig, 'optionalAccess', _178 => _178.pkg, 'optionalAccess', _179 => _179.type]) === 1;
+  return _optionalChain([$asai, 'access', _193 => _193.hostconfig, 'optionalAccess', _194 => _194.pkg, 'optionalAccess', _195 => _195.type]) === 1;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, shouldForceHostdirs, "shouldForceHostdirs");
 function buildStaticSearchDirs(hostcfg, $asai) {
@@ -1615,12 +1688,12 @@ function buildStaticSearchDirs(hostcfg, $asai) {
           ordered.push(dir);
           return;
         }
-      } catch (e28) {
+      } catch (e32) {
       }
     }
   }, "pushDir");
   for (const dir of hostcfg.hostdirs || []) pushDir(dir);
-  if (_optionalChain([hostcfg, 'access', _180 => _180.weburls, 'optionalAccess', _181 => _181.webdir])) pushDir(hostcfg.weburls.webdir);
+  if (_optionalChain([hostcfg, 'access', _196 => _196.weburls, 'optionalAccess', _197 => _197.webdir])) pushDir(hostcfg.weburls.webdir);
   return ordered;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, buildStaticSearchDirs, "buildStaticSearchDirs");
@@ -1648,7 +1721,7 @@ function parseUrlPath(requrl) {
     if (!requrl) return "/";
     const safeUrl = requrl.startsWith("http") ? requrl : encodeURI(requrl);
     return new URL(safeUrl, "http://localhost").pathname;
-  } catch (e29) {
+  } catch (e33) {
     return requrl;
   }
 }
@@ -1747,8 +1820,8 @@ function serveStaticFile(req, res, foundPath, mimeType, stat, $asai, urlPath = "
 _chunkSMVZ3ZDJcjs.__name.call(void 0, serveStaticFile, "serveStaticFile");
 function createStaticHandler(ctx) {
   const { hostcfg, hostdir, indexFile, $asai, staticPathCache } = ctx;
-  const hasRewrite = !!(_optionalChain([hostcfg, 'access', _182 => _182.weburls, 'optionalAccess', _183 => _183.rewrite]) && _optionalChain([hostcfg, 'access', _184 => _184.weburls, 'optionalAccess', _185 => _185.webdir]) && _optionalChain([hostcfg, 'access', _186 => _186.weburls, 'optionalAccess', _187 => _187.keys, 'optionalAccess', _188 => _188.length]));
-  const rewriteKeys = hasRewrite ? _optionalChain([hostcfg, 'access', _189 => _189.weburls, 'optionalAccess', _190 => _190.keys]) || [] : [];
+  const hasRewrite = !!(_optionalChain([hostcfg, 'access', _198 => _198.weburls, 'optionalAccess', _199 => _199.rewrite]) && _optionalChain([hostcfg, 'access', _200 => _200.weburls, 'optionalAccess', _201 => _201.webdir]) && _optionalChain([hostcfg, 'access', _202 => _202.weburls, 'optionalAccess', _203 => _203.keys, 'optionalAccess', _204 => _204.length]));
+  const rewriteKeys = hasRewrite ? _optionalChain([hostcfg, 'access', _205 => _205.weburls, 'optionalAccess', _206 => _206.keys]) || [] : [];
   const checkWebUrls = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (rurl) => {
     if (!hasRewrite || !rurl) return false;
     for (let i = 0; i < rewriteKeys.length; i++) {
@@ -1763,7 +1836,7 @@ function createStaticHandler(ctx) {
     const roots = rhostdirs.join("|") === primaryDirs.join("|") ? buildStaticRoots(primaryDirs, $asai) : buildStaticRoots(rhostdirs, $asai);
     const findValidFile = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (urlPath) => {
       const hit = staticPathCache.get(cacheKey);
-      if (_optionalChain([hit, 'optionalAccess', _191 => _191.is404])) return null;
+      if (_optionalChain([hit, 'optionalAccess', _207 => _207.is404])) return null;
       if (hit && !hit.is404) {
         const verified = staticPathCache.verify(hit);
         if (verified) return { filePath: hit.filePath, stat: verified };
@@ -1787,7 +1860,7 @@ function createStaticHandler(ctx) {
       showHostDirs(req, res, [hostcfg.weburls.webdir], "/" + indexFile, primaryDirs, rtm + 1);
       return;
     }
-    const mimeType = _optionalChain([hostcfg, 'access', _192 => _192.mimetypes, 'optionalAccess', _193 => _193[nodePath2.extname(found.filePath)]]) || "application/octet-stream";
+    const mimeType = _optionalChain([hostcfg, 'access', _208 => _208.mimetypes, 'optionalAccess', _209 => _209[nodePath2.extname(found.filePath)]]) || "application/octet-stream";
     serveStaticFile(req, res, found.filePath, mimeType, found.stat, $asai, processedUrl);
   }, "showHostDirs");
   return (req, res, url) => {
@@ -1812,7 +1885,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, createStaticHandler, "createStaticHandler"
 function setupHttpConnectionMonitor($asai, hostdir, server, hostcfg) {
   const maxHttp = hostcfg.maxhttp || 100;
   const monitorInterval = setInterval(() => {
-    const connCount = _optionalChain([$asai, 'access', _194 => _194.connectionshttp, 'access', _195 => _195[hostdir], 'optionalAccess', _196 => _196.size]) || 0;
+    const connCount = _optionalChain([$asai, 'access', _210 => _210.connectionshttp, 'access', _211 => _211[hostdir], 'optionalAccess', _212 => _212.size]) || 0;
     if (connCount > maxHttp * 0.8) {
       $asai.$log("HTTP", `HTTP Connection HIGH (${connCount}/${maxHttp})`);
     }
@@ -1883,10 +1956,10 @@ function findListeningPids(port) {
         stdio: ["pipe", "pipe", "ignore"]
       });
       return out.split(/\r?\n/).map((s) => parseInt(s.trim(), 10)).filter((n) => n > 0);
-    } catch (e30) {
+    } catch (e34) {
       return [];
     }
-  } catch (e31) {
+  } catch (e35) {
     return [];
   }
 }
@@ -1897,10 +1970,10 @@ function formatOccupants(port, exclude) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, formatOccupants, "formatOccupants");
 function releasePort(port, opts) {
-  const exclude = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _197 => _197.excludePid]), () => ( OWN_PID));
+  const exclude = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _213 => _213.excludePid]), () => ( OWN_PID));
   const occupants = formatOccupants(port, exclude);
   if (!occupants) return true;
-  const label = _optionalChain([opts, 'optionalAccess', _198 => _198.label]) ? `[${opts.label}] ` : "";
+  const label = _optionalChain([opts, 'optionalAccess', _214 => _214.label]) ? `[${opts.label}] ` : "";
   console.warn(
     `[AsaiHostNodejs] ${label}\u7AEF\u53E3 ${port} \u88AB\u5360\u7528\uFF08PID: ${occupants}\uFF09\uFF0C\u8BF7\u624B\u52A8\u7ED3\u675F\u5360\u7528\u8FDB\u7A0B\u540E\u91CD\u8BD5`
   );
@@ -1909,23 +1982,23 @@ function releasePort(port, opts) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, releasePort, "releasePort");
 function collectStartupPorts($asai) {
   const ports = /* @__PURE__ */ new Set();
-  const hosts = _optionalChain([$asai, 'access', _199 => _199.hostconfig, 'optionalAccess', _200 => _200.hosts]);
+  const hosts = _optionalChain([$asai, 'access', _215 => _215.hostconfig, 'optionalAccess', _216 => _216.hosts]);
   if (hosts) {
     for (const el of Object.keys(hosts)) {
       if (el === "default") continue;
       if (el !== "asai" && !validateHostdir(el)) continue;
       const cfg = getHostCFG(el, $asai);
-      if (_optionalChain([cfg, 'optionalAccess', _201 => _201.close])) continue;
-      if (_optionalChain([cfg, 'optionalAccess', _202 => _202.port])) ports.add(Number(cfg.port));
+      if (_optionalChain([cfg, 'optionalAccess', _217 => _217.close])) continue;
+      if (_optionalChain([cfg, 'optionalAccess', _218 => _218.port])) ports.add(Number(cfg.port));
     }
   }
-  const proxyhosts = _optionalChain([$asai, 'access', _203 => _203.hostconfig, 'optionalAccess', _204 => _204.proxyhosts]);
+  const proxyhosts = _optionalChain([$asai, 'access', _219 => _219.hostconfig, 'optionalAccess', _220 => _220.proxyhosts]);
   if (proxyhosts) {
     for (const el of Object.keys(proxyhosts)) {
       if (el === "default") continue;
       if (!validateHostdir(el)) continue;
       const cfg = getProxyHostCFG(el, $asai);
-      if (_optionalChain([cfg, 'optionalAccess', _205 => _205.proxyport])) ports.add(Number(cfg.proxyport));
+      if (_optionalChain([cfg, 'optionalAccess', _221 => _221.proxyport])) ports.add(Number(cfg.proxyport));
     }
   }
   return [...ports];
@@ -1950,7 +2023,7 @@ function scheduleHttpRetry($asai, hostdir) {
       clearTimeout($asai.hostconfig.guardtm);
       $asai.hostconfig.guardtm = null;
     }
-  }, _optionalChain([$asai, 'access', _206 => _206.hostconfig, 'access', _207 => _207.tm, 'optionalAccess', _208 => _208.d]) || 2e3);
+  }, _optionalChain([$asai, 'access', _222 => _222.hostconfig, 'access', _223 => _223.tm, 'optionalAccess', _224 => _224.d]) || 2e3);
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, scheduleHttpRetry, "scheduleHttpRetry");
 function clearFailedHttpHost($asai, hostdir, ws2) {
@@ -1963,7 +2036,7 @@ function getHTTPServer(httptype = "", cfg, $asai) {
     if (httptype.startsWith("https")) {
       return {
         AsCreateServer: /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (callback) => {
-          return https.createServer(_optionalChain([cfg, 'optionalAccess', _209 => _209.httpscert]) || $asai.hostconfig.httpscert, callback);
+          return https.createServer(_optionalChain([cfg, 'optionalAccess', _225 => _225.httpscert]) || $asai.hostconfig.httpscert, callback);
         }, "AsCreateServer"),
         Agent: https.Agent,
         request: https.request
@@ -2015,13 +2088,13 @@ function startHTTPServer($asai, hostdir) {
             return;
           }
           applySecurityHeaders(res, isHttps, $asai.hostconfig);
-          if (_optionalChain([req, 'access', _210 => _210.url, 'optionalAccess', _211 => _211.startsWith, 'call', _212 => _212("/sys")]) && sysWork) {
+          if (_optionalChain([req, 'access', _226 => _226.url, 'optionalAccess', _227 => _227.startsWith, 'call', _228 => _228("/sys")]) && sysWork) {
             logHttp($asai, "SYS", req.method, req.url, skipChecker, req, res);
             sysWork(req, res, hostdir);
-          } else if (_optionalChain([req, 'access', _213 => _213.url, 'optionalAccess', _214 => _214.startsWith, 'call', _215 => _215("/api")]) && apiWork) {
+          } else if (_optionalChain([req, 'access', _229 => _229.url, 'optionalAccess', _230 => _230.startsWith, 'call', _231 => _231("/api")]) && apiWork) {
             logHttp($asai, "API", req.method, req.url, skipChecker, req, res);
             apiWork(req, res, hostdir);
-          } else if (_optionalChain([req, 'access', _216 => _216.url, 'optionalAccess', _217 => _217.startsWith, 'call', _218 => _218("/jsonp")]) && jsonpWork) {
+          } else if (_optionalChain([req, 'access', _232 => _232.url, 'optionalAccess', _233 => _233.startsWith, 'call', _234 => _234("/jsonp")]) && jsonpWork) {
             logHttp($asai, "JSONP", req.method, req.url, skipChecker, req, res);
             jsonpWork(req, res, hostdir);
           } else if (handleStatic) {
@@ -2092,7 +2165,7 @@ function findSameProcessPortOwner($asai, port, excludeHostdir) {
   for (const hostdir of Object.keys($asai.servershttp || {})) {
     if (hostdir === excludeHostdir) continue;
     const cfg = getHostCFG(hostdir, $asai);
-    if (_optionalChain([cfg, 'optionalAccess', _219 => _219.port]) === port) return hostdir;
+    if (_optionalChain([cfg, 'optionalAccess', _235 => _235.port]) === port) return hostdir;
   }
   return null;
 }
@@ -2100,7 +2173,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, findSameProcessPortOwner, "findSameProcess
 function asaiGuard($asai, failedHostdir = "asai") {
   const conflictPorts = $asai.hostconfig.asaiport || [];
   const hostcfg = getHostCFG(failedHostdir, $asai);
-  const port = _optionalChain([hostcfg, 'optionalAccess', _220 => _220.port]);
+  const port = _optionalChain([hostcfg, 'optionalAccess', _236 => _236.port]);
   if (!port || !conflictPorts.includes(port)) {
     scheduleHttpRetry($asai, failedHostdir);
     return;
@@ -2132,7 +2205,7 @@ var PROXY_SKIP_HEADERS = /* @__PURE__ */ new Set([
 function startProxyServer($asai, proxyhostdir) {
   const proxycfg = getProxyHostCFG(proxyhostdir, $asai);
   if (!proxycfg.url) return;
-  if (_optionalChain([$asai, 'access', _221 => _221.serversproxy, 'optionalAccess', _222 => _222[proxyhostdir]])) return;
+  if (_optionalChain([$asai, 'access', _237 => _237.serversproxy, 'optionalAccess', _238 => _238[proxyhostdir]])) return;
   try {
     const httpServer = getHTTPServer(proxycfg.proxyhttptype, proxycfg, $asai);
     const targetHttp = getHTTPServer(proxycfg.url, proxycfg, $asai);
@@ -2214,12 +2287,12 @@ function startProxyServer($asai, proxyhostdir) {
     proxyServer.on("error", (err) => {
       if (err.code === "EADDRINUSE") {
         $asai.$log("PROXY", `\x1B[41mPort ${proxycfg.proxyport} is already start!\x1B[0m`);
-         _optionalChainDelete([$asai, 'access', _223 => _223.serversproxy, 'optionalAccess', _224 => delete _224[proxyhostdir]]);
+         _optionalChainDelete([$asai, 'access', _239 => _239.serversproxy, 'optionalAccess', _240 => delete _240[proxyhostdir]]);
         releasePort(proxycfg.proxyport, {
           excludePid: process.pid,
           label: proxyhostdir
         });
-        setTimeout(() => startProxyServer($asai, proxyhostdir), _optionalChain([$asai, 'access', _225 => _225.hostconfig, 'access', _226 => _226.tm, 'optionalAccess', _227 => _227.d]) || 2e3);
+        setTimeout(() => startProxyServer($asai, proxyhostdir), _optionalChain([$asai, 'access', _241 => _241.hostconfig, 'access', _242 => _242.tm, 'optionalAccess', _243 => _243.d]) || 2e3);
       } else {
         $asai.$log("PROXY", "Proxy server error:", err);
       }
@@ -2259,7 +2332,7 @@ function src_default($asai, opt) {
     initAsaiHostNodejs($asai, opt);
     console.log(`\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B`);
     releaseConfiguredPorts($asai);
-    if (_optionalChain([$asai, 'access', _228 => _228.hostconfig, 'optionalAccess', _229 => _229.hosts])) {
+    if (_optionalChain([$asai, 'access', _244 => _244.hostconfig, 'optionalAccess', _245 => _245.hosts])) {
       $asai.startHTTPServer = (hostdir) => startHTTPServer($asai, hostdir);
       Object.keys($asai.hostconfig.hosts).forEach((el) => {
         if (validateHostdir(el)) {
@@ -2270,7 +2343,7 @@ function src_default($asai, opt) {
         startHTTPServer($asai, "asai");
       }
     }
-    if (_optionalChain([$asai, 'access', _230 => _230.hostconfig, 'optionalAccess', _231 => _231.proxyhosts])) {
+    if (_optionalChain([$asai, 'access', _246 => _246.hostconfig, 'optionalAccess', _247 => _247.proxyhosts])) {
       Object.keys($asai.hostconfig.proxyhosts).forEach((el) => {
         if (validateHostdir(el)) {
           startProxyServer($asai, el);
@@ -2293,22 +2366,22 @@ _chunkSMVZ3ZDJcjs.__export.call(void 0, utils_exports, {
 // src/utils/ws-mock.ts
 function wsMock($asai) {
   function getKeyByData(reqdata, hostdir) {
-    return "_wstask_" + (hostdir || "") + "_" + (_optionalChain([reqdata, 'optionalAccess', _232 => _232.id]) || _optionalChain([reqdata, 'optionalAccess', _233 => _233.ty]) + "." + _optionalChain([reqdata, 'optionalAccess', _234 => _234.ac]));
+    return "_wstask_" + (hostdir || "") + "_" + (_optionalChain([reqdata, 'optionalAccess', _248 => _248.id]) || _optionalChain([reqdata, 'optionalAccess', _249 => _249.ty]) + "." + _optionalChain([reqdata, 'optionalAccess', _250 => _250.ac]));
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getKeyByData, "getKeyByData");
   function getMockDb(workopt) {
     const { reqdata, mockdata } = workopt;
-    const wsfn = _optionalChain([mockdata, 'optionalAccess', _235 => _235.fn]) ? _optionalChain([$asai, 'access', _236 => _236.asaimock, 'access', _237 => _237.fn, 'optionalAccess', _238 => _238[mockdata.fn]]) : null;
+    const wsfn = _optionalChain([mockdata, 'optionalAccess', _251 => _251.fn]) ? _optionalChain([$asai, 'access', _252 => _252.asaimock, 'access', _253 => _253.fn, 'optionalAccess', _254 => _254[mockdata.fn]]) : null;
     if (wsfn) return wsfn({ workopt, $asai, mockName: mockdata.fn });
     return { ...reqdata, ...mockdata || {} };
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getMockDb, "getMockDb");
   function wsWorkApi(workopt) {
-    _optionalChain([$asai, 'access', _239 => _239.serversws, 'access', _240 => _240[workopt.hostdir], 'optionalAccess', _241 => _241.sendws, 'optionalCall', _242 => _242(workopt.reqdataisobj ? getMockDb(workopt) : workopt.reqdata, 0, workopt.ws)]);
+    _optionalChain([$asai, 'access', _255 => _255.serversws, 'access', _256 => _256[workopt.hostdir], 'optionalAccess', _257 => _257.sendws, 'optionalCall', _258 => _258(workopt.reqdataisobj ? getMockDb(workopt) : workopt.reqdata, 0, workopt.ws)]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, wsWorkApi, "wsWorkApi");
   function wsWorkListen(workopt, reqkey) {
-    if (_optionalChain([workopt, 'access', _243 => _243.reqdata, 'optionalAccess', _244 => _244.off])) {
+    if (_optionalChain([workopt, 'access', _259 => _259.reqdata, 'optionalAccess', _260 => _260.off])) {
       if ($asai.tasksws[workopt.hostdir][reqkey]) {
         clearInterval($asai.tasksws[workopt.hostdir][reqkey]);
         $asai.tasksws[workopt.hostdir][reqkey] = null;
@@ -2323,9 +2396,9 @@ function wsMock($asai) {
       if (!$asai.tasksws[workopt.hostdir][reqkey]) {
         clearInterval($asai.tasksws[workopt.hostdir][reqkey]);
       }
-    }, _optionalChain([newDataMock, 'optionalAccess', _245 => _245.tc]) || 2e3);
-    _optionalChain([workopt, 'access', _246 => _246.ws, 'optionalAccess', _247 => _247.once, 'optionalCall', _248 => _248("close", () => {
-      if (_optionalChain([$asai, 'access', _249 => _249.tasksws, 'access', _250 => _250[workopt.hostdir], 'optionalAccess', _251 => _251[reqkey]])) {
+    }, _optionalChain([newDataMock, 'optionalAccess', _261 => _261.tc]) || 2e3);
+    _optionalChain([workopt, 'access', _262 => _262.ws, 'optionalAccess', _263 => _263.once, 'optionalCall', _264 => _264("close", () => {
+      if (_optionalChain([$asai, 'access', _265 => _265.tasksws, 'access', _266 => _266[workopt.hostdir], 'optionalAccess', _267 => _267[reqkey]])) {
         clearInterval($asai.tasksws[workopt.hostdir][reqkey]);
         delete $asai.tasksws[workopt.hostdir][reqkey];
       }
@@ -2333,8 +2406,8 @@ function wsMock($asai) {
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, wsWorkListen, "wsWorkListen");
   function wsWorkMock(workopt) {
-    workopt.mockdata = workopt.reqdataisobj && _optionalChain([$asai, 'access', _252 => _252.asaimock, 'optionalAccess', _253 => _253.db, 'optionalAccess', _254 => _254[workopt.hostdir], 'optionalAccess', _255 => _255[_optionalChain([workopt, 'access', _256 => _256.reqdata, 'optionalAccess', _257 => _257.ty])]]) || {};
-    if (_optionalChain([workopt, 'access', _258 => _258.mockdata, 'optionalAccess', _259 => _259.wc])) {
+    workopt.mockdata = workopt.reqdataisobj && _optionalChain([$asai, 'access', _268 => _268.asaimock, 'optionalAccess', _269 => _269.db, 'optionalAccess', _270 => _270[workopt.hostdir], 'optionalAccess', _271 => _271[_optionalChain([workopt, 'access', _272 => _272.reqdata, 'optionalAccess', _273 => _273.ty])]]) || {};
+    if (_optionalChain([workopt, 'access', _274 => _274.mockdata, 'optionalAccess', _275 => _275.wc])) {
       wsWorkListen(workopt, getKeyByData(workopt.reqdata, workopt.hostdir));
     } else {
       wsWorkApi(workopt);
@@ -2347,7 +2420,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, wsMock, "wsMock");
 // src/infra/user-auth.ts
 async function attachServerUserLevel(req, $asai) {
-  const userinfo = _optionalChain([req, 'optionalAccess', _260 => _260.Userinfo]);
+  const userinfo = _optionalChain([req, 'optionalAccess', _276 => _276.Userinfo]);
   if (!Array.isArray(userinfo) || !userinfo[0]) return;
   const us = String(userinfo[0]);
   try {
@@ -2359,34 +2432,34 @@ async function attachServerUserLevel(req, $asai) {
     } else {
       req._serverUser = null;
     }
-  } catch (e32) {
+  } catch (e36) {
     req._serverUser = null;
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, attachServerUserLevel, "attachServerUserLevel");
 function getRequestUserLevel(req) {
-  if (_optionalChain([req, 'optionalAccess', _261 => _261._serverUser, 'optionalAccess', _262 => _262.lv]) != null) return Number(req._serverUser.lv);
-  const n = Number(_nullishCoalesce(_optionalChain([req, 'optionalAccess', _263 => _263.Userinfo, 'optionalAccess', _264 => _264[1]]), () => ( -1)));
+  if (_optionalChain([req, 'optionalAccess', _277 => _277._serverUser, 'optionalAccess', _278 => _278.lv]) != null) return Number(req._serverUser.lv);
+  const n = Number(_nullishCoalesce(_optionalChain([req, 'optionalAccess', _279 => _279.Userinfo, 'optionalAccess', _280 => _280[1]]), () => ( -1)));
   return Number.isFinite(n) ? n : -1;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getRequestUserLevel, "getRequestUserLevel");
 function getRequestUsername(req) {
-  if (_optionalChain([req, 'optionalAccess', _265 => _265._serverUser, 'optionalAccess', _266 => _266.us])) return String(req._serverUser.us);
-  const us = _optionalChain([req, 'optionalAccess', _267 => _267.Userinfo, 'optionalAccess', _268 => _268[0]]);
+  if (_optionalChain([req, 'optionalAccess', _281 => _281._serverUser, 'optionalAccess', _282 => _282.us])) return String(req._serverUser.us);
+  const us = _optionalChain([req, 'optionalAccess', _283 => _283.Userinfo, 'optionalAccess', _284 => _284[0]]);
   return us ? String(us) : void 0;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getRequestUsername, "getRequestUsername");
 // src/infra/access-control.ts
 function getSecurityConfig($asai) {
-  return _optionalChain([$asai, 'optionalAccess', _269 => _269.hostconfig, 'optionalAccess', _270 => _270.security]) || {};
+  return _optionalChain([$asai, 'optionalAccess', _285 => _285.hostconfig, 'optionalAccess', _286 => _286.security]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSecurityConfig, "getSecurityConfig");
-function pathMatchesPattern(path7, pattern) {
+function pathMatchesPattern(path8, pattern) {
   if (pattern.endsWith("*")) {
-    return path7.startsWith(pattern.slice(0, -1));
+    return path8.startsWith(pattern.slice(0, -1));
   }
-  return path7 === pattern;
+  return path8 === pattern;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, pathMatchesPattern, "pathMatchesPattern");
 function isAuthSkipped($asai, pathname) {
@@ -2413,13 +2486,13 @@ function validateHttpAuth(req, $asai, pathname) {
   if (!isAuthRequired($asai, pathname)) {
     return { ok: true };
   }
-  const userinfo = _optionalChain([req, 'optionalAccess', _271 => _271.Userinfo]);
+  const userinfo = _optionalChain([req, 'optionalAccess', _287 => _287.Userinfo]);
   const ip = getClientIp(req);
   if (!Array.isArray(userinfo) || userinfo.length < 3 || !userinfo[0]) {
     logSecurityEvent($asai, {
       type: "AUTH_MISSING",
       path: pathname,
-      method: _optionalChain([req, 'optionalAccess', _272 => _272.method]),
+      method: _optionalChain([req, 'optionalAccess', _288 => _288.method]),
       ip,
       detail: "Userinfo header missing or invalid"
     });
@@ -2433,7 +2506,7 @@ function validateHttpAuth(req, $asai, pathname) {
     logSecurityEvent($asai, {
       type: "ACCESS_DENIED",
       path: pathname,
-      method: _optionalChain([req, 'optionalAccess', _273 => _273.method]),
+      method: _optionalChain([req, 'optionalAccess', _289 => _289.method]),
       user: String(us),
       level: userLevel,
       ip,
@@ -2445,13 +2518,13 @@ function validateHttpAuth(req, $asai, pathname) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, validateHttpAuth, "validateHttpAuth");
 async function validateHttpAuthAsync(req, $asai, pathname) {
-  if (Array.isArray(_optionalChain([req, 'optionalAccess', _274 => _274.Userinfo])) && req.Userinfo[0]) {
+  if (Array.isArray(_optionalChain([req, 'optionalAccess', _290 => _290.Userinfo])) && req.Userinfo[0]) {
     await attachServerUserLevel(req, $asai);
     if (!req._serverUser && isAuthRequired($asai, pathname)) {
       logSecurityEvent($asai, {
         type: "ACCESS_DENIED",
         path: pathname,
-        method: _optionalChain([req, 'optionalAccess', _275 => _275.method]),
+        method: _optionalChain([req, 'optionalAccess', _291 => _291.method]),
         user: String(req.Userinfo[0]),
         ip: getClientIp(req),
         detail: "User not found or inactive"
@@ -2513,7 +2586,7 @@ function resolveApiCorsOrigin(req, hostcfg, getHeader) {
     if (referer) {
       try {
         origin = new URL(referer).origin;
-      } catch (e33) {
+      } catch (e37) {
         const parts = referer.split("/");
         if (parts.length >= 3) origin = `${parts[0]}//${parts[2]}`;
       }
@@ -2525,7 +2598,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveApiCorsOrigin, "resolveApiCorsOrigi
 function isApiCorsAllowed(origin, hostcfg, hostHeader) {
   if (!origin) return false;
   if (origin === "*") return true;
-  const corsList = _optionalChain([hostcfg, 'optionalAccess', _276 => _276.cors]);
+  const corsList = _optionalChain([hostcfg, 'optionalAccess', _292 => _292.cors]);
   if (!Array.isArray(corsList) || !corsList.length) return true;
   if (corsList.includes(origin)) return true;
   if (hostHeader && origin.includes(hostHeader)) return true;
@@ -2535,7 +2608,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, isApiCorsAllowed, "isApiCorsAllowed");
 // src/common/server/Api.ts
 function readRequestBody(req, maxBody) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const chunks = [];
     let received = 0;
     let settled = false;
@@ -2543,7 +2616,7 @@ function readRequestBody(req, maxBody) {
       if (settled) return;
       settled = true;
       if (err) reject(err);
-      else resolve5(_nullishCoalesce(data, () => ( "")));
+      else resolve6(_nullishCoalesce(data, () => ( "")));
     }, "finish");
     req.on("data", (chunk) => {
       if (settled) return;
@@ -2571,19 +2644,19 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, isPlainSourcePost, "isPlainSourcePost");
 function processPostPayload($asai, req, postdata, pm) {
   let isAes = false;
   let out = postdata;
-  if ($asai.$lib.aesfns && _optionalChain([out, 'optionalAccess', _277 => _277.startsWith, 'optionalCall', _278 => _278('{"aes":')])) {
+  if ($asai.$lib.aesfns && _optionalChain([out, 'optionalAccess', _293 => _293.startsWith, 'optionalCall', _294 => _294('{"aes":')])) {
     isAes = true;
     const aesData = JSON.parse(out);
     out = $asai.$lib.aesfns.reqAES({ data: aesData });
-    if (_optionalChain([aesData, 'optionalAccess', _279 => _279.aes]) === 2 && typeof out === "string") {
+    if (_optionalChain([aesData, 'optionalAccess', _295 => _295.aes]) === 2 && typeof out === "string") {
       try {
         out = JSON.parse(out);
-      } catch (e34) {
+      } catch (e38) {
       }
     }
   }
   const plainJson = typeof out === "string" && out.trimStart().startsWith("{");
-  if (_optionalChain([req, 'optionalAccess', _280 => _280.Userinfo, 'optionalAccess', _281 => _281[2]]) && !plainJson && !isRawUploadPost(_optionalChain([req, 'optionalAccess', _282 => _282.url])) && !isPlainSourcePost(_optionalChain([req, 'optionalAccess', _283 => _283.url]))) {
+  if (_optionalChain([req, 'optionalAccess', _296 => _296.Userinfo, 'optionalAccess', _297 => _297[2]]) && !plainJson && !isRawUploadPost(_optionalChain([req, 'optionalAccess', _298 => _298.url])) && !isPlainSourcePost(_optionalChain([req, 'optionalAccess', _299 => _299.url]))) {
     pm = req.Userinfo[2];
     out = $asai.$lib.AsCode.asdecode(out, pm);
   }
@@ -2591,7 +2664,7 @@ function processPostPayload($asai, req, postdata, pm) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, processPostPayload, "processPostPayload");
 var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _284 => _284.fn, 'optionalCall', _285 => _285($asai)]);
+  _optionalChain([opt, 'optionalAccess', _300 => _300.fn, 'optionalCall', _301 => _301($asai)]);
   function getHeader(req, key) {
     return req.headers[key.toLowerCase()] || "";
   }
@@ -2600,7 +2673,7 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   let apiRouteCacheLen = -1;
   function findApiHandler($asai2, pathname) {
     const apis = $asai2.hostserverapis;
-    if (!_optionalChain([apis, 'optionalAccess', _286 => _286.length])) return void 0;
+    if (!_optionalChain([apis, 'optionalAccess', _302 => _302.length])) return void 0;
     if (!apiRouteCache || apiRouteCacheLen !== apis.length) {
       apiRouteCache = apis.map((elp) => ({ key: elp, path: `/api/${elp}` }));
       apiRouteCacheLen = apis.length;
@@ -2648,9 +2721,9 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
           pm: decodeURIComponent(urlParse.search.substring(4))
         };
         if (req.url.indexOf("binary") === -1) {
-          if (_optionalChain([req, 'optionalAccess', _287 => _287.Userinfo]) && _optionalChain([req, 'optionalAccess', _288 => _288.Userinfo, 'access', _289 => _289[2]]) && _optionalChain([query, 'optionalAccess', _290 => _290.pm])) {
+          if (_optionalChain([req, 'optionalAccess', _303 => _303.Userinfo]) && _optionalChain([req, 'optionalAccess', _304 => _304.Userinfo, 'access', _305 => _305[2]]) && _optionalChain([query, 'optionalAccess', _306 => _306.pm])) {
             pm = req.Userinfo[2];
-            query = $asai.$lib.AsCode.asdecode(_optionalChain([query, 'optionalAccess', _291 => _291.pm]), pm);
+            query = $asai.$lib.AsCode.asdecode(_optionalChain([query, 'optionalAccess', _307 => _307.pm]), pm);
             query = Object.fromEntries(new URLSearchParams("?" + query).entries());
           }
         }
@@ -2669,87 +2742,99 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       const releaseSlot = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, () => releaseApiSlot(hostdir, clientIp), "releaseSlot");
       res.once("finish", releaseSlot);
       res.once("close", releaseSlot);
-      const maxBody = _optionalChain([$asai, 'access', _292 => _292.hostconfig, 'optionalAccess', _293 => _293.maxbody]) || 100 * 1024 * 1024;
+      const maxBody = _optionalChain([$asai, 'access', _308 => _308.hostconfig, 'optionalAccess', _309 => _309.maxbody]) || 100 * 1024 * 1024;
       const isTextPost = req.method === "POST" && req.url.indexOf("binary") === -1;
       const bodyPromise = isTextPost ? readRequestBody(req, maxBody) : null;
       void (async () => {
-        let authResult;
-        let rawBody = "";
         try {
-          [authResult, rawBody] = await Promise.all([
-            validateHttpAuthAsync(req, $asai, pathname),
-            _nullishCoalesce(bodyPromise, () => ( Promise.resolve("")))
-          ]);
-        } catch (err) {
-          releaseSlot();
-          if (_optionalChain([err, 'optionalAccess', _294 => _294.message]) === "PAYLOAD_TOO_LARGE") {
-            return sendError(res, 413, "Payload Too Large");
-          }
-          return sendError(res, 400, _optionalChain([err, 'optionalAccess', _295 => _295.message]) || "Bad Request");
-        }
-        if (!authResult.ok) {
-          releaseSlot();
-          return sendAuthError(res, authResult);
-        }
-        let apiFn = _optionalChain([$asai, 'access', _296 => _296.hostserverapi, 'access', _297 => _297[apiHandlerKey], 'optionalCall', _298 => _298($asai, query)]);
-        if (!apiFn) {
-          return sendError(res, 501, "Not Implemented");
-        }
-        res.setHeader("Content-Type", "application/json; charset=utf-8");
-        $asai.$log("API", req.method, urlParse.pathname, query);
-        let qrdata;
-        let postdata;
-        if (req.url.indexOf("binary") === -1) {
-          qrdata = query;
-          if (req.method === "POST") {
-            try {
-              const processed = processPostPayload($asai, req, rawBody, pm);
-              postdata = processed.postdata;
-              pm = processed.pm;
-              isAes = processed.isAes;
-            } catch (e35) {
-              return sendError(res, 400, "AES decrypt failed");
-            }
-            if (_optionalChain([apiFn, 'optionalAccess', _299 => _299.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _300 => _300.post]) === "function") {
-              const optTmp = { qrdata, data: postdata, pm };
-              if (isAes || _optionalChain([$asai, 'access', _301 => _301.$lib, 'access', _302 => _302.aesfns, 'optionalAccess', _303 => _303.allaes])) {
-                optTmp.resAES = _optionalChain([$asai, 'access', _304 => _304.$lib, 'access', _305 => _305.aesfns, 'optionalAccess', _306 => _306.resAES]);
-              }
-              apiFn.post(req, res, hostdir, optTmp);
-            } else {
-              res.end(typeof postdata === "string" ? postdata : JSON.stringify(_nullishCoalesce(postdata, () => ( ""))));
-            }
-          } else if (req.method === "GET") {
-            if (_optionalChain([apiFn, 'optionalAccess', _307 => _307.get]) && typeof _optionalChain([apiFn, 'optionalAccess', _308 => _308.get]) === "function") {
-              const optTmp = { qrdata, data: qrdata, pm };
-              if (isAes || _optionalChain([$asai, 'access', _309 => _309.$lib, 'access', _310 => _310.aesfns, 'optionalAccess', _311 => _311.allaes])) {
-                optTmp.resAES = _optionalChain([$asai, 'access', _312 => _312.$lib, 'access', _313 => _313.aesfns, 'optionalAccess', _314 => _314.resAES]);
-              }
-              apiFn.get(req, res, hostdir, optTmp);
-            } else {
-              res.end(JSON.stringify(qrdata));
+          let authResult;
+          let rawBody = "";
+          try {
+            [authResult, rawBody] = await Promise.all([
+              validateHttpAuthAsync(req, $asai, pathname),
+              _nullishCoalesce(bodyPromise, () => ( Promise.resolve("")))
+            ]);
+          } catch (err) {
+            releaseSlot();
+            if (_optionalChain([err, 'optionalAccess', _310 => _310.message]) === "PAYLOAD_TOO_LARGE") {
+              return sendError(res, 413, "Payload Too Large");
             }
+            return sendError(res, 400, _optionalChain([err, 'optionalAccess', _311 => _311.message]) || "Bad Request");
           }
-        } else {
-          if (_optionalChain([Object, 'access', _315 => _315.keys, 'call', _316 => _316(query), 'optionalAccess', _317 => _317.length])) {
-            qrdata = query;
+          if (!authResult.ok) {
+            releaseSlot();
+            return sendAuthError(res, authResult);
+          }
+          let apiFn = _optionalChain([$asai, 'access', _312 => _312.hostserverapi, 'access', _313 => _313[apiHandlerKey], 'optionalCall', _314 => _314($asai, query)]);
+          if (!apiFn) {
+            return sendError(res, 501, "Not Implemented");
           }
-          if (req.method === "POST") {
-            $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
-              if (_optionalChain([apiFn, 'optionalAccess', _318 => _318.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _319 => _319.post]) === "function") {
-                apiFn.post(req, res, hostdir, {
-                  qrdata,
-                  data: postdata2
-                });
+          res.setHeader("Content-Type", "application/json; charset=utf-8");
+          $asai.$log("API", req.method, urlParse.pathname, query);
+          let qrdata;
+          let postdata;
+          if (req.url.indexOf("binary") === -1) {
+            qrdata = query;
+            if (req.method === "POST") {
+              try {
+                const processed = processPostPayload($asai, req, rawBody, pm);
+                postdata = processed.postdata;
+                pm = processed.pm;
+                isAes = processed.isAes;
+              } catch (e39) {
+                return sendError(res, 400, "AES decrypt failed");
+              }
+              if (_optionalChain([apiFn, 'optionalAccess', _315 => _315.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _316 => _316.post]) === "function") {
+                const optTmp = { qrdata, data: postdata, pm };
+                if (isAes || _optionalChain([$asai, 'access', _317 => _317.$lib, 'access', _318 => _318.aesfns, 'optionalAccess', _319 => _319.allaes])) {
+                  optTmp.resAES = _optionalChain([$asai, 'access', _320 => _320.$lib, 'access', _321 => _321.aesfns, 'optionalAccess', _322 => _322.resAES]);
+                }
+                apiFn.post(req, res, hostdir, optTmp);
               } else {
-                res.end(postdata2);
+                res.end(typeof postdata === "string" ? postdata : JSON.stringify(_nullishCoalesce(postdata, () => ( ""))));
               }
-            }).catch((err) => {
-              return sendError(res, 400, "Invalid content type");
-            });
+            } else if (req.method === "GET") {
+              if (_optionalChain([apiFn, 'optionalAccess', _323 => _323.get]) && typeof _optionalChain([apiFn, 'optionalAccess', _324 => _324.get]) === "function") {
+                const optTmp = { qrdata, data: qrdata, pm };
+                if (isAes || _optionalChain([$asai, 'access', _325 => _325.$lib, 'access', _326 => _326.aesfns, 'optionalAccess', _327 => _327.allaes])) {
+                  optTmp.resAES = _optionalChain([$asai, 'access', _328 => _328.$lib, 'access', _329 => _329.aesfns, 'optionalAccess', _330 => _330.resAES]);
+                }
+                apiFn.get(req, res, hostdir, optTmp);
+              } else {
+                res.end(JSON.stringify(qrdata));
+              }
+            }
+          } else {
+            if (_optionalChain([Object, 'access', _331 => _331.keys, 'call', _332 => _332(query), 'optionalAccess', _333 => _333.length])) {
+              qrdata = query;
+            }
+            if (req.method === "POST") {
+              $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
+                if (_optionalChain([apiFn, 'optionalAccess', _334 => _334.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _335 => _335.post]) === "function") {
+                  apiFn.post(req, res, hostdir, {
+                    qrdata,
+                    data: postdata2
+                  });
+                } else {
+                  res.end(postdata2);
+                }
+              }).catch((err) => {
+                return sendError(res, 400, "Invalid content type");
+              });
+            }
+          }
+        } catch (err) {
+          releaseSlot();
+          if (!res.headersSent) {
+            return sendError(res, 500, _optionalChain([err, 'optionalAccess', _336 => _336.message]) || "Internal Server Error");
           }
         }
-      })();
+      })().catch((err) => {
+        releaseSlot();
+        if (!res.headersSent) {
+          sendError(res, 500, _optionalChain([err, 'optionalAccess', _337 => _337.message]) || "Internal Server Error");
+        }
+      });
     } else {
       $asai.$log("API", req.method, req.url);
     }
@@ -2760,12 +2845,12 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 // src/common/server/Ws.ts
 var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _320 => _320.fn, 'optionalCall', _321 => _321($asai)]);
+  _optionalChain([opt, 'optionalAccess', _338 => _338.fn, 'optionalCall', _339 => _339($asai)]);
   const wsHandlerCache = /* @__PURE__ */ new Map();
   const routeIndex = ensureWsRouteIndex($asai);
   function getWsHandler(handlerKey) {
     if (!wsHandlerCache.has(handlerKey)) {
-      wsHandlerCache.set(handlerKey, _optionalChain([$asai, 'access', _322 => _322.hostserverws, 'access', _323 => _323[handlerKey], 'optionalCall', _324 => _324($asai)]));
+      wsHandlerCache.set(handlerKey, _optionalChain([$asai, 'access', _340 => _340.hostserverws, 'access', _341 => _341[handlerKey], 'optionalCall', _342 => _342($asai)]));
     }
     return wsHandlerCache.get(handlerKey);
   }
@@ -2789,21 +2874,21 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
       let reqdata = parseMessage(msg);
       let handlerKey;
       if (reqdata === "ping") {
-        _optionalChain([ws2, 'access', _325 => _325.send, 'optionalCall', _326 => _326("pong")]);
+        _optionalChain([ws2, 'access', _343 => _343.send, 'optionalCall', _344 => _344("pong")]);
         return;
       } else {
         const reqdataisobj = typeof reqdata === "object" && reqdata !== null;
-        handlerKey = reqdataisobj ? routeIndex.matchTy(_optionalChain([reqdata, 'optionalAccess', _327 => _327.ty])) : routeIndex.matchString(reqdata);
-        if (!handlerKey && _optionalChain([$asai, 'access', _328 => _328.hostserverwss, 'optionalAccess', _329 => _329.length])) {
+        handlerKey = reqdataisobj ? routeIndex.matchTy(_optionalChain([reqdata, 'optionalAccess', _345 => _345.ty])) : routeIndex.matchString(reqdata);
+        if (!handlerKey && _optionalChain([$asai, 'access', _346 => _346.hostserverwss, 'optionalAccess', _347 => _347.length])) {
           handlerKey = $asai.hostserverwss.find((elp) => {
             if (reqdataisobj) {
-              return _optionalChain([reqdata, 'optionalAccess', _330 => _330.ty, 'optionalAccess', _331 => _331.startsWith, 'call', _332 => _332(elp)]);
+              return _optionalChain([reqdata, 'optionalAccess', _348 => _348.ty, 'optionalAccess', _349 => _349.startsWith, 'call', _350 => _350(elp)]);
             }
             return typeof reqdata === "string" && reqdata.startsWith(elp);
           });
         }
         if (!handlerKey) {
-          _optionalChain([$asai, 'access', _333 => _333.asaimock, 'optionalAccess', _334 => _334.wsWorkMock, 'call', _335 => _335({
+          _optionalChain([$asai, 'access', _351 => _351.asaimock, 'optionalAccess', _352 => _352.wsWorkMock, 'call', _353 => _353({
             msg,
             ws: ws2,
             hostdir,
@@ -2815,14 +2900,14 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
         }
       }
       if (!handlerKey) return;
-      _optionalChain([getWsHandler, 'call', _336 => _336(handlerKey), 'optionalAccess', _337 => _337.work, 'optionalCall', _338 => _338(reqdata, ws2, hostdir, req)]);
+      _optionalChain([getWsHandler, 'call', _354 => _354(handlerKey), 'optionalAccess', _355 => _355.work, 'optionalCall', _356 => _356(reqdata, ws2, hostdir, req)]);
     } catch (err) {
-      _optionalChain([($asai.$log || console.error), 'optionalCall', _339 => _339("WS", "handler error", err instanceof Error ? err.message : err)]);
+      _optionalChain([($asai.$log || console.error), 'optionalCall', _357 => _357("WS", "handler error", err instanceof Error ? err.message : err)]);
     }
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, wsWork, "wsWork");
   function _getMessage(msg) {
-    if (_optionalChain([msg, 'optionalAccess', _340 => _340.db, 'optionalAccess', _341 => _341.aes]) && _optionalChain([$asai, 'access', _342 => _342.$lib, 'optionalAccess', _343 => _343.aesfns, 'optionalAccess', _344 => _344.reqAES])) {
+    if (_optionalChain([msg, 'optionalAccess', _358 => _358.db, 'optionalAccess', _359 => _359.aes]) && _optionalChain([$asai, 'access', _360 => _360.$lib, 'optionalAccess', _361 => _361.aesfns, 'optionalAccess', _362 => _362.reqAES])) {
       msg.db = $asai.$lib.aesfns.reqAES({ data: msg.db });
     }
     return msg;
@@ -2849,12 +2934,12 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
 // src/common/server/Sys.ts
 var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _345 => _345.fn, 'optionalCall', _346 => _346($asai)]);
+  _optionalChain([opt, 'optionalAccess', _363 => _363.fn, 'optionalCall', _364 => _364($asai)]);
   let sysRouteCache = null;
   let sysRouteCacheLen = -1;
   function findSystemHandler(req) {
     const routes = $asai.hostserversyss;
-    if (!_optionalChain([routes, 'optionalAccess', _347 => _347.length])) return void 0;
+    if (!_optionalChain([routes, 'optionalAccess', _365 => _365.length])) return void 0;
     if (!sysRouteCache || sysRouteCacheLen !== routes.length) {
       sysRouteCache = routes.map((elp) => ({ key: elp, route: `/${elp}` }));
       sysRouteCacheLen = routes.length;
@@ -2883,27 +2968,28 @@ var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     }
     const urlPath = (req.url || "").split("?")[0];
     void (async () => {
-      const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
-      if (!authResult.ok) {
-        return sendAuthError(res, authResult);
-      }
-      const handler = _optionalChain([$asai, 'access', _348 => _348.hostserversys, 'access', _349 => _349[handlerKey], 'optionalCall', _350 => _350($asai)]);
-      if (!handler) {
-        return sendError(res, 500, "Handler Initialization Failed");
-      }
-      if (_optionalChain([handler, 'optionalAccess', _351 => _351.show]) && typeof _optionalChain([handler, 'optionalAccess', _352 => _352.show]) === "function") {
-        handler.show(req, res, hostdir);
-      } else {
-        res.end("postdata");
+      try {
+        const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
+        if (!authResult.ok) {
+          return sendAuthError(res, authResult);
+        }
+        const handler = _optionalChain([$asai, 'access', _366 => _366.hostserversys, 'access', _367 => _367[handlerKey], 'optionalCall', _368 => _368($asai)]);
+        if (!handler) {
+          return sendError(res, 500, "Handler Initialization Failed");
+        }
+        if (_optionalChain([handler, 'optionalAccess', _369 => _369.show]) && typeof _optionalChain([handler, 'optionalAccess', _370 => _370.show]) === "function") {
+          handler.show(req, res, hostdir);
+        } else {
+          res.end("postdata");
+        }
+      } catch (err) {
+        return sendError(res, 500, _optionalChain([err, 'optionalAccess', _371 => _371.message]) || "Internal Server Error");
       }
-      if (!handler) {
-        res.writeHead(404, {
-          "Content-Type": "application/json; charset=utf-8"
-        });
-        res.end(req.url);
-      } else {
+    })().catch((err) => {
+      if (!res.headersSent) {
+        sendError(res, 500, _optionalChain([err, 'optionalAccess', _372 => _372.message]) || "Internal Server Error");
       }
-    })();
+    });
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sysWork, "sysWork");
   return { sysWork };
@@ -2911,18 +2997,18 @@ var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 // src/common/server/WsClient.ts
 var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, wsname) => {
-  if (!_optionalChain([$asai, 'optionalAccess', _353 => _353.clientws])) {
+  if (!_optionalChain([$asai, 'optionalAccess', _373 => _373.clientws])) {
     $asai.clientws = {};
   }
   if (!$asai.clientws[wsname]) {
     $asai.clientws[wsname] = { tasks: /* @__PURE__ */ new Map() };
   }
   function getKeyByData(msgdata) {
-    return _optionalChain([msgdata, 'optionalAccess', _354 => _354.id]) || _optionalChain([msgdata, 'optionalAccess', _355 => _355.ty]);
+    return _optionalChain([msgdata, 'optionalAccess', _374 => _374.id]) || _optionalChain([msgdata, 'optionalAccess', _375 => _375.ty]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getKeyByData, "getKeyByData");
   function clientwsInit() {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       $asai.clientws[wsname].socket = new $asai.asaiWs(
         $asai.command.commandconfig.clientws[wsname]
       );
@@ -2931,7 +3017,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
       };
       $asai.clientws[wsname].socket.on("error", (err) => {
         $asai.clientws[wsname].open = 0;
-        _optionalChain([$asai, 'access', _356 => _356.hostconfig, 'access', _357 => _357.logger, 'optionalAccess', _358 => _358.lv, 'optionalAccess', _359 => _359.view]) && console.error(
+        _optionalChain([$asai, 'access', _376 => _376.hostconfig, 'access', _377 => _377.logger, 'optionalAccess', _378 => _378.lv, 'optionalAccess', _379 => _379.view]) && console.error(
           666.2203,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is error.`,
           err
@@ -2940,19 +3026,19 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
       });
       $asai.clientws[wsname].socket.on("close", () => {
         $asai.clientws[wsname].open = 0;
-        _optionalChain([$asai, 'access', _360 => _360.hostconfig, 'access', _361 => _361.logger, 'optionalAccess', _362 => _362.lv, 'optionalAccess', _363 => _363.view]) && console.error(
+        _optionalChain([$asai, 'access', _380 => _380.hostconfig, 'access', _381 => _381.logger, 'optionalAccess', _382 => _382.lv, 'optionalAccess', _383 => _383.view]) && console.error(
           666.2205,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is close.`
         );
         reject();
       });
       $asai.clientws[wsname].socket.onopen = () => {
-        _optionalChain([$asai, 'access', _364 => _364.hostconfig, 'access', _365 => _365.logger, 'optionalAccess', _366 => _366.lv, 'optionalAccess', _367 => _367.view]) && console.log(
+        _optionalChain([$asai, 'access', _384 => _384.hostconfig, 'access', _385 => _385.logger, 'optionalAccess', _386 => _386.lv, 'optionalAccess', _387 => _387.view]) && console.log(
           666.2201,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is open.`
         );
         $asai.clientws[wsname].open = 1;
-        resolve5();
+        resolve6();
       };
     });
   }
@@ -2970,7 +3056,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
         const key = getKeyByData(messageData);
         const task = $asai.clientws[wsname].tasks.get(key);
         if (task) {
-          _optionalChain([task, 'optionalAccess', _368 => _368.callback, 'call', _369 => _369(messageData)]);
+          _optionalChain([task, 'optionalAccess', _388 => _388.callback, 'call', _389 => _389(messageData)]);
           if (messageData.ty && !messageData.id) {
           } else {
             $asai.clientws[wsname].tasks.delete(key);
@@ -2982,7 +3068,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, clientwsOnmessage, "clientwsOnmessage");
   function clientwsApi(messageData) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       if ($asai.clientws[wsname].open) {
         try {
           const taskOpt = {};
@@ -2994,7 +3080,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
             getKeyByData(messageData),
             {
               callback: /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (res) => {
-                resolve5(res);
+                resolve6(res);
               }, "callback"),
               ...messageData,
               ...taskOpt
@@ -3024,7 +3110,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, clientwsWatch, "clientwsWatch");
   function clientwsWatchOff(messageData) {
-    if (_optionalChain([messageData, 'optionalAccess', _370 => _370.ty]) === "clear") {
+    if (_optionalChain([messageData, 'optionalAccess', _390 => _390.ty]) === "clear") {
       $asai.clientws[wsname].tasks = /* @__PURE__ */ new Map();
     } else {
       const key = getKeyByData(messageData);
@@ -3065,7 +3151,7 @@ var ping_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai)
 var web_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
   function chatBoard(msgdata, ws2, hostdir, req) {
     let room;
-    if (_optionalChain([msgdata, 'access', _371 => _371.db, 'optionalAccess', _372 => _372.room]) && typeof msgdata.db.room === "string") {
+    if (_optionalChain([msgdata, 'access', _391 => _391.db, 'optionalAccess', _392 => _392.room]) && typeof msgdata.db.room === "string") {
       room = msgdata.db.room;
       delete msgdata.db.room;
     } else {
@@ -3122,26 +3208,26 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     removeFile: removeFile2,
     resolvePathUnderBase: resolvePathUnderBase2
   } = $asai.$lib.AsFs;
-  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'access', _373 => _373.$lib, 'optionalAccess', _374 => _374.reqWork, 'optionalCall', _375 => _375($asai)]);
+  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'access', _393 => _393.$lib, 'optionalAccess', _394 => _394.reqWork, 'optionalCall', _395 => _395($asai)]);
   function mgLog(...arg) {
     mnLog("LOG", ...arg);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mgLog, "mgLog");
   function getDir(opt) {
-    let tmpDir = _optionalChain([opt, 'access', _376 => _376.qrdata, 'optionalAccess', _377 => _377.dir]) || _optionalChain([opt, 'access', _378 => _378.data, 'optionalAccess', _379 => _379.dir]);
+    let tmpDir = _optionalChain([opt, 'access', _396 => _396.qrdata, 'optionalAccess', _397 => _397.dir]) || _optionalChain([opt, 'access', _398 => _398.data, 'optionalAccess', _399 => _399.dir]);
     if (tmpDir) {
       tmpDir = decodeURIComponent(tmpDir);
     } else {
-      tmpDir = _optionalChain([opt, 'access', _380 => _380.qrdata, 'optionalAccess', _381 => _381.ty]) || _optionalChain([opt, 'access', _382 => _382.data, 'optionalAccess', _383 => _383.ty]);
+      tmpDir = _optionalChain([opt, 'access', _400 => _400.qrdata, 'optionalAccess', _401 => _401.ty]) || _optionalChain([opt, 'access', _402 => _402.data, 'optionalAccess', _403 => _403.ty]);
       if (tmpDir) {
         tmpDir = decodeURIComponent(tmpDir);
         if (tmpDir === "access-clf" || tmpDir === "access-w3c") {
-          tmpDir = _optionalChain([$asai, 'access', _384 => _384.hostconfig, 'access', _385 => _385.logger, 'optionalAccess', _386 => _386.path, 'optionalAccess', _387 => _387.access]) || "";
+          tmpDir = _optionalChain([$asai, 'access', _404 => _404.hostconfig, 'access', _405 => _405.logger, 'optionalAccess', _406 => _406.path, 'optionalAccess', _407 => _407.access]) || "";
         } else {
-          tmpDir = _optionalChain([$asai, 'access', _388 => _388.hostconfig, 'access', _389 => _389.logger, 'optionalAccess', _390 => _390.path, 'optionalAccess', _391 => _391[tmpDir]]) || "";
+          tmpDir = _optionalChain([$asai, 'access', _408 => _408.hostconfig, 'access', _409 => _409.logger, 'optionalAccess', _410 => _410.path, 'optionalAccess', _411 => _411[tmpDir]]) || "";
         }
       } else {
-        tmpDir = _optionalChain([$asai, 'access', _392 => _392.hostconfig, 'access', _393 => _393.logger, 'optionalAccess', _394 => _394.path, 'optionalAccess', _395 => _395.client]) || "";
+        tmpDir = _optionalChain([$asai, 'access', _412 => _412.hostconfig, 'access', _413 => _413.logger, 'optionalAccess', _414 => _414.path, 'optionalAccess', _415 => _415.client]) || "";
       }
     }
     return tmpDir;
@@ -3173,7 +3259,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       if (!await ensureLv(req, $asai, 3)) return sendFail(res, "Forbidden", opt);
       try {
         const baseDir = getDir(opt);
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _396 => _396.qrdata, 'optionalAccess', _397 => _397.path]) || _optionalChain([opt, 'access', _398 => _398.data, 'optionalAccess', _399 => _399.path]));
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _416 => _416.qrdata, 'optionalAccess', _417 => _417.path]) || _optionalChain([opt, 'access', _418 => _418.data, 'optionalAccess', _419 => _419.path]));
         const jsonpath = resolvePathUnderBase2(baseDir, relPath);
         await ensureFile2(jsonpath);
         mgLog("ENSURE", jsonpath);
@@ -3194,7 +3280,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     if (url.startsWith("/api/asailog/manage/selectlist/")) {
       if (!await ensureLv(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ty = decodeURIComponent(_optionalChain([opt, 'access', _400 => _400.qrdata, 'optionalAccess', _401 => _401.ty]) || _optionalChain([opt, 'access', _402 => _402.data, 'optionalAccess', _403 => _403.ty]) || "client");
+        const ty = decodeURIComponent(_optionalChain([opt, 'access', _420 => _420.qrdata, 'optionalAccess', _421 => _421.ty]) || _optionalChain([opt, 'access', _422 => _422.data, 'optionalAccess', _423 => _423.ty]) || "client");
         if (!_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
           const kind = ty === "sec" ? "sec" : "web";
           const groups = await _chunkHR5JKN7Ycjs.listUnifiedGroups.call(void 0, $asai, { kind, source: ty === "sec" ? "sec" : ty });
@@ -3222,8 +3308,8 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     if (url.startsWith("/api/asailog/manage/select/")) {
       if (!await ensureLv(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ty = decodeURIComponent(_optionalChain([opt, 'access', _404 => _404.qrdata, 'optionalAccess', _405 => _405.ty]) || _optionalChain([opt, 'access', _406 => _406.data, 'optionalAccess', _407 => _407.ty]) || "client");
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _408 => _408.qrdata, 'optionalAccess', _409 => _409.path]) || _optionalChain([opt, 'access', _410 => _410.data, 'optionalAccess', _411 => _411.path]));
+        const ty = decodeURIComponent(_optionalChain([opt, 'access', _424 => _424.qrdata, 'optionalAccess', _425 => _425.ty]) || _optionalChain([opt, 'access', _426 => _426.data, 'optionalAccess', _427 => _427.ty]) || "client");
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _428 => _428.qrdata, 'optionalAccess', _429 => _429.path]) || _optionalChain([opt, 'access', _430 => _430.data, 'optionalAccess', _431 => _431.path]));
         if (!_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
           const data2 = await _chunkHR5JKN7Ycjs.readWebLogFromStore.call(void 0, $asai, ty, relPath);
           if (data2) {
@@ -3251,7 +3337,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       if (!await ensureLv(req, $asai, 3)) return sendFail(res, "Forbidden", opt);
       try {
         const baseDir = getDir(opt);
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _412 => _412.qrdata, 'optionalAccess', _413 => _413.path]) || _optionalChain([opt, 'access', _414 => _414.data, 'optionalAccess', _415 => _415.path]));
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _432 => _432.qrdata, 'optionalAccess', _433 => _433.path]) || _optionalChain([opt, 'access', _434 => _434.data, 'optionalAccess', _435 => _435.path]));
         const fileName = relPath.split(/[/\\]/).pop() || relPath;
         if (_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai)) {
           await _chunkHR5JKN7Ycjs.purgeStoreEntriesForFile.call(void 0, $asai, fileName).catch(() => void 0);
@@ -3274,14 +3360,14 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
 // src/infra/siem-auth.ts
 function isSiemEnabled($asai) {
-  const cfg = _optionalChain([$asai, 'optionalAccess', _416 => _416.hostconfig, 'optionalAccess', _417 => _417.logger, 'optionalAccess', _418 => _418.siem]);
-  return !!(_optionalChain([cfg, 'optionalAccess', _419 => _419.enabled]) && getSiemToken($asai));
+  const cfg = _optionalChain([$asai, 'optionalAccess', _436 => _436.hostconfig, 'optionalAccess', _437 => _437.logger, 'optionalAccess', _438 => _438.siem]);
+  return !!(_optionalChain([cfg, 'optionalAccess', _439 => _439.enabled]) && getSiemToken($asai));
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, isSiemEnabled, "isSiemEnabled");
 function getSiemToken($asai) {
   const fromEnv = process.env.ASAI_SIEM_TOKEN;
   if (typeof fromEnv === "string" && fromEnv.trim()) return fromEnv.trim();
-  const fromCfg = _optionalChain([$asai, 'optionalAccess', _420 => _420.hostconfig, 'optionalAccess', _421 => _421.logger, 'optionalAccess', _422 => _422.siem, 'optionalAccess', _423 => _423.token]);
+  const fromCfg = _optionalChain([$asai, 'optionalAccess', _440 => _440.hostconfig, 'optionalAccess', _441 => _441.logger, 'optionalAccess', _442 => _442.siem, 'optionalAccess', _443 => _443.token]);
   return typeof fromCfg === "string" ? fromCfg.trim() : "";
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSiemToken, "getSiemToken");
@@ -3289,9 +3375,9 @@ function isSiemTokenValid($asai, req) {
   if (!isSiemEnabled($asai)) return false;
   const expected = getSiemToken($asai);
   if (!expected) return false;
-  const header = _optionalChain([req, 'optionalAccess', _424 => _424.headers, 'optionalAccess', _425 => _425["x-siem-token"]]) || _optionalChain([req, 'optionalAccess', _426 => _426.headers, 'optionalAccess', _427 => _427["x-api-key"]]);
+  const header = _optionalChain([req, 'optionalAccess', _444 => _444.headers, 'optionalAccess', _445 => _445["x-siem-token"]]) || _optionalChain([req, 'optionalAccess', _446 => _446.headers, 'optionalAccess', _447 => _447["x-api-key"]]);
   if (typeof header === "string" && header === expected) return true;
-  const q = _optionalChain([req, 'optionalAccess', _428 => _428.query]) || {};
+  const q = _optionalChain([req, 'optionalAccess', _448 => _448.query]) || {};
   const qToken = q.siem_token || q.token;
   return typeof qToken === "string" && qToken === expected;
 }
@@ -3315,20 +3401,20 @@ function getNs(raw) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getNs, "getNs");
 async function ensureServerUser(req, $asai) {
-  if (Array.isArray(_optionalChain([req, 'optionalAccess', _429 => _429.Userinfo])) && req.Userinfo[0]) {
+  if (Array.isArray(_optionalChain([req, 'optionalAccess', _449 => _449.Userinfo])) && req.Userinfo[0]) {
     await attachServerUserLevel(req, $asai);
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, ensureServerUser, "ensureServerUser");
 var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _430 => _430.$lib, 'optionalAccess', _431 => _431.reqWork, 'optionalCall', _432 => _432($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _450 => _450.$lib, 'optionalAccess', _451 => _451.reqWork, 'optionalCall', _452 => _452($asai)]) || {};
   const IL = $asai.$lib.InterventionLog;
   async function get(req, res, hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/asailog/intervention/selectlist/")) {
       if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ns = getNs(_optionalChain([opt, 'access', _433 => _433.qrdata, 'optionalAccess', _434 => _434.ns]) || _optionalChain([opt, 'access', _435 => _435.data, 'optionalAccess', _436 => _436.ns]));
+        const ns = getNs(_optionalChain([opt, 'access', _453 => _453.qrdata, 'optionalAccess', _454 => _454.ns]) || _optionalChain([opt, 'access', _455 => _455.data, 'optionalAccess', _456 => _456.ns]));
         let list = await IL.listInterventionFiles($asai, ns);
         if (_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && !_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai)) {
           const groups = await _chunkHR5JKN7Ycjs.listUnifiedGroups.call(void 0, $asai, { kind: "intervention", ns });
@@ -3340,19 +3426,19 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
         }
         return sendSuccess(res, { ns, files: list }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _437 => _437.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _457 => _457.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/intervention/select/")) {
       if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const name = decodeURIComponent(_optionalChain([opt, 'access', _438 => _438.qrdata, 'optionalAccess', _439 => _439.name]) || _optionalChain([opt, 'access', _440 => _440.data, 'optionalAccess', _441 => _441.name]) || "");
-        const ns = getNs(_optionalChain([opt, 'access', _442 => _442.qrdata, 'optionalAccess', _443 => _443.ns]) || _optionalChain([opt, 'access', _444 => _444.data, 'optionalAccess', _445 => _445.ns]));
+        const name = decodeURIComponent(_optionalChain([opt, 'access', _458 => _458.qrdata, 'optionalAccess', _459 => _459.name]) || _optionalChain([opt, 'access', _460 => _460.data, 'optionalAccess', _461 => _461.name]) || "");
+        const ns = getNs(_optionalChain([opt, 'access', _462 => _462.qrdata, 'optionalAccess', _463 => _463.ns]) || _optionalChain([opt, 'access', _464 => _464.data, 'optionalAccess', _465 => _465.ns]));
         if (!name) return sendFail(res, "name required", opt);
         const content = await IL.readInterventionFile($asai, name, ns);
         return sendSuccess(res, { ns, ...content }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _446 => _446.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _466 => _466.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/intervention/types/")) {
@@ -3360,7 +3446,7 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
       try {
         return sendSuccess(res, IL.getInterventionTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _447 => _447.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _467 => _467.message]) || err, opt);
       }
     }
   }
@@ -3390,7 +3476,7 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
         );
         return sendSuccess(res, { ns, ...result }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _448 => _448.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _468 => _468.message]) || err, opt);
       }
     }
   }
@@ -3409,11 +3495,11 @@ function parseQuery(opt) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, parseQuery, "parseQuery");
 function parseBody(opt) {
-  if (!_optionalChain([opt, 'optionalAccess', _449 => _449.data])) return {};
+  if (!_optionalChain([opt, 'optionalAccess', _469 => _469.data])) return {};
   if (typeof opt.data === "string") {
     try {
       return JSON.parse(opt.data);
-    } catch (e36) {
+    } catch (e40) {
       return {};
     }
   }
@@ -3421,7 +3507,7 @@ function parseBody(opt) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, parseBody, "parseBody");
 var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _450 => _450.$lib, 'optionalAccess', _451 => _451.reqWork, 'optionalCall', _452 => _452($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _470 => _470.$lib, 'optionalAccess', _471 => _471.reqWork, 'optionalCall', _472 => _472($asai)]) || {};
   const IL = $asai.$lib.InterventionLog;
   async function get(req, res, hostdir, opt) {
     const url = req.url || "";
@@ -3431,7 +3517,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       try {
         return sendSuccess(res, _chunkHR5JKN7Ycjs.getLogStoreMeta.call(void 0, $asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _453 => _453.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _473 => _473.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/stats/")) {
@@ -3444,7 +3530,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const stats = await _chunkHR5JKN7Ycjs.getUnifiedStats.call(void 0, $asai);
         return sendSuccess(res, { store: storeType, stats, config: _chunkHR5JKN7Ycjs.getLogStoreMeta.call(void 0, $asai) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _454 => _454.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _474 => _474.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/compliance/")) {
@@ -3454,7 +3540,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const report = await _chunkHR5JKN7Ycjs.getComplianceReport.call(void 0, $asai, ns);
         return sendSuccess(res, report, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _455 => _455.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _475 => _475.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/search/")) {
@@ -3476,7 +3562,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, result, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _456 => _456.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _476 => _476.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/export/")) {
@@ -3497,7 +3583,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, payload, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _457 => _457.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _477 => _477.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/taxonomy/")) {
@@ -3505,7 +3591,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       try {
         return sendSuccess(res, IL.getInterventionTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _458 => _458.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _478 => _478.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/formats/")) {
@@ -3514,7 +3600,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const { getLogFormatTaxonomy } = await Promise.resolve().then(() => _interopRequireWildcard(require("./log-formats-TUXGMCCU.cjs")));
         return sendSuccess(res, getLogFormatTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _459 => _459.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _479 => _479.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/selectlist/")) {
@@ -3541,7 +3627,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         }
         return sendSuccess(res, { groups }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _460 => _460.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _480 => _480.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/select/")) {
@@ -3575,7 +3661,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, { entries: rows }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _461 => _461.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _481 => _481.message]) || err, opt);
       }
     }
   }
@@ -3597,7 +3683,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       });
       return sendSuccess(res, result, opt);
     } catch (err) {
-      return sendFail(res, _optionalChain([err, 'optionalAccess', _462 => _462.message]) || err, opt);
+      return sendFail(res, _optionalChain([err, 'optionalAccess', _482 => _482.message]) || err, opt);
     }
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, post, "post");
@@ -3609,7 +3695,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
 var registry = null;
 function resolveFilePath($asai) {
-  const root = _optionalChain([$asai, 'optionalAccess', _463 => _463.serverRoot]) || process.cwd();
+  const root = _optionalChain([$asai, 'optionalAccess', _483 => _483.serverRoot]) || process.cwd();
   return nodePath3.join(root, "websys/sys/errorcodes.json");
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveFilePath, "resolveFilePath");
@@ -3619,7 +3705,7 @@ function loadErrorCodes($asai) {
   try {
     const raw = fs8.readFileSync(filePath, "utf8");
     registry = JSON.parse(raw);
-  } catch (e37) {
+  } catch (e41) {
     registry = { version: "0", errors: {} };
   }
   if ($asai) $asai.errorcodes = registry;
@@ -3627,7 +3713,7 @@ function loadErrorCodes($asai) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, loadErrorCodes, "loadErrorCodes");
 function getError(ec) {
-  return _optionalChain([registry, 'optionalAccess', _464 => _464.errors, 'optionalAccess', _465 => _465[ec]]) || null;
+  return _optionalChain([registry, 'optionalAccess', _484 => _484.errors, 'optionalAccess', _485 => _485[ec]]) || null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getError, "getError");
 function hasError(ec) {
@@ -3636,11 +3722,11 @@ function hasError(ec) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, hasError, "hasError");
 function logError($asai, ec, params) {
   const entry = getError(ec);
-  const logFn = _optionalChain([$asai, 'optionalAccess', _466 => _466.$log]) || console.warn;
+  const logFn = _optionalChain([$asai, 'optionalAccess', _486 => _486.$log]) || console.warn;
   if (entry) {
-    logFn(`[EC:${ec}]`, entry.id || "", entry.detail || "", _optionalChain([params, 'optionalAccess', _467 => _467.length]) ? params : "");
+    logFn(`[EC:${ec}]`, entry.id || "", entry.detail || "", _optionalChain([params, 'optionalAccess', _487 => _487.length]) ? params : "");
   } else {
-    logFn(`[EC:${ec}]`, "(unregistered)", _optionalChain([params, 'optionalAccess', _468 => _468.length]) ? params : "");
+    logFn(`[EC:${ec}]`, "(unregistered)", _optionalChain([params, 'optionalAccess', _488 => _488.length]) ? params : "");
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, logError, "logError");
@@ -3668,14 +3754,14 @@ var ErrorCode_default = {
 // src/sysserver/api/common/errorcodes.ts
 var errorcodes_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _469 => _469.$lib, 'optionalAccess', _470 => _470.reqWork, 'optionalCall', _471 => _471($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _489 => _489.$lib, 'optionalAccess', _490 => _490.reqWork, 'optionalCall', _491 => _491($asai)]) || {};
   function get(req, res, _hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/sys/errorcodes/")) {
       try {
         return sendSuccess(res, loadErrorCodes($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _472 => _472.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _492 => _492.message]) || err, opt);
       }
     }
   }
@@ -3685,9 +3771,9 @@ var errorcodes_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
 // src/sysserver/api/common/sqlitemanage.ts
 var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'optionalAccess', _473 => _473.$lib, 'optionalAccess', _474 => _474.reqWork, 'optionalCall', _475 => _475($asai)]) || {};
+  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'optionalAccess', _493 => _493.$lib, 'optionalAccess', _494 => _494.reqWork, 'optionalCall', _495 => _495($asai)]) || {};
   function mgLog(...arg) {
-    _optionalChain([mnLog, 'optionalCall', _476 => _476("SQLite", ...arg)]);
+    _optionalChain([mnLog, 'optionalCall', _496 => _496("SQLite", ...arg)]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mgLog, "mgLog");
   return $asai.$lib.AsDb($asai, {
@@ -3705,7 +3791,7 @@ var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0,
       if (req.url.startsWith("/api/asaisqlite/manage/post")) {
         try {
           mgLog("POST", "custom handler triggered");
-          _optionalChain([sendSuccess, 'optionalCall', _477 => _477(res, { data: "post" }, opt)]);
+          _optionalChain([sendSuccess, 'optionalCall', _497 => _497(res, { data: "post" }, opt)]);
         } catch (err) {
           mgLog("ERROR", "post handler", err);
         }
@@ -3722,10 +3808,10 @@ var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0,
             table: dataObj.table
           });
           mgLog("SELECT", "completed");
-          _optionalChain([sendSuccess, 'optionalCall', _478 => _478(res, resdb, opt)]);
+          _optionalChain([sendSuccess, 'optionalCall', _498 => _498(res, resdb, opt)]);
         } catch (errdb) {
           mgLog("ERROR", "select", errdb);
-          _optionalChain([sendFail, 'optionalCall', _479 => _479(res, errdb, opt)]);
+          _optionalChain([sendFail, 'optionalCall', _499 => _499(res, errdb, opt)]);
         }
         return "ok";
       }
@@ -3741,7 +3827,7 @@ function promLine(name, value, labels) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, promLine, "promLine");
 var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _480 => _480.$lib, 'optionalAccess', _481 => _481.reqWork, 'optionalCall', _482 => _482($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _500 => _500.$lib, 'optionalAccess', _501 => _501.reqWork, 'optionalCall', _502 => _502($asai)]) || {};
   async function get(req, res, _hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/sys/health/metrics/")) {
@@ -3750,10 +3836,10 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
         let httpTotal = 0;
         let wsTotal = 0;
         for (const set of Object.values($asai.connectionshttp || {})) {
-          httpTotal += _optionalChain([set, 'optionalAccess', _483 => _483.size]) || 0;
+          httpTotal += _optionalChain([set, 'optionalAccess', _503 => _503.size]) || 0;
         }
         for (const set of Object.values($asai.connectionsws || {})) {
-          wsTotal += _optionalChain([set, 'optionalAccess', _484 => _484.size]) || 0;
+          wsTotal += _optionalChain([set, 'optionalAccess', _504 => _504.size]) || 0;
         }
         const lines = [
           "# HELP asai_uptime_seconds Process uptime",
@@ -3775,7 +3861,7 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
         return res.end(lines.join("\n") + "\n");
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _485 => _485.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _505 => _505.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/sys/health/status/")) {
@@ -3788,10 +3874,10 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
           memory: process.memoryUsage(),
           quota: {
             http: Object.fromEntries(
-              Object.entries($asai.connectionshttp || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _486 => _486.size]) || 0])
+              Object.entries($asai.connectionshttp || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _506 => _506.size]) || 0])
             ),
             ws: Object.fromEntries(
-              Object.entries($asai.connectionsws || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _487 => _487.size]) || 0])
+              Object.entries($asai.connectionsws || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _507 => _507.size]) || 0])
             )
           }
         },
@@ -3832,7 +3918,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, sanitizeString, "sanitizeString");
 // src/sysserver/api/login/service/session.ts
 function getSessionTtlMs($asai) {
-  const hours = _nullishCoalesce(_optionalChain([$asai, 'optionalAccess', _488 => _488.hostconfig, 'optionalAccess', _489 => _489.security, 'optionalAccess', _490 => _490.sessionTtlHours]), () => ( 24));
+  const hours = _nullishCoalesce(_optionalChain([$asai, 'optionalAccess', _508 => _508.hostconfig, 'optionalAccess', _509 => _509.security, 'optionalAccess', _510 => _510.sessionTtlHours]), () => ( 24));
   return Number(hours) * 3600 * 1e3;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSessionTtlMs, "getSessionTtlMs");
@@ -3849,7 +3935,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, generatePriKey, "generatePriKey");
 function createSessionKeys($asai) {
   const sessionId = _crypto.randomUUID.call(void 0, );
   const pri = generatePriKey();
-  const sn = _optionalChain([$asai, 'optionalAccess', _491 => _491.hostconfig, 'optionalAccess', _492 => _492.asaisn]);
+  const sn = _optionalChain([$asai, 'optionalAccess', _511 => _511.hostconfig, 'optionalAccess', _512 => _512.asaisn]);
   if (!sn) throw new Error("[session] ASAI_ASAISN \u672A\u914D\u7F6E");
   const pub = $asai.$lib.AsCode.asencode(pri, sn);
   return { pri, pub, sessionId };
@@ -3899,20 +3985,20 @@ function unwrapJsonString(value) {
   if (!text.startsWith("{") && !text.startsWith("[")) return value;
   try {
     return JSON.parse(text);
-  } catch (e38) {
+  } catch (e42) {
     return value;
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, unwrapJsonString, "unwrapJsonString");
 function parseAuthBody(opt) {
-  let raw = _optionalChain([opt, 'optionalAccess', _493 => _493.data]);
+  let raw = _optionalChain([opt, 'optionalAccess', _513 => _513.data]);
   if (raw == null || raw === "") return {};
   if (typeof raw === "string") {
     const text = raw.trim();
     if (!text) return {};
     try {
       raw = JSON.parse(text);
-    } catch (e39) {
+    } catch (e43) {
       if (text.includes("=") && !text.startsWith("{") && !text.startsWith("[")) {
         raw = Object.fromEntries(new URLSearchParams(text));
       } else {
@@ -3981,7 +4067,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, purgeOfflineSessions, "purgeOfflineSession
 // src/sysserver/api/login/index.ts
 function getSecurity($asai) {
-  return _optionalChain([$asai, 'optionalAccess', _494 => _494.hostconfig, 'optionalAccess', _495 => _495.security]) || {};
+  return _optionalChain([$asai, 'optionalAccess', _514 => _514.hostconfig, 'optionalAccess', _515 => _515.security]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSecurity, "getSecurity");
 function getQuota2($asai) {
@@ -3994,7 +4080,7 @@ async function canLogin($asai, us, hostdir) {
   if (!quota.enabled) return { ok: true };
   const store = _chunkZK4O4Z2Ocjs.createUserStore.call(void 0, $asai);
   const total = await countOnlineSessions($asai, hostdir, store);
-  const maxLogin = _nullishCoalesce(_nullishCoalesce(quota.maxLoginSessions, () => ( _optionalChain([$asai, 'optionalAccess', _496 => _496.hostconfig, 'optionalAccess', _497 => _497.hosts, 'optionalAccess', _498 => _498.default, 'optionalAccess', _499 => _499.maxonline]))), () => ( 100));
+  const maxLogin = _nullishCoalesce(_nullishCoalesce(quota.maxLoginSessions, () => ( _optionalChain([$asai, 'optionalAccess', _516 => _516.hostconfig, 'optionalAccess', _517 => _517.hosts, 'optionalAccess', _518 => _518.default, 'optionalAccess', _519 => _519.maxonline]))), () => ( 100));
   if (total >= maxLogin) {
     return { ok: false, message: "LOGIN_QUOTA_FULL" };
   }
@@ -4027,7 +4113,7 @@ function ensureReady($asai) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, ensureReady, "ensureReady");
 var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail, sendErr } = _optionalChain([$asai, 'access', _500 => _500.$lib, 'optionalAccess', _501 => _501.reqWork, 'optionalCall', _502 => _502($asai)]) || {};
+  const { sendSuccess, sendFail, sendErr } = _optionalChain([$asai, 'access', _520 => _520.$lib, 'optionalAccess', _521 => _521.reqWork, 'optionalCall', _522 => _522($asai)]) || {};
   const store = _chunkZK4O4Z2Ocjs.createUserStore.call(void 0, $asai);
   async function checkAdmin(req, pathname, minOverride) {
     await attachServerUserLevel(req, $asai);
@@ -4068,7 +4154,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "password_changed" });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _503 => _503.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _523 => _523.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/register/")) {
@@ -4101,11 +4187,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "register_ok" });
         return sendSuccess(res, { user: publicUser($asai, user) }, opt);
       } catch (err) {
-        const msg = _optionalChain([err, 'optionalAccess', _504 => _504.message]) || String(err);
+        const msg = _optionalChain([err, 'optionalAccess', _524 => _524.message]) || String(err);
         if (msg.includes("exists") || msg.includes("\u5DF2\u5B58\u5728")) {
           return sendErr(res, "USER_ALREADY_EXISTS", void 0, opt);
         }
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _505 => _505.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _525 => _525.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/auth/")) {
@@ -4139,9 +4225,15 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         const policy = _chunkGXOFLFFWcjs.getPasswordPolicy.call(void 0, $asai);
         const mustChange = !!user.mustChangePassword || _chunkGXOFLFFWcjs.isPasswordExpired.call(void 0, user.passwordChangedAt, policy.maxAgeDays);
-        const hostcfg = _optionalChain([$asai, 'access', _506 => _506.getHost, 'optionalCall', _507 => _507(hostdir)]) || {};
-        if (hostcfg.ckws && isUserOnlineOnWs($asai, us, hostdir)) {
-          kickUserWs($asai, us, hostdir);
+        const hostcfg = _optionalChain([$asai, 'access', _526 => _526.getHost, 'optionalCall', _527 => _527(hostdir)]) || {};
+        if (hostcfg.ckws) {
+          const existingWs = _optionalChain([$asai, 'access', _528 => _528.connectionsws, 'optionalAccess', _529 => _529[hostdir], 'optionalAccess', _530 => _530[us]]);
+          if (existingWs) {
+            const cleared = await clearStaleWsIfDead($asai, hostdir, us, existingWs);
+            if (!cleared) {
+              kickUserWs($asai, us, hostdir);
+            }
+          }
         }
         const quotaCheck = await canLogin($asai, us, hostdir);
         if (!quotaCheck.ok) {
@@ -4164,13 +4256,13 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           opt
         );
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _508 => _508.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _531 => _531.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/logout/")) {
       try {
         const bodySid = body.sessionId ? sanitizeString(body.sessionId, 64) : "";
-        const us = _optionalChain([req, 'optionalAccess', _509 => _509.Userinfo, 'optionalAccess', _510 => _510[0]]);
+        const us = _optionalChain([req, 'optionalAccess', _532 => _532.Userinfo, 'optionalAccess', _533 => _533[0]]);
         if (bodySid) {
           if (!us) {
             return sendErr(res, "AUTH_MISSING", void 0, opt);
@@ -4184,7 +4276,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (us) logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: String(us), ip, detail: "logout" });
         return sendSuccess(res, "ok", opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _511 => _511.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _534 => _534.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/kick/")) {
@@ -4202,7 +4294,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         kickUserWs($asai, target.us, hostdir);
         await store.removeSession(sessionId);
-        const operator = String(_optionalChain([req, 'optionalAccess', _512 => _512.Userinfo, 'optionalAccess', _513 => _513[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _535 => _535.Userinfo, 'optionalAccess', _536 => _536[0]]) || "");
         await _chunkARHPHWT5cjs.logSessionTerminate.call(void 0, $asai, {
           operator,
           sessionId,
@@ -4211,7 +4303,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _514 => _514.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _537 => _537.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/delete/")) {
@@ -4223,11 +4315,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (!targetUs || targetUs === "admin") return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
         const ok = await store.deleteUser(targetUs);
         if (!ok) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        const operator = String(_optionalChain([req, 'optionalAccess', _515 => _515.Userinfo, 'optionalAccess', _516 => _516[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _538 => _538.Userinfo, 'optionalAccess', _539 => _539[0]]) || "");
         await _chunkARHPHWT5cjs.logAccountPurge.call(void 0, $asai, { operator, targetUs, ip });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _517 => _517.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _540 => _540.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/levels/")) {
@@ -4239,7 +4331,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const thresholds = body.thresholds && typeof body.thresholds === "object" ? body.thresholds : void 0;
         const routeRights = Array.isArray(body.routeRights) ? body.routeRights : void 0;
         const defaultResetPassword = typeof body.defaultResetPassword === "string" ? body.defaultResetPassword : void 0;
-        const operator = String(_optionalChain([req, 'optionalAccess', _518 => _518.Userinfo, 'optionalAccess', _519 => _519[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _541 => _541.Userinfo, 'optionalAccess', _542 => _542[0]]) || "");
         const cfg = await _chunkGXOFLFFWcjs.saveUserLevelConfig.call(void 0,
           $asai,
           {
@@ -4252,13 +4344,13 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         );
         await _chunkARHPHWT5cjs.logSecurityConfigIntervention.call(void 0, $asai, {
           section: "user_levels",
-          detail: JSON.stringify({ levels: _optionalChain([levels, 'optionalAccess', _520 => _520.length]), thresholds: !!thresholds, routeRights: _optionalChain([routeRights, 'optionalAccess', _521 => _521.length]) }),
+          detail: JSON.stringify({ levels: _optionalChain([levels, 'optionalAccess', _543 => _543.length]), thresholds: !!thresholds, routeRights: _optionalChain([routeRights, 'optionalAccess', _544 => _544.length]) }),
           operator,
           ip
         });
         return sendSuccess(res, cfg, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _522 => _522.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _545 => _545.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/resetpass/")) {
@@ -4292,7 +4384,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           passHistory: "[]"
         });
         if (!updated) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        const operator = String(_optionalChain([req, 'optionalAccess', _523 => _523.Userinfo, 'optionalAccess', _524 => _524[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _546 => _546.Userinfo, 'optionalAccess', _547 => _547[0]]) || "");
         await _chunkARHPHWT5cjs.logUserRbacChange.call(void 0, $asai, {
           operator,
           targetUs,
@@ -4309,7 +4401,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         });
         return sendSuccess(res, { user: publicUser($asai, updated) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _525 => _525.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _548 => _548.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/update/")) {
@@ -4340,7 +4432,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (!updated) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
         if (Object.keys(patch).length) {
           await _chunkARHPHWT5cjs.logUserRbacChange.call(void 0, $asai, {
-            operator: String(_optionalChain([req, 'optionalAccess', _526 => _526.Userinfo, 'optionalAccess', _527 => _527[0]]) || ""),
+            operator: String(_optionalChain([req, 'optionalAccess', _549 => _549.Userinfo, 'optionalAccess', _550 => _550[0]]) || ""),
             targetUs,
             patch,
             ip
@@ -4348,11 +4440,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         return sendSuccess(res, { user: publicUser($asai, updated) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _528 => _528.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _551 => _551.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/profile/")) {
-      const us = _optionalChain([req, 'optionalAccess', _529 => _529.Userinfo, 'optionalAccess', _530 => _530[0]]);
+      const us = _optionalChain([req, 'optionalAccess', _552 => _552.Userinfo, 'optionalAccess', _553 => _553[0]]);
       if (!us) return sendErr(res, "AUTH_UNAUTHORIZED", void 0, opt);
       try {
         const user = await store.findByUsername(String(us));
@@ -4386,7 +4478,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const fresh = await store.findByUsername(String(us));
         return sendSuccess(res, { user: fresh ? publicUser($asai, fresh) : null }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _531 => _531.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _554 => _554.message]) || err, opt);
       }
     }
   }
@@ -4395,7 +4487,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     const url = req.url || "";
     const ip = getClientIp(req);
     if (url.startsWith("/api/user/login/config/")) {
-      const lang = String(_optionalChain([req, 'optionalAccess', _532 => _532.headers, 'optionalAccess', _533 => _533["accept-language"]]) || _optionalChain([opt, 'optionalAccess', _534 => _534.headers, 'optionalAccess', _535 => _535["accept-language"]]) || "zh-CN").split(",")[0];
+      const lang = String(_optionalChain([req, 'optionalAccess', _555 => _555.headers, 'optionalAccess', _556 => _556["accept-language"]]) || _optionalChain([opt, 'optionalAccess', _557 => _557.headers, 'optionalAccess', _558 => _558["accept-language"]]) || "zh-CN").split(",")[0];
       await _chunkGXOFLFFWcjs.loadUserLevelConfig.call(void 0, $asai);
       return sendSuccess(res, _chunkGXOFLFFWcjs.getPublicSecurityConfig.call(void 0, $asai, lang), opt);
     }
@@ -4456,7 +4548,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
       );
     }
     if (url.startsWith("/api/user/login/profile/")) {
-      const us = _optionalChain([req, 'optionalAccess', _536 => _536.Userinfo, 'optionalAccess', _537 => _537[0]]);
+      const us = _optionalChain([req, 'optionalAccess', _559 => _559.Userinfo, 'optionalAccess', _560 => _560[0]]);
       if (!us) return sendErr(res, "AUTH_UNAUTHORIZED", void 0, opt);
       const user = await store.findByUsername(String(us));
       return sendSuccess(res, { user: user ? publicUser($asai, user) : null }, opt);
@@ -4498,16 +4590,16 @@ var As_default = {
     return { code: 908, data: val };
   },
   ctxSuccess(val, opt = null) {
-    if (typeof _optionalChain([opt, 'optionalAccess', _538 => _538.resAES]) === "function") {
+    if (typeof _optionalChain([opt, 'optionalAccess', _561 => _561.resAES]) === "function") {
       val = opt.resAES(val);
     }
     return { code: 909, data: val };
   },
   getPath(str = "-") {
-    return _optionalChain([str, 'optionalAccess', _539 => _539.replace, 'call', _540 => _540(/[^a-zA-Z0-9.\-_\\\/]/g, "")]);
+    return _optionalChain([str, 'optionalAccess', _562 => _562.replace, 'call', _563 => _563(/[^a-zA-Z0-9.\-_\\\/]/g, "")]);
   },
   getName(str = "-") {
-    return _optionalChain([str, 'optionalAccess', _541 => _541.replace, 'call', _542 => _542(/[^a-zA-Z0-9.\-_]/g, "")]);
+    return _optionalChain([str, 'optionalAccess', _564 => _564.replace, 'call', _565 => _565(/[^a-zA-Z0-9.\-_]/g, "")]);
   },
   toDirPath(relativePath) {
     const pathArr = relativePath.split("/");
@@ -4543,10 +4635,10 @@ var As_default = {
     return absPath;
   },
   makeDir(fs11, filePaths) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       try {
         const newPath = this.ensureDir(fs11, filePaths);
-        resolve5(newPath);
+        resolve6(newPath);
       } catch (err) {
         reject(err);
       }
@@ -4578,7 +4670,7 @@ var As_default = {
   //     immediate: false,
   // });
   dtImmediate(fn, opt) {
-    if (_optionalChain([opt, 'optionalAccess', _543 => _543.immediate])) {
+    if (_optionalChain([opt, 'optionalAccess', _566 => _566.immediate])) {
       fn();
       opt.immediate = false;
     }
@@ -4600,7 +4692,7 @@ var As_default = {
     if (opt.endtime - opt.starttime < opt.wait) {
       this.dtClearTimeout(opt);
     }
-    if (!_optionalChain([opt, 'optionalAccess', _544 => _544.timeout])) {
+    if (!_optionalChain([opt, 'optionalAccess', _567 => _567.timeout])) {
       opt.starttime = opt.endtime;
       opt.timeout = this.dtSetTimeout(fn, opt);
     }
@@ -4608,7 +4700,7 @@ var As_default = {
   // 节流:指定长度时间内有多次触发，只fn最后一次触发
   throttle(fn, opt) {
     this.dtImmediate(fn, opt);
-    if (!_optionalChain([opt, 'optionalAccess', _545 => _545.timeout])) {
+    if (!_optionalChain([opt, 'optionalAccess', _568 => _568.timeout])) {
       opt.timeout = this.dtSetTimeout(fn, opt);
     }
   },
@@ -4644,8 +4736,8 @@ var As_default = {
 var AsCode_default = {
   // 加密
   asencode(str, keys) {
-    const strlen = _optionalChain([str, 'optionalAccess', _546 => _546.length]) || 0;
-    const keyslen = _optionalChain([keys, 'optionalAccess', _547 => _547.length]) || 0;
+    const strlen = _optionalChain([str, 'optionalAccess', _569 => _569.length]) || 0;
+    const keyslen = _optionalChain([keys, 'optionalAccess', _570 => _570.length]) || 0;
     let newstr = "";
     for (let i = 0; i < strlen; i++) {
       const rnum = Math.round(Math.random() * 1e3) % keyslen;
@@ -4670,7 +4762,7 @@ var AsCode_default = {
         const rnum = keys.indexOf(str[i + 3]);
         const rnumx = Number(rnum.toString().slice(-1)) + 1;
         const ylen = keyslen - rnumx;
-        newstr += _optionalChain([String, 'optionalAccess', _548 => _548.fromCodePoint, 'call', _549 => _549(
+        newstr += _optionalChain([String, 'optionalAccess', _571 => _571.fromCodePoint, 'call', _572 => _572(
           (keys.indexOf(str[i++]) - rnumx) * ylen * ylen + (keys.indexOf(str[i++]) - rnumx) * ylen + (keys.indexOf(str[i++]) - rnumx)
         )]);
       }
@@ -4717,7 +4809,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     if (typeof value !== "string") return value;
     try {
       return JSON.parse(value);
-    } catch (e40) {
+    } catch (e44) {
       return value;
     }
   }
@@ -4753,7 +4845,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, decrypt, "decrypt");
   function validateFields(payload, fields) {
-    return fields.every((key) => typeof _optionalChain([payload, 'optionalAccess', _550 => _550[key]]) === "string" && payload[key].length > 0);
+    return fields.every((key) => typeof _optionalChain([payload, 'optionalAccess', _573 => _573[key]]) === "string" && payload[key].length > 0);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, validateFields, "validateFields");
   function reqAES(opt, fn = (data) => data) {
@@ -4761,7 +4853,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     try {
       if (validateFields(reqData, ["data", "iv", "auth"])) {
         let aesData = decrypt(reqData);
-        if (_optionalChain([reqData, 'optionalAccess', _551 => _551.aes]) === 2) {
+        if (_optionalChain([reqData, 'optionalAccess', _574 => _574.aes]) === 2) {
           aesData = JSON.parse(aesData);
         }
         return fn(aesData);
@@ -4795,24 +4887,24 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
 // src/sysserver/lib/common/AsDb.ts
 var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, cfg) => {
   const DataServer = _chunk2BCIIKRGcjs.getDataServerForAsDb.call(void 0, $asai, {
-    type: _optionalChain([cfg, 'optionalAccess', _552 => _552.type]) || "sqlite",
+    type: _optionalChain([cfg, 'optionalAccess', _575 => _575.type]) || "sqlite",
     opt: {
-      ..._optionalChain([cfg, 'optionalAccess', _553 => _553.opt]) || {
+      ..._optionalChain([cfg, 'optionalAccess', _576 => _576.opt]) || {
         database: "./webdata/webdb/sqlite/asaisqlite.db",
         create: 1
       }
     },
-    storeKey: _optionalChain([cfg, 'optionalAccess', _554 => _554.storeKey])
+    storeKey: _optionalChain([cfg, 'optionalAccess', _577 => _577.storeKey])
   });
   function reqwherestr(str) {
-    if (_optionalChain([cfg, 'optionalAccess', _555 => _555.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _556 => _556.type]) === "mysql") {
+    if (_optionalChain([cfg, 'optionalAccess', _578 => _578.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _579 => _579.type]) === "mysql") {
       return `'${str}'`;
     }
     return str;
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqwherestr, "reqwherestr");
   function reqfield(queryData) {
-    if (_optionalChain([queryData, 'optionalAccess', _557 => _557.fd])) {
+    if (_optionalChain([queryData, 'optionalAccess', _580 => _580.fd])) {
       return queryData.fd.split("-");
     }
     return cfg.field.data;
@@ -4820,14 +4912,14 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqfield, "reqfield");
   function reqwhere(queryData) {
     const wheretmp = [];
-    if ((_optionalChain([cfg, 'optionalAccess', _558 => _558.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _559 => _559.type]) === "mysql") && _optionalChain([queryData, 'optionalAccess', _560 => _560.wlv])) {
+    if ((_optionalChain([cfg, 'optionalAccess', _581 => _581.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _582 => _582.type]) === "mysql") && _optionalChain([queryData, 'optionalAccess', _583 => _583.wlv])) {
       const wlvarr = queryData.wlv.split("-");
       wheretmp.push([wlvarr[0], ">", Number(wlvarr[1] || 0)]);
     }
-    if (_optionalChain([queryData, 'optionalAccess', _561 => _561.fl])) {
+    if (_optionalChain([queryData, 'optionalAccess', _584 => _584.fl])) {
       wheretmp.push([cfg.field.class, "LIKE", reqwherestr(`${queryData.fl}%`)]);
     }
-    if (_optionalChain([queryData, 'optionalAccess', _562 => _562.ss]) && _optionalChain([queryData, 'optionalAccess', _563 => _563.ssty])) {
+    if (_optionalChain([queryData, 'optionalAccess', _585 => _585.ss]) && _optionalChain([queryData, 'optionalAccess', _586 => _586.ssty])) {
       wheretmp.push([queryData.ssty, "LIKE", reqwherestr(`%${queryData.ss}%`)]);
     }
     if (wheretmp.length > 1) {
@@ -4838,16 +4930,16 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqwhere, "reqwhere");
   function reqorder(queryData) {
     const ordertmp = [];
-    if (_optionalChain([queryData, 'optionalAccess', _564 => _564.sx])) {
-      ordertmp.push([queryData.sx, _optionalChain([queryData, 'optionalAccess', _565 => _565.sxty]) == 1 ? "DESC" : "ASC"]);
+    if (_optionalChain([queryData, 'optionalAccess', _587 => _587.sx])) {
+      ordertmp.push([queryData.sx, _optionalChain([queryData, 'optionalAccess', _588 => _588.sxty]) == 1 ? "DESC" : "ASC"]);
     }
     return ordertmp;
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqorder, "reqorder");
   function reqlimit(queryData) {
     let limittmp = "";
-    let limitps = _optionalChain([queryData, 'optionalAccess', _566 => _566.ps]);
-    if (_optionalChain([queryData, 'optionalAccess', _567 => _567.pg])) {
+    let limitps = _optionalChain([queryData, 'optionalAccess', _589 => _589.ps]);
+    if (_optionalChain([queryData, 'optionalAccess', _590 => _590.pg])) {
       limitps = limitps || 20;
       limittmp = `${(queryData.pg - 1) * limitps},${limitps}`;
     } else if (limitps) {
@@ -4859,7 +4951,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   function decodePathSegment(seg) {
     try {
       return decodeURIComponent(seg);
-    } catch (e41) {
+    } catch (e45) {
       return seg;
     }
   }
@@ -4875,7 +4967,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     if (typeof body === "string") {
       try {
         body = JSON.parse(body);
-      } catch (e42) {
+      } catch (e46) {
         return { content: body };
       }
     }
@@ -4900,8 +4992,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, fileKeyFromSegment, "fileKeyFromSegment");
   function getSqlParamsByUrl(req, opt) {
     let tmpSqlParams;
-    const reqArr = _optionalChain([req, 'optionalAccess', _568 => _568.url, 'optionalAccess', _569 => _569.split, 'call', _570 => _570("?"), 'access', _571 => _571[0], 'optionalAccess', _572 => _572.split, 'call', _573 => _573("/")]) || [];
-    const table = (_optionalChain([opt, 'optionalAccess', _574 => _574.qrdata, 'optionalAccess', _575 => _575.table]) || _optionalChain([opt, 'optionalAccess', _576 => _576.data, 'optionalAccess', _577 => _577.table]) || reqArr[3]).replaceAll("_", "/");
+    const reqArr = _optionalChain([req, 'optionalAccess', _591 => _591.url, 'optionalAccess', _592 => _592.split, 'call', _593 => _593("?"), 'access', _594 => _594[0], 'optionalAccess', _595 => _595.split, 'call', _596 => _596("/")]) || [];
+    const table = (_optionalChain([opt, 'optionalAccess', _597 => _597.qrdata, 'optionalAccess', _598 => _598.table]) || _optionalChain([opt, 'optionalAccess', _599 => _599.data, 'optionalAccess', _600 => _600.table]) || reqArr[3]).replaceAll("_", "/");
     if (!table) return tmpSqlParams;
     tmpSqlParams = {
       type: "select",
@@ -4910,7 +5002,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     if (reqArr[5]) {
       if (reqArr[4] === "insert") {
         tmpSqlParams.type = reqArr[4];
-        if (_optionalChain([cfg, 'optionalAccess', _578 => _578.type]) === "file") {
+        if (_optionalChain([cfg, 'optionalAccess', _601 => _601.type]) === "file") {
           const { name: bodyName, content } = parseFileBody(opt.data);
           const fileKey = fileKeyFromSegment(reqArr[5], bodyName);
           tmpSqlParams.field = cfg.field.data;
@@ -4934,11 +5026,11 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         }
       } else if (reqArr[4] === "update") {
         tmpSqlParams.type = reqArr[4];
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _579 => _579.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _602 => _602.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
-        if (_optionalChain([cfg, 'optionalAccess', _580 => _580.type]) === "file") {
+        if (_optionalChain([cfg, 'optionalAccess', _603 => _603.type]) === "file") {
           const { content } = parseFileBody(opt.data);
-          const contentField = _optionalChain([cfg, 'access', _581 => _581.field, 'access', _582 => _582.data, 'optionalAccess', _583 => _583[1]]) || "content";
+          const contentField = _optionalChain([cfg, 'access', _604 => _604.field, 'access', _605 => _605.data, 'optionalAccess', _606 => _606[1]]) || "content";
           tmpSqlParams.set = [[contentField, fileContentString(content)]];
         } else {
           tmpSqlParams.set = [];
@@ -4955,18 +5047,18 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         }
       } else if (reqArr[4] === "delete") {
         tmpSqlParams.type = reqArr[4];
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _584 => _584.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _607 => _607.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       } else {
-        if (_optionalChain([cfg, 'optionalAccess', _585 => _585.as]) > 1) {
+        if (_optionalChain([cfg, 'optionalAccess', _608 => _608.as]) > 1) {
           tmpSqlParams.as = +cfg.as - 1;
         }
         tmpSqlParams.field = cfg.field.data;
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _586 => _586.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _609 => _609.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       }
     } else {
-      tmpSqlParams.as = _optionalChain([cfg, 'optionalAccess', _587 => _587.as]);
+      tmpSqlParams.as = _optionalChain([cfg, 'optionalAccess', _610 => _610.as]);
       tmpSqlParams.field = reqfield(opt.data);
       tmpSqlParams.where = reqwhere(opt.data);
       tmpSqlParams.order = reqorder(opt.data);
@@ -4976,8 +5068,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getSqlParamsByUrl, "getSqlParamsByUrl");
   function dbFresh(req, resdb) {
-    if (_optionalChain([req, 'optionalAccess', _588 => _588.url, 'optionalAccess', _589 => _589.includes, 'call', _590 => _590("/selectlist/")])) {
-      const list = Array.isArray(resdb) ? resdb : _optionalChain([resdb, 'optionalAccess', _591 => _591.data]);
+    if (_optionalChain([req, 'optionalAccess', _611 => _611.url, 'optionalAccess', _612 => _612.includes, 'call', _613 => _613("/selectlist/")])) {
+      const list = Array.isArray(resdb) ? resdb : _optionalChain([resdb, 'optionalAccess', _614 => _614.data]);
       if (Array.isArray(list)) {
         const names = list.map((el) => {
           if (typeof el === "string") {
@@ -4999,8 +5091,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, dbFresh, "dbFresh");
   function normalizeFileSelectRow(row) {
-    const nameKey = _optionalChain([cfg, 'access', _592 => _592.field, 'optionalAccess', _593 => _593.data, 'optionalAccess', _594 => _594[0]]) || "name";
-    const contentKey = _optionalChain([cfg, 'access', _595 => _595.field, 'optionalAccess', _596 => _596.data, 'optionalAccess', _597 => _597[1]]) || "content";
+    const nameKey = _optionalChain([cfg, 'access', _615 => _615.field, 'optionalAccess', _616 => _616.data, 'optionalAccess', _617 => _617[0]]) || "name";
+    const contentKey = _optionalChain([cfg, 'access', _618 => _618.field, 'optionalAccess', _619 => _619.data, 'optionalAccess', _620 => _620[1]]) || "content";
     if (!row || typeof row !== "object") return row;
     const out = { ...row };
     if (out[nameKey] != null) {
@@ -5014,7 +5106,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeFileSelectRow, "normalizeFileSelectRow");
   function isFileSingleNameSelect(params) {
-    return _optionalChain([cfg, 'optionalAccess', _598 => _598.type]) === "file" && _optionalChain([params, 'optionalAccess', _599 => _599.type]) === "select" && !!_optionalChain([params, 'optionalAccess', _600 => _600.where, 'optionalAccess', _601 => _601.length]);
+    return _optionalChain([cfg, 'optionalAccess', _621 => _621.type]) === "file" && _optionalChain([params, 'optionalAccess', _622 => _622.type]) === "select" && !!_optionalChain([params, 'optionalAccess', _623 => _623.where, 'optionalAccess', _624 => _624.length]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, isFileSingleNameSelect, "isFileSingleNameSelect");
   function normalizeSelectResult(params, resdb) {
@@ -5028,12 +5120,12 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       }
       return data;
     }
-    if (_optionalChain([params, 'optionalAccess', _602 => _602.where, 'optionalAccess', _603 => _603.length]) && Array.isArray(data) && data.length === 1) {
+    if (_optionalChain([params, 'optionalAccess', _625 => _625.where, 'optionalAccess', _626 => _626.length]) && Array.isArray(data) && data.length === 1) {
       data = data[0];
     }
-    if (_optionalChain([cfg, 'optionalAccess', _604 => _604.type]) === "file" && data && typeof data === "object" && !Array.isArray(data)) {
-      const nameKey = _optionalChain([cfg, 'access', _605 => _605.field, 'optionalAccess', _606 => _606.data, 'optionalAccess', _607 => _607[0]]) || "name";
-      const contentKey = _optionalChain([cfg, 'access', _608 => _608.field, 'optionalAccess', _609 => _609.data, 'optionalAccess', _610 => _610[1]]) || "content";
+    if (_optionalChain([cfg, 'optionalAccess', _627 => _627.type]) === "file" && data && typeof data === "object" && !Array.isArray(data)) {
+      const nameKey = _optionalChain([cfg, 'access', _628 => _628.field, 'optionalAccess', _629 => _629.data, 'optionalAccess', _630 => _630[0]]) || "name";
+      const contentKey = _optionalChain([cfg, 'access', _631 => _631.field, 'optionalAccess', _632 => _632.data, 'optionalAccess', _633 => _633[1]]) || "content";
       if (data[nameKey] != null) {
         data[nameKey] = bareFileName(String(data[nameKey]));
       }
@@ -5043,7 +5135,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         if (text.startsWith("{") || text.startsWith("[")) {
           try {
             data[contentKey] = JSON.parse(text);
-          } catch (e43) {
+          } catch (e47) {
           }
         }
       }
@@ -5052,7 +5144,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeSelectResult, "normalizeSelectResult");
   function dbCodePm(req, resdb) {
-    if (_optionalChain([req, 'optionalAccess', _611 => _611.Userinfo]) && _optionalChain([req, 'optionalAccess', _612 => _612.Userinfo, 'access', _613 => _613[2]])) {
+    if (_optionalChain([req, 'optionalAccess', _634 => _634.Userinfo]) && _optionalChain([req, 'optionalAccess', _635 => _635.Userinfo, 'access', _636 => _636[2]])) {
       if (resdb != null && typeof resdb === "object") {
         resdb.data = $asai.$lib.AsCode.asencode(JSON.stringify(resdb.data), req.Userinfo[2]);
       }
@@ -5066,8 +5158,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       DataServer.sqlDb(params).then((resdb) => {
         res.end(JSON.stringify($asai.$lib.As.ctxSuccess(dbCodePm(req, dbFresh(req, resdb)), opt)));
       }).catch((errdb) => {
-        const msg = String(_optionalChain([errdb, 'optionalAccess', _614 => _614.message]) || errdb || "");
-        if (_optionalChain([params, 'optionalAccess', _615 => _615.type]) === "select" && msg.includes("no such table")) {
+        const msg = String(_optionalChain([errdb, 'optionalAccess', _637 => _637.message]) || errdb || "");
+        if (_optionalChain([params, 'optionalAccess', _638 => _638.type]) === "select" && msg.includes("no such table")) {
           res.end(JSON.stringify($asai.$lib.As.ctxSuccess([], opt)));
           return;
         }
@@ -5084,29 +5176,29 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       try {
         DataServer.sqlDb(params).then((resdb) => {
           let resData = normalizeSelectResult(params, dbFresh(req, resdb));
-          if (_optionalChain([params, 'optionalAccess', _616 => _616.as]) === 2 && _optionalChain([params, 'optionalAccess', _617 => _617.field, 'optionalAccess', _618 => _618.length]) > 1) {
+          if (_optionalChain([params, 'optionalAccess', _639 => _639.as]) === 2 && _optionalChain([params, 'optionalAccess', _640 => _640.field, 'optionalAccess', _641 => _641.length]) > 1) {
             let limitArr = [];
-            if (_optionalChain([params, 'access', _619 => _619.limit, 'optionalAccess', _620 => _620.split, 'call', _621 => _621(","), 'optionalAccess', _622 => _622.length]) < 2) {
-              limitArr = [0, +_optionalChain([params, 'access', _623 => _623.limit, 'optionalAccess', _624 => _624.split, 'call', _625 => _625(","), 'optionalAccess', _626 => _626[0]])];
+            if (_optionalChain([params, 'access', _642 => _642.limit, 'optionalAccess', _643 => _643.split, 'call', _644 => _644(","), 'optionalAccess', _645 => _645.length]) < 2) {
+              limitArr = [0, +_optionalChain([params, 'access', _646 => _646.limit, 'optionalAccess', _647 => _647.split, 'call', _648 => _648(","), 'optionalAccess', _649 => _649[0]])];
             } else {
               limitArr = params.limit.split(",");
               limitArr = [+limitArr[0], +limitArr[0] + +limitArr[1]];
             }
-            if (_optionalChain([resData, 'access', _627 => _627.data, 'optionalAccess', _628 => _628.length])) {
+            if (_optionalChain([resData, 'access', _650 => _650.data, 'optionalAccess', _651 => _651.length])) {
               resData.data = resData.data.slice(+limitArr[0], +limitArr[1]);
             }
           }
           resData = dbCodePm(req, resData);
           res.end(JSON.stringify($asai.$lib.As.ctxSuccess(resData, opt)));
         }).catch((errdb) => {
-          const msg = String(_optionalChain([errdb, 'optionalAccess', _629 => _629.message]) || errdb || "");
-          if (_optionalChain([params, 'optionalAccess', _630 => _630.type]) === "select" && msg.includes("no such table")) {
+          const msg = String(_optionalChain([errdb, 'optionalAccess', _652 => _652.message]) || errdb || "");
+          if (_optionalChain([params, 'optionalAccess', _653 => _653.type]) === "select" && msg.includes("no such table")) {
             res.end(JSON.stringify($asai.$lib.As.ctxSuccess([], opt)));
             return;
           }
           res.end(JSON.stringify($asai.$lib.As.ctxFail(errdb)));
         });
-      } catch (e44) {
+      } catch (e48) {
         res.end(JSON.stringify({ code: 901 }));
       }
     } else {
@@ -5115,7 +5207,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, runDefaultGet, "runDefaultGet");
   function post(req, res, hostdir, opt) {
-    if (_optionalChain([cfg, 'optionalAccess', _631 => _631.post]) && typeof cfg.post === "function") {
+    if (_optionalChain([cfg, 'optionalAccess', _654 => _654.post]) && typeof cfg.post === "function") {
       Promise.resolve(cfg.post(req, res, hostdir, opt, DataServer)).then((reqstat) => {
         if (!reqstat) runDefaultPost(req, res, opt);
       }).catch((errdb) => {
@@ -5127,7 +5219,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, post, "post");
   function get(req, res, hostdir, opt) {
-    if (_optionalChain([cfg, 'optionalAccess', _632 => _632.get]) && typeof cfg.get === "function") {
+    if (_optionalChain([cfg, 'optionalAccess', _655 => _655.get]) && typeof cfg.get === "function") {
       Promise.resolve(cfg.get(req, res, hostdir, opt, DataServer)).then((reqstat) => {
         if (!reqstat) runDefaultGet(req, res, opt);
       }).catch((errdb) => {
@@ -5142,6 +5234,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 }, "default");
 // src/sysserver/lib/common/reqWork.ts
 var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
   function hostDefault2(mod) {
     if (mod && typeof mod === "object" && "default" in mod) {
@@ -5152,17 +5245,30 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, hostDefault2, "hostDefault");
   function getPathFromOpt(opt) {
-    const rawPath = _optionalChain([opt, 'access', _633 => _633.qrdata, 'optionalAccess', _634 => _634.path]) || _optionalChain([opt, 'access', _635 => _635.data, 'optionalAccess', _636 => _636.path]);
+    const rawPath = _optionalChain([opt, 'access', _656 => _656.qrdata, 'optionalAccess', _657 => _657.path]) || _optionalChain([opt, 'access', _658 => _658.data, 'optionalAccess', _659 => _659.path]);
     if (!rawPath) {
       throw new Error("Missing path");
     }
     const decoded = decodeURIComponent(String(rawPath));
-    const roots = _optionalChain([$asai, 'optionalAccess', _637 => _637.asaihost, 'optionalAccess', _638 => _638.getHostAllowedRoots, 'optionalCall', _639 => _639(_optionalChain([$asai, 'optionalAccess', _640 => _640.hostconfig]))]) || [];
+    if (path4.isAbsolute(decoded)) {
+      return path4.normalize(decoded);
+    }
+    const rel = decoded.replace(/^\.(\/)?/, "");
+    const serverRoot = _optionalChain([$asai, 'optionalAccess', _660 => _660.serverRoot]);
+    if (serverRoot && rel) {
+      const absRoot = path4.resolve(serverRoot);
+      const abs = path4.resolve(absRoot, rel);
+      const relCheck = path4.relative(absRoot, abs);
+      if (relCheck === "" || !relCheck.startsWith("..") && !path4.isAbsolute(relCheck)) {
+        return abs;
+      }
+    }
+    const roots = _optionalChain([$asai, 'optionalAccess', _661 => _661.asaihost, 'optionalAccess', _662 => _662.getHostAllowedRoots, 'optionalCall', _663 => _663(_optionalChain([$asai, 'optionalAccess', _664 => _664.hostconfig]))]) || [];
     if (!roots.length) {
-      const fallback = _optionalChain([$asai, 'optionalAccess', _641 => _641.serverRoot]) || process.cwd();
+      const fallback = _optionalChain([$asai, 'optionalAccess', _665 => _665.serverRoot]) || process.cwd();
       if (fallback) roots.push(fallback);
     }
-    if (!_optionalChain([$asai, 'optionalAccess', _642 => _642.asaihost, 'optionalAccess', _643 => _643.resolvePathUnderRoots])) {
+    if (!_optionalChain([$asai, 'optionalAccess', _666 => _666.asaihost, 'optionalAccess', _667 => _667.resolvePathUnderRoots])) {
       throw new Error("Path resolver unavailable");
     }
     return $asai.asaihost.resolvePathUnderRoots(decoded, roots);
@@ -5174,18 +5280,18 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendSuccess, "sendSuccess");
   function sendErr(res, ec, params, opt) {
-    const ErrorCode = _optionalChain([$asai, 'access', _644 => _644.$lib, 'optionalAccess', _645 => _645.ErrorCode]);
-    _optionalChain([ErrorCode, 'optionalAccess', _646 => _646.loadErrorCodes, 'optionalCall', _647 => _647($asai)]);
-    _optionalChain([ErrorCode, 'optionalAccess', _648 => _648.logError, 'optionalCall', _649 => _649($asai, ec, Array.isArray(params) ? params.map(String) : params != null ? [String(params)] : void 0)]);
+    const ErrorCode = _optionalChain([$asai, 'access', _668 => _668.$lib, 'optionalAccess', _669 => _669.ErrorCode]);
+    _optionalChain([ErrorCode, 'optionalAccess', _670 => _670.loadErrorCodes, 'optionalCall', _671 => _671($asai)]);
+    _optionalChain([ErrorCode, 'optionalAccess', _672 => _672.logError, 'optionalCall', _673 => _673($asai, ec, Array.isArray(params) ? params.map(String) : params != null ? [String(params)] : void 0)]);
     const response = $asai.$lib.As.ctxErr(ec, params, opt);
     res.end(JSON.stringify(response));
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendErr, "sendErr");
   function sendFail(res, err, opt) {
-    const ErrorCode = _optionalChain([$asai, 'access', _650 => _650.$lib, 'optionalAccess', _651 => _651.ErrorCode]);
-    _optionalChain([ErrorCode, 'optionalAccess', _652 => _652.loadErrorCodes, 'optionalCall', _653 => _653($asai)]);
-    const normalized = _optionalChain([ErrorCode, 'optionalAccess', _654 => _654.normalizeErrPayload, 'optionalCall', _655 => _655(err)]);
-    if (_optionalChain([normalized, 'optionalAccess', _656 => _656.ec])) {
+    const ErrorCode = _optionalChain([$asai, 'access', _674 => _674.$lib, 'optionalAccess', _675 => _675.ErrorCode]);
+    _optionalChain([ErrorCode, 'optionalAccess', _676 => _676.loadErrorCodes, 'optionalCall', _677 => _677($asai)]);
+    const normalized = _optionalChain([ErrorCode, 'optionalAccess', _678 => _678.normalizeErrPayload, 'optionalCall', _679 => _679(err)]);
+    if (_optionalChain([normalized, 'optionalAccess', _680 => _680.ec])) {
       return sendErr(res, normalized.ec, normalized.pm, opt);
     }
     const response = $asai.$lib.As.ctxFail(err);
@@ -5193,7 +5299,7 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendFail, "sendFail");
   function mnLog(...arg) {
-    (_optionalChain([$asai, 'optionalAccess', _657 => _657.$log]) || console.log)(...arg);
+    (_optionalChain([$asai, 'optionalAccess', _681 => _681.$log]) || console.log)(...arg);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mnLog, "mnLog");
   return { hostDefault: hostDefault2, getPathFromOpt, sendSuccess, sendFail, sendErr, mnLog };
@@ -5226,7 +5332,7 @@ async function pathExists(filePath) {
   try {
     await _promises2.default.access(nodePath2.default.normalize(filePath));
     return true;
-  } catch (e45) {
+  } catch (e49) {
     return false;
   }
 }
@@ -5293,7 +5399,7 @@ async function removeFile(filePath) {
   try {
     await _promises2.default.unlink(nodePath2.default.normalize(filePath));
   } catch (err) {
-    if (_optionalChain([err, 'optionalAccess', _658 => _658.code]) !== "ENOENT") throw err;
+    if (_optionalChain([err, 'optionalAccess', _682 => _682.code]) !== "ENOENT") throw err;
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, removeFile, "removeFile");
@@ -5343,17 +5449,17 @@ _chunkSMVZ3ZDJcjs.__export.call(void 0, common_exports, {
 });
 function promisifySqlDb(query, sql) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     query(sql, (err, result) => {
       if (err) {
         reject(err);
         return;
       }
       if (!result || Array.isArray(result) && result.length === 0) {
-        resolve5("");
+        resolve6("");
         return;
       }
-      resolve5(result);
+      resolve6(result);
     });
   });
 }
@@ -5406,11 +5512,11 @@ function toInsertRows(sql) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, toInsertRows, "toInsertRows");
 function isPathInside(baseDir, targetPath) {
-  const base = path5.resolve(baseDir);
-  const target = path5.resolve(targetPath);
-  const relative4 = path5.relative(base, target);
-  if (!relative4) return true;
-  return !relative4.startsWith("..") && !path5.isAbsolute(relative4);
+  const base = path6.resolve(baseDir);
+  const target = path6.resolve(targetPath);
+  const relative5 = path6.relative(base, target);
+  if (!relative5) return true;
+  return !relative5.startsWith("..") && !path6.isAbsolute(relative5);
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, isPathInside, "isPathInside");
 function joinTablePath(table, ...segments) {
@@ -5605,11 +5711,11 @@ function dbDriver(opt = {}) {
       this.fileExt = config.ext === ".*" ? "" : config.ext || "";
       this.fileDel = (config.del || 0) !== 0;
       this.createDir = config.create || false;
-      const root = _optionalChain([config, 'access', _659 => _659.$asai, 'optionalAccess', _660 => _660.serverRoot]) || _chunkHR5JKN7Ycjs.getPrimaryServerRoot.call(void 0, );
-      this.baseDirAbs = path6.resolve(root, config.dir);
+      const root = _optionalChain([config, 'access', _683 => _683.$asai, 'optionalAccess', _684 => _684.serverRoot]) || _chunkHR5JKN7Ycjs.getPrimaryServerRoot.call(void 0, );
+      this.baseDirAbs = path7.resolve(root, config.dir);
     }
     dbLog(...args) {
-      (_optionalChain([this, 'access', _661 => _661.config, 'optionalAccess', _662 => _662.$asai, 'optionalAccess', _663 => _663.$log]) || console.log)("FILE", ...args);
+      (_optionalChain([this, 'access', _685 => _685.config, 'optionalAccess', _686 => _686.$asai, 'optionalAccess', _687 => _687.$log]) || console.log)("FILE", ...args);
     }
     checkFile(file) {
       return fs10.existsSync(this.getAbsPath(file, false));
@@ -5619,9 +5725,9 @@ function dbDriver(opt = {}) {
       if (!relPath) {
         return this.baseDirAbs;
       }
-      const abs = path6.isAbsolute(relPath) ? path6.normalize(relPath) : path6.resolve(this.baseDirAbs, relPath);
+      const abs = path7.isAbsolute(relPath) ? path7.normalize(relPath) : path7.resolve(this.baseDirAbs, relPath);
       if (!isPathInside2(this.baseDirAbs, abs)) {
-        return this.baseDirAbs;
+        throw new Error("Path not allowed");
       }
       return abs;
     }
@@ -5633,11 +5739,11 @@ function dbDriver(opt = {}) {
       if (!relPath) {
         return "";
       }
-      return path6.isAbsolute(relPath) ? path6.relative(this.baseDirAbs, relPath) : relPath;
+      return path7.isAbsolute(relPath) ? path7.relative(this.baseDirAbs, relPath) : relPath;
     }
     ensureDir(relPath) {
-      const relative4 = this.normalizeRelPath(relPath);
-      const dirPath = path6.dirname(relative4);
+      const relative5 = this.normalizeRelPath(relPath);
+      const dirPath = path7.dirname(relative5);
       const absDir = this.resolvePath(dirPath === "." ? "" : dirPath);
       if (this.createDir && !fs10.existsSync(absDir)) {
         this.dbLog("mkdir", "[MKDIR]", absDir);
@@ -5663,9 +5769,9 @@ function dbDriver(opt = {}) {
       this.dbLog("delete", "[RMDIR]", absPath);
       const entries = fs10.readdirSync(absPath, { withFileTypes: true });
       for (const entry of entries) {
-        const current = path6.join(absPath, entry.name);
+        const current = path7.join(absPath, entry.name);
         if (entry.isDirectory()) {
-          this.deldir(path6.join(relativePath, entry.name));
+          this.deldir(path7.join(relativePath, entry.name));
         } else {
           this.dbLog("delete", "[UNLINK]", current);
           fs10.unlinkSync(current);
@@ -5675,9 +5781,9 @@ function dbDriver(opt = {}) {
     }
     getReadPath(file, sql) {
       const candidates = [];
-      if (_optionalChain([sql, 'optionalAccess', _664 => _664.filename])) {
-        candidates.push({ dir: path6.join(file, sql.filename) });
-        candidates.push({ dir: path6.join(file + ".delete" + this.fileExt, sql.filename) });
+      if (_optionalChain([sql, 'optionalAccess', _688 => _688.filename])) {
+        candidates.push({ dir: path7.join(file, sql.filename) });
+        candidates.push({ dir: path7.join(file + ".delete" + this.fileExt, sql.filename) });
       } else {
         candidates.push({ dir: file });
         candidates.push({ dir: file + this.fileExt + ".delete" });
@@ -5695,20 +5801,20 @@ function dbDriver(opt = {}) {
       if (!read2.path) {
         return { path: "", dir: read2.dir };
       }
-      if (_optionalChain([sql, 'optionalAccess', _665 => _665.filename])) {
-        return { path: path6.dirname(read2.path), dir: path6.dirname(read2.dir) };
+      if (_optionalChain([sql, 'optionalAccess', _689 => _689.filename])) {
+        return { path: path7.dirname(read2.path), dir: path7.dirname(read2.dir) };
       }
       return { path: read2.path, dir: read2.dir };
     }
     getNewPath(file, sql) {
-      if (_optionalChain([sql, 'optionalAccess', _666 => _666.filename])) {
-        return this.getAbsPath(path6.join(file, sql.filename), true);
+      if (_optionalChain([sql, 'optionalAccess', _690 => _690.filename])) {
+        return this.getAbsPath(path7.join(file, sql.filename), true);
       }
       return this.getAbsPath(file, true);
     }
     write(file, data, sql) {
       try {
-        const filePath = _optionalChain([sql, 'optionalAccess', _667 => _667.type]) === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
+        const filePath = _optionalChain([sql, 'optionalAccess', _691 => _691.type]) === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
         this.dbLog("write", "[WRITE]", filePath);
         fs10.writeFileSync(filePath, data, "utf8");
         return "ok";
@@ -5738,11 +5844,11 @@ function dbDriver(opt = {}) {
         if (!del.path) {
           return "";
         }
-        if (this.fileDel && _optionalChain([sql, 'optionalAccess', _668 => _668.deltrue])) {
+        if (this.fileDel && _optionalChain([sql, 'optionalAccess', _692 => _692.deltrue])) {
           const target = del.path + ".delete" + this.fileExt;
           this.dbLog("soft delete", "[SOFT DELETE]", `${del.path} -> ${target}`);
           fs10.renameSync(del.path, target);
-        } else if (_optionalChain([sql, 'optionalAccess', _669 => _669.filename])) {
+        } else if (_optionalChain([sql, 'optionalAccess', _693 => _693.filename])) {
           this.deldir(del.dir);
         } else {
           this.dbLog("delete", "[DELETE]", del.path);
@@ -5784,8 +5890,8 @@ function dbDriver(opt = {}) {
         let entries;
         try {
           entries = fs10.readdirSync(absDir, { withFileTypes: true });
-        } catch (e46) {
-          return _optionalChain([sql, 'optionalAccess', _670 => _670.list]) ? { open: [], delete: [] } : [];
+        } catch (e50) {
+          return _optionalChain([sql, 'optionalAccess', _694 => _694.list]) ? { open: [], delete: [] } : [];
         }
         const result = { open: [], delete: [] };
         const deleteSuffix = ".delete" + this.fileExt;
@@ -5795,19 +5901,19 @@ function dbDriver(opt = {}) {
           const isDelete = fileName.endsWith(deleteSuffix);
           const baseName = isDelete ? fileName.slice(0, -deleteSuffix.length) : fileName;
           if (this.fileExt && !baseName.endsWith(this.fileExt)) continue;
-          const fullPath = path6.join(absDir, fileName);
+          const fullPath = path7.join(absDir, fileName);
           try {
             const data = fs10.readFileSync(fullPath, "utf8");
             const entryData = { data, file: baseName };
             if (isDelete) {
-              if (_optionalChain([sql, 'optionalAccess', _671 => _671.list])) result.delete.push(entryData);
+              if (_optionalChain([sql, 'optionalAccess', _695 => _695.list])) result.delete.push(entryData);
             } else {
               result.open.push(entryData);
             }
-          } catch (e47) {
+          } catch (e51) {
           }
         }
-        return _optionalChain([sql, 'optionalAccess', _672 => _672.list]) ? result : result.open;
+        return _optionalChain([sql, 'optionalAccess', _696 => _696.list]) ? result : result.open;
       } catch (e) {
         this.dbLog("list failed", "[LIST ERROR]", e);
         return e;
@@ -5817,14 +5923,14 @@ function dbDriver(opt = {}) {
     getFileNameFromWhere(where) {
       if (!where || !Array.isArray(where)) return "";
       const first = where.find((item) => Array.isArray(item));
-      const raw = _optionalChain([first, 'optionalAccess', _673 => _673[2]]);
+      const raw = _optionalChain([first, 'optionalAccess', _697 => _697[2]]);
       if (typeof raw === "string") {
         return raw.replace(/^'+|'+$/g, "");
       }
       return String(_nullishCoalesce(raw, () => ( "")));
     }
     sqlDb(sql) {
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve6, reject) => {
         try {
           let result;
           const tableDir = this.tableFilePath(sql.table);
@@ -5842,22 +5948,22 @@ function dbDriver(opt = {}) {
             const data = sql.set[0][1];
             result = this.write(this.tableFilePath(sql.table, file), data, sql);
           } else if (sql.type === "select") {
-            if (_optionalChain([sql, 'optionalAccess', _674 => _674.where, 'optionalAccess', _675 => _675.length]) && _optionalChain([sql, 'optionalAccess', _676 => _676.as]) !== 2) {
+            if (_optionalChain([sql, 'optionalAccess', _698 => _698.where, 'optionalAccess', _699 => _699.length]) && _optionalChain([sql, 'optionalAccess', _700 => _700.as]) !== 2) {
               const file = this.getFileNameFromWhere(sql.where);
               const readRes = this.read(this.tableFilePath(sql.table, file), sql);
               const resObj = {};
-              if (_optionalChain([readRes, 'optionalAccess', _677 => _677[0], 'optionalAccess', _678 => _678.file]) && !readRes.error) {
+              if (_optionalChain([readRes, 'optionalAccess', _701 => _701[0], 'optionalAccess', _702 => _702.file]) && !readRes.error) {
                 if (sql.as === 1) {
                   try {
                     const parsed = JSON.parse(readRes[0].data);
-                    if (_optionalChain([sql, 'access', _679 => _679.field, 'optionalAccess', _680 => _680.length])) {
+                    if (_optionalChain([sql, 'access', _703 => _703.field, 'optionalAccess', _704 => _704.length])) {
                       sql.field.forEach((f) => {
                         resObj[f] = _nullishCoalesce(parsed[f], () => ( ""));
                       });
                     } else {
                       Object.assign(resObj, parsed);
                     }
-                  } catch (e48) {
+                  } catch (e52) {
                   }
                 } else {
                   const fields = sql.field;
@@ -5871,7 +5977,7 @@ function dbDriver(opt = {}) {
             } else {
               const listRes = this.list(tableDir, sql);
               if (listRes && !listRes.error) {
-                if (_optionalChain([sql, 'optionalAccess', _681 => _681.list])) {
+                if (_optionalChain([sql, 'optionalAccess', _705 => _705.list])) {
                   const mapEntry = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (el) => {
                     const fields = sql.field;
                     const item = { [fields[0]]: el.file };
@@ -5882,9 +5988,9 @@ function dbDriver(opt = {}) {
                   if (listRes.delete) listRes.delete = listRes.delete.map(mapEntry);
                   result = listRes;
                 } else {
-                  if (_optionalChain([sql, 'optionalAccess', _682 => _682.as]) === 2) {
+                  if (_optionalChain([sql, 'optionalAccess', _706 => _706.as]) === 2) {
                     let items = listRes;
-                    if (_optionalChain([sql, 'access', _683 => _683.where, 'optionalAccess', _684 => _684.length])) {
+                    if (_optionalChain([sql, 'access', _707 => _707.where, 'optionalAccess', _708 => _708.length])) {
                       const where = sql.where;
                       const whereType = typeof where[0] === "string" ? where[0] : "and";
                       items = items.filter((el) => {
@@ -5898,7 +6004,7 @@ function dbDriver(opt = {}) {
                           let fieldVal = "";
                           try {
                             fieldVal = _nullishCoalesce(JSON.parse(el.data)[field], () => ( ""));
-                          } catch (e49) {
+                          } catch (e53) {
                           }
                           const condMatch = String(fieldVal).includes(searchVal);
                           if (whereType === "and") {
@@ -5916,18 +6022,18 @@ function dbDriver(opt = {}) {
                       const obj = {};
                       try {
                         const parsed = JSON.parse(el.data);
-                        if (_optionalChain([sql, 'access', _685 => _685.field, 'optionalAccess', _686 => _686.length])) {
+                        if (_optionalChain([sql, 'access', _709 => _709.field, 'optionalAccess', _710 => _710.length])) {
                           sql.field.forEach((f) => {
                             obj[f] = _nullishCoalesce(parsed[f], () => ( ""));
                           });
                         } else {
                           Object.assign(obj, parsed);
                         }
-                      } catch (e50) {
+                      } catch (e54) {
                       }
                       return obj;
                     });
-                    if (_optionalChain([sql, 'access', _687 => _687.order, 'optionalAccess', _688 => _688.length])) {
+                    if (_optionalChain([sql, 'access', _711 => _711.order, 'optionalAccess', _712 => _712.length])) {
                       const orderField = sql.order[0];
                       const orderFieldName = typeof orderField === "string" ? orderField : orderField[0];
                       const direction = typeof orderField === "string" ? "ASC" : String(orderField[1]).toUpperCase();
@@ -5948,12 +6054,12 @@ function dbDriver(opt = {}) {
                   }
                 }
               } else {
-                result = _optionalChain([sql, 'optionalAccess', _689 => _689.list]) ? { open: [], delete: [] } : [];
+                result = _optionalChain([sql, 'optionalAccess', _713 => _713.list]) ? { open: [], delete: [] } : [];
               }
             }
           }
           if (result !== void 0) {
-            resolve5(result);
+            resolve6(result);
           } else {
             reject("");
           }
@@ -6004,7 +6110,7 @@ function sysserver($asai, opt = {}) {
   if (!$asai.$lib) $asai.$lib = {};
   $asai.$lib = { ...lib_default, ...$asai.$lib, ...opt || {} };
   $asai.dataserver = db_default;
-  _optionalChain([$asai, 'access', _690 => _690.$lib, 'access', _691 => _691.ErrorCode, 'optionalAccess', _692 => _692.loadErrorCodes, 'optionalCall', _693 => _693($asai)]);
+  _optionalChain([$asai, 'access', _714 => _714.$lib, 'access', _715 => _715.ErrorCode, 'optionalAccess', _716 => _716.loadErrorCodes, 'optionalCall', _717 => _717($asai)]);
   if (!$asai.$lib.api) $asai.$lib.api = {};
   $asai.$lib.api = { ...api_default, ...$asai.$lib.api };
   if (!$asai.$lib.ws) $asai.$lib.ws = {};
@@ -6197,7 +6303,7 @@ function normalizeDataStoresConfig(cfg) {
     }
     if (userStore.opt.create == null) userStore.opt.create = 1;
   }
-  if (!stores.log && _optionalChain([cfg, 'access', _694 => _694.logger, 'optionalAccess', _695 => _695.store])) {
+  if (!stores.log && _optionalChain([cfg, 'access', _718 => _718.logger, 'optionalAccess', _719 => _719.store])) {
     const s = cfg.logger.store;
     stores.log = {
       type: s.type || "file",
@@ -6261,13 +6367,13 @@ function validateHostConfig(cfg) {
   if (cfg.asaisn != null) {
     errors.push("asaisn \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_ASAISN");
   }
-  if (_optionalChain([cfg, 'access', _696 => _696.aes, 'optionalAccess', _697 => _697.keybase64]) != null) {
+  if (_optionalChain([cfg, 'access', _720 => _720.aes, 'optionalAccess', _721 => _721.keybase64]) != null) {
     errors.push("aes.keybase64 \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_AES_KEYBASE64");
   }
-  if (_optionalChain([cfg, 'access', _698 => _698.httpscert, 'optionalAccess', _699 => _699.key]) != null || _optionalChain([cfg, 'access', _700 => _700.httpscert, 'optionalAccess', _701 => _701.cert]) != null) {
+  if (_optionalChain([cfg, 'access', _722 => _722.httpscert, 'optionalAccess', _723 => _723.key]) != null || _optionalChain([cfg, 'access', _724 => _724.httpscert, 'optionalAccess', _725 => _725.cert]) != null) {
     errors.push("httpscert.key/cert \u7981\u6B62\u5185\u8054\u4E8E asaihost.json\uFF0C\u8BF7\u4F7F\u7528 keyPath/certPath \u6216\u73AF\u5883\u53D8\u91CF");
   }
-  if (_optionalChain([cfg, 'access', _702 => _702.security, 'optionalAccess', _703 => _703.sessionSecret]) != null) {
+  if (_optionalChain([cfg, 'access', _726 => _726.security, 'optionalAccess', _727 => _727.sessionSecret]) != null) {
     errors.push("security.sessionSecret \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_SESSION_SECRET");
   }
   if (Array.isArray(cfg.wssec) && typeof cfg.wssec[0] === "string" && cfg.wssec[0].length > 0) {
@@ -6322,10 +6428,10 @@ function validateHostConfig(cfg) {
       validateHostSiteLimits(name, h, errors);
     }
   }
-  if (_optionalChain([cfg, 'access', _704 => _704.logger, 'optionalAccess', _705 => _705.sample]) && typeof cfg.logger.sample !== "object") {
+  if (_optionalChain([cfg, 'access', _728 => _728.logger, 'optionalAccess', _729 => _729.sample]) && typeof cfg.logger.sample !== "object") {
     errors.push('logger.sample \u5FC5\u987B\u4E3A\u5BF9\u8C61\uFF08\u5982 { "REQ_OTHER": 0.1 }\uFF09');
   }
-  if (_optionalChain([cfg, 'access', _706 => _706.logger, 'optionalAccess', _707 => _707.skip]) != null && !Array.isArray(cfg.logger.skip)) {
+  if (_optionalChain([cfg, 'access', _730 => _730.logger, 'optionalAccess', _731 => _731.skip]) != null && !Array.isArray(cfg.logger.skip)) {
     errors.push('logger.skip \u5FC5\u987B\u4E3A\u5B57\u7B26\u4E32\u6570\u7EC4\uFF08\u5982 ["/sys/info/metrics"]\uFF09');
   }
   if (cfg.proxyhosts && typeof cfg.proxyhosts === "object") {
@@ -6359,7 +6465,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, validateHostSiteLimits, "validateHostSiteL
 function validateProductionSecurity(cfg) {
   const errors = [];
   if (process.env.NODE_ENV !== "production") return errors;
-  const sec = _optionalChain([cfg, 'optionalAccess', _708 => _708.security]);
+  const sec = _optionalChain([cfg, 'optionalAccess', _732 => _732.security]);
   if (!sec || typeof sec !== "object") {
     errors.push("\u751F\u4EA7\u73AF\u5883\u5FC5\u987B\u914D\u7F6E security \u5BF9\u8C61");
     return errors;
@@ -6370,7 +6476,7 @@ function validateProductionSecurity(cfg) {
   if (sec.allowRegister === 1) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.allowRegister \u5E94\u4E3A 0\uFF08CR 1.3 \u7981\u6B62\u5F00\u653E\u6CE8\u518C\uFF09");
   }
-  if (!_optionalChain([sec, 'access', _709 => _709.quota, 'optionalAccess', _710 => _710.enabled])) {
+  if (!_optionalChain([sec, 'access', _733 => _733.quota, 'optionalAccess', _734 => _734.enabled])) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.quota.enabled \u5E94\u4E3A 1\uFF08CR 7.1 \u8D44\u6E90\u9650\u5236\uFF09");
   }
   if (sec.csp !== 1) {
@@ -6379,7 +6485,7 @@ function validateProductionSecurity(cfg) {
   if (typeof sec.minUserLevel !== "number" || sec.minUserLevel < 0) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.minUserLevel \u5E94\u663E\u5F0F\u914D\u7F6E");
   }
-  if (sec.forceWss === 1 && !_optionalChain([cfg, 'optionalAccess', _711 => _711.httpscert, 'optionalAccess', _712 => _712.keyPath]) && !_optionalChain([cfg, 'optionalAccess', _713 => _713.httpscert, 'optionalAccess', _714 => _714.key])) {
+  if (sec.forceWss === 1 && !_optionalChain([cfg, 'optionalAccess', _735 => _735.httpscert, 'optionalAccess', _736 => _736.keyPath]) && !_optionalChain([cfg, 'optionalAccess', _737 => _737.httpscert, 'optionalAccess', _738 => _738.key])) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.forceWss=1 \u65F6\u9700\u914D\u7F6E HTTPS \u8BC1\u4E66");
   }
   return errors;
@@ -6398,12 +6504,12 @@ var DEFAULT_RECONNECT = {
   rs485: { enabled: true, maxRetries: 60, initialDelay: 3e3, maxDelay: 3e4, factor: 2 }
 };
 function getTransportBlock(cfg, kind) {
-  const block = _optionalChain([cfg, 'optionalAccess', _715 => _715[kind]]);
+  const block = _optionalChain([cfg, 'optionalAccess', _739 => _739[kind]]);
   return block && typeof block === "object" ? block : null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getTransportBlock, "getTransportBlock");
 function getTransportDefault(cfg, kind) {
-  const def = _optionalChain([getTransportBlock, 'call', _716 => _716(cfg, kind), 'optionalAccess', _717 => _717.default]);
+  const def = _optionalChain([getTransportBlock, 'call', _740 => _740(cfg, kind), 'optionalAccess', _741 => _741.default]);
   return def && typeof def === "object" ? def : null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getTransportDefault, "getTransportDefault");
@@ -6413,7 +6519,7 @@ function hasTransportDefault(cfg, kind) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, hasTransportDefault, "hasTransportDefault");
 function getDefaultConnId(cfg, kind) {
   const def = getTransportDefault(cfg, kind);
-  const id = _optionalChain([def, 'optionalAccess', _718 => _718.id]);
+  const id = _optionalChain([def, 'optionalAccess', _742 => _742.id]);
   return typeof id === "string" && id.length > 0 ? id : DEFAULT_CONN_ID[kind];
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getDefaultConnId, "getDefaultConnId");
@@ -6424,14 +6530,14 @@ function shouldAutoConnect(def) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, shouldAutoConnect, "shouldAutoConnect");
 function resolveReconnectOptions(def, kind, cfg) {
   const base = DEFAULT_RECONNECT[kind];
-  const rc = _optionalChain([def, 'optionalAccess', _719 => _719.reconnect]);
-  const tmMaxTry = _optionalChain([cfg, 'optionalAccess', _720 => _720.tm, 'optionalAccess', _721 => _721.maxtry]);
+  const rc = _optionalChain([def, 'optionalAccess', _743 => _743.reconnect]);
+  const tmMaxTry = _optionalChain([cfg, 'optionalAccess', _744 => _744.tm, 'optionalAccess', _745 => _745.maxtry]);
   return {
-    enabled: _optionalChain([rc, 'optionalAccess', _722 => _722.enabled]) !== false && base.enabled !== false,
-    maxRetries: _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _723 => _723.maxRetries]), () => ( tmMaxTry)), () => ( base.maxRetries)), () => ( 60)),
-    initialDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _724 => _724.initialDelay]), () => ( base.initialDelay)), () => ( 1e3)),
-    maxDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _725 => _725.maxDelay]), () => ( base.maxDelay)), () => ( 3e4)),
-    factor: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _726 => _726.factor]), () => ( base.factor)), () => ( 2))
+    enabled: _optionalChain([rc, 'optionalAccess', _746 => _746.enabled]) !== false && base.enabled !== false,
+    maxRetries: _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _747 => _747.maxRetries]), () => ( tmMaxTry)), () => ( base.maxRetries)), () => ( 60)),
+    initialDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _748 => _748.initialDelay]), () => ( base.initialDelay)), () => ( 1e3)),
+    maxDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _749 => _749.maxDelay]), () => ( base.maxDelay)), () => ( 3e4)),
+    factor: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _750 => _750.factor]), () => ( base.factor)), () => ( 2))
   };
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveReconnectOptions, "resolveReconnectOptions");
@@ -6481,17 +6587,17 @@ function createTransportDataHandler($asai, manager) {
     if (typeof event.data === "string") {
       try {
         event.data = JSON.parse(event.data);
-      } catch (e51) {
+      } catch (e55) {
       }
     }
-    if (_optionalChain([event, 'access', _727 => _727.data, 'optionalAccess', _728 => _728.id])) {
+    if (_optionalChain([event, 'access', _751 => _751.data, 'optionalAccess', _752 => _752.id])) {
       manager.watch(event.id, event.data);
       return;
     }
     try {
-      const wsKey = _optionalChain([$asai, 'optionalAccess', _729 => _729.command, 'optionalAccess', _730 => _730.commandconfig, 'optionalAccess', _731 => _731.config, 'optionalAccess', _732 => _732.commandclient]);
-      _optionalChain([$asai, 'access', _733 => _733.serversws, 'optionalAccess', _734 => _734[wsKey], 'optionalAccess', _735 => _735.broadws, 'optionalCall', _736 => _736(event.data)]);
-    } catch (e52) {
+      const wsKey = _optionalChain([$asai, 'optionalAccess', _753 => _753.command, 'optionalAccess', _754 => _754.commandconfig, 'optionalAccess', _755 => _755.config, 'optionalAccess', _756 => _756.commandclient]);
+      _optionalChain([$asai, 'access', _757 => _757.serversws, 'optionalAccess', _758 => _758[wsKey], 'optionalAccess', _759 => _759.broadws, 'optionalCall', _760 => _760(event.data)]);
+    } catch (e56) {
     }
   };
 }
@@ -6563,7 +6669,7 @@ var initAsaiHostNodejs2 = {
   createTransportDataHandler,
   wireTransportConnectionLogs
 };
-var PLUGIN_VERSION = true ? "0.0.6" : "0.0.1";
+var PLUGIN_VERSION = true ? "0.0.9" : "0.0.1";
 var index_default = initAsaiHostNodejs2;